repository-dispatch

Repository dispatch success events can include deployment aliases, but the client payload type did not model that field. This PR updates the payload contract so consumers can read aliases in a typed way. Payload type update Added optional to in . Keeps backward compatibility by making the field optional. Documentation update Updated the package payload example in to include and show a success-state payload. Aligns docs with the event shape expected by consumers. Release metadata** Added a changeset for patch release.

Summary Several blocks inline expressions directly into the script source (, , inputs). This moves every one of them into and references them as quoted shell variables, following GitHub's guidance for composite actions and workflows. Why: Inlining into is the pattern CodeQL and zizmor flag (template injection), so consumers running those scanners against their workflows will see it. It's a small change with no behavior change for existing callers, and every consumer picks it up once the tag moves. An action should treat its documented inputs as data rather than script source, regardless of how the caller wires them. Changes : , , and go through . Resolution order is unchanged (explicit → SHA → empty) and log lines are identical. Values are written with , and a ref containing a newline fails the step so it can't add extra lines to . Also drops the unused env entries. : all fields and the raw payload go through . : inputs go through / in both the shell step and the step. New **: Fails if any block under or contains (via , preinstalled on ). Runs with refs containing shell metacharacters and asserts none of them get evaluated. Checks that checks out that exact SHA. : upgrades Next.js → . Next 16 removed , so the example now lints with Biome (, ) instead of ESLint. The stock SVGs are excluded, and Tailwind v4 directives are enabled in the CSS parser. : drops Node 18.x from the matrix, since Next 16 requires Node 20.9 or later. : widens from exactly / to / . Vercel now builds with Node 22 and a newer pnpm 9, and pnpm hard-fails on a root engines mismatch, which was breaking the example's preview deployment. Follow-up After merge, move the tag to the merge commit so consumers pick this up. 🤖 Generated with Claude Code

Summary GitHub Actions is deprecating Node 20 on runners starting June 2 (changelog). This PR upgrades the sub-action to use the runtime. Changes:** : → : → : add to the test matrix The and sub-actions are composite actions and are unaffected. The compiled dist output is unchanged — only the runtime declaration needed updating.