@williamthorsen/release-kit 10.9.0 → 11.0.0

package/.meta/changelog.json

@@ -1,4 +1,61 @@
 [
+  {
+    "version": "11.0.0",
+    "date": "2026-09-22",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Return the provenance check's remediation as the outcome's fix (#855)",
+            "body": "- Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.\n- Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.\n\nMigration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.",
+            "breaking": true,
+            "migration": "Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.",
+            "hash": "2455edc46611a47e95707f79cdebda539a844431"
+          },
+          {
+            "description": "Accept a --config argument on every config-reading subcommand (#857)",
+            "body": "- Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.\n- Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.\n- Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.",
+            "hash": "f605a6fd7e48b27b17fb90bad161f4507979e5aa"
+          },
+          {
+            "description": "Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)",
+            "body": "- 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.\n- Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.\n- Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.\n- Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.\n- Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.\n\nMigration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.",
+            "breaking": true,
+            "migration": "Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.",
+            "hash": "b1126866159402b8f027a9b82f2a19591a6e9e1b"
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Truncate release-kit commit subjects by display column (#840)",
+            "body": "- Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.\n- Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.\n- Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.",
+            "hash": "f75d9b4abd9fbda264d5dd40ca5b7abb64f5a3f3"
+          },
+          {
+            "description": "Abort show-tag-prefixes on an unusable config (#861)",
+            "body": "- Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.",
+            "hash": "2177873d9a79247385e5a1f09e95971449488d9f"
+          },
+          {
+            "description": "Abort every config-reading command on an unusable default config (#869)",
+            "body": "- Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.\n- Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.",
+            "hash": "5b2873f2b9b7e42f1011d90506ca7ea6945d09a1"
+          },
+          {
+            "description": "Strip trailing Change trailers from changelog item bodies (#870)",
+            "body": "- Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.",
+            "hash": "250e52b3a2947202e3a7246fb39ebcb79e2bd1fc"
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "10.9.0",
     "date": "2026-09-18",

package/.readyup/kits/default.js

@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "10.9.0" };
+  const picked = { "version": "11.0.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }

package/.readyup/kits/npm-auto-publish.js

@@ -94,6 +94,9 @@ var packagesChecklist = defineRdyChecklist({
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
+  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. An older
+  // runner drops that `fix` silently, so failing to load the kit is the lesser harm.
+  minReadyupVersion: "0.37.0",
   checklists: [repoChecklist, packagesChecklist]
 });
 function belongsInPackagesChecklist(workspace) {
@@ -107,8 +110,8 @@ function buildSessionCheck() {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
     },
-    // A plain string rather than a getter, because readyup takes outcome-specific wording in `detail`, which the
-    // check above already carries.
+    // A plain string rather than a getter, because the remediation is the same however the session fails; only
+    // the `detail` above varies.
     fix: 'Restore a usable npm session: log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
   };
 }
@@ -175,29 +178,13 @@ function buildWorkspaceCheck(workspace) {
 function checkProvenanceMatchesVisibility() {
   const workflowPath = ".github/workflows/publish.yaml";
   const content = readFile(workflowPath);
-  if (content === void 0) {
-    return { ok: false, detail: `Cannot read ${workflowPath} \u2014 check file permissions` };
-  }
-  const hasProvenance = parseProvenanceSetting(content);
-  let isPrivate;
+  let visibility;
   try {
-    isPrivate = isRepoPrivate();
+    visibility = isRepoPrivate() ? "private" : "public";
   } catch {
-    return { ok: false, detail: "Install and authenticate the GitHub CLI: gh auth login" };
-  }
-  if (!isPrivate && !hasProvenance) {
-    return {
-      ok: false,
-      detail: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
-    };
-  }
-  if (isPrivate && hasProvenance) {
-    return {
-      ok: false,
-      detail: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
-    };
+    visibility = "unknown";
   }
-  return { ok: true };
+  return classifyProvenanceSetting(content, visibility);
 }
 function checkTrustedPublisher(packageName) {
   const result = getTrustQueryResult(packageName);
@@ -226,6 +213,38 @@ function classifyNpmAuth(result) {
   }
   return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
 }
+function classifyProvenanceSetting(workflowContent, visibility) {
+  if (workflowContent === void 0) {
+    return {
+      ok: false,
+      detail: "Cannot read .github/workflows/publish.yaml",
+      fix: "Check the file's permissions"
+    };
+  }
+  if (visibility === "unknown") {
+    return {
+      ok: false,
+      detail: "The GitHub CLI could not report the repo's visibility",
+      fix: "Install and authenticate the GitHub CLI: gh auth login"
+    };
+  }
+  const hasProvenance = parseProvenanceSetting(workflowContent);
+  if (visibility === "public" && !hasProvenance) {
+    return {
+      ok: false,
+      detail: "The repo is public and publish.yaml does not set provenance: true",
+      fix: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
+    };
+  }
+  if (visibility === "private" && hasProvenance) {
+    return {
+      ok: false,
+      detail: "The repo is private and publish.yaml sets provenance: true",
+      fix: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
+    };
+  }
+  return { ok: true };
+}
 function classifyTrustCapability(auth, probe) {
   if (auth.status !== "authenticated") {
     return { ok: false, detail: auth.detail };
@@ -409,6 +428,7 @@ function skipIfNotPublishable(workspace) {
 export {
   buildWorkspaceCheck,
   classifyNpmAuth,
+  classifyProvenanceSetting,
   classifyTrustCapability,
   classifyTrustQuery,
   npm_auto_publish_default as default,

package/.readyup/manifest.json

@@ -13,7 +13,7 @@
           "path": "kits/default.ts"
         },
         {
-          "hash": "beeecbc7",
+          "hash": "e9aadbb2",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -46,7 +46,7 @@
       "readyupVersion": "0.38.0",
       "source": "kits/default.ts",
       "sourceHash": "a20ce64b",
-      "targetHash": "d3d5b51c"
+      "targetHash": "b3fd135a"
     },
     {
       "checklists": [
@@ -56,7 +56,7 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "4eed1e9c",
+          "hash": "c2d2d375",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         }
@@ -65,8 +65,8 @@
       "path": "kits/npm-auto-publish.js",
       "readyupVersion": "0.38.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "4eed1e9c",
-      "targetHash": "d6126351"
+      "sourceHash": "c2d2d375",
+      "targetHash": "9d2d224b"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,54 @@
 
 All notable changes to this project will be documented in this file.
 
+## 11.0.0 — 2026-09-22
+
+### 🎉 Features
+
+- 🚨 **Breaking:** Return the provenance check's remediation as the outcome's fix (#855)
+
+  - Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.
+  - Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.
+
+  Migration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.
+
+- Accept a --config argument on every config-reading subcommand (#857)
+
+  - Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.
+  - Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.
+  - Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.
+
+- 🚨 **Breaking:** Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)
+
+  - 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.
+  - Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.
+  - Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.
+  - Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.
+  - Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.
+
+  Migration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.
+
+### 🐛 Bug fixes
+
+- Truncate release-kit commit subjects by display column (#840)
+
+  - Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.
+  - Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.
+  - Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.
+
+- Abort show-tag-prefixes on an unusable config (#861)
+
+  - Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.
+
+- Abort every config-reading command on an unusable default config (#869)
+
+  - Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.
+  - Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.
+
+- Strip trailing Change trailers from changelog item bodies (#870)
+
+  - Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.
+
 ## 10.9.0 — 2026-09-18
 
 ### 🎉 Features

package/README.md

@@ -7,36 +7,53 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from `git-cliff --context` output rendered in-process (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v10.9.0 (2026-09-18)
+## Release notes — v11.0.0 (2026-09-22)
 
 ### 🎉 Features
 
-- Give release-kit plain output in pipes and CI logs (#835)
+- 🚨 **Breaking:** Return the provenance check's remediation as the outcome's fix (#855)
 
-  - Adds the `RELEASE_KIT_OUTPUT_STYLE` environment variable, which accepts `auto`, `plain`, or `rich` and outranks the detection from `CI`, the stream's terminal state, and `TERM`; any other value is a usage error that exits with code 1.
-  - Changes the emoji in rich output so that none has a different meaning from the one that it has in `nmr`: warnings from ⚠️ to 🟠, skips from ⏭️ to ⏩, the errors of `show-tag-prefixes` from ⛔ to ❌, and the tag marker from 🏷️ to 🔖.
-  - Adds a required `style` parameter to `formatValidateOverridesResult`, which the package root exports.
+  - Moves the remediation of the `npm-auto-publish` kit's `Provenance setting matches repo visibility` check from the failing outcome's `detail` into its `fix`, so that readyup marks it as a remedy, lists it in the `Fixes` recap, and reports it under `rdy run --json --detail summary` instead of printing it as a plain reason line.
+  - Declares `minReadyupVersion: '0.37.0'` on the kit, the readyup release that introduced `CheckOutcome.fix`, which retires the kit's `version-skew` advisory and makes an older runner fail to load the kit.
 
-- Give nmr plain output in pipes and CI logs (#838)
+  Migration: Upgrade readyup to 0.37.0 or later before consuming this release of the `npm-auto-publish` kit.
 
-  - Stops `nmr` from printing emoji to a pipe or a CI log: When the output stream is not a terminal or `CI` is set, a verdict reads `PASS`, `FAIL`, `SKIP`, or `NOOP` and a command icon is omitted, so that a log can be searched for a verdict.
-  - Adds `--output-style <auto|plain|rich>` to `nmr` and the `NMR_OUTPUT_STYLE` variable, each forcing either style; the flag outranks the variable, a value that names no style exits 1 with a usage error, and neither enters a check-cache key: A rich run and a plain run share a recorded pass.
-  - Replaces several rich glyphs, taking the status markers from the set that release-kit and v11y-check print so that one status has one glyph across the three tools: a recalled pass shows ⏩ in place of ⏭️, a skipped empty override shows ⚪ in place of ⛔, a warning and the `--log` refusal show 🟠 in place of ⚠️ and 📭, the `--log` header shows 💾 in place of 📼, and `nmr-ensure-prepublish-hooks` reports ✅ and ❌ in place of ✓ and ✗.
+- Accept a --config argument on every config-reading subcommand (#857)
+
+  - Adds `--config <path>` to `prepare`, `publish`, `create-github-release`, `show-tag-prefixes`, `overrides validate`, `sync-labels init`, and `sync-labels generate`, each of which then reads the named file in place of `.config/release-kit.config.ts`.
+  - Requires a named `--config` file to exist, failing if it does not; an absent default path continues to mean that the repo declares no config.
+  - Confines scaffolding to the default path: `release-kit init` and `sync-labels init` still write `.config/release-kit.config.ts`, and `sync-labels init --config` reads the named file and fails when it is absent.
+
+- 🚨 **Breaking:** Adopt the shared workspace resolver in release-kit, honoring exclusions (#865)
+
+  - 🚨 **Breaking:** Narrows `no-pattern` in `@williamthorsen/nmr-core`'s `EmptyWorkspaceCause`, moving an absent or empty `packages` list onto `no-packages-list` and a value that is not a list of strings onto `unreadable-packages`.
+  - Stops `release-kit` from tagging, publishing, and label-syncing a package that a `!` entry in `pnpm-workspace.yaml` excludes, which its previous `glob`-based resolution could not remove from the match.
+  - Replaces the release of the root package alone with a failure naming the condition that emptied the workspace, when `pnpm-workspace.yaml` does not hold valid YAML or declares a workspace that does not resolve to a package.
+  - Replaces the `no-pattern` remedy that `nmr` printed for a `pnpm-workspace.yaml` declaring no `packages` list, and for one declaring a `packages` value that is not a list of strings.
+  - Raises `engines.node` to `>=24.16.0` in `@williamthorsen/nmr-core` and `@williamthorsen/release-kit`, because Node 24.0 through 24.15 ignores the `followSymlinks` option that the workspace matcher passes to `globSync` and drops a symlinked package directory from the resolution without reporting it.
+
+  Migration: Add a `no-packages-list` arm and an `unreadable-packages` arm to any `switch` that covers `EmptyWorkspaceCause` exhaustively. `no-pattern` now names only a list that the resolver read in full and whose entries all failed to become a positive pattern, so move the handling of an absent `packages` key, an empty list, and a value that is not a list of strings out of the `no-pattern` arm into the two new ones. Route `no-packages-list` to single-package behavior rather than to a failure path: pnpm resolves such a manifest to the root package alone.
 
 ### 🐛 Bug fixes
 
-- Move work-types check and sync from the CLI into maintainer scripts (#820)
+- Truncate release-kit commit subjects by display column (#840)
 
-  - Removes the `release-kit work-types` command, whose `sync` rewrote an unused copy of `work-types.json` inside `node_modules` and whose `check` reported drift that a consumer could not fix.
+  - Fixes the issue that the `release-kit` prepare report cut a commit subject at 69 UTF-16 code units instead of at display columns, so a subject of CJK characters printed about twice the intended 72-column width and a cut inside an emoji left a broken character that a terminal drew as a replacement glyph.
+  - Replaces the `...` marker on a truncated subject with `…`, the default of the width-aware truncation that now does the cutting.
+  - Exports `truncateToWidth` and `measureWidth` from `@williamthorsen/nmr-core`, which measure and cut text by display width without splitting a grapheme cluster.
 
-- Exclude distributed agent guidance from ai and documentation labels (#825)
+- Abort show-tag-prefixes on an unusable config (#861)
 
-  - Marks a `.github/labels.yaml` generated from the previous `common` preset as stale in the default readyup kit, whose "labels.yaml has current common preset" check reports the file until the repo regenerates it.
+  - Fixes the issue that `release-kit show-tag-prefixes` silently ignored a config file that failed schema validation, which left the preview reading no `legacyIdentities` and no `retiredPackages` and reporting already-declared and retired tag prefixes as undeclared candidates; the command now prints those validation errors and exits 1 with no preview.
 
-- Suppress bold and dim escapes for a stream that cannot render them (#830)
+- Abort every config-reading command on an unusable default config (#869)
 
-  - Stops `release-kit prepare` from writing raw escape bytes into piped output, redirected files, and CI logs: It styled bold and dim unconditionally, without checking whether the destination renders escapes.
-  - Honors `NO_COLOR`, `NODE_DISABLE_COLORS`, and `FORCE_COLOR`, which the previous styling ignored.
+  - Fixes `publish` proceeding on derived defaults when the default config file exists and fails to load, which silently dropped a configured `releaseNotes.shouldInjectIntoReadme`, `changelogJson.outputPath`, or `workTypes`; it now reports the failure and exits 1, as every other config-reading subcommand does.
+  - Fixes `publish` and `create-github-release` ignoring a broken or invalid default config when every requested tag names a private package, a case in which both commands return before any loader runs.
+
+- Strip trailing Change trailers from changelog item bodies (#870)
+
+  - Fixes a changelog item body that kept a commit's trailing `Change:` trailers, which then appeared verbatim in the rendered release notes, including the notes injected into a README.
 <!-- /section:release-notes -->
 
 ## Installation
@@ -89,8 +106,8 @@ The CLI applies defaults to every discovered workspace and uses the bundled `cli
 
 ## How it works
 
-1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` globs to find workspace directories. Each directory containing a `package.json` becomes a workspace. If no workspace file is found, the repo is treated as a single-package project.
-2. **Config loading**: loads `.config/release-kit.config.ts` (if present) and merges it with discovered defaults.
+1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` patterns to find workspace directories, applying pnpm's semantics — a `!`-prefixed entry excludes what it matches, wherever it appears in the list. Each directory containing a `package.json` becomes a workspace. The repo is treated as a single-package project when it holds no workspace file, and when the workspace file declares no `packages` list — a file kept for `catalog:` or `overrides:` alone, which pnpm likewise resolves to the root package. A workspace file that declares patterns resolving to no package is an error naming the condition that emptied it.
+2. **Config loading**: loads `.config/release-kit.config.ts` (if present), or the file named by `--config`, and merges it with discovered defaults.
 3. **Commit analysis**: for each workspace, finds commits since the last version tag, parses them for type and scope, and determines the appropriate version bump.
 4. **Version bump + changelog**: bumps `package.json` versions, builds structured `ChangelogEntry[]` from `git-cliff --context`, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source. `git-cliff` is invoked only for its `--context` JSON; markdown rendering happens in-process so `.meta/changelog.json` and `CHANGELOG.md` always agree.
 5. **Release tags file**: writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
@@ -118,6 +135,8 @@ The `scope|type:` format scopes a commit to a specific workspace in a monorepo.
 
 Configuration is optional. The CLI works out of the box by auto-discovering workspaces and applying defaults. Create `.config/release-kit.config.ts` only when you need to customize behavior.
 
+Every subcommand that reads a config accepts `--config <path>` to read a file elsewhere. An absent default path means "no config"; an absent `--config` path fails the command. See [Config file location](docs/configuration.md#config-file-location).
+
 ```typescript
 import { defineConfig } from '@williamthorsen/release-kit/config';
 

package/dist/esm/bin/release-kit.js

@@ -2,6 +2,7 @@
 import { parseArgsOrExit, readPackageVersion, reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { commitCommand } from "../commitCommand.js";
+import { configFlagSchema } from "../configFlagSchema.js";
 import { createGithubReleaseCommand } from "../createGithubReleaseCommand.js";
 import { showPrepareHelp } from "../help/prepareHelp.js";
 import { initCommand } from "../init/initCommand.js";
@@ -68,9 +69,10 @@ retired packages, then generate .github/labels.yaml. When the config file alread
 exists, print the block for manual paste instead of rewriting the file.
 
 Options:
-  --dry-run     Preview changes without writing files
-  --force       Overwrite existing files instead of skipping them
-  --help, -h    Show this help message
+  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --dry-run        Preview changes without writing files
+  --force          Overwrite existing files instead of skipping them
+  --help, -h       Show this help message
 `);
 }
 function showSyncLabelsGenerateHelp() {
@@ -80,8 +82,9 @@ Usage: release-kit sync-labels generate [options]
 Regenerate .github/labels.yaml from the repoLabels block of .config/release-kit.config.ts.
 
 Options:
-  --check       Report whether .github/labels.yaml is stale instead of writing it
-  --help, -h    Show this help message
+  --check          Report whether .github/labels.yaml is stale instead of writing it
+  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --help, -h       Show this help message
 `);
 }
 function showSyncLabelsSyncHelp() {
@@ -154,6 +157,7 @@ Create GitHub Releases from changelog.json for tags on HEAD. Private
 (package.json#private) workspaces are skipped with a warning and get no Release.
 
 Options:
+  --config <path>        Path to config file (default: .config/release-kit.config.ts)
   --dry-run              Preview without creating releases
   --tags=tag1,tag2       Only create releases for the named tags (comma-separated, full tag names)
   --help, -h             Show this help message
@@ -169,7 +173,8 @@ derived prefix nor declared in \`legacyIdentities\`, with a copy-pasteable
 config snippet.
 
 Options:
-  --help, -h    Show this help message
+  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --help, -h       Show this help message
 `);
 }
 function showOverridesHelp() {
@@ -198,7 +203,8 @@ Exit codes:
   2    Schema/parse or ambiguous-prefix errors (errors dominate)
 
 Options:
-  --help, -h    Show this help message
+  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --help, -h       Show this help message
 `);
 }
 function showPublishHelp() {
@@ -211,6 +217,7 @@ silently filtered out. With --tags, an unpublishable tag is skipped with a warni
 any publishable tags still publish.
 
 Options:
+  --config <path>        Path to config file (default: .config/release-kit.config.ts)
   --dry-run              Preview without publishing
   --no-git-checks        Skip the clean-working-tree check
   --tags=tag1,tag2       Only publish the named tags (comma-separated, full tag names)
@@ -269,7 +276,7 @@ if (command === 'push') {
         showPushHelp();
         process.exit(0);
     }
-    await pushCommand(flags);
+    pushCommand(flags);
     process.exit(0);
 }
 if (command === 'create-github-release') {
@@ -293,11 +300,8 @@ if (command === 'show-tag-prefixes') {
         showShowTagPrefixesHelp();
         process.exit(0);
     }
-    if (flags.length > 0) {
-        reportError(`Unknown option: ${flags[0]}`);
-        process.exit(1);
-    }
-    const exitCode = await showTagPrefixesCommand(styles);
+    const { config } = parseArgsOrExit(flags, configFlagSchema).flags;
+    const exitCode = await showTagPrefixesCommand(styles, config);
     process.exit(exitCode);
 }
 if (command === 'init') {
@@ -327,11 +331,17 @@ if (command === 'sync-labels') {
             process.exit(0);
         }
         const syncLabelsInitFlagSchema = {
+            ...configFlagSchema,
             dryRun: { long: '--dry-run', type: 'boolean' },
             force: { long: '--force', type: 'boolean' },
         };
-        const { dryRun, force } = parseArgsOrExit(subflags, syncLabelsInitFlagSchema).flags;
-        const exitCode = await syncLabelsInitCommand({ dryRun, force, styles });
+        const { config, dryRun, force } = parseArgsOrExit(subflags, syncLabelsInitFlagSchema).flags;
+        const exitCode = await syncLabelsInitCommand({
+            ...(config !== undefined && { configPath: config }),
+            dryRun,
+            force,
+            styles,
+        });
         process.exit(exitCode);
     }
     if (subcommand === 'generate') {
@@ -340,10 +350,11 @@ if (command === 'sync-labels') {
             process.exit(0);
         }
         const generateFlagSchema = {
+            ...configFlagSchema,
             check: { long: '--check', type: 'boolean' },
         };
-        const { check } = parseArgsOrExit(subflags, generateFlagSchema).flags;
-        const exitCode = await generateCommand({ check, styles });
+        const { check, config } = parseArgsOrExit(subflags, generateFlagSchema).flags;
+        const exitCode = await generateCommand({ check, ...(config !== undefined && { configPath: config }), styles });
         process.exit(exitCode);
     }
     if (subcommand === 'sync') {
@@ -374,11 +385,8 @@ if (command === 'overrides') {
             showOverridesValidateHelp();
             process.exit(0);
         }
-        if (subflags.length > 0) {
-            reportError(`Unknown option: ${subflags[0]}`);
-            process.exit(1);
-        }
-        const result = await validateOverridesCommand(styles);
+        const { config } = parseArgsOrExit(subflags, configFlagSchema).flags;
+        const result = await validateOverridesCommand(styles, config);
         if (result.exitCode === 0) {
             console.info(result.message);
         }

package/dist/esm/buildChangelogEntries.js

@@ -158,6 +158,7 @@ function extractDescription(message) {
     return firstLine;
 }
 const TRAILER_PATTERNS = [
+    /^Change:/i,
     /^Signed-off-by:/i,
     /^Co-authored-by:/i,
     /^(Closes|Fixes|Resolves)\s+#\d+\s*$/i,

package/dist/esm/configFlagSchema.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The `--config` flag, shared by every subcommand that reads the config file.
+ *
+ * Spread into a subcommand's own schema rather than repeated, so that seven subcommands cannot drift to seven
+ * spellings of one flag.
+ */
+export declare const configFlagSchema: {
+    config: {
+        long: string;
+        type: "string";
+    };
+};

package/dist/esm/configFlagSchema.js

@@ -0,0 +1,3 @@
+export const configFlagSchema = {
+    config: { long: '--config', type: 'string' },
+};

package/dist/esm/createGithubReleaseCommand.js

@@ -1,19 +1,23 @@
 import { parseArgsOrExit, reportError } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
+import { configFlagSchema } from "./configFlagSchema.js";
 import { createGithubReleases } from "./createGithubRelease.js";
 import { formatPrivateSkip } from "./formatPrivateSkip.js";
+import { assertConfigUsable } from "./loadValidatedConfig.js";
 import { parseRequestedTags } from "./parseRequestedTags.js";
 import { resolveCommandTags } from "./resolveCommandTags.js";
 import { resolveReleaseNotesConfig } from "./resolveReleaseNotesConfig.js";
 const createGithubReleaseFlagSchema = {
+    ...configFlagSchema,
     dryRun: { long: '--dry-run', type: 'boolean' },
     tags: { long: '--tags', type: 'string' },
 };
 export async function createGithubReleaseCommand(argv, styles) {
     const parsed = parseArgsOrExit(argv, createGithubReleaseFlagSchema);
     const { dryRun } = parsed.flags;
+    await assertConfigUsable(styles.stderr, parsed.flags.config);
     const requestedTags = parseRequestedTags(parsed.flags.tags);
-    const resolvedTags = await resolveCommandTags(requestedTags);
+    const resolvedTags = resolveCommandTags(requestedTags);
     const publishableTags = resolvedTags.filter((resolvedTag) => resolvedTag.isPublishable);
     for (const resolvedTag of resolvedTags) {
         if (!resolvedTag.isPublishable) {
@@ -24,7 +28,7 @@ export async function createGithubReleaseCommand(argv, styles) {
         return;
     }
     const { changelogJsonOutputPath, sectionOrder } = await resolveReleaseNotesConfig(styles.stderr, {
-        strictLoad: true,
+        ...(parsed.flags.config !== undefined && { configPath: parsed.flags.config }),
     });
     let outcome;
     try {