@oorabona/release-it-preset 0.10.1 → 0.11.0

package/README.md

@@ -660,6 +660,7 @@ Customize behavior with environment variables:
 
 ### Changelog
 - `CHANGELOG_FILE` - Changelog file path (default: `CHANGELOG.md`)
+- `GIT_CHANGELOG_PATH` - Optional. When set to a repository-relative path (e.g. `packages/tar-xz`), restrict changelog generation to commits touching that path. Useful for monorepo per-package CHANGELOG files. Empty / unset = repository-wide (default).
 
 ### Git
 - `GIT_COMMIT_MESSAGE` - Commit message template (default: `release: bump v${version}`)
@@ -678,6 +679,7 @@ Customize behavior with environment variables:
 - `NPM_PUBLISH` - Enable npm publishing (default: `false`)
 - `NPM_SKIP_CHECKS` - Skip npm checks (default: `false`)
 - `NPM_ACCESS` - npm access level (default: `public`)
+- `NPM_TAG` - Optional. When set, the npm publish step appends `--tag <value>` (e.g. `legacy-v0.10.0`). Used to assign version-named dist-tags when republishing older versions so `latest` is not overwritten. Empty / unset = npm uses `latest`.
 
 > ℹ️  By default, the presets skip GitHub releases and npm publishing. Set `GITHUB_RELEASE=true` and/or `NPM_PUBLISH=true` in the environment (typically in CI) when you are ready to perform those steps.
 

package/config/base-config.js

@@ -41,15 +41,24 @@ export function createBaseGitConfig(overrides = {}) {
  * @returns {Object} Npm configuration object
  */
 export function createBaseNpmConfig(overrides = {}) {
+  const publishArgs = [
+    ...NPM_DEFAULTS.PUBLISH_ARGS_BASE,
+    '--access',
+    process.env.NPM_ACCESS || NPM_DEFAULTS.ACCESS,
+  ];
+
+  // Optional --tag <name> for npm dist-tag control (e.g. republishing an older
+  // version without overwriting `latest`). When unset, npm uses `latest`.
+  const npmTag = process.env.NPM_TAG;
+  if (npmTag) {
+    publishArgs.push('--tag', npmTag);
+  }
+
   const defaults = {
     skipChecks: process.env.NPM_SKIP_CHECKS === 'true',
     publish: process.env.NPM_PUBLISH === 'true',
     versionArgs: NPM_DEFAULTS.VERSION_ARGS,
-    publishArgs: [
-      ...NPM_DEFAULTS.PUBLISH_ARGS_BASE,
-      '--access',
-      process.env.NPM_ACCESS || NPM_DEFAULTS.ACCESS,
-    ],
+    publishArgs,
   };
 
   return {

package/dist/scripts/populate-unreleased-changelog.js

@@ -22,6 +22,7 @@ import { readFileSync, writeFileSync } from 'node:fs';
 import { getGitHubRepoUrl } from './lib/git-utils.js';
 import { CONVENTIONAL_COMMIT_REGEX } from './lib/commit-parser.js';
 import { runScript } from './lib/run-script.js';
+import { ValidationError } from './lib/errors.js';
 /**
  * Extract all conventional commit patterns from a commit body
  */
@@ -180,9 +181,20 @@ export function populateChangelog(deps) {
         deps.log('ℹ️  No tags found, using all commits');
         latestTag = '';
     }
+    const gitChangelogPath = deps.getEnv('GIT_CHANGELOG_PATH');
+    let pathFilter = '';
+    if (gitChangelogPath !== undefined && gitChangelogPath !== '') {
+        // Validate: must be a relative path — no leading slash, no ".." segments, no shell metacharacters
+        if (gitChangelogPath.startsWith('/') ||
+            /(^|[/\\])\.\.([/\\]|$)/.test(gitChangelogPath) ||
+            /[`$;&|<>{}()\\*?!#"']/.test(gitChangelogPath)) {
+            throw new ValidationError(`GIT_CHANGELOG_PATH must be a relative path under the repository (got: ${gitChangelogPath})`);
+        }
+        pathFilter = ` -- ${gitChangelogPath}`;
+    }
     const gitLogCommand = latestTag
-        ? `git log --pretty=format:"%H|%B|||END|||" ${latestTag}..HEAD`
-        : `git log --pretty=format:"%H|%B|||END|||"`;
+        ? `git log --pretty=format:"%H|%B|||END|||" ${latestTag}..HEAD${pathFilter}`
+        : `git log --pretty=format:"%H|%B|||END|||"${pathFilter}`;
     let gitOutput;
     try {
         gitOutput = deps.execSync(gitLogCommand, { encoding: 'utf8' }).trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oorabona/release-it-preset",
-  "version": "0.10.1",
+  "version": "0.11.0",
   "description": "Shared release-it configuration and scripts for the organisation",
   "type": "module",
   "keywords": [