@ankhorage/devtools 1.6.1 → 1.7.0

package/README.md

@@ -101,7 +101,7 @@ The synchronized package scripts are:
     "lint:fix": "ankhorage-eslint . --fix --max-warnings=0",
     "format": "ankhorage-prettier --write .",
     "format:check": "ankhorage-prettier --check .",
-    "knip": "ankhorage-knip"
+    "knip:check": "ankhorage-knip"
   }
 }
 ```
@@ -291,10 +291,13 @@ When this managed package contract changes, synchronization runs `bun install`.
 
 ```text
 .github/workflows/ci.yml
+.github/workflows/renovate.yml
 .github/workflows/release.yml
 ```
 
-Both workflows render their `bun-version` from the same managed Bun runtime policy used for `package.json`. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks.
+CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks.
+
+The Renovate workflow accepts only same-repository branches created by `renovate[bot]`. It calls the SHA-pinned `ankhorage/renovate` workflow to add a release Changeset for runtime Ankhorage dependency updates or an empty Changeset for dev-only updates, then dispatches CI for that bot-authored commit. It never checks out or executes pull-request code in the privileged `pull_request_target` context.
 
 ## Managed VS Code configuration
 

package/dist/tools/package/index.js

@@ -5,7 +5,7 @@
  * as a development dependency for normal consumers, while `@ankhorage/ankh` keeps devtools as a
  * runtime dependency because the CLI loads it as a bundled core provider. Individually installed
  * toolchain packages that devtools now owns are removed, and the canonical `lint`, `lint:fix`,
- * `format`, `format:check`, and `knip` scripts are written.
+ * `format`, `format:check`, and `knip:check` scripts are written.
  * Unrelated manifest fields, scripts, dependencies, and metadata are preserved.
  *
  * The Bun runtime policy is shared by every repository, including devtools itself. Devtools skips
@@ -30,7 +30,7 @@ const STANDARD_SCRIPTS = {
     'lint:fix': 'ankhorage-eslint . --fix --max-warnings=0',
     format: 'ankhorage-prettier --write .',
     'format:check': 'ankhorage-prettier --check .',
-    knip: 'ankhorage-knip',
+    'knip:check': 'ankhorage-knip',
 };
 const DEVTOOLS_OWNED_DEV_DEPENDENCIES = [
     '@eslint/js',
@@ -82,7 +82,9 @@ export function applyManagedPackageContract(manifest, devtoolsVersion) {
     if (manifest.name === DEVTOOLS_PACKAGE_NAME) {
         return applyBunRuntimePolicy(manifest);
     }
-    const scripts = { ...toRecord(manifest.scripts), ...STANDARD_SCRIPTS };
+    const scripts = { ...toRecord(manifest.scripts) };
+    delete scripts.knip;
+    Object.assign(scripts, STANDARD_SCRIPTS);
     const devDependencies = removeOwnedDependencies(toRecord(manifest.devDependencies));
     const dependencies = toRecord(manifest.dependencies);
     applyDevtoolsDependencyPlacement(manifest, dependencies, devDependencies, devtoolsVersion);
@@ -175,7 +177,8 @@ function normalizedDependencies(manifest, dependencies) {
         : { dependencies };
 }
 function hasStandardScripts(scripts) {
-    return Object.entries(STANDARD_SCRIPTS).every(([name, command]) => scripts[name] === command);
+    return (scripts.knip === undefined &&
+        Object.entries(STANDARD_SCRIPTS).every(([name, command]) => scripts[name] === command));
 }
 function serializePackageManifest(manifest) {
     return `${JSON.stringify(manifest, null, 2)}\n`;

package/dist/tools/workflows/files/ci.yml

@@ -5,6 +5,7 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -61,10 +62,10 @@ jobs:
 
       - name: Run Knip
         run: |
-          if node -e "const p=require('./package.json'); process.exit(p.scripts?.knip ? 0 : 1)"; then
-            bun run knip
+          if node -e "const p=require('./package.json'); process.exit(p.scripts?.['knip:check'] ? 0 : 1)"; then
+            bun run knip:check
           else
-            echo "No knip script found; skipping."
+            echo "No knip:check script found; skipping."
           fi
 
       - name: Run tests

package/dist/tools/workflows/files/renovate.yml

@@ -0,0 +1,21 @@
+name: Renovate
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: read
+
+jobs:
+  changeset:
+    if: >-
+      github.actor == 'renovate[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      startsWith(github.event.pull_request.head.ref, 'renovate/')
+    uses: ankhorage/renovate/.github/workflows/changeset.yml@b7305e8f17f9b07238f6b827bbc9f866fd498a0f

package/dist/tools/workflows/index.d.ts

@@ -1,2 +1,2 @@
 import type { ManagedFileDefinition } from '../shared/managedFiles.js';
-export declare const workflowManagedFiles: readonly [ManagedFileDefinition, ManagedFileDefinition];
+export declare const workflowManagedFiles: readonly [ManagedFileDefinition, ManagedFileDefinition, ManagedFileDefinition];

package/dist/tools/workflows/index.js

@@ -5,6 +5,7 @@ const NODE_VERSION_TOKEN = '__ANKH_NODE_VERSION__';
 export const workflowManagedFiles = [
     createWorkflowDefinition('.github/workflows/ci.yml', './files/ci.yml'),
     createWorkflowDefinition('.github/workflows/release.yml', './files/release.yml'),
+    createWorkflowDefinition('.github/workflows/renovate.yml', './files/renovate.yml'),
 ];
 function createWorkflowDefinition(relativePath, sourcePath) {
     const sourceUrl = new URL(sourcePath, import.meta.url);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",