@smoothbricks/cli 0.1.1 → 0.2.0

package/dist/release/index.js

@@ -5,10 +5,12 @@ import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, stringProperty } from '../lib/json.js';
-import { decode, run, runStatus } from '../lib/run.js';
+import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
+import { decode, run, runResult, runStatus } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
+import { bootstrapNpmPackages, NPM_BOOTSTRAP_DIST_TAG, NPM_BOOTSTRAP_VERSION, } from './bootstrap-npm-packages.js';
+import { autoReleaseCandidatePackages } from './candidates.js';
 import { collectOwnedReleaseTagRecords, pendingReleaseTargets, releaseTag, } from './core.js';
 import { createOrUpdateGithubRelease, renderNxProjectChangelogContents } from './github-release.js';
 import { publishWithAuthDiagnostics } from './npm-auth.js';
@@ -17,12 +19,12 @@ import { retagUnpublished } from './retag-unpublished.js';
 export async function releaseVersion(root, options) {
     const bump = releaseBumpArg(options.bump);
     const packages = releasePackages(root);
-    const projects = releasePackageProjects(packages);
     const result = await runReleaseVersion({
         releasePackagesAtHead: () => releasePackagesAtHead(root, packages),
+        releaseVersionPackages: (releaseBump) => releaseVersionPackages(root, packages, releaseBump),
         ensureLocalReleaseTags: (releasePackages) => ensureLocalReleaseTags(root, releasePackages),
         gitHead: () => gitHead(root),
-        runNxReleaseVersion: (releaseBump, dryRun) => runNxReleaseVersion(root, projects, releaseBump, dryRun),
+        runNxReleaseVersion: (releasePackages, releaseBump, dryRun) => runNxReleaseVersion(root, releasePackageProjects(releasePackages), releaseBump, dryRun),
         assertCleanGitTree: () => assertCleanGitTree(root),
     }, { bump, dryRun: options.dryRun === true });
     if (result.status === 'already-release-target') {
@@ -76,56 +78,107 @@ export async function releaseRepairPending(root, options) {
 export async function releaseTrustPublisher(root, options) {
     const repository = githubRepositoryFromRootPackage(root);
     const workflow = 'publish.yml';
-    const packages = listReleasePackages(root);
+    await configureTrustedPublishers({
+        repository,
+        workflow,
+        listReleasePackages: () => listReleasePackages(root),
+        packageExists: (name) => npmPackageExists(root, name),
+        bootstrapNpmPackages: (bootstrapOptions) => bootstrapNpmPackages({
+            listReleasePackages: () => listReleasePackages(root),
+            packageExists: (name) => npmPackageExists(root, name),
+            login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+            publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+            promptOtp: (packageName) => promptForNpmOtp(packageName),
+            log: (message) => console.log(message),
+        }, bootstrapOptions),
+        login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+        trustPublisher: (pkg, dryRun, env) => {
+            const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
+            if (dryRun) {
+                args.push('--dry-run');
+            }
+            return runLatestNpmTrust(root, args, env);
+        },
+        promptOtp: (packageName) => promptForNpmOtp(packageName),
+        log: (message) => console.log(message),
+        error: (message) => console.error(message),
+    }, options);
+}
+export async function configureTrustedPublishers(shell, options) {
+    const packages = shell.listReleasePackages();
     if (packages.length === 0) {
         throw new Error('No owned release packages found.');
     }
+    let bootstrapLoggedIn = false;
+    if (options.bootstrap) {
+        const bootstrapped = await shell.bootstrapNpmPackages({
+            dryRun: options.dryRun === true,
+            skipLogin: options.skipLogin === true,
+            otp: options.bootstrapOtp,
+            packages: [],
+        });
+        bootstrapLoggedIn = bootstrapped.length > 0 && !options.dryRun && !options.skipLogin;
+    }
     if (!options.dryRun) {
-        const packageStates = await Promise.all(packages.map(async (pkg) => ((await npmPackageExists(root, pkg.name)) ? null : pkg.name)));
+        const packageStates = await Promise.all(packages.map(async (pkg) => ((await shell.packageExists(pkg.name)) ? null : pkg.name)));
         const missingPackages = packageStates.filter((name) => name !== null);
         if (missingPackages.length > 0) {
             throw new Error('npm trusted publishing can only be configured after packages exist on the registry. ' +
-                'Bootstrap the first publish with a temporary NPM_TOKEN, then rerun trust-publisher. ' +
+                'Run smoo release trust-publisher --bootstrap locally. ' +
                 `Missing packages: ${missingPackages.join(', ')}`);
         }
     }
-    if (!options.dryRun && !options.skipLogin) {
-        await runLatestNpm(root, ['login', '--auth-type=web']);
+    if (!options.dryRun && !options.skipLogin && !bootstrapLoggedIn) {
+        await shell.login();
     }
     const failedPackages = [];
     for (const pkg of packages) {
-        console.log(`${pkg.name}: trusting GitHub Actions ${repository}/${workflow}`);
-        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
-        if (options.dryRun) {
-            args.push('--dry-run');
-        }
+        shell.log(`${pkg.name}: trusting GitHub Actions ${shell.repository}/${shell.workflow}`);
         while (true) {
-            const otp = options.dryRun ? undefined : (options.otp ?? (await promptForNpmOtp(pkg.name)));
+            const otp = options.dryRun ? undefined : (options.otp ?? (await shell.promptOtp(pkg.name)));
             try {
-                await runLatestNpm(root, args, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+                const result = await shell.trustPublisher(pkg, options.dryRun === true, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+                if (result === 'already-configured') {
+                    shell.log(`${pkg.name}: npm trusted publisher is already configured; skipping.`);
+                }
                 break;
             }
             catch (error) {
-                console.error(`${pkg.name}: npm trusted publisher setup failed.`);
-                console.error(error instanceof Error ? error.message : String(error));
+                shell.error(`${pkg.name}: npm trusted publisher setup failed.`);
+                shell.error(error instanceof Error ? error.message : String(error));
                 if (!options.dryRun) {
-                    console.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
+                    shell.error('npm OTP codes are single-use. Generate a fresh OTP before retrying this package.');
                 }
                 if (options.otp || options.dryRun) {
                     failedPackages.push(pkg.name);
                     break;
                 }
-                console.error('Retrying this package. Press Ctrl-C to stop.');
+                shell.error('Retrying this package. Press Ctrl-C to stop.');
             }
         }
     }
     if (failedPackages.length > 0) {
-        console.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
+        shell.error(`Trusted publishing was not configured for: ${failedPackages.join(', ')}`);
         if (options.otp) {
-            console.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
+            shell.error('Rerun smoo release trust-publisher without --otp to enter a fresh OTP for each failed package.');
         }
     }
 }
+export async function releaseBootstrapNpmPackages(root, options) {
+    await bootstrapNpmPackages({
+        listReleasePackages: () => listReleasePackages(root),
+        packageExists: (name) => npmPackageExists(root, name),
+        login: () => runLatestNpm(root, ['login', '--auth-type=web']),
+        publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
+        promptOtp: (packageName) => promptForNpmOtp(packageName),
+        log: (message) => console.log(message),
+    }, {
+        dryRun: options.dryRun === true,
+        skipLogin: options.skipLogin === true,
+        otp: options.otp,
+        packages: options.packages ?? [],
+    });
+}
 export async function releaseRetagUnpublished(root, options) {
     const toRef = options.to ?? 'HEAD';
     const dispatch = options.dispatch === true;
@@ -159,15 +212,14 @@ async function listUnpublishedPackages(root, packages) {
     const states = await Promise.all(packages.map(async (pkg) => ({ pkg, published: await npmVersionExists(root, pkg.name, pkg.version) })));
     return states.filter((state) => !state.published).map((state) => state.pkg);
 }
-async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
+async function publishPackedPackage(root, pkg, tag, dryRun) {
     const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
     const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
     try {
         console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
         await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
         await assertPackedWorkspaceDependencies(root, tarball, pkg);
-        // npm CLI owns authentication here: trusted publishing OIDC when configured,
-        // or the temporary NODE_AUTH_TOKEN bootstrap path below before trust exists.
+        // npm CLI owns authentication here: trusted publishing OIDC when configured.
         // Bun still produces the tarball so workspace:* dependencies are resolved the
         // same way smoo validates packed packages before release.
         const args = ['publish', tarball, '--access', 'public', '--tag', tag, '--provenance'];
@@ -175,7 +227,7 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
             args.push('--dry-run');
         }
         await publishWithAuthDiagnostics(pkg, {
-            publish: () => runLatestNpmPublish(root, args, useBootstrapToken),
+            publish: () => runLatestNpmPublish(root, args),
             versionExists: () => npmVersionExists(root, pkg.name, pkg.version),
             log: (message) => console.log(message),
             error: (message) => console.error(message),
@@ -186,7 +238,6 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
                 }
             },
         }, {
-            useBootstrapToken,
             tokenPresent: npmAuthTokenPresent(),
             repository: githubRepositoryFromRootPackage(root),
         });
@@ -198,6 +249,24 @@ async function publishPackedPackage(root, pkg, tag, dryRun, useBootstrapToken) {
 function npmAuthTokenPresent() {
     return Boolean(process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN || process.env.NPM_CONFIG_USERCONFIG);
 }
+async function publishPlaceholderPackage(root, pkg, env) {
+    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-bootstrap-'));
+    try {
+        await writeFile(join(tempDir, 'package.json'), `${JSON.stringify({
+            name: pkg.name,
+            version: NPM_BOOTSTRAP_VERSION,
+            description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
+            license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+            repository: pkg.json.repository,
+            publishConfig: { access: 'public' },
+        }, null, 2)}\n`);
+        await writeFile(join(tempDir, 'README.md'), `# ${pkg.name}\n\nThis is a bootstrap placeholder. Real package versions are published by SmoothBricks release automation.\n`);
+        await runLatestNpm(root, ['publish', tempDir, '--access', 'public', '--tag', NPM_BOOTSTRAP_DIST_TAG], env);
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
 function safeTarballPrefix(name) {
     return name.replace(/^@/, '').replace(/[^a-zA-Z0-9._-]+/g, '-');
 }
@@ -216,7 +285,20 @@ function releasePackages(root) {
     return packages;
 }
 function releasePackageProjects(packages) {
-    return packages.map((pkg) => pkg.name).join(',');
+    return packages.map((pkg) => pkg.projectName).join(',');
+}
+async function releaseVersionPackages(root, packages, bump) {
+    if (bump !== 'auto') {
+        return packages;
+    }
+    return autoReleaseCandidatePackages({
+        gitRefExists: (ref) => gitRefExists(root, ref),
+        packageChangedFilesSince: (ref, packagePath) => packageChangedFilesSince(root, ref, packagePath),
+        packageJsonAtRef: (ref, packagePath) => packageJsonAtRef(root, ref, packagePath),
+        currentPackageJson: (packagePath) => currentPackageJson(root, packagePath),
+        packageBuildInputPatterns: (projectName, packagePath) => packageBuildInputPatterns(root, projectName, packagePath),
+        packageHasHistory: (packagePath) => packageHasHistory(root, packagePath),
+    }, packages);
 }
 async function runNxReleaseVersion(root, projects, bump, dryRun) {
     // Nx owns local release mutation: package versions, bun.lock updates, the
@@ -355,7 +437,10 @@ function releaseCompletionShell(root) {
         buildReleaseCandidate: (packages) => buildReleaseCandidate(root, packages),
         publishPackage: async (pkg, distTag, dryRun) => {
             const packageExists = dryRun ? true : await npmPackageExists(root, pkg.name);
-            await publishPackedPackage(root, pkg, distTag, dryRun, !dryRun && !packageExists);
+            if (!packageExists) {
+                throw new Error(missingNpmPackagePublishGuidance(pkg));
+            }
+            await publishPackedPackage(root, pkg, distTag, dryRun);
         },
         listGithubMissingPackages: (packages) => listMissingGithubReleasePackages(root, packages),
         createGithubRelease: (pkg, dryRun) => createGithubRelease(root, pkg, dryRun),
@@ -538,6 +623,125 @@ async function gitRefExists(root, ref) {
     const result = await $ `git rev-parse --verify ${ref}`.cwd(root).quiet().nothrow();
     return result.exitCode === 0;
 }
+async function packageChangedFilesSince(root, ref, packagePath) {
+    const result = await $ `git diff --name-only ${`${ref}..HEAD`} -- ${packagePath}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect package changes under ${packagePath}.`);
+    }
+    const packagePrefix = `${packagePath}/`;
+    return decode(result.stdout)
+        .split('\n')
+        .map((path) => path.trim())
+        .filter(Boolean)
+        .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
+}
+async function packageJsonAtRef(root, ref, packagePath) {
+    const result = await $ `git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        return null;
+    }
+    try {
+        const parsed = JSON.parse(decode(result.stdout));
+        return isRecord(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function currentPackageJson(root, packagePath) {
+    return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
+}
+async function packageBuildInputPatterns(root, projectName, _packagePath) {
+    const project = await nxProjectJson(root, projectName);
+    const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
+    return resolveBuildInputPatterns(project, nxJson);
+}
+async function nxProjectJson(root, projectName) {
+    const result = await $ `nx show project ${projectName} --json`.cwd(root).quiet();
+    const parsed = JSON.parse(decode(result.stdout));
+    if (!isRecord(parsed)) {
+        throw new Error(`Unable to inspect Nx project ${projectName}.`);
+    }
+    return parsed;
+}
+function resolveBuildInputPatterns(project, nxJson) {
+    const targets = recordProperty(project, 'targets');
+    if (!targets) {
+        return [];
+    }
+    return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
+}
+function collectBuildInputs(targets) {
+    const build = recordProperty(targets, 'build');
+    if (!build) {
+        return ['production'];
+    }
+    const directInputs = stringArrayProperty(build, 'inputs');
+    if (directInputs.length > 0) {
+        return directInputs;
+    }
+    const inputs = [];
+    for (const dependency of stringArrayProperty(build, 'dependsOn')) {
+        if (dependency.startsWith('^')) {
+            continue;
+        }
+        const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
+        if (!targetName) {
+            continue;
+        }
+        inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+    }
+    return inputs.length > 0 ? inputs : ['production'];
+}
+function normalizeInputPatterns(inputs, nxJson) {
+    const patterns = [];
+    const seen = new Set();
+    for (const input of inputs) {
+        for (const pattern of expandInputPattern(input, nxJson, seen)) {
+            patterns.push(pattern);
+        }
+    }
+    return patterns;
+}
+function expandInputPattern(input, nxJson, seen) {
+    if (seen.has(input)) {
+        return [];
+    }
+    seen.add(input);
+    if (!input.includes('{')) {
+        const namedInputs = recordProperty(nxJson, 'namedInputs');
+        const namedInput = namedInputs?.[input];
+        if (Array.isArray(namedInput)) {
+            return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
+        }
+        return [];
+    }
+    const excluded = input.startsWith('!');
+    const rawInput = excluded ? input.slice(1) : input;
+    if (!rawInput.startsWith('{projectRoot}/')) {
+        return [];
+    }
+    const packageRelative = rawInput.slice('{projectRoot}/'.length);
+    return [`${excluded ? '!' : ''}${packageRelative}`];
+}
+function recordProperty(record, key) {
+    if (!record) {
+        return null;
+    }
+    const value = record[key];
+    return isRecord(value) ? value : null;
+}
+function stringArrayProperty(record, key) {
+    const value = record?.[key];
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+async function packageHasHistory(root, packagePath) {
+    const result = await $ `git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error(`Unable to inspect package history under ${packagePath}.`);
+    }
+    return decode(result.stdout).trim().length > 0;
+}
 async function gitIsAncestor(root, ancestor, descendant) {
     const result = await $ `git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
     return result.exitCode === 0;
@@ -712,28 +916,22 @@ function githubRepositoryFromUrl(url) {
 async function runLatestNpm(root, npmArgs, env) {
     await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
 }
-async function runLatestNpmPublish(root, npmArgs, useBootstrapToken) {
-    if (!useBootstrapToken) {
-        await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
-        return;
-    }
-    const token = process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN;
-    if (!token || process.env.NPM_CONFIG_USERCONFIG) {
-        if (!token && !process.env.NPM_CONFIG_USERCONFIG) {
-            throw new Error('First publish for a package requires NODE_AUTH_TOKEN or NPM_TOKEN until trusted publishing exists.');
-        }
-        await runLatestNpm(root, npmArgs);
-        return;
-    }
-    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-auth-'));
-    const npmrc = join(tempDir, '.npmrc');
-    try {
-        await writeFile(npmrc, `registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`);
-        await runLatestNpm(root, npmArgs, { NPM_CONFIG_USERCONFIG: npmrc });
+async function runLatestNpmTrust(root, npmArgs, env) {
+    const result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
+    if (result.exitCode === 0) {
+        return 'configured';
     }
-    finally {
-        await rm(tempDir, { recursive: true, force: true });
+    const output = `${result.stdout}\n${result.stderr}`;
+    if (/\bE409\b|\b409 Conflict\b/.test(output)) {
+        return 'already-configured';
     }
+    throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${result.exitCode}`);
+}
+async function runLatestNpmPublish(root, npmArgs) {
+    await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
+}
+function missingNpmPackagePublishGuidance(pkg) {
+    return `${pkg.name} does not exist on npm yet. Run smoo release trust-publisher --bootstrap locally before rerunning the Publish workflow.`;
 }
 async function promptForNpmOtp(packageName) {
     if (!process.stdin.isTTY || !process.stdout.isTTY) {

package/dist/release/npm-auth.d.ts

@@ -1,6 +1,5 @@
 import type { ReleasePackageInfo } from './core.js';
 export interface NpmPublishAuthFailureOptions {
-    useBootstrapToken: boolean;
     tokenPresent: boolean;
     repository?: string;
 }

package/dist/release/npm-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"npm-auth.d.ts","sourceRoot":"","sources":["../../src/release/npm-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAuCR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAgCR"}
+{"version":3,"file":"npm-auth.d.ts","sourceRoot":"","sources":["../../src/release/npm-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,KAAK,EAAE,yBAAyB,EAChC,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAwBR;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC,EACjD,OAAO,EAAE,4BAA4B,GACpC,MAAM,CAmBR"}

package/dist/release/npm-auth.js

@@ -10,40 +10,28 @@ export async function publishWithAuthDiagnostics(pkg, shell, options) {
         }
         shell.error(npmPublishAuthFailureMessage(pkg, options));
         await shell.appendSummary(npmPublishAuthFailureMarkdown(pkg, options));
-        throw new Error(`${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher after the package exists on npm; see the warning banner above for details.`, { cause: error });
+        throw new Error(`${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher; see the warning banner above for details.`, { cause: error });
     }
 }
 export function npmPublishAuthFailureMessage(pkg, options) {
     const packageVersion = `${pkg.name}@${pkg.version}`;
     const lines = [
-        `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo, or the bootstrap NPM_TOKEN is missing/invalid.`,
+        `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo.`,
         '',
         `🚨 npm publish authentication failed for ${packageVersion}`,
         '',
     ];
-    if (options.useBootstrapToken) {
-        lines.push('smoo expected a temporary npm automation token because this package does not exist on npm yet.', options.tokenPresent
-            ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
-            : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set. Add a temporary NPM_TOKEN repository secret and rerun the Publish workflow.', '', 'After the first successful publish, run:', '  smoo release trust-publisher', '', 'Then remove the temporary bootstrap token path for future releases.');
-        return lines.join('\n');
-    }
     lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', options.tokenPresent
         ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
-        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '1. Run locally: smoo release trust-publisher', '2. Ensure the npm trusted publisher uses:', `   repository: ${trustedPublisherRepository(options)}`, '   workflow: publish.yml', '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, add a temporary NPM_TOKEN repository secret, publish once, then run smoo release trust-publisher.');
+        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '1. Run locally: smoo release trust-publisher', '2. Ensure the npm trusted publisher uses:', `   repository: ${trustedPublisherRepository(options)}`, '   workflow: publish.yml', '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, run locally: smoo release trust-publisher --bootstrap.');
     return lines.join('\n');
 }
 export function npmPublishAuthFailureMarkdown(pkg, options) {
     const packageVersion = `${pkg.name}@${pkg.version}`;
     const lines = ['## 🚨 npm Publish Authentication Failed', '', `Package: \`${packageVersion}\``, ''];
-    if (options.useBootstrapToken) {
-        lines.push('smoo expected a temporary npm automation token because this package does not exist on npm yet.', '', options.tokenPresent
-            ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
-            : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set. Add a temporary `NPM_TOKEN` repository secret and rerun the Publish workflow.', '', 'After the first successful publish, run `smoo release trust-publisher`, then remove the temporary bootstrap token path for future releases.');
-        return lines.join('\n');
-    }
     lines.push('smoo expected npm trusted publishing/OIDC because this package already exists on npm.', '', options.tokenPresent
         ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
-        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '', '1. Run locally: `smoo release trust-publisher`', `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``, '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, add a temporary `NPM_TOKEN` repository secret, publish once, then run `smoo release trust-publisher`.');
+        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.', '', 'Fix:', '', '1. Run locally: `smoo release trust-publisher`', `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``, '3. Rerun the Publish workflow.', '', 'For first-ever package publishes, run `smoo release trust-publisher --bootstrap` locally.');
     return lines.join('\n');
 }
 function trustedPublisherRepository(options) {

package/dist/release/orchestration.d.ts

@@ -28,9 +28,10 @@ export interface ReleaseRepairShell<Package extends ReleasePackageInfo = Release
 }
 export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
     releasePackagesAtHead(): Promise<Package[]>;
+    releaseVersionPackages(bump: string): Promise<Package[]>;
     ensureLocalReleaseTags(packages: Package[]): Promise<void>;
     gitHead(): Promise<string>;
-    runNxReleaseVersion(bump: string, dryRun: boolean): Promise<void>;
+    runNxReleaseVersion(packages: Package[], bump: string, dryRun: boolean): Promise<void>;
     assertCleanGitTree(): Promise<void>;
 }
 export interface ReleaseVersionResult<Package extends ReleasePackageInfo = ReleasePackageInfo> {

package/dist/release/orchestration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAgCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAmBzC;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}
+{"version":3,"file":"orchestration.d.ts","sourceRoot":"","sources":["../../src/release/orchestration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,MAAM,MAAM,kBAAkB,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhD,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,gBAAgB,EAAE,OAAO,EAAE,CAAC;IAC5B,cAAc,EAAE,OAAO,EAAE,CAAC;IAC1B,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,sBAAsB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC7F,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,yBAAyB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,kBAAkB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB,CACzF,SAAQ,sBAAsB,CAAC,OAAO,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,aAAa,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3D,kBAAkB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,iBAAiB,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC1F,qBAAqB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACzD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3B,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvF,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,GAAG,kBAAkB;IAC3F,IAAI,EAAE,kBAAkB,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;CACpF;AAED,wBAAsB,iBAAiB,CAAC,OAAO,SAAS,kBAAkB,EACxE,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,EACnC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GACzC,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAyCxC;AAED,wBAAsB,qBAAqB,CAAC,OAAO,SAAS,kBAAkB,EAC5E,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,QAAQ,EAAE,OAAO,EAAE,EACnB,MAAM,EAAE,OAAO,EACf,aAAa,EAAE,OAAO,GACrB,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAYlC;AAED,wBAAsB,oBAAoB,CAAC,OAAO,SAAS,kBAAkB,EAC3E,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAClC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EACtC,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAmBzC;AAED,wBAAsB,0BAA0B,CAAC,OAAO,SAAS,kBAAkB,EACjF,KAAK,EAAE,sBAAsB,CAAC,OAAO,CAAC,EACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,MAAM,EAAE,OAAO,GACd,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAUlC"}

package/dist/release/orchestration.js

@@ -7,8 +7,16 @@ export async function runReleaseVersion(shell, options) {
             return { mode: 'none', packages: localRelease, status: 'already-release-target' };
         }
     }
+    const versionPackages = await shell.releaseVersionPackages(options.bump);
+    if (versionPackages.length === 0) {
+        if (options.bump !== 'auto') {
+            // invariant throw: the CLI resolves forced bumps from the full owned release package set.
+            throw new Error(`No release packages were selected for forced --bump ${options.bump}.`);
+        }
+        return { mode: 'none', packages: [], status: 'no-release-needed' };
+    }
     const headBeforeVersioning = await shell.gitHead();
-    await shell.runNxReleaseVersion(options.bump, options.dryRun);
+    await shell.runNxReleaseVersion(versionPackages, options.bump, options.dryRun);
     if (options.dryRun) {
         return { mode: 'none', packages: [], status: 'dry-run' };
     }

package/dist/release/publish-plan.js

@@ -5,7 +5,7 @@ export function planPublishActions(input) {
     const npmPackages = input.releasePackages.filter((pkg) => npmMissingNames.has(pkg.name));
     const githubReleasePackages = input.releasePackages.filter((pkg) => githubMissingNames.has(pkg.name));
     return {
-        buildProjects: npmPackages.map((pkg) => pkg.name),
+        buildProjects: npmPackages.map((pkg) => pkg.projectName),
         publishPackages: npmPackages.map((pkg) => ({ pkg, distTag: npmDistTagForVersion(pkg.version) })),
         githubReleasePackages,
     };

package/managed/raw/git-format-staged.yml

@@ -0,0 +1,54 @@
+# git-format-staged configuration for SmoothBricks-style monorepos
+
+formatters:
+  # ESLint for Astro files (run first as it only handles .astro files)
+  eslint:
+    command: "eslint-stdout '{}'"
+    patterns:
+      - '*.astro'
+      - '!.*' # Exclude hidden files
+
+  # Biome for JS/TS/JSX/TSX/JSON/HTML/CSS/GraphQL files
+  biome:
+    command: "biome check --files-ignore-unknown=true --use-editorconfig=true '--stdin-file-path={}' --fix"
+    patterns:
+      - '*.js'
+      - '*.ts'
+      - '*.jsx'
+      - '*.tsx'
+      - '*.json'
+      - '*.jsonc'
+      - '*.html'
+      - '*.css'
+      - '*.graphql'
+
+  # Prettier for all other files (mainly Markdown)
+  prettier:
+    command: "prettier --ignore-unknown --stdin-filepath '{}'"
+    patterns:
+      # Match all files
+      - '*'
+      # Exclude files handled by Biome
+      - '!*.js'
+      - '!*.ts'
+      - '!*.jsx'
+      - '!*.tsx'
+      - '!*.json'
+      - '!*.jsonc'
+      - '!*.html'
+      - '!*.css'
+      - '!*.graphql'
+      # Exclude files handled by Alejandra
+      - '!*.nix'
+      # Bun lockfiles are generated and should not be rewritten by Prettier
+      - '!bun.lock'
+
+  # Alejandra for Nix files
+  alejandra:
+    command: 'alejandra'
+    patterns:
+      - '*.nix'
+
+settings:
+  update_working_tree: true
+  show_commands: true # Verbose output

package/managed/raw/tooling/git-hooks/commit-msg.sh

@@ -6,4 +6,4 @@ export PATH="$TOOLING/git-hooks:$TOOLING:$PWD/node_modules/.bin:$TOOLING/direnv/
 
 set -e -o pipefail
 
-smoo monorepo validate-commit-msg "$1"
+smoo monorepo validate-commit-msg --fix "$1"

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -15,13 +15,7 @@ runs:
     # This action is intentionally post-checkout only. Repo-local actions do not
     # exist before actions/checkout has populated the working tree.
     - name: ❄️ Install Nix
-      uses: DeterminateSystems/nix-installer-action@v22
-      with:
-        extra-conf: |
-          keep-outputs = true
-          keep-derivations = true
-          gc-keep-derivations = true
-          gc-keep-outputs = true
+      uses: DeterminateSystems/determinate-nix-action@v3
 
     - name: 🧊 Cache Nix profiles and store NAR
       id: nix-cache

package/managed/templates/github/workflows/ci.yml

@@ -18,6 +18,7 @@ defaults:
 jobs:
   main:
     runs-on: ubuntu-latest
+    timeout-minutes: 45
     env:
       NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
       GH_TOKEN: ${{ github.token }}