ci(deps): bump step-security/changeset-action to v1.9.0

[alexprudhomme]

Problem

The release job in cd.yml pins step-security/changeset-action@v1.7.0. In a monorepo, if a single package fails to publish (e.g. missing npm permissions for a new package), the whole action fails because getExecOutput throws on the non-zero exit code from changeset publish. As a result, packages that did publish successfully never get their GitHub releases created and the published output is never set to true.

This was reported upstream in step-security/changeset-action#89.

Solution

Bump the pinned action from v1.7.0 (4ec991f) to v1.9.0 (6ddf462), which syncs with upstream changesets/action@v1.9.0 (PR changesets/action#535 by @Andarist). That fix adds ignoreReturnCode: true to the getExecOutput call in runPublish, so the action still processes New tag: lines, creates GitHub releases for the successfully published packages, and sets the published output even when some packages fail to publish.

Note: ignoreReturnCode is an internal fix within the action — there is no new workflow input to enable. Upgrading to v1.9.0 is all that is required to get the resilient-publish behavior.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 87a2f2c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[svcsnykcoveo]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[pkg-pr-new]

• @coveo/pkg-new-template

@coveo/atomic

npm i https://pkg.pr.new/@coveo/atomic@7926

@coveo/atomic-hosted-page

npm i https://pkg.pr.new/@coveo/atomic-hosted-page@7926

@coveo/atomic-legacy

npm i https://pkg.pr.new/@coveo/atomic-legacy@7926

@coveo/atomic-react

npm i https://pkg.pr.new/@coveo/atomic-react@7926

@coveo/auth

npm i https://pkg.pr.new/@coveo/auth@7926

@coveo/bueno

npm i https://pkg.pr.new/@coveo/bueno@7926

@coveo/create-atomic

npm i https://pkg.pr.new/@coveo/create-atomic@7926

@coveo/create-atomic-component

npm i https://pkg.pr.new/@coveo/create-atomic-component@7926

@coveo/create-atomic-component-project

npm i https://pkg.pr.new/@coveo/create-atomic-component-project@7926

@coveo/create-atomic-result-component

npm i https://pkg.pr.new/@coveo/create-atomic-result-component@7926

@coveo/create-atomic-rollup-plugin

npm i https://pkg.pr.new/@coveo/create-atomic-rollup-plugin@7926

@coveo/headless

npm i https://pkg.pr.new/@coveo/headless@7926

@coveo/headless-react

npm i https://pkg.pr.new/@coveo/headless-react@7926

@coveo/shopify

npm i https://pkg.pr.new/@coveo/shopify@7926

commit: 87a2f2c

[Copilot]

Pull request overview

Updates the CD workflow to use a newer pinned version of step-security/changeset-action, aligning the release job with upstream behavior so GitHub releases and the published output are still produced even if one package publish fails in a monorepo.

Changes:

• Bump step-security/changeset-action from v1.7.0 to v1.9.0 in the release workflow.
• Keep the action pinned to a specific commit SHA (verified to match tag v1.9.0).