ci(deps): bump the github-actions group and migrate changesets to v2

.github/workflows/ci.yml

@@ -10,10 +10,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -47,7 +47,7 @@ jobs:
         run: CI=true npm run coverage
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 

.github/workflows/codeql.yml

@@ -24,10 +24,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: javascript-typescript
           # security-extended adds rules that are lower signal on their own but
@@ -36,9 +36,9 @@ jobs:
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: /language:javascript-typescript

.github/workflows/docker-publish.yml

@@ -35,23 +35,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           ref: ${{ inputs.image_tag || github.ref_name }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/${{ env.IMAGE_NAME }}
@@ -64,7 +64,7 @@ jobs:
       # the local daemon, which is why this is separate from the push below.
       # Buildx caches the layers, so the second build is cheap.
       - name: Build image for scanning
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: false
@@ -73,7 +73,7 @@ jobs:
           platforms: linux/amd64
 
       - name: Scan image for vulnerabilities
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: ${{ env.IMAGE_NAME }}:scan
           format: table
@@ -96,7 +96,7 @@ jobs:
         # Runs even when the gate above failed, so the findings that blocked the
         # release are visible rather than only in the job log.
         if: always()
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
           image-ref: ${{ env.IMAGE_NAME }}:scan
           format: sarif
@@ -107,14 +107,14 @@ jobs:
 
       - name: Upload scan findings
         if: always()
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: trivy-results.sarif
           category: trivy-image
 
       - name: Build and push Docker image
         id: push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           push: true

.github/workflows/release.yml

@@ -27,12 +27,12 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version-file: '.nvmrc'
           cache: npm
@@ -57,13 +57,16 @@ jobs:
 
       - name: Create or update version and changelog PR
         id: changesets
-        uses: changesets/action@v1
+        uses: changesets/action@v2
         with:
-          version: npm run version-packages
-          title: 'chore: update version and changelog'
-          commit: 'chore: update version and changelog'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # v2 renamed every one of these. Unknown inputs are ignored rather than
+          # rejected, so the old names would have left the version PR titled
+          # "Version Packages", which commitlint rejects.
+          version-script: npm run version-packages
+          pr-title: 'chore: update version and changelog'
+          commit-message: 'chore: update version and changelog'
+          # v2 no longer reads GITHUB_TOKEN from the environment.
+          github-token: ${{ secrets.GITHUB_TOKEN }}
 
       # Once the version PR is merged there are no changesets left, so the
       # version in package.json is the one to release. Tag it (idempotently) so
@@ -72,7 +75,10 @@ jobs:
       # not trigger other workflows; the image build is invoked directly below.
       - name: Tag release
         id: tag
-        if: steps.changesets.outputs.hasChangesets == 'false'
+        # Renamed from hasChangesets in changesets/action v2. The old name reads as
+        # empty, never equals 'false', and would silently stop every release here.
+        # Index syntax because the new name is hyphenated.
+        if: steps.changesets.outputs['has-changesets'] == 'false'
         run: |
           set -euo pipefail
           VERSION="$(node -p "require('./package.json').version")"