chore: setup changesets + oidc (#2844)

- setup changesets: all packages are now released through changesets, only the extension is released via tag as before
- remove pkg deploy flows in favor of one
- that flow will use oidc, so no npm token anymore
- also harden the workflows

Author: dummdidumm

.changeset/README.md

@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)

.changeset/config.json

@@ -0,0 +1,15 @@
+{
+    "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+    "changelog": [
+        "@svitejs/changesets-changelog-github-compact",
+        { "repo": "sveltejs/language-tools" }
+    ],
+    "commit": false,
+    "fixed": [],
+    "linked": [],
+    "access": "public",
+    "baseBranch": "master",
+    "updateInternalDependencies": "minor",
+    "bumpVersionsWithWorkspaceProtocolOnly": true,
+    "ignore": []
+}

.github/workflows/CI.yml

@@ -1,8 +1,11 @@
 name: CI
 on: pull_request
+permissions:
+  contents: read # to fetch code (actions/checkout)
 
 jobs:
   test:
+    permissions: {}
     runs-on: ubuntu-latest
 
     steps:
@@ -24,6 +27,7 @@ jobs:
           CI: true
 
   test-svelte5:
+    permissions: {}
     runs-on: ubuntu-latest
 
     steps:
@@ -49,6 +53,7 @@ jobs:
           CI: true
 
   lint:
+    permissions: {}
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/DeployExtensionsProd.yml

@@ -5,16 +5,22 @@ on:
     tags:
       - "extensions-*"
 
+permissions: {}
+
 jobs:
   deploy:
+    # prevents this action from running on forks
+    if: github.repository == 'sveltejs/language-tools'
+    permissions:
+      contents: write # to create release (adjust package.json etc)
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v4
       - uses: pnpm/action-setup@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: "20.x"
+          node-version: "22.x"
           registry-url: "https://registry.npmjs.org"
           cache: pnpm
 

.github/workflows/DeploySvelte2tsxProd.yml

@@ -0,0 +1,44 @@
+name: Release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  release:
+    # prevents this action from running on forks
+    if: github.repository == 'sveltejs/language-tools'
+    permissions:
+      contents: write # to create release (changesets/action)
+      id-token: write # OpenID Connect token needed for provenance
+      pull-requests: write # to create pull request (changesets/action)
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@v4
+        with:
+          # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4.1.0
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.x
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Create Release Pull Request or Publish to npm
+        id: changesets
+        uses: changesets/action@v1
+        with:
+          # This expects you to have a script called release which does a build for your packages and calls changeset publish
+          publish: pnpm changeset:release
+          version: pnpm changeset:version
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true

.github/workflows/DeploySvelteCheckProd.yml

@@ -10,12 +10,15 @@
         "test": "cross-env CI=true pnpm test -r",
         "watch": "tsc -b -watch",
         "format": "prettier --write .",
-        "lint": "prettier --check ."
+        "lint": "prettier --check .",
+        "changeset:version": "changeset version && git add --all",
+        "changeset:publish": "changeset publish"
     },
     "dependencies": {
         "typescript": "^5.9.2"
     },
     "devDependencies": {
+        "@changesets/cli": "^2.29.7",
         "cross-env": "^7.0.2",
         "prettier": "~3.3.3",
         "ts-node": "^10.0.0"