@williamthorsen/release-kit 12.0.0 → 13.0.0

package/README.md

@@ -7,39 +7,42 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v12.0.0 (2026-09-23)
+## Release notes — v13.0.0 (2026-10-01)
 
 ### 🎉 Features
 
-- Assign changelog sections from the work-type taxonomy (#877)
-
-  - Adds `excludedFromChangelog` to a `workTypes` entry, which keeps commits of that type out of every changelog while they still count toward the version bump.
-  - Fixes the silent omission of a ticketed commit written as `type(scope):` or with a capitalized type such as `FEAT:`, which counted toward the version bump but reached no changelog.
-  - Documents that a scaffolded `.config/git-cliff.toml` may vary its enumeration keys alone: a `commit_parsers` entry that skips or narrows drops the commit before classification, with no error.
-
-- Build changelog items from a merge commit's change-record block (#882)
-
-  Builds `release-kit` changelog items from a commit's `change-record` block, the fenced YAML block at the end of a squash-merge commit that lists the change's outcomes, so that a merge with several outcomes of different types yields one item per outcome, each under its own type's section. Makes `release-kit prepare` warn about a block that cannot be read, an entry whose type is undeclared, and an entry that violates its type's breaking policy. Keeps reading a commit with no usable block from its title, as before.
-
-- 🚨 **Breaking:** Derive the version bump from the changelog items (#885)
-
-  Derives the version bump in every `release-kit prepare` path (single-package, project, and monorepo) from the changelog items of the unreleased commits, so that the bump and the changelog describe the same release. A commit that yields no changelog item no longer bumps, and a `BREAKING CHANGE:` footer no longer raises a major bump. Single-package mode now follows the monorepo rules for `--bump` and `--force`, and the `prepare` report shows the diagnostics of a skipped target.
-
-  Migration: Mark a breaking change with a `!` on the commit subject or with `breaking: true` on its change-record entry, because a `BREAKING CHANGE:` footer alone now gets the bump of the commit's type. Give each commit that should bump a ticket-ID prefix and a type that the changelog does not exclude. In single-package mode, add `--force` to a release that used `--bump=X` alone, or that relied on the patch floor, when no commit yields a changelog item; without it, `prepare` skips the release.
-
-- 🚨 **Breaking:** Key an editorial override to one of several items on a commit (#886)
-
-  Adds the `<hash>:<n>` key to `.meta/changelog-overrides.json`. It targets one of the several changelog items that a commit's change-record block yields, while a bare `<hash>` key still targets all of them. Also makes `release-kit prepare` and `release-kit overrides validate` fail when override keys conflict on an item, and publishes a JSON Schema for the override file.
-
-  Migration: Replace a bare key that sets `description` or `body` on a commit with several items with one `<hash>:<n>` key per item, as listed by the error message. Where two keys match the same item, such as `abc1234` beside `abc1234:2`, remove one of them. This includes a root-file key that overlaps a workspace-file key, which now fails even though the two files are separate. In each scope passed to `validateAllChangelogOverrides`, rename `hashes` to `items` and pass `OverrideTargetItem` objects (`{ hash, entry? }`) instead of hash strings.
+- Adds the `--config <path>` flag to `release-kit push`, which now reads the config as `publish` and `create-github-release` do and fails when the file exists but is invalid. (#895)
+- Makes `release-kit` add an item derived from a change-record entry to a workspace's changelog and version bump only when the entry's `scopes`, after `scopeAliases` resolution, name the workspace's `dir`, are empty, or contain `*`, and extends that rule to the sections of earlier releases that `release-kit prepare` rebuilds. (#896)
+- Adds a warning to the `release-kit prepare` report that lists each change-record entry scope matching no workspace in its commit's window, such as a misspelled scope or the old name of a renamed directory that has no `scopeAliases` entry. (#896)
+- Makes `release-kit overrides validate` check a workspace's overrides against only the entries routed to that workspace, so that an override keyed to an entry routed elsewhere is reported as stale. (#896)
+- Adds `release-kit update-templates`, which writes each scaffolded workflow that is missing or differs from the installed template, prints a diff of each updated file, refreshes `sync-labels.yaml` only when it exists, keeps `publish.yaml`'s provenance setting, and never reads or writes the config files. (#952)
+- Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)
 
 ### 🪦 Removed
 
-- 🚨 **Breaking:** Build changelogs from release-kit's own enumeration and remove git-cliff (#880)
-
-  Removes git-cliff from `@williamthorsen/release-kit`: `prepare` now builds every changelog from the same commit history that decides each version bump, and no longer fetches a git-cliff binary through `npx`. A config that still sets `cliffConfigPath` now fails validation. Two ways in which the changelog and the bump read different commits are gone, affecting single-package repositories with a tag prefix other than `v` and `paths` entries that name a bare directory.
-
-  Migration: Remove `cliffConfigPath` from `.config/release-kit.config.ts`, and delete `.config/git-cliff.toml` or `cliff.toml` if the repository has one. Any customization in that file, such as `tag_pattern` or its tag-skipping keys, no longer has an effect: `release-kit` now splits the changelog on the configured tag prefixes alone.
+- 🚨 **Breaking:** Removes `required` as a `breakingPolicies` value, making `drop` default to `optional` so that an unmarked `drop:` commit no longer reports a policy violation. (#905)
+- Stops `release-kit` from parsing a commit subject that combines a pipe scope with a parenthesized scope, such as `web|feat(other): ...`, or that lacks a space and a title after the colon, because subjects are now read through `@williamthorsen/change-grammar`. (#905)
+- Stops publishing `schemas/label-map.json` from `release-kit`, whose identical schema `@williamthorsen/change-grammar` now publishes; URLs under existing `release-kit-v*` tags keep resolving. (#905)
+
+### 🐛 Bug fixes
+
+- Record a changelog entry for a forced release whose commits yield no item (#887)
+
+  Makes `release-kit prepare` record the "Forced version bump." changelog entry for any release forced by `--force` or `--set-version` whose commits yield no changelog item, instead of only for a release with no commits at all. It also stops a monorepo's project release from dropping the forced-release entries that earlier releases recorded.
+
+- Stops `release-kit prepare` from reporting `commitCount` 0 and dropping the unparseable commits and change-record and policy diagnostics of a workspace released only because a dependency was bumped, and makes `prepare` list that workspace's commits in the release commit summary under its tag. (#888)
+- Stops `release-kit prepare` from labeling a direct release that has no commits as bumped via a dependency, by marking a propagation-only release with the new `propagatedOnly` result field, whose report line now reads `Bumped via dependency: …` in place of `0 commits (bumped via dependency: …)`. (#888)
+- Stops a `release-kit` command run from inside a package from releasing that package as a single-package repo with its own tag and changelog, by running every command from the repo root: the nearest directory that contains `pnpm-workspace.yaml`, or else the working directory when it contains a `package.json`. (#893)
+- Stops `sync-labels generate` from writing the `--config` path into the `.github/labels.yaml` header as typed, which made the header and the result of `generate --check` depend on the directory from which the command ran; the header now names the config by its path relative to the repo root. (#893)
+- Stops `push`, `publish`, and `create-github-release` from pushing, publishing, or creating a GitHub Release for a tag on HEAD whose workspace the config excludes with `shouldExclude: true`, which each command now skips with a warning, including when `--tags` names the tag or when every tag on HEAD is excluded. (#895)
+- Stops `release-kit prepare` from silently deleting a `CHANGELOG.md` section whose version is absent from both the release windows and `changelog.json`, such as history written by hand before release-kit was adopted; `prepare` now keeps that section verbatim in version order, lists the kept versions in its report, and warns about each `##` section that names no version and is dropped. (#897)
+- Stops `release-kit prepare` from folding every earlier commit into the new version, and deriving the bump from all of them, when the current version was released and recorded in the changelog but never tagged; `prepare` now fails before any write, under `--force` and `--set-version` too, and names each target and the tag to create. (#897)
+- Adds the missing `removal` and `formatting` labels to the `common` preset by defining a label for every work type in change-grammar's taxonomy, and keeps the names, colors, and descriptions of the existing type labels. (#906)
+- Fixes the `release.yaml` generated by `release-kit init`, which `actionlint` rejected because its `bump` choice input listed an empty string as the auto-detect option, by offering `auto` as the default option and passing it to the reusable release workflow as an empty `bump`. (#936)
+- Rewords the error messages, `prepare` report lines, command help, and readyup kit fix strings of `release-kit` that addressed the reader as "your", separated a detail from its subject with an em-dash, or stated an absence with "no", such as "No workspaces had release-worthy changes." (#937)
+- Fixes the issue that the `release.yaml` and `sync-labels.yaml` workflows generated by `release-kit init` and `release-kit sync-labels init` contained unclear wording in two comments and in the `force` input description, which the change rewrites without altering any job, trigger, or input; the release-kit kit check reports a copy generated before this change as stale until `release-kit init --force` or `release-kit sync-labels init --force` regenerates it. (#946)
+- Fixes the issue that `release-kit` titled a propagation-only bump's changelog section `Dependency updates` rather than with the resolved `deps` work type's header, `📦 Dependencies` by default or a consumer's `workTypes.deps.header` override, which broke the heading convention and left the section outside the section order. (#950)
+- Fixes the issue that `release-kit init`'s next steps told a public repo to set `provenance: true` in `publish.yaml`, which the template already sets, and now tells a private repo to remove it instead. (#952)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -63,7 +66,7 @@ npx @williamthorsen/release-kit prepare --dry-run
 Example output from `prepare --dry-run` in a monorepo whose `arrays` workspace has two commits since its last release:
 
 ```
-🔍 DRY RUN — no files will be modified
+🔍 DRY RUN: release-kit will not modify any files
 
 ━━━ arrays ━━━
   Found 2 commits since arrays-v1.2.0
@@ -88,17 +91,21 @@ gh workflow run release.yaml                  # every workspace with release-wor
 gh workflow run release.yaml -f only=arrays   # the named workspaces alone
 ```
 
+After upgrading release-kit, run `release-kit update-templates` to update the scaffolded workflows to its templates; it leaves the config files alone.
+
 The CLI applies defaults to every discovered workspace. [Releasing](docs/releasing.md) covers `prepare`'s flags, release-notes previews, and the workflow's inputs.
 
 ## How it works
 
-1. **Workspace discovery**: reads `pnpm-workspace.yaml` and resolves its `packages` patterns to find workspace directories, applying pnpm's semantics — a `!`-prefixed entry excludes what it matches, wherever it appears in the list. Each directory containing a `package.json` becomes a workspace. The repo is treated as a single-package project when it holds no workspace file, and when the workspace file declares no `packages` list — a file kept for `catalog:` or `overrides:` alone, which pnpm likewise resolves to the root package. A workspace file that declares patterns resolving to no package is an error naming the condition that emptied it.
-2. **Config loading**: loads `.config/release-kit.config.ts` (if present), or the file named by `--config`, and merges it with discovered defaults.
-3. **Commit analysis**: for each workspace, reads the history once, builds the changelog items of the commits since the last version tag, and takes the bump as the highest level that those items call for.
-4. **Version bump + changelog**: bumps `package.json` versions, builds structured `ChangelogEntry[]` from the commits between each pair of release tags, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source, so the two always agree.
-5. **Release tags file**: writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
+Every command other than `--version` and `--help` first locates the repo root and runs from it, so it can be invoked from any directory in the repo. The root is the nearest directory at or above the invocation directory that contains `pnpm-workspace.yaml`, or else the invocation directory itself when it contains a `package.json`; when neither exists, the command fails. Because a `pnpm-workspace.yaml` takes precedence wherever it is, as it does for pnpm, a single-package repo checked out below a pnpm workspace resolves to that outer workspace.
+
+1. **Workspace discovery**: Reads `pnpm-workspace.yaml` and resolves its `packages` patterns to find workspace directories, applying pnpm's semantics: A `!`-prefixed entry excludes what it matches, wherever it appears in the list. Each directory containing a `package.json` becomes a workspace. The repo is treated as a single-package project when it doesn't contain a workspace file, and when the workspace file doesn't declare a `packages` list: a file kept for `catalog:` or `overrides:` alone, which pnpm likewise resolves to the root package. A workspace file that declares patterns that don't resolve to any package is an error naming the condition that emptied it.
+2. **Config loading**: Loads `.config/release-kit.config.ts` (if present) from the repo root, or the file named by `--config` relative to the invocation directory, and merges it with discovered defaults.
+3. **Commit analysis**: For each workspace, reads the history once, builds the changelog items of the commits since the last version tag, and takes the bump as the highest level that those items call for.
+4. **Version bump + changelog**: Bumps `package.json` versions, builds structured `ChangelogEntry[]` from the commits between each pair of release tags, applies any [editorial overrides](docs/editorial-overrides.md) from per-scope `.meta/changelog-overrides.json` files, and renders both `CHANGELOG.md` and `.meta/changelog.json` from that single source, so the two always agree.
+5. **Release tags file**: Writes computed tags to `tmp/.release-tags` for the release workflow to read when tagging and pushing.
 
-[Changelogs](docs/changelogs.md) covers what reaches a published tarball, the `changelog.json` item schema, and which commits reach a changelog.
+[Changelogs](docs/changelogs.md) covers what a published tarball includes, the `changelog.json` item schema, and which commits appear in a changelog.
 
 ## Commit format
 
@@ -113,15 +120,15 @@ scope|type!: description       # scoped breaking change
 type(scope)!: description      # conventional scoped breaking change
 ```
 
-The `scope|type:` format scopes a commit to a specific workspace in a monorepo. Use `scopeAliases` in your config to map shorthand names to canonical scope names.
+The `scope|type:` format scopes a commit to a specific workspace in a monorepo. Use `scopeAliases` in the config to map shorthand names to canonical scope names.
 
 [Work types and tiers](docs/work-types.md) lists the recognized types and how each one affects the bump and the changelog.
 
 ## Configuration
 
-Configuration is optional. The CLI works out of the box by auto-discovering workspaces and applying defaults. Create `.config/release-kit.config.ts` only when you need to customize behavior.
+Configuration is optional. The CLI works out of the box by auto-discovering workspaces and applying defaults. Create `.config/release-kit.config.ts` only to customize behavior.
 
-Every subcommand that reads a config accepts `--config <path>` to read a file elsewhere. An absent default path means "no config"; an absent `--config` path fails the command. See [Config file location](docs/configuration.md#config-file-location).
+Every subcommand that reads a config accepts `--config <path>` to read a file elsewhere. An absent default path means that the repo doesn't declare a config; an absent `--config` path fails the command. See [Config file location](docs/configuration.md#config-file-location).
 
 ```typescript
 import { defineConfig } from '@williamthorsen/release-kit/config';
@@ -141,9 +148,9 @@ export default defineConfig({
 });
 ```
 
-`defineConfig` is a type-safe identity function: it gives the config object validation and completion in `.ts` files and full inference in `.js` ones. The loader also accepts a plain `export default config` or `export const config = { ... }`.
+`defineConfig` is a type-safe identity function: It gives the config object validation and completion in `.ts` files and full inference in `.js` ones. The loader also accepts a plain `export default config` or `export const config = { ... }`.
 
-Node loads the file directly, so a relative import inside it needs an explicit file extension — `./work-types.ts`, not `./work-types`.
+Node loads the file directly, so a relative import inside it needs an explicit file extension: `./work-types.ts`, not `./work-types`.
 
 [Configuration](docs/configuration.md) lists every field and covers legacy identities, retired packages, and tag prefixes. [Project releases](docs/project-releases.md) covers releasing a monorepo as one combined deliverable.
 
@@ -168,7 +175,7 @@ export default defineRdyConfig({
 rdy run --packages
 ```
 
-`rdy run` needs `readyup` 0.23 or later, and `@williamthorsen/release-kit` as a _direct_ devDependency: a strict pnpm layout links nothing else into the project; therefore, a transitive copy is unreachable.
+`rdy run` needs `readyup` 0.23 or later, and `@williamthorsen/release-kit` as a _direct_ devDependency: A strict pnpm layout links nothing else into the project; therefore, a transitive copy is unreachable.
 
 [Readiness checks](docs/readiness-checks.md) covers running each kit alone and what `npm-auto-publish` needs from the npm session.
 
@@ -178,18 +185,18 @@ rdy run --packages
 2. Remove `@changesets/cli` from dev dependencies. The [default readyup kit](#readiness-checks) reports a repo that still declares it.
 3. Delete the `.changeset/` directory.
 4. Run `npx @williamthorsen/release-kit init` to scaffold the release workflows.
-5. Remove `changeset:*` scripts from `package.json` (no replacement needed — the CLI handles everything).
+5. Remove `changeset:*` scripts from `package.json` (they don't need a replacement, because the CLI handles everything).
 6. Create an initial version tag for each package (e.g., `git tag v1.0.0` or `git tag arrays-v1.0.0`).
 
 ## Documentation
 
 - [Configuration](docs/configuration.md): `ReleaseKitConfig` fields, workspace overrides and legacy identities, retired packages, tag prefixes, and version patterns
-- [Project releases](docs/project-releases.md): the `project` block, and how a project release interacts with `prepare`'s flags
-- [Releasing](docs/releasing.md): `init`, `prepare`'s flags and release-notes previews, and the release workflow
+- [Project releases](docs/project-releases.md): The `project` block, and how a project release interacts with `prepare`'s flags
+- [Releasing](docs/releasing.md): `init`, `update-templates`, `prepare`'s flags and release-notes previews, and the release workflow
 - [Publishing](docs/publishing.md): `publish`, the publishability filter, and `create-github-release`
-- [Changelogs](docs/changelogs.md): the `changelog.json` item schema, which commits reach a changelog, and release-notes injection
-- [Editorial overrides](docs/editorial-overrides.md): correcting generated changelog entries, and `overrides validate`
-- [Work types and tiers](docs/work-types.md): tiers, the `!` policy, markers, custom work types, and maintenance of the bundled taxonomy
-- [Labels](docs/labels.md): `sync-labels`, label configuration, the workflow's triggers, and the `label-map.json` schema
-- [Readiness checks](docs/readiness-checks.md): both readyup kits, and how to run each
+- [Changelogs](docs/changelogs.md): The `changelog.json` item schema, which commits appear in a changelog, and release-notes injection
+- [Editorial overrides](docs/editorial-overrides.md): Correcting generated changelog entries, and `overrides validate`
+- [Work types and tiers](docs/work-types.md): Tiers, the `!` policy, markers, and custom work types
+- [Labels](docs/labels.md): `sync-labels`, label configuration, the workflow's triggers, and where the `label-map.json` schema is published
+- [Readiness checks](docs/readiness-checks.md): Both readyup kits, and how to run each
 - [Programmatic API](docs/api.md): `deriveWorkspaceConfig()`, the script-based approach, and `resolveReleaseTags`

package/bin/release-kit.js

@@ -3,7 +3,7 @@ try {
   await import('../dist/esm/bin/release-kit.js');
 } catch (error) {
   if (error.code === 'ERR_MODULE_NOT_FOUND') {
-    process.stderr.write('release-kit: build output not found — run `nmr build` first\n');
+    process.stderr.write('release-kit: build output not found; run `nmr build` first\n');
   } else {
     process.stderr.write(`release-kit: failed to load: ${error.message}\n`);
   }

package/dist/esm/assertCleanWorkingTree.d.ts

@@ -1,6 +1,2 @@
-/**
- * Verify that the git working tree has no uncommitted changes.
- *
- * @throws If `git status --porcelain` reports any changes.
- */
+/** Throws if `git status --porcelain` reports any uncommitted change in the working tree. */
 export declare function assertCleanWorkingTree(): void;

package/dist/esm/assertTaggedBaseline.d.ts

@@ -0,0 +1,29 @@
+import type { ReleaseConfig } from './types.js';
+/** A release target whose history `prepare` has read, as the baseline check sees it. */
+export interface BaselineTarget {
+    /** How the error names the target, such as `workspace 'core'`. */
+    label: string;
+    packageFiles: readonly string[];
+    changelogPaths: readonly string[];
+    /** The prefixes under which the history was read; a missing tag is named under the first. */
+    tagPrefixes: readonly string[];
+    previousTag: string | undefined;
+}
+/** A target whose current version is recorded in its changelog but is not its previous reachable tag. */
+export interface UntaggedBaseline {
+    label: string;
+    version: string;
+    /** The tag to create at the commit that released `version`. */
+    tag: string;
+}
+/**
+ * Throws when any finding is an untagged baseline, naming each one's missing tag. Without that tag, the unreleased
+ * window extends back to the start of history, so the new version would include every earlier commit.
+ */
+export declare function assertTaggedBaseline(findings: ReadonlyArray<UntaggedBaseline | undefined>): void;
+/**
+ * Returns the target's untagged baseline: its current version appears in one of its `CHANGELOG.md` or
+ * `changelog.json` files, and its previous tag is not that version under any of its prefixes. A first release has
+ * none, because its changelogs do not record its version yet.
+ */
+export declare function findUntaggedBaseline(target: BaselineTarget, config: Pick<ReleaseConfig, 'changelogJson'>): UntaggedBaseline | undefined;

package/dist/esm/assertTaggedBaseline.js

@@ -0,0 +1,41 @@
+import { join } from 'node:path';
+import { resolveChangelogJsonPath } from "./changelogJsonFile.js";
+import { readChangelogEntries } from "./changelogJsonUtils.js";
+import { readCurrentVersion } from "./planVersionBump.js";
+import { readChangelogSections } from "./readChangelogSections.js";
+export function assertTaggedBaseline(findings) {
+    const untagged = findings.filter((finding) => finding !== undefined);
+    if (untagged.length === 0)
+        return;
+    const lines = untagged.map(({ label, version, tag }) => `  - ${label}: ${version} (create tag ${tag})`);
+    throw new Error([
+        'The current version is recorded in the changelog, but its tag is not the previous tag reachable from HEAD:',
+        ...lines,
+        'Tag the commit that released each version, then run prepare again.',
+    ].join('\n'));
+}
+export function findUntaggedBaseline(target, config) {
+    const recordedVersions = readRecordedVersions(target.changelogPaths, config);
+    if (recordedVersions.size === 0) {
+        return undefined;
+    }
+    const version = readCurrentVersion(target.packageFiles);
+    if (!recordedVersions.has(version)) {
+        return undefined;
+    }
+    if (target.tagPrefixes.some((prefix) => target.previousTag === `${prefix}${version}`)) {
+        return undefined;
+    }
+    return { label: target.label, version, tag: `${target.tagPrefixes[0] ?? ''}${version}` };
+}
+function readRecordedVersions(changelogPaths, config) {
+    const versions = new Set();
+    for (const changelogPath of changelogPaths) {
+        const { versioned } = readChangelogSections(join(changelogPath, 'CHANGELOG.md'));
+        const entries = readChangelogEntries(resolveChangelogJsonPath(config, changelogPath)) ?? [];
+        for (const { version } of [...versioned, ...entries]) {
+            versions.add(version);
+        }
+    }
+    return versions;
+}

package/dist/esm/attachChangelogDiagnostics.d.ts

@@ -1,4 +1,4 @@
 import type { ChangelogDiagnostics } from './buildChangelogEntries.js';
 import type { ReleasedWorkspaceResult } from './types.js';
 /** Attaches a history's diagnostics to a released or skipped result, omitting each empty list. */
-export declare function attachChangelogDiagnostics(result: Pick<ReleasedWorkspaceResult, 'malformedBlocks' | 'policyViolations' | 'undeclaredEntryTypes'>, diagnostics: ChangelogDiagnostics): void;
+export declare function attachChangelogDiagnostics(result: Pick<ReleasedWorkspaceResult, 'malformedBlocks' | 'policyViolations' | 'undeclaredEntryTypes' | 'unroutedEntryScopes'>, diagnostics: ChangelogDiagnostics): void;

package/dist/esm/attachChangelogDiagnostics.js

@@ -8,4 +8,7 @@ export function attachChangelogDiagnostics(result, diagnostics) {
     if (diagnostics.policyViolations.length > 0) {
         result.policyViolations = diagnostics.policyViolations;
     }
+    if (diagnostics.unroutedEntryScopes.length > 0) {
+        result.unroutedEntryScopes = diagnostics.unroutedEntryScopes;
+    }
 }

package/dist/esm/bin/release-kit.js

@@ -4,11 +4,14 @@ import { describeError } from '@williamthorsen/toolbelt.errors';
 import { commitCommand } from "../commitCommand.js";
 import { configFlagSchema } from "../configFlagSchema.js";
 import { createGithubReleaseCommand } from "../createGithubReleaseCommand.js";
+import { enterRepoRoot } from "../enterRepoRoot.js";
 import { showPrepareHelp } from "../help/prepareHelp.js";
 import { initCommand } from "../init/initCommand.js";
+import { updateTemplatesCommand } from "../init/updateTemplatesCommand.js";
 import { prepareCommand } from "../prepareCommand.js";
 import { publishCommand } from "../publishCommand.js";
 import { pushCommand } from "../pushCommand.js";
+import { resolveConfigFlag } from "../resolveConfigFlag.js";
 import { OUTPUT_STYLE_ENV_VAR, resolveStylesOrExit } from "../resolveStylesOrExit.js";
 import { showTagPrefixesCommand } from "../showTagPrefixesCommand.js";
 import { generateCommand } from "../sync-labels/generateCommand.js";
@@ -30,6 +33,7 @@ Commands:
   create-github-release  Create GitHub Releases from changelog.json for tags on HEAD
   show-tag-prefixes  Show derived and declared legacy tag prefixes per workspace
   init             Initialize release-kit in the current repository
+  update-templates Update the scaffolded workflows to the current templates
   overrides        Manage editorial changelog overrides
   sync-labels      Manage GitHub label synchronization
 
@@ -69,7 +73,8 @@ retired packages, then generate .github/labels.yaml. When the config file alread
 exists, print the block for manual paste instead of rewriting the file.
 
 Options:
-  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --config <path>  Config file, relative to the current directory
+                   (default: .config/release-kit.config.ts at the repo root)
   --dry-run        Preview changes without writing files
   --force          Overwrite existing files instead of skipping them
   --help, -h       Show this help message
@@ -83,7 +88,8 @@ Regenerate .github/labels.yaml from the repoLabels block of .config/release-kit.
 
 Options:
   --check          Report whether .github/labels.yaml is stale instead of writing it
-  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --config <path>  Config file, relative to the current directory
+                   (default: .config/release-kit.config.ts at the repo root)
   --help, -h       Show this help message
 `);
 }
@@ -111,6 +117,20 @@ Options:
   --help, -h      Show this help message
 `);
 }
+function showUpdateTemplatesHelp() {
+    console.info(`
+Usage: release-kit update-templates [options]
+
+Update the GitHub Actions workflows that release-kit scaffolds to the templates
+of the installed version, showing what changed in each file. Creates a missing
+workflow that \`init\` would create, and refreshes sync-labels.yaml only when it
+exists. Keeps publish.yaml's provenance setting. Never touches config files.
+
+Options:
+  --dry-run       Preview changes without writing files
+  --help, -h      Show this help message
+`);
+}
 function showCommitHelp() {
     console.info(`
 Usage: release-kit commit [options]
@@ -139,10 +159,12 @@ function showPushHelp() {
     console.info(`
 Usage: release-kit push [options]
 
-Push the release commit and each tag individually, ensuring GitHub Actions
-fires a separate workflow run per tag.
+Push the release commit and each tag individually, so that GitHub Actions
+starts a separate workflow run for each tag.
 
 Options:
+  --config <path>        Config file, relative to the current directory
+                         (default: .config/release-kit.config.ts at the repo root)
   --dry-run              Preview without pushing
   --tags=tag1,tag2       Only push the named tags (comma-separated, full tag names)
   --tags-only            Skip the branch push (push tags only)
@@ -154,10 +176,12 @@ function showCreateGithubReleaseHelp() {
 Usage: release-kit create-github-release [options]
 
 Create GitHub Releases from changelog.json for tags on HEAD. Private
-(package.json#private) workspaces are skipped with a warning and get no Release.
+(package.json#private) workspaces are skipped with a warning, and the command
+doesn't create a Release for them.
 
 Options:
-  --config <path>        Path to config file (default: .config/release-kit.config.ts)
+  --config <path>        Config file, relative to the current directory
+                         (default: .config/release-kit.config.ts at the repo root)
   --dry-run              Preview without creating releases
   --tags=tag1,tag2       Only create releases for the named tags (comma-separated, full tag names)
   --help, -h             Show this help message
@@ -168,12 +192,13 @@ function showShowTagPrefixesHelp() {
 Usage: release-kit show-tag-prefixes [options]
 
 Print a per-workspace table of derived tag prefixes, tag counts, and declared
-legacy tag prefixes. Surfaces any release-shaped tags whose prefix is neither a
+legacy tag prefixes. Reports any release-shaped tags whose prefix is neither a
 derived prefix nor declared in \`legacyIdentities\`, with a copy-pasteable
 config snippet.
 
 Options:
-  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --config <path>  Config file, relative to the current directory
+                   (default: .config/release-kit.config.ts at the repo root)
   --help, -h       Show this help message
 `);
 }
@@ -199,12 +224,13 @@ scopes. Reports schema/parse errors, ambiguous-prefix errors, conflicting-key er
 stale-key warnings.
 
 Exit codes:
-  0    Clean — no errors, no stale keys
+  0    Clean: no errors, no stale keys
   1    Stale-key warnings only (no errors)
-  2    Schema/parse, ambiguous-prefix, or conflicting-key errors (errors dominate)
+  2    Schema/parse, ambiguous-prefix, or conflicting-key errors (errors take precedence)
 
 Options:
-  --config <path>  Path to config file (default: .config/release-kit.config.ts)
+  --config <path>  Config file, relative to the current directory
+                   (default: .config/release-kit.config.ts at the repo root)
   --help, -h       Show this help message
 `);
 }
@@ -212,13 +238,14 @@ function showPublishHelp() {
     console.info(`
 Usage: release-kit publish [options]
 
-Publish packages that have release tags on HEAD. Operates only on workspaces where
+Publish packages that have release tags on HEAD. Operates only on workspaces whose
 package.json#private is absent or false. Without --tags, unpublishable workspaces are
 silently filtered out. With --tags, an unpublishable tag is skipped with a warning while
-any publishable tags still publish.
+any publishable tags are still published.
 
 Options:
-  --config <path>        Path to config file (default: .config/release-kit.config.ts)
+  --config <path>        Config file, relative to the current directory
+                         (default: .config/release-kit.config.ts at the repo root)
   --dry-run              Preview without publishing
   --no-git-checks        Skip the clean-working-tree check
   --tags=tag1,tag2       Only publish the named tags (comma-separated, full tag names)
@@ -226,6 +253,15 @@ Options:
   --help, -h             Show this help message
 `);
 }
+function enterRepoRootOrExit() {
+    try {
+        return enterRepoRoot();
+    }
+    catch (error) {
+        reportError(describeError(error));
+        process.exit(1);
+    }
+}
 const args = process.argv.slice(2);
 const command = args[0];
 if (command === '--version' || command === '-V') {
@@ -247,7 +283,8 @@ if (command === 'prepare') {
         showPrepareHelp();
         process.exit(0);
     }
-    await prepareCommand(flags, styles);
+    const { invocationDir } = enterRepoRootOrExit();
+    await prepareCommand(flags, styles, invocationDir);
     process.exit(0);
 }
 if (command === 'commit') {
@@ -255,6 +292,7 @@ if (command === 'commit') {
         showCommitHelp();
         process.exit(0);
     }
+    enterRepoRootOrExit();
     try {
         commitCommand(flags);
     }
@@ -269,6 +307,7 @@ if (command === 'tag') {
         showTagHelp();
         process.exit(0);
     }
+    enterRepoRootOrExit();
     tagCommand(flags, styles);
     process.exit(0);
 }
@@ -277,7 +316,8 @@ if (command === 'push') {
         showPushHelp();
         process.exit(0);
     }
-    pushCommand(flags);
+    const { invocationDir } = enterRepoRootOrExit();
+    await pushCommand(flags, styles, invocationDir);
     process.exit(0);
 }
 if (command === 'create-github-release') {
@@ -285,7 +325,8 @@ if (command === 'create-github-release') {
         showCreateGithubReleaseHelp();
         process.exit(0);
     }
-    await createGithubReleaseCommand(flags, styles);
+    const { invocationDir } = enterRepoRootOrExit();
+    await createGithubReleaseCommand(flags, styles, invocationDir);
     process.exit(0);
 }
 if (command === 'publish') {
@@ -293,7 +334,8 @@ if (command === 'publish') {
         showPublishHelp();
         process.exit(0);
     }
-    await publishCommand(flags, styles);
+    const { invocationDir } = enterRepoRootOrExit();
+    await publishCommand(flags, styles, invocationDir);
     process.exit(0);
 }
 if (command === 'show-tag-prefixes') {
@@ -301,8 +343,9 @@ if (command === 'show-tag-prefixes') {
         showShowTagPrefixesHelp();
         process.exit(0);
     }
+    const { invocationDir } = enterRepoRootOrExit();
     const { config } = parseArgsOrExit(flags, configFlagSchema).flags;
-    const exitCode = await showTagPrefixesCommand(styles, config);
+    const exitCode = await showTagPrefixesCommand(styles, resolveConfigFlag(config, invocationDir));
     process.exit(exitCode);
 }
 if (command === 'init') {
@@ -310,6 +353,7 @@ if (command === 'init') {
         showInitHelp();
         process.exit(0);
     }
+    enterRepoRootOrExit();
     const initFlagSchema = {
         dryRun: { long: '--dry-run', type: 'boolean' },
         force: { long: '--force', type: 'boolean' },
@@ -319,6 +363,19 @@ if (command === 'init') {
     const exitCode = initCommand({ dryRun, force, styles, withConfig });
     process.exit(exitCode);
 }
+if (command === 'update-templates') {
+    if (flags.some((f) => f === '--help' || f === '-h')) {
+        showUpdateTemplatesHelp();
+        process.exit(0);
+    }
+    enterRepoRootOrExit();
+    const updateTemplatesFlagSchema = {
+        dryRun: { long: '--dry-run', type: 'boolean' },
+    };
+    const { dryRun } = parseArgsOrExit(flags, updateTemplatesFlagSchema).flags;
+    const exitCode = updateTemplatesCommand({ dryRun, styles });
+    process.exit(exitCode);
+}
 if (command === 'sync-labels') {
     const subcommand = flags[0];
     if (subcommand === undefined || ['--help', '-h'].includes(subcommand)) {
@@ -331,14 +388,16 @@ if (command === 'sync-labels') {
             showSyncLabelsInitHelp();
             process.exit(0);
         }
+        const { invocationDir } = enterRepoRootOrExit();
         const syncLabelsInitFlagSchema = {
             ...configFlagSchema,
             dryRun: { long: '--dry-run', type: 'boolean' },
             force: { long: '--force', type: 'boolean' },
         };
         const { config, dryRun, force } = parseArgsOrExit(subflags, syncLabelsInitFlagSchema).flags;
+        const configPath = resolveConfigFlag(config, invocationDir);
         const exitCode = await syncLabelsInitCommand({
-            ...(config !== undefined && { configPath: config }),
+            ...(configPath !== undefined && { configPath }),
             dryRun,
             force,
             styles,
@@ -350,12 +409,14 @@ if (command === 'sync-labels') {
             showSyncLabelsGenerateHelp();
             process.exit(0);
         }
+        const { invocationDir } = enterRepoRootOrExit();
         const generateFlagSchema = {
             ...configFlagSchema,
             check: { long: '--check', type: 'boolean' },
         };
         const { check, config } = parseArgsOrExit(subflags, generateFlagSchema).flags;
-        const exitCode = await generateCommand({ check, ...(config !== undefined && { configPath: config }), styles });
+        const configPath = resolveConfigFlag(config, invocationDir);
+        const exitCode = await generateCommand({ check, ...(configPath !== undefined && { configPath }), styles });
         process.exit(exitCode);
     }
     if (subcommand === 'sync') {
@@ -367,6 +428,7 @@ if (command === 'sync-labels') {
             reportError(`Unknown option: ${subflags[0]}`);
             process.exit(1);
         }
+        enterRepoRootOrExit();
         const exitCode = syncLabelsCommand();
         process.exit(exitCode);
     }
@@ -386,8 +448,9 @@ if (command === 'overrides') {
             showOverridesValidateHelp();
             process.exit(0);
         }
+        const { invocationDir } = enterRepoRootOrExit();
         const { config } = parseArgsOrExit(subflags, configFlagSchema).flags;
-        const result = await validateOverridesCommand(styles, config);
+        const result = await validateOverridesCommand(styles, resolveConfigFlag(config, invocationDir));
         if (result.exitCode === 0) {
             console.info(result.message);
         }