@williamthorsen/release-kit 14.2.3 → 14.2.4

package/.meta/changelog.json

@@ -1,4 +1,21 @@
 [
+  {
+    "version": "14.2.4",
+    "date": "2026-10-21",
+    "sections": [
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that `release-kit` did not release a workspace whose files a commit changed when that commit scoped every change-record entry to other workspaces; for that workspace, the commit's title now sets the bump and the changelog item. (#1086)",
+            "hash": "b518414c98f4703f2adca3840577e9f2b66e0924",
+            "entry": 1
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "14.2.3",
     "date": "2026-10-18",
@@ -183,6 +200,17 @@
           }
         ]
       },
+      {
+        "title": "🏗️ Internal features",
+        "audience": "dev",
+        "items": [
+          {
+            "description": "Resolve package roots past dual-format marker manifests (#1016)",
+            "body": "Replaces nmr-core's hand-written package-root and version lookups with `findPackageRoot` and `resolveSelfVersion` re-exported from `@williamthorsen/toolbelt.packaging`, which pass over the `{\"type\": \"commonjs\"}` marker manifest of a dual-format layout to reach the package that declares a `name`. `nmr`, `release-kit`, and `v11y-check` switch from `readPackageVersion` to `resolveSelfVersion`, and the boundary guard now holds `toolbelt.packaging`, like `toolbelt.terminal`, to a single importer and a single declarer in nmr-core.",
+            "hash": "ff6627180d9e86d083656afb2c09a3fb190fc79d"
+          }
+        ]
+      },
       {
         "title": "♻️ Refactoring",
         "audience": "dev",
@@ -234,6 +262,16 @@
             "description": "Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)",
             "hash": "7b8b6d67b264af56dff761d0bf987eca8bc2f934",
             "entry": 1
+          },
+          {
+            "description": "Let a calling repo choose the runner of the reusable workflows (#997)",
+            "body": "Makes the reusable `audit`, `create-github-release`, `release`, and `sync-labels` workflows run their jobs on the runner named by the calling repository's `CI_RUNS_ON` configuration variable, such as a self-hosted runner, and keeps `ubuntu-latest` as the default when the variable is unset. Leaves the reusable `publish` workflow on `ubuntu-latest`, because npm generates provenance only on GitHub-hosted runners.",
+            "hash": "91573eec402f4028b766684be84c33e8739513ce"
+          },
+          {
+            "description": "Keep undeclared repo labels and warn about each (#1002)",
+            "body": "Changes the reusable sync-labels workflow to keep each repository label that `.github/labels.yaml` does not declare, rather than delete it, and to report each such label as a warning annotation on the run and on the pull request's check. A label created by hand now stays in place across syncs until the file declares it or it is deleted with `gh label delete <name>`.",
+            "hash": "f696a4f92064a5f2993e8bcbb6764762f161ec9d"
           }
         ]
       },

package/.readyup/kits/default.js

@@ -234,7 +234,7 @@ var CREATE_GITHUB_RELEASE_WORKFLOW_HASH_SINGLE = "f595831ff28f8b3a01d97e6cb0cfe1
 
 // .readyup/kits/default.ts
 function getMinVersion() {
-  const picked = { "version": "14.2.3" };
+  const picked = { "version": "14.2.4" };
   if (typeof picked["version"] !== "string") {
     throw new TypeError("release-kit/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -7,7 +7,7 @@
           "checklist": "release-kit",
           "checks": [
             "@williamthorsen/release-kit in devDependencies",
-            "@williamthorsen/release-kit >= 14.2.3",
+            "@williamthorsen/release-kit >= 14.2.4",
             "release.yaml workflow exists",
             "release.yaml matches template",
             "release.yaml does not reference deprecated tag ref",
@@ -63,7 +63,7 @@
           "path": "lib/workflow-hashes.ts"
         },
         {
-          "hash": "b89073b8",
+          "hash": "d2f6e29b",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -101,7 +101,7 @@
       "readyupVersion": "0.42.0",
       "source": "kits/default.ts",
       "sourceHash": "ad3666b8",
-      "targetHash": "9f5a50d9"
+      "targetHash": "da678c1d"
     },
     {
       "checklistChecks": [

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## 14.2.4 — 2026-10-21
+
+### 🐛 Bug fixes
+
+- Fixes the issue that `release-kit` did not release a workspace whose files a commit changed when that commit scoped every change-record entry to other workspaces; for that workspace, the commit's title now sets the bump and the changelog item. (#1086)
+
 ## 14.2.3 — 2026-10-18
 
 ### 🐛 Bug fixes
@@ -56,6 +62,12 @@ All notable changes to this project will be documented in this file.
 - Fixes the issue that `release-kit create-github-release` did not create a GitHub Release for the project tag; a private workspace's tag is still skipped. (#1027)
 - Makes `release-kit publish` skip a project tag named by `--tags` with the warning `Skipping v0.13.0: a project tag is not an npm package.`, since the project does not have an npm package to publish. (#1027)
 
+### 🏗️ Internal features
+
+- Resolve package roots past dual-format marker manifests (#1016)
+
+  Replaces nmr-core's hand-written package-root and version lookups with `findPackageRoot` and `resolveSelfVersion` re-exported from `@williamthorsen/toolbelt.packaging`, which pass over the `{"type": "commonjs"}` marker manifest of a dual-format layout to reach the package that declares a `name`. `nmr`, `release-kit`, and `v11y-check` switch from `readPackageVersion` to `resolveSelfVersion`, and the boundary guard now holds `toolbelt.packaging`, like `toolbelt.terminal`, to a single importer and a single declarer in nmr-core.
+
 ### ♻️ Refactoring
 
 - Replaces `releasePrepare`, `releasePrepareMono`, and `releasePrepareProject` with `releasePrepareTargets`, which prepares a release from one list of package and project targets resolved from any config shape. (#1026)
@@ -72,6 +84,13 @@ All notable changes to this project will be documented in this file.
 - Stops `release-kit init` from scaffolding `publish.yaml` and `create-github-release.yaml` when every package is private, even with `--force`, and removes the provenance and trusted-publisher steps from the next steps that it prints. (#995)
 - Stops `release-kit update-templates` from re-creating a deleted `publish.yaml` or `create-github-release.yaml` when every package is private, while it still refreshes either workflow that exists. (#995)
 - Makes `release-kit prepare` refuse, before it writes any file and in a dry run too, to release a publishable package that npm does not list or that it cannot look up, and prints `npm publish --access public` as the fix for each unlisted package. (#996)
+- Let a calling repo choose the runner of the reusable workflows (#997)
+
+  Makes the reusable `audit`, `create-github-release`, `release`, and `sync-labels` workflows run their jobs on the runner named by the calling repository's `CI_RUNS_ON` configuration variable, such as a self-hosted runner, and keeps `ubuntu-latest` as the default when the variable is unset. Leaves the reusable `publish` workflow on `ubuntu-latest`, because npm generates provenance only on GitHub-hosted runners.
+
+- Keep undeclared repo labels and warn about each (#1002)
+
+  Changes the reusable sync-labels workflow to keep each repository label that `.github/labels.yaml` does not declare, rather than delete it, and to report each such label as a warning annotation on the run and on the pull request's check. A label created by hand now stays in place across syncs until the file declares it or it is deleted with `gh label delete <name>`.
 
 ### 🐛 Bug fixes
 

package/README.md

@@ -7,11 +7,11 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from the same commit history that decides each bump (with optional [editorial overrides](docs/editorial-overrides.md)).
 
 <!-- section:release-notes -->
-## Release notes — v14.2.3 (2026-10-18)
+## Release notes — v14.2.4 (2026-10-21)
 
 ### 🐛 Bug fixes
 
-- Fixes the issue that the manifest of the `npm-auto-publish` kit recorded a different list of checks depending on the directory from which `rdy compile` ran, by declaring one fixed check, "Repo publishes at least one package", under which `rdy run` builds the npm session check and the per-package rows. (#1081)
+- Fixes the issue that `release-kit` did not release a workspace whose files a commit changed when that commit scoped every change-record entry to other workspaces; for that workspace, the commit's title now sets the bump and the changelog item. (#1086)
 <!-- /section:release-notes -->
 
 ## Installation

package/dist/esm/buildChangelogEntries.d.ts

@@ -15,10 +15,10 @@ export declare function buildChangelogEntries(config: ReleaseHistoryConfig, tag:
  * Reads a scope's release windows once and returns the changelog items of every window, with what the unreleased
  * window decides: its commits, its bump, and its diagnostics.
  *
- * A commit whose last `change-record` block records entries yields one item per entry routed to
- * `options.scope`; any other commit is classified by its title through `classifyChangelogCommit`. A `release:`
- * or merge subject yields nothing either way. The read records diagnostics only for the unreleased window, since the
- * released windows were reported when they were prepared.
+ * A commit whose last `change-record` block records at least one entry routed to `options.scope` yields one item per
+ * routed entry; any other commit, including one whose entries all route elsewhere, is classified by its title through
+ * `classifyChangelogCommit`. A `release:` or merge subject yields nothing either way. The read records diagnostics
+ * only for the unreleased window, since the released windows were reported when they were prepared.
  */
 export declare function readReleaseHistory(config: ReleaseHistoryConfig, options: GenerateChangelogOptions): ReleaseHistory;
 /** One read of a scope's release windows. */

package/dist/esm/buildChangelogEntries.js

@@ -1,5 +1,5 @@
 import { chainError } from '@williamthorsen/toolbelt.errors/candidate';
-import { buildEntryItem, buildTitleItem, } from "./buildChangelogItem.js";
+import { buildEntryItem, buildTitleItem, hasRoutedEntry, } from "./buildChangelogItem.js";
 import { buildEmptyReleaseEntry } from "./buildEmptyReleaseEntry.js";
 import { extractVersion } from "./changelogJsonUtils.js";
 import { classifyChangelogCommit, isNonChangeSubject, isReleaseSubject } from "./classifyChangelogCommit.js";
@@ -93,7 +93,7 @@ function readCommit(commit, context, diagnostics) {
             reason: reading.reason,
         });
     }
-    if (reading.kind === 'read' && reading.entries.length > 0) {
+    if (reading.kind === 'read' && reading.entries.length > 0 && hasRoutedEntry(reading.entries, context.routing)) {
         const items = reading.entries.flatMap((entry, entryIndex) => buildEntryItem(commit, entry, entryIndex + 1, reading.prNumber, context, diagnostics) ?? []);
         return { items, isUnparseable: false };
     }

package/dist/esm/buildChangelogItem.d.ts

@@ -38,6 +38,8 @@ export interface DerivedItem {
     item: ChangelogItem;
     signal: BumpSignal;
 }
+/** Reports whether any of `entries` is routed to the workspace of `routing`; always true for a read without routing. */
+export declare function hasRoutedEntry(entries: readonly ChangeRecordEntry[], routing: EntryRouting | undefined): boolean;
 /** What every window's read shares. */
 export interface ReadContext {
     breakingPolicies: NonNullable<ReleaseSettings['breakingPolicies']>;

package/dist/esm/buildChangelogItem.js

@@ -75,6 +75,9 @@ export function buildTitleItem(commit, isParsedBreaking, workTypes) {
     item.hash = commit.hash;
     return item;
 }
+export function hasRoutedEntry(entries, routing) {
+    return routing === undefined || entries.some((entry) => isRoutedTo(entry.scopes, routing));
+}
 function extractBody(message) {
     const lines = message.split('\n').slice(1);
     let start = 0;

package/docs/changelogs.md

@@ -93,9 +93,11 @@ A workspace's window contains every commit that touches the workspace's paths. A
 
 A scope narrows the window and never widens it: A scope that names a workspace whose window does not contain the commit doesn't route the item to any workspace, and `prepare` reports it (see [Reported diagnostics](#reported-diagnostics)). A composite's changelog, such as the project changelog, and a single-package repo take every entry, whatever its scopes.
 
-A workspace's bump reads the items routed to it, so a breaking entry scoped to one workspace does not raise a major bump in another that the same commit touched. A workspace whose window has commits but lacks a routed item doesn't call for a release.
+The window decides whether a workspace releases, and the scopes decide only what its changelog says. When none of a commit's entries routes to a workspace whose window contains the commit, release-kit reads the commit for that workspace from its title, as it reads a commit without a block: The title's type counts toward the workspace's bump, and the title's item enters its changelog. A commit with at least one entry routed to the workspace is read from its routed entries alone, even when none of them yields an item.
 
-Each `prepare` rebuilds a workspace's released windows with the same routing. When an earlier release recorded an item under a workspace that the item's scopes do not name, the rebuild removes the item from that workspace's past section. A path window does not follow a renamed directory, and legacy identities do not rename scopes: An entry scoped to a workspace's old directory name is routed to the workspace only through a `scopeAliases` entry from the old name to the new one, and until one exists, `prepare` reports the scope for each such commit in the unreleased window.
+A workspace's bump reads the items routed to it, so a breaking entry scoped to one workspace does not raise a major bump in another workspace that has a routed entry of its own. A workspace read from the title takes the title's breaking marker; the workspace to which an entry is scoped keeps the entry's level.
+
+Each `prepare` rebuilds a workspace's released windows with the same routing, the fallback to the title included. When an earlier release recorded an item under a workspace that the item's scopes do not name, the rebuild removes the item from that workspace's past section. A path window does not follow a renamed directory, and legacy identities do not rename scopes: An entry scoped to a workspace's old directory name is routed to the workspace only through a `scopeAliases` entry from the old name to the new one, and until one exists, `prepare` reports the scope for each such commit in the unreleased window.
 
 ## Change-record blocks
 
@@ -128,7 +130,7 @@ An entry whose type is excluded from the changelog doesn't yield an item. An ove
 
 ### Fallback to the title
 
-A commit is read from its title, as [Which commits appear in a changelog](#which-commits-appear-in-a-changelog) describes, when it doesn't have a block, when the block's `entries` is absent or empty, or when the block is malformed. A block is malformed when it never closes, when its payload is not valid YAML or not a mapping, when `entries` is not a list, when an entry is not a mapping, when an entry's `type` or `text` is missing, blank, or not a string, when `breaking` is not a boolean, when `scopes` is not a list of strings, when `migration` or `ticket_ref` is not a string, or when `pr_number` is not a positive integer. One defect makes the whole block malformed.
+A commit is read from its title, as [Which commits appear in a changelog](#which-commits-appear-in-a-changelog) describes, when it doesn't have a block, when the block's `entries` is absent or empty, when none of its entries routes to the workspace being read (see [Routing to workspaces](#routing-to-workspaces)), or when the block is malformed. A block is malformed when it never closes, when its payload is not valid YAML or not a mapping, when `entries` is not a list, when an entry is not a mapping, when an entry's `type` or `text` is missing, blank, or not a string, when `breaking` is not a boolean, when `scopes` is not a list of strings, when `migration` or `ticket_ref` is not a string, or when `pr_number` is not a positive integer. One defect makes the whole block malformed.
 
 ### Reported diagnostics
 
@@ -139,7 +141,7 @@ A commit is read from its title, as [Which commits appear in a changelog](#which
 - **An entry that violates its type's breaking policy**, as a policy violation at the entry's position. Its item is not marked breaking.
 - **An entry scope that doesn't name a workspace in its commit's window**, with the commit's hash, the entry's position, and the scope as the entry declares it. release-kit reports it under every workspace whose window contains the commit. A scope that names nothing, or a workspace whose window does not contain the commit, is reported; `*`, `root`, and a scope that names a workspace in the window are not. Under `--only`, a scope that names a configured workspace left out of the run is not reported either. A workspace excluded with `shouldExclude: true` or a `releases` entry of `false` is not a configured workspace, so a scope that names one is reported.
 
-The result that `prepare` returns includes these as `malformedBlocks`, `undeclaredEntryTypes`, `policyViolations` entries whose `surface` is `'entry'`, and `unroutedEntryScopes`, whether the target releases or is skipped. Because a block whose entries are all undeclared or excluded doesn't yield an item, the commit doesn't raise a bump.
+The result that `prepare` returns includes these as `malformedBlocks`, `undeclaredEntryTypes`, `policyViolations` entries whose `surface` is `'entry'`, and `unroutedEntryScopes`, whether the target releases or is skipped. Because a block whose routed entries are all undeclared or excluded doesn't yield an item, the commit doesn't raise a bump.
 
 ## Release-notes injection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "14.2.3",
+  "version": "14.2.4",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [
     "changelog",
@@ -51,12 +51,12 @@
   ],
   "dependencies": {
     "@williamthorsen/change-grammar": "0.2.1",
-    "@williamthorsen/nmr-core": "0.13.4",
+    "@williamthorsen/nmr-core": "0.13.5",
     "@williamthorsen/toolbelt.errors": "0.8.3",
     "json-stringify-pretty-compact": "4.0.0",
     "semver": "7.8.5",
     "yaml": "2.9.1",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@types/semver": "7.8.0",