@joshuafolkken/kit 1.1784.0 → 1.2116.0

package/.github/workflows/ci.yml

@@ -156,6 +156,7 @@ jobs:
       reuse: ${{ steps.prove.outputs.reuse }}
       run-id: ${{ steps.prove.outputs.run-id }}
       pull-number: ${{ steps.prove.outputs.pull-number }}
+      author-association: ${{ steps.prove.outputs.author-association }}
     steps:
       - name: Prove the pushed tree passed PR Checks
         id: prove
@@ -171,7 +172,7 @@ jobs:
             exit 0
           fi
           if ! pull=$(printf '%s' "${pulls}" | jq -r --arg sha "${CURRENT_SHA}" \
-            '[.[] | select(.merged_at != null and .merge_commit_sha == $sha and .base.ref == "main")] | if length == 1 then .[0] | [.number, .head.sha, .head.ref, .created_at, .merged_at] | @tsv else empty end'); then
+            '[.[] | select(.merged_at != null and .merge_commit_sha == $sha and .base.ref == "main")] | if length == 1 then .[0] | [.number, .head.sha, .head.ref, .created_at, .merged_at, .author_association] | @tsv else empty end'); then
             echo '::notice::Could not parse the pull request; running the verification jobs.'
             exit 0
           fi
@@ -179,7 +180,7 @@ jobs:
             echo 'No unique merged pull request matched this push; running the verification jobs.'
             exit 0
           fi
-          IFS=$'\t' read -r pull_number head_sha head_ref created_at merged_at <<< "${pull}"
+          IFS=$'\t' read -r pull_number head_sha head_ref created_at merged_at author_association <<< "${pull}"
 
           if ! current_tree=$(gh api "repos/${REPOSITORY}/git/commits/${CURRENT_SHA}" --jq '.tree.sha') || \
             ! pr_tree=$(gh api "repos/${REPOSITORY}/git/commits/${head_sha}" --jq '.tree.sha'); then
@@ -225,6 +226,7 @@ jobs:
           echo 'reuse=true' >> "$GITHUB_OUTPUT"
           echo "run-id=${run_id}" >> "$GITHUB_OUTPUT"
           echo "pull-number=${pull_number}" >> "$GITHUB_OUTPUT"
+          echo "author-association=${author_association}" >> "$GITHUB_OUTPUT"
           echo "Reusing successful PR Checks for tree ${current_tree}."
 
   # joshuafolkken/kit#1226 split the gate's four checks across two runners. The unit suite is the only
@@ -240,12 +242,23 @@ jobs:
   # needed a ruleset edit to stay as strict as it was, and left every merge between the two
   # unguarded. So the two halves run under new names and `Checks` stays exactly what the ruleset
   # already requires: a job that is green only when both halves are.
+  #
+  # **The static half is a matrix of three legs** (joshuafolkken/kit#5215). On one runner its seven
+  # checks took 4.1 minutes while every unit shard was done in about two, so it was the critical path
+  # to `Checks`. Each leg is still `josh gate`, narrowed by `--static-group` to the partition
+  # `scripts/gate/gate-static-group.ts` defines, and restores only the caches its checks write — a leg
+  # that restored a cache it never writes would save it back unchanged under the same sha-keyed name,
+  # racing the leg that does write it. `needs.static-checks.result` is `success` only when every leg is.
   static-checks:
-    name: Static Checks
+    name: Static Checks (${{ matrix.group }})
     needs: reuse-pr-checks
     if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 8
+    strategy:
+      fail-fast: false
+      matrix:
+        group: [lint, types, rest]
     permissions:
       contents: read
       packages: read
@@ -267,6 +280,7 @@ jobs:
           registry-url: 'https://npm.pkg.github.com'
 
       - name: Setup ESLint cache
+        if: matrix.group == 'lint'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: eslint-cache
         with:
@@ -307,6 +321,7 @@ jobs:
       # `josh check` runs `tsc --noEmit --incremental --tsBuildInfoFile .tsbuildinfo` and `josh
       # cspell:dot` runs `cspell . --dot --cache --cache-strategy content --cache-location .cspellcache`.
       - name: Setup TypeScript build cache
+        if: matrix.group == 'types'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: tsbuildinfo-cache
         with:
@@ -318,6 +333,7 @@ jobs:
             ${{ runner.os }}-tsbuildinfo-
 
       - name: Setup cspell cache
+        if: matrix.group == 'rest'
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cspell-cache
         with:
@@ -328,6 +344,25 @@ jobs:
             ${{ runner.os }}-cspell-cache-${{ hashFiles('pnpm-lock.yaml') }}-
             ${{ runner.os }}-cspell-cache-
 
+      # joshuafolkken/kit#5116: `josh lint --changed` runs `prettier --check . --cache --cache-strategy
+      # content --cache-location .prettiercache` beside eslint, and with no restored cache it walked
+      # the whole tree cold on every run. Prettier hashes each file's absolute path into its entry
+      # (`scripts/josh/josh-command-types.ts` → `GATE_CACHE_SPECS`), which is why no lane shares it,
+      # but the runner checks out to the same path on every run, so an earlier run's entries hit. The
+      # key is the eslint cache's shape: lockfile and prettier config hashes, then the sha.
+      - name: Setup prettier cache
+        if: matrix.group == 'lint'
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: prettier-cache
+        with:
+          path: |
+            .prettiercache
+          key: ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('prettier.config.js', 'prettier/**/*.js') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('prettier.config.js', 'prettier/**/*.js') }}-
+            ${{ runner.os }}-prettier-cache-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-prettier-cache-
+
       - name: Setup pnpm and install dependencies
         uses: ./.github/actions/setup-pnpm
         with:
@@ -374,9 +409,10 @@ jobs:
       # default branch itself. A name that does not resolve fails the step rather than comparing
       # with nothing.
       - name: Run verification gate
-        run: pnpm josh gate --verbose --no-unit
+        run: pnpm josh gate --verbose --no-unit "--static-group=${STATIC_GROUP}"
         env:
           JOSH_METRICS_BASE: HEAD^1
+          STATIC_GROUP: ${{ matrix.group }}
 
       # joshuafolkken/kit#4449: a main push that reuses this run skips the job above, so it saves no
       # ESLint cache, and a later pull request restored an entry several merges old. Since
@@ -388,13 +424,13 @@ jobs:
       # transient artifact-service error must not turn this required job red; it continues on error.
       - name: Write ESLint cache prefix
         id: eslint-cache-prefix
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && matrix.group == 'lint'
         env:
           ESLINT_CACHE_PREFIX: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
         run: printf '%s\n' "${ESLINT_CACHE_PREFIX}" > eslint-cache-prefix
 
       - name: Upload ESLint cache
-        if: github.event_name == 'pull_request'
+        if: github.event_name == 'pull_request' && matrix.group == 'lint'
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
@@ -411,6 +447,9 @@ jobs:
   # fresh key and saves the downloaded file in its post step; the prefix is checked before it becomes
   # a key. A missing artifact — a run from before this — or a prefix that is not a key saves nothing
   # and leaves the push green; the next pull request then restores an older entry, as it did before.
+  # Only a pull request whose author holds a trusted association (OWNER / MEMBER / COLLABORATOR) is promoted:
+  # an outside author's run can write any `.eslintcache` it likes, and main's scope would then let
+  # later pull requests skip lint on that forged record (joshuafolkken/kit#5050).
   seed-eslint-cache:
     name: Seed ESLint Cache
     needs: reuse-pr-checks
@@ -427,7 +466,15 @@ jobs:
           REPOSITORY: ${{ github.repository }}
           RUN_ID: ${{ needs.reuse-pr-checks.outputs.run-id }}
           PULL_NUMBER: ${{ needs.reuse-pr-checks.outputs.pull-number }}
+          AUTHOR_ASSOCIATION: ${{ needs.reuse-pr-checks.outputs.author-association }}
         run: |
+          case "${AUTHOR_ASSOCIATION}" in
+            OWNER | MEMBER | COLLABORATOR) ;;
+            *)
+              echo "::notice::The pull request's author association (${AUTHOR_ASSOCIATION:-unknown}) is not trusted; saving nothing."
+              exit 0
+              ;;
+          esac
           if ! gh run download "${RUN_ID}" --repo "${REPOSITORY}" --name "eslint-cache-${PULL_NUMBER}"; then
             echo '::notice::The reused run left no ESLint cache; saving nothing.'
             exit 0
@@ -448,15 +495,68 @@ jobs:
             .eslintcache
           key: ${{ steps.download.outputs.prefix }}${{ github.sha }}
 
+  # joshuafolkken/kit#5189: the seed above saves the pull request's cache under the Node.js release
+  # *that* run resolved. When the runner images move to a new patch release, main holds no lineage
+  # for it, and the first pull request on the new release lints cold (Static Checks 3.7 → 6.6 min).
+  # This job restores with the static-checks key on its own runner, after the seed has saved: an
+  # exact hit means the seed already wrote this release's lineage for this push, and nothing runs.
+  # A miss — a new release, or a seed that saved nothing — lints here, and `actions/cache` saves the
+  # result in its post step, so the cold lint is paid on main instead of on a pull request. The lint
+  # only saves time, so its step continues on error: a red lint still saves, and leaves the job green.
+  warm-eslint-lineage:
+    name: Warm ESLint Lineage
+    needs: [reuse-pr-checks, seed-eslint-cache]
+    if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Node.js
+        id: setup-node
+        uses: ./.github/actions/setup-node
+        with:
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Setup ESLint cache
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        id: eslint-cache
+        with:
+          path: |
+            .eslintcache
+          key: ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-${{ hashFiles('eslint.config.js', 'eslint/**/*.js') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-${{ hashFiles('pnpm-lock.yaml') }}-
+            ${{ runner.os }}-eslint-cache-${{ steps.setup-node.outputs.node-version }}-
+
+      - name: Setup pnpm and install dependencies
+        if: steps.eslint-cache.outputs.cache-hit != 'true'
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Lint to write this release's lineage
+        id: lint
+        if: steps.eslint-cache.outputs.cache-hit != 'true'
+        continue-on-error: true
+        run: pnpm josh lint
+
   # The other half of the gate, on a runner of its own. A GitHub job is its own machine, so this job
   # sets Node up again; the pnpm preamble is the shared `.github/actions/setup-pnpm` action
   # (joshuafolkken/kit#2982), which `templates/workflows/ci.yml` calls the same way, so
   # `scripts/ci/ci-yml-action-parity.test.ts` compares the two files without the action's own pins
   # (joshuafolkken/kit#3095).
   #
-  # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `gate-plan.ts` leaves
-  # any machine below its measured 11 cores uncapped, so vitest sizes its own pool from the runner
-  # exactly as it did inside the gate step.
+  # No ESLint cache here — nothing in this job lints — and no `--maxWorkers`: `josh test:unit` sizes a
+  # lone run's claim on a 4-core runner at vitest's own default, three workers plus vitest itself
+  # (`gate_plan.direct_unit_weight`, joshuafolkken/kit#4607).
   # **Sharded across runners, because one runner is already saturated** (joshuafolkken/kit#3220).
   # Alone on a 4-core runner vitest takes every core, so the suite can only get faster by spreading
   # its files over more machines. `fail-fast: false` keeps a red shard from cancelling the others,
@@ -464,19 +564,19 @@ jobs:
   # which for a matrix is `success` only when every shard succeeded — no change there is needed.
   # The shards split by the recorded per-file durations in `tools/test/unit-durations.json`, not by
   # file count, so they finish together (`tools/test/duration-shard.ts`, joshuafolkken/kit#4467).
-  # Four shards, not three (joshuafolkken/kit#4573): balanced at three, each shard still ran its tests
-  # for 196–227 seconds and set the CI wait; a fourth cuts each slice by a quarter for about 12
-  # seconds of duplicated setup.
+  # Six shards (joshuafolkken/kit#5090): at three (joshuafolkken/kit#4610) the slowest shard had
+  # become the last check `Checks` waited on, past Static Checks. Six bring a shard's recorded load
+  # to about two minutes; past that the longest single file, not the shard count, sets the floor.
   # Only kit shards: the distributed template runs the unit suite inside its single `checks` job,
   # where a small consumer suite would pay the duplicated setup and could leave a shard with no file.
   unit:
-    name: Unit Tests (${{ matrix.shard }}/4)
+    name: Unit Tests (${{ matrix.shard }}/6)
     needs: reuse-pr-checks
     if: ${{ !cancelled() && needs.reuse-pr-checks.outputs.reuse != 'true' }}
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4]
+        shard: [1, 2, 3, 4, 5, 6]
     runs-on: ubuntu-latest
     timeout-minutes: 8
     permissions:
@@ -508,7 +608,7 @@ jobs:
       # `scripts/ci/ci-yml-unit-job.test.ts` pins the command; the guard itself is
       # `scripts/test/test-unit-guard.ts`.
       - name: Run unit tests
-        run: pnpm josh test:unit --shard=${{ matrix.shard }}/4
+        run: pnpm josh test:unit --shard=${{ matrix.shard }}/6
 
       # One shard is enough: the check does not depend on which test files ran beside it.
       - name: Verify optional ESLint consumer install
@@ -586,6 +686,46 @@ jobs:
           path: pr-checks-evidence
           retention-days: 1
 
+  # The pre-commit secretlint scan skips when its binary is missing and never runs on a commit made
+  # with `--no-verify`, so this job scans the pull request's changes again where neither applies
+  # (joshuafolkken/kit#4657). It needs no other job and none needs it, so it stays off the critical
+  # path, and its own `Secret Scan` context is what makes a finding block the merge. Only the files
+  # the pull request adds or changes are read: the merge commit's first parent is the base, which is
+  # why the checkout fetches two commits. secretlint comes from the same store cache every other job
+  # installs from, and `JOSH_SECRETLINT_REQUIRE` turns the hook's missing-binary skip into a failure.
+  # `shell: bash` adds `pipefail`, so a diff that fails cannot hand `xargs` an empty list and pass.
+  secret-scan:
+    name: Secret Scan
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 2
+
+      - name: Setup Node.js
+        uses: ./.github/actions/setup-node
+        with:
+          registry-url: 'https://npm.pkg.github.com'
+
+      - name: Setup pnpm and install dependencies
+        uses: ./.github/actions/setup-pnpm
+        with:
+          node-auth-token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Scan the changed files for secrets
+        id: scan
+        shell: bash
+        env:
+          JOSH_SECRETLINT_REQUIRE: '1'
+        run: git diff -z --name-only --diff-filter=d HEAD^1 HEAD | xargs -0 -r pnpm josh secretlint-scan
+
   security:
     name: Security Audit
     runs-on: ubuntu-latest

package/.github/workflows/dependabot-auto-merge.yml

@@ -4,9 +4,10 @@ on: pull_request
 
 # One run per pull request, superseded ones cancelled. `ci.yml` groups its pull-request runs the
 # same way but no longer its pushes: since joshuafolkken/kit#1481 it appends the commit sha on a
-# `push` event, which this workflow — triggered by `pull_request` alone — has no use for. kit's own
-# copy has no withdrawal for a stale run to arm behind (joshuafolkken/kit#842 is about the
-# distributed copy), so here the group only keeps a force-pushed bump from paying for two runs.
+# `push` event, which this workflow — triggered by `pull_request` alone — has no use for. A stale run
+# cannot arm behind the withdrawal below: its `--match-head-commit` is refused once the branch moved
+# (joshuafolkken/kit#842 is about the distributed copy), so here the group only keeps a
+# force-pushed bump from paying for two runs.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -51,13 +52,71 @@ jobs:
       # npm bumps never auto-merge, at any semver level: kit publishes lint plugins as runtime
       # dependencies, so a patch release can change rule behavior for every consumer while kit's own
       # CI only proves that kit still builds. Major bumps never auto-merge in either ecosystem.
+      #
+      # Only the `github-actions` group merges: `.github/dependabot.yml` puts the actions the publish
+      # jobs run with publish credentials, and those of the `pack` job that builds the tarball they
+      # publish, in a group of their own, because a hijacked release of one would publish with valid
+      # provenance, so a person reviews it (joshuafolkken/kit#4633, joshuafolkken/kit#4654). An
+      # ungrouped pull request does not merge either, so a bump that escapes both groups is reviewed.
+      #
+      # `--match-head-commit` refuses to arm when the branch moved after the event this run was
+      # triggered for, so a commit pushed before the arming does not merge on the bump's metadata. A
+      # push after the arming is the withdrawal step's (joshuafolkken/kit#4654).
       - name: Enable auto-merge for github-actions patch and minor updates
         if: >-
           github.actor == 'dependabot[bot]'
           && steps.metadata.outputs.package-ecosystem == 'github_actions'
+          && steps.metadata.outputs.dependency-group == 'github-actions'
           && (steps.metadata.outputs.update-type == 'version-update:semver-patch'
           || steps.metadata.outputs.update-type == 'version-update:semver-minor')
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           GH_TOKEN: ${{ github.token }}
-        run: gh pr merge --auto --merge "$PR_URL"
+        run: gh pr merge --auto --merge --match-head-commit "$HEAD_SHA" "$PR_URL"
+
+      # The arming only binds the head it was made on: GitHub keeps auto-merge on through a later push,
+      # so a commit a collaborator pushes to the branch would merge on the bump's metadata. A push by
+      # anyone but Dependabot therefore withdraws the arming this workflow made (joshuafolkken/kit#4691).
+      # Only that one: an auto-merge a maintainer enabled by hand — before their push or after it — is
+      # their decision, and the step reads who enabled it to leave it alone.
+      #
+      # `--disable-auto` is an error on a pull request with nothing armed, so the state is read first;
+      # a read that fails falls through to the withdrawal rather than past it, and a withdrawal that
+      # still fails after its retries leaves the run red. GraphQL names the token's identity
+      # `github-actions`; the REST spelling is accepted too.
+      - name: Withdraw this workflow's auto-merge after a push by anyone but Dependabot
+        id: withdraw
+        if: github.actor != 'dependabot[bot]'
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          # A variable so the unit test that runs this script can set the delay to zero.
+          RETRY_ATTEMPTS: '3'
+          RETRY_BACKOFF_SECONDS: '5'
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          enabler="$(gh pr view "$PR_URL" --json autoMergeRequest \
+            --jq '.autoMergeRequest.enabledBy.login // ""')" || enabler=unknown
+
+          case "$enabler" in
+            '')
+              echo 'Auto-merge is not enabled — nothing to withdraw.'
+              exit 0
+              ;;
+            github-actions | 'github-actions[bot]' | unknown) ;;
+            *)
+              echo "Auto-merge was enabled by $enabler — leaving their decision as it is."
+              exit 0
+              ;;
+          esac
+
+          attempt=1
+
+          until gh pr merge --disable-auto "$PR_URL"; do
+            if [ "$attempt" -ge "$RETRY_ATTEMPTS" ]; then
+              exit 1
+            fi
+
+            sleep "$((attempt * RETRY_BACKOFF_SECONDS))"
+            attempt=$((attempt + 1))
+          done

package/.github/workflows/production.yml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Configure Git
         run: |
@@ -35,7 +36,14 @@ jobs:
           # resolves to that branch, not the released tag. Use the tag carried in the
           # dispatch payload (set by auto-tag.yml) as the merge source instead.
           REF_NAME: ${{ inputs.tag || github.event.client_payload.tag }}
+          GH_TOKEN: ${{ github.token }}
         run: |
+          # The checkout keeps no credentials, so the token reaches git for this step only, through
+          # the environment rather than .git/config (joshuafolkken/kit#4651).
+          BASIC=$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)
+          echo "::add-mask::$BASIC"
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.https://github.com/.extraheader GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $BASIC"
+
           if [ -z "$REF_NAME" ]; then
             echo "::error::new-tag-created dispatch carried no tag payload; aborting." >&2
             exit 1

package/.github/workflows/publish.yml

@@ -7,9 +7,11 @@ run-name: Publish ${{ github.ref_name }}
 on:
   workflow_dispatch:
 
-# Every job installs through `.github/actions/setup-pnpm`, so the jobs holding the publish rights
-# install behind the same hash-verified safe-chain scan as CI (joshuafolkken/kit#2982). The store
-# cache is off here: a cache entry another run saved never reaches a job with publish credentials.
+# The jobs holding the publish rights install nothing and run no repository code: a compromised
+# dependency would otherwise publish with valid provenance (joshuafolkken/kit#4633). Every install
+# and every `tsx` run happens in `pack`, which holds no credentials, behind the same hash-verified
+# safe-chain scan as CI (joshuafolkken/kit#2982). Its store cache is off: a cache entry another run
+# saved never reaches the tarball the publish jobs receive.
 
 jobs:
   # The package is built once, here, and both registries receive this one tarball: a job that built
@@ -21,6 +23,12 @@ jobs:
     timeout-minutes: 10
     permissions:
       contents: read
+    # One dist-tag for both registries, chosen against npmjs, whose `latest` needs no credentials to
+    # read: both receive the same tarball in the same run, so they move in step. `pack` runs outside
+    # the `package-publish` queue, so the publish jobs re-check `latest` against its choice (see there).
+    outputs:
+      tag: ${{ steps.publish-tag.outputs.tag }}
+      version: ${{ steps.publish-tag.outputs.version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -28,10 +36,28 @@ jobs:
 
       - uses: ./.github/actions/setup-node
 
+      # Read before setup-pnpm puts the safe-chain shims on PATH: safe-chain hides recent versions from
+      # registry metadata and prints a notice to stdout, which corrupts the value (joshuafolkken/kit#3060).
+      - name: Read registry latest
+        id: registry-latest
+        run: |
+          latest=$(cd "$(mktemp -d)" && npm view @joshuafolkken/kit dist-tags.latest --registry https://registry.npmjs.org)
+          echo "latest=$latest" >> "$GITHUB_OUTPUT"
+
       - uses: ./.github/actions/setup-pnpm
         with:
           cache: 'false'
 
+      - name: Select publish tag
+        id: publish-tag
+        run: |
+          version=$(node -p "require('./package.json').version")
+          tag=$(pnpm exec tsx scripts/release/publish-tag-cli.ts "$version" "$LATEST")
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+        env:
+          LATEST: ${{ steps.registry-latest.outputs.latest }}
+
       - run: pnpm pack --out "$RUNNER_TEMP/kit.tgz"
 
       # Kept as long as GitHub lets a run be re-run, so re-running a failed publish job still finds
@@ -64,34 +90,31 @@ jobs:
           registry-url: 'https://npm.pkg.github.com'
           scope: '@joshuafolkken'
 
-      # Read before setup-pnpm puts the safe-chain shims on PATH: safe-chain hides recent versions from
-      # registry metadata and prints a notice to stdout, which corrupts the value (joshuafolkken/kit#3060).
-      - name: Read registry latest
-        id: registry-latest
-        run: |
-          latest=$(cd "$RUNNER_TEMP" && npm view @joshuafolkken/kit dist-tags.latest --registry https://npm.pkg.github.com)
-          echo "latest=$latest" >> "$GITHUB_OUTPUT"
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - uses: ./.github/actions/setup-pnpm
-        with:
-          cache: 'false'
-
-      - name: Select GitHub Packages tag
-        id: publish-tag
-        run: |
-          version=$(node -p "require('./package.json').version")
-          tag=$(pnpm exec tsx scripts/release/publish-tag-cli.ts "$version" "$LATEST")
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
-        env:
-          LATEST: ${{ steps.registry-latest.outputs.latest }}
-
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: kit-package
           path: ${{ runner.temp }}
 
+      # `pack` chose `latest` outside this queue, so another tag's run may have moved npmjs' `latest`
+      # since: publishing then could move it back to an older version (joshuafolkken/kit#2660). The
+      # choice stays valid while npmjs' `latest` is not above this run's version, so an older tag's
+      # run publishing in between does not stop this one; a newer one stops the job before it
+      # publishes, and re-running all jobs chooses again. `sort -V` ranks a prerelease above its
+      # release, which can only stop a valid run, never let a stale one through. `backfill` needs no
+      # check: a later `latest` is never lower than the one `pack` read. The lookup runs in an empty
+      # directory with the user config skipped: setup-node writes its scoped GitHub Packages registry to
+      # `$RUNNER_TEMP/.npmrc`, which npm reads as the project config from there (joshuafolkken/kit#5376).
+      - name: Confirm npm latest is not newer
+        if: needs.pack.outputs.tag == 'latest'
+        run: |
+          latest=$(cd "$(mktemp -d)" && npm view @joshuafolkken/kit dist-tags.latest --registry https://registry.npmjs.org --userconfig /dev/null)
+          if ! printf '%s\n%s\n' "$latest" "$VERSION" | sort -V -C; then
+            echo "::error::npm latest moved to $latest, above $VERSION, after pack chose the tag; re-run all jobs"
+            exit 1
+          fi
+        env:
+          VERSION: ${{ needs.pack.outputs.version }}
+
       # The tag reaches the command through the environment rather than expanded into it, so a step
       # output is never parsed as shell (joshuafolkken/kit#3084). setup-node's user config carries
       # the GitHub Packages token, so it is kept here.
@@ -99,7 +122,7 @@ jobs:
         run: cd "$RUNNER_TEMP" && npm publish kit.tgz --tag "$PUBLISH_TAG" --registry https://npm.pkg.github.com
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PUBLISH_TAG: ${{ steps.publish-tag.outputs.tag }}
+          PUBLISH_TAG: ${{ needs.pack.outputs.tag }}
 
   publish-npm:
     needs: pack
@@ -121,35 +144,27 @@ jobs:
         with:
           registry-url: 'https://registry.npmjs.org'
 
-      # Before setup-pnpm, for the same reason as publish-github's lookup (joshuafolkken/kit#3060).
-      - name: Read registry latest
-        id: registry-latest
-        run: |
-          latest=$(cd "$RUNNER_TEMP" && npm view @joshuafolkken/kit dist-tags.latest --registry https://registry.npmjs.org)
-          echo "latest=$latest" >> "$GITHUB_OUTPUT"
-
-      - uses: ./.github/actions/setup-pnpm
-        with:
-          cache: 'false'
-
       - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: kit-package
           path: ${{ runner.temp }}
 
-      - name: Select npm tag
-        id: publish-tag
+      # The same check as publish-github's, for the same reason.
+      - name: Confirm npm latest is not newer
+        if: needs.pack.outputs.tag == 'latest'
         run: |
-          version=$(node -p "require('./package.json').version")
-          tag=$(pnpm exec tsx scripts/release/publish-tag-cli.ts "$version" "$LATEST")
-          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          latest=$(cd "$(mktemp -d)" && npm view @joshuafolkken/kit dist-tags.latest --registry https://registry.npmjs.org --userconfig /dev/null)
+          if ! printf '%s\n%s\n' "$latest" "$VERSION" | sort -V -C; then
+            echo "::error::npm latest moved to $latest, above $VERSION, after pack chose the tag; re-run all jobs"
+            exit 1
+          fi
         env:
-          LATEST: ${{ steps.registry-latest.outputs.latest }}
+          VERSION: ${{ needs.pack.outputs.version }}
 
       - name: Publish to npm
         run: cd "$RUNNER_TEMP" && npm publish kit.tgz --access public --tag "$PUBLISH_TAG" --registry https://registry.npmjs.org --userconfig /dev/null
         env:
-          PUBLISH_TAG: ${{ steps.publish-tag.outputs.tag }}
+          PUBLISH_TAG: ${{ needs.pack.outputs.tag }}
 
   update-production:
     needs: [publish-github, publish-npm]

package/.vscode/settings.json

@@ -16,6 +16,25 @@
 	"files.associations": {
 		"**/tsconfig/*.json": "jsonc"
 	},
+	"files.watcherExclude": {
+		"**/node_modules/**": true,
+		"**/.git/objects/**": true,
+		"**/.git/subtree-cache/**": true,
+		"**/.git/josh/**": true,
+		"**/.josh/observations/**": true,
+		"**/.svelte-kit/**": true,
+		"coverage/**": true,
+		"build/**": true,
+		"dist/**": true
+	},
+	"search.exclude": {
+		"**/node_modules": true,
+		"**/.git/josh": true,
+		"**/.svelte-kit": true,
+		"coverage": true,
+		"build": true,
+		"dist": true
+	},
 	"[markdown]": {
 		"editor.defaultFormatter": "esbenp.prettier-vscode"
 	},