@rtorcato/repo-tooling 4.2.0 → 4.3.1

package/AGENTS.md

@@ -8,7 +8,7 @@ A one-package JavaScript / TypeScript tooling distribution. Ships every preset (
 
 **Swift** repos (detected via `Package.swift`) are covered end to end: `setup --preset swift-library` scaffolds a SwiftPM package, and `doctor`/`fix` run the language-agnostic checks plus SwiftLint / Periphery / `.gitignore` / `Package.swift`. **Python** repos (detected via `pyproject.toml` / `setup.py`) get `doctor`/`fix` — Ruff / mypy / pytest / `.gitignore` / CI / git hooks — but no `setup` preset yet. **Perl** distributions (detected via `cpanfile` / `Makefile.PL` / `dist.ini`) get the same deal: Perl::Critic / perltidy / `.gitignore` / CI / git hooks, no `setup` preset. See `src/languages/` — one directory per language module, `src/base/` for what's shared.
 
-The **ai-issue-loop** pipeline (the `loop` commands, its skills, and the label / agent-user / skills checks) lives in [`@rtorcato/repo-ai`](https://github.com/rtorcato/repo-ai) since #658. `repo-tooling loop` now only prints a pointer there. Its settings still sit in this package's `.repo-tooling.json` under `rules.aiLoop` and `rules.requiredSkills`, which repo-tooling carries forward without reading.
+repo-tooling stands alone. The **ai-issue-loop** pipeline (the `loop` commands, its skills, and the label / agent-user / skills checks) is an optional companion package, [`@rtorcato/repo-ai`](https://rtorcato.github.io/repo-ai/), since #658. Nothing here requires it or checks for it; `repo-tooling loop` only prints a pointer there. Its settings sit in this package's `.repo-tooling.json` under `rules.aiLoop` and `rules.requiredSkills`, which repo-tooling carries forward without reading. See `apps/docs/docs/guides/ai-issue-loop.md` for how the two fit together.
 
 ## CLI surface (agent-friendly)
 

package/README.md

@@ -137,6 +137,7 @@ full field reference. The keys `doctor` acts on:
 - `securityAutomation` — boolean (Dependabot + CodeQL)
 - `bundler` — `tsup` \| `esbuild` \| `vite` \| `none`
 - `aiSetup` — boolean (AGENTS.md, CLAUDE.md, Cursor/Copilot rules)
+- `brand` — boolean (`brand/` banner + social-card SVG sources and `render.sh`)
 
 **How opt-outs actually work.** When the lockfile records that you declined an
 *optional* tool (e.g. `securityAutomation: false`), `doctor` demotes that check
@@ -190,19 +191,22 @@ throwaway fixtures) — in any session:
 /plugin install repo-tooling@repo-tooling
 ```
 
-### The AI issue loop
+### Optional: agents on your issue queue (repo-ai)
 
-The label-driven `ai-ready` issue → PR pipeline (the `ai-workflow`,
-`ai-issue-loop`, `ai-issue` and `ai-loop-status` skills, and the `loop`
-commands they call) moved to its own package,
-[`@rtorcato/repo-ai`](https://github.com/rtorcato/repo-ai), so this one can be
-used without it:
+repo-tooling works entirely on its own. If you also want agents working your
+GitHub issues, the optional companion
+[`@rtorcato/repo-ai`](https://rtorcato.github.io/repo-ai/) runs a label-driven
+loop: an `ai-ready` issue becomes a worktree, a PR and two agent reviews, then
+waits for you to merge. It builds on the repo standard repo-tooling sets up
+(branch protection, the release gate, worktree config) and keeps its settings in
+the same `.repo-tooling.json`:
 
 ```bash
-npx @rtorcato/repo-ai fix claude-skills   # → ~/.claude/skills/{ai-issue-loop,ai-workflow,ai-issue,ai-loop-status}/SKILL.md
+npx @rtorcato/repo-ai setup
 ```
 
-Its settings stay in `.repo-tooling.json` (`rules.aiLoop`, `rules.requiredSkills`).
+See [Using with repo-ai](https://rtorcato.github.io/repo-tooling/guides/ai-issue-loop/)
+for how the two fit together. The loop shipped inside repo-tooling until 4.0.0.
 
 ### Use with other AI tools (Cursor / Copilot / Codex)
 

package/dist/base/checks.js

@@ -266,6 +266,11 @@ export async function checkDependabot(dir) {
                 if (!automerge.includes("package-ecosystem == 'github-actions'")) {
                     deltas.push('auto-merge workflow leaves CI action bumps to a human (#452)');
                 }
+                // #694: a declined PR used to get only a log notice — no assignee, no
+                // comment — and could sit green and ownerless indefinitely.
+                if (!automerge.includes("steps.merge.outcome == 'skipped'")) {
+                    deltas.push('auto-merge workflow leaves declined PRs with no owner (#694)');
+                }
             }
             else {
                 deltas.push('missing dependabot-automerge workflow');

package/dist/base/github-settings.js

@@ -217,7 +217,7 @@ async function checkBranchProtection(exec, nwo, branch) {
  * enabled only makes them available on the merge button, and one mis-click puts
  * every intermediate branch commit on the default branch: semantic-release then
  * reads subjects nobody reviewed (a stray `fix:` inside a docs PR cuts a
- * release), and `ai-issue-loop`'s Pass 2 stops finding the `(#N)` squash subject
+ * release), and repo-ai's `ai-loop` cleanup stops finding the `(#N)` squash subject
  * it uses to confirm work landed, so worktrees leak. Observed on `js-common`
  * #204, whose CONTRIBUTING already said squash-only — the rule existed, nothing
  * enforced it.
@@ -706,8 +706,8 @@ const PROTECTION_BODY = JSON.stringify({
     // any required_pull_request_reviews as drift, so `fix github-settings` PUTs it
     // back to null. A repo that deliberately requires approvals will have that
     // silently reverted by the next unrelated fix run, with nothing in the output
-    // naming the rule that was removed. Known downstream case: the ai-issue-loop
-    // pipeline works around it with approval labels precisely because of this.
+    // naming the rule that was removed. Known downstream case: @rtorcato/repo-ai's
+    // ai-loop pipeline works around it with approval labels precisely because of this.
     // Loosen the standard here first if a repo ever genuinely needs review gating.
     required_pull_request_reviews: null,
     restrictions: null,

package/dist/cli/commands/fix-targets.js

@@ -173,6 +173,8 @@ export function declinedInLock(lock, checkName) {
             return c.turborepo === false;
         case 'Tailwind':
             return c.tailwind === false;
+        case 'Brand assets':
+            return c.brand === false;
         default:
             return false;
     }
@@ -246,6 +248,8 @@ export function lockfilePatchForTarget(target, lock) {
             return c.docsSite ? null : { docsSite: true };
         case 'bun':
             return c.bun ? null : { bun: true };
+        case 'brand':
+            return c.brand ? null : { brand: true };
         default:
             return null;
     }

package/dist/cli/commands/setup-presets.js

@@ -59,6 +59,7 @@ export function buildPresetConfig(name, projectName) {
                 semanticRelease: true,
                 bundler: 'tsup',
                 publint: true,
+                brand: true,
             };
         case 'web-app':
             return {
@@ -210,6 +211,7 @@ export const CONFIG_SCHEMA = {
         nx: { type: 'boolean' },
         tailwind: { type: 'boolean' },
         docsSite: { type: 'boolean' },
+        brand: { type: 'boolean' },
         bun: { type: 'boolean' },
     },
 };
@@ -315,6 +317,8 @@ export function computeFileList(config) {
         files.push('postcss.config.mjs', 'src/styles/globals.css');
     if (config.bun)
         files.push('bunfig.toml');
+    if (config.brand)
+        files.push('brand/banner.svg', 'brand/banner-mobile.svg', 'brand/social-card.svg', 'brand/render.sh');
     files.push('README.md');
     return files;
 }

package/dist/cli/commands/setup.js

@@ -22,6 +22,7 @@ const REVIEWABLE_FEATURES = [
     { key: 'securityAutomation', label: 'Security automation (Dependabot + CodeQL)' },
     { key: 'badges', label: 'README status badges' },
     { key: 'aiSetup', label: 'AI agent rules (AGENTS.md, CLAUDE.md, Cursor, Copilot)' },
+    { key: 'brand', label: 'Brand assets (brand/ banner + social-card SVGs, render.sh)' },
 ];
 /**
  * A preset run may only ask questions when a human is on both ends of the pipe.
@@ -457,6 +458,13 @@ async function promptForConfig(targetDir, seed) {
             message: '🤖 Add AI agent rules (AGENTS.md, CLAUDE.md, Cursor, Copilot, Claude skill)?',
             default: seed?.aiSetup ?? true,
         },
+        {
+            type: 'confirm',
+            name: 'brand',
+            message: '🎨 Add brand assets (brand/ banner + social-card SVG sources, render.sh)?',
+            // On by default for libraries — the ones that publish a README to npm.
+            default: (answers) => seed?.brand ?? answers.projectType === 'library',
+        },
         {
             type: 'select',
             name: 'orchestrator',
@@ -546,6 +554,7 @@ async function promptForConfig(targetDir, seed) {
         publint: answers.publint ?? false,
         badges: answers.badges ?? false,
         aiSetup: answers.aiSetup ?? false,
+        brand: answers.brand ?? false,
         turborepo: answers.orchestrator === 'turbo',
         nx: answers.orchestrator === 'nx',
         tailwind: answers.tailwind ?? false,

package/dist/cli/generators/docs-site.js

@@ -29,6 +29,9 @@ const SELF_RANGE = `^${selfPackageJson.version}`;
 const DOCS_APP = 'apps/docs';
 /** Docusaurus's neutral green — the default accent, meant to be branded over. */
 const DEFAULT_ACCENT = { light: '#2e8555', dark: '#25c2a0' };
+// One range for every @docusaurus/* package; TypeScript tracks repo-tooling's own devDependency (tested).
+export const DOCUSAURUS_RANGE = '^3.10.2';
+export const TYPESCRIPT_RANGE = '~7.0.2';
 /**
  * Source modules to document with TypeDoc: single-segment subpath exports
  * (`./errors` → `errors`), which map to `src/<id>/index.ts`. Multi-segment
@@ -288,8 +291,8 @@ function docsPackageJson(meta, typedoc) {
             typecheck: 'tsc --noEmit',
         },
         dependencies: {
-            '@docusaurus/core': '^3.10.2',
-            '@docusaurus/preset-classic': '^3.8.1',
+            '@docusaurus/core': DOCUSAURUS_RANGE,
+            '@docusaurus/preset-classic': DOCUSAURUS_RANGE,
             '@easyops-cn/docusaurus-search-local': '^0.55.2',
             '@mdx-js/react': '^3.1.0',
             clsx: '^2.1.1',
@@ -298,12 +301,12 @@ function docsPackageJson(meta, typedoc) {
             'react-dom': '^19.0.0',
         },
         devDependencies: {
-            '@docusaurus/module-type-aliases': '^3.10.2',
-            '@docusaurus/tsconfig': '^3.8.1',
-            '@docusaurus/types': '^3.10.2',
+            '@docusaurus/module-type-aliases': DOCUSAURUS_RANGE,
+            '@docusaurus/tsconfig': DOCUSAURUS_RANGE,
+            '@docusaurus/types': DOCUSAURUS_RANGE,
             '@rtorcato/repo-tooling': SELF_RANGE,
             '@types/react': '^19.0.0',
-            typescript: '~5.6.3',
+            typescript: TYPESCRIPT_RANGE,
             ...typedocDevDeps,
         },
         browserslist: {

package/dist/cli/generators/index.js

@@ -19,6 +19,7 @@ import { generateTailwind } from './tailwind.js';
 import { generateTurborepo } from './turborepo.js';
 import { generateNx } from './nx.js';
 import { generateBun } from './bun.js';
+import { generateBrand } from './brand.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 export async function generateConfigs(config, targetDir) {
@@ -122,6 +123,11 @@ export async function generateConfigs(config, targetDir) {
     }
     // Generate README
     await generateReadme(config, targetDir);
+    // brand/ (#677) — the same generator as `fix brand`. After the README so the
+    // banner-path repoint sees it; no tagline yet, as the lockfile isn't written.
+    if (config.brand) {
+        await generateBrand(await fs.readJson(path.join(targetDir, 'package.json')), targetDir);
+    }
     // Copy ts-reset if TypeScript is enabled
     if (config.typescript.enabled) {
         await copyTSReset(targetDir);

package/dist/cli/generators/security.js

@@ -163,6 +163,8 @@ export function dependabotIgnoreRules(content) {
  * Everything else falls through to a human: production bumps ship to consumers
  * of a published package (#423), majors are breaking by definition, and an
  * ungrouped npm PR reports an empty \`dependency-group\`, so the gate fails closed.
+ * A PR that falls through is assigned to the repo owner with one upserted comment
+ * saying why (#694), so it never sits green and ownerless.
  *
  * CI action bumps are the one ungrouped case that is allowed through, matched on
  * \`package-ecosystem\` (#452): they reach no consumer of the published package
@@ -226,11 +228,13 @@ jobs:
           # No names reported means we cannot verify anything — fail closed.
           if [ -z "\${NAMES//[, ]/}" ]; then
             echo "::notice::no dependency names reported — leaving this PR for a human"
+            echo "reason=Dependabot reported no dependency names, so nothing could be verified" >> "$GITHUB_OUTPUT"
             safe=false
           fi
           for name in \${NAMES//,/ }; do
             if printf '%s\\n' "$ships" | grep -qxF -- "$name"; then
               echo "::notice::$name ships to consumers — leaving this PR for a human"
+              echo "reason=$name ships to consumers of this package" >> "$GITHUB_OUTPUT"
               safe=false
               break
             fi
@@ -247,6 +251,7 @@ jobs:
       # "ci(deps): …", which cuts no release. Majors still fall through to a
       # human — the update-type clause below applies to them too.
       - name: Auto-merge dev-dependency and CI action patch and minor updates
+        id: merge
         if: |
           steps.gate.outputs.safe == 'true' &&
           (steps.metadata.outputs.dependency-group == 'dev-minor' ||
@@ -257,6 +262,46 @@ jobs:
         env:
           PR_URL: \${{ github.event.pull_request.html_url }}
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+
+      # Everything the step above declines needs a human, and a notice in the
+      # Actions log is not one (#694). Assign the repo owner and say why in a
+      # single comment, edited in place on every later run rather than repeated.
+      - name: Hand the PR to a human
+        if: steps.merge.outcome == 'skipped'
+        env:
+          PR_URL: \${{ github.event.pull_request.html_url }}
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          REPO: \${{ github.repository }}
+          PR_NUMBER: \${{ github.event.pull_request.number }}
+          OWNER: \${{ github.repository_owner }}
+          REASON: \${{ steps.gate.outputs.reason }}
+          UPDATE_TYPE: \${{ steps.metadata.outputs.update-type }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "$REASON" ]; then
+            case "$UPDATE_TYPE" in
+              version-update:semver-major) REASON="this is a major version bump" ;;
+              version-update:semver-minor | version-update:semver-patch)
+                REASON="this is neither a dev-minor group bump nor a CI action bump, so it may ship to consumers" ;;
+              *) REASON="Dependabot reported no update type, so nothing could be verified" ;;
+            esac
+          fi
+
+          marker='<!-- dependabot-automerge:manual-review -->'
+          body="$marker
+          Not auto-merged: $REASON. Leaving this for @$OWNER to review and merge by hand."
+
+          ids=$(gh api --paginate "repos/$REPO/issues/$PR_NUMBER/comments" \\
+            --jq ".[] | select(.body | startswith(\\"$marker\\")) | .id")
+          if [ -n "$ids" ]; then
+            gh api -X PATCH "repos/$REPO/issues/comments/\${ids%%$'\\n'*}" -f body="$body" > /dev/null
+          else
+            gh pr comment "$PR_URL" --body "$body"
+          fi
+
+          # An organisation login cannot be assigned; the comment still stands.
+          gh pr edit "$PR_URL" --add-assignee "$OWNER" || echo "::warning::could not assign $OWNER"
 `;
 /** Relative paths this generator owns, in a stable order for \`filesWritten\`. */
 export const DEPENDABOT_FILES = [

package/dist/cli/utils/lockfile.js

@@ -36,8 +36,6 @@ export const MCP_IMPORTANCE = ['nice-to-have', 'important', 'critical'];
  * be this tool asserting a rule on a repo whose humans have not stated any.
  */
 export const DEFAULT_RULES = {
-    aiLoop: {},
-    requiredSkills: [],
     mcp: { recommended: [] },
     exceptions: {},
 };
@@ -111,7 +109,8 @@ export function lockfileSchema() {
                     aiLoop: {
                         type: 'object',
                         additionalProperties: false,
-                        description: 'Settings for the ai-issue-loop skills from @rtorcato/repo-ai. Repo-scoped on purpose: committed here they travel with the repo and survive a new laptop.',
+                        deprecated: true,
+                        description: 'Deprecated: moved to `.repo-ai.json`, owned by @rtorcato/repo-ai. Still accepted so existing files validate; removed in the next major. `npx @rtorcato/repo-ai fix config` moves it across.',
                         properties: {
                             agentUser: {
                                 type: 'string',
@@ -122,7 +121,8 @@ export function lockfileSchema() {
                     requiredSkills: {
                         type: 'array',
                         items: { type: 'string' },
-                        description: "Agent skills this repo's workflows depend on. Audited by `npx @rtorcato/repo-ai doctor`, which reports a missing or stale installed copy; it never installs one for you.",
+                        deprecated: true,
+                        description: 'Deprecated: moved to `.repo-ai.json`, owned by @rtorcato/repo-ai. Still accepted so existing files validate; removed in the next major. `npx @rtorcato/repo-ai fix config` moves it across.',
                     },
                     mcp: {
                         type: 'object',

package/dist/languages/js/checks.js

@@ -1188,8 +1188,8 @@ export async function checkTreeshakeSetup(dir, pkg) {
  * checkout (#396). JS-only: the other language modules have nothing to symlink.
  *
  * Two consumers, one list (#527). Claude Code honours the setting only for
- * worktrees it creates itself (`EnterWorktree`); the shipped `ai-issue-loop`
- * skill creates its own with `git worktree add`, so it reads this same list and
+ * worktrees it creates itself (`EnterWorktree`); @rtorcato/repo-ai's `ai-loop`
+ * creates its own with `git worktree add`, so it reads this same list and
  * makes the symlinks itself. That is why the check is worth passing on a repo
  * running the loop, where the setting alone would govern nothing.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "4.2.0",
+	"version": "4.3.1",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [
@@ -248,6 +248,7 @@
 		"@next/eslint-plugin-next": "^16.3.2",
 		"@playwright/test": "^1.62.1",
 		"@rollup/plugin-typescript": "^12.3.0",
+		"@rtorcato/repo-ai": "^3.1.1",
 		"@semantic-release/commit-analyzer": "^13.0.1",
 		"@semantic-release/exec": "^7.1.0",
 		"@semantic-release/github": "^12.0.9",