@decohere/ci-tools 0.0.1-dev.20261105.110 → 0.0.1-dev.20261105.119

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.20261105.110",
+  "version": "0.0.1-dev.20261105.119",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -41,7 +41,6 @@
     "./changeset/check-status": "./src/changeset/check-status.mjs",
     "./github/create-issue": "./src/github/create-issue.mjs",
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
-    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
     "./github/publish-verify": "./src/github/publish-verify.mjs",
     "./github/first-publish-check": "./src/github/first-publish-check.mjs",
     "./github/npm-bootstrap": "./src/github/npm-bootstrap.mjs"

package/src/release/promote-latest.mjs

@@ -43,6 +43,13 @@ export function promoteLatest(options) {
 	}
 	log(`Promoting ${version} to latest on ${packages.length} packages`);
 
+	// Once a stable version is out, latest belongs to releases: see "Stable release" in docs/ci.
+	const current = /^latest: (.+)$/m.exec(npm("dist-tag", "ls", LAUNCH_PACKAGE).stdout)?.[1];
+	if (current != null && !current.includes("-") && version.includes("-")) {
+		log(`latest is the stable ${current}, and ${version} is a dev version. Nothing moved.`);
+		return 1;
+	}
+
 	const tag = run("git", ["tag", "--list", `v${version}`]).stdout.trim();
 	if (tag !== `v${version}`) {
 		log(`${version} has no v${version} tag, so it didn't fully ship. Nothing moved.`);

package/src/release/restamp-build.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * Gives a tested build its stable version by changing only `package.json` files, so what ships is
+ * the code that was tested. Refuses if the old version appears anywhere else, because then the
+ * version couldn't be changed in those files alone. Checks everything before writing anything.
+ *
+ *   node restamp-build.mjs <build dir> <tested version> <stable version>
+ */
+import { readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+
+const STABLE = /^\d+\.\d+\.\d+$/;
+const DEPENDENCY_KEYS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies",
+];
+
+function listFiles(dir) {
+	return readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+		const path = join(dir, entry.name);
+		return entry.isDirectory() ? listFiles(path) : [path];
+	});
+}
+
+/**
+ * @param {{ dir: string, from: string, to: string }} options
+ * @returns {{ packages: string[] }}
+ */
+export function restampBuild({ dir, from, to }) {
+	if (!STABLE.test(to)) {
+		throw new Error(`${to} isn't a stable version: expected major.minor.patch`);
+	}
+
+	const files = listFiles(dir);
+	const stamped = [];
+	const elsewhere = [];
+	for (const file of files) {
+		const text = readFileSync(file, "utf8");
+		if (file.endsWith("/package.json")) {
+			const manifest = JSON.parse(text);
+			if (manifest.version !== from) {
+				throw new Error(`${manifest.name} is at ${manifest.version}, not ${from}`);
+			}
+			manifest.version = to;
+			for (const key of DEPENDENCY_KEYS) {
+				for (const name of Object.keys(manifest[key] ?? {})) {
+					if (name.startsWith("@decohere/") && manifest[key][name] === from) {
+						manifest[key][name] = to;
+					}
+				}
+			}
+			const output = `${JSON.stringify(manifest, null, 2)}\n`;
+			if (output.includes(from)) elsewhere.push(relative(dir, file));
+			stamped.push({ file, name: manifest.name, output });
+		} else if (text.includes(from)) {
+			elsewhere.push(relative(dir, file));
+		}
+	}
+
+	if (stamped.length === 0) {
+		throw new Error(`No packages in ${dir}`);
+	}
+	if (elsewhere.length > 0) {
+		throw new Error(`${from} also appears in: ${elsewhere.join(", ")}`);
+	}
+
+	for (const { file, output } of stamped) {
+		writeFileSync(file, output);
+	}
+	return { packages: stamped.map((item) => item.name).sort() };
+}
+
+if (
+	process.argv[1] != null &&
+	import.meta.url === pathToFileURL(resolve(process.argv[1])).href
+) {
+	const [dir, from, to] = process.argv.slice(2);
+	if (!dir || !from || !to) {
+		console.error("Usage: restamp-build.mjs <build dir> <tested version> <stable version>");
+		process.exit(1);
+	}
+	const { packages } = restampBuild({ dir, from, to });
+	console.log(`${packages.length} packages now at ${to}`);
+}

package/tests/github/publish-workflow.test.mjs

@@ -9,6 +9,27 @@ const PUBLISH_YML = fileURLToPath(
 describe("publish.yml", () => {
 	const yml = fs.readFileSync(PUBLISH_YML, "utf8");
 
+	it("defaults a stable release to a dry run", () => {
+		const dryRun = yml.slice(yml.indexOf("dry_run:"), yml.indexOf("\nconcurrency:"));
+
+		expect(dryRun).toMatch(/default: true/);
+	});
+
+	it("stops a stable release before publishing on a dry run, or if its checks fail", () => {
+		const verify = yml.slice(yml.indexOf("\n  verify:"), yml.indexOf("\n  npm:"));
+
+		expect(verify).toContain("inputs.dry_run != true");
+		expect(verify).toContain("needs.release-build.result == 'success'");
+	});
+
+	it("ships a stable release from the tested build, without rebuilding it", () => {
+		const build = yml.slice(yml.indexOf("\n  release-build:"), yml.indexOf("\n  verify:"));
+
+		expect(build).toContain("forge-release-beta-");
+		expect(build).toContain("restamp-build.mjs");
+		expect(build).not.toContain("forge --log-level info build");
+	});
+
 	it("only tags a version once npm and the images have shipped", () => {
 		const tag = yml.slice(yml.indexOf("\n  tag:"));
 		const needs = /needs: \[(.+)\]/.exec(tag)?.[1].split(", ");

package/src/github/create-or-update-pr.mjs

@@ -1,143 +0,0 @@
-import { execSync } from "node:child_process";
-import { readFileSync } from "node:fs";
-
-function getArg(name, fallback) {
-	const equals = process.argv.find((arg) => arg.startsWith(`--${name}=`));
-	if (equals) return equals.slice(name.length + 3);
-	const index = process.argv.indexOf(`--${name}`);
-	if (index >= 0) return process.argv[index + 1];
-	return fallback;
-}
-
-function hasFlag(name) {
-	return process.argv.includes(`--${name}`);
-}
-
-function run(command) {
-	return execSync(command, { encoding: "utf8" }).trim();
-}
-
-function parseRepoFromRemoteUrl(url) {
-	const sshMatch = url.match(/github\.com:([^/]+)\/([^/.]+)(?:\.git)?$/);
-	if (sshMatch) return { owner: sshMatch[1], repo: sshMatch[2] };
-	const httpsMatch = url.match(/github\.com\/([^/]+)\/([^/.]+)(?:\.git)?$/);
-	if (httpsMatch) return { owner: httpsMatch[1], repo: httpsMatch[2] };
-	throw new Error(`Unable to parse GitHub owner/repo from remote URL: ${url}`);
-}
-
-async function request(apiBaseUrl, token, method, path, body) {
-	const response = await fetch(`${apiBaseUrl}${path}`, {
-		method,
-		headers: {
-			Authorization: `Bearer ${token}`,
-			Accept: "application/vnd.github+json",
-			"X-GitHub-Api-Version": "2022-11-28",
-			"Content-Type": "application/json",
-		},
-		body: body == null ? undefined : JSON.stringify(body),
-	});
-	if (!response.ok) {
-		const message = await response.text();
-		throw new Error(`GitHub API ${method} ${path} failed (${response.status}): ${message}`);
-	}
-	return response.status === 204 ? undefined : response.json();
-}
-
-if (hasFlag("help")) {
-	console.log(`Usage: node create-or-update-pr.mjs [options]
-
-Required:
-  --title <title>                PR title
-  --body <markdown>              PR body markdown
-    or
-  --body-file <path>             Read PR body markdown from file
-
-Optional:
-  --base <branch>                Base branch (default: main)
-  --head <branch>                Head branch (default: current git branch)
-  --draft                        Create as draft
-  --labels <a,b,c>               Apply labels
-  --reviewers <u1,u2>            Request reviewers
-  --dry-run                      Print intended operation without calling API
-  --help                         Show this help
-
-Auth: Set GITHUB_TOKEN or GH_TOKEN
-`);
-	process.exit(0);
-}
-
-const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
-if (token == null || token.length === 0) throw new Error("Missing GITHUB_TOKEN or GH_TOKEN");
-
-const apiBaseUrl = process.env.GITHUB_API_URL ?? "https://api.github.com";
-const base = getArg("base", "main");
-const head = getArg("head", run("git rev-parse --abbrev-ref HEAD"));
-const title = getArg("title");
-const bodyFile = getArg("body-file");
-const body = getArg("body", bodyFile ? readFileSync(bodyFile, "utf8") : undefined);
-const draft = hasFlag("draft");
-const dryRun = hasFlag("dry-run");
-const labels = (getArg("labels") ?? "")
-	.split(",")
-	.map((v) => v.trim())
-	.filter(Boolean);
-const reviewers = (getArg("reviewers") ?? "")
-	.split(",")
-	.map((v) => v.trim())
-	.filter(Boolean);
-
-if (!title) throw new Error("Missing required argument: --title");
-if (!body) throw new Error("Missing required argument: --body or --body-file");
-
-const remoteUrl = run("git config --get remote.origin.url");
-const parsedRepo = parseRepoFromRemoteUrl(remoteUrl);
-const owner = getArg("owner", parsedRepo.owner);
-const repo = getArg("repo", parsedRepo.repo);
-
-const findPath = `/repos/${owner}/${repo}/pulls?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}`;
-
-if (dryRun) {
-	console.log(
-		JSON.stringify({ owner, repo, base, head, title, draft, labels, reviewers }, null, 2),
-	);
-	process.exit(0);
-}
-
-const existing = await request(apiBaseUrl, token, "GET", findPath);
-const pr = existing[0]
-	? await request(
-			apiBaseUrl,
-			token,
-			"PATCH",
-			`/repos/${owner}/${repo}/pulls/${existing[0].number}`,
-			{ title, body, base },
-		)
-	: await request(apiBaseUrl, token, "POST", `/repos/${owner}/${repo}/pulls`, {
-			title,
-			body,
-			base,
-			head,
-			draft,
-		});
-
-if (labels.length > 0) {
-	await request(
-		apiBaseUrl,
-		token,
-		"POST",
-		`/repos/${owner}/${repo}/issues/${pr.number}/labels`,
-		{ labels },
-	);
-}
-
-if (reviewers.length > 0) {
-	await request(
-		apiBaseUrl,
-		token,
-		"POST",
-		`/repos/${owner}/${repo}/pulls/${pr.number}/requested_reviewers`,
-		{ reviewers },
-	);
-}
-
-console.log(`${existing[0] ? "Updated" : "Created"} PR #${pr.number}: ${pr.html_url}`);

package/src/release/capture-version.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-/**
- * Capture final version metadata from package.json
- * Outputs version and is_prerelease flags for GitHub Actions
- */
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-
-try {
-	const packageJson = JSON.parse(readFileSync(join(process.cwd(), "package.json"), "utf8"));
-	const version = packageJson.version;
-
-	if (!version) {
-		console.error("No version found in package.json");
-		process.exit(1);
-	}
-
-	console.log(`version=${version}`);
-
-	// Check if prerelease (has hyphen in version)
-	const isPrerelease = version.includes("-");
-	console.log(`is_prerelease=${isPrerelease}`);
-} catch (e) {
-	console.error(`Failed to capture version: ${e.message}`);
-	process.exit(1);
-}

package/src/release/npm-links.mjs

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-/**
- * Generate npm package links for all @decohere packages
- * Outputs markdown formatted links for GitHub release notes
- */
-
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { listProjectDirs } from "../lib/workspace-packages.mjs";
-
-const VERSION = process.argv[2] || process.env.VERSION;
-
-if (!VERSION) {
-	console.error("VERSION not provided as argument or env var");
-	process.exit(1);
-}
-
-let links = "## Published Packages\n\n";
-
-try {
-	for (const projectDir of listProjectDirs(process.cwd())) {
-		const pkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf8"));
-		if (pkg.name?.startsWith("@decohere/")) {
-			links += `- [\`${pkg.name}@${VERSION}\`](https://www.npmjs.com/package/${pkg.name}/v/${VERSION})\n`;
-		}
-	}
-
-	console.log(links);
-} catch (e) {
-	console.error(`Failed to generate npm links: ${e.message}`);
-	process.exit(1);
-}

package/src/release/push-prerelease-commit.mjs

@@ -1,85 +0,0 @@
-#!/usr/bin/env node
-/**
- * Publish prerelease version commit via PR
- * Validates working tree, pushes prerelease commit to a release branch,
- * and creates/updates a PR targeting the protected base branch.
- */
-
-import { execSync } from "node:child_process";
-
-function run(command) {
-	return execSync(command, { encoding: "utf8" }).trim();
-}
-
-function runInherit(command, env) {
-	execSync(command, { stdio: "inherit", env });
-}
-
-try {
-	// Check if working tree is dirty
-	const status = run("git status --porcelain");
-	if (status.trim().length > 0) {
-		console.error(
-			"::error::Working tree is dirty after version/dependency sync; refusing to publish with uncommitted changes.",
-		);
-		console.log(status);
-		process.exit(1);
-	}
-
-	// Compare HEAD with origin and create a PR branch targeting an explicit base branch.
-	const head = run("git rev-parse HEAD");
-	const sourceBranch = process.env.GITHUB_REF_NAME || run("git rev-parse --abbrev-ref HEAD");
-	const channel = process.env.RELEASE_CHANNEL ?? "beta";
-	const baseBranch = process.env.RELEASE_BASE_BRANCH || sourceBranch;
-	const releasePrBranch = `release/${channel}-${sourceBranch}-to-${baseBranch}`;
-	const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
-
-	try {
-		const origin = run(`git rev-parse origin/${sourceBranch}`);
-
-		if (head !== origin) {
-			console.log(
-				`Publishing release commit via PR branch origin/${releasePrBranch} (base: origin/${baseBranch})`,
-			);
-			runInherit(`git push origin HEAD:${releasePrBranch} --force`, process.env);
-
-			if (token == null || token.length === 0) {
-				throw new Error("Missing GITHUB_TOKEN/GH_TOKEN for PR upsert");
-			}
-
-			const version = process.env.RELEASE_VERSION ?? "(unknown)";
-			const ownerRepo = run("git config --get remote.origin.url")
-				.replace(/^.*github\.com[:/]/, "")
-				.replace(/\.git$/, "");
-
-			runInherit(
-				[
-					"node projects/ci-tools/src/github/create-or-update-pr.mjs",
-					`--title "chore(release): ${channel} ${version}"`,
-					`--base "${baseBranch}"`,
-					`--head "${releasePrBranch}"`,
-					`--body "Automated ${channel} version bump and dependency sync.\\n\\n- Channel: ${channel}\\n- Version: ${version}\\n- Source branch: ${sourceBranch}\\n- Base branch: ${baseBranch}\\n- Source commit: ${head}\\n\\nGenerated by pull-request workflow."`,
-					`--owner "${ownerRepo.split("/")[0]}"`,
-					`--repo "${ownerRepo.split("/")[1]}"`,
-				].join(" "),
-				{ ...process.env, GITHUB_TOKEN: token },
-			);
-		} else {
-			console.log("No prerelease version commit to push.");
-		}
-	} catch (err) {
-		const message = err?.message ?? "";
-		if (
-			message.includes(`origin/${sourceBranch}`) &&
-			message.includes("Needed a single revision")
-		) {
-			console.log(`Remote branch origin/${sourceBranch} not found, skipping push.`);
-		} else {
-			console.error("::error::Failed to publish release commit via PR branch.");
-			throw err;
-		}
-	}
-} catch (e) {
-	console.error(`Push failed: ${e.message}`);
-	process.exit(1);
-}

package/src/release/sync-dependencies.mjs

@@ -1,26 +0,0 @@
-#!/usr/bin/env node
-/**
- * Sync cross-library dependency versions
- * Conditionally runs sync with or without commit based on DRY_RUN flag
- */
-
-import { execSync } from "node:child_process";
-
-const DRY_RUN = process.env.DRY_RUN === "true";
-const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
-
-const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
-
-try {
-	if (DRY_RUN) {
-		console.log(`[DRY RUN] ${baseCmd}`);
-		execSync(baseCmd, { stdio: "inherit" });
-	} else {
-		const commitCmd = `${baseCmd} --commit --message "chore: version packages and sync cross-library dependencies [skip ci]"`;
-		console.log(`Syncing with commit...`);
-		execSync(commitCmd, { stdio: "inherit" });
-	}
-} catch (e) {
-	console.error(`Dependency sync failed: ${e.message}`);
-	process.exit(1);
-}