@williamthorsen/release-kit 12.0.0 → 13.1.0

package/.meta/changelog.json

@@ -1,4 +1,233 @@
 [
+  {
+    "version": "13.1.0",
+    "date": "2026-10-02",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds an `archived: true` mark to `repoLabels.labels` entries, which `sync-labels generate` writes to `.github/labels.yaml` without changing the output for unmarked labels. (#955)",
+            "hash": "23c0e0eeaf3e59cd921632850c7771ccdd6effe1",
+            "entry": 1
+          }
+        ]
+      }
+    ]
+  },
+  {
+    "version": "13.0.0",
+    "date": "2026-10-01",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds the `--config <path>` flag to `release-kit push`, which now reads the config as `publish` and `create-github-release` do and fails when the file exists but is invalid. (#895)",
+            "hash": "6aea08cf0154f2d1cc253a44cd9b09c283ad3248",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit` add an item derived from a change-record entry to a workspace's changelog and version bump only when the entry's `scopes`, after `scopeAliases` resolution, name the workspace's `dir`, are empty, or contain `*`, and extends that rule to the sections of earlier releases that `release-kit prepare` rebuilds. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 1
+          },
+          {
+            "description": "Adds a warning to the `release-kit prepare` report that lists each change-record entry scope matching no workspace in its commit's window, such as a misspelled scope or the old name of a renamed directory that has no `scopeAliases` entry. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit overrides validate` check a workspace's overrides against only the entries routed to that workspace, so that an override keyed to an entry routed elsewhere is reported as stale. (#896)",
+            "hash": "066c6bde1ad4fda6705066f538283e9c80a92a1e",
+            "entry": 3
+          },
+          {
+            "description": "Adds `release-kit update-templates`, which writes each scaffolded workflow that is missing or differs from the installed template, prints a diff of each updated file, refreshes `sync-labels.yaml` only when it exists, keeps `publish.yaml`'s provenance setting, and never reads or writes the config files. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 1
+          },
+          {
+            "description": "Changes the readyup kits' fix messages for a workflow that differs from its template, or that references a deprecated tag, to recommend `update-templates` rather than `init --force`. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🪦 Removed",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Removes `required` as a `breakingPolicies` value, making `drop` default to `optional` so that an unmarked `drop:` commit no longer reports a policy violation. (#905)",
+            "breaking": true,
+            "migration": "Remove each `'required'` value from `breakingPolicies` in `release-kit.config.ts`, or replace it with `'optional'`.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit` from parsing a commit subject that combines a pipe scope with a parenthesized scope, such as `web|feat(other): ...`, or that lacks a space and a title after the colon, because subjects are now read through `@williamthorsen/change-grammar`. (#905)",
+            "migration": "Rewrite a combined subject such as `web|feat(other): ...` as `web|feat: ...`, and follow the colon with a space and a title.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 2
+          },
+          {
+            "description": "Stops publishing `schemas/label-map.json` from `release-kit`, whose identical schema `@williamthorsen/change-grammar` now publishes; URLs under existing `release-kit-v*` tags keep resolving. (#905)",
+            "migration": "Point the `$schema` of `.meta/label-map.json` at `https://github.com/williamthorsen/node-monorepo-tools/raw/change-grammar-v<version>/packages/change-grammar/schemas/label-map.json`, and keep an existing `release-kit-v*` URL until a `change-grammar-v*` tag exists, since that URL does not resolve before then.",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Record a changelog entry for a forced release whose commits yield no item (#887)",
+            "body": "Makes `release-kit prepare` record the \"Forced version bump.\" changelog entry for any release forced by `--force` or `--set-version` whose commits yield no changelog item, instead of only for a release with no commits at all. It also stops a monorepo's project release from dropping the forced-release entries that earlier releases recorded.",
+            "hash": "e806c32a4f412abde5d7ab22f150506e946b3a87"
+          },
+          {
+            "description": "Stops `release-kit prepare` from reporting `commitCount` 0 and dropping the unparseable commits and change-record and policy diagnostics of a workspace released only because a dependency was bumped, and makes `prepare` list that workspace's commits in the release commit summary under its tag. (#888)",
+            "hash": "d60ac32b7452b850c98571017e5f7f373479fc10",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from labeling a direct release that has no commits as bumped via a dependency, by marking a propagation-only release with the new `propagatedOnly` result field, whose report line now reads `Bumped via dependency: …` in place of `0 commits (bumped via dependency: …)`. (#888)",
+            "hash": "d60ac32b7452b850c98571017e5f7f373479fc10",
+            "entry": 2
+          },
+          {
+            "description": "Stops a `release-kit` command run from inside a package from releasing that package as a single-package repo with its own tag and changelog, by running every command from the repo root: the nearest directory that contains `pnpm-workspace.yaml`, or else the working directory when it contains a `package.json`. (#893)",
+            "hash": "97af8314da5dfe135c680310eb79f8309bc9918e",
+            "entry": 1
+          },
+          {
+            "description": "Stops `sync-labels generate` from writing the `--config` path into the `.github/labels.yaml` header as typed, which made the header and the result of `generate --check` depend on the directory from which the command ran; the header now names the config by its path relative to the repo root. (#893)",
+            "hash": "97af8314da5dfe135c680310eb79f8309bc9918e",
+            "entry": 2
+          },
+          {
+            "description": "Stops `push`, `publish`, and `create-github-release` from pushing, publishing, or creating a GitHub Release for a tag on HEAD whose workspace the config excludes with `shouldExclude: true`, which each command now skips with a warning, including when `--tags` names the tag or when every tag on HEAD is excluded. (#895)",
+            "hash": "6aea08cf0154f2d1cc253a44cd9b09c283ad3248",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from silently deleting a `CHANGELOG.md` section whose version is absent from both the release windows and `changelog.json`, such as history written by hand before release-kit was adopted; `prepare` now keeps that section verbatim in version order, lists the kept versions in its report, and warns about each `##` section that names no version and is dropped. (#897)",
+            "hash": "9316ba5903b330895e258786d0fc7de005554cae",
+            "entry": 1
+          },
+          {
+            "description": "Stops `release-kit prepare` from folding every earlier commit into the new version, and deriving the bump from all of them, when the current version was released and recorded in the changelog but never tagged; `prepare` now fails before any write, under `--force` and `--set-version` too, and names each target and the tag to create. (#897)",
+            "hash": "9316ba5903b330895e258786d0fc7de005554cae",
+            "entry": 2
+          },
+          {
+            "description": "Adds the missing `removal` and `formatting` labels to the `common` preset by defining a label for every work type in change-grammar's taxonomy, and keeps the names, colors, and descriptions of the existing type labels. (#906)",
+            "hash": "ccdb3aa585d6fb36b2994cceb59df54caea12a79",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the `release.yaml` generated by `release-kit init`, which `actionlint` rejected because its `bump` choice input listed an empty string as the auto-detect option, by offering `auto` as the default option and passing it to the reusable release workflow as an empty `bump`. (#936)",
+            "hash": "9c0ef936a0d5b91fe64c5a1ea1be258f1678ea62",
+            "entry": 1
+          },
+          {
+            "description": "Rewords the error messages, `prepare` report lines, command help, and readyup kit fix strings of `release-kit` that addressed the reader as \"your\", separated a detail from its subject with an em-dash, or stated an absence with \"no\", such as \"No workspaces had release-worthy changes.\" (#937)",
+            "hash": "22ae182082e683ef94bf59db3bd23ca2c5b72c1f",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that the `release.yaml` and `sync-labels.yaml` workflows generated by `release-kit init` and `release-kit sync-labels init` contained unclear wording in two comments and in the `force` input description, which the change rewrites without altering any job, trigger, or input; the release-kit kit check reports a copy generated before this change as stale until `release-kit init --force` or `release-kit sync-labels init --force` regenerates it. (#946)",
+            "hash": "dc1c4bd4b05425ed1c2a7d031105c402c3d01f20",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit` titled a propagation-only bump's changelog section `Dependency updates` rather than with the resolved `deps` work type's header, `📦 Dependencies` by default or a consumer's `workTypes.deps.header` override, which broke the heading convention and left the section outside the section order. (#950)",
+            "hash": "5a4771a1cb1e1b324a9ce3cb64fc3527199946a7",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit init`'s next steps told a public repo to set `provenance: true` in `publish.yaml`, which the template already sets, and now tells a private repo to remove it instead. (#952)",
+            "hash": "9fac96675e9fb4dd70407cbfb0e3e0ffa7e83ba4",
+            "entry": 4
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Narrows the config accepted by `releasePrepare`, `releasePrepareMono`, `releasePrepareProject`, and the helpers that they pass it to, to the new `PrepareConfig` and `MonorepoPrepareConfig` aliases, which omit `releaseNotes` so that typecheck rejects any read of release-notes configuration on the prepare path. (#890)",
+            "hash": "e2b4e44f37a3f8254a42d98f67bc2f15d9e6c2c5",
+            "entry": 1
+          },
+          {
+            "description": "Derives `DEFAULT_WORK_TYPES`, `DEFAULT_BREAKING_POLICIES`, the default `devOnlySections`, and the release-notes breaking marker from change-grammar's `CANONICAL_TAXONOMY`, removing release-kit's taxonomy copy and its `work-types:check` and `work-types:sync` scripts. (#905)",
+            "hash": "3ccdc8960988b71c2b9ce065f2889cf741c44721",
+            "entry": 4
+          },
+          {
+            "description": "Replaces every `.sort()` call that suppressed `unicorn/no-array-sort` with `toSorted()` and drops the spread copy wherever the source was already an array. (#925)",
+            "hash": "4680fb4e865ffce0bd135fac20d49b766b156992",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "🧪 Tests",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Extends the `changelogJson.enabled` tests of `releasePrepareMono` to configure a format command and assert that `formatCommand.files` includes the workspace's `changelog.json` when the feature is enabled and excludes it when the feature is disabled, where the disabled case also requires a format command to exist so that the exclusion cannot pass vacuously. (#889)",
+            "hash": "eaf3782e606b98ba360cde9eab08770e27155d2b",
+            "entry": 1
+          },
+          {
+            "description": "Replaces the inline copies of the fixture in which `app` depends on `core` in `releasePrepareMono.unit.test.ts` with `stubPropagationWorkspaces`, a helper that stubs both manifests at their exact paths and returns the two-workspace config. (#951)",
+            "hash": "c1d511c5ae570e75358cd642b90b4979723fe375",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Upgrades all dependencies to the latest versions allowed by the ceilings in `taze.config.ts` and the release quarantine, including pnpm to 12.6.0. (#944)",
+            "hash": "6dffd5df5bc4209dc225d08390ef2b67fe381f1b",
+            "entry": 1
+          },
+          {
+            "description": "Adds `esbuild` 0.28.2 to the pnpm catalog and declares it as a devDependency of `nmr`, `release-kit`, and `v11y-check`, because `readyup` declares it only as an optional peer and `rdy compile` failed in those packages once a regenerated lockfile stopped installing it. (#944)",
+            "hash": "6dffd5df5bc4209dc225d08390ef2b67fe381f1b",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Revises the comments in `packages/release-kit/src` and the `default` and `npm-auto-publish` readyup kits against the comment-discipline rules, correcting comments that misstated the code, such as the `releasePrepareProject` description that said it returns `undefined` where it throws and the `renderChangelogMarkdown` note that said no logic reads the footer. (#922)",
+            "hash": "176d09caec47686fa0023a31c5f77d4e2362d9bb",
+            "entry": 1
+          },
+          {
+            "description": "Rewrites the prose of the `release-kit` README, the pages under `docs/`, and the package's source comments and test names in plain, literal wording. (#937)",
+            "hash": "22ae182082e683ef94bf59db3bd23ca2c5b72c1f",
+            "entry": 2
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "12.0.0",
     "date": "2026-09-23",

package/.readyup/kits/default.js

@@ -98,7 +98,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "12.0.0" };
+  const picked = { "version": "13.1.0" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -114,10 +114,10 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\{[^}]*\b(?:config|default)\b[^}]*\}/,
   /export\s*\*/
 ];
-var COMMON_PRESET_HASH = "8c52654d4eee216c22377dd1e65b89f6bbb0a3478d74379bd28b04a877f0b02a";
-var SYNC_LABELS_WORKFLOW_HASH = "d6e2403fb551d2d415f679125989c92760444eec887644565b2e05c9bf8f4c1e";
-var RELEASE_WORKFLOW_HASH_MONOREPO = "0a9724b7b3c5e24087fd3a8f36fed8e990d699267fcf36028ce048ab40dc2946";
-var RELEASE_WORKFLOW_HASH_SINGLE = "a3d19bbc1ba8bb30622e53c590137b97e3179e80988c0967737b021cdaeab73f";
+var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
+var SYNC_LABELS_WORKFLOW_HASH = "6b50015e2919ffa4b16d0b4a1f340e585ff3e5b779a2256010d3c62fa07ff8f2";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "f35503bcfc5c131a8309305fed27f8127cb901f422cb8b62978a34b86dda7f7a";
+var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
 var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO = "c455d88c93d855737c96079945ff729a9d094f846519c24afbefe83a425c1d7f";
@@ -160,14 +160,14 @@ var default_default = defineRdyKit({
                 const hash = detectRepoType() === "monorepo" ? RELEASE_WORKFLOW_HASH_MONOREPO : RELEASE_WORKFLOW_HASH_SINGLE;
                 return fileMatchesHash(".github/workflows/release.yaml", hash);
               },
-              fix: "Run `release-kit init --force` to regenerate release.yaml from the current template"
+              fix: "Run `release-kit update-templates` to regenerate release.yaml from the current template"
             },
             {
               name: "release.yaml does not reference deprecated tag ref",
               severity: "error",
               quiet: true,
               check: () => fileDoesNotContain(".github/workflows/release.yaml", /@(release|publish)-workflow-v[0-9]/),
-              fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+              fix: "Update release.yaml to use @workflow/release-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
             }
           ]
         },
@@ -185,14 +185,14 @@ var default_default = defineRdyKit({
                 const hash = detectRepoType() === "monorepo" ? PUBLISH_WORKFLOW_HASH_MONOREPO : PUBLISH_WORKFLOW_HASH_SINGLE;
                 return fileMatchesHash(".github/workflows/publish.yaml", hash);
               },
-              fix: "Run `release-kit init --force` to regenerate publish.yaml from the current template"
+              fix: "Run `release-kit update-templates` to regenerate publish.yaml from the current template"
             },
             {
               name: "publish.yaml does not reference deprecated tag ref",
               severity: "error",
               quiet: true,
               check: () => fileDoesNotContain(".github/workflows/publish.yaml", /@(release|publish)-workflow-v[0-9]/),
-              fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit init --force` to regenerate, or replace the ref manually)"
+              fix: "Update publish.yaml to use @workflow/publish-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
             }
           ]
         },
@@ -204,14 +204,14 @@ var default_default = defineRdyKit({
             const hash = detectRepoType() === "monorepo" ? CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO : CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE;
             return fileMatchesHash(".github/workflows/create-github-release.yaml", hash);
           },
-          fix: "Run `release-kit init --force` to regenerate create-github-release.yaml from the current template"
+          fix: "Run `release-kit update-templates` to regenerate create-github-release.yaml from the current template"
         },
         {
           name: ".config/release-kit.config.ts exports a config",
           severity: "error",
           skip: () => !fileExists(".config/release-kit.config.ts") ? "no release-kit config file" : false,
           check: () => configFileExportsConfig(),
-          fix: "Export the config from .config/release-kit.config.ts as a default export or as a named `config` export; release-kit resolves no other export",
+          fix: "Export the config from .config/release-kit.config.ts as a default export or as a named `config` export; release-kit does not resolve any other export",
           checks: [
             {
               name: "releaseNotes config is consistent with changelogJson",
@@ -223,7 +223,7 @@ var default_default = defineRdyKit({
               name: ".config/release-kit.config.ts uses defineConfig",
               severity: "recommend",
               check: () => fileContains(".config/release-kit.config.ts", /defineConfig/),
-              fix: "Wrap your config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
+              fix: "Wrap the config export with defineConfig() from @williamthorsen/release-kit/config for type safety"
             },
             {
               name: "releaseNotes.shouldInjectIntoReadme is true",
@@ -262,8 +262,9 @@ var default_default = defineRdyKit({
             }
           ]
         },
-        // Deliberately outside the config gate above: that check skips where the config file is absent, and a repo
-        // with no config file still defaults `changelogJson.enabled` to true and still publishes tarballs.
+        // Keep these checks outside the config gate above, which skips when the config file is absent: For a repo
+        // without a config file, release-kit still defaults `changelogJson.enabled` to true, and the repo still
+        // publishes tarballs.
         {
           name: "published packages ship CHANGELOG.md",
           severity: "warn",
@@ -276,7 +277,7 @@ var default_default = defineRdyKit({
           severity: "recommend",
           skip: () => !hasPublishablePackages() ? "no publishable packages" : false,
           check: () => changelogJsonIsEnabled(),
-          fix: "Remove changelogJson.enabled: false from .config/release-kit.config.ts so release-kit writes the machine-readable changelog that upgrade tooling reads before CHANGELOG.md",
+          fix: "Remove changelogJson.enabled: false from .config/release-kit.config.ts so that release-kit writes the machine-readable changelog that upgrade tooling reads before CHANGELOG.md",
           checks: [
             {
               name: "published packages ship the changelog JSON",
@@ -312,7 +313,7 @@ var default_default = defineRdyKit({
               name: "sync-labels.yaml matches template",
               severity: "warn",
               check: () => fileMatchesHash(".github/workflows/sync-labels.yaml", SYNC_LABELS_WORKFLOW_HASH),
-              fix: "Run `release-kit sync-labels init --force` to regenerate the workflow from the current template"
+              fix: "Run `release-kit update-templates` to regenerate the workflow from the current template"
             }
           ]
         },
@@ -321,7 +322,7 @@ var default_default = defineRdyKit({
           severity: "error",
           quiet: true,
           check: () => fileDoesNotContain(".github/workflows/sync-labels.yaml", /@sync-labels-workflow-v[0-9]/),
-          fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit sync-labels init --force` to regenerate, or replace the ref manually)"
+          fix: "Update sync-labels.yaml to use @workflow/sync-labels-v1 (run `release-kit update-templates` to regenerate, or replace the ref manually)"
         },
         {
           name: "retired .config/sync-labels.config.ts is absent",

package/.readyup/kits/npm-auto-publish.js

@@ -17,6 +17,13 @@ import {
   readFile,
   readJsonFile
 } from "readyup/check-utils";
+
+// src/init/hasProvenance.ts
+function hasProvenance(workflowContent) {
+  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
+}
+
+// .readyup/kits/npm-auto-publish.ts
 var AUTH_ERROR_CODES = /* @__PURE__ */ new Set(["E401", "ENEEDAUTH"]);
 var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
@@ -41,7 +48,7 @@ var repoChecklist = defineRdyChecklist({
         {
           name: "id-token: write permission declared",
           check: () => fileContains(".github/workflows/publish.yaml", /id-token:\s*write/),
-          fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml \u2014 required for OIDC-based npm authentication'
+          fix: 'Add "permissions: { id-token: write, contents: read }" to .github/workflows/publish.yaml; OIDC-based npm authentication requires it'
         },
         {
           name: "No legacy token references in workflow files",
@@ -69,18 +76,17 @@ var packagesChecklist = defineRdyChecklist({
       },
       fix: 'Set "packageManager": "pnpm@..." in root package.json'
     },
-    // Unfalsifiable on readyup 0.33 and later, where discovery reports the repo root and throws on an unreadable
-    // root package.json rather than returning an empty list. It stays for a consumer below that, whose monorepo
-    // mode returns the matched directories alone and so returns nothing when the globs match nothing.
+    // Unfalsifiable on every readyup version that `minReadyupVersion` admits: Discovery reports the repo root, and it
+    // throws on an unreadable root package.json instead of returning an empty list.
     {
       name: "At least one workspace discovered",
       check: () => discoverWorkspaces().length > 0,
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  // The gate stands beside the workspace rows rather than above them, so a session that cannot answer trust queries
-  // suppresses the trusted-publisher rows alone and leaves the package.json checks reporting. The rows no longer
-  // hang beneath the gate's skip, so a repo that publishes nothing has to be held to its one line here.
+  // The session gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust
+  // queries suppresses only the trusted-publisher rows and leaves the package.json checks reporting. The gate's skip
+  // therefore does not cover the rows, and this getter omits them for a repo that publishes nothing.
   get checks() {
     const sessionCheck = buildSessionCheck();
     if (skipIfNothingPublishable() !== false) {
@@ -94,8 +100,8 @@ var packagesChecklist = defineRdyChecklist({
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
-  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. An older
-  // runner drops that `fix` silently, so failing to load the kit is the lesser harm.
+  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. Because an
+  // older runner drops that `fix` silently, failing to load the kit is the lesser harm.
   minReadyupVersion: "0.37.0",
   checklists: [repoChecklist, packagesChecklist]
 });
@@ -110,9 +116,7 @@ function buildSessionCheck() {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
     },
-    // A plain string rather than a getter, because the remediation is the same however the session fails; only
-    // the `detail` above varies.
-    fix: 'Restore a usable npm session: log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
+    fix: 'Restore a usable npm session: Log in with "npm login", supplying the one-time password when prompted, or restore access to the registry, which the trusted-publisher check queries directly'
   };
 }
 function buildWorkspaceCheck(workspace) {
@@ -139,7 +143,7 @@ function buildWorkspaceCheck(workspace) {
     {
       name: "published to npm",
       // `npm view` reads the registry without a session, so a missing login or a missing one-time password leaves
-      // this answerable. An unreachable registry does not: the lookup fails for every package, and reporting that
+      // this answerable. An unreachable registry does not: The lookup fails for every package, and reporting that
       // as unpublished would advise publishing a package that is already there.
       skip: () => {
         const auth = getCachedNpmAuthStatus();
@@ -192,7 +196,7 @@ function checkTrustedPublisher(packageName) {
     case "configured":
       return { ok: true };
     case "not-configured":
-      return { ok: false, detail: "No trusted publisher is configured for this package" };
+      return { ok: false, detail: "The npm registry does not list any trusted publisher for this package" };
     default:
       return { ok: false, detail: result.detail };
   }
@@ -228,19 +232,19 @@ function classifyProvenanceSetting(workflowContent, visibility) {
       fix: "Install and authenticate the GitHub CLI: gh auth login"
     };
   }
-  const hasProvenance = parseProvenanceSetting(workflowContent);
-  if (visibility === "public" && !hasProvenance) {
+  const provenance = hasProvenance(workflowContent);
+  if (visibility === "public" && !provenance) {
     return {
       ok: false,
       detail: "The repo is public and publish.yaml does not set provenance: true",
-      fix: "Set provenance: true in .github/workflows/publish.yaml \u2014 public repos should generate provenance attestations"
+      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
     };
   }
-  if (visibility === "private" && hasProvenance) {
+  if (visibility === "private" && provenance) {
     return {
       ok: false,
       detail: "The repo is private and publish.yaml sets provenance: true",
-      fix: "Make the GitHub repo public \u2014 OIDC publishing with provenance requires a public repo"
+      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
     };
   }
   return { ok: true };
@@ -273,7 +277,7 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
   }
   const relationships = readTrustRelationships(result.stdout);
   if (relationships === void 0) {
-    return { status: "error", detail: "The npm trust query returned a payload this check cannot read" };
+    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
   }
   if (relationships.length === 0) {
     return { status: "not-configured" };
@@ -366,9 +370,6 @@ function isRepoPrivate() {
   }).trim();
   return result === "true";
 }
-function parseProvenanceSetting(workflowContent) {
-  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
-}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);

package/.readyup/manifest.json

@@ -8,12 +8,12 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "07f5fe58",
+          "hash": "91bc3638",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "54c6b74c",
+          "hash": "fd27a632",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -21,22 +21,22 @@
           ]
         },
         {
-          "hash": "850b703f",
+          "hash": "43bb0452",
           "kind": "module",
           "path": "../src/init/detectRepoType.ts"
         },
         {
-          "hash": "b6873aba",
+          "hash": "68354f97",
           "kind": "module",
           "path": "../src/init/parseJsonRecord.ts"
         },
         {
-          "hash": "b798d024",
+          "hash": "1c9cbce9",
           "kind": "module",
           "path": "../src/packsPath.ts"
         },
         {
-          "hash": "646fe51b",
+          "hash": "1424b343",
           "kind": "module",
           "path": "../src/typeGuards.ts"
         }
@@ -45,8 +45,8 @@
       "path": "kits/default.js",
       "readyupVersion": "0.38.0",
       "source": "kits/default.ts",
-      "sourceHash": "07f5fe58",
-      "targetHash": "cece8501"
+      "sourceHash": "91bc3638",
+      "targetHash": "a3266cf2"
     },
     {
       "checklists": [
@@ -56,17 +56,22 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "c2d2d375",
+          "hash": "d9910d60",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
+        },
+        {
+          "hash": "d360febf",
+          "kind": "module",
+          "path": "../src/init/hasProvenance.ts"
         }
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
       "readyupVersion": "0.38.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "c2d2d375",
-      "targetHash": "9d2d224b"
+      "sourceHash": "d9910d60",
+      "targetHash": "8bdbefef"
     }
   ]
 }