@bensandee/tooling 0.62.0 → 0.62.1

package/dist/bin.mjs

@@ -844,30 +844,27 @@ function parseGitUrl(urlStr) {
 	}
 }
 /**
-* Configure the git remote origin to push as `token` regardless of what
-* `actions/checkout` left behind.
+* Build per-invocation git auth for release pushes.
 *
-* `actions/checkout@v6` injects an HTTP Authorization header into git config
-* under `http.<serverUrl>/.extraheader`. That header overrides Basic auth
-* embedded in the remote URL, so a `git remote set-url` alone is not enough —
-* the runner's pseudo-user token still wins and the push authenticates as
-* uid=-2 on Forgejo (and as the runner identity on GitHub Enterprise with
-* custom pre-receive hooks). Unset the extraheader before rewriting the URL.
+* Pure: no executor side effects, no `.git/config` mutation. Caller threads
+* `auth.args` + `auth.url` through every `git push` / `git ls-remote` that
+* needs to authenticate as the RELEASE_TOKEN owner.
+*
+* Background: `actions/checkout@v6` mounts its Authorization header through
+* `includeIf.gitdir:<workspace>/.git.path → /tmp/git-credentials-*.config`
+* (the file holds `http.<server>/.extraheader = Authorization: Basic <runner
+* pseudo-user>`). That header overrides URL-embedded auth in the request,
+* which is why pushes from CI authenticated as `uid: -2` and tripped the
+* Forgejo pre-receive hook. Setting `extraheader=` to empty at the
+* command-line layer wins over the include, so the only Authorization git
+* sends is the one from `auth.url`.
 */
-function configureGitAuth(executor, coords, cwd) {
+function buildGitAuth(coords) {
 	const host = coords.serverUrl.replace(/^https?:\/\//, "");
-	executor.exec("git", [
-		"config",
-		"--unset-all",
-		`http.${coords.serverUrl}/.extraheader`
-	], { cwd });
-	const authUrl = `https://x-access-token:${coords.token}@${host}/${coords.repository}`;
-	executor.exec("git", [
-		"remote",
-		"set-url",
-		"origin",
-		authUrl
-	], { cwd });
+	return {
+		args: ["-c", `http.${coords.serverUrl}/.extraheader=`],
+		url: `https://x-access-token:${coords.token}@${host}/${coords.repository}`
+	};
 }
 /** Resolve the CI bot actor name for the given platform. */
 function ciActorName(platform) {
@@ -2225,7 +2222,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.11.3";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.62.0";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.62.1";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.13.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.31.0",
@@ -5425,7 +5422,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.62.0 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.62.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -6090,9 +6087,11 @@ async function runVersionMode(executor, config) {
 		};
 	}
 	debug(config, `Force-pushing version commit to ${BRANCH}`);
+	const auth = buildGitAuth(config);
 	const pushResult = executor.exec("git", [
+		...auth.args,
 		"push",
-		"origin",
+		auth.url,
 		`HEAD:refs/heads/${BRANCH}`,
 		"--force"
 	], { cwd: config.cwd });
@@ -6153,10 +6152,12 @@ async function runPublishMode(executor, config) {
 	debug(config, `Tags from publish stdout: ${stdoutTags.length > 0 ? stdoutTags.join(", ") : "(none)"}`);
 	const expectedTags = computeExpectedTags(executor.listWorkspacePackages(config.cwd));
 	debug(config, `Expected tags from workspace packages: ${expectedTags.length > 0 ? expectedTags.join(", ") : "(none)"}`);
+	const auth = buildGitAuth(config);
 	const remoteTags = parseRemoteTags(executor.exec("git", [
+		...auth.args,
 		"ls-remote",
 		"--tags",
-		"origin"
+		auth.url
 	], { cwd: config.cwd }).stdout);
 	debug(config, `Remote tags: ${remoteTags.length > 0 ? remoteTags.join(", ") : "(none)"}`);
 	const remoteSet = new Set(remoteTags);
@@ -6205,8 +6206,9 @@ async function runPublishMode(executor, config) {
 				if (tagResult.exitCode !== 0) throw new FatalError(`Failed to create tag ${tag}: ${tagResult.stderr || tagResult.stdout}`);
 			}
 			const pushTagResult = executor.exec("git", [
+				...auth.args,
 				"push",
-				"origin",
+				auth.url,
 				`refs/tags/${tag}`
 			], { cwd: config.cwd });
 			if (pushTagResult.exitCode !== 0) throw new FatalError(`Failed to push tag ${tag}: ${pushTagResult.stderr || pushTagResult.stdout}`);
@@ -6316,8 +6318,6 @@ async function runRelease(config, executor) {
 	}
 	const identity = await configureGitIdentity(executor, "forgejo", config.cwd, config);
 	log.info(`Git identity: ${identity.name} <${identity.email}>`);
-	configureGitAuth(executor, config, config.cwd);
-	debug(config, `Configured git remote auth for ${config.repository}`);
 	const changesetFiles = executor.listChangesetFiles(config.cwd);
 	debug(config, `Changeset files found: ${changesetFiles.length > 0 ? changesetFiles.join(", ") : "(none)"}`);
 	if (changesetFiles.length > 0) {
@@ -6716,24 +6716,32 @@ async function runSimpleRelease(executor, config) {
 		};
 	}
 	let pushed = false;
+	const authCoords = resolveAuthCoordinates(executor, config, releaseToken);
+	let auth;
+	if (authCoords) {
+		auth = buildGitAuth(authCoords);
+		debug(config, `Built git auth for ${authCoords.repository}`);
+	} else debug(config, "Skipping git auth: could not resolve server URL / repository");
 	if (!config.noPush) {
-		const authCoords = resolveAuthCoordinates(executor, config, releaseToken);
-		if (authCoords) {
-			configureGitAuth(executor, authCoords, config.cwd);
-			debug(config, `Configured git remote auth for ${authCoords.repository}`);
-		} else debug(config, "Skipping git remote auth: could not resolve server URL / repository");
 		const branch = executor.exec("git", [
 			"rev-parse",
 			"--abbrev-ref",
 			"HEAD"
 		], { cwd: config.cwd }).stdout.trim() || "main";
 		debug(config, `Pushing ${tag} to origin/${branch} with --follow-tags`);
-		const pushResult = executor.exec("git", [
+		const pushArgs = auth ? [
+			...auth.args,
+			"push",
+			"--follow-tags",
+			auth.url,
+			branch
+		] : [
 			"push",
 			"--follow-tags",
 			"origin",
 			branch
-		], { cwd: config.cwd });
+		];
+		const pushResult = executor.exec("git", pushArgs, { cwd: config.cwd });
 		debugExec(config, "git push", pushResult);
 		if (pushResult.exitCode !== 0) throw new FatalError(`git push failed (exit code ${String(pushResult.exitCode)}):\n${pushResult.stderr || pushResult.stdout}`);
 		pushed = true;
@@ -6751,12 +6759,19 @@ async function runSimpleRelease(executor, config) {
 			], { cwd: config.cwd });
 			if (slidingTagResult.exitCode !== 0) throw new FatalError(`Failed to create sliding tag ${slidingTag}: ${slidingTagResult.stderr || slidingTagResult.stdout}`);
 		}
-		const forcePushResult = executor.exec("git", [
+		const forcePushArgs = auth ? [
+			...auth.args,
+			"push",
+			auth.url,
+			...slidingTags,
+			"--force"
+		] : [
 			"push",
 			"origin",
 			...slidingTags,
 			"--force"
-		], { cwd: config.cwd });
+		];
+		const forcePushResult = executor.exec("git", forcePushArgs, { cwd: config.cwd });
 		debugExec(config, "force-push sliding tags", forcePushResult);
 		if (forcePushResult.exitCode !== 0) log.warn(`Warning: Failed to push sliding tags: ${forcePushResult.stderr || forcePushResult.stdout}`);
 		else log.info(`Created sliding tags: ${slidingTags.join(", ")}`);
@@ -9122,7 +9137,7 @@ const out = (msg) => console.log(msg);
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.62.0",
+		version: "0.62.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -9195,7 +9210,7 @@ const main = defineCommand({
 		})
 	}
 });
-console.log(`@bensandee/tooling v0.62.0`);
+console.log(`@bensandee/tooling v0.62.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.62.0",
+  "version": "0.62.1",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -54,8 +54,8 @@
     "prettier": "3.8.3",
     "release-it": "20.0.1",
     "tsdown": "0.22.0",
-    "@bensandee/claude-hooks": "0.8.1",
-    "@bensandee/config": "0.11.3"
+    "@bensandee/config": "0.11.3",
+    "@bensandee/claude-hooks": "0.8.1"
   },
   "scripts": {
     "build": "tsdown",