@varlock/bumpy 0.0.1 → 1.0.0

package/dist/ci-Bhx--Tj6.mjs

@@ -0,0 +1,629 @@
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as loadConfig } from "./config-XZWUL3ma.mjs";
+import { t as detectPackageManager } from "./package-manager-VCe10bjc.mjs";
+import { n as discoverWorkspace } from "./workspace-C5ULTyUN.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { n as runArgsAsync, o as tryRunArgs, t as runArgs } from "./shell-Dj7JRD_q.mjs";
+import { r as readBumpFiles } from "./bump-file-CCLXMLA8.mjs";
+import { t as assembleReleasePlan } from "./release-plan-Bi5QNSEo.mjs";
+import { n as getChangedFiles } from "./git-CGHVXXKw.mjs";
+import { t as randomName } from "./names-9VubBmL0.mjs";
+import { createHash } from "node:crypto";
+//#region src/commands/ci.ts
+/**
+* Temporarily override GH_TOKEN with BUMPY_GH_TOKEN for a gh CLI call.
+*
+* Use `--pat-pr` / `--pat-comments` flags to opt in. This is useful when
+* BUMPY_GH_TOKEN belongs to a dedicated automation/bot account. If you're
+* using a developer's personal PAT, it's better to leave these flags off so
+* that PRs and comments appear from github-actions[bot] — allowing the
+* developer to still review and approve the PR.
+*/
+function requirePatToken() {
+	const token = process.env.BUMPY_GH_TOKEN;
+	if (!token) throw new Error("BUMPY_GH_TOKEN must be set when using --pat-pr or --pat-comments");
+	return token;
+}
+async function withPatToken(usePat, fn) {
+	if (!usePat) return fn();
+	const token = requirePatToken();
+	const originalGhToken = process.env.GH_TOKEN;
+	process.env.GH_TOKEN = token;
+	try {
+		return await fn();
+	} finally {
+		if (originalGhToken !== void 0) process.env.GH_TOKEN = originalGhToken;
+		else delete process.env.GH_TOKEN;
+	}
+}
+/** Validate a git branch name to prevent injection */
+function validateBranchName(name) {
+	if (!/^[a-zA-Z0-9_./-]+$/.test(name)) throw new Error(`Invalid branch name: ${name}`);
+	return name;
+}
+/** Validate a PR number is numeric */
+function validatePrNumber(pr) {
+	if (!/^\d+$/.test(pr)) throw new Error(`Invalid PR number: ${pr}`);
+	return pr;
+}
+/** Configure git identity for CI commits if not already set */
+function ensureGitIdentity(rootDir, config) {
+	if (!tryRunArgs([
+		"git",
+		"config",
+		"user.name"
+	], { cwd: rootDir })) {
+		const { name: gitName, email: gitEmail } = config.gitUser;
+		runArgs([
+			"git",
+			"config",
+			"user.name",
+			gitName
+		], { cwd: rootDir });
+		runArgs([
+			"git",
+			"config",
+			"user.email",
+			gitEmail
+		], { cwd: rootDir });
+		log.dim(`  Using git identity: ${gitName} <${gitEmail}>`);
+	}
+}
+/**
+* CI check: report on pending bump files.
+* Designed for PR workflows — shows what would be released and optionally comments on the PR.
+*/
+async function ciCheckCommand(rootDir, opts) {
+	const config = await loadConfig(rootDir);
+	const { packages } = await discoverWorkspace(rootDir, config);
+	const depGraph = new DependencyGraph(packages);
+	const allBumpFiles = await readBumpFiles(rootDir);
+	if (detectPrBranch(rootDir) === config.versionPr.branch) {
+		log.dim("  Skipping — this is the version PR branch.");
+		return;
+	}
+	const inCI = !!process.env.CI;
+	const shouldComment = opts.comment ?? inCI;
+	const prNumber = detectPrNumber();
+	const pm = await detectPackageManager(rootDir);
+	const changedFiles = getChangedFiles(rootDir, config.baseBranch);
+	const prBumpFileIds = new Set(changedFiles.filter((f) => /^\.bumpy\/.*\.md$/.test(f) && !f.endsWith("README.md")).map((f) => f.replace(/^\.bumpy\//, "").replace(/\.md$/, "")));
+	const prBumpFiles = allBumpFiles.filter((bf) => prBumpFileIds.has(bf.id));
+	if (prBumpFiles.length === 0) {
+		log.info("No bump files found in this PR.");
+		if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatNoBumpFilesComment(detectPrBranch(rootDir), pm), rootDir, opts.patComments);
+		if (opts.failOnMissing) process.exit(1);
+		return;
+	}
+	const plan = assembleReleasePlan(prBumpFiles, packages, depGraph, config);
+	log.bold(`${prBumpFiles.length} bump file(s) → ${plan.releases.length} package(s) to release\n`);
+	for (const r of plan.releases) {
+		const tag = r.isDependencyBump ? " (dep)" : r.isCascadeBump ? " (cascade)" : "";
+		console.log(`  ${r.name}: ${r.oldVersion} → ${colorize(r.newVersion, "cyan")}${tag}`);
+	}
+	if (plan.warnings.length > 0) for (const w of plan.warnings) log.warn(w);
+	if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatReleasePlanComment(plan, prBumpFiles, prNumber, detectPrBranch(rootDir), pm, plan.warnings), rootDir, opts.patComments);
+}
+/**
+* CI release: either auto-publish or create a version PR.
+* Designed for merge-to-main workflows.
+*/
+async function ciReleaseCommand(rootDir, opts) {
+	const config = await loadConfig(rootDir);
+	ensureGitIdentity(rootDir, config);
+	const { packages } = await discoverWorkspace(rootDir, config);
+	const depGraph = new DependencyGraph(packages);
+	const bumpFiles = await readBumpFiles(rootDir);
+	if (bumpFiles.length === 0) {
+		log.info("No pending bump files — checking for unpublished packages...");
+		const { publishCommand } = await import("./publish-Cun-zQ1b.mjs");
+		await publishCommand(rootDir, { tag: opts.tag });
+		return;
+	}
+	const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
+	if (plan.releases.length === 0) {
+		log.info("Bump files found but no packages would be released.");
+		return;
+	}
+	if (opts.mode === "auto-publish") await autoPublish(rootDir, config, opts.tag);
+	else await createVersionPr(rootDir, plan, config, new Map([...packages.values()].map((p) => [p.name, p.relativeDir])), opts.branch, opts.patPr);
+}
+async function autoPublish(rootDir, config, tag) {
+	log.step("Running bumpy version...");
+	const { versionCommand } = await import("./version-19vVt9dv.mjs");
+	await versionCommand(rootDir);
+	log.step("Committing version changes...");
+	runArgs([
+		"git",
+		"add",
+		"-A"
+	], { cwd: rootDir });
+	if (tryRunArgs([
+		"git",
+		"status",
+		"--porcelain"
+	], { cwd: rootDir })) {
+		runArgs([
+			"git",
+			"commit",
+			"-m",
+			"Version packages"
+		], { cwd: rootDir });
+		runArgs([
+			"git",
+			"push",
+			"--no-verify"
+		], { cwd: rootDir });
+	}
+	log.step("Running bumpy publish...");
+	const { publishCommand } = await import("./publish-Cun-zQ1b.mjs");
+	await publishCommand(rootDir, { tag });
+}
+/**
+* Push a branch to origin, optionally using a custom GitHub token.
+*
+* When `BUMPY_GH_TOKEN` is set, the remote URL is temporarily rewritten to
+* include the token.  Pushes made with a PAT or GitHub App token bypass
+* GitHub's anti-recursion guard, allowing `pull_request` workflows to fire
+* on the version PR — no extra CI configuration required.
+*
+* When only the default `GITHUB_TOKEN` is available the push still succeeds,
+* but PR workflows won't be triggered automatically.
+*/
+function pushWithToken(rootDir, branch, config) {
+	if (branch === config.baseBranch || branch === "main" || branch === "master") throw new Error(`Refusing to force-push to "${branch}" — this looks like a base branch, not a version PR branch`);
+	const token = process.env.BUMPY_GH_TOKEN;
+	const repo = process.env.GITHUB_REPOSITORY;
+	const server = process.env.GITHUB_SERVER_URL || "https://github.com";
+	if (token && repo) {
+		const authedUrl = `${server.replace("://", `://x-access-token:${token}@`)}/${repo}.git`;
+		const originalUrl = tryRunArgs([
+			"git",
+			"remote",
+			"get-url",
+			"origin"
+		], { cwd: rootDir });
+		const extraHeaderKey = `http.${server}/.extraheader`;
+		const savedHeader = tryRunArgs([
+			"git",
+			"config",
+			"--local",
+			extraHeaderKey
+		], { cwd: rootDir });
+		const includeIfRaw = tryRunArgs([
+			"git",
+			"config",
+			"--local",
+			"--get-regexp",
+			"^includeif\\.gitdir:"
+		], { cwd: rootDir });
+		const savedIncludeIfs = [];
+		if (includeIfRaw) for (const line of includeIfRaw.split("\n").filter(Boolean)) {
+			const spaceIdx = line.indexOf(" ");
+			if (spaceIdx > 0) savedIncludeIfs.push({
+				key: line.slice(0, spaceIdx),
+				value: line.slice(spaceIdx + 1)
+			});
+		}
+		try {
+			if (savedHeader) runArgs([
+				"git",
+				"config",
+				"--local",
+				"--unset-all",
+				extraHeaderKey
+			], { cwd: rootDir });
+			for (const entry of savedIncludeIfs) tryRunArgs([
+				"git",
+				"config",
+				"--local",
+				"--unset",
+				entry.key
+			], { cwd: rootDir });
+			runArgs([
+				"git",
+				"remote",
+				"set-url",
+				"origin",
+				authedUrl
+			], { cwd: rootDir });
+			try {
+				runArgs([
+					"git",
+					"push",
+					"-u",
+					"origin",
+					branch,
+					"--force",
+					"--no-verify"
+				], { cwd: rootDir });
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				throw new Error(msg.replaceAll(token, "***"));
+			}
+		} finally {
+			if (originalUrl) runArgs([
+				"git",
+				"remote",
+				"set-url",
+				"origin",
+				originalUrl
+			], { cwd: rootDir });
+			if (savedHeader) runArgs([
+				"git",
+				"config",
+				"--local",
+				extraHeaderKey,
+				savedHeader
+			], { cwd: rootDir });
+			for (const entry of savedIncludeIfs) tryRunArgs([
+				"git",
+				"config",
+				"--local",
+				entry.key,
+				entry.value
+			], { cwd: rootDir });
+		}
+		log.dim("  Pushed with custom token — PR workflows will be triggered");
+	} else {
+		runArgs([
+			"git",
+			"push",
+			"-u",
+			"origin",
+			branch,
+			"--force",
+			"--no-verify"
+		], { cwd: rootDir });
+		if (!token && repo) log.warn("BUMPY_GH_TOKEN is not set — PR checks will not trigger automatically.\n  Run `bumpy ci setup` for help.");
+	}
+}
+async function createVersionPr(rootDir, plan, config, packageDirs, branchName, patPr) {
+	const branch = validateBranchName(branchName || config.versionPr.branch);
+	const baseBranch = validateBranchName(tryRunArgs([
+		"git",
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	], { cwd: rootDir }) || "main");
+	const existingPr = tryRunArgs([
+		"gh",
+		"pr",
+		"list",
+		"--head",
+		branch,
+		"--json",
+		"number",
+		"--jq",
+		".[0].number"
+	], { cwd: rootDir });
+	log.step(`Creating branch ${branch}...`);
+	if (tryRunArgs([
+		"git",
+		"rev-parse",
+		"--verify",
+		branch
+	], { cwd: rootDir }) !== null) {
+		runArgs([
+			"git",
+			"checkout",
+			branch
+		], { cwd: rootDir });
+		runArgs([
+			"git",
+			"reset",
+			"--hard",
+			baseBranch
+		], { cwd: rootDir });
+	} else runArgs([
+		"git",
+		"checkout",
+		"-b",
+		branch
+	], { cwd: rootDir });
+	log.step("Running bumpy version...");
+	const { versionCommand } = await import("./version-19vVt9dv.mjs");
+	await versionCommand(rootDir);
+	runArgs([
+		"git",
+		"add",
+		"-A"
+	], { cwd: rootDir });
+	if (!tryRunArgs([
+		"git",
+		"status",
+		"--porcelain"
+	], { cwd: rootDir })) {
+		log.info("No version changes to commit.");
+		runArgs([
+			"git",
+			"checkout",
+			baseBranch
+		], { cwd: rootDir });
+		return;
+	}
+	runArgs([
+		"git",
+		"commit",
+		"-F",
+		"-"
+	], {
+		cwd: rootDir,
+		input: [
+			"Version packages",
+			"",
+			...plan.releases.map((r) => `${r.name}@${r.newVersion}`)
+		].join("\n")
+	});
+	pushWithToken(rootDir, branch, config);
+	const prBody = formatVersionPrBody(plan, config.versionPr.preamble, packageDirs);
+	if (existingPr) {
+		const validPr = validatePrNumber(existingPr);
+		log.step(`Updating existing PR #${validPr}...`);
+		await withPatToken(!!patPr, () => runArgsAsync([
+			"gh",
+			"pr",
+			"edit",
+			validPr,
+			"--title",
+			config.versionPr.title,
+			"--body-file",
+			"-"
+		], {
+			cwd: rootDir,
+			input: prBody
+		}));
+		log.success(`Updated PR #${validPr}`);
+	} else {
+		log.step("Creating version PR...");
+		const prTitle = config.versionPr.title;
+		const result = await withPatToken(!!patPr, () => runArgsAsync([
+			"gh",
+			"pr",
+			"create",
+			"--title",
+			prTitle,
+			"--body-file",
+			"-",
+			"--base",
+			baseBranch,
+			"--head",
+			branch
+		], {
+			cwd: rootDir,
+			input: prBody
+		}));
+		log.success(`Created PR: ${result}`);
+		if (!patPr) pushWithToken(rootDir, branch, config);
+	}
+	runArgs([
+		"git",
+		"checkout",
+		baseBranch
+	], { cwd: rootDir });
+}
+const FROG_IMG_BASE = "https://raw.githubusercontent.com/dmno-dev/bumpy/main/images";
+function buildAddBumpFileLink(prBranch) {
+	if (!prBranch) return null;
+	const repo = process.env.GITHUB_REPOSITORY;
+	if (!repo) return null;
+	const template = [
+		"---",
+		"\"package-name\": patch",
+		"---",
+		"",
+		"Description of the change",
+		""
+	].join("\n");
+	const filename = `.bumpy/${randomName()}.md`;
+	return `https://github.com/${repo}/new/${prBranch}?filename=${encodeURIComponent(filename)}&value=${encodeURIComponent(template)}`;
+}
+function pmRunCommand(pm) {
+	if (pm === "bun") return "bunx bumpy";
+	if (pm === "pnpm") return "pnpm exec bumpy";
+	if (pm === "yarn") return "yarn bumpy";
+	return "npx bumpy";
+}
+function formatReleasePlanComment(plan, bumpFiles, prNumber, prBranch, pm, warnings = []) {
+	const repo = process.env.GITHUB_REPOSITORY;
+	const lines = [];
+	const preamble = [
+		`<a href="https://github.com/dmno-dev/bumpy"><img src="${FROG_IMG_BASE}/frog-talking.png" alt="bumpy-frog" width="60" align="left" style="image-rendering: pixelated;" title="Hi! I'm bumpy!" /></a>`,
+		"",
+		"**The changes in this PR will be included in the next version bump.**",
+		"<br clear=\"left\" />"
+	].join("\n");
+	lines.push(preamble);
+	lines.push("");
+	const groups = {
+		major: [],
+		minor: [],
+		patch: []
+	};
+	for (const r of plan.releases) groups[r.type]?.push(r);
+	for (const type of [
+		"major",
+		"minor",
+		"patch"
+	]) {
+		const releases = groups[type];
+		if (!releases || releases.length === 0) continue;
+		lines.push(bumpSectionHeader(type));
+		lines.push("");
+		for (const r of releases) {
+			const suffix = r.isDependencyBump ? " _(dep)_" : r.isCascadeBump ? " _(cascade)_" : "";
+			lines.push(`- \`${r.name}\` ${r.oldVersion} → **${r.newVersion}**${suffix}`);
+		}
+		lines.push("");
+	}
+	lines.push(`#### Bump files in this PR`);
+	lines.push("");
+	for (const bf of bumpFiles) {
+		const filename = `${bf.id}.md`;
+		const parts = [`\`${filename}\``];
+		if (repo) {
+			parts.push(`([view diff](https://github.com/${repo}/pull/${prNumber}/files#diff-.bumpy/${filename}))`);
+			if (prBranch) parts.push(`([edit](https://github.com/${repo}/edit/${prBranch}/.bumpy/${filename}))`);
+		}
+		lines.push(`- ${parts.join(" ")}`);
+	}
+	lines.push("");
+	if (warnings.length > 0) {
+		lines.push("#### Warnings");
+		lines.push("");
+		for (const w of warnings) lines.push(`> ⚠️ ${w}`);
+		lines.push("");
+	}
+	const addLink = buildAddBumpFileLink(prBranch);
+	if (addLink) lines.push(`[Click here if you want to add another bump file to this PR](${addLink})\n`);
+	else lines.push(`To add another bump file, run \`${pmRunCommand(pm)} add\`\n`);
+	lines.push("---");
+	lines.push(`_This comment is maintained by [bumpy](https://github.com/dmno-dev/bumpy)._`);
+	return lines.join("\n");
+}
+function formatNoBumpFilesComment(prBranch, pm) {
+	const runCmd = pmRunCommand(pm);
+	const lines = [
+		`<a href="https://github.com/dmno-dev/bumpy"><img src="${FROG_IMG_BASE}/frog-neutral.png" alt="bumpy-frog" width="60" align="left" style="image-rendering: pixelated;" title="Hi! I'm bumpy!" /></a>`,
+		"",
+		"Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a bump file.**",
+		"<br clear=\"left\" />\n",
+		"You can add a bump file by running:\n",
+		"```bash",
+		`${runCmd} add`,
+		"```"
+	];
+	const addLink = buildAddBumpFileLink(prBranch);
+	if (addLink) {
+		lines.push("");
+		lines.push(`Or [click here to add a bump file](${addLink}) directly on GitHub.`);
+	}
+	lines.push("\n---");
+	lines.push(`_This comment is maintained by [bumpy](https://github.com/dmno-dev/bumpy)._`);
+	return lines.join("\n");
+}
+function bumpSectionHeader(type) {
+	return `### ${`<img src="${FROG_IMG_BASE}/frog-${type}.png" alt="${type}" width="52" style="image-rendering: pixelated;" align="right" />`} ${type.charAt(0).toUpperCase() + type.slice(1)} releases`;
+}
+/** Build inline diff links for a package's changed files in the PR */
+function buildDiffLinks(pkgDir) {
+	const pkgJsonPath = `${pkgDir}/package.json`;
+	const changelogPath = `${pkgDir}/CHANGELOG.md`;
+	return ` <sub>${[`[package.json](#diff-${sha256Hex(pkgJsonPath)})`, `[CHANGELOG.md](#diff-${sha256Hex(changelogPath)})`].join(" · ")}</sub>`;
+}
+function sha256Hex(input) {
+	return createHash("sha256").update(input).digest("hex");
+}
+function formatVersionPrBody(plan, preamble, packageDirs) {
+	const lines = [];
+	lines.push(preamble);
+	lines.push("");
+	const groups = {
+		major: [],
+		minor: [],
+		patch: []
+	};
+	for (const r of plan.releases) groups[r.type]?.push(r);
+	for (const type of [
+		"major",
+		"minor",
+		"patch"
+	]) {
+		const releases = groups[type];
+		if (!releases || releases.length === 0) continue;
+		lines.push(bumpSectionHeader(type));
+		lines.push("");
+		for (const r of releases) {
+			const suffix = r.isDependencyBump ? " _(dep)_" : r.isCascadeBump ? " _(cascade)_" : "";
+			const pkgDir = packageDirs.get(r.name);
+			const diffLinks = pkgDir ? buildDiffLinks(pkgDir) : "";
+			lines.push(`#### \`${r.name}\` ${r.oldVersion} → **${r.newVersion}**${suffix}${diffLinks}`);
+			lines.push("");
+			const relevantBumpFiles = plan.bumpFiles.filter((bf) => r.bumpFiles.includes(bf.id));
+			if (relevantBumpFiles.length > 0) {
+				for (const bf of relevantBumpFiles) if (bf.summary) {
+					const bfLink = ` ([bump file](#diff-${sha256Hex(`.bumpy/${bf.id}.md`)}))`;
+					const summaryLines = bf.summary.split("\n");
+					lines.push(`- ${summaryLines[0]}${bfLink}`);
+					for (let i = 1; i < summaryLines.length; i++) if (summaryLines[i].trim()) lines.push(`  ${summaryLines[i]}`);
+				}
+			} else if (r.isDependencyBump) lines.push("- Updated dependencies");
+			else if (r.isCascadeBump) lines.push("- Version bump via cascade rule");
+			lines.push("");
+		}
+	}
+	return lines.join("\n");
+}
+const COMMENT_MARKER = "<!-- bumpy-release-plan -->";
+async function postOrUpdatePrComment(prNumber, body, rootDir, usePat = false) {
+	const validPr = validatePrNumber(prNumber);
+	const markedBody = `${COMMENT_MARKER}\n${body}`;
+	try {
+		const commentId = tryRunArgs([
+			"gh",
+			"pr",
+			"view",
+			validPr,
+			"--json",
+			"comments",
+			"--jq",
+			`.comments[] | select(.body | startswith("${COMMENT_MARKER}")) | .url | capture("issuecomment-(?<id>[0-9]+)$") | .id`
+		], { cwd: rootDir })?.split("\n")[0]?.trim();
+		if (commentId) {
+			await withPatToken(usePat, () => runArgsAsync([
+				"gh",
+				"api",
+				`repos/{owner}/{repo}/issues/comments/${commentId}`,
+				"-X",
+				"PATCH",
+				"-F",
+				"body=@-"
+			], {
+				cwd: rootDir,
+				input: markedBody
+			}));
+			log.dim("  Updated PR comment");
+		} else {
+			await withPatToken(usePat, () => runArgsAsync([
+				"gh",
+				"pr",
+				"comment",
+				validPr,
+				"--body-file",
+				"-"
+			], {
+				cwd: rootDir,
+				input: markedBody
+			}));
+			log.dim("  Posted PR comment");
+		}
+	} catch (err) {
+		log.warn(`  Failed to comment on PR: ${err instanceof Error ? err.message : err}`);
+	}
+}
+function detectPrBranch(rootDir) {
+	if (process.env.GITHUB_HEAD_REF) return process.env.GITHUB_HEAD_REF;
+	return tryRunArgs([
+		"gh",
+		"pr",
+		"view",
+		"--json",
+		"headRefName",
+		"--jq",
+		".headRefName"
+	], { cwd: rootDir })?.trim() || null;
+}
+function detectPrNumber() {
+	if (process.env.GITHUB_EVENT_NAME === "pull_request") {
+		const match = process.env.GITHUB_REF?.match(/refs\/pull\/(\d+)\//);
+		if (match) return match[1];
+	}
+	const envPr = process.env.BUMPY_PR_NUMBER || process.env.PR_NUMBER || null;
+	if (envPr && !/^\d+$/.test(envPr)) {
+		log.warn(`Ignoring invalid PR number from environment: ${envPr}`);
+		return null;
+	}
+	return envPr;
+}
+//#endregion
+export { ciCheckCommand, ciReleaseCommand };