repokeeper 0.4.7 → 0.6.0

package/.github/workflows/stack-ruby.yml

@@ -0,0 +1,65 @@
+name: stack-ruby
+
+on:
+  workflow_call:
+    inputs:
+      ruby-versions:
+        description: JSON list of Ruby versions
+        type: string
+        default: '["3.3","3.4"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      install-command:
+        description: Command that installs dependencies
+        type: string
+        default: bundle install
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: "[]"
+      working-directory:
+        description: Directory holding the Gemfile
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  ruby:
+    name: ruby ${{ matrix.ruby }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        ruby: ${{ fromJSON(inputs.ruby-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          working-directory: ${{ inputs.working-directory }}
+      - name: Install dependencies
+        env:
+          INSTALL: ${{ inputs.install-command }}
+        run: bash -c "$INSTALL"
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-rust.yml

@@ -0,0 +1,60 @@
+name: stack-rust
+
+on:
+  workflow_call:
+    inputs:
+      rust-versions:
+        description: JSON list of rustup toolchains ("stable", "1.85.0")
+        type: string
+        default: '["stable"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["cargo test --all-targets"]'
+      working-directory:
+        description: Directory holding Cargo.toml
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  rust:
+    name: rust ${{ matrix.rust }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        rust: ${{ fromJSON(inputs.rust-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install the toolchain
+        env:
+          TOOLCHAIN: ${{ matrix.rust }}
+        # rustup ships on the hosted runners
+        run: |
+          rustup toolchain install "$TOOLCHAIN" --profile minimal --component rustfmt,clippy
+          rustup default "$TOOLCHAIN"
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-script.yml

@@ -0,0 +1,87 @@
+name: stack-script
+
+on:
+  workflow_call:
+    inputs:
+      shell-scripts:
+        description: '"true" to run ShellCheck and shfmt on *.sh'
+        type: string
+        default: "true"
+      powershell-scripts:
+        description: '"true" to run PSScriptAnalyzer on *.ps1'
+        type: string
+        default: "false"
+      test-command:
+        description: Test command run on Linux and Windows; empty for none
+        type: string
+        default: ""
+      working-directory:
+        description: Directory the checks start from
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  shell:
+    if: inputs.shell-scripts == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: ShellCheck
+        run: git ls-files -z '*.sh' | xargs -0 --no-run-if-empty shellcheck
+      - name: shfmt
+        run: |
+          curl -fsSL -o "$RUNNER_TEMP/shfmt" https://github.com/mvdan/sh/releases/download/v3.14.1/shfmt_v3.14.1_linux_amd64
+          chmod +x "$RUNNER_TEMP/shfmt"
+          git ls-files -z '*.sh' | xargs -0 --no-run-if-empty "$RUNNER_TEMP/shfmt" -d
+  powershell:
+    if: inputs.powershell-scripts == 'true'
+    runs-on: windows-latest
+    permissions:
+      contents: read
+    defaults:
+      run:
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: PSScriptAnalyzer
+        shell: pwsh
+        run: |
+          Install-Module PSScriptAnalyzer -RequiredVersion 1.25.0 -Force -Scope CurrentUser
+          # a repository settings file decides the rules; otherwise only errors and warnings fail the job
+          $issues = if (Test-Path PSScriptAnalyzerSettings.psd1) {
+            Invoke-ScriptAnalyzer -Path . -Recurse -Settings PSScriptAnalyzerSettings.psd1
+          } else {
+            Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error, Warning
+          }
+          $issues | Format-Table -AutoSize
+          if ($issues) { exit 1 }
+  test:
+    if: inputs.test-command != ''
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - run: ${{ inputs.test-command }}

package/README.md

@@ -6,12 +6,40 @@ the standard evolves.
 
 > Status: early development. Supported stacks: Node.js (including NestJS), Python, Dart and
 > Flutter, shell and PowerShell scripts, Java (Maven and Gradle), Kotlin, .NET, Go, Rust, PHP and
-> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. See the
+> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. GitLab is
+> supported for Node.js and Go projects, with project settings through `repokeeper gitlab apply`. See the
 > [design](docs/superpowers/specs/2026-09-25-repokeeper-design.md).
 
+## How it works
+
+```mermaid
+flowchart LR
+  config[".repokeeper.yml<br/>stacks, modules, owned"]
+  tool(["repokeeper<br/>init, update, check"])
+  files["Managed files<br/>.editorconfig, .gitignore, lefthook.yml,<br/>commitlint, CONTRIBUTING, LICENSE,<br/>dependabot.yml, ci.yml, release.yml"]
+  lock[".repokeeper/lock.json<br/>what repokeeper wrote"]
+  workflows["Reusable workflows<br/>vannt-dev/repokeeper at v0,<br/>or pinned, mirrored, local"]
+  config --> tool
+  tool -->|"init, update: write,<br/>keep your edits"| files
+  tool -.->|"check: compare,<br/>exit 1 on drift"| files
+  tool --> lock
+  files -->|"ci.yml, release.yml call"| workflows
+```
+
+One file describes the repository (`.repokeeper.yml`); repokeeper turns it into the managed files and
+remembers what it wrote, so it can tell your edits from its own. `check` only compares; `update`
+moves the files to a newer standard and leaves alone what you changed or listed under `owned`.
+
 ## Usage
 
-repokeeper is not on npm yet. Until the first release, build it from source and link the command:
+repokeeper is [on npm](https://www.npmjs.com/package/repokeeper). Install it once, or run it without
+installing by putting `npx` in front of each command below:
+
+```bash
+npm install --global repokeeper
+```
+
+To work on repokeeper itself, build it from source and link the command instead:
 
 ```bash
 git clone https://github.com/vannt-dev/repokeeper.git
@@ -33,6 +61,29 @@ yours. `owned` also takes a single key of a shared file, such as `.github/workfl
 `package.json#devDependencies.lefthook`; repokeeper then leaves that key, and everything under it,
 alone. Every write command accepts `--dry-run`.
 
+`init` applies the whole standard unless you say otherwise:
+
+- `repokeeper init --preset essential` writes only the editor settings, `.gitignore` and the CI
+  workflow. `standard` is the default. `strict` adds the drift check to CI and, on GitHub, writes
+  branch protection (pull requests with one approval, no force push, the commit check required) and
+  Dependabot security updates into `.repokeeper.yml`; `repokeeper github apply` then puts them in
+  place. There is no preset that promises code or secret scanning: repokeeper does not set those up.
+- `repokeeper init --interactive` (or `-i`) asks about each part in turn, naming the files it would
+  write, shows the result, and asks once more before writing anything. Enter keeps the preset's
+  answer. Add `--dry-run` to go through the questions without the possibility of writing.
+
+Either way the choice ends up as plain `modules:` switches in `.repokeeper.yml`, which you can change
+later and apply with `repokeeper update`.
+
+You can also start from the file instead of from detection: put a `.repokeeper.yml` you wrote
+yourself in the repository and run `repokeeper init`. When the file is there and repokeeper has not
+applied anything yet, `init` applies it as it is written. Nothing is detected, `--stack`,
+`--platform` and `--preset` are refused, and the only line it changes is `standard:`, which it sets
+to the standard it applied.
+
+The [playground](https://vannt-dev.github.io/repokeeper/) writes that file for you: tick the stacks
+and the parts you want, and it shows the `.repokeeper.yml` and the command to run.
+
 `init` reads the default branch from `origin/HEAD` and records it as `github.default_branch` when it
 isn't `main`. The release manifest starts from the latest `vX.Y.Z` tag when the stack has no version
 of its own.
@@ -48,68 +99,14 @@ projects, which the dotnet CLI can't build.
 
 Requires Node.js 22.12 or newer.
 
-## CI and releases
-
-`ci.yml` and `release.yml` call reusable workflows from this repository (`stack-node.yml`,
-`commitlint.yml`, `release-please.yml`) at the moving major tag, so fixes reach every repository
-without a pull request. repokeeper owns the `name`, `on`, `permissions` and `concurrency` keys and
-the jobs it adds; jobs you add yourself are left alone, and so is the formatting of the rest of the
-file. A new push to a pull request cancels that pull request's earlier `ci` run; runs on the default
-branch always finish.
-
-The script stack runs ShellCheck and `shfmt -d` on `*.sh` (format with `shfmt -w` before pushing)
-and PSScriptAnalyzer on `*.ps1`, which fails on errors and warnings (not on information-level rules). To
-choose the rules yourself, add a `PSScriptAnalyzerSettings.psd1` at the repository root; the job then
-uses it instead of its own filter, so keep `Severity` in it unless you want information-level rules too:
-
-```powershell
-@{
-    Severity     = @('Error', 'Warning')
-    # installers print for the person running them
-    ExcludeRules = @('PSAvoidUsingWriteHost')
-}
-```
-
-`release.yml` runs [release-please](https://github.com/googleapis/release-please): it keeps a release
-pull request open, and merging it tags the release and updates `CHANGELOG.md`. Two settings make this
-work:
-
-- In the repository settings, under Actions → General, allow GitHub Actions to create and approve
-  pull requests.
-- Optionally add a `RELEASE_PLEASE_TOKEN` secret (a fine-grained token with contents, pull requests
-  and issues write access). Without it the release pull request is opened with `GITHUB_TOKEN`, and
-  GitHub holds its `pull_request` runs until someone approves them; the `release-pr-ci` job approves
-  them, so the pull request gets its checks and required checks in a ruleset can pass.
-
-A repository with no release yet (manifest at `0.0.0`) gets `initial-version: 0.1.0`, so its first
-release is 0.1.0 rather than release-please's default 1.0.0.
-
-Set `modules.drift: true` to add a `repokeeper` job to `ci.yml` that runs `repokeeper check` with
-the version that wrote the standard, so a pull request that edits a managed file fails until the edit
-is resolved.
-
-## GitHub settings
-
-`repokeeper github apply` brings the repository's settings in line with the `github:` section of
-`.repokeeper.yml`. Only the keys you write are managed; anything left out stays as it is.
-
-```yaml
-github:
-  description: Keeps repositories on one standard
-  topics: [cli, conventional-commits]
-  merge: { squash: true, merge_commit: false, rebase: false, delete_branch_on_merge: true }
-  security: { dependabot_alerts: true, dependabot_security_updates: true }
-  protect:                  # a ruleset named "repokeeper" on the default branch; false removes it
-    require_pull_request: true
-    required_approvals: 0
-    required_checks: ["commits / commitlint"]   # check names exactly as pull requests show them
-    allow_force_push: false
-```
+## Guides
 
-It prints every change first and applies them with `--yes`, or after you confirm in a terminal;
-`--dry-run` only prints. The token comes from `GITHUB_TOKEN` or `gh auth token` and needs admin
-access to the repository. Legacy branch protection, visibility, secrets and collaborators are never
-touched.
+| Guide | What it covers |
+| --- | --- |
+| [CI and releases](docs/ci-and-releases.md) | The workflows repokeeper writes, pinning or mirroring the reusable workflows, `repokeeper eject`, script linting, release-please, the drift check |
+| [Monorepos](docs/monorepos.md) | Stacks in folders: `stack_options.<stack>.directory`, what runs where, the limits |
+| [GitHub settings](docs/github-settings.md) | `repokeeper github apply`: description, topics, merge settings, security, branch protection |
+| [GitLab](docs/gitlab.md) | What differs on GitLab, the two jobs that need a token, and `repokeeper gitlab apply`: merge settings, branch protection, the Renovate schedule |
 
 ## Pilots
 

package/dist/cli.js

@@ -4,8 +4,11 @@ import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
 import { checkCommand } from "./commands/check.js";
+import { ejectCommand } from "./commands/eject.js";
 import { githubApplyCommand } from "./commands/github.js";
+import { gitlabApplyCommand } from "./commands/gitlab.js";
 import { initCommand } from "./commands/init.js";
+import { PRESET_SUMMARY, PRESETS } from "./commands/presets.js";
 import { updateCommand } from "./commands/update.js";
 import { STACK_IDS } from "./config/types.js";
 import { RepokeeperError, UsageError } from "./errors.js";
@@ -14,20 +17,26 @@ export const USAGE = [
     "usage: repokeeper <command> [options]",
     "",
     "commands:",
-    "  init    detect stacks, write .repokeeper.yml and apply the standard",
+    "  init    detect stacks, write .repokeeper.yml and apply the standard (or apply a .repokeeper.yml you wrote)",
     "  check   report drift from the standard without writing (exit 1 on drift)",
     "  update  move to the standard of this repokeeper version and resync",
     "  github apply  diff the GitHub settings against .repokeeper.yml and apply them",
+    "  gitlab apply  the same for a GitLab project: settings, branch protection, the Renovate schedule",
+    "  eject   copy the reusable CI workflows into this repository and call them from there",
     "",
     "options:",
     "  --dry-run        show what would change without writing",
     "  --force          write even when target files have uncommitted changes",
     "  --adopt <path>   let repokeeper manage an existing file (repeatable); --adopt-all for every file",
     "  --accept <path>  take repokeeper's version of a locally edited file (update, repeatable)",
-    "  --stack <id>     stack to use instead of detection (init, repeatable)",
+    "  --stack <id>     stack to use instead of detection (init, repeatable); id:folder for a stack in a folder",
+    "  --platform <id>  github or gitlab, instead of detection from the origin remote (init)",
+    `  --preset <name>  ${PRESETS.map((name) => `${name}: ${PRESET_SUMMARY[name]}`).join("; ")} (init)`,
+    "  -i, --interactive  ask which parts to apply, naming the files of each, and confirm before writing (init)",
     "  --relock         rebuild .repokeeper/lock.json from the current files (init)",
+    "  --to <folder>    write every reusable workflow into another repository's folder instead (eject)",
     "  --json           machine-readable output (check)",
-    "  -y, --yes        apply without asking (github apply)",
+    "  -y, --yes        apply without asking (github apply, gitlab apply)",
     "  -v, --version    print the version",
 ].join("\n");
 const toPosix = (path) => path.replace(/\\/g, "/").replace(/^\.\//, "");
@@ -44,7 +53,11 @@ export async function run(argv, io) {
                 "adopt-all": { type: "boolean", default: false },
                 accept: { type: "string", multiple: true, default: [] },
                 stack: { type: "string", multiple: true, default: [] },
+                platform: { type: "string" },
+                preset: { type: "string" },
+                interactive: { type: "boolean", short: "i", default: false },
                 relock: { type: "boolean", default: false },
+                to: { type: "string" },
                 json: { type: "boolean", default: false },
                 yes: { type: "boolean", short: "y", default: false },
                 version: { type: "boolean", short: "v", default: false },
@@ -60,12 +73,34 @@ export async function run(argv, io) {
             io.out(USAGE);
             return command === undefined && !values.help ? 2 : 0;
         }
-        const stacks = values.stack;
-        for (const stack of stacks) {
-            if (!STACK_IDS.includes(stack)) {
+        // `go:backend` names the folder of a monorepo the stack lives in
+        const stackDirectories = {};
+        const stacks = values.stack.map((value) => {
+            const [stack, ...rest] = value.split(":");
+            if (stack === undefined || !STACK_IDS.includes(stack)) {
                 throw new UsageError(`unknown stack ${stack}; expected one of ${STACK_IDS.join(", ")}`);
             }
+            const directory = toPosix(rest.join(":")).replace(/\/+$/, "");
+            if (directory !== "" && directory !== ".")
+                stackDirectories[stack] = directory;
+            return stack;
+        });
+        const platform = values.platform;
+        if (platform !== undefined && platform !== "github" && platform !== "gitlab") {
+            throw new UsageError(`unknown platform ${platform}; expected github or gitlab`);
         }
+        if (platform !== undefined && command !== "init")
+            throw new UsageError("--platform is only for init");
+        const preset = values.preset;
+        if (preset !== undefined && !PRESETS.includes(preset)) {
+            throw new UsageError(`unknown preset ${preset}; expected one of ${PRESETS.join(", ")}`);
+        }
+        if ((preset !== undefined || values.interactive) && command !== "init") {
+            throw new UsageError("--preset and --interactive are only for init");
+        }
+        const to = values.to;
+        if (to !== undefined && command !== "eject")
+            throw new UsageError("--to is only for eject");
         const options = {
             dryRun: values["dry-run"],
             force: values.force,
@@ -73,9 +108,14 @@ export async function run(argv, io) {
             adoptAll: values["adopt-all"],
             accept: values.accept.map(toPosix),
             stacks: stacks,
+            stackDirectories,
             relock: values.relock,
             json: values.json,
             yes: values.yes,
+            ...(platform !== undefined ? { platform } : {}),
+            ...(to !== undefined ? { to } : {}),
+            ...(preset !== undefined ? { preset: preset } : {}),
+            interactive: values.interactive,
         };
         if (command === "init")
             return await initCommand(io.cwd, options, io);
@@ -83,11 +123,18 @@ export async function run(argv, io) {
             return await checkCommand(io.cwd, options, io);
         if (command === "update")
             return await updateCommand(io.cwd, options, io);
+        if (command === "eject")
+            return await ejectCommand(io.cwd, options, io);
         if (command === "github") {
             if (positionals[1] !== "apply")
                 throw new UsageError("usage: repokeeper github apply [--dry-run] [--yes]");
             return await githubApplyCommand(io.cwd, options, io);
         }
+        if (command === "gitlab") {
+            if (positionals[1] !== "apply")
+                throw new UsageError("usage: repokeeper gitlab apply [--dry-run] [--yes]");
+            return await gitlabApplyCommand(io.cwd, options, io);
+        }
         throw new UsageError(`unknown command: ${command}`);
     }
     catch (error) {
@@ -105,10 +152,11 @@ export async function run(argv, io) {
         throw error;
     }
 }
-async function askYesNo(question) {
+async function askYesNo(question, fallback = false) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
     try {
-        return /^y(es)?$/i.test((await rl.question(`${question} [y/N] `)).trim());
+        const answer = (await rl.question(`${question} ${fallback ? "[Y/n]" : "[y/N]"} `)).trim();
+        return answer === "" ? fallback : /^y(es)?$/i.test(answer);
     }
     finally {
         rl.close();

package/dist/commands/context.js

@@ -1,7 +1,30 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { CONFIG_FILE } from "../config/load.js";
+import { ConfigError, UsageError } from "../errors.js";
 import { repoInfo } from "../git.js";
-import { githubPlatform } from "../platforms/github.js";
+import { platformFor } from "../platforms/index.js";
 import { getStackPack } from "../stacks/index.js";
+import { stackDirectory } from "../stacks/support.js";
 export async function buildContext(root, config, repo) {
-    const stacks = await Promise.all(config.stacks.map((id) => getStackPack(id).resolve(root, config.stack_options[id] ?? {})));
-    return { config, stacks, platform: githubPlatform, repo: repo ?? (await repoInfo(root)) };
+    const platform = platformFor(config.platform);
+    const unsupported = config.stacks.find((id) => !platform.stacks.includes(id));
+    if (unsupported) {
+        throw new UsageError(`stack "${unsupported}" is not supported on ${platform.id} yet (supported: ${platform.stacks.join(", ")})`);
+    }
+    const stacks = await Promise.all(config.stacks.map(async (id) => {
+        // `directory` is read here, for every stack alike; the rest of the options are the stack's own
+        const { directory: _directory, ...options } = config.stack_options[id] ?? {};
+        const directory = stackDirectory(id, config.stack_options[id] ?? {});
+        if (directory === undefined)
+            return getStackPack(id).resolve(root, options);
+        if (platform.id !== "github") {
+            throw new UsageError(`a stack in a folder of its own (stack_options.${id}.directory) is not supported on ${platform.id} yet`);
+        }
+        if (!existsSync(join(root, directory))) {
+            throw new ConfigError(`${CONFIG_FILE}: stack_options.${id}.directory: the folder ${directory} does not exist`);
+        }
+        return { ...(await getStackPack(id).resolve(join(root, directory), options)), directory };
+    }));
+    return { config, stacks, platform, repo: repo ?? (await repoInfo(root, config.platform)) };
 }

package/dist/commands/eject.js

@@ -0,0 +1,74 @@
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { parseDocument } from "yaml";
+import { CONFIG_FILE, loadConfig } from "../config/load.js";
+import { UsageError } from "../errors.js";
+import { listWorkflows, readWorkflow } from "../templates.js";
+import { PACKAGE_VERSION, REUSABLE_REPO } from "../version.js";
+import { updateCommand } from "./update.js";
+const WORKFLOWS = ".github/workflows";
+/** Sets `github.workflows.source: local` in place, keeping every comment and the rest of the layout. */
+export function setLocalWorkflows(text) {
+    const doc = parseDocument(text);
+    doc.setIn(["github", "workflows", "source"], "local");
+    // a ref belongs to a repository; the files of this one are called as they are on each commit
+    doc.deleteIn(["github", "workflows", "ref"]);
+    return doc.toString();
+}
+/**
+ * Stops depending on repokeeper's repository for CI.
+ *
+ * Without `--to`: this repository gets its own copies of the reusable workflows its CI and release
+ * call, and the callers are pointed at them. With `--to <folder>`: every reusable workflow is
+ * written into that folder, for a repository of the organisation that the others then call.
+ */
+export async function ejectCommand(root, options, io) {
+    if (options.to !== undefined)
+        return ejectTo(resolve(root, options.to), options, io);
+    const config = await loadConfig(root);
+    if (config.platform !== "github") {
+        throw new UsageError("eject is for GitHub: on GitLab every job is already generated into .gitlab-ci.yml");
+    }
+    const local = {
+        ...config,
+        github: { ...config.github, workflows: { source: "local" } },
+    };
+    const code = await updateCommand(root, options, io, {
+        config: local,
+        async beforeWrite() {
+            const path = join(root, CONFIG_FILE);
+            await writeFile(path, setLocalWorkflows(await readFile(path, "utf8")));
+        },
+    });
+    if (code === 0 && !options.dryRun) {
+        io.out(`the reusable workflows are now files of this repository, under ${WORKFLOWS}/, and yours to maintain`);
+    }
+    return code;
+}
+async function ejectTo(target, options, io) {
+    const directory = join(target, WORKFLOWS);
+    const files = listWorkflows();
+    const existing = files.filter((file) => existsSync(join(directory, file)));
+    if (existing.length > 0 && !options.force) {
+        throw new UsageError(`${existing.map((file) => `${WORKFLOWS}/${file}`).join(", ")} already exist in ${target}; pass --force to replace them`);
+    }
+    for (const file of files)
+        io.out(`${existing.includes(file) ? "replace" : "create "}   ${WORKFLOWS}/${file}`);
+    if (options.dryRun) {
+        io.out("dry run: nothing written");
+        return 0;
+    }
+    await mkdir(directory, { recursive: true });
+    for (const file of files) {
+        await writeFile(join(directory, file), `# Copied from repokeeper ${PACKAGE_VERSION} (https://github.com/${REUSABLE_REPO}).\n${readWorkflow(file)}`);
+    }
+    io.out(`wrote ${files.length} reusable workflows to ${directory}`);
+    io.out("next: commit and push them in that repository, and allow other repositories to call its workflows");
+    io.out("next: in each repository that should call them, add to .repokeeper.yml and run `repokeeper update`:");
+    io.out("        github:");
+    io.out("          workflows:");
+    io.out("            source: your-org/that-repository");
+    io.out("            ref: main   # or a tag or commit of that repository");
+    return 0;
+}

package/dist/commands/github.js

@@ -6,6 +6,8 @@ import { planGithub } from "../github/settings.js";
 /** `repokeeper github apply`: diff the repository's GitHub settings against `github:` and apply on confirmation. */
 export async function githubApplyCommand(root, options, io) {
     const config = await loadConfig(root);
+    if (config.platform !== "github")
+        throw new UsageError(`this repository uses the ${config.platform} platform`);
     const repo = await repoInfo(root);
     if (!repo.owner)
         throw new UsageError("the origin remote is not a GitHub repository");

package/dist/commands/gitlab.js

@@ -0,0 +1,46 @@
+import { loadConfig } from "../config/load.js";
+import { UsageError } from "../errors.js";
+import { repoInfo } from "../git.js";
+import { gitlabRestApi, resolveGitlabToken } from "../gitlab/api.js";
+import { planGitlab } from "../gitlab/settings.js";
+/** `repokeeper gitlab apply`: diff the project's GitLab settings against `gitlab:` and apply on confirmation. */
+export async function gitlabApplyCommand(root, options, io) {
+    const config = await loadConfig(root);
+    if (config.platform !== "gitlab")
+        throw new UsageError(`this repository uses the ${config.platform} platform`);
+    const repo = await repoInfo(root, "gitlab");
+    if (!repo.owner)
+        throw new UsageError("the origin remote is not a GitLab project");
+    const path = `${repo.owner}/${repo.name}`;
+    const host = repo.host ?? "gitlab.com";
+    const api = io.gitlabApi ?? gitlabRestApi(await resolveGitlabToken(host), host);
+    // the jobs that wait for a secret: reported when it is missing, never created
+    const secrets = [
+        ...(config.modules.release ? [{ key: "GITLAB_TOKEN", job: "release" }] : []),
+        ...(config.modules.deps ? [{ key: "RENOVATE_TOKEN", job: "renovate" }] : []),
+    ];
+    const { changes, notes } = await planGitlab(api, path, config.gitlab ?? {}, secrets);
+    if (changes.length === 0)
+        io.out(`GitLab settings of ${path} match .repokeeper.yml`);
+    for (const change of changes)
+        io.out(`change     ${change.setting}: ${change.from} -> ${change.to}`);
+    for (const note of notes)
+        io.out(`note: ${note}`);
+    if (changes.length === 0)
+        return 0;
+    if (options.dryRun) {
+        io.out("dry run: nothing applied");
+        return 0;
+    }
+    const question = `apply ${changes.length} change(s) to ${path}?`;
+    const confirmed = options.yes || (io.confirm ? await io.confirm(question) : false);
+    if (!confirmed) {
+        io.out("nothing applied; pass --yes to apply");
+        return 1;
+    }
+    for (const change of changes) {
+        await change.apply(api);
+        io.out(`applied    ${change.setting}`);
+    }
+    return 0;
+}