ci(release): upgrade changesets/action to v2 for @changesets/cli v3 - #1995

Summary

The 3.6.0 release published all five packages to npm but created no git tags
and no GitHub releases, and the publish step still reported success. This
restores the release pipeline and recovers the missing history.

The git tags and GitHub releases for 3.6.0 have already been created manually
on d1d331e44 (the ci(changesets): version packages (#1944) commit) — a
re-run cannot recreate them, because npm already has 3.6.0, so
changeset publish reports nothing to publish and emits no entries to tag.

Root cause

@changesets/cli and changesets/action are a matched pair upstream:

The pair got split:

• 2026-08-18 — Renovate opened chore(deps): update changesets/action action to v2 #1931 (changesets/action v1.9.0 → v2.1.1).
• 2026-08-27 — closed unmerged. Renovate then commented: "Because you
  closed this PR without merging, Renovate will ignore this update. You will
  not get PRs for any future 2.x releases."
• 2026-09-15 — chore(deps): upgrade @changesets/cli to v3 (major) #1975 merged @changesets/cli 2.31.1 → 3.0.2 (then 3.0.3 in
  chore(deps): update dependency @changesets/cli to v3.0.3 #1993), leaving CLI v3 running against action v1.9.0.

Two independent v3 breaking changes then combined:

1. Publish detection moved off stdout (Expect publish output to be shared through a file changesets/action#678). The string
   New tag is present in @changesets/[email protected]'s dist/ and absent in
   3.0.3's. Action v1.9.0 matches it at src/run.ts:101, found zero
   packages, so the createGithubReleases block looped over an empty array —
   no pushTag, no createRelease — and set published=false. This is
   silent by construction: an empty loop cannot throw.
2. changeset version exit code flipped (fix(version): exit with code 1 when no unreleased changesets found changesets/changesets#1860):
   return (exit 0) became throw new ExitError(1) when there are no
   unreleased changesets.

(1) un-gated the canary step (if: published != 'true'), and (2) turned it
into a hard failure against an emptied .changeset/. Under CLI v2, (1) alone
would still have lost the tags and releases while the run stayed green.

It stayed hidden for three days because neither break is reachable on a normal
push: at the #1975 merge, .changeset/ still held changesets, so
published=false was the correct answer and --snapshot found work to do.
The first real release after the upgrade is when both fired.

Upstream guards this pair in one direction only — action v2 refuses CLI v2
(changesets/action#699) — but v1 has no check rejecting CLI v3.

Changes

• changesets/action v1.9.0 → v2.1.2. v2 reads CHANGESETS_OUTPUT, which
  it injects into the custom scripts' environment along with GITHUB_TOKEN
  (src/run.ts:176-184), so publish-script: pnpm changeset publish needs no
  change and @changesets/changelog-github still gets its token. All inputs
  were renamed in v2, so this is not a version-only bump:

  v1	v2
  publish / version	publish-script / version-script
  commit / title	commit-message / pr-title
  createGithubReleases	create-github-releases
  commitMode: "github-api"	dropped — now the default
  GITHUB_TOKEN via env	github-token input (env no longer honoured)

• Guarded both canary steps on the presence of changeset files, so an empty
  .changeset/ is a clean skip instead of exit 1.

• Added a tagging assertion. If the version on npm has no matching git tag,
  the job now fails with an actionable message instead of reporting success.
  Verified locally against all paths, including that it would have caught this
  incident and that its ls-remote pattern does not match sibling packages.

• Removed scripts/print_release_version.sh and its step. Its output
  (steps.release_version.outputs.VALUE) is read nowhere in the workflow, its
  exit code was swallowed by echo "VALUE=$(...)", and it ran
  changeset version followed by git reset --hard inside the release job.

Side benefit

Renovate said "if you manually upgrade to 2.x then Renovate will re-enable
minor and patch updates automatically." Landing v2.1.2 by hand lifts the
suppression left by #1931.

Verification

• Workflow YAML parses; step list unchanged apart from the removal and the new
  assertion.
• Guard logic exercised locally: positive (npm + tag present), missing tag,
  version absent from npm (skip), and no cross-package false match.
• The publish path itself only executes on a real release, so the true end-to-end
  proof is the next version PR merge. Worth watching that run.

No changeset needed — CI configuration only, no published package changed.