repokeeper 0.2.3 → 0.4.0

package/README.md

@@ -5,8 +5,9 @@ files, editor and gitignore settings, Dependabot, CI and releases — applied on
 the standard evolves.
 
 > Status: early development. Supported stacks: Node.js (including NestJS), Python, Dart and
-> Flutter, shell and PowerShell scripts, Java (Maven and Gradle) and .NET, each with CI and releases.
-> GitHub settings are on the way. See the [design](docs/superpowers/specs/2026-09-25-repokeeper-design.md).
+> Flutter, shell and PowerShell scripts, Java (Maven and Gradle), Kotlin, .NET, Go, Rust, PHP and
+> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. See the
+> [design](docs/superpowers/specs/2026-09-25-repokeeper-design.md).
 
 ## Usage
 
@@ -51,15 +52,19 @@ Requires Node.js 22.12 or newer.
 
 `ci.yml` and `release.yml` call reusable workflows from this repository (`stack-node.yml`,
 `commitlint.yml`, `release-please.yml`) at the moving major tag, so fixes reach every repository
-without a pull request. repokeeper owns the `name`, `on` and `permissions` keys and the jobs it
-adds; jobs you add yourself are left alone, and so is the formatting of the rest of the file.
+without a pull request. repokeeper owns the `name`, `on`, `permissions` and `concurrency` keys and
+the jobs it adds; jobs you add yourself are left alone, and so is the formatting of the rest of the
+file. A new push to a pull request cancels that pull request's earlier `ci` run; runs on the default
+branch always finish.
 
 The script stack runs ShellCheck and `shfmt -d` on `*.sh` (format with `shfmt -w` before pushing)
 and PSScriptAnalyzer on `*.ps1`, which fails on errors and warnings (not on information-level rules). To
-choose the rules yourself, add a `PSScriptAnalyzerSettings.psd1` at the repository root; the job then uses it:
+choose the rules yourself, add a `PSScriptAnalyzerSettings.psd1` at the repository root; the job then
+uses it instead of its own filter, so keep `Severity` in it unless you want information-level rules too:
 
 ```powershell
 @{
+    Severity     = @('Error', 'Warning')
     # installers print for the person running them
     ExcludeRules = @('PSAvoidUsingWriteHost')
 }
@@ -75,6 +80,33 @@ work:
   and issues write access). Without it the release pull request is opened with `GITHUB_TOKEN`, and
   GitHub does not run CI on pull requests opened that way.
 
+Set `modules.drift: true` to add a `repokeeper` job to `ci.yml` that runs `repokeeper check` with
+the version that wrote the standard, so a pull request that edits a managed file fails until the edit
+is resolved.
+
+## GitHub settings
+
+`repokeeper github apply` brings the repository's settings in line with the `github:` section of
+`.repokeeper.yml`. Only the keys you write are managed; anything left out stays as it is.
+
+```yaml
+github:
+  description: Keeps repositories on one standard
+  topics: [cli, conventional-commits]
+  merge: { squash: true, merge_commit: false, rebase: false, delete_branch_on_merge: true }
+  security: { dependabot_alerts: true, dependabot_security_updates: true }
+  protect:                  # a ruleset named "repokeeper" on the default branch; false removes it
+    require_pull_request: true
+    required_approvals: 0
+    required_checks: ["commits / commitlint"]   # check names exactly as pull requests show them
+    allow_force_push: false
+```
+
+It prints every change first and applies them with `--yes`, or after you confirm in a terminal;
+`--dry-run` only prints. The token comes from `GITHUB_TOKEN` or `gh auth token` and needs admin
+access to the repository. Legacy branch protection, visibility, secrets and collaborators are never
+touched.
+
 ## License
 
 MIT

package/dist/cli.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 import { realpathSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { checkCommand } from "./commands/check.js";
+import { githubApplyCommand } from "./commands/github.js";
 import { initCommand } from "./commands/init.js";
 import { updateCommand } from "./commands/update.js";
 import { STACK_IDS } from "./config/types.js";
@@ -15,6 +17,7 @@ export const USAGE = [
     "  init    detect stacks, write .repokeeper.yml and apply the standard",
     "  check   report drift from the standard without writing (exit 1 on drift)",
     "  update  move to the standard of this repokeeper version and resync",
+    "  github apply  diff the GitHub settings against .repokeeper.yml and apply them",
     "",
     "options:",
     "  --dry-run        show what would change without writing",
@@ -24,6 +27,7 @@ export const USAGE = [
     "  --stack <id>     stack to use instead of detection (init, repeatable)",
     "  --relock         rebuild .repokeeper/lock.json from the current files (init)",
     "  --json           machine-readable output (check)",
+    "  -y, --yes        apply without asking (github apply)",
     "  -v, --version    print the version",
 ].join("\n");
 const toPosix = (path) => path.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -42,6 +46,7 @@ export async function run(argv, io) {
                 stack: { type: "string", multiple: true, default: [] },
                 relock: { type: "boolean", default: false },
                 json: { type: "boolean", default: false },
+                yes: { type: "boolean", short: "y", default: false },
                 version: { type: "boolean", short: "v", default: false },
                 help: { type: "boolean", short: "h", default: false },
             },
@@ -70,6 +75,7 @@ export async function run(argv, io) {
             stacks: stacks,
             relock: values.relock,
             json: values.json,
+            yes: values.yes,
         };
         if (command === "init")
             return await initCommand(io.cwd, options, io);
@@ -77,6 +83,11 @@ export async function run(argv, io) {
             return await checkCommand(io.cwd, options, io);
         if (command === "update")
             return await updateCommand(io.cwd, options, io);
+        if (command === "github") {
+            if (positionals[1] !== "apply")
+                throw new UsageError("usage: repokeeper github apply [--dry-run] [--yes]");
+            return await githubApplyCommand(io.cwd, options, io);
+        }
         throw new UsageError(`unknown command: ${command}`);
     }
     catch (error) {
@@ -94,12 +105,22 @@ export async function run(argv, io) {
         throw error;
     }
 }
+async function askYesNo(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return /^y(es)?$/i.test((await rl.question(`${question} [y/N] `)).trim());
+    }
+    finally {
+        rl.close();
+    }
+}
 const invokedPath = process.argv[1];
 if (invokedPath !== undefined && realpathSync(invokedPath) === fileURLToPath(import.meta.url)) {
     run(process.argv.slice(2), {
         cwd: process.cwd(),
         out: (line) => process.stdout.write(`${line}\n`),
         err: (line) => process.stderr.write(`${line}\n`),
+        ...(process.stdin.isTTY ? { confirm: askYesNo } : {}),
     }).then((code) => {
         process.exitCode = code;
     });

package/dist/commands/github.js

@@ -0,0 +1,36 @@
+import { loadConfig } from "../config/load.js";
+import { UsageError } from "../errors.js";
+import { repoInfo } from "../git.js";
+import { resolveToken, restApi } from "../github/api.js";
+import { planGithub } from "../github/settings.js";
+/** `repokeeper github apply`: diff the repository's GitHub settings against `github:` and apply on confirmation. */
+export async function githubApplyCommand(root, options, io) {
+    const config = await loadConfig(root);
+    const repo = await repoInfo(root);
+    if (!repo.owner)
+        throw new UsageError("the origin remote is not a GitHub repository");
+    const slug = `${repo.owner}/${repo.name}`;
+    const api = io.githubApi ?? restApi(await resolveToken());
+    const changes = await planGithub(api, repo.owner, repo.name, config.github ?? {});
+    if (changes.length === 0) {
+        io.out(`GitHub settings of ${slug} match .repokeeper.yml`);
+        return 0;
+    }
+    for (const change of changes)
+        io.out(`change     ${change.setting}: ${change.from} -> ${change.to}`);
+    if (options.dryRun) {
+        io.out("dry run: nothing applied");
+        return 0;
+    }
+    const question = `apply ${changes.length} change(s) to ${slug}?`;
+    const confirmed = options.yes || (io.confirm ? await io.confirm(question) : false);
+    if (!confirmed) {
+        io.out("nothing applied; pass --yes to apply");
+        return 1;
+    }
+    for (const change of changes) {
+        await change.apply(api);
+        io.out(`applied    ${change.setting}`);
+    }
+    return 0;
+}

package/dist/config/load.js

@@ -59,6 +59,7 @@ function withDefaults(data) {
             release: modules.release ?? true,
             deps: modules.deps ?? true,
             gitignore: modules.gitignore ?? true,
+            drift: modules.drift ?? false,
             health: modules.health,
         },
         owned: data.owned ?? [],

package/dist/config/schema.js

@@ -20,6 +20,7 @@ export const configSchema = {
                 release: flag,
                 deps: flag,
                 gitignore: flag,
+                drift: flag,
                 health: {
                     anyOf: [
                         { const: false },
@@ -40,6 +41,39 @@ export const configSchema = {
         },
         owned: { type: "array", items: { type: "string", minLength: 1 } },
         stack_options: { type: "object" },
-        github: { type: "object" },
+        github: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                default_branch: { type: "string", minLength: 1 },
+                description: { type: "string" },
+                topics: { type: "array", uniqueItems: true, items: { type: "string", pattern: "^[a-z0-9][a-z0-9-]{0,49}$" } },
+                merge: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: { squash: flag, merge_commit: flag, rebase: flag, delete_branch_on_merge: flag },
+                },
+                security: {
+                    type: "object",
+                    additionalProperties: false,
+                    properties: { dependabot_alerts: flag, dependabot_security_updates: flag },
+                },
+                protect: {
+                    anyOf: [
+                        { const: false },
+                        {
+                            type: "object",
+                            additionalProperties: false,
+                            properties: {
+                                require_pull_request: flag,
+                                required_approvals: { type: "integer", minimum: 0, maximum: 10 },
+                                required_checks: { type: "array", uniqueItems: true, items: { type: "string", minLength: 1 } },
+                                allow_force_push: flag,
+                            },
+                        },
+                    ],
+                },
+            },
+        },
     },
 };

package/dist/config/types.js

@@ -1,4 +1,16 @@
-export const STACK_IDS = ["node", "python", "dart", "script", "java", "dotnet"];
+export const STACK_IDS = [
+    "node",
+    "python",
+    "dart",
+    "script",
+    "java",
+    "dotnet",
+    "go",
+    "rust",
+    "kotlin",
+    "php",
+    "ruby",
+];
 /** The branch workflows run on and contributors branch from: `github.default_branch`, or `main`. */
 export function defaultBranch(config) {
     const branch = config.github?.default_branch;
@@ -18,6 +30,7 @@ export function defaultConfig(input) {
             release: true,
             deps: true,
             gitignore: true,
+            drift: false,
             health: { license: "MIT", copyright: input.copyright, contact: input.contact, codeowners: input.codeowners },
         },
         owned: [],

package/dist/errors.js

@@ -18,6 +18,12 @@ export class UsageError extends RepokeeperError {
         super(message, 2);
     }
 }
+/** A GitHub API call failed; nothing on disk was touched. */
+export class ApiError extends RepokeeperError {
+    constructor(message) {
+        super(message, 3);
+    }
+}
 /** `.repokeeper/lock.json` is unreadable; the repository state is unknown, which counts as drift. */
 export class LockError extends RepokeeperError {
     constructor(message) {

package/dist/github/api.js

@@ -0,0 +1,49 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { ApiError } from "../errors.js";
+const execFileAsync = promisify(execFile);
+/** `GITHUB_TOKEN`, or the token of the GitHub CLI. */
+export async function resolveToken(env = process.env) {
+    if (env.GITHUB_TOKEN)
+        return env.GITHUB_TOKEN;
+    try {
+        const { stdout } = await execFileAsync("gh", ["auth", "token"], { encoding: "utf8" });
+        if (stdout.trim())
+            return stdout.trim();
+    }
+    catch {
+        // fall through to the error below
+    }
+    throw new ApiError("no GitHub token: set GITHUB_TOKEN or sign in with `gh auth login`");
+}
+export function restApi(token, base = "https://api.github.com") {
+    return {
+        async request(method, path, body) {
+            let response;
+            try {
+                response = await fetch(`${base}${path}`, {
+                    method,
+                    headers: {
+                        accept: "application/vnd.github+json",
+                        authorization: `Bearer ${token}`,
+                        "x-github-api-version": "2022-11-28",
+                        ...(body === undefined ? {} : { "content-type": "application/json" }),
+                    },
+                    body: body === undefined ? undefined : JSON.stringify(body),
+                });
+            }
+            catch (error) {
+                throw new ApiError(`GitHub API ${method} ${path} failed: ${error.message}`);
+            }
+            const text = await response.text();
+            let data = null;
+            try {
+                data = text ? JSON.parse(text) : null;
+            }
+            catch {
+                data = text;
+            }
+            return { status: response.status, data };
+        },
+    };
+}

package/dist/github/settings.js

@@ -0,0 +1,184 @@
+import { ApiError } from "../errors.js";
+export const RULESET_NAME = "repokeeper";
+function expect2xx(response, what, repo) {
+    if (response.status < 400)
+        return response;
+    const message = response.data?.message ?? `HTTP ${response.status}`;
+    const access = response.status === 403 || response.status === 404
+        ? `; this needs admin access to ${repo} (a token with the repo scope, or Administration: write)`
+        : "";
+    throw new ApiError(`${what} failed: ${message}${access}`);
+}
+const show = (value) => value === undefined || value === null || value === ""
+    ? "(none)"
+    : Array.isArray(value)
+        ? value.join(", ") || "(none)"
+        : String(value);
+const MERGE_FIELDS = {
+    squash: "allow_squash_merge",
+    merge_commit: "allow_merge_commit",
+    rebase: "allow_rebase_merge",
+    delete_branch_on_merge: "delete_branch_on_merge",
+};
+function summarize(rules) {
+    const pr = rules.find((r) => r.type === "pull_request");
+    const checks = rules.find((r) => r.type === "required_status_checks");
+    return {
+        pullRequest: pr !== undefined,
+        approvals: pr?.parameters?.required_approving_review_count ?? 0,
+        checks: (checks?.parameters?.required_status_checks ?? []).map((c) => c.context).sort(),
+        forcePush: !rules.some((r) => r.type === "non_fast_forward"),
+    };
+}
+function describeRules(summary) {
+    if (summary === null)
+        return "(none)";
+    const parts = [
+        summary.pullRequest ? `pull request required (${summary.approvals} approvals)` : "no pull request required",
+        summary.checks.length > 0 ? `checks: ${summary.checks.join(", ")}` : "no required checks",
+        summary.forcePush ? "force push allowed" : "no force push",
+    ];
+    return parts.join("; ");
+}
+function desiredRules(protect) {
+    const rules = [];
+    if (protect.require_pull_request ?? true) {
+        rules.push({
+            type: "pull_request",
+            parameters: {
+                required_approving_review_count: protect.required_approvals ?? 0,
+                dismiss_stale_reviews_on_push: false,
+                require_code_owner_review: false,
+                require_last_push_approval: false,
+                required_review_thread_resolution: false,
+            },
+        });
+    }
+    const checks = protect.required_checks ?? [];
+    if (checks.length > 0) {
+        rules.push({
+            type: "required_status_checks",
+            parameters: {
+                strict_required_status_checks_policy: false,
+                required_status_checks: checks.map((context) => ({ context })),
+            },
+        });
+    }
+    if (!(protect.allow_force_push ?? false))
+        rules.push({ type: "non_fast_forward" });
+    return rules;
+}
+const sameSummary = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/** Reads the repository's current settings and lists what differs from `settings`. Reads only. */
+export async function planGithub(api, owner, name, settings) {
+    const repo = `${owner}/${name}`;
+    const base = `/repos/${owner}/${name}`;
+    const get = async (path, what, missingOk = false) => {
+        const response = await api.request("GET", `${base}${path}`);
+        return missingOk && response.status === 404 ? response : expect2xx(response, what, repo);
+    };
+    const send = async (method, path, what, body) => {
+        expect2xx(await api.request(method, `${base}${path}`, body), what, repo);
+    };
+    const changes = [];
+    const current = (await get("", `reading ${repo}`)).data;
+    for (const [key, field] of Object.entries(MERGE_FIELDS)) {
+        const want = settings.merge?.[key];
+        if (want === undefined || current[field] === want)
+            continue;
+        changes.push({
+            setting: `merge.${key}`,
+            from: show(current[field]),
+            to: show(want),
+            apply: () => send("PATCH", "", `setting merge.${key}`, { [field]: want }),
+        });
+    }
+    if (settings.description !== undefined && (current.description ?? "") !== settings.description) {
+        const description = settings.description;
+        changes.push({
+            setting: "description",
+            from: show(current.description),
+            to: show(description),
+            apply: () => send("PATCH", "", "setting the description", { description }),
+        });
+    }
+    if (settings.topics !== undefined) {
+        const have = ((await get("/topics", "reading topics")).data.names ?? []).slice().sort();
+        const want = [...settings.topics].sort();
+        if (JSON.stringify(have) !== JSON.stringify(want)) {
+            changes.push({
+                setting: "topics",
+                from: show(have),
+                to: show(want),
+                apply: () => send("PUT", "/topics", "setting topics", { names: want }),
+            });
+        }
+    }
+    const alerts = settings.security?.dependabot_alerts;
+    if (alerts !== undefined) {
+        const have = (await get("/vulnerability-alerts", "reading Dependabot alerts", true)).status === 204;
+        if (have !== alerts) {
+            changes.push({
+                setting: "security.dependabot_alerts",
+                from: show(have),
+                to: show(alerts),
+                apply: () => send(alerts ? "PUT" : "DELETE", "/vulnerability-alerts", "setting Dependabot alerts"),
+            });
+        }
+    }
+    const fixes = settings.security?.dependabot_security_updates;
+    if (fixes !== undefined) {
+        const response = await get("/automated-security-fixes", "reading Dependabot security updates", true);
+        const have = response.status !== 404 && response.data?.enabled === true;
+        if (have !== fixes) {
+            changes.push({
+                setting: "security.dependabot_security_updates",
+                from: show(have),
+                to: show(fixes),
+                apply: () => send(fixes ? "PUT" : "DELETE", "/automated-security-fixes", "setting Dependabot security updates"),
+            });
+        }
+    }
+    if (settings.protect !== undefined) {
+        const list = (await get("/rulesets?includes_parents=false", "reading rulesets")).data;
+        const existing = list.find((r) => r.name === RULESET_NAME);
+        const detail = existing
+            ? (await get(`/rulesets/${existing.id}`, "reading the repokeeper ruleset")).data
+            : null;
+        const have = detail ? summarize(detail.rules ?? []) : null;
+        if (settings.protect === false) {
+            if (existing) {
+                changes.push({
+                    setting: "protect",
+                    from: describeRules(have),
+                    to: "(none)",
+                    apply: () => send("DELETE", `/rulesets/${existing.id}`, "removing the repokeeper ruleset"),
+                });
+            }
+        }
+        else {
+            const rules = desiredRules(settings.protect);
+            const want = summarize(rules);
+            const targetsDefault = detail?.conditions?.ref_name?.include?.includes("~DEFAULT_BRANCH") ?? false;
+            const upToDate = have !== null && sameSummary(have, want) && detail?.enforcement === "active" && targetsDefault;
+            if (!upToDate) {
+                const body = {
+                    name: RULESET_NAME,
+                    target: "branch",
+                    enforcement: "active",
+                    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+                    rules,
+                };
+                changes.push({
+                    setting: "protect",
+                    from: describeRules(have),
+                    to: describeRules(want),
+                    apply: () => existing
+                        ? send("PUT", `/rulesets/${existing.id}`, "updating the repokeeper ruleset", body)
+                        : send("POST", "/rulesets", "creating the repokeeper ruleset", body),
+                });
+            }
+        }
+    }
+    return changes;
+}

package/dist/platforms/github.js

@@ -1,7 +1,7 @@
 import { stringify } from "yaml";
 import { defaultBranch } from "../config/types.js";
 import { MANAGED_HEADER } from "../model.js";
-import { REUSABLE_REPO, WORKFLOW_REF } from "../version.js";
+import { PACKAGE_VERSION, REUSABLE_REPO, WORKFLOW_REF } from "../version.js";
 const yamlFile = (module, path, data) => ({
     kind: "file",
     module,
@@ -120,12 +120,25 @@ export const githubPlatform = {
         if (ctx.config.modules.commits) {
             jobs.push(workflowKey("ci", path, ["jobs", "commits"], { uses: workflowRef(ctx, "commitlint.yml") }));
         }
+        if (ctx.config.modules.drift) {
+            jobs.push(workflowKey("ci", path, ["jobs", "repokeeper"], {
+                uses: workflowRef(ctx, "repokeeper-check.yml"),
+                with: { version: PACKAGE_VERSION },
+            }));
+        }
         if (jobs.length === 0)
             return [];
         return [
             workflowKey("ci", path, ["name"], "ci"),
             workflowKey("ci", path, ["on"], { pull_request: null, push: { branches: [defaultBranch(ctx.config)] } }),
             workflowKey("ci", path, ["permissions"], { contents: "read" }),
+            // a new push to a pull request makes its earlier run pointless; runs on the default branch always finish
+            workflowKey("ci", path, ["concurrency"], {
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions
+                group: "${{ github.workflow }}-${{ github.ref }}",
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions
+                "cancel-in-progress": "${{ github.event_name == 'pull_request' }}",
+            }),
             ...jobs,
         ];
     },
@@ -145,6 +158,7 @@ export const githubPlatform = {
                             "bump-minor-pre-major": true,
                             "include-component-in-tag": false,
                             ...(release.extraFiles && release.extraFiles.length > 0 ? { "extra-files": release.extraFiles } : {}),
+                            ...(release.versionFile ? { "version-file": release.versionFile } : {}),
                         },
                     },
                 }),

package/dist/stacks/go.js

@@ -0,0 +1,30 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { checkKeys, stringList } from "./support.js";
+const OPTION_KEYS = ["versions", "os"];
+const GOFMT = 'test -z "$(gofmt -l .)" || { gofmt -l .; exit 1; }';
+export const goStack = {
+    id: "go",
+    detect: (root) => existsSync(join(root, "go.mod")),
+    async resolve(_root, options = {}) {
+        checkKeys("go", options, OPTION_KEYS);
+        return {
+            id: "go",
+            staged: [{ name: "go:gofmt", glob: "*.go", run: "gofmt -w {staged_files}" }],
+            test: "go test ./...",
+            install: "go mod download",
+            gitignore: ["Go"],
+            dependabot: ["gomod"],
+            ci: {
+                workflow: "stack-go.yml",
+                with: {
+                    "go-versions": JSON.stringify(stringList("go", options, "versions") ?? ["stable"]),
+                    os: JSON.stringify(stringList("go", options, "os") ?? ["ubuntu-latest"]),
+                    commands: JSON.stringify([GOFMT, "go vet ./...", "go test ./..."]),
+                },
+            },
+            // Go modules are versioned by their tags; the manifest starts from the latest one
+            release: { type: "go", version: null },
+        };
+    },
+};

package/dist/stacks/gradle.js

@@ -0,0 +1,16 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { readText } from "./support.js";
+export const GRADLE_FILES = ["build.gradle", "build.gradle.kts"];
+/** The build command (wrapper when present) and release info of a Gradle project. */
+export async function gradleBuild(root) {
+    const wrapper = existsSync(join(root, "gradlew"));
+    const properties = await readText(root, "gradle.properties");
+    const version = properties ? (/^version\s*=\s*(\S+)/m.exec(properties)?.[1] ?? null) : null;
+    return {
+        command: wrapper ? "./gradlew check" : "gradle check",
+        wrapper,
+        // release-please's generic updater changes gradle.properties once it carries x-release-please markers
+        release: { type: "simple", version, ...(properties !== null ? { extraFiles: ["gradle.properties"] } : {}) },
+    };
+}

package/dist/stacks/index.js

@@ -1,9 +1,14 @@
 import { STACK_IDS } from "../config/types.js";
 import { dartStack } from "./dart.js";
 import { dotnetStack } from "./dotnet.js";
+import { goStack } from "./go.js";
 import { javaStack } from "./java.js";
+import { kotlinStack } from "./kotlin.js";
 import { nodeStack } from "./node.js";
+import { phpStack } from "./php.js";
 import { pythonStack } from "./python.js";
+import { rubyStack } from "./ruby.js";
+import { rustStack } from "./rust.js";
 import { scriptStack } from "./script.js";
 const PACKS = {
     node: nodeStack,
@@ -12,12 +17,20 @@ const PACKS = {
     script: scriptStack,
     java: javaStack,
     dotnet: dotnetStack,
+    go: goStack,
+    rust: rustStack,
+    kotlin: kotlinStack,
+    php: phpStack,
+    ruby: rubyStack,
 };
 export function getStackPack(id) {
     return PACKS[id];
 }
 export async function detectStacks(root) {
-    const found = STACK_IDS.filter((id) => PACKS[id].detect(root));
+    let found = STACK_IDS.filter((id) => PACKS[id].detect(root));
+    // a Kotlin build is also a Gradle build; one CI job runs it
+    if (found.includes("kotlin"))
+        found = found.filter((id) => id !== "java");
     // scripts beside another stack belong to that stack; the script pack is for script-only repositories
     return found.length > 1 ? found.filter((id) => id !== "script") : found;
 }

package/dist/stacks/java.js

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
+import { gradleBuild } from "./gradle.js";
 import { checkKeys, readText, stringList } from "./support.js";
 const OPTION_KEYS = ["versions", "os"];
 /** The project's own <version>: parent, dependency and plugin versions are removed first. */
@@ -22,11 +23,7 @@ export const javaStack = {
             release = { type: "maven", version: mavenVersion((await readText(root, "pom.xml")) ?? "") };
         }
         else {
-            command = has("gradlew") ? "./gradlew check" : "gradle check";
-            const properties = await readText(root, "gradle.properties");
-            const version = properties ? (/^version\s*=\s*(\S+)/m.exec(properties)?.[1] ?? null) : null;
-            // release-please's generic updater changes gradle.properties once it carries x-release-please markers
-            release = { type: "simple", version, ...(properties !== null ? { extraFiles: ["gradle.properties"] } : {}) };
+            ({ command, release } = await gradleBuild(root));
         }
         return {
             id: "java",

package/dist/stacks/kotlin.js

@@ -0,0 +1,54 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { UsageError } from "../errors.js";
+import { GRADLE_FILES, gradleBuild } from "./gradle.js";
+import { checkKeys, stringList } from "./support.js";
+const OPTION_KEYS = ["versions", "os"];
+// plugin ids, the kotlin() shorthand and version-catalog aliases; org.jetbrains.kotlinx is a library, not the plugin
+const KOTLIN = /\bkotlin\(\s*"|org\.jetbrains\.kotlin[."']|libs\.plugins\.kotlin\b/;
+const ANDROID = /com\.android\.(application|library)|libs\.plugins\.android\b/;
+/** The root Gradle build files, with `//` comments removed. */
+function buildFiles(root) {
+    return GRADLE_FILES.flatMap((file) => {
+        try {
+            return [{ file, text: readFileSync(join(root, file), "utf8").replace(/\/\/.*$/gm, "") }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+/** Whether a Gradle build at the root applies a Kotlin plugin. */
+export const usesKotlin = (root) => buildFiles(root).some(({ text }) => KOTLIN.test(text));
+export const kotlinStack = {
+    id: "kotlin",
+    detect: usesKotlin,
+    async resolve(root, options = {}) {
+        checkKeys("kotlin", options, OPTION_KEYS);
+        const android = buildFiles(root).find(({ text }) => ANDROID.test(text));
+        if (android) {
+            throw new UsageError(`${android.file} is an Android project, which needs the Android SDK the CI runners don't have; leave kotlin out of stacks`);
+        }
+        const { command, release, wrapper } = await gradleBuild(root);
+        return {
+            id: "kotlin",
+            // ktlint or Spotless run through the build, like Spotless for java
+            staged: [],
+            test: command,
+            install: null,
+            gitignore: ["Kotlin", "Gradle"],
+            dependabot: ["gradle"],
+            ci: {
+                workflow: "stack-java.yml",
+                with: {
+                    "java-versions": JSON.stringify(stringList("kotlin", options, "versions") ?? ["17", "21"]),
+                    os: JSON.stringify(stringList("kotlin", options, "os") ?? ["ubuntu-latest"]),
+                    "build-tool": "gradle",
+                    "gradle-version": wrapper ? "" : "current",
+                    commands: JSON.stringify([command]),
+                },
+            },
+            release,
+        };
+    },
+};

package/dist/stacks/php.js

@@ -0,0 +1,53 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { UsageError } from "../errors.js";
+import { checkKeys, readText, stringList } from "./support.js";
+const OPTION_KEYS = ["versions", "os"];
+export const phpStack = {
+    id: "php",
+    detect: (root) => existsSync(join(root, "composer.json")),
+    async resolve(root, options = {}) {
+        checkKeys("php", options, OPTION_KEYS);
+        const has = (path) => existsSync(join(root, path));
+        let composer;
+        try {
+            composer = JSON.parse((await readText(root, "composer.json")) ?? "{}");
+        }
+        catch (error) {
+            throw new UsageError(`composer.json could not be read: ${error.message}`);
+        }
+        const csFixer = has(".php-cs-fixer.dist.php") || has(".php-cs-fixer.php");
+        const phpstan = has("phpstan.neon") || has("phpstan.neon.dist") || has("phpstan.dist.neon");
+        const test = composer.scripts?.test
+            ? "composer test"
+            : has("phpunit.xml") || has("phpunit.xml.dist") || has("phpunit.dist.xml")
+                ? "vendor/bin/phpunit"
+                : null;
+        return {
+            id: "php",
+            staged: csFixer
+                ? [{ name: "php:cs-fixer", glob: "*.php", run: "vendor/bin/php-cs-fixer fix {staged_files}" }]
+                : [],
+            test,
+            install: "composer install",
+            gitignore: ["Composer"],
+            dependabot: ["composer"],
+            ci: {
+                workflow: "stack-php.yml",
+                with: {
+                    "php-versions": JSON.stringify(stringList("php", options, "versions") ?? ["8.3", "8.4"]),
+                    os: JSON.stringify(stringList("php", options, "os") ?? ["ubuntu-latest"]),
+                    "install-command": "composer install --no-interaction --no-progress",
+                    commands: JSON.stringify([
+                        // --strict would fail on warnings such as a missing license or the version field release-please writes
+                        "composer validate --no-check-publish",
+                        ...(csFixer ? ["vendor/bin/php-cs-fixer fix --dry-run --diff"] : []),
+                        ...(phpstan ? ["vendor/bin/phpstan analyse --no-progress"] : []),
+                        ...(test ? [test] : []),
+                    ]),
+                },
+            },
+            release: { type: "php", version: composer.version ?? null },
+        };
+    },
+};

package/dist/stacks/python.js

@@ -1,14 +1,10 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
-import { checkKeys, filesMatching, optionalString, readText, stringList } from "./support.js";
+import { checkKeys, filesMatching, optionalString, readText, stringList, tomlSection } from "./support.js";
 const OPTION_KEYS = ["versions", "os", "test"];
 /** The `version = "…"` of the `[project]` table, if any. */
 function projectVersion(pyproject) {
-    return /^version\s*=\s*"([^"]+)"/m.exec(section(pyproject, "project"))?.[1] ?? null;
-}
-/** The body of the `[name]` table of a TOML file, or "". */
-function section(toml, name) {
-    return toml.split(/^\[/m).find((part) => part.startsWith(`${name}]`)) ?? "";
+    return /^version\s*=\s*"([^"]+)"/m.exec(tomlSection(pyproject, "project"))?.[1] ?? null;
 }
 export const pythonStack = {
     id: "python",
@@ -21,7 +17,7 @@ export const pythonStack = {
         const mypyIni = (await readText(root, "mypy.ini")) ?? "";
         const mypy = has("mypy.ini") || pyproject.includes("[tool.mypy]");
         // a config that names its files decides what mypy checks; otherwise check the whole tree
-        const mypyFiles = /^files\s*=/m.test(mypyIni) || /^files\s*=/m.test(section(pyproject, "tool.mypy"));
+        const mypyFiles = /^files\s*=/m.test(mypyIni) || /^files\s*=/m.test(tomlSection(pyproject, "tool.mypy"));
         const hasTests = has("tests") || has("test") || filesMatching(root, ".", /^test_.*\.py$/).length > 0;
         const customTest = optionalString("python", options, "test");
         const pytest = customTest === undefined && hasTests;

package/dist/stacks/ruby.js

@@ -0,0 +1,53 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { checkKeys, filesMatching, readText, stringList } from "./support.js";
+const OPTION_KEYS = ["versions", "os"];
+// only the gem's own version: not MINIMUM_RUBY_VERSION, required_ruby_version or a computed value
+const VERSION_CONSTANT = /^\s*VERSION\s*=\s*["']([^"']+)["']/m;
+const GEMSPEC_VERSION = /\.version\s*=\s*["']([^"']+)["']/;
+/** A `VERSION = "x.y.z"` in lib/<name>/version.rb, else the gemspec's `s.version = "x.y.z"`. */
+async function rubyRelease(root) {
+    for (const dir of filesMatching(root, "lib", /^[^.]+$/)) {
+        const path = `lib/${dir}/version.rb`;
+        const version = VERSION_CONSTANT.exec((await readText(root, path)) ?? "")?.[1];
+        if (version)
+            return { type: "ruby", version, versionFile: path };
+    }
+    for (const spec of filesMatching(root, ".", /\.gemspec$/)) {
+        const version = GEMSPEC_VERSION.exec((await readText(root, spec)) ?? "")?.[1];
+        // release-please's ruby strategy only bumps version.rb; the generic updater bumps the gemspec
+        if (version)
+            return { type: "ruby", version, extraFiles: [spec] };
+    }
+    return { type: "ruby", version: null };
+}
+export const rubyStack = {
+    id: "ruby",
+    detect: (root) => existsSync(join(root, "Gemfile")),
+    async resolve(root, options = {}) {
+        checkKeys("ruby", options, OPTION_KEYS);
+        const has = (path) => existsSync(join(root, path));
+        const rubocop = has(".rubocop.yml");
+        const test = has("spec") ? "bundle exec rspec" : has("Rakefile") && has("test") ? "bundle exec rake test" : null;
+        return {
+            id: "ruby",
+            staged: rubocop
+                ? [{ name: "ruby:rubocop", glob: "*.rb", run: "bundle exec rubocop --autocorrect {staged_files}" }]
+                : [],
+            test,
+            install: "bundle install",
+            gitignore: ["Ruby"],
+            dependabot: ["bundler"],
+            ci: {
+                workflow: "stack-ruby.yml",
+                with: {
+                    "ruby-versions": JSON.stringify(stringList("ruby", options, "versions") ?? ["3.3", "3.4"]),
+                    os: JSON.stringify(stringList("ruby", options, "os") ?? ["ubuntu-latest"]),
+                    "install-command": "bundle install",
+                    commands: JSON.stringify([...(rubocop ? ["bundle exec rubocop"] : []), ...(test ? [test] : [])]),
+                },
+            },
+            release: await rubyRelease(root),
+        };
+    },
+};

package/dist/stacks/rust.js

@@ -0,0 +1,39 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { checkKeys, readText, stringList, tomlSection } from "./support.js";
+const OPTION_KEYS = ["versions", "os"];
+export const rustStack = {
+    id: "rust",
+    detect: (root) => existsSync(join(root, "Cargo.toml")),
+    async resolve(root, options = {}) {
+        checkKeys("rust", options, OPTION_KEYS);
+        const cargo = (await readText(root, "Cargo.toml")) ?? "";
+        const pkg = tomlSection(cargo, "package");
+        const version = /^version\s*=\s*"([^"]+)"/m.exec(pkg)?.[1] ?? null;
+        // a workspace root without its own package has nothing for release-please's rust updater to bump
+        const release = pkg ? { type: "rust", version } : { type: "simple", version: null };
+        return {
+            id: "rust",
+            staged: [{ name: "rust:fmt", glob: "*.rs", run: "cargo fmt --all" }],
+            test: "cargo test",
+            install: "cargo fetch",
+            gitignore: ["Rust"],
+            dependabot: ["cargo"],
+            ci: {
+                workflow: "stack-rust.yml",
+                with: {
+                    "rust-versions": JSON.stringify(stringList("rust", options, "versions") ?? ["stable"]),
+                    os: JSON.stringify(stringList("rust", options, "os") ?? ["ubuntu-latest"]),
+                    commands: JSON.stringify([
+                        "cargo fmt --all --check",
+                        "cargo clippy --workspace --all-targets -- -D warnings",
+                        "cargo test --workspace --all-targets",
+                        // --all-targets leaves doctests out, and --doc fails when there is no library to document
+                        ...(existsSync(join(root, "src/lib.rs")) ? ["cargo test --workspace --doc"] : []),
+                    ]),
+                },
+            },
+            release,
+        };
+    },
+};

package/dist/stacks/support.js

@@ -48,3 +48,7 @@ export async function readText(root, file) {
         return null;
     }
 }
+/** The body of the `[name]` table of a TOML file, or "". */
+export function tomlSection(toml, name) {
+    return toml.split(/^\[/m).find((part) => part.startsWith(`${name}]`)) ?? "";
+}

package/dist/version.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 export const PACKAGE_VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version;
 /** The standard this build of repokeeper applies. Bump it whenever generated output changes. */
-export const STANDARD_VERSION = "1.2.2";
+export const STANDARD_VERSION = "1.3.0";
 export const TOOL_VERSIONS = {
     lefthook: "2.1.14",
     commitlintCli: "21.2.3",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repokeeper",
-  "version": "0.2.3",
+  "version": "0.4.0",
   "description": "Keep every repository on one maintained standard: commits, git hooks, CI, releases, dependency updates and repo settings.",
   "type": "module",
   "bin": {

package/templates/gitignore/Composer.gitignore

@@ -0,0 +1,6 @@
+composer.phar
+/vendor/
+
+# Commit your application's lock file https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control
+# You may choose to ignore a library lock file http://getcomposer.org/doc/02-libraries.md#lock-file
+# composer.lock

package/templates/gitignore/Go.gitignore

@@ -0,0 +1,32 @@
+# If you prefer the allow list template instead of the deny list, see community template:
+# https://github.com/github/gitignore/blob/main/community/Golang/Go.AllowList.gitignore
+#
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Code coverage profiles and other test artifacts
+*.out
+coverage.*
+*.coverprofile
+profile.cov
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+# Go workspace file
+go.work
+go.work.sum
+
+# env file
+.env
+
+# Editor/IDE
+# .idea/
+# .vscode/

package/templates/gitignore/Kotlin.gitignore

@@ -0,0 +1,27 @@
+# Compiled class file
+*.class
+
+# Log file
+*.log
+
+# BlueJ files
+*.ctxt
+
+# Mobile Tools for Java (J2ME)
+.mtj.tmp/
+
+# Package Files #
+*.jar
+*.war
+*.nar
+*.ear
+*.zip
+*.tar.gz
+*.rar
+
+# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml
+hs_err_pid*
+replay_pid*
+
+# Kotlin Gradle plugin data, see https://kotlinlang.org/docs/whatsnew20.html#new-directory-for-kotlin-data-in-gradle-projects
+.kotlin/

package/templates/gitignore/Ruby.gitignore

@@ -0,0 +1,56 @@
+*.gem
+*.rbc
+/.config
+/coverage/
+/InstalledFiles
+/pkg/
+/spec/reports/
+/spec/examples.txt
+/test/tmp/
+/test/version_tmp/
+/tmp/
+
+# Used by dotenv library to load environment variables.
+# .env
+
+# Ignore Byebug command history file.
+.byebug_history
+
+## Specific to RubyMotion:
+.dat*
+.repl_history
+build/
+*.bridgesupport
+build-iPhoneOS/
+build-iPhoneSimulator/
+
+## Specific to RubyMotion (use of CocoaPods):
+#
+# We recommend against adding the Pods directory to your .gitignore. However
+# you should judge for yourself, the pros and cons are mentioned at:
+# https://guides.cocoapods.org/using/using-cocoapods.html#should-i-check-the-pods-directory-into-source-control
+#
+# vendor/Pods/
+
+## Documentation cache and generated files:
+/.yardoc/
+/_yardoc/
+/doc/
+/rdoc/
+
+## Environment normalization:
+/.bundle/
+/vendor/bundle
+/lib/bundler/man/
+
+# for a library or gem, you might want to ignore these files since the code is
+# intended to run in multiple environments; otherwise, check them in:
+# Gemfile.lock
+# .ruby-version
+# .ruby-gemset
+
+# unless supporting rvm < 1.11.0 or doing something fancy, ignore this:
+.rvmrc
+
+# Used by RuboCop. Remote config files pulled in from inherit_from directive.
+# .rubocop-https?--*

package/templates/gitignore/Rust.gitignore

@@ -0,0 +1,24 @@
+# Generated by Cargo
+# will have compiled files and executables
+debug
+target
+
+# These are backup files generated by rustfmt
+**/*.rs.bk
+
+# MSVC Windows builds of rustc generate these, which store debugging information
+*.pdb
+
+# Generated by cargo mutants
+# Contains mutation testing data
+**/mutants.out*/
+
+# rustc will dump stack traces when hitting an internal compiler error to PWD
+rustc-ice-*.txt
+
+# RustRover
+#  JetBrains specific template is maintained in a separate JetBrains.gitignore that can
+#  be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
+#  and can be added to the global gitignore or merged into this file.  For a more nuclear
+#  option (not recommended) you can uncomment the following to ignore the entire idea folder.
+#.idea/