@open-tomato/rafa 0.45.0 → 0.46.0

package/dist/release-templates/release-bot-fragment.yml

@@ -0,0 +1,153 @@
+# The rafa release bot fragment workflow: the fragment of a Dependabot
+# pull request, for levels 3 and 4 of the release ladder.
+#
+# Written into a project's `.github/workflows/` by `writeReleaseWorkflow`
+# (`src/release/templates.ts`) at levels 3 and 4 while
+# `.github/dependabot.yml` exists. A bot pull request has no wrap-up to
+# write its fragment, so this workflow writes one with
+# `rafa release fragment --plan=dependabot-<number>`, at `patch` when
+# `dependabot/fetch-metadata` reads the update as `direct:production` and
+# at `none` otherwise, commits it as `chore: release fragment
+# dependabot-<number>` and pushes it to the pull request's branch. A
+# branch that already adds a fragment named for the pull request
+# (`dependabot-<number>.md`, or `-2`, `-3` and on) is left as it is.
+#
+# A `pull_request` run started by Dependabot gets a read-only token, so
+# this runs on `pull_request_target`, in the base branch's context with a
+# writable one. That is why nothing from the pull request's branch runs
+# here: the branch is checked out under `head/` only to add one file and
+# push, while bun is set up from, and rafa installed or run from, the
+# base branch's checkout under `base/`. rafa reads its config (a
+# `rafa.config.ts` included) and loads its modules from the directory it
+# runs in, so the fragment is written in `base/` and copied to `head/`.
+#
+# A commit pushed with the workflow's GITHUB_TOKEN starts no other
+# workflow run, and Dependabot stops rebasing a branch someone else has
+# pushed to; a rebase it is asked for drops the fragment commit, and the
+# `synchronize` run that follows writes it again.
+#
+# rafa needs a config with `release.enabled: true`, and the base's
+# checkout may hold none: when none of `rafa.config.ts`, `rafa.config.mjs`
+# and `.rafa/config.yaml` is there, the workflow writes
+# `.rafa/config.yaml` with that key in `base/`. A committed config is left
+# as it is, so a project that needs other release keys in CI commits
+# them. The written config stays in the runner's checkout: the commit
+# stages the fragment alone.
+#
+# rafa runs from the base's checkout when the project is rafa itself (its
+# manifest names `@open-tomato/rafa` and git tracks `src/rafa.ts`), and
+# from a global install otherwise, so one file serves both.
+name: Release bot fragment
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions:
+  contents: write
+  pull-requests: read
+
+concurrency:
+  group: release-bot-fragment-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  fragment:
+    if: >-
+      github.actor == 'dependabot[bot]'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Fetch metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v2
+
+      - name: Checkout the base
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          path: base
+          fetch-depth: 0
+
+      - name: Checkout the head
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.ref }}
+          path: head
+          fetch-depth: 0
+          persist-credentials: true
+
+      - name: Look for the fragment
+        id: held
+        shell: bash
+        working-directory: head
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          added=$(git diff --name-only --diff-filter=A "origin/$BASE_REF...HEAD")
+          if printf '%s\n' "$added" | grep -Eq "(^|/)dependabot-$PR_NUMBER(-[0-9]+)?\.md$"; then
+            echo "held=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "held=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up bun
+        if: steps.held.outputs.held == 'false'
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: base/package.json
+
+      - name: Write the CI config
+        if: steps.held.outputs.held == 'false'
+        shell: bash
+        working-directory: base
+        run: |
+          if [ ! -f rafa.config.ts ] && [ ! -f rafa.config.mjs ] && [ ! -f .rafa/config.yaml ]; then
+            mkdir -p .rafa
+            printf '%s\n' '# Written by the Release bot fragment workflow: the checkout holds no rafa config.' 'release:' '  enabled: true' > .rafa/config.yaml
+          fi
+
+      - name: Write the fragment
+        id: write
+        if: steps.held.outputs.held == 'false'
+        shell: bash
+        working-directory: base
+        env:
+          DEPENDENCY_TYPE: ${{ steps.metadata.outputs.dependency-type }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          if [ "$DEPENDENCY_TYPE" = 'direct:production' ]; then
+            level=patch
+          else
+            level=none
+          fi
+          name=$(node -p "require('./package.json').name")
+          if [ "$name" = '@open-tomato/rafa' ] && git ls-files --error-unmatch src/rafa.ts > /dev/null 2>&1; then
+            bun install --frozen-lockfile
+            written=$(bun src/rafa.ts release fragment "--plan=dependabot-$PR_NUMBER" "--level=$level" "--title=$PR_TITLE" | tail -n 1)
+          else
+            bun install -g @open-tomato/rafa
+            export PATH="${BUN_INSTALL:-$HOME/.bun}/bin:$PATH"
+            written=$(rafa release fragment "--plan=dependabot-$PR_NUMBER" "--level=$level" "--title=$PR_TITLE" | tail -n 1)
+          fi
+          mkdir -p "../head/$(dirname "$written")"
+          cp "$written" "../head/$written"
+          echo "path=$written" >> "$GITHUB_OUTPUT"
+
+      - name: Commit and push
+        if: steps.held.outputs.held == 'false'
+        shell: bash
+        working-directory: head
+        env:
+          FRAGMENT: ${{ steps.write.outputs.path }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+          git add -- "$FRAGMENT"
+          git commit -m "chore: release fragment dependabot-$PR_NUMBER"
+          git push origin "HEAD:$HEAD_REF"

package/dist/release-templates/release-publish.yml

@@ -0,0 +1,110 @@
+# The rafa release publish workflow: level 2 of the release ladder.
+#
+# Written into a project's `.github/workflows/` by `writeReleaseWorkflow`
+# (`src/release/templates.ts`) for `release.publish: ci`. A pushed tag,
+# or a workflow that tags in its own run and calls this one with the tag
+# as `ref`, checks the tag out, runs the gates and then
+# `rafa release publish`, which publishes every release unit whose tag
+# points at the checked-out commit and skips a version the registry
+# already holds.
+#
+# npm trusted publishing needs npm 11.5.1 or newer, `id-token: write` on
+# the job, and a trusted publisher configured on npmjs.com for each
+# package, naming this repository and this workflow file. npm attaches
+# provenance on a trusted publish, so no token and no flag are set here.
+#
+# The publish job runs only when the repository variable
+# `RAFA_RELEASE_PUBLISH` is `ci`: with it unset or holding anything else,
+# GitHub skips the job, and a skipped job does not fail the run. Set it
+# under Settings, Secrets and variables, Actions, Variables, or with
+# `gh variable set RAFA_RELEASE_PUBLISH --body ci`.
+#
+# A tag pushed with a workflow's GITHUB_TOKEN starts no other workflow
+# run, so a workflow that tags calls this one through `workflow_call`
+# instead of waiting for the `push` trigger.
+#
+# rafa needs a config with `release.enabled: true`, and the checkout may
+# hold none: when none of `rafa.config.ts`, `rafa.config.mjs` and
+# `.rafa/config.yaml` is there, the workflow writes `.rafa/config.yaml`
+# with that key. A committed config is left as it is, so a project that
+# needs other release keys in CI commits them.
+#
+# rafa runs from the checkout when the project is rafa itself (its
+# manifest names `@open-tomato/rafa` and git tracks `src/rafa.ts`), and
+# from a global install otherwise, so one file serves both.
+name: Release publish
+
+on:
+  push:
+    tags: ['**']
+  workflow_call:
+    inputs:
+      ref:
+        description: The tag or commit to publish from.
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    if: vars.RAFA_RELEASE_PUBLISH == 'ci'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref || github.ref }}
+          fetch-depth: 0
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Set up node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+          registry-url: https://registry.npmjs.org
+
+      - name: Upgrade npm
+        run: npm install -g npm@latest && npm --version
+
+      - name: Install
+        run: bun install --frozen-lockfile
+
+      - name: Test
+        if: ${{ !cancelled() }}
+        run: bun test
+
+      - name: Lint
+        if: ${{ !cancelled() }}
+        run: bunx eslint .
+
+      - name: Types
+        if: ${{ !cancelled() }}
+        run: bun run check-types
+
+      - name: Write the CI config
+        shell: bash
+        run: |
+          if [ ! -f rafa.config.ts ] && [ ! -f rafa.config.mjs ] && [ ! -f .rafa/config.yaml ]; then
+            mkdir -p .rafa
+            printf '%s\n' '# Written by the Release publish workflow: the checkout holds no rafa config.' 'release:' '  enabled: true' > .rafa/config.yaml
+          fi
+
+      - name: Publish
+        shell: bash
+        run: |
+          name=$(node -p "require('./package.json').name")
+          if [ "$name" = '@open-tomato/rafa' ] && git ls-files --error-unmatch src/rafa.ts > /dev/null 2>&1; then
+            bun src/rafa.ts release publish
+          else
+            bun install -g @open-tomato/rafa
+            export PATH="${BUN_INSTALL:-$HOME/.bun}/bin:$PATH"
+            rafa release publish
+          fi

package/dist/release-templates/release-settle.yml

@@ -0,0 +1,122 @@
+# The rafa release settle workflow: level 4 of the release ladder.
+#
+# Written into a project's `.github/workflows/` by `writeReleaseWorkflow`
+# (`src/release/templates.ts`) for `release.settle: push` with
+# `release.tag: settle` and `release.publish: ci`. Every push to the base
+# branch checks it out with full history, sets a git identity for the
+# release commit, and runs `rafa release settle`, which folds the waiting
+# fragments into a release commit, pushes it to the base and tags it.
+# A push with no fragment waiting settles nothing and exits 0.
+#
+# The settle job runs on a push to the repository's default branch. When
+# `pr.base` names another branch, write that branch's name in place of
+# `github.event.repository.default_branch` in the job's `if`.
+#
+# A commit or tag pushed with the workflow's GITHUB_TOKEN starts no other
+# workflow run, so the release commit settle pushes does not run this
+# workflow again, and the publish job calls `release-publish.yml` through
+# `workflow_call` with the release commit as `ref` instead of waiting for
+# its `push: tags` trigger. It runs only when settle pushed a release
+# commit and tagged it; the job grants `id-token: write` for npm trusted
+# publishing, and the settle job needs only `contents: write`.
+#
+# The publish job runs only when the repository variable
+# `RAFA_RELEASE_PUBLISH` is `ci`: with it unset or holding anything else,
+# GitHub skips the job, and a skipped job does not fail the run. Set it
+# under Settings, Secrets and variables, Actions, Variables, or with
+# `gh variable set RAFA_RELEASE_PUBLISH --body ci`.
+# Settling and tagging run either way; publishing waits for the switch.
+#
+# rafa needs a config with `release.enabled: true`, and the checkout may
+# hold none: when none of `rafa.config.ts`, `rafa.config.mjs` and
+# `.rafa/config.yaml` is there, the workflow writes `.rafa/config.yaml`
+# with that key. A committed config is left as it is, so a project that
+# needs other release keys in CI commits them.
+#
+# rafa runs from the checkout when the project is rafa itself (its
+# manifest names `@open-tomato/rafa` and git tracks `src/rafa.ts`), and
+# from a global install otherwise, so one file serves both.
+name: Release settle
+
+on:
+  push:
+    branches: ['**']
+
+permissions:
+  contents: write
+
+concurrency:
+  group: release-settle
+  cancel-in-progress: false
+
+jobs:
+  settle:
+    if: github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      release: ${{ steps.settle.outputs.release }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+          fetch-depth: 0
+
+      - name: Set git identity
+        run: |
+          git config user.name 'github-actions[bot]'
+          git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Write the CI config
+        shell: bash
+        run: |
+          if [ ! -f rafa.config.ts ] && [ ! -f rafa.config.mjs ] && [ ! -f .rafa/config.yaml ]; then
+            mkdir -p .rafa
+            printf '%s\n' '# Written by the Release settle workflow: the checkout holds no rafa config.' 'release:' '  enabled: true' > .rafa/config.yaml
+          fi
+
+      - name: Settle
+        id: settle
+        shell: bash
+        run: |
+          result="${RUNNER_TEMP:-/tmp}/settle.json"
+          name=$(node -p "require('./package.json').name")
+          if [ "$name" = '@open-tomato/rafa' ] && git ls-files --error-unmatch src/rafa.ts > /dev/null 2>&1; then
+            bun install --frozen-lockfile
+            bun src/rafa.ts release settle --output=json > "$result"
+          else
+            bun install -g @open-tomato/rafa
+            export PATH="${BUN_INSTALL:-$HOME/.bun}/bin:$PATH"
+            rafa release settle --output=json > "$result"
+          fi
+          cat "$result"
+          node -e '
+            const fs = require("fs");
+            const events = fs.readFileSync(process.argv[1], "utf8").split("\n").flatMap((line) => {
+              try { return [JSON.parse(line)]; } catch { return []; }
+            });
+            const data = (events.find((event) => event && event.type === "result") || {}).data || {};
+            const pushed = data.delivered && data.delivered.outcome && data.delivered.outcome.outcome === "pushed";
+            const tagged = data.tag && data.tag.outcome === "tagged" && data.tag.tags.length > 0;
+            const release = pushed && tagged
+              ? data.tag.commit
+              : "";
+            fs.appendFileSync(process.env.GITHUB_OUTPUT, `release=${release}\n`);
+          ' "$result"
+
+  publish:
+    needs: settle
+    if: needs.settle.outputs.release != '' && vars.RAFA_RELEASE_PUBLISH == 'ci'
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/release-publish.yml
+    with:
+      ref: ${{ needs.settle.outputs.release }}
+    secrets: inherit

package/dist/release-templates/release-tag.yml

@@ -0,0 +1,102 @@
+# The rafa release tag workflow: level 3 of the release ladder.
+#
+# Written into a project's `.github/workflows/` by `writeReleaseWorkflow`
+# (`src/release/templates.ts`) for `release.settle: pr` with
+# `release.tag: settle` and `release.publish: ci`. Settle never tags a
+# `pr` delivery: it pushes the release commit to `rafa/release` and opens
+# one release pull request. When that pull request merges, by any merge
+# button, this workflow checks the base branch out at the merge commit,
+# runs `rafa release tag --push`, and then publishes.
+#
+# It runs only on the release pull request's merge: a closed pull
+# request that did not merge, or one from another head or from a fork,
+# runs nothing, since `rafa release tag` refuses `tagged` (exit 1) once
+# every unit is tagged.
+#
+# A tag pushed with the workflow's GITHUB_TOKEN starts no other workflow
+# run, so the publish job calls `release-publish.yml` through
+# `workflow_call` with the merge commit as `ref` instead of waiting for
+# its `push: tags` trigger. That job grants `id-token: write` for npm
+# trusted publishing; the tag job needs only `contents: write`.
+#
+# The publish job runs only when the repository variable
+# `RAFA_RELEASE_PUBLISH` is `ci`: with it unset or holding anything else,
+# GitHub skips the job, and a skipped job does not fail the run. Set it
+# under Settings, Secrets and variables, Actions, Variables, or with
+# `gh variable set RAFA_RELEASE_PUBLISH --body ci`.
+# Tagging runs either way; publishing waits for the switch.
+#
+# rafa needs a config with `release.enabled: true`, and the checkout may
+# hold none: when none of `rafa.config.ts`, `rafa.config.mjs` and
+# `.rafa/config.yaml` is there, the workflow writes `.rafa/config.yaml`
+# with that key. A committed config is left as it is, so a project that
+# needs other release keys in CI commits them.
+#
+# rafa runs from the checkout when the project is rafa itself (its
+# manifest names `@open-tomato/rafa` and git tracks `src/rafa.ts`), and
+# from a global install otherwise, so one file serves both.
+name: Release tag
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: write
+
+jobs:
+  tag:
+    if: >-
+      github.event.pull_request.merged == true
+      && github.event.pull_request.head.ref == 'rafa/release'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.base.ref }}
+          fetch-depth: 0
+
+      - name: Move to the merge commit
+        env:
+          MERGE_COMMIT: ${{ github.event.pull_request.merge_commit_sha }}
+        run: git reset --hard "$MERGE_COMMIT"
+
+      - name: Set up bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version-file: package.json
+
+      - name: Write the CI config
+        shell: bash
+        run: |
+          if [ ! -f rafa.config.ts ] && [ ! -f rafa.config.mjs ] && [ ! -f .rafa/config.yaml ]; then
+            mkdir -p .rafa
+            printf '%s\n' '# Written by the Release tag workflow: the checkout holds no rafa config.' 'release:' '  enabled: true' > .rafa/config.yaml
+          fi
+
+      - name: Tag
+        shell: bash
+        run: |
+          name=$(node -p "require('./package.json').name")
+          if [ "$name" = '@open-tomato/rafa' ] && git ls-files --error-unmatch src/rafa.ts > /dev/null 2>&1; then
+            bun install --frozen-lockfile
+            bun src/rafa.ts release tag --push --output=json
+          else
+            bun install -g @open-tomato/rafa
+            export PATH="${BUN_INSTALL:-$HOME/.bun}/bin:$PATH"
+            rafa release tag --push --output=json
+          fi
+
+  publish:
+    needs: tag
+    if: vars.RAFA_RELEASE_PUBLISH == 'ci'
+    permissions:
+      contents: read
+      id-token: write
+    uses: ./.github/workflows/release-publish.yml
+    with:
+      ref: ${{ github.event.pull_request.merge_commit_sha }}
+    secrets: inherit