@rindrics/initrepo 0.1.5 → 0.2.0

package/.github/workflows/ci.yml

@@ -64,4 +64,6 @@ jobs:
       - run: bun install --frozen-lockfile
 
       - name: Test
-        run: bun test
+        run: |
+          bun run build
+          bun test

package/.github/workflows/tagpr.yml

@@ -19,3 +19,7 @@ jobs:
       - uses: Songmu/tagpr@v1
         env:
           GITHUB_TOKEN: ${{ secrets.PAT_FOR_TAGPR }}
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## [v0.2.0](https://github.com/Rindrics/initrepo/compare/v0.1.5...v0.2.0) - 2025-12-28
+- ci: commit as GitHub Actions bot by @Rindrics in https://github.com/Rindrics/initrepo/pull/20
+- feat: generate publish.yml from prepare-release command by @Rindrics in https://github.com/Rindrics/initrepo/pull/21
+- feat: embed templates at build by @Rindrics in https://github.com/Rindrics/initrepo/pull/23
+
 ## [v0.1.5](https://github.com/Rindrics/initrepo/compare/v0.1.4...v0.1.5) - 2025-12-28
 - fix: correct binary name by @Rindrics in https://github.com/Rindrics/initrepo/pull/18
 

package/dist/cli.js

@@ -3321,8 +3321,8 @@ var require_light = __commonJS((exports, module) => {
         return this.Promise.resolve();
       }
       yieldLoop(t = 0) {
-        return new this.Promise(function(resolve2, reject) {
-          return setTimeout(resolve2, t);
+        return new this.Promise(function(resolve, reject) {
+          return setTimeout(resolve, t);
         });
       }
       computePenalty() {
@@ -3533,15 +3533,15 @@ var require_light = __commonJS((exports, module) => {
         return this._queue.length === 0;
       }
       async _tryToRun() {
-        var args, cb, error, reject, resolve2, returned, task;
+        var args, cb, error, reject, resolve, returned, task;
         if (this._running < 1 && this._queue.length > 0) {
           this._running++;
-          ({ task, args, resolve: resolve2, reject } = this._queue.shift());
+          ({ task, args, resolve, reject } = this._queue.shift());
           cb = await async function() {
             try {
               returned = await task(...args);
               return function() {
-                return resolve2(returned);
+                return resolve(returned);
               };
             } catch (error1) {
               error = error1;
@@ -3556,13 +3556,13 @@ var require_light = __commonJS((exports, module) => {
         }
       }
       schedule(task, ...args) {
-        var promise, reject, resolve2;
-        resolve2 = reject = null;
+        var promise, reject, resolve;
+        resolve = reject = null;
         promise = new this.Promise(function(_resolve, _reject) {
-          resolve2 = _resolve;
+          resolve = _resolve;
           return reject = _reject;
         });
-        this._queue.push({ task, args, resolve: resolve2, reject });
+        this._queue.push({ task, args, resolve, reject });
         this._tryToRun();
         return promise;
       }
@@ -3966,14 +3966,14 @@ var require_light = __commonJS((exports, module) => {
               counts = this._states.counts;
               return counts[0] + counts[1] + counts[2] + counts[3] === at;
             };
-            return new this.Promise((resolve2, reject) => {
+            return new this.Promise((resolve, reject) => {
               if (finished()) {
-                return resolve2();
+                return resolve();
               } else {
                 return this.on("done", () => {
                   if (finished()) {
                     this.removeAllListeners("done");
-                    return resolve2();
+                    return resolve();
                   }
                 });
               }
@@ -4066,9 +4066,9 @@ var require_light = __commonJS((exports, module) => {
             options = parser$5.load(options, this.jobDefaults);
           }
           task = (...args2) => {
-            return new this.Promise(function(resolve2, reject) {
+            return new this.Promise(function(resolve, reject) {
               return fn(...args2, function(...args3) {
-                return (args3[0] != null ? reject : resolve2)(args3);
+                return (args3[0] != null ? reject : resolve)(args3);
               });
             });
           };
@@ -4207,7 +4207,7 @@ var {
 // package.json
 var package_default = {
   name: "@rindrics/initrepo",
-  version: "0.1.5",
+  version: "0.2.0",
   description: "setup GitHub repo with dev tools",
   type: "module",
   bin: {
@@ -4215,11 +4215,11 @@ var package_default = {
   },
   scripts: {
     dev: "bun run src/cli.ts",
-    build: "bun build src/cli.ts --outdir dist --target node",
+    build: "bun scripts/embed-templates.ts && bun build src/cli.ts --outdir dist --target node",
     lint: "biome lint src",
     format: "biome format src --write",
     check: "biome check src",
-    test: "bun test",
+    test: "bun scripts/embed-templates.ts && bun test",
     clean: "rm -rf test-* dist",
     prepare: "husky"
   },
@@ -4257,6 +4257,7 @@ import * as path from "node:path";
 // src/config.ts
 var GITHUB_ACTIONS = {
   "actions/checkout": "v6",
+  "actions/setup-node": "v4",
   "Songmu/tagpr": "v1",
   "oven-sh/setup-bun": "v2",
   "github/codeql-action": "v3"
@@ -4317,8 +4318,272 @@ async function getLatestVersions(packageNames) {
   return versions;
 }
 
+// src/generators/embedded-templates.ts
+var EMBEDDED_TEMPLATES = {
+  "common/dependabot.yml.ejs": `version: 2
+updates:
+<% if (lang === 'typescript') { -%>
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+<% } -%>
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+`,
+  "common/release.yml.ejs": `changelog:
+  exclude:
+    labels:
+      - tagpr
+`,
+  "common/workflows/publish.yml.ejs": `name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+
+      - uses: oven-sh/setup-bun@<%= actionVersions['oven-sh/setup-bun'] %>
+
+      - uses: actions/setup-node@<%= actionVersions['actions/setup-node'] %>
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: bun install --frozen-lockfile
+
+      - name: Build
+        run: bun run build
+
+      - name: Test
+        run: bun test
+
+      - name: Publish to npm with provenance
+        run: npm publish --access public --provenance
+
+`,
+  "common/workflows/tagpr.yml.ejs": `name: tagpr
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  tagpr:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+<% if (isDevcode) { -%>
+        # TODO: After replace-devcode, add token: \${{ secrets.PAT_FOR_TAGPR }}
+<% } else { -%>
+        with:
+          token: \${{ secrets.PAT_FOR_TAGPR }}
+<% } -%>
+
+      - uses: Songmu/tagpr@<%= actionVersions['Songmu/tagpr'] %>
+        env:
+<% if (isDevcode) { -%>
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          # TODO: After replace-devcode, use PAT_FOR_TAGPR instead
+<% } else { -%>
+          GITHUB_TOKEN: \${{ secrets.PAT_FOR_TAGPR }}
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+<% } -%>
+`,
+  "typescript/.tagpr.ejs": `# tagpr configuration
+# https://github.com/Songmu/tagpr
+
+[tagpr]
+versionFile = "package.json"
+`,
+  "typescript/codeql/codeql-config.yml.ejs": `name: "CodeQL config for <%= name %>"
+
+paths:
+  - src
+
+paths-ignore:
+  - node_modules/
+`,
+  "typescript/package.json.ejs": `{
+  "name": "<%= name %>",
+  "version": "0.0.0",
+<% if (isDevcode) { -%>
+  "private": true,
+<% } -%>
+  "description": "",
+  "type": "module",
+  "scripts": {
+    "dev": "bun run src/index.ts",
+    "build": "bun build src/index.ts --outdir dist --target node",
+    "lint": "biome lint src",
+    "format": "biome format src --write",
+    "check": "biome check src",
+    "test": "bun test",
+    "prepare": "husky"
+  },
+  "keywords": [],
+  "author": "<%= author %>",
+  "license": "MIT",
+  "devDependencies": {
+    "@biomejs/biome": "^<%= versions['@biomejs/biome'] %>",
+    "@commitlint/cli": "^<%= versions['@commitlint/cli'] %>",
+    "@commitlint/config-conventional": "^<%= versions['@commitlint/config-conventional'] %>",
+    "bun-types": "^<%= versions['bun-types'] %>",
+    "husky": "^<%= versions['husky'] %>",
+    "typescript": "^<%= versions['typescript'] %>"
+  }
+}
+`,
+  "typescript/src/index.ts.ejs": `console.log('Hello from <%= name %>!');
+`,
+  "typescript/tsconfig.json.ejs": `{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "declaration": true,
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "types": ["bun-types"]
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}
+
+`,
+  "typescript/workflows/ci.yml.ejs": `name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'tsconfig.json'
+      - 'biome.json'
+      - 'bun.lock'
+      - '.github/workflows/ci.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'tsconfig.json'
+      - 'biome.json'
+      - 'bun.lock'
+      - '.github/workflows/ci.yml'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+
+      - uses: oven-sh/setup-bun@<%= actionVersions['oven-sh/setup-bun'] %>
+        with:
+          bun-version: latest
+
+      - run: bun install --frozen-lockfile
+
+      - name: Biome check
+        run: bun run check
+
+      - name: TypeScript check
+        run: bun run build
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+
+      - uses: oven-sh/setup-bun@<%= actionVersions['oven-sh/setup-bun'] %>
+        with:
+          bun-version: latest
+
+      - run: bun install --frozen-lockfile
+
+      - name: Test
+        run: bun test
+`,
+  "typescript/workflows/codeql.yml.ejs": `name: CodeQL
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'tsconfig.json'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - 'tsconfig.json'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    # Run weekly on Sunday at 00:00 UTC
+    - cron: '0 0 * * 0'
+  workflow_dispatch:
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@<%= actionVersions['github/codeql-action'] %>
+        with:
+          languages: javascript-typescript
+          config-file: ./.github/codeql/codeql-config.yml
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@<%= actionVersions['github/codeql-action'] %>
+        with:
+          category: '/language:javascript-typescript'
+`
+};
+
 // src/generators/project.ts
-var TEMPLATES_DIR = path.join(import.meta.dir, "../templates");
 var DEV_DEPENDENCIES = [
   "@biomejs/biome",
   "@commitlint/cli",
@@ -4338,21 +4603,11 @@ class TemplateError extends Error {
     this.name = "TemplateError";
   }
 }
-async function loadTemplate(templatePath, data) {
-  const resolvedTemplatesDir = path.resolve(TEMPLATES_DIR);
-  const fullPath = path.resolve(TEMPLATES_DIR, templatePath);
-  if (!fullPath.startsWith(resolvedTemplatesDir + path.sep)) {
-    throw new TemplateError(`Invalid template path: "${templatePath}" resolves outside templates directory`, templatePath);
-  }
-  let template;
-  try {
-    template = await fs.readFile(fullPath, "utf-8");
-  } catch (error) {
-    const fsError = error;
-    if (fsError.code === "ENOENT") {
-      throw new TemplateError(`Template not found: "${templatePath}"`, templatePath, fsError);
-    }
-    throw new TemplateError(`Failed to read template "${templatePath}": ${fsError.message}`, templatePath, fsError);
+function loadTemplate(templatePath, data) {
+  const normalizedPath = templatePath.replace(/\\/g, "/");
+  const template = EMBEDDED_TEMPLATES[normalizedPath];
+  if (!template) {
+    throw new TemplateError(`Template not found: "${templatePath}"`, templatePath);
   }
   try {
     return import_ejs.default.render(template, data);
@@ -4369,7 +4624,7 @@ async function generatePackageJson(options) {
     ]);
     const author = detectedAuthor ?? "";
     const templatePath = `${options.lang}/package.json.ejs`;
-    const content = await loadTemplate(templatePath, {
+    const content = loadTemplate(templatePath, {
       name: options.projectName,
       isDevcode: options.isDevcode,
       author,
@@ -4381,48 +4636,52 @@ async function generatePackageJson(options) {
   }
 }
 async function generateTsconfig(options) {
-  const content = await loadTemplate(`${options.lang}/tsconfig.json.ejs`, {});
+  const content = loadTemplate(`${options.lang}/tsconfig.json.ejs`, {});
   return { path: "tsconfig.json", content };
 }
 async function generateEntryPoint(options) {
-  const content = await loadTemplate(`${options.lang}/src/index.ts.ejs`, {
+  const content = loadTemplate(`${options.lang}/src/index.ts.ejs`, {
     name: options.projectName
   });
   return { path: "src/index.ts", content };
 }
 async function generateTagprConfig(options) {
-  const content = await loadTemplate(`${options.lang}/.tagpr.ejs`, {});
+  const content = loadTemplate(`${options.lang}/.tagpr.ejs`, {});
   return { path: ".tagpr", content };
 }
 async function generateTagprWorkflow(options, actionVersions) {
-  const content = await loadTemplate("common/workflows/tagpr.yml.ejs", {
+  const content = loadTemplate("common/workflows/tagpr.yml.ejs", {
     isDevcode: options.isDevcode,
     actionVersions
   });
   return { path: ".github/workflows/tagpr.yml", content };
 }
 async function generateCiWorkflow(options, actionVersions) {
-  const content = await loadTemplate(`${options.lang}/workflows/ci.yml.ejs`, {
+  const content = loadTemplate(`${options.lang}/workflows/ci.yml.ejs`, {
     actionVersions
   });
   return { path: ".github/workflows/ci.yml", content };
 }
 async function generateCodeqlWorkflow(options, actionVersions) {
-  const content = await loadTemplate(`${options.lang}/workflows/codeql.yml.ejs`, { actionVersions });
+  const content = loadTemplate(`${options.lang}/workflows/codeql.yml.ejs`, {
+    actionVersions
+  });
   return { path: ".github/workflows/codeql.yml", content };
 }
 async function generateCodeqlConfig(options) {
-  const content = await loadTemplate(`${options.lang}/codeql/codeql-config.yml.ejs`, { name: options.projectName });
+  const content = loadTemplate(`${options.lang}/codeql/codeql-config.yml.ejs`, {
+    name: options.projectName
+  });
   return { path: ".github/codeql/codeql-config.yml", content };
 }
 async function generateDependabot(options) {
-  const content = await loadTemplate("common/dependabot.yml.ejs", {
+  const content = loadTemplate("common/dependabot.yml.ejs", {
     lang: options.lang
   });
   return { path: ".github/dependabot.yml", content };
 }
 async function generateReleaseConfig() {
-  const content = await loadTemplate("common/release.yml.ejs", {});
+  const content = loadTemplate("common/release.yml.ejs", {});
   return { path: ".github/release.yml", content };
 }
 
@@ -5265,8 +5524,8 @@ function withCustomRequest(customRequest) {
 
 // node_modules/@octokit/auth-token/dist-bundle/index.js
 var b64url = "(?:[a-zA-Z0-9_-]+)";
-var sep2 = "\\.";
-var jwtRE = new RegExp(`^${b64url}${sep2}${b64url}${sep2}${b64url}$`);
+var sep = "\\.";
+var jwtRE = new RegExp(`^${b64url}${sep}${b64url}${sep}${b64url}$`);
 var isJWT = jwtRE.test.bind(jwtRE);
 async function auth(token) {
   const isApp = isJWT(token);
@@ -8616,7 +8875,7 @@ function getCachedAuthentication(state, auth2) {
   return newScope === currentScope ? authentication : false;
 }
 async function wait(seconds) {
-  await new Promise((resolve2) => setTimeout(resolve2, seconds * 1000));
+  await new Promise((resolve) => setTimeout(resolve, seconds * 1000));
 }
 async function waitForAccessToken(request2, clientId, clientType, verification) {
   try {
@@ -9532,7 +9791,7 @@ async function sendRequestWithRetries(state, request2, options, createdAt, retri
     ++retries;
     const awaitTime = retries * 1000;
     state.log.warn(`[@octokit/auth-app] Retrying after 401 response to account for token replication delay (retry: ${retries}, wait: ${awaitTime / 1000}s)`);
-    await new Promise((resolve2) => setTimeout(resolve2, awaitTime));
+    await new Promise((resolve) => setTimeout(resolve, awaitTime));
     return sendRequestWithRetries(state, request2, options, createdAt, retries);
   }
 }
@@ -11056,25 +11315,26 @@ async function replaceInCodeqlConfig(targetDir, devcode, publishName) {
 }
 async function replaceInTagprWorkflow(targetDir, _devcode, _publishName) {
   const workflowPath = path2.join(targetDir, ".github/workflows/tagpr.yml");
-  let content;
   try {
-    content = await fs2.readFile(workflowPath, "utf-8");
-  } catch (error) {
-    const fsError = error;
-    if (fsError.code === "ENOENT") {
-      return;
-    }
-    throw error;
+    await fs2.access(workflowPath);
+  } catch {
+    return;
   }
-  content = content.replace(/GITHUB_TOKEN: \$\{\{ secrets\.GITHUB_TOKEN \}\}/g, "GITHUB_TOKEN: ${{ secrets.PAT_FOR_TAGPR }}");
-  content = content.replace(/(uses: actions\/checkout@v\d+)\n(\s*)# TODO: After replace-devcode, add token: \$\{\{ secrets\.PAT_FOR_TAGPR \}\}/g, `$1
-$2with:
-$2  token: \${{ secrets.PAT_FOR_TAGPR }}`);
-  content = content.replace(/\s*# TODO: After replace-devcode.*\n/g, `
-`);
-  content = content.replace(/\n{3,}/g, `
-
-`);
+  const actionVersions = await getLatestActionVersions();
+  const content = await loadTemplate("common/workflows/tagpr.yml.ejs", {
+    isDevcode: false,
+    actionVersions
+  });
+  await fs2.writeFile(workflowPath, content, "utf-8");
+}
+async function generatePublishWorkflow(targetDir) {
+  const workflowDir = path2.join(targetDir, ".github/workflows");
+  const workflowPath = path2.join(workflowDir, "publish.yml");
+  await fs2.mkdir(workflowDir, { recursive: true });
+  const actionVersions = await getLatestActionVersions();
+  const content = await loadTemplate("common/workflows/publish.yml.ejs", {
+    actionVersions
+  });
   await fs2.writeFile(workflowPath, content, "utf-8");
 }
 var MANAGED_LOCATIONS = [
@@ -11157,6 +11417,14 @@ async function prepareRelease(options) {
       console.log(`   ⚠️  ${location.file}: ${error instanceof Error ? error.message : String(error)}`);
     }
   }
+  console.log(`
+\uD83D\uDCE6 Generating release workflows:`);
+  try {
+    await generatePublishWorkflow(targetDir);
+    console.log("   ✅ .github/workflows/publish.yml (npm OIDC publishing)");
+  } catch (error) {
+    console.log(`   ⚠️  publish.yml: ${error instanceof Error ? error.message : String(error)}`);
+  }
   const unmanaged = await findUnmanagedOccurrences(targetDir, devcode);
   if (unmanaged.length > 0) {
     console.log(`
@@ -11172,6 +11440,7 @@ async function prepareRelease(options) {
   console.log(`   Package renamed: ${devcode} → ${options.publishName}`);
   console.log(`   Private flag removed`);
   console.log(`   Workflows updated to use PAT_FOR_TAGPR`);
+  console.log(`   publish.yml generated for npm OIDC publishing`);
   console.log(`
 ⚠️  Action required: Set up PAT_FOR_TAGPR secret`);
   console.log(`   1. Create a Personal Access Token (classic) at:`);

package/docs/adr/0002-embed-templates-at-build-time.md

@@ -0,0 +1,126 @@
+# ADR 0002: Embed Templates at Build Time
+
+## Status
+
+Accepted
+
+## Context
+
+`@rindrics/initrepo` uses EJS templates to generate project files. Initially, templates were loaded from the filesystem at runtime:
+
+```typescript
+const TEMPLATES_DIR = path.join(__dirname, '../templates');
+const template = await fs.readFile(path.join(TEMPLATES_DIR, templatePath), 'utf-8');
+```
+
+This approach had several issues:
+
+1. **Bun vs Node.js incompatibility**: The code used `import.meta.dir` (Bun-specific) to resolve template paths. When running the bundled CLI with Node.js, this API is undefined, causing `path.join()` to fail with `ERR_INVALID_ARG_TYPE`.
+
+2. **Distribution complexity**: Templates had to be copied alongside the bundled JavaScript (`cp -r src/templates dist/`), requiring:
+   - Additional build steps
+   - Correct `files` configuration in `package.json` for npm publishing
+   - Careful handling of relative paths between the bundle and templates
+
+3. **Runtime file system dependency**: The CLI required read access to template files at runtime, adding a potential failure point.
+
+## Alternatives Considered
+
+### 1. Runtime file loading (original approach)
+
+Templates as separate `.ejs` files, loaded via `fs.readFile()` at runtime.
+
+- ✅ Simple to understand
+- ❌ Requires correct path resolution across Bun/Node.js
+- ❌ Templates must be distributed alongside the bundle
+- ❌ Runtime filesystem dependency
+
+### 2. Inline templates in source code
+
+Templates as template literals directly in TypeScript source.
+
+```typescript
+const PACKAGE_JSON_TEMPLATE = `{
+  "name": "<%= name %>",
+  ...
+}`;
+```
+
+- ✅ Single-file distribution
+- ✅ No build step for templates
+- ❌ Poor editing experience (no syntax highlighting for EJS/YAML)
+- ❌ Difficult to review changes in PRs
+- ❌ Escaping issues with backticks and `${}`
+
+### 3. Build-time embedding (chosen)
+
+Templates managed as `.ejs` files, embedded into a TypeScript module at build time.
+
+- ✅ Single-file distribution
+- ✅ Best editing experience (syntax highlighting, linting)
+- ✅ Clear diffs in PRs for template changes
+- ✅ No runtime filesystem dependency
+- ⚠️ Requires build step (`bun scripts/embed-templates.ts`)
+
+## Decision
+
+Embed all EJS templates as string literals in the JavaScript bundle at build time (Alternative 3).
+
+This is a **hybrid approach**: templates are authored as `.ejs` files for developer experience, but converted to an embedded object at build time for distribution simplicity.
+
+### Implementation
+
+1. **Build script** (`scripts/embed-templates.ts`):
+   - Scans `src/templates/` for `.ejs` files
+   - Generates `src/generators/embedded-templates.ts` with all templates as a `Record<string, string>`
+
+2. **Template loading** (`src/generators/project.ts`):
+   - Changed from async file reading to synchronous lookup in the embedded map
+   - Removed filesystem and path resolution logic
+
+```typescript
+// Before (runtime loading)
+export async function loadTemplate(templatePath: string, data: Record<string, unknown>): Promise<string> {
+  const template = await fs.readFile(path.join(TEMPLATES_DIR, templatePath), 'utf-8');
+  return ejs.render(template, data);
+}
+
+// After (embedded templates)
+export function loadTemplate(templatePath: string, data: Record<string, unknown>): string {
+  const template = EMBEDDED_TEMPLATES[templatePath];
+  if (!template) throw new TemplateError(`Template not found: "${templatePath}"`, templatePath);
+  return ejs.render(template, data);
+}
+```
+
+3. **Build process**:
+   ```json
+   "build": "bun scripts/embed-templates.ts && bun build src/cli.ts --outdir dist --target node"
+   ```
+
+### Generated File
+
+The `embedded-templates.ts` file is auto-generated and should not be edited manually. It is gitignored and regenerated on each build.
+
+## Consequences
+
+### Positive
+
+- **Single-file distribution**: The CLI is now a self-contained JavaScript file with no external dependencies on template files
+- **Cross-runtime compatibility**: Works with both Bun and Node.js without conditional path resolution
+- **Simpler npm publishing**: No need to configure `files` to include template directories
+- **Faster execution**: No filesystem I/O for template loading
+- **Synchronous API**: `loadTemplate()` is now synchronous, simplifying call sites
+
+### Negative
+
+- **Larger bundle size**: Templates are embedded as strings in the bundle (~20KB increase)
+- **Build step required**: Templates must be regenerated when changed (`bun scripts/embed-templates.ts`)
+- **Generated file**: `embedded-templates.ts` is auto-generated, which may cause confusion if edited directly
+
+### Mitigations
+
+- The generated file includes a clear header: `// Auto-generated by scripts/embed-templates.ts - Do not edit manually`
+- `embedded-templates.ts` is added to `.gitignore` to prevent accidental commits
+- The build script runs automatically as part of `pnpm build`
+- Bundle size increase is negligible for a CLI tool

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rindrics/initrepo",
-  "version": "0.1.5",
+  "version": "0.2.0",
   "description": "setup GitHub repo with dev tools",
   "type": "module",
   "bin": {
@@ -8,11 +8,11 @@
   },
   "scripts": {
     "dev": "bun run src/cli.ts",
-    "build": "bun build src/cli.ts --outdir dist --target node",
+    "build": "bun scripts/embed-templates.ts && bun build src/cli.ts --outdir dist --target node",
     "lint": "biome lint src",
     "format": "biome format src --write",
     "check": "biome check src",
-    "test": "bun test",
+    "test": "bun scripts/embed-templates.ts && bun test",
     "clean": "rm -rf test-* dist",
     "prepare": "husky"
   },

package/scripts/embed-templates.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env bun
+/**
+ * Build script to embed EJS templates as strings in the bundle.
+ * This eliminates the need to distribute template files separately.
+ */
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+const TEMPLATES_DIR = path.join(import.meta.dir, '../src/templates');
+const OUTPUT_FILE = path.join(import.meta.dir, '../src/generators/embedded-templates.ts');
+
+async function findTemplateFiles(dir: string, basePath = ''): Promise<string[]> {
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+  const files: string[] = [];
+
+  for (const entry of entries) {
+    const relativePath = path.join(basePath, entry.name);
+    const fullPath = path.join(dir, entry.name);
+
+    if (entry.isDirectory()) {
+      files.push(...(await findTemplateFiles(fullPath, relativePath)));
+    } else if (entry.name.endsWith('.ejs')) {
+      files.push(relativePath);
+    }
+  }
+
+  return files;
+}
+
+function escapeTemplateString(content: string): string {
+  return content
+    .replace(/\\/g, '\\\\')
+    .replace(/`/g, '\\`')
+    .replace(/\$\{/g, '\\${');
+}
+
+async function main() {
+  const templateFiles = await findTemplateFiles(TEMPLATES_DIR);
+  templateFiles.sort();
+
+  const entries: string[] = [];
+
+  for (const file of templateFiles) {
+    const fullPath = path.join(TEMPLATES_DIR, file);
+    const content = await fs.readFile(fullPath, 'utf-8');
+    const escaped = escapeTemplateString(content);
+    // Normalize path separators for cross-platform compatibility
+    const normalizedPath = file.replace(/\\/g, '/');
+    entries.push(`  '${normalizedPath}': \`${escaped}\``);
+  }
+
+  const output = `// Auto-generated by scripts/embed-templates.ts
+// Do not edit manually
+
+export const EMBEDDED_TEMPLATES: Record<string, string> = {
+${entries.join(',\n')},
+};
+`;
+
+  await fs.writeFile(OUTPUT_FILE, output, 'utf-8');
+  console.log(`Generated ${OUTPUT_FILE} with ${templateFiles.length} templates`);
+}
+
+main().catch(console.error);

package/src/commands/prepare-release.ts

@@ -1,6 +1,8 @@
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import type { Command } from 'commander';
+import { loadTemplate } from '../generators/project';
+import { getLatestActionVersions } from '../utils/github';
 
 export interface PrepareReleaseOptions {
   /** New package name for release */
@@ -125,8 +127,8 @@ async function replaceInCodeqlConfig(
 }
 
 /**
- * Updates tagpr.yml: switches from GITHUB_TOKEN to PAT_FOR_TAGPR
- * This is a MANAGED replacement - only touches specific workflow patterns
+ * Updates tagpr.yml: regenerates from template with isDevcode=false
+ * This ensures all release-ready settings are applied
  */
 async function replaceInTagprWorkflow(
   targetDir: string,
@@ -135,34 +137,35 @@ async function replaceInTagprWorkflow(
 ): Promise<void> {
   const workflowPath = path.join(targetDir, '.github/workflows/tagpr.yml');
 
-  let content: string;
+  // Check if file exists
   try {
-    content = await fs.readFile(workflowPath, 'utf-8');
-  } catch (error) {
-    const fsError = error as NodeJS.ErrnoException;
-    if (fsError.code === 'ENOENT') {
-      return; // File doesn't exist, nothing to do
-    }
-    throw error;
+    await fs.access(workflowPath);
+  } catch {
+    return; // File doesn't exist, nothing to do
   }
 
-  // Replace GITHUB_TOKEN with PAT_FOR_TAGPR in env
-  content = content.replace(
-    /GITHUB_TOKEN: \$\{\{ secrets\.GITHUB_TOKEN \}\}/g,
-    'GITHUB_TOKEN: ${{ secrets.PAT_FOR_TAGPR }}',
-  );
+  const actionVersions = await getLatestActionVersions();
+  const content = await loadTemplate('common/workflows/tagpr.yml.ejs', {
+    isDevcode: false,
+    actionVersions,
+  });
 
-  // Add token to checkout if not present
-  content = content.replace(
-    /(uses: actions\/checkout@v\d+)\n(\s*)# TODO: After replace-devcode, add token: \$\{\{ secrets\.PAT_FOR_TAGPR \}\}/g,
-    '$1\n$2with:\n$2  token: ${{ secrets.PAT_FOR_TAGPR }}',
-  );
+  await fs.writeFile(workflowPath, content, 'utf-8');
+}
 
-  // Remove remaining TODO comments
-  content = content.replace(/\s*# TODO: After replace-devcode.*\n/g, '\n');
+/**
+ * Generates publish.yml workflow for npm publishing with OIDC
+ */
+async function generatePublishWorkflow(targetDir: string): Promise<void> {
+  const workflowDir = path.join(targetDir, '.github/workflows');
+  const workflowPath = path.join(workflowDir, 'publish.yml');
 
-  // Clean up extra blank lines
-  content = content.replace(/\n{3,}/g, '\n\n');
+  await fs.mkdir(workflowDir, { recursive: true });
+
+  const actionVersions = await getLatestActionVersions();
+  const content = await loadTemplate('common/workflows/publish.yml.ejs', {
+    actionVersions,
+  });
 
   await fs.writeFile(workflowPath, content, 'utf-8');
 }
@@ -292,6 +295,17 @@ export async function prepareRelease(
     }
   }
 
+  // Generate publish workflow for npm OIDC publishing
+  console.log('\n📦 Generating release workflows:');
+  try {
+    await generatePublishWorkflow(targetDir);
+    console.log('   ✅ .github/workflows/publish.yml (npm OIDC publishing)');
+  } catch (error) {
+    console.log(
+      `   ⚠️  publish.yml: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
   // Scan for unmanaged occurrences
   const unmanaged = await findUnmanagedOccurrences(targetDir, devcode);
 
@@ -312,6 +326,7 @@ export async function prepareRelease(
   console.log(`   Package renamed: ${devcode} → ${options.publishName}`);
   console.log(`   Private flag removed`);
   console.log(`   Workflows updated to use PAT_FOR_TAGPR`);
+  console.log(`   publish.yml generated for npm OIDC publishing`);
 
   console.log(`\n⚠️  Action required: Set up PAT_FOR_TAGPR secret`);
   console.log(`   1. Create a Personal Access Token (classic) at:`);

package/src/config.ts

@@ -4,6 +4,7 @@
  */
 export const GITHUB_ACTIONS = {
   'actions/checkout': 'v6',
+  'actions/setup-node': 'v4',
   'Songmu/tagpr': 'v1',
   'oven-sh/setup-bun': 'v2',
   'github/codeql-action': 'v3',

package/src/generators/project.test.ts

@@ -29,26 +29,25 @@ describe('project generator', () => {
   });
 
   describe('loadTemplate', () => {
-    test('should throw TemplateError for path traversal attempt', async () => {
-      expect(loadTemplate('../../../etc/passwd', {})).rejects.toThrow(
+    test('should throw TemplateError for path traversal attempt', () => {
+      // With embedded templates, path traversal simply results in "not found"
+      expect(() => loadTemplate('../../../etc/passwd', {})).toThrow(
         TemplateError,
       );
-      expect(loadTemplate('../../../etc/passwd', {})).rejects.toThrow(
-        'resolves outside templates directory',
+      expect(() => loadTemplate('../../../etc/passwd', {})).toThrow(
+        'Template not found',
       );
     });
 
-    test('should throw TemplateError for non-existent template', async () => {
-      expect(loadTemplate('non-existent.ejs', {})).rejects.toThrow(
-        TemplateError,
-      );
-      expect(loadTemplate('non-existent.ejs', {})).rejects.toThrow(
+    test('should throw TemplateError for non-existent template', () => {
+      expect(() => loadTemplate('non-existent.ejs', {})).toThrow(TemplateError);
+      expect(() => loadTemplate('non-existent.ejs', {})).toThrow(
         'Template not found',
       );
     });
 
-    test('should load and render valid template', async () => {
-      const result = await loadTemplate('typescript/package.json.ejs', {
+    test('should load and render valid template', () => {
+      const result = loadTemplate('typescript/package.json.ejs', {
         name: 'test',
         author: '',
         isDevcode: false,

package/src/generators/project.ts

@@ -4,8 +4,7 @@ import ejs from 'ejs';
 import type { InitOptions } from '../types';
 import { getLatestActionVersions } from '../utils/github';
 import { getLatestVersions, getNpmUsername } from '../utils/npm';
-
-const TEMPLATES_DIR = path.join(import.meta.dir, '../templates');
+import { EMBEDDED_TEMPLATES } from './embedded-templates';
 
 const DEV_DEPENDENCIES = [
   '@biomejs/biome',
@@ -32,39 +31,21 @@ export class TemplateError extends Error {
   }
 }
 
-export async function loadTemplate(
+export function loadTemplate(
   templatePath: string,
   data: Record<string, unknown>,
-): Promise<string> {
-  const resolvedTemplatesDir = path.resolve(TEMPLATES_DIR);
-  const fullPath = path.resolve(TEMPLATES_DIR, templatePath);
+): string {
+  // Normalize path separators
+  const normalizedPath = templatePath.replace(/\\/g, '/');
 
-  if (!fullPath.startsWith(resolvedTemplatesDir + path.sep)) {
+  const template = EMBEDDED_TEMPLATES[normalizedPath];
+  if (!template) {
     throw new TemplateError(
-      `Invalid template path: "${templatePath}" resolves outside templates directory`,
+      `Template not found: "${templatePath}"`,
       templatePath,
     );
   }
 
-  let template: string;
-  try {
-    template = await fs.readFile(fullPath, 'utf-8');
-  } catch (error) {
-    const fsError = error as NodeJS.ErrnoException;
-    if (fsError.code === 'ENOENT') {
-      throw new TemplateError(
-        `Template not found: "${templatePath}"`,
-        templatePath,
-        fsError,
-      );
-    }
-    throw new TemplateError(
-      `Failed to read template "${templatePath}": ${fsError.message}`,
-      templatePath,
-      fsError,
-    );
-  }
-
   try {
     return ejs.render(template, data);
   } catch (error) {
@@ -87,7 +68,7 @@ export async function generatePackageJson(
     ]);
     const author = detectedAuthor ?? '';
     const templatePath = `${options.lang}/package.json.ejs`;
-    const content = await loadTemplate(templatePath, {
+    const content = loadTemplate(templatePath, {
       name: options.projectName,
       isDevcode: options.isDevcode,
       author,
@@ -104,14 +85,14 @@ export async function generatePackageJson(
 export async function generateTsconfig(
   options: InitOptions,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(`${options.lang}/tsconfig.json.ejs`, {});
+  const content = loadTemplate(`${options.lang}/tsconfig.json.ejs`, {});
   return { path: 'tsconfig.json', content };
 }
 
 export async function generateEntryPoint(
   options: InitOptions,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(`${options.lang}/src/index.ts.ejs`, {
+  const content = loadTemplate(`${options.lang}/src/index.ts.ejs`, {
     name: options.projectName,
   });
   return { path: 'src/index.ts', content };
@@ -120,7 +101,7 @@ export async function generateEntryPoint(
 export async function generateTagprConfig(
   options: InitOptions,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(`${options.lang}/.tagpr.ejs`, {});
+  const content = loadTemplate(`${options.lang}/.tagpr.ejs`, {});
   return { path: '.tagpr', content };
 }
 
@@ -128,7 +109,7 @@ export async function generateTagprWorkflow(
   options: InitOptions,
   actionVersions: Record<string, string>,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate('common/workflows/tagpr.yml.ejs', {
+  const content = loadTemplate('common/workflows/tagpr.yml.ejs', {
     isDevcode: options.isDevcode,
     actionVersions,
   });
@@ -139,7 +120,7 @@ export async function generateCiWorkflow(
   options: InitOptions,
   actionVersions: Record<string, string>,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(`${options.lang}/workflows/ci.yml.ejs`, {
+  const content = loadTemplate(`${options.lang}/workflows/ci.yml.ejs`, {
     actionVersions,
   });
   return { path: '.github/workflows/ci.yml', content };
@@ -149,34 +130,32 @@ export async function generateCodeqlWorkflow(
   options: InitOptions,
   actionVersions: Record<string, string>,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(
-    `${options.lang}/workflows/codeql.yml.ejs`,
-    { actionVersions },
-  );
+  const content = loadTemplate(`${options.lang}/workflows/codeql.yml.ejs`, {
+    actionVersions,
+  });
   return { path: '.github/workflows/codeql.yml', content };
 }
 
 export async function generateCodeqlConfig(
   options: InitOptions,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate(
-    `${options.lang}/codeql/codeql-config.yml.ejs`,
-    { name: options.projectName },
-  );
+  const content = loadTemplate(`${options.lang}/codeql/codeql-config.yml.ejs`, {
+    name: options.projectName,
+  });
   return { path: '.github/codeql/codeql-config.yml', content };
 }
 
 export async function generateDependabot(
   options: InitOptions,
 ): Promise<GeneratedFile> {
-  const content = await loadTemplate('common/dependabot.yml.ejs', {
+  const content = loadTemplate('common/dependabot.yml.ejs', {
     lang: options.lang,
   });
   return { path: '.github/dependabot.yml', content };
 }
 
 export async function generateReleaseConfig(): Promise<GeneratedFile> {
-  const content = await loadTemplate('common/release.yml.ejs', {});
+  const content = loadTemplate('common/release.yml.ejs', {});
   return { path: '.github/release.yml', content };
 }
 

package/src/templates/common/workflows/publish.yml.ejs

@@ -0,0 +1,36 @@
+name: Publish to npm
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@<%= actionVersions['actions/checkout'] %>
+
+      - uses: oven-sh/setup-bun@<%= actionVersions['oven-sh/setup-bun'] %>
+
+      - uses: actions/setup-node@<%= actionVersions['actions/setup-node'] %>
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: bun install --frozen-lockfile
+
+      - name: Build
+        run: bun run build
+
+      - name: Test
+        run: bun test
+
+      - name: Publish to npm with provenance
+        run: npm publish --access public --provenance
+

package/src/templates/common/workflows/tagpr.yml.ejs

@@ -28,4 +28,8 @@ jobs:
           # TODO: After replace-devcode, use PAT_FOR_TAGPR instead
 <% } else { -%>
           GITHUB_TOKEN: ${{ secrets.PAT_FOR_TAGPR }}
+          GIT_COMMITTER_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
 <% } -%>