docs: link changelog PRs and fix pnpm all wording

Author: goanpeca

.github/pull_request_template.md

@@ -8,7 +8,7 @@ Thanks for sending a pull request! A few quick checks before submitting:
 
 ## Checklist
 
-- [ ] `pnpm all` passes locally (lint + typecheck + test + build).
+- [ ] `pnpm all` passes locally (lint + release policy + typecheck + test + build + spellcheck).
 - [ ] If `src/` changed, `dist/index.js` was rebuilt and is included in this PR. CI will fail otherwise.
 - [ ] Test coverage for new logic added under `__tests__/` (and passes the 95%/85%/100%/95% coverage gate).
 - [ ] If a new `action:` verb was added: it's listed in `src/inputs.ts` `ActionName`, wired in `src/main.ts`, documented in `action.yml`, and has a usage entry in the [README](../README.md).

CHANGELOG.md

@@ -8,33 +8,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Security
 
-- Hardened release/test tooling to clear GitHub security-scanning findings: bearer-token-like test data is no longer committed as a contiguous literal, release-provenance checks reuse parsed step bodies, mutation-report paths sanitize POSIX and Windows separators, and mutation-report tables share one column definition.
-- Bumped pinned CI action SHAs, `biome.json`, and development dependencies to clear GitHub Dependabot security alerts.
+- Hardened release/test tooling to clear GitHub security-scanning findings: bearer-token-like test data is no longer committed as a contiguous literal, release-provenance checks reuse parsed step bodies, mutation-report paths sanitize POSIX and Windows separators, and mutation-report tables share one column definition. ([#176](https://github.com/backblaze-labs/b2-action/issues/176))
+- Bumped pinned CI action SHAs, `biome.json`, and development dependencies to clear GitHub Dependabot security alerts. ([#175](https://github.com/backblaze-labs/b2-action/issues/175))
 
 ### Added
 
-- Local path inputs now expand a leading `~` or `~/` to the runner's home directory: `source` for `upload` and `sync` up, `destination` for `download`, `sync` down, and `verify`, plus `include` / `exclude` globs. Action inputs are not shell-expanded, so `destination: ~/.cache/huggingface` previously created a literal `~` directory inside the workspace, while `@actions/glob` already expanded `~` for upload patterns. B2 keys are never tilde-expanded because `~` is a legal key character. `~user` forms are passed through with a warning, and `~/..` paths are rejected because the expanded path would leave the runner home directory.
-- `keep-days` input: the retention window for `keep-mode: keep-days`, which the action never forwarded to the SDK. The SDK defaults the window to 0 days, so `keep-mode: keep-days` can delete every destination-only file immediately and behave exactly like `keep-mode: delete`. For v1 compatibility, `keep-mode: keep-days` without `keep-days` still parses but emits a deprecation warning; set `keep-days` explicitly to use the intended retention window. A future major release should make the window required. Setting `keep-days` with any other `keep-mode` warns that it is ignored.
-- `sync` warns when `direction: auto` resolves to a B2-to-local sync while `source` still looks like a local path (`~`, `./`, `../`, or a Windows drive). Auto-detection treats "not an existing local directory" as "must be a B2 prefix", so a mistyped or not-yet-created local path silently reversed the intended direction.
-- `upload` file metadata and content headers: new `file-info` (custom `X-Bz-Info-*` entries), `cache-control`, `content-disposition`, `content-language`, and `expires` inputs, plus `preserve-mtime` to record the local file's modification time. Uploaded-file entries in the `summary-json` output now include the resolved `fileInfo`.
+- Local path inputs now expand a leading `~` or `~/` to the runner's home directory: `source` for `upload` and `sync` up, `destination` for `download`, `sync` down, and `verify`, plus `include` / `exclude` globs. Action inputs are not shell-expanded, so `destination: ~/.cache/huggingface` previously created a literal `~` directory inside the workspace, while `@actions/glob` already expanded `~` for upload patterns. B2 keys are never tilde-expanded because `~` is a legal key character. `~user` forms are passed through with a warning, and `~/..` paths are rejected because the expanded path would leave the runner home directory. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `keep-days` input: the retention window for `keep-mode: keep-days`, which the action never forwarded to the SDK. The SDK defaults the window to 0 days, so `keep-mode: keep-days` can delete every destination-only file immediately and behave exactly like `keep-mode: delete`. For v1 compatibility, `keep-mode: keep-days` without `keep-days` still parses but emits a deprecation warning; set `keep-days` explicitly to use the intended retention window. A future major release should make the window required. Setting `keep-days` with any other `keep-mode` warns that it is ignored. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `sync` warns when `direction: auto` resolves to a B2-to-local sync while `source` still looks like a local path (`~`, `./`, `../`, or a Windows drive). Auto-detection treats "not an existing local directory" as "must be a B2 prefix", so a mistyped or not-yet-created local path silently reversed the intended direction. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `upload` file metadata and content headers: new `file-info` (custom `X-Bz-Info-*` entries), `cache-control`, `content-disposition`, `content-language`, and `expires` inputs, plus `preserve-mtime` to record the local file's modification time. Uploaded-file entries in the `summary-json` output now include the resolved `fileInfo`. ([#135](https://github.com/backblaze-labs/b2-action/issues/135))
 
 ### Changed
 
 - Updated the `@backblaze-labs/b2-sdk` dependency from `^0.1.0` to `^0.2.0`.
-- `bypass-governance` now also covers `delete` and `purge`, not just retention changes: it is forwarded to Object Lock delete operations, so a governance-locked file can be removed when the application key has the capability.
+- `bypass-governance` now also covers `delete` and `purge`, not just retention changes: it is forwarded to Object Lock delete operations, so a governance-locked file can be removed when the application key has the capability. ([#132](https://github.com/backblaze-labs/b2-action/issues/132))
 
 ### Deprecated
 
-- `keep-mode: keep-days` without an explicit `keep-days` value. It still parses but emits a deprecation warning, and because the SDK defaults the window to 0 days it deletes destination-only files immediately (like `keep-mode: delete`). Set `keep-days` explicitly; a future major release will require it.
+- `keep-mode: keep-days` without an explicit `keep-days` value. It still parses but emits a deprecation warning, and because the SDK defaults the window to 0 days it deletes destination-only files immediately (like `keep-mode: delete`). Set `keep-days` explicitly; a future major release will require it. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
 
 ### Fixed
 
-- `sync`: `direction: auto` now fails closed for an expandable tilde-prefixed `source` that exists as a local directory, because the same string can also be a valid B2 prefix. Set `direction: up` for a local home-directory upload or `direction: down` for a B2-prefix download. This is a version-to-version behavior change for `~`-prefixed auto sources that briefly resolved as uploads after tilde expansion was added.
-- `upload`: glob matches outside the working directory no longer produce B2 keys containing `..` path segments. The key was computed with `relative(process.cwd(), match)`, so a pattern such as `/tmp/build/*.bin` yielded keys like `artifacts/../../../tmp/build/a.bin`. Those objects uploaded successfully but this action's own prefix `download` then refused to map them back onto disk, so they could not be restored. Keys are now resolved against the first containing root (the working directory first, so in-workspace globs keep their existing keys, then the glob's own search paths), falling back to the basename.
-- `upload`: multi-file uploads now fail before any upload starts if two local files would map to the same final B2 file name after destination remapping. This avoids silent overwrites from same-basename files matched through multiple absolute roots or basename fallback.
-- `copy`: abort signals now flow through both small-file and large-file copy paths, so workflow cancellation behaves consistently.
-- `file-info`: oversized metadata entries are now checked against the remaining total metadata budget, producing one coherent limit instead of a value-only limit that could still fail the final total check.
-- `copy`: large cross-bucket copies now land in the destination bucket. `copyLargeFile` was never sent the destination bucket id, so a large file copied across buckets was silently written back into the source bucket.
+- `sync`: `direction: auto` now fails closed for an expandable tilde-prefixed `source` that exists as a local directory, because the same string can also be a valid B2 prefix. Set `direction: up` for a local home-directory upload or `direction: down` for a B2-prefix download. This is a version-to-version behavior change for `~`-prefixed auto sources that briefly resolved as uploads after tilde expansion was added. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `upload`: glob matches outside the working directory no longer produce B2 keys containing `..` path segments. The key was computed with `relative(process.cwd(), match)`, so a pattern such as `/tmp/build/*.bin` yielded keys like `artifacts/../../../tmp/build/a.bin`. Those objects uploaded successfully but this action's own prefix `download` then refused to map them back onto disk, so they could not be restored. Keys are now resolved against the first containing root (the working directory first, so in-workspace globs keep their existing keys, then the glob's own search paths), falling back to the basename. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `upload`: multi-file uploads now fail before any upload starts if two local files would map to the same final B2 file name after destination remapping. This avoids silent overwrites from same-basename files matched through multiple absolute roots or basename fallback. ([#164](https://github.com/backblaze-labs/b2-action/issues/164))
+- `copy`: abort signals now flow through both small-file and large-file copy paths, so workflow cancellation behaves consistently. ([#131](https://github.com/backblaze-labs/b2-action/issues/131))
+- `file-info`: oversized metadata entries are now checked against the remaining total metadata budget, producing one coherent limit instead of a value-only limit that could still fail the final total check. ([#135](https://github.com/backblaze-labs/b2-action/issues/135))
+- `copy`: large cross-bucket copies now land in the destination bucket. `copyLargeFile` was never sent the destination bucket id, so a large file copied across buckets was silently written back into the source bucket. ([#131](https://github.com/backblaze-labs/b2-action/issues/131))
 
 ### Documentation
 
@@ -44,7 +44,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 - README: `keep-mode` states that deletion applies to whichever side is the destination, so a `down` sync with `keep-mode: delete` removes local files; the sync examples say the same inline.
 - README: the `delete` verb row distinguishes exact-name deletes (latest version only, history preserved) from prefix deletes (every version, same as `purge`).
 - README: `source-bucket` notes that cross-bucket `copy` needs a key that reaches both buckets, so a single-bucket-restricted key cannot do it.
-- Release and contributor docs now include the pre-release coherence checklist, require pnpm 11+, use `pnpm run docs` for TypeDoc, and document that the link checker skips generated `docs/` output.
+- Release and contributor docs now include the pre-release coherence checklist, pin pnpm via the `packageManager` field, use `pnpm run docs` for TypeDoc, and document that the link checker skips generated `docs/` output.
 
 ## [1.1.0] - 2026-06-23
 

CLAUDE.md

@@ -27,7 +27,7 @@ pnpm lint:fix
 pnpm typecheck   # tsc --noEmit
 pnpm test        # vitest run, against B2Simulator
 pnpm build       # ncc build src/main.ts -o dist
-pnpm all         # lint + typecheck + test + build
+pnpm all         # lint + release policy + typecheck + test + build + spellcheck
 pnpm verify-dist # build, then `git diff --exit-code dist/`: must be clean before commit
 ```
 

README.md

@@ -26,6 +26,7 @@ A Backblaze-maintained B2 GitHub Action. TypeScript-native, built on [@backblaze
   - [Verbs](#verbs)
   - [Worked examples](#worked-examples)
     - [Upload a single file](#upload-a-single-file)
+    - [Upload with metadata and content headers](#upload-with-metadata-and-content-headers)
     - [Upload a directory with globs](#upload-a-directory-with-globs)
     - [Download a file or a prefix](#download-a-file-or-a-prefix)
     - [Sync (both directions)](#sync-both-directions)