@frsource/semantic-release-config 1.117.6 → 1.117.7

package/README.md

@@ -9,3 +9,12 @@ Semantic Release configuration files used across the FRSOURCE organization.
 
 export { default } from '@frsource/semantic-release-config';
 ```
+
+## Skipping releases that change nothing
+
+`chore(deps)` commits trigger a patch release. To avoid publishing a new version for dependency bumps that do not change what consumers receive (for example `devDependencies` updates), the commit analyzer is wrapped: when `chore(deps)` commits are the only reason to release, the package is packed with `npm pack` and compared to the tarball of the last published version. If the content is identical, the release is skipped.
+
+- Compared byte for byte, except `package.json`, where `version` and `devDependencies` (and registry-injected fields) are ignored. A change to anything else in `package.json`, such as `dependencies`, still releases.
+- Any `fix`, `feat` or breaking commit always releases, without packing.
+- If the comparison cannot be made (first release, version not on the registry, offline), the release goes ahead.
+- Build the package before running semantic-release, so the packed output reflects the release.

package/index.d.mts

@@ -1,6 +1,8 @@
 declare const _default: {
     branches: string[];
-    plugins: (string | [string, {
+    plugins: (string | [{
+        analyzeCommits: (pluginConfig: any, context: any) => Promise<any>;
+    }, {
         releaseRules: {
             type: string;
             scope: string;

package/index.mjs

@@ -1,3 +1,5 @@
+import { analyzeCommits } from './skip-unchanged.mjs';
+
 /**
  * @type {import('semantic-release').GlobalConfig}
  */
@@ -5,7 +7,7 @@ export default {
   branches: ['main'],
   plugins: [
     [
-      '@semantic-release/commit-analyzer',
+      { analyzeCommits },
       {
         releaseRules: [{ type: 'chore', scope: 'deps', release: 'patch' }],
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frsource/semantic-release-config",
-  "version": "1.117.6",
+  "version": "1.117.7",
   "main": "index.mjs",
   "types": "index.d.mts",
   "dependencies": {
@@ -12,7 +12,7 @@
     "@semantic-release/release-notes-generator": "14.1.1"
   },
   "devDependencies": {
-    "@frsource/eslint-config": "1.86.3",
+    "@frsource/eslint-config": "1.86.4",
     "@frsource/prettier-config": "1.48.2",
     "@frsource/release-it-config": "1.60.3",
     "@types/node": "24.19.2",
@@ -47,6 +47,7 @@
   "funding": "https://buymeacoffee.com/frsource",
   "scripts": {
     "build": "tsc index.mjs --declaration --emitDeclarationOnly --allowJs --moduleResolution bundler --target esnext --skipLibCheck",
+    "test": "node --test",
     "release": "release-it",
     "eslint": "eslint .",
     "prettier": "prettier . --check",

package/skip-unchanged.d.mts

@@ -0,0 +1,2 @@
+export function isSamePackedContent(dirA: any, dirB: any): boolean;
+export function analyzeCommits(pluginConfig: any, context: any): Promise<any>;

package/skip-unchanged.mjs

@@ -0,0 +1,132 @@
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import {
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { analyzeCommits as analyze } from '@semantic-release/commit-analyzer';
+
+/** package.json fields that never reach consumers in a meaningful way. */
+const IGNORED_MANIFEST_FIELDS = ['version', 'devDependencies', 'gitHead'];
+
+const sortKeys = (value) => {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.keys(value)
+        .sort()
+        .map((key) => [key, sortKeys(value[key])]),
+    );
+  }
+  return value;
+};
+
+const normalizeManifest = (raw) => {
+  const manifest = JSON.parse(raw);
+  for (const field of IGNORED_MANIFEST_FIELDS) delete manifest[field];
+  for (const field of Object.keys(manifest)) {
+    if (field.startsWith('_')) delete manifest[field];
+  }
+  return JSON.stringify(sortKeys(manifest));
+};
+
+const listFiles = (dir) =>
+  readdirSync(dir, { recursive: true })
+    .filter((entry) => statSync(join(dir, entry)).isFile())
+    .map((entry) => entry.split('\\').join('/'))
+    .sort();
+
+const hash = (buffer) => createHash('sha256').update(buffer).digest('hex');
+
+/**
+ * Compares two extracted `npm pack` directories (the `package/` folders).
+ * `package.json` is compared without `version`, `devDependencies` and
+ * registry-injected fields; every other file byte by byte.
+ *
+ * @returns {boolean} true when consumers would receive identical content
+ */
+export const isSamePackedContent = (dirA, dirB) => {
+  const filesA = listFiles(dirA);
+  const filesB = listFiles(dirB);
+  if (JSON.stringify(filesA) !== JSON.stringify(filesB)) return false;
+
+  return filesA.every((file) => {
+    const a = readFileSync(join(dirA, file));
+    const b = readFileSync(join(dirB, file));
+    if (file === 'package.json') {
+      return normalizeManifest(a) === normalizeManifest(b);
+    }
+    return hash(a) === hash(b);
+  });
+};
+
+const pack = (spec, cwd, destination) => {
+  const [{ filename }] = JSON.parse(
+    execFileSync(
+      'npm',
+      ['pack', spec, '--json', '--pack-destination', destination],
+      { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] },
+    ),
+  );
+  const extracted = join(destination, `${hash(spec)}-extracted`);
+  mkdirSync(extracted);
+  execFileSync('tar', ['-xzf', join(destination, filename), '-C', extracted]);
+  return join(extracted, 'package');
+};
+
+/**
+ * Packs the current working tree and the last published version and compares
+ * them. Throws when either of them cannot be packed.
+ */
+const isUnchangedSinceLastRelease = ({ cwd, lastRelease }) => {
+  const { name } = JSON.parse(readFileSync(join(cwd, 'package.json'), 'utf8'));
+  const tmp = mkdtempSync(join(tmpdir(), 'skip-unchanged-'));
+  try {
+    const current = pack('.', cwd, tmp);
+    const published = pack(`${name}@${lastRelease.version}`, cwd, tmp);
+    return isSamePackedContent(current, published);
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+};
+
+/**
+ * Drop-in replacement for `@semantic-release/commit-analyzer`. When the only
+ * thing triggering a release are the dependency-bump rules, the release is
+ * skipped if the packed output is identical to the last published version.
+ * Fails open: on any problem it behaves like the plain commit analyzer.
+ */
+export const analyzeCommits = async (pluginConfig, context) => {
+  const releaseType = await analyze(pluginConfig, context);
+  if (releaseType !== 'patch' || !context.lastRelease?.version) {
+    return releaseType;
+  }
+
+  const withoutDepsRules = {
+    ...pluginConfig,
+    releaseRules: (pluginConfig.releaseRules ?? []).filter(
+      ({ scope }) => scope !== 'deps',
+    ),
+  };
+  if (await analyze(withoutDepsRules, context)) return releaseType;
+
+  try {
+    if (isUnchangedSinceLastRelease(context)) {
+      context.logger.log(
+        `Only dependency updates since ${context.lastRelease.version} and the packed output is unchanged, skipping release.`,
+      );
+      return null;
+    }
+  } catch (error) {
+    context.logger.log(
+      `Could not compare with ${context.lastRelease.version} (${error.message}), releasing.`,
+    );
+  }
+  return releaseType;
+};

package/skip-unchanged.test.mjs

@@ -0,0 +1,85 @@
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { afterEach, describe, it } from 'node:test';
+import { isSamePackedContent } from './skip-unchanged.mjs';
+
+const dirs = [];
+const make = (files) => {
+  const dir = mkdtempSync(join(tmpdir(), 'skip-unchanged-test-'));
+  dirs.push(dir);
+  for (const [name, content] of Object.entries(files)) {
+    mkdirSync(dirname(join(dir, name)), { recursive: true });
+    writeFileSync(join(dir, name), content);
+  }
+  return dir;
+};
+const manifest = (extra = {}) =>
+  JSON.stringify({
+    name: 'pkg',
+    version: '1.0.0',
+    dependencies: { a: '1.0.0' },
+    devDependencies: { b: '1.0.0' },
+    ...extra,
+  });
+
+afterEach(() => {
+  for (const dir of dirs.splice(0)) rmSync(dir, { recursive: true });
+});
+
+describe('isSamePackedContent', () => {
+  it('is true for identical content', () => {
+    const files = { 'package.json': manifest(), 'dist/a.js': 'a' };
+    assert.equal(isSamePackedContent(make(files), make(files)), true);
+  });
+
+  it('ignores version, devDependencies and registry fields', () => {
+    const a = make({ 'package.json': manifest(), 'dist/a.js': 'a' });
+    const b = make({
+      'package.json': manifest({
+        version: '1.0.1',
+        devDependencies: { b: '2.0.0' },
+        gitHead: 'abc',
+        _id: 'pkg@1.0.1',
+      }),
+      'dist/a.js': 'a',
+    });
+    assert.equal(isSamePackedContent(a, b), true);
+  });
+
+  it('detects dependencies and other manifest changes', () => {
+    const a = make({ 'package.json': manifest() });
+    assert.equal(
+      isSamePackedContent(
+        a,
+        make({ 'package.json': manifest({ dependencies: { a: '2.0.0' } }) }),
+      ),
+      false,
+    );
+    assert.equal(
+      isSamePackedContent(
+        a,
+        make({ 'package.json': manifest({ engines: { node: '>=20' } }) }),
+      ),
+      false,
+    );
+  });
+
+  it('detects changed, added and removed files', () => {
+    const base = { 'package.json': manifest(), 'dist/a.js': 'a' };
+    const a = make(base);
+    assert.equal(
+      isSamePackedContent(a, make({ ...base, 'dist/a.js': 'b' })),
+      false,
+    );
+    assert.equal(
+      isSamePackedContent(a, make({ ...base, 'dist/b.js': 'a' })),
+      false,
+    );
+    assert.equal(
+      isSamePackedContent(a, make({ 'package.json': manifest() })),
+      false,
+    );
+  });
+});