@icebreakers/monorepo-templates 2.3.1 → 2.3.2

package/assets/.github/workflows/release.yml

@@ -95,7 +95,6 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
-          registry-url: https://registry.npmjs.org
 
       - name: Install npm with trusted publishing support
         run: npm install --global npm@11.16.0 --registry=https://registry.npmjs.org
@@ -103,7 +102,8 @@ jobs:
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Run repo release CI
+      - name: Release plan
+        id: release-plan
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
           REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
@@ -111,7 +111,67 @@ jobs:
           REPO_RELEASE_VERSION: ${{ inputs.version }}
           REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
           REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
-        run: pnpm exec repo release ci
+        run: pnpm exec repo release ci --stage plan
+
+      - name: Release verify
+        id: release-verify
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage verify
+
+      - name: Release prepare
+        id: release-prepare
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage prepare
+
+      - name: Release upload
+        id: release-upload
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage upload
+
+      - name: Release confirm
+        id: release-confirm
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage confirm
+
+      - name: Release finalize
+        id: release-finalize
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage finalize
 
       - name: Preserve npm publish progress
         if: ${{ always() }}
@@ -122,6 +182,7 @@ jobs:
             pnpm-publish-summary.json
             repoctl-publish-progress.json
             repoctl-release-progress.json
+            repoctl-ci-progress.json
           if-no-files-found: ignore
           retention-days: 14
 

package/assets/gitignore

@@ -48,3 +48,5 @@ config.ts.timestamp-*.mjs
 /repoctl-publish-progress.json.*.tmp
 
 /repoctl-release-progress.json
+
+/repoctl-ci-progress.json

package/assets/package.json

@@ -50,7 +50,9 @@
     "postinstall": "pnpm run build",
     "commit": "commit",
     "commitlint": "commitlint --edit",
-    "sync": "turbo run sync",
+    "sync": "pnpm sync:npmmirror",
+    "sync:npmmirror": "repo release sync-npmmirror --all",
+    "release:sync-npmmirror": "repo release sync-npmmirror --published",
     "inspector": "npx @eslint/config-inspector",
     "build:inspector": "pnpm build && npx @eslint/config-inspector build",
     "-------": "---------------",

package/assets/renovate.json

@@ -6,6 +6,8 @@
     ":semanticCommitTypeAll(chore)"
   ],
   "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
   "gitIgnoredAuthors": [
     "41898282+github-actions[bot]@users.noreply.github.com",
     "335527025+auto-upgrade-deps[bot]@users.noreply.github.com"

package/assets/repoctl.config.ts

@@ -2,6 +2,11 @@ import type { MonorepoConfig } from 'repoctl'
 
 export default {
   commands: {
+    release: {
+      hooks: {
+        afterPublish: [{ script: 'release:sync-npmmirror', continueOnError: true, idempotent: true }],
+      },
+    },
     create: {
       defaultTemplate: 'tsdown',
       renameJson: false,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@icebreakers/monorepo-templates",
   "type": "module",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Built-in project templates and managed workspace assets for repoctl",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",

package/templates/vitepress/learn/tools/renovate.md

@@ -8,12 +8,14 @@ Renovate keeps dependencies current through reviewable pull requests. It is most
 {
   "extends": ["config:recommended", "group:allNonMajor"],
   "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
   "automerge": true,
   "automergeType": "pr"
 }
 ```
 
-The repository groups compatible minor and patch updates. Cloudflare Workers tooling is grouped separately because Wrangler and its Vite plugin have a deliberate compatibility relationship.
+The repository groups compatible minor and patch updates. Cloudflare Workers tooling is grouped separately because Wrangler and its Vite plugin have a deliberate compatibility relationship. Renovate waits seven days after each version is published before it can create an update branch or pull request. `internalChecksFilter: "strict"` keeps the stability check blocking, so a pending `renovate/stability-days` check does not appear as a pull request yet. The timer is evaluated for each version independently; it does not require a package to stop publishing for seven days. Security updates follow the same seven-day wait so every automated update gets the same validation window.
 
 ## Review an update
 

package/templates/vitepress/zh/learn/tools/renovate.md

@@ -52,25 +52,24 @@ npx renovate
 
 ```json
 {
-  "extends": ["config:base"],
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
-    },
-    {
-      "matchUpdateTypes": ["major"],
-      "automerge": false
-    }
-  ]
+  "extends": ["config:recommended", "group:allNonMajor"],
+  "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
+  "automerge": true,
+  "automergeType": "pr"
 }
 ```
 
 解释：
 
-- 使用基础配置 `"extends": ["config:base"]`。
-- **minor/patch 更新** 自动合并。
-- **major 更新** 需要人工 review。
+- 使用推荐配置，并将兼容的非 major 更新分组。
+- `"rangeStrategy": "bump"` 让版本范围随升级一起更新。
+- `"minimumReleaseAge": "7 days"` 要求每个新版本发布满 7 天后才进入升级候选。
+- `"internalChecksFilter": "strict"` 让 `renovate/stability-days` 稳定性检查保持阻塞状态；检查通过前不会创建升级分支或 PR。
+- `"automerge": true` 和 `"automergeType": "pr"` 允许通过检查的升级 PR 自动合并。
+
+Renovate 按版本分别计时：它等待的是当前版本发布后的 7 天，而不是等待这个包连续 7 天没有新发布。安全更新也遵循相同的 7 天等待窗口，确保自动升级都经过一致的验证时间。
 
 ### 实际效果