ci: update actions

[LGLabGreg]

Summary by CodeRabbit

• Chores
  • Added a changeset indicating patch releases for two packages.
  • Updated CI and release workflows to use newer workflow actions and a streamlined Node.js spec.
  • Added a publish step and environment variables to the release workflow.
  • Enabled Dependabot to automatically keep GitHub Actions workflows up to date.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
reactqrcode-com	Ready	Preview	Comment	Nov 9, 2025 11:47am

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Adds a new changeset declaring patch releases for two packages, introduces a Dependabot config to update GitHub Actions daily, and updates action versions and Node.js syntax across CI and release workflows (including a new publish step and environment variables in the release workflow).

Changes

Cohort / File(s)	Summary
Changeset Entry \.changeset/dark-crews-dream.md	Adds a changeset declaring patch releases for @lglab/react-qr-code and reactqrcode.com
Dependabot Config \.github/dependabot.yml	Adds Dependabot configuration to update GitHub Actions workflows daily in the repository root
CI Workflow \.github/workflows/ci.yml	Bumps actions: actions/checkout v4→v5, actions/setup-node v4→v6, pnpm/action-setup v3→v4; updates Node spec from '20.x' to 20
Release Workflow \.github/workflows/release.yml	Same action bumps as CI; changes changesets/action from v1.4.9→v1, numeric Node version, and adds a publish: pnpm ci:publish --no-git-checks step with GITHUB_TOKEN and NPM_CONFIG_PROVENANCE env vars

Sequence Diagram(s)

sequenceDiagram
  participant Dev as Developer/Push
  participant GH as GitHub Actions
  participant Ch as Changesets Action
  participant NPM as npm registry

  Dev->>GH: push tags / changeset
  GH->>Ch: run changesets (publish step added) 
  alt publish succeeds
    Ch->>NPM: pnpm ci:publish --no-git-checks (with GITHUB_TOKEN, NPM_CONFIG_PROVENANCE)
    NPM-->>Ch: publish ok
    Ch-->>GH: report success
  else publish fails
    Ch-->>GH: report failure
  end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Check compatibility of bumped actions (checkout v5, setup-node v6, pnpm v4) with existing workflow usages.
• Verify the new numeric Node version syntax (20) is accepted by the actions used.
• Review the added release publish step and environment variables for correctness and security (scoped tokens, provenance intent).
• Confirm dependabot schedule/syntax matches intended directory and update frequency.

Possibly related PRs

• Chore/deps 09 11 25 #313 — Overlapping changeset entries and CI/dependabot modifications for the same packages.
• ci: fix publish #56 — Related to the repository publish workflow and ci:publish behavior used by the new release step.
• ci: changesets version #55 — Also modifies the changesets/action version in the release workflow.

Poem

🐰
I hopped through commits, a tiny cheer,
Updated actions, pushed the gear,
Dependabot watches, neat and spry,
Two patches ready—off they fly!
🥕🎉

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: update actions' directly and accurately summarizes the main changes in the PR, which involve updating GitHub Actions versions across multiple workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 05151c4 and 9416d09.

📒 Files selected for processing (2)

• .github/workflows/ci.yml (1 hunks)
• .github/workflows/release.yml (1 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}