@varlock/bumpy 0.0.2 → 1.0.0

package/dist/{changelog-github-Du62krXi.mjs → changelog-github-Cd8uJHZI.mjs}

@@ -7,12 +7,14 @@ import { o as tryRunArgs } from "./shell-Dj7JRD_q.mjs";
 * Usage in config:
 *   "changelog": "github"
 *   "changelog": ["github", { "repo": "dmno-dev/bumpy" }]
-*   "changelog": ["github", { "repo": "dmno-dev/bumpy", "internalAuthors": ["theoephraim"] }]
+*   "changelog": ["github", { "thankContributors": false }]
+*   "changelog": ["github", { "internalAuthors": ["theoephraim"] }]
 */
 function createGithubFormatter(options = {}) {
+	const thankContributors = options.thankContributors ?? true;
 	const internalAuthorsSet = new Set((options.internalAuthors ?? []).map((a) => a.toLowerCase()));
 	return async (ctx) => {
-		const { release, changesets, date } = ctx;
+		const { release, bumpFiles, date } = ctx;
 		const repoSlug = options.repo ?? detectRepo();
 		const serverUrl = process.env.GITHUB_SERVER_URL || "https://github.com";
 		const lines = [];
@@ -20,25 +22,25 @@ function createGithubFormatter(options = {}) {
 		lines.push("");
 		lines.push(`_${date}_`);
 		lines.push("");
-		const relevantChangesets = changesets.filter((cs) => release.changesets.includes(cs.id));
-		if (relevantChangesets.length > 0) for (const cs of relevantChangesets) {
-			if (!cs.summary) continue;
-			const { cleanSummary, overrides } = extractSummaryMeta(cs.summary);
-			const gitInfo = resolveChangesetInfo(cs.id, repoSlug, serverUrl, overrides);
+		const relevantBumpFiles = bumpFiles.filter((bf) => release.bumpFiles.includes(bf.id));
+		if (relevantBumpFiles.length > 0) for (const bf of relevantBumpFiles) {
+			if (!bf.summary) continue;
+			const { cleanSummary, overrides } = extractSummaryMeta(bf.summary);
+			const gitInfo = resolveBumpFileInfo(bf.id, repoSlug, serverUrl, overrides);
 			const summaryLines = cleanSummary.split("\n");
 			const firstLine = linkifyIssueRefs(summaryLines[0], serverUrl, repoSlug);
-			const prefix = formatPrefix(gitInfo, serverUrl, repoSlug, internalAuthorsSet);
+			const prefix = formatPrefix(gitInfo, serverUrl, repoSlug, thankContributors, internalAuthorsSet);
 			lines.push(`-${prefix ? ` ${prefix} -` : ""} ${firstLine}`);
 			for (let i = 1; i < summaryLines.length; i++) if (summaryLines[i].trim()) lines.push(`  ${linkifyIssueRefs(summaryLines[i], serverUrl, repoSlug)}`);
 		}
-		if (release.isDependencyBump && relevantChangesets.length === 0) lines.push("- Updated dependencies");
-		if (release.isCascadeBump && !release.isDependencyBump && relevantChangesets.length === 0) lines.push("- Version bump via cascade rule");
+		if (release.isDependencyBump && relevantBumpFiles.length === 0) lines.push("- Updated dependencies");
+		if (release.isCascadeBump && !release.isDependencyBump && relevantBumpFiles.length === 0) lines.push("- Version bump via cascade rule");
 		lines.push("");
 		return lines.join("\n");
 	};
 }
 /**
-* Extract metadata lines (pr, commit, author) from a changeset summary.
+* Extract metadata lines (pr, commit, author) from a bump file summary.
 * These override git-derived info, matching the behavior of @changesets/changelog-github.
 */
 function extractSummaryMeta(summary) {
@@ -60,10 +62,10 @@ function extractSummaryMeta(summary) {
 	};
 }
 /**
-* Resolve PR, commit, and author info for a changeset.
+* Resolve PR, commit, and author info for a bump file.
 * Summary overrides take precedence over git-derived info.
 */
-function resolveChangesetInfo(changesetId, repo, serverUrl, overrides) {
+function resolveBumpFileInfo(bumpFileId, repo, serverUrl, overrides) {
 	if (overrides.pr !== void 0) {
 		const prInfo = lookupPr(overrides.pr, repo);
 		return {
@@ -73,7 +75,7 @@ function resolveChangesetInfo(changesetId, repo, serverUrl, overrides) {
 			author: overrides.authors?.[0] ?? prInfo?.author
 		};
 	}
-	const gitInfo = findChangesetCommitInfo(changesetId, repo);
+	const gitInfo = findBumpFileCommitInfo(bumpFileId, repo);
 	return {
 		prNumber: gitInfo?.prNumber,
 		prUrl: gitInfo?.prUrl,
@@ -106,10 +108,10 @@ function lookupPr(prNumber, repo) {
 	}
 }
 /**
-* Find the PR that introduced a changeset file by checking git log
+* Find the PR that introduced a bump file by checking git log
 * for the commit that added the file, then looking up the PR.
 */
-function findChangesetCommitInfo(changesetId, repo) {
+function findBumpFileCommitInfo(bumpFileId, repo) {
 	try {
 		const commitOutput = tryRunArgs([
 			"git",
@@ -117,8 +119,8 @@ function findChangesetCommitInfo(changesetId, repo) {
 			"--diff-filter=A",
 			"--format=%H",
 			"--",
-			`.bumpy/${changesetId}.md`,
-			`.changeset/${changesetId}.md`
+			`.bumpy/${bumpFileId}.md`,
+			`.changeset/${bumpFileId}.md`
 		]);
 		if (!commitOutput) return null;
 		const commitHash = commitOutput.split("\n")[0].trim();
@@ -155,14 +157,14 @@ function findChangesetCommitInfo(changesetId, repo) {
 * Build the prefix portion of a changelog line: PR link, commit link, thanks.
 * Matches the format used by @changesets/changelog-github.
 */
-function formatPrefix(info, serverUrl, repo, internalAuthors) {
+function formatPrefix(info, serverUrl, repo, thankContributors, internalAuthors) {
 	const parts = [];
 	if (info.prNumber && info.prUrl) parts.push(`[#${info.prNumber}](${info.prUrl})`);
 	if (info.commitHash && repo) {
 		const short = info.commitHash.slice(0, 7);
 		parts.push(`[\`${short}\`](${serverUrl}/${repo}/commit/${info.commitHash})`);
 	}
-	if (info.author && !internalAuthors.has(info.author.toLowerCase())) parts.push(`Thanks [@${info.author}](${serverUrl}/${info.author})!`);
+	if (thankContributors && info.author && !internalAuthors.has(info.author.toLowerCase())) parts.push(`Thanks [@${info.author}](${serverUrl}/${info.author})!`);
 	return parts.join(" ");
 }
 /**

package/dist/{check-jIwike9F.mjs → check-BOoxpWqk.mjs}

@@ -1,21 +1,21 @@
 import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
-import { a as loadConfig } from "./config-BkwIEaQg.mjs";
-import { n as discoverWorkspace } from "./workspace-CxEKakDm.mjs";
-import { r as readChangesets } from "./changeset-UCZdSRDv.mjs";
+import { a as loadConfig } from "./config-XZWUL3ma.mjs";
+import { n as discoverWorkspace } from "./workspace-C5ULTyUN.mjs";
+import { r as readBumpFiles } from "./bump-file-CCLXMLA8.mjs";
 import { n as getChangedFiles } from "./git-CGHVXXKw.mjs";
 import { relative } from "node:path";
 //#region src/commands/check.ts
 /**
 * Local check: detect which packages have changed on this branch
-* and verify they have corresponding changesets.
+* and verify they have corresponding bump files.
 * Designed for pre-push hooks — no GitHub API needed.
 */
 async function checkCommand(rootDir) {
 	const config = await loadConfig(rootDir);
 	const { packages } = await discoverWorkspace(rootDir, config);
-	const changesets = await readChangesets(rootDir);
+	const bumpFiles = await readBumpFiles(rootDir);
 	const coveredPackages = /* @__PURE__ */ new Set();
-	for (const cs of changesets) for (const release of cs.releases) coveredPackages.add(release.name);
+	for (const bf of bumpFiles) for (const release of bf.releases) coveredPackages.add(release.name);
 	const baseBranch = config.baseBranch;
 	const changedFiles = getChangedFiles(rootDir, baseBranch);
 	if (changedFiles.length === 0) {
@@ -29,13 +29,13 @@ async function checkCommand(rootDir) {
 	}
 	const missing = changedPackages.filter((name) => !coveredPackages.has(name));
 	if (missing.length === 0) {
-		log.success(`All ${changedPackages.length} changed package(s) have changesets.`);
+		log.success(`All ${changedPackages.length} changed package(s) have bump files.`);
 		return;
 	}
-	log.warn(`${missing.length} changed package(s) missing changesets:\n`);
+	log.warn(`${missing.length} changed package(s) missing bump files:\n`);
 	for (const name of missing) console.log(`  ${colorize(name, "yellow")}`);
 	console.log();
-	log.dim("Run `bumpy add` to create a changeset, or `bumpy add --empty` if no release is needed.");
+	log.dim("Run `bumpy add` to create a bump file, or `bumpy add --empty` if no release is needed.");
 	process.exit(1);
 }
 /** Map changed files to the packages they belong to */

package/dist/{ci-D6LQbR38.mjs → ci-Bhx--Tj6.mjs}

@@ -1,14 +1,41 @@
 import { n as log, t as colorize } from "./logger-C2dEe5Su.mjs";
-import { a as loadConfig } from "./config-BkwIEaQg.mjs";
-import { t as detectPackageManager } from "./package-manager-DcI5TdDE.mjs";
-import { n as discoverWorkspace } from "./workspace-CxEKakDm.mjs";
+import { a as loadConfig } from "./config-XZWUL3ma.mjs";
+import { t as detectPackageManager } from "./package-manager-VCe10bjc.mjs";
+import { n as discoverWorkspace } from "./workspace-C5ULTyUN.mjs";
 import { t as DependencyGraph } from "./dep-graph-E-9-eQ2J.mjs";
 import { n as runArgsAsync, o as tryRunArgs, t as runArgs } from "./shell-Dj7JRD_q.mjs";
-import { r as readChangesets } from "./changeset-UCZdSRDv.mjs";
-import { t as assembleReleasePlan } from "./release-plan-BEzwApuK.mjs";
+import { r as readBumpFiles } from "./bump-file-CCLXMLA8.mjs";
+import { t as assembleReleasePlan } from "./release-plan-Bi5QNSEo.mjs";
 import { n as getChangedFiles } from "./git-CGHVXXKw.mjs";
-import { t as randomName } from "./names-Ck8cun7B.mjs";
+import { t as randomName } from "./names-9VubBmL0.mjs";
+import { createHash } from "node:crypto";
 //#region src/commands/ci.ts
+/**
+* Temporarily override GH_TOKEN with BUMPY_GH_TOKEN for a gh CLI call.
+*
+* Use `--pat-pr` / `--pat-comments` flags to opt in. This is useful when
+* BUMPY_GH_TOKEN belongs to a dedicated automation/bot account. If you're
+* using a developer's personal PAT, it's better to leave these flags off so
+* that PRs and comments appear from github-actions[bot] — allowing the
+* developer to still review and approve the PR.
+*/
+function requirePatToken() {
+	const token = process.env.BUMPY_GH_TOKEN;
+	if (!token) throw new Error("BUMPY_GH_TOKEN must be set when using --pat-pr or --pat-comments");
+	return token;
+}
+async function withPatToken(usePat, fn) {
+	if (!usePat) return fn();
+	const token = requirePatToken();
+	const originalGhToken = process.env.GH_TOKEN;
+	process.env.GH_TOKEN = token;
+	try {
+		return await fn();
+	} finally {
+		if (originalGhToken !== void 0) process.env.GH_TOKEN = originalGhToken;
+		else delete process.env.GH_TOKEN;
+	}
+}
 /** Validate a git branch name to prevent injection */
 function validateBranchName(name) {
 	if (!/^[a-zA-Z0-9_./-]+$/.test(name)) throw new Error(`Invalid branch name: ${name}`);
@@ -43,14 +70,14 @@ function ensureGitIdentity(rootDir, config) {
 	}
 }
 /**
-* CI check: report on pending changesets.
+* CI check: report on pending bump files.
 * Designed for PR workflows — shows what would be released and optionally comments on the PR.
 */
 async function ciCheckCommand(rootDir, opts) {
 	const config = await loadConfig(rootDir);
 	const { packages } = await discoverWorkspace(rootDir, config);
 	const depGraph = new DependencyGraph(packages);
-	const allChangesets = await readChangesets(rootDir);
+	const allBumpFiles = await readBumpFiles(rootDir);
 	if (detectPrBranch(rootDir) === config.versionPr.branch) {
 		log.dim("  Skipping — this is the version PR branch.");
 		return;
@@ -60,21 +87,22 @@ async function ciCheckCommand(rootDir, opts) {
 	const prNumber = detectPrNumber();
 	const pm = await detectPackageManager(rootDir);
 	const changedFiles = getChangedFiles(rootDir, config.baseBranch);
-	const prChangesetIds = new Set(changedFiles.filter((f) => /^\.bumpy\/.*\.md$/.test(f) && !f.endsWith("README.md")).map((f) => f.replace(/^\.bumpy\//, "").replace(/\.md$/, "")));
-	const prChangesets = allChangesets.filter((cs) => prChangesetIds.has(cs.id));
-	if (prChangesets.length === 0) {
-		log.info("No changesets found in this PR.");
-		if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatNoChangesetsComment(detectPrBranch(rootDir), pm), rootDir);
+	const prBumpFileIds = new Set(changedFiles.filter((f) => /^\.bumpy\/.*\.md$/.test(f) && !f.endsWith("README.md")).map((f) => f.replace(/^\.bumpy\//, "").replace(/\.md$/, "")));
+	const prBumpFiles = allBumpFiles.filter((bf) => prBumpFileIds.has(bf.id));
+	if (prBumpFiles.length === 0) {
+		log.info("No bump files found in this PR.");
+		if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatNoBumpFilesComment(detectPrBranch(rootDir), pm), rootDir, opts.patComments);
 		if (opts.failOnMissing) process.exit(1);
 		return;
 	}
-	const plan = assembleReleasePlan(prChangesets, packages, depGraph, config);
-	log.bold(`${prChangesets.length} changeset(s) → ${plan.releases.length} package(s) to release\n`);
+	const plan = assembleReleasePlan(prBumpFiles, packages, depGraph, config);
+	log.bold(`${prBumpFiles.length} bump file(s) → ${plan.releases.length} package(s) to release\n`);
 	for (const r of plan.releases) {
 		const tag = r.isDependencyBump ? " (dep)" : r.isCascadeBump ? " (cascade)" : "";
 		console.log(`  ${r.name}: ${r.oldVersion} → ${colorize(r.newVersion, "cyan")}${tag}`);
 	}
-	if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatReleasePlanComment(plan, prChangesets, prNumber, detectPrBranch(rootDir), pm), rootDir);
+	if (plan.warnings.length > 0) for (const w of plan.warnings) log.warn(w);
+	if (shouldComment && prNumber) await postOrUpdatePrComment(prNumber, formatReleasePlanComment(plan, prBumpFiles, prNumber, detectPrBranch(rootDir), pm, plan.warnings), rootDir, opts.patComments);
 }
 /**
 * CI release: either auto-publish or create a version PR.
@@ -85,24 +113,24 @@ async function ciReleaseCommand(rootDir, opts) {
 	ensureGitIdentity(rootDir, config);
 	const { packages } = await discoverWorkspace(rootDir, config);
 	const depGraph = new DependencyGraph(packages);
-	const changesets = await readChangesets(rootDir);
-	if (changesets.length === 0) {
-		log.info("No pending changesets — checking for unpublished packages...");
-		const { publishCommand } = await import("./publish-D_7RqEYL.mjs");
+	const bumpFiles = await readBumpFiles(rootDir);
+	if (bumpFiles.length === 0) {
+		log.info("No pending bump files — checking for unpublished packages...");
+		const { publishCommand } = await import("./publish-Cun-zQ1b.mjs");
 		await publishCommand(rootDir, { tag: opts.tag });
 		return;
 	}
-	const plan = assembleReleasePlan(changesets, packages, depGraph, config);
+	const plan = assembleReleasePlan(bumpFiles, packages, depGraph, config);
 	if (plan.releases.length === 0) {
-		log.info("Changesets found but no packages would be released.");
+		log.info("Bump files found but no packages would be released.");
 		return;
 	}
 	if (opts.mode === "auto-publish") await autoPublish(rootDir, config, opts.tag);
-	else await createVersionPr(rootDir, plan, config, new Map([...packages.values()].map((p) => [p.name, p.relativeDir])), opts.branch);
+	else await createVersionPr(rootDir, plan, config, new Map([...packages.values()].map((p) => [p.name, p.relativeDir])), opts.branch, opts.patPr);
 }
 async function autoPublish(rootDir, config, tag) {
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-cAUkfYPx.mjs");
+	const { versionCommand } = await import("./version-19vVt9dv.mjs");
 	await versionCommand(rootDir);
 	log.step("Committing version changes...");
 	runArgs([
@@ -121,10 +149,14 @@ async function autoPublish(rootDir, config, tag) {
 			"-m",
 			"Version packages"
 		], { cwd: rootDir });
-		runArgs(["git", "push"], { cwd: rootDir });
+		runArgs([
+			"git",
+			"push",
+			"--no-verify"
+		], { cwd: rootDir });
 	}
 	log.step("Running bumpy publish...");
-	const { publishCommand } = await import("./publish-D_7RqEYL.mjs");
+	const { publishCommand } = await import("./publish-Cun-zQ1b.mjs");
 	await publishCommand(rootDir, { tag });
 }
 /**
@@ -138,7 +170,8 @@ async function autoPublish(rootDir, config, tag) {
 * When only the default `GITHUB_TOKEN` is available the push still succeeds,
 * but PR workflows won't be triggered automatically.
 */
-function pushWithToken(rootDir, branch) {
+function pushWithToken(rootDir, branch, config) {
+	if (branch === config.baseBranch || branch === "main" || branch === "master") throw new Error(`Refusing to force-push to "${branch}" — this looks like a base branch, not a version PR branch`);
 	const token = process.env.BUMPY_GH_TOKEN;
 	const repo = process.env.GITHUB_REPOSITORY;
 	const server = process.env.GITHUB_SERVER_URL || "https://github.com";
@@ -162,7 +195,7 @@ function pushWithToken(rootDir, branch) {
 			"config",
 			"--local",
 			"--get-regexp",
-			"^includeIf\\.gitdir:"
+			"^includeif\\.gitdir:"
 		], { cwd: rootDir });
 		const savedIncludeIfs = [];
 		if (includeIfRaw) for (const line of includeIfRaw.split("\n").filter(Boolean)) {
@@ -194,14 +227,20 @@ function pushWithToken(rootDir, branch) {
 				"origin",
 				authedUrl
 			], { cwd: rootDir });
-			runArgs([
-				"git",
-				"push",
-				"-u",
-				"origin",
-				branch,
-				"--force"
-			], { cwd: rootDir });
+			try {
+				runArgs([
+					"git",
+					"push",
+					"-u",
+					"origin",
+					branch,
+					"--force",
+					"--no-verify"
+				], { cwd: rootDir });
+			} catch (err) {
+				const msg = err instanceof Error ? err.message : String(err);
+				throw new Error(msg.replaceAll(token, "***"));
+			}
 		} finally {
 			if (originalUrl) runArgs([
 				"git",
@@ -233,12 +272,13 @@ function pushWithToken(rootDir, branch) {
 			"-u",
 			"origin",
 			branch,
-			"--force"
+			"--force",
+			"--no-verify"
 		], { cwd: rootDir });
 		if (!token && repo) log.warn("BUMPY_GH_TOKEN is not set — PR checks will not trigger automatically.\n  Run `bumpy ci setup` for help.");
 	}
 }
-async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
+async function createVersionPr(rootDir, plan, config, packageDirs, branchName, patPr) {
 	const branch = validateBranchName(branchName || config.versionPr.branch);
 	const baseBranch = validateBranchName(tryRunArgs([
 		"git",
@@ -282,7 +322,7 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		branch
 	], { cwd: rootDir });
 	log.step("Running bumpy version...");
-	const { versionCommand } = await import("./version-cAUkfYPx.mjs");
+	const { versionCommand } = await import("./version-19vVt9dv.mjs");
 	await versionCommand(rootDir);
 	runArgs([
 		"git",
@@ -315,12 +355,12 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 			...plan.releases.map((r) => `${r.name}@${r.newVersion}`)
 		].join("\n")
 	});
-	pushWithToken(rootDir, branch);
+	pushWithToken(rootDir, branch, config);
 	const prBody = formatVersionPrBody(plan, config.versionPr.preamble, packageDirs);
 	if (existingPr) {
 		const validPr = validatePrNumber(existingPr);
 		log.step(`Updating existing PR #${validPr}...`);
-		await runArgsAsync([
+		await withPatToken(!!patPr, () => runArgsAsync([
 			"gh",
 			"pr",
 			"edit",
@@ -332,12 +372,12 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		], {
 			cwd: rootDir,
 			input: prBody
-		});
+		}));
 		log.success(`Updated PR #${validPr}`);
 	} else {
 		log.step("Creating version PR...");
 		const prTitle = config.versionPr.title;
-		const result = await runArgsAsync([
+		const result = await withPatToken(!!patPr, () => runArgsAsync([
 			"gh",
 			"pr",
 			"create",
@@ -352,8 +392,9 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 		], {
 			cwd: rootDir,
 			input: prBody
-		});
+		}));
 		log.success(`Created PR: ${result}`);
+		if (!patPr) pushWithToken(rootDir, branch, config);
 	}
 	runArgs([
 		"git",
@@ -362,7 +403,7 @@ async function createVersionPr(rootDir, plan, config, packageDirs, branchName) {
 	], { cwd: rootDir });
 }
 const FROG_IMG_BASE = "https://raw.githubusercontent.com/dmno-dev/bumpy/main/images";
-function buildAddChangesetLink(prBranch) {
+function buildAddBumpFileLink(prBranch) {
 	if (!prBranch) return null;
 	const repo = process.env.GITHUB_REPOSITORY;
 	if (!repo) return null;
@@ -383,7 +424,7 @@ function pmRunCommand(pm) {
 	if (pm === "yarn") return "yarn bumpy";
 	return "npx bumpy";
 }
-function formatReleasePlanComment(plan, changesets, prNumber, prBranch, pm) {
+function formatReleasePlanComment(plan, bumpFiles, prNumber, prBranch, pm, warnings = []) {
 	const repo = process.env.GITHUB_REPOSITORY;
 	const lines = [];
 	const preamble = [
@@ -415,10 +456,10 @@ function formatReleasePlanComment(plan, changesets, prNumber, prBranch, pm) {
 		}
 		lines.push("");
 	}
-	lines.push(`#### Changesets in this PR`);
+	lines.push(`#### Bump files in this PR`);
 	lines.push("");
-	for (const cs of changesets) {
-		const filename = `${cs.id}.md`;
+	for (const bf of bumpFiles) {
+		const filename = `${bf.id}.md`;
 		const parts = [`\`${filename}\``];
 		if (repo) {
 			parts.push(`([view diff](https://github.com/${repo}/pull/${prNumber}/files#diff-.bumpy/${filename}))`);
@@ -427,29 +468,35 @@ function formatReleasePlanComment(plan, changesets, prNumber, prBranch, pm) {
 		lines.push(`- ${parts.join(" ")}`);
 	}
 	lines.push("");
-	const addLink = buildAddChangesetLink(prBranch);
-	if (addLink) lines.push(`[Click here if you want to add another changeset to this PR](${addLink})\n`);
-	else lines.push(`To add another changeset, run \`${pmRunCommand(pm)} add\`\n`);
+	if (warnings.length > 0) {
+		lines.push("#### Warnings");
+		lines.push("");
+		for (const w of warnings) lines.push(`> ⚠️ ${w}`);
+		lines.push("");
+	}
+	const addLink = buildAddBumpFileLink(prBranch);
+	if (addLink) lines.push(`[Click here if you want to add another bump file to this PR](${addLink})\n`);
+	else lines.push(`To add another bump file, run \`${pmRunCommand(pm)} add\`\n`);
 	lines.push("---");
 	lines.push(`_This comment is maintained by [bumpy](https://github.com/dmno-dev/bumpy)._`);
 	return lines.join("\n");
 }
-function formatNoChangesetsComment(prBranch, pm) {
+function formatNoBumpFilesComment(prBranch, pm) {
 	const runCmd = pmRunCommand(pm);
 	const lines = [
 		`<a href="https://github.com/dmno-dev/bumpy"><img src="${FROG_IMG_BASE}/frog-neutral.png" alt="bumpy-frog" width="60" align="left" style="image-rendering: pixelated;" title="Hi! I'm bumpy!" /></a>`,
 		"",
-		"Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a changeset.**",
+		"Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a bump file.**",
 		"<br clear=\"left\" />\n",
-		"You can add a changeset by running:\n",
+		"You can add a bump file by running:\n",
 		"```bash",
 		`${runCmd} add`,
 		"```"
 	];
-	const addLink = buildAddChangesetLink(prBranch);
+	const addLink = buildAddBumpFileLink(prBranch);
 	if (addLink) {
 		lines.push("");
-		lines.push(`Or [click here to add a changeset](${addLink}) directly on GitHub.`);
+		lines.push(`Or [click here to add a bump file](${addLink}) directly on GitHub.`);
 	}
 	lines.push("\n---");
 	lines.push(`_This comment is maintained by [bumpy](https://github.com/dmno-dev/bumpy)._`);
@@ -465,10 +512,7 @@ function buildDiffLinks(pkgDir) {
 	return ` <sub>${[`[package.json](#diff-${sha256Hex(pkgJsonPath)})`, `[CHANGELOG.md](#diff-${sha256Hex(changelogPath)})`].join(" · ")}</sub>`;
 }
 function sha256Hex(input) {
-	const encoder = new TextEncoder();
-	const hasher = new Bun.CryptoHasher("sha256");
-	hasher.update(encoder.encode(input));
-	return hasher.digest("hex");
+	return createHash("sha256").update(input).digest("hex");
 }
 function formatVersionPrBody(plan, preamble, packageDirs) {
 	const lines = [];
@@ -495,12 +539,12 @@ function formatVersionPrBody(plan, preamble, packageDirs) {
 			const diffLinks = pkgDir ? buildDiffLinks(pkgDir) : "";
 			lines.push(`#### \`${r.name}\` ${r.oldVersion} → **${r.newVersion}**${suffix}${diffLinks}`);
 			lines.push("");
-			const relevantChangesets = plan.changesets.filter((cs) => r.changesets.includes(cs.id));
-			if (relevantChangesets.length > 0) {
-				for (const cs of relevantChangesets) if (cs.summary) {
-					const csLink = ` ([changeset](#diff-${sha256Hex(`.bumpy/${cs.id}.md`)}))`;
-					const summaryLines = cs.summary.split("\n");
-					lines.push(`- ${summaryLines[0]}${csLink}`);
+			const relevantBumpFiles = plan.bumpFiles.filter((bf) => r.bumpFiles.includes(bf.id));
+			if (relevantBumpFiles.length > 0) {
+				for (const bf of relevantBumpFiles) if (bf.summary) {
+					const bfLink = ` ([bump file](#diff-${sha256Hex(`.bumpy/${bf.id}.md`)}))`;
+					const summaryLines = bf.summary.split("\n");
+					lines.push(`- ${summaryLines[0]}${bfLink}`);
 					for (let i = 1; i < summaryLines.length; i++) if (summaryLines[i].trim()) lines.push(`  ${summaryLines[i]}`);
 				}
 			} else if (r.isDependencyBump) lines.push("- Updated dependencies");
@@ -511,7 +555,7 @@ function formatVersionPrBody(plan, preamble, packageDirs) {
 	return lines.join("\n");
 }
 const COMMENT_MARKER = "<!-- bumpy-release-plan -->";
-async function postOrUpdatePrComment(prNumber, body, rootDir) {
+async function postOrUpdatePrComment(prNumber, body, rootDir, usePat = false) {
 	const validPr = validatePrNumber(prNumber);
 	const markedBody = `${COMMENT_MARKER}\n${body}`;
 	try {
@@ -526,7 +570,7 @@ async function postOrUpdatePrComment(prNumber, body, rootDir) {
 			`.comments[] | select(.body | startswith("${COMMENT_MARKER}")) | .url | capture("issuecomment-(?<id>[0-9]+)$") | .id`
 		], { cwd: rootDir })?.split("\n")[0]?.trim();
 		if (commentId) {
-			await runArgsAsync([
+			await withPatToken(usePat, () => runArgsAsync([
 				"gh",
 				"api",
 				`repos/{owner}/{repo}/issues/comments/${commentId}`,
@@ -537,10 +581,10 @@ async function postOrUpdatePrComment(prNumber, body, rootDir) {
 			], {
 				cwd: rootDir,
 				input: markedBody
-			});
+			}));
 			log.dim("  Updated PR comment");
 		} else {
-			await runArgsAsync([
+			await withPatToken(usePat, () => runArgsAsync([
 				"gh",
 				"pr",
 				"comment",
@@ -550,7 +594,7 @@ async function postOrUpdatePrComment(prNumber, body, rootDir) {
 			], {
 				cwd: rootDir,
 				input: markedBody
-			});
+			}));
 			log.dim("  Posted PR comment");
 		}
 	} catch (err) {

package/dist/{ci-setup-C6FlOfW5.mjs → ci-setup-qz4Y3v7T.mjs}

@@ -1,5 +1,5 @@
 import { n as log, o as __toESM, r as require_picocolors } from "./logger-C2dEe5Su.mjs";
-import { t as detectPackageManager } from "./package-manager-DcI5TdDE.mjs";
+import { t as detectPackageManager } from "./package-manager-VCe10bjc.mjs";
 import { o as tryRunArgs } from "./shell-Dj7JRD_q.mjs";
 import { a as fe, c as ot, i as _t, n as O, o as gt, r as Ot, s as mt, t as unwrap, u as wt } from "./clack-CDRCHrC-.mjs";
 //#region src/commands/ci-setup.ts