@mannyc1/ts-release 0.0.7 → 0.3.0

package/templates/github-actions/release.yml

@@ -0,0 +1,74 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_sha:
+        description: Exact candidate commit; it must be the current main tip.
+        required: true
+        type: string
+      prepared_ref:
+        description: Optional prepared:gha reference for recovery; leave empty for a fresh release.
+        required: false
+        default: ""
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
+    runs-on: ubuntu-24.04
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22.22.2"
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
+      - name: Prime isolated Bun dependency cache
+        if: ${{ inputs.prepared_ref == '' }}
+        run: |-
+          bun install --frozen-lockfile --ignore-scripts --no-save --linker=hoisted
+          bun --no-env-file --no-install -e 'await (await import("node:fs/promises")).rm("node_modules", { recursive: true, force: true })'
+      - id: release
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
+        with:
+          command: ${{ inputs.prepared_ref == '' && 'release' || 'publish' }}
+          config: ${{ inputs.prepared_ref == '' && 'release.config.json' || '' }}
+          prepared: ${{ inputs.prepared_ref }}
+      - name: Upload redacted release report
+        if: ${{ always() && steps.release.outputs.report-ref != '' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ts-release-report-${{ github.run_attempt }}
+          path: ${{ steps.release.outputs.report-ref }}
+          if-no-files-found: error

package/templates/github-actions/reviewed-release.yml

@@ -0,0 +1,115 @@
+name: Reviewed release
+
+on:
+  workflow_dispatch:
+    inputs:
+      candidate_sha:
+        description: Exact candidate commit; it must be the current main tip.
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  prepare:
+    if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
+    runs-on: ubuntu-24.04
+    outputs:
+      prepared-ref: ${{ steps.prepare.outputs.prepared-ref }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22.22.2"
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
+      - name: Prime isolated Bun dependency cache
+        run: |-
+          bun install --frozen-lockfile --ignore-scripts --no-save --linker=hoisted
+          bun --no-env-file --no-install -e 'await (await import("node:fs/promises")).rm("node_modules", { recursive: true, force: true })'
+      - id: prepare
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
+        env:
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
+        with:
+          command: prepare
+          config: reviewed-release.config.json
+      - name: Upload redacted preparation report
+        if: ${{ always() && steps.prepare.outputs.report-ref != '' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ts-release-prepare-report-${{ github.run_attempt }}
+          path: ${{ steps.prepare.outputs.report-ref }}
+          if-no-files-found: error
+
+  publish:
+    if: ${{ github.ref == 'refs/heads/main' && github.sha == inputs.candidate_sha }}
+    needs: prepare
+    runs-on: ubuntu-24.04
+    environment: release
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - id: setup-node
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: "22.22.2"
+      - id: setup-bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: "1.3.14"
+      - id: release-tools
+        name: Bind exact release tool paths
+        env:
+          SETUP_BUN_PATH: ${{ steps.setup-bun.outputs.bun-path }}
+        run: |-
+          node_path="$(type -P node)"
+          bun_path="$(type -P bun)"
+          [[ "$node_path" = /* && "$bun_path" = /* ]]
+          [[ "$("$node_path" --version)" == v22.22.2 ]]
+          [[ "$("$bun_path" --version)" == 1.3.14 ]]
+          [[ "$(realpath "$bun_path")" == "$(realpath "$SETUP_BUN_PATH")" ]]
+          echo "node-bin=$node_path" >> "$GITHUB_OUTPUT"
+          echo "bun-bin=$bun_path" >> "$GITHUB_OUTPUT"
+      - run: bun add --global npm@11.11.0
+      - id: publish
+        uses: mannyc2/ts-release/apps/ts-release-action@v0.3.0
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          TS_RELEASE_NODE_BIN: ${{ steps.release-tools.outputs.node-bin }}
+          TS_RELEASE_BUN_BIN: ${{ steps.release-tools.outputs.bun-bin }}
+        with:
+          command: publish
+          prepared: ${{ needs.prepare.outputs.prepared-ref }}
+      - name: Upload redacted publication report
+        if: ${{ always() && steps.publish.outputs.report-ref != '' }}
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ts-release-publish-report-${{ github.run_attempt }}
+          path: ${{ steps.publish.outputs.report-ref }}
+          if-no-files-found: error

package/templates/multi-target-homebrew/README.md

@@ -0,0 +1,10 @@
+# Multi-target Homebrew template
+
+This template renders one formula with separate Apple Silicon and Intel
+download clauses. Both archives must be selected by the paired GitHub release
+publication; the catalog subject is dependency-blocked until those upstream
+asset subjects converge.
+
+Replace the project, tap, homepage, artifact, and credential coordinates. A
+repository check can prepare this template without publishing, but an actual
+release requires explicit provider authority.

package/templates/multi-target-homebrew/release.config.json

@@ -1,70 +1,53 @@
 {
-  "$schema": "https://mannyc2.github.io/ts-release/schema/release-config.schema.json",
-  "identity": {
-    "name": "@scope/pkg",
-    "version": "0.1.0",
-    "commit": "abc123",
-    "tag": "v0.1.0"
+  "$schema": "../../schema/release-config.schema.json",
+  "project": {
+    "name": "fixture",
+    "version": "1.0.0",
+    "tag": "v1.0.0",
+    "repository": "owner/fixture"
   },
   "artifacts": [
     {
-      "id": "package",
-      "path": ".",
-      "format": "directory",
-      "consumers": ["npm"]
+      "id": "fixture-darwin-arm64",
+      "path": "dist/fixture-darwin-arm64.tar.gz",
+      "format": "tarball"
     },
     {
-      "id": "archive",
-      "path": "artifacts/pkg-0.1.0.tgz",
-      "format": "tarball",
-      "consumers": ["github", "homebrew"]
+      "id": "fixture-darwin-x64",
+      "path": "dist/fixture-darwin-x64.tar.gz",
+      "format": "tarball"
     }
   ],
-  "targets": [
-    {
-      "_tag": "NpmRegistryTarget",
-      "id": "npm",
-      "registry": "https://registry.npmjs.org",
-      "packageName": "@scope/pkg",
-      "packagePath": ".",
-      "trustedPublishing": {
-        "provider": "github-actions",
-        "workflow": "release.yml",
-        "packageExists": true,
-        "verifyPackageExists": true
-      },
-      "access": "public",
-      "provenance": true,
-      "dryRunSupport": "native",
-      "mutability": "immutable",
-      "recovery": "publish-new-version"
-    },
-    {
-      "_tag": "GitHubReleaseTarget",
-      "id": "github",
-      "repository": "owner/repo",
-      "tokenEnv": "GH_TOKEN",
-      "draft": true,
-      "prerelease": false,
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-release",
-      "recovery": "delete-and-recreate"
+  "catalogs": {
+    "homebrew": [
+      {
+        "id": "fixture-homebrew",
+        "formulaName": "fixture",
+        "description": "Fixture command",
+        "homepage": "https://example.com/fixture",
+        "license": "MIT",
+        "installPath": "fixture",
+        "sources": [
+          { "artifact": "fixture-darwin-arm64", "architecture": "arm64" },
+          { "artifact": "fixture-darwin-x64", "architecture": "x64" }
+        ]
+      }
+    ]
+  },
+  "publish": {
+    "github": {
+      "repository": "owner/fixture",
+      "ids": ["fixture-darwin-arm64", "fixture-darwin-x64"]
     },
-    {
-      "_tag": "HomebrewTapTarget",
-      "id": "homebrew",
-      "repository": "owner/homebrew-tap",
-      "formulaName": "pkg",
-      "formulaPath": ".release/generated/pkg.rb",
-      "artifactId": "archive",
-      "homepage": "https://github.com/owner/repo",
-      "url": "https://github.com/owner/repo/releases/download/v0.1.0/pkg-0.1.0.tgz",
-      "installPath": "bin/pkg",
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-index",
-      "recovery": "manual"
-    }
-  ],
-  "strict": true,
-  "evidenceDirectory": ".release/evidence/{version}"
+    "catalogGit": [
+      {
+        "catalog": "fixture-homebrew",
+        "repository": "owner/homebrew-tap",
+        "branch": "main",
+        "targetPath": "Formula/fixture.rb",
+        "statePath": ".ts-release/fixture-homebrew.json",
+        "tokenEnv": "GITHUB_TOKEN"
+      }
+    ]
+  }
 }

package/templates/multi-target-scoop/README.md

@@ -0,0 +1,10 @@
+# Multi-target Scoop template
+
+This template renders one Scoop manifest with x64 and arm64 ZIP downloads.
+Both archives must be selected by the paired GitHub release publication; the
+catalog subject is dependency-blocked until those upstream asset subjects
+converge.
+
+Replace the project, bucket, homepage, artifact, and credential coordinates.
+A repository check can prepare this template without publishing, but an actual
+release requires explicit provider authority.

package/templates/multi-target-scoop/release.config.json

@@ -1,72 +1,53 @@
 {
-  "$schema": "https://mannyc2.github.io/ts-release/schema/release-config.schema.json",
-  "identity": {
-    "name": "@scope/pkg",
-    "version": "0.1.0",
-    "commit": "abc123",
-    "tag": "v0.1.0"
+  "$schema": "../../schema/release-config.schema.json",
+  "project": {
+    "name": "fixture",
+    "version": "1.0.0",
+    "tag": "v1.0.0",
+    "repository": "owner/fixture"
   },
   "artifacts": [
     {
-      "id": "package",
-      "path": ".",
-      "format": "directory",
-      "consumers": ["npm"]
+      "id": "fixture-windows-x64",
+      "path": "dist/fixture-windows-x64.zip",
+      "format": "zip"
     },
     {
-      "id": "archive",
-      "path": "artifacts/pkg-0.1.0.zip",
-      "format": "zip",
-      "consumers": ["github", "scoop"]
+      "id": "fixture-windows-arm64",
+      "path": "dist/fixture-windows-arm64.zip",
+      "format": "zip"
     }
   ],
-  "targets": [
-    {
-      "_tag": "NpmRegistryTarget",
-      "id": "npm",
-      "registry": "https://registry.npmjs.org",
-      "packageName": "@scope/pkg",
-      "packagePath": ".",
-      "trustedPublishing": {
-        "provider": "github-actions",
-        "workflow": "release.yml",
-        "packageExists": true,
-        "verifyPackageExists": true
-      },
-      "access": "public",
-      "provenance": true,
-      "dryRunSupport": "native",
-      "mutability": "immutable",
-      "recovery": "publish-new-version"
-    },
-    {
-      "_tag": "GitHubReleaseTarget",
-      "id": "github",
-      "repository": "owner/repo",
-      "tokenEnv": "GH_TOKEN",
-      "draft": true,
-      "prerelease": false,
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-release",
-      "recovery": "delete-and-recreate"
+  "catalogs": {
+    "scoop": [
+      {
+        "id": "fixture-scoop",
+        "manifestName": "fixture",
+        "description": "Fixture command",
+        "homepage": "https://example.com/fixture",
+        "license": "MIT",
+        "bin": "fixture.exe",
+        "sources": [
+          { "artifact": "fixture-windows-x64", "architecture": "x64" },
+          { "artifact": "fixture-windows-arm64", "architecture": "arm64" }
+        ]
+      }
+    ]
+  },
+  "publish": {
+    "github": {
+      "repository": "owner/fixture",
+      "ids": ["fixture-windows-x64", "fixture-windows-arm64"]
     },
-    {
-      "_tag": "ScoopBucketTarget",
-      "id": "scoop",
-      "repository": "owner/scoop-bucket",
-      "manifestName": "pkg",
-      "manifestPath": ".release/generated/pkg.json",
-      "artifactId": "archive",
-      "homepage": "https://github.com/owner/repo",
-      "description": "Example Scoop manifest for pkg",
-      "license": "MIT",
-      "url": "https://github.com/owner/repo/releases/download/v0.1.0/pkg-0.1.0.zip",
-      "bin": "pkg.exe",
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-index",
-      "recovery": "manual"
-    }
-  ],
-  "strict": true,
-  "evidenceDirectory": ".release/evidence/{version}"
+    "catalogGit": [
+      {
+        "catalog": "fixture-scoop",
+        "repository": "owner/scoop-bucket",
+        "branch": "main",
+        "targetPath": "bucket/fixture.json",
+        "statePath": ".ts-release/fixture-scoop.json",
+        "tokenEnv": "GITHUB_TOKEN"
+      }
+    ]
+  }
 }

package/templates/npm-github/release.config.json

@@ -1,50 +1,37 @@
 {
-  "$schema": "https://mannyc2.github.io/ts-release/schema/release-config.schema.json",
-  "identity": {
+  "$schema": "https://raw.githubusercontent.com/mannyc2/ts-release/main/schema/release-config.schema.json",
+  "project": {
     "name": "@scope/pkg",
+    "packageName": "@scope/pkg",
+    "repository": "owner/repo",
     "version": "0.1.0",
-    "commit": "abc123",
     "tag": "v0.1.0"
   },
-  "artifacts": [
-    {
-      "id": "package",
-      "path": ".",
-      "format": "directory",
-      "consumers": ["npm"]
-    }
-  ],
-  "targets": [
-    {
-      "_tag": "NpmRegistryTarget",
-      "id": "npm",
-      "registry": "https://registry.npmjs.org",
-      "packageName": "@scope/pkg",
-      "packagePath": ".",
-      "trustedPublishing": {
-        "provider": "github-actions",
-        "workflow": "release.yml",
-        "packageExists": true,
-        "verifyPackageExists": true
+  "npmPackage": {
+    "path": "."
+  },
+  "publish": {
+    "npm": {
+      "registry": "https://registry.npmjs.org/",
+      "authentication": {
+        "strategy": "trusted-publishing",
+        "attestation": {
+          "provider": "github-actions",
+          "runner": "github-hosted",
+          "repository": "owner/repo",
+          "workflow": "release.yml",
+          "workflowRef": "refs/heads/main",
+          "allowedAction": "npm-publish-direct"
+        }
       },
       "access": "public",
-      "provenance": true,
-      "dryRunSupport": "native",
-      "mutability": "immutable",
-      "recovery": "publish-new-version"
+      "provenance": "automatic"
     },
-    {
-      "_tag": "GitHubReleaseTarget",
-      "id": "github",
+    "github": {
       "repository": "owner/repo",
-      "tokenEnv": "GH_TOKEN",
+      "tokenEnv": "GITHUB_TOKEN",
       "draft": true,
-      "prerelease": false,
-      "dryRunSupport": "simulated",
-      "mutability": "mutable-release",
-      "recovery": "delete-and-recreate"
+      "prerelease": false
     }
-  ],
-  "strict": true,
-  "evidenceDirectory": ".release/evidence/{version}"
+  }
 }

package/templates/npm-github/reviewed-release.config.json

@@ -0,0 +1,37 @@
+{
+  "$schema": "https://raw.githubusercontent.com/mannyc2/ts-release/main/schema/release-config.schema.json",
+  "project": {
+    "name": "@scope/pkg",
+    "packageName": "@scope/pkg",
+    "repository": "owner/repo",
+    "version": "0.1.0",
+    "tag": "v0.1.0"
+  },
+  "npmPackage": {
+    "path": "."
+  },
+  "publish": {
+    "npm": {
+      "registry": "https://registry.npmjs.org/",
+      "authentication": {
+        "strategy": "trusted-publishing",
+        "attestation": {
+          "provider": "github-actions",
+          "runner": "github-hosted",
+          "repository": "owner/repo",
+          "workflow": "reviewed-release.yml",
+          "workflowRef": "refs/heads/main",
+          "allowedAction": "npm-publish-direct"
+        }
+      },
+      "access": "public",
+      "provenance": "automatic"
+    },
+    "github": {
+      "repository": "owner/repo",
+      "tokenEnv": "GITHUB_TOKEN",
+      "draft": true,
+      "prerelease": false
+    }
+  }
+}

package/templates/npm-only/README.md

@@ -0,0 +1,10 @@
+# npm token-mode template
+
+This template is the explicit non-OIDC migration path. The authored config
+contains only the environment-variable name `NPM_TOKEN`; the token value stays
+inside the host credential boundary and is written only to the scoped,
+temporary npm user config during an authorized publish.
+
+For GitHub-hosted Actions, prefer `../npm-github/release.config.json` and its
+explicit trusted-publisher attestation. Do not combine the token and trusted
+authentication shapes.

package/templates/npm-only/release.config.json

@@ -1,39 +1,24 @@
 {
-  "$schema": "https://mannyc2.github.io/ts-release/schema/release-config.schema.json",
-  "identity": {
+  "$schema": "https://raw.githubusercontent.com/mannyc2/ts-release/main/schema/release-config.schema.json",
+  "project": {
     "name": "@scope/pkg",
+    "packageName": "@scope/pkg",
+    "repository": "owner/repo",
     "version": "0.1.0",
-    "commit": "abc123",
     "tag": "v0.1.0"
   },
-  "artifacts": [
-    {
-      "id": "package",
-      "path": ".",
-      "format": "directory",
-      "consumers": ["npm"]
-    }
-  ],
-  "targets": [
-    {
-      "_tag": "NpmRegistryTarget",
-      "id": "npm",
-      "registry": "https://registry.npmjs.org",
-      "packageName": "@scope/pkg",
-      "packagePath": ".",
-      "trustedPublishing": {
-        "provider": "github-actions",
-        "workflow": "release.yml",
-        "packageExists": true,
-        "verifyPackageExists": true
+  "npmPackage": {
+    "path": "."
+  },
+  "publish": {
+    "npm": {
+      "registry": "https://registry.npmjs.org/",
+      "authentication": {
+        "strategy": "token",
+        "credential": "NPM_TOKEN"
       },
       "access": "public",
-      "provenance": true,
-      "dryRunSupport": "native",
-      "mutability": "immutable",
-      "recovery": "publish-new-version"
+      "provenance": "disabled"
     }
-  ],
-  "strict": true,
-  "evidenceDirectory": ".release/evidence/{version}"
+  }
 }

package/templates/portable-cli/README.md

@@ -0,0 +1,13 @@
+# Portable CLI template
+
+This complete fixture prepares one Bun CLI for GitHub Releases and npm. Its
+artifact targets are Linux and macOS x64/arm64; ts-release itself runs only on
+Linux. Preparation requires an external Bun runtime and `libseccomp.so.2` on
+the Linux host. A standalone CLI binary still uses those native tools for
+network-denied commands and is not a self-contained preparation environment.
+Update all product and destination identities before use.
+
+```sh
+ts-release inspect --config release.config.json
+ts-release release --config release.config.json
+```