bulk-release 2.2.13

package/README.md

@@ -0,0 +1,312 @@
+# zx-bulk-release
+> [zx](https://github.com/google/zx)-based alternative for [multi-semantic-release](https://github.com/dhoulb/multi-semantic-release)
+
+[![CI](https://github.com/semrel-extra/zx-bulk-release/workflows/CI/badge.svg)](https://github.com/semrel-extra/zx-bulk-release/actions)
+[![Maintainability](https://api.codeclimate.com/v1/badges/bb94e929b1b6430781b5/maintainability)](https://codeclimate.com/github/semrel-extra/zx-bulk-release/maintainability)
+[![Test Coverage](https://api.codeclimate.com/v1/badges/bb94e929b1b6430781b5/test_coverage)](https://codeclimate.com/github/semrel-extra/zx-bulk-release/test_coverage)
+[![npm (tag)](https://img.shields.io/npm/v/zx-bulk-release)](https://www.npmjs.com/package/zx-bulk-release)
+
+🚧 Work in progress. Early access preview
+
+## Key features
+* [Conventional commits](https://www.conventionalcommits.org/en/v1.0.0/#specification) trigger semantic releases.
+* Automated cross-pkg version bumping.
+* Predictable [toposort](https://githib.com/semrel-extra/topo)-driven flow.
+* No default branch blocking (no release commits).
+* Pkg changelogs go to `changelog` branch (configurable).
+* Docs are published to `gh-pages` branch (configurable).
+* No extra builds. The required deps are fetched from the pkg registry (`npmFetch` config opt).
+
+## Roadmap
+* [x] Store release metrics to `meta`.
+* [ ] ~~Self-repair. Restore broken/missing metadata from external registries (npm, pypi, m2)~~. Tags should be the only source of truth
+* [ ] Multistack. Add support for java/kt/py.
+* [ ] Semaphore. Let several release agents to serve the monorepo at the same time.
+
+## Requirements
+* macOS / linux
+* Node.js >= 16.0.0
+* npm >=7 / yarn >= 3
+
+## Usage
+### Install
+```shell
+yarn add zx-bulk-release
+```
+### CLI
+```shell
+GH_TOKEN=ghtoken GH_USER=username NPM_TOKEN=npmtoken npx zx-bulk-release [opts]
+```
+| Flag                         | Description                                                    | Default          |
+|------------------------------|----------------------------------------------------------------|------------------|
+| `--ignore`                   | Packages to ignore: `a, b`                                     |                  |
+| `--include-private`          | Include `private` packages                                     | `false`          |
+| `--concurrency`              | `build/publish` threads limit                                  | `os.cpus.length` |
+| `--no-build`                 | Skip `buildCmd` invoke                                         |                  |
+| `--no-npm-fetch`             | Disable npm artifacts fetching                                 |                  |                      
+| `--dry-run` / `--no-publish` | Disable any publish logic                                      |                  |
+| `--report`                   | Persist release state to file                                  |                  |
+| `--debug`                    | Enable [zx](https://github.com/google/zx#verbose) verbose mode |                  |
+
+### JS API
+```js
+import { run } from 'zx-bulk-release'
+
+const cwd = '/foo/bar'
+const env = {GH_TOKEN: 'foo', NPM_TOKEN: 'bar'}
+const flags = {dryRun: true}
+
+await run({
+  cwd,    // Defaults to process.cwd()
+  flags,  // Defaults to process.env
+  env     // Defaults to minimist-parsed `process.argv.slice(2)`
+})
+```
+
+### Config
+Any [cosmiconfig](https://github.com/davidtheclark/cosmiconfig) compliant format: `.releaserc`, `.release.json`, `.release.yaml`, etc.
+```json
+{
+  "cmd": "yarn && yarn build && yarn test",
+  "npmFetch": true,
+  "changelog": "changelog",
+  "ghPages": "gh-pages"
+}
+```
+
+### Demo
+* [demo-zx-bulk-release](https://github.com/semrel-extra/demo-zx-bulk-release)
+* [qiwi/pijma](https://github.com/qiwi/pijma)
+
+### Output
+
+[Compact and clear logs](https://github.com/semrel-extra/demo-zx-bulk-release/runs/7090161341?check_suite_focus=true#step:6:1)
+
+```shell
+Run npm_config_yes=true npx zx-bulk-release
+zx-bulk-release
+[@semrel-extra/zxbr-test-a] semantic changes [
+  {
+    group: 'Fixes & improvements',
+    releaseType: 'patch',
+    change: 'fix(a): random',
+    subj: 'fix(a): random',
+    body: '',
+    short: '6ff25bd',
+    hash: '6ff25bd421755b929ef2b58f35c727670fd93849'
+  }
+]
+[@semrel-extra/zxbr-test-a] run cmd 'yarn && yarn build && yarn test'
+[@semrel-extra/zxbr-test-a] push release tag 2022.6.27-semrel-extra.zxbr-test-a.1.8.1-f0
+[@semrel-extra/zxbr-test-a] push artifact to branch 'meta'
+[@semrel-extra/zxbr-test-a] push changelog
+[@semrel-extra/zxbr-test-a] publish npm package @semrel-extra/zxbr-test-a 1.8.1 to https://registry.npmjs.org
+[@semrel-extra/zxbr-test-a] create gh release
+[@semrel-extra/zxbr-test-b] semantic changes [
+  {
+    group: 'Dependencies',
+    releaseType: 'patch',
+    change: 'perf',
+    subj: 'perf: @semrel-extra/zxbr-test-a updated to 1.8.1'
+  }
+]
+[@semrel-extra/zxbr-test-b] run cmd 'yarn && yarn build && yarn test'
+[@semrel-extra/zxbr-test-b] push release tag 2022.6.27-semrel-extra.zxbr-test-b.1.3.5-f0
+[@semrel-extra/zxbr-test-b] push artifact to branch 'meta'
+[@semrel-extra/zxbr-test-b] push changelog
+[@semrel-extra/zxbr-test-b] publish npm package @semrel-extra/zxbr-test-b 1.3.5 to https://registry.npmjs.org
+[@semrel-extra/zxbr-test-b] create gh release
+[@semrel-extra/zxbr-test-d] semantic changes [
+```
+
+## Implementation notes
+### Flow
+```js
+try {
+  const {packages, queue, root} = await topo({cwd, flags})
+  console.log('queue:', queue)
+
+  for (let name of queue) {
+    const pkg = packages[name]
+
+    await analyze(pkg, packages, root)
+
+    if (pkg.changes.length === 0) continue
+
+    await build(pkg, packages)
+
+    if (flags.dryRun) continue
+
+    await publish(pkg)
+  }
+} catch (e) {
+  console.error(e)
+  throw e
+}
+```
+
+### `topo`
+[Toposort](https://github.com/semrel-extra/topo) is used to resolve the pkg release queue.
+By default, it omits the packages marked as `private`. You can override this by setting the `--include-private` flag.
+
+### `analyze`
+Determines pkg changes, release type, next version etc.
+
+```js
+export const analyze = async (pkg, packages, root) => {
+  pkg.config = await getPkgConfig(pkg.absPath, root.absPath)
+  pkg.latest = await getLatest(pkg)
+
+  const semanticChanges = await getSemanticChanges(pkg.absPath, pkg.latest.tag?.ref)
+  const depsChanges = await updateDeps(pkg, packages)
+  const changes = [...semanticChanges, ...depsChanges]
+
+  pkg.changes = changes
+  pkg.version = resolvePkgVersion(changes, pkg.latest.tag?.version || pkg.manifest.version)
+  pkg.manifest.version = pkg.version
+
+  console.log(`[${pkg.name}] semantic changes`, changes)
+}
+```
+
+### `build`
+Applies `config.cmd` to build pkg assets: bundles, docs, etc.
+```js
+export const build = async (pkg, packages) => {
+  // ...
+  if (!pkg.fetched && config.cmd) {
+    console.log(`[${pkg.name}] run cmd '${config.cmd}'`)
+    await $.o({cwd: pkg.absPath, quote: v => v})`${config.cmd}`
+  }
+  // ...
+}
+```
+
+### `publish`
+Publish the pkg to git, npm, gh-pages, gh-release, etc.
+```js
+export const publish = async (pkg) => {
+  await fs.writeJson(pkg.manifestPath, pkg.manifest, {spaces: 2})
+  await pushTag(pkg)
+  await pushMeta(pkg)
+  await pushChangelog(pkg)
+  await npmPublish(pkg)
+  await ghRelease(pkg)
+  await ghPages(pkg)
+}
+```
+
+### Tags
+[Lerna](https://github.com/lerna/lerna) tags (like `@pkg/name@v1.0.0-beta.0`) are suitable for monorepos, but they don’t follow [semver spec](https://semver.org/). Therefore, we propose another contract:
+```js
+'2022.6.13-optional-org.pkg-name.v1.0.0-beta.1+sha.1-f0'
+// date    name                  version             format
+```
+Note, [npm-package-name charset](https://www.npmjs.com/package/validate-npm-package-name) is wider than [semver](https://semver.org/spec/v2.0.0.html#spec-item-4), so we need a pinch of [base64url magic](https://stackoverflow.com/questions/55389211/string-based-data-encoding-base64-vs-base64url) for some cases.
+```js
+'2022.6.13-examplecom.v1.0.0.ZXhhbXBsZS5jb20-f1'
+// date    name       ver    b64             format
+```
+
+### env vars
+
+```js
+export const parseEnv = (env = process.env) => {
+  const {GH_USER, GH_USERNAME, GITHUB_USER, GITHUB_USERNAME, GH_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NPM_REGISTRY, NPMRC, NPM_USERCONFIG, NPM_CONFIG_USERCONFIG, GIT_COMMITTER_NAME, GIT_COMMITTER_EMAIL} = env
+
+  return {
+    ghUser:             GH_USER || GH_USERNAME || GITHUB_USER || GITHUB_USERNAME,
+    ghToken:            GH_TOKEN || GITHUB_TOKEN,
+    npmToken:           NPM_TOKEN,
+    // npmConfig suppresses npmToken
+    npmConfig:          NPMRC || NPM_USERCONFIG || NPM_CONFIG_USERCONFIG,
+    npmRegistry:        NPM_REGISTRY || 'https://registry.npmjs.org',
+    gitCommitterName:   GIT_COMMITTER_NAME || 'Semrel Extra Bot',
+    gitCommitterEmail:  GIT_COMMITTER_EMAIL || 'semrel-extra-bot@hotmail.com',
+  }
+}
+```
+
+### Meta
+
+Each release stores its result into the `meta` branch.  
+`2022-6-26-semrel-extra-zxbr-test-c-1-3-1-f0.json`
+```json
+{
+  "META_VERSION": "1",
+  "name": "@semrel-extra/zxbr-test-c",
+  "hash": "07b7df33f0159f674c940bd7bbb2652cdaef5207",
+  "version": "1.3.1",
+  "dependencies": {
+    "@semrel-extra/zxbr-test-a": "^1.4.0",
+    "@semrel-extra/zxbr-test-d": "~1.2.0"
+  }
+}
+```
+
+### Report
+
+Release process state is reported to the console and to a file if `--report` flag is set to `/some/path/release-report.json`, for example.
+```js
+{
+  status: 'success',            // 'sucess' | 'failure' | 'pending'
+  error: null,                  // null or Error
+  queue: ['a', 'b', 'c', 'd']   // release queue
+  packages: [{
+    name: 'a',
+    version: '1.1.0',
+    path: '/pkg/abs/path',
+    relPath: 'pkg/rel/path',
+    config: {                   // pkg config
+      changelog: 'changelog',
+      npmFetch: true
+    },                 
+    changes: [{                 // semantic changes
+      group: 'Features',
+      releaseType: 'minor',
+      change: 'feat: add feat',
+      subj: 'feat: add feat',
+      body: '',
+      short: '792512c',
+      hash: '792512cccd69c6345d9d32d3d73e2591ea1776b5'
+    }],                  
+    tag: {
+      version: 'v1.1.0',
+      name: 'a',
+      ref: '2022.6.22-a.v1.1.0-f0'
+    },
+    releaseType: 'minor',       // 'major' | 'minor' | 'patch'
+    prevVersion: '1.0.0'        // previous version or null
+  }, {
+    name: 'b',
+    // ...
+  }],
+  events: [
+    {msg: ['zx-bulk-release'], scope:'~', date: 1665839585488, level: 'info'},
+    {msg: ['queue:',['a','b']], scope:'~', date: 1665839585493, level: 'info'},
+    {msg: ["run buildCmd 'yarn && yarn build && yarn test'"], scope: 'a', date: 1665839585719, level:'info'},
+    // ...
+  ]
+}
+```
+
+## References
+* [semrel-extra/zx-semrel](https://github.com/semrel-extra/zx-semrel)
+* [dhoulb/multi-semantic-release](https://github.com/dhoulb/multi-semantic-release)
+* [semantic-release/semantic-release](https://github.com/semantic-release/semantic-release)
+* [conventional-changelog/releaser-tools](https://github.com/conventional-changelog/releaser-tools)
+* [pmowrer/semantic-release-monorepo](https://github.com/pmowrer/semantic-release-monorepo)
+* [bubkoo/semantic-release-monorepo](https://github.com/bubkoo/semantic-release-monorepo)
+* [ext/semantic-release-lerna](https://github.com/ext/semantic-release-lerna)
+* [jscutlery/semver](https://github.com/jscutlery/semver)
+* [microsoft/rushstack](https://github.com/microsoft/rushstack) / [rushjs.io](https://rushjs.io/)
+* [tophat/monodeploy](https://github.com/tophat/monodeploy)
+* [intuit/auto](https://github.com/intuit/auto)
+* [vercel/turborepo](https://github.com/vercel/turborepo)
+* [lerna/lerna](https://github.com/lerna/lerna)
+* [nrwl/nx](https://github.com/nrwl/nx)
+* [moonrepo/moon](https://github.com/moonrepo/moon)
+* [ojkelly/yarn.build](https://github.com/ojkelly/yarn.build)
+
+## License 
+[MIT](./LICENSE)

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "bulk-release",
+  "alias": "bulk-release",
+  "version": "2.2.13",
+  "description": "zx-based alternative for multi-semantic-release",
+  "type": "module",
+  "exports": {
+    ".": "./src/main/js/index.js",
+    "./test-utils": "./src/test/js/test-utils.js"
+  },
+  "bin": "./src/main/js/cli.js",
+  "files": [
+    "src/main/js",
+    "src/test/js/test-utils.js",
+    "CHANGELOG.md",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "NPM_REGISTRY='http://localhost:4873' NPM_TOKEN='mRv6eIuiaggXGb9ZDFCtBA==' c8 uvu ./src/test -i fixtures -i utils && c8 report -r lcov",
+    "test:it": "NPM_REGISTRY='http://localhost:4873' NPM_TOKEN='mRv6eIuiaggXGb9ZDFCtBA==' node ./src/test/js/integration.test.js",
+    "docs": "mkdir -p docs && cp ./README.md ./docs/README.md"
+  },
+  "dependencies": {
+    "@semrel-extra/topo": "^1.6.0",
+    "cosmiconfig": "^8.1.3",
+    "queuefy": "^1.2.1",
+    "zx-extra": "^2.5.4"
+  },
+  "devDependencies": {
+    "c8": "^7.13.0",
+    "uvu": "^0.5.6",
+    "verdaccio": "^5.22.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/semrel-extra/zx-bulk-release.git"
+  },
+  "author": "Anton Golub <antongolub@antongolub.com>",
+  "license": "MIT"
+}

package/src/main/js/analyze.js

@@ -0,0 +1,70 @@
+import {semver} from 'zx-extra'
+import {updateDeps} from './deps.js'
+import {formatTag} from './meta.js';
+import {log} from './log.js'
+import {getCommits} from './git.js'
+
+export const analyze = async (pkg) => {
+  const semanticChanges = await getSemanticChanges(pkg.absPath, pkg.latest.tag?.ref)
+  const depsChanges = await updateDeps(pkg, pkg.context.packages)
+  const changes = [...semanticChanges, ...depsChanges]
+  const releaseType = getNextReleaseType(changes)
+
+  pkg.changes = changes
+  pkg.releaseType = releaseType
+  pkg.version = resolvePkgVersion(releaseType, pkg.latest.tag?.version || pkg.manifest.version)
+  pkg.manifest.version = pkg.version
+  pkg.tag = releaseType ? formatTag({name: pkg.name, version: pkg.version}) : null
+
+  log({pkg})('semantic changes', changes)
+}
+
+export const releaseSeverityOrder = ['major', 'minor', 'patch']
+export const semanticRules = [
+  {group: 'Features', releaseType: 'minor', prefixes: ['feat']},
+  {group: 'Fixes & improvements', releaseType: 'patch', prefixes: ['fix', 'perf', 'refactor', 'docs', 'patch']},
+  {group: 'BREAKING CHANGES', releaseType: 'major', keywords: ['BREAKING CHANGE', 'BREAKING CHANGES']},
+]
+
+export const getSemanticChanges = async (cwd, from, to) => {
+  const commits = await getCommits(cwd, from, to)
+
+  return analyzeCommits(commits)
+}
+
+export const analyzeCommits = (commits) =>
+  commits.reduce((acc, {subj, body, short, hash}) => {
+    semanticRules.forEach(({group, releaseType, prefixes, keywords}) => {
+      const prefixMatcher = prefixes && new RegExp(`^(${prefixes.join('|')})(\\([a-z0-9\\-_,]+\\))?:\\s.+$`)
+      const keywordsMatcher = keywords && new RegExp(`(${keywords.join('|')}):\\s(.+)`)
+      const change = subj.match(prefixMatcher)?.[0] || body.match(keywordsMatcher)?.[2]
+
+      if (change) {
+        acc.push({
+          group,
+          releaseType,
+          change,
+          subj,
+          body,
+          short,
+          hash
+        })
+      }
+    })
+    return acc
+  }, [])
+
+export const getNextReleaseType = (changes) => changes.length
+  ? releaseSeverityOrder.find(type => changes.find(({releaseType}) => type === releaseType))
+  : null
+
+export const getNextVersion = (releaseType, prevVersion) => {
+  if (!prevVersion) return '1.0.0'
+
+  return semver.inc(prevVersion, releaseType)
+}
+
+export const resolvePkgVersion = (releaseType, prevVersion) =>
+  releaseType
+    ? getNextVersion(releaseType, prevVersion)
+    : prevVersion || null

package/src/main/js/changelog.js

@@ -0,0 +1,42 @@
+import {$} from 'zx-extra'
+import {log} from './log.js'
+import {fetchRepo, getRepo, pushCommit} from './git.js'
+import {msgJoin} from './util.js'
+import {formatTag} from './meta.js'
+
+export const pushChangelog = async (pkg) => {
+  const {absPath: cwd, config: {changelog: opts, gitCommitterEmail, gitCommitterName, ghBasicAuth: basicAuth}} = pkg
+  if (!opts) return
+
+  log({pkg})('push changelog')
+  const [branch = 'changelog', file = `${pkg.name.replace(/[^a-z0-9-]/ig, '')}-changelog.md`, ..._msg] = typeof opts === 'string'
+    ? opts.split(' ')
+    : [opts.branch, opts.file, opts.msg]
+  const _cwd = await fetchRepo({cwd, branch, basicAuth})
+  const msg = msgJoin(_msg, pkg, 'chore: update changelog ${{name}}')
+  const releaseNotes = await formatReleaseNotes(pkg)
+
+  await $.o({cwd: _cwd})`echo ${releaseNotes}"\n$(cat ./${file})" > ./${file}`
+  await pushCommit({cwd, branch, msg, gitCommitterEmail, gitCommitterName, basicAuth})
+}
+
+export const formatReleaseNotes = async (pkg) => {
+  const {name, version, absPath: cwd, config: {ghBasicAuth: basicAuth}} = pkg
+  const {repoPublicUrl} = await getRepo(cwd, {basicAuth})
+  const tag = formatTag({name, version})
+  const releaseDiffRef = `## [${name}@${version}](${repoPublicUrl}/compare/${pkg.latest.tag?.ref}...${tag}) (${new Date().toISOString().slice(0, 10)})`
+  const releaseDetails = Object.values(pkg.changes
+    .reduce((acc, {group, subj, short, hash}) => {
+      const {commits} = acc[group] || (acc[group] = {commits: [], group})
+      const commitRef = `* ${subj}${short ? ` [${short}](${repoPublicUrl}/commit/${hash})` : ''}`
+
+      commits.push(commitRef)
+
+      return acc
+    }, {}))
+    .map(({group, commits}) => `
+### ${group}
+${commits.join('\n')}`).join('\n')
+
+  return releaseDiffRef + '\n' + releaseDetails + '\n'
+}

package/src/main/js/cli.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+
+import {argv} from 'zx-extra'
+import {run} from './index.js'
+import {normalizeFlags} from './config.js'
+
+run({flags: normalizeFlags(argv)})

package/src/main/js/config.js

@@ -0,0 +1,52 @@
+import { cosmiconfig } from 'cosmiconfig'
+import { camelize } from './util.js'
+
+const CONFIG_NAME = 'release'
+const CONFIG_FILES = [
+  'package.json',
+  `.${CONFIG_NAME}rc`,
+  `.${CONFIG_NAME}rc.json`,
+  `.${CONFIG_NAME}rc.yaml`,
+  `.${CONFIG_NAME}rc.yml`,
+  `.${CONFIG_NAME}rc.js`,
+  `.${CONFIG_NAME}rc.cjs`,
+  `${CONFIG_NAME}.config.js`,
+  `${CONFIG_NAME}.config.cjs`
+]
+
+export const defaultConfig = {
+  cmd:        'yarn && yarn build && yarn test',
+  changelog:  'changelog',
+  npmFetch:   true,
+  ghRelease:  true,
+  // npmPublish: true,
+  // ghPages: 'gh-pages'
+}
+
+export const getPkgConfig = async (...cwds) =>
+  normalizePkgConfig((await Promise.all(cwds.map(
+    cwd => cosmiconfig(CONFIG_NAME, { searchPlaces: CONFIG_FILES }).search(cwd).then(r => r?.config)
+  ))).find(Boolean) || defaultConfig)
+
+export const normalizePkgConfig = (config, env) => ({
+  ...parseEnv(env),
+  ...config,
+  npmFetch: config.npmFetch || config.fetch || config.fetchPkg,
+  buildCmd: config.buildCmd || config.cmd,
+  get ghBasicAuth() {
+    return this.ghUser && this.ghToken ? `${this.ghUser}:${this.ghToken}` : false
+  }
+})
+
+export const parseEnv = ({GH_USER, GH_USERNAME, GITHUB_USER, GITHUB_USERNAME, GH_TOKEN, GITHUB_TOKEN, NPM_TOKEN, NPM_REGISTRY, NPMRC, NPM_USERCONFIG, NPM_CONFIG_USERCONFIG, GIT_COMMITTER_NAME, GIT_COMMITTER_EMAIL} = process.env) =>
+  ({
+    ghUser:             GH_USER || GH_USERNAME || GITHUB_USER || GITHUB_USERNAME,
+    ghToken:            GH_TOKEN || GITHUB_TOKEN,
+    npmConfig:          NPMRC || NPM_USERCONFIG || NPM_CONFIG_USERCONFIG,
+    npmToken:           NPM_TOKEN,
+    npmRegistry:        NPM_REGISTRY || 'https://registry.npmjs.org',
+    gitCommitterName:   GIT_COMMITTER_NAME || 'Semrel Extra Bot',
+    gitCommitterEmail:  GIT_COMMITTER_EMAIL || 'semrel-extra-bot@hotmail.com',
+  })
+
+export const normalizeFlags = (flags = {}) => Object.entries(flags).reduce((acc, [k, v]) => ({...acc, [camelize(k)]: v}), {})

package/src/main/js/deps.js

@@ -0,0 +1,90 @@
+import {semver} from 'zx-extra'
+import {topo as _topo} from '@semrel-extra/topo'
+
+export const depScopes = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
+
+export const traverseDeps = async (pkg, packages, fn) => {
+  const {manifest} = pkg
+
+  for (let scope of depScopes) {
+    const deps = manifest[scope]
+    if (!deps) continue
+
+    for (let [name, version] of Object.entries(deps)) {
+      if (!packages[name]) continue
+
+      await fn(pkg, {name, version, deps, scope, pkg: packages[name]})
+    }
+  }
+}
+
+export const updateDeps = async (pkg, packages) => {
+  const changes = []
+
+  await traverseDeps(pkg, packages, async (_, {name, version, deps, scope, pkg: dep}) => {
+    const prev = pkg.latest.meta?.[scope]?.[name]
+    const actual = dep?.version
+    const next = resolveNextVersion(version, actual, prev)
+    const _version = next || subsWorkspace(version, actual)
+
+    pkg[scope] = {...pkg[scope], [name]: _version}  // Update pkg context
+    deps[name] = _version                           // Update manifest
+
+    if (!next) return
+    changes.push({
+      group: 'Dependencies',
+      releaseType: 'patch',
+      change: 'perf',
+      subj: `perf: ${name} updated to ${next}`,
+    })
+  })
+
+  return changes
+}
+
+export const resolveNextVersion = (decl, actual, prev) => {
+  if (!decl) return null
+
+  // https://yarnpkg.com/features/workspaces
+  decl = subsWorkspace(decl, actual)
+
+  if (!semver.satisfies(actual, decl)) return actual === prev ? null : actual
+
+  return decl === prev ? null : decl
+}
+
+export const subsWorkspace = (decl, actual) => {
+  if (decl.startsWith('workspace:')) {
+    const [, range, caret] = /^workspace:(([\^~*])?.*)$/.exec(decl)
+
+    return caret === range
+      ? caret === '*' ? actual : caret + actual
+      : range
+  }
+
+  return decl
+}
+
+export const topo = async ({flags = {}, cwd} = {}) => {
+  const ignore = typeof flags.ignore === 'string'
+    ? flags.ignore.split(/\s*,\s*/)
+    : Array.isArray(flags.ignore)
+      ? flags.ignore
+      : []
+
+  const filter = ({manifest: {private: _private, name}}) =>
+    !ignore.includes(name) && (flags.includePrivate || !_private)
+
+  return _topo({cwd, filter})
+}
+
+export const traverseQueue = async ({queue, prev, cb}) => {
+  const acc = {}
+
+  return Promise.all(queue.map((name) =>
+    (acc[name] = (async () => {
+      await Promise.all((prev.get(name) || []).map((p) => acc[p]))
+      await cb(name)
+    })()))
+  )
+}

package/src/main/js/gh.js

@@ -0,0 +1,49 @@
+import {queuefy} from 'queuefy'
+import {$, path} from 'zx-extra'
+import {log} from './log.js'
+import {getRepo, pushCommit} from './git.js'
+import {formatTag} from './meta.js'
+import {formatReleaseNotes} from './changelog.js'
+import {msgJoin} from './util.js'
+
+export const ghRelease = async (pkg) => {
+  log({pkg})(`create gh release`)
+
+  const {ghBasicAuth: basicAuth, ghToken} = pkg.config
+  if (!ghToken) return null
+
+  const {name, version, absPath: cwd} = pkg
+  const {repoName} = await getRepo(cwd, {basicAuth})
+  const tag = formatTag({name, version})
+  const releaseNotes = await formatReleaseNotes(pkg)
+  const releaseData = JSON.stringify({
+    name: tag,
+    tag_name: tag,
+    body: releaseNotes
+  })
+
+  await $.o({cwd})`curl -H 'Authorization: token ${ghToken}' -H 'Accept: application/vnd.github.v3+json' https://api.github.com/repos/${repoName}/releases -d ${releaseData}`
+}
+
+export const ghPages = queuefy(async (pkg) => {
+  const {config: {ghPages: opts, gitCommitterEmail, gitCommitterName, ghBasicAuth: basicAuth}} = pkg
+  if (!opts) return
+
+  const [branch = 'gh-pages', from = 'docs', to = '.', ..._msg] = typeof opts === 'string'
+    ? opts.split(' ')
+    : [opts.branch, opts.from, opts.to, opts.msg]
+  const msg = msgJoin(_msg, pkg, 'docs: update docs ${{name}} ${{version}}')
+
+  log({pkg})(`publish docs to ${branch}`)
+
+  await pushCommit({
+    cwd: path.join(pkg.absPath, from),
+    from: '.',
+    to,
+    branch,
+    msg,
+    gitCommitterEmail,
+    gitCommitterName,
+    basicAuth
+  })
+})