merge

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,38 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Desktop (please complete the following information):**
+ - OS: [e.g. iOS]
+ - Browser [e.g. chrome, safari]
+ - Version [e.g. 22]
+
+**Smartphone (please complete the following information):**
+ - Device: [e.g. iPhone6]
+ - OS: [e.g. iOS8.1]
+ - Browser [e.g. stock browser, safari]
+ - Version [e.g. 22]
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,20 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/codeql.yml

@@ -0,0 +1,101 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: '38 18 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: actions
+          build-mode: none
+        - language: javascript-typescript
+          build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Add any setup steps before running the `github/codeql-action/init` action.
+    # This includes steps like installing compilers or runtimes (`actions/setup-node`
+    # or others). This is typically only required for manual builds.
+    # - name: Setup runtime (example)
+    #   uses: actions/setup-example@v1
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v4
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        # queries: security-extended,security-and-quality
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - name: Run manual build steps
+      if: matrix.build-mode == 'manual'
+      shell: bash
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v4
+      with:
+        category: "/language:${{matrix.language}}"

BEGINNER_GUIDE.vi.md

@@ -0,0 +1,60 @@
+# Hướng dẫn nhanh cho người mới: `changesets/action`
+
+## 1) Repo này làm gì?
+
+Đây là mã nguồn của GitHub Action `changesets/action`. Action này tự động hóa 2 luồng chính:
+
+- **Version PR**: tạo/cập nhật pull request chứa thay đổi version + changelog từ Changesets.
+- **Publish**: khi không còn changeset cần xử lý, chạy lệnh publish và xuất output các package đã phát hành.
+
+Điểm vào runtime là `src/index.ts`: đọc input từ workflow, quyết định đi nhánh `runVersion` hay `runPublish`, và set outputs cho step của GitHub Actions.
+
+## 2) Cấu trúc thư mục quan trọng
+
+- `src/index.ts`: điều phối toàn bộ luồng của action.
+- `src/run.ts`: nghiệp vụ chính cho **version** (tạo PR) và **publish** (đọc output publish, tạo GitHub release).
+- `src/git.ts`: lớp `Git` trừu tượng thao tác git, hỗ trợ 2 chế độ commit (`git-cli` và `github-api`).
+- `src/utils.ts`: hàm tiện ích như đọc changelog entry, xác định package đổi version, sort hiển thị PR body.
+- `src/readChangesetState.ts`: đọc trạng thái changeset và xử lý `pre mode`.
+- `src/*.test.ts` + `src/__snapshots__`: test chính bằng Vitest.
+- `action.yml`: định nghĩa input/output cho GitHub Action.
+
+## 3) Luồng chạy tổng quát (mental model)
+
+1. Action lấy token + input (`publish`, `version`, `commitMode`, `cwd`, ...).
+2. Đọc danh sách changeset hiện có.
+3. Rẽ nhánh:
+   - **Có changeset**: chạy luồng version (`runVersion`) → commit/push vào nhánh release → tạo hoặc cập nhật PR.
+   - **Không có changeset nhưng có `publish` script**: chạy luồng publish (`runPublish`) → parse kết quả publish → set output `published`/`publishedPackages`.
+   - **Không có cả changeset lẫn publish script**: kết thúc sớm.
+4. Set outputs để workflow phía trên dùng tiếp.
+
+## 4) Những điểm quan trọng cần nắm
+
+- **`commitMode` ảnh hưởng cách ghi commit**:
+  - `git-cli`: dùng git local (`git add/commit/push`).
+  - `github-api`: dùng API (`@changesets/ghcommit`) để commit đã ký GPG theo token owner.
+- **Giới hạn độ dài PR body**: có cơ chế cắt bớt nội dung changelog để tránh vượt limit payload GitHub.
+- **`pre mode` của Changesets**: được phát hiện và hiển thị cảnh báo trong PR body.
+- **Khả năng publish linh hoạt**:
+  - ưu tiên `.npmrc` có sẵn;
+  - tự thêm auth line khi có `NPM_TOKEN`;
+  - fallback sang trusted publishing khi có OIDC env.
+- **Tạo GitHub Releases là tùy chọn** (`createGithubReleases`) và phụ thuộc package/tag được phát hiện từ output publish.
+
+## 5) Cách đọc code hiệu quả cho người mới
+
+- Bắt đầu từ `src/index.ts` để hiểu router điều kiện.
+- Sau đó đọc `runVersion` và `runPublish` trong `src/run.ts`.
+- Khi thấy thao tác git/network, nhảy sang `src/git.ts` và `src/octokit.ts`.
+- Cuối cùng đọc test `src/run.test.ts`, `src/utils.test.ts` để xem các edge-case và expected behavior.
+
+## 6) Gợi ý học tiếp theo
+
+- **Changesets core concepts**: changeset file, versioning, pre-release mode.
+- **GitHub Actions runtime**: input/output, environment, token model.
+- **Octokit/GitHub REST API**: pull requests, releases, rate limit + retry.
+- **Testing strategy**: snapshot testing, fixture-based tests cho các case nhiều package.
+- **Monorepo package tooling**: `@manypkg/get-packages` và cách phân biệt root package vs workspace packages.
+
+Nếu mới hoàn toàn, hãy chạy test trước khi sửa code (`yarn test`), rồi thử trace một test case trong `src/run.test.ts` để bám theo toàn bộ luồng.

README.md

@@ -2,6 +2,11 @@
 
 This action for [Changesets](https://github.com/changesets/changesets) creates a pull request with all of the package versions updated and changelogs updated and when there are new changesets on [your configured `baseBranch`](https://github.com/changesets/changesets/blob/main/docs/config-file-options.md#basebranch-git-branch-name), the PR will be updated. When you're ready, you can merge the pull request and you can either publish the packages to npm manually or setup the action to do it for you.
 
+
+## New contributor notes
+
+- Vietnamese beginner guide: [`BEGINNER_GUIDE.vi.md`](./BEGINNER_GUIDE.vi.md)
+
 ## Usage
 
 ### Inputs