fg-devkit 1.22.0 → 1.24.0

package/scripts/fleet-bump-fg-devkit.mjs

@@ -16,12 +16,11 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
 
-import { collectFleetVueRepos } from './fleet-vue-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
+import { collectFleetVueRepos } from './lib/fleet-vue-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
+import { fgDevkitRoot } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
 const fgDevkitOnly = cliArgs.includes('--fg-devkit-only')
@@ -29,7 +28,7 @@ const { pick, all, only, filteredArgs: positionalArgs } = parseFleetSelectionFla
 const projectsRootArg = positionalArgs.find((a) => !a.startsWith('-'))
 const projectsRoot = projectsRootArg
   ? path.resolve(process.cwd(), projectsRootArg)
-  : path.resolve(scriptDir, '../..')
+  : path.resolve(fgDevkitRoot, '..')
 
 const LOG_PREFIX = '[fleet-bump-fg-devkit]'
 

package/scripts/fleet-git-commit-push-scoped.mjs

@@ -15,16 +15,13 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
 
-import { collectFleetGitRepos } from './fleet-project-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
-import { filterCommitPushPositionalArgs, resolveCommitMessage } from './git-fleet-common.mjs'
-import { runFleetGitCommitPush } from './git-commit-push-fleet-common.mjs'
+import { collectFleetGitRepos } from './lib/fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
+import { filterCommitPushPositionalArgs, resolveCommitMessage } from './lib/git-fleet-common.mjs'
+import { runFleetGitCommitPush } from './lib/git-commit-push-fleet-common.mjs'
+import { assertFgDevkitMaintainerContext, fgDevkitRoot } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const fgDevkitRoot = path.resolve(scriptDir, '..')
-const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
 const LOG_PREFIX = '[fleet-git-commit-push-scoped]'
 
 const cliArgs = process.argv.slice(2)
@@ -37,25 +34,8 @@ let projectsRoot = projectsRootArg
   ? path.resolve(process.cwd(), projectsRootArg)
   : path.resolve(fgDevkitRoot, '..')
 
-function assertFgDevkitMaintainerContext() {
-  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
-    console.error(`${LOG_PREFIX} Run from the fg-devkit repository root.`)
-    process.exit(1)
-  }
-  try {
-    const pkg = JSON.parse(fs.readFileSync(fgDevkitPkgPath, 'utf8'))
-    if (pkg?.name !== 'fg-devkit') {
-      console.error(`${LOG_PREFIX} package.json name must be fg-devkit.`)
-      process.exit(1)
-    }
-  } catch {
-    console.error(`${LOG_PREFIX} Could not read fg-devkit package.json.`)
-    process.exit(1)
-  }
-}
-
 async function main() {
-  assertFgDevkitMaintainerContext()
+  assertFgDevkitMaintainerContext(LOG_PREFIX)
 
   if (!fgDevkitOnly && !fs.existsSync(projectsRoot)) {
     console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)

package/scripts/fleet-git-discard-scoped.mjs

@@ -15,15 +15,12 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
 
-import { collectFleetGitRepos } from './fleet-project-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
-import { runFleetGitDiscard } from './git-discard-fleet-common.mjs'
+import { collectFleetGitRepos } from './lib/fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
+import { runFleetGitDiscard } from './lib/git-discard-fleet-common.mjs'
+import { assertFgDevkitMaintainerContext, fgDevkitRoot } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const fgDevkitRoot = path.resolve(scriptDir, '..')
-const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
 const LOG_PREFIX = '[fleet-git-discard-scoped]'
 
 const cliArgs = process.argv.slice(2)
@@ -36,25 +33,8 @@ let projectsRoot = projectsRootArg
   ? path.resolve(process.cwd(), projectsRootArg)
   : path.resolve(fgDevkitRoot, '..')
 
-function assertFgDevkitMaintainerContext() {
-  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
-    console.error(`${LOG_PREFIX} Run from the fg-devkit repository root.`)
-    process.exit(1)
-  }
-  try {
-    const pkg = JSON.parse(fs.readFileSync(fgDevkitPkgPath, 'utf8'))
-    if (pkg?.name !== 'fg-devkit') {
-      console.error(`${LOG_PREFIX} package.json name must be fg-devkit.`)
-      process.exit(1)
-    }
-  } catch {
-    console.error(`${LOG_PREFIX} Could not read fg-devkit package.json.`)
-    process.exit(1)
-  }
-}
-
 async function main() {
-  assertFgDevkitMaintainerContext()
+  assertFgDevkitMaintainerContext(LOG_PREFIX)
 
   if (!fgDevkitOnly && !fs.existsSync(projectsRoot)) {
     console.error(`${LOG_PREFIX} projects root not found: ${projectsRoot}`)

package/scripts/fleet-git-pull-scoped.mjs

@@ -15,15 +15,12 @@
 
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
 
-import { collectFleetGitRepos } from './fleet-project-repos.mjs'
-import { parseFleetSelectionFlags, resolveFleetRepos } from './fleet-repo-picker.mjs'
-import { runFleetGitPull } from './git-pull-fleet-common.mjs'
+import { collectFleetGitRepos } from './lib/fleet-project-repos.mjs'
+import { parseFleetSelectionFlags, resolveFleetRepos } from './lib/fleet-repo-picker.mjs'
+import { runFleetGitPull } from './lib/git-pull-fleet-common.mjs'
+import { assertFgDevkitMaintainerContext, fgDevkitRoot } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-const fgDevkitRoot = path.resolve(scriptDir, '..')
-const fgDevkitPkgPath = path.join(fgDevkitRoot, 'package.json')
 
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
@@ -35,25 +32,8 @@ let projectsRoot = projectsRootArg
   ? path.resolve(process.cwd(), projectsRootArg)
   : path.resolve(fgDevkitRoot, '..')
 
-function assertFgDevkitMaintainerContext() {
-  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
-    console.error('[fleet-git-pull-scoped] Run from the fg-devkit repository root.')
-    process.exit(1)
-  }
-  try {
-    const pkg = JSON.parse(fs.readFileSync(fgDevkitPkgPath, 'utf8'))
-    if (pkg?.name !== 'fg-devkit') {
-      console.error('[fleet-git-pull-scoped] package.json name must be fg-devkit.')
-      process.exit(1)
-    }
-  } catch {
-    console.error('[fleet-git-pull-scoped] Could not read fg-devkit package.json.')
-    process.exit(1)
-  }
-}
-
 async function main() {
-  assertFgDevkitMaintainerContext()
+  assertFgDevkitMaintainerContext('[fleet-git-pull-scoped]')
 
   if (!fgDevkitOnly && !fs.existsSync(projectsRoot)) {
     console.error(`[fleet-git-pull-scoped] projects root not found: ${projectsRoot}`)

package/scripts/fleet-vulns.mjs

@@ -10,17 +10,16 @@
 import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
-import { fileURLToPath } from 'node:url'
-import { isFgDevkitRepoDir } from './fleet-project-repos.mjs'
-import { filterReposByOnly, parseFleetOnlyArg } from './fleet-repo-picker.mjs'
+import { isFgDevkitRepoDir } from './lib/fleet-project-repos.mjs'
+import { filterReposByOnly, parseFleetOnlyArg } from './lib/fleet-repo-picker.mjs'
+import { fgDevkitRoot, readJson } from './lib/common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const summaryOnly = cliArgs.includes('--summary-only')
 const dryRun = cliArgs.includes('--dry-run')
 const only = parseFleetOnlyArg(cliArgs)
 const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
-const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
+const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(fgDevkitRoot, '..')
 const delayArg = cliArgs.find((a) => a.startsWith('--delay-ms='))
 const delayMs = Number(delayArg?.split('=')[1] ?? 2500)
 
@@ -38,10 +37,6 @@ function walk(dir, acc = []) {
   return acc
 }
 
-function readJson(p) {
-  return JSON.parse(fs.readFileSync(p, 'utf8'))
-}
-
 function isPnpmProject(pkg) {
   return (
     typeof pkg.packageManager === 'string' && pkg.packageManager.toLowerCase().startsWith('pnpm@')

package/scripts/generate-release-notes.mjs

@@ -13,7 +13,7 @@ import {
   resolveCliffConfig,
   resolveGitCliffBin,
   runSyncUserChangelog,
-} from './release-notes-common.mjs'
+} from './lib/release-notes-common.mjs'
 const cwd = process.cwd()
 const tagArg = process.argv.find((arg) => arg.startsWith('--tag='))?.slice('--tag='.length)
 

package/scripts/{audit-fix-plan.mjs → lib/audit-fix-plan.mjs}

@@ -156,10 +156,6 @@ export function planOverrides(advisories, { directDependencies = new Set() } = {
 
   for (const [name, packageAdvisories] of byPackage) {
     const ghsas = [...new Set(packageAdvisories.map((advisory) => advisory.ghsa))]
-    if (directDependencies.has(name)) {
-      plan.direct.push({ name, ghsas, versions: collectVersions(packageAdvisories) })
-      continue
-    }
 
     // installed version -> highest "lowest patched version" across its advisories
     const targets = new Map()
@@ -185,6 +181,17 @@ export function planOverrides(advisories, { directDependencies = new Set() } = {
       }
     }
 
+    if (directDependencies.has(name)) {
+      // Bumped in package.json, not overridden. `to` is the lowest version that fixes every
+      // installed version, or undefined when some advisory cannot be fixed.
+      const fixable = blocked.none.size === 0 && blocked.unparseable.size === 0 && targets.size > 0
+      const to = fixable
+        ? [...targets.values()].map((item) => item.target).sort(compareVersions).at(-1)
+        : undefined
+      plan.direct.push({ name, ghsas, versions: collectVersions(packageAdvisories), to })
+      continue
+    }
+
     if (blocked.none.size > 0) {
       plan.noPatch.push({ name, ghsas: [...blocked.none], versions: collectVersions(packageAdvisories) })
     }
@@ -568,3 +575,69 @@ export function rewriteWorkspaceList(text, key, replacements) {
   }
   return [...output, ...lines.slice(end)].join('\n')
 }
+
+/**
+ * Add `name@version` pins to the top-level minimumReleaseAgeExclude list. A version is
+ * merged into an existing `name@a || b` entry, skipped when a name rule already covers it,
+ * and otherwise appended as a new item. Creates the list when it is missing.
+ *
+ * @param {string} text
+ * @param {{ name: string, version: string }[]} pins
+ */
+export function addReleaseAgeExcludes(text, pins) {
+  const key = 'minimumReleaseAgeExclude'
+  let result = String(text ?? '')
+  const replacements = new Map()
+  const appended = []
+  const entries = readWorkspaceList(result, key)
+  for (const { name, version } of pins) {
+    const current = [...entries.map((entry) => replacements.get(entry) ?? entry), ...appended]
+    if (isReleaseAgeExcluded(current, name, version)) continue
+    const existing = entries.find((entry) => {
+      const parsed = parseReleaseAgeExcludeEntry(entry)
+      return parsed.name === name && parsed.versions !== null
+    })
+    if (existing) {
+      const merged = replacements.get(existing) ?? existing
+      replacements.set(existing, `${merged} || ${version}`)
+      continue
+    }
+    const pending = appended.findIndex((entry) => parseReleaseAgeExcludeEntry(entry).name === name)
+    if (pending >= 0) appended[pending] = `${appended[pending]} || ${version}`
+    else appended.push(`${name}@${version}`)
+  }
+  if (replacements.size > 0) result = rewriteWorkspaceList(result, key, replacements)
+  if (appended.length === 0) return result
+
+  const lines = result.split('\n')
+  const start = lines.findIndex((line) => line === `${key}:` || line.startsWith(`${key}: #`))
+  const rendered = (indent) => appended.map((entry) => `${indent}- ${renderYamlListItem(entry)}`)
+  if (start === -1) {
+    while (lines.length > 0 && lines.at(-1) === '') lines.pop()
+    lines.push(`${key}:`, ...rendered('  '), '')
+    return lines.join('\n')
+  }
+  let last = start
+  let indent = '  '
+  for (let i = start + 1; i < lines.length; i += 1) {
+    if (lines[i].trim() === '' || lines[i].trim().startsWith('#')) continue
+    const item = lines[i].match(/^(\s+)-\s/)
+    if (!item) break
+    indent = item[1]
+    last = i
+  }
+  lines.splice(last + 1, 0, ...rendered(indent))
+  return lines.join('\n')
+}
+
+/**
+ * New package.json spec that pins `version` with the same prefix as `spec`
+ * (`1.2.3`, `^1.2.3`, `~1.2.3`, `=1.2.3`). Returns null for specs that are not a plain
+ * version (`workspace:*`, `catalog:`, ranges, URLs), which are left for a human.
+ */
+export function bumpDependencySpec(spec, version) {
+  const match = String(spec ?? '')
+    .trim()
+    .match(/^([\^~=]?)v?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/)
+  return match ? `${match[1]}${version}` : null
+}

package/scripts/{audit-fix-plan.test.mjs → lib/audit-fix-plan.test.mjs}

@@ -3,7 +3,9 @@ import test from 'node:test'
 
 import {
   activeSuppressedGhsas,
+  addReleaseAgeExcludes,
   buildRefreshCommitMessage,
+  bumpDependencySpec,
   compareVersions,
   diffLockfileVersions,
   filterSuppressions,
@@ -148,11 +150,57 @@ test('planOverrides reports instead of overriding when it would be unsafe or use
     [['old', '2.4.0', '3.0.0']],
   )
   assert.deepEqual(
-    plan.direct.map((item) => item.name),
-    ['eslint'],
+    plan.direct.map((item) => [item.name, item.to]),
+    [['eslint', '10.0.1']],
   )
 })
 
+test('planOverrides leaves the direct target empty when a finding has no patch', () => {
+  const plan = planOverrides(
+    [advisory({ name: 'vite', ghsa: 'GHSA-none', vulnerable: '<=7.0.0', patched: null, versions: ['7.0.0'] })],
+    { directDependencies: new Set(['vite']) },
+  )
+  assert.deepEqual(
+    plan.direct.map((item) => [item.name, item.to]),
+    [['vite', undefined]],
+  )
+})
+
+test('addReleaseAgeExcludes merges, skips covered names and appends', () => {
+  const text = ['packages: []', 'minimumReleaseAgeExclude:', '  - fg-devkit', '  - lefthook@2.1.15', ''].join('\n')
+  assert.equal(
+    addReleaseAgeExcludes(text, [
+      { name: 'fg-devkit', version: '1.0.0' },
+      { name: 'lefthook', version: '2.1.17' },
+      { name: '@scope/pkg', version: '1.2.3' },
+      { name: '@scope/pkg', version: '1.2.4' },
+    ]),
+    [
+      'packages: []',
+      'minimumReleaseAgeExclude:',
+      '  - fg-devkit',
+      '  - lefthook@2.1.15 || 2.1.17',
+      "  - '@scope/pkg@1.2.3 || 1.2.4'",
+      '',
+    ].join('\n'),
+  )
+})
+
+test('addReleaseAgeExcludes creates the list when it is missing', () => {
+  assert.equal(
+    addReleaseAgeExcludes('packages: []\n', [{ name: 'undici', version: '6.21.2' }]),
+    'packages: []\nminimumReleaseAgeExclude:\n  - undici@6.21.2\n',
+  )
+})
+
+test('bumpDependencySpec keeps the prefix and skips non-version specs', () => {
+  assert.equal(bumpDependencySpec('1.7.0', '1.8.2'), '1.8.2')
+  assert.equal(bumpDependencySpec('^1.7.0', '1.8.2'), '^1.8.2')
+  assert.equal(bumpDependencySpec('~1.7.0', '1.8.2'), '~1.8.2')
+  assert.equal(bumpDependencySpec('workspace:*', '1.8.2'), null)
+  assert.equal(bumpDependencySpec('>=1.0.0 <2', '1.8.2'), null)
+})
+
 test('isReleaseAgeExcluded understands names, patterns and version lists', () => {
   const list = ['fg-devkit', '@fallow-cli/*', 'lefthook@2.1.15 || 2.1.17']
   assert.equal(isReleaseAgeExcluded(list, 'fg-devkit', '1.0.0'), true)

package/scripts/lib/common.mjs

@@ -0,0 +1,95 @@
+/**
+ * Small helpers shared by the fg-devkit scripts: JSON, git and locating fg-devkit itself.
+ */
+
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+/** Root of the fg-devkit package these scripts belong to. */
+export const fgDevkitRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..')
+
+export function readJson(filePath) {
+  return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+}
+
+/**
+ * Run git in `cwd`. Output goes to the terminal unless `capture` is set. A failure to start
+ * git is logged with `tag` and reported as status 1.
+ *
+ * @param {string[]} args
+ * @param {{ cwd: string, tag: string, capture?: boolean }} options
+ * @returns {{ status: number, stdout: string }}
+ */
+export function runGit(args, { cwd, tag, capture = false }) {
+  const result = spawnSync('git', args, {
+    stdio: capture ? 'pipe' : 'inherit',
+    encoding: capture ? 'utf8' : undefined,
+    cwd,
+    env: process.env,
+  })
+  if (result.error) {
+    console.error(tag, result.error.message)
+    return { status: 1, stdout: '' }
+  }
+  return { status: result.status ?? 1, stdout: result.stdout ?? '' }
+}
+
+/**
+ * `git add` the files that exist, relative to `cwd`.
+ *
+ * @param {string[]} files
+ * @param {{ cwd: string, tag: string }} options
+ * @returns {number} exit status, 0 when there was nothing to stage
+ */
+export function stageExistingFiles(files, options) {
+  const existingFiles = files.filter((filePath) => fs.existsSync(path.join(options.cwd, filePath)))
+  if (existingFiles.length === 0) return 0
+  return runGit(['add', '--', ...existingFiles], options).status
+}
+
+/**
+ * True when the file exists and is untracked or differs from HEAD.
+ *
+ * @param {string} filePath relative to `cwd`
+ * @param {{ cwd: string, tag: string }} options
+ */
+export function fileDiffersFromHead(filePath, options) {
+  if (!fs.existsSync(path.join(options.cwd, filePath))) return false
+  const tracked = runGit(['ls-files', '--error-unmatch', '--', filePath], { ...options, capture: true })
+  if (tracked.status !== 0) return true
+  return runGit(['diff', '--quiet', 'HEAD', '--', filePath], { ...options, capture: true }).status !== 0
+}
+
+/**
+ * fg-devkit on disk for a consumer repo: this package, a direct dependency, or the copy
+ * bundled with fds-vue-core. Null when none of them has a package.json.
+ *
+ * @param {string} projectRoot
+ */
+export function findFgDevkitPackageRoot(projectRoot) {
+  const candidates = [
+    fgDevkitRoot,
+    path.join(projectRoot, 'node_modules', 'fg-devkit'),
+    path.join(projectRoot, 'node_modules', 'fds-vue-core', 'node_modules', 'fg-devkit'),
+  ]
+  return candidates.find((candidate) => fs.existsSync(path.join(candidate, 'package.json'))) ?? null
+}
+
+/** Exit unless the current directory is the fg-devkit repository root. */
+export function assertFgDevkitMaintainerContext(tag) {
+  if (path.resolve(process.cwd()) !== fgDevkitRoot) {
+    console.error(`${tag} Run from the fg-devkit repository root.`)
+    process.exit(1)
+  }
+  try {
+    if (readJson(path.join(fgDevkitRoot, 'package.json'))?.name !== 'fg-devkit') {
+      console.error(`${tag} package.json name must be fg-devkit.`)
+      process.exit(1)
+    }
+  } catch {
+    console.error(`${tag} Could not read fg-devkit package.json.`)
+    process.exit(1)
+  }
+}

package/scripts/{dependency-policy-toolchain.mjs → lib/dependency-policy-toolchain.mjs}

@@ -9,7 +9,7 @@ const PNPM_PACKAGE_MANAGER_PATTERN = /^pnpm@\d+\.\d+\.\d+(-[\w.]+)?$/i
 const NODE_NVMRC_PATTERN = /^\d+(\.\d+(\.\d+)?)?$/
 
 /** @param {unknown} value */
-export function isValidPnpmPackageManager(value) {
+function isValidPnpmPackageManager(value) {
   return typeof value === 'string' && PNPM_PACKAGE_MANAGER_PATTERN.test(value)
 }
 
@@ -17,7 +17,7 @@ export function isValidPnpmPackageManager(value) {
  * @param {string} fgDevkitRoot
  * @returns {string | undefined}
  */
-export function readFgDevkitPackageManager(fgDevkitRoot) {
+function readFgDevkitPackageManager(fgDevkitRoot) {
   const pkgPath = path.join(fgDevkitRoot, 'package.json')
   if (!fs.existsSync(pkgPath)) {
     return undefined
@@ -82,7 +82,7 @@ export function collectToolchainPolicyViolations(policy, labelPrefix = '[policy]
 /**
  * @param {unknown} value
  */
-export function isValidNodeNvmrc(value) {
+function isValidNodeNvmrc(value) {
   return typeof value === 'string' && NODE_NVMRC_PATTERN.test(value.trim().replace(/^v/, ''))
 }
 
@@ -189,38 +189,6 @@ export function resolveExpectedNodePolicy(policy, fgDevkitRoot) {
   return undefined
 }
 
-/**
- * @param {Record<string, unknown>} policy
- * @param {string} fgDevkitRoot
- * @returns {{ policy: Record<string, unknown>; changed: boolean }}
- */
-export function syncPolicyNodeFromFgDevkit(policy, fgDevkitRoot) {
-  const fromFgDevkit = readFgDevkitNodePolicy(fgDevkitRoot)
-  if (!fromFgDevkit) {
-    return { policy, changed: false }
-  }
-  const next = {
-    ...policy,
-    toolchain: {
-      ...(policy.toolchain ?? {}),
-      node: {
-        nvmrc: fromFgDevkit.nvmrc,
-        ...(fromFgDevkit.engines ? { engines: fromFgDevkit.engines } : {}),
-        jenkinsImage: fromFgDevkit.jenkinsImage,
-        dockerTag: fromFgDevkit.dockerTag,
-      },
-    },
-  }
-  const current = policy.toolchain?.node
-  const changed =
-    !current ||
-    current.nvmrc !== next.toolchain.node.nvmrc ||
-    current.engines !== next.toolchain.node.engines ||
-    current.jenkinsImage !== next.toolchain.node.jenkinsImage ||
-    current.dockerTag !== next.toolchain.node.dockerTag
-  return { policy: changed ? next : policy, changed }
-}
-
 /**
  * @param {Record<string, unknown>} policy
  * @param {string} [labelPrefix]

package/scripts/{git-commit-push-fleet-common.mjs → lib/git-commit-push-fleet-common.mjs}

@@ -119,7 +119,7 @@ export function runFleetGitCommitPush(options) {
   console.log(`${logPrefix} repositories=${repos.length}`)
 
   if (committed.length > 0) {
-    console.log(`${logPrefix} committed and pushed (${committed.length}):`)
+    console.log(`${logPrefix} ${dryRun ? 'would commit and push' : 'committed and pushed'} (${committed.length}):`)
     for (const item of committed) {
       console.log(`  - ${item.label} (${item.branch})`)
     }

package/scripts/{git-discard-fleet-common.mjs → lib/git-discard-fleet-common.mjs}

@@ -72,7 +72,7 @@ export function runFleetGitDiscard(options) {
   console.log(`${logPrefix} repositories=${repos.length}`)
 
   if (discarded.length > 0) {
-    console.log(`${logPrefix} discarded tracked changes (${discarded.length}):`)
+    console.log(`${logPrefix} ${dryRun ? 'would discard tracked changes' : 'discarded tracked changes'} (${discarded.length}):`)
     for (const item of discarded) {
       console.log(`  - ${item.label} (${item.branch})`)
     }

package/scripts/{git-pull-fleet-common.mjs → lib/git-pull-fleet-common.mjs}

@@ -69,7 +69,7 @@ export function runFleetGitPull(options) {
   console.log(`${logPrefix} repositories=${repos.length}`)
 
   if (pulled.length > 0) {
-    console.log(`${logPrefix} pulled (${pulled.length}):`)
+    console.log(`${logPrefix} ${dryRun ? 'would pull' : 'pulled'} (${pulled.length}):`)
     for (const item of pulled) {
       console.log(`  - ${item.label} (${item.branch})`)
     }

package/scripts/{override-changes.mjs → lib/override-changes.mjs}

@@ -17,6 +17,26 @@ export function getOverridePackageName(overrideKey) {
   return match ? match[1] : key
 }
 
+/**
+ * Policy overrides for packages present in the lockfile, so a repo only gets the overrides
+ * it can use. All of them when there is no lockfile.
+ *
+ * @param {Record<string, string> | undefined} policyOverrides
+ * @param {string} lockfilePath
+ */
+export function getRelevantPolicyOverrides(policyOverrides, lockfilePath) {
+  const entries = Object.entries(policyOverrides ?? {})
+  if (entries.length === 0) return {}
+  if (!fs.existsSync(lockfilePath)) return Object.fromEntries(entries)
+  const lockfile = fs.readFileSync(lockfilePath, 'utf8')
+  return Object.fromEntries(
+    entries.filter(([name]) => {
+      const pkgName = getOverridePackageName(name)
+      return lockfile.includes(`${pkgName}@`) || lockfile.includes(`/${pkgName}/`)
+    }),
+  )
+}
+
 function readWorkspaceOverrides(yamlPath) {
   if (!fs.existsSync(yamlPath)) return {}
   const overrides = {}

package/scripts/{piwik-dimensions.test.mjs → lib/piwik-dimensions.test.mjs}

@@ -1,8 +1,5 @@
 import assert from 'node:assert/strict'
-import fs from 'node:fs'
-import path from 'node:path'
 import test from 'node:test'
-import { fileURLToPath } from 'node:url'
 
 import {
   accountFromPiwikUrl,
@@ -24,8 +21,6 @@ import {
   rewriteDimensionNumbers,
 } from './piwik-dimensions.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
-
 const bookingSource = `
 export const customDimensions = {
   clientNumber: 1,

package/scripts/{release-notes-common.mjs → lib/release-notes-common.mjs}

@@ -6,11 +6,9 @@
 import { spawnSync } from 'node:child_process'
 import fs from 'node:fs'
 import path from 'node:path'
-import { fileURLToPath } from 'node:url'
+import { fgDevkitRoot } from './common.mjs'
 
-const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 
-export const fgRoot = path.resolve(scriptDir, '..')
 
 /** True when the consumer repo has opted into git-cliff release notes. */
 export function hasReleaseNotesConfig(cwd = process.cwd()) {
@@ -28,7 +26,7 @@ export function resolveCliffConfig(name, cwd = process.cwd()) {
     return local
   }
 
-  const bundled = path.join(fgRoot, 'configs', name)
+  const bundled = path.join(fgDevkitRoot, 'configs', name)
   if (fs.existsSync(bundled)) {
     return bundled
   }
@@ -89,20 +87,20 @@ function resolvePackageFile(packageName, relativePaths, searchRoots) {
 }
 
 function dependencySearchRoots() {
-  return [fgRoot, process.cwd(), path.join(process.cwd(), 'node_modules', 'fg-devkit')]
+  return [fgDevkitRoot, process.cwd(), path.join(process.cwd(), 'node_modules', 'fg-devkit')]
 }
 
 export function resolveGitCliffBin() {
   return resolvePackageFile('git-cliff', ['lib/cli/cli.js'], dependencySearchRoots())
 }
 
-export function resolveTsxBin() {
+function resolveTsxBin() {
   return resolvePackageFile('tsx', ['dist/cli.mjs', 'cli.mjs'], dependencySearchRoots())
 }
 
 export function runSyncUserChangelog(cwd = process.cwd()) {
   const tsxBin = resolveTsxBin()
-  const syncScript = path.join(fgRoot, 'release-notes', 'sync-user-changelog.ts')
+  const syncScript = path.join(fgDevkitRoot, 'release-notes', 'sync-user-changelog.ts')
 
   if (!tsxBin) {
     console.error('[fg-devkit] Could not resolve tsx. Reinstall fg-devkit and retry.')