chore: self-bootstrap validation and release automation

[markbang]

Summary

• add a repo-level pnpm validate flow and wire lint/check into CI
• switch package publishing to a Changesets release-PR workflow and align package metadata/access settings
• add realistic home/docs smoke tests plus tarball consumer smoke coverage for the published packages
• trim unused site dependencies and split large client chunks with manual vendor chunking

Testing

• pnpm validate

---

Summary by cubic

Adds a repo-wide pnpm validate and switches publishing to a Changesets release-PR flow to automate releases and improve quality. Also adds site smoke tests, tarball consumer tests, Vitest workspace-source aliases, and Paraglide test mocks for more stable runs.

• New Features

  • CI runs pnpm validate (lint, Biome, tests, site build, tarball-consumer smoke via scripts/pack-smoke.mjs); Vitest aliases workspace sources and mocks Paraglide runtime/messages.
  • Publish workflow now opens a Changesets release PR on main and publishes on merge; packages set to public access.
  • Added homepage/docs smoke tests and stabilized embed auto-resize behavior.
  • Trimmed unused site deps and added manual vendor chunking in Vite for smaller bundles.

• Migration

  • Run pnpm validate locally before pushing.
  • When changing packages, run pnpm changeset; merge the release PR to publish to npm.

^{Written for commit 285f5eb. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memos-embed-site	Ready	Preview, Comment	Mar 7, 2026 7:44am

[cubic-dev-ai]

2 issues found across 56 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/site/src/routes/embed/$memoId.tsx">

<violation number="1" location="apps/site/src/routes/embed/$memoId.tsx:112">
P2: Removing `html` from this effect dependency breaks resize updates for the no-`ResizeObserver` fallback path when embed content changes.</violation>
</file>

<file name=".github/workflows/publish.yml">

<violation number="1" location=".github/workflows/publish.yml:38">
P2: Pin the new third-party action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in the publish workflow.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: Removing html from this effect dependency breaks resize updates for the no-ResizeObserver fallback path when embed content changes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/site/src/routes/embed/$memoId.tsx, line 112:

<comment>Removing `html` from this effect dependency breaks resize updates for the no-`ResizeObserver` fallback path when embed content changes.</comment>

<file context>
@@ -109,7 +109,7 @@ export function EmbedPreview({
 			container: containerRef.current,
 		});
-	}, [frameId, html]);
+	}, [frameId]);
 
 	return <div ref={containerRef} />;
</file context>

Suggested change

	}, [frameId]);
	}, [frameId, html]);

[cubic-dev-ai]

P2: Pin the new third-party action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in the publish workflow.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/publish.yml, line 38:

<comment>Pin the new third-party action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in the publish workflow.</comment>

<file context>
@@ -24,18 +25,23 @@ jobs:
-      
-      - run: npx changelogithub
+      - name: Create release PR or publish packages
+        uses: changesets/action@v1
+        with:
+          version: pnpm version-packages
</file context>