@zairakai/js-dev-tools 3.7.0 → 3.8.0

package/.gitlab/ci/pipeline-js-package.yml

@@ -393,6 +393,9 @@ js:publish:
   id_tokens:
     NPM_ID_TOKEN:
       aud: "npm:registry.npmjs.org"
+    # Lets npm sign the provenance: the package page shows it was built on GitLab from this project.
+    SIGSTORE_ID_TOKEN:
+      aud: sigstore
   rules:
     - if: $UPDATE_DEPENDENCIES == "true"
       when: never
@@ -406,7 +409,7 @@ js:publish:
       fi
       echo "Publishing ${NPM_PACKAGE_NAME}@${CI_COMMIT_TAG} to npm (tag ${npm_tag})..."
       npm version "${CI_COMMIT_TAG}" --no-git-tag-version --allow-same-version
-      npm publish --access public --tag "${npm_tag}"
+      npm publish --provenance --access public --tag "${npm_tag}"
   environment:
     name: production
     url: https://www.npmjs.com/package/${NPM_PACKAGE_NAME}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zairakai/js-dev-tools",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "The unified and centralized development toolkit for JavaScript/TypeScript projects - ESLint, Prettier, Stylelint, Knip, Vitest, Git Hooks, and GitLab CI pipeline templates",
   "keywords": [
     "dev-tools",
@@ -89,14 +89,14 @@
   },
   "dependencies": {
     "@stanislas-poisson/js-dev-tools": "^1.0.0",
-    "eslint": "^10.12.0",
+    "eslint": "^10.13.0",
     "markdownlint-cli2": "^0.23.3",
     "prettier": "^3.9.10",
     "stylelint": "^17.16.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^5.0.5",
-    "knip": "^6.41.0",
+    "knip": "^6.42.0",
     "sort-package-json": "^4.1.0",
     "typescript": "^6.0.3",
     "vitest": "^5.0.5",

package/scripts/update-dependencies.mjs

@@ -26,6 +26,7 @@ import { existsSync, readFileSync } from 'node:fs'
 import { pathToFileURL } from 'node:url'
 
 const CONFIG_FILE = '.dependency-update.json'
+const PIPELINE_FILE = '.gitlab-ci.yml'
 const COMMIT_SUBJECT = 'chore(deps): update the dependencies'
 const BRANCH_PREFIX = 'chore/update-dependencies'
 
@@ -152,6 +153,16 @@ export function planTag({ config, last, commits, before, after, sections = RUNTI
   return { version: nextVersion(last, config.tag.level), reason: 'a published range changed' }
 }
 
+/**
+ * True when a diff changes one `ref:` line and nothing else. The install of the tools moves the `ref:` of the shared
+ * pipeline to the installed version: that is the only change of the pipeline file an update may commit.
+ */
+export function isRefOnlyChange(diff) {
+  const changed = diff.split('\n').filter((line) => /^[+-]/.test(line) && !/^(\+\+\+|---)/.test(line))
+
+  return 2 === changed.length && changed.every((line) => /^[+-]\s*ref:\s*\S+\s*$/.test(line))
+}
+
 // ---------------------------------------------------------------------------------------------------------------------
 
 const log = (message) => console.info(message)
@@ -336,6 +347,11 @@ async function update(config) {
   // Only the manifest and the lock file: the postinstall of the tools can rewrite other files of the project in CI.
   const files = [ecosystem.file, ...['package-lock.json', 'composer.lock'].filter((file) => existsSync(file))]
 
+  // The one exception: the `ref:` of the shared pipeline follows the installed version of the tools.
+  if (existsSync(PIPELINE_FILE) && isRefOnlyChange(run('git', ['diff', '-U0', '--', PIPELINE_FILE]))) {
+    files.push(PIPELINE_FILE)
+  }
+
   if ('' === run('git', ['status', '--porcelain', '--', ...files])) {
     log('Everything is up to date.')
     return