chore: move to pnpm 12, update dependencies and migrate to changesets/action v2

[Patrick Lafrance (patricklafrance)]

pnpm 12

Upgrades the package manager to pnpm@12.2.1 and bumps engines.pnpm to >=12 to match, then updates dependencies to their latest versions.

changesets/action v2

Ports workleap/wl-web-configs#473 into this repo.

changesets/action@v1 detects published packages by scraping publish stdout for New tag: lines. @changesets/cli v3 no longer prints those, so v1 + CLI v3 publishes to npm but creates no git tags and no GitHub releases, and still exits green. v2 reads the published packages from the CHANGESETS_OUTPUT NDJSON file the v3 CLI writes.

Pinned to a commit hash rather than the v2 branch because this step holds contents: write and the npm trusted publishing token.

@changesets/cli 2.31.0 → 3.0.1 and @changesets/changelog-github 0.7.0 → 1.0.0 are part of the same change, not a drive-by: action v2 hard-throws if the resolved CLI is major 2 (src/utils.ts: "Changesets CLI v2 is not supported; use Changesets action v1 instead"). The workflow migration and the CLI bump have to land together.

Input renames per the v2 release notes:

• commit → commit-message
• title → pr-title
• publish → publish-script
• GITHUB_TOKEN env → dropped; v2 requires a custom token to go through the github-token input, whose default is ${{ github.token }} — exactly what this workflow was passing as secrets.GITHUB_TOKEN. Leaving it set makes the action throw on a mismatch.

Left at v2 defaults: create-github-releases and push-git-tags (both true), and push-with-git-cli: false, so release commits and tags are pushed through the GitHub API and signed with GitHub's GPG key.

No backfill needed

Unlike wl-web-configs, this repo never ran CLI v3 under action v1, so it never hit the bug. Tags and releases are in sync through @workleap/logging@2.0.0.

Verification

• .changeset/config.json parses under 3.0.1 with zero errors or warnings — access: "restricted" and the ___experimentalUnsafeOptions block are both still in the v4 schema, and the privatePackages default flip is moot because samples/web is already in ignore.
• Provenance / trusted publishing unchanged: publishConfig.access still overrides the root access, and publish still shells out to pnpm publish --access public, so pnpm handles OIDC as before. id-token: write stays correct.
• The [bot] author filter in sync-agent-skill.yml still matches API-pushed commits, which are authored by github-actions[bot].
• build-pkg, test (329 passed), typecheck, eslint, syncpack, and pnpm install --frozen-lockfile all green.

Note that changeset.yml only triggers on push to main, so the workflow change can't be exercised by CI on this PR — the first run of action v2 happens after merge.

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

pnpm add https://pkg.pr.new/@workleap/logging@112

commit: a61305d

[Copilot]

Pull request overview

This PR updates the repo’s tooling and release automation by upgrading to pnpm 12, bumping dependency versions across the workspace, and migrating the Changesets GitHub Action to a v2-compatible implementation required by @changesets/cli v3 so tags/releases are correctly produced.

Changes:

• Upgraded workspace package manager configuration to pnpm@12.2.1 and engines.pnpm >=12, alongside general dependency bumps.
• Updated dependencies in @workleap/logging and the samples/web app (eslint/ts-eslint/rsbuild/rspack/vitest, etc.).
• Migrated .github/workflows/changeset.yml from changesets/action@v1 to a pinned v2 commit and renamed inputs to the v2 schema.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
samples/web/package.json	Bumps runtime/dev dependencies for the sample app to align with the upgraded toolchain.
packages/logging/package.json	Updates dev tooling deps (rsbuild, ts-eslint, vitest, etc.) for the published logging package.
package.json	Sets pnpm 12 as the package manager/engine and bumps repo-wide devDependencies.
.github/workflows/changeset.yml	Migrates Changesets action usage to v2-compatible pinned commit + updated input names.
.changeset/update-deps-20260901-104900.md	Adds a patch changeset for @workleap/logging to publish dependency updates.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[claude]

Low — release policy: this changeset should not exist, and will cause a spurious @workleap/logging@2.0.1 publish.

packages/logging/package.json declares no dependencies and no peerDependencies — the only changes to it in this PR are devDependencies (@rsbuild/core, @typescript-eslint/parser, @workleap/eslint-configs, typescript-eslint, vitest). The repo's own automation contract, .github/prompts/update-dependencies.md Step 3a, says:

Only include @workleap/* packages whose dependencies or peerDependencies have actually changed. Do NOT include packages where only devDependencies changed [...] If no @workleap/* packages qualify (i.e., every change is devDependency-only), skip this step entirely — do NOT create a changeset file.

The only non-dev dependency bumps here (logrocket, react, react-dom) are in samples/web, which is private and already covered by ignore: ["@samples/*"] in .changeset/config.json, so no @workleap/* package qualifies.

Since this is the only file in .changeset/, merging it makes the Changesets workflow open a release PR and publish 2.0.1 with a Updated dependencies. changelog entry that reflects no consumer-visible change.

Fix: delete .changeset/update-deps-20260901-104900.md.

(If the changeset was kept deliberately to exercise the new changesets/action@v2 publish path end-to-end, that's a reasonable call — but it's worth stating in the PR description, since it's the opposite of what the prompt instructs.)

[Patrick Lafrance (patricklafrance)]

Deleted in a61305d.

Confirmed against .github/prompts/update-dependencies.md Step 3a and packages/logging/package.json, which declares neither dependencies nor peerDependencies — the only changes to it here are devDependencies. Not kept deliberately; it was added on the precedent of earlier devDependency-only bumps (ce35d5e, bcd87b7, d359ed3) that shipped a patch changeset, but the prompt's contract supersedes that.

This PR now ships no changeset, so merging it will not open a release PR.