repokeeper 0.2.1 → 0.2.3

package/README.md

@@ -28,7 +28,22 @@ repokeeper update   # move to the latest standard without overwriting your edits
 
 `init` never overwrites a file you already have: it reports it as unmanaged. Pass
 `--adopt <path>` to let repokeeper manage it, or list it under `owned` in `.repokeeper.yml` to keep it
-yours. Every write command accepts `--dry-run`.
+yours. `owned` also takes a single key of a shared file, such as `.github/workflows/ci.yml#on` or
+`package.json#devDependencies.lefthook`; repokeeper then leaves that key, and everything under it,
+alone. Every write command accepts `--dry-run`.
+
+`init` reads the default branch from `origin/HEAD` and records it as `github.default_branch` when it
+isn't `main`. The release manifest starts from the latest `vX.Y.Z` tag when the stack has no version
+of its own.
+
+After writing, repokeeper prints what is left to do (installing the git hooks, and
+`git add --renormalize .` when tracked files are stored with CRLF). `init`, `update` and `check` also
+point out what they can't fix: `.gitattributes` lines above the repokeeper block that the block
+overrides, and pull request workflows of your own that run the same tests as the repokeeper ci job.
+
+Stack notes: Python runs `mypy` on the files its config names (`files = …`), or on the whole tree
+otherwise. The dotnet stack needs SDK-style projects; `init` stops with the names of .NET Framework
+projects, which the dotnet CLI can't build.
 
 Requires Node.js 22.12 or newer.
 
@@ -37,7 +52,18 @@ Requires Node.js 22.12 or newer.
 `ci.yml` and `release.yml` call reusable workflows from this repository (`stack-node.yml`,
 `commitlint.yml`, `release-please.yml`) at the moving major tag, so fixes reach every repository
 without a pull request. repokeeper owns the `name`, `on` and `permissions` keys and the jobs it
-adds; jobs you add yourself are left alone.
+adds; jobs you add yourself are left alone, and so is the formatting of the rest of the file.
+
+The script stack runs ShellCheck and `shfmt -d` on `*.sh` (format with `shfmt -w` before pushing)
+and PSScriptAnalyzer on `*.ps1`, which fails on errors and warnings (not on information-level rules). To
+choose the rules yourself, add a `PSScriptAnalyzerSettings.psd1` at the repository root; the job then uses it:
+
+```powershell
+@{
+    # installers print for the person running them
+    ExcludeRules = @('PSAvoidUsingWriteHost')
+}
+```
 
 `release.yml` runs [release-please](https://github.com/googleapis/release-please): it keeps a release
 pull request open, and merging it tags the release and updates `CHANGELOG.md`. Two settings make this

package/dist/commands/check.js

@@ -6,7 +6,7 @@ import { readLock } from "../sync/lock.js";
 import { computeSync } from "../sync/sync.js";
 import { compareVersions, STANDARD_VERSION } from "../version.js";
 import { buildContext } from "./context.js";
-import { hasDrift, printResult } from "./report.js";
+import { hasDrift, printResult, printWarnings } from "./report.js";
 export function assertSupportedStandard(standard) {
     if (compareVersions(standard, STANDARD_VERSION) > 0) {
         throw new UsageError(`this repository uses standard ${standard}, newer than ${STANDARD_VERSION}; upgrade repokeeper`);
@@ -21,7 +21,11 @@ export async function checkCommand(root, options, io) {
         return 1;
     }
     const ctx = await buildContext(root, config);
-    const result = await computeSync(root, planOutputs(ctx), lock, { adopt: new Set(), accept: new Set() });
+    const result = await computeSync(root, planOutputs(ctx), lock, {
+        adopt: new Set(),
+        accept: new Set(),
+        owned: config.owned,
+    });
     const behind = config.standard !== STANDARD_VERSION || lock.standard !== STANDARD_VERSION;
     const clean = !hasDrift(result) && !behind;
     if (options.json) {
@@ -38,6 +42,7 @@ export async function checkCommand(root, options, io) {
         return clean ? 0 : 1;
     }
     printResult(io, result);
+    await printWarnings(root, ctx, io);
     if (behind)
         io.out(`standard   ${config.standard} applied, ${STANDARD_VERSION} available (run \`repokeeper update\`)`);
     io.out(clean ? "repository matches the standard" : "repository has drifted from the standard");

package/dist/commands/init.js

@@ -4,7 +4,7 @@ import { join } from "node:path";
 import { CONFIG_FILE, loadConfig, renderConfig } from "../config/load.js";
 import { defaultConfig } from "../config/types.js";
 import { UsageError } from "../errors.js";
-import { dirtyPaths, gitUserName, repoInfo } from "../git.js";
+import { dirtyPaths, gitUserName, remoteDefaultBranch, repoInfo } from "../git.js";
 import { outputId } from "../model.js";
 import { planOutputs } from "../plan.js";
 import { detectStacks } from "../stacks/index.js";
@@ -15,11 +15,27 @@ import { readCurrent } from "../sync/state.js";
 import { computeSync, pathsToWrite } from "../sync/sync.js";
 import { STANDARD_VERSION } from "../version.js";
 import { buildContext } from "./context.js";
-import { printResult } from "./report.js";
-export async function guardUncommitted(root, result, force) {
+import { nextSteps, printResult, printWarnings } from "./report.js";
+/** A dirty path is still safe to write when every part repokeeper manages in it is exactly what it last wrote. */
+async function onlyRepokeeperChanges(root, path, lock) {
+    const entries = lock?.entries.filter((e) => e.target.path === path) ?? [];
+    if (entries.length === 0)
+        return false;
+    for (const entry of entries) {
+        const current = await readCurrent(root, entry.target);
+        if (current === null || hashText(current) !== entry.hash)
+            return false;
+    }
+    return true;
+}
+export async function guardUncommitted(root, result, force, lock = null) {
     if (force)
         return;
-    const dirty = await dirtyPaths(root, pathsToWrite(result));
+    const dirty = [];
+    for (const d of await dirtyPaths(root, pathsToWrite(result))) {
+        if (!(await onlyRepokeeperChanges(root, d.path, lock)))
+            dirty.push(d);
+    }
     if (dirty.length === 0)
         return;
     const names = dirty.map((d) => (d.untracked ? `${d.path} (untracked)` : d.path)).join(", ");
@@ -46,6 +62,9 @@ export async function initCommand(root, options, io) {
         contact: repo.owner ? `https://github.com/${repo.owner}` : "the repository maintainers",
         codeowners: repo.owner ? [`@${repo.owner}`] : [],
     });
+    const branch = await remoteDefaultBranch(root);
+    if (branch && branch !== "main")
+        config.github = { default_branch: branch };
     const ctx = await buildContext(root, config, repo);
     const adopt = options.adoptAll ? "all" : new Set(options.adopt);
     const result = await computeSync(root, planOutputs(ctx), null, { adopt, accept: new Set() });
@@ -59,7 +78,10 @@ export async function initCommand(root, options, io) {
     await writeFile(join(root, CONFIG_FILE), renderConfig(config));
     await applySync(root, result, null, STANDARD_VERSION);
     io.out(`applied standard ${STANDARD_VERSION}; wrote ${CONFIG_FILE}`);
-    io.out(`next: install dependencies (this installs the git hooks), then commit with "chore(repokeeper): apply standard ${STANDARD_VERSION}"`);
+    await printWarnings(root, ctx, io);
+    for (const step of await nextSteps(root, ctx, result))
+        io.out(`next: ${step}`);
+    io.out(`next: commit with "chore(repokeeper): apply standard ${STANDARD_VERSION}"`);
     return 0;
 }
 /** Records the current content of every planned output as repokeeper's own, rebuilding a lost or corrupt lock. */

package/dist/commands/report.js

@@ -1,7 +1,25 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { duplicateTestRuns } from "../duplicates.js";
+import { crlfTrackedFiles } from "../git.js";
 import { describeOutput } from "../model.js";
+import { overriddenAttributes } from "../sync/attributes.js";
+import { TOOL_VERSIONS } from "../version.js";
+/** How to name the output under `owned`: the path, or `path#key` for one key of a shared file. */
+function ownedName(output) {
+    if (output.kind === "yaml" || output.kind === "json")
+        return `"${output.path}#${output.keyPath.join(".")}"`;
+    if (output.kind === "block")
+        return `"${output.path}#${output.id}"`;
+    return "it";
+}
 const HINTS = {
-    conflict: (p) => `edited locally; take repokeeper's version with --accept ${p}, or add it to owned in .repokeeper.yml`,
-    unmanaged: (p) => `exists and is not managed; let repokeeper manage it with --adopt ${p}, or add it to owned`,
+    conflict: (o) => `edited locally; take repokeeper's version with --accept ${o.path}, or add ${ownedName(o)} to owned in .repokeeper.yml`,
+    unmanaged: (o) => `exists and is not managed; let repokeeper manage it with --adopt ${o.path}, or add ${ownedName(o)} to owned`,
+};
+const REMOVAL_NOTES = {
+    "orphan-edited": " (no longer generated, but edited locally; left in place)",
+    left: " (no longer generated; left for the tools that use it, delete it if none do)",
 };
 export function printResult(io, result) {
     let unchanged = 0;
@@ -10,18 +28,51 @@ export function printResult(io, result) {
             unchanged++;
             continue;
         }
-        const hint = HINTS[action]?.(output.path);
+        const hint = HINTS[action]?.(output);
         io.out(`${action.padEnd(10)} ${describeOutput(output)}${hint ? ` (${hint})` : ""}`);
     }
     for (const { entry, action } of result.removals) {
-        if (action === "gone")
+        if (action === "gone" || action === "release")
             continue;
-        const label = action === "delete" ? "delete" : "kept";
-        const note = action === "delete" ? "" : " (no longer generated, but edited locally; left in place)";
+        const label = action === "orphan-edited" ? "kept" : action;
+        const note = REMOVAL_NOTES[action] ?? "";
         io.out(`${label.padEnd(10)} ${entry.target.path}${note}`);
     }
     io.out(`${unchanged} output(s) already match the standard`);
 }
+const WROTE = ["create", "write", "adopt"];
+/** What the user still has to do after a write: install the hooks, renormalize line endings. */
+export async function nextSteps(root, ctx, result) {
+    const steps = [];
+    const wrote = (path) => result.decisions.some((d) => d.output.path === path && WROTE.includes(d.action));
+    if (ctx.config.modules.hooks && wrote("lefthook.yml")) {
+        steps.push(ctx.stacks.some((s) => s.id === "node")
+            ? "install dependencies; this installs the git hooks"
+            : `run \`npx --yes lefthook@${TOOL_VERSIONS.lefthook} install\` to enable the git hooks`);
+    }
+    if (wrote(".gitattributes")) {
+        const crlf = await crlfTrackedFiles(root);
+        if (crlf.length > 0) {
+            const files = crlf.length === 1 ? "1 file is" : `${crlf.length} files are`;
+            steps.push(`${files} stored with CRLF line endings; run \`git add --renormalize .\` so they follow .gitattributes`);
+        }
+    }
+    return steps;
+}
+/** Problems repokeeper can't fix itself; printed, but not counted as drift. */
+export async function printWarnings(root, ctx, io) {
+    if (ctx.config.modules.ci) {
+        for (const { file, command } of await duplicateTestRuns(root, ctx.stacks)) {
+            io.out(`note: ${file} also runs "${command}", which the repokeeper ci job now runs too; drop one of them to save CI time`);
+        }
+    }
+    if (!ctx.config.modules.editorconfig)
+        return;
+    const text = await readFile(join(root, ".gitattributes"), "utf8").catch(() => "");
+    for (const { line, by } of overriddenAttributes(text, "editorconfig")) {
+        io.out(`warning: .gitattributes: "${line}" has no effect because repokeeper's "${by}" comes later; move it below the repokeeper block to keep it`);
+    }
+}
 export function hasDrift(result) {
-    return result.decisions.some((d) => d.action !== "unchanged") || result.removals.length > 0;
+    return result.decisions.some((d) => d.action !== "unchanged") || result.removals.some((r) => r.action !== "release");
 }

package/dist/commands/update.js

@@ -10,7 +10,7 @@ import { STANDARD_VERSION } from "../version.js";
 import { assertSupportedStandard } from "./check.js";
 import { buildContext } from "./context.js";
 import { guardUncommitted } from "./init.js";
-import { printResult } from "./report.js";
+import { nextSteps, printResult, printWarnings } from "./report.js";
 export async function updateCommand(root, options, io) {
     const config = await loadConfig(root);
     assertSupportedStandard(config.standard);
@@ -19,15 +19,21 @@ export async function updateCommand(root, options, io) {
         throw new UsageError(".repokeeper/lock.json is missing; run `repokeeper init --relock` first");
     const ctx = await buildContext(root, { ...config, standard: STANDARD_VERSION });
     const adopt = options.adoptAll ? "all" : new Set(options.adopt);
-    const result = await computeSync(root, planOutputs(ctx), lock, { adopt, accept: new Set(options.accept) });
+    const result = await computeSync(root, planOutputs(ctx), lock, {
+        adopt,
+        accept: new Set(options.accept),
+        owned: config.owned,
+    });
     if (!options.dryRun)
-        await guardUncommitted(root, result, options.force);
+        await guardUncommitted(root, result, options.force, lock);
     printResult(io, result);
     if (options.dryRun) {
         io.out("dry run: nothing written");
         return 0;
     }
     await applySync(root, result, lock, STANDARD_VERSION);
+    const steps = await nextSteps(root, ctx, result);
+    await printWarnings(root, ctx, io);
     if (config.standard !== STANDARD_VERSION) {
         const path = join(root, CONFIG_FILE);
         await writeFile(path, setStandard(await readFile(path, "utf8"), STANDARD_VERSION));
@@ -37,6 +43,8 @@ export async function updateCommand(root, options, io) {
         io.out(`${conflicts.length} file(s) kept because they were edited locally; new versions are beside them as *.repokeeper-new`);
         return 1;
     }
+    for (const step of steps)
+        io.out(`next: ${step}`);
     io.out(`repository is on standard ${STANDARD_VERSION}; commit with "chore(repokeeper): update standard to ${STANDARD_VERSION}"`);
     return 0;
 }

package/dist/config/types.js

@@ -1,4 +1,9 @@
 export const STACK_IDS = ["node", "python", "dart", "script", "java", "dotnet"];
+/** The branch workflows run on and contributors branch from: `github.default_branch`, or `main`. */
+export function defaultBranch(config) {
+    const branch = config.github?.default_branch;
+    return typeof branch === "string" && branch.length > 0 ? branch : "main";
+}
 export function defaultConfig(input) {
     return {
         schema: 1,

package/dist/duplicates.js

@@ -0,0 +1,36 @@
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { REUSABLE_REPO } from "./version.js";
+const WORKFLOWS = ".github/workflows";
+const calls = (job) => {
+    const uses = job?.uses;
+    return (typeof uses === "string" && (uses.startsWith(`${REUSABLE_REPO}/`) || uses.startsWith("./.github/workflows/stack-")));
+};
+/** Workflows of the user's own that run a stack's test command, which repokeeper's ci job now runs as well. */
+export async function duplicateTestRuns(root, stacks) {
+    const commands = stacks.map((s) => s.test).filter((c) => c !== null);
+    if (commands.length === 0)
+        return [];
+    const names = await readdir(join(root, WORKFLOWS)).catch(() => []);
+    const found = [];
+    for (const name of names.filter((n) => /\.ya?ml$/.test(n)).sort()) {
+        let workflow;
+        try {
+            workflow = parse(await readFile(join(root, WORKFLOWS, name), "utf8"));
+        }
+        catch {
+            continue;
+        }
+        // only pull request CI overlaps with repokeeper's ci job; a release workflow testing before it publishes doesn't
+        if (!JSON.stringify(workflow?.on ?? "").includes("pull_request"))
+            continue;
+        const jobs = workflow?.jobs ?? {};
+        const own = JSON.stringify(Object.values(jobs).filter((job) => !calls(job)));
+        for (const command of commands) {
+            if (own.includes(command))
+                found.push({ file: `${WORKFLOWS}/${name}`, command });
+        }
+    }
+    return found;
+}

package/dist/git.js

@@ -20,7 +20,27 @@ export function parseRemoteUrl(url) {
 }
 export async function repoInfo(root) {
     const url = await git(root, ["remote", "get-url", "origin"]);
-    return (url ? parseRemoteUrl(url) : null) ?? { owner: null, name: basename(root) };
+    const remote = (url ? parseRemoteUrl(url) : null) ?? { owner: null, name: basename(root) };
+    return { ...remote, releasedVersion: await latestReleaseVersion(root) };
+}
+/** The branch `origin/HEAD` points at, or null when the remote's default branch isn't known locally. */
+export async function remoteDefaultBranch(root) {
+    const ref = (await git(root, ["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]))?.trim();
+    return ref?.startsWith("origin/") ? ref.slice("origin/".length) : null;
+}
+/** The highest `vX.Y.Z` tag as `X.Y.Z`; major tags such as `v0` are skipped. */
+export async function latestReleaseVersion(root) {
+    const tags = (await git(root, ["tag", "--list", "v*", "--sort=-v:refname"])) ?? "";
+    const tag = tags.split("\n").find((t) => /^v\d+\.\d+\.\d+$/.test(t.trim()));
+    return tag ? tag.trim().slice(1) : null;
+}
+/** Tracked files git stores with CRLF line endings; `.gitattributes` only reaches them after a renormalize. */
+export async function crlfTrackedFiles(root) {
+    const out = (await git(root, ["ls-files", "--eol"])) ?? "";
+    return out
+        .split("\n")
+        .filter((line) => line.startsWith("i/crlf"))
+        .map((line) => line.split("\t").pop());
 }
 export async function gitUserName(root) {
     return (await git(root, ["config", "user.name"]))?.trim() || null;

package/dist/modules/editorconfig.js

@@ -22,10 +22,13 @@ trim_trailing_whitespace = false
 [Makefile]
 indent_style = tab
 `;
+// gitattributes patterns have no brace expansion, so every extension gets its own line
+const CRLF = ["ps1", "psm1", "bat", "cmd"];
+const BINARY = ["png", "jpg", "jpeg", "gif", "ico", "webp", "pdf", "zip", "gz", "woff", "woff2"];
 const GITATTRIBUTES = [
     "* text=auto eol=lf",
-    "*.{ps1,psm1,bat,cmd} text eol=crlf",
-    "*.{png,jpg,jpeg,gif,ico,webp,pdf,zip,gz,woff,woff2} binary",
+    ...CRLF.map((ext) => `*.${ext} text eol=crlf`),
+    ...BINARY.map((ext) => `*.${ext} binary`),
 ].join("\n");
 export const editorconfigModule = {
     id: "editorconfig",

package/dist/modules/health.js

@@ -1,3 +1,4 @@
+import { defaultBranch } from "../config/types.js";
 import { UsageError } from "../errors.js";
 import { MANAGED_HEADER } from "../model.js";
 import { readTemplate } from "../templates.js";
@@ -48,9 +49,9 @@ export const healthModule = {
         const run = install.length ? `Run ${install.map((c) => `\`${c}\``).join(" and ")}.` : "";
         const hooks = ctx.stacks.some((s) => s.id === "node")
             ? "Installing the dependencies also installs the git hooks (lefthook)."
-            : `Then run \`npx --yes lefthook@${TOOL_VERSIONS.lefthook} install\` once to enable the git hooks (they need Node.js 22 or newer).`;
+            : `${run ? "Then run" : "Run"} \`npx --yes lefthook@${TOOL_VERSIONS.lefthook} install\` once to enable the git hooks (they need Node.js 22 or newer).`;
         const setup = [run, hooks].filter(Boolean).join(" ");
-        outputs.push(md("CONTRIBUTING.md", `# Contributing\n\n<!-- ${MANAGED_HEADER} -->\n\nThanks for helping improve this project.\n\n## Local setup\n\n${setup}\n\n## Workflow\n\n1. Create a branch from \`main\`.\n2. Write commit messages in [Conventional Commits](https://www.conventionalcommits.org/) form, for example \`feat: add export button\` or \`fix(api): handle empty input\`. The \`commit-msg\` hook checks them.\n3. Open a pull request. It is merged once the checks pass and it has been reviewed.\n\nPlease follow the [Code of Conduct](CODE_OF_CONDUCT.md).\n`));
+        outputs.push(md("CONTRIBUTING.md", `# Contributing\n\n<!-- ${MANAGED_HEADER} -->\n\nThanks for helping improve this project.\n\n## Local setup\n\n${setup}\n\n## Workflow\n\n1. Create a branch from \`${defaultBranch(ctx.config)}\`.\n2. Write commit messages in [Conventional Commits](https://www.conventionalcommits.org/) form, for example \`feat: add export button\` or \`fix(api): handle empty input\`. The \`commit-msg\` hook checks them.\n3. Open a pull request. It is merged once the checks pass and it has been reviewed.\n\nPlease follow the [Code of Conduct](CODE_OF_CONDUCT.md).\n`));
         outputs.push(md("CODE_OF_CONDUCT.md", readTemplate("CODE_OF_CONDUCT.md").replace("[INSERT CONTACT METHOD]", health.contact)));
         outputs.push(...ctx.platform.communityFiles(ctx));
         return outputs;

package/dist/owned.js

@@ -0,0 +1,23 @@
+const toPosix = (path) => path.replace(/\\/g, "/").replace(/^\.\//, "");
+/**
+ * Whether an `owned` entry covers the target: a whole path (`LICENSE`), a block (`.gitattributes#editorconfig`),
+ * or a key and everything under it (`.github/workflows/ci.yml#on`, `package.json#devDependencies.lefthook`).
+ */
+export function isOwned(owned, target) {
+    return owned.some((entry) => {
+        const hash = entry.indexOf("#");
+        const path = toPosix(hash === -1 ? entry : entry.slice(0, hash));
+        if (path !== target.path)
+            return false;
+        if (hash === -1)
+            return true;
+        const key = entry.slice(hash + 1);
+        if (target.kind === "block")
+            return key === target.id;
+        if (target.kind === "yaml" || target.kind === "json") {
+            const dotted = target.keyPath.join(".");
+            return dotted === key || dotted.startsWith(`${key}.`);
+        }
+        return false;
+    });
+}

package/dist/plan.js

@@ -1,13 +1,13 @@
 import { outputId } from "./model.js";
 import { MODULES } from "./modules/index.js";
-const toPosix = (path) => path.replace(/\\/g, "/").replace(/^\.\//, "");
+import { isOwned } from "./owned.js";
+import { targetOf } from "./sync/lock.js";
 /** Pure: the outputs the standard asks for, given the config and resolved stacks. */
 export function planOutputs(ctx, modules = MODULES) {
-    const owned = new Set(ctx.config.owned.map(toPosix));
     const outputs = modules
         .filter((module) => module.enabled(ctx.config))
         .flatMap((module) => module.outputs(ctx))
-        .filter((output) => !owned.has(output.path));
+        .filter((output) => !isOwned(ctx.config.owned, targetOf(output)));
     const seen = new Set();
     for (const output of outputs) {
         const id = outputId(output);

package/dist/platforms/github.js

@@ -1,4 +1,5 @@
 import { stringify } from "yaml";
+import { defaultBranch } from "../config/types.js";
 import { MANAGED_HEADER } from "../model.js";
 import { REUSABLE_REPO, WORKFLOW_REF } from "../version.js";
 const yamlFile = (module, path, data) => ({
@@ -21,10 +22,6 @@ const workflowKey = (module, path, keyPath, value) => ({
     value,
     order: WORKFLOW_KEYS,
 });
-function defaultBranch(ctx) {
-    const branch = ctx.config.github?.default_branch;
-    return typeof branch === "string" && branch.length > 0 ? branch : "main";
-}
 const RELEASE_PLEASE_SCHEMA = "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json";
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
 export const githubPlatform = {
@@ -102,6 +99,10 @@ export const githubPlatform = {
             directory: "/",
             schedule: { interval: "weekly" },
             groups: { [`${ecosystem}-minor-and-patch`]: { "update-types": ["minor", "patch"] } },
+            // @types/node majors track the Node.js line a project runs on, which the project chooses
+            ...(ecosystem === "npm"
+                ? { ignore: [{ "dependency-name": "@types/node", "update-types": ["version-update:semver-major"] }] }
+                : {}),
         }));
         return [yamlFile("deps", ".github/dependabot.yml", { version: 2, updates })];
     },
@@ -123,7 +124,7 @@ export const githubPlatform = {
             return [];
         return [
             workflowKey("ci", path, ["name"], "ci"),
-            workflowKey("ci", path, ["on"], { pull_request: null, push: { branches: [defaultBranch(ctx)] } }),
+            workflowKey("ci", path, ["on"], { pull_request: null, push: { branches: [defaultBranch(ctx.config)] } }),
             workflowKey("ci", path, ["permissions"], { contents: "read" }),
             ...jobs,
         ];
@@ -152,10 +153,10 @@ export const githubPlatform = {
                 kind: "seed",
                 module: "release",
                 path: ".release-please-manifest.json",
-                content: json({ ".": release.version ?? "0.0.0" }),
+                content: json({ ".": release.version ?? ctx.repo.releasedVersion ?? "0.0.0" }),
             },
             workflowKey("release", path, ["name"], "release"),
-            workflowKey("release", path, ["on"], { push: { branches: [defaultBranch(ctx)] } }),
+            workflowKey("release", path, ["on"], { push: { branches: [defaultBranch(ctx.config)] } }),
             workflowKey("release", path, ["permissions"], { contents: "read" }),
             workflowKey("release", path, ["jobs", "release"], {
                 uses: workflowRef(ctx, "release-please.yml"),

package/dist/stacks/dotnet.js

@@ -1,9 +1,23 @@
+import { UsageError } from "../errors.js";
 import { checkKeys, filesMatching, readText, stringList } from "./support.js";
 const OPTION_KEYS = ["versions", "os"];
 const SOLUTIONS = /\.(sln|slnx)$/;
 const PROJECTS = /\.(csproj|fsproj|vbproj)$/;
 const VERSION_XPATH = "//Project/PropertyGroup/Version";
 const versionOf = (xml) => (xml ? (/<Version>\s*([^<\s]+)\s*<\/Version>/.exec(xml)?.[1] ?? null) : null);
+/** Project files the root solutions list, plus projects at the root, as posix paths. */
+async function projectPaths(root, solutions, projects) {
+    const paths = new Set(projects);
+    for (const solution of solutions) {
+        const text = (await readText(root, solution)) ?? "";
+        const pattern = solution.endsWith(".slnx") ? /Path="([^"]+\.[cfv][sb]proj)"/g : /"([^"]+\.[cfv][sb]proj)"/g;
+        for (const match of text.matchAll(pattern))
+            paths.add(match[1].replace(/\\/g, "/"));
+    }
+    return [...paths];
+}
+/** SDK-style projects name an SDK; .NET Framework projects don't, and the dotnet CLI can't build them. */
+const isSdkStyle = (xml) => /<Project[^>]*\sSdk=/.test(xml) || /<Sdk\s+Name=/.test(xml);
 export const dotnetStack = {
     id: "dotnet",
     detect: (root) => filesMatching(root, ".", SOLUTIONS).length + filesMatching(root, ".", PROJECTS).length > 0,
@@ -13,6 +27,15 @@ export const dotnetStack = {
         const projects = filesMatching(root, ".", PROJECTS);
         // with several entries at the root, dotnet stops with MSB1011 unless one is named
         const target = solutions.length + projects.length > 1 ? ` ${solutions[0] ?? projects[0]}` : "";
+        const legacy = [];
+        for (const path of await projectPaths(root, solutions, projects)) {
+            const xml = await readText(root, path);
+            if (xml !== null && /<Project[\s>]/.test(xml) && !isSdkStyle(xml))
+                legacy.push(path);
+        }
+        if (legacy.length > 0) {
+            throw new UsageError(`the dotnet stack needs SDK-style projects, and ${legacy.join(", ")} ${legacy.length > 1 ? "are" : "is"} .NET Framework projects the dotnet CLI can't build; convert them (for example with the .NET Upgrade Assistant) or leave dotnet out of stacks`);
+        }
         let release = { type: "simple", version: null };
         for (const file of ["Directory.Build.props", ...(projects.length === 1 ? projects : [])]) {
             const version = versionOf(await readText(root, file));

package/dist/stacks/python.js

@@ -4,8 +4,11 @@ import { checkKeys, filesMatching, optionalString, readText, stringList } from "
 const OPTION_KEYS = ["versions", "os", "test"];
 /** The `version = "…"` of the `[project]` table, if any. */
 function projectVersion(pyproject) {
-    const table = pyproject.split(/^\[/m).find((section) => section.startsWith("project]"));
-    return table ? (/^version\s*=\s*"([^"]+)"/m.exec(table)?.[1] ?? null) : null;
+    return /^version\s*=\s*"([^"]+)"/m.exec(section(pyproject, "project"))?.[1] ?? null;
+}
+/** The body of the `[name]` table of a TOML file, or "". */
+function section(toml, name) {
+    return toml.split(/^\[/m).find((part) => part.startsWith(`${name}]`)) ?? "";
 }
 export const pythonStack = {
     id: "python",
@@ -15,7 +18,10 @@ export const pythonStack = {
         const has = (path) => existsSync(join(root, path));
         const pyproject = (await readText(root, "pyproject.toml")) ?? "";
         const uv = has("uv.lock");
+        const mypyIni = (await readText(root, "mypy.ini")) ?? "";
         const mypy = has("mypy.ini") || pyproject.includes("[tool.mypy]");
+        // a config that names its files decides what mypy checks; otherwise check the whole tree
+        const mypyFiles = /^files\s*=/m.test(mypyIni) || /^files\s*=/m.test(section(pyproject, "tool.mypy"));
         const hasTests = has("tests") || has("test") || filesMatching(root, ".", /^test_.*\.py$/).length > 0;
         const customTest = optionalString("python", options, "test");
         const pytest = customTest === undefined && hasTests;
@@ -37,7 +43,7 @@ export const pythonStack = {
         const commands = [
             `${run}ruff format --check .`,
             `${run}ruff check .`,
-            ...(mypy ? [`${run}mypy .`] : []),
+            ...(mypy ? [`${run}mypy${mypyFiles ? "" : " ."}`] : []),
             ...(test ? [test] : []),
         ];
         const ruff = uv ? "uvx ruff" : "ruff";

package/dist/sync/attributes.js

@@ -0,0 +1,44 @@
+import { endMarker, startMarker } from "./block.js";
+import { normalizeEol } from "./hash.js";
+/** `eol=lf` → ["eol", "lf"], `-text` → ["text", "unset"], `text` → ["text", "set"]. */
+function attributes(fields) {
+    const map = new Map();
+    for (const field of fields) {
+        if (field.startsWith("-") || field.startsWith("!"))
+            map.set(field.slice(1), "unset");
+        else if (field.includes("="))
+            map.set(field.slice(0, field.indexOf("=")), field.slice(field.indexOf("=") + 1));
+        else
+            map.set(field, "set");
+    }
+    return map;
+}
+const parse = (line) => {
+    const [pattern, ...fields] = line.trim().split(/\s+/);
+    return { raw: line.trim(), pattern: pattern, attrs: attributes(fields) };
+};
+const isRule = (line) => line.trim() !== "" && !line.trim().startsWith("#");
+/**
+ * Lines above repokeeper's block that set an attribute the block sets differently for the same
+ * pattern. gitattributes applies the last match, so those lines have no effect.
+ */
+export function overriddenAttributes(text, blockId) {
+    const lines = normalizeEol(text).split("\n");
+    const start = lines.indexOf(startMarker(blockId, "hash"));
+    const end = lines.indexOf(endMarker(blockId, "hash"), start + 1);
+    if (start < 0 || end < 0)
+        return [];
+    const block = lines
+        .slice(start + 1, end)
+        .filter(isRule)
+        .map(parse);
+    const found = [];
+    for (const line of lines.slice(0, start).filter(isRule)) {
+        const mine = parse(line);
+        const theirs = block.find((rule) => rule.pattern === mine.pattern &&
+            [...mine.attrs].some(([key, value]) => rule.attrs.has(key) && rule.attrs.get(key) !== value));
+        if (theirs)
+            found.push({ line: mine.raw, by: theirs.raw });
+    }
+    return found;
+}

package/dist/sync/decide.js

@@ -13,9 +13,9 @@ export function decide(output, currentText, entry, adopt) {
 }
 /** For a lock entry the standard no longer produces. */
 export function decideRemoval(entry, currentText) {
-    if (entry.target.kind === "seed")
-        return "gone"; // other tools own a seed once it exists
     if (currentText === null)
         return "gone";
+    if (entry.target.kind === "seed")
+        return "left"; // other tools own a seed once it exists
     return hashText(currentText) === entry.hash ? "delete" : "orphan-edited";
 }

package/dist/sync/sync.js

@@ -1,4 +1,5 @@
 import { outputId } from "../model.js";
+import { isOwned } from "../owned.js";
 import { decide, decideRemoval } from "./decide.js";
 import { targetOf } from "./lock.js";
 import { readCurrent } from "./state.js";
@@ -15,8 +16,12 @@ export async function computeSync(root, outputs, lock, options) {
     const wanted = new Set(outputs.map(outputId));
     const removals = [];
     for (const entry of entries.values()) {
-        if (!wanted.has(entry.id))
-            removals.push({ entry, action: decideRemoval(entry, await readCurrent(root, entry.target)) });
+        if (wanted.has(entry.id))
+            continue;
+        const action = isOwned(options.owned ?? [], entry.target)
+            ? "release"
+            : decideRemoval(entry, await readCurrent(root, entry.target));
+        removals.push({ entry, action });
     }
     return { decisions, removals };
 }

package/dist/sync/yaml.js

@@ -1,3 +1,4 @@
+import { isDeepStrictEqual } from "node:util";
 import { Document, isMap, isScalar, parseDocument } from "yaml";
 import { UsageError } from "../errors.js";
 import { getAtPath } from "./json.js";
@@ -8,18 +9,127 @@ function parse(text, file) {
         throw new UsageError(`${file} is not valid YAML: ${error.message.split("\n")[0]}`);
     return doc;
 }
-function render(doc, original) {
-    const text = doc.toString({ lineWidth: 0, nullStr: "", flowCollectionPadding: false });
-    return original?.includes("\r\n") ? text.replace(/\r?\n/g, "\r\n") : text;
-}
+const renderLf = (doc) => doc.toString({ lineWidth: 0, nullStr: "", flowCollectionPadding: false });
+const withEol = (text, original) => original?.includes("\r\n") ? text.replace(/\r?\n/g, "\r\n") : text;
 /** JSON text of the value at `keyPath`, or null when the key is absent. */
 export function readYamlKey(text, keyPath, file) {
     const value = getAtPath(parse(text, file).toJS() ?? {}, keyPath);
     return value === undefined ? null : JSON.stringify(value);
 }
+const keyName = (key) => String(isScalar(key) ? key.value : key);
+const pairIn = (map, key) => map.items.find((p) => keyName(p.key) === key);
+/** The block map at `keyPath` (the root for []); null when absent or written in flow style. */
+function blockMap(doc, keyPath) {
+    const node = keyPath.length === 0 ? doc.contents : doc.getIn(keyPath, true);
+    return isMap(node) && !node.flow ? node : null;
+}
+const lineStart = (text, offset) => text.lastIndexOf("\n", offset - 1) + 1;
+function lineEnd(text, offset) {
+    const index = text.indexOf("\n", offset);
+    return index === -1 ? text.length : index + 1;
+}
+const rangeOf = (node) => node?.range;
+/** [start, end) of the whole lines a block-map pair occupies, and the column of its key. */
+function pairSpan(text, pair) {
+    const key = rangeOf(pair.key);
+    if (!key)
+        return null;
+    const last = Math.max((rangeOf(pair.value)?.[1] ?? key[1]) - 1, key[1]);
+    const start = lineStart(text, key[0]);
+    return { start, end: lineEnd(text, last), column: key[0] - start };
+}
+function reindent(lines, from, to) {
+    if (from === to)
+        return lines;
+    return lines
+        .split("\n")
+        .map((line) => {
+        if (line.trim() === "")
+            return line;
+        const strip = Math.min(from, line.length - line.trimStart().length);
+        return " ".repeat(to) + line.slice(strip);
+    })
+        .join("\n");
+}
+/** The lines of the pair at `keyPath` in the rendered `doc`, indented to `column`. */
+function renderedPair(doc, keyPath, column) {
+    const text = renderLf(doc);
+    const parent = blockMap(parseDocument(text), keyPath.slice(0, -1));
+    const pair = parent && pairIn(parent, keyPath[keyPath.length - 1]);
+    const span = pair && pairSpan(text, pair);
+    if (!span)
+        return null;
+    const lines = text.slice(span.start, span.end);
+    return reindent(lines.endsWith("\n") ? lines : `${lines}\n`, span.column, column);
+}
+/**
+ * Writes the key into `text` by editing only its own lines, so the rest of the file keeps its
+ * formatting. Null when the file's shape doesn't allow it (flow collections, an empty map).
+ */
+function spliceSet(text, keyPath, next, order) {
+    const doc = parseDocument(text);
+    let parent = blockMap(doc, []);
+    let depth = 0;
+    for (; parent && depth < keyPath.length; depth++) {
+        const pair = pairIn(parent, keyPath[depth]);
+        if (!pair)
+            break;
+        if (depth === keyPath.length - 1) {
+            const span = pairSpan(text, pair);
+            const lines = span && renderedPair(next, keyPath, span.column);
+            return span && lines ? text.slice(0, span.start) + lines + text.slice(span.end) : null;
+        }
+        parent = isMap(pair.value) && !pair.value.flow ? pair.value : null;
+    }
+    const first = parent?.items[0];
+    const firstSpan = first && pairSpan(text, first);
+    if (!parent || !firstSpan)
+        return null;
+    const unit = keyPath.slice(0, depth + 1);
+    const lines = renderedPair(next, unit, firstSpan.column);
+    if (!lines)
+        return null;
+    let at = null;
+    if (depth === 0 && order) {
+        const rank = (key) => (order.includes(key) ? order.indexOf(key) : order.length);
+        const after = parent.items.find((p) => rank(keyName(p.key)) > rank(unit[0]));
+        if (after)
+            at = pairSpan(text, after)?.start ?? null;
+    }
+    if (at === null) {
+        const lastSpan = pairSpan(text, parent.items[parent.items.length - 1]);
+        if (!lastSpan)
+            return null;
+        at = lastSpan.end;
+    }
+    const before = text.slice(0, at);
+    return (before === "" || before.endsWith("\n") ? before : `${before}\n`) + lines + text.slice(at);
+}
+/** Removes the pair at `keyPath` plus the parents it leaves empty by cutting their lines. */
+function spliceDelete(text, keyPath) {
+    const doc = parseDocument(text);
+    let cut = keyPath.length;
+    while (cut > 1 && blockMap(doc, keyPath.slice(0, cut - 1))?.items.length === 1)
+        cut--;
+    const parent = blockMap(doc, keyPath.slice(0, cut - 1));
+    const pair = parent && pairIn(parent, keyPath[cut - 1]);
+    const span = pair && pairSpan(text, pair);
+    return span ? text.slice(0, span.start) + text.slice(span.end) : null;
+}
+/** The spliced text when it parses to exactly `expected`, otherwise a full re-render. */
+function preferSplice(original, spliced, expected) {
+    if (spliced !== null) {
+        const check = parseDocument(spliced);
+        if (check.errors.length === 0 && isDeepStrictEqual(check.toJS(), expected.toJS())) {
+            return withEol(spliced, original);
+        }
+    }
+    return withEol(renderLf(expected), original);
+}
 export function setYamlKey(text, file, keyPath, value, options) {
     const fresh = text === null || text.trim() === "";
-    const doc = text !== null && !fresh ? parse(text, file) : new Document({});
+    const lf = fresh ? "" : text.replace(/\r\n/g, "\n");
+    const doc = fresh ? new Document({}) : parse(lf, file);
     if (fresh)
         doc.commentBefore = ` ${options.header}`;
     doc.setIn(keyPath, doc.createNode(value));
@@ -31,11 +141,14 @@ export function setYamlKey(text, file, keyPath, value, options) {
         };
         doc.contents.items.sort((a, b) => rank(a.key) - rank(b.key));
     }
-    return render(doc, text);
+    if (fresh)
+        return withEol(renderLf(doc), text);
+    return preferSplice(text, spliceSet(lf, keyPath, doc, order), doc);
 }
 /** Removes the key and any parents it leaves empty; null when nothing is left. */
 export function deleteYamlKey(text, file, keyPath) {
-    const doc = parse(text, file);
+    const lf = text.replace(/\r\n/g, "\n");
+    const doc = parse(lf, file);
     doc.deleteIn(keyPath);
     for (let depth = keyPath.length - 1; depth > 0; depth--) {
         const parent = doc.getIn(keyPath.slice(0, depth));
@@ -45,5 +158,5 @@ export function deleteYamlKey(text, file, keyPath) {
     }
     if (!isMap(doc.contents) || doc.contents.items.length === 0)
         return null;
-    return render(doc, text);
+    return preferSplice(text, spliceDelete(lf, keyPath), doc);
 }

package/dist/version.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 export const PACKAGE_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 /** The standard this build of repokeeper applies. Bump it whenever generated output changes. */
-export const STANDARD_VERSION = "1.2.0";
+export const STANDARD_VERSION = "1.2.2";
 export const TOOL_VERSIONS = {
     lefthook: "2.1.14",
     commitlintCli: "21.2.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repokeeper",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Keep every repository on one maintained standard: commits, git hooks, CI, releases, dependency updates and repo settings.",
   "type": "module",
   "bin": {