@williamthorsen/release-kit 14.2.1 → 14.2.3

package/.readyup/kits/npm-auto-publish.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.40.0";
+export const __readyupVersion = "0.42.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
@@ -13,16 +13,10 @@ import {
   fileContains,
   fileExists,
   getJsonValue,
-  isRecord as isRecord2,
   readFile,
   readJsonFile
 } from "readyup/check-utils";
 
-// src/init/hasProvenance.ts
-function hasProvenance(workflowContent) {
-  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
-}
-
 // src/npmRegistry.ts
 import { execFileSync } from "node:child_process";
 
@@ -87,10 +81,169 @@ function runNpmJson(args) {
   }
 }
 
-// .readyup/kits/npm-auto-publish.ts
+// .readyup/lib/npm-trust.ts
+import { isRecord as isRecord2 } from "readyup/check-utils";
+
+// src/init/hasProvenance.ts
+function hasProvenance(workflowContent) {
+  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
+}
+
+// .readyup/lib/npm-trust.ts
 var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var NO_GITHUB_REMOTE_FIX = "Add an origin remote that points to the GitHub repo, then run this check again";
+function classifyNpmAuth(result) {
+  if (result.exitOk) {
+    return { status: "authenticated" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unreachable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unauthenticated", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unreachable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function classifyProvenanceSetting(workflowContent, visibility) {
+  if (workflowContent === void 0) {
+    return {
+      ok: false,
+      detail: "Cannot read .github/workflows/publish.yaml",
+      fix: "Check the file's permissions"
+    };
+  }
+  if (typeof visibility !== "string") {
+    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
+  }
+  if (visibility === "unknown") {
+    return {
+      ok: false,
+      detail: "The GitHub CLI could not report the repo's visibility",
+      fix: "Install and authenticate the GitHub CLI: gh auth login"
+    };
+  }
+  const provenance = hasProvenance(workflowContent);
+  if (visibility === "public" && !provenance) {
+    return {
+      ok: false,
+      detail: "The repo is public and publish.yaml does not set provenance: true",
+      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
+    };
+  }
+  if (visibility === "private" && provenance) {
+    return {
+      ok: false,
+      detail: "The repo is private and publish.yaml sets provenance: true",
+      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
+    };
+  }
+  return { ok: true };
+}
+function classifyTrustCapability(auth, probe) {
+  if (auth.status !== "authenticated") {
+    return { ok: false, detail: auth.detail };
+  }
+  return probe?.status === "unanswerable" ? { ok: false, detail: probe.detail } : { ok: true };
+}
+function classifyTrustQuery(result, expectedRepo, expectedFile) {
+  if (!result.exitOk) {
+    const error = readNpmError(result.stdout);
+    if (error === void 0) {
+      return { status: "error", detail: "The npm trust query failed without a readable error payload" };
+    }
+    if (error.code === "E404") {
+      return { status: "not-configured" };
+    }
+    if (AUTH_ERROR_CODES.has(error.code) || error.code === OTP_ERROR_CODE) {
+      return {
+        status: "unanswerable",
+        detail: `The npm session cannot answer trust queries (${error.code}): ${error.summary}`
+      };
+    }
+    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+      return { status: "unanswerable", detail: `Cannot reach the npm registry (${error.code})` };
+    }
+    return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
+  }
+  const relationships = readTrustRelationships(result.stdout);
+  if (relationships === void 0) {
+    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
+  }
+  if (relationships.length === 0) {
+    return { status: "not-configured" };
+  }
+  if (!expectedRepo.ok) {
+    return {
+      status: "error",
+      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
+    };
+  }
+  const isMatch = relationships.some(
+    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
+  );
+  return isMatch ? { status: "configured" } : {
+    status: "mismatched",
+    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+  };
+}
+function describeNpmPackageLookup(lookup) {
+  if (lookup.status === "published") {
+    return { ok: true };
+  }
+  if (lookup.status === "unpublished") {
+    return { ok: false, detail: "The npm registry does not list this package" };
+  }
+  return {
+    ok: false,
+    detail: lookup.detail,
+    fix: "Restore access to the npm registry, then run this check again"
+  };
+}
+function describeTrustedPublisher(result, packageName, ownerRepo) {
+  if (result.status === "configured") {
+    return { ok: true };
+  }
+  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
+  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
+}
+function formatTrustCommand(packageName, ownerRepo) {
+  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
+}
+function parseGitHubOwnerRepo(url) {
+  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
+  const ownerRepo = match?.[1];
+  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
+}
+function describeTrustRelationships(relationships) {
+  return relationships.map((relationship) => {
+    const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
+    const repository = typeof relationship.repository === "string" ? relationship.repository : "(unknown)";
+    const file = typeof relationship.file === "string" ? relationship.file : "(unknown)";
+    return `${type} ${repository} (${file})`;
+  }).join(", ");
+}
+function readTrustRelationships(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (Array.isArray(parsed)) {
+    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
+  }
+  if (!isRecord2(parsed)) {
+    return void 0;
+  }
+  return "type" in parsed ? [parsed] : [];
+}
+
+// .readyup/kits/npm-auto-publish.ts
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -139,25 +292,28 @@ var packagesChecklist = defineRdyChecklist({
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  // The session gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust
-  // queries suppresses only the trusted-publisher rows and leaves the package.json checks reporting. The gate's skip
-  // therefore does not cover the rows, and this getter omits them for a repo that publishes nothing.
-  get checks() {
-    const sessionCheck = buildSessionCheck();
-    if (skipIfNothingPublishable() !== false) {
-      return [sessionCheck];
+  checks: [
+    {
+      name: "Repo publishes at least one package",
+      skip: () => skipIfNothingPublishable(),
+      check: () => true,
+      // Built when the checklist runs, so that the kit declares the same checks wherever it is imported. The session
+      // gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust queries
+      // suppresses only the trusted-publisher rows and leaves the package.json checks reporting.
+      checks: () => [
+        buildSessionCheck(),
+        ...discoverWorkspaces({ filter: belongsInPackagesChecklist }).map(
+          (workspace) => buildWorkspaceCheck(workspace)
+        )
+      ]
     }
-    return [
-      sessionCheck,
-      ...discoverWorkspaces({ filter: belongsInPackagesChecklist }).map((workspace) => buildWorkspaceCheck(workspace))
-    ];
-  }
+  ]
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
-  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. Because an
-  // older runner drops that `fix` silently, failing to load the kit is the lesser harm.
-  minReadyupVersion: "0.37.0",
+  // The release that introduced a function-valued `checks`, which builds the per-package rows. An older runner rejects
+  // it when validating the kit.
+  minReadyupVersion: "0.42.0",
   checklists: [repoChecklist, packagesChecklist]
 });
 function belongsInPackagesChecklist(workspace) {
@@ -166,7 +322,6 @@ function belongsInPackagesChecklist(workspace) {
 function buildSessionCheck() {
   return {
     name: "npm session can answer trust queries",
-    skip: () => skipIfNothingPublishable(),
     check: () => {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
@@ -202,7 +357,7 @@ function buildWorkspaceCheck(workspace) {
       // as unpublished would advise publishing a package that is already there.
       skip: () => {
         const auth = getCachedNpmAuthStatus();
-        return auth.status === "unreachable" ? auth.detail : false;
+        return auth.status === "unreachable" && auth.detail;
       },
       check: () => describeNpmPackageLookup(lookUpNpmPackage(displayName, readPublishRegistry(workspace))),
       fix: `Run "npm publish --access public" from ${workspace.dir} to bootstrap the package on npm`,
@@ -211,7 +366,7 @@ function buildWorkspaceCheck(workspace) {
           name: "trusted publisher configured",
           skip: () => {
             const capability = getCachedTrustCapability();
-            return capability.ok ? false : capability.detail;
+            return !capability.ok && capability.detail;
           },
           check: () => describeTrustedPublisher(getTrustQueryResult(displayName), displayName, getCachedOwnerRepo()),
           fix: formatTrustCommand(displayName, "<owner>/<repo>")
@@ -247,135 +402,6 @@ function checkProvenanceMatchesVisibility() {
   }
   return classifyProvenanceSetting(content, visibility);
 }
-function classifyNpmAuth(result) {
-  if (result.exitOk) {
-    return { status: "authenticated" };
-  }
-  const error = readNpmError(result.stdout);
-  if (error === void 0) {
-    return { status: "unreachable", detail: "The npm registry query failed without a readable error payload" };
-  }
-  if (AUTH_ERROR_CODES.has(error.code)) {
-    return { status: "unauthenticated", detail: `The npm registry rejected the session (${error.code})` };
-  }
-  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
-    return { status: "unreachable", detail: `Cannot reach the npm registry (${error.code})` };
-  }
-  return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
-}
-function classifyProvenanceSetting(workflowContent, visibility) {
-  if (workflowContent === void 0) {
-    return {
-      ok: false,
-      detail: "Cannot read .github/workflows/publish.yaml",
-      fix: "Check the file's permissions"
-    };
-  }
-  if (typeof visibility !== "string") {
-    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
-  }
-  if (visibility === "unknown") {
-    return {
-      ok: false,
-      detail: "The GitHub CLI could not report the repo's visibility",
-      fix: "Install and authenticate the GitHub CLI: gh auth login"
-    };
-  }
-  const provenance = hasProvenance(workflowContent);
-  if (visibility === "public" && !provenance) {
-    return {
-      ok: false,
-      detail: "The repo is public and publish.yaml does not set provenance: true",
-      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
-    };
-  }
-  if (visibility === "private" && provenance) {
-    return {
-      ok: false,
-      detail: "The repo is private and publish.yaml sets provenance: true",
-      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
-    };
-  }
-  return { ok: true };
-}
-function classifyTrustCapability(auth, probe) {
-  if (auth.status !== "authenticated") {
-    return { ok: false, detail: auth.detail };
-  }
-  return probe?.status === "unanswerable" ? { ok: false, detail: probe.detail } : { ok: true };
-}
-function classifyTrustQuery(result, expectedRepo, expectedFile) {
-  if (!result.exitOk) {
-    const error = readNpmError(result.stdout);
-    if (error === void 0) {
-      return { status: "error", detail: "The npm trust query failed without a readable error payload" };
-    }
-    if (error.code === "E404") {
-      return { status: "not-configured" };
-    }
-    if (AUTH_ERROR_CODES.has(error.code) || error.code === OTP_ERROR_CODE) {
-      return {
-        status: "unanswerable",
-        detail: `The npm session cannot answer trust queries (${error.code}): ${error.summary}`
-      };
-    }
-    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
-      return { status: "unanswerable", detail: `Cannot reach the npm registry (${error.code})` };
-    }
-    return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
-  }
-  const relationships = readTrustRelationships(result.stdout);
-  if (relationships === void 0) {
-    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
-  }
-  if (relationships.length === 0) {
-    return { status: "not-configured" };
-  }
-  if (!expectedRepo.ok) {
-    return {
-      status: "error",
-      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
-    };
-  }
-  const isMatch = relationships.some(
-    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
-  );
-  return isMatch ? { status: "configured" } : {
-    status: "mismatched",
-    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
-  };
-}
-function describeNpmPackageLookup(lookup) {
-  if (lookup.status === "published") {
-    return { ok: true };
-  }
-  if (lookup.status === "unpublished") {
-    return { ok: false, detail: "The npm registry does not list this package" };
-  }
-  return {
-    ok: false,
-    detail: lookup.detail,
-    fix: "Restore access to the npm registry, then run this check again"
-  };
-}
-function describeTrustedPublisher(result, packageName, ownerRepo) {
-  if (result.status === "configured") {
-    return { ok: true };
-  }
-  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
-  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
-}
-function describeTrustRelationships(relationships) {
-  return relationships.map((relationship) => {
-    const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
-    const repository = typeof relationship.repository === "string" ? relationship.repository : "(unknown)";
-    const file = typeof relationship.file === "string" ? relationship.file : "(unknown)";
-    return `${type} ${repository} (${file})`;
-  }).join(", ");
-}
-function formatTrustCommand(packageName, ownerRepo) {
-  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
-}
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
@@ -422,11 +448,6 @@ function isRepoPrivate(ownerRepo) {
   }).trim();
   return result === "true";
 }
-function parseGitHubOwnerRepo(url) {
-  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
-  const ownerRepo = match?.[1];
-  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
-}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
@@ -435,21 +456,6 @@ function readPublishRegistry(workspace) {
   const registry = getJsonValue(workspace.packageJson, "publishConfig", "registry");
   return typeof registry === "string" ? registry : void 0;
 }
-function readTrustRelationships(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout);
-  } catch {
-    return void 0;
-  }
-  if (Array.isArray(parsed)) {
-    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
-  }
-  if (!isRecord2(parsed)) {
-    return void 0;
-  }
-  return "type" in parsed ? [parsed] : [];
-}
 function resolveOwnerRepo() {
   let url;
   try {
@@ -470,22 +476,15 @@ function selectProbeName() {
 }
 function skipIfNothingPublishable() {
   const publishable = discoverWorkspaces({ filter: (workspace) => workspace.isPackage });
-  return publishable.length > 0 ? false : "no publishable packages";
+  return publishable.length === 0 && "no publishable packages";
 }
 function skipIfNotPublishable(workspace) {
-  return workspace.isPackage ? false : "package.json#private is true";
+  return !workspace.isPackage && "package.json#private is true";
 }
 export {
   buildWorkspaceCheck,
-  classifyNpmAuth,
-  classifyProvenanceSetting,
-  classifyTrustCapability,
-  classifyTrustQuery,
   npm_auto_publish_default as default,
-  describeNpmPackageLookup,
-  describeTrustedPublisher,
   packagesChecklist,
-  parseGitHubOwnerRepo,
   selectProbeName,
   skipIfNotPublishable,
   skipIfNothingPublishable

package/.readyup/manifest.json

@@ -2,18 +2,68 @@
   "version": 1,
   "kits": [
     {
+      "checklistChecks": [
+        {
+          "checklist": "release-kit",
+          "checks": [
+            "@williamthorsen/release-kit in devDependencies",
+            "@williamthorsen/release-kit >= 14.2.3",
+            "release.yaml workflow exists",
+            "release.yaml matches template",
+            "release.yaml does not reference deprecated tag ref",
+            "publish.yaml workflow exists",
+            "publish.yaml matches template",
+            "publish.yaml does not reference deprecated tag ref",
+            "create-github-release.yaml matches template",
+            ".config/release-kit.config.ts exports a config",
+            "releaseNotes config is consistent with changelogJson",
+            ".config/release-kit.config.ts uses defineConfig",
+            "releaseNotes.shouldInjectIntoReadme is true",
+            "README contains release-notes section markers",
+            "repoLabels block declared in .config/release-kit.config.ts",
+            ".github/labels.yaml exists",
+            "labels.yaml has current common preset",
+            "scope labels in .github/labels.yaml have no description",
+            "published packages ship CHANGELOG.md",
+            "published packages ship the changelog archives",
+            "changelog.json generation is enabled",
+            "published packages ship the changelog JSON",
+            "config does not use removed releaseNotes.shouldCreateGithubRelease",
+            "@changesets/cli not in devDependencies",
+            "sync-labels.yaml workflow exists",
+            "sync-labels.yaml matches template",
+            "sync-labels.yaml does not reference deprecated tag ref",
+            "retired .config/sync-labels.config.ts is absent"
+          ]
+        }
+      ],
       "checklists": [
         "release-kit"
       ],
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "a9f00459",
+          "hash": "ad3666b8",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "d9e9e87f",
+          "hash": "45fc235f",
+          "kind": "module",
+          "path": "lib/changelog-checks.ts"
+        },
+        {
+          "hash": "be2c2cb3",
+          "kind": "module",
+          "path": "lib/config-checks.ts"
+        },
+        {
+          "hash": "290731d6",
+          "kind": "module",
+          "path": "lib/workflow-hashes.ts"
+        },
+        {
+          "hash": "b89073b8",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -48,12 +98,31 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.40.0",
+      "readyupVersion": "0.42.0",
       "source": "kits/default.ts",
-      "sourceHash": "a9f00459",
-      "targetHash": "6119af3f"
+      "sourceHash": "ad3666b8",
+      "targetHash": "9f5a50d9"
     },
     {
+      "checklistChecks": [
+        {
+          "checklist": "repo",
+          "checks": [
+            "publish.yaml exists",
+            "id-token: write permission declared",
+            "No legacy token references in workflow files",
+            "Provenance setting matches repo visibility"
+          ]
+        },
+        {
+          "checklist": "packages",
+          "checks": [
+            "packageManager field starts with \"pnpm\"",
+            "At least one workspace discovered",
+            "Repo publishes at least one package"
+          ]
+        }
+      ],
       "checklists": [
         "repo",
         "packages"
@@ -61,10 +130,15 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "79c773cf",
+          "hash": "682fdd4a",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         },
+        {
+          "hash": "05215737",
+          "kind": "module",
+          "path": "lib/npm-trust.ts"
+        },
         {
           "hash": "d360febf",
           "kind": "module",
@@ -83,10 +157,10 @@
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.40.0",
+      "readyupVersion": "0.42.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "79c773cf",
-      "targetHash": "38ddb04a"
+      "sourceHash": "682fdd4a",
+      "targetHash": "04adb134"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,30 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.2.3 — 2026-10-18
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the manifest of the `npm-auto-publish` kit recorded a different list of checks depending on the directory from which `rdy compile` ran, by declaring one fixed check, "Repo publishes at least one package", under which `rdy run` builds the npm session check and the per-package rows. (#1081)
+
+### ♻️ Refactoring
+
+- Splits `types.ts`, `loadConfig.ts`, `changelogOverrides.ts`, and `buildChangelogEntries.ts` to bring each under the 300-line `max-lines` limit, moving the config zod schemas into `configSchema.ts`, config merging into `mergeConfig.ts`, the cross-target checks into `monorepoConfigAssertions.ts`, override parsing, application, and repo-wide validation into `loadChangelogOverrides.ts`, `applyChangelogOverrides.ts`, and `validateAllChangelogOverrides.ts`, and changelog-item construction into `buildChangelogItem.ts`. (#1067)
+- Splits the `release-kit` bin, the `prepare` pipeline (`prepareCommand`, `prepareTarget`, `releasePrepareTargets`, and `reportPrepare`), and the `default` and `npm-auto-publish` readyup kits into smaller modules under `src`, `src/help`, and `.readyup/lib`, and recompiles the kit bundles without changing their check lists. (#1069)
+- Rewrites the code that the new and widened rules in `eslint-plugin-unicorn` 78 report, mostly by changing `flatMap` callbacks to return a single value rather than a one-element array. (#1072)
+
+### 🧪 Tests
+
+- Splits the `release-kit` unit tests for `releasePrepareTargets`, `reportPrepare`, `prepareCommand`, `publishCommand`, `parseCommitMessage`, and `validateConfig` into `<subject>.<aspect>.unit.test.ts` files that each stay under the `max-lines` limit, and moves the mocks and fixtures that the split files share into modules under `src/test-utils/`. (#1066)
+
+## 14.2.2 — 2026-10-17
+
+### 📦 Dependencies
+
+- Upgrades `@williamthorsen/eslint-config-typescript` from 18.0.0 to 19.0.0 and rewrites the code in `build-info`, `nmr-core`, `nmr`, and `release-kit` that its new and widened rules report, without changing behavior. (#1047)
+- Upgrades `readyup` from 0.40.0 to 0.41.0 and recompiles the kits in `nmr`, `release-kit`, and `v11y-check`, whose manifests now record each checklist's check names under `checklistChecks`. (#1047)
+- Upgrades `pnpm` to 12.11.2, `@types/node` to 24.19.2, `lefthook` to 2.2.1, `@williamthorsen/strict-lint` to 14.2.0, `@williamthorsen/tsconfig` to 0.11.0, `smol-toml` to 1.9.1, and `vite` to 8.3.4. (#1047)
+
 ## 14.2.1 — 2026-10-13
 
 ### 📦 Dependencies

package/README.md

@@ -6,7 +6,13 @@ Version-bumping and changelog-generation toolkit for release workflows.
 
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
-<!-- section:release-notes --><!-- /section:release-notes -->
+<!-- section:release-notes -->
+## Release notes — v14.2.3 (2026-10-18)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the manifest of the `npm-auto-publish` kit recorded a different list of checks depending on the directory from which `rdy compile` ran, by declaring one fixed check, "Repo publishes at least one package", under which `rdy run` builds the npm session check and the per-package rows. (#1081)
+<!-- /section:release-notes -->
 
 ## Installation