@williamthorsen/release-kit 14.1.0 → 14.2.1

package/.meta/changelog.json

@@ -1,4 +1,140 @@
 [
+  {
+    "version": "14.2.1",
+    "date": "2026-10-13",
+    "sections": [
+      {
+        "title": "📦 Dependencies",
+        "audience": "dev",
+        "items": [{ "description": "Bumped `@williamthorsen/change-grammar` to 0.2.1" }]
+      }
+    ]
+  },
+  {
+    "version": "14.2.0",
+    "date": "2026-10-12",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds an optional `aliases` array to a `repoLabels.labels` entry, which `sync-labels` writes to `.github/labels.yaml` so that the sync renames each existing label named by an alias to the entry's name and keeps it on the issues and pull requests that have it. (#1015)",
+            "hash": "29e43c8066d15d956e60964e616a1bb51c3cd6bd",
+            "entry": 1
+          },
+          {
+            "description": "Makes `release-kit sync-labels` reject a config whose alias names a label that the config resolves or appears twice, because the sync would otherwise merge one declared label into another and delete it. (#1015)",
+            "hash": "29e43c8066d15d956e60964e616a1bb51c3cd6bd",
+            "entry": 2
+          },
+          {
+            "description": "Adds the `confidence:high` (\"Clearly worth doing\"), `confidence:medium` (\"Worth doing, but arguable\"), and `confidence:low` (\"Not worth a ticket now\") labels to the `common` preset of `release-kit sync-labels`, and documents in `docs/labels.md` that the family grades how advisable a recommendation is. (#1019)",
+            "hash": "a92f374228e4a2ccc1f7053b1565cbf081c241b8",
+            "entry": 1
+          },
+          {
+            "description": "Adds a warning to the `release-kit` readyup kit that names each `scope:` label in `.github/labels.yaml` with a non-empty description, archived labels included, because GitHub's label list groups scope labels compactly only when they have no description. (#1022)",
+            "hash": "b24ced5a34b7f3baacbbf2bbe2aca5e0eb08d548",
+            "entry": 1
+          },
+          {
+            "description": "Adds the `releases` block to `.config/release-kit.config.ts`, in which an entry renames a discovered workspace's release target, excludes the workspace with `false`, or declares a composite of named members that the root `package.json` versions, as an alternative to the `workspaces` and `project` blocks, which keep working unchanged. (#1028)",
+            "hash": "6427c9642c3517bc4a0a6c8b8f6ff1012bd0adcf",
+            "entry": 1
+          },
+          {
+            "description": "Lets `release-kit prepare --only` select a `releases` composite by its target name, and makes a narrowed run that leaves the composite out skip it with a warning that names it. (#1028)",
+            "hash": "6427c9642c3517bc4a0a6c8b8f6ff1012bd0adcf",
+            "entry": 2
+          },
+          {
+            "description": "Adds directory release targets to `release-kit`: A `releases` entry whose `path` is not a workspace now declares a target that `prepare` versions from the directory's `package.json` or `version.json`, whose `CHANGELOG.md` `prepare` writes, and whose tags `push` and `create-github-release` handle, while `publish` skips them because a directory does not have any package to publish to npm. (#1029)",
+            "hash": "06d7ada2cd352d9ba9cfbf1cc30195b2273488d9",
+            "entry": 1
+          },
+          {
+            "description": "Adds the repo-root target `{ path: '.' }`, which versions the root `package.json`, tags `v{version}`, and writes every commit in the repo to `./CHANGELOG.md`, replacing a `project` block whose window covered the whole repo only while every workspace was excluded. (#1029)",
+            "hash": "06d7ada2cd352d9ba9cfbf1cc30195b2273488d9",
+            "entry": 2
+          },
+          {
+            "description": "Adds the `changelogMarkdown.keepVersions` config option, which makes `prepare` write only the newest `keepVersions` sections to `CHANGELOG.md`, with links to `changelogs/CHANGELOG-v{major}.md` archive files that contain the older sections, and delete any archive file that is no longer needed after the option is raised or removed. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 1
+          },
+          {
+            "description": "Extends `prepare` to read hand-written sections from the `changelogs/` archive files as well as from `CHANGELOG.md`, so that an archived section written by hand is kept when the changelog is regenerated. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 2
+          },
+          {
+            "description": "Adds the warning \"published packages ship the changelog archives\" to the release-kit readyup kit, which reports each publishable package whose `files` field omits `changelogs/` while `keepVersions` is set, because the links in `CHANGELOG.md` to the archive files would otherwise be broken in the published package. (#1031)",
+            "hash": "0368850a5719d9a9ee21db6a82063adc44b4ea70",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that the `npm-auto-publish` kit crashed without reporting any results in a repo whose `origin` remote is missing or does not point to GitHub, and makes its trusted-publisher and provenance checks name that cause and advise adding the remote. (#1018)",
+            "hash": "7faff3726a51003c80060ba5fd98235338997145",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit prepare` accepted two workspaces whose directories share a name, which `--only` and the dependency graph use to identify a workspace, and makes `prepare` and `release-kit overrides validate` stop with an error that lists the path of each. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 2
+          },
+          {
+            "description": "Fixes the issue that `release-kit push` never pushed the project tag on HEAD, and failed with `HEAD does not have any release tags.` when the project tag was the only release tag. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 1
+          },
+          {
+            "description": "Fixes the issue that `release-kit create-github-release` did not create a GitHub Release for the project tag; a private workspace's tag is still skipped. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 2
+          },
+          {
+            "description": "Makes `release-kit publish` skip a project tag named by `--tags` with the warning `Skipping v0.13.0: a project tag is not an npm package.`, since the project does not have an npm package to publish. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 3
+          }
+        ]
+      },
+      {
+        "title": "♻️ Refactoring",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Replaces `releasePrepare`, `releasePrepareMono`, and `releasePrepareProject` with `releasePrepareTargets`, which prepares a release from one list of package and project targets resolved from any config shape. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 1
+          }
+        ]
+      },
+      {
+        "title": "📚 Documentation",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Rewrites `docs/api.md` to describe what the `.` and `./config` entries export, and drops its sections on `deriveWorkspaceConfig`, the script-based approach, and `resolveReleaseTags`, none of which the package exports. (#1026)",
+            "hash": "7211951adb8e3e7b05a35196096d67bc33890801",
+            "entry": 3
+          },
+          {
+            "description": "Documents in `docs/project-releases.md` the tag pattern that a scaffolded `create-github-release.yaml` needs in order to trigger on a project tag, because its default `'*-v[0-9]*.[0-9]*.[0-9]*'` filter does not match a `v<version>` tag. (#1027)",
+            "hash": "ffab419c87725051d04a1d817fc4be8b7222694b",
+            "entry": 4
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "14.1.0",
     "date": "2026-10-11",

package/.readyup/kits/default.js

@@ -16,6 +16,9 @@ import {
   readFile
 } from "readyup/check-utils";
 
+// src/changelogArchive.ts
+var CHANGELOG_ARCHIVE_DIRECTORY = "changelogs";
+
 // src/init/detectRepoType.ts
 import { existsSync, readFileSync } from "node:fs";
 
@@ -98,7 +101,7 @@ function translateGlob(pattern) {
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "14.1.0" };
+  const picked = { "version": "14.2.1" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }
@@ -114,9 +117,9 @@ var CONFIG_EXPORT_PATTERNS = [
   /export\s*\{[^}]*\b(?:config|default)\b[^}]*\}/,
   /export\s*\*/
 ];
-var COMMON_PRESET_HASH = "618bb5cbcbdd4f4f0c2a777add7e14d992d48483350dd9651bf8cf4c1fa9d418";
+var COMMON_PRESET_HASH = "1d3e2df1ccd7deea4707fa07a4ae171d761344b65c1a311467fc0f66b70ee646";
 var SYNC_LABELS_WORKFLOW_HASH = "0a88829d154c0de7cdd4246fede99e9311a89ab4199034dbe601663d641ab1e4";
-var RELEASE_WORKFLOW_HASH_MONOREPO = "4a20ff3315155500f64a27133c54eb1bc1f07a4acc370ec0d83176109041c60d";
+var RELEASE_WORKFLOW_HASH_MONOREPO = "f63f4cabb57f94ee6550f17a9874c7a346d46554595ddbcd46fdd3208d613437";
 var RELEASE_WORKFLOW_HASH_SINGLE = "d26dd4ca186632b388ea46bd885721124c03d19918e511baa40821d2d760da69";
 var PUBLISH_WORKFLOW_HASH_MONOREPO = "0afa9ffe914f3dc8f043e68252ebc604c8cc1a953422fcea37a909a4def370ee";
 var PUBLISH_WORKFLOW_HASH_SINGLE = "6f31183e0a1e66be791a19266c3b028dadbd9fe010f7fc4452f3f8970c937b43";
@@ -257,6 +260,13 @@ var default_default = defineRdyKit({
                   severity: "warn",
                   check: () => labelsHaveCurrentPresetHash("common", COMMON_PRESET_HASH),
                   fix: "Run `release-kit sync-labels generate` to incorporate updated common labels"
+                },
+                {
+                  name: "scope labels in .github/labels.yaml have no description",
+                  severity: "warn",
+                  quiet: true,
+                  check: () => scopeLabelsHaveNoDescriptions(),
+                  fix: "Remove `description` from these scope labels in the repoLabels block of .config/release-kit.config.ts, so that GitHub groups them compactly, then run `release-kit sync-labels generate`"
                 }
               ]
             }
@@ -272,6 +282,16 @@ var default_default = defineRdyKit({
           check: () => packagesShipChangelog(),
           fix: 'Add "CHANGELOG.md" to the files field of each affected package.json'
         },
+        {
+          name: "published packages ship the changelog archives",
+          severity: "warn",
+          skip: () => {
+            if (!hasPublishablePackages()) return "no publishable packages";
+            return changelogArchivesAreEnabled() ? false : "changelogMarkdown.keepVersions is not set";
+          },
+          check: () => packagesShipChangelogArchives(),
+          fix: 'Add "changelogs/" to the files field of each affected package.json, so that the links from CHANGELOG.md to its archive files resolve in the published package'
+        },
         {
           name: "changelog.json generation is enabled",
           severity: "recommend",
@@ -335,6 +355,11 @@ var default_default = defineRdyKit({
     }
   ]
 });
+function changelogArchivesAreEnabled() {
+  const content = readFile(".config/release-kit.config.ts");
+  if (content === void 0) return false;
+  return /changelogMarkdown\s*:\s*\{[^}]*keepVersions\s*:/.test(content);
+}
 function changelogJsonIsEnabled() {
   const content = readFile(".config/release-kit.config.ts");
   if (content === void 0) return true;
@@ -355,6 +380,9 @@ function labelsHaveCurrentPresetHash(presetName, expectedHash) {
 function packagesShipChangelog() {
   return reportWorkspacesOmitting("CHANGELOG.md");
 }
+function packagesShipChangelogArchives() {
+  return reportWorkspacesOmitting(`${CHANGELOG_ARCHIVE_DIRECTORY}/CHANGELOG-v1.md`, `${CHANGELOG_ARCHIVE_DIRECTORY}/`);
+}
 function packagesShipChangelogJson() {
   return reportWorkspacesOmitting(resolveChangelogJsonOutputPath());
 }
@@ -390,7 +418,7 @@ function releaseNotesInjectsIntoReadme() {
   if (content === void 0) return false;
   return /shouldInjectIntoReadme\s*:\s*true/.test(content);
 }
-function reportWorkspacesOmitting(path) {
+function reportWorkspacesOmitting(path, label = path) {
   const failing = [];
   const packageWorkspaces = discoverWorkspaces({ filter: (w) => w.isPackage });
   for (const { dir, packageJson } of packageWorkspaces) {
@@ -401,7 +429,7 @@ function reportWorkspacesOmitting(path) {
   if (failing.length === 0) return true;
   return {
     ok: false,
-    detail: `files field omits ${path}: ${failing.join(", ")}`
+    detail: `files field omits ${label}: ${failing.join(", ")}`
   };
 }
 function resolveChangelogJsonOutputPath() {
@@ -410,6 +438,32 @@ function resolveChangelogJsonOutputPath() {
   const match = /changelogJson\s*:\s*\{[^}]*outputPath\s*:\s*['"]([^'"]+)['"]/.exec(content);
   return match?.[1] ?? DEFAULT_CHANGELOG_JSON_PATH;
 }
+function scopeLabelsHaveNoDescriptions() {
+  const content = readFile(".github/labels.yaml");
+  if (content === void 0) return true;
+  const described = [];
+  let currentName;
+  for (const line of content.split("\n")) {
+    const nameMatch = /^- name:\s*(.*?)\s*$/.exec(line);
+    if (nameMatch) {
+      currentName = stripYamlQuotes(nameMatch[1] ?? "");
+      continue;
+    }
+    const descriptionMatch = /^\s+description:\s*(.*?)\s*$/.exec(line);
+    if (descriptionMatch && currentName?.startsWith("scope:")) {
+      if (stripYamlQuotes(descriptionMatch[1] ?? "") !== "") described.push(currentName);
+    }
+  }
+  if (described.length === 0) return true;
+  return {
+    ok: false,
+    detail: `scope labels with a description: ${described.join(", ")}`
+  };
+}
+function stripYamlQuotes(value) {
+  const match = /^(['"])(.*)\1$/.exec(value);
+  return match?.[2] ?? value;
+}
 export {
   COMMON_PRESET_HASH,
   CREATE_GITHUB_RELEASE_WORKFLOW_HASH_MONOREPO,
@@ -420,12 +474,15 @@ export {
   RELEASE_WORKFLOW_HASH_MONOREPO,
   RELEASE_WORKFLOW_HASH_SINGLE,
   SYNC_LABELS_WORKFLOW_HASH,
+  changelogArchivesAreEnabled,
   changelogJsonIsEnabled,
   configFileExportsConfig,
   default_default as default,
   packagesShipChangelog,
+  packagesShipChangelogArchives,
   packagesShipChangelogJson,
   readmeHasReleaseNotesMarkers,
   readmesHaveReleaseNotesMarkers,
-  resolveChangelogJsonOutputPath
+  resolveChangelogJsonOutputPath,
+  scopeLabelsHaveNoDescriptions
 };

package/.readyup/kits/npm-auto-publish.js

@@ -90,6 +90,7 @@ function runNpmJson(args) {
 // .readyup/kits/npm-auto-publish.ts
 var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
+var NO_GITHUB_REMOTE_FIX = "Add an origin remote that points to the GitHub repo, then run this check again";
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -212,10 +213,8 @@ function buildWorkspaceCheck(workspace) {
             const capability = getCachedTrustCapability();
             return capability.ok ? false : capability.detail;
           },
-          check: () => checkTrustedPublisher(displayName),
-          get fix() {
-            return `Run: npm trust github ${displayName} --repo ${getCachedOwnerRepo()} --file ${PUBLISH_WORKFLOW_FILE}`;
-          }
+          check: () => describeTrustedPublisher(getTrustQueryResult(displayName), displayName, getCachedOwnerRepo()),
+          fix: formatTrustCommand(displayName, "<owner>/<repo>")
         }
       ]
     },
@@ -236,25 +235,18 @@ function buildWorkspaceCheck(workspace) {
 function checkProvenanceMatchesVisibility() {
   const workflowPath = ".github/workflows/publish.yaml";
   const content = readFile(workflowPath);
+  const ownerRepo = getCachedOwnerRepo();
+  if (!ownerRepo.ok) {
+    return classifyProvenanceSetting(content, ownerRepo);
+  }
   let visibility;
   try {
-    visibility = isRepoPrivate() ? "private" : "public";
+    visibility = isRepoPrivate(ownerRepo.value) ? "private" : "public";
   } catch {
     visibility = "unknown";
   }
   return classifyProvenanceSetting(content, visibility);
 }
-function checkTrustedPublisher(packageName) {
-  const result = getTrustQueryResult(packageName);
-  switch (result.status) {
-    case "configured":
-      return { ok: true };
-    case "not-configured":
-      return { ok: false, detail: "The npm registry does not list any trusted publisher for this package" };
-    default:
-      return { ok: false, detail: result.detail };
-  }
-}
 function classifyNpmAuth(result) {
   if (result.exitOk) {
     return { status: "authenticated" };
@@ -279,6 +271,9 @@ function classifyProvenanceSetting(workflowContent, visibility) {
       fix: "Check the file's permissions"
     };
   }
+  if (typeof visibility !== "string") {
+    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
+  }
   if (visibility === "unknown") {
     return {
       ok: false,
@@ -336,12 +331,18 @@ function classifyTrustQuery(result, expectedRepo, expectedFile) {
   if (relationships.length === 0) {
     return { status: "not-configured" };
   }
+  if (!expectedRepo.ok) {
+    return {
+      status: "error",
+      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
+    };
+  }
   const isMatch = relationships.some(
-    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo && relationship.file === expectedFile
+    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
   );
   return isMatch ? { status: "configured" } : {
     status: "mismatched",
-    detail: `Expected github ${expectedRepo} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
   };
 }
 function describeNpmPackageLookup(lookup) {
@@ -357,6 +358,13 @@ function describeNpmPackageLookup(lookup) {
     fix: "Restore access to the npm registry, then run this check again"
   };
 }
+function describeTrustedPublisher(result, packageName, ownerRepo) {
+  if (result.status === "configured") {
+    return { ok: true };
+  }
+  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
+  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
+}
 function describeTrustRelationships(relationships) {
   return relationships.map((relationship) => {
     const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
@@ -365,32 +373,21 @@ function describeTrustRelationships(relationships) {
     return `${type} ${repository} (${file})`;
   }).join(", ");
 }
+function formatTrustCommand(packageName, ownerRepo) {
+  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
+}
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
 })();
 var getCachedOwnerRepo = /* @__PURE__ */ (() => {
   let cached;
-  return () => cached ??= getOwnerRepo();
+  return () => cached ??= resolveOwnerRepo();
 })();
 var getCachedTrustCapability = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= resolveTrustCapability();
 })();
-function getOwnerRepo() {
-  const url = execSync("git remote get-url origin", {
-    encoding: "utf8"
-  }).trim();
-  const sshMatch = url.match(/git@github\.com:(.+?)(?:\.git)?$/);
-  if (sshMatch?.[1]) {
-    return sshMatch[1];
-  }
-  const httpsMatch = url.match(/github\.com\/(.+?)(?:\.git)?$/);
-  if (httpsMatch?.[1]) {
-    return httpsMatch[1];
-  }
-  throw new Error(`Cannot parse GitHub owner/repo from remote URL: ${url}`);
-}
 var trustQueryResults = /* @__PURE__ */ new Map();
 function getTrustQueryResult(packageName) {
   const cached = trustQueryResults.get(packageName);
@@ -419,13 +416,17 @@ function hasTokenReferences() {
   }
   return false;
 }
-function isRepoPrivate() {
-  const ownerRepo = getOwnerRepo();
+function isRepoPrivate(ownerRepo) {
   const result = execSync(`gh api repos/${ownerRepo} --jq .private`, {
     encoding: "utf8"
   }).trim();
   return result === "true";
 }
+function parseGitHubOwnerRepo(url) {
+  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
+  const ownerRepo = match?.[1];
+  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
+}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
@@ -449,6 +450,15 @@ function readTrustRelationships(stdout) {
   }
   return "type" in parsed ? [parsed] : [];
 }
+function resolveOwnerRepo() {
+  let url;
+  try {
+    url = execSync("git remote get-url origin", { encoding: "utf8", stdio: "pipe" }).trim();
+  } catch {
+    return { ok: false, detail: "The repo does not have a readable origin remote" };
+  }
+  return parseGitHubOwnerRepo(url);
+}
 function resolveTrustCapability() {
   const auth = getCachedNpmAuthStatus();
   return classifyTrustCapability(auth, auth.status === "authenticated" ? probeTrustQuery() : void 0);
@@ -473,7 +483,9 @@ export {
   classifyTrustQuery,
   npm_auto_publish_default as default,
   describeNpmPackageLookup,
+  describeTrustedPublisher,
   packagesChecklist,
+  parseGitHubOwnerRepo,
   selectProbeName,
   skipIfNotPublishable,
   skipIfNothingPublishable

package/.readyup/manifest.json

@@ -8,18 +8,23 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "dee24ab4",
+          "hash": "a9f00459",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "4aa0967e",
+          "hash": "d9e9e87f",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
             "version"
           ]
         },
+        {
+          "hash": "40404aa0",
+          "kind": "module",
+          "path": "../src/changelogArchive.ts"
+        },
         {
           "hash": "43bb0452",
           "kind": "module",
@@ -45,8 +50,8 @@
       "path": "kits/default.js",
       "readyupVersion": "0.40.0",
       "source": "kits/default.ts",
-      "sourceHash": "dee24ab4",
-      "targetHash": "25d17b58"
+      "sourceHash": "a9f00459",
+      "targetHash": "6119af3f"
     },
     {
       "checklists": [
@@ -56,7 +61,7 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "70c0bb99",
+          "hash": "79c773cf",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         },
@@ -80,8 +85,8 @@
       "path": "kits/npm-auto-publish.js",
       "readyupVersion": "0.40.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "70c0bb99",
-      "targetHash": "d97d6123"
+      "sourceHash": "79c773cf",
+      "targetHash": "38ddb04a"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,45 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.2.1 — 2026-10-13
+
+### 📦 Dependencies
+
+- Bumped `@williamthorsen/change-grammar` to 0.2.1
+
+## 14.2.0 — 2026-10-12
+
+### 🎉 Features
+
+- Adds an optional `aliases` array to a `repoLabels.labels` entry, which `sync-labels` writes to `.github/labels.yaml` so that the sync renames each existing label named by an alias to the entry's name and keeps it on the issues and pull requests that have it. (#1015)
+- Makes `release-kit sync-labels` reject a config whose alias names a label that the config resolves or appears twice, because the sync would otherwise merge one declared label into another and delete it. (#1015)
+- Adds the `confidence:high` ("Clearly worth doing"), `confidence:medium` ("Worth doing, but arguable"), and `confidence:low` ("Not worth a ticket now") labels to the `common` preset of `release-kit sync-labels`, and documents in `docs/labels.md` that the family grades how advisable a recommendation is. (#1019)
+- Adds a warning to the `release-kit` readyup kit that names each `scope:` label in `.github/labels.yaml` with a non-empty description, archived labels included, because GitHub's label list groups scope labels compactly only when they have no description. (#1022)
+- Adds the `releases` block to `.config/release-kit.config.ts`, in which an entry renames a discovered workspace's release target, excludes the workspace with `false`, or declares a composite of named members that the root `package.json` versions, as an alternative to the `workspaces` and `project` blocks, which keep working unchanged. (#1028)
+- Lets `release-kit prepare --only` select a `releases` composite by its target name, and makes a narrowed run that leaves the composite out skip it with a warning that names it. (#1028)
+- Adds directory release targets to `release-kit`: A `releases` entry whose `path` is not a workspace now declares a target that `prepare` versions from the directory's `package.json` or `version.json`, whose `CHANGELOG.md` `prepare` writes, and whose tags `push` and `create-github-release` handle, while `publish` skips them because a directory does not have any package to publish to npm. (#1029)
+- Adds the repo-root target `{ path: '.' }`, which versions the root `package.json`, tags `v{version}`, and writes every commit in the repo to `./CHANGELOG.md`, replacing a `project` block whose window covered the whole repo only while every workspace was excluded. (#1029)
+- Adds the `changelogMarkdown.keepVersions` config option, which makes `prepare` write only the newest `keepVersions` sections to `CHANGELOG.md`, with links to `changelogs/CHANGELOG-v{major}.md` archive files that contain the older sections, and delete any archive file that is no longer needed after the option is raised or removed. (#1031)
+- Extends `prepare` to read hand-written sections from the `changelogs/` archive files as well as from `CHANGELOG.md`, so that an archived section written by hand is kept when the changelog is regenerated. (#1031)
+- Adds the warning "published packages ship the changelog archives" to the release-kit readyup kit, which reports each publishable package whose `files` field omits `changelogs/` while `keepVersions` is set, because the links in `CHANGELOG.md` to the archive files would otherwise be broken in the published package. (#1031)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the `npm-auto-publish` kit crashed without reporting any results in a repo whose `origin` remote is missing or does not point to GitHub, and makes its trusted-publisher and provenance checks name that cause and advise adding the remote. (#1018)
+- Fixes the issue that `release-kit prepare` accepted two workspaces whose directories share a name, which `--only` and the dependency graph use to identify a workspace, and makes `prepare` and `release-kit overrides validate` stop with an error that lists the path of each. (#1026)
+- Fixes the issue that `release-kit push` never pushed the project tag on HEAD, and failed with `HEAD does not have any release tags.` when the project tag was the only release tag. (#1027)
+- Fixes the issue that `release-kit create-github-release` did not create a GitHub Release for the project tag; a private workspace's tag is still skipped. (#1027)
+- Makes `release-kit publish` skip a project tag named by `--tags` with the warning `Skipping v0.13.0: a project tag is not an npm package.`, since the project does not have an npm package to publish. (#1027)
+
+### ♻️ Refactoring
+
+- Replaces `releasePrepare`, `releasePrepareMono`, and `releasePrepareProject` with `releasePrepareTargets`, which prepares a release from one list of package and project targets resolved from any config shape. (#1026)
+
+### 📚 Documentation
+
+- Rewrites `docs/api.md` to describe what the `.` and `./config` entries export, and drops its sections on `deriveWorkspaceConfig`, the script-based approach, and `resolveReleaseTags`, none of which the package exports. (#1026)
+- Documents in `docs/project-releases.md` the tag pattern that a scaffolded `create-github-release.yaml` needs in order to trigger on a project tag, because its default `'*-v[0-9]*.[0-9]*.[0-9]*'` filter does not match a `v<version>` tag. (#1027)
+
 ## 14.1.0 — 2026-10-11
 
 ### 🎉 Features

package/README.md

@@ -6,21 +6,7 @@ Version-bumping and changelog-generation toolkit for release workflows.
 
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
-<!-- section:release-notes -->
-## Release notes — v14.1.0 (2026-10-11)
-
-### 🎉 Features
-
-- Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
-- Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
-- Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
-
-### 🐛 Bug fixes
-
-- Fixes the issue that the `npm-auto-publish` kit's "published to npm" check reported a failed lookup, such as an unreachable registry or an authentication error, as an unpublished package and ignored `publishConfig.registry`. (#996)
-- Fixes the issue that release-kit's changelog generation treated a floating major tag such as `v1` as a release and added a spurious release to the history, by counting a tag only when the rest of its name after the prefix is a complete SemVer version such as `1.0.0` or `1.0.0-beta.1`. (#1000)
-- Fixes the issue that `release-kit show-tag-prefixes` counted every tag that starts with a workspace's prefix, including floating pointers such as `core-v1` and non-release tags such as `core-vnext`, rather than only the tags that release-kit counts as releases. (#1000)
-<!-- /section:release-notes -->
+<!-- section:release-notes --><!-- /section:release-notes -->
 
 ## Installation
 
@@ -176,4 +162,4 @@ rdy run --sources
 - [Work types and tiers](docs/work-types.md): Tiers, the `!` policy, markers, and custom work types
 - [Labels](docs/labels.md): `sync-labels`, label configuration, the workflow's triggers, and where the `label-map.json` schema is published
 - [Readiness checks](docs/readiness-checks.md): Both readyup kits, and how to run each
-- [Programmatic API](docs/api.md): `deriveWorkspaceConfig()`, the script-based approach, and `resolveReleaseTags`
+- [Programmatic API](docs/api.md): `defineConfig()` for typing a config file, and validating override files from code

package/dist/esm/assertTaggedBaseline.d.ts

@@ -1,4 +1,4 @@
-import type { ReleaseConfig } from './types.js';
+import type { ReleaseSettings } from './types.js';
 /** A release target whose history `prepare` has read, as the baseline check sees it. */
 export interface BaselineTarget {
     /** How the error names the target, such as `workspace 'core'`. */
@@ -26,4 +26,4 @@ export declare function assertTaggedBaseline(findings: ReadonlyArray<UntaggedBas
  * `changelog.json` files, and its previous tag is not that version under any of its prefixes. A first release has
  * none, because its changelogs do not record its version yet.
  */
-export declare function findUntaggedBaseline(target: BaselineTarget, config: Pick<ReleaseConfig, 'changelogJson'>): UntaggedBaseline | undefined;
+export declare function findUntaggedBaseline(target: BaselineTarget, config: Pick<ReleaseSettings, 'changelogJson'>): UntaggedBaseline | undefined;

package/dist/esm/attachChangelogDiagnostics.d.ts

@@ -1,4 +1,4 @@
 import type { ChangelogDiagnostics } from './buildChangelogEntries.js';
-import type { ReleasedWorkspaceResult } from './types.js';
+import type { ReleasedPackageResult } from './types.js';
 /** Attaches a history's diagnostics to a released or skipped result, omitting each empty list. */
-export declare function attachChangelogDiagnostics(result: Pick<ReleasedWorkspaceResult, 'malformedBlocks' | 'policyViolations' | 'undeclaredEntryTypes' | 'unroutedEntryScopes'>, diagnostics: ChangelogDiagnostics): void;
+export declare function attachChangelogDiagnostics(result: Pick<ReleasedPackageResult, 'malformedBlocks' | 'policyViolations' | 'undeclaredEntryTypes' | 'unroutedEntryScopes'>, diagnostics: ChangelogDiagnostics): void;

package/dist/esm/bin/release-kit.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { parseArgsOrExit, readPackageVersion, reportError } from '@williamthorsen/nmr-core';
+import { parseArgsOrExit, reportError, resolveSelfVersion } from '@williamthorsen/nmr-core';
 import { describeError } from '@williamthorsen/toolbelt.errors';
 import { commitCommand } from "../commitCommand.js";
 import { configFlagSchema } from "../configFlagSchema.js";
@@ -19,7 +19,7 @@ import { syncLabelsInitCommand } from "../sync-labels/initCommand.js";
 import { syncLabelsCommand } from "../sync-labels/syncCommand.js";
 import { tagCommand } from "../tagCommand.js";
 import { validateOverridesCommand } from "../validateOverridesCommand.js";
-const VERSION = readPackageVersion(import.meta.url);
+const VERSION = resolveSelfVersion(import.meta.url);
 function showUsage() {
     console.info(`
 Usage: release-kit <command> [options]
@@ -180,7 +180,8 @@ Usage: release-kit create-github-release [options]
 
 Create GitHub Releases from changelog.json for tags on HEAD. Private
 (package.json#private) workspaces are skipped with a warning, and the command
-doesn't create a Release for them.
+doesn't create a Release for them. A project tag gets a Release even when the
+root package is private.
 
 Options:
   --config <path>        Config file, relative to the current directory
@@ -244,7 +245,7 @@ Usage: release-kit publish [options]
 Publish packages that have release tags on HEAD. Operates only on workspaces whose
 package.json#private is absent or false. Without --tags, unpublishable workspaces are
 silently filtered out. With --tags, an unpublishable tag is skipped with a warning while
-any publishable tags are still published.
+any publishable tags are still published. A project tag is never published.
 
 Options:
   --config <path>        Config file, relative to the current directory