chore(ci): migrate the release workflow to changesets/action v2

[frahlg]

Supersedes #1035, which bumped the tag alone.

changesets/action v2 renamed every input and output. GitHub Actions
only warns on an unknown with: key, so the bare tag bump would have
gone green while quietly changing what the release workflow does.

What the tag bump alone would have done

Old	New	Effect if left stale
version:	version-script:	Falls back to a bare changeset version, dropping the npm install --package-lock-only half of version-packages. package-lock.json drifts off package.json.
title: / commit:	pr-title: / commit-message:	Version PR renamed to "Version Packages".
env: GITHUB_TOKEN	github-token: input	v2 stopped reading the environment variable. It falls back to github.token, whose pushes start no workflows — the Version Packages PR would arrive with no checks. CI_TOKEN exists for exactly that reason.
—	push-with-git-cli:	v2 pushes through the GitHub API by default, which would leave the CI_TOKEN auth header installed one step earlier as dead weight. Set to true to keep the existing credential path.
outputs.hasChangesets	outputs.has-changesets	The worst one. The stale name reads as empty, '' == 'false' is false, so all five stable-promotion guards skip. A workflow_dispatch promotion would report success having skipped the GHCR write checks, the tag and the draft release.

@changesets/cli is already ^3.0.1; v2 requires v3, so that gate passes.

Test

web/release-metadata.test.mjs pinned the v1 input name, which is how
the mismatch surfaced. It now pins the v2 name, and additionally pins
the output name against the action major that publishes it — so the
uses: tag and the expressions reading its outputs cannot drift apart
again silently.

npm test — 482 pass.

Review

Workflow-only, so no job in CI actually exercises this path. The
push-with-git-cli: true choice is the one worth a second opinion: it
keeps today's behaviour rather than moving to v2's API push. Moving to
the API push would mean deleting both credential-juggling steps and
letting github-token carry the push — cleaner, but a bigger change
than a dependency bump should carry, and it needs a real release to
prove out.

Closes #1035

---

Note

Medium Risk
Release and stable-promotion behavior depends on correct action inputs/outputs; mistakes would skip promotion steps or mis-version lockfiles, though this PR explicitly fixes those v2 migration footguns and adds tests.

Overview
Upgrades the release workflow from changesets/action v1 to v2 and renames every input/output the action expects, so a tag-only bump cannot pass CI while silently breaking versioning or stable promotion.

The Version Packages step now passes github-token (scoped CI_TOKEN) and push-with-git-cli: true instead of relying on GITHUB_TOKEN in env, and uses version-script, pr-title, and commit-message for the lockfile-aware version-packages script and PR metadata. All stable-promotion guards that run only when there are no pending changesets now read steps.changesets.outputs.has-changesets (v2 kebab-case); the old hasChangesets name would read empty and skip GHCR checks, tagging, and draft release creation on workflow_dispatch.

web/release-metadata.test.mjs asserts the v2 version-script wiring and adds a regression test that pins uses: changesets/action@v2 to has-changesets and forbids stale hasChangesets references.

^{Reviewed by Cursor Bugbot for commit a0c0fac. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-01T16:32:03.540310Z	a0c0fac	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Left a non-blocking comment: Cursor Bugbot was still pending after the 8-minute wait, so this run did not approve. Human review is needed; erikarenhill was assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[miravoss26]

Migrates the release workflow's changesets/action v1 → v2 and renames every input/output the action expects, exactly right: checked the live action.yml on changesets/action@v2.1.1 and github-token, push-with-git-cli, version-script, pr-title, commit-message, and outputs.has-changesets all match upstream verbatim. Deliberately not passing publish-script matches the stated rationale (publish is done manually below).

The push-with-git-cli: true call (flagged in the PR description as worth a second opinion) is correct: v2's default API push uses github.token, whose commits don't trigger new workflow runs, which would leave the Version Packages PR with no checks. Keeping the CLI push with CI_TOKEN preserves that.

Workflow-only change, no job actually exercises this path, but the new regression test (web/release-metadata.test.mjs) pins both the uses: major and the output name together so they can't silently drift apart again, which is the right guard for exactly the failure mode #1035 would have shipped. Safe to merge from my read.