fix(ci): hold changesets/action at v1 and stop grouping major bumps

[PunGrumpy]

Description

The release workflow has been failing on main since #70 merged (run 32211135291):

Warning: Unexpected input(s) 'version', 'publish', valid inputs are
['github-token', 'publish-script', 'version-script', ...]
Error: This version of the Changesets action is designed to work with
Changesets CLI v3. Changesets CLI v2 is not supported; use Changesets
action v1 instead, which is compatible with CLI v2.

changesets/action v2 requires Changesets CLI v3 and renames its inputs to version-script / publish-script. This repo is on @changesets/cli: ^2.31.1 — still maintained upstream under the maintenance-v2 dist-tag — so the action is reverted to v1.9.0 (a45c4d59), with a comment at the call site recording why it is held there rather than left to drift back up.

How the bump reached main. The Dependabot config added in #68 grouped every action update under patterns: ["*"] with no major-version guard. Three majors — setup-node v6→v7, github-script v8→v9, and changesets/action v1→v2 — were bundled into one PR titled "bump the actions group with 3 updates", which reads as routine. That grouping is the actual defect; reverting the pin alone would leave it to happen again next week.

The group is now restricted to minor and patch, so majors arrive as individual PRs where the breaking change is visible in the title. changesets/action majors are additionally ignored outright until the CLI upgrade is done deliberately.

The other two majors are left in place. Both were verified working on main after #70: code-quality, docker-doctor, and codeql all pass with setup-node v7 and github-script v9. Only release was broken, so only release is touched here.

Related Issues

None — regression from #70, reported directly.

Checklist

• I've reviewed my code
• I've written tests — n/a, CI configuration with no test surface
• I've generated a change set file — n/a, no published package changed
• I've updated the docs, if necessary — n/a

Screenshots (if applicable)

n/a — workflow output quoted above.

Additional Notes

This restores the release pipeline with the minimum change; it is not a decision to stay on Changesets v2 forever. The forward path is a separate PR that bumps @changesets/cli to ^3.0.1, moves the action back to v2.1.0, and renames the two inputs — all three have to move together. Doing that here would mean shipping a CLI major through a release pipeline that is currently red, which is the wrong order.

There is an open Version Packages PR (#62) that was created before the break. It should pick up normally once this lands and the workflow runs green again.

[changeset-bot]

⚠️ No Changeset found

Latest commit: a736b9f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docker-doctor	Ready	Preview	Aug 19, 2026 10:31am

[github-actions]

The latest Docker Doctor scan for this pull request. Learn more about Docker Doctor.

File	Status	Issues	Updated (UTC)
Dockerfile	Error	1 error, 2 info	Aug 19, 2026 10:31am

Score: 84 / 100 · Good

3 issues

Dockerfile

• Dockerfile:2 Potential secret found in ENV: 'DB_PASSWORD'. no-secrets-in-env
• Dockerfile:1 No HEALTHCHECK instruction found. require-healthcheck
• Dockerfile:1 No LABEL metadata was found in this Dockerfile. require-labels

_{Scanned by Docker Doctor for commit a736b9f.}