@bensandee/tooling 0.30.0 → 0.32.0

package/README.md

@@ -77,7 +77,7 @@ The generated `ci:check` script defaults to `pnpm check --skip 'docker:*'` since
 
 Docker packages are discovered automatically. Any package with a `Dockerfile` or `docker/Dockerfile` is a Docker package. Image names are derived as `{root-package-name}-{package-name}`, build context defaults to `.` (project root). For single-package repos, `Dockerfile` or `docker/Dockerfile` at the project root is checked.
 
-When Docker packages are present, `repo:sync` generates a deploy workflow (`.forgejo/workflows/publish.yml` or `.github/workflows/publish.yml`) triggered on version tags (`v*.*.*`) that runs `pnpm exec tooling docker:publish`.
+When Docker packages are present, `repo:sync` generates a publish workflow (`.forgejo/workflows/publish.yml` or `.github/workflows/publish.yml`) triggered via `workflow_dispatch` for manual runs. For the `simple` release strategy, docker publishing is also added as a step in the release workflow so it runs automatically after each release.
 
 #### Overrides
 

package/dist/bin.mjs

@@ -970,10 +970,6 @@ function runDockerPublish(executor, config) {
 //#region src/utils/yaml-merge.ts
 const IGNORE_PATTERN = "@bensandee/tooling:ignore";
 const FORGEJO_SCHEMA_COMMENT = "# yaml-language-server: $schema=../../.vscode/forgejo-workflow.schema.json\n";
-/** Returns a yaml-language-server schema comment for Forgejo workflows, empty string otherwise. */
-function workflowSchemaComment(ci) {
-	return ci === "forgejo" ? FORGEJO_SCHEMA_COMMENT : "";
-}
 /** Prepend the Forgejo schema comment if it's not already present. No-op for GitHub. */
 function ensureSchemaComment(content, ci) {
 	if (ci !== "forgejo") return content;
@@ -1028,6 +1024,29 @@ function mergeLefthookCommands(existing, requiredCommands) {
 		};
 	}
 }
+/** Extract only the mergeable steps (those with a match) as RequiredSteps. */
+function toRequiredSteps(steps) {
+	return steps.filter((s) => s.match !== void 0).map((s) => ({
+		match: s.match,
+		step: s.step
+	}));
+}
+/** Build a complete workflow YAML string from structured options. Single source of truth for both new files and merge steps. */
+function buildWorkflowYaml(options) {
+	const doc = { name: options.name };
+	if (options.enableEmailNotifications) doc["enable-email-notifications"] = true;
+	doc["on"] = options.on;
+	if (options.permissions) doc["permissions"] = options.permissions;
+	if (options.concurrency) doc["concurrency"] = options.concurrency;
+	doc["jobs"] = { [options.jobName]: {
+		"runs-on": options.runsOn ?? "ubuntu-latest",
+		steps: options.steps.map((s) => s.step)
+	} };
+	return ensureSchemaComment(stringify(doc, {
+		lineWidth: 0,
+		nullStr: ""
+	}), options.ci);
+}
 /**
 * Ensure required steps exist in a workflow job's steps array.
 * Only adds missing steps at the end — never modifies existing ones.
@@ -1169,45 +1188,22 @@ function computeNodeVersionYaml(ctx) {
 }
 //#endregion
 //#region src/generators/publish-ci.ts
-function deployWorkflow(ci, nodeVersionYaml) {
-	return `${workflowSchemaComment(ci)}name: Publish
-on:
-  push:
-    tags:
-      - "v[0-9]+.[0-9]+.[0-9]+"
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-      - run: pnpm install --frozen-lockfile
-      - name: Publish Docker images
-        env:
-          DOCKER_REGISTRY_HOST: ${actionsExpr("vars.DOCKER_REGISTRY_HOST")}
-          DOCKER_REGISTRY_NAMESPACE: ${actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")}
-          DOCKER_USERNAME: ${actionsExpr("secrets.DOCKER_USERNAME")}
-          DOCKER_PASSWORD: ${actionsExpr("secrets.DOCKER_PASSWORD")}
-        run: pnpm exec bst docker:publish
-`;
-}
-function requiredDeploySteps() {
+function publishSteps(nodeVersionYaml) {
 	return [
 		{
 			match: { uses: "actions/checkout" },
-			step: { uses: "actions/checkout@v4" }
+			step: { uses: "actions/checkout@v6" }
 		},
 		{
 			match: { uses: "pnpm/action-setup" },
-			step: { uses: "pnpm/action-setup@v4" }
+			step: { uses: "pnpm/action-setup@v5" }
 		},
 		{
 			match: { uses: "actions/setup-node" },
-			step: { uses: "actions/setup-node@v4" }
+			step: {
+				uses: "actions/setup-node@v6",
+				with: nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" }
+			}
 		},
 		{
 			match: { run: "pnpm install" },
@@ -1215,7 +1211,16 @@ function requiredDeploySteps() {
 		},
 		{
 			match: { run: "docker:publish" },
-			step: { run: "pnpm exec bst docker:publish" }
+			step: {
+				name: "Publish Docker images",
+				env: {
+					DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+					DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
+					DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+					DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD")
+				},
+				run: "pnpm exec bst docker:publish"
+			}
 		}
 	];
 }
@@ -1257,8 +1262,14 @@ async function generateDeployCi(ctx) {
 	};
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/publish.yml" : ".forgejo/workflows/publish.yml";
-	const nodeVersionYaml = computeNodeVersionYaml(ctx);
-	const content = deployWorkflow(ctx.config.ci, nodeVersionYaml);
+	const steps = publishSteps(computeNodeVersionYaml(ctx));
+	const content = buildWorkflowYaml({
+		ci: ctx.config.ci,
+		name: "Publish",
+		on: { workflow_dispatch: null },
+		jobName: "publish",
+		steps
+	});
 	if (ctx.exists(workflowPath)) {
 		const raw = ctx.read(workflowPath);
 		if (raw) {
@@ -1278,7 +1289,7 @@ async function generateDeployCi(ctx) {
 					description: "Publish workflow already up to date"
 				};
 			}
-			const merged = mergeWorkflowSteps(existing, "publish", requiredDeploySteps());
+			const merged = mergeWorkflowSteps(existing, "publish", toRequiredSteps(steps));
 			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
 			if (!merged.changed) {
 				if (withComment !== raw) {
@@ -1364,6 +1375,7 @@ const PER_PACKAGE_DEV_DEPS = {
 	"@types/node": {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1371,7 +1383,6 @@ const PER_PACKAGE_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1380,6 +1391,7 @@ const PER_PACKAGE_DEV_DEPS = {
 	tsdown: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1387,7 +1399,6 @@ const PER_PACKAGE_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1396,6 +1407,7 @@ const PER_PACKAGE_DEV_DEPS = {
 	typescript: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1403,7 +1415,6 @@ const PER_PACKAGE_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1412,6 +1423,7 @@ const PER_PACKAGE_DEV_DEPS = {
 	vitest: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1419,7 +1431,6 @@ const PER_PACKAGE_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1431,6 +1442,7 @@ const ROOT_DEV_DEPS = {
 	knip: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1438,7 +1450,6 @@ const ROOT_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1447,6 +1458,7 @@ const ROOT_DEV_DEPS = {
 	lefthook: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1454,7 +1466,6 @@ const ROOT_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1463,6 +1474,7 @@ const ROOT_DEV_DEPS = {
 	oxlint: {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1470,7 +1482,6 @@ const ROOT_DEV_DEPS = {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1506,6 +1517,7 @@ function addReleaseDeps(deps, config) {
 			deps["release-it"] = {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
+				"@types/node": "24.12.0",
 				"commit-and-tag-version": "12.7.0",
 				"knip": "5.87.0",
 				"lefthook": "2.1.4",
@@ -1513,7 +1525,6 @@ function addReleaseDeps(deps, config) {
 				"oxlint": "1.56.0",
 				"prettier": "3.8.1",
 				"release-it": "19.2.4",
-				"@types/node": "24.12.0",
 				"tsdown": "0.21.4",
 				"typescript": "5.9.3",
 				"vitest": "4.1.0",
@@ -1522,6 +1533,7 @@ function addReleaseDeps(deps, config) {
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
+				"@types/node": "24.12.0",
 				"commit-and-tag-version": "12.7.0",
 				"knip": "5.87.0",
 				"lefthook": "2.1.4",
@@ -1529,7 +1541,6 @@ function addReleaseDeps(deps, config) {
 				"oxlint": "1.56.0",
 				"prettier": "3.8.1",
 				"release-it": "19.2.4",
-				"@types/node": "24.12.0",
 				"tsdown": "0.21.4",
 				"typescript": "5.9.3",
 				"vitest": "4.1.0",
@@ -1540,6 +1551,7 @@ function addReleaseDeps(deps, config) {
 			deps["commit-and-tag-version"] = {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
+				"@types/node": "24.12.0",
 				"commit-and-tag-version": "12.7.0",
 				"knip": "5.87.0",
 				"lefthook": "2.1.4",
@@ -1547,7 +1559,6 @@ function addReleaseDeps(deps, config) {
 				"oxlint": "1.56.0",
 				"prettier": "3.8.1",
 				"release-it": "19.2.4",
-				"@types/node": "24.12.0",
 				"tsdown": "0.21.4",
 				"typescript": "5.9.3",
 				"vitest": "4.1.0",
@@ -1558,6 +1569,7 @@ function addReleaseDeps(deps, config) {
 			deps["@changesets/cli"] = {
 				"@changesets/cli": "2.30.0",
 				"@release-it/bumper": "7.0.5",
+				"@types/node": "24.12.0",
 				"commit-and-tag-version": "12.7.0",
 				"knip": "5.87.0",
 				"lefthook": "2.1.4",
@@ -1565,7 +1577,6 @@ function addReleaseDeps(deps, config) {
 				"oxlint": "1.56.0",
 				"prettier": "3.8.1",
 				"release-it": "19.2.4",
-				"@types/node": "24.12.0",
 				"tsdown": "0.21.4",
 				"typescript": "5.9.3",
 				"vitest": "4.1.0",
@@ -1579,10 +1590,11 @@ function getAddedDevDepNames(config) {
 	const deps = { ...ROOT_DEV_DEPS };
 	if (config.structure !== "monorepo") Object.assign(deps, PER_PACKAGE_DEV_DEPS);
 	deps["@bensandee/config"] = "0.9.1";
-	deps["@bensandee/tooling"] = "0.30.0";
+	deps["@bensandee/tooling"] = "0.32.0";
 	if (config.formatter === "oxfmt") deps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1590,7 +1602,6 @@ function getAddedDevDepNames(config) {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1599,6 +1610,7 @@ function getAddedDevDepNames(config) {
 	if (config.formatter === "prettier") deps["prettier"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1606,7 +1618,6 @@ function getAddedDevDepNames(config) {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1634,11 +1645,12 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.9.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.30.0";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.32.0";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.9.2";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1646,7 +1658,6 @@ async function generatePackageJson(ctx) {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1655,6 +1666,7 @@ async function generatePackageJson(ctx) {
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "2.30.0",
 		"@release-it/bumper": "7.0.5",
+		"@types/node": "24.12.0",
 		"commit-and-tag-version": "12.7.0",
 		"knip": "5.87.0",
 		"lefthook": "2.1.4",
@@ -1662,7 +1674,6 @@ async function generatePackageJson(ctx) {
 		"oxlint": "1.56.0",
 		"prettier": "3.8.1",
 		"release-it": "19.2.4",
-		"@types/node": "24.12.0",
 		"tsdown": "0.21.4",
 		"typescript": "5.9.3",
 		"vitest": "4.1.0",
@@ -1743,6 +1754,7 @@ async function generatePackageJson(ctx) {
 		packageManager: `pnpm@${{
 			"@changesets/cli": "2.30.0",
 			"@release-it/bumper": "7.0.5",
+			"@types/node": "24.12.0",
 			"commit-and-tag-version": "12.7.0",
 			"knip": "5.87.0",
 			"lefthook": "2.1.4",
@@ -1750,7 +1762,6 @@ async function generatePackageJson(ctx) {
 			"oxlint": "1.56.0",
 			"prettier": "3.8.1",
 			"release-it": "19.2.4",
-			"@types/node": "24.12.0",
 			"tsdown": "0.21.4",
 			"typescript": "5.9.3",
 			"vitest": "4.1.0",
@@ -2176,50 +2187,20 @@ const CI_CONCURRENCY = {
 	group: `ci-${actionsExpr("github.ref")}`,
 	"cancel-in-progress": actionsExpr("github.ref != 'refs/heads/main'")
 };
-function ciWorkflow(nodeVersionYaml, isForgejo, isChangesets) {
-	const emailNotifications = isForgejo ? "\nenable-email-notifications: true\n" : "";
-	const concurrencyBlock = isChangesets ? `
-concurrency:
-  group: ci-${actionsExpr("github.ref")}
-  cancel-in-progress: ${actionsExpr("github.ref != 'refs/heads/main'")}
-` : "";
-	return `${workflowSchemaComment(isForgejo ? "forgejo" : "github")}name: CI
-${emailNotifications}on:
-  push:
-    branches: [main]
-    tags-ignore:
-      - "**"
-  pull_request:
-${concurrencyBlock}
-jobs:
-  check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-          cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - name: Run all checks
-        run: pnpm ci:check
-`;
-}
-function requiredCheckSteps(nodeVersionYaml) {
+function checkSteps(nodeVersionYaml) {
 	return [
 		{
 			match: { uses: "actions/checkout" },
-			step: { uses: "actions/checkout@v4" }
+			step: { uses: "actions/checkout@v6" }
 		},
 		{
 			match: { uses: "pnpm/action-setup" },
-			step: { uses: "pnpm/action-setup@v4" }
+			step: { uses: "pnpm/action-setup@v5" }
 		},
 		{
 			match: { uses: "actions/setup-node" },
 			step: {
-				uses: "actions/setup-node@v4",
+				uses: "actions/setup-node@v6",
 				with: {
 					...nodeVersionYaml.startsWith("node-version-file") ? { "node-version-file": "package.json" } : { "node-version": "24" },
 					cache: "pnpm"
@@ -2250,14 +2231,29 @@ async function generateCi(ctx) {
 		description: "CI workflow not requested"
 	};
 	const isGitHub = ctx.config.ci === "github";
+	const isForgejo = !isGitHub;
 	const isChangesets = ctx.config.releaseStrategy === "changesets";
-	const nodeVersionYaml = computeNodeVersionYaml(ctx);
+	const steps = checkSteps(computeNodeVersionYaml(ctx));
+	const content = buildWorkflowYaml({
+		ci: ctx.config.ci,
+		name: "CI",
+		on: {
+			push: {
+				branches: ["main"],
+				"tags-ignore": ["**"]
+			},
+			pull_request: null
+		},
+		enableEmailNotifications: isForgejo,
+		...isChangesets && { concurrency: CI_CONCURRENCY },
+		jobName: "check",
+		steps
+	});
 	const filePath = ciWorkflowPath(ctx.config.ci, ctx.config.releaseStrategy);
-	const content = ciWorkflow(nodeVersionYaml, !isGitHub, isChangesets);
 	if (ctx.exists(filePath)) {
 		const existing = ctx.read(filePath);
 		if (existing) {
-			let result = mergeWorkflowSteps(existing, "check", requiredCheckSteps(nodeVersionYaml));
+			let result = mergeWorkflowSteps(existing, "check", toRequiredSteps(steps));
 			const withTagsIgnore = ensureWorkflowTagsIgnore(result.content);
 			result = {
 				content: withTagsIgnore.content,
@@ -2762,71 +2758,84 @@ async function generateChangesets(ctx) {
 }
 //#endregion
 //#region src/generators/release-ci.ts
+/** Common setup steps shared by release-it and simple strategies. */
 function commonSteps(nodeVersionYaml, publishesNpm) {
-	return `      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
-        with:
-          ${nodeVersionYaml}
-          cache: pnpm${publishesNpm ? `\n          registry-url: "https://registry.npmjs.org"` : ""}
-      - run: pnpm install --frozen-lockfile`;
-}
-function releaseItWorkflow(ci, nodeVersionYaml, publishesNpm) {
-	const isGitHub = ci === "github";
-	const permissions = isGitHub ? `
-permissions:
-  contents: write
-` : "";
-	const tokenEnv = isGitHub ? `GITHUB_TOKEN: \${{ github.token }}` : `RELEASE_TOKEN: \${{ secrets.RELEASE_TOKEN }}`;
-	const npmEnv = publishesNpm ? `\n          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}` : "";
-	return `${workflowSchemaComment(ci)}name: Release
-on:
-  workflow_dispatch:
-${permissions}
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-${commonSteps(nodeVersionYaml, publishesNpm)}
-      - run: pnpm release-it --ci
-        env:
-          ${tokenEnv}${npmEnv}
-`;
+	const isNodeVersionFile = nodeVersionYaml.startsWith("node-version-file");
+	return [
+		{
+			match: { uses: "actions/checkout" },
+			step: {
+				uses: "actions/checkout@v6",
+				with: { "fetch-depth": 0 }
+			}
+		},
+		{
+			match: { uses: "pnpm/action-setup" },
+			step: { uses: "pnpm/action-setup@v5" }
+		},
+		{
+			match: { uses: "actions/setup-node" },
+			step: {
+				uses: "actions/setup-node@v6",
+				with: {
+					...isNodeVersionFile ? { "node-version-file": "package.json" } : { "node-version": "24" },
+					cache: "pnpm",
+					...publishesNpm && { "registry-url": "https://registry.npmjs.org" }
+				}
+			}
+		},
+		{
+			match: { run: "pnpm install" },
+			step: { run: "pnpm install --frozen-lockfile" }
+		}
+	];
 }
-function commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm) {
-	const isGitHub = ci === "github";
-	const permissions = isGitHub ? `
-permissions:
-  contents: write
-` : "";
-	const gitConfigStep = `
-      - name: Configure git
-        run: |
-          git config user.name "${isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]"}"
-          git config user.email "${isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost"}"`;
-	const releaseStep = isGitHub ? `
-      - name: Release
-        env:
-          GITHUB_TOKEN: \${{ github.token }}
-        run: pnpm exec bst release:simple` : `
-      - name: Release
-        env:
-          FORGEJO_SERVER_URL: \${{ github.server_url }}
-          FORGEJO_REPOSITORY: \${{ github.repository }}
-          RELEASE_TOKEN: \${{ secrets.RELEASE_TOKEN }}
-        run: pnpm exec bst release:simple`;
-	return `${workflowSchemaComment(ci)}name: Release
-on:
-  workflow_dispatch:
-${permissions}
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-${commonSteps(nodeVersionYaml, publishesNpm)}${gitConfigStep}${releaseStep}
-`;
+function releaseItSteps(ci, nodeVersionYaml, publishesNpm) {
+	const tokenEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : { RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN") };
+	const npmEnv = publishesNpm ? { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") } : {};
+	return [...commonSteps(nodeVersionYaml, publishesNpm), {
+		match: { run: "release-it" },
+		step: {
+			run: "pnpm release-it --ci",
+			env: {
+				...tokenEnv,
+				...npmEnv
+			}
+		}
+	}];
+}
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker) {
+	const releaseStep = {
+		match: { run: "release:simple" },
+		step: {
+			name: "Release",
+			env: ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : {
+				FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
+				FORGEJO_REPOSITORY: actionsExpr("github.repository"),
+				RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN")
+			},
+			run: "pnpm exec bst release:simple"
+		}
+	};
+	const dockerStep = {
+		match: { run: "docker:publish" },
+		step: {
+			name: "Publish Docker images",
+			if: "success()",
+			env: {
+				DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+				DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE"),
+				DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+				DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD")
+			},
+			run: "pnpm exec bst docker:publish"
+		}
+	};
+	return [
+		...commonSteps(nodeVersionYaml, publishesNpm),
+		releaseStep,
+		...hasDocker ? [dockerStep] : []
+	];
 }
 /** Build the required release step for the check job (changesets). */
 function changesetsReleaseStep(ci, publishesNpm) {
@@ -2860,62 +2869,10 @@ function changesetsReleaseStep(ci, publishesNpm) {
 		}
 	};
 }
-function requiredReleaseSteps(strategy, nodeVersionYaml, publishesNpm) {
-	const isNodeVersionFile = nodeVersionYaml.startsWith("node-version-file");
-	const steps = [
-		{
-			match: { uses: "actions/checkout" },
-			step: {
-				uses: "actions/checkout@v4",
-				with: { "fetch-depth": 0 }
-			}
-		},
-		{
-			match: { uses: "pnpm/action-setup" },
-			step: { uses: "pnpm/action-setup@v4" }
-		},
-		{
-			match: { uses: "actions/setup-node" },
-			step: {
-				uses: "actions/setup-node@v4",
-				with: {
-					...isNodeVersionFile ? { "node-version-file": "package.json" } : { "node-version": "24" },
-					cache: "pnpm",
-					...publishesNpm && { "registry-url": "https://registry.npmjs.org" }
-				}
-			}
-		},
-		{
-			match: { run: "pnpm install" },
-			step: { run: "pnpm install --frozen-lockfile" }
-		}
-	];
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker) {
 	switch (strategy) {
-		case "release-it":
-			steps.push({
-				match: { run: "release-it" },
-				step: { run: "pnpm release-it --ci" }
-			});
-			break;
-		case "simple":
-			steps.push({
-				match: { run: "release:simple" },
-				step: { run: "pnpm exec bst release:simple" }
-			});
-			break;
-		case "changesets":
-			steps.push({
-				match: { run: "changeset" },
-				step: { run: "pnpm exec bst release:changesets" }
-			});
-			break;
-	}
-	return steps;
-}
-function buildWorkflow(strategy, ci, nodeVersionYaml, publishesNpm) {
-	switch (strategy) {
-		case "release-it": return releaseItWorkflow(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return commitAndTagVersionWorkflow(ci, nodeVersionYaml, publishesNpm);
+		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker);
 		default: return null;
 	}
 }
@@ -2965,12 +2922,21 @@ async function generateReleaseCi(ctx) {
 	const isGitHub = ctx.config.ci === "github";
 	const workflowPath = isGitHub ? ".github/workflows/release.yml" : ".forgejo/workflows/release.yml";
 	const nodeVersionYaml = computeNodeVersionYaml(ctx);
-	const content = buildWorkflow(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm);
-	if (!content) return {
+	const hasDocker = hasDockerPackages(ctx);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker);
+	if (!steps) return {
 		filePath,
 		action: "skipped",
 		description: "Release CI workflow not applicable"
 	};
+	const content = buildWorkflowYaml({
+		ci: ctx.config.ci,
+		name: "Release",
+		on: { workflow_dispatch: null },
+		...isGitHub && { permissions: { contents: "write" } },
+		jobName: "release",
+		steps
+	});
 	if (ctx.exists(workflowPath)) {
 		const raw = ctx.read(workflowPath);
 		if (raw) {
@@ -2990,7 +2956,7 @@ async function generateReleaseCi(ctx) {
 					description: "Release workflow already up to date"
 				};
 			}
-			const merged = mergeWorkflowSteps(existing, "release", requiredReleaseSteps(ctx.config.releaseStrategy, nodeVersionYaml, publishesNpm));
+			const merged = mergeWorkflowSteps(existing, "release", toRequiredSteps(steps));
 			const withComment = ensureSchemaComment(merged.content, ctx.config.ci);
 			if (!merged.changed) {
 				if (withComment !== raw) {
@@ -3319,7 +3285,7 @@ function generateMigratePrompt(results, config, detected) {
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
 	sections.push("# Migration Prompt");
 	sections.push("");
-	sections.push(`_Generated by \`@bensandee/tooling@0.30.0 repo:sync\` on ${timestamp}_`);
+	sections.push(`_Generated by \`@bensandee/tooling@0.32.0 repo:sync\` on ${timestamp}_`);
 	sections.push("");
 	sections.push("The following prompt was generated by `@bensandee/tooling repo:sync`. Paste it into Claude Code or another AI assistant to finish migrating this repository.");
 	sections.push("");
@@ -4455,8 +4421,18 @@ function readVersion(executor, cwd) {
 	if (!pkg?.version) throw new FatalError("No version field found in package.json");
 	return pkg.version;
 }
+/** Configure git identity for CI bot commits. */
+function configureGitIdentity(executor, config) {
+	const isGitHub = config.platform?.type === "github";
+	const name = isGitHub ? "github-actions[bot]" : "forgejo-actions[bot]";
+	const email = isGitHub ? "github-actions[bot]@users.noreply.github.com" : "forgejo-actions[bot]@noreply.localhost";
+	executor.exec(`git config user.name "${name}"`, { cwd: config.cwd });
+	executor.exec(`git config user.email "${email}"`, { cwd: config.cwd });
+	debug(config, `Configured git identity: ${name} <${email}>`);
+}
 /** Run the full commit-and-tag-version release flow. */
 async function runSimpleRelease(executor, config) {
+	configureGitIdentity(executor, config);
 	const command = buildCommand(config);
 	log$2.info(`Running: ${command}`);
 	const versionResult = executor.exec(command, { cwd: config.cwd });
@@ -5127,7 +5103,7 @@ const dockerCheckCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.30.0",
+		version: "0.32.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -5143,7 +5119,7 @@ const main = defineCommand({
 		"docker:check": dockerCheckCommand
 	}
 });
-console.log(`@bensandee/tooling v0.30.0`);
+console.log(`@bensandee/tooling v0.32.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.30.0",
+  "version": "0.32.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "bin": {
     "bst": "./dist/bin.mjs"
@@ -40,23 +40,21 @@
     "@bensandee/common": "0.1.2"
   },
   "devDependencies": {
-    "@types/node": "24.12.0",
-    "@types/picomatch": "4.0.2",
-    "tsdown": "0.21.4",
-    "typescript": "5.9.3",
-    "vitest": "4.1.0",
-    "@bensandee/config": "0.9.1"
-  },
-  "optionalDependencies": {
     "@changesets/cli": "2.30.0",
     "@release-it/bumper": "7.0.5",
+    "@types/node": "24.12.0",
+    "@types/picomatch": "4.0.2",
     "commit-and-tag-version": "12.7.0",
     "knip": "5.87.0",
     "lefthook": "2.1.4",
     "oxfmt": "0.41.0",
     "oxlint": "1.56.0",
     "prettier": "3.8.1",
-    "release-it": "19.2.4"
+    "release-it": "19.2.4",
+    "tsdown": "0.21.4",
+    "typescript": "5.9.3",
+    "vitest": "4.1.0",
+    "@bensandee/config": "0.9.1"
   },
   "scripts": {
     "build": "tsdown",