@inditextech/docouture-cli 0.1.0-SNAPSHOT.52.1 → 0.1.0-SNAPSHOT.57.1

package/build/commands/new.js

@@ -394,6 +394,7 @@ export async function runNew(argv, io = defaultIO()) {
         pmLockfile: pm.lockfile,
         pmCiCmd: pm.ciCmd,
         pmSetupStepYaml: pm.setupStepYaml,
+        pmPackageManagerField: pm.packageManagerField,
         repoIgnoreGlob: repoIgnoreGlob(target),
     };
     // The whole starter subtree — package.json, antora-playbook.yml, its own

package/build/commands/upgrade.js

@@ -108,6 +108,10 @@ export async function runUpgrade(argv) {
         pmLockfile: pm.lockfile,
         pmCiCmd: pm.ciCmd,
         pmSetupStepYaml: pm.setupStepYaml,
+        // Same reasoning as repoIgnoreGlob below: package.json (the only
+        // template file this placeholder appears in) is never re-copied by
+        // upgrade either, so there's nothing meaningful to compute it from.
+        pmPackageManagerField: 'unused-by-upgrade',
         // upgrade never re-copies docs/ (see below) — package.json, the only
         // template file this placeholder appears in, is never touched here — so
         // there's nothing meaningful to compute it from. Not an empty string:

package/build/lib/copy-template.js

@@ -22,6 +22,7 @@ const PLACEHOLDERS = {
     // value (which ends in its own `\n` — see packageManagerPlan) or the
     // empty npm value drop cleanly in its place.
     '      # __DOCOUTURE_PM_SETUP_STEP__\n': 'pmSetupStepYaml',
+    __DOCOUTURE_PM_PACKAGE_MANAGER__: 'pmPackageManagerField',
     // A bare token this time, unlike pmSetupStepYaml above — see
     // TemplateValues.repoIgnoreGlob's own comment for why the whole-segment
     // trick doesn't survive here.

package/build/lib/detect-package-manager.js

@@ -1,9 +1,34 @@
 'use strict';
+import { execFileSync } from 'node:child_process';
 import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 const PNPM_ACTION_SETUP_STEP = '      - name: Setup pnpm\n' +
-    '        uses: pnpm/action-setup@a3252b78c470c02f7abfb6128aa3c1852013d47c # v4\n' +
+    '        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4\n' +
+    '        with:\n' +
+    // `package_json_file` "must be relative to the repository root
+    // (GITHUB_WORKSPACE)" per the action's own action.yml — its default
+    // ('package.json') looks at the true repo root, not this site's own
+    // docs/package.json, even though `defaults.run.working-directory: docs`
+    // applies everywhere else in this workflow. Same gotcha, same fix as
+    // setup-node's `cache-dependency-path` a few lines below.
+    '          package_json_file: docs/package.json\n' +
     '\n';
+// The exact pnpm/npm version actually available wherever `docouture new` is
+// running — queried directly rather than guessed, so the `packageManager`
+// field this writes into the scaffolded package.json (see
+// packageManagerPlan below) is always a real, installable version. Falls
+// back to a pinned last-known-good version only if the binary can't be
+// queried at all (e.g. a test sandbox with neither on PATH) — degrading
+// gracefully rather than leaving the scaffold without a value that
+// `pnpm/action-setup` (CI) and corepack (locally) both need.
+function detectPackageManagerVersion(pm) {
+    try {
+        return execFileSync(pm, ['--version'], { encoding: 'utf8' }).trim();
+    }
+    catch {
+        return pm === 'pnpm' ? '10.24.0' : '10.9.2';
+    }
+}
 // Reads the invoking package manager off npm's own user-agent env var — set
 // by npm, pnpm and yarn alike on every script/exec they run, e.g.
 // 'pnpm/9.1.0 npm/? node/v20.11.0 darwin x64'. This is how `docouture new` was
@@ -64,6 +89,7 @@ export function packageManagerPlan(pm) {
             lockfile: 'pnpm-lock.yaml',
             cacheName: 'pnpm',
             setupStepYaml: PNPM_ACTION_SETUP_STEP,
+            packageManagerField: `pnpm@${detectPackageManagerVersion('pnpm')}`,
         };
     }
     return {
@@ -74,6 +100,7 @@ export function packageManagerPlan(pm) {
         lockfile: 'package-lock.json',
         cacheName: 'npm',
         setupStepYaml: '',
+        packageManagerField: `npm@${detectPackageManagerVersion('npm')}`,
     };
 }
 //# sourceMappingURL=detect-package-manager.js.map

package/build/lib/dev-server.js

@@ -309,7 +309,7 @@ export async function startDevServer(options) {
     log(`serving ${root}`);
     log(`  http://localhost:${port}${basePath}/`);
     const watchers = [
-        watchPath(join(siteRoot, 'docs')),
+        watchPath(join(siteRoot, 'src')),
         watchPath(join(siteRoot, 'antora-playbook.local.yml'), { recursive: false }),
     ];
     void Promise.all(watchers);

package/build/templates/starter/package.json

@@ -7,6 +7,7 @@
   "engines": {
     "node": ">=24.0.0"
   },
+  "packageManager": "__DOCOUTURE_PM_PACKAGE_MANAGER__",
   "scripts": {
     "build": "antora --fetch antora-playbook.yml",
     "dev": "docouture dev",

package/build/templates/workflows/docouture-kroki-cache-warm.yml

@@ -29,6 +29,15 @@ on:
   push:
     branches: ['main*']
 
+# Least-privilege default: this job only checks out `main`, warms the
+# Docker/Kroki image cache and writes it via actions/cache (a separate,
+# token-independent cache API, not repository contents) — it never uses
+# GITHUB_TOKEN itself, so it never needs more than read access. Declared
+# explicitly rather than left to inherit whatever the repository/
+# organization's default token permissions happen to be.
+permissions:
+  contents: read
+
 concurrency:
   group: docouture-kroki-cache-warm
   cancel-in-progress: true

package/build/templates/workflows/docouture-pr-verify.yml

@@ -19,6 +19,14 @@ name: docouture-pr-verify
 on:
   pull_request: {}
 
+# Least-privilege default: this job only checks out the PR's own HEAD,
+# builds it, and checks links — it never writes to the repository, comments
+# on the PR, or otherwise uses GITHUB_TOKEN, so it never needs more than
+# read access. Declared explicitly rather than left to inherit whatever the
+# repository/organization's default token permissions happen to be.
+permissions:
+  contents: read
+
 concurrency:
   group: docouture-pr-verify-${{ github.event.pull_request.number }}
   cancel-in-progress: true

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inditextech/docouture-cli",
-  "version": "0.1.0-SNAPSHOT.52.1",
+  "version": "0.1.0-SNAPSHOT.57.1",
   "description": "Command-line tool for docouture documentation sites: scaffold a new site and set its Antora version outside the monorepo",
   "repository": {
     "type": "git",