@bensandee/tooling 0.27.1 → 0.28.1

package/dist/bin.mjs

@@ -113,6 +113,7 @@ const LEGACY_PATTERNS = {
 /** Detect existing project state in the target directory. */
 function detectProject(targetDir) {
 	const exists = (rel) => existsSync(path.join(targetDir, rel));
+	const rootPkg = readPackageJson(targetDir);
 	return {
 		hasPackageJson: exists("package.json"),
 		hasTsconfig: exists("tsconfig.json"),
@@ -127,7 +128,8 @@ function detectProject(targetDir) {
 		hasReleaseItConfig: exists(".release-it.json") || exists(".release-it.yaml") || exists(".release-it.toml"),
 		hasSimpleReleaseConfig: exists(".versionrc") || exists(".versionrc.json") || exists(".versionrc.js"),
 		hasChangesetsConfig: exists(".changeset/config.json"),
-		hasRepositoryField: !!readPackageJson(targetDir)?.repository,
+		hasRepositoryField: !!rootPkg?.repository,
+		hasCommitAndTagVersion: !!rootPkg?.devDependencies?.["commit-and-tag-version"],
 		legacyConfigs: detectLegacyConfigs(targetDir)
 	};
 }
@@ -278,14 +280,18 @@ function getMonorepoPackages(targetDir) {
 function isCancelled(value) {
 	return clack.isCancel(value);
 }
+function detectProjectInfo(targetDir) {
+	const existingPkg = readPackageJson(targetDir);
+	return {
+		detected: detectProject(targetDir),
+		defaults: computeDefaults(targetDir),
+		name: existingPkg?.name ?? path.basename(targetDir)
+	};
+}
 async function runInitPrompts(targetDir, saved) {
 	clack.intro("@bensandee/tooling repo:sync");
-	const existingPkg = readPackageJson(targetDir);
-	const detected = detectProject(targetDir);
-	const defaults = computeDefaults(targetDir);
-	const isExisting = detected.hasPackageJson;
+	const { detected, defaults, name } = detectProjectInfo(targetDir);
 	const isFirstInit = !saved;
-	const name = existingPkg?.name ?? path.basename(targetDir);
 	const structure = saved?.structure ?? defaults.structure;
 	const useEslintPlugin = saved?.useEslintPlugin ?? defaults.useEslintPlugin;
 	let formatter = saved?.formatter ?? defaults.formatter;
@@ -404,7 +410,6 @@ async function runInitPrompts(targetDir, saved) {
 	clack.outro("Configuration complete!");
 	return {
 		name,
-		isNew: !isExisting,
 		structure,
 		useEslintPlugin,
 		formatter,
@@ -421,12 +426,9 @@ async function runInitPrompts(targetDir, saved) {
 }
 /** Build a ProjectConfig from CLI flags for non-interactive mode. */
 function buildDefaultConfig(targetDir, flags) {
-	const existingPkg = readPackageJson(targetDir);
-	const detected = detectProject(targetDir);
-	const defaults = computeDefaults(targetDir);
+	const { defaults, name } = detectProjectInfo(targetDir);
 	return {
-		name: existingPkg?.name ?? path.basename(targetDir),
-		isNew: !detected.hasPackageJson,
+		name,
 		...defaults,
 		...flags.eslintPlugin !== void 0 && { useEslintPlugin: flags.eslintPlugin },
 		...flags.noCi && { ci: "none" },
@@ -572,7 +574,6 @@ const ToolingConfigSchema = z.strictObject({
 		"library"
 	]).optional().meta({ description: "Project type (determines tsconfig base)" }),
 	detectPackageTypes: z.boolean().optional().meta({ description: "Auto-detect project types for monorepo packages" }),
-	setupDocker: z.boolean().optional().meta({ description: "Generate Docker build/check scripts" }),
 	docker: z.record(z.string(), z.object({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
 		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
@@ -635,7 +636,6 @@ function saveToolingConfig(ctx, config) {
 function mergeWithSavedConfig(detected, saved) {
 	return {
 		name: detected.name,
-		isNew: detected.isNew,
 		targetDir: detected.targetDir,
 		structure: saved.structure ?? detected.structure,
 		useEslintPlugin: saved.useEslintPlugin ?? detected.useEslintPlugin,
@@ -651,173 +651,499 @@ function mergeWithSavedConfig(detected, saved) {
 	};
 }
 //#endregion
-//#region src/utils/yaml-merge.ts
-const IGNORE_PATTERN = "@bensandee/tooling:ignore";
-const FORGEJO_SCHEMA_COMMENT = "# yaml-language-server: $schema=../../.vscode/forgejo-workflow.schema.json\n";
-/** Returns a yaml-language-server schema comment for Forgejo workflows, empty string otherwise. */
-function workflowSchemaComment(ci) {
-	return ci === "forgejo" ? FORGEJO_SCHEMA_COMMENT : "";
-}
-/** Prepend the Forgejo schema comment if it's not already present. No-op for GitHub. */
-function ensureSchemaComment(content, ci) {
-	if (ci !== "forgejo") return content;
-	if (content.includes("yaml-language-server")) return content;
-	return FORGEJO_SCHEMA_COMMENT + content;
-}
-/** Migrate content from old tooling binary name to new. */
-function migrateToolingBinary(content) {
-	return content.replaceAll("pnpm exec tooling ", "pnpm exec bst ");
-}
-/** Check if a YAML file has an opt-out comment in the first 10 lines. */
-function isToolingIgnored(content) {
-	return content.split("\n", 10).some((line) => line.includes(IGNORE_PATTERN));
+//#region src/release/docker.ts
+const ToolingDockerMapSchema = z.record(z.string(), z.object({
+	dockerfile: z.string(),
+	context: z.string().default(".")
+}));
+const ToolingConfigDockerSchema = z.object({ docker: ToolingDockerMapSchema.optional() });
+const PackageInfoSchema = z.object({
+	name: z.string().optional(),
+	version: z.string().optional()
+});
+/** Read the docker map from .tooling.json. Returns empty record if missing or invalid. */
+function loadDockerMap(executor, cwd) {
+	const configPath = path.join(cwd, ".tooling.json");
+	const raw = executor.readFile(configPath);
+	if (!raw) return {};
+	try {
+		const result = ToolingConfigDockerSchema.safeParse(JSON.parse(raw));
+		if (!result.success || !result.data.docker) return {};
+		return result.data.docker;
+	} catch (_error) {
+		return {};
+	}
 }
-/**
-* Ensure required commands exist under `pre-commit.commands` in a lefthook config.
-* Only adds missing commands — never modifies existing ones.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
-*/
-function mergeLefthookCommands(existing, requiredCommands) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
+/** Read name and version from a package's package.json. */
+function readPackageInfo(executor, packageJsonPath) {
+	const raw = executor.readFile(packageJsonPath);
+	if (!raw) return {
+		name: void 0,
+		version: void 0
 	};
 	try {
-		const doc = parseDocument(existing);
-		let changed = false;
-		if (!doc.hasIn(["pre-commit", "commands"])) {
-			doc.setIn(["pre-commit", "commands"], requiredCommands);
-			return {
-				content: doc.toString(),
-				changed: true
-			};
-		}
-		const commands = doc.getIn(["pre-commit", "commands"]);
-		if (!isMap(commands)) return {
-			content: existing,
-			changed: false
+		const result = PackageInfoSchema.safeParse(JSON.parse(raw));
+		if (!result.success) return {
+			name: void 0,
+			version: void 0
 		};
-		for (const [name, config] of Object.entries(requiredCommands)) if (!commands.has(name)) {
-			commands.set(name, config);
-			changed = true;
-		}
 		return {
-			content: changed ? doc.toString() : existing,
-			changed
+			name: result.data.name,
+			version: result.data.version
 		};
-	} catch {
+	} catch (_error) {
 		return {
-			content: existing,
-			changed: false
+			name: void 0,
+			version: void 0
 		};
 	}
 }
+/** Strip npm scope from a package name: "@scope/foo" → "foo", "foo" → "foo". */
+function stripScope(name) {
+	const slashIndex = name.indexOf("/");
+	return name.startsWith("@") && slashIndex !== -1 ? name.slice(slashIndex + 1) : name;
+}
+/** Convention paths to check for Dockerfiles in a package directory. */
+const CONVENTION_DOCKERFILE_PATHS = ["Dockerfile", "docker/Dockerfile"];
 /**
-* Ensure required steps exist in a workflow job's steps array.
-* Only adds missing steps at the end — never modifies existing ones.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+* Find a Dockerfile at convention paths for a monorepo package.
+* Checks packages/{dir}/Dockerfile and packages/{dir}/docker/Dockerfile.
 */
-function mergeWorkflowSteps(existing, jobName, requiredSteps) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
-	};
-	try {
-		const doc = parseDocument(existing);
-		const steps = doc.getIn([
-			"jobs",
-			jobName,
-			"steps"
-		]);
-		if (!isSeq(steps)) return {
-			content: existing,
-			changed: false
-		};
-		let changed = false;
-		for (const { match, step } of requiredSteps) if (!steps.items.some((item) => {
-			if (!isMap(item)) return false;
-			if (match.run) {
-				const run = item.get("run");
-				return typeof run === "string" && run.includes(match.run);
-			}
-			if (match.uses) {
-				const uses = item.get("uses");
-				return typeof uses === "string" && uses.startsWith(match.uses);
-			}
-			return false;
-		})) {
-			steps.add(doc.createNode(step));
-			changed = true;
-		}
-		return {
-			content: changed ? doc.toString() : existing,
-			changed
-		};
-	} catch {
-		return {
-			content: existing,
-			changed: false
+function findConventionDockerfile(executor, cwd, dir) {
+	for (const rel of CONVENTION_DOCKERFILE_PATHS) {
+		const dockerfilePath = `packages/${dir}/${rel}`;
+		if (executor.readFile(path.join(cwd, dockerfilePath)) !== null) return {
+			dockerfile: dockerfilePath,
+			context: "."
 		};
 	}
 }
 /**
-* Add a job to an existing workflow YAML if it doesn't already exist.
-* Returns unchanged content if the job already exists, the file has an opt-out comment,
-* or the document can't be parsed.
+* Find a Dockerfile at convention paths for a single-package repo.
+* Checks Dockerfile and docker/Dockerfile at the project root.
 */
+function findRootDockerfile(executor, cwd) {
+	for (const rel of CONVENTION_DOCKERFILE_PATHS) if (executor.readFile(path.join(cwd, rel)) !== null) return {
+		dockerfile: rel,
+		context: "."
+	};
+}
 /**
-* Ensure a `concurrency` block exists at the workflow top level.
-* Adds it if missing — never modifies an existing one.
-* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+* Discover Docker packages by convention and merge with .tooling.json overrides.
+*
+* Convention: any package with a Dockerfile or docker/Dockerfile is a Docker package.
+* For monorepos, scans packages/{name}/. For single-package repos, scans the root.
+* The docker map in .tooling.json overrides convention-discovered config and can add
+* packages at non-standard locations.
+*
+* Image names are derived from {root-name}-{package-name} using each package's package.json name.
+* Versions are read from each package's own package.json.
 */
-function ensureWorkflowConcurrency(existing, concurrency) {
-	if (isToolingIgnored(existing)) return {
-		content: existing,
-		changed: false
-	};
-	try {
-		const doc = parseDocument(existing);
-		if (doc.has("concurrency")) return {
-			content: existing,
-			changed: false
-		};
-		doc.set("concurrency", concurrency);
-		const contents = doc.contents;
-		if (isMap(contents)) {
-			const items = contents.items;
-			const nameIdx = items.findIndex((p) => isScalar(p.key) && p.key.value === "name");
-			const concPair = items.pop();
-			if (concPair) items.splice(nameIdx + 1, 0, concPair);
+function detectDockerPackages(executor, cwd, repoName) {
+	const overrides = loadDockerMap(executor, cwd);
+	const packageDirs = executor.listPackageDirs(cwd);
+	const packages = [];
+	const seen = /* @__PURE__ */ new Set();
+	if (packageDirs.length > 0) {
+		for (const dir of packageDirs) {
+			const convention = findConventionDockerfile(executor, cwd, dir);
+			const docker = overrides[dir] ?? convention;
+			if (docker) {
+				const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+				packages.push({
+					dir,
+					imageName: `${repoName}-${stripScope(name ?? dir)}`,
+					version,
+					docker
+				});
+				seen.add(dir);
+			}
+		}
+		for (const [dir, docker] of Object.entries(overrides)) if (!seen.has(dir)) {
+			const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+			packages.push({
+				dir,
+				imageName: `${repoName}-${stripScope(name ?? dir)}`,
+				version,
+				docker
+			});
+		}
+	} else {
+		const convention = findRootDockerfile(executor, cwd);
+		const docker = overrides["."] ?? convention;
+		if (docker) {
+			const { name, version } = readPackageInfo(executor, path.join(cwd, "package.json"));
+			packages.push({
+				dir: ".",
+				imageName: stripScope(name ?? repoName),
+				version,
+				docker
+			});
 		}
-		return {
-			content: doc.toString(),
-			changed: true
-		};
-	} catch {
-		return {
-			content: existing,
-			changed: false
-		};
 	}
+	return packages;
 }
-//#endregion
-//#region src/generators/deploy-ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr$2(expr) {
-	return `\${{ ${expr} }}`;
-}
-function hasEnginesNode$2(ctx) {
-	return typeof ctx.packageJson?.["engines"]?.["node"] === "string";
-}
-function deployWorkflow(ci, nodeVersionYaml) {
-	return `${workflowSchemaComment(ci)}name: Deploy
-on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
+/**
+* Read docker config for a single package, checking convention paths first,
+* then .tooling.json overrides. Used by the per-package image:build script.
+*/
+function readSinglePackageDocker(executor, cwd, packageDir, repoName) {
+	const dir = path.basename(path.resolve(cwd, packageDir));
+	const convention = findConventionDockerfile(executor, cwd, dir);
+	const docker = loadDockerMap(executor, cwd)[dir] ?? convention;
+	if (!docker) throw new FatalError(`No Dockerfile found for package "${dir}" (checked convention paths and .tooling.json)`);
+	const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+	return {
+		dir,
+		imageName: `${repoName}-${stripScope(name ?? dir)}`,
+		version,
+		docker
+	};
+}
+/** Parse semver version string into major, minor, patch components. */
+function parseSemver(version) {
+	const clean = version.replace(/^v/, "");
+	const match = /^(\d+)\.(\d+)\.(\d+)/.exec(clean);
+	if (!match?.[1] || !match[2] || !match[3]) throw new FatalError(`Invalid semver version: ${version}`);
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3])
+	};
+}
+/** Generate semver tag variants: latest, vX.Y.Z, vX.Y, vX */
+function generateTags(version) {
+	const { major, minor, patch } = parseSemver(version);
+	return [
+		"latest",
+		`v${major}.${minor}.${patch}`,
+		`v${major}.${minor}`,
+		`v${major}`
+	];
+}
+/** Build the full image reference: namespace/imageName:tag */
+function imageRef(namespace, imageName, tag) {
+	return `${namespace}/${imageName}:${tag}`;
+}
+function log$1(message) {
+	console.log(message);
+}
+/** Read the repo name from root package.json. */
+function readRepoName(executor, cwd) {
+	const rootPkgRaw = executor.readFile(path.join(cwd, "package.json"));
+	if (!rootPkgRaw) throw new FatalError("No package.json found in project root");
+	const repoName = parsePackageJson(rootPkgRaw)?.name;
+	if (!repoName) throw new FatalError("Root package.json must have a name field");
+	return repoName;
+}
+/** Build a single docker image from its config. Paths are resolved relative to cwd. */
+function buildImage(executor, pkg, cwd, extraArgs) {
+	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
+	const contextPath = path.resolve(cwd, pkg.docker.context);
+	const command = [
+		"docker build",
+		`-f ${dockerfilePath}`,
+		`-t ${pkg.imageName}:latest`,
+		...extraArgs,
+		contextPath
+	].join(" ");
+	executor.execInherit(command);
+}
+/**
+* Detect packages with docker config in .tooling.json and build each one.
+* Runs `docker build -f <dockerfile> -t <image-name>:latest <context>` for each package.
+* Dockerfile and context paths are resolved relative to the project root.
+*
+* When `packageDir` is set, builds only that single package (for use as an image:build script).
+*/
+function runDockerBuild(executor, config) {
+	const repoName = readRepoName(executor, config.cwd);
+	if (config.packageDir) {
+		const pkg = readSinglePackageDocker(executor, config.cwd, config.packageDir, repoName);
+		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
+		buildImage(executor, pkg, config.cwd, config.extraArgs);
+		log$1(`Built ${pkg.imageName}:latest`);
+		return { packages: [pkg] };
+	}
+	const packages = detectDockerPackages(executor, config.cwd, repoName);
+	if (packages.length === 0) {
+		log$1("No packages with docker config found");
+		return { packages: [] };
+	}
+	log$1(`Found ${packages.length} Docker package(s): ${packages.map((p) => p.dir).join(", ")}`);
+	for (const pkg of packages) {
+		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
+		buildImage(executor, pkg, config.cwd, config.extraArgs);
+	}
+	log$1(`Built ${packages.length} image(s)`);
+	return { packages };
+}
+/**
+* Run the full Docker publish pipeline:
+* 1. Build all images via runDockerBuild
+* 2. Login to registry
+* 3. Tag each image with semver variants from its own package.json version
+* 4. Push all tags
+* 5. Logout from registry
+*/
+function runDockerPublish(executor, config) {
+	const { packages } = runDockerBuild(executor, {
+		cwd: config.cwd,
+		packageDir: void 0,
+		extraArgs: []
+	});
+	if (packages.length === 0) return {
+		packages: [],
+		tags: []
+	};
+	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
+	if (!config.dryRun) {
+		log$1(`Logging in to ${config.registryHost}...`);
+		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
+		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
+	} else log$1("[dry-run] Skipping docker login");
+	const allTags = [];
+	try {
+		for (const pkg of packages) {
+			const tags = generateTags(pkg.version ?? "");
+			log$1(`${pkg.dir} v${pkg.version} → tags: ${tags.join(", ")}`);
+			for (const tag of tags) {
+				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
+				allTags.push(ref);
+				log$1(`Tagging ${pkg.imageName} → ${ref}`);
+				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
+				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
+				if (!config.dryRun) {
+					log$1(`Pushing ${ref}...`);
+					const pushResult = executor.exec(`docker push ${ref}`);
+					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
+				} else log$1(`[dry-run] Skipping push for ${ref}`);
+			}
+		}
+	} finally {
+		if (!config.dryRun) {
+			log$1(`Logging out from ${config.registryHost}...`);
+			executor.exec(`docker logout ${config.registryHost}`);
+		}
+	}
+	log$1(`Published ${allTags.length} image tag(s)`);
+	return {
+		packages,
+		tags: allTags
+	};
+}
+//#endregion
+//#region src/utils/yaml-merge.ts
+const IGNORE_PATTERN = "@bensandee/tooling:ignore";
+const FORGEJO_SCHEMA_COMMENT = "# yaml-language-server: $schema=../../.vscode/forgejo-workflow.schema.json\n";
+/** Returns a yaml-language-server schema comment for Forgejo workflows, empty string otherwise. */
+function workflowSchemaComment(ci) {
+	return ci === "forgejo" ? FORGEJO_SCHEMA_COMMENT : "";
+}
+/** Prepend the Forgejo schema comment if it's not already present. No-op for GitHub. */
+function ensureSchemaComment(content, ci) {
+	if (ci !== "forgejo") return content;
+	if (content.includes("yaml-language-server")) return content;
+	return FORGEJO_SCHEMA_COMMENT + content;
+}
+/** Migrate content from old tooling binary name to new. */
+function migrateToolingBinary(content) {
+	return content.replaceAll("pnpm exec tooling ", "pnpm exec bst ");
+}
+/** Check if a YAML file has an opt-out comment in the first 10 lines. */
+function isToolingIgnored(content) {
+	return content.split("\n", 10).some((line) => line.includes(IGNORE_PATTERN));
+}
+/**
+* Ensure required commands exist under `pre-commit.commands` in a lefthook config.
+* Only adds missing commands — never modifies existing ones.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+function mergeLefthookCommands(existing, requiredCommands) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
+	};
+	try {
+		const doc = parseDocument(existing);
+		let changed = false;
+		if (!doc.hasIn(["pre-commit", "commands"])) {
+			doc.setIn(["pre-commit", "commands"], requiredCommands);
+			return {
+				content: doc.toString(),
+				changed: true
+			};
+		}
+		const commands = doc.getIn(["pre-commit", "commands"]);
+		if (!isMap(commands)) return {
+			content: existing,
+			changed: false
+		};
+		for (const [name, config] of Object.entries(requiredCommands)) if (!commands.has(name)) {
+			commands.set(name, config);
+			changed = true;
+		}
+		return {
+			content: changed ? doc.toString() : existing,
+			changed
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
+	}
+}
+/**
+* Ensure required steps exist in a workflow job's steps array.
+* Only adds missing steps at the end — never modifies existing ones.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+function mergeWorkflowSteps(existing, jobName, requiredSteps) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
+	};
+	try {
+		const doc = parseDocument(existing);
+		const steps = doc.getIn([
+			"jobs",
+			jobName,
+			"steps"
+		]);
+		if (!isSeq(steps)) return {
+			content: existing,
+			changed: false
+		};
+		let changed = false;
+		for (const { match, step } of requiredSteps) if (!steps.items.some((item) => {
+			if (!isMap(item)) return false;
+			if (match.run) {
+				const run = item.get("run");
+				return typeof run === "string" && run.includes(match.run);
+			}
+			if (match.uses) {
+				const uses = item.get("uses");
+				return typeof uses === "string" && uses.startsWith(match.uses);
+			}
+			return false;
+		})) {
+			steps.add(doc.createNode(step));
+			changed = true;
+		}
+		return {
+			content: changed ? doc.toString() : existing,
+			changed
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
+	}
+}
+/**
+* Add a job to an existing workflow YAML if it doesn't already exist.
+* Returns unchanged content if the job already exists, the file has an opt-out comment,
+* or the document can't be parsed.
+*/
+/**
+* Ensure a `concurrency` block exists at the workflow top level.
+* Adds it if missing — never modifies an existing one.
+* Returns unchanged content if the file has an opt-out comment or can't be parsed.
+*/
+/**
+* Ensure `on.push` has `tags-ignore: ["**"]` so tag pushes don't trigger CI.
+* Only adds the filter when `on.push` exists and `tags-ignore` is absent.
+*/
+function ensureWorkflowTagsIgnore(existing) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
+	};
+	try {
+		const doc = parseDocument(existing);
+		const on = doc.get("on");
+		if (!isMap(on)) return {
+			content: existing,
+			changed: false
+		};
+		const push = on.get("push");
+		if (!isMap(push)) return {
+			content: existing,
+			changed: false
+		};
+		if (push.has("tags-ignore")) return {
+			content: existing,
+			changed: false
+		};
+		push.set("tags-ignore", ["**"]);
+		return {
+			content: doc.toString(),
+			changed: true
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
+	}
+}
+function ensureWorkflowConcurrency(existing, concurrency) {
+	if (isToolingIgnored(existing)) return {
+		content: existing,
+		changed: false
+	};
+	try {
+		const doc = parseDocument(existing);
+		if (doc.has("concurrency")) return {
+			content: existing,
+			changed: false
+		};
+		doc.set("concurrency", concurrency);
+		const contents = doc.contents;
+		if (isMap(contents)) {
+			const items = contents.items;
+			const nameIdx = items.findIndex((p) => isScalar(p.key) && p.key.value === "name");
+			const concPair = items.pop();
+			if (concPair) items.splice(nameIdx + 1, 0, concPair);
+		}
+		return {
+			content: doc.toString(),
+			changed: true
+		};
+	} catch {
+		return {
+			content: existing,
+			changed: false
+		};
+	}
+}
+//#endregion
+//#region src/generators/ci-utils.ts
+/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
+function actionsExpr(expr) {
+	return `\${{ ${expr} }}`;
+}
+function hasEnginesNode(ctx) {
+	const raw = ctx.read("package.json");
+	if (!raw) return false;
+	return typeof parsePackageJson(raw)?.engines?.["node"] === "string";
+}
+function computeNodeVersionYaml(ctx) {
+	return hasEnginesNode(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
+}
+//#endregion
+//#region src/generators/publish-ci.ts
+function deployWorkflow(ci, nodeVersionYaml) {
+	return `${workflowSchemaComment(ci)}name: Publish
+on:
+  push:
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+"
 
 jobs:
-  deploy:
+  publish:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -828,10 +1154,10 @@ jobs:
       - run: pnpm install --frozen-lockfile
       - name: Publish Docker images
         env:
-          DOCKER_REGISTRY_HOST: ${actionsExpr$2("vars.DOCKER_REGISTRY_HOST")}
-          DOCKER_REGISTRY_NAMESPACE: ${actionsExpr$2("vars.DOCKER_REGISTRY_NAMESPACE")}
-          DOCKER_USERNAME: ${actionsExpr$2("secrets.DOCKER_USERNAME")}
-          DOCKER_PASSWORD: ${actionsExpr$2("secrets.DOCKER_PASSWORD")}
+          DOCKER_REGISTRY_HOST: ${actionsExpr("vars.DOCKER_REGISTRY_HOST")}
+          DOCKER_REGISTRY_NAMESPACE: ${actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")}
+          DOCKER_USERNAME: ${actionsExpr("secrets.DOCKER_USERNAME")}
+          DOCKER_PASSWORD: ${actionsExpr("secrets.DOCKER_PASSWORD")}
         run: pnpm exec bst docker:publish
 `;
 }
@@ -859,8 +1185,6 @@ function requiredDeploySteps() {
 		}
 	];
 }
-/** Convention paths to check for Dockerfiles. */
-const CONVENTION_DOCKERFILE_PATHS$1 = ["Dockerfile", "docker/Dockerfile"];
 const DockerMapSchema = z.object({ docker: z.record(z.string(), z.unknown()).optional() });
 /** Get names of packages that have Docker builds (by convention or .tooling.json config). */
 function getDockerPackageNames(ctx) {
@@ -875,12 +1199,12 @@ function getDockerPackageNames(ctx) {
 		for (const pkg of packages) {
 			const dirName = pkg.name.split("/").pop() ?? pkg.name;
 			if (names.includes(dirName)) continue;
-			for (const rel of CONVENTION_DOCKERFILE_PATHS$1) if (ctx.exists(`packages/${dirName}/${rel}`)) {
+			for (const rel of CONVENTION_DOCKERFILE_PATHS) if (ctx.exists(`packages/${dirName}/${rel}`)) {
 				names.push(dirName);
 				break;
 			}
 		}
-	} else for (const rel of CONVENTION_DOCKERFILE_PATHS$1) if (ctx.exists(rel)) {
+	} else for (const rel of CONVENTION_DOCKERFILE_PATHS) if (ctx.exists(rel)) {
 		if (!names.includes(ctx.config.name)) names.push(ctx.config.name);
 		break;
 	}
@@ -899,7 +1223,7 @@ async function generateDeployCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const nodeVersionYaml = hasEnginesNode$2(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const content = deployWorkflow(ctx.config.ci, nodeVersionYaml);
 	if (ctx.exists(workflowPath)) {
 		const raw = ctx.read(workflowPath);
@@ -911,16 +1235,16 @@ async function generateDeployCi(ctx) {
 					return {
 						filePath: workflowPath,
 						action: "updated",
-						description: "Migrated tooling binary name in deploy workflow"
+						description: "Migrated tooling binary name in publish workflow"
 					};
 				}
 				return {
 					filePath: workflowPath,
 					action: "skipped",
-					description: "Deploy workflow already up to date"
+					description: "Publish workflow already up to date"
 				};
 			}
-			const merged = mergeWorkflowSteps(existing, "deploy", requiredDeploySteps());
+			const merged = mergeWorkflowSteps(existing, "publish", requiredDeploySteps());
 			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
 			if (!merged.changed) {
 				if (withComment !== raw) {
@@ -928,33 +1252,33 @@ async function generateDeployCi(ctx) {
 					return {
 						filePath: workflowPath,
 						action: "updated",
-						description: existing !== raw ? "Migrated tooling binary name in deploy workflow" : "Added schema comment to deploy workflow"
+						description: existing !== raw ? "Migrated tooling binary name in publish workflow" : "Added schema comment to publish workflow"
 					};
 				}
 				return {
 					filePath: workflowPath,
 					action: "skipped",
-					description: "Existing deploy workflow preserved"
+					description: "Existing publish workflow preserved"
 				};
 			}
 			ctx.write(workflowPath, withComment);
 			return {
 				filePath: workflowPath,
 				action: "updated",
-				description: "Added missing steps to deploy workflow"
+				description: "Added missing steps to publish workflow"
 			};
 		}
 		return {
 			filePath: workflowPath,
 			action: "skipped",
-			description: "Deploy workflow already up to date"
+			description: "Publish workflow already up to date"
 		};
 	}
 	ctx.write(workflowPath, content);
 	return {
 		filePath: workflowPath,
 		action: "created",
-		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions deploy workflow`
+		description: `Generated ${isGitHub ? "GitHub" : "Forgejo"} Actions publish workflow`
 	};
 }
 //#endregion
@@ -1054,7 +1378,7 @@ function getAddedDevDepNames(config) {
 	const deps = { ...ROOT_DEV_DEPS };
 	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
 	deps["@bensandee/config"] = "0.9.1";
-	deps["@bensandee/tooling"] = "0.27.1";
+	deps["@bensandee/tooling"] = "0.28.1";
 	if (config.formatter === "oxfmt") deps["oxfmt"] = "0.35.0";
 	if (config.formatter === "prettier") deps["prettier"] = "3.8.1";
 	addReleaseDeps(deps, config);
@@ -1079,7 +1403,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.27.1";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.28.1";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = "0.35.0";
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = "3.8.1";
@@ -1563,30 +1887,23 @@ async function generateGitignore(ctx) {
 }
 //#endregion
 //#region src/generators/ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr$1(expr) {
-	return `\${{ ${expr} }}`;
-}
 const CI_CONCURRENCY = {
-	group: `ci-${actionsExpr$1("github.ref")}`,
-	"cancel-in-progress": actionsExpr$1("github.ref != 'refs/heads/main'")
+	group: `ci-${actionsExpr("github.ref")}`,
+	"cancel-in-progress": actionsExpr("github.ref != 'refs/heads/main'")
 };
-function hasEnginesNode$1(ctx) {
-	const raw = ctx.read("package.json");
-	if (!raw) return false;
-	return typeof parsePackageJson(raw)?.engines?.["node"] === "string";
-}
 function ciWorkflow(nodeVersionYaml, isForgejo, isChangesets) {
 	const emailNotifications = isForgejo ? "\nenable-email-notifications: true\n" : "";
 	const concurrencyBlock = isChangesets ? `
 concurrency:
-  group: ci-${actionsExpr$1("github.ref")}
-  cancel-in-progress: ${actionsExpr$1("github.ref != 'refs/heads/main'")}
+  group: ci-${actionsExpr("github.ref")}
+  cancel-in-progress: ${actionsExpr("github.ref != 'refs/heads/main'")}
 ` : "";
 	return `${workflowSchemaComment(isForgejo ? "forgejo" : "github")}name: CI
 ${emailNotifications}on:
   push:
     branches: [main]
+    tags-ignore:
+      - "**"
   pull_request:
 ${concurrencyBlock}
 jobs:
@@ -1649,13 +1966,18 @@ async function generateCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const isChangesets = ctx.config.releaseStrategy === "changesets";
-	const nodeVersionYaml = hasEnginesNode$1(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
 	const content = ciWorkflow(nodeVersionYaml, !isGitHub, isChangesets);
 	if (ctx.exists(filePath)) {
 		const existing = ctx.read(filePath);
 		if (existing) {
 			let result = mergeWorkflowSteps(existing, "check", requiredCheckSteps(nodeVersionYaml));
+			const withTagsIgnore = ensureWorkflowTagsIgnore(result.content);
+			result = {
+				content: withTagsIgnore.content,
+				changed: result.changed || withTagsIgnore.changed
+			};
 			if (isChangesets) {
 				const withConcurrency = ensureWorkflowConcurrency(result.content, CI_CONCURRENCY);
 				result = {
@@ -2155,13 +2477,6 @@ async function generateChangesets(ctx) {
 }
 //#endregion
 //#region src/generators/release-ci.ts
-/** Build a GitHub Actions expression like `${{ expr }}` without triggering no-template-curly-in-string. */
-function actionsExpr(expr) {
-	return `\${{ ${expr} }}`;
-}
-function hasEnginesNode(ctx) {
-	return typeof ctx.packageJson?.["engines"]?.["node"] === "string";
-}
 function commonSteps(nodeVersionYaml, publishesNpm) {
 	return `      - uses: actions/checkout@v4
         with:
@@ -2171,8 +2486,7 @@ function commonSteps(nodeVersionYaml, publishesNpm) {
         with:
           ${nodeVersionYaml}
           cache: pnpm${publishesNpm ? `\n          registry-url: "https://registry.npmjs.org"` : ""}
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm build`;
+      - run: pnpm install --frozen-lockfile`;
 }
 function releaseItWorkflow(ci, nodeVersionYaml, publishesNpm) {
 	const isGitHub = ci === "github";
@@ -2289,10 +2603,6 @@ function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
 		{
 			match: { run: "pnpm install" },
 			step: { run: "pnpm install --frozen-lockfile" }
-		},
-		{
-			match: { run: "build" },
-			step: { run: "pnpm build" }
 		}
 	];
 	switch (strategy) {
@@ -2369,7 +2679,7 @@ async function generateReleaseCi(ctx) {
 	if (ctx.config.releaseStrategy === "changesets") return generateChangesetsReleaseCi(ctx, publishesNpm);
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
-	const nodeVersionYaml = hasEnginesNode(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
+	const nodeVersionYaml = computeNodeVersionYaml(ctx);
 	const content = buildWorkflow(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm);
 	if (!content) return {
 		filePath,
@@ -2589,411 +2899,129 @@ async function generateLefthook(ctx) {
 const SCHEMA_NPM_PATH = "@bensandee/config/schemas/forgejo-workflow.schema.json";
 const SCHEMA_LOCAL_PATH = ".vscode/forgejo-workflow.schema.json";
 const SETTINGS_PATH = ".vscode/settings.json";
-const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
-const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
-function readSchemaFromNodeModules(targetDir) {
-	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
-	if (!existsSync(candidate)) return void 0;
-	return readFileSync(candidate, "utf-8");
-}
-function serializeSettings(settings) {
-	return JSON.stringify(settings, null, 2) + "\n";
-}
-const YamlSchemasSchema = z.record(z.string(), z.unknown());
-/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
-function mergeYamlSchemas(settings) {
-	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
-	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
-	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
-		merged: settings,
-		changed: false
-	};
-	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
-	return {
-		merged: {
-			...settings,
-			"yaml.schemas": yamlSchemas
-		},
-		changed: true
-	};
-}
-function writeSchemaToSettings(ctx) {
-	if (ctx.exists(SETTINGS_PATH)) {
-		const raw = ctx.read(SETTINGS_PATH);
-		if (!raw) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Could not read existing settings"
-		};
-		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
-		if (!parsed.success) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Could not parse existing settings"
-		};
-		const { merged, changed } = mergeYamlSchemas(parsed.data);
-		if (!changed) return {
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Already has Forgejo schema mapping"
-		};
-		ctx.write(SETTINGS_PATH, serializeSettings(merged));
-		return {
-			filePath: SETTINGS_PATH,
-			action: "updated",
-			description: "Added Forgejo workflow schema mapping"
-		};
-	}
-	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
-	return {
-		filePath: SETTINGS_PATH,
-		action: "created",
-		description: "Generated .vscode/settings.json with Forgejo workflow schema"
-	};
-}
-async function generateVscodeSettings(ctx) {
-	const results = [];
-	if (ctx.config.ci !== "forgejo") {
-		results.push({
-			filePath: SETTINGS_PATH,
-			action: "skipped",
-			description: "Not a Forgejo project"
-		});
-		return results;
-	}
-	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
-	if (!schemaContent) {
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: "skipped",
-			description: "Could not find @bensandee/config schema in node_modules"
-		});
-		return results;
-	}
-	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
-	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
-		filePath: SCHEMA_LOCAL_PATH,
-		action: "skipped",
-		description: "Schema already up to date"
-	});
-	else {
-		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
-		results.push({
-			filePath: SCHEMA_LOCAL_PATH,
-			action: existingSchema ? "updated" : "created",
-			description: "Copied Forgejo workflow schema from @bensandee/config"
-		});
-	}
-	results.push(writeSchemaToSettings(ctx));
-	return results;
-}
-//#endregion
-//#region src/generators/pipeline.ts
-/** Run all generators sequentially and return their results. */
-async function runGenerators(ctx) {
-	const results = [];
-	results.push(await generatePackageJson(ctx));
-	results.push(await generatePnpmWorkspace(ctx));
-	results.push(...await generateTsconfig(ctx));
-	results.push(await generateTsdown(ctx));
-	results.push(await generateOxlint(ctx));
-	results.push(await generateFormatter(ctx));
-	results.push(...await generateLefthook(ctx));
-	results.push(await generateGitignore(ctx));
-	results.push(await generateKnip(ctx));
-	results.push(await generateRenovate(ctx));
-	results.push(await generateCi(ctx));
-	results.push(...await generateClaudeSettings(ctx));
-	results.push(await generateReleaseIt(ctx));
-	results.push(await generateChangesets(ctx));
-	results.push(await generateReleaseCi(ctx));
-	results.push(await generateDeployCi(ctx));
-	results.push(...await generateVitest(ctx));
-	results.push(...await generateVscodeSettings(ctx));
-	results.push(saveToolingConfig(ctx, ctx.config));
-	return results;
-}
-//#endregion
-//#region src/release/docker.ts
-const ToolingDockerMapSchema = z.record(z.string(), z.object({
-	dockerfile: z.string(),
-	context: z.string().default(".")
-}));
-const ToolingConfigDockerSchema = z.object({ docker: ToolingDockerMapSchema.optional() });
-const PackageInfoSchema = z.object({
-	name: z.string().optional(),
-	version: z.string().optional()
-});
-/** Read the docker map from .tooling.json. Returns empty record if missing or invalid. */
-function loadDockerMap(executor, cwd) {
-	const configPath = path.join(cwd, ".tooling.json");
-	const raw = executor.readFile(configPath);
-	if (!raw) return {};
-	try {
-		const result = ToolingConfigDockerSchema.safeParse(JSON.parse(raw));
-		if (!result.success || !result.data.docker) return {};
-		return result.data.docker;
-	} catch (_error) {
-		return {};
-	}
-}
-/** Read name and version from a package's package.json. */
-function readPackageInfo(executor, packageJsonPath) {
-	const raw = executor.readFile(packageJsonPath);
-	if (!raw) return {
-		name: void 0,
-		version: void 0
-	};
-	try {
-		const result = PackageInfoSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return {
-			name: void 0,
-			version: void 0
-		};
-		return {
-			name: result.data.name,
-			version: result.data.version
-		};
-	} catch (_error) {
-		return {
-			name: void 0,
-			version: void 0
-		};
-	}
-}
-/** Strip npm scope from a package name: "@scope/foo" → "foo", "foo" → "foo". */
-function stripScope(name) {
-	const slashIndex = name.indexOf("/");
-	return name.startsWith("@") && slashIndex !== -1 ? name.slice(slashIndex + 1) : name;
-}
-/** Convention paths to check for Dockerfiles in a package directory. */
-const CONVENTION_DOCKERFILE_PATHS = ["Dockerfile", "docker/Dockerfile"];
-/**
-* Find a Dockerfile at convention paths for a monorepo package.
-* Checks packages/{dir}/Dockerfile and packages/{dir}/docker/Dockerfile.
-*/
-function findConventionDockerfile(executor, cwd, dir) {
-	for (const rel of CONVENTION_DOCKERFILE_PATHS) {
-		const dockerfilePath = `packages/${dir}/${rel}`;
-		if (executor.readFile(path.join(cwd, dockerfilePath)) !== null) return {
-			dockerfile: dockerfilePath,
-			context: "."
-		};
-	}
-}
-/**
-* Find a Dockerfile at convention paths for a single-package repo.
-* Checks Dockerfile and docker/Dockerfile at the project root.
-*/
-function findRootDockerfile(executor, cwd) {
-	for (const rel of CONVENTION_DOCKERFILE_PATHS) if (executor.readFile(path.join(cwd, rel)) !== null) return {
-		dockerfile: rel,
-		context: "."
-	};
-}
-/**
-* Discover Docker packages by convention and merge with .tooling.json overrides.
-*
-* Convention: any package with a Dockerfile or docker/Dockerfile is a Docker package.
-* For monorepos, scans packages/{name}/. For single-package repos, scans the root.
-* The docker map in .tooling.json overrides convention-discovered config and can add
-* packages at non-standard locations.
-*
-* Image names are derived from {root-name}-{package-name} using each package's package.json name.
-* Versions are read from each package's own package.json.
-*/
-function detectDockerPackages(executor, cwd, repoName) {
-	const overrides = loadDockerMap(executor, cwd);
-	const packageDirs = executor.listPackageDirs(cwd);
-	const packages = [];
-	const seen = /* @__PURE__ */ new Set();
-	if (packageDirs.length > 0) {
-		for (const dir of packageDirs) {
-			const convention = findConventionDockerfile(executor, cwd, dir);
-			const docker = overrides[dir] ?? convention;
-			if (docker) {
-				const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
-				packages.push({
-					dir,
-					imageName: `${repoName}-${stripScope(name ?? dir)}`,
-					version,
-					docker
-				});
-				seen.add(dir);
-			}
-		}
-		for (const [dir, docker] of Object.entries(overrides)) if (!seen.has(dir)) {
-			const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
-			packages.push({
-				dir,
-				imageName: `${repoName}-${stripScope(name ?? dir)}`,
-				version,
-				docker
-			});
-		}
-	} else {
-		const convention = findRootDockerfile(executor, cwd);
-		const docker = overrides["."] ?? convention;
-		if (docker) {
-			const { name, version } = readPackageInfo(executor, path.join(cwd, "package.json"));
-			packages.push({
-				dir: ".",
-				imageName: stripScope(name ?? repoName),
-				version,
-				docker
-			});
-		}
-	}
-	return packages;
+const SCHEMA_GLOB = ".forgejo/workflows/*.{yml,yaml}";
+const VscodeSettingsSchema = z.looseObject({ "yaml.schemas": z.record(z.string(), z.unknown()).default({}) });
+function readSchemaFromNodeModules(targetDir) {
+	const candidate = path.join(targetDir, "node_modules", SCHEMA_NPM_PATH);
+	if (!existsSync(candidate)) return void 0;
+	return readFileSync(candidate, "utf-8");
 }
-/**
-* Read docker config for a single package, checking convention paths first,
-* then .tooling.json overrides. Used by the per-package image:build script.
-*/
-function readSinglePackageDocker(executor, cwd, packageDir, repoName) {
-	const dir = path.basename(path.resolve(cwd, packageDir));
-	const convention = findConventionDockerfile(executor, cwd, dir);
-	const docker = loadDockerMap(executor, cwd)[dir] ?? convention;
-	if (!docker) throw new FatalError(`No Dockerfile found for package "${dir}" (checked convention paths and .tooling.json)`);
-	const { name, version } = readPackageInfo(executor, path.join(cwd, "packages", dir, "package.json"));
+function serializeSettings(settings) {
+	return JSON.stringify(settings, null, 2) + "\n";
+}
+const YamlSchemasSchema = z.record(z.string(), z.unknown());
+/** Merge yaml.schemas into a settings object. Returns the result and whether anything changed. */
+function mergeYamlSchemas(settings) {
+	const parsed = YamlSchemasSchema.safeParse(settings["yaml.schemas"]);
+	const yamlSchemas = parsed.success ? { ...parsed.data } : {};
+	if (SCHEMA_LOCAL_PATH in yamlSchemas) return {
+		merged: settings,
+		changed: false
+	};
+	yamlSchemas[SCHEMA_LOCAL_PATH] = SCHEMA_GLOB;
 	return {
-		dir,
-		imageName: `${repoName}-${stripScope(name ?? dir)}`,
-		version,
-		docker
+		merged: {
+			...settings,
+			"yaml.schemas": yamlSchemas
+		},
+		changed: true
 	};
 }
-/** Parse semver version string into major, minor, patch components. */
-function parseSemver(version) {
-	const clean = version.replace(/^v/, "");
-	const match = /^(\d+)\.(\d+)\.(\d+)/.exec(clean);
-	if (!match?.[1] || !match[2] || !match[3]) throw new FatalError(`Invalid semver version: ${version}`);
+function writeSchemaToSettings(ctx) {
+	if (ctx.exists(SETTINGS_PATH)) {
+		const raw = ctx.read(SETTINGS_PATH);
+		if (!raw) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not read existing settings"
+		};
+		const parsed = VscodeSettingsSchema.safeParse(parse(raw));
+		if (!parsed.success) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Could not parse existing settings"
+		};
+		const { merged, changed } = mergeYamlSchemas(parsed.data);
+		if (!changed) return {
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Already has Forgejo schema mapping"
+		};
+		ctx.write(SETTINGS_PATH, serializeSettings(merged));
+		return {
+			filePath: SETTINGS_PATH,
+			action: "updated",
+			description: "Added Forgejo workflow schema mapping"
+		};
+	}
+	ctx.write(SETTINGS_PATH, serializeSettings({ "yaml.schemas": { [SCHEMA_LOCAL_PATH]: SCHEMA_GLOB } }));
 	return {
-		major: Number(match[1]),
-		minor: Number(match[2]),
-		patch: Number(match[3])
+		filePath: SETTINGS_PATH,
+		action: "created",
+		description: "Generated .vscode/settings.json with Forgejo workflow schema"
 	};
 }
-/** Generate semver tag variants: latest, vX.Y.Z, vX.Y, vX */
-function generateTags(version) {
-	const { major, minor, patch } = parseSemver(version);
-	return [
-		"latest",
-		`v${major}.${minor}.${patch}`,
-		`v${major}.${minor}`,
-		`v${major}`
-	];
-}
-/** Build the full image reference: namespace/imageName:tag */
-function imageRef(namespace, imageName, tag) {
-	return `${namespace}/${imageName}:${tag}`;
-}
-function log$1(message) {
-	console.log(message);
-}
-/** Read the repo name from root package.json. */
-function readRepoName(executor, cwd) {
-	const rootPkgRaw = executor.readFile(path.join(cwd, "package.json"));
-	if (!rootPkgRaw) throw new FatalError("No package.json found in project root");
-	const repoName = parsePackageJson(rootPkgRaw)?.name;
-	if (!repoName) throw new FatalError("Root package.json must have a name field");
-	return repoName;
-}
-/** Build a single docker image from its config. Paths are resolved relative to cwd. */
-function buildImage(executor, pkg, cwd, extraArgs) {
-	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
-	const contextPath = path.resolve(cwd, pkg.docker.context);
-	const command = [
-		"docker build",
-		`-f ${dockerfilePath}`,
-		`-t ${pkg.imageName}:latest`,
-		...extraArgs,
-		contextPath
-	].join(" ");
-	executor.execInherit(command);
-}
-/**
-* Detect packages with docker config in .tooling.json and build each one.
-* Runs `docker build -f <dockerfile> -t <image-name>:latest <context>` for each package.
-* Dockerfile and context paths are resolved relative to the project root.
-*
-* When `packageDir` is set, builds only that single package (for use as an image:build script).
-*/
-function runDockerBuild(executor, config) {
-	const repoName = readRepoName(executor, config.cwd);
-	if (config.packageDir) {
-		const pkg = readSinglePackageDocker(executor, config.cwd, config.packageDir, repoName);
-		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
-		buildImage(executor, pkg, config.cwd, config.extraArgs);
-		log$1(`Built ${pkg.imageName}:latest`);
-		return { packages: [pkg] };
-	}
-	const packages = detectDockerPackages(executor, config.cwd, repoName);
-	if (packages.length === 0) {
-		log$1("No packages with docker config found");
-		return { packages: [] };
+async function generateVscodeSettings(ctx) {
+	const results = [];
+	if (ctx.config.ci !== "forgejo") {
+		results.push({
+			filePath: SETTINGS_PATH,
+			action: "skipped",
+			description: "Not a Forgejo project"
+		});
+		return results;
 	}
-	log$1(`Found ${packages.length} Docker package(s): ${packages.map((p) => p.dir).join(", ")}`);
-	for (const pkg of packages) {
-		log$1(`Building image for ${pkg.dir} (${pkg.imageName}:latest)...`);
-		buildImage(executor, pkg, config.cwd, config.extraArgs);
+	const schemaContent = readSchemaFromNodeModules(ctx.targetDir);
+	if (!schemaContent) {
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: "skipped",
+			description: "Could not find @bensandee/config schema in node_modules"
+		});
+		return results;
 	}
-	log$1(`Built ${packages.length} image(s)`);
-	return { packages };
-}
-/**
-* Run the full Docker publish pipeline:
-* 1. Build all images via runDockerBuild
-* 2. Login to registry
-* 3. Tag each image with semver variants from its own package.json version
-* 4. Push all tags
-* 5. Logout from registry
-*/
-function runDockerPublish(executor, config) {
-	const { packages } = runDockerBuild(executor, {
-		cwd: config.cwd,
-		packageDir: void 0,
-		extraArgs: []
+	const existingSchema = ctx.read(SCHEMA_LOCAL_PATH);
+	if (existingSchema !== void 0 && contentEqual(SCHEMA_LOCAL_PATH, existingSchema, schemaContent)) results.push({
+		filePath: SCHEMA_LOCAL_PATH,
+		action: "skipped",
+		description: "Schema already up to date"
 	});
-	if (packages.length === 0) return {
-		packages: [],
-		tags: []
-	};
-	for (const pkg of packages) if (!pkg.version) throw new FatalError(`Package ${pkg.dir} has docker config but no version in package.json`);
-	if (!config.dryRun) {
-		log$1(`Logging in to ${config.registryHost}...`);
-		const loginResult = executor.exec(`echo "${config.password}" | docker login ${config.registryHost} -u ${config.username} --password-stdin`);
-		if (loginResult.exitCode !== 0) throw new FatalError(`Docker login failed: ${loginResult.stderr}`);
-	} else log$1("[dry-run] Skipping docker login");
-	const allTags = [];
-	try {
-		for (const pkg of packages) {
-			const tags = generateTags(pkg.version ?? "");
-			log$1(`${pkg.dir} v${pkg.version} → tags: ${tags.join(", ")}`);
-			for (const tag of tags) {
-				const ref = imageRef(config.registryNamespace, pkg.imageName, tag);
-				allTags.push(ref);
-				log$1(`Tagging ${pkg.imageName} → ${ref}`);
-				const tagResult = executor.exec(`docker tag ${pkg.imageName} ${ref}`);
-				if (tagResult.exitCode !== 0) throw new FatalError(`docker tag failed: ${tagResult.stderr}`);
-				if (!config.dryRun) {
-					log$1(`Pushing ${ref}...`);
-					const pushResult = executor.exec(`docker push ${ref}`);
-					if (pushResult.exitCode !== 0) throw new FatalError(`docker push failed: ${pushResult.stderr}`);
-				} else log$1(`[dry-run] Skipping push for ${ref}`);
-			}
-		}
-	} finally {
-		if (!config.dryRun) {
-			log$1(`Logging out from ${config.registryHost}...`);
-			executor.exec(`docker logout ${config.registryHost}`);
-		}
+	else {
+		ctx.write(SCHEMA_LOCAL_PATH, schemaContent);
+		results.push({
+			filePath: SCHEMA_LOCAL_PATH,
+			action: existingSchema ? "updated" : "created",
+			description: "Copied Forgejo workflow schema from @bensandee/config"
+		});
 	}
-	log$1(`Published ${allTags.length} image tag(s)`);
-	return {
-		packages,
-		tags: allTags
-	};
+	results.push(writeSchemaToSettings(ctx));
+	return results;
+}
+//#endregion
+//#region src/generators/pipeline.ts
+/** Run all generators sequentially and return their results. */
+async function runGenerators(ctx) {
+	const results = [];
+	results.push(await generatePackageJson(ctx));
+	results.push(await generatePnpmWorkspace(ctx));
+	results.push(...await generateTsconfig(ctx));
+	results.push(await generateTsdown(ctx));
+	results.push(await generateOxlint(ctx));
+	results.push(await generateFormatter(ctx));
+	results.push(...await generateLefthook(ctx));
+	results.push(await generateGitignore(ctx));
+	results.push(await generateKnip(ctx));
+	results.push(await generateRenovate(ctx));
+	results.push(await generateCi(ctx));
+	results.push(...await generateClaudeSettings(ctx));
+	results.push(await generateReleaseIt(ctx));
+	results.push(await generateChangesets(ctx));
+	results.push(await generateReleaseCi(ctx));
+	results.push(await generateDeployCi(ctx));
+	results.push(...await generateVitest(ctx));
+	results.push(...await generateVscodeSettings(ctx));
+	results.push(saveToolingConfig(ctx, ctx.config));
+	return results;
 }
 //#endregion
 //#region src/generators/migrate-prompt.ts
@@ -3003,8 +3031,11 @@ function runDockerPublish(executor, config) {
 */
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
+	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
 	sections.push("# Migration Prompt");
 	sections.push("");
+	sections.push(`_Generated by \`@bensandee/tooling@0.28.1 repo:sync\` on ${timestamp}_`);
+	sections.push("");
 	sections.push("The following prompt was generated by `@bensandee/tooling repo:sync`. Paste it into Claude Code or another AI assistant to finish migrating this repository.");
 	sections.push("");
 	sections.push("> **Tip:** Before starting, run `/init` in Claude Code to generate a `CLAUDE.md` that gives the AI a complete picture of your repository's structure, conventions, and build commands.");
@@ -3037,6 +3068,18 @@ function generateMigratePrompt(results, config, detected) {
 	}
 	sections.push("## Migration tasks");
 	sections.push("");
+	if (config.releaseStrategy === "simple" && !detected.hasCommitAndTagVersion) {
+		sections.push("### Add commit-and-tag-version to devDependencies");
+		sections.push("");
+		sections.push("The `simple` release strategy requires `commit-and-tag-version` as a root devDependency so that `pnpm exec commit-and-tag-version` resolves correctly.");
+		sections.push("");
+		sections.push("Run:");
+		sections.push("");
+		sections.push("```sh");
+		sections.push("pnpm add -D -w commit-and-tag-version");
+		sections.push("```");
+		sections.push("");
+	}
 	if (config.releaseStrategy !== "none" && !detected.hasRepositoryField) {
 		sections.push("### Add repository field to package.json");
 		sections.push("");
@@ -4804,7 +4847,7 @@ const dockerCheckCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.27.1",
+		version: "0.28.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -4820,7 +4863,7 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand
 	}
 });
-console.log(`@bensandee/tooling v0.27.1`);
+console.log(`@bensandee/tooling v0.28.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);