chore: clean up release flow and fix CI

Author: github-actions[bot]

.changesets/fix-publish-workflow.md

@@ -15,6 +15,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -37,6 +42,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -69,6 +79,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -78,7 +93,13 @@ jobs:
         run: bun install --frozen-lockfile
 
       - name: Run security audit
-        run: bun audit
+        # Ignore currently unpatched transitive advisories from latest Astro/eslint dependency chains.
+        run: >
+          bun audit --audit-level high
+          --ignore=GHSA-25h7-pfq9-p65f
+          --ignore=GHSA-rf6f-7fwh-wjgh
+          --ignore=GHSA-c2c7-rcm5-vvqj
+          --ignore=GHSA-mw96-cpmx-2vgc
 
   pack-test:
     name: Test Package Pack
@@ -88,6 +109,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
@@ -117,6 +143,11 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22.14.0'
+
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: '22'
+          node-version: '22.14.0'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install Bun (for tests/build)

.github/workflows/publish.yml

@@ -33,4 +33,5 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 # Finder (MacOS) folder config
 .DS_Store
 
-_refs/
+_refs/
+.changesets/

.gitignore

@@ -74,14 +74,15 @@ alwaysApply: false
 - Do not hand-edit generated output in `packages/astro-gravatar/dist/`.
 - Do not commit or manually edit transient coverage output in `packages/astro-gravatar/coverage/` unless the workflow explicitly requires it.
 - Keep lockfile updates intentional. If dependencies change, prefer `bun install` so `bun.lock` stays consistent.
+- Sampo release entries live in `.sampo/changesets/`. Do not reintroduce the old top-level `.changesets/` directory.
 
 ## CI and release notes
 
 - CI currently checks lint, formatting, typechecking, coverage, build, security audit, pack dry-run, and bundle size.
 - Coverage enforcement is implemented by `packages/astro-gravatar/package.json` plus `scripts/check-coverage.ts`.
 - Package publishing is tag-driven through `.github/workflows/publish.yml`.
 - The publish workflow uses `npm publish --provenance --access public` from `packages/astro-gravatar`.
-- Changes that affect the published package should usually include a Sampo changeset via `bun run changeset`.
+- Changes that affect the published package should usually include a Sampo release entry via `bun run sampo:add`.
 
 ## Documentation expectations
 

AGENTS.md

@@ -114,7 +114,7 @@ This repo uses Bun for local validation and a tag-driven GitHub Actions workflow
 
 1. Run `bun run lint`, `bun run typecheck`, `bun run test`, and `bun run build`.
 2. Confirm publish output with `cd packages/astro-gravatar && bun pm pack --dry-run`.
-3. Add a changeset when the published package changes: `bun run changeset`.
+3. Add a Sampo release entry when the published package changes: `bun run sampo:add`.
 4. Create and push a version tag like `v0.0.16` to trigger `.github/workflows/publish.yml`.
 
 ## License