ci: shared release job and Renovate

.changeset/README.md

@@ -0,0 +1,9 @@
+# Changesets
+
+A changeset records a package release: which packages, which bump, and the changelog text.
+
+- `pnpm changeset` writes one; commit it with the change it describes.
+- Without one, the release job writes a patch changeset for every package whose published contents
+  changed (a minor, on 0.x, when a dependency moved to another breaking line).
+- On `main`, pending changesets become the "chore: version packages" pull request; merging it
+  publishes the packages to npm.

.changeset/config.json

@@ -1,11 +1,15 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.1.2/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@4.0.1/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
   "fixed": [],
   "linked": [],
   "access": "public",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
+  "privatePackages": {
+    "version": false,
+    "tag": false
+  },
   "ignore": []
 }

.github/workflows/ci.yml

@@ -4,25 +4,19 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm run lint:check
-      - run: pnpm run format:check
-      - run: pnpm run build
-      - run: pnpm run typecheck
-      - run: pnpm run test
+    uses: statewalker/.github/.github/workflows/ci.yml@main
+
+  # Releases to npm: a version pull request while changes are unreleased, publishing once it is
+  # merged. npm's trusted publishers for these packages name this file (ci.yml).
+  release:
+    needs: ci
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    uses: statewalker/.github/.github/workflows/release.yml@main
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    secrets: inherit

package.json

@@ -25,10 +25,7 @@
     "lint:check": "biome check .",
     "format": "biome format --write .",
     "format:check": "biome format .",
-    "publish-all": "pnpm run build && pnpm -r publish --access public --no-git-checks",
-    "changeset": "changeset",
-    "version-packages": "changeset version",
-    "release-packages": "changeset publish"
+    "changeset": "changeset"
   },
   "devDependencies": {
     "@biomejs/biome": "catalog:",

renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>statewalker/.github"]
+}