fg-devkit 1.9.0 → 1.12.0

package/scripts/fg-devkit.mjs

@@ -10,8 +10,10 @@
  *   pnpm exec fg-devkit repo-vulns
  *   pnpm exec fg-devkit fleet-vulns [projects-root] [--summary-only] [--delay-ms=<ms>]
  *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [--dry-run]
+ *   pnpm exec fg-devkit bump-pnpm-toolchain [version] [projects-root] [--dry-run] [--skip-fleet] [--skip-install]
  *   pnpm exec fg-devkit policy-upgrade [policy-file] [ncu-args...]
  *   pnpm exec fg-devkit policy-upgrade-commit [ncu-args...]
+ *   pnpm exec fg-devkit audit-override-commit [pnpm-audit-args...]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-vscode-settings
@@ -20,7 +22,10 @@
  *   pnpm exec fg-devkit setup-lefthook
  *   pnpm exec fg-devkit prune-consumer-deps [--dry-run]
  *   pnpm exec fg-devkit full-consumer-setup
- *   pnpm exec fg-devkit create-release [release|candidate] [patch|minor|major]
+ *   pnpm exec fg-devkit create-release [release|candidate] [patch|minor|major] [--skip-release-notes]
+ *   pnpm exec fg-devkit generate-release-notes [--tag=vX.Y.Z]
+ *   pnpm exec fg-devkit verify-release-notes
+ *   pnpm exec fg-devkit sync-release-notes-config
  *   pnpm exec fg-devkit commit [cz-args...]   (czg/cz-git with fg-devkit bundled config)
  *   pnpm exec fg-devkit commit-vuln           (staged package.json version bumps → vuln() commit)
  *   pnpm exec fg-devkit lint [eslint-args...]     (run ESLint with fg-devkit bundled packages)
@@ -153,6 +158,9 @@ function runFullConsumerSetup() {
   const scriptsStep = runNode('sync-consumer-scripts.mjs')
   if (scriptsStep !== 0) return scriptsStep
 
+  const releaseNotesStep = runNode('sync-release-notes-config.mjs')
+  if (releaseNotesStep !== 0) return releaseNotesStep
+
   const hooksStep = runSetupLefthook()
   if (hooksStep !== 0) return hooksStep
 
@@ -453,13 +461,18 @@ const DIRECT_COMMANDS = {
   'repo-vulns': 'repo-vulns.mjs',
   'fleet-vulns': 'fleet-vulns.mjs',
   'fleet-bump-fg-devkit': 'fleet-bump-fg-devkit.mjs',
+  'bump-pnpm-toolchain': 'bump-pnpm-toolchain.mjs',
   'policy-upgrade': 'policy-upgrade.mjs',
   'policy-upgrade-commit': 'policy-upgrade-commit.mjs',
+  'audit-override-commit': 'audit-override-commit.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
   'sync-vscode-settings': 'sync-vscode-settings.mjs',
   'sync-core-coding-standards': 'sync-core-coding-standards.mjs',
   'sync-consumer-scripts': 'sync-consumer-scripts.mjs',
+  'sync-release-notes-config': 'sync-release-notes-config.mjs',
+  'generate-release-notes': 'generate-release-notes.mjs',
+  'verify-release-notes': 'verify-release-notes.mjs',
   'setup-lefthook': 'setup-lefthook',
   'prune-consumer-deps': 'prune-consumer-deps.mjs',
   'sync-scaffold-vue-deps': 'sync-scaffold-vue-deps.mjs',
@@ -472,8 +485,8 @@ function printHelp() {
   pnpm exec fg-devkit [command] [args...]
 
 Commands:
-  check-deps [policy-file]        Validate package.json + pins against policy
-  sync-deps [policy-file]         Align declared versions to policy (existing keys only)
+  check-deps [policy-file]        Validate package.json + pins + toolchain against policy
+  sync-deps [policy-file]         Align declared versions and packageManager to policy
   policy-outdated [policy-file]   Show outdated policy packages via pnpm outdated
   policy-vulns [policy-file]      Check all policy packages together (including transitives) via pnpm audit
   repo-vulns                      Check all repo dependencies for vulnerabilities via pnpm audit
@@ -481,10 +494,15 @@ Commands:
                                  Run pnpm audit across Vue repos (full output + combined summary)
   fleet-bump-fg-devkit [projects-root] [--dry-run]
                                  Bump fg-devkit, run sync-deps, then pnpm install across Vue repos
+  bump-pnpm-toolchain [version] [projects-root] [options]
+                                 Maintainer: bump pnpm to latest (or version), sync fg-devkit + fleet
+                                 Options: --dry-run, --skip-fleet, --skip-install
   policy-upgrade [policy-file] [ncu-args...]
                                  Upgrade policy packages via npm-check-updates (default interactive)
   policy-upgrade-commit [ncu-args...]
                                  Upgrade one consumer package.json package and auto-commit
+  audit-override-commit [pnpm-audit-args...]
+                                 Fix one vulnerability override via pnpm audit and auto-commit
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-vscode-settings            Copy shared VS Code settings into .vscode/settings.json
@@ -493,9 +511,13 @@ Commands:
   setup-lefthook                  Setup lefthook and migrate from husky/lint-staged
   prune-consumer-deps [--dry-run] Remove consumer tooling deps bundled by fg-devkit
   full-consumer-setup             Run: step 7 -> scripts -> lefthook -> step 3 -> step 2 -> pnpm install
-  create-release [release|candidate] [patch|minor|major]
+  create-release [release|candidate] [patch|minor|major] [--skip-release-notes]
                                  Stable release or candidate (X.Y.Z-rc.N); omit = interactive menu
                                  (alias: createRelease)
+  generate-release-notes [--tag=vX.Y.Z]
+                                 Generate CHANGELOG.md and user changelog via git-cliff
+  verify-release-notes           Interactive review step before committing release notes
+  sync-release-notes-config      Copy cliff configs and generate:release-notes script when missing
   commit [args...]              czg/cz-git with fg-devkit bundled config
   commit-vuln                   Commit staged dependency bumps as vuln() (alias: vuln-commit)
   lint [eslint-args...]         Run ESLint using fg-devkit bundled ESLint stack
@@ -648,6 +670,18 @@ async function runInteractiveMenu() {
       })
       if (releaseKind === 'cancel') continue
 
+      const releaseMode = await selectPrompt({
+        message: 'Create release',
+        choices: [
+          { name: 'Release + release notes', value: 'with-notes' },
+          { name: 'Release', value: 'without-notes' },
+          { name: 'Cancel', value: 'cancel' },
+        ],
+        default: 'with-notes',
+        loop: false,
+      })
+      if (releaseMode === 'cancel') continue
+
       const bumpChoice = await selectPrompt({
         message: releaseKind === 'candidate' ? 'Candidate' : 'Release',
         choices: [
@@ -663,6 +697,11 @@ async function runInteractiveMenu() {
 
       const releaseArgs =
         releaseKind === 'candidate' ? [bumpChoice, 'candidate'] : [bumpChoice]
+
+      if (releaseMode === 'without-notes') {
+        releaseArgs.push('--skip-release-notes')
+      }
+
       return runSelectedAction(() => runReleaseScript(releaseArgs))
     }
 
@@ -710,6 +749,7 @@ async function runInteractiveMenu() {
           { name: 'Check', value: 'check' },
           { name: 'Sync', value: 'sync' },
           { name: 'Upgrade one package.json package and auto-commit', value: 'upgrade-commit' },
+          { name: 'Fix one vulnerability override and auto-commit', value: 'audit-override-commit' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -718,6 +758,9 @@ async function runInteractiveMenu() {
       if (choice === 'cancel') continue
       if (choice === 'check') return runSelectedAction(() => runNode('check-dependency-policy.mjs'))
       if (choice === 'sync') return runSelectedAction(() => runNode('sync-dependency-policy.mjs'))
+      if (choice === 'audit-override-commit') {
+        return runSelectedAction(() => runNode('audit-override-commit.mjs'))
+      }
       return runSelectedAction(() => runNode('policy-upgrade-commit.mjs'))
     }
 
@@ -781,6 +824,7 @@ async function runInteractiveMenu() {
           { name: 'Check fg-devkit repo vulnerabilities', value: 'm5' },
           { name: 'Check vulnerabilities across all Vue repos', value: 'm6' },
           { name: 'Bump fg-devkit in all Vue repos, run sync-deps, and pnpm install', value: 'm7' },
+          { name: 'Bump pnpm toolchain (latest)', value: 'm8' },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'm1',
@@ -796,6 +840,24 @@ async function runInteractiveMenu() {
       if (choice === 'm5') return runSelectedAction(() => runMaintainerAuditAll())
       if (choice === 'm6') return runSelectedAction(() => runNode('fleet-vulns.mjs'))
       if (choice === 'm7') return runSelectedAction(() => runNode('fleet-bump-fg-devkit.mjs'))
+      if (choice === 'm8') {
+        const scope = await selectPrompt({
+          message: 'Bump pnpm toolchain',
+          choices: [
+            { name: 'fg-devkit only (policy, scaffold, install)', value: 'fg-devkit' },
+            { name: 'fg-devkit + all Vue repos under projects root', value: 'fleet' },
+            { name: 'Cancel', value: 'cancel' },
+          ],
+          default: 'fg-devkit',
+          loop: false,
+        })
+        if (scope === 'cancel') continue
+        const bumpArgs = []
+        if (scope === 'fg-devkit') {
+          bumpArgs.push('--skip-fleet')
+        }
+        return runSelectedAction(() => runNode('bump-pnpm-toolchain.mjs', bumpArgs))
+      }
       return 1
     }
   }
@@ -875,6 +937,11 @@ async function main() {
       process.exitCode = 1
       return
     }
+    if (sub === 'bump-pnpm-toolchain' && !isFgDevkitMaintainerContext()) {
+      console.error('[fg-devkit] bump-pnpm-toolchain is only available in the fg-devkit repository root.')
+      process.exitCode = 1
+      return
+    }
     process.exitCode = runNode(script, rest)
     return
   }

package/scripts/fleet-bump-fg-devkit.mjs

@@ -6,68 +6,19 @@
  *   pnpm exec fg-devkit fleet-bump-fg-devkit [projects-root] [--dry-run]
  */
 
-import fs from 'node:fs'
 import path from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { fileURLToPath } from 'node:url'
 
+import { collectFleetVueRepos } from './fleet-vue-repos.mjs'
+
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
 const cliArgs = process.argv.slice(2)
 const dryRun = cliArgs.includes('--dry-run')
 const projectsRootArg = cliArgs.find((a) => !a.startsWith('-'))
 const projectsRoot = projectsRootArg ? path.resolve(process.cwd(), projectsRootArg) : path.resolve(scriptDir, '../..')
 
-function shouldSkipPackageJsonDir(relDir) {
-  const normalized = relDir.split(path.sep).join('/')
-  if (normalized === 'scaffold/vue' || normalized.endsWith('/scaffold/vue')) {
-    return true
-  }
-  return false
-}
-
-function walk(dir, acc = []) {
-  for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
-    if (item.name === 'node_modules' || item.name === '.git') continue
-    const p = path.join(dir, item.name)
-    if (item.isDirectory()) walk(p, acc)
-    else if (item.name === 'package.json') acc.push(p)
-  }
-  return acc
-}
-
-function readJson(p) {
-  return JSON.parse(fs.readFileSync(p, 'utf8'))
-}
-
-function isVueProject(pkg) {
-  return Boolean(pkg.dependencies?.vue || pkg.devDependencies?.vue)
-}
-
-function hasFgDevkit(pkg) {
-  return Boolean(pkg.dependencies?.['fg-devkit'] || pkg.devDependencies?.['fg-devkit'])
-}
-
-function isFgDevkitRepo(pkg) {
-  return pkg?.name === 'fg-devkit'
-}
-
-const packageJsonFiles = walk(projectsRoot)
-const repos = []
-for (const packageJsonPath of packageJsonFiles) {
-  try {
-    const relDir = path.relative(projectsRoot, path.dirname(packageJsonPath))
-    if (shouldSkipPackageJsonDir(relDir)) continue
-    const pkg = readJson(packageJsonPath)
-    if (!isVueProject(pkg)) continue
-    if (isFgDevkitRepo(pkg)) continue
-    if (!hasFgDevkit(pkg)) continue
-    repos.push(path.dirname(packageJsonPath))
-  } catch {
-    // Ignore invalid package.json files.
-  }
-}
-
-const uniqueRepos = [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+const uniqueRepos = collectFleetVueRepos(projectsRoot)
 if (uniqueRepos.length === 0) {
   console.log(`[fleet-bump-fg-devkit] No Vue repositories with fg-devkit found under ${projectsRoot}`)
   process.exit(0)

package/scripts/fleet-vue-repos.mjs

@@ -0,0 +1,54 @@
+/**
+ * Discover Vue repositories under a projects root that use fg-devkit.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+
+/**
+ * @param {string} projectsRoot
+ * @param {{ skipScaffoldVue?: boolean }} [options]
+ * @returns {string[]} Absolute repo directory paths, sorted.
+ */
+export function collectFleetVueRepos(projectsRoot, options = {}) {
+  const { skipScaffoldVue = true } = options
+
+  function shouldSkipPackageJsonDir(relDir) {
+    if (!skipScaffoldVue) {
+      return false
+    }
+    const normalized = relDir.split(path.sep).join('/')
+    return normalized === 'scaffold/vue' || normalized.endsWith('/scaffold/vue')
+  }
+
+  function walk(dir, acc = []) {
+    for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+      if (item.name === 'node_modules' || item.name === '.git') continue
+      const p = path.join(dir, item.name)
+      if (item.isDirectory()) walk(p, acc)
+      else if (item.name === 'package.json') acc.push(p)
+    }
+    return acc
+  }
+
+  function readJson(p) {
+    return JSON.parse(fs.readFileSync(p, 'utf8'))
+  }
+
+  const repos = []
+  for (const packageJsonPath of walk(projectsRoot)) {
+    try {
+      const relDir = path.relative(projectsRoot, path.dirname(packageJsonPath))
+      if (shouldSkipPackageJsonDir(relDir)) continue
+      const pkg = readJson(packageJsonPath)
+      if (pkg?.name === 'fg-devkit') continue
+      if (!pkg.dependencies?.vue && !pkg.devDependencies?.vue) continue
+      if (!pkg.dependencies?.['fg-devkit'] && !pkg.devDependencies?.['fg-devkit']) continue
+      repos.push(path.dirname(packageJsonPath))
+    } catch {
+      // Ignore invalid package.json files.
+    }
+  }
+
+  return [...new Set(repos)].sort((a, b) => a.localeCompare(b))
+}

package/scripts/generate-release-notes.mjs

@@ -0,0 +1,84 @@
+#!/usr/bin/env node
+/**
+ * Generate technical and user-facing changelogs via git-cliff, then sync user changelog.
+ *
+ * Usage:
+ *   node node_modules/fg-devkit/scripts/generate-release-notes.mjs [--tag=vX.Y.Z]
+ *   pnpm exec fg-devkit generate-release-notes [--tag=vX.Y.Z]
+ */
+
+import { spawnSync } from 'node:child_process'
+import path from 'node:path'
+import {
+  hasReleaseNotesConfig,
+  resolveCliffConfig,
+  resolveGitCliffBin,
+  runSyncUserChangelog,
+} from './release-notes-common.mjs'
+const cwd = process.cwd()
+const tagArg = process.argv.find((arg) => arg.startsWith('--tag='))?.slice('--tag='.length)
+
+function runGitCliff(configPath, outputPath) {
+  const gitCliffBin = resolveGitCliffBin()
+  if (!gitCliffBin) {
+    console.error('[fg-devkit] Could not resolve git-cliff. Reinstall fg-devkit and retry.')
+    return 1
+  }
+
+  const args = ['-c', configPath, '-o', outputPath]
+  if (tagArg) {
+    args.push('--tag', tagArg)
+  }
+
+  const r = spawnSync(gitCliffBin, args, {
+    stdio: 'inherit',
+    cwd,
+    env: process.env,
+  })
+
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+
+  return r.status ?? 1
+}
+
+function main() {
+  if (!hasReleaseNotesConfig(cwd)) {
+    console.error(
+      '[fg-devkit] No release-notes config found. Run "pnpm exec fgd sync-release-notes-config" first.',
+    )
+    return 1
+  }
+
+  const technicalConfig = resolveCliffConfig('cliff.toml', cwd)
+  if (!technicalConfig) {
+    console.error('[fg-devkit] Missing cliff.toml in repo and fg-devkit configs.')
+    return 1
+  }
+
+  const userConfig = resolveCliffConfig('cliff.user.toml', cwd)
+
+  const technicalCode = runGitCliff(technicalConfig, path.join(cwd, 'CHANGELOG.md'))
+  if (technicalCode !== 0) {
+    return technicalCode
+  }
+
+  if (userConfig) {
+    const userCode = runGitCliff(userConfig, path.join(cwd, 'CHANGELOG.user.draft.md'))
+    if (userCode !== 0) {
+      return userCode
+    }
+
+    const syncCode = runSyncUserChangelog(cwd)
+    if (syncCode !== 0) {
+      return syncCode
+    }
+  }
+
+  console.log('[fg-devkit] Release notes generated.')
+  return 0
+}
+
+process.exitCode = main()

package/scripts/refresh-dependency-policy-from-repos.mjs

@@ -29,6 +29,7 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
 import { collectPinViolations } from './dependency-policy-pins.mjs'
+import { collectToolchainPolicyViolations } from './dependency-policy-toolchain.mjs'
 import { syncScaffoldVueDepsFromPolicy } from './sync-scaffold-vue-deps.mjs'
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url))
@@ -188,6 +189,18 @@ for (const [name, u] of usage) {
 }
 
 const policy = {
+  toolchain:
+    existingPolicy.toolchain ??
+    (() => {
+      try {
+        const fgDevkitPkg = JSON.parse(fs.readFileSync(fgDevkitPackageJsonPath, 'utf8'))
+        return fgDevkitPkg.packageManager
+          ? { packageManager: fgDevkitPkg.packageManager }
+          : undefined
+      } catch {
+        return undefined
+      }
+    })(),
   managedDependencies: {
     dependencies: sortRecord(outDeps),
     devDependencies: sortRecord(outDev),
@@ -201,6 +214,7 @@ const policyErrors = [
     collectPinViolations(`managedDependencies.${section}.`, deps),
   ),
   ...collectPinViolations('managedAnywhere.', policy.managedAnywhere),
+  ...collectToolchainPolicyViolations(policy),
 ]
 
 if (policyErrors.length > 0) {

package/scripts/release-notes-common.mjs

@@ -0,0 +1,114 @@
+#!/usr/bin/env node
+/**
+ * Shared helpers for release-notes scripts.
+ */
+
+import { spawnSync } from 'node:child_process'
+import fs from 'node:fs'
+import path from 'node:path'
+import { createRequire } from 'node:module'
+import { fileURLToPath } from 'node:url'
+
+const scriptDir = path.dirname(fileURLToPath(import.meta.url))
+const require = createRequire(import.meta.url)
+
+export const fgRoot = path.resolve(scriptDir, '..')
+
+/** True when the consumer repo has opted into git-cliff release notes. */
+export function hasReleaseNotesConfig(cwd = process.cwd()) {
+  return (
+    fs.existsSync(path.join(cwd, 'cliff.toml')) ||
+    fs.existsSync(path.join(cwd, 'cliff.user.toml')) ||
+    fs.existsSync(path.join(cwd, 'CHANGELOG.md')) ||
+    fs.existsSync(path.join(cwd, 'CHANGELOG.user.md'))
+  )
+}
+
+export function resolveCliffConfig(name, cwd = process.cwd()) {
+  const local = path.join(cwd, name)
+  if (fs.existsSync(local)) {
+    return local
+  }
+
+  const bundled = path.join(fgRoot, 'configs', name)
+  if (fs.existsSync(bundled)) {
+    return bundled
+  }
+
+  return null
+}
+
+export function resolveGitCliffBin() {
+  const candidates = [
+    path.join(fgRoot, 'node_modules', 'git-cliff', 'lib', 'cli', 'cli.js'),
+    path.join(process.cwd(), 'node_modules', 'git-cliff', 'lib', 'cli', 'cli.js'),
+    path.join(process.cwd(), 'node_modules', 'fg-devkit', 'node_modules', 'git-cliff', 'lib', 'cli', 'cli.js'),
+  ]
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate
+    }
+  }
+
+  return null
+}
+
+export function resolveTsxBin() {
+  const candidates = [
+    path.join(fgRoot, 'node_modules', 'tsx', 'dist', 'cli.mjs'),
+    path.join(fgRoot, 'node_modules', 'tsx', 'cli.mjs'),
+    path.join(process.cwd(), 'node_modules', 'tsx', 'dist', 'cli.mjs'),
+    path.join(process.cwd(), 'node_modules', 'fg-devkit', 'node_modules', 'tsx', 'dist', 'cli.mjs'),
+  ]
+
+  for (const candidate of candidates) {
+    if (fs.existsSync(candidate)) {
+      return candidate
+    }
+  }
+
+  try {
+    return require.resolve('tsx/cli.mjs', { paths: [fgRoot, process.cwd()] })
+  } catch {
+    return null
+  }
+}
+
+export function runSyncUserChangelog(cwd = process.cwd()) {
+  const tsxBin = resolveTsxBin()
+  const syncScript = path.join(fgRoot, 'release-notes', 'sync-user-changelog.ts')
+
+  if (!tsxBin) {
+    console.error('[fg-devkit] Could not resolve tsx. Reinstall fg-devkit and retry.')
+    return 1
+  }
+
+  const r = spawnSync(process.execPath, [tsxBin, syncScript], {
+    stdio: 'inherit',
+    cwd,
+    env: { ...process.env, FG_DEVKIT_CWD: cwd },
+  })
+
+  if (r.error) {
+    console.error('[fg-devkit]', r.error.message)
+    return 1
+  }
+
+  return r.status ?? 1
+}
+
+export function readPreviewFiles(cwd = process.cwd()) {
+  const files = ['CHANGELOG.user.draft.md', 'CHANGELOG.user.md', 'CHANGELOG.md']
+  const previews = []
+
+  for (const file of files) {
+    const filePath = path.join(cwd, file)
+    if (!fs.existsSync(filePath)) {
+      continue
+    }
+    previews.push({ file, content: fs.readFileSync(filePath, 'utf8') })
+  }
+
+  return previews
+}