[jennifer-shehane]

What this changes

This moves everything CircleCI did into one GitHub Actions workflow, .github/workflows/ci.yml, and removes .circleci/config.yml.

• Lint: the Prettier check and the Markdown link check.
• Unit tests: run with npm run coverage on Node 24, so the 80% line threshold in vitest.config.ts is now enforced in CI. The report is uploaded as an artifact.
• Build: npm run build.
• Test apps: all 17 run in a matrix with fail-fast: false, so one failing app doesn't hide the others. Each job uploads its coverage report.
• Windows: test-apps/all-files runs on windows-latest through cypress-io/github-action@v7.
• Release: after every test job passes on a push to master, next, beta, or dev, semantic-release publishes to npm. It uses npm trusted publishing (OIDC), so there's no npm token to store or rotate, and provenance attestations are added automatically.

Along the way:

• semantic-release goes from 23.1.1 to 25.0.9, the first line whose npm plugin supports trusted publishing. It needs Node 22.14 or later, so AGENTS.md now lists that as the minimum for development. The published plugin still supports Node 20 (engines is unchanged).
• Every action is on its Node 24 major version: checkout, setup-node, cache, and upload-artifact at @v6.
• Most jobs read their Node version from .nvmrc.
• The README badge now points at the new workflow, AGENTS.md describes the new CI and release flow, and the CircleCI-only effective:config script is gone.

Nothing in lib/ changes, and the commits are ci:, so merging this won't cut a release by itself.

Setup needed from an admin

Here's what needs a human with the right access. 🙌

npmjs.com (package admin, before the next release):

1. Go to Packages → @cypress/code-coverage → Settings → Trusted Publisher and choose GitHub Actions.
2. Fill in: organization cypress-io, repository code-coverage, workflow filename ci.yml. Leave the environment blank.
3. Under Allowed actions, enable npm publish and manage dist-tags. Publishers created since September 3, 2026 default to staged publishing only, which semantic-release can't use.
4. Timing matters: a new trusted publisher expires unless it publishes successfully within 2 days. So add it shortly before a feat: or fix: lands on master.
5. Once a release works, set Publishing access to “Require two-factor authentication and disallow tokens”. Then retire the npm token in the CircleCI org-npm-credentials context, after checking whether other repos still use it.

GitHub (repo admin):

• In branch protection for master, replace the old ci/circleci: … required checks with the new job names (Lint, Unit tests, Build, Test app (…)). Otherwise PRs will wait for checks that never arrive.
• If a ruleset protects tags, give GitHub Actions a bypass, since semantic-release pushes the version tag with GITHUB_TOKEN.
• Disable the CircleCI project for this repo.

Things I'd love a second opinion on

• Push triggers: pushes only run CI on the release branches, and other branches run CI once a PR is open. That avoids running everything twice. CircleCI used to build every pushed branch, so tell me if that's something people relied on.
• Repeated build: every test-app job builds dist/ itself instead of reusing the build job's output. It's simpler but slower, and it could be a follow-up.
• Windows startup: the Windows job starts Cypress without wait-on, the same way the CircleCI job did. This PR's run is the first real test of that.

Checks run locally

• npm ci from the updated lockfile
• npm run coverage: 30 of 30 tests pass, 94.5% line coverage
• npm run format:check
• npm run build
• actionlint on ci.yml

The release job can only really run after merge, on a release branch.

---

Generated by Claude Code

---

Note

Medium Risk
CI and npm publishing paths change materially (OIDC trusted publishing and branch-protection check renames required); plugin runtime code is untouched but a misconfigured trusted publisher could block releases.

Overview
Replaces CircleCI with a single GitHub Actions workflow (.github/workflows/ci.yml) and deletes .circleci/config.yml. Lint, unit tests (now npm run coverage on Node 24 with artifact upload), build, the 17-app Cypress matrix, Windows all-files, and npm release are all defined there—with PR concurrency cancellation and push triggers limited to release branches plus all PRs.

The release job runs semantic-release after green CI on pushes to master/next/beta/dev, using npm trusted publishing (OIDC) instead of CircleCI’s npm token context. semantic-release is bumped to 25.0.9; docs now call for Node 22.14+ for dev/release tooling while engines stays >=20.

Docs and housekeeping: README CI badge points at Actions; AGENTS.md describes the new pipeline and matrix location; the CircleCI-only effective:config script is removed from package.json.

^{Reviewed by Cursor Bugbot for commit 1239af5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[jennifer-shehane]

A quick heads-up on the red CircleCI Pipeline status: it's expected, and nothing in this PR needs to change.

This PR deletes .circleci/config.yml, but CircleCI is still connected to the repo. It now reports "No configuration was found in your project" on every push, and that status will keep showing up on new PRs and master until the CircleCI project is turned off.

I'd rather not add a placeholder config just to turn it green, since that would keep a CI system around that no longer runs anything. The real fix needs a repo admin:

• In CircleCI, stop building cypress-io/code-coverage (Project Settings → Advanced → Stop Building, or unfollow the project).
• If CircleCI Pipeline or any ci/circleci: … check is required in master's branch protection, swap those for the new GitHub Actions jobs listed in the PR description.

All the actual testing now happens in the GitHub Actions CI workflow.

---

Generated by Claude Code

[github-actions]

🎉 This PR is included in version 4.1.2 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀