@williamthorsen/release-kit 8.0.1 → 8.1.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+## 8.1.0 — 2026-07-22
+
+### 🎉 Features
+
+- Make label deletions reviewable and apply labels on merge (#493)
+
+  Pull requests that touch a repository's label file now get a check listing every label change the sync would make, including deletions of labels the file never mentions, which a diff of the file cannot show. Merging the pull request now applies those labels. The sync's deletion and rename handling now changes only through a reviewed upgrade to a verified release. Repositories that already scaffolded this workflow adopt the new triggers by re-running `release-kit sync-labels init --force`.
+
+### 📦 Dependencies
+
+- Upgrade dependencies and align the Node support policy (#483)
+
+  All four published packages (`nmr`, `nmr-core`, `release-kit`, and `v11y-check`) now require Node.js 24 or later, up from Node 18.17. Separately, `nmr-compile` now rebuilds when the TypeScript version changes.
+
 ## 8.0.1 — 2026-07-18
 
 ### 🐛 Bug fixes

package/README.md

@@ -5,17 +5,19 @@ Version-bumping and changelog-generation toolkit for release workflows.
 Provides a self-contained CLI that auto-discovers workspaces from `pnpm-workspace.yaml`, parses conventional commits, determines version bumps, updates `package.json` files, and generates changelogs from `git-cliff --context` output rendered in-process (with optional [editorial overrides](#editorial-overrides)).
 
 <!-- section:release-notes -->
-## Release notes — v8.0.1 (2026-07-18)
+## Release notes — v8.1.0 (2026-07-22)
 
-### 🐛 Bug fixes
+### 🎉 Features
 
-- Skip private packages cleanly in publish and create-github-release (#477)
+- Make label deletions reviewable and apply labels on merge (#493)
 
-  Fixes an issue where a workspace marked private in its `package.json` could break a release: `release-kit publish` failed on it, and `release-kit create-github-release` created an unwanted public GitHub Release for it. Both commands now skip private workspaces cleanly: publish reports the skip and continues instead of failing the run, and create-github-release produces no Release for a private package. Any publishable packages released alongside it still publish and still get their Releases. Marking a workspace private is now all it takes to exclude it from both publishing and GitHub Releases.
+  Pull requests that touch a repository's label file now get a check listing every label change the sync would make, including deletions of labels the file never mentions, which a diff of the file cannot show. Merging the pull request now applies those labels. The sync's deletion and rename handling now changes only through a reviewed upgrade to a verified release. Repositories that already scaffolded this workflow adopt the new triggers by re-running `release-kit sync-labels init --force`.
 <!-- /section:release-notes -->
 
 ## Installation
 
+Requires Node.js 24 or later.
+
 ```bash
 pnpm add -D @williamthorsen/release-kit
 ```
@@ -728,6 +730,40 @@ Manage GitHub label definitions via config-driven YAML files.
 
 `init` scaffolds `.config/sync-labels.config.ts` with auto-detected workspace scope labels and a `.github/workflows/sync-labels.yaml` caller workflow, then generates `.github/labels.yaml`. `generate` reads the config and writes `.github/labels.yaml`. `sync` triggers the workflow remotely — it requires the `gh` CLI and an existing workflow file.
 
+#### When labels are applied
+
+The scaffolded workflow carries three triggers:
+
+| Trigger                                                   | Job     | Token           | Effect                            |
+| --------------------------------------------------------- | ------- | --------------- | --------------------------------- |
+| Push to the default branch touching `.github/labels.yaml` | `sync`  | `issues: write` | Applies the labels                |
+| Manual dispatch (`release-kit sync-labels sync`)          | `sync`  | `issues: write` | Applies the labels                |
+| Pull request touching `.github/labels.yaml`               | `check` | `issues: read`  | Logs the diff without applying it |
+
+Applying on merge closes the window in which a regenerated `.github/labels.yaml` sits unapplied — a window in which a later manual dispatch would apply a label set nobody reviewed.
+
+The `check` job runs the same sync in dry-run. Its **Label diff** log group lists every create, edit, rename, and deletion the sync would perform, including deletions of labels the file does not declare — the destructive edits a diff of `.github/labels.yaml` alone cannot show, because a label created by hand or by another workflow is absent from the file both before and after. Read that log; the check reports success whether or not the diff is destructive, so a green check is not evidence that nothing will be deleted.
+
+The two jobs are split because a job's permissions are fixed when the run is created and cannot vary by trigger. The split is what keeps a write-scoped token out of pull-request runs.
+
+The push trigger filters on the path alone; the `sync` job compares `github.ref_name` against the repository's default branch. The workflow therefore needs no per-repo edit whatever that branch is named — and a push touching `.github/labels.yaml` on any other branch produces a run whose jobs all skip.
+
+Manual dispatch is not a preview. It matches the `sync` job, so it applies the labels, deletions included; only the pull-request path runs in dry-run.
+
+#### Dry-run checks on fork pull requests
+
+GitHub issues a read-only `GITHUB_TOKEN` to pull requests from forks, and by default holds runs from first-time contributors until a maintainer approves them. The dry-run reads labels and writes nothing, so the check normally runs once approved. A repo that disables workflows on fork pull requests gets no check at all; to preview such a change, push the branch to the base repo and open the pull request from there.
+
+#### Migrating an existing repo
+
+The caller workflow gained the `push` and `pull_request` triggers after its first release. A repo scaffolded before that keeps working on manual dispatch alone — nothing breaks — but it applies labels only when someone remembers to. To adopt the new shape:
+
+```sh
+pnpm exec release-kit sync-labels init --force
+```
+
+`readyup` prompts for this: its `sync-labels.yaml matches template` check fails once the scaffolded workflow no longer matches the current template.
+
 #### Published JSON Schema for `.meta/label-map.json`
 
 release-kit publishes a JSON Schema for `.meta/label-map.json` — a separate, generic data file that maps commit-prefix scopes and types to GitHub label names. The schema lives at `packages/release-kit/schemas/label-map.json` in this repo and is reachable via the stable raw URL:

package/dist/esm/buildChangelogEntries.js

@@ -9,7 +9,7 @@ const HTML_COMMENT_PREFIX_PATTERN = /^<!--[^>]*-->/;
 const CANONICAL_SECTION_ORDER = new Map(Object.values(DEFAULT_WORK_TYPES).map((config, index) => [stripGroupDecorations(config.header), index]));
 function canonicalSectionPriority(title) {
     const index = CANONICAL_SECTION_ORDER.get(stripGroupDecorations(title));
-    return index ?? Number.POSITIVE_INFINITY;
+    return index ?? Infinity;
 }
 export function stripGroupDecorations(group) {
     return stripEmojiPrefix(group.replace(HTML_COMMENT_PREFIX_PATTERN, ''));
@@ -132,7 +132,7 @@ function subjectHasBreakingMarker(message) {
     return /^(?:[^|]+\|)?\w+(?:\([^)]+\))?!:/.test(subject);
 }
 function extractDescription(message) {
-    const firstLine = message.split('\n')[0] ?? message;
+    const firstLine = message.split('\n', 1)[0] ?? message;
     const afterColon = firstLine.split(': ').slice(1).join(': ');
     if (afterColon.length > 0) {
         return afterColon.charAt(0).toUpperCase() + afterColon.slice(1);

package/dist/esm/changelogOverrides.js

@@ -59,10 +59,11 @@ function validateSingleOverride(key, rawEntry, errors) {
     }
     let entryValid = true;
     for (const fieldName of Object.keys(rawEntry)) {
-        if (!KNOWN_OVERRIDE_FIELDS.has(fieldName)) {
-            errors.push(`overrides['${key}']: unknown field '${fieldName}'`);
-            entryValid = false;
+        if (KNOWN_OVERRIDE_FIELDS.has(fieldName)) {
+            continue;
         }
+        errors.push(`overrides['${key}']: unknown field '${fieldName}'`);
+        entryValid = false;
     }
     const result = {};
     if (rawEntry.audience !== undefined) {

package/dist/esm/createGithubRelease.js

@@ -26,7 +26,7 @@ export function createGithubRelease(options) {
     const body = renderReleaseNotesSingle(entry, {
         filter: matchesAudience('all'),
         includeHeading: false,
-        ...(sectionOrder === undefined ? {} : { sectionOrder }),
+        ...(sectionOrder !== undefined && { sectionOrder }),
     });
     if (body.trim() === '') {
         return { status: 'skipped', reason: 'empty-body' };
@@ -48,7 +48,7 @@ export function createGithubReleases(tags, changelogJsonOutputPath, dryRun, sect
             tag,
             changelogJsonPath,
             dryRun,
-            ...(sectionOrder === undefined ? {} : { sectionOrder }),
+            ...(sectionOrder !== undefined && { sectionOrder }),
         });
         if (result.status === 'created') {
             created.push(tag);

package/dist/esm/detectPackageManager.js

@@ -7,7 +7,7 @@ export function detectPackageManager() {
         const content = readFileSync(packageJsonPath, 'utf8');
         const parsed = JSON.parse(content);
         if (isRecord(parsed) && typeof parsed.packageManager === 'string') {
-            const [name, version] = parsed.packageManager.split('@');
+            const [name, version] = parsed.packageManager.split('@', 2);
             if (name === 'pnpm' || name === 'npm') {
                 return name;
             }

package/dist/esm/format.js

@@ -1,8 +1,8 @@
 export function bold(text) {
-    return `\u001B[1m${text}\u001B[0m`;
+    return `\u{1B}[1m${text}\u{1B}[0m`;
 }
 export function dim(text) {
-    return `\u001B[2m${text}\u001B[0m`;
+    return `\u{1B}[2m${text}\u{1B}[0m`;
 }
 export function sectionHeader(name) {
     return `━━━ ${name} ━━━`;

package/dist/esm/getCommitsSinceTarget.js

@@ -1,5 +1,5 @@
 import { execFileSync } from 'node:child_process';
-const FIELD_SEPARATOR = '\u001F';
+const FIELD_SEPARATOR = '\u{1F}';
 function isNoTagError(err) {
     return typeof err === 'object' && err !== null && 'status' in err && err.status === 128;
 }

package/dist/esm/injectReleaseNotesIntoReadme.js

@@ -22,7 +22,7 @@ export function renderInjectedReadme(readme, changelogJsonPath, tag, sectionOrde
     const renderedSections = renderReleaseNotesSingle(entry, {
         filter: matchesAudience('all'),
         includeHeading: false,
-        ...(sectionOrder === undefined ? {} : { sectionOrder }),
+        ...(sectionOrder !== undefined && { sectionOrder }),
     });
     if (renderedSections.trimEnd().length === 0) {
         console.warn(`Warning: no user-facing release notes for version ${version}; skipping README injection`);

package/dist/esm/prepareCommand.js

@@ -85,9 +85,9 @@ export async function prepareCommand(argv) {
     const options = {
         dryRun,
         force,
-        ...(bumpOverride === undefined ? {} : { bumpOverride }),
-        ...(setVersion === undefined ? {} : { setVersion }),
-        ...(withReleaseNotes ? { withReleaseNotes: true } : {}),
+        ...(bumpOverride !== undefined && { bumpOverride }),
+        ...(setVersion !== undefined && { setVersion }),
+        ...(withReleaseNotes && { withReleaseNotes: true }),
     };
     if (dryRun) {
         console.info('\n🔍 DRY RUN — no files will be modified\n');
@@ -155,10 +155,11 @@ function runMonorepoMode(discoveredPaths, userConfig, options, only, setVersion,
     if (only !== undefined) {
         const knownNames = config.workspaces.map((w) => w.dir);
         for (const name of only) {
-            if (!knownNames.includes(name)) {
-                reportError(`Unknown workspace "${name}". Known workspaces: ${knownNames.join(', ')}`);
-                process.exit(1);
+            if (knownNames.includes(name)) {
+                continue;
             }
+            reportError(`Unknown workspace "${name}". Known workspaces: ${knownNames.join(', ')}`);
+            process.exit(1);
         }
         const graph = buildDependencyGraph(config.workspaces);
         const violations = validateOnlyExcludesStrandedDependents(config.workspaces, only, graph, (workspace) => {

package/dist/esm/previewTagPrefixes.js

@@ -9,10 +9,7 @@ export async function previewTagPrefixes() {
     const workspacePaths = (await discoverWorkspaces()) ?? [];
     const userConfig = await loadUserConfig();
     const overridesByDir = buildOverrideMap(userConfig);
-    const workspaces = [];
-    for (const workspacePath of workspacePaths) {
-        workspaces.push(buildPreviewRow(workspacePath, overridesByDir));
-    }
+    const workspaces = Array.from(workspacePaths, (workspacePath) => buildPreviewRow(workspacePath, overridesByDir));
     const retiredPackages = buildRetiredPreviewEntries(userConfig?.retiredPackages ?? []);
     const collisions = detectCollisions(workspaces);
     const knownPrefixes = collectKnownPrefixes(workspaces, retiredPackages);
@@ -120,6 +117,6 @@ function buildRetiredPreviewEntries(retiredPackages) {
         name: retired.name,
         tagPrefix: retired.tagPrefix,
         tagCount: countTagsMatching(retired.tagPrefix),
-        ...(retired.successor !== undefined ? { successor: retired.successor } : {}),
+        ...(retired.successor !== undefined && { successor: retired.successor }),
     }));
 }

package/dist/esm/releasePrepareMono.js

@@ -95,8 +95,8 @@ export function releasePrepareMono(config, options) {
         tags,
         formatCommand,
         dryRun,
-        ...(allWarnings.length > 0 ? { warnings: allWarnings } : {}),
-        ...(project === undefined ? {} : { project }),
+        ...(allWarnings.length > 0 && { warnings: allWarnings }),
+        ...(project !== undefined && { project }),
     };
 }
 function determineDirectBumps(config, options) {
@@ -487,10 +487,11 @@ function topologicalSort(releaseSet, graph) {
     const sortedSet = new Set(sorted);
     const cyclicDirs = [];
     for (const dir of releaseDirs) {
-        if (!sortedSet.has(dir)) {
-            sorted.push(dir);
-            cyclicDirs.push(dir);
+        if (sortedSet.has(dir)) {
+            continue;
         }
+        sorted.push(dir);
+        cyclicDirs.push(dir);
     }
     return { sorted, cyclicDirs };
 }

package/dist/esm/renderReleaseNotes.js

@@ -50,8 +50,8 @@ function sortSectionsByOrder(sections, order) {
     }
     const indexed = sections.map((section, index) => ({ section, index }));
     indexed.sort((a, b) => {
-        const priorityA = priority.get(a.section.title) ?? Number.POSITIVE_INFINITY;
-        const priorityB = priority.get(b.section.title) ?? Number.POSITIVE_INFINITY;
+        const priorityA = priority.get(a.section.title) ?? Infinity;
+        const priorityB = priority.get(b.section.title) ?? Infinity;
         if (priorityA !== priorityB) {
             return priorityA - priorityB;
         }

package/dist/esm/resolveCommandTags.js

@@ -42,10 +42,11 @@ export async function resolveCommandTags(tags) {
     if (tags !== undefined) {
         const availableTagNames = resolvedTags.map((t) => t.tag);
         for (const name of tags) {
-            if (!availableTagNames.includes(name)) {
-                reportError(`Unknown tag "${name}" in --tags. Available: ${availableTagNames.join(', ')}`);
-                process.exit(1);
+            if (availableTagNames.includes(name)) {
+                continue;
             }
+            reportError(`Unknown tag "${name}" in --tags. Available: ${availableTagNames.join(', ')}`);
+            process.exit(1);
         }
         resolvedTags = resolvedTags.filter((t) => tags.includes(t.tag));
     }

package/dist/esm/sync-labels/generateCommand.js

@@ -8,7 +8,7 @@ import { resolveLabels } from "./resolveLabels.js";
 export const LABELS_OUTPUT_PATH = '.github/labels.yaml';
 export function formatLabelsYaml(labels, presetHashes) {
     const headerLines = ['# Generated by release-kit sync-labels — do not edit.', `# Source: ${SYNC_LABELS_CONFIG_PATH}`];
-    for (const [name, hash] of [...presetHashes.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    for (const [name, hash] of [...presetHashes].sort(([a], [b]) => a.localeCompare(b))) {
         headerLines.push(`# ${name} preset hash: ${hash}`);
     }
     const yamlBody = stringify(labels, { singleQuote: true, lineWidth: 0 });

package/dist/esm/sync-labels/templates.js

@@ -6,13 +6,37 @@ name: Sync labels
 on:
   workflow_dispatch:
 
-permissions:
-  contents: read
-  issues: write
+  # Apply on merge, so a regenerated labels file cannot sit unapplied.
+  push:
+    paths:
+      - .github/labels.yaml
 
+  # Preview on review: the check's log carries the full computed diff,
+  # including deletions of labels the file does not declare.
+  pull_request:
+    paths:
+      - .github/labels.yaml
+
+# Permissions are fixed when a run is created and cannot vary by trigger within a job,
+# so applying and previewing are separate jobs and the write token stays out of PR runs.
 jobs:
+  # The push arm applies on the default branch alone. A \`branches:\` filter cannot name the
+  # default branch, so the gate lives on the job and this file stays identical across repos.
   sync:
+    if: github.event_name != 'pull_request' && (github.event_name != 'push' || github.ref_name == github.event.repository.default_branch)
+    permissions:
+      contents: read
+      issues: write
+    uses: williamthorsen/node-monorepo-tools/.github/workflows/sync-labels.reusable.yaml@workflow/sync-labels-v1
+
+  check:
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+      issues: read
     uses: williamthorsen/node-monorepo-tools/.github/workflows/sync-labels.reusable.yaml@workflow/sync-labels-v1
+    with:
+      dry-run: true
 `;
 }
 export function buildScopeLabels(workspacePaths) {

package/dist/esm/writeReleaseNotesPreviews.js

@@ -53,7 +53,7 @@ function writePreviewFile(filePath, content, dryRun) {
     const result = writeFileWithCheck(filePath, content, { dryRun: false, overwrite: true });
     if (result.outcome === 'failed') {
         reportError(`Failed to write ${filePath}: ${result.error ?? 'unknown error'}`);
-        return { filePath, outcome: 'failed', ...(result.error === undefined ? {} : { error: result.error }) };
+        return { filePath, outcome: 'failed', ...(result.error !== undefined && { error: result.error }) };
     }
     if (result.outcome === 'created' || result.outcome === 'overwritten') {
         console.info(dim(`  Wrote ${filePath}`));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/release-kit",
-  "version": "8.0.1",
+  "version": "8.1.0",
   "description": "Version-bumping and changelog-generation toolkit for release workflows",
   "keywords": [],
   "homepage": "https://github.com/williamthorsen/node-monorepo-tools/tree/main/packages/release-kit#readme",
@@ -39,14 +39,14 @@
     "semver": "7.8.5",
     "yaml": "2.9.0",
     "zod": "4.4.3",
-    "@williamthorsen/nmr-core": "0.7.0"
+    "@williamthorsen/nmr-core": "0.7.1"
   },
   "devDependencies": {
     "@types/semver": "7.7.1",
     "smol-toml": "1.7.0"
   },
   "engines": {
-    "node": ">=18.17.0"
+    "node": ">=24"
   },
   "publishConfig": {
     "access": "public",