feat: tegami release process

[gabrielmfern]

Summary

Replaces changesets with Tegami. Versioning and publishing are split across branches:

• canary: version.yml opens/updates a "Version Packages" PR when there are pending changelogs. release.yml also runs here, but only publishes if the version is a prerelease (-canary.N).
• main: release.yml publishes whatever's in the lock (stable or otherwise) once canary is promoted.

The version PR pushes/opens as the resend-version-bump GitHub App (same setup as react-email), so its checks actually run.

Make a changeset

1. pnpm tegami — interactive prompt, pick a package + bump type, write a summary. Writes a file under .tegami/.
   Or by hand, create .tegami/<name>.md:

   ---
   resend: patch
   ---
   
   Fixed the thing.
   

2. Commit it as part of your PR, merge to canary as normal.

Release stable

1. Run pnpm tegami to make changeset(s) on your PR before merging.
2. version.yml opens/updates chore: release X.Y.Z against canary.
3. Merge that PR.
4. Promote canary to main.
5. release.yml on main publishes to latest, tags, GitHub release.

Release canary (prerelease)

1. PR to canary adding packages: { resend: { prerelease: 'canary' } } to scripts/tegami.mts, merge it.
2. Merge changeset(s) to canary as normal.
3. version.yml opens chore: release X.Y.Z-canary.N against canary.
4. Merge that PR. Canary's release.yml run sees the prerelease version and publishes it under the canary dist-tag, with a GitHub prerelease.
5. Repeat 2-4 for more canaries (-canary.1, -canary.2, ...).
6. To graduate: PR removing the prerelease line, merge it. The next version PR bumps to stable, carrying over the whole cycle's changelogs. Continue with "Release stable" above.

Test plan

• pnpm tegami check-publish runs locally
• Merge a throwaway changelog to a test canary push and confirm version.yml opens a PR as the bot
• Confirm BOT_APP_ID / BOT_APP_PRIVATE_KEY secrets exist on this repo

---

Summary by cubic

Replaces changesets with tegami and splits the release flow: versioning on canary, publishing from canary (prereleases) and main (all) via npm trusted publishing. This automates canary prereleases and keeps stable releases gated until promotion.

• New Features

  • Workflows: version.yml opens/updates a Version PR on canary; release.yml publishes pending versions (prereleases from canary, all from main) using OIDC.
  • PR previews: tegami-pr.yml builds a release preview and uploads it; tegami-pr-comment.yml posts it. Both run on runners (not slim containers) so system git is available for tegami’s git plugin.
  • Added scripts/tegami.mts and pnpm script tegami; added tegami@1.1.2.
  • Auth/publishing: Version PR uses a GitHub App so required checks run. Enables npm trusted publishing via OIDC on GitHub-hosted runners (no NPM_TOKEN).

• Migration

  • Bump: add a changelog under .tegami/*.md or run pnpm tegami; merge to canary to open the Version PR.
  • Prerelease: set packages: { resend: { prerelease: 'canary' } } in scripts/tegami.mts to publish x.y.z-canary.N under the canary dist-tag; remove it to graduate the next stable.
  • Setup: ensure BOT_APP_ID and BOT_APP_PRIVATE_KEY secrets; configure an npm Trusted Publisher for release.yml; Node 24+ required.

^{Written for commit c1cb726. Summary will update on new commits.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	tegami@​1.1.2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Low adoption: npm @rainbowatcher/toml-edit-js Location: Package overview From: pnpm-lock.yaml → npm/tegami@1.1.2 → npm/@rainbowatcher/toml-edit-js@0.6.5 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@rainbowatcher/toml-edit-js@0.6.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Low adoption: npm fast-wrap-ansi Location: Package overview From: pnpm-lock.yaml → npm/tegami@1.1.2 → npm/fast-wrap-ansi@0.2.2 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-wrap-ansi@0.2.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[cubic-dev-ai]

3 issues found across 8 files

Confidence score: 2/5

• In .github/workflows/version.yml, runs-on: depot-ubuntu-22.04-2 is an invalid runner label, so the version workflow will fail immediately with “No runner found” and block automation after merge — switch it to depot-ubuntu-22.04 before merging.
• In .github/workflows/release.yml, the manual dispatch path can publish prereleases from non-canary branches, which creates a concrete risk of shipping from feature/test refs — restrict the publish condition to main/canary before merge.
• In package.json, node scripts/tegami.mts is incompatible with Node 22.12–22.17 as declared in devEngines, so contributors/CI on that range can hit runtime failures — add --experimental-strip-types (or raise the minimum Node version) to align behavior before merging.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/version.yml">

<violation number="1" location=".github/workflows/version.yml:24">
P1: The `runs-on: depot-ubuntu-22.04-2` label doesn't exist — the workflow will fail with "No runner found" at job assignment time. Depot's Ubuntu 22.04 runner for 2 CPUs is simply `depot-ubuntu-22.04` (no size suffix). The `-4`, `-8`, `-16`, `-32`, and `-64` suffixes exist for larger sizes, but `-2` is not a valid variant.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 3 files (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 1 file (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>

[cubic-dev-ai]

0 issues found across 2 files (changes from recent commits).

<sub>Requires human review: Auto-approval blocked by 1 unresolved issue from previous reviews.

Re-trigger cubic</sub>