@ankhorage/devtools 1.11.2 → 1.11.4

package/README.md

@@ -338,7 +338,7 @@ A repository participates in Changesets synchronization when `.changeset/config.
 .github/workflows/release.yml
 ```
 
-CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. They also render Changesets status, version, and publish commands from the same policy that owns the synchronized package scripts. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks. Ordinary pull requests run the strict `changeset:status --since=origin/main` guard. A same-repository `changeset-release/main` pull request instead runs `bun run changeset -- status --since=HEAD`, validating the Version Packages metadata from the detached release checkout without requiring a local `main` ref or another unreleased Changeset after the release Changeset was consumed. A fork using that branch name remains subject to the ordinary strict guard. Release publishing calls the Devtools-owned runner through the synchronized package script; it never resolves an ambient or mutable Changesets executable. Changesets v3 creates the local release tags; the managed workflow pushes those exact tags and creates any missing GitHub Releases directly, without parsing Changesets’ human-readable publish output.
+CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. They also render Changesets status, version, and publish commands from the same policy that owns the synchronized package scripts. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and the strict `changeset:status --since=origin/main` guard for pull requests. After a green change reaches `main`, Release uses the scoped Ankhorage Renovate Sync App token to apply Changesets versioning directly to `main` in a `chore(release)` `[skip ci]` commit and publishes without creating a second Version Packages pull request. Release publishing calls the Devtools-owned runner through the synchronized package script; it never resolves an ambient or mutable Changesets executable. Changesets v3 creates the local release tags; the managed workflow pushes those exact tags and creates any missing GitHub Releases directly, without parsing Changesets’ human-readable publish output.
 
 The Renovate workflow accepts only same-repository branches created by `renovate[bot]`. It calls the SHA-pinned `ankhorage/renovate` workflow to add a release Changeset for runtime Ankhorage dependency updates or an empty Changeset for dev-only updates. The trusted workflow scopes the Ankhorage Renovate Sync GitHub App token to the current repository and uses it only for the validated commit, allowing every normal pull-request CI workflow to start without manual approval. It never checks out or executes pull-request code in the privileged `pull_request_target` context.
 

package/dist/internal/readmeDocs.js

@@ -27,8 +27,8 @@ const REQUIRED_README_SNIPPETS = [
     "profile: 'auto'",
     '@ankhorage/utility/project',
     'ankhorage-changeset',
-    'changeset-release/main',
-    'bun run changeset -- status --since=HEAD',
+    'without creating a second Version Packages pull request',
+    'chore(release)',
     '.changeset/config.json',
     '<!-- devtools-bun-policy:start -->',
     '<!-- devtools-bun-policy:end -->',

package/dist/policy/changesetsPolicy.d.ts

@@ -11,12 +11,8 @@ export declare const changesetsPolicy: {
         readonly 'changeset:status': "bun src/cli/bin/changeset.ts status --since=origin/main";
         readonly 'version-packages': "bun src/cli/bin/changeset.ts version";
     };
-    readonly workflowArguments: {
-        readonly versionPackagesStatus: readonly ["status", "--since=HEAD"];
-    };
     readonly workflowCommands: {
         readonly status: "bun run changeset:status";
-        readonly versionPackagesStatus: `bun run changeset -- ${string}`;
         readonly version: "bun run version-packages";
         readonly publish: "bun run changeset -- publish";
     };

package/dist/policy/changesetsPolicy.js

@@ -1,4 +1,3 @@
-const versionPackagesStatusArguments = ['status', '--since=HEAD'];
 export const changesetsPolicy = {
     packageName: '@changesets/cli',
     binaryName: 'ankhorage-changeset',
@@ -12,12 +11,8 @@ export const changesetsPolicy = {
         'changeset:status': 'bun src/cli/bin/changeset.ts status --since=origin/main',
         'version-packages': 'bun src/cli/bin/changeset.ts version',
     },
-    workflowArguments: {
-        versionPackagesStatus: versionPackagesStatusArguments,
-    },
     workflowCommands: {
         status: 'bun run changeset:status',
-        versionPackagesStatus: `bun run changeset -- ${versionPackagesStatusArguments.join(' ')}`,
         version: 'bun run version-packages',
         publish: 'bun run changeset -- publish',
     },

package/dist/tools/workflows/files/ci.yml

@@ -84,17 +84,8 @@ jobs:
             echo "No typecheck script found; skipping."
           fi
 
-      - name: Validate Version Packages metadata
-        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'changeset-release/main'
-        run: |
-          if node -e "const p=require('./package.json'); process.exit(p.scripts?.changeset ? 0 : 1)"; then
-            __ANKH_CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND__
-          else
-            echo "No changeset script found; skipping."
-          fi
-
       - name: Check changesets
-        if: github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || github.head_ref != 'changeset-release/main')
+        if: github.event_name == 'pull_request'
         run: |
           if node -e "const p=require('./package.json'); process.exit(p.scripts?.['changeset:status'] ? 0 : 1)"; then
             __ANKH_CHANGESETS_STATUS_COMMAND__

package/dist/tools/workflows/files/release.yml

@@ -7,7 +7,6 @@ on:
 
 permissions:
   contents: write
-  pull-requests: write
   id-token: write
 
 concurrency:
@@ -19,10 +18,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Create the scoped release token
+        id: release-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
+          private-key: ${{ secrets.ANKHORAGE_RENOVATE_SYNC_PRIVATE_KEY }}
+          owner: ankhorage
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ steps.release-token.outputs.token }}
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
@@ -49,18 +59,36 @@ jobs:
             echo "No build script found; skipping."
           fi
 
-      - name: Create release pull request or publish to npm
-        id: changesets
+      - name: Version packages directly on main
+        id: release
         if: hashFiles('.changeset/config.json') != ''
-        uses: changesets/action@v1
-        with:
-          version: __ANKH_CHANGESETS_VERSION_COMMAND__
-          publish: __ANKH_CHANGESETS_PUBLISH_COMMAND__
-          commit: Version Packages
-          title: Version Packages
-          createGithubReleases: false
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          before_version="$(node -p "require('./package.json').version")"
+          __ANKH_CHANGESETS_VERSION_COMMAND__
+          after_version="$(node -p "require('./package.json').version")"
+
+          if git diff --quiet; then
+            echo "versioned=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          git config user.name "ankhorage-renovate-sync[bot]"
+          git config user.email "ankhorage-renovate-sync[bot]@users.noreply.github.com"
+          git add --all
+          git commit -m "chore(release): version packages [skip ci]"
+          git push origin HEAD:main
+
+          if [ "$before_version" = "$after_version" ]; then
+            echo "versioned=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "versioned=true" >> "$GITHUB_OUTPUT"
+            echo "package_name=$(node -p "require('./package.json').name")" >> "$GITHUB_OUTPUT"
+            echo "package_version=$after_version" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish unpublished packages
+        if: hashFiles('.changeset/config.json') != ''
+        run: __ANKH_CHANGESETS_PUBLISH_COMMAND__
 
       - name: Finalize Changesets v3 tags and GitHub releases
         if: hashFiles('.changeset/config.json') != ''
@@ -79,7 +107,7 @@ jobs:
 
       - name: Create the scoped rollout token
         id: rollout-token
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.release.outputs.versioned == 'true'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.ANKHORAGE_RENOVATE_SYNC_CLIENT_ID }}
@@ -89,18 +117,22 @@ jobs:
           permission-contents: write
 
       - name: Trigger the Devtools consumer rollout
-        if: steps.changesets.outputs.published == 'true'
+        if: steps.release.outputs.versioned == 'true'
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
-          PUBLISHED_PACKAGES: ${{ steps.changesets.outputs.publishedPackages }}
+          PUBLISHED_PACKAGE_NAME: ${{ steps.release.outputs.package_name }}
+          PUBLISHED_PACKAGE_VERSION: ${{ steps.release.outputs.package_version }}
         with:
           github-token: ${{ steps.rollout-token.outputs.token }}
           script: |
-            const publishedPackages = JSON.parse(process.env.PUBLISHED_PACKAGES ?? '[]');
-            const release = publishedPackages.find(
-              (candidate) => candidate.name === '@ankhorage/devtools',
-            );
-            if (!release || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(release.version)) {
+            const release = {
+              name: process.env.PUBLISHED_PACKAGE_NAME,
+              version: process.env.PUBLISHED_PACKAGE_VERSION,
+            };
+            if (
+              release.name !== '@ankhorage/devtools' ||
+              !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(release.version)
+            ) {
               throw new Error('Changesets must report one exact published Devtools version.');
             }
 
@@ -111,6 +143,6 @@ jobs:
               client_payload: { version: release.version },
             });
 
-      - name: Skip release
+      - name: Skip release tooling
         if: hashFiles('.changeset/config.json') == ''
-        run: echo "No Changesets config found; skipping release."
+        run: echo "No Changesets config found; skipping versioning and publishing."

package/dist/tools/workflows/renderWorkflowAsync.js

@@ -7,13 +7,11 @@ export async function renderWorkflowAsync(sourceUrl, policy) {
         .replaceAll(BUN_VERSION_TOKEN, policy.bunVersion)
         .replaceAll(CHANGESETS_PUBLISH_COMMAND_TOKEN, changesetsPolicy.workflowCommands.publish)
         .replaceAll(CHANGESETS_STATUS_COMMAND_TOKEN, changesetsPolicy.workflowCommands.status)
-        .replaceAll(CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND_TOKEN, changesetsPolicy.workflowCommands.versionPackagesStatus)
         .replaceAll(CHANGESETS_VERSION_COMMAND_TOKEN, changesetsPolicy.workflowCommands.version)
         .replaceAll(NODE_VERSION_TOKEN, policy.nodeVersion);
 }
 const BUN_VERSION_TOKEN = '__ANKH_BUN_VERSION__';
 const CHANGESETS_PUBLISH_COMMAND_TOKEN = '__ANKH_CHANGESETS_PUBLISH_COMMAND__';
 const CHANGESETS_STATUS_COMMAND_TOKEN = '__ANKH_CHANGESETS_STATUS_COMMAND__';
-const CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND_TOKEN = '__ANKH_CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND__';
 const CHANGESETS_VERSION_COMMAND_TOKEN = '__ANKH_CHANGESETS_VERSION_COMMAND__';
 const NODE_VERSION_TOKEN = '__ANKH_NODE_VERSION__';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.11.2",
+  "version": "1.11.4",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",
@@ -125,7 +125,7 @@
   },
   "devDependencies": {
     "@ankhorage/ankh": "^0.8.11",
-    "@ankhorage/doctor": "0.10.7",
+    "@ankhorage/doctor": "0.10.8",
     "@types/bun": "^1.4.1",
     "@types/node": "^26.4.1",
     "typescript": "~6.0.3"