breakaway 1.4.0-main.26 → 1.4.0-main.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "1.4.0-main.26",
+  "version": "1.4.0-main.28",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/scripts/lib/package-release.js

@@ -56,6 +56,25 @@ export function nextPrerelease(current, tags, prefix = 'v') {
   return { version, base, tag: `${prefix}${version}` };
 }
 
+/**
+ * The version a stable release's pull request sets package.json to (BRK-118, WEB-39): the next minor or major after
+ * the stable, or null when there is nothing to set. A patch is null, since the pre-releases count patches by
+ * themselves, and so is a package.json already at or past the choice (main moved on before an older pre-release was
+ * released).
+ * @param {string} stable the version just released, like 1.3.0
+ * @param {string} next patch, minor, or major
+ * @param {string} current package.json's version on the default branch
+ * @returns {string | null}
+ */
+export function nextVersion(stable, next, current) {
+  const [maj, min] = parts(stable);
+  parts(current);
+  if (next === 'patch') return null;
+  if (next !== 'minor' && next !== 'major') throw new Error(`next is patch, minor, or major, not "${next}".`);
+  const version = next === 'major' ? `${maj + 1}.0.0` : `${maj}.${min + 1}.0`;
+  return compareVersions(current, version) >= 0 ? null : version;
+}
+
 /** The pre-release among `tags` (the tags on one commit), if one was already staged from it. */
 export function prereleaseAmong(tags, prefix = 'v') {
   const prerelease = prereleasePattern(prefix);

package/scripts/package-release.mjs

@@ -7,13 +7,15 @@
  *       exists=true when that commit already has a pre-release (a second run for one merge stages nothing)
  *   node scripts/package-release.mjs stable <pre-release tag> --prefix <tag prefix>
  *       the stable version and tag it becomes, and the commit it was staged from; stops if that stable exists
+ *   node scripts/package-release.mjs next <stable> <patch|minor|major> --dir <path>
+ *       the version to set <path>/package.json to after the stable, empty for none (WEB-39)
  * Reads the tags with git, so run it in a checkout with its tags (fetch-depth: 0). Copied by `repos init`.
  */
 import { execFileSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseArgs } from 'node:util';
-import { nextPrerelease, prereleaseAmong, stableOf } from './lib/package-release.js';
+import { nextPrerelease, nextVersion, prereleaseAmong, stableOf } from './lib/package-release.js';
 
 const { positionals, values: o } = parseArgs({
   allowPositionals: true,
@@ -41,9 +43,15 @@ try {
       throw new Error(`${o.prefix}${version} is already released. Pick a newer pre-release.`);
     const [commit] = git('rev-list', '-n', '1', `refs/tags/${tag}`);
     console.log(`version=${version}\ntag=${o.prefix}${version}\ncommit=${commit}`);
+  } else if (command === 'next' && tag) {
+    const current = JSON.parse(readFileSync(join(o.dir, 'package.json'), 'utf8')).version;
+    const version = nextVersion(tag, positionals[2] ?? 'patch', current);
+    if (!version && positionals[2] && positionals[2] !== 'patch')
+      console.error(`package.json already says ${current}, at or past the next ${positionals[2]} after ${tag}.`);
+    console.log(`version=${version ?? ''}`);
   } else {
     throw new Error(
-      'Usage: package-release.mjs prerelease --dir <path> --prefix <p> [--sha <commit>] | stable <tag> --prefix <p>',
+      'Usage: package-release.mjs prerelease --dir <path> --prefix <p> [--sha <commit>] | stable <tag> --prefix <p> | next <stable> <patch|minor|major> --dir <path>',
     );
   }
 } catch (error) {

package/scripts/tasks/cli.js

@@ -106,18 +106,27 @@ export function pullAgentRequest(action, number, { repo = null, problem, note, f
 }
 
 /**
- * `npx breakaway github release <pre-release>` (BRK-103): the owner releases a package's pre-release as its stable, as
- * Release on the GitHub page does. The board starts the repository's release.yml stable job, and npm waits for the
- * owner's 2FA; it refuses an agent, so the request always says who asks.
+ * `npx breakaway github release <pre-release> [--next patch|minor|major]` (BRK-103, WEB-39): the owner releases a
+ * package's pre-release as its stable, as Release on the GitHub page does, with what the default branch works toward
+ * next. The board starts the repository's release.yml stable job, and npm waits for the owner's 2FA; it refuses an
+ * agent, so the request always says who asks, and refuses a pre-release whose stable is already out (409).
  * @param {string | undefined} version the pre-release, like 1.4.0-main.5 (or its tag)
- * @param {{ repo?: string | null, by?: string }} [options]
+ * @param {{ repo?: string | null, by?: string, next?: string | null }} [options]
  * @returns {{ error?: string, request?: [string, string, Record<string, string>] }}
  */
-export function packageReleaseRequest(version, { repo = null, by } = {}) {
+export function packageReleaseRequest(version, { repo = null, by, next = null } = {}) {
   const v = String(version ?? '').trim();
   if (!/^(?:\S+@|v)?\d+\.\d+\.\d+-main\.\d+$/u.test(v))
     return { error: 'say which pre-release: npx breakaway github release <version>, like 1.4.0-main.5' };
-  return { request: ['POST', 'github/release', { version: v, ...(repo ? { repo } : {}), ...(by ? { by } : {}) }] };
+  if (next !== null && next !== undefined && !['patch', 'minor', 'major'].includes(String(next)))
+    return { error: '--next is patch, minor, or major' };
+  return {
+    request: [
+      'POST',
+      'github/release',
+      { version: v, ...(next ? { next: String(next) } : {}), ...(repo ? { repo } : {}), ...(by ? { by } : {}) },
+    ],
+  };
 }
 
 export const REVIEW_VERDICTS = ['ready', 'follow-up', 'changes'];

package/scripts/tasks/pipeline.js

@@ -576,7 +576,10 @@ export function lintWorkflow(text) {
       if (!(need in doc.jobs)) problems.push(`${where} needs ${need}, which isn't a job`);
     const { steps = [], ...rest } = job;
     checkExpressions(stringsIn({ if: rest.if }), where, [], true);
-    checkExpressions(stringsIn({ ...rest, if: undefined }), where, [], false);
+    checkExpressions(stringsIn({ ...rest, if: undefined, outputs: undefined }), where, [], false);
+    // A job's outputs read its steps once they've all run.
+    const stepIds = Array.isArray(steps) ? steps.map((s) => s?.id).filter(Boolean) : [];
+    checkExpressions(stringsIn({ outputs: rest.outputs }), `${where}'s outputs`, stepIds, false);
     if (stringsIn(job).some(({ text: value }) => /\bsecrets\./u.test(value)) && !job.environment)
       problems.push(`${where} reads a secret outside an environment`);
     if (!Array.isArray(steps) || !steps.length) {

package/scripts/tasks.mjs

@@ -181,7 +181,9 @@ Reading                (list, next, claim, and add work in this checkout's repos
                          Review with an agent does; on a Dependabot one it tests the update, as Safe to merge? does
                          (owner)  [--note <text>] [--repo <slug>] [--force]
   github release <pre-release>   release a package's pre-release (1.4.0-main.5) as its stable on latest, as Release on the
-                         GitHub page does: the board starts release.yml's stable job, and npm waits for your 2FA (owner)  [--repo <slug>]
+                         GitHub page does: the board starts release.yml's stable job, and npm waits for your 2FA (owner);
+                         --next minor or major opens the pull request that sets the next version (patch, the default, counts
+                         by itself). Refused once that stable is out  [--next patch|minor|major] [--repo <slug>]
   specs                  the repository's specs, newest first: each one's status and its tasks  [--repo <slug>]
   specs show <path>      one spec: its status, last change, Markdown, and the tasks that link it  [--repo <slug>]
   github                 the checkout's repository on GitHub: open pull requests, checks, reviews, CI, deploys, alerts  [--sync] [--repo <slug>]
@@ -1441,13 +1443,15 @@ const commands = {
       const built = packageReleaseRequest(args[1], {
         repo: (await checkoutRepo()).slug,
         by: opts.as ?? setting('AGENT'),
+        next: typeof opts.next === 'string' ? opts.next : null,
       });
       if (built.error || !built.request) fail(built.error ?? 'bad request');
       const answer = await call(...built.request);
+      const next = built.request[2].next;
       print(
         answer,
         () =>
-          `Started ${answer.workflow}'s stable job for ${args[1]}. It stages the stable on npm's latest, where it waits for your approval with 2FA.`,
+          `Started ${answer.workflow}'s stable job for ${args[1]}. It stages the stable on npm's latest, where it waits for your approval with 2FA.${next && next !== 'patch' ? ` Then a pull request sets package.json to the next ${next}.` : ''}`,
       );
       return;
     }

package/src/cli-version.js

@@ -4,5 +4,5 @@
  * and how to update it. scripts/tasks/version.test.js fails when the copied files change and this doesn't:
  * so it lives in the board's package (CLD-135) and the CLI imports it from here.
  */
-export const CLI_VERSION = 71;
-export const CLI_FINGERPRINT = '908852b62fff3574';
+export const CLI_VERSION = 72;
+export const CLI_FINGERPRINT = '393b3864ca66fb71';

package/template/pipeline/release.yml

@@ -19,6 +19,14 @@ on:
         description: The pre-release to release as stable, like {{prefixName}}1.4.0-main.5
         required: true
         type: string
+      # Pre-releases count patches from the stable by themselves. With minor or major, once the stable is staged, the
+      # next-version job opens the pull request that sets package.json to the next minor or major after it.
+      next:
+        description: What {{branchName}} works toward next. Patch opens nothing; minor or major opens a pull request that sets package.json
+        required: false
+        default: patch
+        type: choice
+        options: [patch, minor, major]
 
 permissions: {}
 
@@ -139,6 +147,8 @@ jobs:
     permissions:
       contents: write
       id-token: write
+    outputs:
+      version: ${{ steps.version.outputs.version }}
     env:
       GITHUB_TOKEN: ${{ github.token }}
       GH_TOKEN: ${{ github.token }}
@@ -210,3 +220,64 @@ jobs:
           TAG: ${{ steps.version.outputs.tag }}
           COMMIT: ${{ steps.version.outputs.commit }}
         run: gh api -X POST "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/tags/$TAG" -f "sha=$COMMIT" > /dev/null
+
+  # With next minor or major, a pull request sets package.json to the next minor or major after the stable, so the next
+  # merge stages X.Y.0-main.1 instead of the stable's next patch. It runs after the stable is staged, in its own job with
+  # no environment and no secrets, and writes through GitHub's API, so no credentials are kept in a checkout. A pull
+  # request opened with GITHUB_TOKEN starts no workflows, so its checks run once the owner closes and reopens it, or
+  # pushes to it.
+  next-version:
+    name: next version
+    needs: stable
+    if: inputs.next == 'minor' || inputs.next == 'major'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+      STABLE: ${{ needs.stable.outputs.version }}
+      NEXT: ${{ inputs.next }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: {{branchName}}
+          persist-credentials: false
+      - name: Open the pull request that sets the version
+        run: |
+          set -euo pipefail
+          version=$(node scripts/package-release.mjs next "$STABLE" "$NEXT" --dir "$DIRECTORY" | sed 's/^version=//')
+          if [ -z "$version" ]; then
+            echo "::notice title=No version to set::{{branchName}}'s package.json is already at or past the next $NEXT after $STABLE."
+            exit 0
+          fi
+          branch="next-version/$version"
+          if [ -n "$(gh pr list --repo "$GITHUB_REPOSITORY" --head "$branch" --state open --json number --jq '.[].number')" ]; then
+            echo "::notice title=Already open::A pull request from $branch sets $version."
+            exit 0
+          fi
+          file=package.json
+          if [ "$DIRECTORY" != . ]; then file="$DIRECTORY/package.json"; fi
+          # A run GitHub refused the pull request leaves its branch: open the pull request from it.
+          if ! gh api "repos/$GITHUB_REPOSITORY/git/ref/heads/$branch" >/dev/null 2>&1; then
+            base=$(git rev-parse HEAD)
+            blob=$(git rev-parse "HEAD:$file")
+            export V=$version F=$file
+            node -e "const f=process.env.F,p=JSON.parse(require('fs').readFileSync(f));p.version=process.env.V;require('fs').writeFileSync(f,JSON.stringify(p,null,2)+'\n')"
+            gh api -X POST "repos/$GITHUB_REPOSITORY/git/refs" -f "ref=refs/heads/$branch" -f "sha=$base" >/dev/null
+            gh api -X PUT "repos/$GITHUB_REPOSITORY/contents/$file" -f "branch=$branch" -f "sha=$blob" \
+              -f "message=Set $PACKAGE's version to $version" -f "content=$(base64 -w0 "$file")" >/dev/null
+          fi
+          printf '%s\n' \
+            "$PACKAGE@$STABLE is staged, and the Release workflow was run with next $NEXT: this sets $file's version to $version." \
+            "" \
+            "Once it merges, the next pre-release is $version-main.1 instead of $STABLE's next patch." \
+            "" \
+            "Opened with the workflow's token, which starts no workflows: close and reopen this pull request, or push to it, for its checks to run." \
+            > "$RUNNER_TEMP/body.md"
+          if ! gh pr create --repo "$GITHUB_REPOSITORY" --base {{branchName}} --head "$branch" \
+            --title "Set $PACKAGE's version to $version" --body-file "$RUNNER_TEMP/body.md"; then
+            echo "::error title=GitHub refused the pull request::$branch sets $version, but the repository doesn't let Actions open pull requests. Turn on Settings, Actions, General, Allow GitHub Actions to create and approve pull requests, then re-run this job, or open the pull request from $branch yourself."
+            exit 1
+          fi