ci: prepare for trusted publishing (#1087)

* ci: prepare for trusted publishing

* Update PR template

* Update pnpm-lock

* Remove @tanstack/config

* Upgrade @tanstack/eslint-config

Author: lachlancollins

.changeset/config.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://unpkg.com/@changesets/[email protected].1/schema.json",
+  "$schema": "https://unpkg.com/@changesets/[email protected].2/schema.json",
   "changelog": [
     "@svitejs/changesets-changelog-github-compact",
     { "repo": "TanStack/virtual" }
@@ -10,5 +10,8 @@
   "updateInternalDependencies": "patch",
   "fixed": [],
   "linked": [],
-  "ignore": []
+  "ignore": [],
+  "___experimentalUnsafeOptions_WILL_CHANGE_IN_PATCH": {
+    "onlyUpdatePeerDependentsWhenOutOfRange": true
+  }
 }

.github/FUNDING.yml

@@ -1,2 +1 @@
 github: tannerlinsley
-custom: https://youtube.com/tannerlinsley

.github/pull_request_template.md

@@ -1,9 +1,13 @@
 ## 🎯 Changes
 
-<!-- What changes are made in this PR? Is it a feature or a package submission? -->
+<!-- What changes are made in this PR? Describe the change and its motivation. -->
 
 ## ✅ Checklist
 
-- [ ] I have followed the steps listed in the [Contributing guide](https://github.com/TanStack/config/blob/main/CONTRIBUTING.md).
-- [ ] I have tested and linted this code locally.
-- [ ] I have generated a [changeset](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md) for this PR, or this PR should not release a new version.
+- [ ] I have followed the steps in the [Contributing guide](https://github.com/TanStack/virtual/blob/main/CONTRIBUTING.md).
+- [ ] I have tested this code locally with `pnpm run test:pr`.
+
+## 🚀 Release Impact
+
+- [ ] This change affects published code, and I have generated a [changeset](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md).
+- [ ] This change is docs/CI/dev-only (no release).

.github/workflows/autofix.yml

@@ -18,13 +18,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Setup Tools
         uses: tanstack/config/.github/setup@main
       - name: Fix formatting
-        run: pnpm prettier:write
+        run: pnpm format
       - name: Apply fixes
         uses: autofix-ci/action@551dded8c6cc8a1054039c8bc0b8b48c51dfc6ef
         with:

.github/workflows/pr.yml

@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Setup Tools
         uses: tanstack/config/.github/setup@main
       - name: Get base and head commits for `nx affected`
-        uses: nrwl/nx-set-shas@v4.3.0
+        uses: nrwl/nx-set-shas@v4.4.0
         with:
           main-branch-name: main
       - name: Install Playwright browsers
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Setup Tools
@@ -46,3 +46,15 @@ jobs:
         run: pnpm run build:all
       - name: Publish Previews
         run: pnpx pkg-pr-new publish --pnpm --compact './packages/*' --template './examples/*/*'
+  provenance:
+    name: Provenance
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+      - name: Check Provenance
+        uses: danielroe/[email protected]
+        with:
+          fail-on-downgrade: true

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5.0.0
+        uses: actions/checkout@v6.0.1
         with:
           fetch-depth: 0
       - name: Setup Tools
@@ -41,4 +41,3 @@ jobs:
           title: 'ci: Version Packages'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

eslint.config.js

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { tanstackConfig } from '@tanstack/config/eslint'
+import { tanstackConfig } from '@tanstack/eslint-config'
 
 export default [
   ...tanstackConfig,

examples/svelte/dynamic/src/App.svelte

@@ -10,9 +10,9 @@
 <main>
   <p>
     These components are using <strong>dynamic</strong> sizes. This means that each
-    element's exact dimensions are unknown when rendered. An estimated dimension
-    is used as the initial measurement, then this measurement is readjusted on the
-    fly as each element is rendered.
+    element's exact dimensions are unknown when rendered. An estimated dimension is
+    used as the initial measurement, then this measurement is readjusted on the fly
+    as each element is rendered.
   </p>
   <nav>
     <ul>

nx.json

@@ -1,9 +1,12 @@
 {
   "$schema": "./node_modules/nx/schemas/nx-schema.json",
   "defaultBase": "main",
-  "nxCloudAccessToken": "ZjRlNGQyYjgtYmQ2NS00ZjNkLTgwZTktNGQ2YzEwZmRlNzQ3fHJlYWQ=",
+  "nxCloudId": "65d1330edb0c1e7def5cb068",
   "useInferencePlugins": false,
   "parallel": 5,
+  "tui": {
+    "enabled": false
+  },
   "namedInputs": {
     "sharedGlobals": [
       "{workspaceRoot}/.nvmrc",

package.json

@@ -3,7 +3,7 @@
   "private": true,
   "repository": {
     "type": "git",
-    "url": "https://github.com/TanStack/virtual.git"
+    "url": "git+https://github.com/TanStack/virtual.git"
   },
   "packageManager": "[email protected]",
   "type": "module",
@@ -13,7 +13,6 @@
     "test:pr": "nx affected --targets=test:sherif,test:knip,test:docs,test:eslint,test:lib,test:e2e,test:types,test:build,build",
     "test:ci": "nx run-many --targets=test:sherif,test:knip,test:docs,test:eslint,test:lib,test:e2e,test:types,test:build,build",
     "test:eslint": "nx affected --target=test:eslint",
-    "test:format": "pnpm run prettier --check",
     "test:sherif": "sherif",
     "test:lib": "nx affected --target=test:lib --exclude=examples/**",
     "test:lib:dev": "pnpm run test:lib && nx watch --all -- pnpm run test:lib",
@@ -26,10 +25,9 @@
     "build:all": "nx run-many --target=build --exclude=examples/**",
     "watch": "pnpm run build:all && nx watch --all -- pnpm run build:all",
     "dev": "pnpm run watch",
-    "prettier": "prettier --ignore-unknown '**/*'",
-    "prettier:write": "pnpm run prettier --write",
+    "format": "prettier --experimental-cli --ignore-unknown '**/*' --write",
     "changeset": "changeset",
-    "changeset:version": "changeset version && pnpm install --no-frozen-lockfile && pnpm prettier:write",
+    "changeset:version": "changeset version && pnpm install --no-frozen-lockfile && pnpm format",
     "changeset:publish": "changeset publish"
   },
   "nx": {
@@ -40,22 +38,23 @@
     ]
   },
   "devDependencies": {
-    "@changesets/cli": "^2.29.7",
+    "@changesets/cli": "^2.29.8",
     "@playwright/test": "^1.53.1",
     "@svitejs/changesets-changelog-github-compact": "^1.2.0",
-    "@tanstack/config": "^0.20.2",
+    "@tanstack/eslint-config": "0.3.4",
+    "@tanstack/vite-config": "0.3.0",
     "@testing-library/jest-dom": "^6.6.3",
     "@types/node": "^24.5.2",
     "eslint": "^9.36.0",
     "jsdom": "^27.0.0",
     "knip": "^5.63.1",
     "markdown-link-extractor": "^4.0.2",
-    "nx": "^21.5.3",
+    "nx": "22.1.3",
     "premove": "^4.0.0",
-    "prettier": "^3.6.2",
+    "prettier": "^3.7.4",
     "prettier-plugin-svelte": "^3.4.0",
-    "publint": "^0.3.13",
-    "sherif": "^1.6.1",
+    "publint": "^0.3.15",
+    "sherif": "^1.9.0",
     "tinyglobby": "^0.2.15",
     "typescript": "5.4.5",
     "vite": "^5.4.19",