@rmartz/merge-safety 0.13.0 → 0.14.0

package/README.md

@@ -6,11 +6,13 @@ breaking-change, and conflict facts for a PR, posts them as the `merge-safety`
 check-run, and re-holds every open PR when the base branch moves — so a PR only
 auto-merges once it is genuinely safe against the current base.
 
-It is distributed the same way [`@rmartz/repo-hygiene`](https://github.com/rmartz/repo-hygiene)
-is:
+Consuming repos adopt it through the composite action
+[**`rmartz/merge-safety-action`**](https://github.com/rmartz/merge-safety-action),
+distributed the same way as the fleet's other `-action` repos:
 
-1. **Updates propagate automatically.** Consuming repos pin one reusable workflow
-   by SHA; Dependabot's `github-actions` ecosystem opens PRs to bump that pin.
+1. **Updates propagate automatically.** Consuming repos pin the action by SHA;
+   Dependabot's `github-actions` ecosystem opens PRs to bump that pin, and each
+   action release pins a specific version of this CLI.
 2. **The check-run name is a fleet contract.** Every consumer requires a status
    check named exactly `merge-safety`; see
    [docs/check-run-contract.md](docs/check-run-contract.md).
@@ -20,60 +22,22 @@ is:
 
 ## Using it in a consuming repo
 
-Add one caller workflow (this is what Dependabot keeps current). Unlike a
-read-only hygiene check, this caller carries the triggers, grants write scopes,
-and passes secrets through — because a reusable workflow can't declare its own
-triggers and runs with the intersection of granted and declared permissions:
-
-```yaml
-# .github/workflows/merge-safety.yml
-name: merge-safety
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, edited, labeled, unlabeled]
-  push:
-    branches: [main]
-  check_suite:
-    types: [completed]
-  workflow_dispatch:
-    inputs:
-      pr:
-        description: PR number to evaluate
-        required: true
-permissions:
-  checks: write
-  statuses: write
-  pull-requests: write
-  contents: read
-  actions: write
-  packages: read
-jobs:
-  merge-safety:
-    uses: rmartz/merge-safety/.github/workflows/merge-safety.yml@<sha> # vX.Y.Z
-    with:
-      pr: ${{ inputs.pr }}
-    secrets: inherit
-```
-
-Then require the `merge-safety` status check on the default branch. Both the
-caller and the Dependabot entry are seeded once by
-[`@rmartz/bootstrap`](https://github.com/rmartz/ai-tools)
-(`ai-ensure-project-config`); after that Dependabot maintains the pin. The
-`@rmartz/merge-safety` CLI is public on npmjs, so installing it needs no token.
-(Pins at v0.6.0 or earlier install from GitHub Packages instead, which is what the
-`packages: read` permission above is for; it can be dropped once your pin is past
-v0.6.0.)
+Add the caller workflow from the action's
+[consumer guide](https://github.com/rmartz/merge-safety-action/blob/main/docs/consuming.md),
+create the labels merge-safety manages, and require the `merge-safety` status
+check on the default branch. See [docs/consuming.md](docs/consuming.md) for what
+the verdict expects of a repo and how it behaves.
 
-> For the full walkthrough — the caller's permissions, why it isn't trigger-free,
-> and how to verify the setup — see the
-> [consumer setup guide](docs/consuming.md).
+> **The reusable workflow in this repo is deprecated.** Repos pinned to
+> `rmartz/merge-safety/.github/workflows/merge-safety.yml` keep working and see a
+> deprecation warning on each run; migrate them to the action.
 
 ## Requirements
 
 - Node.js >= 20.11
 - pnpm 9 (pinned via `packageManager`)
 
-Consuming repos need neither — the reusable workflow runs the published CLI on a
+Consuming repos need neither — the action runs the published CLI on a
 GitHub-hosted runner.
 
 ## Local development
@@ -98,9 +62,9 @@ OIDC trusted publishing with provenance — no npm token), and creates the git t
 GitHub Release with generated notes — using only the built-in `GITHUB_TOKEN`, no
 release-please and no PAT. There is deliberately **no
 `@semantic-release/git`**: `package.json`'s `version` is a frozen `0.0.0` placeholder
-and is never committed back. The version installed by the reusable workflow is
-resolved at runtime from the **release tag at its own pinned commit**, so it lives
-only in the git tag. Config: [`.releaserc.json`](.releaserc.json).
+and is never committed back. The version installed by the deprecated reusable
+workflow is resolved at runtime from the **release tag at its own pinned commit**,
+so it lives only in the git tag; the action pins the version in its own lockfile. Config: [`.releaserc.json`](.releaserc.json).
 
 **Version mapping (v0):** `feat:` → minor; `fix:`/`perf:` → patch. Pre-1.0, a
 breaking change (`!`) is **capped at minor** so it can't auto-jump to `1.0.0`;

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@rmartz/merge-safety",
-  "version": "0.13.0",
-  "description": "The pre-auto-merge safety verdict for a PR (base-currency, breaking-change, and conflict facts), posted as the `merge-safety` check-run and distributed via a reusable workflow kept current by Dependabot.",
+  "version": "0.14.0",
+  "description": "The pre-auto-merge safety verdict for a PR (base-currency, breaking-change, and conflict facts), posted as the `merge-safety` check-run and distributed through the `rmartz/merge-safety-action` composite action kept current by Dependabot.",
   "keywords": [
     "ci",
     "merge-safety",
     "auto-merge",
     "github-actions",
-    "reusable-workflow",
+    "composite-action",
     "check-run"
   ],
   "homepage": "https://github.com/rmartz/merge-safety#readme",