@varlock/bumpy 0.0.1 → 1.0.0

package/dist/{publish-DZ3m7qkX.mjs → publish-Cun-zQ1b.mjs}

@@ -1,26 +1,48 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as loadConfig } from "./config-CJ2orhTL.mjs";
-import { n as discoverWorkspace, r as detectWorkspaces } from "./workspace-mVjawG8g.mjs";
-import { t as DependencyGraph } from "./dep-graph-DiLeAhl9.mjs";
-import { i as tryRun, n as runAsync } from "./shell-DPlltpzb.mjs";
-import { n as hasUncommittedChanges, r as pushWithTags, t as publishPackages } from "./publish-pipeline-1M5GmbdP.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as loadConfig } from "./config-XZWUL3ma.mjs";
+import { n as detectWorkspaces } from "./package-manager-VCe10bjc.mjs";
+import { n as discoverWorkspace } from "./workspace-C5ULTyUN.mjs";
+import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
+import { n as runArgsAsync, o as tryRunArgs } from "./shell-Dj7JRD_q.mjs";
+import { a as pushWithTags, i as listTags, r as hasUncommittedChanges } from "./git-CGHVXXKw.mjs";
+import { t as publishPackages } from "./publish-pipeline-BwBuKCIk.mjs";
 //#region src/core/github-release.ts
+/** Get the current HEAD commit SHA */
+function getHeadSha(rootDir) {
+	return tryRunArgs([
+		"git",
+		"rev-parse",
+		"HEAD"
+	], { cwd: rootDir });
+}
 /** Create individual GitHub releases for each published package */
-async function createIndividualReleases(releases, changesets, rootDir, opts = {}) {
+async function createIndividualReleases(releases, bumpFiles, rootDir, opts = {}) {
 	if (!isGhAvailable()) {
 		log.dim("  gh CLI not found — skipping GitHub releases");
 		return;
 	}
+	const headSha = getHeadSha(rootDir);
 	for (const release of releases) {
 		const tag = `${release.name}@${release.newVersion}`;
-		const body = buildReleaseBody(release, changesets);
+		const body = buildReleaseBody(release, bumpFiles);
 		const title = `${release.name} v${release.newVersion}`;
 		if (opts.dryRun) {
 			log.dim(`  Would create GitHub release: ${title}`);
 			continue;
 		}
 		try {
-			await runAsync(`gh release create "${tag}" --title "${escapeShell(title)}" --notes "${escapeShell(body)}"`, { cwd: rootDir });
+			const args = [
+				"gh",
+				"release",
+				"create",
+				tag,
+				"--title",
+				title,
+				"--notes",
+				body
+			];
+			if (headSha) args.push("--target", headSha);
+			await runArgsAsync(args, { cwd: rootDir });
 			log.dim(`  Created GitHub release: ${title}`);
 		} catch (err) {
 			log.warn(`  Failed to create GitHub release for ${tag}: ${err instanceof Error ? err.message : err}`);
@@ -28,39 +50,54 @@ async function createIndividualReleases(releases, changesets, rootDir, opts = {}
 	}
 }
 /** Create a single aggregated GitHub release for all published packages */
-async function createAggregateRelease(releases, changesets, rootDir, opts = {}) {
+async function createAggregateRelease(releases, bumpFiles, rootDir, opts = {}) {
 	if (!isGhAvailable()) {
 		log.dim("  gh CLI not found — skipping GitHub release");
 		return;
 	}
 	if (releases.length === 0) return;
 	const date = (/* @__PURE__ */ new Date()).toISOString().split("T")[0];
-	const title = (opts.title || "Release {{date}}").replace("{{date}}", date);
-	const tag = `release-${date}`;
-	const body = buildAggregateBody(releases, changesets);
+	const { tag, title } = resolveAggregateTagAndTitle(date, listTags(`release-${date}*`, { cwd: rootDir }), opts.title);
+	const body = buildAggregateBody(releases, bumpFiles);
 	if (opts.dryRun) {
 		log.dim(`  Would create aggregate GitHub release: ${title}`);
 		log.dim(`  Tag: ${tag}`);
 		return;
 	}
 	try {
-		tryRun(`git tag "${tag}"`, { cwd: rootDir });
-		await runAsync(`gh release create "${tag}" --title "${escapeShell(title)}" --notes "${escapeShell(body)}"`, { cwd: rootDir });
+		tryRunArgs([
+			"git",
+			"tag",
+			tag
+		], { cwd: rootDir });
+		const headSha = getHeadSha(rootDir);
+		const args = [
+			"gh",
+			"release",
+			"create",
+			tag,
+			"--title",
+			title,
+			"--notes",
+			body
+		];
+		if (headSha) args.push("--target", headSha);
+		await runArgsAsync(args, { cwd: rootDir });
 		log.success(`Created aggregate GitHub release: ${title}`);
 	} catch (err) {
 		log.warn(`Failed to create aggregate GitHub release: ${err instanceof Error ? err.message : err}`);
 	}
 }
-function buildReleaseBody(release, changesets) {
+function buildReleaseBody(release, bumpFiles) {
 	const lines = [];
-	const relevant = changesets.filter((cs) => release.changesets.includes(cs.id));
+	const relevant = bumpFiles.filter((bf) => release.bumpFiles.includes(bf.id));
 	if (relevant.length > 0) {
-		for (const cs of relevant) if (cs.summary) lines.push(`- ${cs.summary.split("\n")[0]}`);
+		for (const bf of relevant) if (bf.summary) lines.push(`- ${bf.summary.split("\n")[0]}`);
 	}
 	if (release.isDependencyBump && relevant.length === 0) lines.push("- Updated dependencies");
 	return lines.join("\n") || "No changelog entries.";
 }
-function buildAggregateBody(releases, changesets) {
+function buildAggregateBody(releases, bumpFiles) {
 	const lines = [];
 	const groups = [
 		["Major Changes", releases.filter((r) => r.type === "major")],
@@ -72,9 +109,9 @@ function buildAggregateBody(releases, changesets) {
 		lines.push(`## ${heading}\n`);
 		for (const release of group) {
 			lines.push(`### ${release.name} v${release.newVersion}\n`);
-			const relevant = changesets.filter((cs) => release.changesets.includes(cs.id));
+			const relevant = bumpFiles.filter((bf) => release.bumpFiles.includes(bf.id));
 			if (relevant.length > 0) {
-				for (const cs of relevant) if (cs.summary) lines.push(`- ${cs.summary.split("\n")[0]}`);
+				for (const bf of relevant) if (bf.summary) lines.push(`- ${bf.summary.split("\n")[0]}`);
 			} else if (release.isDependencyBump) lines.push("- Updated dependencies");
 			else if (release.isCascadeBump) lines.push("- Version bump via cascade rule");
 			lines.push("");
@@ -82,11 +119,17 @@ function buildAggregateBody(releases, changesets) {
 	}
 	return lines.join("\n").trim() || "No changelog entries.";
 }
-function isGhAvailable() {
-	return tryRun("gh --version") !== null;
+/** Compute the aggregate release tag and title, appending -n suffix if a tag for the same date already exists */
+function resolveAggregateTagAndTitle(date, existingTags, titleTemplate) {
+	const baseTag = `release-${date}`;
+	const suffix = existingTags.length === 0 ? "" : `-${existingTags.length + 1}`;
+	return {
+		tag: `${baseTag}${suffix}`,
+		title: (titleTemplate || "Release {{date}}").replace("{{date}}", `${date}${suffix}`)
+	};
 }
-function escapeShell(str) {
-	return str.replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+function isGhAvailable() {
+	return tryRunArgs(["gh", "--version"]) !== null;
 }
 //#endregion
 //#region src/commands/publish.ts
@@ -105,7 +148,7 @@ async function publishCommand(rootDir, opts) {
 	}
 	let toPublish = await findUnpublishedPackages(packages, config);
 	if (opts.filter) {
-		const { matchGlob } = await import("./config-CJ2orhTL.mjs").then((n) => n.t);
+		const { matchGlob } = await import("./config-XZWUL3ma.mjs").then((n) => n.t);
 		const patterns = opts.filter.split(",").map((p) => p.trim());
 		toPublish = toPublish.filter((r) => patterns.some((p) => matchGlob(r.name, p)));
 	}
@@ -114,8 +157,9 @@ async function publishCommand(rootDir, opts) {
 		return;
 	}
 	const releasePlan = {
-		changesets: [],
-		releases: toPublish
+		bumpFiles: [],
+		releases: toPublish,
+		warnings: []
 	};
 	if (opts.dryRun) log.bold("Dry run — would publish:");
 	else log.bold("Publishing:");
@@ -143,11 +187,11 @@ async function publishCommand(rootDir, opts) {
 		const aggConfig = config.aggregateRelease;
 		const isAggregate = aggConfig === true || typeof aggConfig === "object" && aggConfig.enabled;
 		const aggTitle = typeof aggConfig === "object" ? aggConfig.title : void 0;
-		if (isAggregate) await createAggregateRelease(publishedReleases, releasePlan.changesets, rootDir, {
+		if (isAggregate) await createAggregateRelease(publishedReleases, releasePlan.bumpFiles, rootDir, {
 			dryRun: opts.dryRun,
 			title: aggTitle
 		});
-		else await createIndividualReleases(publishedReleases, releasePlan.changesets, rootDir, { dryRun: opts.dryRun });
+		else await createIndividualReleases(publishedReleases, releasePlan.bumpFiles, rootDir, { dryRun: opts.dryRun });
 	}
 }
 /**
@@ -168,7 +212,7 @@ async function findUnpublishedPackages(packages, _config) {
 			type: "patch",
 			oldVersion: pkg.version,
 			newVersion: pkg.version,
-			changesets: [],
+			bumpFiles: [],
 			isDependencyBump: false,
 			isCascadeBump: false
 		});
@@ -176,8 +220,7 @@ async function findUnpublishedPackages(packages, _config) {
 	return unpublished;
 }
 async function checkIfPublished(name, version, pkgConfig) {
-	const { runAsync } = await import("./shell-DPlltpzb.mjs").then((n) => n.r);
-	const { tryRun } = await import("./shell-DPlltpzb.mjs").then((n) => n.r);
+	const { runAsync, runArgsAsync, tryRunArgs } = await import("./shell-Dj7JRD_q.mjs").then((n) => n.i);
 	if (pkgConfig?.checkPublished) try {
 		return (await runAsync(pkgConfig.checkPublished)).trim() === version;
 	} catch {
@@ -185,10 +228,22 @@ async function checkIfPublished(name, version, pkgConfig) {
 	}
 	if (pkgConfig?.skipNpmPublish || pkgConfig?.publishCommand) {
 		const tag = `${name}@${version}`;
-		return tryRun(`git tag -l "${tag}"`) === tag;
+		return tryRunArgs([
+			"git",
+			"tag",
+			"-l",
+			tag
+		]) === tag;
 	}
 	try {
-		return await runAsync(`npm info "${name}@${version}" version ${pkgConfig?.registry ? `--registry ${pkgConfig.registry}` : ""}`.trim()) === version;
+		const args = [
+			"npm",
+			"info",
+			`${name}@${version}`,
+			"version"
+		];
+		if (pkgConfig?.registry) args.push("--registry", pkgConfig.registry);
+		return await runArgsAsync(args) === version;
 	} catch {
 		return false;
 	}

package/dist/{publish-pipeline-1M5GmbdP.mjs → publish-pipeline-BwBuKCIk.mjs}

@@ -1,30 +1,12 @@
-import { n as log, t as colorize } from "./logger-ZqggsyGZ.mjs";
-import { a as readJson, c as writeJson } from "./fs-DbNNEyzq.mjs";
-import { i as resolveCatalogDep } from "./workspace-mVjawG8g.mjs";
-import { r as stripProtocol } from "./semver-DWO6NFKN.mjs";
-import { i as tryRun, n as runAsync, t as run } from "./shell-DPlltpzb.mjs";
+import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
+import { a as readJson, l as updateJsonNestedField } from "./fs-DYR2XuFE.mjs";
+import { r as resolveCatalogDep } from "./package-manager-VCe10bjc.mjs";
+import { a as sq, n as runArgsAsync, o as tryRunArgs, r as runAsync } from "./shell-Dj7JRD_q.mjs";
+import { r as stripProtocol } from "./semver-DfQyVLM_.mjs";
+import { o as tagExists, t as createTag } from "./git-CGHVXXKw.mjs";
 import { resolve } from "node:path";
 import { unlink } from "node:fs/promises";
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from "node:fs";
-//#region src/core/git.ts
-/** Create a git tag */
-function createTag(tag, opts) {
-	run(`git tag ${tag}`, opts);
-}
-/** Push commits and tags to remote */
-function pushWithTags(opts) {
-	run("git push --follow-tags", opts);
-}
-/** Check if there are uncommitted changes */
-function hasUncommittedChanges(opts) {
-	const result = tryRun("git status --porcelain", opts);
-	return result !== null && result.length > 0;
-}
-/** Check if a tag already exists */
-function tagExists(tag, opts) {
-	return tryRun(`git tag -l "${tag}"`, opts) === tag;
-}
-//#endregion
 //#region src/core/publish-pipeline.ts
 /**
 * Detect which CI OIDC provider is available for npm trusted publishing.
@@ -42,7 +24,7 @@ function detectOidcProvider() {
 	return null;
 }
 const OIDC_NPM_UPGRADE_HINTS = {
-	"github-actions": "Add `actions/setup-node@v4` with `node-version: lts/*` to your workflow",
+	"github-actions": "Add `actions/setup-node@v6` with `node-version: lts/*` to your workflow",
 	gitlab: "Use a Node.js image with npm >= 11.5.1 or run `npm install -g npm@latest`",
 	circleci: "Use a Node.js image with npm >= 11.5.1 or run `sudo npm install -g npm@latest`"
 };
@@ -67,7 +49,7 @@ function setupNpmAuth(rootDir, publishManager) {
 	}
 	const oidcProvider = detectOidcProvider();
 	if (oidcProvider) {
-		const npmVersion = tryRun("npm --version");
+		const npmVersion = tryRunArgs(["npm", "--version"]);
 		if (npmVersion) {
 			const [major, minor, patch] = npmVersion.split(".").map(Number);
 			if (!(major > 11 || major === 11 && (minor > 5 || minor === 5 && patch >= 1))) {
@@ -135,7 +117,7 @@ async function publishPackages(releasePlan, packages, depGraph, config, rootDir,
 			if (pkgConfig.publishCommand) {
 				const commands = Array.isArray(pkgConfig.publishCommand) ? pkgConfig.publishCommand : [pkgConfig.publishCommand];
 				for (const cmd of commands) {
-					const expanded = cmd.replace(/\{\{version\}\}/g, release.newVersion).replace(/\{\{name\}\}/g, release.name);
+					const expanded = cmd.replace(/\{\{version\}\}/g, sq(release.newVersion)).replace(/\{\{name\}\}/g, sq(release.name));
 					log.dim(`  Running: ${expanded}`);
 					if (!opts.dryRun) await runAsync(expanded, { cwd: pkg.dir });
 				}
@@ -171,18 +153,18 @@ async function publishPackages(releasePlan, packages, depGraph, config, rootDir,
 * then publish the tarball with npm (which supports OIDC/provenance).
 */
 async function packThenPublish(pkg, pkgConfig, config, packManager, opts) {
-	const packCmd = getPackCommand(packManager);
-	log.dim(`  Packing with: ${packCmd}`);
+	const packArgs = getPackArgs(packManager);
+	log.dim(`  Packing with: ${packArgs.join(" ")}`);
 	if (opts.dryRun) {
-		const publishCmd = buildPublishCommand(pkg, pkgConfig, config, opts, "<tarball>");
-		log.dim(`  Would publish with: ${publishCmd}`);
+		const publishArgs = buildPublishArgs(pkg, pkgConfig, config, opts, "<tarball>");
+		log.dim(`  Would publish with: ${publishArgs.join(" ")}`);
 		return;
 	}
-	const tarball = parseTarballPath(await runAsync(packCmd, { cwd: pkg.dir }), pkg.dir);
+	const tarball = parseTarballPath(await runArgsAsync(packArgs, { cwd: pkg.dir }), pkg.dir, packManager);
 	try {
-		const publishCmd = buildPublishCommand(pkg, pkgConfig, config, opts, tarball);
-		log.dim(`  Publishing: ${publishCmd}`);
-		await runAsync(publishCmd, { cwd: pkg.dir });
+		const publishArgs = buildPublishArgs(pkg, pkgConfig, config, opts, tarball);
+		log.dim(`  Publishing: ${publishArgs.join(" ")}`);
+		await runArgsAsync(publishArgs, { cwd: pkg.dir });
 	} finally {
 		try {
 			await unlink(tarball);
@@ -191,39 +173,53 @@ async function packThenPublish(pkg, pkgConfig, config, packManager, opts) {
 }
 /** Publish directly from the package directory (no tarball) */
 async function npmPublishDirect(pkg, pkgConfig, config, opts) {
-	const cmd = buildPublishCommand(pkg, pkgConfig, config, opts);
-	log.dim(`  Running: ${cmd}`);
-	if (!opts.dryRun) await runAsync(cmd, { cwd: pkg.dir });
+	const args = buildPublishArgs(pkg, pkgConfig, config, opts);
+	log.dim(`  Running: ${args.join(" ")}`);
+	if (!opts.dryRun) await runArgsAsync(args, { cwd: pkg.dir });
 }
-function getPackCommand(pm) {
+function getPackArgs(pm) {
 	switch (pm) {
-		case "pnpm": return "pnpm pack";
-		case "bun": return "bun pm pack";
-		case "yarn": return "yarn pack";
-		default: return "npm pack";
+		case "pnpm": return [
+			"pnpm",
+			"pack",
+			"--json"
+		];
+		case "bun": return [
+			"bun",
+			"pm",
+			"pack"
+		];
+		case "yarn": return ["yarn", "pack"];
+		default: return [
+			"npm",
+			"pack",
+			"--json"
+		];
 	}
 }
-function buildPublishCommand(pkg, pkgConfig, config, opts, tarball) {
+function buildPublishArgs(pkg, pkgConfig, config, opts, tarball) {
 	const publishManager = config.publish.publishManager;
-	const parts = [];
-	if (publishManager === "yarn") parts.push("yarn npm publish");
-	else parts.push(`${publishManager} publish`);
-	if (tarball) parts.push(tarball);
+	const args = [];
+	if (publishManager === "yarn") args.push("yarn", "npm", "publish");
+	else args.push(publishManager, "publish");
+	if (tarball) args.push(tarball);
 	const access = pkgConfig?.access || config.access;
-	parts.push(`--access ${access}`);
-	if (pkgConfig?.registry) parts.push(`--registry ${pkgConfig.registry}`);
-	if (opts.tag) parts.push(`--tag ${opts.tag}`);
-	if (config.publish.publishArgs.length > 0) parts.push(...config.publish.publishArgs);
-	return parts.join(" ");
+	args.push("--access", access);
+	if (pkgConfig?.registry) args.push("--registry", pkgConfig.registry);
+	if (opts.tag) args.push("--tag", opts.tag);
+	if (config.publish.publishArgs.length > 0) args.push(...config.publish.publishArgs);
+	return args;
 }
 /**
 * Parse the tarball path from pack command output.
-* Each PM has different output formats:
-*   npm/pnpm: tarball filename on the last line
-*   bun:      tarball filename mid-output, summary lines after
-*   yarn:     'success Wrote tarball to "/path/to/foo.tgz".'
+* npm/pnpm use --json for structured output; bun/yarn fall back to regex parsing.
 */
-function parseTarballPath(output, cwd) {
+function parseTarballPath(output, cwd, pm) {
+	if (pm === "npm" || pm === "pnpm") try {
+		const parsed = JSON.parse(output);
+		const entry = Array.isArray(parsed) ? parsed[0] : parsed;
+		if (entry?.filename) return resolve(cwd, entry.filename);
+	} catch {}
 	const tgzMatch = output.match(/(?:^|["'\s])([^\s"']*\.tgz)/m);
 	if (tgzMatch) {
 		const tarball = tgzMatch[1];
@@ -253,7 +249,6 @@ function createGitTag(release, rootDir, opts) {
 async function resolveProtocolsInPlace(pkg, packages, releasePlan, catalogs) {
 	const pkgJsonPath = resolve(pkg.dir, "package.json");
 	const pkgJson = await readJson(pkgJsonPath);
-	let modified = false;
 	const releaseMap = new Map(releasePlan.releases.map((r) => [r.name, r]));
 	for (const depField of [
 		"dependencies",
@@ -279,13 +274,9 @@ async function resolveProtocolsInPlace(pkg, packages, releasePlan, catalogs) {
 					resolved = `${cleanRange === "*" ? "^" : cleanRange}${version}`;
 				} else resolved = cleanRange;
 			}
-			if (resolved) {
-				deps[depName] = resolved;
-				modified = true;
-			}
+			if (resolved) await updateJsonNestedField(pkgJsonPath, depField, depName, resolved);
 		}
 	}
-	if (modified) await writeJson(pkgJsonPath, pkgJson);
 }
 //#endregion
-export { hasUncommittedChanges as n, pushWithTags as r, publishPackages as t };
+export { publishPackages as t };