@fairgarden/distribution 0.1.0-0.canary.0

package/dist/workflows.js

@@ -0,0 +1,710 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import path from 'node:path';
+import semver from 'semver';
+import { fileURLToPath } from 'node:url';
+import { submodules } from "./submodules.js";
+import { CHANGELOG, newChangelog } from "./changelog.js";
+/**
+ * The publishing workflow a module carries.
+ *
+ * A module releases on its own schedule, so the workflow lives in the module
+ * rather than the distribution. Authentication is npm trusted publishing over
+ * OIDC — there is no token to leak, and the package must already exist on npm
+ * with a trusted publisher pointing at this repository and this file.
+ */
+export const publishWorkflow = (packageName) => ({
+    '.github/workflows/publish.yml': `name: Publish
+
+# npm trusted publishing is configured against one workflow file per package,
+# so canary and release both live here. There is no npm token: the package must
+# already exist on npm with a trusted publisher pointing at this repository and
+# this file. Bootstrap a new package by publishing it once from a workstation,
+# then configure trusted publishing on npmjs.com.
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: '0 0 * * *' # Daily at midnight UTC
+  workflow_dispatch:
+    inputs:
+      dist-tag:
+        description: 'npm dist tag to publish the release to'
+        required: false
+        type: string
+        default: 'latest'
+      dry-run:
+        description: 'Pack and validate without publishing'
+        required: false
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: publish-\${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  canary:
+    name: Publish canary
+    # Lockfile bumps do not warrant a canary.
+    if: >
+      github.event_name == 'schedule'
+      || (github.event_name == 'push' && github.event.head_commit.author.name != 'renovate[bot]')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for provenance and trusted publishing
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Prepare for publishing
+        uses: ./.github/actions/publish-prepare
+
+      - name: Stamp the canary version
+        id: canary
+        # \`fg-dist canary\` works out the version and whether there is anything
+        # to publish: a canary records the commit it was built from, so a
+        # nightly run with nothing new is a no-op rather than a version bump.
+        run: pnpm run canary
+
+      - name: Publish to npm
+        if: steps.canary.outputs.skip != 'true'
+        # Provenance only where npm will generate it: it refuses for anything
+        # not published publicly, and refusing is a failed publish.
+        run: |
+          if [ "\${{ steps.canary.outputs.provenance }}" = "true" ]; then
+            npm publish --tag canary --provenance
+          else
+            npm publish --tag canary
+          fi
+
+      - name: Summary
+        run: |
+          if [ "\${{ steps.canary.outputs.skip }}" = "true" ]; then
+            echo "\\\`\${{ steps.canary.outputs.version }}\\\` is already the canary for this commit." >> "\$GITHUB_STEP_SUMMARY"
+          else
+            echo "Published \\\`${packageName}@\${{ steps.canary.outputs.version }}\\\` to the \\\`canary\\\` tag." >> "\$GITHUB_STEP_SUMMARY"
+          fi
+
+  release:
+    name: Publish release
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for pushing the tag and creating the release
+      id-token: write # Required for provenance and trusted publishing
+    environment:
+      name: npm-publish
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          fetch-depth: 0 # \`gh release create --generate-notes\` needs history
+
+      - name: Prepare for publishing
+        uses: ./.github/actions/publish-prepare
+
+      - name: Resolve version
+        id: version
+        # Refuses when the version is already on npm: main is meant to carry the
+        # next unreleased version, so finding it published means \`fg-dist
+        # release\` has not run since the last one.
+        run: pnpm run release:check
+
+      - name: Publish to npm
+        env:
+          DIST_TAG: \${{ inputs.dist-tag }}
+          # npm refuses provenance for anything not published publicly.
+          PROVENANCE: \${{ steps.version.outputs.provenance }}
+          DRY_RUN: \${{ inputs.dry-run }}
+        run: |
+          flags="--tag \$DIST_TAG"
+          [ "\$PROVENANCE" = "true" ] && flags="\$flags --provenance"
+          [ "\$DRY_RUN" = "true" ] && flags="\$flags --dry-run"
+          npm publish \$flags
+
+      - name: Tag and create the GitHub release
+        if: inputs.dry-run != true
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          TAG: \${{ steps.version.outputs.tag }}
+        run: |
+          git tag "\$TAG"
+          git push origin "\$TAG"
+          # The notes are the changelog's section for this version, written as
+          # each pull request merged; GitHub's own where there is none.
+          if pnpm run --silent changelog notes > "\$RUNNER_TEMP/notes.md"; then
+            notes="--notes-file \$RUNNER_TEMP/notes.md"
+          else
+            notes="--generate-notes"
+          fi
+          gh release create "\$TAG" --title "\$TAG" \$notes --verify-tag
+
+      - name: Summary
+        run: |
+          echo "Published \\\`${packageName}@\${{ steps.version.outputs.version }}\\\` to the \\\`\${{ inputs.dist-tag }}\\\` tag." >> "\$GITHUB_STEP_SUMMARY"
+`,
+    '.github/actions/publish-prepare/action.yml': `name: Prepare for publishing
+description: Install dependencies and build, so the package is ready to publish.
+
+# Kept as an action rather than repeated steps: npm trusted publishing pins one
+# workflow file per package, so the canary and release jobs both have to share
+# this.
+
+runs:
+  using: composite
+  steps:
+    # Pin these to a commit sha once Renovate is watching the repository. The
+    # checkout in the workflow is pinned already, because it handles credentials.
+    #
+    # No \`version\` here: the \`packageManager\` field in package.json is what
+    # pins pnpm, and giving both makes this action refuse to choose.
+    - uses: pnpm/action-setup@v4
+
+    - uses: actions/setup-node@v4
+      with:
+        # Inline rather than \`node-version-file\`, so this action works in a
+        # repository that has no \`.nvmrc\`.
+        node-version: 22
+        # No \`cache: pnpm\`: it needs a lockfile to hash, and a module developed
+        # inside a distribution keeps its lockfile in the distribution.
+        #
+        # No \`registry-url\` either. Given one, setup-node writes an .npmrc
+        # with \`_authToken=\${NODE_AUTH_TOKEN}\` and, with no token to put
+        # there, exports a placeholder. npm then publishes with that instead of
+        # exchanging the Actions OIDC token, and the registry answers
+        # \`E404 Not Found - PUT\`. Trusted publishing needs npm to find no
+        # credentials at all; npmjs.org is the default registry anyway.
+
+    # Trusted publishing needs npm 11.5.1 or later, which Node 22 does not ship.
+    - name: Update npm
+      shell: bash
+      run: npm install -g npm@^11.5.1
+
+    - name: Install
+      shell: bash
+      run: |
+        if [ -f pnpm-lock.yaml ]; then
+          pnpm install --frozen-lockfile
+        else
+          # A module developed inside a distribution has no lockfile of its
+          # own; the distribution's workspace holds it.
+          pnpm install --no-frozen-lockfile
+        fi
+
+    - name: Build
+      shell: bash
+      # A module that is consumed as source has nothing to build; one that ships
+      # a \`dist\` does. Neither should have to edit this file.
+      run: pnpm run --if-present build
+`,
+});
+/** Steps both of a distribution's publishing jobs start with. */
+const distributionSetup = (fetchDepth) => `      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          # What it publishes is read from its modules: their versions, and
+          # the commits it pins.
+          submodules: true${fetchDepth ? '\n          fetch-depth: 0 # `gh release create --generate-notes` needs history' : ''}
+
+      # No build: what a distribution publishes is its manifest and its
+      # policy, not its apps.
+      - uses: pnpm/action-setup@v4
+
+      # No \`registry-url\`, and npm new enough for trusted publishing: see
+      # .github/actions/publish-prepare in any module for why.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Update npm
+        run: npm install -g npm@^11.5.1
+
+      - name: Install
+        run: pnpm install --frozen-lockfile
+
+      # Only where fg-dist is developed in this workspace, as a module of the
+      # distribution: then it is linked from its checkout, which is not built.
+      # Everywhere else it is installed from npm, and this matches nothing.
+      - name: Build fg-dist
+        run: pnpm --filter @fairgarden/distribution run --if-present build
+`;
+/**
+ * The publishing workflow a distribution carries, for others to extend it.
+ *
+ * The same shape as a module's — a canary on every push to main, a release by
+ * hand — but checked out with its submodules, since `fg-dist canary` and
+ * `release --check` record every module's version, path, repository and
+ * commit in the manifest they publish. That is what an extension checks
+ * itself against and takes its own modules from.
+ */
+export const distributionWorkflow = (packageName) => ({
+    '.github/workflows/publish.yml': `name: Publish
+
+# Publishes this distribution for others to extend. As for a module, npm
+# trusted publishing is configured against this one workflow file, and there is
+# no npm token: publish once from a workstation, then configure it on npmjs.com.
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      dist-tag:
+        description: 'npm dist tag to publish the release to'
+        required: false
+        type: string
+        default: 'latest'
+      dry-run:
+        description: 'Pack and validate without publishing'
+        required: false
+        type: boolean
+        default: false
+
+permissions: {}
+
+concurrency:
+  group: publish-\${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  canary:
+    name: Publish canary
+    if: github.event_name == 'push' && github.event.head_commit.author.name != 'renovate[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # Required for provenance and trusted publishing
+    steps:
+${distributionSetup(false)}
+      - name: Stamp the canary version and what it ships
+        id: canary
+        run: pnpm run canary
+
+      - name: Publish to npm
+        if: steps.canary.outputs.skip != 'true'
+        run: |
+          if [ "\${{ steps.canary.outputs.provenance }}" = "true" ]; then
+            npm publish --tag canary --provenance
+          else
+            npm publish --tag canary
+          fi
+
+  release:
+    name: Publish release
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for pushing the tag and creating the release
+      id-token: write # Required for provenance and trusted publishing
+    environment:
+      name: npm-publish
+    steps:
+${distributionSetup(true)}
+      - name: Stamp what it ships
+        id: version
+        # Refuses when this version is on npm already, or names a month that
+        # is over: \`fg-dist release\` moves the distribution on.
+        run: pnpm run release:check
+
+      - name: Publish to npm
+        env:
+          DIST_TAG: \${{ inputs.dist-tag }}
+          PROVENANCE: \${{ steps.version.outputs.provenance }}
+          DRY_RUN: \${{ inputs.dry-run }}
+        run: |
+          flags="--tag \$DIST_TAG"
+          [ "\$PROVENANCE" = "true" ] && flags="\$flags --provenance"
+          [ "\$DRY_RUN" = "true" ] && flags="\$flags --dry-run"
+          npm publish \$flags
+
+      - name: Tag and create the GitHub release
+        if: inputs.dry-run != true
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          TAG: \${{ steps.version.outputs.tag }}
+        run: |
+          git tag "\$TAG"
+          git push origin "\$TAG"
+          # The changelog's section for this version: the modules it moved,
+          # and what changed in the organization's policy.
+          if pnpm run --silent changelog notes > "\$RUNNER_TEMP/notes.md"; then
+            notes="--notes-file \$RUNNER_TEMP/notes.md"
+          else
+            notes="--generate-notes"
+          fi
+          gh release create "\$TAG" --title "\$TAG" \$notes --verify-tag
+
+      - name: Summary
+        run: |
+          echo "Published \\\`${packageName}@\${{ steps.version.outputs.version }}\\\`." >> "\$GITHUB_STEP_SUMMARY"
+`,
+    ...changelogWorkflow({ submodules: true }),
+});
+/**
+ * The pull request check that keeps a changelog current.
+ *
+ * Every pull request has to add a line linking itself under the version being
+ * worked on — or, in a distribution, every one that changes the
+ * organization's policy — so a release's notes are written, and committed,
+ * before it is released. A distribution is checked out with its submodules,
+ * without which its workspace does not install.
+ */
+export const changelogWorkflow = ({ submodules }) => ({
+    '.github/workflows/changelog.yml': `name: Changelog
+
+# Every pull request says what it changes in CHANGELOG.md, under the version
+# being worked on, with a link to itself — so that version's notes are written,
+# and committed, before it is released: whoever makes the change writes the
+# line, and review sees it with the change. Make this job a required status
+# check on main, or it only advises.
+#
+# A pull request that changes nothing anyone would read about — a lockfile
+# bump — is labelled "skip changelog".
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+jobs:
+  changelog:
+    name: Changelog entry
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          fetch-depth: 0 # to compare with what it merges into${submodules ? '\n          submodules: true # a distribution does not install without them' : ''}
+
+      - uses: pnpm/action-setup@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Install
+        run: |
+          if [ -f pnpm-lock.yaml ]; then
+            pnpm install --frozen-lockfile
+          else
+            pnpm install --no-frozen-lockfile
+          fi
+
+      # Only where fg-dist is developed in this workspace; see publish.yml.
+      - name: Build fg-dist
+        run: pnpm --filter @fairgarden/distribution run --if-present build
+
+      - name: Check for a line linking this pull request
+        run: pnpm run changelog check
+`,
+});
+const readManifest = async (root) => {
+    try {
+        return JSON.parse(await readFile(path.join(root, 'package.json'), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+};
+/** The package whose CLI a module releases with. */
+const TOOL = '@fairgarden/distribution';
+/**
+ * This tool's own version, which is what a module is given to release with.
+ *
+ * Read rather than written down, so a module is pinned to the CLI that set it
+ * up instead of to whatever was current when this file was last edited.
+ */
+const toolVersion = async () => {
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const own = await readManifest(path.join(here, '..'));
+    return typeof own?.version === 'string' ? own.version : undefined;
+};
+/**
+ * The scripts the workflow calls, and a module releases by hand with.
+ *
+ * They are named rather than spelled out in the workflow so that every
+ * module's workflow is the same file, and so `pnpm release` is the answer to
+ * "how do I release this" wherever you are standing.
+ */
+export const releaseScripts = (packageName) => {
+    // The tool cannot depend on itself being published to release itself.
+    const cli = packageName === TOOL ? 'node dist/cli.js' : 'fg-dist';
+    return {
+        canary: `${cli} canary`,
+        release: `${cli} release`,
+        'release:check': `${cli} release --check`,
+        changelog: `${cli} changelog`,
+    };
+};
+/**
+ * Give a module what it needs to publish itself.
+ *
+ * One pass over the manifest rather than several: a structural rewrite undoes
+ * a careful textual splice, so doing both would mean the second silently
+ * discarding the first's formatting. Two-space JSON is what npm and pnpm write
+ * anyway.
+ */
+export const updateManifest = async (moduleRoot, packageName, version, packageManager, { write = true } = {}) => {
+    const manifest = await readManifest(moduleRoot);
+    if (!manifest) {
+        return { changed: false, unprivated: false, missingFiles: false, missingAccess: false };
+    }
+    const before = JSON.stringify(manifest);
+    const updated = { ...manifest };
+    // A private package cannot be published, which is the one thing the workflow
+    // being added here is for.
+    const unprivated = updated.private === true;
+    if (unprivated)
+        delete updated.private;
+    // `pnpm/action-setup` takes its version from this field and will not run
+    // without one. A module that pins its own is left alone.
+    if (!updated.packageManager && packageManager) {
+        updated.packageManager = packageManager;
+    }
+    const scripts = { ...updated.scripts };
+    for (const [name, command] of Object.entries(releaseScripts(packageName))) {
+        // A script the module already defines may call the tool differently on
+        // purpose.
+        if (!scripts[name])
+            scripts[name] = command;
+    }
+    updated.scripts = scripts;
+    const dependencies = updated.dependencies;
+    const devDependencies = updated.devDependencies;
+    // Whichever list already has it wins; the tool is only needed to release, so
+    // a module that does not already depend on it gets it as a devDependency.
+    if (packageName !== TOOL && !dependencies?.[TOOL] && !devDependencies?.[TOOL] && version) {
+        updated.devDependencies = { ...devDependencies, [TOOL]: `^${version}` };
+    }
+    // One that does is moved up to this version at least: the workflows written
+    // here call commands it has, and an older one — resolved from npm in the
+    // module's own CI — would not know them.
+    for (const key of ['dependencies', 'devDependencies']) {
+        const list = updated[key];
+        const range = list?.[TOOL];
+        const floor = range ? semver.minVersion(range, { loose: true }) : null;
+        if (packageName !== TOOL && version && floor && semver.lt(floor, version)) {
+            updated[key] = { ...list, [TOOL]: `^${version}` };
+        }
+    }
+    const changed = JSON.stringify(updated) !== before;
+    if (changed && write) {
+        await writeFile(path.join(moduleRoot, 'package.json'), `${JSON.stringify(updated, null, 2)}\n`);
+    }
+    // Guessed at, this would be wrong: a module consumed as source ships `app`
+    // and `lib`, one that builds ships `dist`, and npm's default ships both plus
+    // whatever else is lying around. Report it instead.
+    // Both of these are reported rather than guessed. `files` because a module
+    // consumed as source ships `app` and `lib` while one that builds ships
+    // `dist`. `publishConfig.access` because npm takes an explicit value as an
+    // instruction to *change* an existing package's visibility — writing
+    // `restricted` into an already-public package would make it private on the
+    // next publish, or fail on an org with no paid plan.
+    return {
+        changed,
+        unprivated,
+        missingFiles: !updated.files,
+        missingAccess: packageName.startsWith('@') &&
+            updated.publishConfig?.access === undefined,
+    };
+};
+/**
+ * Give every module a publishing workflow.
+ *
+ * A module that already has one is left alone: it may have been changed on
+ * purpose, and overwriting it would be the kind of help nobody asked for.
+ */
+export const writeWorkflows = async (root, { force = false, dryRun = false, names = [], } = {}) => {
+    const updates = [];
+    // What the distribution builds with, which is what its modules are developed
+    // against whether or not they say so themselves.
+    const packageManager = (await readManifest(root))?.packageManager;
+    const spec = typeof packageManager === 'string' ? packageManager : undefined;
+    const tool = await toolVersion();
+    const unknown = names.filter((name) => !submodules(root).some((submodule) => submodule.name === name || submodule.relativePath === name));
+    if (unknown.length > 0)
+        throw new Error(`No such module: ${unknown.join(', ')}.`);
+    for (const submodule of submodules(root)) {
+        if (names.length > 0 && !names.includes(submodule.name) && !names.includes(submodule.relativePath))
+            continue;
+        const name = (await readManifest(submodule.path))?.name;
+        if (typeof name !== 'string')
+            continue;
+        // File by file: a module that publishes already still gets the changelog
+        // check it lacks, and what it has is only replaced when forced.
+        const written = [];
+        const files = { ...publishWorkflow(name), ...changelogWorkflow({ submodules: false }) };
+        for (const [relative, contents] of Object.entries(files)) {
+            const full = path.join(submodule.path, relative);
+            if (existsSync(full) && !force)
+                continue;
+            if (!dryRun) {
+                await mkdir(path.dirname(full), { recursive: true });
+                await writeFile(full, contents);
+            }
+            written.push(relative);
+        }
+        if (await startChangelog(submodule.path, dryRun))
+            written.push(CHANGELOG);
+        // An earlier version of this command shipped the canary stamper as a file
+        // in the module. It is a CLI command now, and a stale copy of it would go
+        // on being the thing anyone reads.
+        const stale = path.join(submodule.path, 'scripts/stampCanaryVersion.mjs');
+        if (existsSync(stale)) {
+            if (!dryRun) {
+                await rm(stale);
+                // And the directory, if that was the only thing in it. A module with
+                // scripts of its own keeps them.
+                await rm(path.dirname(stale), { recursive: false }).catch(() => { });
+            }
+            written.push('scripts/stampCanaryVersion.mjs (removed)');
+        }
+        const manifest = await updateManifest(submodule.path, name, tool, spec, {
+            write: !dryRun,
+        });
+        if (manifest.changed)
+            written.push('package.json');
+        updates.push({
+            relativePath: submodule.relativePath,
+            files: written.sort(),
+            skipped: written.length === 0,
+            unprivated: manifest.unprivated,
+            missingFiles: manifest.missingFiles,
+            missingAccess: manifest.missingAccess,
+        });
+    }
+    return updates;
+};
+/**
+ * Give the distribution itself a publishing workflow, so others can extend it.
+ *
+ * Asked for rather than done by `writeWorkflows`: it makes the distribution
+ * public on npm, which a distribution only its owner deploys has no need to be.
+ * The tarball is the manifest and the organization's policy, which is what an
+ * extension builds its own on.
+ */
+export const writeDistributionWorkflow = async (root, { force = false, dryRun = false } = {}) => {
+    const manifest = await readManifest(root);
+    const name = manifest?.name;
+    if (typeof name !== 'string')
+        throw new Error('The distribution needs a name in package.json to publish.');
+    const relativePath = '.';
+    const workflow = path.join(root, '.github/workflows/publish.yml');
+    if (existsSync(workflow) && !force) {
+        return { relativePath, files: [], skipped: true, unprivated: false, missingFiles: false, missingAccess: false };
+    }
+    const written = [];
+    for (const [relative, contents] of Object.entries(distributionWorkflow(name))) {
+        if (!dryRun) {
+            await mkdir(path.dirname(path.join(root, relative)), { recursive: true });
+            await writeFile(path.join(root, relative), contents);
+        }
+        written.push(relative);
+    }
+    if (await startChangelog(root, dryRun))
+        written.push(CHANGELOG);
+    const packageManager = typeof manifest?.packageManager === 'string' ? manifest.packageManager : undefined;
+    const change = await updateManifest(root, name, await toolVersion(), packageManager, { write: !dryRun });
+    if (change.changed)
+        written.push('package.json');
+    // Its policy is what an extension layers its own on; nothing else is needed.
+    let missingFiles = change.missingFiles;
+    if (missingFiles) {
+        const updated = (await readManifest(root)) ?? {};
+        const files = existsSync(path.join(root, 'policies')) ? ['policies'] : [];
+        if (!dryRun)
+            await writeFile(path.join(root, 'package.json'), `${JSON.stringify({ ...updated, files }, null, 2)}\n`);
+        if (!written.includes('package.json'))
+            written.push('package.json');
+        missingFiles = false;
+    }
+    return {
+        relativePath,
+        files: written.sort(),
+        skipped: false,
+        unprivated: change.unprivated,
+        missingFiles,
+        missingAccess: change.missingAccess,
+    };
+};
+/**
+ * Start a repository's changelog at the version it carries, unless it keeps one
+ * already: a changelog is history, and is never written over.
+ */
+const startChangelog = async (root, dryRun) => {
+    const file = path.join(root, CHANGELOG);
+    if (existsSync(file))
+        return false;
+    const version = (await readManifest(root))?.version;
+    if (typeof version !== 'string')
+        return false;
+    if (!dryRun)
+        await writeFile(file, newChangelog(version));
+    return true;
+};
+/**
+ * Give the distribution itself the changelog check, for pull requests that
+ * change the organization's policy — what else changes in it, fg-dist notes
+ * itself. Unlike its publishing, this makes nothing public.
+ */
+export const writeDistributionChangelogCheck = async (root, { force = false, dryRun = false } = {}) => {
+    const written = [];
+    for (const [relative, contents] of Object.entries(changelogWorkflow({ submodules: true }))) {
+        const full = path.join(root, relative);
+        if (existsSync(full) && !force)
+            continue;
+        if (!dryRun) {
+            await mkdir(path.dirname(full), { recursive: true });
+            await writeFile(full, contents);
+        }
+        written.push(relative);
+    }
+    if (await startChangelog(root, dryRun))
+        written.push(CHANGELOG);
+    // The script the check runs, and the tool it runs — nothing that publishes.
+    const manifest = await readManifest(root);
+    if (manifest) {
+        const scripts = { ...manifest.scripts };
+        const dev = { ...manifest.devDependencies };
+        const deps = manifest.dependencies;
+        const tool = await toolVersion();
+        let changed = false;
+        if (!scripts.changelog) {
+            scripts.changelog = releaseScripts(String(manifest.name ?? '')).changelog;
+            changed = true;
+        }
+        if (!dev[TOOL] && !deps?.[TOOL] && tool) {
+            dev[TOOL] = `^${tool}`;
+            changed = true;
+        }
+        if (changed) {
+            if (!dryRun) {
+                await writeFile(path.join(root, 'package.json'), `${JSON.stringify({ ...manifest, scripts, devDependencies: dev }, null, 2)}\n`);
+            }
+            written.push('package.json');
+        }
+    }
+    return {
+        relativePath: '.',
+        files: written.sort(),
+        skipped: written.length === 0,
+        unprivated: false,
+        missingFiles: false,
+        missingAccess: false,
+    };
+};
+//# sourceMappingURL=workflows.js.map