@ankhorage/devtools 1.8.1 → 1.8.3

package/README.md

@@ -311,7 +311,7 @@ A repository participates in Changesets synchronization when `.changeset/config.
 .github/workflows/release.yml
 ```
 
-CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. They also render Changesets status, version, and publish commands from the same policy that owns the synchronized package scripts. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks. Release publishing calls the Devtools-owned runner through the synchronized package script; it never resolves an ambient or mutable Changesets executable.
+CI and Release render their `bun-version` from the same managed Bun runtime policy used for `package.json`. They also render Changesets status, version, and publish commands from the same policy that owns the synchronized package scripts. The CI workflow installs that Bun version with the frozen lockfile, builds before repository-provider validation, runs `bunx @ankhorage/ankh doctor validate .`, and conditionally runs lint, formatting, Knip, tests, typecheck, and Changesets checks. Ordinary pull requests run the strict `changeset:status --since=origin/main` guard. A same-repository `changeset-release/main` pull request instead runs `bun run changeset -- status --since=HEAD`, validating the Version Packages metadata from the detached release checkout without requiring a local `main` ref or another unreleased Changeset after the release Changeset was consumed. A fork using that branch name remains subject to the ordinary strict guard. Release publishing calls the Devtools-owned runner through the synchronized package script; it never resolves an ambient or mutable Changesets executable.
 
 The Renovate workflow accepts only same-repository branches created by `renovate[bot]`. It calls the SHA-pinned `ankhorage/renovate` workflow to add a release Changeset for runtime Ankhorage dependency updates or an empty Changeset for dev-only updates, then dispatches CI for that bot-authored commit. It never checks out or executes pull-request code in the privileged `pull_request_target` context.
 

package/dist/internal/readmeDocs.js

@@ -22,6 +22,8 @@ const REQUIRED_README_SNIPPETS = [
     "profile: 'auto'",
     '@ankhorage/utility/project',
     'ankhorage-changeset',
+    'changeset-release/main',
+    'bun run changeset -- status --since=HEAD',
     '.changeset/config.json',
     '<!-- devtools-bun-policy:start -->',
     '<!-- devtools-bun-policy:end -->',

package/dist/policy/changesetsPolicy.d.ts

@@ -11,8 +11,12 @@ export declare const changesetsPolicy: {
         readonly 'changeset:status': "bun src/cli/bin/changeset.ts status --since=origin/main";
         readonly 'version-packages': "bun src/cli/bin/changeset.ts version";
     };
+    readonly workflowArguments: {
+        readonly versionPackagesStatus: readonly ["status", "--since=HEAD"];
+    };
     readonly workflowCommands: {
         readonly status: "bun run changeset:status";
+        readonly versionPackagesStatus: `bun run changeset -- ${string}`;
         readonly version: "bun run version-packages";
         readonly publish: "bun run changeset -- publish";
     };

package/dist/policy/changesetsPolicy.js

@@ -1,3 +1,4 @@
+const versionPackagesStatusArguments = ['status', '--since=HEAD'];
 export const changesetsPolicy = {
     packageName: '@changesets/cli',
     binaryName: 'ankhorage-changeset',
@@ -11,8 +12,12 @@ export const changesetsPolicy = {
         'changeset:status': 'bun src/cli/bin/changeset.ts status --since=origin/main',
         'version-packages': 'bun src/cli/bin/changeset.ts version',
     },
+    workflowArguments: {
+        versionPackagesStatus: versionPackagesStatusArguments,
+    },
     workflowCommands: {
         status: 'bun run changeset:status',
+        versionPackagesStatus: `bun run changeset -- ${versionPackagesStatusArguments.join(' ')}`,
         version: 'bun run version-packages',
         publish: 'bun run changeset -- publish',
     },

package/dist/tools/workflows/files/ci.yml

@@ -84,8 +84,17 @@ jobs:
             echo "No typecheck script found; skipping."
           fi
 
+      - name: Validate Version Packages metadata
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.head_ref == 'changeset-release/main'
+        run: |
+          if node -e "const p=require('./package.json'); process.exit(p.scripts?.changeset ? 0 : 1)"; then
+            __ANKH_CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND__
+          else
+            echo "No changeset script found; skipping."
+          fi
+
       - name: Check changesets
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && (github.event.pull_request.head.repo.full_name != github.repository || github.head_ref != 'changeset-release/main')
         run: |
           if node -e "const p=require('./package.json'); process.exit(p.scripts?.['changeset:status'] ? 0 : 1)"; then
             __ANKH_CHANGESETS_STATUS_COMMAND__

package/dist/tools/workflows/files/renovate.yml

@@ -18,4 +18,4 @@ jobs:
       github.actor == 'renovate[bot]' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       startsWith(github.event.pull_request.head.ref, 'renovate/')
-    uses: ankhorage/renovate/.github/workflows/changeset.yml@7d4a5104b94e763ca5be34919f4fcfbb12efd526
+    uses: ankhorage/renovate/.github/workflows/changeset.yml@ae2cde4673bb58c6659bc5a7bd16739fb6f0db5e

package/dist/tools/workflows/renderWorkflowAsync.js

@@ -6,11 +6,13 @@ export async function renderWorkflowAsync(sourceUrl, policy) {
         .replaceAll(BUN_VERSION_TOKEN, policy.bunVersion)
         .replaceAll(CHANGESETS_PUBLISH_COMMAND_TOKEN, changesetsPolicy.workflowCommands.publish)
         .replaceAll(CHANGESETS_STATUS_COMMAND_TOKEN, changesetsPolicy.workflowCommands.status)
+        .replaceAll(CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND_TOKEN, changesetsPolicy.workflowCommands.versionPackagesStatus)
         .replaceAll(CHANGESETS_VERSION_COMMAND_TOKEN, changesetsPolicy.workflowCommands.version)
         .replaceAll(NODE_VERSION_TOKEN, policy.nodeVersion);
 }
 const BUN_VERSION_TOKEN = '__ANKH_BUN_VERSION__';
 const CHANGESETS_PUBLISH_COMMAND_TOKEN = '__ANKH_CHANGESETS_PUBLISH_COMMAND__';
 const CHANGESETS_STATUS_COMMAND_TOKEN = '__ANKH_CHANGESETS_STATUS_COMMAND__';
+const CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND_TOKEN = '__ANKH_CHANGESETS_VERSION_PACKAGES_STATUS_COMMAND__';
 const CHANGESETS_VERSION_COMMAND_TOKEN = '__ANKH_CHANGESETS_VERSION_COMMAND__';
 const NODE_VERSION_TOKEN = '__ANKH_NODE_VERSION__';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ankhorage/devtools",
-  "version": "1.8.1",
+  "version": "1.8.3",
   "description": "Shared development tools and repository standards for Ankhorage",
   "license": "MIT",
   "homepage": "https://github.com/ankhorage/devtools#readme",