fg-devkit 1.8.1 → 1.8.4

package/configs/lefthook.yml

@@ -1,7 +1,5 @@
 pre-commit:
   commands:
-    audit:
-      run: zsh -lc "node ./node_modules/fg-devkit/scripts/lefthook-audit-if-enabled.mjs"
     lint-check:
       run: zsh -lc "node ./node_modules/fg-devkit/scripts/fg-devkit.mjs lint ."
     typecheck:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.8.1",
+  "version": "1.8.4",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -45,7 +45,7 @@
     "./scripts/poeditor-upload.mjs": "./scripts/poeditor-upload.mjs",
     "./scripts/scaffold-vue.mjs": "./scripts/scaffold-vue.mjs",
     "./scripts/fg-devkit.mjs": "./scripts/fg-devkit.mjs",
-    "./scripts/lefthook-audit-if-enabled.mjs": "./scripts/lefthook-audit-if-enabled.mjs",
+    "./scripts/resolve-candidate-version.mjs": "./scripts/resolve-candidate-version.mjs",
     "./scripts/release.sh": "./scripts/release.sh",
     "./scripts/cz/.cz-config.cjs": "./scripts/cz/.cz-config.cjs",
     "./cursor-rules/core-coding-standards.mdc": "./.cursor/rules/core-coding-standards.mdc"

package/scaffold/vue/package.json

@@ -34,7 +34,7 @@
     "@tanstack/vue-query-devtools": "6.1.28",
     "@types/node": "22.16.5",
     "@vitejs/plugin-vue": "6.0.6",
-    "fg-devkit": "1.8.1",
+    "fg-devkit": "1.8.3",
     "start-server-and-test": "2.1.3",
     "tailwindcss": "4.3.0",
     "tsx": "4.21.0",

package/scripts/cz/.cz-config.cjs

@@ -1,9 +1,6 @@
 /**
  * cz-git config used by fg-devkit commit flows.
  * Keep this in czrc-compatible shape for `czg --config`.
- *
- * Note: interactive `fg-devkit commit` asks each dep/vuln commit whether Lefthook should run
- * `pnpm audit` for that commit only (via env, not persisted).
  */
 module.exports = {
   types: [

package/scripts/fg-devkit.mjs

@@ -20,7 +20,7 @@
  *   pnpm exec fg-devkit setup-lefthook
  *   pnpm exec fg-devkit prune-consumer-deps [--dry-run]
  *   pnpm exec fg-devkit full-consumer-setup
- *   pnpm exec fg-devkit create-release [patch|minor|major]
+ *   pnpm exec fg-devkit create-release [release|candidate] [patch|minor|major]
  *   pnpm exec fg-devkit commit [cz-args...]   (czg/cz-git with fg-devkit bundled config)
  *   pnpm exec fg-devkit commit-vuln           (staged package.json version bumps → vuln() commit)
  *   pnpm exec fg-devkit lint [eslint-args...]     (run ESLint with fg-devkit bundled packages)
@@ -72,7 +72,7 @@ function runNode(scriptRelative, args = [], options = {}) {
 
 /**
  * Run release.sh (pnpm version bump, git push, gh release). Uses consumer cwd.
- * Optional first arg: patch | minor | major (otherwise the script prompts interactively).
+ * Args: [release|candidate] [patch|minor|major] or [patch|minor|major] [release|candidate].
  */
 function runReleaseScript(args = []) {
   const shPath = path.join(scriptDir, 'release.sh')
@@ -273,18 +273,6 @@ async function runCzg(args = [], extraEnv = {}) {
     })
   }
 
-  let runLefthookAuditThisCommit = true
-  if (isDepOrVuln) {
-    runLefthookAuditThisCommit = await selectPrompt({
-      message: 'Run pnpm audit on commit (Lefthook pre-commit)?',
-      choices: [
-        { value: true, name: 'Yes' },
-        { value: false, name: 'No' },
-      ],
-      default: true,
-    })
-  }
-
   if (!isDepOrVuln) {
     shortcutId = await ask('Shortcut ID digits only (optional, e.g. 1234):')
     subject = await ask('Commit subject (imperative, no trailing period):', {
@@ -305,16 +293,10 @@ async function runCzg(args = [], extraEnv = {}) {
   const finalSubject = selectedType === 'dep' ? depSubject : selectedType === 'vuln' ? vulnSubject : subject
   const commitMessage = `${selectedType}${scopePart}: ${finalSubject}${shortcutPart}${bodyPart}`
 
-  const gitEnv = { ...process.env, ...extraEnv }
-  delete gitEnv.FG_DEVKIT_LEFTHOOK_AUDIT
-  if (isDepOrVuln) {
-    gitEnv.FG_DEVKIT_LEFTHOOK_AUDIT = runLefthookAuditThisCommit ? '1' : '0'
-  }
-
   const r = spawnSync('git', ['commit', ...args, '-m', commitMessage], {
     stdio: 'inherit',
     cwd: process.cwd(),
-    env: gitEnv,
+    env: { ...process.env, ...extraEnv },
   })
   if (r.error) {
     console.error('[fg-devkit]', r.error.message)
@@ -511,7 +493,8 @@ Commands:
   setup-lefthook                  Setup lefthook and migrate from husky/lint-staged
   prune-consumer-deps [--dry-run] Remove consumer tooling deps bundled by fg-devkit
   full-consumer-setup             Run: step 7 -> scripts -> lefthook -> step 3 -> step 2 -> pnpm install
-  create-release [bump]         Version bump, git push, GitHub release (patch|minor|major; omit = prompt)
+  create-release [release|candidate] [patch|minor|major]
+                                 Stable release or candidate (X.Y.Z-rc.N); omit = interactive menu
                                  (alias: createRelease)
   commit [args...]              czg/cz-git with fg-devkit bundled config
   commit-vuln                   Commit staged dependency bumps as vuln() (alias: vuln-commit)
@@ -653,8 +636,20 @@ async function runInteractiveMenu() {
     }
 
     if (group === 'release') {
-      const releaseChoice = await selectPrompt({
+      const releaseKind = await selectPrompt({
         message: 'Create release',
+        choices: [
+          { name: 'Release', value: 'release' },
+          { name: 'Candidate', value: 'candidate' },
+          { name: 'Cancel', value: 'cancel' },
+        ],
+        default: 'release',
+        loop: false,
+      })
+      if (releaseKind === 'cancel') continue
+
+      const bumpChoice = await selectPrompt({
+        message: releaseKind === 'candidate' ? 'Candidate' : 'Release',
         choices: [
           { name: 'Patch', value: 'patch' },
           { name: 'Minor', value: 'minor' },
@@ -664,8 +659,11 @@ async function runInteractiveMenu() {
         default: 'patch',
         loop: false,
       })
-      if (releaseChoice === 'cancel') continue
-      return runSelectedAction(() => runReleaseScript([releaseChoice]))
+      if (bumpChoice === 'cancel') continue
+
+      const releaseArgs =
+        releaseKind === 'candidate' ? [bumpChoice, 'candidate'] : [bumpChoice]
+      return runSelectedAction(() => runReleaseScript(releaseArgs))
     }
 
     if (group === 'lint-typecheck') {

package/scripts/release.sh

@@ -3,12 +3,29 @@
 # Interactive or scripted release for this package: bumps version with pnpm, pushes commits/tags,
 # and creates a GitHub Release with generated notes (requires gh CLI, authenticated).
 #
-# Usage: ./scripts/release.sh [major|minor|patch]
-#   With no argument, prompts for patch/minor/major.
+# Usage:
+#   ./scripts/release.sh [patch|minor|major]              # stable release (default mode)
+#   ./scripts/release.sh [patch|minor|major] candidate  # prerelease tag X.Y.Z-rc.N
+#   ./scripts/release.sh candidate [patch|minor|major]
+#
+# Candidate tags follow SemVer prerelease format: <version>-rc.<number> (e.g. 2.8.0-rc.1).
 
 set -euo pipefail
 
-bump_type="${1:-}"
+bump_type=""
+release_mode="release"
+
+for arg in "$@"; do
+  case "$arg" in
+    patch | minor | major) bump_type="$arg" ;;
+    release | candidate) release_mode="$arg" ;;
+    *)
+      echo "Unknown argument: $arg"
+      echo "Usage: ./scripts/release.sh [patch|minor|major] [release|candidate]"
+      exit 1
+      ;;
+  esac
+done
 
 if [[ -z "$bump_type" ]]; then
   echo "Select release type:"
@@ -29,7 +46,7 @@ if [[ -z "$bump_type" ]]; then
 fi
 
 if [[ "$bump_type" != "major" && "$bump_type" != "minor" && "$bump_type" != "patch" ]]; then
-  echo "Usage: ./scripts/release.sh [major|minor|patch]"
+  echo "Usage: ./scripts/release.sh [patch|minor|major] [release|candidate]"
   exit 1
 fi
 
@@ -50,22 +67,61 @@ fi
 
 previous_tag="$(git describe --tags --abbrev=0 2>/dev/null || true)"
 
-pnpm version "$bump_type" --no-git-tag-version
-
-new_version="$(node -p "require('./package.json').version")"
-new_tag="v${new_version}"
-
 is_fg_devkit_repo="$(
   node -e "const fs=require('fs'); try { const p=JSON.parse(fs.readFileSync('./package.json','utf8')); process.stdout.write(p.name==='fg-devkit' ? 'yes' : 'no'); } catch { process.stdout.write('no'); }"
 )"
 
-if [[ "$is_fg_devkit_repo" == "yes" && -f "./scripts/sync-scaffold-vue-deps.mjs" && -f "./scaffold/vue/package.json" ]]; then
-  node ./scripts/sync-scaffold-vue-deps.mjs
-  git add package.json scaffold/vue/package.json
-else
-  git add package.json
+sync_fg_devkit_package_files() {
+  if [[ "$is_fg_devkit_repo" == "yes" && -f "./scripts/sync-scaffold-vue-deps.mjs" && -f "./scaffold/vue/package.json" ]]; then
+    node ./scripts/sync-scaffold-vue-deps.mjs
+    git add package.json scaffold/vue/package.json
+  else
+    git add package.json
+  fi
+}
+
+if [[ "$release_mode" == "candidate" ]]; then
+  script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  new_version="$(node "${script_dir}/resolve-candidate-version.mjs" "$bump_type")"
+
+  node -e "
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+pkg.version = process.argv[1];
+fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
+" "$new_version"
+
+  sync_fg_devkit_package_files
+
+  new_tag="v${new_version}"
+  git commit -m "${new_tag}"
+  git tag "${new_tag}"
+
+  git push
+  git push --tags
+
+  if [[ -n "$previous_tag" ]]; then
+    gh release create "$new_tag" \
+      --prerelease \
+      --generate-notes \
+      --notes-start-tag "$previous_tag"
+  else
+    gh release create "$new_tag" \
+      --prerelease \
+      --generate-notes
+  fi
+
+  echo "Candidate release created: ${new_tag}"
+  exit 0
 fi
 
+pnpm version "$bump_type" --no-git-tag-version
+
+new_version="$(node -p "require('./package.json').version")"
+new_tag="v${new_version}"
+
+sync_fg_devkit_package_files
+
 git commit -m "${new_tag}"
 git tag "${new_tag}"
 

package/scripts/resolve-candidate-version.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Resolves next candidate version: <semver>-rc.<n> (e.g. 2.8.0-rc.2).
+ * Usage: node resolve-candidate-version.mjs <patch|minor|major>
+ */
+import fs from 'node:fs'
+import { execSync } from 'node:child_process'
+
+const bump = process.argv[2]
+if (bump !== 'patch' && bump !== 'minor' && bump !== 'major') {
+  console.error('[resolve-candidate-version] Usage: node resolve-candidate-version.mjs <patch|minor|major>')
+  process.exit(1)
+}
+
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'))
+const v = pkg.version
+
+/** @param {string} ver @param {'patch'|'minor'|'major'} type */
+function bumpSemver(ver, type) {
+  const m = ver.match(/^(\d+)\.(\d+)\.(\d+)$/)
+  if (!m) throw new Error(`Invalid semver base: ${ver}`)
+  let maj = Number(m[1])
+  let min = Number(m[2])
+  let pat = Number(m[3])
+  if (type === 'major') {
+    maj += 1
+    min = 0
+    pat = 0
+  } else if (type === 'minor') {
+    min += 1
+    pat = 0
+  } else if (type === 'patch') {
+    pat += 1
+  }
+  return `${maj}.${min}.${pat}`
+}
+
+const plainMatch = v.match(/^(\d+\.\d+\.\d+)/)
+if (!plainMatch) {
+  console.error(`[resolve-candidate-version] Could not parse version: ${v}`)
+  process.exit(1)
+}
+const plain = plainMatch[1]
+
+/** @type {string} */
+let targetBase
+if (/^\d+\.\d+\.\d+-rc\.\d+$/.test(v)) {
+  targetBase = plain
+} else {
+  targetBase = bumpSemver(plain, bump)
+}
+
+/** @param {string} base @param {string[]} tags */
+function maxRcForBase(base, tags) {
+  const prefixes = [`${base}-rc.`, `v${base}-rc.`]
+  let max = 0
+  for (const tag of tags) {
+    for (const prefix of prefixes) {
+      if (tag.startsWith(prefix)) {
+        const n = Number(tag.slice(prefix.length))
+        if (!Number.isNaN(n)) max = Math.max(max, n)
+      }
+    }
+  }
+  return max
+}
+
+/** @type {string[]} */
+let tags = []
+try {
+  tags = execSync('git tag -l', { encoding: 'utf8' })
+    .split('\n')
+    .map((t) => t.trim())
+    .filter(Boolean)
+} catch {
+  tags = []
+}
+
+const nextRc = maxRcForBase(targetBase, tags) + 1
+process.stdout.write(`${targetBase}-rc.${nextRc}`)

package/scripts/sync-consumer-lefthook.mjs

@@ -6,8 +6,6 @@
  * - removes legacy lint-staged config block from package.json
  * - removes legacy prepare hook scripts for husky/lefthook bootstrap
  *
- * Lefthook `audit` skips only when `FG_DEVKIT_LEFTHOOK_AUDIT=0` for that commit (dep/vuln flow).
- *
  * Usage:
  *   node node_modules/fg-devkit/scripts/sync-consumer-lefthook.mjs
  *   pnpm exec fg-devkit setup-lefthook

package/scripts/lefthook-audit-if-enabled.mjs

@@ -1,23 +0,0 @@
-#!/usr/bin/env node
-/**
- * Lefthook pre-commit helper: runs `pnpm audit` unless this commit was started with
- * `FG_DEVKIT_LEFTHOOK_AUDIT=0` (set only for the current `git commit` by `fg-devkit commit`
- * when the user chooses "No" on dep/vuln). Unset or `1` runs audit.
- */
-import { spawnSync } from 'node:child_process'
-
-function shouldRunAudit() {
-  const v = process.env.FG_DEVKIT_LEFTHOOK_AUDIT
-  return v !== '0' && v !== 'false'
-}
-
-if (!shouldRunAudit()) {
-  console.log('[fg-devkit] Skipping pnpm audit (FG_DEVKIT_LEFTHOOK_AUDIT=0 for this commit).')
-  process.exit(0)
-}
-
-const r = spawnSync('pnpm', ['audit'], {
-  stdio: 'inherit',
-  cwd: process.cwd(),
-})
-process.exit(r.status ?? 1)