create-grist-widget 0.3.28 → 0.3.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-grist-widget",
-  "version": "0.3.28",
+  "version": "0.3.30",
   "description": "Scaffold a new Grist custom widget from the grist-widget-sdk Vite template",
   "license": "MIT",
   "type": "module",

package/src/upgrade.mjs

@@ -7,8 +7,8 @@
 // predates the SDK's base once (SDK_TSCONFIGS), merges package.json's
 // template-set scripts and dependency versions, and prunes pnpm age
 // exceptions that no longer matter. It never touches anything else: src/app/
-// (smoke test included), src/components/ui/, src/index.css, README.md and
-// every file the widget added are the widget's own. It runs on a clean `dev`,
+// (smoke test included), src/components/ui/, src/index.css, components.json,
+// README.md and every file the widget added are the widget's own. It runs on a clean `dev`,
 // so what it changed is one `git diff` to review.
 
 import { execFileSync } from "node:child_process"
@@ -27,6 +27,9 @@ import path from "node:path"
  * The files the template writes and keeps identical in every widget. Listed
  * in the template's AGENTS.md and on the Upgrading a widget page too
  * (tests/upgrade.test.mjs checks all three agree with the template itself).
+ *
+ * components.json isn't one: it is shadcn's configuration, and a widget adds
+ * the registries `shadcn add` installs from to it.
  */
 export const TEMPLATE_FILES = [
   ".github/dependabot.yml",
@@ -36,7 +39,6 @@ export const TEMPLATE_FILES = [
   ".prettierrc",
   "AGENTS.md",
   "CLAUDE.md",
-  "components.json",
   "eslint.config.js",
   "src/components/theme-provider.tsx",
   "src/lib/utils.ts",

package/template/AGENTS.md

@@ -35,14 +35,15 @@ mapping, and rendering all live in `src/app/App.tsx` — that's the file to edit
 - **The template's:** `src/main.tsx`, `src/components/theme-provider.tsx`,
   `src/lib/utils.ts`, `src/vite-env.d.ts`, the workflows and Dependabot config,
   `vite.config.ts`, `tsconfig.json`, `eslint.config.js`, the Prettier config,
-  `components.json`, `CLAUDE.md` and this file.
+  `CLAUDE.md` and this file.
   Leave them as they are: `pnpm exec create-grist-widget upgrade` rewrites them to the
   template of the `create-grist-widget` version the widget depends on
   (<https://gristwidgets.com/docs/cli/upgrading>), and a local edit would be lost.
 - **The widget's:** everything else. `src/app/` holds its code and tests, the smoke test
   included: put every new component, hook, helper and asset there. `src/components/ui/`
   holds the shadcn primitives, where `shadcn add` writes (next to any other registry
-  folder it installs), and `src/index.css` the theme. `tsconfig.app.json` and
+  folder it installs), `src/index.css` the theme, and `components.json` shadcn's
+  configuration, registries included. `tsconfig.app.json` and
   `tsconfig.node.json` keep the widget's own paths and types (their compiler settings come
   from `grist-widget-sdk`). `README.md`, `index.html`, `public/` and
   `pnpm-workspace.yaml` are the widget's too, and so is `package.json`, apart from the
@@ -66,6 +67,10 @@ mapping, and rendering all live in `src/app/App.tsx` — that's the file to edit
    opening the `dev` → `main` PR: merging without a version bump publishes nothing (the
    release build silently no-ops whenever that version's directory already exists — the PR
    merges cleanly and CI reports success either way).
+5. **Template updates arrive with `create-grist-widget`.** Dependabot opens a pull request of
+   its own for it. Once that is merged into `dev`, run `pnpm exec create-grist-widget upgrade`
+   on `dev` in a follow-up pull request, then `pnpm install`, `pnpm typecheck`, `pnpm lint` and
+   `pnpm test`. It rewrites only the template's files (listed above) and says what it changed.
 
 ## Commands
 
@@ -108,6 +113,11 @@ creates a `gh-pages` branch — these settings can't be applied before that exis
 2. If that first workflow run fails with a permissions error pushing to `gh-pages`:
    Settings → Actions → General → Workflow permissions → **Read and write permissions**.
    Most repos don't need this; it depends on account/org defaults.
+3. After the first release (which commits to `main` and resets `dev`), a branch ruleset:
+   `main` requires a pull request and the `check` status, and blocks force pushes and
+   deletion; `dev` blocks force pushes and deletion. An agent acts through the owner's
+   account, so these rules don't tell it apart: they keep red changes off `main` whoever
+   merges. Ask the owner to set them; they need admin access.
 
 Full detail, including the two live URLs (`/latest/` and `/v<version>/`): `README.md`.
 

package/template/README.md

@@ -159,6 +159,20 @@ template's own files (this pipeline, the build config) arrive with
    read-only, which would fail the push to `gh-pages` with a 403.
 3. If the repo is private, set **Pages visibility to Public** — a widget
    embeds inside a Grist iframe, which needs a publicly reachable URL.
+4. **After the first release**, protect the branches: Settings → Rules →
+   Rulesets → New branch ruleset. Not before: the first release itself
+   commits to `main` and resets `dev` (see above).
+   - `main`: **Require a pull request before merging**, **Require status
+     checks to pass** with the `check` status from `ci.yml`, **Block force
+     pushes**, **Restrict deletions**. A change then reaches `main` only
+     through a green pull request (your `dev` → `main` release PR included).
+   - `dev`: **Block force pushes** and **Restrict deletions**. Not the
+     pull-request rule: the version bump before a release is pushed straight
+     to `dev`.
+
+   An AI agent working on this repo acts through your GitHub account, so
+   these rules can't tell it from you. They guarantee the outcome (nothing
+   red reaches `main`), whoever merges.
 
 No manifest/widget-catalog file is generated — that's a multi-widget,
 Grist-widget-repository concept this single-widget template doesn't need.

package/template/package.json

@@ -35,7 +35,7 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.2",
-    "create-grist-widget": "^0.3.28",
+    "create-grist-widget": "^0.3.30",
     "eslint": "^10.13.0",
     "eslint-plugin-react-hooks": "^7.0.1",
     "eslint-plugin-react-refresh": "^0.5.7",