chore: replace semantic-release with changesets (#497)

* chore: replace semantic-release with @changesets/cli

* ci: replace semantic-release job with changeset-check for PRs

* ci: add changesets release workflow

* chore: remove .releaserc.json (semantic-release config)

* docs: document changesets workflow, remove semantic-release references

* chore: add changeset for semantic-release to changesets migration

* chore: add retrospective changeset for unreleased changes since v2.1.0

* chore: align changesets scripts, docs, and PR checklist

* fix: package-lock.json

---------

Co-authored-by: justxd22 <xdjust18@gmail.com>
Co-authored-by: Ricardo Cabral <me@ricardocabral.io>

Author: 3 people

.changeset/config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "restricted",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}

.changeset/replace-semantic-release-with-changesets.md

@@ -0,0 +1,5 @@
+---
+"nostream": patch
+---
+
+Replace semantic-release with changesets for explicit PR-level version management. Contributors now add a changeset file per PR; the Changesets Release workflow handles version bumps and GitHub releases.

.changeset/unreleased-since-v2.1.0.md

@@ -0,0 +1,36 @@
+---
+"nostream": minor
+---
+
+Release highlights:
+
+**Features**
+- NIP-05 verification support (#463)
+- NIP-17 & NIP-44 v2 Modern Direct Messages (#458)
+- NIP-62 vanish event support (#418)
+- Vanish optimization (#446)
+- Export events to JSON Lines format (#451)
+- Import .jsonl events into events table (#414)
+- Opt-in event retention purge (#359, #412)
+- Wipe events table script (#450)
+- Nginx reverse proxy in docker-compose (#423)
+- Docker DNS pre-flight check for connectivity verification (#398)
+- Strict validation for payment callbacks (#426)
+- Real home page with templated pages (#409)
+
+**Bug Fixes**
+- NIP-01 compliance: deterministic event ordering by event_id
+- NIP-01 compliance: correct dedup keys for parametrized replaceable events (#480)
+- NIP-01 replaceable event tiebreaker (#416)
+- NIP-11 served only on root path instead of relay path (#399)
+- Dockerfile: run database migrations in CMD (#422)
+- Added expired_at filter to message pipeline (#403)
+- Removed unsafe-inline and implemented script nonces for CSP hardening (#394)
+- Axios upgraded to fix CVE-2025-62718 (#466)
+
+**Refactors & Chores**
+- Migrated validation from Joi to Zod (#484)
+- Migrated linting and formatting to Biome (#452)
+- Converted user admission to PostgreSQL stored function (#428)
+- Upgraded to Node.js 24 LTS (#419)
+- Updated dependencies (express, body-parser, js-yaml, axios)

.github/PULL_REQUEST_TEMPLATE.md

@@ -33,4 +33,5 @@
 - [ ] I have updated the documentation accordingly.
 - [ ] I have read the **CONTRIBUTING** document.
 - [ ] I have added tests to cover my code changes.
+- [ ] I added a changeset, or this is docs-only and I added an empty changeset.
 - [ ] All new and existing tests passed.

.github/workflows/changesets.yml

@@ -0,0 +1,36 @@
+name: Changesets Release
+
+on:
+  push:
+    branches:
+      - main
+
+concurrency: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v3
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+
+      - name: Install package dependencies
+        run: npm ci
+
+      - name: Create Release Pull Request or Publish
+        uses: changesets/action@v1
+        with:
+          version: npm run changeset:version
+          publish: npm run changeset:tag
+          createGithubReleases: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }}

.github/workflows/checks.yml

@@ -142,24 +142,20 @@ jobs:
       with:
         github-token: ${{ secrets.GITHUB_TOKEN }}
         parallel-finished: true
-  release:
-    name: Release
+  changeset-check:
+    name: Changeset Required
     runs-on: ubuntu-latest
-    needs: [test-units-and-cover, test-integrations-and-cover]
-    if: github.ref == 'refs/heads/main'
-    environment: release
-    env:
-      TELEGRAM_BOT_ID: ${{ secrets.TELEGRAM_BOT_ID }}
-      TELEGRAM_BOT_TOKEN: ${{ secrets.TELEGRAM_BOT_TOKEN }}
+    if: github.event_name == 'pull_request' && github.head_ref != 'changeset-release/main'
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
       - uses: actions/setup-node@v3
         with:
           node-version-file: .nvmrc
+          cache: npm
       - name: Install package dependencies
         run: npm ci
-      - name: Release
-        env:
-          GITHUB_TOKEN: ${{ secrets.RELEASE_PAT }}
-        run: npx semantic-release
+      - name: Check for changeset
+        run: npx changeset status --since origin/${{ github.base_ref }}

.releaserc.json

@@ -20,11 +20,47 @@ npm run knip
 
 1. Update the relevant documentation with details of changes to the interface, this includes new environment
    variables, exposed ports, useful file locations and container parameters.
-2. Increase the version numbers in any examples files and the README.md to the new version that this
-   Pull Request would represent. The versioning scheme we use is [SemVer](http://semver.org/).
+2. Follow the versioning and changeset process described in [Releases & Versioning](#releases--versioning).
 3. You may merge the Pull Request in once you have the sign-off of two other developers, or if you
    do not have permission to do that, you may request the second reviewer to merge it for you.
 
+## Releases & Versioning
+
+This project uses [Changesets](https://github.com/changesets/changesets) for version management.
+
+### For contributors
+
+Every pull request that changes behavior, adds a feature, or fixes a bug **must include a changeset file**. The CI `changeset-check` job will fail if no changeset is present.
+
+To add a changeset:
+
+```bash
+npx changeset
+```
+
+This interactive prompt will ask you to:
+1. Select the bump type: `major`, `minor`, or `patch`
+2. Write a short summary of the change (this becomes the changelog entry)
+
+The command creates a file in `.changeset/` — commit it with your PR.
+
+### Docs-only PRs (no release)
+
+If your PR only updates documentation and should not affect versioning, add an empty changeset:
+
+```bash
+npx changeset --empty
+```
+
+Commit the generated `.changeset/*.md` file with your PR. This satisfies CI without producing a version bump or changelog entry.
+
+### Release process
+
+1. Changesets accumulate as PRs are merged to `main`
+2. The `Changesets Release` workflow automatically opens a **"Version Packages"** PR that aggregates all pending changesets, bumps `package.json`, and updates `CHANGELOG.md`
+3. When a maintainer merges the Version Packages PR, the workflow publishes a GitHub release and creates the corresponding git tag
+4. The Docker image is then automatically built and pushed to GHCR via the `release.yml` workflow
+
 ## Code Quality
 
 Run Biome checks before opening a pull request: