repokeeper 0.6.0 → 0.7.0

package/README.md

@@ -6,8 +6,8 @@ the standard evolves.
 
 > Status: early development. Supported stacks: Node.js (including NestJS), Python, Dart and
 > Flutter, shell and PowerShell scripts, Java (Maven and Gradle), Kotlin, .NET, Go, Rust, PHP and
-> Ruby, each with CI and releases, plus GitHub settings through `repokeeper github apply`. GitLab is
-> supported for Node.js and Go projects, with project settings through `repokeeper gitlab apply`. See the
+> Ruby, each with CI and releases, on GitHub and on GitLab, plus repository settings through
+> `repokeeper github apply` and `repokeeper gitlab apply`. See the
 > [design](docs/superpowers/specs/2026-09-25-repokeeper-design.md).
 
 ## How it works
@@ -106,7 +106,7 @@ Requires Node.js 22.12 or newer.
 | [CI and releases](docs/ci-and-releases.md) | The workflows repokeeper writes, pinning or mirroring the reusable workflows, `repokeeper eject`, script linting, release-please, the drift check |
 | [Monorepos](docs/monorepos.md) | Stacks in folders: `stack_options.<stack>.directory`, what runs where, the limits |
 | [GitHub settings](docs/github-settings.md) | `repokeeper github apply`: description, topics, merge settings, security, branch protection |
-| [GitLab](docs/gitlab.md) | What differs on GitLab, the two jobs that need a token, and `repokeeper gitlab apply`: merge settings, branch protection, the Renovate schedule |
+| [GitLab](docs/gitlab.md) | What differs on GitLab, the image each stack's job runs in, how releases write the version, the two jobs that need a token, and `repokeeper gitlab apply`: merge settings, branch protection, the Renovate schedule |
 
 ## Pilots
 

package/dist/cli.js

@@ -3,6 +3,7 @@ import { realpathSync } from "node:fs";
 import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
+import { bumpCommand } from "./commands/bump.js";
 import { checkCommand } from "./commands/check.js";
 import { ejectCommand } from "./commands/eject.js";
 import { githubApplyCommand } from "./commands/github.js";
@@ -23,6 +24,7 @@ export const USAGE = [
     "  github apply  diff the GitHub settings against .repokeeper.yml and apply them",
     "  gitlab apply  the same for a GitLab project: settings, branch protection, the Renovate schedule",
     "  eject   copy the reusable CI workflows into this repository and call them from there",
+    "  bump <version>  write a release's version into the stack's version files (the GitLab release job runs it)",
     "",
     "options:",
     "  --dry-run        show what would change without writing",
@@ -125,6 +127,8 @@ export async function run(argv, io) {
             return await updateCommand(io.cwd, options, io);
         if (command === "eject")
             return await ejectCommand(io.cwd, options, io);
+        if (command === "bump")
+            return await bumpCommand(io.cwd, positionals[1], options, io);
         if (command === "github") {
             if (positionals[1] !== "apply")
                 throw new UsageError("usage: repokeeper github apply [--dry-run] [--yes]");

package/dist/commands/bump.js

@@ -0,0 +1,30 @@
+import { join } from "node:path";
+import { loadConfig } from "../config/load.js";
+import { UsageError } from "../errors.js";
+import { pickReleaseStack } from "../modules/release.js";
+import { bumpVersion } from "../release/bump.js";
+import { buildContext } from "./context.js";
+const VERSION = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+/**
+ * `repokeeper bump <version>`: writes a release's version into the version files of the stack the
+ * repository releases. The GitLab release job runs it, where no release tool knows the stack's files.
+ */
+export async function bumpCommand(root, version, options, io) {
+    if (version === undefined || !VERSION.test(version)) {
+        throw new UsageError("usage: repokeeper bump <version> [--dry-run], with a version such as 1.4.0");
+    }
+    const ctx = await buildContext(root, await loadConfig(root));
+    const stack = pickReleaseStack(ctx.stacks);
+    if (stack === undefined)
+        throw new UsageError("no stack to release");
+    const folder = stack.directory ? join(root, stack.directory) : root;
+    const changed = await bumpVersion(folder, stack.release, version, !options.dryRun);
+    for (const path of changed)
+        io.out(`bumped     ${stack.directory ? `${stack.directory}/${path}` : path}`);
+    if (changed.length === 0) {
+        io.out(`no file of the ${stack.id} stack holds a version to change; the release is its tag`);
+    }
+    if (options.dryRun)
+        io.out("dry run: nothing written");
+    return 0;
+}

package/dist/commands/report.js

@@ -68,9 +68,11 @@ export async function printWarnings(root, ctx, io) {
         }
     }
     if (ctx.platform.id === "gitlab") {
-        const os = ctx.stacks.find((stack) => stack.id === "node")?.ci?.with.os;
-        if (os !== undefined && os !== '["ubuntu-latest"]') {
-            io.out("note: node.os is ignored on gitlab (Linux runners only)");
+        for (const stack of ctx.stacks) {
+            const os = stack.ci?.with.os;
+            if (os !== undefined && os !== '["ubuntu-latest"]') {
+                io.out(`note: ${stack.id}.os is ignored on gitlab (Linux runners only)`);
+            }
         }
         // repokeeper's jobs use GitLab's default stages; a stages list of the user's own replaces those
         let ci = null;

package/dist/platforms/gitlab-jobs.js

@@ -0,0 +1,191 @@
+export const NOT_SCHEDULED = '$CI_PIPELINE_SOURCE != "schedule"';
+/** The checks of a change: merge requests and the default branch, not schedules and not tag pipelines. */
+export const FOR_CHANGES = `${NOT_SCHEDULED} && $CI_COMMIT_TAG == null`;
+const list = (input, key) => JSON.parse(input[key] ?? "[]");
+/** A job per version: the image is named with the matrix variable, so each run pulls its own. */
+function perVersion(image, variable, versions, script, more = {}) {
+    return {
+        stage: "test",
+        image,
+        parallel: { matrix: [{ [variable]: versions }] },
+        rules: [{ if: FOR_CHANGES }],
+        ...more,
+        script,
+    };
+}
+/** A job that runs once. */
+const once = (image, script, more = {}) => ({
+    stage: "test",
+    image,
+    rules: [{ if: FOR_CHANGES }],
+    ...more,
+    script,
+});
+/** The version of shfmt the script stack checks with; the same as in .github/workflows/stack-script.yml. */
+export const SHFMT_VERSION = "3.14.1";
+/** The version of PSScriptAnalyzer the script stack checks with; the same as in stack-script.yml. */
+export const SCRIPT_ANALYZER_VERSION = "1.25.0";
+const SHFMT = `wget -q -O /usr/local/bin/shfmt https://github.com/mvdan/sh/releases/download/v${SHFMT_VERSION}/shfmt_v${SHFMT_VERSION}_linux_amd64
+chmod +x /usr/local/bin/shfmt
+git ls-files -z '*.sh' | xargs -0 -r shfmt -d
+`;
+// the settings file is the repository's own choice of rules; without one, errors and warnings fail the job.
+// Stop on the first error: an analyzer that fails to load would otherwise report no issues and pass
+const SCRIPT_ANALYZER = `pwsh -NoProfile -Command '
+$ErrorActionPreference = "Stop"
+Set-PSRepository PSGallery -InstallationPolicy Trusted
+Install-Module PSScriptAnalyzer -RequiredVersion ${SCRIPT_ANALYZER_VERSION} -Force -Scope CurrentUser
+$issues = if (Test-Path PSScriptAnalyzerSettings.psd1) {
+  Invoke-ScriptAnalyzer -Path . -Recurse -Settings PSScriptAnalyzerSettings.psd1
+} else {
+  Invoke-ScriptAnalyzer -Path . -Recurse -Severity Error, Warning
+}
+$issues | Format-Table -AutoSize
+if ($issues) { exit 1 }
+'
+`;
+/** Composer is not in the php image; neither are the git and unzip it fetches packages with. */
+const COMPOSER = `apt-get update -qq && apt-get install -y -qq git unzip > /dev/null
+php -r "copy('https://getcomposer.org/installer', '/tmp/composer-setup.php');"
+php /tmp/composer-setup.php --quiet --install-dir=/usr/local/bin --filename=composer
+`;
+/**
+ * PowerShell for Linux. Not `mcr.microsoft.com/powershell`: its `latest` stopped at 7.4.2, older than
+ * PSScriptAnalyzer loads on. The .NET SDK image carries a PowerShell that is kept current.
+ */
+const POWERSHELL_IMAGE = "mcr.microsoft.com/dotnet/sdk:10.0";
+/** Newest first, so the image is the newest SDK and the older ones are installed beside it. */
+const newestFirst = (versions) => [...versions].sort((a, b) => b.localeCompare(a, undefined, { numeric: true }));
+/**
+ * The CI jobs of a stack on GitLab: the inputs its GitHub reusable workflow receives, run in a
+ * container image instead of on a runner that a setup action prepares. node and go are in gitlab.ts.
+ */
+export function stackJobs(stack) {
+    const input = stack.ci?.with;
+    if (input === undefined)
+        return [];
+    const commands = list(input, "commands");
+    const install = input["install-command"] ? [input["install-command"]] : [];
+    if (stack.id === "python") {
+        const uv = input.manager === "uv";
+        return [
+            {
+                key: "python",
+                job: perVersion(
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                "python:${PYTHON_VERSION}", "PYTHON_VERSION", list(input, "python-versions"), [...(uv ? ["python -m pip install uv"] : []), ...install, ...commands], 
+                // uv then runs the image's interpreter instead of fetching one of its own choice
+                { variables: { PIP_ROOT_USER_ACTION: "ignore", ...(uv ? { UV_PYTHON: "$PYTHON_VERSION" } : {}) } }),
+            },
+        ];
+    }
+    if (stack.id === "rust") {
+        return [
+            {
+                key: "rust",
+                // the toolchain is installed by name, as on GitHub, so "stable", "beta" and "1.80" all work
+                job: perVersion("rust:latest", "RUST_VERSION", list(input, "rust-versions"), [
+                    'rustup toolchain install "$RUST_VERSION" --profile minimal --component rustfmt,clippy',
+                    'rustup default "$RUST_VERSION"',
+                    ...commands,
+                ]),
+            },
+        ];
+    }
+    if (stack.id === "ruby") {
+        return [
+            {
+                key: "ruby",
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                job: perVersion("ruby:${RUBY_VERSION}", "RUBY_VERSION", list(input, "ruby-versions"), [
+                    ...install,
+                    ...commands,
+                ]),
+            },
+        ];
+    }
+    if (stack.id === "php") {
+        return [
+            {
+                key: "php",
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                job: perVersion("php:${PHP_VERSION}-cli", "PHP_VERSION", list(input, "php-versions"), [
+                    COMPOSER,
+                    ...install,
+                    ...commands,
+                ]),
+            },
+        ];
+    }
+    if (stack.id === "dart") {
+        const flutter = input.flutter === "true";
+        return [
+            {
+                key: "dart",
+                job: perVersion(
+                // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                flutter ? "ghcr.io/cirruslabs/flutter:${SDK_VERSION}" : "dart:${SDK_VERSION}", "SDK_VERSION", list(input, "sdk-versions"), [...install, ...commands]),
+            },
+        ];
+    }
+    if (stack.id === "java" || stack.id === "kotlin") {
+        const image = input["build-tool"] === "maven"
+            ? // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                "maven:3-eclipse-temurin-${JAVA_VERSION}"
+            : input["gradle-version"] === ""
+                ? // the project's own wrapper fetches its Gradle
+                    // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                    "eclipse-temurin:${JAVA_VERSION}-jdk"
+                : // biome-ignore lint/suspicious/noTemplateCurlyInString: a GitLab CI variable
+                    "gradle:jdk${JAVA_VERSION}";
+        return [{ key: stack.id, job: perVersion(image, "JAVA_VERSION", list(input, "java-versions"), commands) }];
+    }
+    if (stack.id === "dotnet") {
+        const [newest = "9.0", ...older] = newestFirst(list(input, "dotnet-versions"));
+        return [
+            {
+                key: "dotnet",
+                // one job with every SDK side by side, as on GitHub: a project may target several of them
+                job: once(`mcr.microsoft.com/dotnet/sdk:${newest}`, [
+                    ...older.map((version) => `curl -fsSL https://dot.net/v1/dotnet-install.sh | bash -s -- --channel ${version} --install-dir /usr/share/dotnet`),
+                    ...commands,
+                ], { variables: { DOTNET_CLI_TELEMETRY_OPTOUT: "1", DOTNET_NOLOGO: "1" } }),
+            },
+        ];
+    }
+    if (stack.id === "script") {
+        const jobs = [];
+        if (input["shell-scripts"] === "true") {
+            jobs.push({
+                key: "shell",
+                job: once("koalaman/shellcheck-alpine:stable", [
+                    "apk add --no-cache git > /dev/null",
+                    "git ls-files -z '*.sh' | xargs -0 -r shellcheck",
+                    SHFMT,
+                ]),
+            });
+        }
+        if (input["powershell-scripts"] === "true") {
+            jobs.push({ key: "powershell", job: once(POWERSHELL_IMAGE, [SCRIPT_ANALYZER]) });
+        }
+        // the image has both bash and pwsh, whichever the test command is written for
+        if (input["test-command"])
+            jobs.push({ key: "script-test", job: once(POWERSHELL_IMAGE, [input["test-command"]]) });
+        return jobs;
+    }
+    return [];
+}
+/** Every key `stackJobs` can write, in the order they appear in .gitlab-ci.yml. */
+export const STACK_JOB_KEYS = [
+    "python",
+    "dart",
+    "shell",
+    "powershell",
+    "script-test",
+    "java",
+    "dotnet",
+    "rust",
+    "kotlin",
+    "php",
+    "ruby",
+];

package/dist/platforms/gitlab.js

@@ -1,6 +1,8 @@
-import { defaultBranch } from "../config/types.js";
-import { MANAGED_HEADER } from "../model.js";
+import { defaultBranch, STACK_IDS } from "../config/types.js";
+import { MANAGED_HEADER, } from "../model.js";
+import { releaseFiles } from "../release/bump.js";
 import { PACKAGE_VERSION, TOOL_VERSIONS } from "../version.js";
+import { FOR_CHANGES, NOT_SCHEDULED, STACK_JOB_KEYS, stackJobs } from "./gitlab-jobs.js";
 const md = (path, body) => ({
     kind: "file",
     module: "health",
@@ -10,7 +12,7 @@ const md = (path, body) => ({
 /** Web address of the GitLab instance the repository lives on. */
 const baseUrl = (repo) => `https://${repo.host ?? "gitlab.com"}`;
 const CI_FILE = ".gitlab-ci.yml";
-const CI_KEYS = ["workflow", "node", "go", "commits", "repokeeper", "renovate", "release"];
+const CI_KEYS = ["workflow", "node", "go", ...STACK_JOB_KEYS, "commits", "repokeeper", "renovate", "release"];
 /** One managed top-level key of .gitlab-ci.yml; keys the user adds are left alone. */
 const ciKey = (module, key, value) => ({
     kind: "yaml",
@@ -20,9 +22,6 @@ const ciKey = (module, key, value) => ({
     value,
     order: CI_KEYS,
 });
-const NOT_SCHEDULED = '$CI_PIPELINE_SOURCE != "schedule"';
-/** The checks of a change: merge requests and the default branch, not schedules and not tag pipelines. */
-const FOR_CHANGES = `${NOT_SCHEDULED} && $CI_COMMIT_TAG == null`;
 /** Image of the jobs that only run tools, whatever Node.js versions the project tests on. */
 const TOOL_IMAGE = "node:24";
 /** The node stack's CI inputs, as the GitHub reusable workflow receives them, as a GitLab job. */
@@ -84,14 +83,16 @@ const json = (value) => `${JSON.stringify(value, null, 2)}\n`;
 /**
  * semantic-release and the plugins it does not bundle, from a scratch directory. It resolves plugins next to
  * itself before it looks in the project, so the project needs none of them installed.
+ *
+ * @param exec Whether the release runs a command of its own (the version bump of a stack npm does not know).
  */
-const SEMANTIC_RELEASE = `dir="$(mktemp -d)"
-(cd "$dir" && echo '{ "private": true }' > package.json && npm install --no-audit --no-fund semantic-release@${TOOL_VERSIONS.semanticRelease} @semantic-release/changelog@${TOOL_VERSIONS.semanticReleaseChangelog} @semantic-release/git@${TOOL_VERSIONS.semanticReleaseGit} @semantic-release/gitlab@${TOOL_VERSIONS.semanticReleaseGitlab} conventional-changelog-conventionalcommits@${TOOL_VERSIONS.conventionalCommitsPreset})
+const semanticRelease = (exec) => `dir="$(mktemp -d)"
+(cd "$dir" && echo '{ "private": true }' > package.json && npm install --no-audit --no-fund semantic-release@${TOOL_VERSIONS.semanticRelease} @semantic-release/changelog@${TOOL_VERSIONS.semanticReleaseChangelog} @semantic-release/git@${TOOL_VERSIONS.semanticReleaseGit} @semantic-release/gitlab@${TOOL_VERSIONS.semanticReleaseGitlab}${exec ? ` @semantic-release/exec@${TOOL_VERSIONS.semanticReleaseExec}` : ""} conventional-changelog-conventionalcommits@${TOOL_VERSIONS.conventionalCommitsPreset})
 "$dir/node_modules/.bin/semantic-release"
 `;
 export const gitlabPlatform = {
     id: "gitlab",
-    stacks: ["node", "go"],
+    stacks: STACK_IDS,
     changeRequest: "merge request",
     profileUrl: (repo) => (repo.owner ? `${baseUrl(repo)}/${repo.owner}` : null),
     securityReport: (repo) => repo.owner
@@ -156,6 +157,10 @@ export const gitlabPlatform = {
         const go = ctx.stacks.find((stack) => stack.id === "go")?.ci;
         if (go)
             jobs.push(ciKey("ci", "go", goJob(go.with)));
+        for (const stack of ctx.stacks) {
+            for (const { key, job } of stackJobs(stack))
+                jobs.push(ciKey("ci", key, job));
+        }
         if (ctx.config.modules.commits) {
             jobs.push(ciKey("ci", "commits", {
                 stage: "test",
@@ -189,10 +194,11 @@ export const gitlabPlatform = {
             ...jobs,
         ];
     },
-    releaseAutomation(ctx) {
+    releaseAutomation(ctx, release) {
         const branch = defaultBranch(ctx.config);
-        // a Go module's version is its tag: there is no file to bump, so the release is the changelog and the tag
-        const npm = ctx.stacks.some((stack) => stack.release.type === "node");
+        const npm = release.type === "node";
+        // the files of the other stacks that hold a version; none for a Go module, whose version is its tag
+        const versionFiles = npm ? [] : releaseFiles(release);
         return [
             {
                 kind: "file",
@@ -208,10 +214,23 @@ export const gitlabPlatform = {
                         ["@semantic-release/changelog", { changelogFile: "CHANGELOG.md" }],
                         // bumps package.json and the npm lock file; publishing stays the project's own business
                         ...(npm ? [["@semantic-release/npm", { npmPublish: false }]] : []),
+                        // semantic-release knows no other stack's version file; repokeeper writes the version into it
+                        ...(versionFiles.length > 0
+                            ? [
+                                [
+                                    "@semantic-release/exec",
+                                    { prepareCmd: `npx --yes repokeeper@${PACKAGE_VERSION} bump \${nextRelease.version}` },
+                                ],
+                            ]
+                            : []),
                         [
                             "@semantic-release/git",
                             {
-                                assets: ["CHANGELOG.md", ...(npm ? ["package.json", "package-lock.json", "npm-shrinkwrap.json"] : [])],
+                                assets: [
+                                    "CHANGELOG.md",
+                                    ...(npm ? ["package.json", "package-lock.json", "npm-shrinkwrap.json"] : []),
+                                    ...versionFiles,
+                                ],
                                 // biome-ignore lint/suspicious/noTemplateCurlyInString: a semantic-release template
                                 message: "chore(release): ${nextRelease.version} [skip ci]",
                             },
@@ -226,7 +245,7 @@ export const gitlabPlatform = {
                 image: TOOL_IMAGE,
                 rules: [{ if: `${NOT_SCHEDULED} && $CI_COMMIT_BRANCH == "${branch}" && $GITLAB_TOKEN` }],
                 variables: { GIT_DEPTH: "0" },
-                script: [SEMANTIC_RELEASE],
+                script: [semanticRelease(versionFiles.length > 0)],
             }),
         ];
     },

package/dist/release/bump.js

@@ -0,0 +1,223 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Writing a release's version into the files of a stack, for a release tool that has no updater per
+ * language: on GitHub release-please does this, on GitLab the release job runs `repokeeper bump`.
+ * Every function here takes the text of a file and returns it with the new version, or null when
+ * the file holds no version of the kind it looks for.
+ */
+const SEMVER = /\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?/;
+/** Replaces the first match of `pattern` in the body of the `[name]` table; group 1 is what precedes the version. */
+function inTomlTable(toml, name, pattern, version) {
+    const header = new RegExp(`^\\[${name.replace(/\./g, "\\.")}\\][^\\n]*$`, "m").exec(toml);
+    if (!header)
+        return null;
+    const start = header.index + header[0].length;
+    const next = /^\[/m.exec(toml.slice(start));
+    const end = next ? start + next.index : toml.length;
+    const body = toml.slice(start, end);
+    if (!pattern.test(body))
+        return null;
+    return toml.slice(0, start) + body.replace(pattern, `$1${version}$2`) + toml.slice(end);
+}
+const TOML_VERSION = /^(version\s*=\s*")[^"]*(")/m;
+/** `version` of `[project]`, or of `[tool.poetry]` for a Poetry project without one. */
+export function bumpPyproject(text, version) {
+    return inTomlTable(text, "project", TOML_VERSION, version) ?? inTomlTable(text, "tool.poetry", TOML_VERSION, version);
+}
+/** `version = x` of `[metadata]` in setup.cfg. */
+export function bumpSetupCfg(text, version) {
+    const header = /^\[metadata\][^\n]*$/m.exec(text);
+    if (!header)
+        return null;
+    const start = header.index + header[0].length;
+    const next = /^\[/m.exec(text.slice(start));
+    const end = next ? start + next.index : text.length;
+    const pattern = /^(version\s*=\s*)\S+/m;
+    const body = text.slice(start, end);
+    // `attr:` and `file:` read the version from elsewhere; there is nothing to write here
+    if (!pattern.test(body) || /^version\s*=\s*(attr|file):/m.test(body))
+        return null;
+    return text.slice(0, start) + body.replace(pattern, `$1${version}`) + text.slice(end);
+}
+/** The `version="x"` argument of `setup()` in setup.py. */
+export function bumpSetupPy(text, version) {
+    const pattern = /(\bversion\s*=\s*["'])[^"']*(["'])/;
+    return pattern.test(text) ? text.replace(pattern, `$1${version}$2`) : null;
+}
+/** `version:` of pubspec.yaml; a build number (`+4`) is kept and counted up, as stores require. */
+export function bumpPubspec(text, version) {
+    const match = /^(version:\s*)(\S+)/m.exec(text);
+    if (!match)
+        return null;
+    const build = /\+(\d+)$/.exec(match[2]);
+    const next = build ? `${version}+${Number(build[1]) + 1}` : version;
+    return text.replace(/^(version:\s*)\S+/m, `$1${next}`);
+}
+/** `version` of `[package]` in Cargo.toml, or of `[workspace.package]` when the package inherits it. */
+export function bumpCargoToml(text, version) {
+    return (inTomlTable(text, "package", TOML_VERSION, version) ?? inTomlTable(text, "workspace.package", TOML_VERSION, version));
+}
+/** The name of the crate at the root, for its entry in Cargo.lock. */
+export function cargoPackageName(cargoToml) {
+    const table = cargoToml.split(/^\[/m).find((part) => part.startsWith("package]")) ?? "";
+    return /^name\s*=\s*"([^"]+)"/m.exec(table)?.[1] ?? null;
+}
+/** The crate's own entry in Cargo.lock, which `cargo build --locked` compares with Cargo.toml. */
+export function bumpCargoLock(text, name, version) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const pattern = new RegExp(`(\\[\\[package\\]\\]\\r?\\nname = "${escaped}"\\r?\\nversion = ")[^"]*(")`);
+    return pattern.test(text) ? text.replace(pattern, `$1${version}$2`) : null;
+}
+/** The top-level `version` of composer.json, when the project keeps one; Composer itself reads tags. */
+export function bumpComposer(text, version) {
+    let current;
+    try {
+        current = JSON.parse(text).version;
+    }
+    catch {
+        return null;
+    }
+    if (typeof current !== "string")
+        return null;
+    const pattern = new RegExp(`("version"\\s*:\\s*")${current.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(")`);
+    return pattern.test(text) ? text.replace(pattern, `$1${version}$2`) : null;
+}
+/** `VERSION = "x"` of a gem's version.rb. */
+export function bumpRubyVersion(text, version) {
+    const pattern = /^(\s*VERSION\s*=\s*["'])[^"']*(["'])/m;
+    return pattern.test(text) ? text.replace(pattern, `$1${version}$2`) : null;
+}
+/** The gem's own entry in Gemfile.lock: the spec of the `PATH` source that is the repository itself. */
+export function bumpGemfileLock(text, version) {
+    const pattern = /(^PATH\r?\n {2}remote: \.\r?\n {2}specs:\r?\n {4}\S+ \()[^)]*(\))/m;
+    return pattern.test(text) ? text.replace(pattern, `$1${version}$2`) : null;
+}
+/** The elements of an XML document in order, without reading comments, CDATA or processing instructions as tags. */
+function* elements(xml) {
+    const token = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<!\w[^>]*>|<(\/?)([\w.:-]+)([^>]*?)(\/?)>/g;
+    const open = [];
+    for (let match = token.exec(xml); match !== null; match = token.exec(xml)) {
+        const [, closing, name, , selfClosing] = match;
+        if (name === undefined || selfClosing === "/")
+            continue;
+        if (closing === "/") {
+            const element = open.pop();
+            if (element === undefined)
+                return;
+            yield { path: [...open.map((e) => e.name), element.name], start: element.start, end: match.index };
+        }
+        else {
+            open.push({ name, start: match.index + match[0].length });
+        }
+    }
+}
+/** Sets the text of the first element whose path ends with (or, when `anchored`, is exactly) `path`. */
+function setElement(xml, path, version, anchored) {
+    for (const element of elements(xml)) {
+        const tail = anchored ? element.path : element.path.slice(-path.length);
+        if (tail.length !== path.length || tail.some((name, index) => name !== path[index]))
+            continue;
+        return xml.slice(0, element.start) + version + xml.slice(element.end);
+    }
+    return null;
+}
+/** `<version>` of the project itself in pom.xml: not the parent's, a dependency's or a plugin's. */
+export function bumpPom(text, version) {
+    return setElement(text, ["project", "version"], version, true);
+}
+/** An element named by a path such as `//Project/PropertyGroup/Version` (the form release-please takes). */
+export function bumpXml(text, xpath, version) {
+    const anchored = !xpath.startsWith("//");
+    const path = xpath.replace(/^\/+/, "").split("/");
+    return path.every((name) => /^[\w.:-]+$/.test(name)) ? setElement(text, path, version, anchored) : null;
+}
+/**
+ * release-please's generic updater: the version on a line marked `x-release-please-version`, and on
+ * every line between `x-release-please-start-version` and `x-release-please-end`.
+ */
+export function bumpMarked(text, version) {
+    let inside = false;
+    let changed = false;
+    const lines = text.split("\n").map((line) => {
+        if (line.includes("x-release-please-start-version")) {
+            inside = true;
+            return line;
+        }
+        if (line.includes("x-release-please-end")) {
+            inside = false;
+            return line;
+        }
+        if ((inside || line.includes("x-release-please-version")) && SEMVER.test(line)) {
+            changed = true;
+            return line.replace(SEMVER, version);
+        }
+        return line;
+    });
+    return changed ? lines.join("\n") : null;
+}
+/** The files that can hold the version of a release, with how each is rewritten. Paths are relative to the stack. */
+function plan(release, version) {
+    const own = [];
+    if (release.type === "python") {
+        own.push({ path: "pyproject.toml", edit: (text) => bumpPyproject(text, version) }, { path: "setup.cfg", edit: (text) => bumpSetupCfg(text, version) }, { path: "setup.py", edit: (text) => bumpSetupPy(text, version) });
+    }
+    else if (release.type === "dart") {
+        own.push({ path: "pubspec.yaml", edit: (text) => bumpPubspec(text, version) });
+    }
+    else if (release.type === "maven") {
+        own.push({ path: "pom.xml", edit: (text) => bumpPom(text, version) });
+    }
+    else if (release.type === "rust") {
+        own.push({ path: "Cargo.toml", edit: (text) => bumpCargoToml(text, version) }, {
+            path: "Cargo.lock",
+            edit: async (text, read) => {
+                const name = cargoPackageName((await read("Cargo.toml")) ?? "");
+                return name ? bumpCargoLock(text, name, version) : null;
+            },
+        });
+    }
+    else if (release.type === "php") {
+        own.push({ path: "composer.json", edit: (text) => bumpComposer(text, version) });
+    }
+    else if (release.type === "ruby") {
+        if (release.versionFile)
+            own.push({ path: release.versionFile, edit: (text) => bumpRubyVersion(text, version) });
+        own.push({ path: "Gemfile.lock", edit: (text) => bumpGemfileLock(text, version) });
+    }
+    const extra = (release.extraFiles ?? []).map((file) => typeof file === "string"
+        ? { path: file, edit: (text) => bumpMarked(text, version) }
+        : { path: file.path, edit: (text) => bumpXml(text, file.xpath, version) });
+    return [...own, ...extra];
+}
+/** Paths, relative to the stack, a release of this kind can change; for the release tool to commit. */
+export function releaseFiles(release) {
+    return [...new Set(plan(release, "0.0.0").map((file) => file.path))];
+}
+/**
+ * Writes `version` into the stack's version files under `root` (the stack's own folder).
+ * Returns the paths it changed (would change, when `write` is off); a file without a version is left as it is.
+ */
+export async function bumpVersion(root, release, version, write = true) {
+    const read = async (path) => {
+        try {
+            return await readFile(join(root, path), "utf8");
+        }
+        catch {
+            return null;
+        }
+    };
+    const changed = [];
+    for (const { path, edit } of plan(release, version)) {
+        const text = await read(path);
+        if (text === null)
+            continue;
+        const next = await edit(text, read);
+        if (next === null || next === text)
+            continue;
+        if (write)
+            await writeFile(join(root, path), next);
+        changed.push(path);
+    }
+    return changed;
+}

package/dist/version.js

@@ -9,6 +9,7 @@ export const TOOL_VERSIONS = {
     semanticRelease: "25.0.9",
     semanticReleaseChangelog: "7.0.0",
     semanticReleaseGit: "11.0.1",
+    semanticReleaseExec: "7.1.0",
     semanticReleaseGitlab: "13.3.3",
     // 10.x needs conventional-changelog-writer 9, and semantic-release 25's notes generator bundles 8
     conventionalCommitsPreset: "9.3.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repokeeper",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Keep every repository on one maintained standard: commits, git hooks, CI, releases, dependency updates and repo settings.",
   "type": "module",
   "bin": {