@adamhl8/configs 0.24.4 → 0.24.5

package/README.md

@@ -110,10 +110,11 @@ extends:
 
 ## GitHub Actions
 
-This repo hosts two reusable workflows you can call from other projects instead of copy/pasting them. The calling project must use `nub` and define `lint` / `bundle` / `bump-deps` scripts and a commitlint config (e.g. via these configs).
+This repo hosts three reusable workflows you can call from other projects instead of copy/pasting them. The calling project must use `nub` and define `lint` / `bundle` / `bump-deps` / `release:run` scripts and a commitlint config (e.g. via these configs).
 
 - `ci.yml`: runs `bundle` (build + lint) on pushes/PRs and lints commit messages with commitlint
 - `update-deps.yml`: weekly `bump-deps` run that opens a dependency-update PR
+- `release.yml`: manually dispatched release where git-cliff sets the version, then publishes to npm and cuts a GitHub release (commit and tag signed)
 
 Reference `@main` for latest, or pin to a release tag or commit SHA to update deliberately.
 
@@ -133,7 +134,7 @@ jobs:
 
 ### Update dependencies
 
-Requires a `CI_TOKEN` repo secret (a PAT with `contents` and `pull-requests` write) so the opened PR triggers the CI workflow.
+Needs the `CI_TOKEN` secret (see [Secrets](#secrets)).
 
 ```yaml
 # .github/workflows/update-deps.yml
@@ -148,6 +149,37 @@ jobs:
     secrets: inherit
 ```
 
+### Release
+
+Manually dispatched. git-cliff computes the next version from the commits, then `release-it` bumps `package.json`, regenerates the changelog, commits and tags (both SSH-signed), publishes to npm, and cuts a GitHub release. There is no automatic trigger, so run it when a release is ready (the `release` script just does `gh workflow run release.yml`). A dispatch with no releasable commits fails fast at release-it's `Version not changed`.
+
+Needs the `NPM_CI_TOKEN` and `CI_SIGNING_KEY` secrets (see [Secrets](#secrets)). The calling project must define `release` and `release:run` scripts, where `release:run` is `release-it --ci -i "$(adamhl8-cliff --bumped-version)"`.
+
+```yaml
+# .github/workflows/release.yml
+name: Release
+on:
+  workflow_dispatch: {}
+jobs:
+  release:
+    permissions:
+      contents: write
+    uses: adamhl8/configs/.github/workflows/release.yml@main
+    secrets: inherit
+```
+
+### Secrets
+
+Configure these on each repo that uses the workflows (Settings -> Secrets and variables -> Actions):
+
+| Secret           | Used by           | What it is                                                                                                                                                                                                                     |
+| ---------------- | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `CI_TOKEN`       | `update-deps.yml` | PAT with `contents` and `pull-requests` write, so the opened PR triggers CI                                                                                                                                                    |
+| `NPM_CI_TOKEN`   | `release.yml`     | npm automation token with publish access                                                                                                                                                                                       |
+| `CI_SIGNING_KEY` | `release.yml`     | Private SSH key that signs the release commit and tag. Add the matching public key to your GitHub account as a Signing Key so the signature verifies as you. Use a dedicated, passphrase-less key, not your personal auth key. |
+
+`GITHUB_TOKEN` is provided automatically. The release wrapper grants it `contents: write` to push the release commit and tag and to create the GitHub release.
+
 ## Notes
 
 The `prepare` script looks like: `"prepare": "lefthook install && nub ./patch-knip.ts && tsdown"`

package/dist/configs/knip.base.d.ts

@@ -5,7 +5,7 @@ import { KnipConfig } from "knip";
 declare const baseConfig: {
   readonly project: ["**"];
   readonly entry: ["./src/index.ts", "**/*.test.ts", "./tsdown.config.ts"];
-  readonly ignoreBinaries: ["lefthook"];
+  readonly ignoreBinaries: ["lefthook", "gh"];
   readonly ignoreDependencies: string[];
   readonly tsdown: false;
 };

package/dist/configs/knip.base.js

@@ -15,7 +15,7 @@ const IGNORE_DEPENDENCIES = [...["@commitlint/cli"], ...UNLISTED_DEPENDENCIES];
 const knipConfig = createMergeConfigFn({
 	project: ["**"],
 	entry: DEFAULT_ENTRIES,
-	ignoreBinaries: ["lefthook"],
+	ignoreBinaries: ["lefthook", "gh"],
 	ignoreDependencies: IGNORE_DEPENDENCIES,
 	tsdown: false
 });

package/dist/configs/knip.base.js.map

@@ -1 +1 @@
-{"version":3,"file":"knip.base.js","names":[],"sources":["../../src/configs/knip.base.ts"],"sourcesContent":["import type { KnipConfig } from \"knip\"\n\nimport { createMergeConfigFn } from \"#/utils.ts\"\nimport type { OptionalMergeConfigFn } from \"#/utils.ts\"\n\n// Normally, specifying the `./src/index.ts` entry would cause knip to complain about a redundant entry because it gets automatically included via the tsdown plugin.\n// However, in projects that _don't_ use tsdown, the `./src/index.ts` entry would be missing entirely.\n// To handle this, we specify it and disable the tsdown plugin. This makes knip work in both cases.\n\nexport const DEFAULT_ENTRIES = [\"./src/index.ts\", \"**/*.test.ts\", \"./tsdown.config.ts\"] as const satisfies string[]\n\n/**\n * Consuming projects show these transitive dependencies as unlisted. e.g. knip resolves\n * `@adamhl8/eslint-plugin-clean-modules` via the oxlint config, but we don't need to install it directly in the\n * consuming project.\n */\nconst UNLISTED_DEPENDENCIES = [\"@adamhl8/eslint-plugin-clean-modules\"]\n/**\n * Consuming projects show these dependencies as unused. e.g. `@commitlint/cli` can't be found by knip because it's\n * hidden by the fact that we call/extend our GitHub workflows.\n */\nconst UNUSED_DEPENDENCIES = [\"@commitlint/cli\"]\nexport const IGNORE_DEPENDENCIES = [...UNUSED_DEPENDENCIES, ...UNLISTED_DEPENDENCIES]\n\nconst baseConfig = {\n  project: [\"**\"],\n  entry: DEFAULT_ENTRIES,\n  ignoreBinaries: [\"lefthook\"],\n  ignoreDependencies: IGNORE_DEPENDENCIES,\n  tsdown: false,\n} as const satisfies KnipConfig\n\nexport const knipConfig: OptionalMergeConfigFn<KnipConfig, typeof baseConfig> = createMergeConfigFn(baseConfig)\n"],"mappings":";;AASA,MAAa,kBAAkB;CAAC;CAAkB;CAAgB;AAAoB;;;;;;AAOtF,MAAM,wBAAwB,CAAC,sCAAsC;AAMrE,MAAa,sBAAsB,CAAC,GAAG,CADV,iBACU,GAAqB,GAAG,qBAAqB;AAUpF,MAAa,aAAmE,oBAAoB;CAPlG,SAAS,CAAC,IAAI;CACd,OAAO;CACP,gBAAgB,CAAC,UAAU;CAC3B,oBAAoB;CACpB,QAAQ;AAG0F,CAAU"}
+{"version":3,"file":"knip.base.js","names":[],"sources":["../../src/configs/knip.base.ts"],"sourcesContent":["import type { KnipConfig } from \"knip\"\n\nimport { createMergeConfigFn } from \"#/utils.ts\"\nimport type { OptionalMergeConfigFn } from \"#/utils.ts\"\n\n// Normally, specifying the `./src/index.ts` entry would cause knip to complain about a redundant entry because it gets automatically included via the tsdown plugin.\n// However, in projects that _don't_ use tsdown, the `./src/index.ts` entry would be missing entirely.\n// To handle this, we specify it and disable the tsdown plugin. This makes knip work in both cases.\n\nexport const DEFAULT_ENTRIES = [\"./src/index.ts\", \"**/*.test.ts\", \"./tsdown.config.ts\"] as const satisfies string[]\n\n/**\n * Consuming projects show these transitive dependencies as unlisted. e.g. knip resolves\n * `@adamhl8/eslint-plugin-clean-modules` via the oxlint config, but we don't need to install it directly in the\n * consuming project.\n */\nconst UNLISTED_DEPENDENCIES = [\"@adamhl8/eslint-plugin-clean-modules\"]\n/**\n * Consuming projects show these dependencies as unused. e.g. `@commitlint/cli` can't be found by knip because it's\n * hidden by the fact that we call/extend our GitHub workflows.\n */\nconst UNUSED_DEPENDENCIES = [\"@commitlint/cli\"]\nexport const IGNORE_DEPENDENCIES = [...UNUSED_DEPENDENCIES, ...UNLISTED_DEPENDENCIES]\n\nconst baseConfig = {\n  project: [\"**\"],\n  entry: DEFAULT_ENTRIES,\n  ignoreBinaries: [\"lefthook\", \"gh\"],\n  ignoreDependencies: IGNORE_DEPENDENCIES,\n  tsdown: false,\n} as const satisfies KnipConfig\n\nexport const knipConfig: OptionalMergeConfigFn<KnipConfig, typeof baseConfig> = createMergeConfigFn(baseConfig)\n"],"mappings":";;AASA,MAAa,kBAAkB;CAAC;CAAkB;CAAgB;AAAoB;;;;;;AAOtF,MAAM,wBAAwB,CAAC,sCAAsC;AAMrE,MAAa,sBAAsB,CAAC,GAAG,CADV,iBACU,GAAqB,GAAG,qBAAqB;AAUpF,MAAa,aAAmE,oBAAoB;CAPlG,SAAS,CAAC,IAAI;CACd,OAAO;CACP,gBAAgB,CAAC,YAAY,IAAI;CACjC,oBAAoB;CACpB,QAAQ;AAG0F,CAAU"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adamhl8/configs",
-  "version": "0.24.4",
+  "version": "0.24.5",
   "homepage": "https://github.com/adamhl8/configs",
   "bugs": {
     "url": "https://github.com/adamhl8/configs/issues"
@@ -40,7 +40,8 @@
     "lint": "markdown-toc -i --bullets '-' --maxdepth 3 ./README.md && oxfmt && oxlint --fix --fix-suggestions --fix-dangerously && adamhl8-knip",
     "bump-deps": "nub update -L && rm -f lock.yaml && nub i --no-frozen-lockfile && oxfmt lock.yaml",
     "bundle": "nub run lint && tsdown",
-    "release": "release-it --ci -i \"$(adamhl8-cliff --bumped-version)\"",
+    "release": "gh workflow run release.yml",
+    "release:run": "release-it --ci -i \"$(adamhl8-cliff --bumped-version)\"",
     "prepare": "lefthook install && nub ./patch-knip.ts && tsdown"
   },
   "dependencies": {