@moku-labs/ci 1.4.0 → 1.5.1

package/README.md

@@ -91,8 +91,17 @@ flowchart LR
 1. `release:setup` writes two thin callers into `.github/workflows/`.
 2. Every PR runs `package-ci.yml`: four jobs, reported as `ci / lint`, `ci / types`,
    `ci / test`, `ci / build`.
-3. `release patch` dispatches `publish.yml`, which calls `package-release.yml`:
-   check → tag → pack → publish. The CLI watches the run and verifies the version on npm.
+3. Every merge to `main` runs `publish.yml`, which calls `package-release.yml`:
+   check → tag → pack → publish. The version is always a patch. `release wait` waits for
+   it and verifies the version on npm.
+4. A person runs `release minor`, or `release major` for a milestone. It dispatches the same
+   `publish.yml`.
+
+| Who releases | Version |
+|---|---|
+| a merge to `main` | patch, always |
+| a person | minor |
+| a person, for a milestone | major |
 
 ## Workflows
 
@@ -110,7 +119,8 @@ flowchart LR
 | [`examples/package/publish.local-publish.yml`](examples/package/publish.local-publish.yml) | Fallback: publish from the project's own job. Use it only if the central publish fails npm auth. |
 | [`rulesets/main.json`](rulesets/main.json) | Branch ruleset for `main`: PR only, no force-push, the four `ci / …` checks required. |
 | [`examples/dependabot.yml`](examples/dependabot.yml) | Dependabot config: one grouped PR a day for `@moku-labs/*` only. `setup` writes it to `.github/dependabot.yml`. |
-| [`examples/package/dependabot-automerge.yml`](examples/package/dependabot-automerge.yml) | Turns on auto-merge for a Dependabot PR; the ruleset checks stay the gate. `setup` writes it and allows auto-merge on the repo. |
+| [`examples/org/fleet.yml`](examples/org/fleet.yml) | For the organization's `.github` repository. Every hour it runs `moku-release fleet --markdown` and puts the table between `<!-- fleet:start -->` and `<!-- fleet:end -->` of `profile/README.md`. |
+| [`examples/package/dependabot-automerge.yml`](examples/package/dependabot-automerge.yml) | Turns on auto-merge for a Dependabot PR; the ruleset checks stay the gate. After the merge it dispatches `publish.yml` with `patch`, because a merge made by `GITHUB_TOKEN` starts no push run. `setup` writes it and allows auto-merge on the repo. |
 
 > [!TIP]
 > A Layer-3 app copies `examples/app/ci.yml` and `examples/dependabot.yml` by hand and needs
@@ -198,7 +208,9 @@ Examples: `examples/package/ci-with-demos.yml` (label `demos:full`) and
 |---|---|---|
 | `bun run release:setup` | once per project | Idempotent wizard: workflows, Dependabot, script contract, first publish, first tag, trusted publisher, branch ruleset, auto-merge, then `doctor`. `--dry-run` prints every action, changes nothing and asks nothing. `--yes` answers every confirmation for an agent or CI; a step that needs your npm OTP is then printed, not run. |
 | `bun run release:doctor` | any time | Changes nothing in the project; it only runs `git fetch --tags` first. Twelve checks, one line each, and the exact `fix:` command for every red line. `--json` for machines. |
-| `bun run release <patch\|minor\|major\|prerelease>` | each release | Refuses unless the tree is clean and `HEAD == origin/main`. Dispatches `publish.yml`, watches the run, verifies the version and dist-tag on npm. |
+| `bun run release wait` | after each merge to `main` | Refuses unless `origin/main` holds `HEAD`. Waits for the first release tag that holds the commit, then for npm to serve that version. Stops on a failed run and prints the log command. |
+| `bun run release fleet` | any time | Read-only. One table for every repository of the organization: CI on `main`, the release of `main`, tag against npm, commits nobody released, open PRs, old `@moku-labs/*` pins. Then the list of what waits for a person. `--markdown` prints the public rows for the organization page, `--json` every row. |
+| `bun run release <patch\|minor\|major\|prerelease>` | a release a person asks for | Refuses unless the tree is clean and `HEAD == origin/main`. Dispatches `publish.yml`, watches the run, verifies the version and dist-tag on npm. |
 
 The scripts are plain aliases of the `moku-release` bin. Internals and the list of checks:
 [src/README.md](src/README.md).

package/dist/release.mjs

@@ -487,6 +487,57 @@ function createBrandPrompts(options = {}) {
 		if (!color) return `${question} [1-${count}] `;
 		return `    ${palette.dim(`pick 1–${count}`)} ${palette.cyan("›")} `;
 	};
+	let readline;
+	let closed = false;
+	const lines = [];
+	const waiters = [];
+	/**
+	* Show `prompt` and resolve the next input line. Lines that arrive before a question are
+	* queued; once the input has ended, the question resolves `""` (the prompt's default).
+	*
+	* @param prompt - The readline prompt string.
+	* @returns Resolves the raw answer line.
+	* @example
+	* await ask("Deploy? [y/N] ");
+	*/
+	const ask = (prompt) => {
+		if (closed && lines.length === 0) {
+			output.write(prompt);
+			return Promise.resolve("");
+		}
+		readline ??= openReadline();
+		readline.setPrompt(prompt);
+		readline.prompt();
+		const queued = lines.shift();
+		if (queued !== void 0) return Promise.resolve(queued);
+		readline.resume();
+		return new Promise((resolve) => waiters.push(resolve));
+	};
+	/**
+	* Create the shared interface: route each line to the oldest waiting question or the
+	* queue, pause while idle so the process can exit, and settle waiters on close.
+	*
+	* @returns The shared readline interface.
+	* @example
+	* readline ??= openReadline();
+	*/
+	const openReadline = () => {
+		const created = createInterface({
+			input,
+			output
+		});
+		created.on("line", (line) => {
+			const waiter = waiters.shift();
+			if (waiter) waiter(line);
+			else lines.push(line);
+			if (waiters.length === 0) created.pause();
+		});
+		created.on("close", () => {
+			closed = true;
+			for (const waiter of waiters.splice(0)) waiter("");
+		});
+		return created;
+	};
 	return {
 		/**
 		* Ask a yes/no question; resolves `true` only on an explicit `y`/`yes`.
@@ -497,16 +548,7 @@ function createBrandPrompts(options = {}) {
 		* await prompts.confirm("Deploy?");
 		*/
 		confirm(question) {
-			return new Promise((resolve) => {
-				const readline = createInterface({
-					input,
-					output
-				});
-				readline.question(confirmPrompt(question), (answer) => {
-					readline.close();
-					resolve(YES_PATTERN.test(answer.trim()));
-				});
-			});
+			return ask(confirmPrompt(question)).then((answer) => YES_PATTERN.test(answer.trim()));
 		},
 		/**
 		* Present `choices` numbered from 1 and resolve the chosen zero-based index.
@@ -518,17 +560,10 @@ function createBrandPrompts(options = {}) {
 		* await prompts.select("Pick", ["a", "b"]);
 		*/
 		select(question, choices) {
-			return new Promise((resolve) => {
-				const readline = createInterface({
-					input,
-					output
-				});
-				write(choicesBlock(question, choices));
-				readline.question(selectPrompt(question, choices.length), (answer) => {
-					readline.close();
-					const picked = Number.parseInt(answer.trim(), 10);
-					resolve(Number.isInteger(picked) && picked >= 1 && picked <= choices.length ? picked - 1 : 0);
-				});
+			write(choicesBlock(question, choices));
+			return ask(selectPrompt(question, choices.length)).then((answer) => {
+				const picked = Number.parseInt(answer.trim(), 10);
+				return Number.isInteger(picked) && picked >= 1 && picked <= choices.length ? picked - 1 : 0;
 			});
 		}
 	};
@@ -742,6 +777,22 @@ function latestRunId(stdout) {
 	return String(first.databaseId);
 }
 /**
+* The runs from `gh run list --json databaseId,headSha,status,conclusion`, newest first.
+*
+* @param stdout - The raw `gh run list` JSON.
+* @returns The runs that carry an id and a commit; anything else is left out.
+* @example
+* parseRuns('[{"databaseId":42,"headSha":"abc123","status":"queued","conclusion":""}]');
+*/
+function parseRuns(stdout) {
+	return parseJsonArray(stdout).flatMap((run) => run.databaseId === void 0 || run.headSha === void 0 ? [] : [{
+		databaseId: run.databaseId,
+		headSha: run.headSha,
+		status: run.status ?? "",
+		conclusion: run.conclusion ?? ""
+	}]);
+}
+/**
 * The permalink of a GitHub release, for the final summary.
 *
 * @param ownerRepo - The `owner/repo` slug.
@@ -782,7 +833,7 @@ const REQUIRED_SCRIPTS = {
 * @example
 * parseManifest('{"name":"x"}');
 */
-function parseManifest(text) {
+function parseManifest$1(text) {
 	if (text === void 0) return void 0;
 	try {
 		const parsed = JSON.parse(text);
@@ -801,7 +852,7 @@ function parseManifest(text) {
 * const manifest = await readManifest(ctx.files);
 */
 async function readManifest(files) {
-	return parseManifest(await files.read(MANIFEST_PATH));
+	return parseManifest$1(await files.read(MANIFEST_PATH));
 }
 /** Any character outside printable ASCII and the JSON whitespace. */
 const NON_ASCII = /[^\t\n\r -~]/;
@@ -1707,7 +1758,7 @@ const tagSyncCheck = {
 * `npm trust` warns instead — the answer there is an upgrade, not a registration.
 */
 /** Basename npm registers the publisher against — the workflow file's name, not its path. */
-const PUBLISH_WORKFLOW_FILE$1 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
+const PUBLISH_WORKFLOW_FILE$2 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
 /** Detail of the result when the listing sits behind 2FA; `setup` offers to register anyway. */
 const TRUST_NEEDS_OTP = "npm asks for an OTP, cannot verify from here";
 /**
@@ -1754,7 +1805,7 @@ function isOtpRequired(output) {
 * trustCommand("@moku-labs/common", "moku-labs/common");
 */
 function trustCommand(name, ownerRepo) {
-	return `npm trust github ${name} --file ${PUBLISH_WORKFLOW_FILE$1} --repo ${ownerRepo} --allow-publish --yes`;
+	return `npm trust github ${name} --file ${PUBLISH_WORKFLOW_FILE$2} --repo ${ownerRepo} --allow-publish --yes`;
 }
 /** Verifies a trusted publisher is registered for the package. */
 const trustedPublisherCheck = {
@@ -1782,8 +1833,8 @@ const trustedPublisherCheck = {
 		if (isUnknownCommand(`${listing.stdout}${listing.stderr}`)) return warn("this npm has no `trust` command", "upgrade npm");
 		if (isUnauthorized(`${listing.stdout}${listing.stderr}`)) return skip("cannot list trusted publishers without `npm login`");
 		if (isOtpRequired(`${listing.stdout}${listing.stderr}`)) return warn(TRUST_NEEDS_OTP, `npm trust list ${manifest.name}`);
-		if (listing.code !== 0 || !listing.stdout.includes(PUBLISH_WORKFLOW_FILE$1)) return fail("no trusted publisher registered", trustCommand(manifest.name, ownerRepo));
-		return pass(`${ownerRepo} · ${PUBLISH_WORKFLOW_FILE$1}`);
+		if (listing.code !== 0 || !listing.stdout.includes(PUBLISH_WORKFLOW_FILE$2)) return fail("no trusted publisher registered", trustCommand(manifest.name, ownerRepo));
+		return pass(`${ownerRepo} · ${PUBLISH_WORKFLOW_FILE$2}`);
 	}
 };
 //#endregion
@@ -1794,10 +1845,15 @@ const trustedPublisherCheck = {
 * Three outcomes, and the middle one matters most: a MISSING workflow fails, a
 * hand-written one warns ("legacy workflow, run release:setup to migrate") because the
 * repo still releases — just not through the shared pipeline — and a pinned thin caller
-* passes.
+* passes. A thin `publish.yml` without the `push` trigger warns too: it releases only by
+* hand, and the family rule is a patch on every merge to main.
 */
 /** Advisory shown for a workflow that exists but does not call the central pipeline. */
 const LEGACY_FIX = "legacy workflow, run release:setup to migrate";
+/** Advisory shown for a thin `publish.yml` that does not release on a merge to main. */
+const AUTO_RELEASE_FIX = "add `push: branches: [main]` under `on:` in publish.yml";
+/** Matches the `push:` trigger of a workflow, at the indent `on:` gives its events. */
+const PUSH_TRIGGER = /^ {2}push:/m;
 /** Verifies `ci.yml` and `publish.yml` are the `@v1`-pinned thin callers. */
 const workflowsCheck = {
 	id: "workflows",
@@ -1813,13 +1869,16 @@ const workflowsCheck = {
 	async run(ctx) {
 		const missing = [];
 		const legacy = [];
+		let autoRelease = true;
 		for (const template of workflowTemplates) {
 			const content = await ctx.files.read(template.path);
 			if (content === void 0) missing.push(template.path);
 			else if (!isThinWorkflow(content, template)) legacy.push(template.path);
+			else if (template.path === ".github/workflows/publish.yml") autoRelease = PUSH_TRIGGER.test(content);
 		}
 		if (missing.length > 0) return fail(`missing ${missing.join(", ")}`, "moku-release setup");
 		if (legacy.length > 0) return warn(`${legacy.join(", ")} not pinned to @v1`, LEGACY_FIX);
+		if (!autoRelease) return warn("publish.yml does not release on a merge to main", AUTO_RELEASE_FIX);
 		return pass("ci.yml + publish.yml pinned to @v1");
 	}
 };
@@ -1976,11 +2035,474 @@ async function runDoctor(options) {
 	};
 }
 //#endregion
+//#region src/lib/fleet.ts
+/**
+* @file `moku-release fleet` — one GraphQL query for every repository of the organization,
+* and the pure functions that turn its answer into a status table.
+*
+* Everything a row shows comes from that one answer, except the version npm serves. The
+* checks of the newest commit on the default branch hold both pipelines: a `release / …`
+* check belongs to `publish.yml`, every other check to CI. The newest `v*` tag sits on a
+* bump commit whose parent is the commit that was released, so the distance from that
+* parent to the head is the number of commits nobody released.
+*/
+/** Prefix GitHub puts on the jobs of `publish.yml`: the caller's job id, `release`. */
+const RELEASE_PREFIX = "release / ";
+/** The scope every family package is published under. */
+const FAMILY_SCOPE = "@moku-labs/";
+/** Matches a release tag, prereleases included: `v1.2.3`, `v1.2.3-rc.0`. Not the moving `v1`. */
+const RELEASE_TAG = /^v\d+\.\d+\.\d+/;
+/** Matches a dependency pinned to one exact version. A range is not a pin and is not judged. */
+const EXACT_VERSION = /^\d+\.\d+\.\d+/;
+/** The query `gh api graphql -F org=<org>` runs. One call answers the whole table. */
+const FLEET_QUERY = `query($org: String!) {
+  organization(login: $org) {
+    repositories(first: 100, isArchived: false, orderBy: { field: NAME, direction: ASC }) {
+      nodes {
+        name
+        isPrivate
+        manifest: object(expression: "HEAD:package.json") { ... on Blob { text } }
+        publish: object(expression: "HEAD:.github/workflows/publish.yml") { ... on Blob { byteSize } }
+        defaultBranchRef {
+          target {
+            ... on Commit {
+              oid
+              history(first: 30) { nodes { oid } }
+              statusCheckRollup { contexts(first: 100) { nodes { ... on CheckRun { name status conclusion } } } }
+            }
+          }
+        }
+        refs(refPrefix: "refs/tags/", first: 10, orderBy: { field: TAG_COMMIT_DATE, direction: DESC }) {
+          nodes {
+            name
+            target {
+              ... on Commit { parents(first: 1) { nodes { oid } } }
+              ... on Tag { target { ... on Commit { parents(first: 1) { nodes { oid } } } } }
+            }
+          }
+        }
+        pullRequests(states: OPEN, first: 50) {
+          nodes {
+            number
+            isDraft
+            author { login }
+            commits(last: 1) { nodes { commit { statusCheckRollup { state } } } }
+          }
+        }
+      }
+    }
+  }
+}`;
+/**
+* Fold the checks of one pipeline into one state. Red wins over running, running over green.
+*
+* @param checks - The checks that belong to the pipeline.
+* @returns The state of the pipeline.
+* @example
+* pipelineState([{ status: "COMPLETED", conclusion: "FAILURE" }]); // "red"
+*/
+function pipelineState(checks) {
+	if (checks.length === 0) return "none";
+	const done = checks.filter((check) => check.status === "COMPLETED");
+	const passed = /* @__PURE__ */ new Set([
+		"SUCCESS",
+		"SKIPPED",
+		"NEUTRAL"
+	]);
+	if (done.some((check) => !passed.has(check.conclusion ?? ""))) return "red";
+	return done.length === checks.length ? "green" : "running";
+}
+/**
+* The state of a pull request from the rollup state GitHub computes for its newest commit.
+*
+* @param state - `SUCCESS`, `FAILURE`, `ERROR`, `PENDING`, `EXPECTED`, or nothing.
+* @returns The matching pipeline state.
+* @example
+* rollupState("FAILURE"); // "red"
+*/
+function rollupState(state) {
+	if (state === "SUCCESS") return "green";
+	if (state === "FAILURE" || state === "ERROR") return "red";
+	return state === void 0 ? "none" : "running";
+}
+/**
+* Parse a manifest text, tolerating a missing or malformed file.
+*
+* @param text - The `package.json` text, when the repository has one.
+* @returns The manifest, or an empty one.
+* @example
+* parseManifest('{"name":"@moku-labs/core"}');
+*/
+function parseManifest(text) {
+	try {
+		const parsed = JSON.parse(text ?? "");
+		return typeof parsed === "object" && parsed !== null ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+/**
+* The newest release tag of a repository and the commit it released.
+*
+* @param raw - The repository, as the query returns it.
+* @returns The tag and the released commit, or nothing when no release tag exists.
+* @example
+* const newest = newestRelease(raw);
+*/
+function newestRelease(raw) {
+	const [newest] = (raw.refs?.nodes ?? []).filter((node) => RELEASE_TAG.test(node.name ?? "")).toSorted((a, b) => compareSemver(b.name ?? "", a.name ?? ""));
+	if (newest?.name === void 0) return void 0;
+	const commit = newest.target?.parents === void 0 ? newest.target?.target : newest.target;
+	return {
+		tag: newest.name,
+		released: commit?.parents?.nodes?.[0]?.oid
+	};
+}
+/**
+* The exact family pins of a manifest, from `dependencies` and `devDependencies`.
+*
+* @param manifest - The parsed manifest.
+* @returns Dependency name to pinned version, for exact `@moku-labs/*` pins only.
+* @example
+* familyPins({ dependencies: { "@moku-labs/core": "1.7.1" } }); // { "@moku-labs/core": "1.7.1" }
+*/
+function familyPins(manifest) {
+	const all = {
+		...manifest.devDependencies,
+		...manifest.dependencies
+	};
+	return Object.fromEntries(Object.entries(all).filter(([name, spec]) => name.startsWith(FAMILY_SCOPE) && EXACT_VERSION.test(spec)));
+}
+/**
+* Whether a check belongs to `publish.yml`.
+*
+* @param check - One check of a commit.
+* @returns `true` for a `release / …` check.
+* @example
+* isRelease({ name: "release / publish" }); // true
+*/
+function isRelease(check) {
+	return (check.name ?? "").startsWith(RELEASE_PREFIX);
+}
+/**
+* The GitHub URL of a repository, or of a page inside it.
+*
+* @param org - The organization login.
+* @param repo - The row.
+* @param path - A path inside the repository, with the leading slash.
+* @returns The URL.
+* @example
+* repoUrl("moku-labs", row, "/pulls");
+*/
+function repoUrl(org, repo, path = "") {
+	return `https://github.com/${org}/${repo.name}${path}`;
+}
+/**
+* Turn one repository of the answer into a row. The pins are judged later, once the
+* newest version of every package is known.
+*
+* @param raw - The repository, as the query returns it.
+* @returns The row, with `pins` still empty and the manifest pins kept in `pinned`.
+* @example
+* const row = toRepo(raw);
+*/
+function toRepo(raw) {
+	const manifest = parseManifest(raw.manifest?.text ?? void 0);
+	const head = raw.defaultBranchRef?.target;
+	const checks = (head?.statusCheckRollup?.contexts?.nodes ?? []).filter((check) => check?.name !== void 0);
+	const publishes = raw.publish?.byteSize !== void 0 && manifest.private !== true && manifest.name !== void 0;
+	const newest = publishes ? newestRelease(raw) : void 0;
+	const distance = (head?.history?.nodes ?? []).findIndex((node) => node.oid === newest?.released);
+	return {
+		name: raw.name ?? "",
+		isPrivate: raw.isPrivate === true,
+		...publishes && manifest.name !== void 0 ? { packageName: manifest.name } : {},
+		ci: pipelineState(checks.filter((check) => !isRelease(check))),
+		release: pipelineState(checks.filter((check) => isRelease(check))),
+		...newest === void 0 ? {} : {
+			tag: newest.tag,
+			unreleased: distance === -1 ? 30 : distance
+		},
+		pullRequests: (raw.pullRequests?.nodes ?? []).map((pr) => ({
+			number: pr.number ?? 0,
+			bot: (pr.author?.login ?? "").endsWith("[bot]") || pr.author?.login === "dependabot",
+			draft: pr.isDraft === true,
+			state: rollupState(pr.commits?.nodes?.[0]?.commit?.statusCheckRollup?.state)
+		})),
+		pins: [],
+		pinned: familyPins(manifest)
+	};
+}
+/**
+* Parse the answer of {@link FLEET_QUERY} into rows, pins judged against the newest tags.
+*
+* @param stdout - The raw `gh api graphql` output.
+* @returns One row per repository, or `undefined` when the answer is not the expected shape.
+* @example
+* const rows = parseFleet(stdout);
+*/
+function parseFleet(stdout) {
+	let nodes;
+	try {
+		nodes = JSON.parse(stdout).data?.organization?.repositories?.nodes;
+	} catch {
+		return;
+	}
+	if (!Array.isArray(nodes)) return void 0;
+	const rows = nodes.map((raw) => toRepo(raw));
+	const newest = new Map(rows.flatMap((row) => row.packageName !== void 0 && row.tag !== void 0 ? [[row.packageName, row.tag.slice(1)]] : []));
+	return rows.map(({ pinned = {}, ...row }) => ({
+		...row,
+		pins: Object.entries(pinned).flatMap(([name, version]) => {
+			const latest = newest.get(name);
+			return latest !== void 0 && compareSemver(version, latest) < 0 ? [{
+				name,
+				pinned: version,
+				latest
+			}] : [];
+		})
+	}));
+}
+/**
+* What waits for a person in one repository, most urgent first. An empty list is a quiet row.
+*
+* @param repo - The row.
+* @returns One short line per thing to look at.
+* @example
+* attention({ ...row, ci: "red" }); // ["CI is red on main"]
+*/
+function attention(repo) {
+	const lines = [];
+	const version = repo.tag?.slice(1);
+	if (repo.ci === "red") lines.push("CI is red on main");
+	if (repo.release === "red") lines.push("the release of main failed");
+	if ((repo.unreleased ?? 0) > 0 && repo.release !== "running" && repo.release !== "red") {
+		const count = repo.unreleased === 30 ? `30+` : `${repo.unreleased}`;
+		lines.push(`${count} commit(s) on main are not released`);
+	}
+	if (repo.npm !== void 0 && version !== void 0 && repo.npm !== version) lines.push(`npm serves ${repo.npm}, the tag is ${repo.tag}`);
+	for (const pr of repo.pullRequests.filter((open) => !open.draft)) {
+		if (pr.state === "red") lines.push(`PR #${pr.number} has red checks`);
+		if (pr.state === "green") lines.push(`PR #${pr.number} is green and not merged`);
+	}
+	return lines;
+}
+/** The mark of each state in the Markdown table. */
+const MARKS = {
+	green: "🟢",
+	red: "🔴",
+	running: "🟡",
+	none: "—"
+};
+/**
+* The open pull requests of a row as one short cell: the count, then what stands out.
+*
+* @param repo - The row.
+* @returns E.g. `3 (1 red, 2 bot)`, or `0`.
+* @example
+* pullRequestCell(row); // "3 (1 red, 2 bot)"
+*/
+function pullRequestCell(repo) {
+	const open = repo.pullRequests;
+	const red = open.filter((pr) => pr.state === "red").length;
+	const bot = open.filter((pr) => pr.bot).length;
+	const notes = [red > 0 ? `${red} red` : "", bot > 0 ? `${bot} bot` : ""].filter(Boolean);
+	return notes.length > 0 ? `${open.length} (${notes.join(", ")})` : `${open.length}`;
+}
+/**
+* The "not released" cell of a row.
+*
+* @param repo - The row.
+* @returns The number of commits after the released one, or a dash for a repository without releases.
+* @example
+* unreleasedCell(row); // "0"
+*/
+function unreleasedCell(repo) {
+	if (repo.unreleased === void 0) return "—";
+	return repo.unreleased === 30 ? `30+` : `${repo.unreleased}`;
+}
+/**
+* The "old pins" cell of a row: every family dependency pinned below its newest release.
+* It is a column and not a line of {@link attention}: Dependabot moves the pins by itself.
+*
+* @param repo - The row.
+* @returns E.g. `core 1.7.1, ci 1.3.0`, or a dash.
+* @example
+* pinsCell(row); // "core 1.7.1"
+*/
+function pinsCell(repo) {
+	if (repo.pins.length === 0) return "—";
+	return repo.pins.map((pin) => `${pin.name.slice(11)} ${pin.pinned}`).join(", ");
+}
+/**
+* Render the public rows as a Markdown table with links, and the list of what waits. A
+* private repository is left out: the page this lands on is public.
+*
+* @param org - The organization login, for the links.
+* @param repos - The rows.
+* @returns The Markdown block, without a trailing newline.
+* @example
+* renderFleetMarkdown("moku-labs", rows);
+*/
+function renderFleetMarkdown(org, repos) {
+	const shown = repos.filter((repo) => !repo.isPrivate);
+	const rows = shown.map((repo) => [
+		`[${repo.name}](${repoUrl(org, repo)})`,
+		`[${MARKS[repo.ci]}](${repoUrl(org, repo, "/actions")})`,
+		repo.packageName === void 0 ? "—" : `[${MARKS[repo.release]}](${repoUrl(org, repo, "/actions/workflows/publish.yml")})`,
+		repo.tag === void 0 ? "—" : `[${repo.tag}](${repoUrl(org, repo, "/releases/tag/")}${repo.tag})`,
+		repo.npm ?? "—",
+		unreleasedCell(repo),
+		`[${pullRequestCell(repo)}](${repoUrl(org, repo, "/pulls")})`,
+		pinsCell(repo)
+	].join(" | "));
+	const waiting = shown.flatMap((repo) => attention(repo).map((line) => `- [${repo.name}](${repoUrl(org, repo)}): ${line}`));
+	return [
+		"| Repo | CI | Release | Tag | npm | Not released | PRs | Old pins |",
+		"| --- | --- | --- | --- | --- | --- | --- | --- |",
+		...rows.map((row) => `| ${row} |`),
+		"",
+		waiting.length === 0 ? "Nothing waits." : "**Waits for a person**",
+		...waiting.length === 0 ? [] : ["", ...waiting]
+	].join("\n");
+}
+//#endregion
+//#region src/commands/fleet.ts
+/**
+* The organization the command reads: the owner of this checkout's remote, or of the
+* manifest's `repository` when there is no remote.
+*
+* @param ctx - The ports and flags.
+* @returns The organization login, or `undefined` when neither names a GitHub owner.
+* @example
+* const org = await organizationOf(ctx); // "moku-labs"
+*/
+async function organizationOf(ctx) {
+	const remote = await ctx.exec.capture("git", [
+		"remote",
+		"get-url",
+		"origin"
+	]);
+	const manifest = await readManifest(ctx.files);
+	const declared = manifest === void 0 ? void 0 : repositoryUrlOf(manifest);
+	const url = remote.code === 0 ? remote.stdout : declared;
+	return url === void 0 ? void 0 : ownerRepoFrom(url)?.split("/")[0];
+}
+/**
+* Add the version npm serves as `latest` to every row that publishes a package.
+*
+* @param ctx - The ports and flags.
+* @param repos - The rows from the query.
+* @returns The rows, with `npm` filled where the registry answered.
+* @example
+* const rows = await withRegistry(ctx, parsed);
+*/
+async function withRegistry(ctx, repos) {
+	return Promise.all(repos.map(async (repo) => {
+		if (repo.packageName === void 0) return repo;
+		const view = await ctx.exec.capture("npm", [
+			"view",
+			repo.packageName,
+			"dist-tags",
+			"--json"
+		]);
+		const latest = view.code === 0 ? parseDistTags(view.stdout)?.latest : void 0;
+		return latest === void 0 ? repo : {
+			...repo,
+			npm: latest
+		};
+	}));
+}
+/**
+* Lay one row of the terminal table out in fixed columns.
+*
+* @param row - The cells of the row.
+* @returns The padded line.
+* @example
+* cells(["core", "green"]);
+*/
+function cells(row) {
+	return row.map((cell, index) => cell.padEnd(index === 0 ? 10 : 9)).join(" ");
+}
+/**
+* Print the table and the list of what waits, for a person at a terminal.
+*
+* @param ui - The branded console.
+* @param repos - The rows.
+* @example
+* renderTerminal(ui, rows);
+*/
+function renderTerminal(ui, repos) {
+	ui.heading("Fleet");
+	ui.line(cells([
+		"repo",
+		"ci",
+		"release",
+		"tag",
+		"npm",
+		"ahead",
+		"prs",
+		"old pins"
+	]));
+	for (const repo of repos) ui.line(cells([
+		repo.name,
+		repo.ci,
+		repo.packageName === void 0 ? "—" : repo.release,
+		repo.tag ?? "—",
+		repo.npm ?? "—",
+		unreleasedCell(repo),
+		pullRequestCell(repo),
+		pinsCell(repo)
+	]));
+	ui.heading("Waits for a person");
+	const waiting = repos.flatMap((repo) => attention(repo).map((line) => `${repo.name}: ${line}`));
+	if (waiting.length === 0) ui.check(true, "nothing waits");
+	for (const line of waiting) ui.check(false, line);
+}
+/**
+* Read the state of every repository of the organization and print it.
+*
+* @param options - The ports, console and output flags.
+* @returns The process exit code: `1` only when the state could not be read.
+* @example
+* const code = await runFleet({ ctx, ui });
+*/
+async function runFleet(options) {
+	const { ctx, ui, json = false, markdown = false } = options;
+	if (!(json || markdown)) ui.lockup({
+		wordmark: "moku release",
+		label: "fleet"
+	});
+	const org = await organizationOf(ctx);
+	if (org === void 0) {
+		ui.error("no GitHub organization found", "run inside a checkout whose `origin` is on GitHub");
+		return 1;
+	}
+	const answer = await ctx.exec.capture("gh", [
+		"api",
+		"graphql",
+		"-F",
+		`org=${org}`,
+		"-f",
+		`query=${FLEET_QUERY}`
+	]);
+	const parsed = answer.code === 0 ? parseFleet(answer.stdout) : void 0;
+	if (parsed === void 0) {
+		ui.error(`could not read the repositories of ${org}`, answer.stderr.trim() || "gh auth login");
+		return 1;
+	}
+	const repos = await withRegistry(ctx, parsed);
+	if (json) ui.line(JSON.stringify(repos, void 0, 2));
+	else if (markdown) ui.line(renderFleetMarkdown(org, repos));
+	else renderTerminal(ui, repos);
+	return 0;
+}
+//#endregion
 //#region src/commands/release.ts
 /** Workflow file dispatched by name — the same name npm's trusted publisher is bound to. */
-const PUBLISH_WORKFLOW_FILE = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
+const PUBLISH_WORKFLOW_FILE$1 = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
 /** How long to keep asking the registry for the new version before giving up. */
-const REGISTRY_POLL_ATTEMPTS = 60;
+const REGISTRY_POLL_ATTEMPTS$1 = 60;
 /** Gap between registry polls — 60 × 10s = ten minutes. The first live release needed three. */
 const REGISTRY_POLL_INTERVAL_MS = 1e4;
 /** How many times to look for the dispatched run before concluding it never started. */
@@ -1995,7 +2517,7 @@ const RUN_LOOKUP_INTERVAL_MS = 3e3;
 * @example
 * await defaultSleep(500);
 */
-const defaultSleep = (ms) => new Promise((resolve) => {
+const defaultSleep$1 = (ms) => new Promise((resolve) => {
 	setTimeout(resolve, ms);
 });
 /**
@@ -2026,7 +2548,7 @@ const LATEST_RUN_ARGS = [
 	"run",
 	"list",
 	"--workflow",
-	PUBLISH_WORKFLOW_FILE,
+	PUBLISH_WORKFLOW_FILE$1,
 	"--branch",
 	"main",
 	"--limit",
@@ -2081,7 +2603,7 @@ async function findDispatchedRun(ctx, previous, sleep) {
 * await awaitPublishedVersion(ctx, "@moku-labs/common", "latest", "1.2.2", defaultSleep);
 */
 async function awaitPublishedVersion(ctx, name, tag, before, sleep) {
-	for (let attempt = 0; attempt < REGISTRY_POLL_ATTEMPTS; attempt += 1) {
+	for (let attempt = 0; attempt < REGISTRY_POLL_ATTEMPTS$1; attempt += 1) {
 		const view = await ctx.exec.capture("npm", [
 			"view",
 			name,
@@ -2124,7 +2646,7 @@ function renderSummary(ui, name, version, ownerRepo) {
 * const code = await runRelease({ ctx, ui, releaseType: "patch" });
 */
 async function runRelease(options) {
-	const { ctx, ui, releaseType, dryRun = false, sleep = defaultSleep } = options;
+	const { ctx, ui, releaseType, dryRun = false, sleep = defaultSleep$1 } = options;
 	ui.lockup({
 		wordmark: "moku release",
 		label: dryRun ? `${releaseType} · dry-run` : releaseType
@@ -2146,7 +2668,7 @@ async function runRelease(options) {
 	])).stdout)?.[tag];
 	if (dryRun) {
 		ui.heading("Plan");
-		ui.info(`gh workflow run ${PUBLISH_WORKFLOW_FILE} -f release_type=${releaseType} --ref main`);
+		ui.info(`gh workflow run ${PUBLISH_WORKFLOW_FILE$1} -f release_type=${releaseType} --ref main`);
 		ui.info(`watch the run, then wait for npm dist-tag \`${tag}\` to move from ${before ?? "—"}`);
 		return 0;
 	}
@@ -2155,7 +2677,7 @@ async function runRelease(options) {
 	const dispatched = await ctx.exec.capture("gh", [
 		"workflow",
 		"run",
-		PUBLISH_WORKFLOW_FILE,
+		PUBLISH_WORKFLOW_FILE$1,
 		"-f",
 		`release_type=${releaseType}`,
 		"--ref",
@@ -2165,7 +2687,7 @@ async function runRelease(options) {
 		ui.error("could not dispatch the workflow", dispatched.stderr.trim());
 		return 1;
 	}
-	ui.check(true, `${PUBLISH_WORKFLOW_FILE} dispatched (${releaseType})`);
+	ui.check(true, `${PUBLISH_WORKFLOW_FILE$1} dispatched (${releaseType})`);
 	const runId = await findDispatchedRun(ctx, previousRun, sleep);
 	if (runId === void 0) {
 		ui.error("the dispatched run never appeared — check GitHub Actions");
@@ -2647,13 +3169,200 @@ async function runSetup(options) {
 	return report.failed ? 1 : 0;
 }
 //#endregion
+//#region src/commands/wait.ts
+/** Workflow file whose runs are read — the one that releases on a push to main. */
+const PUBLISH_WORKFLOW_FILE = ".github/workflows/publish.yml".split("/").pop() ?? "publish.yml";
+/** How long to wait for a tag that holds the commit — 120 × 10s = twenty minutes. */
+const TAG_POLL_ATTEMPTS = 120;
+/** How long to wait for a run to start before saying none will — 12 × 10s = two minutes. */
+const RUN_START_ATTEMPTS = 12;
+/** How long to keep asking the registry for the version — 60 × 10s = ten minutes. */
+const REGISTRY_POLL_ATTEMPTS = 60;
+/** Gap between polls of every loop here. */
+const POLL_INTERVAL_MS = 1e4;
+/** The `gh run list` call that reads the newest `publish.yml` runs on main. */
+const RECENT_RUNS_ARGS = [
+	"run",
+	"list",
+	"--workflow",
+	PUBLISH_WORKFLOW_FILE,
+	"--branch",
+	"main",
+	"--limit",
+	"5",
+	"--json",
+	"databaseId,headSha,status,conclusion"
+];
+/** Argv for the release tags that hold a commit, oldest first: the first one shipped it. */
+const TAGS_WITH_HEAD_ARGS = [
+	"-c",
+	"versionsort.suffix=-",
+	"tag",
+	"--list",
+	"v*",
+	"--contains",
+	"HEAD",
+	"--sort=v:refname"
+];
+/**
+* The default delay helper.
+*
+* @param ms - Milliseconds to wait.
+* @returns Resolves after the delay.
+* @example
+* await defaultSleep(500);
+*/
+const defaultSleep = (ms) => new Promise((resolve) => {
+	setTimeout(resolve, ms);
+});
+/**
+* Whether `HEAD` is an ancestor of a ref, i.e. the ref holds the commit.
+*
+* @param ctx - The ports and flags.
+* @param ref - A branch, tag or sha.
+* @returns `true` when the ref holds `HEAD`.
+* @example
+* await holdsHead(ctx, "origin/main");
+*/
+async function holdsHead(ctx, ref) {
+	return (await ctx.exec.capture("git", [
+		"merge-base",
+		"--is-ancestor",
+		"HEAD",
+		ref
+	])).code === 0;
+}
+/**
+* The newest `publish.yml` run whose commit holds `HEAD`. A run of a later merge counts:
+* its version carries the commit too.
+*
+* @param ctx - The ports and flags.
+* @returns The run, or `undefined` when no run covers the commit yet.
+* @example
+* const run = await coveringRun(ctx);
+*/
+async function coveringRun(ctx) {
+	const listing = await ctx.exec.capture("gh", RECENT_RUNS_ARGS);
+	if (listing.code !== 0) return void 0;
+	for (const run of parseRuns(listing.stdout)) if (await holdsHead(ctx, run.headSha)) return run;
+}
+/**
+* Wait until a release tag holds `HEAD`. Stops early when the covering run failed, or when
+* no run started at all.
+*
+* @param ctx - The ports and flags.
+* @param ui - The branded console.
+* @param sleep - The delay helper.
+* @returns The tag, or `undefined` after the reason was printed.
+* @example
+* const tag = await awaitTag(ctx, ui, defaultSleep);
+*/
+async function awaitTag(ctx, ui, sleep) {
+	for (let attempt = 0; attempt < TAG_POLL_ATTEMPTS; attempt += 1) {
+		await ctx.exec.capture("git", [
+			"fetch",
+			"--tags",
+			"--prune"
+		]);
+		const tags = await ctx.exec.capture("git", TAGS_WITH_HEAD_ARGS);
+		const tag = tags.code === 0 ? latestVersionTag(tags.stdout) : void 0;
+		if (tag !== void 0) return tag;
+		const run = await coveringRun(ctx);
+		if (run === void 0 && attempt >= RUN_START_ATTEMPTS) {
+			ui.error(`no ${PUBLISH_WORKFLOW_FILE} run started for this commit`, `${PUBLISH_WORKFLOW_FILE} needs \`push: branches: [main]\`; a Dependabot merge needs the dispatch step of dependabot-automerge.yml`);
+			return;
+		}
+		if (run?.status === "completed" && run.conclusion !== "success") {
+			ui.error(`run ${run.databaseId} ended as ${run.conclusion}`, `gh run view ${run.databaseId} --log-failed`);
+			return;
+		}
+		await sleep(POLL_INTERVAL_MS);
+	}
+	ui.error("no release tag holds this commit after twenty minutes");
+}
+/**
+* Poll the registry until it serves one exact version. The registry lags behind a
+* successful publish, so "not there yet" is expected for a while.
+*
+* @param ctx - The ports and flags.
+* @param name - The package name.
+* @param version - The version the tag names.
+* @param sleep - The delay helper.
+* @returns `true` when the registry serves the version.
+* @example
+* await awaitVersion(ctx, "@moku-labs/common", "1.2.4", defaultSleep);
+*/
+async function awaitVersion(ctx, name, version, sleep) {
+	for (let attempt = 0; attempt < REGISTRY_POLL_ATTEMPTS; attempt += 1) {
+		const view = await ctx.exec.capture("npm", [
+			"view",
+			`${name}@${version}`,
+			"version"
+		]);
+		if (view.code === 0 && view.stdout.trim() === version) return true;
+		await sleep(POLL_INTERVAL_MS);
+	}
+	return false;
+}
+/**
+* Wait for the auto-release of `HEAD`: the commit is on `origin/main`, a release tag holds
+* it, and npm serves that version.
+*
+* @param options - The ports, console and delay helper.
+* @returns The process exit code.
+* @example
+* const code = await runWait({ ctx, ui });
+*/
+async function runWait(options) {
+	const { ctx, ui, sleep = defaultSleep } = options;
+	ui.lockup({
+		wordmark: "moku release",
+		label: "wait"
+	});
+	const manifest = await readManifest(ctx.files);
+	if (!manifest?.name) {
+		ui.error("package.json is missing, malformed, or has no `name`");
+		return 1;
+	}
+	await ctx.exec.capture("git", [
+		"fetch",
+		"--tags",
+		"--prune"
+	]);
+	if (!await holdsHead(ctx, "origin/main")) {
+		ui.error("HEAD is not on origin/main", "merge the PR, then: git checkout main && git pull");
+		return 1;
+	}
+	ui.heading("Tag");
+	const tag = await awaitTag(ctx, ui, sleep);
+	if (tag === void 0) return 1;
+	ui.check(true, `${tag} holds this commit`);
+	ui.heading("Registry");
+	const version = tag.replace(/^v/, "");
+	if (!await awaitVersion(ctx, manifest.name, version, sleep)) {
+		ui.error(`npm does not serve ${manifest.name}@${version} after ten minutes`);
+		return 1;
+	}
+	const declared = repositoryUrlOf(manifest);
+	const ownerRepo = declared === void 0 ? void 0 : ownerRepoFrom(declared);
+	const lines = [
+		ui.railLine(manifest.name, version, 48),
+		ui.railLine("tag", tag, 48),
+		ui.railLine("npm", npmPackageUrl(manifest.name, version), 48)
+	];
+	if (ownerRepo !== void 0) lines.push(ui.railLine("release", releaseUrl(ownerRepo, tag), 48));
+	ui.heading("Released");
+	ui.box(lines);
+	return 0;
+}
+//#endregion
 //#region src/lib/argv.ts
 /**
 * @file `moku-release` — argv parsing, kept out of the entry so the entry stays a
 * dispatcher.
 *
 * The grammar is deliberately tiny: one positional (a command name, or a semver bump that
-* implies the `release` command) plus four flags. Anything unrecognized resolves to
+* implies the `release` command) plus five flags. Anything unrecognized resolves to
 * `help` with an `error` set — the CLI never guesses what an operator meant.
 */
 /** The semver bumps `moku-release <type>` accepts, in menu order. */
@@ -2666,6 +3375,7 @@ const RELEASE_TYPES = [
 /** Every flag the CLI accepts, besides `--help`. */
 const KNOWN_FLAGS = /* @__PURE__ */ new Set([
 	"--json",
+	"--markdown",
 	"--dry-run",
 	"--yes",
 	"-y"
@@ -2729,12 +3439,19 @@ function parseArgv(argv) {
 		dryRun,
 		yes
 	};
-	if (first === "doctor" || first === "setup") return {
+	if (first === "doctor" || first === "setup" || first === "wait") return {
 		command: first,
 		json,
 		dryRun,
 		yes
 	};
+	if (first === "fleet") return {
+		command: first,
+		json,
+		dryRun,
+		yes,
+		markdown: flags.includes("--markdown")
+	};
 	if (first === "help") return {
 		command: "help",
 		json,
@@ -2929,8 +3646,14 @@ function createFileStore(root) {
 const USAGE = [
 	"  moku-release setup              one-time wizard: workflows, contract, first publish",
 	"  moku-release doctor [--json]    read-only diagnosis of the release setup",
+	"  moku-release wait               wait for the auto-release of HEAD, verify it on npm",
+	"  moku-release fleet [--json|--markdown]",
+	"                                  every repository of the organization in one table",
 	`  moku-release <${RELEASE_TYPES.join("|")}>`,
 	"",
+	"  A merge to main releases a patch by itself. A person releases minor,",
+	"  or major for a milestone.",
+	"",
 	"  --dry-run                       print every action, mutate nothing, ask nothing",
 	"  --yes, -y                       answer every setup confirmation with yes",
 	"",
@@ -2986,6 +3709,16 @@ async function dispatch(parsed, ctx, ui) {
 		dryRun: parsed.dryRun,
 		unattended: parsed.yes
 	});
+	if (parsed.command === "wait") return runWait({
+		ctx,
+		ui
+	});
+	if (parsed.command === "fleet") return runFleet({
+		ctx,
+		ui,
+		json: parsed.json,
+		markdown: parsed.markdown === true
+	});
 	if (parsed.command === "release" && parsed.releaseType !== void 0) return runRelease({
 		ctx,
 		ui,

package/examples/org/fleet.yml

@@ -0,0 +1,51 @@
+name: Fleet status
+
+# For the organization's `.github` repository. Every hour it reads the state of every public
+# repository with `moku-release fleet` and puts the table into profile/README.md, the page
+# GitHub shows on the organization. It commits only when the table changed.
+#
+# No token is added: GITHUB_TOKEN reads the public repositories and writes this one.
+on:
+  schedule:
+    - cron: "17 * * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: fleet
+  cancel-in-progress: true
+
+permissions:
+  contents: write # commit profile/README.md
+
+jobs:
+  fleet:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: 24
+      - name: Read the fleet
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: npx --yes --package @moku-labs/ci@1 moku-release fleet --markdown > fleet.md
+      - name: Put the table between the markers of profile/README.md
+        run: |
+          set -euo pipefail
+          # An empty table means the read failed without an exit code; keep the old one.
+          [ -s fleet.md ] || { echo "fleet.md is empty"; exit 1; }
+          awk -v table=fleet.md '
+            /<!-- fleet:start -->/ { print; while ((getline line < table) > 0) print line; skip = 1; next }
+            /<!-- fleet:end -->/ { skip = 0 }
+            !skip
+          ' profile/README.md > README.next
+          mv README.next profile/README.md
+          rm fleet.md
+      - name: Commit when the table changed
+        run: |
+          set -euo pipefail
+          git diff --quiet && { echo "no change"; exit 0; }
+          git config user.name  "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -qam "fleet: status"
+          git push

package/examples/package/dependabot-automerge.yml

@@ -2,20 +2,47 @@ name: Dependabot automerge
 
 # Turns on auto-merge for a Dependabot PR. The branch ruleset stays the gate: the merge
 # waits for ci / lint, ci / types, ci / test and ci / build. Needs the repo setting
-# allow_auto_merge, which `moku-release setup` turns on.
+# allow_auto_merge, which `moku-release setup` turns on. After the merge it dispatches
+# publish.yml, so a Dependabot merge releases a patch like any other merge.
 on: pull_request
 
+# One waiter per PR: a rebase of the PR starts a new run and ends the old one.
+concurrency:
+  group: dependabot-automerge-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: write
   pull-requests: write
+  actions: write # dispatch publish.yml after the merge
 
 jobs:
   automerge:
     if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    env:
+      PR_URL: ${{ github.event.pull_request.html_url }}
+      REPO: ${{ github.repository }}
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Merge once required checks pass
         run: gh pr merge --auto --squash "$PR_URL"
-        env:
-          PR_URL: ${{ github.event.pull_request.html_url }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Release the merge as a patch
+        # A merge made by GITHUB_TOKEN starts no push run, so the auto-release of publish.yml
+        # never sees it. workflow_dispatch is the one event GITHUB_TOKEN may start: wait for
+        # the merge, then dispatch the same patch a push would have cut.
+        run: |
+          set -euo pipefail
+          for _ in $(seq 1 90); do
+            state="$(gh pr view "$PR_URL" --json state --jq .state)"
+            case "$state" in
+              MERGED)
+                gh workflow run publish.yml --repo "$REPO" --ref main -f release_type=patch
+                exit 0 ;;
+              CLOSED)
+                echo "closed without a merge, nothing to release"
+                exit 0 ;;
+            esac
+            sleep 20
+          done
+          echo "::warning::not merged after 30 minutes, no release was dispatched"

package/examples/package/publish.local-publish.yml

@@ -8,6 +8,11 @@ name: Release
 # `npm publish` runs HERE, in this repo's own publish.yml, so the OIDC claim's
 # job_workflow_ref points at <owner>/<repo>/.github/workflows/publish.yml.
 on:
+  # Auto-release: every merge to main ships a PATCH. A person dispatches minor, or major for
+  # a milestone. A PR merged by GITHUB_TOKEN starts no push run: dependabot-automerge.yml
+  # dispatches the patch for its own merges.
+  push:
+    branches: [main]
   workflow_dispatch:
     inputs:
       release_type:
@@ -39,7 +44,7 @@ jobs:
     if: |
       always() && needs.release.outputs.artifact_name != '' &&
       (
-        (github.event_name == 'workflow_dispatch' && needs.release.outputs.tag != '') ||
+        (github.event_name != 'release' && needs.release.outputs.tag != '') ||
         github.event_name == 'release'
       )
     runs-on: ubuntu-latest
@@ -49,7 +54,7 @@ jobs:
     steps:
       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
         with:
-          ref: ${{ github.event_name == 'workflow_dispatch' && needs.release.outputs.tag || github.ref }}
+          ref: ${{ github.event_name != 'release' && needs.release.outputs.tag || github.ref }}
           persist-credentials: false
       - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
@@ -75,7 +80,7 @@ jobs:
         run: |
           set -euo pipefail
           pkg="$(node -p "require('./package.json').version")"
-          if [ "$EVENT" = "workflow_dispatch" ]; then want="$DISPATCH_VERSION"; else want="${REF_NAME#v}"; fi
+          if [ "$EVENT" = "release" ]; then want="${REF_NAME#v}"; else want="$DISPATCH_VERSION"; fi
           [ -n "$want" ] || { echo "empty version/ref — refusing to publish"; exit 1; }
           [ "$pkg" = "$want" ] || { echo "package.json $pkg != ref $want"; exit 1; }
           # Prereleases go to dist-tag 'next' so they never clobber 'latest'.

package/examples/package/publish.yml

@@ -3,6 +3,11 @@ name: Release
 # Thin caller. The FILENAME is a contract: npm Trusted Publishing is registered against
 # "publish.yml" for this repo — renaming it breaks tokenless publishing.
 on:
+  # Auto-release: every merge to main ships a PATCH. A person dispatches minor, or major for
+  # a milestone. A PR merged by GITHUB_TOKEN starts no push run: dependabot-automerge.yml
+  # dispatches the patch for its own merges.
+  push:
+    branches: [main]
   workflow_dispatch:
     inputs:
       release_type:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moku-labs/ci",
-  "version": "1.4.0",
+  "version": "1.5.1",
   "description": "Central CI and release for the moku family: reusable workflows, caller examples and the moku-release CLI.",
   "type": "module",
   "sideEffects": [
@@ -32,7 +32,7 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.4.16",
-    "@moku-labs/common": "0.3.3",
+    "@moku-labs/common": "0.3.4",
     "@types/bun": "1.3.14",
     "@vitest/coverage-istanbul": "4.0.18",
     "eslint": "9.39.3",