repokeeper 0.4.7 → 0.5.0

package/README.md

@@ -6,7 +6,8 @@ the standard evolves.
 
 > Status: early development. Supported stacks: Node.js (including NestJS), Python, Dart and
 > Flutter, shell and PowerShell scripts, Java (Maven and Gradle), Kotlin, .NET, Go, Rust, PHP and
-> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. See the
+> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. GitLab is
+> supported for Node.js projects. See the
 > [design](docs/superpowers/specs/2026-09-25-repokeeper-design.md).
 
 ## Usage
@@ -111,6 +112,48 @@ It prints every change first and applies them with `--yes`, or after you confirm
 access to the repository. Legacy branch protection, visibility, secrets and collaborators are never
 touched.
 
+## GitLab
+
+`repokeeper init` selects GitLab when the `origin` remote's host contains `gitlab`; pass
+`--platform gitlab` otherwise (a self-hosted instance under another name, or no remote yet). Only
+the node stack is supported on GitLab for now.
+
+What differs from GitHub:
+
+| | GitHub | GitLab |
+| --- | --- | --- |
+| Templates, CODEOWNERS | `.github/` | `.gitlab/` |
+| CI | caller workflows of reusable workflows | every job generated into `.gitlab-ci.yml` |
+| Dependency updates | Dependabot | Renovate (`renovate.json`) |
+| Releases | release-please, through a release pull request | semantic-release, on every push to the default branch |
+
+Jobs you add to `.gitlab-ci.yml` are kept; repokeeper manages only its own top-level keys
+(`workflow`, `node`, `commits`, `repokeeper`, `renovate`, `release`). `stack_options.node.os` has
+no effect: GitLab jobs run on Linux.
+
+Two things to know when you add jobs of your own:
+
+- The managed `workflow` runs pipelines for merge requests, the default branch, schedules and
+  tags. repokeeper's own jobs skip tags, so a tag pipeline holds only your jobs (publishing, for
+  example). A job meant for other branches never starts. To write the `workflow` rules yourself,
+  list the key under `owned` in `.repokeeper.yml`: `owned: [".gitlab-ci.yml#workflow"]`.
+- repokeeper's jobs use GitLab's default stages `test` and `deploy`. If you declare `stages`,
+  include both; repokeeper warns when one is missing.
+
+Two jobs stay inactive until you set them up in the project's CI/CD settings:
+
+- **`release`** needs a CI/CD variable `GITLAB_TOKEN`: a project access token with the `api` and
+  `write_repository` scopes and a role that may push to the default branch. Every push to the
+  default branch with a `feat`, `fix` or breaking change then releases at once: version bump,
+  `CHANGELOG.md`, tag and GitLab release. There is no release merge request. A repository without
+  a `vX.Y.Z` tag starts at `1.0.0`; tag the current version first to continue from it. A variable
+  marked Protected is only visible on protected branches, so protect the default branch or leave
+  the variable unprotected; otherwise the job silently stays away.
+- **`renovate`** needs a CI/CD variable `RENOVATE_TOKEN` (same scopes) and a pipeline schedule,
+  for example weekly. The schedule alone decides how often Renovate runs.
+
+`repokeeper github apply` has no GitLab counterpart yet.
+
 ## Pilots
 
 Each stack is tried on a real or demo repository before a release. The demo repositories carry the

package/dist/cli.js

@@ -25,6 +25,7 @@ export const USAGE = [
     "  --adopt <path>   let repokeeper manage an existing file (repeatable); --adopt-all for every file",
     "  --accept <path>  take repokeeper's version of a locally edited file (update, repeatable)",
     "  --stack <id>     stack to use instead of detection (init, repeatable)",
+    "  --platform <id>  github or gitlab, instead of detection from the origin remote (init)",
     "  --relock         rebuild .repokeeper/lock.json from the current files (init)",
     "  --json           machine-readable output (check)",
     "  -y, --yes        apply without asking (github apply)",
@@ -44,6 +45,7 @@ export async function run(argv, io) {
                 "adopt-all": { type: "boolean", default: false },
                 accept: { type: "string", multiple: true, default: [] },
                 stack: { type: "string", multiple: true, default: [] },
+                platform: { type: "string" },
                 relock: { type: "boolean", default: false },
                 json: { type: "boolean", default: false },
                 yes: { type: "boolean", short: "y", default: false },
@@ -66,6 +68,12 @@ export async function run(argv, io) {
                 throw new UsageError(`unknown stack ${stack}; expected one of ${STACK_IDS.join(", ")}`);
             }
         }
+        const platform = values.platform;
+        if (platform !== undefined && platform !== "github" && platform !== "gitlab") {
+            throw new UsageError(`unknown platform ${platform}; expected github or gitlab`);
+        }
+        if (platform !== undefined && command !== "init")
+            throw new UsageError("--platform is only for init");
         const options = {
             dryRun: values["dry-run"],
             force: values.force,
@@ -76,6 +84,7 @@ export async function run(argv, io) {
             relock: values.relock,
             json: values.json,
             yes: values.yes,
+            ...(platform !== undefined ? { platform } : {}),
         };
         if (command === "init")
             return await initCommand(io.cwd, options, io);

package/dist/commands/context.js

@@ -1,7 +1,13 @@
+import { UsageError } from "../errors.js";
 import { repoInfo } from "../git.js";
-import { githubPlatform } from "../platforms/github.js";
+import { platformFor } from "../platforms/index.js";
 import { getStackPack } from "../stacks/index.js";
 export async function buildContext(root, config, repo) {
+    const platform = platformFor(config.platform);
+    const unsupported = config.stacks.find((id) => !platform.stacks.includes(id));
+    if (unsupported) {
+        throw new UsageError(`stack "${unsupported}" is not supported on ${platform.id} yet (supported: ${platform.stacks.join(", ")})`);
+    }
     const stacks = await Promise.all(config.stacks.map((id) => getStackPack(id).resolve(root, config.stack_options[id] ?? {})));
-    return { config, stacks, platform: githubPlatform, repo: repo ?? (await repoInfo(root)) };
+    return { config, stacks, platform, repo: repo ?? (await repoInfo(root, config.platform)) };
 }

package/dist/commands/github.js

@@ -6,6 +6,8 @@ import { planGithub } from "../github/settings.js";
 /** `repokeeper github apply`: diff the repository's GitHub settings against `github:` and apply on confirmation. */
 export async function githubApplyCommand(root, options, io) {
     const config = await loadConfig(root);
+    if (config.platform !== "github")
+        throw new UsageError(`this repository uses the ${config.platform} platform`);
     const repo = await repoInfo(root);
     if (!repo.owner)
         throw new UsageError("the origin remote is not a GitHub repository");

package/dist/commands/init.js

@@ -4,9 +4,10 @@ import { join } from "node:path";
 import { CONFIG_FILE, loadConfig, renderConfig } from "../config/load.js";
 import { defaultConfig } from "../config/types.js";
 import { UsageError } from "../errors.js";
-import { dirtyPaths, gitUserName, remoteDefaultBranch, repoInfo } from "../git.js";
+import { dirtyPaths, gitUserName, remoteDefaultBranch, remoteHost, repoInfo } from "../git.js";
 import { outputId } from "../model.js";
 import { planOutputs } from "../plan.js";
+import { platformFor } from "../platforms/index.js";
 import { detectStacks } from "../stacks/index.js";
 import { applySync } from "../sync/apply.js";
 import { hashText } from "../sync/hash.js";
@@ -53,18 +54,20 @@ export async function initCommand(root, options, io) {
     const stacks = options.stacks.length > 0 ? options.stacks : await detectStacks(root);
     if (stacks.length === 0)
         throw new UsageError("no supported stack detected; pass --stack node");
-    const repo = await repoInfo(root);
+    const platform = options.platform ?? ((await remoteHost(root))?.includes("gitlab") ? "gitlab" : "github");
+    const repo = await repoInfo(root, platform);
     const holder = (await gitUserName(root)) ?? repo.owner ?? "the project authors";
     const config = defaultConfig({
         stacks,
         standard: STANDARD_VERSION,
         copyright: `${new Date().getFullYear()} ${holder}`,
-        contact: repo.owner ? `https://github.com/${repo.owner}` : "the repository maintainers",
+        contact: platformFor(platform).profileUrl(repo) ?? "the repository maintainers",
         codeowners: repo.owner ? [`@${repo.owner}`] : [],
+        platform,
     });
     const branch = await remoteDefaultBranch(root);
     if (branch && branch !== "main")
-        config.github = { default_branch: branch };
+        config[platform] = { default_branch: branch };
     const ctx = await buildContext(root, config, repo);
     const adopt = options.adoptAll ? "all" : new Set(options.adopt);
     const result = await computeSync(root, planOutputs(ctx), null, { adopt, accept: new Set() });

package/dist/commands/report.js

@@ -1,5 +1,6 @@
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { parse } from "yaml";
 import { duplicateTestRuns } from "../duplicates.js";
 import { crlfTrackedFiles } from "../git.js";
 import { describeOutput } from "../model.js";
@@ -61,11 +62,30 @@ export async function nextSteps(root, ctx, result) {
 }
 /** Problems repokeeper can't fix itself; printed, but not counted as drift. */
 export async function printWarnings(root, ctx, io) {
-    if (ctx.config.modules.ci) {
+    if (ctx.config.modules.ci && ctx.platform.id === "github") {
         for (const { file, command } of await duplicateTestRuns(root, ctx.stacks)) {
             io.out(`note: ${file} also runs "${command}", which the repokeeper ci job now runs too; drop one of them to save CI time`);
         }
     }
+    if (ctx.platform.id === "gitlab") {
+        const os = ctx.stacks.find((stack) => stack.id === "node")?.ci?.with.os;
+        if (os !== undefined && os !== '["ubuntu-latest"]') {
+            io.out("note: node.os is ignored on gitlab (Linux runners only)");
+        }
+        // repokeeper's jobs use GitLab's default stages; a stages list of the user's own replaces those
+        let ci = null;
+        try {
+            ci = parse(await readFile(join(root, ".gitlab-ci.yml"), "utf8"));
+        }
+        catch { }
+        if (Array.isArray(ci?.stages)) {
+            const stages = ci.stages;
+            const missing = ["test", "deploy"].filter((stage) => !stages.includes(stage));
+            if (missing.length > 0) {
+                io.out(`warning: .gitlab-ci.yml: stages lacks ${missing.join(" and ")}, which repokeeper's jobs use; add it, or GitLab rejects the pipeline`);
+            }
+        }
+    }
     if (!ctx.config.modules.editorconfig)
         return;
     const text = await readFile(join(root, ".gitattributes"), "utf8").catch(() => "");

package/dist/config/load.js

@@ -30,7 +30,12 @@ export function parseConfig(text) {
         const path = pathOf(error);
         throw new ConfigError(`${CONFIG_FILE}:${lineOf(doc, lineCounter, path)}: ${describe(error, path)}`);
     }
-    return withDefaults(data);
+    const typed = data;
+    const other = typed.platform === "gitlab" ? "github" : "gitlab";
+    if (typed[other] !== undefined) {
+        throw new ConfigError(`${CONFIG_FILE}:${lineOf(doc, lineCounter, [other])}: ${other} is not used on the ${typed.platform} platform`);
+    }
+    return withDefaults(typed);
 }
 export function renderConfig(config) {
     return `# repokeeper configuration: https://github.com/vannt-dev/repokeeper\n${stringify(config)}`;
@@ -67,6 +72,8 @@ function withDefaults(data) {
     };
     if (data.github !== undefined)
         config.github = data.github;
+    if (data.gitlab !== undefined)
+        config.gitlab = data.gitlab;
     return config;
 }
 function pathOf(error) {

package/dist/config/schema.js

@@ -7,7 +7,7 @@ export const configSchema = {
     properties: {
         schema: { const: 1 },
         standard: { type: "string", pattern: "^\\d+\\.\\d+\\.\\d+$" },
-        platform: { enum: ["github"] },
+        platform: { enum: ["github", "gitlab"] },
         stacks: { type: "array", minItems: 1, uniqueItems: true, items: { enum: [...STACK_IDS] } },
         modules: {
             type: "object",
@@ -75,5 +75,10 @@ export const configSchema = {
                 },
             },
         },
+        gitlab: {
+            type: "object",
+            additionalProperties: false,
+            properties: { default_branch: { type: "string", minLength: 1 } },
+        },
     },
 };

package/dist/config/types.js

@@ -11,16 +11,16 @@ export const STACK_IDS = [
     "php",
     "ruby",
 ];
-/** The branch workflows run on and contributors branch from: `github.default_branch`, or `main`. */
+/** The branch CI runs on and contributors branch from: `default_branch` of the configured platform, or `main`. */
 export function defaultBranch(config) {
-    const branch = config.github?.default_branch;
+    const branch = (config.platform === "gitlab" ? config.gitlab : config.github)?.default_branch;
     return typeof branch === "string" && branch.length > 0 ? branch : "main";
 }
 export function defaultConfig(input) {
     return {
         schema: 1,
         standard: input.standard,
-        platform: "github",
+        platform: input.platform ?? "github",
         stacks: input.stacks,
         modules: {
             editorconfig: true,

package/dist/git.js

@@ -18,10 +18,39 @@ export function parseRemoteUrl(url) {
     const match = /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/.exec(url.trim());
     return match ? { owner: match[1], name: match[2] } : null;
 }
-export async function repoInfo(root) {
-    const url = await git(root, ["remote", "get-url", "origin"]);
-    const remote = (url ? parseRemoteUrl(url) : null) ?? { owner: null, name: basename(root) };
-    return { ...remote, releasedVersion: await latestReleaseVersion(root) };
+/** Any hosted remote, HTTPS or SSH. The owner is the whole namespace path, because GitLab groups nest. */
+export function parseRemote(url) {
+    const text = url.trim();
+    // the web address shares the port of an http(s) remote; an SSH port says nothing about it
+    const match = /^https?:\/\/(?:[^@/]+@)?([^/:]+(?::\d+)?)\/(.+)$/i.exec(text) ??
+        /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)(?::\d+)?\/(.+)$/i.exec(text) ??
+        /^(?:[^@/]+@)?([^/:]+):(.+)$/.exec(text);
+    if (!match)
+        return null;
+    const host = match[1].toLowerCase();
+    const segments = match[2]
+        .replace(/\/+$/, "")
+        .replace(/\.git$/, "")
+        .split("/")
+        .filter(Boolean);
+    const name = segments.pop();
+    // a host has a dot, which rules out drive letters and file: URLs
+    if (!host.includes(".") || name === undefined || segments.length === 0)
+        return null;
+    return { host, owner: segments.join("/"), name };
+}
+async function originUrl(root) {
+    return git(root, ["remote", "get-url", "origin"]);
+}
+/** Host of the origin remote, or null without one. */
+export async function remoteHost(root) {
+    const url = await originUrl(root);
+    return url ? (parseRemote(url)?.host ?? null) : null;
+}
+export async function repoInfo(root, platform = "github") {
+    const url = await originUrl(root);
+    const remote = url ? (platform === "gitlab" ? parseRemote(url) : parseRemoteUrl(url)) : null;
+    return { ...(remote ?? { owner: null, name: basename(root) }), releasedVersion: await latestReleaseVersion(root) };
 }
 /** The branch `origin/HEAD` points at, or null when the remote's default branch isn't known locally. */
 export async function remoteDefaultBranch(root) {

package/dist/modules/health.js

@@ -33,7 +33,6 @@ export const healthModule = {
         const health = ctx.config.modules.health;
         if (!health)
             return [];
-        const { owner, name } = ctx.repo;
         const outputs = [];
         if (health.license !== false) {
             if (health.license !== "MIT") {
@@ -41,9 +40,7 @@ export const healthModule = {
             }
             outputs.push(md("LICENSE", MIT(health.copyright)));
         }
-        const report = owner
-            ? `through [GitHub security advisories](https://github.com/${owner}/${name}/security/advisories/new)`
-            : "through the repository's Security tab (Report a vulnerability)";
+        const report = ctx.platform.securityReport(ctx.repo);
         outputs.push(md("SECURITY.md", `# Security Policy\n\n<!-- ${MANAGED_HEADER} -->\n\n## Supported versions\n\nSecurity fixes are released for the latest published version.\n\n## Reporting a vulnerability\n\nPlease do not open a public issue. Report the vulnerability privately ${report}.\nThe maintainers will acknowledge it as soon as possible and keep you informed until it is resolved.\n`));
         const install = ctx.stacks.map((s) => s.install).filter((c) => c !== null);
         const run = install.length ? `Run ${install.map((c) => `\`${c}\``).join(" and ")}.` : "";
@@ -51,7 +48,7 @@ export const healthModule = {
             ? "Installing the dependencies also installs the git hooks (lefthook)."
             : `${run ? "Then run" : "Run"} \`npx --yes lefthook@${TOOL_VERSIONS.lefthook} install\` once to enable the git hooks (they need Node.js 22 or newer).`;
         const setup = [run, hooks].filter(Boolean).join(" ");
-        outputs.push(md("CONTRIBUTING.md", `# Contributing\n\n<!-- ${MANAGED_HEADER} -->\n\nThanks for helping improve this project.\n\n## Local setup\n\n${setup}\n\n## Workflow\n\n1. Create a branch from \`${defaultBranch(ctx.config)}\`.\n2. Write commit messages in [Conventional Commits](https://www.conventionalcommits.org/) form, for example \`feat: add export button\` or \`fix(api): handle empty input\`. The \`commit-msg\` hook checks them.\n3. Open a pull request. It is merged once the checks pass and it has been reviewed.\n\nPlease follow the [Code of Conduct](CODE_OF_CONDUCT.md).\n`));
+        outputs.push(md("CONTRIBUTING.md", `# Contributing\n\n<!-- ${MANAGED_HEADER} -->\n\nThanks for helping improve this project.\n\n## Local setup\n\n${setup}\n\n## Workflow\n\n1. Create a branch from \`${defaultBranch(ctx.config)}\`.\n2. Write commit messages in [Conventional Commits](https://www.conventionalcommits.org/) form, for example \`feat: add export button\` or \`fix(api): handle empty input\`. The \`commit-msg\` hook checks them.\n3. Open a ${ctx.platform.changeRequest}. It is merged once the checks pass and it has been reviewed.\n\nPlease follow the [Code of Conduct](CODE_OF_CONDUCT.md).\n`));
         outputs.push(md("CODE_OF_CONDUCT.md", readTemplate("CODE_OF_CONDUCT.md").replace("[INSERT CONTACT METHOD]", health.contact)));
         outputs.push(...ctx.platform.communityFiles(ctx));
         return outputs;

package/dist/platforms/github.js

@@ -1,5 +1,5 @@
 import { stringify } from "yaml";
-import { defaultBranch } from "../config/types.js";
+import { defaultBranch, STACK_IDS } from "../config/types.js";
 import { MANAGED_HEADER } from "../model.js";
 import { PACKAGE_VERSION, REUSABLE_REPO, WORKFLOW_REF } from "../version.js";
 const yamlFile = (module, path, data) => ({
@@ -49,6 +49,12 @@ const PHP_CHANGELOG_SECTIONS = [
 const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
 export const githubPlatform = {
     id: "github",
+    stacks: STACK_IDS,
+    changeRequest: "pull request",
+    profileUrl: (repo) => (repo.owner ? `https://github.com/${repo.owner}` : null),
+    securityReport: (repo) => repo.owner
+        ? `through [GitHub security advisories](https://github.com/${repo.owner}/${repo.name}/security/advisories/new)`
+        : "through the repository's Security tab (Report a vulnerability)",
     communityFiles(ctx) {
         const { owner, name } = ctx.repo;
         const outputs = [

package/dist/platforms/gitlab.js

@@ -0,0 +1,212 @@
+import { defaultBranch } from "../config/types.js";
+import { MANAGED_HEADER } from "../model.js";
+import { PACKAGE_VERSION, TOOL_VERSIONS } from "../version.js";
+const md = (path, body) => ({
+    kind: "file",
+    module: "health",
+    path,
+    content: `<!-- ${MANAGED_HEADER} -->\n\n${body}`,
+});
+/** Web address of the GitLab instance the repository lives on. */
+const baseUrl = (repo) => `https://${repo.host ?? "gitlab.com"}`;
+const CI_FILE = ".gitlab-ci.yml";
+const CI_KEYS = ["workflow", "node", "commits", "repokeeper", "renovate", "release"];
+/** One managed top-level key of .gitlab-ci.yml; keys the user adds are left alone. */
+const ciKey = (module, key, value) => ({
+    kind: "yaml",
+    module,
+    path: CI_FILE,
+    keyPath: [key],
+    value,
+    order: CI_KEYS,
+});
+const NOT_SCHEDULED = '$CI_PIPELINE_SOURCE != "schedule"';
+/** The checks of a change: merge requests and the default branch, not schedules and not tag pipelines. */
+const FOR_CHANGES = `${NOT_SCHEDULED} && $CI_COMMIT_TAG == null`;
+/** Image of the jobs that only run tools, whatever Node.js versions the project tests on. */
+const TOOL_IMAGE = "node:24";
+/** The node stack's CI inputs, as the GitHub reusable workflow receives them, as a GitLab job. */
+function nodeJob(input) {
+    const pm = input["package-manager"] ?? "npm";
+    const cached = input.cache === "npm";
+    const scripts = JSON.parse(input.scripts ?? "[]");
+    return {
+        stage: "test",
+        // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+        image: "node:${NODE_VERSION}",
+        parallel: { matrix: [{ NODE_VERSION: JSON.parse(input["node-versions"] ?? '["22","24"]') }] },
+        rules: [{ if: FOR_CHANGES }],
+        variables: {
+            COREPACK_ENABLE_DOWNLOAD_PROMPT: "0",
+            ...(cached ? { npm_config_cache: "$CI_PROJECT_DIR/.npm" } : {}),
+        },
+        ...(cached ? { cache: { key: { files: ["package-lock.json"] }, paths: [".npm/"] } } : {}),
+        script: [
+            ...(pm === "npm" ? [] : ["corepack enable"]),
+            input["install-command"] ?? "npm ci",
+            ...scripts.map((script) => `${pm} run ${script}`),
+        ],
+    };
+}
+/** commitlint from a scratch directory, so the project needs no commitlint of its own. */
+const COMMITLINT = `dir="$(mktemp -d)"
+(cd "$dir" && echo '{ "private": true }' > package.json && npm install --no-audit --no-fund @commitlint/cli@${TOOL_VERSIONS.commitlintCli} @commitlint/config-conventional@${TOOL_VERSIONS.commitlintConventional})
+cat > "$dir/commitlint.config.mjs" <<'EOF'
+export default { extends: ["@commitlint/config-conventional"], rules: { "header-max-length": [2, "always", 100] } };
+EOF
+lint() { "$dir/node_modules/.bin/commitlint" --config "$dir/commitlint.config.mjs" --verbose "$@"; }
+# a merged results pipeline runs on a merge commit; the commits to lint end at the source branch
+head="$CI_MERGE_REQUEST_SOURCE_BRANCH_SHA"
+[ -n "$head" ] || head="$CI_COMMIT_SHA"
+if [ -n "$CI_MERGE_REQUEST_DIFF_BASE_SHA" ]; then
+  lint --from "$CI_MERGE_REQUEST_DIFF_BASE_SHA" --to "$head"
+else
+  lint --last
+fi
+`;
+const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
+/**
+ * semantic-release and the plugins it does not bundle, from a scratch directory. It resolves plugins next to
+ * itself before it looks in the project, so the project needs none of them installed.
+ */
+const SEMANTIC_RELEASE = `dir="$(mktemp -d)"
+(cd "$dir" && echo '{ "private": true }' > package.json && npm install --no-audit --no-fund semantic-release@${TOOL_VERSIONS.semanticRelease} @semantic-release/changelog@${TOOL_VERSIONS.semanticReleaseChangelog} @semantic-release/git@${TOOL_VERSIONS.semanticReleaseGit} @semantic-release/gitlab@${TOOL_VERSIONS.semanticReleaseGitlab} conventional-changelog-conventionalcommits@${TOOL_VERSIONS.conventionalCommitsPreset})
+"$dir/node_modules/.bin/semantic-release"
+`;
+export const gitlabPlatform = {
+    id: "gitlab",
+    stacks: ["node"],
+    changeRequest: "merge request",
+    profileUrl: (repo) => (repo.owner ? `${baseUrl(repo)}/${repo.owner}` : null),
+    securityReport: (repo) => repo.owner
+        ? `by opening a [confidential issue](${baseUrl(repo)}/${repo.owner}/${repo.name}/-/issues/new?issue%5Bconfidential%5D=true)`
+        : "by opening a confidential issue in the repository",
+    communityFiles(ctx) {
+        const outputs = [
+            md(".gitlab/issue_templates/Bug.md", "## What happened?\n\n<!-- Include the steps to reproduce it. -->\n\n## What did you expect?\n\n## Version\n\n/label ~bug\n"),
+            md(".gitlab/issue_templates/Feature.md", "## What problem would this solve?\n\n## What do you propose?\n\n/label ~enhancement\n"),
+            md(".gitlab/merge_request_templates/Default.md", "## Summary\n\n## Testing\n\n- [ ] Tests added or updated\n- [ ] Commit messages follow Conventional Commits\n"),
+        ];
+        const health = ctx.config.modules.health;
+        if (health && health.codeowners.length > 0) {
+            outputs.push({
+                kind: "file",
+                module: "health",
+                path: ".gitlab/CODEOWNERS",
+                content: `# ${MANAGED_HEADER}\n* ${health.codeowners.join(" ")}\n`,
+            });
+        }
+        return outputs;
+    },
+    // Renovate finds the package managers itself, so the Dependabot ecosystem names are not needed
+    dependencyUpdates() {
+        return [
+            {
+                kind: "file",
+                module: "deps",
+                path: "renovate.json",
+                content: json({
+                    $schema: "https://docs.renovatebot.com/renovate-schema.json",
+                    // chore commits pass commitlint, as the Dependabot prefix does on GitHub. No schedule preset: the
+                    // pipeline schedule sets the cadence, and a Renovate schedule would skip runs outside its own window
+                    extends: ["config:recommended", ":semanticCommits", ":semanticCommitTypeAll(chore)"],
+                    packageRules: [
+                        { matchUpdateTypes: ["minor", "patch"], groupName: "minor and patch updates" },
+                        // @types/node majors track the Node.js line a project runs on, which the project chooses
+                        { matchPackageNames: ["@types/node"], matchUpdateTypes: ["major"], enabled: false },
+                    ],
+                }),
+            },
+            // runs from a pipeline schedule of the repository; without the token or a schedule it never starts
+            ciKey("deps", "renovate", {
+                stage: "test",
+                image: `renovate/renovate:${TOOL_VERSIONS.renovate}`,
+                rules: [{ if: '$CI_PIPELINE_SOURCE == "schedule" && $RENOVATE_TOKEN' }],
+                variables: {
+                    RENOVATE_PLATFORM: "gitlab",
+                    RENOVATE_ENDPOINT: "$CI_API_V4_URL",
+                    RENOVATE_AUTODISCOVER: "false",
+                    RENOVATE_ONBOARDING: "false",
+                },
+                script: ['renovate "$CI_PROJECT_PATH"'],
+            }),
+        ];
+    },
+    ciWorkflow(ctx) {
+        const jobs = [];
+        const node = ctx.stacks.find((stack) => stack.id === "node")?.ci;
+        if (node)
+            jobs.push(ciKey("ci", "node", nodeJob(node.with)));
+        if (ctx.config.modules.commits) {
+            jobs.push(ciKey("ci", "commits", {
+                stage: "test",
+                image: TOOL_IMAGE,
+                rules: [{ if: FOR_CHANGES }],
+                variables: { GIT_DEPTH: "0" },
+                script: [COMMITLINT],
+            }));
+        }
+        if (ctx.config.modules.drift) {
+            jobs.push(ciKey("ci", "repokeeper", {
+                stage: "test",
+                image: TOOL_IMAGE,
+                rules: [{ if: FOR_CHANGES }],
+                script: [`npx --yes repokeeper@${PACKAGE_VERSION} check`],
+            }));
+        }
+        if (jobs.length === 0)
+            return [];
+        return [
+            // one pipeline per merge request, per push to the default branch and per schedule; none for other branches.
+            // Tags are let through for jobs of the user's own, such as publishing: no managed job runs on one
+            ciKey("ci", "workflow", {
+                rules: [
+                    { if: '$CI_PIPELINE_SOURCE == "merge_request_event"' },
+                    { if: '$CI_PIPELINE_SOURCE == "schedule"' },
+                    { if: `$CI_COMMIT_BRANCH == "${defaultBranch(ctx.config)}"` },
+                    { if: "$CI_COMMIT_TAG" },
+                ],
+            }),
+            ...jobs,
+        ];
+    },
+    releaseAutomation(ctx) {
+        const branch = defaultBranch(ctx.config);
+        return [
+            {
+                kind: "file",
+                module: "release",
+                path: ".releaserc.json",
+                content: json({
+                    branches: [branch],
+                    // biome-ignore lint/suspicious/noTemplateCurlyInString: a semantic-release template
+                    tagFormat: "v${version}",
+                    plugins: [
+                        ["@semantic-release/commit-analyzer", { preset: "conventionalcommits" }],
+                        ["@semantic-release/release-notes-generator", { preset: "conventionalcommits" }],
+                        ["@semantic-release/changelog", { changelogFile: "CHANGELOG.md" }],
+                        // bumps package.json and the npm lock file; publishing stays the project's own business
+                        ["@semantic-release/npm", { npmPublish: false }],
+                        [
+                            "@semantic-release/git",
+                            {
+                                assets: ["CHANGELOG.md", "package.json", "package-lock.json", "npm-shrinkwrap.json"],
+                                // biome-ignore lint/suspicious/noTemplateCurlyInString: a semantic-release template
+                                message: "chore(release): ${nextRelease.version} [skip ci]",
+                            },
+                        ],
+                        "@semantic-release/gitlab",
+                    ],
+                }),
+            },
+            // semantic-release pushes a commit and a tag, which the job token cannot do; without GITLAB_TOKEN the job is absent
+            ciKey("release", "release", {
+                stage: "deploy",
+                image: TOOL_IMAGE,
+                rules: [{ if: `${NOT_SCHEDULED} && $CI_COMMIT_BRANCH == "${branch}" && $GITLAB_TOKEN` }],
+                variables: { GIT_DEPTH: "0" },
+                script: [SEMANTIC_RELEASE],
+            }),
+        ];
+    },
+};

package/dist/platforms/index.js

@@ -0,0 +1,5 @@
+import { githubPlatform } from "./github.js";
+import { gitlabPlatform } from "./gitlab.js";
+export function platformFor(id) {
+    return id === "gitlab" ? gitlabPlatform : githubPlatform;
+}

package/dist/version.js

@@ -6,6 +6,13 @@ export const TOOL_VERSIONS = {
     lefthook: "2.1.14",
     commitlintCli: "21.2.3",
     commitlintConventional: "21.2.3",
+    semanticRelease: "25.0.9",
+    semanticReleaseChangelog: "7.0.0",
+    semanticReleaseGit: "11.0.1",
+    semanticReleaseGitlab: "13.3.3",
+    // 10.x needs conventional-changelog-writer 9, and semantic-release 25's notes generator bundles 8
+    conventionalCommitsPreset: "9.3.1",
+    renovate: "44.128.1",
 };
 /** Repository hosting the reusable workflows that generated CI files call. */
 export const REUSABLE_REPO = "vannt-dev/repokeeper";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repokeeper",
-  "version": "0.4.7",
+  "version": "0.5.0",
   "description": "Keep every repository on one maintained standard: commits, git hooks, CI, releases, dependency updates and repo settings.",
   "type": "module",
   "bin": {