fg-devkit 1.12.6 → 1.12.8

package/scripts/check-dependency-policy.mjs

@@ -22,6 +22,8 @@ import {
   collectToolchainPolicyViolations,
   resolveExpectedPackageManager,
 } from './dependency-policy-toolchain.mjs'
+import { findPnpmVersionMismatchesInRepo } from './pnpm-toolchain-sync.mjs'
+import { collectNodeToolchainViolations } from './node-toolchain-sync.mjs'
 import { resolveDependencyPolicyPath } from './resolve-dependency-policy-path.mjs'
 
 const cwd = process.cwd()
@@ -98,6 +100,12 @@ if (expectedPackageManager !== undefined) {
   }
 }
 
+const fgDevkitRoot = path.resolve(scriptDir, '..')
+mismatches.push(...collectNodeToolchainViolations(cwd, policy, fgDevkitRoot))
+if (expectedPackageManager !== undefined) {
+  mismatches.push(...findPnpmVersionMismatchesInRepo(cwd, expectedPackageManager))
+}
+
 // Intersection: only packages that exist in both policy and consumer are compared.
 for (const [section, dependencies] of Object.entries(policy.managedDependencies ?? {})) {
   const current = pkg[section] ?? {}

package/scripts/dependency-policy-toolchain.mjs

@@ -1,11 +1,12 @@
 /**
- * Shared helpers for fleet-wide pnpm / Corepack toolchain policy.
+ * Shared helpers for fleet-wide pnpm / Corepack / Node toolchain policy.
  */
 
 import fs from 'node:fs'
 import path from 'node:path'
 
 const PNPM_PACKAGE_MANAGER_PATTERN = /^pnpm@\d+\.\d+\.\d+(-[\w.]+)?$/i
+const NODE_NVMRC_PATTERN = /^\d+(\.\d+(\.\d+)?)?$/
 
 /** @param {unknown} value */
 export function isValidPnpmPackageManager(value) {
@@ -67,16 +68,195 @@ export function resolveExpectedPackageManager(policy, fgDevkitRoot) {
  * @returns {string[]}
  */
 export function collectToolchainPolicyViolations(policy, labelPrefix = '[policy] toolchain.') {
+  const violations = []
   const packageManager = policy?.toolchain?.packageManager
-  if (packageManager === undefined) {
+  if (packageManager !== undefined && !isValidPnpmPackageManager(packageManager)) {
+    violations.push(
+      `${labelPrefix}packageManager: must be pnpm@x.y.z, got ${JSON.stringify(packageManager)}`,
+    )
+  }
+  violations.push(...collectNodeToolchainPolicyViolations(policy, labelPrefix))
+  return violations
+}
+
+/**
+ * @param {unknown} value
+ */
+export function isValidNodeNvmrc(value) {
+  return typeof value === 'string' && NODE_NVMRC_PATTERN.test(value.trim().replace(/^v/, ''))
+}
+
+/**
+ * @param {string} value
+ * @returns {string}
+ */
+export function normalizeNodeVersionLine(value) {
+  return value.trim().replace(/^v/, '')
+}
+
+/**
+ * @param {string} nvmrc
+ * @returns {string}
+ */
+export function deriveJenkinsImageTag(nvmrc) {
+  return `node${normalizeNodeVersionLine(nvmrc).split('.')[0]}`
+}
+
+/**
+ * @param {string} version Bare major or semver (e.g. 22 or 22.13.0).
+ * @returns {string}
+ */
+export function formatNodeNvmrc(version) {
+  const bare = normalizeNodeVersionLine(version)
+  if (!NODE_NVMRC_PATTERN.test(bare)) {
+    throw new Error(`Invalid Node nvmrc version: ${JSON.stringify(version)}`)
+  }
+  return bare
+}
+
+/**
+ * @typedef {{ nvmrc: string, engines?: string, jenkinsImage?: string, dockerTag?: string }} NodeToolchainPolicy
+ */
+
+/**
+ * Docker image tag after `node:` (e.g. 22-alpine). Bookworm and other variants normalize to policy/default alpine.
+ *
+ * @param {string} nvmrc
+ * @param {string} [dockerTag]
+ * @returns {string}
+ */
+export function resolveDockerNodeTag(nvmrc, dockerTag) {
+  if (typeof dockerTag === 'string' && dockerTag.trim()) {
+    return dockerTag.trim()
+  }
+  return `${formatNodeNvmrc(nvmrc).split('.')[0]}-alpine`
+}
+
+/**
+ * @param {string} fgDevkitRoot
+ * @returns {NodeToolchainPolicy | undefined}
+ */
+export function readFgDevkitNodePolicy(fgDevkitRoot) {
+  const nvmrcPath = path.join(fgDevkitRoot, '.nvmrc')
+  if (!fs.existsSync(nvmrcPath)) {
+    return undefined
+  }
+  const nvmrc = formatNodeNvmrc(fs.readFileSync(nvmrcPath, 'utf8'))
+
+  const pkgPath = path.join(fgDevkitRoot, 'package.json')
+  let engines
+  if (fs.existsSync(pkgPath)) {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'))
+    if (typeof pkg.engines?.node === 'string') {
+      engines = pkg.engines.node
+    }
+  }
+
+  return {
+    nvmrc,
+    engines,
+    jenkinsImage: deriveJenkinsImageTag(nvmrc),
+    dockerTag: resolveDockerNodeTag(nvmrc),
+  }
+}
+
+/**
+ * @param {Record<string, unknown>} policy
+ * @param {string} [fgDevkitRoot]
+ * @returns {NodeToolchainPolicy | undefined}
+ */
+export function resolveExpectedNodePolicy(policy, fgDevkitRoot) {
+  const fromPolicy = policy?.toolchain?.node
+  if (fromPolicy && typeof fromPolicy === 'object' && typeof fromPolicy.nvmrc === 'string') {
+    const nvmrc = formatNodeNvmrc(fromPolicy.nvmrc)
+    const engines =
+      fromPolicy.engines === null || fromPolicy.engines === undefined
+        ? undefined
+        : String(fromPolicy.engines)
+    const jenkinsImage =
+      typeof fromPolicy.jenkinsImage === 'string'
+        ? fromPolicy.jenkinsImage
+        : deriveJenkinsImageTag(nvmrc)
+    const dockerTag =
+      typeof fromPolicy.dockerTag === 'string'
+        ? fromPolicy.dockerTag
+        : resolveDockerNodeTag(nvmrc)
+    return { nvmrc, engines, jenkinsImage, dockerTag }
+  }
+  if (fgDevkitRoot) {
+    return readFgDevkitNodePolicy(fgDevkitRoot)
+  }
+  return undefined
+}
+
+/**
+ * @param {Record<string, unknown>} policy
+ * @param {string} fgDevkitRoot
+ * @returns {{ policy: Record<string, unknown>; changed: boolean }}
+ */
+export function syncPolicyNodeFromFgDevkit(policy, fgDevkitRoot) {
+  const fromFgDevkit = readFgDevkitNodePolicy(fgDevkitRoot)
+  if (!fromFgDevkit) {
+    return { policy, changed: false }
+  }
+  const next = {
+    ...policy,
+    toolchain: {
+      ...(policy.toolchain ?? {}),
+      node: {
+        nvmrc: fromFgDevkit.nvmrc,
+        ...(fromFgDevkit.engines ? { engines: fromFgDevkit.engines } : {}),
+        jenkinsImage: fromFgDevkit.jenkinsImage,
+        dockerTag: fromFgDevkit.dockerTag,
+      },
+    },
+  }
+  const current = policy.toolchain?.node
+  const changed =
+    !current ||
+    current.nvmrc !== next.toolchain.node.nvmrc ||
+    current.engines !== next.toolchain.node.engines ||
+    current.jenkinsImage !== next.toolchain.node.jenkinsImage ||
+    current.dockerTag !== next.toolchain.node.dockerTag
+  return { policy: changed ? next : policy, changed }
+}
+
+/**
+ * @param {Record<string, unknown>} policy
+ * @param {string} [labelPrefix]
+ * @returns {string[]}
+ */
+export function collectNodeToolchainPolicyViolations(policy, labelPrefix = '[policy] toolchain.') {
+  const node = policy?.toolchain?.node
+  if (node === undefined || node === null) {
     return []
   }
-  if (!isValidPnpmPackageManager(packageManager)) {
-    return [
-      `${labelPrefix}packageManager: must be pnpm@x.y.z, got ${JSON.stringify(packageManager)}`,
-    ]
+  if (typeof node !== 'object') {
+    return [`${labelPrefix}node: must be an object`]
+  }
+
+  const violations = []
+  if (!isValidNodeNvmrc(node.nvmrc)) {
+    violations.push(
+      `${labelPrefix}node.nvmrc: must be a version like "22" or "22.13.0", got ${JSON.stringify(node.nvmrc)}`,
+    )
+  }
+  if (
+    node.engines !== undefined &&
+    node.engines !== null &&
+    (typeof node.engines !== 'string' || node.engines.trim() === '')
+  ) {
+    violations.push(`${labelPrefix}node.engines: must be a non-empty string or null`)
+  }
+  if (
+    node.jenkinsImage !== undefined &&
+    (typeof node.jenkinsImage !== 'string' || !/^node\d+$/.test(node.jenkinsImage))
+  ) {
+    violations.push(
+      `${labelPrefix}node.jenkinsImage: must be like "node22", got ${JSON.stringify(node.jenkinsImage)}`,
+    )
   }
-  return []
+  return violations
 }
 
 /**

package/scripts/fg-devkit.mjs

@@ -11,6 +11,8 @@
  *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
  *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [--dry-run]
  *   pnpm exec fg-devkit bump-pnpm-toolchain [version] [projects-root] [--dry-run] [--skip-fleet] [--skip-install]
+ *   pnpm exec fg-devkit sync-node-toolchain [policy-file] [--dry-run]
+ *   pnpm exec fg-devkit bump-node-toolchain [nvmrc-version] [projects-root] [--dry-run] [--skip-fleet] [--no-engines]
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
  *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
@@ -462,6 +464,15 @@ const DIRECT_COMMANDS = {
   'fleet-vulns': 'fleet-vulns.mjs',
   'fleet-bump-fg-devkit': 'fleet-bump-fg-devkit.mjs',
   'bump-pnpm-toolchain': 'bump-pnpm-toolchain.mjs',
+  'sync-node-toolchain': 'sync-node-toolchain.mjs',
+  'sync-pnpm-toolchain': 'sync-pnpm-toolchain.mjs',
+  'bump-node-toolchain': 'bump-node-toolchain.mjs',
+  'fleet-git-pull': 'fleet-git-pull.mjs',
+  'fleet-git-pull-scoped': 'fleet-git-pull-scoped.mjs',
+  'fleet-git-commit-push': 'fleet-git-commit-push.mjs',
+  'fleet-git-commit-push-scoped': 'fleet-git-commit-push-scoped.mjs',
+  'fleet-git-discard': 'fleet-git-discard.mjs',
+  'fleet-git-discard-scoped': 'fleet-git-discard-scoped.mjs',
   'policy-upgrade': 'policy-upgrade.mjs',
   'policy-upgrade-commit': 'policy-upgrade-commit.mjs',
   'audit-override-commit': 'audit-override-commit.mjs',
@@ -486,7 +497,7 @@ function printHelp() {
 
 Commands:
   check-deps [policy-file]        Validate package.json + pins + toolchain against policy
-  sync-deps [policy-file]         Align declared versions and packageManager to policy
+  sync-deps [policy-file]         Align declared versions, packageManager, and Node toolchain to policy
   policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
   policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
   repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
@@ -496,7 +507,30 @@ Commands:
                                  Bump fg-devkit, run sync-deps, then pnpm install across Vue repos
   bump-pnpm-toolchain [version] [projects-root] [options]
                                  Maintainer: bump pnpm to latest (or version), sync fg-devkit + fleet
-                                 Options: --dry-run, --skip-fleet, --skip-install
+                                 Fleet: all pnpm repos (Vue+fg-devkit get full sync-deps/check-deps)
+                                 Options: --dry-run, --skip-fleet, --skip-install, --pick, --all, --only=a,b
+  sync-node-toolchain [policy-file] [--dry-run]
+                                 Align .nvmrc, engines, Dockerfiles, and Jenkinsfile to policy.node
+  sync-pnpm-toolchain [policy-file] [--dry-run]
+                                 Align packageManager and all pnpm@ pins to policy.packageManager
+  bump-node-toolchain [version] [projects-root] [options]
+                                 Maintainer: set policy.node and sync Node toolchain across fleet
+                                 Options: --dry-run, --skip-fleet, --no-engines, --engines=RANGE, --pick, --all, --only=a,b
+  fleet-git-pull [projects-root] [--dry-run]
+                                 Maintainer: git pull (current branch) for all git repos under projects root
+  fleet-git-pull-scoped [projects-root] [options]
+                                 Maintainer: git pull (current branch) for chosen repositories
+                                 Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
+  fleet-git-commit-push --message="..." [projects-root] [--dry-run]
+                                 Maintainer: stage, commit, and push all git repos under projects root
+  fleet-git-commit-push-scoped --message="..." [projects-root] [options]
+                                 Maintainer: stage, commit, and push chosen repositories
+                                 Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
+  fleet-git-discard [projects-root] [--dry-run]
+                                 Maintainer: discard tracked git changes in all git repos under projects root
+  fleet-git-discard-scoped [projects-root] [options]
+                                 Maintainer: discard tracked git changes in chosen repositories
+                                 Options: --dry-run, --fg-devkit-only, --pick, --all, --only=a,b
   policy-upgrade [policy-file] [ncu-args...]
                                  Upgrade policy packages via npm-check-updates (default interactive)
   policy-upgrade-commit [ncu-args...]
@@ -825,6 +859,13 @@ async function runInteractiveMenu() {
           { name: 'Check vulnerabilities across all Vue repos', value: 'm6' },
           { name: 'Bump fg-devkit in all Vue repos, run sync-deps, and pnpm install', value: 'm7' },
           { name: 'Bump pnpm toolchain (latest)', value: 'm8' },
+          { name: 'Bump Node toolchain (fleet sync)', value: 'm9' },
+          { name: 'Git pull all repositories', value: 'm10' },
+          { name: 'Git pull (choose repositories)', value: 'm11' },
+          { name: 'Stage, commit and push all repositories', value: 'm12' },
+          { name: 'Stage, commit and push (choose repositories)', value: 'm13' },
+          { name: 'Discard tracked changes in all repositories', value: 'm14' },
+          { name: 'Discard tracked changes (choose repositories)', value: 'm15' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'm1',
@@ -845,7 +886,8 @@ async function runInteractiveMenu() {
           message: 'Bump pnpm toolchain',
           choices: [
             { name: 'fg-devkit only (policy, scaffold, install)', value: 'fg-devkit' },
-            { name: 'fg-devkit + all Vue repos under projects root', value: 'fleet' },
+            { name: 'fg-devkit + pick pnpm repos under projects root', value: 'fleet' },
+            { name: 'Dry run + pick pnpm repos', value: 'dry-run-fleet' },
             { name: 'Cancel', value: 'cancel' },
           ],
           default: 'fg-devkit',
@@ -856,8 +898,159 @@ async function runInteractiveMenu() {
         if (scope === 'fg-devkit') {
           bumpArgs.push('--skip-fleet')
         }
+        if (scope === 'fleet') {
+          bumpArgs.push('--pick')
+        }
+        if (scope === 'dry-run-fleet') {
+          bumpArgs.push('--dry-run', '--pick')
+        }
         return runSelectedAction(() => runNode('bump-pnpm-toolchain.mjs', bumpArgs))
       }
+      if (choice === 'm9') {
+        const scope = await selectPrompt({
+          message: 'Bump Node toolchain',
+          choices: [
+            { name: 'fg-devkit only (policy + local files)', value: 'fg-devkit' },
+            { name: 'fg-devkit + pick projects under projects root', value: 'fleet' },
+            { name: 'Dry run + pick projects', value: 'dry-run-fleet' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'fleet',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const bumpArgs = []
+        if (scope === 'fg-devkit') {
+          bumpArgs.push('--skip-fleet')
+        }
+        if (scope === 'fleet') {
+          bumpArgs.push('--pick')
+        }
+        if (scope === 'dry-run-fleet') {
+          bumpArgs.push('--dry-run', '--pick')
+        }
+        return runSelectedAction(() => runNode('bump-node-toolchain.mjs', bumpArgs))
+      }
+      if (choice === 'm10') {
+        const scope = await selectPrompt({
+          message: 'Git pull all repositories',
+          choices: [
+            { name: 'Pull all git repos under projects root', value: 'pull' },
+            { name: 'Dry run (all repos)', value: 'dry-run' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'pull',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const pullArgs = scope === 'dry-run' ? ['--dry-run'] : []
+        return runSelectedAction(() => runNode('fleet-git-pull.mjs', pullArgs))
+      }
+      if (choice === 'm11') {
+        const scope = await selectPrompt({
+          message: 'Git pull (choose repositories)',
+          choices: [
+            { name: 'fg-devkit only', value: 'fg-devkit' },
+            { name: 'Choose repositories under projects root', value: 'pick' },
+            { name: 'Dry run + choose repositories', value: 'dry-run-pick' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'pick',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const pullArgs = []
+        if (scope === 'fg-devkit') {
+          pullArgs.push('--fg-devkit-only')
+        }
+        if (scope === 'pick') {
+          pullArgs.push('--pick')
+        }
+        if (scope === 'dry-run-pick') {
+          pullArgs.push('--dry-run', '--pick')
+        }
+        return runSelectedAction(() => runNode('fleet-git-pull-scoped.mjs', pullArgs))
+      }
+      if (choice === 'm12') {
+        const scope = await selectPrompt({
+          message: 'Stage, commit and push all repositories',
+          choices: [
+            { name: 'Stage, commit and push all repos', value: 'run' },
+            { name: 'Dry run (all repos)', value: 'dry-run' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'run',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const commitArgs = scope === 'dry-run' ? ['--dry-run'] : []
+        return runSelectedAction(() => runNode('fleet-git-commit-push.mjs', commitArgs))
+      }
+      if (choice === 'm13') {
+        const scope = await selectPrompt({
+          message: 'Stage, commit and push (choose repositories)',
+          choices: [
+            { name: 'fg-devkit only', value: 'fg-devkit' },
+            { name: 'Choose repositories under projects root', value: 'pick' },
+            { name: 'Dry run + choose repositories', value: 'dry-run-pick' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'pick',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const commitArgs = []
+        if (scope === 'fg-devkit') {
+          commitArgs.push('--fg-devkit-only')
+        }
+        if (scope === 'pick') {
+          commitArgs.push('--pick')
+        }
+        if (scope === 'dry-run-pick') {
+          commitArgs.push('--dry-run', '--pick')
+        }
+        return runSelectedAction(() => runNode('fleet-git-commit-push-scoped.mjs', commitArgs))
+      }
+      if (choice === 'm14') {
+        const scope = await selectPrompt({
+          message: 'Discard tracked changes in all repositories',
+          choices: [
+            { name: 'Discard tracked changes in all repos', value: 'run' },
+            { name: 'Dry run (all repos)', value: 'dry-run' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'run',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const discardArgs = scope === 'dry-run' ? ['--dry-run'] : []
+        return runSelectedAction(() => runNode('fleet-git-discard.mjs', discardArgs))
+      }
+      if (choice === 'm15') {
+        const scope = await selectPrompt({
+          message: 'Discard tracked changes (choose repositories)',
+          choices: [
+            { name: 'fg-devkit only', value: 'fg-devkit' },
+            { name: 'Choose repositories under projects root', value: 'pick' },
+            { name: 'Dry run + choose repositories', value: 'dry-run-pick' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'pick',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const discardArgs = []
+        if (scope === 'fg-devkit') {
+          discardArgs.push('--fg-devkit-only')
+        }
+        if (scope === 'pick') {
+          discardArgs.push('--pick')
+        }
+        if (scope === 'dry-run-pick') {
+          discardArgs.push('--dry-run', '--pick')
+        }
+        return runSelectedAction(() => runNode('fleet-git-discard-scoped.mjs', discardArgs))
+      }
       return 1
     }
   }
@@ -942,6 +1135,24 @@ async function main() {
       process.exitCode = 1
       return
     }
+    if (sub === 'bump-node-toolchain' && !isFgDevkitMaintainerContext()) {
+      console.error('[fg-devkit] bump-node-toolchain is only available in the fg-devkit repository root.')
+      process.exitCode = 1
+      return
+    }
+    if (
+      (sub === 'fleet-git-pull' ||
+        sub === 'fleet-git-pull-scoped' ||
+        sub === 'fleet-git-commit-push' ||
+        sub === 'fleet-git-commit-push-scoped' ||
+        sub === 'fleet-git-discard' ||
+        sub === 'fleet-git-discard-scoped') &&
+      !isFgDevkitMaintainerContext()
+    ) {
+      console.error(`[fg-devkit] ${sub} is only available in the fg-devkit repository root.`)
+      process.exitCode = 1
+      return
+    }
     process.exitCode = runNode(script, rest)
     return
   }

package/scripts/fleet-git-commit-push-scoped.mjs

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+/**
+ * Maintainer: stage all changes, commit, and push on the current branch for chosen repositories.
+ *
+ * Usage (from fg-devkit repository root):
+ *   pnpm exec fg-devkit fleet-git-commit-push-scoped --message="chore: sync toolchain" [options]
+ *
+ * Options:
+ *   --dry-run         Print planned actions without staging, committing, or pushing
+ *   --fg-devkit-only  Only process the fg-devkit repository
+ *   --pick            Interactive checkbox to choose repositories (default when TTY)
+ *   --all             Run on all git repositories under projects root without prompting
+ *   --only=a,b        Run only on matching repos (basename or path under projects root)
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { collectFleetGitRepos } from './fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
+import { filterCommitPushPositionalArgs, resolveCommitMessage } from './git-fleet-common.mjs'
+import { runFleetGitCommitPush } from './git-commit-push-fleet-common.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
+const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
+const LOG_PREFIX = '[fleet-git-commit-push-scoped]'
+
+const cliArgs = process.argv.slice(2)
+const dryRun = cliArgs.includes('--dry-run')
+const fgDevkitOnly = cliArgs.includes('--fg-devkit-only')
+const fleetArgs = filterCommitPushPositionalArgs(cliArgs)
+const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFlags(fleetArgs)
+const projectsRootArg = positionalArgs[0]
+let projectsRoot = projectsRootArg
+  ? path.resolve(process.cwd(), projectsRootArg)
+  : path.resolve(fgDevkitRoot, '..')
+
+function assertFgDevkitMaintainerContext() {
+  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
+    console.error(`${LOG_PREFIX} Run from the fg-devkit repository root.`)
+    process.exit(1)
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(fgDevkitPkgPath, 'utf8'))
+    if (pkg?.name !== 'fg-devkit') {
+      console.error(`${LOG_PREFIX} package.json name must be fg-devkit.`)
+      process.exit(1)
+    }
+  } catch {
+    console.error(`${LOG_PREFIX} Could not read fg-devkit package.json.`)
+    process.exit(1)
+  }
+}
+
+async function main() {
+  assertFgDevkitMaintainerContext()
+
+  if (!fgDevkitOnly && !fs.existsSync(projectsRoot)) {
+    console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)
+    process.exit(1)
+  }
+
+  const commitMessage = await resolveCommitMessage(cliArgs, LOG_PREFIX)
+
+  let repos
+  if (fgDevkitOnly) {
+    repos = [fgDevkitRoot]
+    projectsRoot = path.dirname(fgDevkitRoot)
+  } else {
+    const allRepos = collectFleetGitRepos(projectsRoot)
+    repos = await resolveFleetRepos(allRepos, projectsRoot, {
+      pick,
+      all,
+      only,
+      message: 'Select repositories to stage, commit, and push',
+    })
+  }
+
+  console.log(`${LOG_PREFIX} projectsRoot=${projectsRoot}`)
+  console.log(`${LOG_PREFIX} repositories=${repos.length}`)
+
+  const exitCode = runFleetGitCommitPush({
+    repos,
+    projectsRoot,
+    commitMessage,
+    dryRun,
+    logPrefix: LOG_PREFIX,
+  })
+  process.exit(exitCode)
+}
+
+main().catch((err) => {
+  console.error(LOG_PREFIX, err)
+  process.exit(1)
+})

package/scripts/fleet-git-commit-push.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+/**
+ * Maintainer: stage all changes, commit, and push on the current branch for every git repo under projects root.
+ *
+ * Usage (from fg-devkit repository root):
+ *   pnpm exec fg-devkit fleet-git-commit-push --message="chore: sync toolchain" [projects-root] [--dry-run]
+ *   pnpm exec fg-devkit fleet-git-commit-push -m "chore: sync toolchain"
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { collectFleetGitRepos } from './fleet-project-repos.mjs'
+import { filterCommitPushPositionalArgs, resolveCommitMessage } from './git-fleet-common.mjs'
+import { runFleetGitCommitPush } from './git-commit-push-fleet-common.mjs'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const fgDevkitRoot = path.resolve(scriptDir, '..')
+const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
+const LOG_PREFIX = '[fleet-git-commit-push]'
+
+const cliArgs = process.argv.slice(2)
+const dryRun = cliArgs.includes('--dry-run')
+const positionalArgs = filterCommitPushPositionalArgs(cliArgs)
+const projectsRootArg = positionalArgs.find((a) => !a.startsWith('-'))
+const projectsRoot = projectsRootArg
+  ? path.resolve(process.cwd(), projectsRootArg)
+  : path.resolve(fgDevkitRoot, '..')
+
+function assertFgDevkitMaintainerContext() {
+  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
+    console.error(`${LOG_PREFIX} Run from the fg-devkit repository root.`)
+    process.exit(1)
+  }
+  try {
+    const pkg = JSON.parse(fs.readFileSync(fgDevkitPkgPath, 'utf8'))
+    if (pkg?.name !== 'fg-devkit') {
+      console.error(`${LOG_PREFIX} package.json name must be fg-devkit.`)
+      process.exit(1)
+    }
+  } catch {
+    console.error(`${LOG_PREFIX} Could not read fg-devkit package.json.`)
+    process.exit(1)
+  }
+}
+
+async function main() {
+  assertFgDevkitMaintainerContext()
+
+  if (!fs.existsSync(projectsRoot)) {
+    console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)
+    process.exit(1)
+  }
+
+  const commitMessage = await resolveCommitMessage(cliArgs, LOG_PREFIX)
+  const repos = collectFleetGitRepos(projectsRoot)
+
+  console.log(`${LOG_PREFIX} projectsRoot=${projectsRoot}`)
+  console.log(`${LOG_PREFIX} repositories=${repos.length}`)
+
+  const exitCode = runFleetGitCommitPush({
+    repos,
+    projectsRoot,
+    commitMessage,
+    dryRun,
+    logPrefix: LOG_PREFIX,
+  })
+  process.exit(exitCode)
+}
+
+main().catch((err) => {
+  console.error(LOG_PREFIX, err)
+  process.exit(1)
+})