@icebreakers/monorepo-templates 2.0.3 → 2.0.5

package/assets/.github/workflows/release-intent-auto.yml

@@ -27,14 +27,38 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
+          persist-credentials: false
 
       - name: Setup Node.js environment
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
 
+      - name: Validate GitHub App configuration
+        if: ${{ github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository }}
+        env:
+          APP_CLIENT_ID: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          APP_PRIVATE_KEY_CONFIGURED: ${{ secrets.REPOCTL_APP_PRIVATE_KEY != '' }}
+        run: |
+          if { [ -n "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" != 'true' ]; } ||
+             { [ -z "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" = 'true' ]; }; then
+            echo 'Configure both REPOCTL_APP_CLIENT_ID and REPOCTL_APP_PRIVATE_KEY.' >&2
+            exit 1
+          fi
+
+      - name: Create GitHub App token
+        if: ${{ vars.REPOCTL_APP_CLIENT_ID != '' && (github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository) }}
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REPOCTL_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Generate or backfill changesets
         env:
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
           PR_NUMBERS: ${{ inputs.pr_numbers }}
         run: node .github/auto-changeset/index.mjs

package/assets/.github/workflows/release.yml

@@ -55,10 +55,32 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
+      - name: Validate GitHub App configuration
+        env:
+          APP_CLIENT_ID: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          APP_PRIVATE_KEY_CONFIGURED: ${{ secrets.REPOCTL_APP_PRIVATE_KEY != '' }}
+        run: |
+          if { [ -n "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" != 'true' ]; } ||
+             { [ -z "$APP_CLIENT_ID" ] && [ "$APP_PRIVATE_KEY_CONFIGURED" = 'true' ]; }; then
+            echo 'Configure both REPOCTL_APP_CLIENT_ID and REPOCTL_APP_PRIVATE_KEY.' >&2
+            exit 1
+          fi
+
+      - name: Create GitHub App token
+        if: ${{ vars.REPOCTL_APP_CLIENT_ID != '' }}
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.REPOCTL_APP_CLIENT_ID }}
+          private-key: ${{ secrets.REPOCTL_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
       - name: Checkout Repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
 
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
@@ -77,9 +99,20 @@ jobs:
 
       - name: Run repo release CI
         env:
-          GITHUB_TOKEN: ${{ secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
           REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
           REPO_RELEASE_PACKAGE: ${{ inputs.package }}
           REPO_RELEASE_VERSION: ${{ inputs.version }}
           REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
         run: pnpm exec repo release ci
+
+      - name: Preserve npm publish progress
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: npm-publish-progress-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            pnpm-publish-summary.json
+            repoctl-publish-progress.json
+          if-no-files-found: ignore
+          retention-days: 14

package/assets/gitignore

@@ -40,3 +40,9 @@ config.ts.timestamp-*.mjs
 
 # local AI task artifacts
 /.qoder/
+
+# release diagnostics (retained as CI artifacts)
+/pnpm-publish-summary.json
+/repoctl-publish-progress.json
+/pnpm-publish-summary.json.*.tmp
+/repoctl-publish-progress.json.*.tmp

package/assets/package.json

@@ -28,7 +28,7 @@
   "scripts": {
     "build": "turbo run build",
     "tooling:build": "turbo run build --filter=@icebreakers/monorepo --filter=repoctl",
-    "dev": "turbo run dev --parallel",
+    "dev": "turbo run dev --concurrency=20",
     "test": "node -e \"require('node:fs').mkdirSync('coverage/.tmp', { recursive: true })\" && pnpm check:no-tracked-build-artifacts && vitest run && pnpm test:types",
     "test:packaged-doctor": "node scripts/smoke-packaged-doctor.mjs",
     "test:dev": "node -e \"require('node:fs').mkdirSync('coverage/.tmp', { recursive: true })\" && pnpm check:no-tracked-build-artifacts && vitest",
@@ -77,21 +77,21 @@
     "@icebreakers/eslint-config": "workspace:*",
     "@icebreakers/monorepo": "workspace:*",
     "@icebreakers/stylelint-config": "workspace:*",
-    "@types/node": "^26.6.2",
-    "@vitest/coverage-v8": "~5.0.1",
+    "@types/node": "^26.6.3",
+    "@vitest/coverage-v8": "~5.0.2",
     "eslint": "^10.11.0",
     "execa": "^10.0.1",
     "husky": "^9.1.7",
-    "lint-staged": "^17.5.1",
+    "lint-staged": "^17.6.0",
     "only-allow": "^1.2.2",
     "repoctl": "workspace:*",
     "stylelint": "^17.15.0",
     "tailwindcss": "^4.3.3",
     "tsd": "^0.33.0",
     "tsdown": "0.23.0",
-    "turbo": "^2.11.3",
+    "turbo": "^2.11.5",
     "typescript": "^6.0.3",
-    "vitest": "~5.0.1",
+    "vitest": "~5.0.2",
     "yaml": "^2.9.1"
   },
   "publishConfig": {

package/assets/pnpm-workspace.yaml

@@ -18,7 +18,7 @@ allowBuilds:
 overrides:
   prettier: 3.9.9
   typescript: 6.0.3
-  vite: 8.3.0
+  vite: 8.3.1
   postcss: 8.5.28
   postcss-selector-parser: 7.1.6
   js-yaml: 5.4.2

package/assets/renovate.json

@@ -7,7 +7,8 @@
   ],
   "rangeStrategy": "bump",
   "gitIgnoredAuthors": [
-    "41898282+github-actions[bot]@users.noreply.github.com"
+    "41898282+github-actions[bot]@users.noreply.github.com",
+    "335527025+auto-upgrade-deps[bot]@users.noreply.github.com"
   ],
   "npm": {
     "commitMessageTopic": "{{prettyDepType}} {{depName}}"

package/assets/turbo.json

@@ -40,6 +40,9 @@
       "outputs": []
     },
     "dev": {
+      "dependsOn": [
+        "^build"
+      ],
       "cache": false,
       "persistent": true
     },

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { t as prepareAssets } from "./prepare-OpBpZD1d.mjs";
+import { t as prepareAssets } from "./prepare-BapI8ioj.mjs";
 import process from "node:process";
 //#region src/cli.ts
 async function main() {

package/dist/index.d.mts

@@ -32,7 +32,7 @@ export declare const templatesDir: string;
 export declare const assetsDir: string;
 export declare const skeletonDir: string;
 //#endregion
-//#region src/prepare.d.ts
+//#region src/prepare/index.d.ts
 interface PrepareAssetsOptions {
   overwriteExisting?: boolean;
   silent?: boolean;

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as isGitignoreFile, c as toWorkspaceGitignorePath, d as packageDir, f as skeletonDir, h as getAssetTargets$1, i as shouldSkipTemplatePath, l as templateChoices$1, m as assetTargets$1, n as sanitizePublishedWorkspaceContent, o as toPublishGitignorePath, p as templatesDir, r as createTemplateCopyFilter, s as toWorkspaceAssetPath, t as prepareAssets, u as assetsDir } from "./prepare-OpBpZD1d.mjs";
+import { a as isGitignoreFile, c as toWorkspaceGitignorePath, d as packageDir, f as skeletonDir, h as getAssetTargets$1, i as shouldSkipTemplatePath, l as templateChoices$1, m as assetTargets$1, n as sanitizePublishedWorkspaceContent, o as toPublishGitignorePath, p as templatesDir, r as createTemplateCopyFilter, s as toWorkspaceAssetPath, t as prepareAssets, u as assetsDir } from "./prepare-BapI8ioj.mjs";
 import path from "node:path";
 import fs, { access, open, readFile, rm } from "node:fs/promises";
 import exec from "nanoexec";

package/dist/{prepare-OpBpZD1d.mjs → prepare-BapI8ioj.mjs}

@@ -168,8 +168,16 @@ function createTemplateCopyFilter(rootDir) {
 	return (src) => !shouldSkipTemplatePath(rootDir, src);
 }
 //#endregion
-//#region src/prepare.ts
-const huskySkippedEntryPattern = /[\\/]_$/;
+//#region src/prepare/published.ts
+function sanitizePublishedManifestContent(content) {
+	const manifest = JSON.parse(content);
+	if (manifest.scripts) {
+		for (const name of Object.keys(manifest.scripts)) if (name.startsWith("dev:") || name === "test:dev-scenarios" || name === "test:worker-types" || name === "test:packaged-create") delete manifest.scripts[name];
+		manifest.scripts["dev"] = "turbo run dev --concurrency=20";
+		if (manifest.scripts["test"]) manifest.scripts["test"] = manifest.scripts["test"].replace(" && pnpm test:dev-scenarios", "");
+	}
+	return `${JSON.stringify(manifest, null, 2)}\n`;
+}
 const publishedToolingConfigs = {
 	"commitlint.config.ts": [
 		`import { defineCommitlintConfig } from 'repoctl/tooling'`,
@@ -204,9 +212,6 @@ const publishedToolingConfigs = {
 	].join("\n")
 };
 const sourceRepoReleaseToolingBuildStepPattern = /\r?\n\s+- name: Build Release Tooling\r?\n\s+run: pnpm run tooling:build\r?\n/g;
-function toPublishedAssetPath(target) {
-	return target === ".npmrc" ? "npmrc" : toPublishGitignorePath(target);
-}
 function removeSourceRepoReleaseToolingBuildStepContent(content) {
 	return content.replaceAll(sourceRepoReleaseToolingBuildStepPattern, "\n");
 }
@@ -230,6 +235,12 @@ function sanitizePublishedWorkspaceContent(content) {
 	}
 	return changed ? YAML.stringify(workspace) : content;
 }
+//#endregion
+//#region src/prepare/index.ts
+const huskySkippedEntryPattern = /[\\/]_$/;
+function toPublishedAssetPath(target) {
+	return target === ".npmrc" ? "npmrc" : toPublishGitignorePath(target);
+}
 async function pathExists(targetPath) {
 	try {
 		await fs.access(targetPath);
@@ -345,7 +356,7 @@ async function removeSourceRepoReleaseToolingBuildStep() {
 	const nextContent = removeSourceRepoReleaseToolingBuildStepContent(content);
 	if (nextContent !== content) await fs.writeFile(releaseWorkflowPath, nextContent, "utf8");
 }
-async function removeSourceRepoWorkerTypeChecks() {
+async function removeSourceRepoChecks() {
 	const workflowPath = path$1.join(assetsDir, ".github/workflows/ci.yml");
 	if (await pathExists(workflowPath)) {
 		const workflow = await fs.readFile(workflowPath, "utf8");
@@ -353,10 +364,8 @@ async function removeSourceRepoWorkerTypeChecks() {
 	}
 	const manifestPath = path$1.join(assetsDir, "package.json");
 	if (await pathExists(manifestPath)) {
-		const manifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
-		delete manifest.scripts?.["test:worker-types"];
-		delete manifest.scripts?.["test:packaged-create"];
-		await fs.writeFile(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+		const content = await fs.readFile(manifestPath, "utf8");
+		await fs.writeFile(manifestPath, sanitizePublishedManifestContent(content));
 	}
 }
 async function copyTemplates(repoRoot, overwriteExisting) {
@@ -382,7 +391,7 @@ async function prepareAssets(options = {}) {
 	await writePublishedToolingConfigs();
 	await writePublishedAgentSkill(repoRoot);
 	await removeSourceRepoReleaseToolingBuildStep();
-	await removeSourceRepoWorkerTypeChecks();
+	await removeSourceRepoChecks();
 	await copyTemplates(repoRoot, overwriteExisting);
 }
 //#endregion

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@icebreakers/monorepo-templates",
   "type": "module",
-  "version": "2.0.3",
+  "version": "2.0.5",
   "description": "Built-in project templates and managed workspace assets for repoctl",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",

package/templates/client/package.json

@@ -37,8 +37,8 @@
   },
   "dependencies": {
     "@faker-js/faker": "^10.6.0",
-    "@tanstack/vue-query": "^5.103.2",
-    "@tanstack/vue-query-devtools": "^6.2.4",
+    "@tanstack/vue-query": "^5.104.0",
+    "@tanstack/vue-query-devtools": "^6.3.0",
     "@tanstack/vue-table": "^9.2.4",
     "@tanstack/vue-virtual": "^3.13.39",
     "@trpc/client": "^11.19.0",
@@ -52,7 +52,7 @@
   },
   "devDependencies": {
     "@cloudflare/vite-plugin": "^1.56.0",
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "@hono/trpc-server": "^0.4.2",
     "@tailwindcss/vite": "^4.3.3",
     "@trpc/server": "^11.19.0",
@@ -60,10 +60,10 @@
     "@vitejs/plugin-vue-jsx": "^5.1.6",
     "@vue/tsconfig": "^0.9.1",
     "consola": "^3.4.2",
-    "hono": "^4.13.9",
+    "hono": "^4.13.11",
     "tailwindcss": "^4.3.3",
     "typescript": "~6.0.3",
-    "vite": "^8.3.0",
+    "vite": "^8.3.1",
     "vite-plugin-vue-devtools": "^8.2.1",
     "vite-tsconfig-paths": "^6.1.1",
     "vue-tsc": "3.3.11",

package/templates/server/package.json

@@ -64,9 +64,9 @@
     "types": "./dist/index.d.ts"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.1.1",
+    "@hono/node-server": "^2.1.3",
     "consola": "^3.4.2",
-    "hono": "^4.13.9",
+    "hono": "^4.13.11",
     "tsdown": "0.23.0",
     "wrangler": "^4.135.0",
     "zod": "^4.6.5"

package/templates/vitepress/tasks/release.md

@@ -26,6 +26,21 @@ The release report names the packages that will change, the version decisions, a
 - Fixed group mismatch: inspect the package relationships before editing versions.
 - Registry authentication failure: refresh the local token and rerun the publish step; do not commit credentials.
 
+## Partial publication and registry visibility
+
+The publisher attempts uploads at most three times, waiting 20 and 40 seconds before refreshing registry state and selecting retry packages. An exact version with explicit upload acceptance is never uploaded again during that invocation, even if `npm view` cannot find it yet. Ordinary permission errors and 404 responses without transient-failure evidence fail immediately. Conflicts require read-only registry confirmation.
+
+Accepted uploads must become queryable before post-publish hooks, Git tags, GitHub Releases, or prerelease pushes proceed. Visibility checks query pending versions every 10 seconds for up to five minutes. A timeout exits unsuccessfully and lists pending versions.
+
+Two files remain in the workspace root:
+
+- `pnpm-publish-summary.json`: cumulative `publishedPackages`, including accepted uploads and registry-confirmed versions. On failure, this file alone does not prove that every listed version is available.
+- `repoctl-publish-progress.json`: `schemaVersion: 1`, `candidates`, `acceptedPackages`, `confirmedPackages`, and `status` (`publishing`, `confirming`, `complete`, or `failed`). Accepted versions missing from `confirmedPackages` still need visibility confirmation.
+
+The managed Release workflow uploads both files as `npm-publish-progress-<run_id>-<run_attempt>` on success or failure, retained for 14 days. Missing reports are ignored. After upgrading repoctl, run `repo upgrade` to refresh managed workflows; custom workflows can add the same upload step.
+
+After a failure, download the artifact and reconcile exact versions with `npm view <name>@<version> version`. Continue read-only checks for accepted but unconfirmed versions instead of rerunning the entire release lifecycle. Use the workflow's `reconcile` mode to repair metadata for visible versions, and `publish-unpublished` only for versions verified as still requiring upload. Reports are diagnostic: a new invocation does not trust old reports or automatically resume across processes.
+
 ## Next
 
 Read [publishing and changelogs](/learn/monorepo/publish) for repository policy and [reports and output](/tasks/reports) for CI artifacts.

package/templates/vitepress/zh/learn/monorepo/publish.md

@@ -33,7 +33,7 @@ CI 将版本号、各包 `CHANGELOG.md` 和 `.changeset/ledger.yaml` 提交到 R
 pnpm publish -r --report-summary --provenance --no-git-checks
 ```
 
-pnpm 根据 registry 中已有的版本自动跳过已发布包。CI 读取 `pnpm-publish-summary.json` 创建 `package@version` tag 和 GitHub Release，发布操作可以安全重试。
+pnpm 根据 registry 中已有的版本自动跳过已发布包。CI 读取 `pnpm-publish-summary.json` 创建 `package@version` tag 和 GitHub Release，发布器在本次调用内保留已接收上传的版本，确认 registry 可见性后再执行后置流程；失败后的处理见[部分发布与 registry 延迟](/zh/tasks/release#部分发布与-registry-延迟)。
 
 ## Workspace versioning 配置
 

package/templates/vitepress/zh/learn/tools/changeset.md

@@ -38,7 +38,7 @@ pnpm version -r
 pnpm publish -r --report-summary --provenance --no-git-checks
 ```
 
-pnpm 会跳过 registry 中已经存在的版本，并把新发布包写入 `pnpm-publish-summary.json`。CI 根据 summary 创建 `package@version` Git tag 和 GitHub Release，因此重复执行不会重新发布已存在版本。
+pnpm 会跳过 registry 中已经存在的版本，并把新发布包写入 `pnpm-publish-summary.json`。CI 根据 summary 创建 `package@version` Git tag 和 GitHub Release，发布器会保留本次调用的部分成功状态，等待 registry 确认可见后再创建元数据；不要在传播延迟期间直接重跑整个生命周期，详见[发布任务](/zh/tasks/release)。
 
 本地推荐使用 repoctl 包装命令：
 

package/templates/vitepress/zh/tasks/release.md

@@ -26,6 +26,21 @@ repo release --dry-run
 - 固定版本组不一致：先检查包之间的关系，再修改版本。
 - registry 认证失败：刷新本地 token 后重试，不要提交凭据。
 
+## 部分发布与 registry 延迟
+
+发布器最多尝试上传 3 次，重试前分别等待 20、40 秒并重新查询 registry。明确上传成功的精确版本不会再次上传，即使此时 `npm view` 暂不可查询。普通权限错误和没有瞬时故障依据的 404 会直接失败；冲突只能通过只读对账确认，不能当作成功。
+
+已接收上传的版本需要确认可查询后，才会执行后置 hooks、Git tag 和 GitHub Release。确认期间每 10 秒查询待确认版本，最多等待 5 分钟；超时会非零退出并列出待确认版本。
+
+工作区根目录保留两份文件：
+
+- `pnpm-publish-summary.json`：跨尝试累计的 `publishedPackages`，包括已接收上传和 registry 已确认的版本；失败时不能仅凭此文件认定所有版本已可用。
+- `repoctl-publish-progress.json`：`schemaVersion: 1`，记录 `candidates`、`acceptedPackages`、`confirmedPackages` 及 `status`（`publishing`、`confirming`、`complete`、`failed`）。已接收但未确认的版本是前两种成功状态之差。
+
+受管 Release 工作流会在发布成功或失败后上传 `npm-publish-progress-<run_id>-<run_attempt>` artifact，保留 14 天；没有清单时跳过上传。现有项目升级 repoctl 后运行 `repo upgrade` 更新受管工作流；自定义工作流可自行添加相同上传步骤。
+
+失败后先下载 artifact，并用 `npm view <name>@<version> version` 对账。对于已接收但未确认的版本，继续只读确认，不要直接重跑整个发布生命周期。确认已经可用的版本可通过工作流的 `reconcile` 模式补齐元数据；仅对核实仍未上传的版本使用 `publish-unpublished`。旧清单仅用于诊断，新调用不会自动信任旧清单或跨进程续传。
+
 ## 下一步
 
 阅读[发包与变更日志](/zh/learn/monorepo/publish)，再查看[报告与输出](/zh/tasks/reports)了解 CI 产物。

package/templates/vue-lib/package.json

@@ -63,7 +63,7 @@
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
     "jsdom": "^30.1.1",
-    "vite": "^8.3.0",
+    "vite": "^8.3.1",
     "vite-plugin-dts": "^5.1.1",
     "vue": "^3.5.43",
     "vue-tsc": "^3.3.11"