@exadev/semantic-release-workspace 1.2.3 → 1.3.0

package/dist/index.cjs

@@ -35,6 +35,7 @@ let _semantic_release_release_notes_generator = require("@semantic-release/relea
 let semantic_release = require("semantic-release");
 semantic_release = __toESM(semantic_release, 1);
 let node_url = require("node:url");
+let _exadev_release_gate = require("@exadev/release-gate");
 //#region src/package-name.ts
 const packageName = "@exadev/semantic-release-workspace";
 //#endregion
@@ -1031,6 +1032,134 @@ async function loadReleasePlugin(absolutePath, cache) {
 	return loaded;
 }
 //#endregion
+//#region src/gate-publish.ts
+/**
+* The `gatePublish: true` half of `releaseWorkspace`: tags and pushes every due package via `@exadev/release-gate`'s `detachRelease`, but never publishes. Built on the same `runReleaseLoop` the normal per-package path uses, so dependency-range bumps between packages happen identically either way -- only the release call itself (`detachRelease` instead of `semanticRelease`) and how "did it release" gets read differ.
+*/
+async function detachWorkspaceRelease(options) {
+	const root = (0, node_path.resolve)(options.root ?? process.cwd());
+	const log = options.log ?? console.log;
+	const dryRun = options.dryRun === true;
+	const env = sanitizeGitEnv(options.env ?? process.env);
+	const workspace = await discoverWorkspace(root);
+	const graph = buildDependencyGraph(workspace.packages);
+	validateDependencyRangeShapes(graph);
+	const order = topologicalOrder(graph);
+	log(`${packageName}: ${order.length} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
+	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
+	const analyzeCommitsConfig = options.analyzeCommits ?? {};
+	const generateNotesConfig = options.generateNotes ?? {};
+	const entries = await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
+		const state = await runPackageDetach(pkg, {
+			publishPlugins,
+			analyzeCommitsConfig,
+			generateNotesConfig,
+			bumpsForThisPackage,
+			dryRun,
+			env,
+			branches: options.branches
+		});
+		return {
+			released: state !== null,
+			version: state?.nextRelease.version,
+			result: state
+		};
+	});
+	return {
+		order,
+		packages: entries.map((entry) => ({
+			name: entry.name,
+			directory: entry.directory,
+			released: entry.result !== null,
+			version: entry.result?.nextRelease.version,
+			gitTag: entry.result?.nextRelease.gitTag,
+			type: entry.result?.nextRelease.type,
+			dependencyBumps: entry.dependencyBumps
+		})),
+		detached: entries.map((entry) => ({
+			name: entry.name,
+			relativeDirectory: entry.relativeDirectory,
+			state: entry.result,
+			dependencyBumps: entry.dependencyBumps
+		}))
+	};
+}
+async function runPackageDetach(pkg, options) {
+	const scoped = createScopedPlugins({
+		pkg,
+		analyzeCommitsConfig: options.analyzeCommitsConfig,
+		generateNotesConfig: options.generateNotesConfig,
+		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+	});
+	const cliOptions = {
+		tagFormat: `${pkg.name}@\${version}`,
+		plugins: options.publishPlugins,
+		analyzeCommits: scoped.analyzeCommits,
+		generateNotes: scoped.generateNotes
+	};
+	if (options.dryRun) cliOptions.dryRun = true;
+	if (options.branches !== void 0) cliOptions.branches = options.branches;
+	try {
+		return await (0, _exadev_release_gate.detachRelease)(cliOptions, {
+			cwd: pkg.directory,
+			env: { ...options.env }
+		});
+	} catch (cause) {
+		throw new WorkspaceReleaseError(`Detaching ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+}
+/**
+* Finishes every package a `gatePublish: true` `releaseWorkspace` run tagged and pushed but did not publish. Resumes each `detached` entry in the array's own order -- not re-derived from the workspace's dependency graph, since a resume pass may run in a separate process or checkout, where re-deriving order should only ever matter for directory lookup, not sequencing.
+*/
+async function resumeWorkspaceRelease(options) {
+	const root = (0, node_path.resolve)(options.root ?? process.cwd());
+	const log = options.log ?? console.log;
+	const env = sanitizeGitEnv(options.env ?? process.env);
+	const order = [];
+	const packages = [];
+	for (const entry of options.detached) {
+		order.push(entry.name);
+		if (entry.state === null) {
+			log(`${entry.name}: no release to resume`);
+			packages.push({
+				name: entry.name,
+				directory: (0, node_path.resolve)(root, entry.relativeDirectory),
+				released: false,
+				version: void 0,
+				gitTag: void 0,
+				type: void 0,
+				dependencyBumps: entry.dependencyBumps
+			});
+			continue;
+		}
+		const directory = (0, node_path.resolve)(root, entry.relativeDirectory);
+		log(`Resuming ${entry.name} from ${entry.relativeDirectory}`);
+		let releases;
+		try {
+			releases = await (0, _exadev_release_gate.resumeRelease)(entry.state, {
+				cwd: directory,
+				env: { ...env }
+			});
+		} catch (cause) {
+			throw new WorkspaceReleaseError(`Resuming ${entry.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+		}
+		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${releases.length} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
+		packages.push({
+			name: entry.name,
+			directory,
+			released: true,
+			version: entry.state.nextRelease.version,
+			gitTag: entry.state.nextRelease.gitTag,
+			type: entry.state.nextRelease.type,
+			dependencyBumps: entry.dependencyBumps
+		});
+	}
+	return {
+		order,
+		packages
+	};
+}
+//#endregion
 //#region src/release.ts
 /**
 * Releases every package in a pnpm workspace with independent versions, in dependency order.
@@ -1038,6 +1167,10 @@ async function loadReleasePlugin(absolutePath, cache) {
 * For each package, in topological order: run semantic-release's programmatic API with `cwd` scoped to the package directory, a `name@version` tag format to keep each package's tags distinct in the one shared tag namespace, and inline `analyzeCommits`/`generateNotes` plugins that filter the release range's commits down to the package's own directory before delegating to the standard plugins. When a package releases, every workspace package that depends on it and has not run yet gets its dependency range rewritten in its manifest and committed immediately -- before its own turn, so its commit analysis and its published manifest both see the new range.
 */
 async function releaseWorkspace(options = {}) {
+	if (options.gatePublish === true) {
+		if ((options.commitStrategy ?? "per-package") === "single") throw new ReleaseConfigurationError("gatePublish is not supported together with commitStrategy: \"single\" -- single-commit-release.ts's tag/publish machinery is entirely bespoke and never goes through semantic-release's own run(), so it has no insertion point for release-gate's detach/resume primitives.");
+		return detachWorkspaceRelease(options);
+	}
 	if ((options.commitStrategy ?? "per-package") === "single") return releaseWorkspaceSingleCommit(options);
 	const root = (0, node_path.resolve)(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
@@ -1051,40 +1184,65 @@ async function releaseWorkspace(options = {}) {
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
+	return {
+		order,
+		packages: (await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
+			const result = await runPackageRelease(pkg, {
+				publishPlugins,
+				analyzeCommitsConfig,
+				generateNotesConfig,
+				bumpsForThisPackage,
+				dryRun,
+				env,
+				branches: options.branches
+			});
+			const nextRelease = result === false ? void 0 : result.nextRelease;
+			return {
+				released: nextRelease !== void 0,
+				version: nextRelease?.version,
+				result
+			};
+		})).map((entry) => {
+			const nextRelease = entry.result === false ? void 0 : entry.result.nextRelease;
+			return {
+				name: entry.name,
+				directory: entry.directory,
+				released: nextRelease !== void 0,
+				version: nextRelease?.version,
+				gitTag: nextRelease?.gitTag,
+				type: nextRelease?.type,
+				dependencyBumps: entry.dependencyBumps
+			};
+		})
+	};
+}
+/**
+* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, and what version" off the result, both captured by `releaseOne`.
+*/
+async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne) {
 	const pendingBumps = /* @__PURE__ */ new Map();
 	let identity;
-	const outcomes = [];
+	const entries = [];
 	for (const name of order) {
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const result = await runPackageRelease(pkg, {
-			publishPlugins,
-			analyzeCommitsConfig,
-			generateNotesConfig,
-			bumpsForThisPackage,
-			dryRun,
-			env,
-			branches: options.branches
-		});
-		const nextRelease = result === false ? void 0 : result.nextRelease;
-		outcomes.push({
+		const { released, version, result } = await releaseOne(pkg, bumpsForThisPackage);
+		entries.push({
 			name,
 			directory: pkg.directory,
-			released: nextRelease !== void 0,
-			version: nextRelease?.version,
-			gitTag: nextRelease?.gitTag,
-			type: nextRelease?.type,
+			relativeDirectory: pkg.relativeDirectory,
+			result,
 			dependencyBumps: bumpsForThisPackage
 		});
 		pendingBumps.delete(name);
-		if (nextRelease === void 0) {
+		if (!released || version === void 0) {
 			log(`${name}: no release`);
 			continue;
 		}
-		log(`${name}: released ${nextRelease.gitTag}`);
+		log(`${name}: released ${version}`);
 		identity ??= await resolveCommitIdentity({ cwd: workspace.root });
-		const bumps = await bumpDependents(pkg, nextRelease.version, graph, {
+		const bumps = await bumpDependents(pkg, version, graph, {
 			workspace,
 			dryRun,
 			identity,
@@ -1096,10 +1254,7 @@ async function releaseWorkspace(options = {}) {
 			pendingBumps.set(bump.dependent, forDependent);
 		}
 	}
-	return {
-		order,
-		packages: outcomes
-	};
+	return entries;
 }
 async function runPackageRelease(pkg, options) {
 	const scoped = createScopedPlugins({
@@ -1188,6 +1343,7 @@ exports.packageName = packageName;
 exports.readManifest = readManifest;
 exports.releaseWorkspace = releaseWorkspace;
 exports.resolvePublishPlugins = resolvePublishPlugins;
+exports.resumeWorkspaceRelease = resumeWorkspaceRelease;
 exports.topologicalOrder = topologicalOrder;
 exports.updateDependencyRange = updateDependencyRange;
 exports.writeDependencyRange = writeDependencyRange;

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext } from "semantic-release";
+import { ReleaseGateState } from "@exadev/release-gate";
 //#region src/package-name.d.ts
 declare const packageName = "@exadev/semantic-release-workspace";
 //#endregion
@@ -184,6 +185,30 @@ declare function resolvePublishPlugins(specs: readonly PublishPluginSpec[], work
   readonly forbidGitPlugin?: boolean;
 }): readonly ResolvedPublishPlugin[];
 //#endregion
+//#region src/gate-publish.d.ts
+/**
+ * One package's outcome from a gated (`gatePublish: true`) detach pass -- what `resumeWorkspaceRelease` needs later to finish publishing it. `relativeDirectory`, not the absolute `directory`, is what a resume pass actually uses to resolve `cwd`: a resume can run against a different checkout of the same repository (a separate CI job, a separate clone) at a different absolute path, and `relativeDirectory` is the portable part.
+ */
+interface DetachedPackageRelease {
+  readonly name: string;
+  readonly relativeDirectory: string;
+  /** The state to hand `resumeRelease`, or `null` if this package had nothing to release. */
+  readonly state: ReleaseGateState | null;
+  readonly dependencyBumps: readonly AppliedDependencyBump[];
+}
+interface ResumeWorkspaceReleaseOptions {
+  /** Directory holding the workspace's `pnpm-workspace.yaml` in *this* checkout -- not necessarily the same absolute path the detach pass ran from. Defaults to the process working directory. */
+  readonly root?: string;
+  readonly env?: NodeJS.ProcessEnv;
+  /** `WorkspaceReleaseOutcome.detached` from the earlier `releaseWorkspace({gatePublish: true})` call this resumes. */
+  readonly detached: readonly DetachedPackageRelease[];
+  readonly log?: (message: string) => void;
+}
+/**
+ * Finishes every package a `gatePublish: true` `releaseWorkspace` run tagged and pushed but did not publish. Resumes each `detached` entry in the array's own order -- not re-derived from the workspace's dependency graph, since a resume pass may run in a separate process or checkout, where re-deriving order should only ever matter for directory lookup, not sequencing.
+ */
+declare function resumeWorkspaceRelease(options: ResumeWorkspaceReleaseOptions): Promise<WorkspaceReleaseOutcome>;
+//#endregion
 //#region src/release.d.ts
 /**
  * How a run commits its released changes:
@@ -211,6 +236,10 @@ interface ReleaseWorkspaceOptions {
   readonly log?: (message: string) => void;
   /** How the run commits its released changes. Defaults to `'per-package'`, today's exact existing behaviour. See `CommitStrategy` for what each mode does. */
   readonly commitStrategy?: CommitStrategy;
+  /**
+   * Opt-in, orthogonal to `commitStrategy` -- it governs *when* publish/success run relative to tag+push, not *how many commits* the release makes. When `true`, each package's release is tagged and pushed via `@exadev/release-gate`'s `detachRelease` but never published: `WorkspaceReleaseOutcome.detached` carries the state `resumeWorkspaceRelease` needs to finish publishing later, from the same process or a different one, once an external gate confirms the release should actually go out. Rejected outright in combination with `commitStrategy: 'single'` -- `single-commit-release.ts`'s tag/publish machinery is entirely bespoke and never goes through semantic-release's own `run()`, so it has no insertion point for `release-gate`'s primitives. Defaults to `false`, today's exact existing behaviour.
+   */
+  readonly gatePublish?: boolean;
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {
@@ -233,6 +262,8 @@ interface WorkspaceReleaseOutcome {
   /** The topological order the packages were released in. */
   readonly order: readonly string[];
   readonly packages: readonly PackageReleaseOutcome[];
+  /** Present only when `gatePublish: true`: one entry per package in `order`, carrying the `@exadev/release-gate` state `resumeWorkspaceRelease` needs to finish publishing it later, or `null` for a package that had nothing to release. */
+  readonly detached?: readonly DetachedPackageRelease[];
 }
 /**
  * Releases every package in a pnpm workspace with independent versions, in dependency order.
@@ -270,4 +301,4 @@ declare class GitCommandError extends WorkspaceReleaseError {
 /** The workspace's git state does not support the release operation -- for example a detached HEAD, which names no branch that dependency-bump commits could be pushed to. */
 declare class WorkspaceStateError extends WorkspaceReleaseError {}
 //#endregion
-export { type AppliedDependencyBump, type CommitStrategy, DEFAULT_PUBLISH_PLUGINS, type DependencyBump, type DependencyBumpSource, DependencyCycleError, type DependencyField, type DependencyGraph, type DependencyRangeShape, type DependencyRangeUpdate, GitCommandError, type PackageManifest, type PackageReleaseOutcome, type PublishPluginSpec, ReleaseConfigurationError, type ReleaseWorkspaceOptions, type ResolvedPublishPlugin, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, type ScopedPlugins, UnsupportedDependencyRangeError, type Workspace, type WorkspaceDependency, WorkspaceDiscoveryError, type WorkspacePackage, WorkspaceReleaseError, type WorkspaceReleaseOutcome, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, topologicalOrder, updateDependencyRange, writeDependencyRange };
+export { type AppliedDependencyBump, type CommitStrategy, DEFAULT_PUBLISH_PLUGINS, type DependencyBump, type DependencyBumpSource, DependencyCycleError, type DependencyField, type DependencyGraph, type DependencyRangeShape, type DependencyRangeUpdate, type DetachedPackageRelease, GitCommandError, type PackageManifest, type PackageReleaseOutcome, type PublishPluginSpec, ReleaseConfigurationError, type ReleaseWorkspaceOptions, type ResolvedPublishPlugin, type ResumeWorkspaceReleaseOptions, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, type ScopedPlugins, UnsupportedDependencyRangeError, type Workspace, type WorkspaceDependency, WorkspaceDiscoveryError, type WorkspacePackage, WorkspaceReleaseError, type WorkspaceReleaseOutcome, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, resumeWorkspaceRelease, topologicalOrder, updateDependencyRange, writeDependencyRange };

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { AnalyzeCommitsContext, BranchSpec, Commit, GenerateNotesContext } from "semantic-release";
+import { ReleaseGateState } from "@exadev/release-gate";
 //#region src/package-name.d.ts
 declare const packageName = "@exadev/semantic-release-workspace";
 //#endregion
@@ -184,6 +185,30 @@ declare function resolvePublishPlugins(specs: readonly PublishPluginSpec[], work
   readonly forbidGitPlugin?: boolean;
 }): readonly ResolvedPublishPlugin[];
 //#endregion
+//#region src/gate-publish.d.ts
+/**
+ * One package's outcome from a gated (`gatePublish: true`) detach pass -- what `resumeWorkspaceRelease` needs later to finish publishing it. `relativeDirectory`, not the absolute `directory`, is what a resume pass actually uses to resolve `cwd`: a resume can run against a different checkout of the same repository (a separate CI job, a separate clone) at a different absolute path, and `relativeDirectory` is the portable part.
+ */
+interface DetachedPackageRelease {
+  readonly name: string;
+  readonly relativeDirectory: string;
+  /** The state to hand `resumeRelease`, or `null` if this package had nothing to release. */
+  readonly state: ReleaseGateState | null;
+  readonly dependencyBumps: readonly AppliedDependencyBump[];
+}
+interface ResumeWorkspaceReleaseOptions {
+  /** Directory holding the workspace's `pnpm-workspace.yaml` in *this* checkout -- not necessarily the same absolute path the detach pass ran from. Defaults to the process working directory. */
+  readonly root?: string;
+  readonly env?: NodeJS.ProcessEnv;
+  /** `WorkspaceReleaseOutcome.detached` from the earlier `releaseWorkspace({gatePublish: true})` call this resumes. */
+  readonly detached: readonly DetachedPackageRelease[];
+  readonly log?: (message: string) => void;
+}
+/**
+ * Finishes every package a `gatePublish: true` `releaseWorkspace` run tagged and pushed but did not publish. Resumes each `detached` entry in the array's own order -- not re-derived from the workspace's dependency graph, since a resume pass may run in a separate process or checkout, where re-deriving order should only ever matter for directory lookup, not sequencing.
+ */
+declare function resumeWorkspaceRelease(options: ResumeWorkspaceReleaseOptions): Promise<WorkspaceReleaseOutcome>;
+//#endregion
 //#region src/release.d.ts
 /**
  * How a run commits its released changes:
@@ -211,6 +236,10 @@ interface ReleaseWorkspaceOptions {
   readonly log?: (message: string) => void;
   /** How the run commits its released changes. Defaults to `'per-package'`, today's exact existing behaviour. See `CommitStrategy` for what each mode does. */
   readonly commitStrategy?: CommitStrategy;
+  /**
+   * Opt-in, orthogonal to `commitStrategy` -- it governs *when* publish/success run relative to tag+push, not *how many commits* the release makes. When `true`, each package's release is tagged and pushed via `@exadev/release-gate`'s `detachRelease` but never published: `WorkspaceReleaseOutcome.detached` carries the state `resumeWorkspaceRelease` needs to finish publishing later, from the same process or a different one, once an external gate confirms the release should actually go out. Rejected outright in combination with `commitStrategy: 'single'` -- `single-commit-release.ts`'s tag/publish machinery is entirely bespoke and never goes through semantic-release's own `run()`, so it has no insertion point for `release-gate`'s primitives. Defaults to `false`, today's exact existing behaviour.
+   */
+  readonly gatePublish?: boolean;
 }
 /** One dependency-range change applied to a dependent package's manifest during the run, attached to the dependent's own outcome. */
 interface AppliedDependencyBump extends DependencyBump {
@@ -233,6 +262,8 @@ interface WorkspaceReleaseOutcome {
   /** The topological order the packages were released in. */
   readonly order: readonly string[];
   readonly packages: readonly PackageReleaseOutcome[];
+  /** Present only when `gatePublish: true`: one entry per package in `order`, carrying the `@exadev/release-gate` state `resumeWorkspaceRelease` needs to finish publishing it later, or `null` for a package that had nothing to release. */
+  readonly detached?: readonly DetachedPackageRelease[];
 }
 /**
  * Releases every package in a pnpm workspace with independent versions, in dependency order.
@@ -270,4 +301,4 @@ declare class GitCommandError extends WorkspaceReleaseError {
 /** The workspace's git state does not support the release operation -- for example a detached HEAD, which names no branch that dependency-bump commits could be pushed to. */
 declare class WorkspaceStateError extends WorkspaceReleaseError {}
 //#endregion
-export { type AppliedDependencyBump, type CommitStrategy, DEFAULT_PUBLISH_PLUGINS, type DependencyBump, type DependencyBumpSource, DependencyCycleError, type DependencyField, type DependencyGraph, type DependencyRangeShape, type DependencyRangeUpdate, GitCommandError, type PackageManifest, type PackageReleaseOutcome, type PublishPluginSpec, ReleaseConfigurationError, type ReleaseWorkspaceOptions, type ResolvedPublishPlugin, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, type ScopedPlugins, UnsupportedDependencyRangeError, type Workspace, type WorkspaceDependency, WorkspaceDiscoveryError, type WorkspacePackage, WorkspaceReleaseError, type WorkspaceReleaseOutcome, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, topologicalOrder, updateDependencyRange, writeDependencyRange };
+export { type AppliedDependencyBump, type CommitStrategy, DEFAULT_PUBLISH_PLUGINS, type DependencyBump, type DependencyBumpSource, DependencyCycleError, type DependencyField, type DependencyGraph, type DependencyRangeShape, type DependencyRangeUpdate, type DetachedPackageRelease, GitCommandError, type PackageManifest, type PackageReleaseOutcome, type PublishPluginSpec, ReleaseConfigurationError, type ReleaseWorkspaceOptions, type ResolvedPublishPlugin, type ResumeWorkspaceReleaseOptions, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, type ScopedPlugins, UnsupportedDependencyRangeError, type Workspace, type WorkspaceDependency, WorkspaceDiscoveryError, type WorkspacePackage, WorkspaceReleaseError, type WorkspaceReleaseOutcome, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, resumeWorkspaceRelease, topologicalOrder, updateDependencyRange, writeDependencyRange };

package/dist/index.js

@@ -10,6 +10,7 @@ import { analyzeCommits } from "@semantic-release/commit-analyzer";
 import { generateNotes } from "@semantic-release/release-notes-generator";
 import semanticRelease from "semantic-release";
 import { pathToFileURL } from "node:url";
+import { detachRelease, resumeRelease } from "@exadev/release-gate";
 //#region src/package-name.ts
 const packageName = "@exadev/semantic-release-workspace";
 //#endregion
@@ -1006,6 +1007,134 @@ async function loadReleasePlugin(absolutePath, cache) {
 	return loaded;
 }
 //#endregion
+//#region src/gate-publish.ts
+/**
+* The `gatePublish: true` half of `releaseWorkspace`: tags and pushes every due package via `@exadev/release-gate`'s `detachRelease`, but never publishes. Built on the same `runReleaseLoop` the normal per-package path uses, so dependency-range bumps between packages happen identically either way -- only the release call itself (`detachRelease` instead of `semanticRelease`) and how "did it release" gets read differ.
+*/
+async function detachWorkspaceRelease(options) {
+	const root = resolve(options.root ?? process.cwd());
+	const log = options.log ?? console.log;
+	const dryRun = options.dryRun === true;
+	const env = sanitizeGitEnv(options.env ?? process.env);
+	const workspace = await discoverWorkspace(root);
+	const graph = buildDependencyGraph(workspace.packages);
+	validateDependencyRangeShapes(graph);
+	const order = topologicalOrder(graph);
+	log(`${packageName}: ${order.length} packages in release order (gated -- tag only, publish deferred): ${order.join(" -> ")}`);
+	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
+	const analyzeCommitsConfig = options.analyzeCommits ?? {};
+	const generateNotesConfig = options.generateNotes ?? {};
+	const entries = await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
+		const state = await runPackageDetach(pkg, {
+			publishPlugins,
+			analyzeCommitsConfig,
+			generateNotesConfig,
+			bumpsForThisPackage,
+			dryRun,
+			env,
+			branches: options.branches
+		});
+		return {
+			released: state !== null,
+			version: state?.nextRelease.version,
+			result: state
+		};
+	});
+	return {
+		order,
+		packages: entries.map((entry) => ({
+			name: entry.name,
+			directory: entry.directory,
+			released: entry.result !== null,
+			version: entry.result?.nextRelease.version,
+			gitTag: entry.result?.nextRelease.gitTag,
+			type: entry.result?.nextRelease.type,
+			dependencyBumps: entry.dependencyBumps
+		})),
+		detached: entries.map((entry) => ({
+			name: entry.name,
+			relativeDirectory: entry.relativeDirectory,
+			state: entry.result,
+			dependencyBumps: entry.dependencyBumps
+		}))
+	};
+}
+async function runPackageDetach(pkg, options) {
+	const scoped = createScopedPlugins({
+		pkg,
+		analyzeCommitsConfig: options.analyzeCommitsConfig,
+		generateNotesConfig: options.generateNotesConfig,
+		bumps: { bumpsFor: () => options.bumpsForThisPackage }
+	});
+	const cliOptions = {
+		tagFormat: `${pkg.name}@\${version}`,
+		plugins: options.publishPlugins,
+		analyzeCommits: scoped.analyzeCommits,
+		generateNotes: scoped.generateNotes
+	};
+	if (options.dryRun) cliOptions.dryRun = true;
+	if (options.branches !== void 0) cliOptions.branches = options.branches;
+	try {
+		return await detachRelease(cliOptions, {
+			cwd: pkg.directory,
+			env: { ...options.env }
+		});
+	} catch (cause) {
+		throw new WorkspaceReleaseError(`Detaching ${pkg.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+}
+/**
+* Finishes every package a `gatePublish: true` `releaseWorkspace` run tagged and pushed but did not publish. Resumes each `detached` entry in the array's own order -- not re-derived from the workspace's dependency graph, since a resume pass may run in a separate process or checkout, where re-deriving order should only ever matter for directory lookup, not sequencing.
+*/
+async function resumeWorkspaceRelease(options) {
+	const root = resolve(options.root ?? process.cwd());
+	const log = options.log ?? console.log;
+	const env = sanitizeGitEnv(options.env ?? process.env);
+	const order = [];
+	const packages = [];
+	for (const entry of options.detached) {
+		order.push(entry.name);
+		if (entry.state === null) {
+			log(`${entry.name}: no release to resume`);
+			packages.push({
+				name: entry.name,
+				directory: resolve(root, entry.relativeDirectory),
+				released: false,
+				version: void 0,
+				gitTag: void 0,
+				type: void 0,
+				dependencyBumps: entry.dependencyBumps
+			});
+			continue;
+		}
+		const directory = resolve(root, entry.relativeDirectory);
+		log(`Resuming ${entry.name} from ${entry.relativeDirectory}`);
+		let releases;
+		try {
+			releases = await resumeRelease(entry.state, {
+				cwd: directory,
+				env: { ...env }
+			});
+		} catch (cause) {
+			throw new WorkspaceReleaseError(`Resuming ${entry.name} failed: ${cause instanceof Error ? cause.message : String(cause)}`);
+		}
+		log(`${entry.name}: published ${entry.state.nextRelease.gitTag} (${releases.length} publish plugin${releases.length === 1 ? "" : "s"} ran)`);
+		packages.push({
+			name: entry.name,
+			directory,
+			released: true,
+			version: entry.state.nextRelease.version,
+			gitTag: entry.state.nextRelease.gitTag,
+			type: entry.state.nextRelease.type,
+			dependencyBumps: entry.dependencyBumps
+		});
+	}
+	return {
+		order,
+		packages
+	};
+}
+//#endregion
 //#region src/release.ts
 /**
 * Releases every package in a pnpm workspace with independent versions, in dependency order.
@@ -1013,6 +1142,10 @@ async function loadReleasePlugin(absolutePath, cache) {
 * For each package, in topological order: run semantic-release's programmatic API with `cwd` scoped to the package directory, a `name@version` tag format to keep each package's tags distinct in the one shared tag namespace, and inline `analyzeCommits`/`generateNotes` plugins that filter the release range's commits down to the package's own directory before delegating to the standard plugins. When a package releases, every workspace package that depends on it and has not run yet gets its dependency range rewritten in its manifest and committed immediately -- before its own turn, so its commit analysis and its published manifest both see the new range.
 */
 async function releaseWorkspace(options = {}) {
+	if (options.gatePublish === true) {
+		if ((options.commitStrategy ?? "per-package") === "single") throw new ReleaseConfigurationError("gatePublish is not supported together with commitStrategy: \"single\" -- single-commit-release.ts's tag/publish machinery is entirely bespoke and never goes through semantic-release's own run(), so it has no insertion point for release-gate's detach/resume primitives.");
+		return detachWorkspaceRelease(options);
+	}
 	if ((options.commitStrategy ?? "per-package") === "single") return releaseWorkspaceSingleCommit(options);
 	const root = resolve(options.root ?? process.cwd());
 	const log = options.log ?? console.log;
@@ -1026,40 +1159,65 @@ async function releaseWorkspace(options = {}) {
 	const publishPlugins = resolvePublishPlugins(options.plugins ?? DEFAULT_PUBLISH_PLUGINS, workspace.root, { requireGitPlugin: !dryRun });
 	const analyzeCommitsConfig = options.analyzeCommits ?? {};
 	const generateNotesConfig = options.generateNotes ?? {};
+	return {
+		order,
+		packages: (await runReleaseLoop(graph, order, workspace, dryRun, log, async (pkg, bumpsForThisPackage) => {
+			const result = await runPackageRelease(pkg, {
+				publishPlugins,
+				analyzeCommitsConfig,
+				generateNotesConfig,
+				bumpsForThisPackage,
+				dryRun,
+				env,
+				branches: options.branches
+			});
+			const nextRelease = result === false ? void 0 : result.nextRelease;
+			return {
+				released: nextRelease !== void 0,
+				version: nextRelease?.version,
+				result
+			};
+		})).map((entry) => {
+			const nextRelease = entry.result === false ? void 0 : entry.result.nextRelease;
+			return {
+				name: entry.name,
+				directory: entry.directory,
+				released: nextRelease !== void 0,
+				version: nextRelease?.version,
+				gitTag: nextRelease?.gitTag,
+				type: nextRelease?.type,
+				dependencyBumps: entry.dependencyBumps
+			};
+		})
+	};
+}
+/**
+* The per-package release loop shared by `releaseWorkspace` (normal per-package releases) and `detachWorkspaceRelease` (gated tag-only releases): iterate the topological `order`, call the caller's own `releaseOne` for each package, record which dependency-range bumps were already applied to it, and -- when it released -- bump every workspace dependent's manifest before that dependent's own turn (see `bumpDependents`'s doc comment for why this happens immediately rather than being staged). The two call sites differ only in how they call semantic-release (`semanticRelease(...)` vs `detachRelease(...)`) and how they read "did it release, and what version" off the result, both captured by `releaseOne`.
+*/
+async function runReleaseLoop(graph, order, workspace, dryRun, log, releaseOne) {
 	const pendingBumps = /* @__PURE__ */ new Map();
 	let identity;
-	const outcomes = [];
+	const entries = [];
 	for (const name of order) {
 		const pkg = mustGet(graph.packages, name, "package");
 		const bumpsForThisPackage = pendingBumps.get(name) ?? [];
 		log(`Releasing ${name} from ${pkg.relativeDirectory}${bumpsForThisPackage.length > 0 ? ` (dependency ranges already bumped: ${bumpsForThisPackage.map((bump) => bump.dependency).join(", ")})` : ""}`);
-		const result = await runPackageRelease(pkg, {
-			publishPlugins,
-			analyzeCommitsConfig,
-			generateNotesConfig,
-			bumpsForThisPackage,
-			dryRun,
-			env,
-			branches: options.branches
-		});
-		const nextRelease = result === false ? void 0 : result.nextRelease;
-		outcomes.push({
+		const { released, version, result } = await releaseOne(pkg, bumpsForThisPackage);
+		entries.push({
 			name,
 			directory: pkg.directory,
-			released: nextRelease !== void 0,
-			version: nextRelease?.version,
-			gitTag: nextRelease?.gitTag,
-			type: nextRelease?.type,
+			relativeDirectory: pkg.relativeDirectory,
+			result,
 			dependencyBumps: bumpsForThisPackage
 		});
 		pendingBumps.delete(name);
-		if (nextRelease === void 0) {
+		if (!released || version === void 0) {
 			log(`${name}: no release`);
 			continue;
 		}
-		log(`${name}: released ${nextRelease.gitTag}`);
+		log(`${name}: released ${version}`);
 		identity ??= await resolveCommitIdentity({ cwd: workspace.root });
-		const bumps = await bumpDependents(pkg, nextRelease.version, graph, {
+		const bumps = await bumpDependents(pkg, version, graph, {
 			workspace,
 			dryRun,
 			identity,
@@ -1071,10 +1229,7 @@ async function releaseWorkspace(options = {}) {
 			pendingBumps.set(bump.dependent, forDependent);
 		}
 	}
-	return {
-		order,
-		packages: outcomes
-	};
+	return entries;
 }
 async function runPackageRelease(pkg, options) {
 	const scoped = createScopedPlugins({
@@ -1145,4 +1300,4 @@ async function bumpDependents(released, version, graph, options) {
 	return applied;
 }
 //#endregion
-export { DEFAULT_PUBLISH_PLUGINS, DependencyCycleError, GitCommandError, ReleaseConfigurationError, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, UnsupportedDependencyRangeError, WorkspaceDiscoveryError, WorkspaceReleaseError, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, topologicalOrder, updateDependencyRange, writeDependencyRange };
+export { DEFAULT_PUBLISH_PLUGINS, DependencyCycleError, GitCommandError, ReleaseConfigurationError, SINGLE_COMMIT_DEFAULT_PUBLISH_PLUGINS, UnsupportedDependencyRangeError, WorkspaceDiscoveryError, WorkspaceReleaseError, WorkspaceStateError, buildDependencyGraph, classifyDependencyRange, createScopedPlugins, discoverWorkspace, filterCommitsToDirectory, packageName, readManifest, releaseWorkspace, resolvePublishPlugins, resumeWorkspaceRelease, topologicalOrder, updateDependencyRange, writeDependencyRange };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exadev/semantic-release-workspace",
-  "version": "1.2.3",
+  "version": "1.3.0",
   "description": "Independent per-package semantic-release orchestration for pnpm workspaces, without lockstep versioning.",
   "type": "module",
   "repository": {
@@ -77,6 +77,7 @@
   "license": "MIT",
   "packageManager": "pnpm@11.6.0",
   "dependencies": {
+    "@exadev/release-gate": "^1.0.0",
     "commander": "^15.0.0",
     "cosmiconfig": "^9.0.2",
     "tinyglobby": "^0.2.17",