Release via tanem/release-action

.github/release.yml

@@ -0,0 +1,17 @@
+# Categories for GitHub's generated release notes, keyed by the same labels the
+# release reads to derive the semver bump. `safe to test` authorises CI runs and
+# says nothing about the release, so it is excluded from both.
+changelog:
+  exclude:
+    labels:
+      - safe to test
+  categories:
+    - title: 💥 Breaking Changes
+      labels:
+        - breaking
+    - title: 🚀 Enhancements
+      labels:
+        - enhancement
+    - title: 🛠 Everything Else
+      labels:
+        - '*'

.github/workflows/release.yml

@@ -1,49 +1,43 @@
 name: Release
 
+# The filename is load-bearing: npm's trusted publisher for this package
+# matches on repo + workflow filename, so renaming this file means updating the
+# publisher first.
+
 on:
   schedule:
     - cron: '0 9 * * 1' # Every Monday at 9:00 AM UTC
   workflow_dispatch:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
 permissions:
   contents: write
   id-token: write
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    # The cron only ever fires on the default branch, but a manual dispatch can
+    # target any branch. Without this guard, dispatching against a version
+    # branch would bump, tag and publish that branch to npm as latest.
     if: github.ref == 'refs/heads/master'
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-          token: ${{ secrets.RELEASE_TOKEN }}
 
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: '.nvmrc'
-          cache: 'npm'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Configure git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
 
-      - name: Install dependencies
-        run: npm ci
+      # Load-bearing: this package has no prepublishOnly, so the dist/ that gets
+      # published is the one `npm test` builds, and the tests gate the release.
+      - run: npm ci
 
-      - name: Build
-        run: npm run build
+      - run: npm test
 
-      - name: Release
-        run: npm run release
-        env:
-          CHANGELOG_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - uses: tanem/release-action@29ffc8b4e3956c1b9532bfb2ad863f31953354a4 # v0.1.0

AGENTS.md

@@ -17,8 +17,8 @@ constrains belongs there, not here.
   subjects or PR titles. Write a plain capitalised sentence. Nothing reads the
   prefix: the version bump comes from the PR label, and renovate is set to
   `semanticCommits: "disabled"` to match.
-- PR titles are copied verbatim into `CHANGELOG.md`, so write them as the
-  changelog line you want readers to see.
+- PR titles are copied verbatim into the generated release notes, so write them
+  as the changelog line you want readers to see.
 - Hard-wrap commit message bodies at 72 columns; `git log` does not reflow
   them. Do not hard-wrap PR or issue descriptions: GitHub reflows markdown,
   and its web editor leaves wrapped source ragged once anyone edits it.
@@ -66,18 +66,23 @@ single version is run.
 
 ## Releases
 
-`npm run release` runs on a Monday cron against `master`. It takes the version
-bump from the labels on PRs merged since the last tag, then regenerates
-`CHANGELOG.md` and `AUTHORS` and bumps `version` in `package.json` and
-`package-lock.json`.
+[`tanem/release-action`](https://github.com/tanem/release-action) runs on a
+Monday cron against `master`. It takes the version bump from the labels on PRs
+merged since the last tag, bumps `version` in `package.json` and
+`package-lock.json` through `npm version`, tags, then publishes the GitHub
+Release and the npm package.
 
 - Exactly one label per PR. None, or more than one, throws and blocks the
   release for everything merged alongside it. `breaking` gives a major,
   `enhancement` a minor, `bug` / `documentation` / `internal` a patch. Tooling,
-  CI and dependency work is `internal`.
-- Never hand-edit `CHANGELOG.md`, `AUTHORS` or either `version` field.
+  CI and dependency work is `internal`. `safe to test` is ignored.
+- The changelog is
+  [GitHub Releases](https://github.com/tanem/react-svg/releases), generated from
+  those same labels via `.github/release.yml`. `CHANGELOG.md` is closed at
+  v19.1.2 — nothing appends to it and nothing should, including you. `AUTHORS`
+  is stale for the same reason. Never hand-edit either `version` field.
 - Breaking changes need a `MIGRATION.md` entry in the same PR: the generated
-  changelog is only a list of PR titles.
+  release notes are only a list of PR titles.
 
 ## Dependencies
 

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+This file is frozen history: it covers releases up to and including v19.1.2, and
+is not regenerated any more. Everything released after that lives on
+[GitHub Releases](https://github.com/tanem/react-svg/releases).
+
 ## [v19.1.2](https://github.com/tanem/react-svg/tree/v19.1.2) (2026-08-07)
 [Full Changelog](https://github.com/tanem/react-svg/compare/v19.1.1...v19.1.2)
 

MIGRATION.md

@@ -1,6 +1,6 @@
 # Migrating
 
-Details relating to major changes that aren't presently in `CHANGELOG.md`, due to limitations with how that file is being generated.
+Details relating to major changes that the release notes don't carry: those are generated from PR titles alone, so anything a reader needs beyond a one-line title lives here.
 
 ## v19.0.0