chore(deps): bump github/codeql-action from 4.37.4 to 4.38.1

.changeset/fix-release-workflow-inputs.md

@@ -0,0 +1,36 @@
+---
+"@tko/bind": major
+"@tko/binding.component": major
+"@tko/binding.core": major
+"@tko/binding.foreach": major
+"@tko/binding.if": major
+"@tko/binding.template": major
+"@tko/build.knockout": major
+"@tko/build.reference": major
+"@tko/builder": major
+"@tko/computed": major
+"@tko/filter.punches": major
+"@tko/lifecycle": major
+"@tko/observable": major
+"@tko/provider": major
+"@tko/provider.attr": major
+"@tko/provider.bindingstring": major
+"@tko/provider.component": major
+"@tko/provider.databind": major
+"@tko/provider.multi": major
+"@tko/provider.mustache": major
+"@tko/provider.native": major
+"@tko/provider.virtual": major
+"@tko/utils": major
+"@tko/utils.component": major
+"@tko/utils.functionrewrite": major
+"@tko/utils.jsx": major
+"@tko/utils.parser": major
+---
+
+Fix the `Release` workflow, which failed on every push to `main` because
+`changesets/action@v2` renamed several inputs (`version` -> `version-script`,
+`title` -> `pr-title`, `commit` -> `commit-message`, `publish` ->
+`publish-script`) and no longer accepts `commitMode`. Also fixes
+`outputs.should_publish`, which read the stale `hasChangesets` key instead of
+the current `has-changesets`. CI-only change; no package behavior affected.

.github/workflows/codeql-analysis.yml

@@ -43,15 +43,15 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.37.4
+      uses: github/codeql-action/init@v4.38.1
       with:
         languages: ${{ matrix.language }}
         config-file: ./.github/codeql/codeql-config.yml
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v4.37.4
+      uses: github/codeql-action/autobuild@v4.38.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -61,4 +61,4 @@ jobs:
     #    uses a compiled language
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.37.4
+      uses: github/codeql-action/analyze@v4.38.1

.github/workflows/release.yml

@@ -36,16 +36,16 @@ jobs:
       pull-requests: write
 
     outputs:
-      should_publish: ${{ steps.changesets.outputs.hasChangesets == 'false' }}
+      should_publish: ${{ steps.changesets.outputs.has-changesets == 'false' }}
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
         with:
           # changesets/action commits version bumps via the GitHub API
-          # (commitMode: github-api) so we deliberately disable
-          # persisted credentials — there is no `git push` from this
-          # job.
+          # (the action's default, since push-with-git-cli is false unless
+          # set) so we deliberately disable persisted credentials — there
+          # is no `git push` from this job.
           persist-credentials: false
 
       - name: Setup Bun
@@ -66,14 +66,14 @@ jobs:
         id: changesets
         uses: changesets/action@v2
         with:
-          version: bunx changeset version
-          title: 'chore: version packages'
-          commit: 'chore: version packages'
-          # Required when persist-credentials: false — without this the
-          # action falls back to git-cli, which has no remote auth and
-          # fails the push. github-api also produces a verified commit
-          # authored by github-actions[bot].
-          commitMode: github-api
+          version-script: bunx changeset version
+          pr-title: 'chore: version packages'
+          commit-message: 'chore: version packages'
+          # push-with-git-cli defaults to false, i.e. commits/tags go via
+          # the GitHub API. Required when persist-credentials: false —
+          # otherwise the action would fall back to git-cli, which has no
+          # remote auth and fails the push. The GitHub API path also
+          # produces a verified commit authored by github-actions[bot].
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -155,7 +155,7 @@ jobs:
         id: publish
         uses: changesets/action@v2
         with:
-          publish: bunx changeset publish
+          publish-script: bunx changeset publish
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}