feat: migrate qwik-sonner to Qwik v2 (beta)

.github/actions/setup/action.yml

@@ -0,0 +1,27 @@
+name: Setup
+description: Set up pnpm (pinned via packageManager), Node 22, and install dependencies frozen
+
+inputs:
+  registry-url:
+    description: npm registry URL. Set this only in publish jobs so NODE_AUTH_TOKEN is wired up.
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install pnpm
+      uses: pnpm/action-setup@v6
+      with:
+        version: 11
+
+    - name: Use Node.js 24
+      uses: actions/setup-node@v6
+      with:
+        node-version: 24
+        cache: pnpm
+        registry-url: ${{ inputs.registry-url }}
+
+    - name: Install dependencies
+      run: pnpm install --frozen-lockfile
+      shell: bash

.github/workflows/ci.yml

@@ -0,0 +1,86 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call: # lets release.yml reuse this exact gate
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  # cancel superseded PR runs, but never cancel pushes to main
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Lint, typecheck & build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+
+      - name: Lint
+        run: pnpm lint
+
+      - name: Build library (types + lib)
+        run: pnpm build.types && pnpm build.lib
+
+      - name: Typecheck website
+        run: pnpm build.types && pnpm lint
+        working-directory: website
+
+      - name: Typecheck test app
+        run: pnpm build.types && pnpm lint
+        working-directory: test
+
+  e2e:
+    name: Playwright (${{ matrix.browser }})
+    needs: verify
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        browser: [chromium, webkit]
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
+
+      # The Playwright webServer runs `pnpm dev` in ./test, which imports the
+      # workspace-linked library from lib/, so the lib must be built first.
+      - name: Build library
+        run: pnpm build.types && pnpm build.lib
+
+      - name: Resolve Playwright version
+        id: pw
+        run: echo "version=$(node -p "require('@playwright/test/package.json').version")" >> "$GITHUB_OUTPUT"
+
+      - name: Cache Playwright browsers
+        id: pw-cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-v2-${{ runner.os }}-${{ matrix.browser }}-${{ steps.pw.outputs.version }}
+
+      - name: Install Playwright (browser + system deps)
+        if: steps.pw-cache.outputs.cache-hit != 'true'
+        run: pnpm exec playwright install --with-deps ${{ matrix.browser }}
+
+      - name: Install Playwright system deps (cached browser)
+        if: steps.pw-cache.outputs.cache-hit == 'true'
+        run: pnpm exec playwright install-deps ${{ matrix.browser }}
+
+      - name: Run Playwright tests
+        run: pnpm exec playwright test --project=${{ matrix.browser }}
+
+      - name: Upload report
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: playwright-report-${{ matrix.browser }}
+          path: playwright-report/
+          retention-days: 7

.github/workflows/release.yml

@@ -1,51 +1,77 @@
 name: Release
 
-permissions:
-  contents: write
-
 on:
   push:
     tags:
       - "v*"
 
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false # never interrupt an in-flight publish
+
+permissions:
+  contents: read
+
 jobs:
-  npm_publish:
+  # Full quality gate (lint + typecheck + lib build + Playwright) before anything ships.
+  ci:
+    uses: ./.github/workflows/ci.yml
+
+  publish:
+    name: Publish to npm
+    needs: ci
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # OIDC token for npm Trusted Publishing (no NPM_TOKEN needed)
     steps:
-      - name: clone repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/setup
 
-      - name: installing pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
+      - name: Build library
+        run: pnpm build.types && pnpm build.lib
 
-      - name: Use Node.js 20
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: "pnpm"
-          registry-url: "https://registry.npmjs.org"
+      # Pack with pnpm so `catalog:`/`workspace:` specifiers are rewritten to real
+      # versions in the tarball, but publish with the npm CLI: pnpm publish does
+      # not yet support npm's OIDC Trusted Publishing (pnpm/pnpm#9812, #11513).
+      - name: Pack
+        run: pnpm pack --pack-destination .
 
-      - name: Building library
-        run: pnpm install --no-frozen-lockfile
+      # Trusted Publishing requires npm CLI >= 11.5.1.
+      - name: Ensure recent npm
+        run: npm install -g npm@latest
 
-      - run: npm publish --no-git-checks
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      # Prerelease versions (e.g. 2.0.0-beta.0) publish under their identifier
+      # tag (`beta`) so `latest` keeps pointing at the stable line; plain
+      # versions publish under `latest`.
+      - name: Resolve npm dist-tag
+        id: disttag
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if [[ "$VERSION" == *-* ]]; then
+            TAG="${VERSION#*-}"; TAG="${TAG%%.*}"
+          else
+            TAG="latest"
+          fi
+          echo "Publishing $VERSION under dist-tag '$TAG'"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - name: Publish via Trusted Publishing (OIDC)
+        run: npm publish *.tgz --provenance --access public --tag ${{ steps.disttag.outputs.tag }}
 
-  gh_release:
-    needs: [npm_publish]
+  github_release:
+    name: GitHub release & changelog
+    needs: publish
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-
-      - run: npx changelogithub # or changelogithub@0.12 if ensure the stable result
+          fetch-depth: 0 # changelogithub needs full history to diff tags
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 22
+      - run: npx changelogithub
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -43,3 +43,6 @@ bun.lockb
 # Yarn
 .yarn/*
 !.yarn/releases
+
+# Local-only notes
+todos.md