@bensandee/tooling 0.45.1 → 0.46.0

package/dist/bin.mjs

@@ -4,16 +4,16 @@ import { defineCommand, runMain } from "citty";
 import * as p from "@clack/prompts";
 import { isCancel, select } from "@clack/prompts";
 import path from "node:path";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { execFileSync, execSync } from "node:child_process";
 import JSON5 from "json5";
 import { parse } from "jsonc-parser";
 import { z } from "zod";
 import { FatalError, TransientError, UnexpectedError } from "@bensandee/common";
 import { isMap, isScalar, parse as parse$1, parseDocument, stringify, visit } from "yaml";
-import { createHmac } from "node:crypto";
 import picomatch from "picomatch";
 import { tmpdir } from "node:os";
+import { createHmac } from "node:crypto";
 //#region src/types.ts
 const LEGACY_TOOLS = [
 	"eslint",
@@ -1167,6 +1167,18 @@ function hasEnginesNode(ctx) {
 function computeNodeVersionYaml(ctx) {
 	return hasEnginesNode(ctx) ? "node-version-file: package.json" : "node-version: \"24\"";
 }
+/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
+function dockerPublishEnv(registryDerivable) {
+	return {
+		...registryDerivable ? {} : {
+			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
+			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
+		},
+		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
+		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
+		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+	};
+}
 //#endregion
 //#region src/generators/publish-ci.ts
 /**
@@ -1179,18 +1191,6 @@ function hasRepositoryUrl(ctx) {
 	if (!raw) return false;
 	return parsePackageJson(raw)?.repository !== void 0;
 }
-/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
-function dockerPublishEnv$1(registryDerivable) {
-	return {
-		...registryDerivable ? {} : {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
-		},
-		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
-	};
-}
 function publishSteps(nodeVersionYaml, registryDerivable) {
 	return [
 		{ step: { uses: "actions/checkout@v6" } },
@@ -1202,13 +1202,13 @@ function publishSteps(nodeVersionYaml, registryDerivable) {
 		{ step: { run: "pnpm install --frozen-lockfile" } },
 		{ step: {
 			name: "Publish Docker images",
-			env: dockerPublishEnv$1(registryDerivable),
+			env: dockerPublishEnv(registryDerivable),
 			run: "pnpm exec bst docker:publish"
 		} }
 	];
 }
 const DockerMapSchema = z.object({ docker: z.record(z.string(), z.unknown()).optional() });
-const PostReleaseHookSchema$1 = z.object({
+const PostReleaseHookSchema = z.object({
 	postReleaseHook: z.string().optional(),
 	postReleaseHookSecrets: z.array(z.string()).optional()
 });
@@ -1217,7 +1217,7 @@ function getPostReleaseHookCommand(ctx) {
 	const raw = ctx.read(".tooling.json");
 	if (!raw) return void 0;
 	try {
-		const result = PostReleaseHookSchema$1.safeParse(JSON.parse(raw));
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
 		if (!result.success) return void 0;
 		return result.data.postReleaseHook;
 	} catch (error) {
@@ -1230,7 +1230,7 @@ function getPostReleaseHookSecrets(ctx) {
 	const raw = ctx.read(".tooling.json");
 	if (!raw) return void 0;
 	try {
-		const result = PostReleaseHookSchema$1.safeParse(JSON.parse(raw));
+		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
 		if (!result.success) return void 0;
 		return result.data.postReleaseHookSecrets;
 	} catch (error) {
@@ -1584,7 +1584,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.10.1";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.45.1";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.46.0";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.12.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
@@ -2208,9 +2208,10 @@ function hookSecretEnv(secrets) {
 }
 /** Step that runs after release, gated on the POST_RELEASE_HOOK_URL secret being set. */
 function postReleaseHookStep(opts) {
+	const ifCondition = opts?.condition ?? (opts?.guardMain ? "github.ref == 'refs/heads/main'" : void 0);
 	return { step: {
 		name: "Post-release hook",
-		...opts?.guardMain && { if: "github.ref == 'refs/heads/main'" },
+		...ifCondition && { if: ifCondition },
 		env: hookSecretEnv(opts?.secrets),
 		run: opts?.command ?? DEFAULT_POST_RELEASE_COMMAND
 	} };
@@ -2282,35 +2283,25 @@ function simpleReleaseCommand() {
 		"pnpm exec bst release:simple $FLAGS"
 	].join("\n");
 }
-/** Build the docker publish env block, omitting registry vars when derivable at runtime. */
-function dockerPublishEnv(registryDerivable) {
-	return {
-		...registryDerivable ? {} : {
-			DOCKER_REGISTRY_HOST: actionsExpr("vars.DOCKER_REGISTRY_HOST"),
-			DOCKER_REGISTRY_NAMESPACE: actionsExpr("vars.DOCKER_REGISTRY_NAMESPACE")
-		},
-		DOCKER_USERNAME: actionsExpr("secrets.DOCKER_USERNAME"),
-		DOCKER_PASSWORD: actionsExpr("secrets.DOCKER_PASSWORD"),
-		RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
+function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
+	const releaseEnv = ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : {
+		FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
+		FORGEJO_REPOSITORY: actionsExpr("github.repository"),
+		RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN")
 	};
-}
-function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable, hookSecrets) {
+	const pushedIf = "steps.release.outputs.pushed == 'true'";
 	const releaseStep = { step: {
+		id: "release",
 		name: "Release",
 		env: {
-			...ci === "github" ? { GITHUB_TOKEN: actionsExpr("github.token") } : {
-				FORGEJO_SERVER_URL: actionsExpr("github.server_url"),
-				FORGEJO_REPOSITORY: actionsExpr("github.repository"),
-				RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN")
-			},
-			...hookSecretEnv(hookSecrets),
+			...releaseEnv,
 			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 		},
 		run: simpleReleaseCommand()
 	} };
 	const dockerStep = { step: {
 		name: "Publish Docker images",
-		if: "success()",
+		if: pushedIf,
 		env: dockerPublishEnv(registryDerivable),
 		run: "pnpm exec bst docker:publish"
 	} };
@@ -2320,10 +2311,10 @@ function simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, regist
 		...hasDocker ? [dockerStep] : []
 	];
 }
-function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable, hookSecrets) {
+function buildSteps(strategy, ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable) {
 	switch (strategy) {
 		case "release-it": return releaseItSteps(ci, nodeVersionYaml, publishesNpm);
-		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable, hookSecrets);
+		case "simple": return simpleReleaseSteps(ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 		default: return null;
 	}
 }
@@ -2346,7 +2337,7 @@ async function generateReleaseCi(ctx) {
 	const hasDocker = hasDockerPackages(ctx);
 	const registryDerivable = hasRepositoryUrl(ctx);
 	const hookSecrets = getPostReleaseHookSecrets(ctx);
-	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable, hookSecrets);
+	const steps = buildSteps(ctx.config.releaseStrategy, ctx.config.ci, nodeVersionYaml, publishesNpm, hasDocker, registryDerivable);
 	if (!steps) return {
 		filePath,
 		action: "skipped",
@@ -2356,6 +2347,11 @@ async function generateReleaseCi(ctx) {
 		command: getPostReleaseHookCommand(ctx),
 		secrets: hookSecrets
 	}));
+	else if (ctx.config.releaseStrategy === "simple") steps.push(postReleaseHookStep({
+		command: getPostReleaseHookCommand(ctx),
+		secrets: hookSecrets,
+		condition: "steps.release.outputs.pushed == 'true'"
+	}));
 	const on = ctx.config.releaseStrategy === "simple" ? simpleWorkflowDispatchTrigger() : { workflow_dispatch: null };
 	const content = buildWorkflowYaml({
 		ci: ctx.config.ci,
@@ -2391,8 +2387,9 @@ async function generateReleaseCi(ctx) {
 //#endregion
 //#region src/generators/ci.ts
 /** Build the release step for the check job (changesets strategy). */
-function changesetsReleaseStep(ci, publishesNpm, hookSecrets) {
+function changesetsReleaseStep(ci, publishesNpm) {
 	if (ci === "github") return { step: {
+		id: "release",
 		uses: "changesets/action@v1",
 		if: "github.ref == 'refs/heads/main'",
 		with: {
@@ -2405,6 +2402,7 @@ function changesetsReleaseStep(ci, publishesNpm, hookSecrets) {
 		}
 	} };
 	return { step: {
+		id: "release",
 		name: "Release",
 		if: "github.ref == 'refs/heads/main'",
 		env: {
@@ -2412,7 +2410,6 @@ function changesetsReleaseStep(ci, publishesNpm, hookSecrets) {
 			FORGEJO_REPOSITORY: actionsExpr("github.repository"),
 			RELEASE_TOKEN: actionsExpr("secrets.RELEASE_TOKEN"),
 			...publishesNpm && { NODE_AUTH_TOKEN: actionsExpr("secrets.NPM_TOKEN") },
-			...hookSecretEnv(hookSecrets),
 			RELEASE_DEBUG: actionsExpr("vars.RELEASE_DEBUG || 'false'")
 		},
 		run: "pnpm exec bst release:changesets"
@@ -2462,14 +2459,22 @@ async function generateCi(ctx) {
 	const publishesNpm = ctx.config.publishNpm === true;
 	const hookCommand = getPostReleaseHookCommand(ctx);
 	const hookSecrets = getPostReleaseHookSecrets(ctx);
-	const needsHookStep = isChangesets && isGitHub;
+	const hasDocker = isChangesets && hasDockerPackages(ctx);
+	const registryDerivable = hasDocker && hasRepositoryUrl(ctx);
+	const publishedIf = "steps.release.outputs.published == 'true'";
 	const steps = [
 		...checkSteps(nodeVersionYaml, isChangesets && publishesNpm),
-		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm, hookSecrets)] : [],
-		...needsHookStep ? [postReleaseHookStep({
+		...isChangesets ? [changesetsReleaseStep(ctx.config.ci, publishesNpm)] : [],
+		...hasDocker ? [{ step: {
+			name: "Publish Docker images",
+			if: publishedIf,
+			env: dockerPublishEnv(registryDerivable),
+			run: "pnpm exec bst docker:publish"
+		} }] : [],
+		...isChangesets ? [postReleaseHookStep({
 			command: hookCommand,
 			secrets: hookSecrets,
-			guardMain: true
+			condition: publishedIf
 		})] : []
 	];
 	const content = buildWorkflowYaml({
@@ -3344,7 +3349,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.45.1 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.46.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -4251,6 +4256,111 @@ async function runVersionMode(executor, config) {
 	};
 }
 //#endregion
+//#region src/release/publish.ts
+/** Mode 2: publish to npm, push tags, and create Forgejo releases. */
+async function runPublishMode(executor, config) {
+	log.info("No changesets — publishing packages");
+	const publishResult = executor.exec("pnpm", ["changeset", "publish"], { cwd: config.cwd });
+	debugExec(config, "pnpm changeset publish", publishResult);
+	if (publishResult.exitCode !== 0) throw new FatalError(`pnpm changeset publish failed (exit code ${String(publishResult.exitCode)}):\n${publishResult.stderr}`);
+	const stdoutTags = parseNewTags(publishResult.stdout + "\n" + publishResult.stderr);
+	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
+	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
+	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
+	const remoteTags = parseRemoteTags(executor.exec("git", [
+		"ls-remote",
+		"--tags",
+		"origin"
+	], { cwd: config.cwd }).stdout);
+	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
+	const remoteSet = new Set(remoteTags);
+	const tagsToPush = reconcileTags(expectedTags, remoteTags, stdoutTags);
+	debug(config, `Reconciled tags to push: ${tagsToPush.length > 0 ? tagsToPush.join(", ") : "(none)"}`);
+	if (config.dryRun) {
+		if (tagsToPush.length === 0) {
+			log.info("No packages were published");
+			return { mode: "none" };
+		}
+		log.info(`Tags to process: ${tagsToPush.join(", ")}`);
+		log.info("[dry-run] Would push tags and create releases");
+		return {
+			mode: "publish",
+			tags: tagsToPush
+		};
+	}
+	const conn = {
+		serverUrl: config.serverUrl,
+		repository: config.repository,
+		token: config.token
+	};
+	const remoteExpectedTags = expectedTags.filter((t) => remoteSet.has(t) && !tagsToPush.includes(t));
+	const tagsWithMissingReleases = [];
+	for (const tag of remoteExpectedTags) if (!await findRelease(executor, conn, tag)) tagsWithMissingReleases.push(tag);
+	const allTags = [...tagsToPush, ...tagsWithMissingReleases];
+	if (allTags.length === 0) {
+		log.info("No packages were published");
+		return { mode: "none" };
+	}
+	log.info(`Tags to process: ${allTags.join(", ")}`);
+	const errors = [];
+	for (const tag of allTags) try {
+		if (!remoteSet.has(tag)) {
+			if (executor.exec("git", [
+				"tag",
+				"-l",
+				tag
+			], { cwd: config.cwd }).stdout.trim() === "") {
+				const tagResult = executor.exec("git", ["tag", tag], { cwd: config.cwd });
+				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
+			}
+			const pushTagResult = executor.exec("git", [
+				"push",
+				"origin",
+				`refs/tags/${tag}`
+			], { cwd: config.cwd });
+			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
+		}
+		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
+		else log.info(`Created release for ${tag}`);
+	} catch (error) {
+		errors.push({
+			tag,
+			error
+		});
+		log.warn(`Failed to process ${tag}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (errors.length > 0) throw new TransientError(`Failed to create releases for: ${errors.map((e) => e.tag).join(", ")}`);
+	const slidingTags = allTags.flatMap((t) => {
+		const atIndex = t.lastIndexOf("@");
+		if (atIndex <= 0) return [];
+		const name = t.slice(0, atIndex);
+		return computeSlidingTags(t.slice(atIndex + 1)).map((suffix) => `${name}@${suffix}`);
+	});
+	if (slidingTags.length > 0) {
+		for (const tag of slidingTags) {
+			const tagResult = executor.exec("git", [
+				"tag",
+				"-f",
+				tag
+			], { cwd: config.cwd });
+			if (tagResult.exitCode !== 0) log.warn(`Warning: Failed to create sliding tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
+		}
+		const forcePushResult = executor.exec("git", [
+			"push",
+			"origin",
+			...slidingTags.map((t) => `refs/tags/${t}`),
+			"--force"
+		], { cwd: config.cwd });
+		debugExec(config, "force-push sliding tags", forcePushResult);
+		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
+		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
+	}
+	return {
+		mode: "publish",
+		tags: allTags
+	};
+}
+//#endregion
 //#region src/release/connection.ts
 const RepositorySchema = z.union([z.string(), z.object({ url: z.string() })]);
 /**
@@ -4364,345 +4474,56 @@ function configureGitIdentity(executor, platform, cwd) {
 	], { cwd });
 }
 //#endregion
-//#region src/release/webhook.ts
-/** Build a webhook payload from changesets publish context. */
-function buildChangesetsPayload(options) {
-	const tagName = options.tags.join(", ");
-	const actor = options.actor ?? ciActorName(options.platform ?? "forgejo");
-	return {
-		action: "published",
-		release: {
-			tag_name: tagName,
-			name: tagName,
-			draft: false,
-			prerelease: false,
-			author: { login: actor }
-		},
-		repository: {
-			full_name: options.repository,
-			html_url: `${options.serverUrl}/${options.repository}`
+//#region src/commands/release-changesets.ts
+const releaseForgejoCommand = defineCommand({
+	meta: {
+		name: "release:changesets",
+		description: "Changesets version/publish for Forgejo CI"
+	},
+	args: {
+		"dry-run": {
+			type: "boolean",
+			description: "Skip push, API calls, and publishing side effects"
 		},
-		sender: { login: actor }
-	};
-}
-/** Build a webhook payload from simple release context. */
-function buildSimplePayload(options) {
-	const repository = options.repository ?? "";
-	const serverUrl = options.serverUrl ?? "https://github.com";
-	const actor = options.actor ?? ciActorName(options.platform ?? "github");
+		verbose: {
+			type: "boolean",
+			description: "Enable detailed debug logging (also enabled by TOOLING_DEBUG env var)"
+		}
+	},
+	async run({ args }) {
+		const result = await runRelease(buildReleaseConfig({
+			dryRun: args["dry-run"] === true,
+			verbose: args.verbose === true || isEnvVerbose()
+		}), createRealExecutor());
+		if (result.mode === "publish") {
+			const outputFile = process.env["GITHUB_OUTPUT"];
+			if (outputFile) try {
+				appendFileSync(outputFile, "published=true\n");
+			} catch (_error) {}
+		}
+		if (result.mode === "none") process.exitCode = 0;
+	}
+});
+/** Build release config from environment / package.json and CLI flags. */
+function buildReleaseConfig(flags) {
+	const resolved = resolveConnection(process.cwd());
+	if (resolved.type !== "forgejo") throw new FatalError("release:changesets requires a Forgejo repository");
 	return {
-		action: "published",
-		release: {
-			tag_name: options.tag,
-			name: options.tag,
-			draft: false,
-			prerelease: options.prerelease ?? false,
-			author: { login: actor }
-		},
-		repository: {
-			full_name: repository,
-			html_url: repository ? `${serverUrl}/${repository}` : ""
-		},
-		sender: { login: actor }
+		...resolved.conn,
+		cwd: process.cwd(),
+		dryRun: flags.dryRun ?? false,
+		verbose: flags.verbose ?? false
 	};
 }
-/** Build a webhook payload from GitHub Actions environment variables. */
-function buildPayloadFromEnv() {
-	const repository = process.env["GITHUB_REPOSITORY"];
+/** Resolve the current branch from CI env vars or git. */
+function getCurrentBranch(executor, cwd) {
 	const ref = process.env["GITHUB_REF"];
-	const serverUrl = process.env["GITHUB_SERVER_URL"] ?? "https://github.com";
-	const actor = process.env["GITHUB_ACTOR"] ?? "github-actions[bot]";
-	if (!repository || !ref) return void 0;
-	const tagName = ref.startsWith("refs/tags/") ? ref.slice(10) : ref;
-	return {
-		action: "published",
-		release: {
-			tag_name: tagName,
-			name: tagName,
-			draft: false,
-			prerelease: false,
-			author: { login: actor }
-		},
-		repository: {
-			full_name: repository,
-			html_url: `${serverUrl}/${repository}`
-		},
-		sender: { login: actor }
-	};
-}
-/**
-* Compute the HMAC-SHA256 hex digest of data using the given secret.
-* Returns the signature in GitHub-style format: `sha256=<hex>`.
-*/
-function computeSignature(secret, data) {
-	const hmac = createHmac("sha256", secret);
-	hmac.update(data);
-	return `sha256=${hmac.digest("hex")}`;
-}
-/**
-* POST to a webhook URL with GitHub-style HMAC-SHA256 authentication.
-*
-* Sends a JSON-serialized release payload (or empty string if no payload).
-* If a secret is provided, computes the HMAC-SHA256 signature of the body
-* and includes it in the `X-Hub-Signature-256` header.
-*
-* Never throws — returns a result object indicating success or failure.
-*/
-async function sendWebhook(options) {
-	const { url, secret, payload, fetcher = globalThis.fetch } = options;
-	const body = payload ? JSON.stringify(payload) : "";
-	const headers = { "Content-Type": "application/json" };
-	if (secret) headers["X-Hub-Signature-256"] = computeSignature(secret, body);
-	try {
-		const response = await fetcher(url, {
-			method: "POST",
-			headers,
-			body
-		});
-		if (!response.ok) return {
-			ok: false,
-			status: response.status,
-			error: `HTTP ${String(response.status)}: ${await response.text().catch(() => "")}`
-		};
-		return {
-			ok: true,
-			status: response.status
-		};
-	} catch (error) {
-		return {
-			ok: false,
-			error: error instanceof Error ? error.message : String(error)
-		};
-	}
-}
-/**
-* Send a webhook and log the result. Intended for CLI usage.
-* Never throws.
-*/
-async function sendWebhookWithLogging(url, secret, payload) {
-	const result = await sendWebhook({
-		url,
-		secret,
-		payload
-	});
-	if (result.ok) log.info("Post-release hook completed successfully");
-	else log.warn(`Post-release hook failed: ${result.error ?? "unknown error"}`);
-}
-//#endregion
-//#region src/release/hook.ts
-const PostReleaseHookSchema = z.object({ postReleaseHook: z.string().optional() });
-/** Read the postReleaseHook command override from .tooling.json at runtime. */
-function loadHookCommand(executor, cwd) {
-	const configPath = path.join(cwd, ".tooling.json");
-	const raw = executor.readFile(configPath);
-	if (!raw) return void 0;
-	try {
-		const result = PostReleaseHookSchema.safeParse(JSON.parse(raw));
-		if (!result.success) return void 0;
-		return result.data.postReleaseHook;
-	} catch (_error) {
-		return;
-	}
-}
-/**
-* Execute the post-release hook after a successful publish.
-*
-* Uses the `postReleaseHook` command from `.tooling.json` if configured,
-* otherwise POSTs to `POST_RELEASE_HOOK_URL` with HMAC-SHA256 authentication
-* using `WEBHOOK_SECRET`. Both env vars must be set by the CI workflow.
-*
-* Failures are logged as warnings — they never fail the release.
-*/
-async function runPostReleaseHook(executor, config, payload) {
-	if (config.dryRun) {
-		debug(config, "Skipping post-release hook (dry-run)");
-		return;
-	}
-	const customCommand = loadHookCommand(executor, config.cwd);
-	if (customCommand) {
-		debug(config, `Running custom post-release hook: ${customCommand}`);
-		executeHookCommand(executor, config, customCommand);
-		return;
-	}
-	const hookUrl = process.env["POST_RELEASE_HOOK_URL"];
-	if (!hookUrl) {
-		debug(config, "No POST_RELEASE_HOOK_URL set — skipping post-release hook");
-		return;
-	}
-	const hookSecret = process.env["WEBHOOK_SECRET"];
-	debug(config, `Running post-release hook: POST ${hookUrl}`);
-	const result = await sendWebhook({
-		url: hookUrl,
-		secret: hookSecret || void 0,
-		payload,
-		fetcher: executor.fetch.bind(executor)
-	});
-	if (result.ok) log.info("Post-release hook completed successfully");
-	else log.warn(`Post-release hook failed: ${result.error ?? "unknown error"}`);
-}
-function executeHookCommand(executor, config, command) {
-	try {
-		const result = executor.exec("sh", ["-c", command], { cwd: config.cwd });
-		if (result.exitCode !== 0) log.warn(`Post-release hook failed (exit code ${String(result.exitCode)}): ${result.stderr || result.stdout}`);
-		else log.info("Post-release hook completed successfully");
-	} catch (error) {
-		log.warn(`Post-release hook error: ${error instanceof Error ? error.message : String(error)}`);
-	}
-}
-//#endregion
-//#region src/release/publish.ts
-/** Mode 2: publish to npm, push tags, and create Forgejo releases. */
-async function runPublishMode(executor, config) {
-	log.info("No changesets — publishing packages");
-	const publishResult = executor.exec("pnpm", ["changeset", "publish"], { cwd: config.cwd });
-	debugExec(config, "pnpm changeset publish", publishResult);
-	if (publishResult.exitCode !== 0) throw new FatalError(`pnpm changeset publish failed (exit code ${String(publishResult.exitCode)}):\n${publishResult.stderr}`);
-	const stdoutTags = parseNewTags(publishResult.stdout + "\n" + publishResult.stderr);
-	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
-	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
-	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
-	const remoteTags = parseRemoteTags(executor.exec("git", [
-		"ls-remote",
-		"--tags",
-		"origin"
-	], { cwd: config.cwd }).stdout);
-	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
-	const remoteSet = new Set(remoteTags);
-	const tagsToPush = reconcileTags(expectedTags, remoteTags, stdoutTags);
-	debug(config, `Reconciled tags to push: ${tagsToPush.length > 0 ? tagsToPush.join(", ") : "(none)"}`);
-	if (config.dryRun) {
-		if (tagsToPush.length === 0) {
-			log.info("No packages were published");
-			return { mode: "none" };
-		}
-		log.info(`Tags to process: ${tagsToPush.join(", ")}`);
-		log.info("[dry-run] Would push tags and create releases");
-		return {
-			mode: "publish",
-			tags: tagsToPush
-		};
-	}
-	const conn = {
-		serverUrl: config.serverUrl,
-		repository: config.repository,
-		token: config.token
-	};
-	const remoteExpectedTags = expectedTags.filter((t) => remoteSet.has(t) && !tagsToPush.includes(t));
-	const tagsWithMissingReleases = [];
-	for (const tag of remoteExpectedTags) if (!await findRelease(executor, conn, tag)) tagsWithMissingReleases.push(tag);
-	const allTags = [...tagsToPush, ...tagsWithMissingReleases];
-	if (allTags.length === 0) {
-		log.info("No packages were published");
-		return { mode: "none" };
-	}
-	log.info(`Tags to process: ${allTags.join(", ")}`);
-	const errors = [];
-	for (const tag of allTags) try {
-		if (!remoteSet.has(tag)) {
-			if (executor.exec("git", [
-				"tag",
-				"-l",
-				tag
-			], { cwd: config.cwd }).stdout.trim() === "") {
-				const tagResult = executor.exec("git", ["tag", tag], { cwd: config.cwd });
-				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
-			}
-			const pushTagResult = executor.exec("git", [
-				"push",
-				"origin",
-				`refs/tags/${tag}`
-			], { cwd: config.cwd });
-			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
-		}
-		if (await ensureRelease(executor, conn, tag) === "exists") log.warn(`Release for ${tag} already exists — skipping`);
-		else log.info(`Created release for ${tag}`);
-	} catch (error) {
-		errors.push({
-			tag,
-			error
-		});
-		log.warn(`Failed to process ${tag}: ${error instanceof Error ? error.message : String(error)}`);
-	}
-	if (errors.length > 0) throw new TransientError(`Failed to create releases for: ${errors.map((e) => e.tag).join(", ")}`);
-	const slidingTags = allTags.flatMap((t) => {
-		const atIndex = t.lastIndexOf("@");
-		if (atIndex <= 0) return [];
-		const name = t.slice(0, atIndex);
-		return computeSlidingTags(t.slice(atIndex + 1)).map((suffix) => `${name}@${suffix}`);
-	});
-	if (slidingTags.length > 0) {
-		for (const tag of slidingTags) {
-			const tagResult = executor.exec("git", [
-				"tag",
-				"-f",
-				tag
-			], { cwd: config.cwd });
-			if (tagResult.exitCode !== 0) log.warn(`Warning: Failed to create sliding tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
-		}
-		const forcePushResult = executor.exec("git", [
-			"push",
-			"origin",
-			...slidingTags.map((t) => `refs/tags/${t}`),
-			"--force"
-		], { cwd: config.cwd });
-		debugExec(config, "force-push sliding tags", forcePushResult);
-		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
-		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
-	}
-	await runPostReleaseHook(executor, config, buildChangesetsPayload({
-		tags: allTags,
-		repository: config.repository,
-		serverUrl: config.serverUrl
-	}));
-	return {
-		mode: "publish",
-		tags: allTags
-	};
-}
-//#endregion
-//#region src/commands/release-changesets.ts
-const releaseForgejoCommand = defineCommand({
-	meta: {
-		name: "release:changesets",
-		description: "Changesets version/publish for Forgejo CI"
-	},
-	args: {
-		"dry-run": {
-			type: "boolean",
-			description: "Skip push, API calls, and publishing side effects"
-		},
-		verbose: {
-			type: "boolean",
-			description: "Enable detailed debug logging (also enabled by TOOLING_DEBUG env var)"
-		}
-	},
-	async run({ args }) {
-		if ((await runRelease(buildReleaseConfig({
-			dryRun: args["dry-run"] === true,
-			verbose: args.verbose === true || isEnvVerbose()
-		}), createRealExecutor())).mode === "none") process.exitCode = 0;
-	}
-});
-/** Build release config from environment / package.json and CLI flags. */
-function buildReleaseConfig(flags) {
-	const resolved = resolveConnection(process.cwd());
-	if (resolved.type !== "forgejo") throw new FatalError("release:changesets requires a Forgejo repository");
-	return {
-		...resolved.conn,
-		cwd: process.cwd(),
-		dryRun: flags.dryRun ?? false,
-		verbose: flags.verbose ?? false
-	};
-}
-/** Resolve the current branch from CI env vars or git. */
-function getCurrentBranch(executor, cwd) {
-	const ref = process.env["GITHUB_REF"];
-	if (ref?.startsWith("refs/heads/")) return ref.slice(11);
-	return executor.exec("git", [
-		"rev-parse",
-		"--abbrev-ref",
-		"HEAD"
-	], { cwd }).stdout.trim();
+	if (ref?.startsWith("refs/heads/")) return ref.slice(11);
+	return executor.exec("git", [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], { cwd }).stdout.trim();
 }
 /** Core release logic — testable with a mock executor. */
 async function runRelease(config, executor) {
@@ -4970,16 +4791,6 @@ async function runSimpleRelease(executor, config) {
 	}
 	let releaseCreated = false;
 	if (!config.noRelease && config.platform) releaseCreated = await createPlatformRelease(executor, config, tag);
-	if (pushed) {
-		const conn = config.platform?.type === "forgejo" ? config.platform.conn : void 0;
-		await runPostReleaseHook(executor, config, buildSimplePayload({
-			tag,
-			repository: conn?.repository,
-			serverUrl: conn?.serverUrl,
-			prerelease: Boolean(config.prerelease),
-			platform: config.platform?.type
-		}));
-	}
 	return {
 		version,
 		tag,
@@ -5078,7 +4889,12 @@ const releaseSimpleCommand = defineCommand({
 			prerelease: args.prerelease,
 			platform
 		};
-		await runSimpleRelease(createRealExecutor(), config);
+		if ((await runSimpleRelease(createRealExecutor(), config)).pushed) {
+			const outputFile = process.env["GITHUB_OUTPUT"];
+			if (outputFile) try {
+				appendFileSync(outputFile, "pushed=true\n");
+			} catch (_error) {}
+		}
 	}
 });
 //#endregion
@@ -5088,13 +4904,13 @@ const CHECKS = [
 	{ name: "typecheck" },
 	{ name: "lint" },
 	{ name: "test" },
-	{ name: "docker:build" },
 	{
 		name: "format",
 		args: "--check"
 	},
 	{ name: "knip" },
 	{ name: "tooling:check" },
+	{ name: "docker:build" },
 	{ name: "docker:check" }
 ];
 /** Check if a name matches any skip pattern. Supports glob syntax via picomatch. */
@@ -6105,6 +5921,111 @@ const forgejoSecretsCommand = defineCommand({
 	}
 });
 //#endregion
+//#region src/release/webhook.ts
+/** Build a webhook payload from simple release context. */
+function buildSimplePayload(options) {
+	const repository = options.repository ?? "";
+	const serverUrl = options.serverUrl ?? "https://github.com";
+	const actor = options.actor ?? ciActorName(options.platform ?? "github");
+	return {
+		action: "published",
+		release: {
+			tag_name: options.tag,
+			name: options.tag,
+			draft: false,
+			prerelease: options.prerelease ?? false,
+			author: { login: actor }
+		},
+		repository: {
+			full_name: repository,
+			html_url: repository ? `${serverUrl}/${repository}` : ""
+		},
+		sender: { login: actor }
+	};
+}
+/** Build a webhook payload from GitHub Actions environment variables. */
+function buildPayloadFromEnv() {
+	const repository = process.env["GITHUB_REPOSITORY"];
+	const ref = process.env["GITHUB_REF"];
+	const serverUrl = process.env["GITHUB_SERVER_URL"] ?? "https://github.com";
+	const actor = process.env["GITHUB_ACTOR"] ?? "github-actions[bot]";
+	if (!repository || !ref) return void 0;
+	const tagName = ref.startsWith("refs/tags/") ? ref.slice(10) : ref;
+	return {
+		action: "published",
+		release: {
+			tag_name: tagName,
+			name: tagName,
+			draft: false,
+			prerelease: false,
+			author: { login: actor }
+		},
+		repository: {
+			full_name: repository,
+			html_url: `${serverUrl}/${repository}`
+		},
+		sender: { login: actor }
+	};
+}
+/**
+* Compute the HMAC-SHA256 hex digest of data using the given secret.
+* Returns the signature in GitHub-style format: `sha256=<hex>`.
+*/
+function computeSignature(secret, data) {
+	const hmac = createHmac("sha256", secret);
+	hmac.update(data);
+	return `sha256=${hmac.digest("hex")}`;
+}
+/**
+* POST to a webhook URL with GitHub-style HMAC-SHA256 authentication.
+*
+* Sends a JSON-serialized release payload (or empty string if no payload).
+* If a secret is provided, computes the HMAC-SHA256 signature of the body
+* and includes it in the `X-Hub-Signature-256` header.
+*
+* Never throws — returns a result object indicating success or failure.
+*/
+async function sendWebhook(options) {
+	const { url, secret, payload, fetcher = globalThis.fetch } = options;
+	const body = payload ? JSON.stringify(payload) : "";
+	const headers = { "Content-Type": "application/json" };
+	if (secret) headers["X-Hub-Signature-256"] = computeSignature(secret, body);
+	try {
+		const response = await fetcher(url, {
+			method: "POST",
+			headers,
+			body
+		});
+		if (!response.ok) return {
+			ok: false,
+			status: response.status,
+			error: `HTTP ${String(response.status)}: ${await response.text().catch(() => "")}`
+		};
+		return {
+			ok: true,
+			status: response.status
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+/**
+* Send a webhook and log the result. Intended for CLI usage.
+* Never throws.
+*/
+async function sendWebhookWithLogging(url, secret, payload) {
+	const result = await sendWebhook({
+		url,
+		secret,
+		payload
+	});
+	if (result.ok) log.info("Post-release hook completed successfully");
+	else log.warn(`Post-release hook failed: ${result.error ?? "unknown error"}`);
+}
+//#endregion
 //#region src/commands/webhook-send.ts
 const webhookSendCommand = defineCommand({
 	meta: {
@@ -6155,7 +6076,7 @@ const webhookSendCommand = defineCommand({
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.45.1",
+		version: "0.46.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -6175,7 +6096,7 @@ const main = defineCommand({
 		"webhook:send": webhookSendCommand
 	}
 });
-console.log(`@bensandee/tooling v0.45.1`);
+console.log(`@bensandee/tooling v0.46.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.45.1",
+  "version": "0.46.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -54,8 +54,8 @@
     "prettier": "3.8.1",
     "release-it": "19.2.4",
     "tsdown": "0.21.6",
-    "@bensandee/config": "0.10.1",
-    "@bensandee/claude-hooks": "0.6.3"
+    "@bensandee/claude-hooks": "0.6.3",
+    "@bensandee/config": "0.10.1"
   },
   "scripts": {
     "build": "tsdown",