@joshuafolkken/kit 1.1050.0 → 1.1094.0

package/templates/sonar-project.properties

@@ -24,7 +24,11 @@ sonar.exclusions=.claude/**,scripts/**
 # tooling. A `*-file` flag takes a path the developer typed on their own command
 # line — the same trust level as the command itself — so there is no untrusted
 # input boundary for the taint analysis to protect, exactly as with S4036.
-sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8
+#
+# Suppress "await inside a loop" (S9382) everywhere. ESLint's `no-await-in-loop` reports the same
+# pattern in the local gate, and each intentional sequential await carries its reason on an
+# `eslint-disable-next-line` comment — which SonarJS does not read — so ESLint is the single gate.
+sonar.issue.ignore.multicriteria=e1,e2,e3,e4,e5,e6,e7,e8,e9,e10,e11,e12,e13,e14
 sonar.issue.ignore.multicriteria.e1.ruleKey=typescript:S4036
 sonar.issue.ignore.multicriteria.e1.resourceKey=scripts/**/*
 sonar.issue.ignore.multicriteria.e2.ruleKey=typescript:S4036
@@ -41,6 +45,29 @@ sonar.issue.ignore.multicriteria.e7.ruleKey=jssecurity:S8707
 sonar.issue.ignore.multicriteria.e7.resourceKey=scripts/**/*
 sonar.issue.ignore.multicriteria.e8.ruleKey=jssecurity:S8707
 sonar.issue.ignore.multicriteria.e8.resourceKey=scripts-ai/**/*
+# Suppress "async function without await" (S7503) everywhere. The shared ESLint
+# config enforces `@typescript-eslint/promise-function-async`, so a function that
+# returns a Promise must be `async` even when it has nothing to await; that is why
+# it turns `require-await` off, and S7503 is the same rule under another name —
+# the two cannot both hold.
+sonar.issue.ignore.multicriteria.e9.ruleKey=typescript:S7503
+sonar.issue.ignore.multicriteria.e9.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e10.ruleKey=javascript:S7503
+sonar.issue.ignore.multicriteria.e10.resourceKey=**/*
+# Suppress "prefer Number static properties" (S7773) everywhere. It asks for
+# `Number.NaN`, while the unicorn recommended preset the shared ESLint config
+# enforces asks for the opposite (`prefer-global-number-constants`: `NaN` over
+# `Number.NaN`) — the two cannot both hold. The rest of what S7773 covers
+# (`Number.parseInt`, `Number.isNaN`, …) is already enforced by
+# `unicorn/prefer-number-properties`.
+sonar.issue.ignore.multicriteria.e11.ruleKey=typescript:S7773
+sonar.issue.ignore.multicriteria.e11.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e12.ruleKey=javascript:S7773
+sonar.issue.ignore.multicriteria.e12.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e13.ruleKey=typescript:S9382
+sonar.issue.ignore.multicriteria.e13.resourceKey=**/*
+sonar.issue.ignore.multicriteria.e14.ruleKey=javascript:S9382
+sonar.issue.ignore.multicriteria.e14.resourceKey=**/*
 
 # Files to exclude from the duplicate check.
 # Snapshot files (.snap) contain machine-generated repetitive patterns and are not authored code.

package/templates/workflows/dependabot-auto-merge.yml

@@ -50,8 +50,10 @@ jobs:
       #
       # Everything comes from the API, so no checkout is needed. `--paginate` is what makes the file
       # list complete rather than the first page of a large diff, and the `select` narrows it to
-      # workflows inside `--jq` rather than through `grep`: the default shell is `bash -e` without
-      # `pipefail`, so a `gh` failure inside a pipeline would be masked by grep's status, and grep
+      # workflows — and the local composite actions under `.github/actions/`, which are stamped and
+      # overwritten the same way (joshuafolkken/kit#3013) — inside `--jq` rather than through `grep`:
+      # the default shell is `bash -e` without `pipefail`, so a `gh` failure inside a pipeline would
+      # be masked by grep's status, and grep
       # itself answers 1 for "no match" and 2 for "I could not look" — two readings this step must
       # not conflate, since one of them means "merge it" (joshuafolkken/kit#844). An assignment
       # carries the command's status, and `case` has no failure mode at all.
@@ -88,7 +90,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           changed="$(gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" --paginate \
-            --jq '.[] | select(.filename | startswith(".github/workflows/"))
+            --jq '.[] | select(.filename | startswith(".github/workflows/") or startswith(".github/actions/"))
                       | [.filename, .contents_url] | @tsv')"
 
           has_managed=false

package/templates/workflows/github-release.yml

@@ -0,0 +1,81 @@
+name: GitHub Release
+
+# Creates the GitHub Release, with notes generated from `.github/release.yml`, for each tag
+# `josh release` cuts (joshuafolkken/kit#3007). A repository with a Publish workflow gets its release
+# once that workflow has succeeded for the tag; one without it gets the release when auto-tag.yml
+# announces the tag. kit's own release is the `create-release` job of its publish.yml, which runs the
+# same `josh release:github`, so this file is distributed but never runs in kit.
+on:
+  workflow_run:
+    workflows: [Publish]
+    types: [completed]
+  repository_dispatch:
+    types: [new-tag-created]
+
+# Deliberately no `concurrency` block: a later tag waits inside `josh release:github` for the lower
+# tag's release, so serializing the runs would leave the later run holding the slot the lower one needs.
+
+jobs:
+  release:
+    # The Publish run is titled `Publish <tag>`; its head branch is not the tag when it was started by
+    # repository_dispatch, so the title is where the tag is read from.
+    if: >-
+      (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' &&
+      startsWith(github.event.workflow_run.display_title, 'Publish v')) ||
+      github.event_name == 'repository_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 65
+    permissions:
+      actions: read
+      contents: write
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      # A repository with a Publish workflow is released from the workflow_run above, after its
+      # publication, so the tag announcement is left alone there and one tag never starts two releases.
+      - name: Select release tag
+        id: release
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          RUN_TITLE: ${{ github.event.workflow_run.display_title }}
+          RUN_WORKFLOW: ${{ github.event.workflow_run.workflow_id }}
+          DISPATCH_TAG: ${{ github.event.client_payload.tag }}
+        run: |
+          if [ "$EVENT_NAME" = workflow_run ]; then
+            echo "tag=${RUN_TITLE#Publish }" >> "$GITHUB_OUTPUT"
+            echo "workflow=$RUN_WORKFLOW" >> "$GITHUB_OUTPUT"
+          elif [ -f .github/workflows/publish.yml ]; then
+            echo "ℹ️ publish.yml releases this tag once it has published, skipping"
+          else
+            echo "tag=$DISPATCH_TAG" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Node.js
+        if: steps.release.outputs.tag != ''
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24'
+
+      - name: Configure GitHub Packages authentication for existing projects
+        if: steps.release.outputs.tag != ''
+        run: printf '//npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}\n' >> "$HOME/.npmrc"
+
+      - name: Setup pnpm and install dependencies
+        if: steps.release.outputs.tag != ''
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+          cache: 'false'
+
+      - name: Publish GitHub Release
+        if: steps.release.outputs.tag != ''
+        run: pnpm josh release:github
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_WORKFLOW: ${{ steps.release.outputs.workflow }}

package/prompts/collaboration-workflow/cross-repo-epic.md

@@ -1,5 +0,0 @@
-## リポジトリをまたぐ EPIC
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "Epics that span repositories" である。** 子の書き方、owner の制限、自動クローズ、公開の完了を待つ依存、配布物を持たない repo、実行のディスパッチ、`owner/repo#N` での参照はすべてそこにある。
-
-経緯（公開待ちが要る理由、joshuafolkken/kit#1129）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/prompts/collaboration-workflow/epic-audit.md

@@ -1,5 +0,0 @@
-## `josh epic:audit` — 子 Issue 群を横断して矛盾を検出する
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "`josh epic:audit <E>` — contradictions across the children" である。** 検査表、警告とエラーの区別、片方が closed の組を警告に降格する規則、孤児検索の 2 つの結果、Tier A の修正、計画時の波及先の点検はすべてそこにある。
-
-経緯（joshuafolkken/kit#858 の監査で見つかった矛盾と波及漏れ、joshuafolkken/kit#1010）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/prompts/collaboration-workflow/epic-bundle.md

@@ -1,5 +0,0 @@
-## 後から関連が判明した Issue を epic に束ねる
-
-**この規則の単一ソースは `.claude/skills/epic-commands/SKILL.md` → "`josh epic:bundle <N>` — does this new issue belong with one already filed?" である。** 発火点、強い信号、候補探索の範囲、決定木、所属先の記録、順序の記録、起票前の `issue:scout` はすべてそこにある。レビュー上限で切り出す後追い Issue の起票と答えへの対応は `prompts/review.md` → "Three-way disposition after the cap" が単一ソースである。
-
-経緯（joshuafolkken/kit#943 / #946 / #947 の取りこぼし、CI 待ちに起票を置く根拠の計測）は [`docs/maintainers/epic-commands-rationale.md`](../../docs/maintainers/epic-commands-rationale.md) にある。

package/scripts/init/plugin-install-hint.ts

@@ -1,47 +0,0 @@
-import { readdirSync } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-import { claude_plugin_config } from './claude-plugin-config'
-
-// `josh init` / `josh sync` declare the kit plugin in the consumer's `.claude/settings.json`, but the
-// CLI does not install it from the declaration alone — a consumer runs `claude plugin install kit@kit`
-// once (joshuafolkken/kit#1930). Nothing said so at the end of init or sync, so a consumer whose
-// skills silently never loaded had no pointer to the one command that fixes it. This prints that
-// command on completion, unless the plugin already appears installed.
-
-const PLUGINS_SUBDIR = path.join('.claude', 'plugins')
-
-// Best effort: Claude Code records installed marketplaces under `~/.claude/plugins`. The kit
-// marketplace directory being present is the strongest signal available at the shell; the plugin's
-// enabled state is not readable here, so an uncertain read (no directory, no permission) counts as
-// "not installed". A hint shown once too often costs a line; one never shown costs a consumer its skills.
-function is_plugin_installed(home_directory: string = os.homedir()): boolean {
-	try {
-		return readdirSync(path.join(home_directory, PLUGINS_SUBDIR)).some(
-			(entry) =>
-				entry === claude_plugin_config.MARKETPLACE_NAME ||
-				entry.startsWith(`${claude_plugin_config.MARKETPLACE_NAME}@`),
-		)
-	} catch {
-		return false
-	}
-}
-
-function plugin_install_hint(is_installed: boolean): string | undefined {
-	if (is_installed) return undefined
-
-	return `  ℹ Skills load from the kit plugin. If they are missing, run: claude plugin install ${claude_plugin_config.PLUGIN_ID}`
-}
-
-function report_plugin_install_hint(home_directory?: string): void {
-	const hint = plugin_install_hint(is_plugin_installed(home_directory))
-	if (hint !== undefined) console.info(hint)
-}
-
-const plugin_install_hint_module = {
-	is_plugin_installed,
-	plugin_install_hint,
-	report_plugin_install_hint,
-}
-
-export { plugin_install_hint_module }

package/scripts/version/parse-json.ts

@@ -1,13 +0,0 @@
-// Parse JSON without throwing: returns the parsed value, or undefined when the input is not valid
-// JSON. Single source for the version commands that read package.json / CLI output and hand the
-// result to a schema's `safeParse` (running-binary, version-targets, effective-upstream), so the
-// permissive-parse behavior is defined once rather than re-cloned per reader.
-function safe_json_parse(raw: string): unknown {
-	try {
-		return JSON.parse(raw)
-	} catch {
-		return undefined
-	}
-}
-
-export { safe_json_parse }