@homeflare/config 0.11.1 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/config",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Shared tsconfig, oxlint, oxfmt, and non-npm release helpers for HomeFlare projects.",
   "license": "MIT",
   "author": "Timothy Schneider",

package/src/repo-shape/dependabot.ts

@@ -1,36 +1,29 @@
 /**
- * `.github/dependabot.yml`, rendered — and the one group that carries kit releases.
+ * `.github/dependabot.yml`, rendered.
  *
  * ★ MEASURED BEFORE IT WAS RENDERED (2026-09-22): 1 of 14 repositories had a Dependabot
  *   config. Twelve took no dependency or Action updates at all, and nothing said so.
  *
- * ★ THE `homeflare` GROUP IS HOW A KIT RELEASE REACHES A CONSUMER (Tim, 2026-09-23:
- *   "Dependabot, grouped", checked daily, merged on green). Measured the same day, the
- *   leg nobody automated had drifted: proxmox and mini pinned `@homeflare/alchemy` 0.13.0
- *   while the kit had published 0.19.1. `automerge.ts` renders the workflow that arms
- *   auto-merge on this group's pull request and on nothing else.
+ * ⛔ `@homeflare/*` IS IGNORED HERE, NOT GROUPED (retired 2026-09-23, kit auto-bumper
+ *   design, Tim). A `homeflare` group and a rendered `dependabot-automerge.yml`
+ *   used to carry kit releases into a consumer; both are gone. `homeflare-bumper` does
+ *   that job now, over `workflow_dispatch` from this repo's own release, with a schedule
+ *   backstop — a Dependabot bump running at the same time would open a SECOND, competing
+ *   pull request for the same version bump. The `ignore` entry below is what stops that:
+ *   Dependabot never proposes `@homeflare/*` at all, so there is only ever one bump PR.
  *
  * Every Dependabot claim below was read from GitHub's docs or dependabot-core's source on
  * 2026-09-22 (dependabot-core v0.397.0); `docs/repo-shape-dependabot.md` has the citations.
  */
 import type { RepoShape } from './shape.ts';
 
-/**
- * The group's identifier. ⛔ IT IS ALSO HALF OF A BRANCH NAME the auto-merge workflow
- *   matches — dependabot-core names a group's branch `dependabot/bun/<group>-<10 hex>`
- *   (branch_namer/dependency_group_strategy.rb) — so it is exported, not retyped there.
- *   Dependabot requires an identifier that starts and ends with a letter.
- */
-export const HOMEFLARE_GROUP = 'homeflare';
-
 /** The first-party scope. Every package the kit publishes is under it. */
 export const HOMEFLARE_PATTERN = '@homeflare/*';
 
 /**
- * ★ SEVEN DAYS FOR THIRD-PARTY VERSIONS. The bun block has to run daily for the kit's sake
- *   (see below), so the weekly pace the estate had for everything else is kept by age
- *   instead of by calendar: a third-party release is proposed once it is a week old. That
- *   is also the supply-chain half — a compromised release is usually yanked within days.
+ * ★ SEVEN DAYS. A third-party release is proposed once it is a week old rather than on
+ *   Dependabot's undocumented-but-real 3-day default — that is also the supply-chain
+ *   half, since a compromised release is usually yanked within days.
  */
 export const THIRD_PARTY_COOLDOWN_DAYS = 7;
 
@@ -65,41 +58,33 @@ version: 2
 
 updates:
   # ── The toolchain (bun.lock) ────────────────────────────────────────────────
-  # ⚠️ BLOCKED UPSTREAM, 2026-09-22: bun 1.4 writes bun.lock \`lockfileVersion\` 2 and
-  #   Dependabot's updater bundles bun 1.3.14, which reads up to 1, so this block fails in
-  #   every estate repository with "Unsupported bun.lock 'lockfileVersion' 2". The fix is
+  # ⚠️ STILL BLOCKED UPSTREAM, 2026-09-22 — unrelated to the ignore below. bun 1.4 writes
+  #   bun.lock \`lockfileVersion\` 2 and Dependabot's updater bundles bun 1.3.14, which reads
+  #   up to 1, so this whole block fails in every estate repository with "Unsupported
+  #   bun.lock 'lockfileVersion' 2" before it reads a single manifest. The fix is
   #   dependabot/dependabot-core pull request 16071. The github-actions block is unaffected.
-  # ⛔ ONE BUN BLOCK, SO ONE SCHEDULE. Dependabot refuses two blocks for one ecosystem and
-  #   target branch whose directories overlap, so the \`homeflare\` group cannot be daily
-  #   while the rest stays weekly. The block is daily; \`cooldown\` slows the rest.
   - package-ecosystem: bun
     directories:
 ${bunDirs.map((dir) => `      - ${dir}`).join('\n')}
     schedule:
-      # ⚠️ Dependabot's \`daily\` is Monday to Friday; a weekend kit release lands on Monday.
-      interval: daily
+      interval: weekly
+      day: monday
       time: '09:00'
       timezone: America/New_York
-    # ⛔ THE EXCLUDE IS NOT OPTIONAL. Dependabot applies a 3-day cooldown to every version
-    #   update even when this key is absent, so without it a kit release would wait three
-    #   days before its bump opened — and "daily" would quietly mean "three days late".
     cooldown:
       default-days: ${THIRD_PARTY_COOLDOWN_DAYS}
-      exclude: ['${HOMEFLARE_PATTERN}']
+    # ⛔ NEVER PROPOSED HERE. \`homeflare-bumper\` opens the one pull request that bumps
+    #   \`@homeflare/*\` (kit auto-bumper design, Tim 2026-09-23) — a Dependabot
+    #   update for the same package would race it and, on the weeks they disagree, leave
+    #   two open pull requests fighting over the same \`package.json\` line.
+    ignore:
+      - dependency-name: '${HOMEFLARE_PATTERN}'
     open-pull-requests-limit: 5
     commit-message:
       prefix: 'chore'
       include: scope
     labels: [dependencies]
     groups:
-      # ★ FIRST, AND EVERY UPDATE TYPE. A kit release is one set of packages built to work
-      #   together, so they move as one pull request; \`bun run check\` is what reads it, and
-      #   .github/workflows/dependabot-automerge.yml merges it when that is green.
-      #   ⚠️ A release that changes what @homeflare/config renders fails the drift test here
-      #   by design; \`bun run repo-shape:refresh\` on the branch is the one-command fix.
-      ${HOMEFLARE_GROUP}:
-        patterns: ['${HOMEFLARE_PATTERN}']
-
       # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
       # noise unless they fail CI, which is what CI is for.
       lint-and-format:

package/src/repo-shape/render.ts

@@ -20,7 +20,6 @@
  *     test lives in `packages/alchemy/tests/repo-shape-policy.test.ts`, which is the one
  *     place that imports both.
  */
-import { renderAutomerge } from './automerge.ts';
 import { renderCi } from './ci.ts';
 import { renderActionlintConfig, renderChangesetConfig } from './companions.ts';
 import { renderDependabot } from './dependabot.ts';
@@ -68,7 +67,6 @@ export function renderRepoShape(shape: RepoShape): RenderedRepo {
     '.changeset/config.json': renderChangesetConfig(shape),
     '.github/dependabot.yml': renderDependabot(shape),
     '.github/workflows/ci.yml': renderCi(shape),
-    '.github/workflows/dependabot-automerge.yml': renderAutomerge(shape),
     '.github/workflows/security.yml': renderSecurity(shape),
   };
 
@@ -87,6 +85,5 @@ export const RENDERED_PATHS: readonly RenderedPath[] = [
   '.github/actionlint.yaml',
   '.github/dependabot.yml',
   '.github/workflows/ci.yml',
-  '.github/workflows/dependabot-automerge.yml',
   '.github/workflows/security.yml',
 ];

package/src/repo-shape/shape.ts

@@ -86,7 +86,6 @@ export type RenderedPath =
   | '.github/actionlint.yaml'
   | '.github/dependabot.yml'
   | '.github/workflows/ci.yml'
-  | '.github/workflows/dependabot-automerge.yml'
   | '.github/workflows/security.yml';
 
 export interface RepoShapeException {

package/src/repo-shape.ts

@@ -17,8 +17,7 @@
  * That one file gives the repository:
  *
  *   · its FILES     — `bun run repo-shape:refresh` writes ci.yml, security.yml,
- *                     dependabot-automerge.yml, actionlint.yaml, dependabot.yml and
- *                     the changeset config;
+ *                     actionlint.yaml, dependabot.yml and the changeset config;
  *   · its DRIFT GATE — a `bun:test` calling `driftInRepoShape` fails on a hand edit;
  *   · its SETTINGS  — `renderRepoShape(shape).policy` is the options object
  *                     `@homeflare/alchemy`'s `declareRepoPolicy` takes, so the ruleset
@@ -34,11 +33,9 @@
  *   including the ones with no Alchemy stack, so it belongs to the package they all
  *   already have — and it takes no dependency on Alchemy or Effect to get there.
  */
-export { GROUP_BRANCH, GROUP_BRANCH_PREFIX, renderAutomerge } from './repo-shape/automerge.ts';
 export { renderCi, ACTIONLINT_VERSION, BUN_VERSION } from './repo-shape/ci.ts';
 export { renderActionlintConfig, renderChangesetConfig } from './repo-shape/companions.ts';
 export {
-  HOMEFLARE_GROUP,
   HOMEFLARE_PATTERN,
   renderDependabot,
   THIRD_PARTY_COOLDOWN_DAYS,

package/dist/repo-shape/automerge.d.ts

@@ -1,17 +0,0 @@
-import type { RepoShape } from './shape.ts';
-/**
- * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression
- * language has no regex, so this is the cheap filter that keeps every other pull request
- * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.
- */
-export declare const GROUP_BRANCH_PREFIX: string;
-/**
- * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is
- *   `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be
- *   `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its
- *   format, the symptom is a bump that waits for a person — never one merged by mistake.
- */
-export declare const GROUP_BRANCH: string;
-/** The whole `dependabot-automerge.yml` for a shape. */
-export declare function renderAutomerge(shape: RepoShape): string;
-//# sourceMappingURL=automerge.d.ts.map

package/dist/repo-shape/automerge.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"automerge.d.ts","sourceRoot":"","sources":["../../src/repo-shape/automerge.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAA6C,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,MAA+C,CAAC;AA0D3E,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,CAyCxD"}

package/src/repo-shape/automerge.ts

@@ -1,144 +0,0 @@
-/**
- * `.github/workflows/dependabot-automerge.yml`, rendered.
- *
- * ★ THE OTHER HALF OF THE `homeflare` GROUP. Dependabot opens the bump; this arms GitHub's
- *   own auto-merge on it; the branch ruleset's required checks (`ci`, `secret scan`)
- *   decide whether it ever merges. Nothing here merges anything itself, and a merge
- *   deploys nothing — every stack in the estate is deployed by hand.
- *
- * ⛔ `gh pr merge --auto` IS NOT ALWAYS "ARM". When the pull request is already CLEAN,
- *   UNSTABLE or HAS_HOOKS it merges AT ONCE instead (cli/cli `pkg/cmd/pr/merge/merge.go`,
- *   `isImmediatelyMergeable`, read at v2.101.0 — the version the mini's job image ships).
- *   UNSTABLE is "mergeable, with a non-passing status", which is every pull request on a
- *   branch whose rules require no check: before `check` has run, and even after it failed.
- *   So the step reads the base branch's active rules first and refuses — a red check, never
- *   a merge — when none requires a status check. Measured 2026-09-22: homeflare-builds (its
- *   ruleset not deployed yet) and homeflare-desktop have none.
- *
- * ⛔ FIRST-PARTY ONLY: A `run:` STEP AND THE GitHub CLI, NO `uses:` AT ALL. GitHub's own
- *   example ("Automating Dependabot with GitHub Actions") identifies the update with
- *   `dependabot/fetch-metadata`, which the same page marks as "not certified by GitHub".
- *   The group is identified by the branch Dependabot gives it instead, whose format is
- *   dependabot-core's (`branch_namer/dependency_group_strategy.rb`, read at v0.397.0):
- *   `<prefix>/<package manager>/<directory>/<group>-<10 hex MD5 digest>`, with the root
- *   directory collapsing to nothing.
- */
-import { HOMEFLARE_GROUP } from './dependabot.ts';
-import type { RepoShape } from './shape.ts';
-import { runsOn } from './shape.ts';
-import { renderSteps } from './yaml.ts';
-
-/**
- * The branch prefix a job-level `if:` can test with `startsWith`. GitHub's expression
- * language has no regex, so this is the cheap filter that keeps every other pull request
- * from taking a runner slot; `GROUP_BRANCH` is the exact test inside the step.
- */
-export const GROUP_BRANCH_PREFIX: string = `dependabot/bun/${HOMEFLARE_GROUP}-`;
-
-/**
- * ⛔ EXACT, AND FAILS CLOSED. A solo update of `@homeflare/config` is
- *   `dependabot/bun/homeflare/config-0.9.0` and a package named `homeflare-x` would be
- *   `dependabot/bun/homeflare-x-1.2.3`; neither matches. If Dependabot ever changes its
- *   format, the symptom is a bump that waits for a person — never one merged by mistake.
- */
-export const GROUP_BRANCH: string = `^${GROUP_BRANCH_PREFIX}[0-9a-f]{10}$`;
-
-const HEADER = `# Arms auto-merge on Dependabot's @homeflare/* group, and on nothing else.
-#
-# 🤖 RENDERED BY @homeflare/config — DO NOT EDIT THIS FILE BY HAND.
-#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
-#
-# ★ HOW A KIT RELEASE ARRIVES: the \`${HOMEFLARE_GROUP}\` group in .github/dependabot.yml opens one
-#   pull request; this arms GitHub's auto-merge on it; the ruleset's required checks decide.
-#   Nothing here merges anything itself, and merging deploys nothing.
-# ⛔ NO THIRD-PARTY ACTION. GitHub's own example uses dependabot/fetch-metadata, which its
-#   docs mark "not certified by GitHub"; the group is recognised by its branch name instead.
-# ⛔ NO REQUIRED CHECK ON THE BASE BRANCH, NO ARMING: there \`gh pr merge --auto\` would merge
-#   at once, unchecked. The job fails instead, so the pull request waits for a person.
-# ⚠️ A RENDERER CHANGE STILL NEEDS A PERSON. When a kit release changes what @homeflare/config
-#   renders, the bump fails \`check\` (the drift test) and never goes green. Run
-#   \`bun run repo-shape:refresh\` on Dependabot's branch and push. ⛔ This workflow does not do
-#   it for you: a push made with GITHUB_TOKEN starts no workflow run, so a refreshed commit
-#   would never get the required checks and the pull request would wait forever.
-`;
-
-const TRIGGER = `name: dependabot auto-merge
-
-on:
-  pull_request:
-
-# ⛔ NOTHING AT THE TOP; the one job asks for exactly what \`gh pr merge --auto\` needs.
-permissions: {}
-
-concurrency:
-  group: automerge-\${{ github.ref }}
-  cancel-in-progress: true
-`;
-
-const JOB_NOTE = `  # ⛔ BOTH LOGINS, NOT EITHER. \`user.login\` is who opened the pull request; \`github.actor\` is
-  #   who started this run. A person pushing to Dependabot's branch changes the actor, so
-  #   their commit never arms anything; only Dependabot's own rebases do.`;
-
-const PERMISSIONS_NOTE = `    # ★ WHAT GitHub'S OWN EXAMPLE GRANTS FOR THIS STEP, AND NO MORE. A run Dependabot starts gets
-    #   a read-only GITHUB_TOKEN unless the workflow raises it ("Troubleshooting Dependabot on
-    #   GitHub Actions" → "Changing GITHUB_TOKEN permissions").`;
-
-const ARM = `set -euo pipefail
-if [[ ! "$HEAD_REF" =~ ${GROUP_BRANCH} ]]; then
-  echo "::notice::$HEAD_REF is not the ${HOMEFLARE_GROUP} group's branch; auto-merge not armed"
-  exit 0
-fi
-# ⛔ gh merges a CLEAN or UNSTABLE pull request at once rather than arming it. Only a branch
-#   rule that requires a status check keeps it BLOCKED until the checks have passed.
-required=$(gh api "repos/$GITHUB_REPOSITORY/rules/branches/$BASE_REF" \\
-  --jq '[.[] | select(.type == "required_status_checks")] | length')
-if [ "$required" = 0 ]; then
-  echo "::error::$BASE_REF requires no status check, so gh would merge at once; auto-merge not armed"
-  exit 1
-fi
-# ★ --squash: the house repositories allow squash merges only (declareRepoPolicy).
-gh pr merge --auto --squash "$PR_URL"`;
-
-/** The whole `dependabot-automerge.yml` for a shape. */
-export function renderAutomerge(shape: RepoShape): string {
-  // ⚠️ GitHub ACTIONS EXPRESSIONS, NOT TEMPLATE LITERALS: the runner interpolates `${{ … }}`
-  //   at job time, so they must reach the file verbatim (see security.ts for the same note).
-  // oxlint-disable-next-line no-template-curly-in-string
-  const headRef = '${{ github.head_ref }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const baseRef = '${{ github.base_ref }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const prUrl = '${{ github.event.pull_request.html_url }}';
-  // oxlint-disable-next-line no-template-curly-in-string
-  const token = '${{ secrets.GITHUB_TOKEN }}';
-  const condition = [
-    "github.event.pull_request.user.login == 'dependabot[bot]'",
-    "github.actor == 'dependabot[bot]'",
-    `startsWith(github.head_ref, '${GROUP_BRANCH_PREFIX}')`,
-  ].join(' && ');
-
-  return `${HEADER}
-${TRIGGER}
-jobs:
-${JOB_NOTE}
-  arm:
-    name: arm auto-merge
-    if: ${condition}
-    runs-on: ${runsOn(shape.runner)}
-${PERMISSIONS_NOTE}
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-${renderSteps(
-  [
-    {
-      env: { BASE_REF: baseRef, GH_TOKEN: token, HEAD_REF: headRef, PR_URL: prUrl },
-      name: 'Arm auto-merge on the homeflare group',
-      run: ARM,
-    },
-  ],
-  3,
-)}
-`;
-}