@pob/version 1.2.1 → 1.3.0

package/src/commands/version.ts

@@ -78,6 +78,7 @@ export interface VersionCommandOptions {
   cwdIsRoot?: boolean;
   packageManager?: "bun" | "yarn";
   publish?: boolean;
+  publishProvenance?: boolean;
 }
 
 interface BumpableWorkspace {
@@ -807,7 +808,9 @@ export const versionCommandAction = async (
       }
       await logger.group("Publishing packages", async () => {
         if (packageManager.publishWorkspaces) {
-          await packageManager.publishWorkspaces(rootWorkspace);
+          await packageManager.publishWorkspaces(rootWorkspace, {
+            provenance: options.publishProvenance,
+          });
         } else {
           for (const [workspace] of bumpedWorkspaces.entries()) {
             if (workspace.pkg.private) {
@@ -818,7 +821,9 @@ export const versionCommandAction = async (
             }
 
             logger.info(`Publishing ${getWorkspaceName(workspace)}`);
-            await packageManager.publish(workspace);
+            await packageManager.publish(workspace, {
+              provenance: options.publishProvenance,
+            });
           }
         }
       });
@@ -843,6 +848,7 @@ export const Defaults: VersionCommandOptions = {
   gitRemote: "origin",
   verbose: false,
   publish: false,
+  publishProvenance: false,
 };
 
 export default program
@@ -936,4 +942,10 @@ export default program
     ).choices(["bun", "yarn"]),
   )
   .addOption(new Option("--publish", "Publish after versioning").default(false))
+  .addOption(
+    new Option(
+      "--publish-provenance",
+      "Generate provenance attestation when publishing (if supported by package manager)",
+    ).default(false),
+  )
   .action((options) => versionCommandAction(options));

package/src/pm/BunPackageManager.ts

@@ -1,12 +1,29 @@
 import { execCommand } from "../utils/execCommand.ts";
-import type { PackageManager } from "./PackageManager.ts";
+import type {
+  PackageManager,
+  PackageManagerPublishOptions,
+} from "./PackageManager.ts";
 
 export const BunPackageManager: PackageManager = {
   async runScript(workspace, scriptName) {
     await execCommand(workspace, ["bun", "run", scriptName], "inherit");
   },
 
-  async publish(workspace) {
-    await execCommand(workspace, ["bun", "publish"], "inherit");
+  async publish(workspace, options?: PackageManagerPublishOptions) {
+    if (options?.provenance) {
+      // Use bun pack for provenance support
+      // See: https://github.com/oven-sh/bun/issues/15601
+      const packResult = await execCommand(workspace, ["bun", "pack"]);
+      // Extract .tgz filename from output (find line ending with .tgz)
+      const lines = packResult.stdout.trim().split("\n");
+      const tgzPath =
+        lines.find((line) => line.endsWith(".tgz")) ?? lines.at(-1);
+      if (!tgzPath) {
+        throw new Error("Failed to extract .tgz path from bun pack output");
+      }
+      await execCommand(workspace, ["npm", "publish", "--provenance", tgzPath]);
+    } else {
+      await execCommand(workspace, ["bun", "publish"], "inherit");
+    }
   },
 };

package/src/pm/PackageManager.ts

@@ -3,11 +3,21 @@ import type { Workspace } from "../utils/packageUtils.ts";
 import { BunPackageManager } from "./BunPackageManager.ts";
 import { YarnPackageManager } from "./YarnPackageManager.ts";
 
+export interface PackageManagerPublishOptions {
+  provenance?: boolean;
+}
+
 export interface PackageManager {
   installOnPackageContentChange?: (rootWorkspace: Workspace) => Promise<void>;
   runScript: (workspace: Workspace, scriptName: string) => Promise<void>;
-  publish: (workspace: Workspace) => Promise<void>;
-  publishWorkspaces?: (rootWorkspace: Workspace) => Promise<void>;
+  publish: (
+    workspace: Workspace,
+    options?: PackageManagerPublishOptions,
+  ) => Promise<void>;
+  publishWorkspaces?: (
+    rootWorkspace: Workspace,
+    options?: PackageManagerPublishOptions,
+  ) => Promise<void>;
 }
 
 export const autoDetectPackageManager = (

package/src/pm/YarnPackageManager.ts

@@ -1,6 +1,9 @@
 import { execCommand } from "../utils/execCommand.ts";
 import type { Workspace } from "../utils/packageUtils.ts";
-import type { PackageManager } from "./PackageManager.ts";
+import type {
+  PackageManager,
+  PackageManagerPublishOptions,
+} from "./PackageManager.ts";
 
 export const YarnPackageManager: PackageManager = {
   async installOnPackageContentChange(rootWorkspace: Workspace) {
@@ -11,24 +14,31 @@ export const YarnPackageManager: PackageManager = {
     await execCommand(workspace, ["yarn", "run", scriptName], "inherit");
   },
 
-  async publish(workspace: Workspace) {
-    await execCommand(workspace, ["yarn", "npm", "publish"], "inherit");
+  async publish(workspace: Workspace, options?: PackageManagerPublishOptions) {
+    const publishArgs = ["yarn", "npm", "publish"];
+    if (options?.provenance) {
+      publishArgs.push("--provenance");
+    }
+    await execCommand(workspace, publishArgs, "inherit");
   },
 
-  async publishWorkspaces(rootWorkspace: Workspace) {
-    await execCommand(
-      rootWorkspace,
-      [
-        "yarn",
-        "workspaces",
-        "foreach",
-        "--all",
-        "--parallel",
-        "--no-private",
-        "npm",
-        "publish",
-      ],
-      "inherit",
-    );
+  async publishWorkspaces(
+    rootWorkspace: Workspace,
+    options?: PackageManagerPublishOptions,
+  ) {
+    const publishArgs = [
+      "yarn",
+      "workspaces",
+      "foreach",
+      "--all",
+      "--parallel",
+      "--no-private",
+      "npm",
+      "publish",
+    ];
+    if (options?.provenance) {
+      publishArgs.push("--provenance");
+    }
+    await execCommand(rootWorkspace, publishArgs, "inherit");
   },
 };

package/.editorconfig

@@ -1,13 +0,0 @@
-# EditorConfig helps developers define and maintain consistent
-# coding styles between different editors and IDEs
-# http://editorconfig.org
-
-root = true
-
-[*]
-indent_style = space
-indent_size = 2
-end_of_line = lf
-charset = utf-8
-trim_trailing_whitespace = true
-insert_final_newline = true

package/.yo-rc.json

@@ -1,13 +0,0 @@
-{
-  "pob": {
-    "app": {
-      "type": "node",
-      "testing": true,
-      "codecov": true,
-      "distribute": true
-    },
-    "project": {
-      "type": "app"
-    }
-  }
-}

package/__fixtures__/bun-basic/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "bun-basic",
-  "version": "1.0.0"
-}

package/__fixtures__/bun-no-version/package.json

@@ -1,3 +0,0 @@
-{
-  "name": "bun-no-version"
-}

package/__fixtures__/yarn-basic/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "yarn-basic",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-basic/yarn.lock

@@ -1,12 +0,0 @@
-# This file is generated by running "yarn install" inside your project.
-# Manual changes might be lost - proceed with caution!
-
-__metadata:
-  version: 8
-  cacheKey: 10c0
-
-"basic@workspace:.":
-  version: 0.0.0-use.local
-  resolution: "basic@workspace:."
-  languageName: unknown
-  linkType: soft

package/__fixtures__/yarn-monorepo/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "yarn-monorepo",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

package/__fixtures__/yarn-monorepo/packages/package-1/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-1",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo/packages/package-2/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "package-2",
-  "version": "1.0.0",
-  "dependencies": {
-    "package-1": "^1.0.0"
-  }
-}

package/__fixtures__/yarn-monorepo/packages/package-3/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "package-3",
-  "version": "1.0.0",
-  "devDependencies": {
-    "package-2": "^1.0.0"
-  }
-}

package/__fixtures__/yarn-monorepo/packages/package-4/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "package-4",
-  "version": "1.0.0",
-  "dependencies": {
-    "package-1": "^0.0.0"
-  }
-}

package/__fixtures__/yarn-monorepo/packages/package-5/package.json

@@ -1,8 +0,0 @@
-{
-  "name": "package-5",
-  "private": true,
-  "version": "1.0.0",
-  "dependencies": {
-    "package-1": "^1.0.0"
-  }
-}

package/__fixtures__/yarn-monorepo-duplicate-names/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "monorepo-duplicate-names",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

package/__fixtures__/yarn-monorepo-duplicate-names/packages/pkg-a/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "duplicate-name",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-duplicate-names/packages/pkg-b/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "duplicate-name",
-  "version": "2.0.0"
-}

package/__fixtures__/yarn-monorepo-invalid-package-json/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "monorepo-invalid-package-json",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

package/__fixtures__/yarn-monorepo-invalid-package-json/packages/pkg-with-invalid-json/package.json

@@ -1,5 +0,0 @@
-{
-  "name": "invalid-json-package",
-  "version": "1.0.0",
-  // invalid comment
-}

package/__fixtures__/yarn-monorepo-nested/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "monorepo-nested",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*",
-    "packages/nested-1/packages/*",
-    "packages/**"
-  ]
-}

package/__fixtures__/yarn-monorepo-nested/packages/deep-nested/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "deep-nested-package",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-nested/packages/nested-1/packages/package-nested.json

@@ -1,4 +0,0 @@
-{
-  "name": "nested-package-2",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-nested/packages/nested-1/packages/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "nested-package-2",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-nested/packages/package-1/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "nested-package-1",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-no-name/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "monorepo-no-name",
-  "version": "1.0.0",
-  "workspaces": [
-    "packages/*"
-  ]
-}

package/__fixtures__/yarn-monorepo-no-name/packages/no-name-package/package.json

@@ -1,3 +0,0 @@
-{
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-object-form/package.json

@@ -1,9 +0,0 @@
-{
-  "name": "monorepo-object-form",
-  "version": "1.0.0",
-  "workspaces": {
-    "packages": [
-      "packages/*"
-    ]
-  }
-}

package/__fixtures__/yarn-monorepo-object-form/packages/package-1/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-1",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-object-form/packages/package-2/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-2",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-object-form/packages/package-3/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-3",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-object-form/packages/package-4/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-4",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-monorepo-object-form/packages/package-5/package.json

@@ -1,4 +0,0 @@
-{
-  "name": "package-5",
-  "version": "1.0.0"
-}

package/__fixtures__/yarn-no-version/package.json

@@ -1,3 +0,0 @@
-{
-  "name": "no-version"
-}

package/__fixtures__/yarn-with-lifecycle/package.json

@@ -1,7 +0,0 @@
-{
-  "name": "with-lifecycle",
-  "version": "1.0.0",
-  "scripts": {
-    "preversion": "echo preversion"
-  }
-}

package/__fixtures__/yarn-with-lifecycle/yarn.lock

@@ -1,11 +0,0 @@
-# This file is generated by running "yarn install" inside your project.
-# Manual changes might be lost - proceed with caution!
-
-__metadata:
-  version: 6
-
-"with-lifecycle@workspace:.":
-  version: 0.0.0-use.local
-  resolution: "with-lifecycle@workspace:."
-  languageName: unknown
-  linkType: soft

package/rollup.config.mjs

@@ -1,12 +0,0 @@
-import { dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import createRollupConfig from "@pob/rollup-esbuild/createRollupConfig.js";
-import run from "@pob/rollup-esbuild/plugin-run.cjs";
-
-const watch = process.env.ROLLUP_WATCH === "true";
-
-export default createRollupConfig({
-  cwd: dirname(fileURLToPath(import.meta.url)),
-  outDirectory: "dist",
-  plugins: [watch && run({ execArgv: ["--enable-source-maps"] })],
-});

package/tsconfig.json

@@ -1,21 +0,0 @@
-{
-  "extends": [
-    "@pob/root/tsconfigs/strict.json",
-    "@pob/root/tsconfigs/targets/rollup-node-22.json"
-  ],
-  "include": ["src/**/*.ts"],
-  "compilerOptions": {
-    "rootDir": "src",
-    "baseUrl": "" /* Base directory to resolve non-absolute module names. */,
-    "noEmit": true,
-    "tsBuildInfoFile": "node_modules/.cache/tsc/tsbuildinfo",
-    "incremental": true,
-
-    "resolveJsonModule": true,
-
-    "paths": {
-      "@pob/rollup-esbuild": ["../../@pob/rollup-esbuild/lib"],
-      "@pob/rollup-esbuild/*": ["../../@pob/rollup-esbuild/lib/*"]
-    }
-  }
-}

package/vitest.config.js

@@ -1,9 +0,0 @@
-import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    globals: true,
-    environment: "node",
-    include: ["src/**/*.test.ts"],
-  },
-});