@theholocron/cli 4.15.0 → 4.16.1

package/README.md

@@ -99,6 +99,16 @@ export default defineConfig({
 });
 ```
 
+The generated ruleset also sets `require_extra_approval_for_unattributed_changes:
+false` — with `required_approving_review_count: 0` and a single maintainer, the
+GitHub default (`true`) is an unsatisfiable block on any PR with an
+unverified/unattributed commit. Repository-admin bypass still covers the real
+risk. And the `codecov.yml` `holocron setup` writes carries `if_not_found:
+success` on every status default, so an infra-only PR (dep bump, config,
+lockfile — no coverable change) passes instead of hanging on a `codecov/*`
+required check that never posts. A re-run of `holocron setup` backfills both into
+an existing repo.
+
 ### Git hooks
 
 ```ts
@@ -275,6 +285,20 @@ export default acmeConfig;
 
 ```
 
+## Upgrading
+
+- **`holocron upgrade node <to>`** — patches every Node.js version pin
+  (`engines.node`, `.nvmrc`, `.node-version`, `.github/workflows/*`,
+  `Dockerfile`, `.tool-versions`) to a new major.
+- **`holocron upgrade deps`** — bumps every `@theholocron/*` pin in
+  `pnpm-workspace.yaml` (`catalog:` and every named `catalogs.*`) to its latest
+  published version, then migrates `holocron.config.ts` from the 7.x preset
+  shape (`const { repo, workflows } = node()` + `repo.requiredChecks` +
+  `workflows:`) to the current composed-preset API (`const preset = node()` +
+  `...preset` + `tasks:` + `extraRequiredChecks:`). Mechanical transforms only —
+  review the result, then `pnpm install && holocron ci`. `--pins-only` skips
+  the config migration; `--dry-run` prints without writing.
+
 ## Auth — fine-grained tokens
 
 Each GitHub capability resolves its own fine-grained PAT so a compromised
@@ -385,7 +409,7 @@ holds the orchestration + the Holocron-specific credential resolution
   never hand-edit its `.github/workflows/*`).
 - `src/commands/` — `setup`, `sync`, `doctor`, `deploy`, `secret set`,
   `secrets sync`, `npm publish-initial`, `sync-github`, `upgrade node`,
-  `plugin create`, `auth`
+  `upgrade deps`, `plugin create`, `auth`
 
 ## Status
 

package/dist/cli.mjs

@@ -3379,7 +3379,7 @@ function createIgnoreConfig() {
 }
 //#endregion
 //#region src/templates/configs/codecov/codecov.yml
-var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n    patch:\n      default:\n        target: 80%\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n  individual_components:\n";
+var codecov_default = "codecov:\n  require_ci_to_pass: true\n\ncoverage:\n  precision: 2\n  round: down\n  status:\n    project:\n      default:\n        target: auto\n        threshold: 2%\n        # Infra-only PRs (dep bumps, config, lockfile) touch no coverable code,\n        # so codecov produces no report to compare. Pass instead of blocking\n        # forever on a required check that will never post.\n        if_not_found: success\n    patch:\n      default:\n        target: 80%\n        if_not_found: success\n\ncomment:\n  layout: \"reach,diff,flags,components\"\n  behavior: default\n  require_changes: true\n\ncomponent_management:\n  default_rules:\n    statuses:\n      - type: patch\n        target: 80%\n        if_not_found: success\n  individual_components:\n";
 //#endregion
 //#region src/templates/configs/codecov/utils.ts
 const INDIVIDUAL_COMPONENTS_MARKER = "  individual_components:";
@@ -3393,10 +3393,45 @@ function codecovComponentBlock(packages) {
 		``
 	]).join("\n");
 }
+/**
+* Ensure every codecov status default carries `if_not_found: success`, so an
+* infra-only PR (dep bump, config, lockfile — no coverable change) passes
+* instead of hanging forever on a required check codecov never posts.
+*
+* Injects the key on the line after each `target:` that sits inside a status
+* block (`coverage.status.*.default` or a `statuses:` list item — indent ≥ 8,
+* or ≥ 8 for a `- type:` list entry), when the immediate sibling lines do not
+* already declare it.
+*/
+function ensureIfNotFound(yaml) {
+	const lines = yaml.split("\n");
+	const out = [];
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		out.push(line);
+		const m = /^(\s{8,})target:\s+\S+\s*$/.exec(line);
+		if (!m) continue;
+		const indent = m[1];
+		let alreadySet = false;
+		for (let j = i + 1; j < lines.length; j++) {
+			const sib = lines[j];
+			if (sib.trim() === "") continue;
+			const sibIndent = sib.match(/^\s*/)[0].length;
+			if (sibIndent < indent.length) break;
+			if (sibIndent === indent.length && /^\s*if_not_found\s*:/.test(sib)) {
+				alreadySet = true;
+				break;
+			}
+			if (sibIndent === indent.length && /^\s*(- |\w)/.test(sib) && !/^\s*(threshold|flags|paths|branches)\s*:/.test(sib)) break;
+		}
+		if (!alreadySet) out.push(`${indent}if_not_found: success`);
+	}
+	return out.join("\n");
+}
 function mergeCodecovComponents(existing, packages) {
 	const idx = existing.indexOf(INDIVIDUAL_COMPONENTS_MARKER);
-	if (idx === -1) return existing;
-	return existing.slice(0, idx + 24) + codecovComponentBlock(packages);
+	if (idx === -1) return ensureIfNotFound(existing);
+	return ensureIfNotFound(existing.slice(0, idx + 24)) + codecovComponentBlock(packages);
 }
 async function readWorkspacePackages(repoRoot) {
 	const packagesDir = join(repoRoot, "packages");
@@ -3965,7 +4000,8 @@ function buildRulesetPayload(requiredChecks = []) {
 				dismiss_stale_reviews_on_push: false,
 				require_code_owner_review: false,
 				require_last_push_approval: false,
-				required_review_thread_resolution: true
+				required_review_thread_resolution: true,
+				require_extra_approval_for_unattributed_changes: false
 			}
 		}
 	];
@@ -6234,6 +6270,224 @@ async function runSyncGithub(input) {
 	});
 }
 //#endregion
+//#region src/commands/upgrade-deps.ts
+/**
+* `holocron upgrade deps` — bring a repo's `@theholocron/*` dependency pins and
+* its `holocron.config.ts` up to the current major.
+*
+* Two concerns:
+*
+* 1. **Catalog pins.** Every `@theholocron/*` entry in `pnpm-workspace.yaml`
+*    (`catalog:` and every named `catalogs.*`) is bumped to the latest published
+*    version, preserving the range prefix (`^` / `~`). Never downgrades.
+* 2. **`holocron.config.ts` migration.** `@theholocron/holocron-config@8`
+*    dropped the 7.x preset shape (`const { repo, workflows, providers } =
+*    node()` + `repo.requiredChecks` + `workflows:`) for a composed-preset
+*    (`const preset = node()` + `...preset` + `tasks:` + `extraRequiredChecks:`).
+*    This applies the mechanical transforms and flags anything that needs a
+*    human eye.
+*
+* After running, `pnpm install && holocron ci`.
+*/
+const FETCH_TIMEOUT_MS$1 = 4e3;
+/** Resolve a package's `latest` dist-tag from the npm registry. */
+const fetchLatestFromNpm = async (pkg) => {
+	try {
+		const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(pkg)}`, {
+			signal: AbortSignal.timeout(FETCH_TIMEOUT_MS$1),
+			headers: { accept: "application/vnd.npm.install-v1+json" }
+		});
+		if (!res.ok) return null;
+		return (await res.json())["dist-tags"]?.["latest"] ?? null;
+	} catch {
+		return null;
+	}
+};
+/** `a > b` for `x.y.z` release versions (prerelease tags are ignored). */
+function gt(a, b) {
+	const pa = a.split(".").map((n) => parseInt(n, 10));
+	const pb = b.split(".").map((n) => parseInt(n, 10));
+	for (let i = 0; i < 3; i++) {
+		const x = pa[i] ?? 0;
+		const y = pb[i] ?? 0;
+		if (x !== y) return x > y;
+	}
+	return false;
+}
+const CATALOG_LINE = /^(\s*['"]?)(@theholocron\/[a-z0-9-]+)(['"]?\s*:\s*['"]?)([~^]?)(\d+\.\d+\.\d+[\w.-]*)(['"]?\s*)$/;
+/**
+* Rewrite every `@theholocron/*` pin in a `pnpm-workspace.yaml` to `latest`,
+* keeping the range prefix. `latest` is looked up once per package.
+*/
+async function bumpCatalogs(content, fetchLatest) {
+	const lines = content.split("\n");
+	const wanted = /* @__PURE__ */ new Set();
+	for (const line of lines) {
+		const m = CATALOG_LINE.exec(line);
+		if (m) wanted.add(m[2]);
+	}
+	const latest = /* @__PURE__ */ new Map();
+	await Promise.all([...wanted].map(async (pkg) => {
+		latest.set(pkg, await fetchLatest(pkg));
+	}));
+	const bumps = [];
+	return {
+		content: lines.map((line) => {
+			const m = CATALOG_LINE.exec(line);
+			if (!m) return line;
+			const [, pre, pkg, mid, prefix, current, post] = m;
+			const next = latest.get(pkg);
+			if (!next || next === current || !gt(next, current)) return line;
+			bumps.push({
+				pkg,
+				from: current,
+				to: next
+			});
+			return `${pre}${pkg}${mid}${prefix}${next}${post}`;
+		}).join("\n"),
+		bumps
+	};
+}
+/** True if the file still uses the 7.x preset shape. */
+function isLegacyConfig(content) {
+	return /const\s*\{[^}]*\b(repo|workflows|providers)\b[^}]*\}\s*=\s*(compose\(|[a-zA-Z]+\(\))/.test(content) || /\.\.\.repo\.requiredChecks/.test(content) || /^\s*workflows\s*:/m.test(content);
+}
+/**
+* Apply the mechanical 7.x → 8.x transforms to a `holocron.config.ts`. Best
+* effort — the result should always be reviewed and run through `holocron ci`.
+*/
+function migrateConfig(content) {
+	const transforms = [];
+	const warnings = [];
+	let s = content;
+	if (!isLegacyConfig(s)) return {
+		content,
+		changed: false,
+		transforms,
+		warnings
+	};
+	s = s.replace(/const\s*\{[^}]*\}\s*=\s*((?:compose\([\s\S]*?\)|[a-zA-Z]+\([\s\S]*?\)))\s*;/, (_m, expr) => {
+		transforms.push("destructured preset → `const preset = …`");
+		return `const preset = ${expr.trim()};`;
+	});
+	if (/const preset =/.test(s) && !/\.\.\.preset\b/.test(s)) {
+		s = s.replace(/(defineConfig\(\{\s*\n)/, `$1\t...preset,\n`);
+		transforms.push("spread `...preset` into defineConfig()");
+	}
+	s = s.replace(/^\torg,\n/m, "");
+	s = s.replace(/^\tdomain,\n/m, "");
+	s = s.replace(/^\tdocs,\n/m, "");
+	if (/\.\.\.repo\.properties/.test(s)) {
+		s = s.replace(/\.\.\.repo\.properties/g, "...preset.repo?.properties");
+		transforms.push("`...repo.properties` → `...preset.repo?.properties`");
+	}
+	if (/([{[,]\s*)\.\.\.repo\b(?!\.)/.test(s)) {
+		s = s.replace(/([{[,]\s*)\.\.\.repo\b(?!\.)/g, "$1...preset.repo");
+		transforms.push("`...repo` → `...preset.repo`");
+	}
+	if (/\.\.\.providers\b/.test(s)) {
+		s = s.replace(/\.\.\.providers\b/g, "...preset.providers");
+		transforms.push("`...providers` → `...preset.providers`");
+	}
+	const rc = /(\n\s*)requiredChecks\s*:\s*\[\s*\n?\s*\.\.\.repo\.requiredChecks\s*,?\s*([\s\S]*?)\n\s*\]\s*,/.exec(s);
+	if (rc) {
+		const custom = rc[2].trim().replace(/,\s*$/, "");
+		s = s.replace(rc[0], "");
+		if (custom) {
+			const block = `\textraRequiredChecks: [\n\t\t${custom.split("\n").map((l) => l.trim()).filter(Boolean).join("\n		")}\n\t],\n`;
+			s = s.replace(/(defineConfig\(\{\s*\n(?:\t\.\.\.preset,\n)?)/, `$1${block}`);
+			transforms.push("`repo.requiredChecks` custom entries → top-level `extraRequiredChecks`");
+			warnings.push("check the moved `extraRequiredChecks` — the preset already contributes lint/test/typecheck");
+		} else {
+			s = s.replace(/,(\s*)\.\.\.repo\.requiredChecks/g, "$1");
+			transforms.push("dropped `...repo.requiredChecks`");
+		}
+	}
+	if (/^\s*workflows\s*:/m.test(s)) {
+		s = s.replace(/(\n\s*)workflows(\s*:\s*\[)/, "$1tasks$2");
+		s = s.replace(/\.\.\.workflows\b/g, "...preset.tasks");
+		transforms.push("`workflows:` → `tasks:` (`...workflows` → `...preset.tasks`)");
+		warnings.push("review the `tasks` array — a bare workflow name that should gate merges now needs `{ name, required: true }`");
+	}
+	return {
+		content: s,
+		changed: s !== content,
+		transforms,
+		warnings
+	};
+}
+async function runUpgradeDeps(input = {}) {
+	const print = input.print ?? ((line) => console.log(line));
+	const logger = input.logger ?? getLogger();
+	const cwd = input.cwd ?? process.cwd();
+	const dryRun = input.dryRun ?? false;
+	const pinsOnly = input.pinsOnly ?? false;
+	const _readFile = input.readFile ?? ((p) => readFileSync(p, "utf8"));
+	const _writeFile = input.writeFile ?? ((p, c) => writeFileSync(p, c));
+	const fetchLatest = input.fetchLatest ?? fetchLatestFromNpm;
+	logger.info({
+		dryRun: dryRun || void 0,
+		pinsOnly: pinsOnly || void 0
+	}, "upgrade deps: start");
+	print(`Upgrading @theholocron/* dependencies${dryRun ? " (dry-run)" : ""}…`);
+	const wsPath = join(cwd, "pnpm-workspace.yaml");
+	let bumps = [];
+	try {
+		const result = await bumpCatalogs(_readFile(wsPath), fetchLatest);
+		bumps = result.bumps;
+		if (bumps.length > 0) {
+			if (!dryRun) _writeFile(wsPath, result.content);
+			print("");
+			print(`  pnpm-workspace.yaml — ${bumps.length} pin${bumps.length === 1 ? "" : "s"}`);
+			for (const b of bumps) print(`    ${dryRun ? "~" : "✓"} ${b.pkg}  ${b.from} → ${b.to}`);
+		} else print("  · pnpm-workspace.yaml — @theholocron/* pins already current");
+	} catch {
+		print("  · no pnpm-workspace.yaml — skipping catalog pins");
+	}
+	let configMigrated = false;
+	let configWarnings = [];
+	if (!pinsOnly) for (const name of ["holocron.config.ts", "holocron.config.js"]) {
+		let cfg;
+		try {
+			cfg = _readFile(join(cwd, name));
+		} catch {
+			continue;
+		}
+		const m = migrateConfig(cfg);
+		if (!m.changed) {
+			print(`  · ${name} — already on the current preset API`);
+			break;
+		}
+		if (!dryRun) _writeFile(join(cwd, name), m.content);
+		configMigrated = true;
+		configWarnings = m.warnings;
+		print("");
+		print(`  ${name} — ${dryRun ? "would migrate" : "migrated"} to the 8.x preset API`);
+		for (const t of m.transforms) print(`    ${dryRun ? "~" : "✓"} ${t}`);
+		for (const w of m.warnings) print(`    ⚠ ${w}`);
+		break;
+	}
+	print("");
+	if (bumps.length === 0 && !configMigrated) print("Nothing to do — already up to date.");
+	else {
+		print(`Next: ${dryRun ? "run without --dry-run, then " : ""}\`pnpm install && holocron ci\``);
+		if (configMigrated) print("      review holocron.config.ts before committing.");
+	}
+	const status = dryRun ? "dry-run" : "ok";
+	logger.info({
+		bumps: bumps.length,
+		configMigrated,
+		warnings: configWarnings.length,
+		status
+	}, "upgrade deps: done");
+	return {
+		status,
+		bumps,
+		configMigrated,
+		configWarnings
+	};
+}
+//#endregion
 //#region src/commands/upgrade-node.ts
 const SKIP_DIRS = /* @__PURE__ */ new Set([
 	"node_modules",
@@ -7433,6 +7687,20 @@ try {
 			if (report.message) getLogger().error(`upgrade node: ${report.message}`);
 			process.exitCode = 1;
 		}
+	}).command("deps", "Bump every @theholocron/* pin to latest and migrate holocron.config.ts to the current preset API", (yy) => yy.option("pins-only", {
+		type: "boolean",
+		default: false,
+		describe: "Only bump the catalog pins — skip the holocron.config.ts migration"
+	}), async (argv) => {
+		const report = await runUpgradeDeps({
+			cwd: argv.cwd,
+			dryRun: argv.dryRun,
+			pinsOnly: argv.pinsOnly
+		});
+		if (report.status === "fail") {
+			if (report.message) getLogger().error(`upgrade deps: ${report.message}`);
+			process.exitCode = 1;
+		}
 	}).demandCommand(1, "Run `holocron upgrade --help` to see available upgrade subcommands."), () => {}).command("auth <subcommand>", "Manage bootstrap credentials in the OS keyring", (y) => y.command("set <provider> [value]", "Verify + store a bootstrap token for a provider", (yy) => yy.positional("provider", {
 		type: "string",
 		demandOption: true