chore: migrate from semantic-release to changesets

.changeset/README.md

@@ -0,0 +1,18 @@
+# Changesets
+
+This folder holds [changesets](https://github.com/changesets/changesets): short markdown files that
+describe user-facing changes and how they should affect the next version number.
+
+Add one to your pull request with:
+
+```sh
+npm run changeset
+```
+
+Pick `patch`, `minor` or `major`, then write a sentence that will make sense to someone reading the
+changelog. The generated file gets committed alongside your changes.
+
+Changes that do not affect published behaviour (docs, tests, CI, refactors) do not need a changeset.
+
+When changesets land on `main`, a "Version Packages" pull request is opened that applies the version
+bump and updates the changelog. Merging that pull request publishes to npm.

.changeset/config.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.4/schema.json",
+  "changelog": ["@changesets/changelog-github", {"repo": "EventSource/eventsource"}],
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "changedFilePatterns": ["src/**"],
+  "ignore": []
+}

.changeset/rare-deserts-stay.md

@@ -0,0 +1,5 @@
+---
+'eventsource': patch
+---
+
+Allow a `value` of any type in `ReaderLike` done-results. TypeScript 5.9's DOM lib types `ReadableStreamDefaultReader.read()`'s done-result as `{done: true, value: T | undefined}`, so a custom `fetch` returning a `Response`-shaped body no longer satisfied `FetchLikeResponse` on TypeScript 5.9 and newer, forcing consumers to hand-wrap the reader.

.github/workflows/changeset.yml

@@ -0,0 +1,30 @@
+name: Changeset
+
+on:
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  status:
+    name: 'Changeset: Status'
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          # `changeset status` diffs against the base branch, so it needs the history
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: lts/*
+          cache: npm
+      # Only the changesets CLI is needed here, so skip the build that `prepare` triggers
+      - run: npm ci --ignore-scripts
+      - name: Check that user-facing changes have a changeset
+        run: npx changeset status --since=origin/${{ github.base_ref }}

.github/workflows/release.yml

@@ -1,74 +1,49 @@
 name: Release
 
-# Workflow name based on selected inputs.
-# Fallback to default GitHub naming when expression evaluates to empty string
-run-name: >
-  ${{ inputs.release && 'Release ➤ Publish to NPM' || inputs.dryrun && 'Release ➤ Dry-run' || '' }}
 on:
-  pull_request:
   push:
     branches: [main]
   workflow_dispatch:
-    inputs:
-      release:
-        description: 'Publish new release'
-        default: false
-        type: boolean
-      dryrun:
-        description: 'Dry run'
-        default: false
-        type: boolean
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
-  cancel-in-progress: true
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
-  dryrun:
-    # only run if opt-in during workflow_dispatch
-    name: 'Release: Dry-run release process'
-    if: always() && github.event.inputs.dryrun == 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          # Need to fetch entire commit history to
-          # analyze every commit since last release
-          fetch-depth: 0
-      - uses: actions/setup-node@v7
-        with:
-          node-version: lts/*
-          cache: npm
-      - run: npm ci
-      - run: npx semantic-release --dry-run
-        if: always()
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
   release:
-    name: 'Release: Publish to NPM'
-    permissions:
-      issues: write # for release notes, comments…
-      contents: write # for checkout + push + release creation
-      id-token: write # to enable use of OIDC for npm provenanc
-    if: always() && github.event.inputs.release == 'true' && github.event.inputs.dryrun == 'false'
+    name: 'Release: Version PR or publish to npm'
+    # `workflow_dispatch` can be triggered on any ref, and npm's trusted publisher
+    # config pins the workflow file but not the branch. Without this, dispatching
+    # from a feature branch could version and publish from an unreviewed ref.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to push the version commit and tag, and create the GitHub release
+      pull-requests: write # to open and update the "Version Packages" pull request
+      id-token: write # to authenticate with npm through OIDC (trusted publishing)
     steps:
       - uses: actions/checkout@v7
         with:
-          # Need to fetch entire commit history to
-          # analyze every commit since last release
           fetch-depth: 0
+
       - uses: actions/setup-node@v7
         with:
           node-version: lts/*
           cache: npm
+
+      # Trusted publishing needs npm >= 11.5.1. Older versions silently skip OIDC
+      # rather than erroring, so don't rely on whatever npm the runner ships with.
+      # Pinned to the major so a new npm release can't land here unattended.
+      - run: npm install --global npm@12
+
       - run: npm ci
-      - run: npx semantic-release
-        # Don't allow interrupting the release step if the job is cancelled, as it can lead to an inconsistent state
-        # e.g. git tags were pushed but it exited before `npm publish`
-        if: always() && github.event.inputs.release == 'true'
+
+      - name: Create version pull request or publish to npm
+        uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
+        with:
+          version: npm run version:packages
+          publish: npm run release
+          commit: 'chore(release): version packages'
+          title: 'chore(release): version packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
-          NPM_CONFIG_PROVENANCE: true