rlsbl 0.67.0 → 0.68.0

package/README.md

@@ -60,6 +60,7 @@ All commands auto-detect targets (versioning) from project files (`package.json`
 | `release edit` | Sync the GitHub Release notes for a given version with the corresponding CHANGELOG.md entry. Defaults to the current version if none is specified. Use --dry-run to preview changes without updating GitHub. |
 | `release undo` | Revert the most recent release by deleting the GitHub Release, removing the git tag from local and remote, and reverting the version bump commit. Requires a manual git push afterward to finalize. |
 | `release yank` | Mark a past release as deprecated (soft yank) or delete it (hard yank). Soft yank marks the GitHub Release as pre-release and prepends a deprecation notice. Hard yank deletes the release entirely while preserving the git tag. |
+| `release scrub` | Scrub sensitive content from git history and update release metadata (JSONL hashes, tags, GitHub Releases). Wraps safegit scrub with automatic post-rewrite cleanup. |
 | **changelog** | Structured changelog management using JSONL entries. Add and generate CHANGELOG.md from per-commit changelog entries stored in unreleased.jsonl for precise, auditable release notes. |
 | `changelog add` | Append a structured changelog entry to the project's unreleased.jsonl file. Each entry includes a human-readable description, an entry type (feature, fix, or breaking), and optional commit hashes linking it to specific changes. The file is auto-committed unless --no-commit is passed. Use --no-user-facing to mark internal changes that should not appear in the published changelog. |
 | `changelog generate` | Compile all validated JSONL changelog entries into a formatted CHANGELOG.md file. Groups entries by type (features, fixes, breaking changes) under the appropriate version heading, preserving existing changelog content for previous releases. Use --dry-run to preview the generated Markdown output without writing to disk, which is useful for reviewing before committing. |
@@ -75,7 +76,7 @@ All commands auto-detect targets (versioning) from project files (`package.json`
 | `monorepo release-order` | Compute and display the topological release order for all projects in the monorepo workspace based on their declared depends-on relationships. Projects with no dependencies are listed first, followed by projects that depend on them, ensuring each project is released only after its dependencies. Detects and reports circular dependency errors. |
 | `monorepo outdated` | Scan all projects in the monorepo workspace for intra-workspace dependencies that reference older versions than what is currently available in the workspace. Lists each outdated dependency with the referenced version and the latest available version, helping identify which downstream projects need a version bump after upstream releases. |
 | `monorepo snapshot` | Generate a committed JSON artifact at .rlsbl-monorepo/snapshot.json summarizing all packages, versions, dependencies, and graph structure. Use --check to verify the snapshot is up-to-date without regenerating it (exits 1 if stale). |
-| `monorepo mirror` | Initialize a subtree mirror repository for a monorepo project. Splits the project's subtree, pushes it to the configured subtree_remote, clones the mirror, scaffolds rlsbl CI, and pushes the result. |
+| `monorepo mirror` | Initialize a subtree mirror repository for a monorepo project by performing a full git subtree split of the project's history, pushing the extracted tree to the configured subtree_remote URL, cloning the resulting standalone mirror repository, running rlsbl scaffold to generate CI workflows for independent publishing, and pushing the scaffolded mirror to its remote. |
 | `monorepo graph` | Export the monorepo dependency graph in JSON, DOT (Graphviz), or indented text tree format. Supports filtering by a root package (transitive deps) or reverse package (transitive rdeps), with optional depth limiting. Use --output to write to a file instead of stdout. |
 | `monorepo impact` | Analyze the impact of changes to a package, file, or git diff range on the monorepo dependency graph. Shows direct and transitive dependents, test scope, and release candidates. Supports package names, file paths, and --since for git-based change detection. |
 | `monorepo release` | Execute a batch release of multiple monorepo packages in topological order. Reads package configurations from .rlsbl-monorepo/releases/unreleased.toml. Each package is released sequentially using the single-package release flow, with leaves (no dependencies) released first. Supports --dry-run, --yes, --allow-dirty flags. |
@@ -139,7 +140,7 @@ Created files are committed automatically by default.
 | `.rlsbl/hooks/pre-checks.sh` | User-customizable pre-checks validation |
 | `.rlsbl/hooks/pre-release.sh` | User-customizable pre-release validation |
 | `.rlsbl/hooks/post-release.sh` | User-customizable post-release actions |
-| `.git/hooks/pre-push` | One-liner: `exec rlsbl pre-push-check "$@"` |
+| `.git/hooks/pre-push` | Captures push refs, runs `rlsbl check --tag prepush` |
 | `.rlsbl/bases/` | Three-way merge bases for scaffold |
 
 **Three-way merge:** Bases are stored at scaffold time. On re-run, user customizations and template updates merge via `git merge-file`. Conflicts get git-style conflict markers.
@@ -169,7 +170,7 @@ rlsbl includes 50 checks across 6 tags.
 | (untagged) | 4 | Additional validation checks |
 
 ```
-rlsbl check --all              # run all 49 checks
+rlsbl check --all              # run all 50 checks
 rlsbl check --tag changelog    # run checks by tag
 rlsbl check --name lock        # run a single check
 ```
@@ -211,17 +212,22 @@ On partial failure, prints a structured summary table with remediation commands
 
 ## Pre-push hook
 
-The `.git/hooks/pre-push` hook calls `rlsbl pre-push-check`, which:
+The `.git/hooks/pre-push` hook captures push refs from git and runs `rlsbl check --tag prepush`, which enforces:
 
-1. Detects project type (`package.json`, `pyproject.toml`, or `VERSION`)
-2. Extracts the current version
-3. Checks that `CHANGELOG.md` contains a `## <version>` heading
-4. Blocks the push if the entry is missing
+1. **Changelog coverage** -- every pushed commit must have a JSONL entry
+2. **Gitignore guard** -- rlsbl-managed files must not be gitignored
+3. **Manual push warning** -- warns when pushing to a release branch outside `rlsbl release`
+4. **Test suite** -- runs project tests (single-project) or affected project tests (monorepo)
+
+Old hooks that call `rlsbl pre-push-check` still work but show a deprecation warning. Run `rlsbl scaffold` to update to the current hook format.
 
 To reinstall manually:
 
 ```
-echo '#!/bin/sh' > .git/hooks/pre-push && echo 'exec rlsbl pre-push-check "$@"' >> .git/hooks/pre-push && chmod +x .git/hooks/pre-push
+echo '#!/usr/bin/env bash' > .git/hooks/pre-push
+echo 'export RLSBL_PUSH_STDIN="$(cat)"' >> .git/hooks/pre-push
+echo 'exec rlsbl check --tag prepush' >> .git/hooks/pre-push
+chmod +x .git/hooks/pre-push
 ```
 
 ## Ecosystem tagging

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rlsbl",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Release orchestration and project scaffolding for npm, PyPI, and Go",
   "license": "MIT",
   "bin": {