@theholocron/holocron-plugin-github 5.0.0-alpha.421 → 5.0.0-alpha.423

package/README.md

@@ -40,11 +40,11 @@ Each capability resolves its own fine-grained token so a compromised credential
 Store tokens once via the keyring so they are picked up automatically:
 
 ```sh
-holocron auth set github.read     ghp_xxx  # clone + CI run listing
-holocron auth set github.issues   ghp_xxx  # issue management
-holocron auth set github.sync     ghp_xxx  # sync-github workflow templates
-holocron auth set github.release  ghp_xxx  # semantic-release
-holocron auth set github.admin    ghp_xxx  # setup, secrets, environments
+holocron new token github.read     ghp_xxx  # clone + CI run listing
+holocron new token github.issues   ghp_xxx  # issue management
+holocron new token github.sync     ghp_xxx  # sync-github workflow templates
+holocron new token github.release  ghp_xxx  # semantic-release
+holocron new token github.admin    ghp_xxx  # setup, secrets, environments
 ```
 
 See the [token reference](https://docs.theholocron.dev/holocron/tokens/) for full scope requirements and CI setup.
@@ -68,7 +68,7 @@ See the [token reference](https://docs.theholocron.dev/holocron/tokens/) for ful
 
 ## `projects` capability
 
-GitHub Projects v2 boards over GraphQL, for `holocron project ...` (SPEC-0020, #1744). It uses the org token
+GitHub Projects v2 boards over GraphQL, for `list projects`, `new project`, `setup project` (SPEC-0020, #1744). It uses the org token
 (`HOLOCRON_ORG_TOKEN`, keyring `github.org`) with the **Projects** organization permission. Items are keyed `#N` in the
 configured `repo` and `owner/repo#N` elsewhere.
 

package/dist/index.d.mts

@@ -444,10 +444,13 @@ export declare function createPlugin(options: GitHubPluginOptions): {
   };
 };
 /**
- * One-line hint printed by `holocron auth set github` when no token
+ * One-line hint printed by `holocron new token github` when no token
  * is supplied or the supplied token is rejected.
  */
 export declare const AUTH_HINT: string;
-/** Every token this plugin takes, for `holocron doctor tokens`. */
+/**
+ * Every token this plugin takes, for `holocron doctor tokens`. The release token is `optional`: only CI's release
+ * workflow reads it (from the org secret), so a development environment has no reason to hold it.
+ */
 export declare const tokens: PluginToken[];
 export { type Auth, AuthError, type CanonicalLabel, type GitHubClientOptions, type NormalizedTeamEntry, type ProjectsOptions, type ResolveTokenInput, type TeamEntry, type TeamPermission, type VerifyTokenFailure, type VerifyTokenResult, type VerifyTokenSuccess, createFeatureResolver, createGitHubClient };

package/dist/index.mjs

@@ -1460,7 +1460,7 @@ function toGHScope(scope) {
 /** Reads one file; `null` when it does not exist. `version` is the blob sha `writeFile` needs to replace exactly this one. */
 /** A fine-grained token only reaches the repositories and permissions it was given; say which one is missing. */
 function noAccess(repo, action, cause) {
-	return new Error(`the token cannot ${action} files in ${repo} (403): give the user-sync token (HOLOCRON_USER_SYNC_TOKEN, or holocron auth set github.user-sync) access to that repository with Contents: ${action === "read" ? "read" : "read and write"}`, { cause });
+	return new Error(`the token cannot ${action} files in ${repo} (403): give the user-sync token (HOLOCRON_USER_SYNC_TOKEN, or holocron new token github.user-sync) access to that repository with Contents: ${action === "read" ? "read" : "read and write"}`, { cause });
 }
 async function readRepoFile(client, repo, path) {
 	try {
@@ -1549,10 +1549,10 @@ function propertyFixHints(githubMessage) {
 		if (!values.includes(value)) values.push(value);
 		byProperty.set(property, values);
 	}
-	return [...byProperty].map(([property, values]) => `add ${values.map((v) => `"${v}"`).join(", ")} to the allowed values of the organization custom property ${property} (the organization's Settings, Custom properties), then run repo setup again`);
+	return [...byProperty].map(([property, values]) => `add ${values.map((v) => `"${v}"`).join(", ")} to the allowed values of the organization custom property ${property} (the organization's Settings, Custom properties), then run setup again`);
 }
 // src/capabilities/rejected-properties.ts
-/** The values `repo setup` sends for `true_false` properties; anything else is rejected. */
+/** The values `setup` sends for `true_false` properties; anything else is rejected. */
 const BOOLEANS = /* @__PURE__ */ new Set(["true", "false"]);
 /**
 * What is wrong with `values` when compared with the organization's property definitions, one sentence per
@@ -1654,7 +1654,7 @@ async function addOrgPropertyValues(client, repo, name, values) {
 	return added;
 }
 // src/capabilities/read-repo.ts
-/** The settings `repo setup` writes, which `GET /repos/{repo}` reports under the same names. */
+/** The settings `setup` writes, which `GET /repos/{repo}` reports under the same names. */
 const SETTING_KEYS = [
 	"allow_squash_merge",
 	"allow_merge_commit",
@@ -1683,7 +1683,7 @@ async function readRepoInfo(client, repo) {
 		settings
 	};
 }
-/** A ruleset reduced to what `repo setup` writes: its enforcement, rule types and required status checks. */
+/** A ruleset reduced to what `setup` writes: its enforcement, rule types and required status checks. */
 function toRulesetDetail(data) {
 	const rules = data.rules ?? [];
 	const checks = rules.find((r) => r.type === "required_status_checks")?.parameters?.required_status_checks;
@@ -2031,7 +2031,7 @@ var GitHubSource = class {
 		return syncVariables(this.client, this.repo, variables, opts);
 	}
 	async syncOrgVariables(org, variables, opts) {
-		if (!this.orgClient) throw new Error("organization variables need the org token: set HOLOCRON_ORG_TOKEN or run `holocron auth set github.org <token>`");
+		if (!this.orgClient) throw new Error("organization variables need the org token: set HOLOCRON_ORG_TOKEN or run `holocron new token github.org <token>`");
 		return syncOrgVariables(this.orgClient, this.repo, org, variables, opts);
 	}
 	async listVariables() {
@@ -2039,7 +2039,7 @@ var GitHubSource = class {
 		return Object.fromEntries(found.map((v) => [v.name, v.value]));
 	}
 	async listOrgVariables(org) {
-		if (!this.orgClient) throw new MissingTokenError("organization variables need the org token: set HOLOCRON_ORG_TOKEN or run `holocron auth set github.org <token>`");
+		if (!this.orgClient) throw new MissingTokenError("organization variables need the org token: set HOLOCRON_ORG_TOKEN or run `holocron new token github.org <token>`");
 		const found = await this.orgClient.variables.listVariables(this.repo, {
 			kind: "organization",
 			org
@@ -2292,20 +2292,26 @@ function createPlugin(options) {
 	};
 }
 /**
-* One-line hint printed by `holocron auth set github` when no token
+* One-line hint printed by `holocron new token github` when no token
 * is supplied or the supplied token is rejected.
 */
-const AUTH_HINT = "generate fine-grained Personal Access Tokens at https://github.com/settings/tokens (one per feature — see docs/tokens.md for required scopes per operation), then run: holocron auth set github.<feature> <PAT>";
-/** Every token this plugin takes, for `holocron doctor tokens`. */
+const AUTH_HINT = "generate fine-grained Personal Access Tokens at https://github.com/settings/tokens (one per feature — see docs/tokens.md for required scopes per operation), then run: holocron new token github.<feature> <PAT>";
+/**
+* Every token this plugin takes, for `holocron doctor tokens`. The release token is `optional`: only CI's release
+* workflow reads it (from the org secret), so a development environment has no reason to hold it.
+*/
 const tokens = [
-	resolveReadToken,
-	resolveIssuesToken,
-	resolveSyncToken,
-	resolveReleaseToken,
-	resolveAdminToken,
-	resolveSecretsToken,
-	resolveDeployToken,
-	resolveUserSyncToken,
-	resolveOrgToken
-].map((resolver) => resolver.token);
+	resolveReadToken.token,
+	resolveIssuesToken.token,
+	resolveSyncToken.token,
+	{
+		...resolveReleaseToken.token,
+		optional: true
+	},
+	resolveAdminToken.token,
+	resolveSecretsToken.token,
+	resolveDeployToken.token,
+	resolveUserSyncToken.token,
+	resolveOrgToken.token
+];
 export { AUTH_HINT, AuthError, GitHubCi, GitHubEnvironments, GitHubIssues, GitHubProjects, GitHubSecrets, GitHubSource, ci, createFeatureResolver, createGitHubClient, createPlugin, encryptSecret, environments, issues, normalizeTeamEntry, projects, resolveAdminToken, resolveDeployToken, resolveIssuesToken, resolveOrgToken, resolveReadToken, resolveReleaseToken, resolveSecretsToken, resolveSyncToken, resolveUserSyncToken, secrets, source, syncLabels, syncTeams, tokens, verifyToken };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/holocron-plugin-github",
-  "version": "5.0.0-alpha.421",
+  "version": "5.0.0-alpha.423",
   "description": "Holocron plugin for GitHub. Implements source, ci, secrets, environments, and issues capabilities against the GitHub REST API.",
   "keywords": [
     "ci",
@@ -44,21 +44,21 @@
     "tsx": "4.23.15",
     "typescript": "^5.9.3",
     "vitest": "^5.1.0",
-    "@theholocron/cli": "5.0.0-alpha.421",
-    "@theholocron/eslint-config": "^8.9.0-alpha.16",
-    "@theholocron/github-client": "^1.58.0-alpha.28",
-    "@theholocron/http-client": "^1.58.0-alpha.28",
-    "@theholocron/misc-utils": "^1.17.0-alpha.4",
+    "@theholocron/eslint-config": "^8.9.0-alpha.17",
+    "@theholocron/cli": "5.0.0-alpha.423",
     "@theholocron/fs-utils": "^1.17.0-alpha.4",
-    "@theholocron/tsconfig": "^8.9.0-alpha.16",
-    "@theholocron/tsdown-config": "^8.9.0-alpha.16",
-    "@theholocron/vitest-config": "^8.9.0-alpha.16"
+    "@theholocron/github-client": "^1.58.0-alpha.29",
+    "@theholocron/http-client": "^1.58.0-alpha.29",
+    "@theholocron/tsconfig": "^8.9.0-alpha.17",
+    "@theholocron/vitest-config": "^8.9.0-alpha.17",
+    "@theholocron/misc-utils": "^1.17.0-alpha.4",
+    "@theholocron/tsdown-config": "^8.9.0-alpha.17"
   },
   "peerDependencies": {
     "@theholocron/fs-utils": "^1.16.0",
     "@theholocron/github-client": "^1.58.0",
     "@theholocron/misc-utils": "^1.16.0",
-    "@theholocron/cli": "5.0.0-alpha.421"
+    "@theholocron/cli": "5.0.0-alpha.423"
   },
   "engines": {
     "node": ">=22"