@releasekit/publish 0.2.0-next.9 → 0.3.0-next.0

package/dist/cli.cjs

@@ -24,7 +24,7 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/cli.ts
-var import_core12 = require("@releasekit/core");
+var import_core13 = require("@releasekit/core");
 var import_commander = require("commander");
 
 // src/config.ts
@@ -52,14 +52,16 @@ function getDefaultConfig() {
       push: true,
       pushMethod: "auto",
       remote: "origin",
-      branch: "main"
+      branch: "main",
+      httpsTokenEnv: void 0,
+      skipHooks: false
     },
     githubRelease: {
       enabled: true,
       draft: true,
-      generateNotes: true,
-      perPackage: false,
-      prerelease: "auto"
+      perPackage: true,
+      prerelease: "auto",
+      releaseNotes: "auto"
     },
     verify: {
       npm: {
@@ -100,15 +102,16 @@ function toPublishConfig(config) {
       push: config.git.push ?? defaults.git.push,
       pushMethod: config.git.pushMethod ?? defaults.git.pushMethod,
       remote: config.git.remote ?? defaults.git.remote,
-      branch: config.git.branch ?? defaults.git.branch
+      branch: config.git.branch ?? defaults.git.branch,
+      httpsTokenEnv: config.git.httpsTokenEnv ?? defaults.git.httpsTokenEnv,
+      skipHooks: config.git.skipHooks ?? defaults.git.skipHooks
     } : defaults.git,
     githubRelease: {
       enabled: config.githubRelease?.enabled ?? defaults.githubRelease.enabled,
       draft: config.githubRelease?.draft ?? defaults.githubRelease.draft,
-      generateNotes: config.githubRelease?.generateNotes ?? defaults.githubRelease.generateNotes,
       perPackage: config.githubRelease?.perPackage ?? defaults.githubRelease.perPackage,
       prerelease: config.githubRelease?.prerelease ?? defaults.githubRelease.prerelease,
-      notesFile: config.githubRelease?.notesFile
+      releaseNotes: config.githubRelease?.releaseNotes ?? defaults.githubRelease.releaseNotes
     },
     verify: {
       npm: {
@@ -261,8 +264,20 @@ var import_core3 = require("@releasekit/core");
 // src/utils/exec.ts
 var import_node_child_process = require("child_process");
 var import_core2 = require("@releasekit/core");
+function redactArg(arg) {
+  try {
+    const url = new URL(arg);
+    if (url.username || url.password) {
+      url.username = url.username ? "***" : "";
+      url.password = url.password ? "***" : "";
+      return url.toString();
+    }
+  } catch {
+  }
+  return arg;
+}
 async function execCommand(file, args, options = {}) {
-  const displayCommand = options.label ?? [file, ...args].join(" ");
+  const displayCommand = options.label ?? [file, ...args.map(redactArg)].join(" ");
   if (options.dryRun) {
     (0, import_core2.info)(`[DRY RUN] Would execute: ${displayCommand}`);
     return { stdout: "", stderr: "", exitCode: 0 };
@@ -318,7 +333,7 @@ function detectNpmAuth() {
   if (process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
     return "oidc";
   }
-  if (process.env.NPM_TOKEN) {
+  if (process.env.NPM_TOKEN || process.env.NODE_AUTH_TOKEN) {
     return "token";
   }
   return null;
@@ -527,13 +542,17 @@ function topologicalSort(crates) {
 var path2 = __toESM(require("path"), 1);
 var import_core4 = require("@releasekit/core");
 async function runGitCommitStage(ctx) {
-  const { input, cliOptions, cwd } = ctx;
+  const { input, config, cliOptions, cwd } = ctx;
   const dryRun = cliOptions.dryRun;
+  const skipHooks = config.git.skipHooks ?? false;
   if (!input.commitMessage) {
     (0, import_core4.info)("No commit message provided, skipping git commit");
     return;
   }
   const filePaths = input.updates.map((u) => path2.resolve(cwd, u.filePath));
+  if (ctx.additionalFiles) {
+    filePaths.push(...ctx.additionalFiles.map((f) => path2.resolve(cwd, f)));
+  }
   if (filePaths.length === 0) {
     (0, import_core4.info)("No files to commit");
     return;
@@ -550,8 +569,13 @@ async function runGitCommitStage(ctx) {
       `git add failed: ${error instanceof Error ? error.message : String(error)}`
     );
   }
+  const commitArgs = ["commit"];
+  if (skipHooks) {
+    commitArgs.push("--no-verify");
+  }
+  commitArgs.push("-m", input.commitMessage);
   try {
-    await execCommand("git", ["commit", "-m", input.commitMessage], {
+    await execCommand("git", commitArgs, {
       cwd,
       dryRun,
       label: `git commit -m "${input.commitMessage}"`
@@ -589,6 +613,18 @@ async function runGitCommitStage(ctx) {
 
 // src/stages/git-push.ts
 var import_core5 = require("@releasekit/core");
+function toGithubAuthedUrl(remoteUrl, token) {
+  try {
+    const url = new URL(remoteUrl);
+    if (url.protocol !== "https:") return void 0;
+    if (url.host !== "github.com") return void 0;
+    url.username = "x-access-token";
+    url.password = token;
+    return url.toString();
+  } catch {
+    return void 0;
+  }
+}
 async function runGitPushStage(ctx) {
   const { config, cliOptions, cwd, output } = ctx;
   const dryRun = cliOptions.dryRun;
@@ -609,16 +645,26 @@ async function runGitPushStage(ctx) {
       pushMethod = "https";
     }
   }
+  const httpsTokenEnv = config.git.httpsTokenEnv;
+  const httpsToken = httpsTokenEnv ? process.env[httpsTokenEnv] : void 0;
   try {
+    let pushRemote = remote;
+    if (pushMethod === "https" && httpsToken) {
+      const remoteUrlResult = await execCommand("git", ["remote", "get-url", remote], { cwd, dryRun: false });
+      const authed = toGithubAuthedUrl(remoteUrlResult.stdout.trim(), httpsToken);
+      if (authed) {
+        pushRemote = authed;
+      }
+    }
     if (output.git.committed) {
-      await execCommand("git", ["push", remote, branch], {
+      await execCommand("git", ["push", pushRemote, branch], {
         cwd,
         dryRun,
         label: `git push ${remote} ${branch}`
       });
     }
     if (output.git.tags.length > 0) {
-      await execCommand("git", ["push", remote, "--tags"], {
+      await execCommand("git", ["push", pushRemote, "--tags"], {
         cwd,
         dryRun,
         label: `git push ${remote} --tags`
@@ -655,6 +701,62 @@ function getDistTag(version, defaultTag = "latest") {
 }
 
 // src/stages/github-release.ts
+function resolveNotes(notesSetting, tag, changelogs, pipelineNotes) {
+  if (notesSetting === "none") {
+    return { useGithubNotes: false };
+  }
+  if (notesSetting === "github") {
+    return { useGithubNotes: true };
+  }
+  if (notesSetting !== "auto") {
+    const body = readFileIfExists(notesSetting);
+    if (body) return { body, useGithubNotes: false };
+    (0, import_core6.debug)(`Notes file not found: ${notesSetting}, falling back to GitHub auto-notes`);
+    return { useGithubNotes: true };
+  }
+  if (pipelineNotes) {
+    const body = findNotesForTag(tag, pipelineNotes);
+    if (body) return { body, useGithubNotes: false };
+  }
+  const packageBody = formatChangelogForTag(tag, changelogs);
+  if (packageBody) {
+    return { body: packageBody, useGithubNotes: false };
+  }
+  return { useGithubNotes: true };
+}
+function isVersionOnlyTag(tag) {
+  return /^v?\d+\.\d+\.\d+/.test(tag);
+}
+function findNotesForTag(tag, notes) {
+  for (const [packageName, body] of Object.entries(notes)) {
+    if (tag.startsWith(`${packageName}@`) && body.trim()) {
+      return body;
+    }
+  }
+  const entries = Object.values(notes).filter((b) => b.trim());
+  if (entries.length === 1 && isVersionOnlyTag(tag)) return entries[0];
+  return void 0;
+}
+function readFileIfExists(filePath) {
+  try {
+    const content = fs3.readFileSync(filePath, "utf-8").trim();
+    return content || void 0;
+  } catch {
+    return void 0;
+  }
+}
+function formatChangelogForTag(tag, changelogs) {
+  if (changelogs.length === 0) return void 0;
+  const changelog = changelogs.find((c) => tag.startsWith(`${c.packageName}@`));
+  const target = changelog ?? (changelogs.length === 1 && isVersionOnlyTag(tag) ? changelogs[0] : void 0);
+  if (!target || target.entries.length === 0) return void 0;
+  const lines = [];
+  for (const entry of target.entries) {
+    const scope = entry.scope ? `**${entry.scope}:** ` : "";
+    lines.push(`- ${scope}${entry.description}`);
+  }
+  return lines.join("\n");
+}
 async function runGithubReleaseStage(ctx) {
   const { config, cliOptions, output } = ctx;
   const dryRun = cliOptions.dryRun;
@@ -667,19 +769,13 @@ async function runGithubReleaseStage(ctx) {
     (0, import_core6.info)("No tags available for GitHub release");
     return;
   }
-  let notesBody;
-  if (config.githubRelease.notesFile) {
-    try {
-      notesBody = fs3.readFileSync(config.githubRelease.notesFile, "utf-8");
-    } catch {
-      (0, import_core6.debug)(`Could not read notes file: ${config.githubRelease.notesFile}`);
-    }
-  }
   const firstTag = tags[0];
   if (!firstTag) return;
   const tagsToRelease = config.githubRelease.perPackage ? tags : [firstTag];
   for (const tag of tagsToRelease) {
-    const versionMatch = tag.match(/(\d+\.\d+\.\d+.*)$/);
+    const MAX_TAG_LENGTH = 1e3;
+    const truncatedTag = tag.length > MAX_TAG_LENGTH ? tag.slice(0, MAX_TAG_LENGTH) : tag;
+    const versionMatch = truncatedTag.match(/(\d{1,20}\.\d{1,20}\.\d{1,20}(?:[-+.]?[a-zA-Z0-9.-]{0,100})?)$/);
     const version = versionMatch?.[1] ?? "";
     const isPreRel = config.githubRelease.prerelease === "auto" ? version ? isPrerelease(version) : false : config.githubRelease.prerelease;
     const result = {
@@ -695,9 +791,15 @@ async function runGithubReleaseStage(ctx) {
     if (isPreRel) {
       ghArgs.push("--prerelease");
     }
-    if (notesBody) {
-      ghArgs.push("--notes", notesBody);
-    } else if (config.githubRelease.generateNotes) {
+    const { body, useGithubNotes } = resolveNotes(
+      config.githubRelease.releaseNotes,
+      tag,
+      ctx.input.changelogs,
+      ctx.releaseNotes
+    );
+    if (body) {
+      ghArgs.push("--notes", body);
+    } else if (useGithubNotes) {
       ghArgs.push("--generate-notes");
     }
     try {
@@ -721,16 +823,82 @@ async function runGithubReleaseStage(ctx) {
 }
 
 // src/stages/npm-publish.ts
-var fs5 = __toESM(require("fs"), 1);
-var path4 = __toESM(require("path"), 1);
-var import_core7 = require("@releasekit/core");
+var fs6 = __toESM(require("fs"), 1);
+var path5 = __toESM(require("path"), 1);
+var import_core8 = require("@releasekit/core");
 
-// src/utils/package-manager.ts
+// src/utils/npm-env.ts
 var fs4 = __toESM(require("fs"), 1);
+var os = __toESM(require("os"), 1);
 var path3 = __toESM(require("path"), 1);
+var import_core7 = require("@releasekit/core");
+function writeTempNpmrc(contents) {
+  const dir = fs4.mkdtempSync(path3.join(os.tmpdir(), "releasekit-npmrc-"));
+  const npmrcPath = path3.join(dir, ".npmrc");
+  fs4.writeFileSync(npmrcPath, contents, "utf-8");
+  return {
+    npmrcPath,
+    cleanup: () => {
+      try {
+        fs4.rmSync(dir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  };
+}
+function createNpmSubprocessIsolation(options) {
+  const { authMethod, registryUrl } = options;
+  const baseEnv = {};
+  if (!authMethod) return { env: baseEnv, cleanup: () => {
+  } };
+  const token = process.env.NPM_TOKEN ?? process.env.NODE_AUTH_TOKEN;
+  const registryHost = (() => {
+    try {
+      return new URL(registryUrl).host;
+    } catch {
+      return "registry.npmjs.org";
+    }
+  })();
+  const lines = [`registry=${registryUrl}`];
+  if (authMethod === "oidc") {
+    lines.push("always-auth=false");
+  }
+  if (authMethod === "token" && token) {
+    lines.push(`//${registryHost}/:_authToken=${token}`);
+  }
+  lines.push("");
+  const { npmrcPath, cleanup } = writeTempNpmrc(lines.join("\n"));
+  (0, import_core7.debug)(`Using isolated npm userconfig: ${npmrcPath}`);
+  const isOidc = authMethod === "oidc";
+  return {
+    env: {
+      ...baseEnv,
+      // Ensure npm and tools that read npm_config_* pick up our temp file
+      NPM_CONFIG_USERCONFIG: npmrcPath,
+      npm_config_userconfig: npmrcPath,
+      // Auth-specific hardening
+      ...isOidc ? {
+        // Prevent setup-node's always-auth from forcing token lookups
+        NPM_CONFIG_ALWAYS_AUTH: "false",
+        npm_config_always_auth: "false",
+        // Explicitly prevent token-based publishing from being selected implicitly
+        NODE_AUTH_TOKEN: void 0,
+        NPM_TOKEN: void 0
+      } : {
+        // Ensure CLIs that expect NODE_AUTH_TOKEN can still work
+        NODE_AUTH_TOKEN: token
+      }
+    },
+    cleanup
+  };
+}
+
+// src/utils/package-manager.ts
+var fs5 = __toESM(require("fs"), 1);
+var path4 = __toESM(require("path"), 1);
 function detectPackageManager(cwd) {
-  if (fs4.existsSync(path3.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (fs4.existsSync(path3.join(cwd, "yarn.lock"))) return "yarn";
+  if (fs5.existsSync(path4.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (fs5.existsSync(path4.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function buildPublishCommand(pm, packageName, _packageDir, options) {
@@ -759,7 +927,7 @@ async function runNpmPublishStage(ctx) {
   const { input, config, cliOptions, cwd } = ctx;
   const dryRun = cliOptions.dryRun;
   if (!config.npm.enabled) {
-    (0, import_core7.info)("NPM publishing disabled in config");
+    (0, import_core8.info)("NPM publishing disabled in config");
     return;
   }
   const authMethod = config.npm.auth === "auto" ? detectNpmAuth() : config.npm.auth;
@@ -767,107 +935,117 @@ async function runNpmPublishStage(ctx) {
     throw createPublishError("NPM_AUTH_ERROR" /* NPM_AUTH_ERROR */, "No NPM authentication method detected");
   }
   const useProvenance = config.npm.provenance && authMethod === "oidc";
-  for (const update of input.updates) {
-    const result = {
-      packageName: update.packageName,
-      version: update.newVersion,
-      registry: "npm",
-      success: false,
-      skipped: false
-    };
-    const pkgJsonPath = path4.resolve(cwd, update.filePath);
-    try {
-      const pkgContent = fs5.readFileSync(pkgJsonPath, "utf-8");
-      const pkgJson = JSON.parse(pkgContent);
-      if (pkgJson.private) {
-        result.skipped = true;
-        result.success = true;
-        result.reason = "Package is private";
-        ctx.output.npm.push(result);
-        (0, import_core7.debug)(`Skipping private package: ${update.packageName}`);
-        continue;
+  const npmIsolation = createNpmSubprocessIsolation({
+    authMethod,
+    registryUrl: config.npm.registry
+  });
+  try {
+    for (const update of input.updates) {
+      const result = {
+        packageName: update.packageName,
+        version: update.newVersion,
+        registry: "npm",
+        success: false,
+        skipped: false
+      };
+      const pkgJsonPath = path5.resolve(cwd, update.filePath);
+      try {
+        const pkgContent = fs6.readFileSync(pkgJsonPath, "utf-8");
+        const pkgJson = JSON.parse(pkgContent);
+        if (pkgJson.private) {
+          result.skipped = true;
+          result.success = true;
+          result.reason = "Package is private";
+          ctx.output.npm.push(result);
+          (0, import_core8.debug)(`Skipping private package: ${update.packageName}`);
+          continue;
+        }
+      } catch {
+        if (update.filePath.endsWith("Cargo.toml")) {
+          result.skipped = true;
+          result.success = true;
+          result.reason = "Not an npm package";
+          ctx.output.npm.push(result);
+          continue;
+        }
       }
-    } catch {
-      if (update.filePath.endsWith("Cargo.toml")) {
+      const { file: viewFile, args: viewArgs } = buildViewCommand(
+        ctx.packageManager,
+        update.packageName,
+        update.newVersion
+      );
+      const viewResult = await execCommandSafe(viewFile, viewArgs, {
+        cwd,
+        dryRun: false,
+        // Always check, even in dry-run
+        env: npmIsolation.env
+      });
+      if (viewResult.exitCode === 0 && viewResult.stdout.trim()) {
+        result.alreadyPublished = true;
         result.skipped = true;
         result.success = true;
-        result.reason = "Not an npm package";
+        result.reason = "Already published";
         ctx.output.npm.push(result);
+        (0, import_core8.warn)(`${update.packageName}@${update.newVersion} is already published, skipping`);
         continue;
       }
-    }
-    const { file: viewFile, args: viewArgs } = buildViewCommand(
-      ctx.packageManager,
-      update.packageName,
-      update.newVersion
-    );
-    const viewResult = await execCommandSafe(viewFile, viewArgs, {
-      cwd,
-      dryRun: false
-      // Always check, even in dry-run
-    });
-    if (viewResult.exitCode === 0 && viewResult.stdout.trim()) {
-      result.alreadyPublished = true;
-      result.skipped = true;
-      result.success = true;
-      result.reason = "Already published";
-      ctx.output.npm.push(result);
-      (0, import_core7.warn)(`${update.packageName}@${update.newVersion} is already published, skipping`);
-      continue;
-    }
-    const distTag = getDistTag(update.newVersion, config.npm.tag);
-    const pkgDir = path4.dirname(path4.resolve(cwd, update.filePath));
-    const { file: pubFile, args: pubArgs } = buildPublishCommand(ctx.packageManager, update.packageName, pkgDir, {
-      access: config.npm.access,
-      tag: distTag,
-      provenance: useProvenance,
-      noGitChecks: true
-    });
-    try {
-      await execCommand(pubFile, pubArgs, {
-        cwd,
-        dryRun,
-        label: `npm publish ${update.packageName}@${update.newVersion}`
+      const distTag = getDistTag(update.newVersion, config.npm.tag);
+      const pkgDir = path5.dirname(path5.resolve(cwd, update.filePath));
+      const { file: pubFile, args: pubArgs } = buildPublishCommand(ctx.packageManager, update.packageName, pkgDir, {
+        access: config.npm.access,
+        tag: distTag,
+        provenance: useProvenance,
+        noGitChecks: true
       });
-      result.success = true;
-      if (!dryRun) {
-        (0, import_core7.success)(`Published ${update.packageName}@${update.newVersion} to npm`);
+      try {
+        await execCommand(pubFile, pubArgs, {
+          cwd,
+          dryRun,
+          label: `npm publish ${update.packageName}@${update.newVersion}`,
+          env: npmIsolation.env
+        });
+        result.success = true;
+        if (!dryRun) {
+          (0, import_core8.success)(`Published ${update.packageName}@${update.newVersion} to npm`);
+        }
+      } catch (error) {
+        result.reason = error instanceof Error ? error.message : String(error);
+        (0, import_core8.warn)(`Failed to publish ${update.packageName}: ${result.reason}`);
       }
-    } catch (error) {
-      result.reason = error instanceof Error ? error.message : String(error);
-      (0, import_core7.warn)(`Failed to publish ${update.packageName}: ${result.reason}`);
+      ctx.output.npm.push(result);
     }
-    ctx.output.npm.push(result);
+  } finally {
+    npmIsolation.cleanup();
   }
 }
 
 // src/stages/prepare.ts
-var fs6 = __toESM(require("fs"), 1);
-var path5 = __toESM(require("path"), 1);
-var import_core8 = require("@releasekit/core");
+var fs7 = __toESM(require("fs"), 1);
+var path6 = __toESM(require("path"), 1);
+var import_core9 = require("@releasekit/core");
 async function runPrepareStage(ctx) {
   const { input, config, cliOptions, cwd } = ctx;
   if (config.npm.enabled && config.npm.copyFiles.length > 0) {
     for (const update of input.updates) {
-      const pkgDir = path5.dirname(path5.resolve(cwd, update.filePath));
+      const pkgDir = path6.dirname(path6.resolve(cwd, update.filePath));
       for (const file of config.npm.copyFiles) {
-        const src = path5.resolve(cwd, file);
-        const dest = path5.join(pkgDir, file);
-        if (!fs6.existsSync(src)) {
-          (0, import_core8.debug)(`Source file not found, skipping copy: ${src}`);
+        const src = path6.resolve(cwd, file);
+        const dest = path6.join(pkgDir, file);
+        if (!fs7.existsSync(src)) {
+          (0, import_core9.debug)(`Source file not found, skipping copy: ${src}`);
           continue;
         }
-        if (path5.resolve(path5.dirname(src)) === path5.resolve(pkgDir)) {
-          (0, import_core8.debug)(`Skipping copy of ${file} - same directory as source`);
+        if (path6.resolve(path6.dirname(src)) === path6.resolve(pkgDir)) {
+          (0, import_core9.debug)(`Skipping copy of ${file} - same directory as source`);
           continue;
         }
         if (cliOptions.dryRun) {
-          (0, import_core8.info)(`[DRY RUN] Would copy ${src} \u2192 ${dest}`);
+          (0, import_core9.info)(`[DRY RUN] Would copy ${src} \u2192 ${dest}`);
           continue;
         }
         try {
-          fs6.copyFileSync(src, dest);
-          (0, import_core8.debug)(`Copied ${file} \u2192 ${pkgDir}`);
+          fs7.copyFileSync(src, dest);
+          (0, import_core9.debug)(`Copied ${file} \u2192 ${pkgDir}`);
         } catch (error) {
           throw createPublishError(
             "FILE_COPY_ERROR" /* FILE_COPY_ERROR */,
@@ -879,26 +1057,26 @@ async function runPrepareStage(ctx) {
   }
   if (config.cargo.enabled) {
     for (const update of input.updates) {
-      const pkgDir = path5.dirname(path5.resolve(cwd, update.filePath));
-      const cargoPath = path5.join(pkgDir, "Cargo.toml");
-      if (!fs6.existsSync(cargoPath)) {
+      const pkgDir = path6.dirname(path6.resolve(cwd, update.filePath));
+      const cargoPath = path6.join(pkgDir, "Cargo.toml");
+      if (!fs7.existsSync(cargoPath)) {
         continue;
       }
       if (cliOptions.dryRun) {
-        (0, import_core8.info)(`[DRY RUN] Would update ${cargoPath} to version ${update.newVersion}`);
+        (0, import_core9.info)(`[DRY RUN] Would update ${cargoPath} to version ${update.newVersion}`);
         continue;
       }
       updateCargoVersion(cargoPath, update.newVersion);
-      (0, import_core8.debug)(`Updated ${cargoPath} to version ${update.newVersion}`);
+      (0, import_core9.debug)(`Updated ${cargoPath} to version ${update.newVersion}`);
     }
   }
 }
 
 // src/stages/verify.ts
-var import_core10 = require("@releasekit/core");
+var import_core11 = require("@releasekit/core");
 
 // src/utils/retry.ts
-var import_core9 = require("@releasekit/core");
+var import_core10 = require("@releasekit/core");
 async function withRetry(fn, options, shouldRetry) {
   let lastError;
   let delay = options.initialDelay;
@@ -911,7 +1089,7 @@ async function withRetry(fn, options, shouldRetry) {
         throw error;
       }
       if (attempt < options.maxAttempts) {
-        (0, import_core9.debug)(`Attempt ${attempt}/${options.maxAttempts} failed, retrying in ${delay}ms...`);
+        (0, import_core10.debug)(`Attempt ${attempt}/${options.maxAttempts} failed, retrying in ${delay}ms...`);
         await sleep(delay);
         delay = Math.floor(delay * options.backoffMultiplier);
       }
@@ -937,7 +1115,7 @@ async function runVerifyStage(ctx) {
         attempts: 0
       };
       if (cliOptions.dryRun) {
-        (0, import_core10.info)(`[DRY RUN] Would verify ${pkg.packageName}@${pkg.version} on npm`);
+        (0, import_core11.info)(`[DRY RUN] Would verify ${pkg.packageName}@${pkg.version} on npm`);
         result.verified = true;
         ctx.output.verification.push(result);
         continue;
@@ -953,12 +1131,12 @@ async function runVerifyStage(ctx) {
           if (viewResult.exitCode !== 0 || !viewResult.stdout.trim()) {
             throw new Error(`${pkg.packageName}@${pkg.version} not yet available on npm`);
           }
-          (0, import_core10.debug)(`Verified ${pkg.packageName}@${pkg.version} on npm`);
+          (0, import_core11.debug)(`Verified ${pkg.packageName}@${pkg.version} on npm`);
         }, config.verify.npm);
         result.verified = true;
-        (0, import_core10.success)(`Verified ${pkg.packageName}@${pkg.version} on npm`);
+        (0, import_core11.success)(`Verified ${pkg.packageName}@${pkg.version} on npm`);
       } catch {
-        (0, import_core10.warn)(`Failed to verify ${pkg.packageName}@${pkg.version} on npm after ${result.attempts} attempts`);
+        (0, import_core11.warn)(`Failed to verify ${pkg.packageName}@${pkg.version} on npm after ${result.attempts} attempts`);
       }
       ctx.output.verification.push(result);
     }
@@ -974,7 +1152,7 @@ async function runVerifyStage(ctx) {
         attempts: 0
       };
       if (cliOptions.dryRun) {
-        (0, import_core10.info)(`[DRY RUN] Would verify ${crate.packageName}@${crate.version} on crates.io`);
+        (0, import_core11.info)(`[DRY RUN] Would verify ${crate.packageName}@${crate.version} on crates.io`);
         result.verified = true;
         ctx.output.verification.push(result);
         continue;
@@ -986,12 +1164,12 @@ async function runVerifyStage(ctx) {
           if (!response.ok) {
             throw new Error(`${crate.packageName}@${crate.version} not yet available on crates.io`);
           }
-          (0, import_core10.debug)(`Verified ${crate.packageName}@${crate.version} on crates.io`);
+          (0, import_core11.debug)(`Verified ${crate.packageName}@${crate.version} on crates.io`);
         }, config.verify.cargo);
         result.verified = true;
-        (0, import_core10.success)(`Verified ${crate.packageName}@${crate.version} on crates.io`);
+        (0, import_core11.success)(`Verified ${crate.packageName}@${crate.version} on crates.io`);
       } catch {
-        (0, import_core10.warn)(`Failed to verify ${crate.packageName}@${crate.version} on crates.io after ${result.attempts} attempts`);
+        (0, import_core11.warn)(`Failed to verify ${crate.packageName}@${crate.version} on crates.io after ${result.attempts} attempts`);
       }
       ctx.output.verification.push(result);
     }
@@ -1026,6 +1204,8 @@ async function runPipeline(input, config, options) {
     cliOptions: options,
     packageManager: detectPackageManager(cwd),
     cwd,
+    releaseNotes: options.releaseNotes,
+    additionalFiles: options.additionalFiles,
     output: {
       dryRun: options.dryRun,
       git: { committed: false, tags: [], pushed: false },
@@ -1037,7 +1217,10 @@ async function runPipeline(input, config, options) {
   };
   try {
     await runPrepareStage(ctx);
-    if (!options.skipGit) {
+    if (options.skipGitCommit && !options.skipGit) {
+      ctx.output.git.committed = !!input.commitMessage;
+      ctx.output.git.tags = [...input.tags];
+    } else if (!options.skipGit) {
       await runGitCommitStage(ctx);
     }
     if (!options.skipPublish) {
@@ -1066,8 +1249,8 @@ async function runPipeline(input, config, options) {
 }
 
 // src/stages/input.ts
-var fs7 = __toESM(require("fs"), 1);
-var import_core11 = require("@releasekit/core");
+var fs8 = __toESM(require("fs"), 1);
+var import_core12 = require("@releasekit/core");
 var import_zod = require("zod");
 var VersionChangelogEntrySchema = import_zod.z.object({
   type: import_zod.z.string(),
@@ -1100,7 +1283,7 @@ async function parseInput(inputPath) {
   let raw;
   if (inputPath) {
     try {
-      raw = fs7.readFileSync(inputPath, "utf-8");
+      raw = fs8.readFileSync(inputPath, "utf-8");
     } catch {
       throw createPublishError("INPUT_PARSE_ERROR" /* INPUT_PARSE_ERROR */, `Could not read file: ${inputPath}`);
     }
@@ -1120,7 +1303,7 @@ async function parseInput(inputPath) {
 ${issues}`);
   }
   if (result.data.updates.length === 0) {
-    (0, import_core11.info)("No package updates in version output \u2014 pipeline will be a no-op");
+    (0, import_core12.info)("No package updates in version output \u2014 pipeline will be a no-op");
   }
   return result.data;
 }
@@ -1135,8 +1318,8 @@ async function readStdin() {
 // src/cli.ts
 var program = new import_commander.Command();
 program.name("releasekit-publish").description("Publish packages to registries with git tagging and GitHub releases").version("0.1.0").option("--input <path>", "Path to version output JSON (default: stdin)").option("--config <path>", "Path to releasekit config").option("--registry <type>", "Registry to publish to (npm, cargo, all)", "all").option("--npm-auth <method>", "NPM auth method (oidc, token, auto)", "auto").option("--dry-run", "Simulate all operations", false).option("--skip-git", "Skip git commit/tag/push", false).option("--skip-publish", "Skip registry publishing", false).option("--skip-github-release", "Skip GitHub Release creation", false).option("--skip-verification", "Skip post-publish verification", false).option("--json", "Output results as JSON", false).option("--verbose", "Verbose logging", false).action(async (options) => {
-  if (options.verbose) (0, import_core12.setLogLevel)("debug");
-  if (options.json) (0, import_core12.setJsonMode)(true);
+  if (options.verbose) (0, import_core13.setLogLevel)("debug");
+  if (options.json) (0, import_core13.setJsonMode)(true);
   try {
     const config = loadConfig({ configPath: options.config });
     const input = await parseInput(options.input);
@@ -1173,14 +1356,14 @@ program.name("releasekit-publish").description("Publish packages to registries w
           2
         )
       );
-      process.exit(import_core12.EXIT_CODES.PUBLISH_ERROR);
+      process.exit(import_core13.EXIT_CODES.PUBLISH_ERROR);
     }
     if (BasePublishError.isPublishError(err)) {
       err.logError();
-      process.exit(import_core12.EXIT_CODES.PUBLISH_ERROR);
+      process.exit(import_core13.EXIT_CODES.PUBLISH_ERROR);
     }
     console.error(err instanceof Error ? err.message : String(err));
-    process.exit(import_core12.EXIT_CODES.GENERAL_ERROR);
+    process.exit(import_core13.EXIT_CODES.GENERAL_ERROR);
   }
 });
 program.parse();