@bobfrankston/npmglobalize 1.0.160 → 1.0.161

package/README.md

@@ -189,6 +189,31 @@ npmglobalize -np          # --nopublish (formerly --apply)
 npmglobalize --cleanup    # Restore original file: references
 ```
 
+### 📝 Release Notes via `.commitmsg`
+
+For multi-line or reusable release notes, write them to a `.commitmsg` file in the package root instead of passing them on the command line:
+
+```bash
+cat > .commitmsg <<'EOF'
+Added foo feature
+Fixed bar regression
+EOF
+npmglobalize
+```
+
+Behavior:
+- If `-m` / `-message` is **not** given and `.commitmsg` exists, its contents are used as the commit message (and force a release even if the working tree is otherwise clean).
+- After a successful `npm publish`, npmglobalize:
+  1. Appends the contents to `npmchanges.md` under a `## v<version> — <YYYY-MM-DD>` header (creating the file if needed)
+  2. Deletes `.commitmsg`
+  3. Commits both changes as `Log v<version> to npmchanges.md` and pushes
+
+Notes:
+- **Git/GitHub only.** npm publish does not consume git commit messages; `npmchanges.md` lives in the git repo and on GitHub but is excluded from the published npm tarball (the standard `*.md` rule keeps only `README.md`).
+- If both `-m` and `.commitmsg` are present, `-m` wins and `.commitmsg` is left alone (not consumed).
+- If publish fails, `.commitmsg` is preserved for the next attempt.
+- `.commitmsg` is auto-added to `.npmignore` (security pattern) so it never leaks into the tarball.
+
 ### 🔧 Git Integration & Error Recovery
 
 **Automatic tag conflict resolution**:
@@ -288,6 +313,8 @@ Publishing requires being on a branch so commits and tags can be properly tracke
 -nopublish, -np      Just transform, don't publish (persisted to config)
 -cleanup             Restore file: dependencies from .dependencies backup
 -m, -message <msg>   Custom commit message (forces release even without changes)
+                     If -m not given, a `.commitmsg` file (if present) is used instead.
+                     See "Release Notes via .commitmsg" below.
 ```
 
 ### Dependency Options

package/cli.js

@@ -27,6 +27,9 @@ Release Options:
   -nopublish, -np      Just transform, don't publish (persisted to config)
   -cleanup             Restore from .dependencies
   -m, -message <msg>   Custom commit message (forces release even without changes)
+                       If -m not given and a .commitmsg file exists in cwd, its
+                       contents are used. After a successful publish it is appended
+                       to npmchanges.md (with version header) and deleted.
 
 Dependency Options:
   -update-deps, -ud        Update package.json to latest (minor/patch only, safe)

package/ignorepatterns.json5

@@ -41,7 +41,8 @@
             ".env*",
             "token*",
             "certs/",
-            "*cert*/"
+            "*cert*/",
+            ".commitmsg"
         ],
         // Prompted or auto-added with --conform
         recommended: [

package/lib.js

@@ -3919,11 +3919,29 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     }
     // Re-check git status after all transformations and potential commits
     currentGitStatus = getGitStatus(cwd);
+    // If no -m given, fall back to .commitmsg file contents (one-shot changelog entry).
+    // Consumed (appended to npmchanges.md + deleted) only after a successful publish.
+    const commitMsgPath = path.join(cwd, '.commitmsg');
+    let commitMsgFromFile = null;
+    let effectiveMessage = message;
+    if (!effectiveMessage && fs.existsSync(commitMsgPath)) {
+        try {
+            const content = fs.readFileSync(commitMsgPath, 'utf-8').trim();
+            if (content) {
+                commitMsgFromFile = content;
+                effectiveMessage = content;
+                console.log(colors.cyan(`  Using .commitmsg for commit message (${content.split('\n')[0].slice(0, 60)}${content.length > 60 ? '…' : ''})`));
+            }
+        }
+        catch (err) {
+            console.error(colors.yellow(`  Warning: could not read .commitmsg: ${err.message}`));
+        }
+    }
     // Check if there are changes to commit or a custom message
     // Skip this check for first publish (currentAccess null) or just-initialized repos
     const isFirstPublish = !currentAccess;
     let skipVersionBump = false;
-    if (!currentGitStatus.hasUncommitted && !message && !justInitialized && !isFirstPublish) {
+    if (!currentGitStatus.hasUncommitted && !effectiveMessage && !justInitialized && !isFirstPublish) {
         // Check if the current version is actually on npm (it might have failed to publish previously)
         const versionCheck = spawnSafe('npm', ['view', `${pkg.name}@${pkg.version}`, 'version'], {
             shell: process.platform === 'win32',
@@ -4074,7 +4092,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     }
     // Git operations
     if (currentGitStatus.hasUncommitted) {
-        const commitMsg = message || 'Pre-release commit';
+        const commitMsg = effectiveMessage || 'Pre-release commit';
         console.log(`${timestamp()} Committing changes: ${commitMsg}`);
         if (!dryRun) {
             // Remove 'nul' files that break git on Windows
@@ -4701,6 +4719,36 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         const finalAccess = effectiveNpmVisibility || currentAccess || (isScoped ? 'restricted' : 'public');
         const accessLabel = (finalAccess === 'restricted' || finalAccess === 'private') ? 'PRIVATE' : 'PUBLIC';
         console.log(`${timestamp()} ${colors.green(`✓ Published to npm as ${accessLabel}`)}`);
+        // Consume .commitmsg: append to npmchanges.md, delete the file, commit+push.
+        // Only runs if .commitmsg was actually used as the commit message.
+        if (commitMsgFromFile) {
+            try {
+                const publishedVersion = readPackageJson(cwd).version;
+                const npmChangesPath = path.join(cwd, 'npmchanges.md');
+                const date = new Date().toISOString().slice(0, 10);
+                const header = `## v${publishedVersion} — ${date}\n\n`;
+                const entry = header + commitMsgFromFile.trim() + '\n\n';
+                const existing = fs.existsSync(npmChangesPath)
+                    ? fs.readFileSync(npmChangesPath, 'utf-8')
+                    : '# npm Publish Changes\n\n';
+                const sep = existing.endsWith('\n') ? '' : '\n';
+                fs.writeFileSync(npmChangesPath, existing + sep + entry);
+                try {
+                    fs.unlinkSync(commitMsgPath);
+                }
+                catch { /* ignore */ }
+                runCommand('git', ['add', 'npmchanges.md', '.commitmsg'], { cwd, silent: true });
+                const logResult = gitCommit(`Log v${publishedVersion} to npmchanges.md`, cwd);
+                if (logResult.success) {
+                    console.log(colors.green(`  ✓ Appended to npmchanges.md and removed .commitmsg`));
+                    if (currentGitStatus.hasRemote)
+                        pushWithProtection(cwd, verbose);
+                }
+            }
+            catch (err) {
+                console.error(colors.yellow(`  Warning: could not update npmchanges.md: ${err.message}`));
+            }
+        }
     }
     else {
         console.log(`  [dry-run] Would run: npm publish ${quiet ? '--quiet' : ''}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.160",
+  "version": "1.0.161",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",