@rmartz/merge-safety 0.10.1 → 0.12.0

package/README.md

@@ -15,11 +15,8 @@ is:
    check named exactly `merge-safety`; see
    [docs/check-run-contract.md](docs/check-run-contract.md).
 
-> **Status: released.** `v0.1.0` ships the full `evaluate` / `invalidate`
-> implementation and the `ai-merge-safety` CLI — the package is functional and
-> ready to adopt. It was split out of `@rmartz/pr-review` per
-> [ai-tools#247](https://github.com/rmartz/ai-tools/issues/247); see
-> [docs/migration.md](docs/migration.md) for the record of how it was extracted.
+> **Status: released.** The package ships the full `evaluate` / `invalidate`
+> implementation as the `merge-safety` CLI and is ready to adopt.
 
 ## Using it in a consuming repo
 
@@ -116,9 +113,11 @@ zero-runtime-dependency package, all Dependabot bumps are dev-only in practice.
 Three guards back the automatic flow: [`pr-title-lint.yml`](.github/workflows/pr-title-lint.yml)
 (pre-merge title format), [`commit-convention.yml`](.github/workflows/commit-convention.yml)
 (post-merge tripwire for a non-conventional subject that would make semantic-release
-silently skip), and, in [`ci.yml`](.github/workflows/ci.yml), the `Release notes render`
-job (renders the notes through the real changelog toolchain so an incompatible
-preset/writer pairing fails the PR) and the `Package`
+silently skip), the shared [`release-check.yml`](.github/workflows/release-check.yml)
+(renders the notes through the shared
+[semantic-release-ci](https://github.com/rmartz/semantic-release-ci) toolchain so an
+incompatible release config fails the PR), and, in [`ci.yml`](.github/workflows/ci.yml),
+the `Package`
 job (packs exactly what `pnpm publish` would upload and fails if the tarball is
 malformed or missing an `exports`/`bin` entry point) — so both a broken release config
 and a broken packaging manifest are caught before merge, not on the real release run.

package/dist/bin/merge-safety.d.ts

@@ -1,13 +1,6 @@
 #!/usr/bin/env node
 import { MergeSafetyCommand } from '../index.js';
 
-/** The open PR that heads a branch, reduced to what the barrier needs. */
-interface BasePr {
-    number: number;
-    /** The PR's label names, matched case-insensitively against the exempt set. */
-    labels: readonly string[];
-}
-
 /**
  * Base-health classification — "is the base branch's own CI failing?", the
  * PR-independent axis of the merge-safety verdict.
@@ -49,14 +42,6 @@ type BaseChecksProbe = (baseSha: string) => Promise<readonly BaseCheckRun[]>;
  * {@link BaseChecksProbe}, with the network boundary in the bin.
  */
 type RequiredChecksProbe = (baseBranch: string) => Promise<readonly string[] | null>;
-/**
- * Fetches the open PR whose **head** is a given branch — this PR's stacked parent
- * (#54) — or `null` when no open PR heads it. A failed probe also yields `null`,
- * which deliberately reads as "not stacked": an unreadable lookup must not hold a
- * PR that may not be stacked at all, the same never-wedge posture as the check
- * probes above. Injected like {@link BaseChecksProbe}.
- */
-type BasePrProbe = (baseBranch: string) => Promise<BasePr | null>;
 
 interface Args {
     mode: MergeSafetyCommand;
@@ -66,25 +51,18 @@ interface Args {
     baseRef: string;
     /**
      * The consumer's caller workflow filename that `invalidate` re-dispatches per PR
-     * (issue #247's dispatch-target wrinkle: a reusable workflow's fan-out targets
-     * the *caller* file, not this reusable file). Defaults to the conventional name.
+     * (a reusable workflow's fan-out must target the *caller* file, not this
+     * reusable file). Defaults to the conventional name.
      */
     workflow: string;
     cwd?: string;
-    /**
-     * The repository default branch, used by the stacked-PR barrier (#54). Absent →
-     * resolved from `gh repo view`; unresolvable → the barrier is disabled rather
-     * than holding every PR.
-     */
-    defaultBranch?: string;
     /**
      * `invalidate` only: the branch that moved, whose open PRs are fanned out over.
      * Any branch, not just the default — a push to a stacked parent's branch must
-     * invalidate its children (#54). Absent → the resolved default branch.
+     * invalidate its children, which may now be stale. Absent → the resolved default
+     * branch.
      */
     baseBranch?: string;
-    /** Labels on a base PR that exempt its children from the barrier (#54). */
-    exemptBaseLabels: readonly string[];
     /** Decision-only: print the verdict as JSON and perform no side effects. */
     json: boolean;
 }
@@ -107,14 +85,7 @@ declare function makeBaseChecksProbe(repo: string, cwd?: string): BaseChecksProb
  * wedging the queue on an unreadable protection config (#40).
  */
 declare function makeRequiredChecksProbe(repo: string, cwd?: string): RequiredChecksProbe;
-/**
- * A real base-PR probe: the open PR whose **head** is `baseBranch`, i.e. this PR's
- * stacked parent (#54). Soft-fails to `null` (not stacked) on any read error or
- * malformed payload, so a transient `gh` failure never holds a PR that may not be
- * stacked at all. `--limit 1` suffices: a branch heads at most one open PR.
- */
-declare function makeBasePrProbe(repo: string, cwd?: string): BasePrProbe;
 declare function runEvaluate(repo: string, pr: number, args: Args): Promise<void>;
 declare function runInvalidate(repo: string, args: Args): Promise<void>;
 
-export { type Args, makeBaseChecksProbe, makeBasePrProbe, makeRequiredChecksProbe, runEvaluate, runInvalidate };
+export { type Args, makeBaseChecksProbe, makeRequiredChecksProbe, runEvaluate, runInvalidate };

package/dist/bin/merge-safety.js

@@ -258,28 +258,6 @@ function mayCarryBreakingMarker(title) {
   return type !== void 0 && FUNCTIONAL_TYPES.has(type);
 }
 
-// src/stacked-base.ts
-var DEFAULT_EXEMPT_BASE_LABELS = ["release", "epic"];
-function isExemptBasePr(basePr, exemptLabels) {
-  const exempt = new Set(exemptLabels.map((l) => l.trim().toLowerCase()));
-  return basePr.labels.some((l) => exempt.has(l.trim().toLowerCase()));
-}
-function stackedParentPr({
-  baseBranch,
-  defaultBranch,
-  basePr,
-  exemptLabels
-}) {
-  if (!defaultBranch) return null;
-  if (!baseBranch || baseBranch === defaultBranch) return null;
-  if (!basePr) return null;
-  if (isExemptBasePr(basePr, exemptLabels)) return null;
-  return basePr.number;
-}
-function stackedBaseReason(baseBranch, parentPr) {
-  return `This PR targets \`${baseBranch}\`, the head of open PR #${parentPr} \u2014 it is stacked and must not merge until that PR does. Once #${parentPr} merges, GitHub retargets this PR to the default branch and it merges normally. Review and fixes proceed meanwhile; only the merge is held.`;
-}
-
 // src/reasons.ts
 var BREAKING_DIFF_REASONS = {
   "major-version-bump": "dependency major bump",
@@ -502,9 +480,6 @@ function evaluateMergeSafety(facts) {
   if (facts.hasConflict) {
     reasons.push("Git reports a merge conflict against the base \u2014 resolve it before merging.");
   }
-  const stackedOnPr = facts.stackedOnPr;
-  const stackedBarred = stackedOnPr !== null;
-  if (stackedOnPr !== null) reasons.push(stackedBaseReason(facts.baseBranch, stackedOnPr));
   const baseUnhealthy = facts.baseCiFailing && !facts.prIsHotfix;
   if (baseUnhealthy) {
     reasons.push(
@@ -525,10 +500,10 @@ function evaluateMergeSafety(facts) {
       )
     );
   }
-  const needsAction = facts.hasConflict || baseUnhealthy || needsCiRetitle || stackedBarred;
+  const needsAction = facts.hasConflict || baseUnhealthy || needsCiRetitle;
   const conclusion = needsAction ? "failure" : needsUpdate ? "pending" : "success";
   const summary = conclusion === "success" ? "No update required: current, or no breaking/overlapping changes on the base, no conflict, and the base CI is green." : firstLine(reasons[0] ?? "Not safe to merge as-is.");
-  const title = facts.hasConflict ? "Merge conflict" : stackedBarred ? "Base PR not merged" : baseUnhealthy ? "Base CI failing" : needsUpdate ? "Update required" : needsCiRetitle ? "Retitle as a CI change" : "No update required";
+  const title = facts.hasConflict ? "Merge conflict" : baseUnhealthy ? "Base CI failing" : needsUpdate ? "Update required" : needsCiRetitle ? "Retitle as a CI change" : "No update required";
   const add = [];
   if (needsUpdate) add.push("update required");
   if (facts.hasConflict) add.push("merge conflict");
@@ -542,7 +517,6 @@ function evaluateMergeSafety(facts) {
     hasConflict: facts.hasConflict,
     baseUnhealthy,
     needsCiRetitle,
-    stackedBarred,
     title,
     reasons,
     summary,
@@ -556,7 +530,6 @@ function errorMergeSafetyDecision(message) {
     hasConflict: false,
     baseUnhealthy: false,
     needsCiRetitle: false,
-    stackedBarred: false,
     title: "Could not evaluate",
     reasons: [message],
     summary: `Could not evaluate merge safety: ${message}`,
@@ -601,15 +574,7 @@ function parseCiPathShas(logOut) {
 function selectCommits(commits, predicate) {
   return commits.filter(predicate).map((c) => ({ sha: c.sha, subject: c.message.split("\n", 1)[0] ?? "" }));
 }
-async function gatherMergeSafetyFacts(meta, {
-  baseRef = "origin/main",
-  git,
-  baseChecks,
-  requiredChecks,
-  basePr = async () => null,
-  defaultBranch = null,
-  exemptBaseLabels = DEFAULT_EXEMPT_BASE_LABELS
-}) {
+async function gatherMergeSafetyFacts(meta, { baseRef = "origin/main", git, baseChecks, requiredChecks }) {
   const mergeBase = (await git(["merge-base", meta.headSha, baseRef]))?.trim();
   const baseTip = (await git(["rev-parse", baseRef]))?.trim();
   if (!mergeBase || !baseTip) {
@@ -646,13 +611,6 @@ async function gatherMergeSafetyFacts(meta, {
   const prDiff = await git(["diff", "--unified=0", mergeBase, meta.headSha]);
   if (prDiff === null) throw new Error(`git diff failed for ${mergeBase}..${meta.headSha}`);
   const diffSignals = breakingDiffSignals(prDiff);
-  const parentPr = defaultBranch && baseBranch !== defaultBranch ? await basePr(baseBranch) : null;
-  const stackedOnPr = stackedParentPr({
-    baseBranch,
-    defaultBranch,
-    basePr: parentPr,
-    exemptLabels: exemptBaseLabels
-  });
   const labels = meta.labels.map((l) => l.toLowerCase());
   return {
     isCurrent,
@@ -675,9 +633,7 @@ async function gatherMergeSafetyFacts(meta, {
     overlappingFiles: overlaps,
     failingBaseChecks,
     prBreakingDiffSignals: diffSignals,
-    prMayCarryBreakingMarker: mayCarryBreakingMarker(meta.title),
-    baseBranch,
-    stackedOnPr
+    prMayCarryBreakingMarker: mayCarryBreakingMarker(meta.title)
   };
 }
 
@@ -685,7 +641,7 @@ async function gatherMergeSafetyFacts(meta, {
 var DEFAULT_CALLER_WORKFLOW = "merge-safety.yml";
 function usage() {
   console.error(
-    "usage: ai-merge-safety evaluate --pr <n> [--json] [--repo <o/r>] [--base <ref>] [--cwd <path>]\n                                 [--default-branch <name>] [--exempt-base-labels <csv>]\n       ai-merge-safety invalidate [--base-branch <name>] [--workflow <file>] [--exclude <n>]\n                                   [--repo <o/r>] [--cwd <path>]"
+    "usage: merge-safety evaluate --pr <n> [--json] [--repo <o/r>] [--base <ref>] [--cwd <path>]\n       merge-safety invalidate [--base-branch <name>] [--workflow <file>] [--exclude <n>]\n                                   [--repo <o/r>] [--cwd <path>]"
   );
   process.exit(2);
 }
@@ -696,7 +652,6 @@ function parse(argv) {
     mode,
     baseRef: "origin/main",
     workflow: DEFAULT_CALLER_WORKFLOW,
-    exemptBaseLabels: DEFAULT_EXEMPT_BASE_LABELS,
     json: false
   };
   for (let i = 1; i < argv.length; i++) {
@@ -707,10 +662,7 @@ function parse(argv) {
     else if (a === "--base") args.baseRef = argv[++i] ?? args.baseRef;
     else if (a === "--workflow") args.workflow = argv[++i] ?? args.workflow;
     else if (a === "--cwd") args.cwd = argv[++i];
-    else if (a === "--default-branch") args.defaultBranch = argv[++i];
     else if (a === "--base-branch") args.baseBranch = argv[++i];
-    else if (a === "--exempt-base-labels")
-      args.exemptBaseLabels = (argv[++i] ?? "").split(",").map((l) => l.trim()).filter(Boolean);
     else if (a === "--json" || a === "--dry-run") args.json = true;
     else usage();
   }
@@ -778,31 +730,6 @@ function makeRequiredChecksProbe(repo, cwd) {
     return [...new Set(contexts)];
   };
 }
-function makeBasePrProbe(repo, cwd) {
-  return async (baseBranch) => {
-    const prs = await ghJson(
-      [
-        "gh",
-        "pr",
-        "list",
-        "--repo",
-        repo,
-        "--state",
-        "open",
-        "--head",
-        baseBranch,
-        "--limit",
-        "1",
-        "--json",
-        "number,labels"
-      ],
-      cwd
-    );
-    const pr = prs?.[0];
-    if (!pr) return null;
-    return { number: pr.number, labels: (pr.labels ?? []).map((l) => l.name) };
-  };
-}
 async function resolveDefaultBranch(repo, override, cwd) {
   if (override) return override;
   const view = await ghJson(
@@ -851,10 +778,7 @@ async function runEvaluate(repo, pr, args) {
       baseRef: args.baseRef,
       git: makeGitRunner(args.cwd),
       baseChecks: makeBaseChecksProbe(repo, args.cwd),
-      requiredChecks: makeRequiredChecksProbe(repo, args.cwd),
-      basePr: makeBasePrProbe(repo, args.cwd),
-      defaultBranch: await resolveDefaultBranch(repo, args.defaultBranch, args.cwd),
-      exemptBaseLabels: args.exemptBaseLabels
+      requiredChecks: makeRequiredChecksProbe(repo, args.cwd)
     });
     decision = evaluateMergeSafety(facts);
   } catch (err) {
@@ -959,7 +883,6 @@ function isDirectRun() {
 if (isDirectRun()) void main();
 export {
   makeBaseChecksProbe,
-  makeBasePrProbe,
   makeRequiredChecksProbe,
   runEvaluate,
   runInvalidate

package/dist/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Encodes the package's stable public contract: the `merge-safety` check-run
  * name and the CLI command surface. The evaluate/invalidate implementation
- * (`merge-safety.ts` + `merge-safety-facts.ts` and the `ai-merge-safety` bin)
+ * (`merge-safety.ts` + `merge-safety-facts.ts` and the `merge-safety` bin)
  * lives alongside it; this module is intentionally the narrow, frozen surface
  * consumers and the reusable workflow depend on.
  */
@@ -19,7 +19,7 @@
  */
 declare const MERGE_SAFETY_CHECK_NAME = "merge-safety";
 /**
- * The two operations the `ai-merge-safety` CLI dispatches:
+ * The two operations the `merge-safety` CLI dispatches:
  * - `evaluate` — gather base-currency + breaking-change + conflict facts for one
  *   PR, post the `merge-safety` check-run, and reconcile the update-required /
  *   merge-conflict labels.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmartz/merge-safety",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "The pre-auto-merge safety verdict for a PR (base-currency, breaking-change, and conflict facts), posted as the `merge-safety` check-run and distributed via a reusable workflow kept current by Dependabot.",
   "keywords": [
     "ci",
@@ -26,7 +26,7 @@
     }
   },
   "bin": {
-    "ai-merge-safety": "./dist/bin/merge-safety.js"
+    "merge-safety": "./dist/bin/merge-safety.js"
   },
   "files": [
     "dist"
@@ -47,22 +47,17 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "verify:release-notes": "node scripts/verify-changelog-render.mjs"
+    "test:watch": "vitest"
   },
   "devDependencies": {
-    "@semantic-release/exec": "^7.1.0",
-    "@semantic-release/release-notes-generator": "^14.1.1",
     "@types/node": "^26.6.2",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
     "@vitest/coverage-v8": "^5.0.1",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
     "eslint": "^10.11.0",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
     "prettier": "^3.9.8",
-    "semantic-release": "^25.0.9",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",