@oorabona/release-it-preset 1.2.0 → 1.3.0

package/dist/scripts/init-project.js

@@ -15,11 +15,11 @@
  */
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { createInterface } from 'node:readline';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { join } from 'node:path';
 import { runScript } from './lib/run-script.js';
 import { parsePnpmWorkspaceYaml, parseWorkspacesFromPackageJson, resolvePackagePaths, } from './lib/workspace-detect.js';
 import { ValidationError } from './lib/errors.js';
+import { readWorkflowTemplate } from './lib/workflow-template.js';
 // Single source of truth for workflow name validation within this file.
 // NOTE: bin/validators.js cannot be imported here — TypeScript compiles scripts/ to
 // dist/scripts/ so a relative '../bin/' import resolves to 'dist/bin/' at runtime
@@ -173,22 +173,14 @@ export async function writeWorkflow(options, deps) {
         deps.log(`   To integrate manually, review the template and merge into your existing workflow.`);
         return false;
     }
-    // Resolve template path: try compiled position first, fall back to source position.
-    //   compiled: dist/scripts/init-project.js → ../../scripts/templates/... (2 hops up)
-    //   source:   scripts/init-project.ts     → ./templates/...             (sibling dir)
-    const __filename = fileURLToPath(import.meta.url);
-    const __dirname = dirname(__filename);
-    const compiledPath = join(__dirname, '..', '..', 'scripts', 'templates', 'workflows', 'release.yml.template');
-    const sourcePath = join(__dirname, 'templates', 'workflows', 'release.yml.template');
-    const templatePath = deps.existsSync(compiledPath) ? compiledPath : sourcePath;
     let templateContent;
     try {
-        templateContent = deps.readFileSync(templatePath, 'utf8');
+        templateContent = readWorkflowTemplate(deps).content;
     }
     catch (error) {
-        throw new ValidationError(`Failed to read workflow template at "${templatePath}".\n` +
-            `The template ships in scripts/templates/ — if it is missing, reinstall the package.\n` +
-            `Original error: ${error}`);
+        throw new ValidationError(error instanceof Error
+            ? error.message
+            : 'Failed to read workflow template. The template ships in scripts/templates/.');
     }
     // Ensure .github/workflows/ exists
     if (!deps.existsSync(workflowDir)) {

package/dist/scripts/lib/semver-utils.js

@@ -1,6 +1,100 @@
 /**
  * Semantic versioning utility functions
  */
+const SEMVER_PATTERN = String.raw `v?\d+\.\d+\.\d+(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?`;
+const exactRangeRegex = new RegExp(String.raw `^=?${SEMVER_PATTERN}$`);
+const caretRangeRegex = new RegExp(String.raw `^\^\s*(${SEMVER_PATTERN})$`);
+const tildeRangeRegex = new RegExp(String.raw `^~\s*(${SEMVER_PATTERN})$`);
+const greaterThanOrEqualRangeRegex = new RegExp(String.raw `^>=\s*(${SEMVER_PATTERN})$`);
+const workspaceProtocolPassthroughRanges = new Set(['*', '^', '~']);
+function hasPrereleaseOrBuildMetadata(version) {
+    const normalized = version.replace(/^v/, '');
+    return normalized.includes('-') || normalized.includes('+');
+}
+function parseVersion(version) {
+    if (!isValidSemver(version)) {
+        return null;
+    }
+    const normalized = version.replace(/^v/, '');
+    const [major, minor, patch] = normalized.split(/[+-]/)[0].split('.').map(Number);
+    return { major, minor, patch, normalized };
+}
+function compareVersions(a, b) {
+    if (a.major !== b.major)
+        return a.major - b.major;
+    if (a.minor !== b.minor)
+        return a.minor - b.minor;
+    return a.patch - b.patch;
+}
+function includesCaretRange(version, base) {
+    if (compareVersions(version, base) < 0) {
+        return false;
+    }
+    if (base.major > 0) {
+        return version.major === base.major;
+    }
+    if (base.minor > 0) {
+        return version.major === 0 && version.minor === base.minor;
+    }
+    return version.major === 0 && version.minor === 0 && version.patch === base.patch;
+}
+function includesTildeRange(version, base) {
+    return compareVersions(version, base) >= 0 && version.major === base.major && version.minor === base.minor;
+}
+function normalizeWorkspaceProtocolRange(trimmed) {
+    if (!trimmed.startsWith('workspace:')) {
+        return trimmed;
+    }
+    const workspaceRange = trimmed.slice('workspace:'.length).trim();
+    if (workspaceProtocolPassthroughRanges.has(workspaceRange)) {
+        return '*';
+    }
+    if (exactRangeRegex.test(workspaceRange) ||
+        caretRangeRegex.test(workspaceRange) ||
+        tildeRangeRegex.test(workspaceRange) ||
+        greaterThanOrEqualRangeRegex.test(workspaceRange)) {
+        return workspaceRange;
+    }
+    return null;
+}
+function evaluateRangePart(range, version) {
+    const trimmed = range.trim();
+    if (!trimmed) {
+        return null;
+    }
+    const normalizedRange = normalizeWorkspaceProtocolRange(trimmed);
+    if (normalizedRange === null) {
+        return null;
+    }
+    if (normalizedRange === '*') {
+        return true;
+    }
+    const semverOperand = normalizedRange.replace(/^(?:=|\^|~|>=)\s*/, '');
+    if (isValidSemver(semverOperand) && hasPrereleaseOrBuildMetadata(semverOperand)) {
+        return null;
+    }
+    const exactMatch = normalizedRange.match(exactRangeRegex);
+    if (exactMatch) {
+        const exact = parseVersion(normalizedRange.replace(/^=/, ''));
+        return exact ? exact.normalized === version.normalized : null;
+    }
+    const caretMatch = normalizedRange.match(caretRangeRegex);
+    if (caretMatch) {
+        const base = parseVersion(caretMatch[1]);
+        return base ? includesCaretRange(version, base) : null;
+    }
+    const tildeMatch = normalizedRange.match(tildeRangeRegex);
+    if (tildeMatch) {
+        const base = parseVersion(tildeMatch[1]);
+        return base ? includesTildeRange(version, base) : null;
+    }
+    const greaterThanOrEqualMatch = normalizedRange.match(greaterThanOrEqualRangeRegex);
+    if (greaterThanOrEqualMatch) {
+        const base = parseVersion(greaterThanOrEqualMatch[1]);
+        return base ? compareVersions(version, base) >= 0 : null;
+    }
+    return null;
+}
 /**
  * Validate if a string is a valid semantic version
  *
@@ -24,3 +118,36 @@ export function validateAndNormalizeSemver(version) {
     }
     return version.replace(/^v/, '');
 }
+/**
+ * Check whether a dependency range includes a concrete workspace package version.
+ *
+ * This intentionally supports only the small zero-dependency subset doctor needs:
+ * workspace: protocol ranges, exact versions, ^, ~, >=, and OR-joined (`||`)
+ * combinations of those forms. Unknown syntax returns null so advisory checks can
+ * skip it without producing false warnings.
+ *
+ * @param range Dependency range string from package.json
+ * @param version Concrete workspace package version
+ * @returns true/false when evaluated, null when the syntax is outside the supported subset
+ */
+export function rangeIncludesVersion(range, version) {
+    const parsedVersion = parseVersion(version);
+    if (!parsedVersion) {
+        return null;
+    }
+    if (hasPrereleaseOrBuildMetadata(version)) {
+        return null;
+    }
+    const parts = range.split(/\s*\|\|\s*/);
+    let sawUnknown = false;
+    for (const part of parts) {
+        const result = evaluateRangePart(part, parsedVersion);
+        if (result === true) {
+            return true;
+        }
+        if (result === null) {
+            sawUnknown = true;
+        }
+    }
+    return sawUnknown ? null : false;
+}

package/dist/scripts/lib/workflow-template.js

@@ -0,0 +1,34 @@
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+export const GENERATED_WORKFLOW_MARKER = '# Generated by: release-it-preset init --with-workflows';
+const WORKFLOW_TEMPLATE_RELATIVE_PATH = ['workflows', 'release.yml.template'];
+export function getWorkflowTemplateCandidates(moduleUrl = import.meta.url) {
+    const moduleDir = dirname(fileURLToPath(moduleUrl));
+    return [
+        join(moduleDir, '..', 'templates', ...WORKFLOW_TEMPLATE_RELATIVE_PATH),
+        join(moduleDir, '..', '..', '..', 'scripts', 'templates', ...WORKFLOW_TEMPLATE_RELATIVE_PATH),
+    ];
+}
+export function readWorkflowTemplate(deps, moduleUrl = import.meta.url) {
+    const candidates = getWorkflowTemplateCandidates(moduleUrl);
+    const templatePath = candidates.find((candidate) => deps.existsSync(candidate)) ?? candidates[0];
+    try {
+        return {
+            path: templatePath,
+            content: deps.readFileSync(templatePath, 'utf8'),
+        };
+    }
+    catch (error) {
+        throw new Error([
+            `Failed to read workflow template at "${templatePath}".`,
+            'The template ships in scripts/templates/ — if it is missing, reinstall the package.',
+            `Original error: ${error}`,
+        ].join('\n'));
+    }
+}
+export function hasGeneratedWorkflowMarker(content) {
+    return content.includes(GENERATED_WORKFLOW_MARKER);
+}
+export function normalizeWorkflowContent(content) {
+    return content.replace(/\r\n/g, '\n').replace(/\r/g, '\n').replace(/\n*$/, '\n');
+}

package/dist/types/annotate-changelog.d.ts

@@ -0,0 +1,86 @@
+#!/usr/bin/env tsx
+/**
+ * Annotate [Unreleased] entries from typed pull request changelog blocks.
+ */
+import type { ExecSyncOptions } from 'node:child_process';
+import { readFileSync, writeFileSync } from 'node:fs';
+export interface AnnotateChangelogDeps {
+    execSync: (command: string, options?: ExecSyncOptions) => Buffer | string;
+    readFileSync: typeof readFileSync;
+    writeFileSync: typeof writeFileSync;
+    getEnv: (key: string) => string | undefined;
+    log: (message: string) => void;
+    warn: (message: string) => void;
+}
+export interface PullRequestInfo {
+    number: number;
+    body?: string | null;
+    merged_at?: string | null;
+}
+export interface ChangelogEntry {
+    section: string;
+    text: string;
+    rawLine: string;
+    shaList: string[];
+    prNumber: number | null;
+    order: number;
+}
+export interface ChangelogNote {
+    section: string;
+    text: string;
+}
+interface UnreleasedBlock {
+    prefix: string;
+    body: string;
+    suffix: string;
+}
+type SectionItem = {
+    kind: 'note';
+    line: string;
+} | {
+    kind: 'entry';
+    entry: ChangelogEntry;
+};
+interface ParsedSection {
+    heading: string | null;
+    items: SectionItem[];
+}
+interface ParsedUnreleased {
+    entries: ChangelogEntry[];
+    sections: ParsedSection[];
+}
+interface CandidateGroup {
+    key: string;
+    kind: 'pr' | 'sha';
+    ref: string;
+    entries: ChangelogEntry[];
+    primarySha: string | null;
+}
+interface ResolvedGroup {
+    pr: PullRequestInfo;
+    entries: ChangelogEntry[];
+    primarySha: string | null;
+}
+export declare function extractUnreleasedBlock(changelog: string, changelogPath?: string): UnreleasedBlock;
+export declare function normalizeSectionHeading(rawHeading: string): string;
+export declare function extractCommitShas(value: string): string[];
+export declare function extractPrNumber(value: string): number | null;
+export declare function choosePrimarySha(values: Array<string | null | undefined>): string | null;
+export declare function parseUnreleasedEntries(body: string): ParsedUnreleased;
+export declare function groupEntriesForLookup(entries: ChangelogEntry[]): {
+    groups: CandidateGroup[];
+    passthrough: ChangelogEntry[];
+};
+export declare function fetchPullRequestByNumber(prNumber: number, ownerRepo: string, deps: AnnotateChangelogDeps): PullRequestInfo | null;
+export declare function fetchPullRequestBySha(sha: string, ownerRepo: string, deps: AnnotateChangelogDeps): PullRequestInfo | null;
+export declare function resolvePullRequestGroups(groups: CandidateGroup[], ownerRepo: string, deps: AnnotateChangelogDeps): {
+    resolved: ResolvedGroup[];
+    unresolved: ChangelogEntry[];
+};
+export declare function extractStructuredChangelogNotes(body: string | null | undefined, options?: {
+    prNumber?: number;
+    warn?: (message: string) => void;
+}): ChangelogNote[];
+export declare function renderAnnotatedBody(parsed: ParsedUnreleased, resolvedGroups: ResolvedGroup[], repoUrl: string, deps: AnnotateChangelogDeps): string | null;
+export declare function annotateChangelog(deps: AnnotateChangelogDeps): void;
+export {};

package/dist/types/check-pr-status.d.ts

@@ -12,12 +12,14 @@
  */
 import type { ExecSyncOptions } from 'node:child_process';
 export type ChangelogStatus = 'updated' | 'skipped' | 'missing';
+export type ChangelogBlockStatus = 'present' | 'absent' | 'unknown';
 export interface PrCheckResult {
     baseRef: string | null;
     headRef: string;
     changedFiles: string[];
     commits: string[];
     changelogStatus: ChangelogStatus;
+    changelogBlock: ChangelogBlockStatus;
     skipChangelogMarker: boolean;
     hasConventionalCommits: boolean;
 }
@@ -41,6 +43,7 @@ export declare function evaluateChangelogStatus(changedFiles: string[], changelo
     status: ChangelogStatus;
     skipMarker: boolean;
 };
+export declare function evaluateChangelogBlockStatus(deps: PrCheckDeps): ChangelogBlockStatus;
 export declare function getDiffRange(baseRef: string | null, headRef: string): string;
 export declare function runPrCheck(args: {
     base?: string | null;

package/dist/types/doctor.d.ts

@@ -13,7 +13,7 @@
  *   node dist/scripts/doctor.js --json
  */
 import type { ExecSyncOptions } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 export type CheckStatus = 'PASS' | 'WARN' | 'FAIL';
 export interface CheckResult {
     name: string;
@@ -58,12 +58,18 @@ export interface DoctorReport {
 export interface DoctorDeps {
     execSync: (command: string, options?: ExecSyncOptions) => Buffer | string;
     existsSync: typeof existsSync;
+    readdirSync: typeof readdirSync;
     readFileSync: typeof readFileSync;
     getEnv: (key: string) => string | undefined;
+    cwd: () => string;
 }
 export declare function safeExec(command: string, deps: DoctorDeps): string | null;
 export declare function collectEnvironment(deps: DoctorDeps): EnvironmentSection;
 export declare function inspectRepository(deps: DoctorDeps): RepositorySection;
+export declare function validatePublishWorkflowFreshness(deps: DoctorDeps): CheckResult | null;
+export declare function workflowHasIdTokenWritePermission(content: string): boolean;
+export declare function validateNpmProvenanceReadiness(deps: DoctorDeps): CheckResult | null;
+export declare function validateWorkspaceDependencyRanges(deps: DoctorDeps): CheckResult | null;
 export declare function validateConfiguration(deps: DoctorDeps): ConfigurationSection;
 /**
  * Runs Check A (peer range satisfaction) and Check B (major version advisor).

package/dist/types/lib/semver-utils.d.ts

@@ -1,6 +1,7 @@
 /**
  * Semantic versioning utility functions
  */
+type RangeEvaluation = boolean | null;
 /**
  * Validate if a string is a valid semantic version
  *
@@ -16,3 +17,17 @@ export declare function isValidSemver(version: string): boolean;
  * @returns Normalized version without 'v' prefix
  */
 export declare function validateAndNormalizeSemver(version: string): string;
+/**
+ * Check whether a dependency range includes a concrete workspace package version.
+ *
+ * This intentionally supports only the small zero-dependency subset doctor needs:
+ * workspace: protocol ranges, exact versions, ^, ~, >=, and OR-joined (`||`)
+ * combinations of those forms. Unknown syntax returns null so advisory checks can
+ * skip it without producing false warnings.
+ *
+ * @param range Dependency range string from package.json
+ * @param version Concrete workspace package version
+ * @returns true/false when evaluated, null when the syntax is outside the supported subset
+ */
+export declare function rangeIncludesVersion(range: string, version: string): RangeEvaluation;
+export {};

package/dist/types/lib/workflow-template.d.ts

@@ -0,0 +1,14 @@
+import type { PathLike } from 'node:fs';
+export declare const GENERATED_WORKFLOW_MARKER = "# Generated by: release-it-preset init --with-workflows";
+export interface WorkflowTemplateDeps {
+    existsSync: (path: PathLike) => boolean;
+    readFileSync: (path: PathLike, encoding: BufferEncoding) => string | Buffer;
+}
+export interface WorkflowTemplateReadResult {
+    path: string;
+    content: string;
+}
+export declare function getWorkflowTemplateCandidates(moduleUrl?: string): string[];
+export declare function readWorkflowTemplate(deps: WorkflowTemplateDeps, moduleUrl?: string): WorkflowTemplateReadResult;
+export declare function hasGeneratedWorkflowMarker(content: string): boolean;
+export declare function normalizeWorkflowContent(content: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oorabona/release-it-preset",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Release tooling for solo and small-team JS maintainers: human-curated changelogs, OIDC zero-config publishing, recovery presets, monorepo support, pre-release diagnostics.",
   "type": "module",
   "keywords": [
@@ -97,10 +97,12 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.4.13",
-    "@types/node": "^25.6.0",
+    "@release-it-plugins/workspaces": "^5.0.3",
+    "@types/node": "^25.9.2",
     "@vitest/coverage-v8": "^4.1.5",
     "nano-staged": "^1.0.2",
     "release-it": "^20.0.1",
+    "release-it19": "npm:release-it@^19.2.4",
     "rimraf": "^6.1.3",
     "tsx": "^4.21.0",
     "typescript": "^6.0.3",
@@ -110,5 +112,10 @@
   "engines": {
     "node": ">=20.19.0"
   },
-  "packageManager": "pnpm@10.17.1"
+  "packageManager": "pnpm@10.17.1",
+  "pnpm": {
+    "overrides": {
+      "undici@<6.24.0": ">=6.24.0 <7"
+    }
+  }
 }

package/scripts/templates/workflows/release.yml.template

@@ -21,8 +21,7 @@ on:
         required: false
 
 permissions:
-  contents: write
-  id-token: write  # Required for npm OIDC trusted publishing
+  contents: read
 
 env:
   NODE_VERSION: '24'  # npm >= 11.5.1 ships with Node 24, required for OIDC trusted publishing
@@ -30,6 +29,9 @@ env:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write  # Required for npm OIDC trusted publishing
     steps:
       - name: Checkout code
         uses: actions/checkout@v6