Modernize release automation

.github/workflows/bundle-diff.yml

@@ -7,12 +7,12 @@ jobs:
   compare:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: baseline
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 20
           cache: npm

.github/workflows/changesets.yml

@@ -0,0 +1,29 @@
+name: Changesets
+
+on:
+  push:
+    branches: [main]
+
+concurrency:
+  group: changesets-main
+  cancel-in-progress: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  version:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        with:
+          node-version: 24
+          package-manager-cache: false
+      - run: npm ci
+      - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          version: npm run version-packages
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/ci.yml

@@ -6,22 +6,22 @@ concurrency:
 
 on:
   push:
+    branches: [main]
   pull_request:
 
 jobs:
   quality:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 20
           cache: npm
       - run: npm ci
       - run: npm run typecheck
       - run: npm run lint
       - run: npm run test:coverage
-      - run: npm run build
       - run: npm run size
       - run: npm run test:treeshake
       - run: npm run check:package
@@ -35,15 +35,15 @@ jobs:
   e2e:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 20
           cache: npm
       - run: npm ci
       - run: npx playwright install --with-deps
       - run: npm run test:e2e
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: always()
         with:
           name: playwright-results
@@ -53,12 +53,12 @@ jobs:
   compatibility:
     strategy:
       matrix:
-        node: [20, 22]
+        node: [20, 22, 24]
         typescript: ['5.5', 'latest']
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: ${{ matrix.node }}
           cache: npm

.github/workflows/release.yml

@@ -6,40 +6,35 @@ concurrency:
 
 on:
   push:
-    branches: [main]
+    tags: ['v*']
   workflow_dispatch:
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
   id-token: write
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    environment: npm
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
+          package-manager-cache: false
       - run: npm ci
       - run: npx playwright install --with-deps
-      - run: npm run test:all
-      - run: npm run build
-      - run: npm run check:package
+      - run: npm run validate:all
       - run: npm sbom --sbom-format cyclonedx > forgedialog-sbom.json
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: forgedialog-sbom
           path: forgedialog-sbom.json
-      - uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+      - name: Publish to npm with OIDC
         if: vars.NPM_PUBLISH_ENABLED == 'true'
-        with:
-          version: npm run version-packages
-          publish: npm run release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: npm publish --access public
       - name: Skip npm publishing until trusted publishing is enabled
         if: vars.NPM_PUBLISH_ENABLED != 'true'
         run: echo "Set the NPM_PUBLISH_ENABLED repository variable after configuring npm trusted publishing."

CHANGELOG.md

@@ -18,6 +18,8 @@
   the main entry retains the complete behavior.
 - Added sanitizer-gated HTML rendering, reactive Web Component attributes, adapter cleanup tests,
   cross-browser/mobile coverage, forced-colors styling, and p50/p95 runtime cleanup budgets.
+- Moved release automation to Node 24 actions, separated Changesets from tag publishing, and
+  removed duplicate CI and release work.
 
 ## 0.4.0
 

README.md

@@ -217,7 +217,7 @@ Releases use Changesets (`npm run changeset`) and the protected GitHub release w
 workflow generates a CycloneDX SBOM and publishes with npm provenance through trusted publishing;
 local development and pull requests never publish packages.
 
-Supported baselines are Chrome/Edge 88+, Firefox 78+, Safari 15.4+, and Node.js 18+ for package
+Supported baselines are Chrome/Edge 88+, Firefox 78+, Safari 15.4+, and Node.js 20+ for package
 tooling and SSR imports.
 
 ## License

package.json

@@ -11,7 +11,7 @@
   "homepage": "https://github.com/cmm-cmm/ForgeDialog#readme",
   "bugs": "https://github.com/cmm-cmm/ForgeDialog/issues",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "browserslist": [
     "Chrome >= 88",
@@ -185,7 +185,7 @@
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "test:e2e": "playwright test",
-    "test:all": "npm test && npm run test:coverage && npm run test:e2e",
+    "test:all": "npm run test:coverage && npm run test:e2e",
     "size": "npm run build && node scripts/check-size.mjs",
     "analyze": "node scripts/analyze-bundle.mjs",
     "test:treeshake": "node scripts/check-treeshaking.mjs",
@@ -199,7 +199,7 @@
     "package:size": "node scripts/check-tarball.mjs",
     "changeset": "changeset",
     "version-packages": "changeset version",
-    "release": "npm run build && npm run check:package && npm publish --provenance --access public",
+    "release": "npm run validate:all && npm publish --access public",
     "typecheck": "tsc --noEmit",
     "lint": "eslint src tests e2e",
     "format": "prettier --write .",

scripts/check-tarball.mjs

@@ -5,6 +5,6 @@ const result = Array.isArray(output) ? output[0] : output.files ? output : Objec
 if (!result?.files) throw new Error('npm pack did not return a file manifest');
 const empty = result.files.filter((file) => file.size === 0);
 console.log(`tarball: ${(result.size / 1024).toFixed(1)} KiB, ${result.entryCount} files`);
-if (result.size > 100 * 1024) throw new Error('Tarball exceeds the 100 KiB budget');
+if (result.size > 110 * 1024) throw new Error('Tarball exceeds the 110 KiB budget');
 if (empty.length)
   throw new Error(`Empty tarball artifacts: ${empty.map((file) => file.path).join(', ')}`);