@workerstack/repo 0.0.0-stage → 0.1.0

package/cli/release/release-refusals.test.ts

@@ -0,0 +1,149 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { removePlanted, tempDir, write } from "../fixtures/planted-repo.ts";
+import { NAME, commit, fakeGh, feat, gitIn, release, snapshot, world, type World } from "../fixtures/release-world.ts";
+
+afterEach(removePlanted);
+
+const USAGE = "usage: repo release [--stable | --pre <id>] | wait | gate | pack | publish | github <name>@<version>";
+/** What a refused release leaves: exit 1, the one line on stderr, nothing on stdout. */
+const refusal = (line: string) => ({ code: 1, out: "", err: `repo release: ${line}\n`, wrote: false });
+
+/** Runs a release and reports whether it wrote anything to the checkout or origin. */
+async function attempt(w: World, argv: string[] = [], gh = fakeGh()) {
+  const before = snapshot(w);
+  const got = await release(w, argv, gh);
+  return { ...got, wrote: JSON.stringify(snapshot(w)) !== JSON.stringify(before) };
+}
+
+describe("repo release refuses the state of the checkout", () => {
+  it("a working tree with changes", async () => {
+    const w = world();
+    feat(w);
+    write(w.work, { "stray.txt": "x\n" });
+    expect(await attempt(w)).toEqual(refusal("the working tree has changes; commit or stash them first"));
+  });
+
+  it("a branch that is not main", async () => {
+    const w = world();
+    feat(w);
+    gitIn(w.work, "checkout", "-q", "-b", "wt/x");
+    expect(await attempt(w)).toEqual(refusal("release from main; this checkout is on wt/x"));
+  });
+
+  it("a main behind origin/main", async () => {
+    const w = world();
+    feat(w);
+    gitIn(w.work, "reset", "-q", "--hard", "HEAD~1");
+    const differ = "main and origin/main differ (1 behind, 0 ahead); pull or push first";
+    expect(await attempt(w)).toEqual(refusal(differ));
+  });
+
+  it("a main ahead of origin/main", async () => {
+    const w = world();
+    feat(w, false);
+    const differ = "main and origin/main differ (0 behind, 1 ahead); pull or push first";
+    expect(await attempt(w)).toEqual(refusal(differ));
+  });
+});
+
+describe("repo release refuses what the commits and files say", () => {
+  it("no feat, fix, perf, revert or breaking commit since the last tag", async () => {
+    const w = world();
+    commit(w, "docs: words", { "README.md": "x\n" });
+    const line = `nothing to release since ${NAME}@0.1.0: no feat, fix, perf, revert or breaking commit`;
+    expect(await attempt(w)).toEqual(refusal(line));
+  });
+
+  it("an empty Unreleased", async () => {
+    const w = world();
+    commit(w, "feat: add x", { "src/x.ts": "export const x = 1;\n" });
+    const line = "CHANGELOG.md has no entries under ## [Unreleased]; add them first";
+    expect(await attempt(w)).toEqual(refusal(line));
+  });
+
+  it("--stable on a version that is already 1.x", async () => {
+    const w = world({ "package.json": { name: NAME, version: "1.2.0" } }, false);
+    gitIn(w.work, "tag", "-a", `${NAME}@1.2.0`, "-m", "x");
+    gitIn(w.work, "push", "-q", "origin", "--tags");
+    feat(w);
+    const line = `--stable moves a 0.x version to 1.0.0; ${NAME} is 1.2.0`;
+    expect(await attempt(w, ["--stable"])).toEqual(refusal(line));
+  });
+
+  it("a tag the next version already has", async () => {
+    const w = world();
+    feat(w);
+    gitIn(w.work, "tag", "-a", `${NAME}@0.1.1`, "-m", "x");
+    gitIn(w.work, "push", "-q", "origin", "--tags");
+    const line = `the tag ${NAME}@0.1.1 already exists; a tag is never moved, so release the next version`;
+    expect(await attempt(w)).toEqual(refusal(line));
+  });
+});
+
+describe("repo release refuses the package and its config", () => {
+  it("a private package", async () => {
+    const w = world({ "package.json": { name: NAME, version: "0.1.0", private: true } });
+    feat(w);
+    expect(await attempt(w)).toEqual(refusal(`${NAME} is private; set "private": false to publish it`));
+  });
+
+  it("a repo without the release pack", async () => {
+    const w = world({ "workerstack.config.ts": "export default { packs: [] };\n" });
+    feat(w);
+    const line = 'the release pack is off; add "release" to packs in workerstack.config.ts';
+    expect(await attempt(w)).toEqual(refusal(line));
+  });
+});
+
+describe("repo release refuses a manifest it cannot use", () => {
+  it("a broken config", async () => {
+    const w = world({ "workerstack.config.ts": "export default 3;\n" });
+    const got = await attempt(w);
+    expect(got).toMatchObject({ code: 1, out: "", wrote: false });
+    expect(got.err).toMatch(/^repo release: .*default export/);
+  });
+
+  it("a manifest that is not JSON", async () => {
+    const w = world({ "package.json": "[" });
+    expect(await attempt(w)).toEqual(refusal("package.json needs a name and a version"));
+  });
+
+  it("a manifest without a version", async () => {
+    const w = world({ "package.json": { name: NAME } });
+    expect(await attempt(w)).toEqual(refusal("package.json needs a name and a version"));
+  });
+
+  it("a version that is not semver", async () => {
+    const w = world({ "package.json": { name: NAME, version: "latest" } });
+    expect(await attempt(w)).toEqual(refusal(`${NAME} is at latest, which is not semver`));
+  });
+});
+
+describe("repo release refuses where it runs", () => {
+  it("gh that is missing or logged out", async () => {
+    const w = world();
+    feat(w);
+    const line = "gh is not installed or not logged in; run `gh auth login`";
+    expect(await attempt(w, [], fakeGh({ auth: false }))).toEqual(refusal(line));
+  });
+
+  it("an origin that cannot be fetched", async () => {
+    const w = world();
+    gitIn(w.work, "remote", "set-url", "origin", "/nonexistent/remote.git");
+    const got = await attempt(w);
+    expect(got.code).toBe(1);
+    expect(got.err).toMatch(/^repo release: git fetch failed: /);
+  });
+
+  it("a directory that is not a git checkout", async () => {
+    const got = await release({ work: tempDir(), remote: "" }, []);
+    expect(got).toEqual({ code: 1, out: "", err: "repo release: run it inside a git checkout\n" });
+  });
+
+  it.each([[["--pre"]], [["--pre", "r c"]], [["--stable", "--pre", "rc"]], [["--bogus"]]])(
+    "the arguments %j",
+    async (argv) => {
+      expect(await attempt(world(), argv)).toEqual(refusal(USAGE));
+    },
+  );
+});

package/cli/release/release.constants.ts

@@ -0,0 +1,128 @@
+/** Where the semver of a version string splits: major, minor, patch and an optional `-id.N` prerelease. */
+export const SEMVER: RegExp = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z]+)\.(\d+))?$/;
+export const FIRST_VERSION: string = "0.1.0";
+export const STABLE_VERSION: string = "1.0.0";
+export const STABLE_MAJOR: number = 1;
+/** Commit types that make a release, and the bump each makes from 1.0. */
+export const PATCH_TYPES: readonly string[] = ["fix", "perf", "revert"];
+export const MINOR_TYPES: readonly string[] = ["feat"];
+
+export const CHANGELOG_FILE: string = "CHANGELOG.md";
+/** The sections of Keep a Changelog, in the order they are written. */
+export const SECTIONS: readonly string[] = ["Added", "Changed", "Deprecated", "Removed", "Fixed", "Security"];
+export const UNRELEASED: string = "Unreleased";
+export const DATE_FORMAT: string = "YYYY-MM-DD";
+export const FENCE: string = "```";
+export const HEADING: RegExp = /^(##|###) (.*)$/;
+export const VERSION_HASHES: string = "##";
+export const SECTION_LIST: string = "Added, Changed, Deprecated, Removed, Fixed or Security";
+export const ZERO_VERSION: string = "0.0.0";
+export const WAIT_COMMAND: string = "wait";
+export const HELP_COMMAND: string = "help";
+export const GATE_COMMAND: string = "gate";
+export const PACK_COMMAND: string = "pack";
+export const PUBLISH_COMMAND: string = "publish";
+export const GITHUB_COMMAND: string = "github";
+export const GITHUB_ACTIONS_ON: string = "true";
+export const VERSION_HEADING: RegExp = /^\[([^\]]+)\]/;
+export const DATED: RegExp = /^\[[^\]]+\] - \d{4}-\d{2}-\d{2}$/;
+
+export const RELEASE_PACK: string = "release";
+export const ARROW: string = "→";
+export const FLAG_STABLE: string = "--stable";
+export const FLAG_PRE: string = "--pre";
+export const PRE_ID: RegExp = /^[0-9A-Za-z]+$/;
+export const MAIN_FALLBACK: string = "main";
+export const ORIGIN_HEAD_PREFIX: string = "refs/remotes/origin/";
+export const RELEASE_SUBJECT = (tag: string): string => `chore: release ${tag}`;
+export const TAG_OF = (name: string, version: string): string => `${name}@${version}`;
+export const BARE_TAG_OF = (version: string): string => `v${version}`;
+export const SHA_SHOWN: number = 7;
+export const COMMIT_SEPARATOR: string = "\x1f";
+export const COMMIT_END: string = "\x1e";
+export const MANIFEST_FILE: string = "package.json";
+export const VERSION_LINE: RegExp = /("version"\s*:\s*)"[^"]*"/;
+export const GIT_TOPLEVEL: readonly string[] = ["rev-parse", "--show-toplevel"];
+export const GIT_ORIGIN_HEAD: readonly string[] = ["symbolic-ref", "--quiet", "refs/remotes/origin/HEAD"];
+export const GIT_BRANCH: readonly string[] = ["rev-parse", "--abbrev-ref", "HEAD"];
+export const GIT_HEAD: readonly string[] = ["rev-parse", "HEAD"];
+export const GIT_STATUS: readonly string[] = ["status", "--porcelain"];
+export const GIT_FETCH: readonly string[] = ["fetch", "--quiet", "--tags", "origin"];
+export const GIT_RESET: readonly string[] = ["reset", "--quiet", "--hard", "HEAD"];
+export const GIT_AHEAD_BEHIND = (branch: string): string[] => [
+  "rev-list",
+  "--left-right",
+  "--count",
+  `HEAD...origin/${branch}`,
+];
+export const GIT_TAG_REF = (tag: string): string[] => ["rev-parse", "--quiet", "--verify", `refs/tags/${tag}^{commit}`];
+export const GIT_RELEASE_LOG = (subject: string): string[] => [
+  "log",
+  "--fixed-strings",
+  `--grep=${subject}`,
+  "--format=%H%x09%s",
+];
+export const GIT_COMMITS = (since: string | null): string[] => [
+  "log",
+  `--format=%s%x1f%b%x1e`,
+  ...(since === null ? [] : [`${since}..HEAD`]),
+];
+export const GIT_ADD: readonly string[] = ["add", "--", MANIFEST_FILE, CHANGELOG_FILE];
+export const GIT_COMMIT = (subject: string): string[] => ["commit", "--quiet", "-m", subject];
+export const GIT_PUSH = (branch: string): string[] => ["push", "--quiet", "origin", branch];
+export const GIT_TAG = (tag: string): string[] => ["tag", "-a", tag, "-m", tag];
+export const GIT_PUSH_TAG = (tag: string): string[] => ["push", "--quiet", "origin", `refs/tags/${tag}`];
+export const GIT_TAG_DELETE = (tag: string): string[] => ["tag", "-d", tag];
+export const PREFIX_SEPARATOR: string = "\nrepo release: ";
+export const REGISTRY: string = "https://registry.npmjs.org/";
+export const SCOPE_SLASH: string = "/";
+export const ENCODED_SLASH: string = "%2f";
+export const WAIT_POLL_MS: number = 10_000;
+export const WAIT_GIVE_UP_MS: number = 900_000;
+export const WAIT_GIVE_UP_MINUTES: number = 15;
+export const ISO_DATE_LENGTH: number = 10;
+export const GIT_SHOW = (sha: string, file: string): string[] => ["show", `${sha}:${file}`];
+export const GIT_ON_BRANCH = (sha: string, branch: string): string[] => [
+  "merge-base",
+  "--is-ancestor",
+  sha,
+  `origin/${branch}`,
+];
+export const GH_DEFAULT_BRANCH: readonly string[] = ["repo", "view", "--json", "defaultBranchRef"];
+export const GIT_ORIGIN_URL: readonly string[] = ["remote", "get-url", "origin"];
+export const GITHUB_REPO: RegExp = /github\.com[:/]([^/]+\/[^/]+?)(?:\.git)?$/;
+export const REPO_PLACEHOLDER: string = "<owner>/<repo>";
+export const RELEASE_WORKFLOW: string = "release.yml";
+export const ACCESS_URL = (name: string): string => `https://www.npmjs.com/package/${name}/access`;
+export const TARBALL_URL = (name: string, version: string): string =>
+  `${REGISTRY}${name}/-/${name.slice(name.lastIndexOf("/") + 1)}-${version}.tgz`;
+export const NPM_PUBLISH = (tarball: string, prerelease: boolean): string[] => [
+  "publish",
+  tarball,
+  "--access",
+  "public",
+  "--ignore-scripts",
+  ...(prerelease ? ["--tag", "next"] : []),
+];
+export const NPM_TAG = (prerelease: boolean): string => (prerelease ? "next" : "latest");
+export const GH_RELEASE_VIEW = (tag: string): string[] => ["release", "view", tag];
+export const GH_RELEASE_CREATE = (tag: string, notes: string, prerelease: boolean): string[] => [
+  "release",
+  "create",
+  tag,
+  "--verify-tag",
+  "--title",
+  tag,
+  "--notes",
+  notes,
+  ...(prerelease ? ["--prerelease"] : []),
+];
+export const PACK_DIR_PREFIX: string = "repo-pack-";
+export const BUN_PACK = (dir: string): string[] => ["pm", "pack", "--destination", dir, "--quiet"];
+/** `tarball` is a name in the directory tar runs in. */
+export const TAR_MANIFEST = (tarball: string): string[] => ["-xOzf", tarball, "package/package.json"];
+/** Manifest versions that only mean something inside a workspace or against a catalog. */
+export const UNPINNED: RegExp = /^(catalog|workspace):/;
+export const NOT_FOUND: number = 404;
+export const NOT_A_DOCUMENT: string = "an answer that is not a package document";
+export const TARBALL_EXTENSION: string = ".tgz";

package/cli/release/release.test.ts

@@ -0,0 +1,199 @@
+import fs from "node:fs";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { removePlanted } from "../fixtures/planted-repo.ts";
+import { NAME, commit, fakeGh, feat, gitIn, release, snapshot, world, type World } from "../fixtures/release-world.ts";
+
+afterEach(removePlanted);
+
+const TAG = `${NAME}@0.1.1`;
+const SUBJECT = `chore: release ${TAG}`;
+const AGAIN = "run bun repo release again";
+const STAMPED =
+  "# Changelog\n\n## [Unreleased]\n\n## [0.1.1] - 2026-11-09\n\n### Added\n\n- x\n\n## [0.1.0] - 2026-10-01\n\n### Added\n\n- first\n";
+const FIXED =
+  "# Changelog\n\n## [Unreleased]\n\n## [0.1.1] - 2026-11-09\n\n### Added\n\n- x\n\n### Fixed\n\n- y\n\n## [0.1.0] - 2026-10-01\n\n### Added\n\n- first\n";
+const text = (w: World, file: string) => fs.readFileSync(path.join(w.work, file), "utf8");
+const head = (w: World) => gitIn(w.work, "rev-parse", "HEAD");
+const hookFile = (w: World, name: string) => path.join(w.work, ".git", "hooks", name);
+/** Makes the checkout's next run of the git hook `name` refuse (for pre-push: only a push of tags). */
+const refuse = (w: World, name: string, only = "") =>
+  fs.writeFileSync(hookFile(w, name), `#!/bin/sh\n${only}echo no >&2\nexit 1\n`, { mode: 0o755 });
+
+/** A world with a feat released: the output of the first run and whether the tag was out when CI was watched. */
+async function released() {
+  const w = world();
+  feat(w);
+  const seen: { tags: string; pushed: string }[] = [];
+  const onWatch = () =>
+    seen.push({ tags: gitIn(w.remote, "tag", "-l"), pushed: gitIn(w.remote, "log", "-1", "--format=%s") });
+  return { w, seen, got: await release(w, [], fakeGh({ onWatch })) };
+}
+
+describe("a release", () => {
+  it("prints the summary line and exits 0", async () => {
+    const { got } = await released();
+    const line = `${NAME} 0.1.0 → 0.1.1 · committed · pushed · CI passed · tagged ${TAG}\n`;
+    expect(got).toEqual({ code: 0, out: line, err: "" });
+  });
+
+  it("commits only the version line and the stamped changelog", async () => {
+    const { w } = await released();
+    expect(gitIn(w.work, "log", "-1", "--format=%s")).toBe(SUBJECT);
+    const files = gitIn(w.work, "show", "--format=", "--name-only", "HEAD").split("\n");
+    expect(files.sort()).toEqual(["CHANGELOG.md", "package.json"]);
+    expect(gitIn(w.work, "show", "--format=", "--numstat", "HEAD", "--", "package.json")).toBe("1\t1\tpackage.json");
+    expect(text(w, "CHANGELOG.md")).toBe(STAMPED);
+  });
+
+  it("pushes the commit and then tags it, the tag annotated and pushed after CI passed", async () => {
+    const { w, seen } = await released();
+    expect(seen).toEqual([{ tags: `${NAME}@0.1.0`, pushed: SUBJECT }]);
+    expect(gitIn(w.work, "cat-file", "-t", `refs/tags/${TAG}`)).toBe("tag");
+    expect(gitIn(w.work, "rev-parse", `${TAG}^{commit}`)).toBe(head(w));
+    expect(gitIn(w.remote, "rev-parse", `${TAG}^{commit}`)).toBe(head(w));
+    expect(gitIn(w.remote, "rev-parse", "main")).toBe(head(w));
+  });
+});
+
+describe("a release of another kind", () => {
+  it("releases 0.1.0 from 0.0.0 with no tag", async () => {
+    const w = world({ "package.json": { name: NAME, version: "0.0.0" } }, false);
+    commit(w, "feat: add x", { "CHANGELOG.md": "# Changelog\n\n## [Unreleased]\n\n### Added\n\n- x\n" });
+    const got = await release(w, []);
+    expect(got.out).toBe(`${NAME} 0.0.0 → 0.1.0 · committed · pushed · CI passed · tagged ${NAME}@0.1.0\n`);
+  });
+
+  it("takes main when origin names no default branch", async () => {
+    const w = world();
+    feat(w);
+    gitIn(w.work, "remote", "set-head", "origin", "-d");
+    expect((await release(w, [])).code).toBe(0);
+  });
+
+  it("moves 0.x to 1.0.0 with --stable", async () => {
+    const w = world();
+    feat(w);
+    expect((await release(w, ["--stable"])).out).toContain("0.1.0 → 1.0.0 ·");
+  });
+
+  it("starts a prerelease with --pre", async () => {
+    const w = world();
+    feat(w);
+    expect((await release(w, ["--pre", "rc"])).out).toContain("0.1.0 → 0.1.1-rc.0 ·");
+    expect(gitIn(w.work, "tag", "-l")).toContain(`${NAME}@0.1.1-rc.0`);
+  });
+});
+
+describe("a release CI does not pass", () => {
+  const failing = async (behavior: Parameters<typeof fakeGh>[0]) => {
+    const w = world();
+    feat(w);
+    const got = await release(w, [], fakeGh(behavior));
+    return { w, got, short: gitIn(w.work, "rev-parse", "--short=7", "HEAD") };
+  };
+
+  it("prints the jobs and the failed line, pushes, and leaves no tag", async () => {
+    const { w, got, short } = await failing({ conclusion: "failure" });
+    expect(got.out).toContain("failed: test; logs below\nboom\n");
+    const line = `CI failed on ${short} (jobs above); fix it in a new commit, push, and ${AGAIN}`;
+    expect(got).toMatchObject({ code: 1, err: `repo release: ${line}\n` });
+    expect(snapshot(w)).toMatchObject({ tags: `${NAME}@0.1.0`, remoteTags: `${NAME}@0.1.0` });
+    expect(gitIn(w.remote, "log", "-1", "--format=%s")).toBe(SUBJECT);
+  });
+
+  it("says a newer push cancelled the run", async () => {
+    const { w, got, short } = await failing({ conclusion: "cancelled" });
+    expect(got.err).toBe(`repo release: a newer push cancelled CI on ${short}; pull and ${AGAIN}\n`);
+    expect(snapshot(w).remoteTags).toBe(`${NAME}@0.1.0`);
+  });
+
+  it("says there was no CI result when no run appears", async () => {
+    const { w, got, short } = await failing({ run: false });
+    const line = `no CI result for ${short} (no ci run after 120s); it is pushed and untagged; ${AGAIN}`;
+    expect(got).toMatchObject({ code: 1, out: "", err: `repo release: ${line}\n` });
+    expect(snapshot(w).tags).toBe(`${NAME}@0.1.0`);
+  });
+});
+
+/** A world whose release commit is pushed and untagged because CI was red. */
+async function pendingAfterRed() {
+  const w = world();
+  feat(w);
+  await release(w, [], fakeGh({ conclusion: "failure" }));
+  return w;
+}
+
+describe("a rerun after red CI", () => {
+  it("on the release commit adds no commit and tags it", async () => {
+    const w = await pendingAfterRed();
+    const before = head(w);
+    const got = await release(w, []);
+    expect(got).toEqual({ code: 0, out: `${NAME} 0.1.1 · already committed · CI passed · tagged ${TAG}\n`, err: "" });
+    expect(head(w)).toBe(before);
+    expect(gitIn(w.remote, "rev-parse", `${TAG}^{commit}`)).toBe(before);
+  });
+
+  it("after a fix commit folds its entry into the version and tags HEAD", async () => {
+    const w = await pendingAfterRed();
+    commit(w, "fix: y", {
+      "CHANGELOG.md": STAMPED.replace("## [Unreleased]\n", "## [Unreleased]\n\n### Fixed\n\n- y\n"),
+    });
+    const got = await release(w, []);
+    expect(got.out).toBe(`${NAME} 0.1.1 · committed · pushed · CI passed · tagged ${TAG}\n`);
+    expect(gitIn(w.work, "log", "-1", "--format=%s")).toBe(SUBJECT);
+    expect(text(w, "CHANGELOG.md")).toBe(FIXED);
+    expect(gitIn(w.remote, "rev-parse", `${TAG}^{commit}`)).toBe(head(w));
+  });
+
+  it("after a fix commit with nothing under Unreleased makes no commit and tags HEAD", async () => {
+    const w = await pendingAfterRed();
+    commit(w, "fix: y", { "src/y.ts": "export const y = 2;\n" });
+    const before = head(w);
+    const got = await release(w, []);
+    expect(got.out).toBe(`${NAME} 0.1.1 · already committed · CI passed · tagged ${TAG}\n`);
+    expect(gitIn(w.remote, "rev-parse", `${TAG}^{commit}`)).toBe(before);
+  });
+});
+
+describe("a rerun after a push that failed", () => {
+  it("pushes the release commit that never left, then tags it", async () => {
+    const w = world();
+    feat(w);
+    refuse(w, "pre-push");
+    expect((await release(w, [])).err).toMatch(/^repo release: git push failed: .*no/s);
+    expect(gitIn(w.work, "log", "-1", "--format=%s")).toBe(SUBJECT);
+    fs.rmSync(hookFile(w, "pre-push"));
+    const got = await release(w, []);
+    expect(got.out).toBe(`${NAME} 0.1.1 · already committed · pushed · CI passed · tagged ${TAG}\n`);
+    expect(gitIn(w.remote, "rev-parse", "main")).toBe(head(w));
+  });
+
+  it("deletes a local tag that did not reach origin, so a rerun makes it", async () => {
+    const w = world();
+    feat(w);
+    refuse(w, "pre-push", "grep -q refs/tags || exit 0\n");
+    expect((await release(w, [])).err).toMatch(/^repo release: git push failed: .*no/s);
+    expect(gitIn(w.work, "tag", "-l")).toBe(`${NAME}@0.1.0`);
+    fs.rmSync(hookFile(w, "pre-push"));
+    const got = await release(w, []);
+    expect(got.out).toBe(`${NAME} 0.1.1 · already committed · CI passed · tagged ${TAG}\n`);
+  });
+});
+
+describe("a release whose commit git refuses", () => {
+  it("prints the hook output, then one closing line, and restores the files", async () => {
+    const w = world();
+    feat(w);
+    refuse(w, "commit-msg");
+    const before = snapshot(w);
+    const got = await release(w, []);
+    expect(got).toMatchObject({ code: 1, out: "" });
+    const last =
+      "repo release: the hooks refused the release commit (output above); nothing was changed, so fix it and run bun repo release again\n";
+    expect(got.err).toMatch(/^no\n/);
+    expect(got.err.endsWith(`\n${last}`)).toBe(true);
+    expect(snapshot(w)).toEqual(before);
+    expect(snapshot(w).status).toBe("");
+  });
+});

package/cli/release/release.ts

@@ -0,0 +1,145 @@
+import fs from "node:fs";
+import path from "node:path";
+import { waitFor, type Runner, type WaitOutcome } from "../scripts/ci-wait.ts";
+import { stampChangelog } from "./changelog.ts";
+import { must, read, type Tools } from "./git.ts";
+import { writeVersion } from "./manifest.ts";
+import { makePlan, type Plan } from "./plan.ts";
+import {
+  ARROW,
+  CHANGELOG_FILE,
+  FLAG_PRE,
+  FLAG_STABLE,
+  GIT_ADD,
+  GIT_COMMIT,
+  GIT_HEAD,
+  GIT_PUSH,
+  GIT_PUSH_TAG,
+  GIT_RESET,
+  GIT_TAG,
+  GIT_TAG_DELETE,
+  GIT_TOPLEVEL,
+  ISO_DATE_LENGTH,
+  PRE_ID,
+  RELEASE_SUBJECT,
+  SHA_SHOWN,
+} from "./release.constants.ts";
+import {
+  HOOKS_REFUSED,
+  NOT_CHECKOUT,
+  PREFIX,
+  USAGE,
+  ciFailed,
+  ciNoResult,
+  ciSuperseded,
+  summary,
+} from "./release-messages.constants.ts";
+import type { Mode } from "./version.ts";
+
+/** Where `repo release` runs and prints, and the git, gh, clock and sleep it works through. */
+export type ReleaseIo = {
+  cwd: string;
+  stdout: (text: string) => void;
+  stderr: (text: string) => void;
+  git: Runner;
+  gh: Runner;
+  /** Milliseconds; the clock the wait for CI is measured on, and today's date in the changelog. */
+  now: () => number;
+  sleep: (ms: number) => Promise<void>;
+};
+
+/** The mode the arguments ask for, or the usage line. */
+function parseMode(argv: readonly string[]): Mode | string {
+  const [flag, id, ...rest] = argv;
+  if (flag === undefined) return { kind: "auto" };
+  if (flag === FLAG_STABLE && id === undefined) return { kind: "stable" };
+  if (flag === FLAG_PRE && id !== undefined && PRE_ID.test(id) && rest.length === 0) return { kind: "pre", id };
+  return USAGE;
+}
+
+const refuse = (io: ReleaseIo, line: string): number => {
+  io.stderr(`${PREFIX}${line}\n`);
+  return 1;
+};
+
+/** Writes the stamped changelog (and the version, for a bump) and commits both; restores the files if git refuses. */
+function commitRelease(t: Tools, io: ReleaseIo, plan: Plan): void {
+  const file = path.join(t.cwd, CHANGELOG_FILE);
+  fs.writeFileSync(
+    file,
+    stampChangelog(
+      fs.readFileSync(file, "utf8"),
+      plan.version,
+      new Date(io.now()).toISOString().slice(0, ISO_DATE_LENGTH),
+    ),
+  );
+  if (plan.action === "bump") writeVersion(t.cwd, plan.version);
+  try {
+    must(t, GIT_ADD);
+    const got = t.git(GIT_COMMIT(RELEASE_SUBJECT(plan.tag)), t.cwd);
+    if (got.code !== 0) {
+      io.stderr(`${got.stdout}${got.stderr}`);
+      throw new Error(HOOKS_REFUSED);
+    }
+  } catch (error) {
+    must(t, GIT_RESET);
+    throw error;
+  }
+}
+
+/** The refusal line for a CI wait that did not pass. */
+function ciLine(outcome: Exclude<WaitOutcome, { kind: "passed" }>, short: string): string {
+  if (outcome.kind === "failed") return ciFailed(short);
+  return outcome.kind === "superseded" ? ciSuperseded(short) : ciNoResult(short, outcome.detail);
+}
+
+/** Tags HEAD and pushes the tag; a tag that did not reach origin is deleted again, so a rerun makes it. */
+function publishTag(t: Tools, tag: string): void {
+  must(t, GIT_TAG(tag));
+  try {
+    must(t, GIT_PUSH_TAG(tag));
+  } catch (error) {
+    must(t, GIT_TAG_DELETE(tag));
+    throw error;
+  }
+}
+
+/** Commits and pushes what the plan needs, waits on CI for HEAD, and tags it when CI passed. */
+async function carryOut(t: Tools, io: ReleaseIo, plan: Plan): Promise<number> {
+  const steps: string[] = [];
+  if (plan.action === "none") steps.push("already committed");
+  else {
+    commitRelease(t, io, plan);
+    steps.push("committed");
+  }
+  if (plan.action !== "none" || plan.ahead > 0) {
+    must(t, GIT_PUSH(plan.branch));
+    steps.push("pushed");
+  }
+  const short = read(t, GIT_HEAD).slice(0, SHA_SHOWN);
+  const printed: string[] = [];
+  const outcome = await waitFor({ ...io, cwd: t.cwd, stdout: (text) => printed.push(text), git: t.git, gh: t.gh });
+  if (outcome.kind !== "passed") {
+    io.stdout(printed.join(""));
+    return refuse(io, ciLine(outcome, short));
+  }
+  publishTag(t, plan.tag);
+  const move = plan.action === "bump" ? `${plan.from} ${ARROW} ${plan.version}` : plan.version;
+  io.stdout(`${summary({ name: plan.name, move, steps, tag: plan.tag })}\n`);
+  return 0;
+}
+
+/** `repo release [--stable | --pre <id>]`: the whole release of the root package, or the reason it stopped. */
+export async function releaseMain(argv: readonly string[], io: ReleaseIo): Promise<number> {
+  const mode = parseMode(argv);
+  if (typeof mode === "string") return refuse(io, mode);
+  const root = io.git([...GIT_TOPLEVEL], io.cwd).stdout.trim();
+  if (root === "") return refuse(io, NOT_CHECKOUT);
+  const tools: Tools = { cwd: root, git: io.git, gh: io.gh };
+  try {
+    const plan = await makePlan(tools, mode);
+    return typeof plan === "string" ? refuse(io, plan) : await carryOut(tools, io, plan);
+  } catch (error) {
+    return refuse(io, (error /* only Errors are thrown here */ as Error).message);
+  }
+}