@icebreakers/monorepo-templates 2.3.1 → 2.3.3

package/assets/.github/workflows/release.yml

@@ -95,7 +95,6 @@ jobs:
         with:
           node-version: 24
           cache: pnpm
-          registry-url: https://registry.npmjs.org
 
       - name: Install npm with trusted publishing support
         run: npm install --global npm@11.16.0 --registry=https://registry.npmjs.org
@@ -103,7 +102,8 @@ jobs:
       - name: Install Dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Run repo release CI
+      - name: Release plan
+        id: release-plan
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
           REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
@@ -111,7 +111,67 @@ jobs:
           REPO_RELEASE_VERSION: ${{ inputs.version }}
           REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
           REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
-        run: pnpm exec repo release ci
+        run: pnpm exec repo release ci --stage plan
+
+      - name: Release verify
+        id: release-verify
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage verify
+
+      - name: Release prepare
+        id: release-prepare
+        if: ${{ steps.release-plan.outputs.run == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage prepare
+
+      - name: Release upload
+        id: release-upload
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage upload
+
+      - name: Release confirm
+        id: release-confirm
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage confirm
+
+      - name: Release finalize
+        id: release-finalize
+        if: ${{ steps.release-prepare.outputs.publish == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token || secrets.REPOCTL_RELEASE_TOKEN || secrets.CHANGESETS_RELEASE_TOKEN || github.token }}
+          REPO_RELEASE_MODE: ${{ inputs.mode || 'auto' }}
+          REPO_RELEASE_PACKAGE: ${{ inputs.package }}
+          REPO_RELEASE_VERSION: ${{ inputs.version }}
+          REPO_RELEASE_DRY_RUN: ${{ inputs.dry-run }}
+          REPO_RELEASE_RECOVERY_SOURCE_SHA: ${{ inputs.source-sha }}
+        run: pnpm exec repo release ci --stage finalize
 
       - name: Preserve npm publish progress
         if: ${{ always() }}
@@ -122,6 +182,7 @@ jobs:
             pnpm-publish-summary.json
             repoctl-publish-progress.json
             repoctl-release-progress.json
+            repoctl-ci-progress.json
           if-no-files-found: ignore
           retention-days: 14
 

package/assets/gitignore

@@ -48,3 +48,5 @@ config.ts.timestamp-*.mjs
 /repoctl-publish-progress.json.*.tmp
 
 /repoctl-release-progress.json
+
+/repoctl-ci-progress.json

package/assets/package.json

@@ -50,7 +50,9 @@
     "postinstall": "pnpm run build",
     "commit": "commit",
     "commitlint": "commitlint --edit",
-    "sync": "turbo run sync",
+    "sync": "pnpm sync:npmmirror",
+    "sync:npmmirror": "repo release sync-npmmirror --all",
+    "release:sync-npmmirror": "repo release sync-npmmirror --published",
     "inspector": "npx @eslint/config-inspector",
     "build:inspector": "pnpm build && npx @eslint/config-inspector build",
     "-------": "---------------",

package/assets/pnpm-workspace.yaml

@@ -19,7 +19,7 @@ overrides:
   prettier: 3.9.9
   typescript: 6.0.3
   "@arethetypeswrong/core>typescript": 5.9.3
-  vite: 8.3.3
+  vite: 8.3.4
   postcss: 8.5.29
   postcss-selector-parser: 7.1.6
   js-yaml: 5.4.3

package/assets/renovate.json

@@ -6,6 +6,8 @@
     ":semanticCommitTypeAll(chore)"
   ],
   "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
   "gitIgnoredAuthors": [
     "41898282+github-actions[bot]@users.noreply.github.com",
     "335527025+auto-upgrade-deps[bot]@users.noreply.github.com"
@@ -37,6 +39,17 @@
       ],
       "groupName": "Cloudflare Workers tooling",
       "groupSlug": "cloudflare-workers-tooling"
+    },
+    {
+      "matchManagers": [
+        "npm"
+      ],
+      "matchPackageNames": [
+        "@cloudflare/nimbus-docs"
+      ],
+      "groupName": "Nimbus documentation engine",
+      "groupSlug": "nimbus-documentation-engine",
+      "automerge": false
     }
   ]
 }

package/assets/repoctl.config.ts

@@ -2,6 +2,11 @@ import type { MonorepoConfig } from 'repoctl'
 
 export default {
   commands: {
+    release: {
+      hooks: {
+        afterPublish: [{ script: 'release:sync-npmmirror', continueOnError: true, idempotent: true }],
+      },
+    },
     create: {
       defaultTemplate: 'tsdown',
       renameJson: false,

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { t as prepareAssets } from "./prepare-BYNSxvoB.mjs";
+import { t as prepareAssets } from "./prepare-3Vhzg3fr.mjs";
 import process from "node:process";
 //#region src/cli.ts
 async function main() {

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as isGitignoreFile, c as toWorkspaceGitignorePath, d as packageDir, f as skeletonDir, h as getAssetTargets$1, i as shouldSkipTemplatePath, l as templateChoices$1, m as assetTargets$1, n as sanitizePublishedWorkspaceContent, o as toPublishGitignorePath, p as templatesDir, r as createTemplateCopyFilter, s as toWorkspaceAssetPath, t as prepareAssets, u as assetsDir } from "./prepare-BYNSxvoB.mjs";
+import { a as isGitignoreFile, c as toWorkspaceGitignorePath, d as packageDir, f as skeletonDir, h as getAssetTargets$1, i as shouldSkipTemplatePath, l as templateChoices$1, m as assetTargets$1, n as sanitizePublishedWorkspaceContent, o as toPublishGitignorePath, p as templatesDir, r as createTemplateCopyFilter, s as toWorkspaceAssetPath, t as prepareAssets, u as assetsDir } from "./prepare-3Vhzg3fr.mjs";
 import path from "node:path";
 import fs, { access, open, readFile, rm } from "node:fs/promises";
 import { Buffer } from "node:buffer";

package/dist/{prepare-BYNSxvoB.mjs → prepare-3Vhzg3fr.mjs}

@@ -208,6 +208,7 @@ function createTemplateCopyFilter(rootDir) {
 const sourceScriptNames = /* @__PURE__ */ new Set([
 	"tooling:build",
 	"check:no-tracked-build-artifacts",
+	"check:nimbus-upgrade",
 	"check:workflows",
 	"test:dev-scenarios",
 	"test:worker-types"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@icebreakers/monorepo-templates",
   "type": "module",
-  "version": "2.3.1",
+  "version": "2.3.3",
   "description": "Built-in project templates and managed workspace assets for repoctl",
   "author": "ice breaker <hi@sonofmagic.top>",
   "license": "MIT",

package/templates/client/package.json

@@ -39,8 +39,8 @@
     "@faker-js/faker": "^10.6.0",
     "@tanstack/vue-query": "^5.104.1",
     "@tanstack/vue-query-devtools": "^6.3.1",
-    "@tanstack/vue-table": "^9.2.7",
-    "@tanstack/vue-virtual": "^3.13.39",
+    "@tanstack/vue-table": "^9.2.8",
+    "@tanstack/vue-virtual": "^3.13.40",
     "@trpc/client": "^11.19.0",
     "clsx": "^2.1.1",
     "pinia": "^4.0.3",
@@ -63,7 +63,7 @@
     "hono": "^4.13.13",
     "tailwindcss": "^4.3.3",
     "typescript": "~6.0.3",
-    "vite": "^8.3.3",
+    "vite": "^8.3.4",
     "vite-plugin-vue-devtools": "^8.2.1",
     "vite-tsconfig-paths": "^6.1.1",
     "vue-tsc": "3.3.12",

package/templates/nimbus/README.md

@@ -14,4 +14,26 @@ pnpm typecheck
 
 Edit `src/content/docs/` and its `zh/` translations. Set your project title and canonical site URL in `astro.config.ts` before publishing `dist/` to a static host. Search is available after a production build.
 
-机器可读入口包括 `/llms.txt`、`/zh/llms.txt`、`/llms-full.txt`，以及页面的 `/index.md` 和 `/index.mdx`。详见 `AGENTS.md` 和 `UPSTREAM.md`。
+机器可读入口包括 `/llms.txt`、`/zh/llms.txt`、`/llms-full.txt`，以及页面的 `/index.md` 和 `/index.mdx`。Nimbus 还会生成 `/.well-known/ard.json`、`/.well-known/ai-catalog.json` 和 `dist/_headers` 中的发现响应头。静态托管需要应用这些响应头；不支持 `_headers` 的主机应配置等效规则。使用子路径部署时，发现文件仍须发布到域名根目录的 `/.well-known/`，并在那里应用对应响应头规则。详见 `AGENTS.md` 和 `UPSTREAM.md`。
+
+## Upgrading Nimbus / 升级 Nimbus
+
+Nimbus updates can require review even within a minor release. Keep its dependency pinned to an exact version and review the migration report before advancing `nimbus.json`.
+
+更新依赖后，先在 monorepo 根目录运行 `pnpm install --ignore-scripts`，再在此目录检查迁移要求：
+
+```sh
+pnpm exec nimbus-docs migrate --dry-run --json
+```
+
+逐项核对适用条件并完成必要修改，在 `UPSTREAM.md` 记录审阅结论，再通过官方命令记录基线并验证：
+
+```sh
+pnpm exec nimbus-docs migrate --yes
+pnpm exec nimbus-docs check --migrations
+pnpm build
+pnpm lint
+pnpm typecheck
+```
+
+不要只修改审阅版本来跳过迁移。部署前检查发现文件、首页 Link 响应头，以及中英文页面和机器可读入口。

package/templates/nimbus/UPSTREAM.md

@@ -4,13 +4,31 @@ This template adapts the static empty starter from [Cloudflare Nimbus](https://g
 
 - Starter tag: `templates-v0.7.9`
 - Starter commit: `aae348048a8c659f84c39696ee6b20c2ad2f5ae2`
-- Nimbus package: `@cloudflare/nimbus-docs@0.16.0`
-- Astro: `7.3.6`
+- Nimbus package: `@cloudflare/nimbus-docs@0.17.0`
+- Nimbus release commit: `1951de5cc3e420a5e672f192c334584216716c1e`
+- Astro: `7.3.8`
 
-Nimbus declares Astro `>=7.2.6 <8`; Astro requires Node `>=22.12.0`, so this workspace retains its stricter Node `>=22.13.0` baseline. Builds, Astro diagnostics and TypeScript checks were verified with the repository's TypeScript `6.0.3` and Vite `8.3.3` constraints. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
+Nimbus declares Astro `>=7.2.6 <8`; Astro requires Node `>=22.12.0`, so this workspace retains its stricter Node `>=22.13.0` baseline. The repository validates builds, Astro diagnostics and TypeScript checks with TypeScript `6.0.3` and Vite `8.3.4`. Resolved dependencies are recorded in the monorepo's root `pnpm-lock.yaml`; generated projects use their own root workspace lockfile.
 
 Agent endpoint routes and the content-loading approach come from that starter. The bilingual layout, navigation, search interface, examples and workspace checks are repoctl adaptations. These files are maintained locally; generating a project never downloads the upstream starter.
 
 The local head component emits page-specific language metadata because the upstream head uses the site-wide locale. Client scripts are emitted as external assets so Astro does not inline them before Vite finalizes Pagefind's dynamic import.
 
 The package version and starter tag were checked against published package metadata. `nimbus.json` records the reviewed package API baseline. The original full starter was not copied wholesale, so upstream starter diffs are not a claim that every local file is an unmodified upstream component.
+
+## Nimbus 0.17.0 upgrade review
+
+The `0.16.0` → `0.17.0` review follows the installed package's `nimbus-docs migrate --dry-run --json` report and the release's [upgrade manifest](https://github.com/cloudflare/nimbus/blob/1951de5cc3e420a5e672f192c334584216716c1e/packages/nimbus-docs/src/_internal/upgrade-manifest.json).
+
+| Required review | Template decision |
+| --- | --- |
+| `api-body-request-example` | No API collection or copied `ApiBody` component exists. No component replacement is needed. |
+| `api-catalog-published-specs` | No API collection or versioned spec exists, so there are no specs to publish or hide. |
+| `api-version-id-format` | No API versions are configured. |
+| `version-switcher-keeps-query` | No query-versioned API or copied `VersionSwitcher` exists. |
+| `page-collections-from-helpers` | The only collection uses `defineCollection(docsCollection())`; there are no plain-loader page collections or rendering overrides. |
+| `generated-agent-discovery-routes` | Neither `public/` nor `src/pages/` owns the generated discovery paths. Nimbus generates both discovery documents and homepage Link headers; packaged regression checks validate their resources and static header rules. |
+
+The site remains static. Its existing Markdown/MDX and LLM endpoint factories stay valid. Optional copied-sidebar, browser WebMCP and server-rendering changes are not adopted. There is no project `skills/` directory to publish. Existing `robots.txt` policy is preserved; the new starter's optional AI training Content Signals are not adopted implicitly.
+
+For a subpath deployment, publish the generated `.well-known/` directory at the origin root and apply its header rules there. Hosts that do not consume `_headers` need equivalent native header configuration; see the [agent deployment guidance](https://nimbus-docs.com/ai/docs-for-agents/).

package/templates/nimbus/nimbus.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://nimbus-docs.com/schema/nimbus.json",
-  "lastReviewedNimbusVersion": "0.16.0"
+  "lastReviewedNimbusVersion": "0.17.0"
 }

package/templates/nimbus/package.json

@@ -19,8 +19,8 @@
     "check:locales": "node scripts/check-locales.mjs"
   },
   "dependencies": {
-    "@cloudflare/nimbus-docs": "0.16.0",
-    "astro": "7.3.7"
+    "@cloudflare/nimbus-docs": "0.17.0",
+    "astro": "7.3.8"
   },
   "devDependencies": {
     "@astrojs/check": "^0.9.10",

package/templates/react-lib/package.json

@@ -41,7 +41,7 @@
     "react-dom": "^19.3.0",
     "tsd": "^0.33.0",
     "typescript": "~6.0.3",
-    "vite": "^8.3.3",
+    "vite": "^8.3.4",
     "vite-plugin-dts": "^5.1.2",
     "vitest": "~5.0.3"
   }

package/templates/react-vite/package.json

@@ -30,7 +30,7 @@
     "@vitejs/plugin-react": "^6.1.2",
     "jsdom": "^30.1.2",
     "typescript": "~6.0.3",
-    "vite": "^8.3.3",
+    "vite": "^8.3.4",
     "vitest": "~5.0.3"
   }
 }

package/templates/vitepress/learn/tools/renovate.md

@@ -8,12 +8,14 @@ Renovate keeps dependencies current through reviewable pull requests. It is most
 {
   "extends": ["config:recommended", "group:allNonMajor"],
   "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
   "automerge": true,
   "automergeType": "pr"
 }
 ```
 
-The repository groups compatible minor and patch updates. Cloudflare Workers tooling is grouped separately because Wrangler and its Vite plugin have a deliberate compatibility relationship.
+The repository groups compatible minor and patch updates. Cloudflare Workers tooling is grouped separately because Wrangler and its Vite plugin have a deliberate compatibility relationship. Renovate waits seven days after each version is published before it can create an update branch or pull request. `internalChecksFilter: "strict"` keeps the stability check blocking, so a pending `renovate/stability-days` check does not appear as a pull request yet. The timer is evaluated for each version independently; it does not require a package to stop publishing for seven days. Security updates follow the same seven-day wait so every automated update gets the same validation window.
 
 ## Review an update
 

package/templates/vitepress/zh/learn/tools/renovate.md

@@ -52,25 +52,24 @@ npx renovate
 
 ```json
 {
-  "extends": ["config:base"],
-  "packageRules": [
-    {
-      "matchUpdateTypes": ["minor", "patch"],
-      "automerge": true
-    },
-    {
-      "matchUpdateTypes": ["major"],
-      "automerge": false
-    }
-  ]
+  "extends": ["config:recommended", "group:allNonMajor"],
+  "rangeStrategy": "bump",
+  "minimumReleaseAge": "7 days",
+  "internalChecksFilter": "strict",
+  "automerge": true,
+  "automergeType": "pr"
 }
 ```
 
 解释：
 
-- 使用基础配置 `"extends": ["config:base"]`。
-- **minor/patch 更新** 自动合并。
-- **major 更新** 需要人工 review。
+- 使用推荐配置，并将兼容的非 major 更新分组。
+- `"rangeStrategy": "bump"` 让版本范围随升级一起更新。
+- `"minimumReleaseAge": "7 days"` 要求每个新版本发布满 7 天后才进入升级候选。
+- `"internalChecksFilter": "strict"` 让 `renovate/stability-days` 稳定性检查保持阻塞状态；检查通过前不会创建升级分支或 PR。
+- `"automerge": true` 和 `"automergeType": "pr"` 允许通过检查的升级 PR 自动合并。
+
+Renovate 按版本分别计时：它等待的是当前版本发布后的 7 天，而不是等待这个包连续 7 天没有新发布。安全更新也遵循相同的 7 天等待窗口，确保自动升级都经过一致的验证时间。
 
 ### 实际效果
 

package/templates/vue-lib/package.json

@@ -63,7 +63,7 @@
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
     "jsdom": "^30.1.2",
-    "vite": "^8.3.3",
+    "vite": "^8.3.4",
     "vite-plugin-dts": "^5.1.2",
     "vue": "^3.5.43",
     "vue-tsc": "^3.3.12"