auditor-lambda 0.2.10 → 0.2.11

package/README.md

@@ -183,6 +183,8 @@ The short version is:
 ```bash
 npm install
 npm run verify:release
+npm run release:patch
+npm run release:patch:publish
 ```
 
 For GitHub Actions publication and npm Trusted Publishing setup, see `docs/releasing.md`.

package/audit-code-wrapper-lib.mjs

@@ -141,9 +141,13 @@ async function newestMtimeMs(path) {
   return newest;
 }
 
-async function shouldBuildDist() {
-  if (!(await fileExists(distEntry))) {
-    if (!(await fileExists(sourceRoot)) || !(await fileExists(tsconfigPath))) {
+export async function shouldBuildDistForPaths({
+  distEntryPath,
+  sourceRootPath,
+  tsconfigPath: tsconfigPathValue,
+}) {
+  if (!(await fileExists(distEntryPath))) {
+    if (!(await fileExists(sourceRootPath)) || !(await fileExists(tsconfigPathValue))) {
       throw new Error(
         'Bundled dist is missing and source files are unavailable for rebuild.',
       );
@@ -151,18 +155,25 @@ async function shouldBuildDist() {
     return true;
   }
 
-  if (!(await fileExists(sourceRoot)) || !(await fileExists(tsconfigPath))) {
+  if (!(await fileExists(sourceRootPath)) || !(await fileExists(tsconfigPathValue))) {
     return false;
   }
 
-  const distMtime = (await stat(distEntry)).mtimeMs;
-  const sourceMtime = await newestMtimeMs(sourceRoot);
-  const tsconfigMtime = (await stat(tsconfigPath)).mtimeMs;
-  const packageJsonMtime = (await stat(packageJsonPath)).mtimeMs;
-  const newestInput = Math.max(sourceMtime, tsconfigMtime, packageJsonMtime);
+  const distMtime = (await stat(distEntryPath)).mtimeMs;
+  const sourceMtime = await newestMtimeMs(sourceRootPath);
+  const tsconfigMtime = (await stat(tsconfigPathValue)).mtimeMs;
+  const newestInput = Math.max(sourceMtime, tsconfigMtime);
   return distMtime < newestInput;
 }
 
+async function shouldBuildDist() {
+  return await shouldBuildDistForPaths({
+    distEntryPath: distEntry,
+    sourceRootPath: sourceRoot,
+    tsconfigPath,
+  });
+}
+
 async function releaseBuildLock(handle) {
   try {
     await handle?.close();

package/docs/releasing.md

@@ -41,6 +41,53 @@ npm publish --dry-run
 
 The local dry run is still valuable even though the real publish happens in GitHub Actions. It proves the packed artifact, lifecycle hooks, and publish metadata before you spend a release on a broken workflow run.
 
+## Version bump helpers
+
+You do not need to look up the current version before cutting a release bump.
+
+From the repository root:
+
+```bash
+npm run release:patch
+```
+
+That delegates the increment to `npm version patch`, updates `package.json` and `package-lock.json`, and creates the matching release commit and git tag in the existing repository format:
+
+Under the hood, the helper uses `npm version patch --no-git-tag-version` and then creates the release commit and annotated git tag explicitly so the workflow stays compatible with current npm CLI behavior.
+
+- commit: `release: vX.Y.Z`
+- tag: `vX.Y.Z`
+
+The repository also exposes:
+
+- `npm run release:minor`
+- `npm run release:major`
+
+After the version bump, push `main` and the new tag, then publish through the GitHub Actions trusted publishing flow.
+
+## One-command release publish
+
+When you want the repository to do the full maintainer flow in one command, use:
+
+```bash
+npm run release:patch:publish
+```
+
+That command:
+
+1. verifies the git worktree is clean and you are on `main`
+2. runs `npm run verify:release`
+3. bumps the version, commits `package.json` and `package-lock.json`, and creates the annotated release tag
+4. pushes `main` and the new release tag
+5. creates the matching GitHub Release
+6. waits for `publish-package.yml` to publish through Trusted Publishing
+7. confirms the new npm version resolves from the registry before exiting
+
+Minor and major variants are also available:
+
+- `npm run release:minor:publish`
+- `npm run release:major:publish`
+
 ## Supported Node lines
 
 Routine CI currently exercises the repository on Node `20` and Node `22`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auditor-lambda",
-  "version": "0.2.10",
+  "version": "0.2.11",
   "private": false,
   "description": "Portable hybrid code-auditing framework for arbitrary repositories.",
   "type": "module",
@@ -22,6 +22,12 @@
     "build": "tsc -p tsconfig.json",
     "check": "tsc -p tsconfig.json --noEmit",
     "test": "npm run build && node --test tests/*.test.mjs",
+    "release:patch": "node scripts/release-and-publish.mjs patch --bump-only",
+    "release:minor": "node scripts/release-and-publish.mjs minor --bump-only",
+    "release:major": "node scripts/release-and-publish.mjs major --bump-only",
+    "release:patch:publish": "node scripts/release-and-publish.mjs patch",
+    "release:minor:publish": "node scripts/release-and-publish.mjs minor",
+    "release:major:publish": "node scripts/release-and-publish.mjs major",
     "verify:release": "npm run check && npm test && npm run smoke:linked-audit-code && npm run smoke:packaged-audit-code",
     "smoke:linked-audit-code": "node scripts/smoke-linked-audit-code.mjs",
     "smoke:packaged-audit-code": "node scripts/smoke-packaged-audit-code.mjs",