@lzear/forge 4.2.2 → 4.4.0

package/README.md

@@ -19,6 +19,7 @@ Requires Node ≥ 20.
 
 ```sh
 yarn forge check          # audit this repo against forge standards
+yarn forge update         # update deps, packageManager & version files
 yarn forge setup          # check and set required GitHub secrets
 yarn forge sync           # pull shared files from forge into this repo
 ```
@@ -35,6 +36,24 @@ forge check --json                  # machine-readable output
 forge check --skip-remote           # skip GitHub secret checks
 ```
 
+### `forge update`
+
+One-stop repo freshening. Detects the package manager (npm, yarn, pnpm, or bun — from the `packageManager` field or the lockfile) and updates everything that needs regular bumping:
+
+- dependency ranges in all workspaces (via `npm-check-updates`; honors `.ncurc{,.json,.js,.cjs,.mjs}` — e.g. `reject` to pin packages)
+- the `packageManager` field (yarn ≥ 2 resolved from `@yarnpkg/cli-dist`)
+- `.nvmrc` / `.node-version` → latest Node LTS
+- `.bun-version` → latest Bun
+- LICENSE copyright year (extends `2023` → `2023-2026`)
+- then installs, refreshes the lockfile, and dedupes with the detected package manager (`yarn up -R '*' && yarn dedupe`, `pnpm update -r && pnpm dedupe`, `npm update && npm dedupe`, or `bun update`)
+
+```sh
+forge update               # update everything, then install
+forge update --dry         # preview changes without writing
+forge update --no-install  # write updates but skip install
+forge update --json        # machine-readable output
+```
+
 ### `forge setup`
 
 Checks and sets the required GitHub secrets (`NPM_TOKEN`, `CODACY_PROJECT_TOKEN`) for a repo.
@@ -50,7 +69,7 @@ forge setup --dry                   # check only, do not prompt
 Fetches shared template files from the forge `main` branch and writes them locally.
 
 ```sh
-forge sync        # write .editorconfig, .codacy.yml, lefthook.yml
+forge sync        # write .editorconfig, .codacy.yml, lefthook.yml, .github/zizmor.yml
 forge sync --dry  # preview without writing
 ```
 

package/dist/bin.js

@@ -9,36 +9,40 @@ import path from "path";
 import * as clack from "@clack/prompts";
 import { Command } from "commander";
 import pc from "picocolors";
-import { checkLocal, checkRepo } from "@lzear/repo-lint";
+import {
+  checkLocal,
+  checkRepo,
+  runUpdate
+} from "@lzear/repo-lint";
 var require2 = createRequire(import.meta.url);
 var { version } = require2("../package.json");
 var isTTY = process.stdout.isTTY;
 var isDebug = process.env.DEBUG?.includes("forge") ?? false;
-var debug = (...args) => {
-  if (isDebug) console.error(pc.dim(`[debug] ${args.join(" ")}`));
+var debug = (...arguments_) => {
+  if (isDebug) console.error(pc.dim(`[debug] ${arguments_.join(" ")}`));
 };
 var log2 = {
-  intro: (msg) => {
-    isTTY ? clack.intro(msg) : console.log(msg);
+  intro: (message) => {
+    isTTY ? clack.intro(message) : console.log(message);
   },
-  outro: (msg) => {
-    isTTY ? clack.outro(msg) : console.log(msg);
+  outro: (message) => {
+    isTTY ? clack.outro(message) : console.log(message);
   },
-  success: (msg) => {
-    isTTY ? clack.log.success(msg) : console.log(`\u2713 ${msg}`);
+  success: (message) => {
+    isTTY ? clack.log.success(message) : console.log(`\u2713 ${message}`);
   },
-  error: (msg) => {
-    isTTY ? clack.log.error(msg) : console.error(`\u2717 ${msg}`);
+  error: (message) => {
+    isTTY ? clack.log.error(message) : console.error(`\u2717 ${message}`);
   },
-  warn: (msg) => {
-    isTTY ? clack.log.warn(msg) : console.warn(`! ${msg}`);
+  warn: (message) => {
+    isTTY ? clack.log.warn(message) : console.warn(`! ${message}`);
   },
   spinner: () => isTTY ? clack.spinner() : {
-    start: (msg) => {
-      debug(msg);
+    start: (message) => {
+      debug(message);
     },
-    stop: (msg) => {
-      debug(msg);
+    stop: (message) => {
+      debug(message);
     }
   }
 };
@@ -46,16 +50,16 @@ var program = new Command();
 program.name("forge").description("lzear repo tooling").version(version, "-v, --version").helpOption("-h, --help", "show help");
 var DEFAULT_DIR = path.join(homedir(), ".cache", "forge");
 var printResults = (report, json) => {
-  const anyFail = report.results.some((r) => !r.pass);
+  const isAnyFail = report.results.some((r) => !r.pass);
   if (json) {
     console.log(
       JSON.stringify(
-        { repo: report.repo, results: report.results, pass: !anyFail },
+        { repo: report.repo, results: report.results, pass: !isAnyFail },
         null,
         2
       )
     );
-    return anyFail;
+    return isAnyFail;
   }
   const pass = report.results.filter((r) => r.pass).length;
   const total = report.results.length;
@@ -73,45 +77,45 @@ var printResults = (report, json) => {
   process.stdout.write(`
   ${score} checks passed
 `);
-  return anyFail;
+  return isAnyFail;
 };
-var runCheck = async (repos, opts) => {
-  if (!opts.json) process.stdout.write(`
+var runCheck = async (repos, options) => {
+  if (!options.json) process.stdout.write(`
   ${pc.bold("forge check")}
 
 `);
   if (!repos) {
     debug("checkLocal", process.cwd());
-    const result = await checkLocal({ skipRemote: opts.skipRemote });
-    process.exit(printResults(result, opts.json) ? 1 : 0);
+    const result = await checkLocal({ skipRemote: options.skipRemote });
+    process.exit(printResults(result, options.json) ? 1 : 0);
   }
   const repoList = repos.split(",").map((r) => r.trim());
-  let anyFail = false;
+  let isAnyFail = false;
   for (const repo of repoList) {
-    if (!opts.json)
+    if (!options.json)
       process.stdout.write(`  ${pc.dim("checking " + repo + "\u2026")}
 `);
     debug("checkRepo", repo);
     try {
       const result = await checkRepo(repo, {
-        baseDir: opts.dir,
-        skipRemote: opts.skipRemote
+        baseDir: options.dir,
+        skipRemote: options.skipRemote
       });
-      if (printResults(result, opts.json)) anyFail = true;
+      if (printResults(result, options.json)) isAnyFail = true;
     } catch (error) {
       debug(String(error));
       process.stderr.write(`  ${pc.red("\u2717 " + repo + " \u2014 could not clone")}
 `);
-      anyFail = true;
+      isAnyFail = true;
     }
   }
-  process.exit(anyFail ? 1 : 0);
+  process.exit(isAnyFail ? 1 : 0);
 };
 program.command("check").description("audit repo(s) against forge standards").option(
   "--repos <repos>",
   "comma-separated list of repos (default: current repo)"
 ).option("--skip-remote", "skip secret checks", false).option("--dir <dir>", "cache dir for cloned repos", DEFAULT_DIR).option("--json", "output results as JSON", false).action(
-  (opts) => runCheck(opts.repos, opts)
+  (options) => runCheck(options.repos, options)
 );
 var promptAndSet = async (s, repo) => {
   if (!isTTY) {
@@ -150,13 +154,13 @@ var detectRepo = () => {
   const match = /github\.com[:/]([^/]+\/[^/.]+)(?:\.git)?$/.exec(url);
   return match?.[1];
 };
-program.command("setup").description("check and set required GitHub secrets for a repo").option("--repo <repo>", "repo to set up (e.g. lzear/my-repo)").option("--dry", "check only, do not prompt for values", false).option("--json", "output results as JSON", false).action(async (opts) => {
-  const repo = opts.repo ?? detectRepo();
+program.command("setup").description("check and set required GitHub secrets for a repo").option("--repo <repo>", "repo to set up (e.g. lzear/my-repo)").option("--dry", "check only, do not prompt for values", false).option("--json", "output results as JSON", false).action(async (options) => {
+  const repo = options.repo ?? detectRepo();
   if (!repo) {
     log2.error("Could not detect repo. Pass --repo <owner/repo>.");
     process.exit(1);
   }
-  const { dry, json } = opts;
+  const { dry, json } = options;
   if (!json) log2.intro(pc.bold(`forge setup \xB7 ${pc.cyan(repo)}`));
   if (spawnSync("gh", ["--version"], { stdio: "ignore" }).status !== 0) {
     log2.error("gh CLI not found \u2014 install at https://cli.github.com");
@@ -208,35 +212,80 @@ program.command("setup").description("check and set required GitHub secrets for
   for (const s of missing) await promptAndSet(s, repo);
   log2.outro(pc.green("Done."));
 });
+var formatPackageManager = (pm) => {
+  const version2 = pm.version ? `@${pm.version}` : "";
+  return `package manager: ${pm.name}${version2} (${pm.source})`;
+};
+var updateMark = (r) => {
+  if (!r.pass) return pc.red("\u2717");
+  return r.changed ? pc.yellow("\u2191") : pc.green("\u2713");
+};
+var printUpdateReport = (report) => {
+  process.stdout.write(
+    `  ${pc.dim(formatPackageManager(report.packageManager))}
+
+`
+  );
+  for (const r of report.results) {
+    process.stdout.write(`  ${updateMark(r)}  ${r.desc}
+`);
+    if (r.detail && (r.changed || !r.pass))
+      for (const line of r.detail.split("\n"))
+        process.stdout.write(`       ${pc.dim(line)}
+`);
+  }
+  process.stdout.write("\n");
+};
+program.command("update").description("update dependencies, packageManager, and runtime version files").option("--dry", "preview changes, do not write", false).option("--no-install", "skip install & lockfile refresh").option("--json", "output results as JSON", false).action(
+  async (options) => {
+    const { dry: isDry, install: isInstall, json: isJson } = options;
+    if (!isJson)
+      process.stdout.write(
+        `
+  ${pc.bold("forge update")}${isDry ? pc.dim(" (dry run)") : ""}
+
+`
+      );
+    debug("runUpdate", process.cwd());
+    const report = await runUpdate({ dry: isDry, install: isInstall });
+    const isAnyFail = report.results.some((r) => !r.pass);
+    if (isJson)
+      console.log(JSON.stringify({ ...report, pass: !isAnyFail }, null, 2));
+    else printUpdateReport(report);
+    process.exit(isAnyFail ? 1 : 0);
+  }
+);
 var SYNC_FILES = [
   { src: "template/.editorconfig", dest: ".editorconfig" },
   { src: "template/.codacy.yml", dest: ".codacy.yml" },
-  { src: "template/lefthook.yml", dest: "lefthook.yml" }
+  { src: "template/lefthook.yml", dest: "lefthook.yml" },
+  // shared as-is: allows @main refs to forge, hash-pins everything else
+  { src: ".github/zizmor.yml", dest: ".github/zizmor.yml" }
 ];
 var RAW_BASE = "https://raw.githubusercontent.com/lzear/forge/main";
-program.command("sync").description("sync template files from forge into this repo").option("--dry", "print what would change, do not write", false).action(async (opts) => {
+program.command("sync").description("sync template files from forge into this repo").option("--dry", "print what would change, do not write", false).action(async (options) => {
   log2.intro(pc.bold("forge sync"));
-  let anyFail = false;
+  let isAnyFail = false;
   for (const { src, dest } of SYNC_FILES) {
     const url = `${RAW_BASE}/${src}`;
-    const destPath = path.join(process.cwd(), dest);
+    const destinationPath = path.join(process.cwd(), dest);
     try {
       const res = await fetch(url);
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const content = await res.text();
-      if (opts.dry) log2.success(`${dest} ${pc.dim("(dry)")}`);
+      if (options.dry) log2.success(`${dest} ${pc.dim("(dry)")}`);
       else {
-        await mkdir(path.dirname(destPath), { recursive: true });
-        await writeFile(destPath, content, "utf8");
+        await mkdir(path.dirname(destinationPath), { recursive: true });
+        await writeFile(destinationPath, content, "utf8");
         log2.success(dest);
       }
     } catch (error) {
       log2.error(`${dest} \u2014 ${String(error)}`);
-      anyFail = true;
+      isAnyFail = true;
     }
   }
-  log2.outro(anyFail ? pc.red("Done with errors.") : pc.green("Done."));
-  if (anyFail) process.exit(1);
+  log2.outro(isAnyFail ? pc.red("Done with errors.") : pc.green("Done."));
+  if (isAnyFail) process.exit(1);
 });
 var handleSignal = () => {
   if (isTTY) clack.cancel("Cancelled.");

package/dist/repo-lint.d.ts

@@ -1 +1 @@
-export { Check, CheckLocalOptions, CheckRepoOptions, CheckResult, LocalCheck, RemoteCheck, RepoReport, checkLocal, checkRepo } from '@lzear/repo-lint';
+export { Check, CheckLocalOptions, CheckRepoOptions, CheckResult, LocalCheck, PackageManager, PackageManagerName, RemoteCheck, RepoReport, UpdateOptions, UpdateReport, UpdateResult, checkLocal, checkRepo, detectPackageManager, runUpdate } from '@lzear/repo-lint';

package/dist/repo-lint.js

@@ -1,6 +1,13 @@
 // src/repo-lint.ts
-import { checkLocal, checkRepo } from "@lzear/repo-lint";
+import {
+  checkLocal,
+  checkRepo,
+  detectPackageManager,
+  runUpdate
+} from "@lzear/repo-lint";
 export {
   checkLocal,
-  checkRepo
+  checkRepo,
+  detectPackageManager,
+  runUpdate
 };

package/package.json

@@ -1,15 +1,14 @@
 {
   "name": "@lzear/forge",
-  "version": "4.2.2",
+  "version": "4.4.0",
   "description": "Umbrella package for all lzear dev tooling",
+  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/lzear/forge.git",
     "directory": "packages/forge"
   },
   "author": "lzear",
-  "license": "MIT",
-  "sideEffects": false,
   "type": "module",
   "exports": {
     "./commitlint": {
@@ -49,29 +48,43 @@
     }
   },
   "bin": "./dist/bin.js",
-  "files": [
-    "dist",
-    "tsconfig"
-  ],
+  "sideEffects": false,
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "scripts": {
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit"
   },
+  "files": [
+    "dist",
+    "tsconfig"
+  ],
+  "keywords": [
+    "cli",
+    "dev-tools",
+    "eslint-config",
+    "monorepo",
+    "tooling"
+  ],
   "dependencies": {
     "@clack/prompts": "^1",
-    "@lzear/configs": "4.2.2",
-    "@lzear/eslint-config": "4.2.2",
-    "@lzear/repo-lint": "4.2.2",
+    "@lzear/configs": "4.4.0",
+    "@lzear/eslint-config": "4.4.0",
+    "@lzear/repo-lint": "4.4.0",
     "commander": "^15",
     "picocolors": "^1"
   },
   "devDependencies": {
-    "@types/node": "^25",
+    "@types/node": "^26",
     "@vitejs/plugin-react": "^6",
     "eslint": "^10",
     "tsup": "^8",
-    "typescript": "^6",
     "vite": "^8",
     "vitest": "^4"
   },
@@ -98,12 +111,5 @@
     "vitest": {
       "optional": true
     }
-  },
-  "engines": {
-    "node": ">=24"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true
   }
 }