@ryusenkei/conventions 0.3.0 → 0.4.0

package/README.md

@@ -59,7 +59,7 @@ The PreToolUse hook blocks the call and tells Claude why, so Claude can fix it a
 | Secrets | `permissions.deny` blocks reading `.env` and `.dev.vars` with Claude's file tools (not Bash) |
 | Definition of done (`--stop`) | The Stop hook runs `pnpm lint` and `pnpm test` when the working tree has changes, and sends Claude back once on failure |
 
-Commit messages are checked by `.githooks/commit-msg`, and edited files by prose-lint's PostToolUse hook. `.githooks/pre-push` runs `pnpm run --if-present check`, so a repository that defines a `check` script cannot push until it passes. It applies to people as well as Claude.
+Commit messages are checked by `.githooks/commit-msg`, and edited files by prose-lint's PostToolUse hook. `.githooks/pre-push` runs `pnpm run --if-present check`, so a repository that defines a `check` script cannot push until it passes. It applies to people as well as Claude. When [jobgate](https://github.com/ryusenkei-inc/jobgate) is on the `PATH` and the repository has a `check` script, the check runs through `jobgate run`, so pushes from parallel agents and repositories wait for free memory instead of exhausting it.
 
 ### Epic flow
 
@@ -83,6 +83,7 @@ Opt in per repository in the root `package.json`:
 
 - `.editorconfig`, `.gitattributes`, `.gitignore`, `.gitleaks.toml`, `mise.toml`, `.github/dependabot.yaml`, `.githooks/commit-msg`, `.githooks/pre-push`
 - `.github/dependabot.yaml` updates npm and GitHub Actions. When the repository has a `go.mod` at the root, a `gomod` entry is appended (same schedule, rebase strategy and cooldown, minor and patch grouped). Without one it is left out, because Dependabot fails on a missing `go.mod`
+- When the repository has a `Cargo.toml` at the root, a `cargo` entry is appended to `.github/dependabot.yaml` after any `gomod` entry (same settings as `gomod`, covering workspace members), and `target/` is appended to `.gitignore`. `Cargo.lock` stays tracked
 - `.claude/settings.json`: only the hooks, `attribution`, and `permissions.deny` are managed. Other settings and hooks are kept
 - `pnpm-workspace.yaml`: `minimumReleaseAge` and `minimumReleaseAgeExclude`, matching the Dependabot `cooldown`
 

package/dist/files.js

@@ -1,17 +1,24 @@
 // 利用側のリポにある共通ファイルの同期・検査
 // - マスタ: パッケージの `files/`（npm は `.gitignore` を同梱しない → 先頭の `.` を除いた名前で格納）
 // - 比較は改行コードを LF に正規化（Windows の作業ツリーは CRLF になりうる）
-// - `append`: 条件のファイルがあるリポのみ末尾に追加（例: go.mod のないリポで gomod の更新はエラー）
+// - `append`: 条件のファイルがあるリポのみ、記載の順に末尾に追加（例: go.mod のないリポで gomod の更新はエラー）
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { hasStop, managedSettings } from "./settings.js";
 const FILES = [
     { from: 'editorconfig', to: '.editorconfig' },
     { from: 'gitattributes', to: '.gitattributes' },
-    { from: 'gitignore', to: '.gitignore' },
+    { from: 'gitignore', to: '.gitignore', append: [{ from: 'gitignore-cargo', if: 'Cargo.toml' }] },
     { from: 'gitleaks.toml', to: '.gitleaks.toml' },
     { from: 'mise.toml', to: 'mise.toml' },
-    { from: 'dependabot.yaml', to: '.github/dependabot.yaml', append: { from: 'dependabot-gomod.yaml', if: 'go.mod' } },
+    {
+        from: 'dependabot.yaml',
+        to: '.github/dependabot.yaml',
+        append: [
+            { from: 'dependabot-gomod.yaml', if: 'go.mod' },
+            { from: 'dependabot-cargo.yaml', if: 'Cargo.toml' },
+        ],
+    },
     { from: 'commit-msg', to: '.githooks/commit-msg', mode: 0o755 },
     { from: 'pre-push', to: '.githooks/pre-push', mode: 0o755 },
 ];
@@ -33,7 +40,8 @@ const master = (name) => lf(readFileSync(new URL(`../files/${name}`, import.meta
 export function drifts(root, options = {}) {
     const out = [];
     for (const f of FILES) {
-        const expected = master(f.from) + (f.append && existsSync(join(root, f.append.if)) ? master(f.append.from) : '');
+        const appended = (f.append ?? []).filter((a) => existsSync(join(root, a.if))).map((a) => master(a.from));
+        const expected = master(f.from) + appended.join('');
         if (read(join(root, f.to)) !== expected)
             out.push({ path: f.to, expected, message: 'マスタと不一致' });
     }

package/files/dependabot-cargo.yaml

@@ -0,0 +1,19 @@
+
+  # Rust のクレート（ルートに Cargo.toml があるリポのみ `sync` が追加）。ワークスペースのメンバーも横断
+  - package-ecosystem: cargo
+    directory: "/"
+    # 頻度・rebase・公開直後のバージョンの回避は npm と同じ
+    schedule:
+      interval: monthly
+    rebase-strategy: disabled
+    cooldown:
+      default-days: 2
+    commit-message:
+      prefix: build
+      include: scope
+    groups:
+      # minor・patch は1つの PR にまとめる（major は個別の PR でレビュー）
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch

package/files/gitignore-cargo

@@ -0,0 +1,3 @@
+
+# ---- Rust（ルートに Cargo.toml があるリポのみ `sync` が追加。Cargo.lock は追跡） ----
+target/

package/files/pre-push

@@ -1,3 +1,8 @@
 #!/bin/sh
 # push の前の検査（`check` のスクリプトを持つリポのみ。CI の失敗・Actions の消費を手元で防止）
+# jobgate があれば資源の空きを待って実行（並行するエージェント・リポの重い検査によるメモリの枯渇を防止）
+#   `check` のないリポは枠を待たない
+if command -v jobgate >/dev/null 2>&1 && grep -q '"check":' package.json 2>/dev/null; then
+  exec jobgate run --weight 2 -- pnpm run check
+fi
 exec pnpm run --if-present check

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ryusenkei/conventions",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "RYUSENKEI のモノリポの共通の規約（Claude Code の規約・hook、共通ファイルの同期）",
   "license": "MIT",
   "author": "RYUSENKEI",