@automattic/vip 4.0.13 → 4.1.0

package/docs/RELEASING.md

@@ -76,6 +76,12 @@ You can release either using GitHub Actions or locally.
 
 This is the preferred method for pushing out the latest release. The workflow runs a bunch of validations, generates a build, bump versions + tags, pushes out to npm, and bumps to the next dev version.
 
+The repository uses `package-lock.json` for npm 12 development and CI installs. An identical
+`npm-shrinkwrap.json` is published with npm 11 so npm 11 and older consumers retain a locked CLI
+dependency tree. Run `npm run sync:shrinkwrap` after changing `package-lock.json`; CI rejects drift
+between the two files. The publish workflows intentionally use npm 11 because npm 12 excludes
+`npm-shrinkwrap.json` from package tarballs.
+
 Please keep in mind internal guidelines before releasing.
 
 To release, follow these steps:
@@ -119,7 +125,7 @@ To publish locally, follow these steps:
 1. Push the tag to GitHub (`git push --tags`)
 1. Push the trunk branch `git push`
 1. Make sure you're part of the Automattic organization in npm
-1. Publish the release to npm (`npm publish --access public`) the script will do some extra checks (
+1. Use npm 11 and publish the release (`npx --yes --package=npm@11 npm publish --access public`). The script will do some extra checks (
    node version, branch, etc) to ensure everything is correct. If all looks good, the new version
    will be published and you can proceed.
 1. Edit [the release on GitHub](https://github.com/Automattic/vip-cli/releases) to include a description
@@ -137,8 +143,8 @@ In order to do that, please follow this:
 
 <summary><details>
 
-1. Manually change the version in `package.json` and `package-lock.json` to a dev version. Example: `1.4.0-dev1`
-1. Run `npm publish --tag next` (When `--tag` is specified, we bypass the usual branch protection that doesn't allow you to publish form a brunch other than `trunk`).
+1. Set the dev version with npm 11 so both lockfiles remain synchronized. Example: `npx --yes --package=npm@11 npm version --no-git-tag-version 1.4.0-dev1`.
+1. Run `npx --yes --package=npm@11 npm publish --tag next` (When `--tag` is specified, we bypass the usual branch protection that doesn't allow you to publish form a brunch other than `trunk`).
 
 You can repeat this with every new version until you're happy with your version and ready to a public release. We currently don't support multiple branches for multiple versions. When it's the case, this process needs to be done for every version in every branch.
 

package/helpers/sync-shrinkwrap.js

@@ -0,0 +1,32 @@
+const { copyFileSync, readFileSync } = require( 'node:fs' );
+const path = require( 'node:path' );
+
+const PACKAGE_LOCK = 'package-lock.json';
+const NPM_SHRINKWRAP = 'npm-shrinkwrap.json';
+
+function syncShrinkwrap( { cwd = process.cwd(), check = false } = {} ) {
+	const packageLockPath = path.join( cwd, PACKAGE_LOCK );
+	const shrinkwrapPath = path.join( cwd, NPM_SHRINKWRAP );
+
+	if ( check ) {
+		const packageLock = readFileSync( packageLockPath );
+		const shrinkwrap = readFileSync( shrinkwrapPath );
+		if ( ! packageLock.equals( shrinkwrap ) ) {
+			throw new Error( `${ NPM_SHRINKWRAP } is out of sync with ${ PACKAGE_LOCK }` );
+		}
+		return;
+	}
+
+	copyFileSync( packageLockPath, shrinkwrapPath );
+}
+
+if ( require.main === module ) {
+	try {
+		syncShrinkwrap( { check: process.argv.includes( '--check' ) } );
+	} catch ( error ) {
+		console.error( error.message );
+		process.exitCode = 1;
+	}
+}
+
+module.exports = { syncShrinkwrap };