bulk-release 2.18.2 → 2.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/package.json +1 -1
  3. package/src/main/js/api/npm.js +5 -0
  4. package/src/main/js/config.js +1 -1
  5. package/src/main/js/processor/release.js +1 -0
  6. package/src/main/js/steps/contextify.js +2 -0
package/CHANGELOG.md CHANGED
@@ -1,3 +1,16 @@
1
+ ## [2.19.0](https://github.com/semrel-extra/zx-bulk-release/compare/v2.18.3...v2.19.0) (2026-04-05)
2
+
3
+ ### Features
4
+ * feat: assert npm version for npm oidc flow ([647c612](https://github.com/semrel-extra/zx-bulk-release/commit/647c612f5ced01c8230ae1f625bbb6920f1e789d))
5
+
6
+ ### Fixes & improvements
7
+ * fix: enable --debug info strem ([3a8ef02](https://github.com/semrel-extra/zx-bulk-release/commit/3a8ef02974a7b7a1fd8624041a37a2203cd6ec56))
8
+
9
+ ## [2.18.3](https://github.com/semrel-extra/zx-bulk-release/compare/v2.18.2...v2.18.3) (2026-04-05)
10
+
11
+ ### Fixes & improvements
12
+ * fix: use default gh username ([5f3ae20](https://github.com/semrel-extra/zx-bulk-release/commit/5f3ae20f4977b8c1f1d09a7367d15d78c211e6a8))
13
+
1
14
  ## [2.18.2](https://github.com/semrel-extra/zx-bulk-release/compare/v2.18.1...v2.18.2) (2026-04-05)
2
15
 
3
16
  ### Fixes & improvements
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "bulk-release",
3
3
  "alias": "bulk-release",
4
- "version": "2.18.2",
4
+ "version": "2.19.0",
5
5
  "description": "zx-based alternative for multi-semantic-release",
6
6
  "type": "module",
7
7
  "exports": {
package/src/main/js/api/npm.js CHANGED
@@ -86,6 +86,11 @@ export const npmPublish = async (pkg) => {
86
86
  // OIDC trusted publishing: no auth token must be present for npm to use OIDC flow.
87
87
  // https://docs.npmjs.com/trusted-publishers/
88
88
  if (npmOidc) {
89
+ const npmVersion = (await $`npm --version`).toString().trim()
90
+ const [major, minor] = npmVersion.split('.').map(Number)
91
+ if (major < 11 || (major === 11 && minor < 5)) {
92
+ throw new Error(`npm OIDC trusted publishing requires npm >= 11.5.0, got ${npmVersion}`)
93
+ }
89
94
  log({pkg})('npm publish: OIDC trusted publishing enabled')
90
95
  npmFlags.push('--provenance')
91
96
  } else {
package/src/main/js/config.js CHANGED
@@ -58,7 +58,7 @@ export const normalizeMetaConfig = (meta) =>
58
58
 
59
59
  export const parseEnv = ({GH_USER, GH_USERNAME, GH_META, GITHUB_USER, GITHUB_USERNAME, GH_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NPM_REGISTRY, NPMRC, NPM_USERCONFIG, NPM_CONFIG_USERCONFIG, NPM_PROVENANCE, NPM_OIDC, ACTIONS_ID_TOKEN_REQUEST_URL, GIT_COMMITTER_NAME, GIT_COMMITTER_EMAIL} = process.env) =>
60
60
  ({
61
- ghUser: GH_USER || GH_USERNAME || GITHUB_USER || GITHUB_USERNAME,
61
+ ghUser: GH_USER || GH_USERNAME || GITHUB_USER || GITHUB_USERNAME || ((GH_TOKEN || GITHUB_TOKEN) ? 'x-access-token' : undefined),
62
62
  ghToken: GH_TOKEN || GITHUB_TOKEN,
63
63
  ghMeta: GH_META,
64
64
  npmConfig: NPMRC || NPM_USERCONFIG || NPM_CONFIG_USERCONFIG,
package/src/main/js/processor/release.js CHANGED
@@ -104,6 +104,7 @@ export const createContext = async ({flags, env: _env, cwd}) => {
104
104
  $.report = report
105
105
  $.env = env
106
106
  $.verbose = !!(flags.debug || $.env.DEBUG ) || $.verbose
107
+ $.quiet = !$.verbose
107
108
 
108
109
  return {
109
110
  report,
package/src/main/js/steps/contextify.js CHANGED
@@ -29,6 +29,7 @@ export const rollbackRelease = async (pkg) => {
29
29
 
30
30
  const cwd = pkg.context.git.root
31
31
  const {ghBasicAuth: basicAuth, ghToken, gitCommitterName, gitCommitterEmail} = pkg.config
32
+ if (!basicAuth) throw new Error('rollback requires git credentials (GH_TOKEN)')
32
33
  const {repoName} = await getRepo(cwd, {basicAuth})
33
34
 
34
35
  log({pkg})(`rollback: cleaning up failed release for tag '${tag}'`)
@@ -98,6 +99,7 @@ export const recover = async (pkg) => {
98
99
 
99
100
  const cwd = await getRoot(pkg.absPath)
100
101
  const {ghBasicAuth: basicAuth, ghToken, gitCommitterName, gitCommitterEmail} = pkg.config
102
+ if (!basicAuth) throw new Error('recover requires git credentials (GH_TOKEN)')
101
103
  const {repoName} = await getRepo(cwd, {basicAuth})
102
104
 
103
105
  log({pkg})(`recover: tag '${tag.ref}' exists but ${pkg.name}@${tag.version} not found on npm, rolling back failed release`)