@williamthorsen/release-kit 14.2.2 → 14.2.4

package/.readyup/kits/npm-auto-publish.js

@@ -1,6 +1,6 @@
 /** @noformat -- @generated. Do not edit. Compiled by rdy. */
 /* eslint-disable */
-export const __readyupVersion = "0.41.0";
+export const __readyupVersion = "0.42.0";
 
 
 // .readyup/kits/npm-auto-publish.ts
@@ -13,16 +13,10 @@ import {
   fileContains,
   fileExists,
   getJsonValue,
-  isRecord as isRecord2,
   readFile,
   readJsonFile
 } from "readyup/check-utils";
 
-// src/init/hasProvenance.ts
-function hasProvenance(workflowContent) {
-  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
-}
-
 // src/npmRegistry.ts
 import { execFileSync } from "node:child_process";
 
@@ -87,10 +81,169 @@ function runNpmJson(args) {
   }
 }
 
-// .readyup/kits/npm-auto-publish.ts
+// .readyup/lib/npm-trust.ts
+import { isRecord as isRecord2 } from "readyup/check-utils";
+
+// src/init/hasProvenance.ts
+function hasProvenance(workflowContent) {
+  return /^[^#]*provenance:\s*['"]?true['"]?/im.test(workflowContent);
+}
+
+// .readyup/lib/npm-trust.ts
 var OTP_ERROR_CODE = "EOTP";
 var PUBLISH_WORKFLOW_FILE = "publish.yaml";
 var NO_GITHUB_REMOTE_FIX = "Add an origin remote that points to the GitHub repo, then run this check again";
+function classifyNpmAuth(result) {
+  if (result.exitOk) {
+    return { status: "authenticated" };
+  }
+  const error = readNpmError(result.stdout);
+  if (error === void 0) {
+    return { status: "unreachable", detail: "The npm registry query failed without a readable error payload" };
+  }
+  if (AUTH_ERROR_CODES.has(error.code)) {
+    return { status: "unauthenticated", detail: `The npm registry rejected the session (${error.code})` };
+  }
+  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+    return { status: "unreachable", detail: `Cannot reach the npm registry (${error.code})` };
+  }
+  return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
+}
+function classifyProvenanceSetting(workflowContent, visibility) {
+  if (workflowContent === void 0) {
+    return {
+      ok: false,
+      detail: "Cannot read .github/workflows/publish.yaml",
+      fix: "Check the file's permissions"
+    };
+  }
+  if (typeof visibility !== "string") {
+    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
+  }
+  if (visibility === "unknown") {
+    return {
+      ok: false,
+      detail: "The GitHub CLI could not report the repo's visibility",
+      fix: "Install and authenticate the GitHub CLI: gh auth login"
+    };
+  }
+  const provenance = hasProvenance(workflowContent);
+  if (visibility === "public" && !provenance) {
+    return {
+      ok: false,
+      detail: "The repo is public and publish.yaml does not set provenance: true",
+      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
+    };
+  }
+  if (visibility === "private" && provenance) {
+    return {
+      ok: false,
+      detail: "The repo is private and publish.yaml sets provenance: true",
+      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
+    };
+  }
+  return { ok: true };
+}
+function classifyTrustCapability(auth, probe) {
+  if (auth.status !== "authenticated") {
+    return { ok: false, detail: auth.detail };
+  }
+  return probe?.status === "unanswerable" ? { ok: false, detail: probe.detail } : { ok: true };
+}
+function classifyTrustQuery(result, expectedRepo, expectedFile) {
+  if (!result.exitOk) {
+    const error = readNpmError(result.stdout);
+    if (error === void 0) {
+      return { status: "error", detail: "The npm trust query failed without a readable error payload" };
+    }
+    if (error.code === "E404") {
+      return { status: "not-configured" };
+    }
+    if (AUTH_ERROR_CODES.has(error.code) || error.code === OTP_ERROR_CODE) {
+      return {
+        status: "unanswerable",
+        detail: `The npm session cannot answer trust queries (${error.code}): ${error.summary}`
+      };
+    }
+    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
+      return { status: "unanswerable", detail: `Cannot reach the npm registry (${error.code})` };
+    }
+    return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
+  }
+  const relationships = readTrustRelationships(result.stdout);
+  if (relationships === void 0) {
+    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
+  }
+  if (relationships.length === 0) {
+    return { status: "not-configured" };
+  }
+  if (!expectedRepo.ok) {
+    return {
+      status: "error",
+      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
+    };
+  }
+  const isMatch = relationships.some(
+    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
+  );
+  return isMatch ? { status: "configured" } : {
+    status: "mismatched",
+    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
+  };
+}
+function describeNpmPackageLookup(lookup) {
+  if (lookup.status === "published") {
+    return { ok: true };
+  }
+  if (lookup.status === "unpublished") {
+    return { ok: false, detail: "The npm registry does not list this package" };
+  }
+  return {
+    ok: false,
+    detail: lookup.detail,
+    fix: "Restore access to the npm registry, then run this check again"
+  };
+}
+function describeTrustedPublisher(result, packageName, ownerRepo) {
+  if (result.status === "configured") {
+    return { ok: true };
+  }
+  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
+  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
+}
+function formatTrustCommand(packageName, ownerRepo) {
+  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
+}
+function parseGitHubOwnerRepo(url) {
+  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
+  const ownerRepo = match?.[1];
+  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
+}
+function describeTrustRelationships(relationships) {
+  return relationships.map((relationship) => {
+    const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
+    const repository = typeof relationship.repository === "string" ? relationship.repository : "(unknown)";
+    const file = typeof relationship.file === "string" ? relationship.file : "(unknown)";
+    return `${type} ${repository} (${file})`;
+  }).join(", ");
+}
+function readTrustRelationships(stdout) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stdout);
+  } catch {
+    return void 0;
+  }
+  if (Array.isArray(parsed)) {
+    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
+  }
+  if (!isRecord2(parsed)) {
+    return void 0;
+  }
+  return "type" in parsed ? [parsed] : [];
+}
+
+// .readyup/kits/npm-auto-publish.ts
 var repoChecklist = defineRdyChecklist({
   name: "repo",
   checks: [
@@ -139,25 +292,28 @@ var packagesChecklist = defineRdyChecklist({
       fix: "Ensure pnpm-workspace.yaml lists package globs, or that a root package.json exists"
     }
   ],
-  // The session gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust
-  // queries suppresses only the trusted-publisher rows and leaves the package.json checks reporting. The gate's skip
-  // therefore does not cover the rows, and this getter omits them for a repo that publishes nothing.
-  get checks() {
-    const sessionCheck = buildSessionCheck();
-    if (skipIfNothingPublishable() !== false) {
-      return [sessionCheck];
+  checks: [
+    {
+      name: "Repo publishes at least one package",
+      skip: () => skipIfNothingPublishable(),
+      check: () => true,
+      // Built when the checklist runs, so that the kit declares the same checks wherever it is imported. The session
+      // gate is a sibling of the workspace rows, not their parent, so a session that cannot answer trust queries
+      // suppresses only the trusted-publisher rows and leaves the package.json checks reporting.
+      checks: () => [
+        buildSessionCheck(),
+        ...discoverWorkspaces({ filter: belongsInPackagesChecklist }).map(
+          (workspace) => buildWorkspaceCheck(workspace)
+        )
+      ]
     }
-    return [
-      sessionCheck,
-      ...discoverWorkspaces({ filter: belongsInPackagesChecklist }).map((workspace) => buildWorkspaceCheck(workspace))
-    ];
-  }
+  ]
 });
 var npm_auto_publish_default = defineRdyKit({
   fixLocation: "inline",
-  // The release that introduced `CheckOutcome.fix`, on which the provenance check's remediation depends. Because an
-  // older runner drops that `fix` silently, failing to load the kit is the lesser harm.
-  minReadyupVersion: "0.37.0",
+  // The release that introduced a function-valued `checks`, which builds the per-package rows. An older runner rejects
+  // it when validating the kit.
+  minReadyupVersion: "0.42.0",
   checklists: [repoChecklist, packagesChecklist]
 });
 function belongsInPackagesChecklist(workspace) {
@@ -166,7 +322,6 @@ function belongsInPackagesChecklist(workspace) {
 function buildSessionCheck() {
   return {
     name: "npm session can answer trust queries",
-    skip: () => skipIfNothingPublishable(),
     check: () => {
       const capability = getCachedTrustCapability();
       return capability.ok ? { ok: true } : { ok: false, detail: capability.detail };
@@ -247,135 +402,6 @@ function checkProvenanceMatchesVisibility() {
   }
   return classifyProvenanceSetting(content, visibility);
 }
-function classifyNpmAuth(result) {
-  if (result.exitOk) {
-    return { status: "authenticated" };
-  }
-  const error = readNpmError(result.stdout);
-  if (error === void 0) {
-    return { status: "unreachable", detail: "The npm registry query failed without a readable error payload" };
-  }
-  if (AUTH_ERROR_CODES.has(error.code)) {
-    return { status: "unauthenticated", detail: `The npm registry rejected the session (${error.code})` };
-  }
-  if (UNREACHABLE_ERROR_CODES.has(error.code)) {
-    return { status: "unreachable", detail: `Cannot reach the npm registry (${error.code})` };
-  }
-  return { status: "unreachable", detail: `The npm registry query failed (${error.code}): ${error.summary}` };
-}
-function classifyProvenanceSetting(workflowContent, visibility) {
-  if (workflowContent === void 0) {
-    return {
-      ok: false,
-      detail: "Cannot read .github/workflows/publish.yaml",
-      fix: "Check the file's permissions"
-    };
-  }
-  if (typeof visibility !== "string") {
-    return { ok: false, detail: visibility.detail, fix: NO_GITHUB_REMOTE_FIX };
-  }
-  if (visibility === "unknown") {
-    return {
-      ok: false,
-      detail: "The GitHub CLI could not report the repo's visibility",
-      fix: "Install and authenticate the GitHub CLI: gh auth login"
-    };
-  }
-  const provenance = hasProvenance(workflowContent);
-  if (visibility === "public" && !provenance) {
-    return {
-      ok: false,
-      detail: "The repo is public and publish.yaml does not set provenance: true",
-      fix: "Set provenance: true in .github/workflows/publish.yaml; public repos should generate provenance attestations"
-    };
-  }
-  if (visibility === "private" && provenance) {
-    return {
-      ok: false,
-      detail: "The repo is private and publish.yaml sets provenance: true",
-      fix: "Make the GitHub repo public; OIDC publishing with provenance requires a public repo"
-    };
-  }
-  return { ok: true };
-}
-function classifyTrustCapability(auth, probe) {
-  if (auth.status !== "authenticated") {
-    return { ok: false, detail: auth.detail };
-  }
-  return probe?.status === "unanswerable" ? { ok: false, detail: probe.detail } : { ok: true };
-}
-function classifyTrustQuery(result, expectedRepo, expectedFile) {
-  if (!result.exitOk) {
-    const error = readNpmError(result.stdout);
-    if (error === void 0) {
-      return { status: "error", detail: "The npm trust query failed without a readable error payload" };
-    }
-    if (error.code === "E404") {
-      return { status: "not-configured" };
-    }
-    if (AUTH_ERROR_CODES.has(error.code) || error.code === OTP_ERROR_CODE) {
-      return {
-        status: "unanswerable",
-        detail: `The npm session cannot answer trust queries (${error.code}): ${error.summary}`
-      };
-    }
-    if (UNREACHABLE_ERROR_CODES.has(error.code)) {
-      return { status: "unanswerable", detail: `Cannot reach the npm registry (${error.code})` };
-    }
-    return { status: "error", detail: `The npm trust query failed (${error.code}): ${error.summary}` };
-  }
-  const relationships = readTrustRelationships(result.stdout);
-  if (relationships === void 0) {
-    return { status: "error", detail: "The npm trust query returned a payload that this check cannot read" };
-  }
-  if (relationships.length === 0) {
-    return { status: "not-configured" };
-  }
-  if (!expectedRepo.ok) {
-    return {
-      status: "error",
-      detail: `Cannot compare the trusted publisher with this repo; found ${describeTrustRelationships(relationships)}`
-    };
-  }
-  const isMatch = relationships.some(
-    (relationship) => relationship.type === "github" && relationship.repository === expectedRepo.value && relationship.file === expectedFile
-  );
-  return isMatch ? { status: "configured" } : {
-    status: "mismatched",
-    detail: `Expected github ${expectedRepo.value} (${expectedFile}); found ${describeTrustRelationships(relationships)}`
-  };
-}
-function describeNpmPackageLookup(lookup) {
-  if (lookup.status === "published") {
-    return { ok: true };
-  }
-  if (lookup.status === "unpublished") {
-    return { ok: false, detail: "The npm registry does not list this package" };
-  }
-  return {
-    ok: false,
-    detail: lookup.detail,
-    fix: "Restore access to the npm registry, then run this check again"
-  };
-}
-function describeTrustedPublisher(result, packageName, ownerRepo) {
-  if (result.status === "configured") {
-    return { ok: true };
-  }
-  const detail = result.status === "not-configured" ? "The npm registry does not list any trusted publisher for this package" : result.detail;
-  return ownerRepo.ok ? { ok: false, detail, fix: formatTrustCommand(packageName, ownerRepo.value) } : { ok: false, detail: `${detail}. ${ownerRepo.detail}`, fix: NO_GITHUB_REMOTE_FIX };
-}
-function describeTrustRelationships(relationships) {
-  return relationships.map((relationship) => {
-    const type = typeof relationship.type === "string" ? relationship.type : "(unknown)";
-    const repository = typeof relationship.repository === "string" ? relationship.repository : "(unknown)";
-    const file = typeof relationship.file === "string" ? relationship.file : "(unknown)";
-    return `${type} ${repository} (${file})`;
-  }).join(", ");
-}
-function formatTrustCommand(packageName, ownerRepo) {
-  return `Run: npm trust github ${packageName} --repo ${ownerRepo} --file ${PUBLISH_WORKFLOW_FILE}`;
-}
 var getCachedNpmAuthStatus = /* @__PURE__ */ (() => {
   let cached;
   return () => cached ??= classifyNpmAuth(runNpmJson(["whoami", "--json"]));
@@ -422,11 +448,6 @@ function isRepoPrivate(ownerRepo) {
   }).trim();
   return result === "true";
 }
-function parseGitHubOwnerRepo(url) {
-  const match = /git@github\.com:(.+?)(?:\.git)?$/.exec(url) ?? /github\.com\/(.+?)(?:\.git)?$/.exec(url);
-  const ownerRepo = match?.[1];
-  return ownerRepo === void 0 ? { ok: false, detail: `The origin remote does not point to GitHub: ${url}` } : { ok: true, value: ownerRepo };
-}
 function probeTrustQuery() {
   const probeName = selectProbeName();
   return probeName === void 0 ? void 0 : getTrustQueryResult(probeName);
@@ -435,21 +456,6 @@ function readPublishRegistry(workspace) {
   const registry = getJsonValue(workspace.packageJson, "publishConfig", "registry");
   return typeof registry === "string" ? registry : void 0;
 }
-function readTrustRelationships(stdout) {
-  let parsed;
-  try {
-    parsed = JSON.parse(stdout);
-  } catch {
-    return void 0;
-  }
-  if (Array.isArray(parsed)) {
-    return parsed.filter((entry) => isRecord2(entry) && "type" in entry);
-  }
-  if (!isRecord2(parsed)) {
-    return void 0;
-  }
-  return "type" in parsed ? [parsed] : [];
-}
 function resolveOwnerRepo() {
   let url;
   try {
@@ -477,15 +483,8 @@ function skipIfNotPublishable(workspace) {
 }
 export {
   buildWorkspaceCheck,
-  classifyNpmAuth,
-  classifyProvenanceSetting,
-  classifyTrustCapability,
-  classifyTrustQuery,
   npm_auto_publish_default as default,
-  describeNpmPackageLookup,
-  describeTrustedPublisher,
   packagesChecklist,
-  parseGitHubOwnerRepo,
   selectProbeName,
   skipIfNotPublishable,
   skipIfNothingPublishable

package/.readyup/manifest.json

@@ -7,7 +7,7 @@
           "checklist": "release-kit",
           "checks": [
             "@williamthorsen/release-kit in devDependencies",
-            "@williamthorsen/release-kit >= 14.2.2",
+            "@williamthorsen/release-kit >= 14.2.4",
             "release.yaml workflow exists",
             "release.yaml matches template",
             "release.yaml does not reference deprecated tag ref",
@@ -43,12 +43,27 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "176a18ce",
+          "hash": "ad3666b8",
           "kind": "module",
           "path": "kits/default.ts"
         },
         {
-          "hash": "92bf79b3",
+          "hash": "45fc235f",
+          "kind": "module",
+          "path": "lib/changelog-checks.ts"
+        },
+        {
+          "hash": "be2c2cb3",
+          "kind": "module",
+          "path": "lib/config-checks.ts"
+        },
+        {
+          "hash": "290731d6",
+          "kind": "module",
+          "path": "lib/workflow-hashes.ts"
+        },
+        {
+          "hash": "d2f6e29b",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -83,10 +98,10 @@
       ],
       "name": "default",
       "path": "kits/default.js",
-      "readyupVersion": "0.41.0",
+      "readyupVersion": "0.42.0",
       "source": "kits/default.ts",
-      "sourceHash": "176a18ce",
-      "targetHash": "f10b7179"
+      "sourceHash": "ad3666b8",
+      "targetHash": "da678c1d"
     },
     {
       "checklistChecks": [
@@ -104,13 +119,7 @@
           "checks": [
             "packageManager field starts with \"pnpm\"",
             "At least one workspace discovered",
-            "npm session can answer trust queries",
-            "@williamthorsen/release-kit",
-            "repository field exists",
-            "publishConfig.access is \"public\"",
-            "published to npm",
-            "trusted publisher configured",
-            "files field exists"
+            "Repo publishes at least one package"
           ]
         }
       ],
@@ -121,10 +130,15 @@
       "esbuildVersion": "0.28.2",
       "inputs": [
         {
-          "hash": "66081555",
+          "hash": "682fdd4a",
           "kind": "module",
           "path": "kits/npm-auto-publish.ts"
         },
+        {
+          "hash": "05215737",
+          "kind": "module",
+          "path": "lib/npm-trust.ts"
+        },
         {
           "hash": "d360febf",
           "kind": "module",
@@ -143,10 +157,10 @@
       ],
       "name": "npm-auto-publish",
       "path": "kits/npm-auto-publish.js",
-      "readyupVersion": "0.41.0",
+      "readyupVersion": "0.42.0",
       "source": "kits/npm-auto-publish.ts",
-      "sourceHash": "66081555",
-      "targetHash": "081994f8"
+      "sourceHash": "682fdd4a",
+      "targetHash": "04adb134"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.2.4 — 2026-10-21
+
+### 🐛 Bug fixes
+
+- Fixes the issue that `release-kit` did not release a workspace whose files a commit changed when that commit scoped every change-record entry to other workspaces; for that workspace, the commit's title now sets the bump and the changelog item. (#1086)
+
+## 14.2.3 — 2026-10-18
+
+### 🐛 Bug fixes
+
+- Fixes the issue that the manifest of the `npm-auto-publish` kit recorded a different list of checks depending on the directory from which `rdy compile` ran, by declaring one fixed check, "Repo publishes at least one package", under which `rdy run` builds the npm session check and the per-package rows. (#1081)
+
+### ♻️ Refactoring
+
+- Splits `types.ts`, `loadConfig.ts`, `changelogOverrides.ts`, and `buildChangelogEntries.ts` to bring each under the 300-line `max-lines` limit, moving the config zod schemas into `configSchema.ts`, config merging into `mergeConfig.ts`, the cross-target checks into `monorepoConfigAssertions.ts`, override parsing, application, and repo-wide validation into `loadChangelogOverrides.ts`, `applyChangelogOverrides.ts`, and `validateAllChangelogOverrides.ts`, and changelog-item construction into `buildChangelogItem.ts`. (#1067)
+- Splits the `release-kit` bin, the `prepare` pipeline (`prepareCommand`, `prepareTarget`, `releasePrepareTargets`, and `reportPrepare`), and the `default` and `npm-auto-publish` readyup kits into smaller modules under `src`, `src/help`, and `.readyup/lib`, and recompiles the kit bundles without changing their check lists. (#1069)
+- Rewrites the code that the new and widened rules in `eslint-plugin-unicorn` 78 report, mostly by changing `flatMap` callbacks to return a single value rather than a one-element array. (#1072)
+
+### 🧪 Tests
+
+- Splits the `release-kit` unit tests for `releasePrepareTargets`, `reportPrepare`, `prepareCommand`, `publishCommand`, `parseCommitMessage`, and `validateConfig` into `<subject>.<aspect>.unit.test.ts` files that each stay under the `max-lines` limit, and moves the mocks and fixtures that the split files share into modules under `src/test-utils/`. (#1066)
+
 ## 14.2.2 — 2026-10-17
 
 ### 📦 Dependencies
@@ -40,6 +62,12 @@ All notable changes to this project will be documented in this file.
 - Fixes the issue that `release-kit create-github-release` did not create a GitHub Release for the project tag; a private workspace's tag is still skipped. (#1027)
 - Makes `release-kit publish` skip a project tag named by `--tags` with the warning `Skipping v0.13.0: a project tag is not an npm package.`, since the project does not have an npm package to publish. (#1027)
 
+### 🏗️ Internal features
+
+- Resolve package roots past dual-format marker manifests (#1016)
+
+  Replaces nmr-core's hand-written package-root and version lookups with `findPackageRoot` and `resolveSelfVersion` re-exported from `@williamthorsen/toolbelt.packaging`, which pass over the `{"type": "commonjs"}` marker manifest of a dual-format layout to reach the package that declares a `name`. `nmr`, `release-kit`, and `v11y-check` switch from `readPackageVersion` to `resolveSelfVersion`, and the boundary guard now holds `toolbelt.packaging`, like `toolbelt.terminal`, to a single importer and a single declarer in nmr-core.
+
 ### ♻️ Refactoring
 
 - Replaces `releasePrepare`, `releasePrepareMono`, and `releasePrepareProject` with `releasePrepareTargets`, which prepares a release from one list of package and project targets resolved from any config shape. (#1026)
@@ -56,6 +84,13 @@ All notable changes to this project will be documented in this file.
 - Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
 - Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
 - Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
+- Let a calling repo choose the runner of the reusable workflows (#997)
+
+  Makes the reusable `audit`, `create-github-release`, `release`, and `sync-labels` workflows run their jobs on the runner named by the calling repository's `CI_RUNS_ON` configuration variable, such as a self-hosted runner, and keeps `ubuntu-latest` as the default when the variable is unset. Leaves the reusable `publish` workflow on `ubuntu-latest`, because npm generates provenance only on GitHub-hosted runners.
+
+- Keep undeclared repo labels and warn about each (#1002)
+
+  Changes the reusable sync-labels workflow to keep each repository label that `.github/labels.yaml` does not declare, rather than delete it, and to report each such label as a warning annotation on the run and on the pull request's check. A label created by hand now stays in place across syncs until the file declares it or it is deleted with `gh label delete <name>`.
 
 ### 🐛 Bug fixes
 

package/README.md

@@ -6,7 +6,13 @@ Version-bumping and changelog-generation toolkit for release workflows.
 
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
-<!-- section:release-notes --><!-- /section:release-notes -->
+<!-- section:release-notes -->
+## Release notes — v14.2.4 (2026-10-21)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that `release-kit` did not release a workspace whose files a commit changed when that commit scoped every change-record entry to other workspaces; for that workspace, the commit's title now sets the bump and the changelog item. (#1086)
+<!-- /section:release-notes -->
 
 ## Installation
 

package/dist/esm/applyChangelogOverrides.d.ts

@@ -0,0 +1,50 @@
+import type { ChangelogEntry, ChangelogOverride } from './types.js';
+/**
+ * Applies overrides to changelog entries, returning new entries without mutating the input.
+ *
+ * Each key's hash prefix is matched against the distinct `ChangelogItem.hash` values:
+ * - No match: The key is unmatched in this batch, and this function doesn't emit a warning.
+ * - One match: A bare key resolves to every item of that commit, and an ordinal key `<hash>:<n>` to the items whose
+ *   `entry` is `n`. A key that doesn't resolve to any item is unmatched, so an ordinal key on a title-derived item
+ *   goes stale.
+ * - Several matches: an error (ambiguous prefix).
+ *
+ * Two more conditions are errors, and the keys involved apply nowhere: a bare key that sets `description` or `body` on a
+ * commit with several items, and two keys that resolve to the same item.
+ *
+ * `matchedKeys` lists the keys that resolved to at least one item without error. The caller computes stale-key
+ * warnings, because in a monorepo a key may target a commit in another workspace: A key unmatched in one batch is not
+ * necessarily stale.
+ *
+ * An override whose audience is `'skip'` removes its item, and a section left empty is dropped; an entry left without
+ * sections is kept. An item without a `hash`, such as a synthetic propagation item, passes through unmatched. Errors
+ * are returned rather than thrown, and the caller decides whether to abort.
+ */
+export declare function applyChangelogOverrides(entries: ChangelogEntry[], overrides: Map<string, ChangelogOverride>): {
+    entries: ChangelogEntry[];
+    warnings: string[];
+    errors: string[];
+    matchedKeys: string[];
+};
+/** Formats the warning for an override key that did not match any item in the changelog. */
+export declare function formatStaleOverrideKeyWarning(key: string): string;
+/** Collects, for each hash, the distinct `entry` positions of the items that have it. */
+export declare function indexItemPositions(items: readonly {
+    hash?: string | undefined;
+    entry?: number | undefined;
+}[]): Map<string, Set<number | undefined>>;
+/**
+ * Resolves one override key against the commits' entry positions. `positions` lists the targeted items' `entry` values,
+ * ascending, with `undefined` standing for a title-derived item; it is empty when the key doesn't target any item of
+ * the commit.
+ */
+export declare function resolveOverrideKey(overrideKey: string, positionsByHash: Map<string, Set<number | undefined>>): {
+    kind: 'none';
+} | {
+    kind: 'ambiguous';
+    hashes: string[];
+} | {
+    kind: 'items';
+    hash: string;
+    positions: (number | undefined)[];
+};