maiass 5.15.8 → 5.15.13

package/lib/ci-templates.js

@@ -16,6 +16,11 @@ function renderTemplate(src) {
   // .trim() guards against a stray newline or whitespace from a mis-quoted
   // .env.maiass entry silently breaking the YAML trigger filter
   const developBranch = (process.env.MAIASS_DEVELOPBRANCH || 'develop').trim() || 'develop';
+  // Note: the develop branch MUST be baked in here because the CI trigger
+  // filter has to be a YAML literal. The credential-missing behaviour
+  // (MAIASS_CI_FAIL_SILENTLY) is deliberately NOT baked — it lives as an
+  // editable env var inside the generated workflow, so it has a single source
+  // of truth (the YAML) rather than a stale copy in .env.maiass.
   return fs.readFileSync(src, 'utf8').replaceAll('__MAIASS_DEVELOPBRANCH__', developBranch);
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "maiass",
   "type": "module",
-  "version": "5.15.8",
+  "version": "5.15.13",
   "description": "AI commit messages, version bumps, and changelogs from one command. Stages, commits, merges, tags. Anonymous on first run — no email, no card.",
   "main": "maiass.mjs",
   "bin": {

package/templates/ci/bitbucket-pipelines-excerpt.yml

@@ -21,6 +21,11 @@
 #        - Create an app password with Repositories: Read & Write scope
 #        - Add it as a repository variable named BB_APP_PASSWORD (secured)
 #        - Add your Bitbucket username as BB_USERNAME
+#
+# Missing-credential behaviour:
+#   If BB_USERNAME / BB_APP_PASSWORD are not set, a preflight (by default) fails
+#   the step with a clear message. To instead skip with a warning and pass, set
+#   MAIASS_CI_FAIL_SILENTLY to "true" on the first line of the script below.
 
 pipelines:
   branches:
@@ -29,6 +34,29 @@ pipelines:
           name: MAIASS Version Bump
           image: node:20
           script:
+            # Bitbucket doesn't reliably export a step-level variables: block to
+            # the script, so these are exported here instead.
+            # Disable AI so CI runs consume no credits (the CLI also self-guards
+            # via CI detection, but keep this explicit and effective).
+            - export MAIASS_AI_MODE="off"
+            # Edit to "true" to skip with a warning instead of failing when the
+            # push credential is missing.
+            - export MAIASS_CI_FAIL_SILENTLY="false"
+            # Preflight: BB_USERNAME/BB_APP_PASSWORD are required to push the
+            # bump back. Behaviour when missing is controlled by
+            # MAIASS_CI_FAIL_SILENTLY above: false (default) fails the step;
+            # true skips with a warning.
+            - |
+              if [ -z "$BB_USERNAME" ] || [ -z "$BB_APP_PASSWORD" ]; then
+                MSG="BB_USERNAME / BB_APP_PASSWORD repository variables are not set — add them (app password with Repositories: Read & Write) to enable automatic version bumping."
+                if [ "$MAIASS_CI_FAIL_SILENTLY" = "true" ]; then
+                  echo "WARNING: $MSG Skipping version bump."
+                  exit 0
+                else
+                  echo "ERROR: $MSG"
+                  exit 1
+                fi
+              fi
             # Guard: skip if last commit was already a version bump
             - |
               LAST_MSG=$(git log -1 --pretty=format:'%s')
@@ -42,5 +70,3 @@ pipelines:
             # Authenticate push via app password
             - git remote set-url origin "https://${BB_USERNAME}:${BB_APP_PASSWORD}@bitbucket.org/${BITBUCKET_REPO_FULL_NAME}.git"
             - maiass -a patch
-          variables:
-            MAIASS_AI_MODE: "off"  # Disable AI — no credits used in CI

package/templates/ci/github-version-bump.yml

@@ -17,6 +17,11 @@
 #   3. Add the PAT as a repository secret named GH_PAT
 #
 # Notes:
+#   - If the GH_PAT secret is missing, this workflow runs a preflight that, by
+#     default, fails with a clear message (the merge itself is unaffected — this
+#     runs after merge). To instead skip with a warning and keep the run green,
+#     set MAIASS_CI_FAIL_SILENTLY to "true" in the preflight step's env: block
+#     below.
 #   - AI is disabled (MAIASS_AI_MODE: off) so no credits are used.
 #   - The branch name below is substituted at install time from
 #     MAIASS_DEVELOPBRANCH. GitHub Actions requires `on.pull_request.branches`
@@ -43,12 +48,46 @@ jobs:
       contents: write  # Required to push the version bump commit
 
     steps:
+      # Preflight: this workflow runs AFTER the PR is merged, so a missing
+      # GH_PAT can't block the merge — but it would fail the checkout/push with
+      # a confusing auth error on every merge. Detect the empty secret up front
+      # and emit a clear, actionable message. Behaviour is controlled by the
+      # MAIASS_CI_FAIL_SILENTLY env var below:
+      #   false (default) — fail the run so the missing secret is noticed.
+      #   true            — skip with a warning; the run stays green.
+      - name: Check GH_PAT secret
+        id: preflight
+        env:
+          GH_PAT: ${{ secrets.GH_PAT }}
+          # Edit this to "true" to skip with a warning instead of failing when
+          # GH_PAT is missing.
+          MAIASS_CI_FAIL_SILENTLY: "false"
+        run: |
+          if [ -n "$GH_PAT" ]; then
+            exit 0
+          fi
+          MSG="GH_PAT secret is not set, so the version bump cannot be pushed back to the repo. Add a fine-grained PAT as a repo secret named GH_PAT (Settings → Secrets → Actions) with Contents: Read & Write, Metadata: Read-only, Workflows: Read & Write."
+          {
+            echo "### ⚠️ MAIASS version bump — GH_PAT missing"
+            echo ""
+            echo "$MSG"
+          } >> "$GITHUB_STEP_SUMMARY"
+          if [ "$MAIASS_CI_FAIL_SILENTLY" = "true" ]; then
+            echo "::warning title=MAIASS version bump skipped::$MSG"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "::error title=MAIASS version bump failed::$MSG"
+            exit 1
+          fi
+
       - uses: actions/checkout@v4
+        if: steps.preflight.outputs.skip != 'true'
         with:
           fetch-depth: 0          # Full history needed for changelog generation
           token: ${{ secrets.GH_PAT }}  # PAT allows the bot to push back to the repo
 
       - uses: actions/setup-node@v4
+        if: steps.preflight.outputs.skip != 'true'
         with:
           node-version: '24'
           # No cache: this workflow only does `npm install -g maiass`, which
@@ -57,9 +96,11 @@ jobs:
           # WordPress/PHP plugins): "Dependencies lock file is not found".
 
       - name: Install maiass
+        if: steps.preflight.outputs.skip != 'true'
         run: npm install -g maiass --no-fund --no-audit
 
       - name: Configure git
+        if: steps.preflight.outputs.skip != 'true'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -67,9 +108,11 @@ jobs:
       # Explicitly check out the develop branch head (the pull_request closed
       # event checks out a merge ref, not the branch itself)
       - name: Checkout __MAIASS_DEVELOPBRANCH__
+        if: steps.preflight.outputs.skip != 'true'
         run: git checkout __MAIASS_DEVELOPBRANCH__
 
       - name: Bump version
+        if: steps.preflight.outputs.skip != 'true'
         run: maiass -a patch
         env:
           # Quoted: unquoted `off` is a YAML boolean that GitHub stringifies to

package/templates/ci/gitlab-ci-excerpt.yml

@@ -17,6 +17,11 @@
 # Double-bump protection:
 #   The script checks the last commit author and skips if it was already made
 #   by the CI bot — preventing an infinite loop of version bumps.
+#
+# Missing-token behaviour:
+#   If GITLAB_TOKEN is not set, a preflight (by default) fails the job with a
+#   clear message. To instead skip with a warning and pass, set
+#   MAIASS_CI_FAIL_SILENTLY to "true" in the variables: block below.
 
 stages:
   - version
@@ -27,6 +32,20 @@ maiass-version-bump:
   only:
     - __MAIASS_DEVELOPBRANCH__
   script:
+    # Preflight: GITLAB_TOKEN is required to push the bump back. Behaviour when
+    # it's missing is controlled by MAIASS_CI_FAIL_SILENTLY in the variables:
+    # block below: false (default) fails the job; true skips with a warning.
+    - |
+      if [ -z "$GITLAB_TOKEN" ]; then
+        MSG="GITLAB_TOKEN CI/CD variable is not set — add it (masked, protected) with write access to enable automatic version bumping."
+        if [ "$MAIASS_CI_FAIL_SILENTLY" = "true" ]; then
+          echo "WARNING: $MSG Skipping version bump."
+          exit 0
+        else
+          echo "ERROR: $MSG"
+          exit 1
+        fi
+      fi
     # Skip if the last commit was already a version bump from this pipeline
     - |
       LAST_AUTHOR=$(git log -1 --pretty=format:'%an')
@@ -43,3 +62,5 @@ maiass-version-bump:
     - maiass -a patch
   variables:
     MAIASS_AI_MODE: "off"  # Disable AI — no credits used in CI
+    # Missing GITLAB_TOKEN: "false" fails the job, "true" skips with a warning.
+    MAIASS_CI_FAIL_SILENTLY: "false"