repokeeper 0.5.0 → 0.7.0

package/.github/workflows/commitlint.yml

@@ -0,0 +1,49 @@
+name: commitlint
+
+on:
+  workflow_call: {}
+
+permissions:
+  contents: read
+
+jobs:
+  commitlint:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+      - name: Install commitlint
+        run: |
+          dir="$RUNNER_TEMP/commitlint"
+          mkdir -p "$dir"
+          cd "$dir"
+          echo '{ "private": true }' > package.json
+          npm install --no-audit --no-fund @commitlint/cli@21.2.3 @commitlint/config-conventional@21.2.3
+          cat > commitlint.config.mjs <<'EOF'
+          export default {
+            extends: ["@commitlint/config-conventional"],
+            rules: { "header-max-length": [2, "always", 100] },
+            // Dependabot writes "Bump x" whatever prefix it is given; its commits carry this sign-off
+            ignores: [(message) => message.includes("Signed-off-by: dependabot[bot] <support@github.com>")],
+          };
+          EOF
+      - name: Check commit messages
+        env:
+          EVENT: ${{ github.event_name }}
+          BASE: ${{ github.event.pull_request.base.sha }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          dir="$RUNNER_TEMP/commitlint"
+          lint() { "$dir/node_modules/.bin/commitlint" --config "$dir/commitlint.config.mjs" --verbose "$@"; }
+          if [ "$EVENT" = "pull_request" ]; then
+            lint --from "$BASE" --to "$HEAD"
+          else
+            lint --last
+          fi

package/.github/workflows/release-please.yml

@@ -0,0 +1,59 @@
+name: release-please
+
+on:
+  workflow_call:
+    secrets:
+      token:
+        description: Token for release-please. GITHUB_TOKEN is used when absent, but its pull requests do not trigger CI.
+        required: false
+    outputs:
+      release_created:
+        description: "'true' when this run created a release"
+        value: ${{ jobs.release-please.outputs.release_created }}
+      tag_name:
+        description: Tag of the release, such as v1.2.0
+        value: ${{ jobs.release-please.outputs.tag_name }}
+      version:
+        description: Version of the release, such as 1.2.0
+        value: ${{ jobs.release-please.outputs.version }}
+      major:
+        description: Major version of the release
+        value: ${{ jobs.release-please.outputs.major }}
+      pr_branch:
+        description: Branch of the release pull request this run opened or updated with GITHUB_TOKEN, whose pull_request runs GitHub holds for approval; empty otherwise
+        value: ${{ jobs.release-please.outputs.pr_branch }}
+
+permissions:
+  contents: read
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+      version: ${{ steps.release.outputs.version }}
+      major: ${{ steps.release.outputs.major }}
+      pr_branch: ${{ steps.pr.outputs.branch }}
+    steps:
+      - id: release
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ secrets.token || github.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+      - name: Release pull request branch
+        id: pr
+        if: steps.release.outputs.prs_created == 'true'
+        env:
+          PR: ${{ steps.release.outputs.pr }}
+          OWN_TOKEN: ${{ secrets.token != '' }}
+        run: |
+          # a pull request opened with the caller's own token starts CI by itself
+          if [ "$OWN_TOKEN" = "false" ]; then
+            echo "branch=$(jq -r .headBranchName <<<"$PR")" >> "$GITHUB_OUTPUT"
+          fi

package/.github/workflows/repokeeper-check.yml

@@ -0,0 +1,30 @@
+name: repokeeper-check
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: repokeeper version to run; the one that wrote the repository's standard
+        type: string
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    name: repokeeper check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: "24"
+      - name: Check the repository against its standard
+        env:
+          VERSION: ${{ inputs.version }}
+        run: npx --yes "repokeeper@$VERSION" check

package/.github/workflows/stack-dart.yml

@@ -0,0 +1,72 @@
+name: stack-dart
+
+on:
+  workflow_call:
+    inputs:
+      sdk-versions:
+        description: JSON list of Dart SDK versions, or Flutter channels when flutter is true
+        type: string
+        default: '["stable"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      flutter:
+        description: '"true" to set up Flutter instead of the Dart SDK'
+        type: string
+        default: "false"
+      install-command:
+        description: Command that fetches the packages
+        type: string
+        default: dart pub get
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["dart format --output=none --set-exit-if-changed .","dart analyze"]'
+      working-directory:
+        description: Directory holding pubspec.yaml
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  dart:
+    name: ${{ inputs.flutter == 'true' && 'flutter' || 'dart' }} ${{ matrix.sdk }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        sdk: ${{ fromJSON(inputs.sdk-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - if: inputs.flutter == 'true'
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
+        with:
+          channel: ${{ matrix.sdk }}
+          cache: true
+      - if: inputs.flutter != 'true'
+        uses: dart-lang/setup-dart@6afc89df92d6eb3834022f73cd65adc8cdfcb92d # v1.8.1
+        with:
+          sdk: ${{ matrix.sdk }}
+      - name: Install dependencies
+        run: ${{ inputs.install-command }}
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-dotnet.yml

@@ -0,0 +1,68 @@
+name: stack-dotnet
+
+on:
+  workflow_call:
+    inputs:
+      dotnet-versions:
+        description: JSON list of .NET SDK versions, all installed side by side
+        type: string
+        default: '["8.0","9.0"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["dotnet restore","dotnet format --verify-no-changes --no-restore","dotnet build --no-restore","dotnet test --no-build"]'
+      working-directory:
+        description: Directory holding the solution or project
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  dotnet:
+    name: dotnet (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+      DOTNET_NOLOGO: "1"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - id: sdks
+        name: List the SDK versions
+        env:
+          VERSIONS: ${{ inputs.dotnet-versions }}
+        run: |
+          {
+            echo "list<<EOF"
+            node -e 'for (const v of JSON.parse(process.env.VERSIONS)) console.log(v)'
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: ${{ steps.sdks.outputs.list }}
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-go.yml

@@ -0,0 +1,59 @@
+name: stack-go
+
+on:
+  workflow_call:
+    inputs:
+      go-versions:
+        description: JSON list of Go versions for actions/setup-go ("stable", "1.24")
+        type: string
+        default: '["stable"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["go vet ./...","go test ./..."]'
+      working-directory:
+        description: Directory holding go.mod
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    name: go ${{ matrix.go }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        go: ${{ fromJSON(inputs.go-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ matrix.go }}
+          # modules without dependencies have no go.sum to key the cache on
+          cache: ${{ hashFiles(format('{0}/go.sum', inputs.working-directory)) != '' }}
+          cache-dependency-path: ${{ inputs.working-directory }}/go.sum
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-java.yml

@@ -0,0 +1,70 @@
+name: stack-java
+
+on:
+  workflow_call:
+    inputs:
+      java-versions:
+        description: JSON list of Java versions (Temurin)
+        type: string
+        default: '["17","21"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      build-tool:
+        description: maven or gradle
+        type: string
+        default: maven
+      gradle-version:
+        description: Gradle version to install; empty to use the wrapper
+        type: string
+        default: ""
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["mvn -B verify"]'
+      working-directory:
+        description: Directory holding the build file
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  java:
+    name: java ${{ matrix.java }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        java: ${{ fromJSON(inputs.java-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.java }}
+          cache: ${{ inputs.build-tool == 'maven' && 'maven' || '' }}
+      - if: inputs.build-tool == 'gradle'
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          gradle-version: ${{ inputs.gradle-version != '' && inputs.gradle-version || 'wrapper' }}
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-node.yml

@@ -0,0 +1,85 @@
+name: stack-node
+
+on:
+  workflow_call:
+    inputs:
+      node-versions:
+        description: JSON list of Node.js versions
+        type: string
+        default: '["22","24"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      package-manager:
+        description: npm, pnpm or yarn
+        type: string
+        default: npm
+      install-command:
+        description: Command that installs dependencies
+        type: string
+        default: npm ci
+      cache:
+        description: setup-node cache, "npm" or empty for none
+        type: string
+        default: npm
+      scripts:
+        description: JSON list of package scripts to run in order
+        type: string
+        default: '["test"]'
+      test-command:
+        description: Extra command run after the scripts
+        type: string
+        default: ""
+      working-directory:
+        description: Directory holding package.json
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  node:
+    name: node ${{ matrix.node }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        node: ${{ fromJSON(inputs.node-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      COREPACK_ENABLE_DOWNLOAD_PROMPT: "0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: ${{ inputs.cache }}
+          cache-dependency-path: ${{ inputs.cache != '' && format('{0}/package-lock.json', inputs.working-directory) || '' }}
+      - name: Enable corepack
+        if: inputs.package-manager != 'npm'
+        run: corepack enable
+      - name: Install dependencies
+        run: ${{ inputs.install-command }}
+      - name: Run scripts
+        env:
+          PM: ${{ inputs.package-manager }}
+          SCRIPTS: ${{ inputs.scripts }}
+        run: |
+          node -e 'for (const s of JSON.parse(process.env.SCRIPTS)) console.log(s)' | while IFS= read -r script; do
+            echo "::group::$PM run $script"
+            "$PM" run "$script" </dev/null
+            echo "::endgroup::"
+          done
+      - name: Run the test command
+        if: inputs.test-command != ''
+        run: ${{ inputs.test-command }}

package/.github/workflows/stack-php.yml

@@ -0,0 +1,66 @@
+name: stack-php
+
+on:
+  workflow_call:
+    inputs:
+      php-versions:
+        description: JSON list of PHP versions
+        type: string
+        default: '["8.3","8.4"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      install-command:
+        description: Command that installs dependencies
+        type: string
+        default: composer install --no-interaction --no-progress
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["composer validate --no-check-publish"]'
+      working-directory:
+        description: Directory holding composer.json
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  php:
+    name: php ${{ matrix.php }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        php: ${{ fromJSON(inputs.php-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer
+          coverage: none
+      - name: Install dependencies
+        env:
+          INSTALL: ${{ inputs.install-command }}
+        run: bash -c "$INSTALL"
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done

package/.github/workflows/stack-python.yml

@@ -0,0 +1,70 @@
+name: stack-python
+
+on:
+  workflow_call:
+    inputs:
+      python-versions:
+        description: JSON list of Python versions
+        type: string
+        default: '["3.11","3.12","3.13"]'
+      os:
+        description: JSON list of runner labels
+        type: string
+        default: '["ubuntu-latest"]'
+      manager:
+        description: pip or uv
+        type: string
+        default: pip
+      install-command:
+        description: Command that installs the project and its check tools
+        type: string
+        default: python -m pip install ruff
+      commands:
+        description: JSON list of shell commands run in order
+        type: string
+        default: '["ruff format --check .","ruff check ."]'
+      working-directory:
+        description: Directory holding the project
+        type: string
+        default: .
+
+permissions:
+  contents: read
+
+jobs:
+  python:
+    name: python ${{ matrix.python }} (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.os) }}
+        python: ${{ fromJSON(inputs.python-versions) }}
+    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+        working-directory: ${{ inputs.working-directory }}
+    env:
+      UV_PYTHON: ${{ matrix.python }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: ${{ matrix.python }}
+      - if: inputs.manager == 'uv'
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+      - name: Install dependencies
+        run: ${{ inputs.install-command }}
+      - name: Run checks
+        env:
+          COMMANDS: ${{ inputs.commands }}
+        run: |
+          node -e 'for (const c of JSON.parse(process.env.COMMANDS)) console.log(c)' | while IFS= read -r command; do
+            echo "::group::$command"
+            bash -c "$command" </dev/null
+            echo "::endgroup::"
+          done