rman 1.0.10 → 1.0.12

package/README.md

@@ -327,29 +327,40 @@ precedence: `package.json`'s own `"rman"` key, `.rmanrc.yml` (YAML), `.rmanrc` (
 the dotfile-style name), and `.rmanrc.cjs`/`.rmanrc.mjs`/`.rmanrc.js` for config that needs real
 logic (a JS module's default export).
 
+**Who a declaration is about** follows one rule: unmarked keys configure the package of the
+directory declaring them, and a `"[selector]"` block configures the packages it names. So the
+repository root's own keys are the *root package's* - which is where repo-wide settings are read
+from anyway - and they reach the other packages only through a selector.
+
 ```yaml
 # .rmanrc.yml, at the repository root
 packageManager: pnpm
 logLevel: info
 allowBranch: [main, release/*]
 
-group: true # implicit repo-wide version group by default
-
 version:
   commitMessage: 'chore(release): v{version}'
 
-changelog:
-  ignoreTypes: [chore, ci]
-  tagPattern: 'v*'
-
-run:
-  build:
-    concurrency: 4
-  lint:
-    topo: false
-    bail: false
-  test:
-    changedSince: v1.0.0
+'[*]': # every package in the repository - quotes are required in YAML
+  group: true # implicit repo-wide version group by default
+  changelog:
+    ignoreTypes: [chore, ci]
+    tagPattern: 'v*'
+  clean:
+    include: [build, '../../coverage/${{ pkg.basename }}'] # any string may embed a JS expression
+  run:
+    test: mocha # a bare string is shorthand for { exec: mocha }
+    build:
+      concurrency: 4
+      before: [rman run lint]
+      exec: tsc -b tsconfig-build.json
+      after: node ../../support/postbuild.cjs
+    lint:
+      topo: false
+      bail: false
+
+'[*-dialect]': # a glob over package names, anchored at both ends
+  group: dialects
 ```
 
 ```json
@@ -363,7 +374,7 @@ run:
 ```
 
 See [docs/api.md#configuration-rmanrc-rmanrcyml](docs/api.md#configuration-rmanrc-rmanrcyml) for the
-full key reference (every `run.<script>.*` sub-key, `clean.*`, `changelog.*`, precedence rules,
+full key reference (every `run.<script>.*` sub-key, `clean.*`, `changelog.*`, selector precedence,
 and which keys are root-level-only today).
 
 **Editor autocomplete:** `rman` ships a JSON Schema for `.rmanrc`/`.rmanrc.yml` at

package/constants.js

@@ -1 +1 @@
-export const version = '1.0.10';
+export const version = '1.0.12';

package/core/config.d.ts

@@ -1,3 +1,4 @@
+import semver from 'semver';
 import type { RmanConfig } from '../interfaces/rman-config.interface.js';
 /**
  * Identity helper for authoring a `.rmanrc.cjs`/`.mjs`/`.js` config with full type-checking and
@@ -21,10 +22,131 @@ export declare function defineConfig(config: RmanConfig): RmanConfig;
  */
 export declare function readDirConfig(dirname: string): Promise<RmanConfig>;
 /**
- * Resolves the effective config for `targetDir` by cascading from `rootDir`
- * down to `targetDir` (inclusive), the same way tsconfig's `extends` chain
- * works: each directory level overrides the ones above it. This lets a
- * package (or any intermediate directory) narrow or override the repository's
- * root configuration for itself and everything below it.
+ * Resolves the effective config for the package at `targetDir`, cascading from `rootDir` down to
+ * it (inclusive) - each directory level overrides the ones above it, the way tsconfig's `extends`
+ * chain does.
+ *
+ * Every level contributes in two ways, and the difference is the whole model:
+ *
+ * - **Unmarked keys configure the package of the directory that declares them.** The root's own
+ *   `.rmanrc` therefore configures the *root package* - which is where repo-wide settings
+ *   (`packageManager`, `allowBranch`, `version.*`, `githubRelease.*`) are read from anyway - and
+ *   not, silently, every package under it.
+ * - **A `"[selector]"` block configures the packages it names** (`"[*]"` for all of them,
+ *   `"[*-dialect]"` for a glob over package names). This is the only way a directory speaks about
+ *   anything but its own package.
+ *
+ * Splitting the two matters because the same key means different things to the two audiences. The
+ * clearest case is `run.<script>.postScript`: on a package it's that package's build hook, run in
+ * its own directory; on the root it's a repo-wide bookend run once at the repository root. A
+ * cascade that fed one declaration to both ran a package-relative command (`node
+ * ../../support/postbuild.cjs`) at the root, where it cannot resolve.
+ *
+ * `packageName` is what selectors match against; without it (resolving the root's own config, say)
+ * selector blocks contribute nothing at all.
+ */
+export declare function resolveConfig(rootDir: string, targetDir: string, cache?: Map<string, RmanConfig>, packageName?: string): Promise<RmanConfig>;
+/** A config key naming packages rather than settings: `"[*]"`, `"[*-dialect]"`, `"[pkg-a]"`. The
+ *  brackets are what keep this space from colliding with real config keys - no setting starts with
+ *  one - and in YAML they also mean the key always needs quoting (`"[*]":`), since a bare `[*]`
+ *  parses as a flow sequence. */
+export declare function isSelectorKey(key: string): boolean;
+/** The glob inside a selector key, as a `RegExp` anchored at both ends - so `"[*-dialect]"` matches
+ *  `mysql-dialect` but not `my-dialect-helper`. Glob rather than regex, to match every other
+ *  pattern in rman (`allowBranch`, `changelog.tagPattern`, `clean.include`). */
+export declare function selectorToRegExp(key: string): RegExp;
+/** One package, as an expression sees it - the same shape for the package the config belongs to
+ *  and for the repository itself, so `${{ repository.basename }}` reads the way `${{ pkg.basename }}` does. */
+export interface PackageScope {
+    /** The package's own name, scope included (`@sqb/builder`). */
+    name: string;
+    /** Just the scope (`@sqb`), or `undefined` for an unscoped package. */
+    scope: string | undefined;
+    /** The name with its scope stripped (`builder`). */
+    unscopedName: string;
+    version: string;
+    /** The package directory's last segment (`builder`) - not always the same as `unscopedName`,
+     *  which is why both exist, and usually what a sibling path (`../../coverage/builder`) is keyed on. */
+    basename: string;
+    /** Absolute path to the package's own directory - named as rman's own `Package.dirname` is. */
+    dirname: string;
+    /** That directory relative to the repository root (`packages/builder`), which is what a command
+     *  addressing another package from the root usually needs. Empty string for the root itself. */
+    relativeDir: string;
+    /** The whole `package.json`, as a copy - so an expression can reach a field rman itself has no
+     *  opinion about (`pkg.json.engines.node`). */
+    json: Record<string, unknown>;
+}
+/** Facts about the repository, on top of the root package's own - because the repository root *is*
+ *  a package (`repository.name` is what its `package.json` says, `repository.basename` the directory
+ *  it sits in, and the two genuinely differ). Sharing `PackageScope`'s shape is what makes
+ *  `repository.version` read the way `pkg.version` does. */
+export interface RepositoryScope extends PackageScope {
+    monorepo: boolean;
+    /** Every package in the repository - the root included only when it *is* the one package. */
+    packages: PackageScope[];
+    /** One package by name, or `undefined` - for reaching a sibling's directory. */
+    package(name: string): PackageScope | undefined;
+    /** Read from git only if an expression actually asks for it, then remembered: a repository that
+     *  never mentions these pays nothing, and every command resolves config. All `undefined` outside
+     *  a git checkout, which is a legitimate state rather than an error. */
+    git: GitScope;
+}
+export interface GitScope {
+    branch: string | undefined;
+    sha: string | undefined;
+    shortSha: string | undefined;
+    /** Whether the working tree has uncommitted changes. */
+    dirty: boolean | undefined;
+}
+/** What a `${{ ... }}` expression can see - the bindings of the fresh global it is evaluated in.
+ *  Namespaced rather than a flat bag of loose names: one obvious place per fact, and room to add
+ *  helpers to `pkg`/`repository` later without crowding the global. */
+export interface ConfigScope {
+    /** The package the config was resolved for - which is what lets one declaration at the root
+     *  still say something package-specific. */
+    pkg: PackageScope;
+    repository: RepositoryScope;
+    env: Record<string, string | undefined>;
+    /** rman's own `semver`, for the arithmetic every release config eventually wants
+     *  (`semver.major(pkg.version)`). */
+    semver: typeof semver;
+}
+/**
+ * Evaluates every `${{ ... }}` expression in **every** string value of a resolved config, against
+ * the package it was resolved for:
+ *
+ * ```yaml
+ * "[*]":
+ *   clean:
+ *     include: ["build", "../../coverage/${{ pkg.basename }}"]
+ *   publish:
+ *     docker:
+ *       image: "panates/${{ pkg.basename }}:${{ semver.major(pkg.version) }}"
+ * ```
+ *
+ * Every string, with no list of "interpolated keys" to memorize - a rule with exceptions is a rule
+ * nobody remembers.
+ *
+ * The contents are **real JavaScript**, not a template mini-language, so there is no growing list
+ * of substitutions to keep adding (`{{major}}`, `{{scope}}`, ...) - see `ConfigScope` for what is
+ * in scope.
+ *
+ * **`${{ }}`, deliberately not `{{ }}`.** A config value may legitimately carry `{{...}}` meant for
+ * something else entirely (`helm template --set tag={{.Values.tag}}`); with the plainer delimiter
+ * rman would try to evaluate it. To emit a literal, let an expression produce it, the way GitHub
+ * Actions does: `${{ '${{' }}`.
+ *
+ * A string that is *nothing but* one expression keeps the value's own type (`"${{ pkg.private }}"`
+ * -> a boolean), since otherwise this could only ever produce strings and settings like
+ * `run.<script>.skip` would be unreachable. Embedded in surrounding text it is stringified.
+ *
+ * Evaluation happens in a fresh V8 context holding only the scope's bindings. That is a clean
+ * scope, **not a sandbox** - `node:vm` is explicitly not a security mechanism, and no sandbox is
+ * called for here anyway: a `.rmanrc` that can say `exec: "..."` already runs arbitrary shell, so
+ * the expression evaluator adds no trust boundary that wasn't already wide open.
+ *
+ * A failing expression throws with the config path that holds it, rather than being left in place:
+ * silently passing through a mistake is how a config ends up quietly doing nothing.
  */
-export declare function resolveConfig(rootDir: string, targetDir: string, cache?: Map<string, RmanConfig>): Promise<RmanConfig>;
+export declare function interpolateConfig<T>(config: T, scope: ConfigScope): T;

package/core/config.js

@@ -3,7 +3,9 @@ import * as yaml from 'js-yaml';
 import { createRequire } from 'module';
 import path from 'path';
 import merge from 'putil-merge';
+import semver from 'semver';
 import { pathToFileURL } from 'url';
+import vm from 'vm';
 /**
  * Identity helper for authoring a `.rmanrc.cjs`/`.mjs`/`.js` config with full type-checking and
  * autocomplete - the same `defineConfig` pattern Vite/Vitest use. Returns `config` completely
@@ -85,24 +87,93 @@ export async function readDirConfig(dirname) {
     return result;
 }
 /**
- * Resolves the effective config for `targetDir` by cascading from `rootDir`
- * down to `targetDir` (inclusive), the same way tsconfig's `extends` chain
- * works: each directory level overrides the ones above it. This lets a
- * package (or any intermediate directory) narrow or override the repository's
- * root configuration for itself and everything below it.
+ * Resolves the effective config for the package at `targetDir`, cascading from `rootDir` down to
+ * it (inclusive) - each directory level overrides the ones above it, the way tsconfig's `extends`
+ * chain does.
+ *
+ * Every level contributes in two ways, and the difference is the whole model:
+ *
+ * - **Unmarked keys configure the package of the directory that declares them.** The root's own
+ *   `.rmanrc` therefore configures the *root package* - which is where repo-wide settings
+ *   (`packageManager`, `allowBranch`, `version.*`, `githubRelease.*`) are read from anyway - and
+ *   not, silently, every package under it.
+ * - **A `"[selector]"` block configures the packages it names** (`"[*]"` for all of them,
+ *   `"[*-dialect]"` for a glob over package names). This is the only way a directory speaks about
+ *   anything but its own package.
+ *
+ * Splitting the two matters because the same key means different things to the two audiences. The
+ * clearest case is `run.<script>.postScript`: on a package it's that package's build hook, run in
+ * its own directory; on the root it's a repo-wide bookend run once at the repository root. A
+ * cascade that fed one declaration to both ran a package-relative command (`node
+ * ../../support/postbuild.cjs`) at the root, where it cannot resolve.
+ *
+ * `packageName` is what selectors match against; without it (resolving the root's own config, say)
+ * selector blocks contribute nothing at all.
  */
-export async function resolveConfig(rootDir, targetDir, cache = new Map()) {
+export async function resolveConfig(rootDir, targetDir, cache = new Map(), packageName) {
     const result = {};
+    const target = path.resolve(targetDir);
     for (const dir of dirChain(rootDir, targetDir)) {
         let local = cache.get(dir);
         if (!local) {
             local = await readDirConfig(dir);
             cache.set(dir, local);
         }
-        merge(result, local, { deep: true });
+        // Selectors first, so a directory's own unmarked config still wins over a selector declared
+        // alongside it - "this package" is a more specific statement than "packages matching a glob".
+        if (packageName) {
+            for (const block of matchingSelectors(local, packageName))
+                merge(result, block, { deep: true });
+        }
+        // A directory holding a package speaks for that package only - which is what keeps the root's
+        // own config off every package under it. A directory that holds none (an intermediate
+        // `packages/`, say) has no package to speak for, so its unmarked config can only mean
+        // "everything below" and still cascades.
+        const ownsAPackage = fs.existsSync(path.join(dir, 'package.json'));
+        if (!ownsAPackage || path.resolve(dir) === target)
+            merge(result, stripSelectors(local), { deep: true });
+    }
+    return result;
+}
+/** A config key naming packages rather than settings: `"[*]"`, `"[*-dialect]"`, `"[pkg-a]"`. The
+ *  brackets are what keep this space from colliding with real config keys - no setting starts with
+ *  one - and in YAML they also mean the key always needs quoting (`"[*]":`), since a bare `[*]`
+ *  parses as a flow sequence. */
+export function isSelectorKey(key) {
+    return key.length > 2 && key.startsWith('[') && key.endsWith(']');
+}
+/** The glob inside a selector key, as a `RegExp` anchored at both ends - so `"[*-dialect]"` matches
+ *  `mysql-dialect` but not `my-dialect-helper`. Glob rather than regex, to match every other
+ *  pattern in rman (`allowBranch`, `changelog.tagPattern`, `clean.include`). */
+export function selectorToRegExp(key) {
+    const glob = key.slice(1, -1);
+    const source = glob
+        .split('*')
+        .map(part => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+        .join('.*');
+    return new RegExp(`^${source}$`);
+}
+/** Every selector block in `config` matching `packageName`, in increasing precedence: `"[*]"` first
+ *  and the rest in declaration order - so a specific glob overrides the catch-all, and two equally
+ *  specific ones resolve by the order they were written in. */
+function matchingSelectors(config, packageName) {
+    const matches = [];
+    for (const [key, value] of Object.entries(config)) {
+        if (!isSelectorKey(key) || !value || typeof value !== 'object')
+            continue;
+        if (selectorToRegExp(key).test(packageName))
+            matches.push([key, value]);
     }
+    return matches.sort((a, b) => Number(b[0] === CATCH_ALL) - Number(a[0] === CATCH_ALL)).map(([, block]) => block);
+}
+function stripSelectors(config) {
+    const result = {};
+    for (const [key, value] of Object.entries(config))
+        if (!isSelectorKey(key))
+            result[key] = value;
     return result;
 }
+const CATCH_ALL = '[*]';
 function dirChain(rootDir, targetDir) {
     const rel = path.relative(rootDir, targetDir);
     if (!rel || rel === '.' || rel.startsWith('..'))
@@ -115,3 +186,101 @@ function dirChain(rootDir, targetDir) {
     }
     return dirs;
 }
+/**
+ * Evaluates every `${{ ... }}` expression in **every** string value of a resolved config, against
+ * the package it was resolved for:
+ *
+ * ```yaml
+ * "[*]":
+ *   clean:
+ *     include: ["build", "../../coverage/${{ pkg.basename }}"]
+ *   publish:
+ *     docker:
+ *       image: "panates/${{ pkg.basename }}:${{ semver.major(pkg.version) }}"
+ * ```
+ *
+ * Every string, with no list of "interpolated keys" to memorize - a rule with exceptions is a rule
+ * nobody remembers.
+ *
+ * The contents are **real JavaScript**, not a template mini-language, so there is no growing list
+ * of substitutions to keep adding (`{{major}}`, `{{scope}}`, ...) - see `ConfigScope` for what is
+ * in scope.
+ *
+ * **`${{ }}`, deliberately not `{{ }}`.** A config value may legitimately carry `{{...}}` meant for
+ * something else entirely (`helm template --set tag={{.Values.tag}}`); with the plainer delimiter
+ * rman would try to evaluate it. To emit a literal, let an expression produce it, the way GitHub
+ * Actions does: `${{ '${{' }}`.
+ *
+ * A string that is *nothing but* one expression keeps the value's own type (`"${{ pkg.private }}"`
+ * -> a boolean), since otherwise this could only ever produce strings and settings like
+ * `run.<script>.skip` would be unreachable. Embedded in surrounding text it is stringified.
+ *
+ * Evaluation happens in a fresh V8 context holding only the scope's bindings. That is a clean
+ * scope, **not a sandbox** - `node:vm` is explicitly not a security mechanism, and no sandbox is
+ * called for here anyway: a `.rmanrc` that can say `exec: "..."` already runs arbitrary shell, so
+ * the expression evaluator adds no trust boundary that wasn't already wide open.
+ *
+ * A failing expression throws with the config path that holds it, rather than being left in place:
+ * silently passing through a mistake is how a config ends up quietly doing nothing.
+ */
+export function interpolateConfig(config, scope) {
+    const context = vm.createContext({ ...scope });
+    return walk(config, scope, context, []);
+}
+const EXPRESSION = /\$\{\{([\s\S]*?)\}\}/g;
+function walk(value, scope, context, at) {
+    if (typeof value === 'string')
+        return interpolateString(value, context, at);
+    if (Array.isArray(value))
+        return value.map((item, i) => walk(item, scope, context, [...at, i]));
+    if (value && typeof value === 'object') {
+        const result = {};
+        for (const [key, item] of Object.entries(value))
+            result[key] = walk(item, scope, context, [...at, key]);
+        return result;
+    }
+    return value;
+}
+function interpolateString(value, context, at) {
+    if (!value.includes('${{'))
+        return value;
+    const found = [...value.matchAll(EXPRESSION)];
+    if (!found.length)
+        return value;
+    /** Counted rather than matched with an anchored `^...$` regex: a lazy quantifier still backtracks
+     *  to satisfy an end anchor, so `"${{ a }} and ${{ b }}"` looked like *one* expression whose body
+     *  ran from `a` to `b`, brace-ends and all - invalid JavaScript. */
+    const soleExpression = found.length === 1 && found[0][0] === value.trim();
+    // Alone, a nullish result is just "this setting is unset" - a legitimate answer.
+    if (soleExpression)
+        return evaluate(found[0][1], value, context, at);
+    return value.replace(EXPRESSION, (_, expr) => {
+        const result = evaluate(expr, value, context, at);
+        /** Embedded in text, though, it never is: splicing in the word "undefined" produces a path or
+         *  tag like `app:undefined` that looks plausible and is wrong - the exact silent-mistake shape
+         *  this evaluator exists to avoid. `?? 'fallback'` says what was meant. */
+        if (result === undefined || result === null) {
+            const where = at.length ? formatPath(at) : 'the config root';
+            throw new Error(`Expression in "${where}" is ${result} inside a string: ${value.trim()}\n` +
+                `  \${{${expr}}} has no value here - give it a fallback (\${{${expr.trim()} ?? '...'}}).`);
+        }
+        return String(result);
+    });
+}
+/** Names the config path as well as the expression: an error saying only "x is not defined" sends
+ *  the reader hunting through a file that may hold dozens of them. */
+function evaluate(expr, source, context, at) {
+    try {
+        return vm.runInContext(expr, context, { timeout: EXPRESSION_TIMEOUT });
+    }
+    catch (e) {
+        const where = at.length ? formatPath(at) : 'the config root';
+        throw new Error(`Invalid expression in "${where}": ${source.trim()}\n  ${e?.message ?? e}`, { cause: e });
+    }
+}
+function formatPath(at) {
+    return at.reduce((acc, part) => (typeof part === 'number' ? `${acc}[${part}]` : acc ? `${acc}.${part}` : String(part)), '');
+}
+/** Guards against an expression that never returns (`while(true)`) taking the whole command with
+ *  it - a typo, not an attack, but the failure mode is identical. */
+const EXPRESSION_TIMEOUT = 1000;

package/core/repository.d.ts

@@ -37,9 +37,14 @@ export declare class Repository extends Package {
         hash?: string;
     }): Promise<Record<string, Repository.PackageStatus>>;
     /**
-     * Resolves the effective rman config for the repository root and every
-     * package, cascading root -> intermediate directories -> package directory,
-     * so a `.rmanrc` placed anywhere along that path overrides the levels above it.
+     * Resolves the effective rman config for the repository root and every package, cascading
+     * root -> intermediate directories -> package directory, so a `.rmanrc` placed anywhere along
+     * that path overrides the levels above it.
+     *
+     * Each package is resolved *by name* as well as by directory, since that is what a `"[selector]"`
+     * block matches against - see `resolveConfig`. The root package is resolved by name too: in a
+     * single-package repository it *is* the one package, so `"[*]"` has to reach it; in a monorepo
+     * nothing under `getPackages()` is the root, so only its own unmarked config applies.
      */
     protected _resolveConfigs(): Promise<void>;
     protected _updateDependencies(): void;

package/core/repository.js

@@ -1,8 +1,10 @@
+import { execFileSync } from 'node:child_process';
 import glob from 'fast-glob';
 import fs from 'fs';
 import path from 'path';
+import semver from 'semver';
 import { GitHelper } from '../utils/git.js';
-import { resolveConfig } from './config.js';
+import { interpolateConfig, resolveConfig } from './config.js';
 import { Package } from './package.js';
 export class Repository extends Package {
     dirname;
@@ -87,20 +89,55 @@ export class Repository extends Package {
         return result;
     }
     /**
-     * Resolves the effective rman config for the repository root and every
-     * package, cascading root -> intermediate directories -> package directory,
-     * so a `.rmanrc` placed anywhere along that path overrides the levels above it.
+     * Resolves the effective rman config for the repository root and every package, cascading
+     * root -> intermediate directories -> package directory, so a `.rmanrc` placed anywhere along
+     * that path overrides the levels above it.
+     *
+     * Each package is resolved *by name* as well as by directory, since that is what a `"[selector]"`
+     * block matches against - see `resolveConfig`. The root package is resolved by name too: in a
+     * single-package repository it *is* the one package, so `"[*]"` has to reach it; in a monorepo
+     * nothing under `getPackages()` is the root, so only its own unmarked config applies.
      */
     async _resolveConfigs() {
         const cache = new Map();
-        const rootConfig = await resolveConfig(this.dirname, this.dirname, cache);
-        this.config = rootConfig;
-        this.rootPackage.config = rootConfig;
+        const repoDir = this.dirname;
+        const scopeOf = (pkg) => {
+            // A package.json without a "name" is unusual but legal, and `info` prints such a package
+            // rather than refusing it - so the scope has to survive one too.
+            const name = pkg.name ?? '';
+            const at = name.lastIndexOf('/');
+            return {
+                name,
+                scope: at > 0 ? name.slice(0, at) : undefined,
+                unscopedName: at > 0 ? name.slice(at + 1) : name,
+                version: pkg.version ?? '',
+                basename: path.basename(pkg.dirname),
+                dirname: pkg.dirname,
+                relativeDir: path.relative(this.dirname, pkg.dirname),
+                // A copy: an expression has no business mutating the package rman is about to act on.
+                json: { ...pkg.json },
+            };
+        };
+        const packageScopes = this.packages.map(scopeOf);
+        let gitScope;
+        const repository = {
+            ...scopeOf(this.rootPackage),
+            monorepo: this.monorepo,
+            packages: packageScopes,
+            package: (name) => packageScopes.find(p => p.name === name),
+            // A getter, so a repository whose config never mentions git spawns no git at all - and every
+            // command resolves config, not just the ones that care.
+            get git() {
+                return (gitScope ??= readGitScope(repoDir));
+            },
+        };
+        const withVars = (pkg, config) => interpolateConfig(config, { pkg: scopeOf(pkg), repository, env: { ...process.env }, semver });
+        this.config = withVars(this.rootPackage, await resolveConfig(this.dirname, this.dirname, cache));
         for (const pkg of this.packages) {
-            if (pkg === this.rootPackage)
-                continue;
-            pkg.config = await resolveConfig(this.dirname, pkg.dirname, cache);
+            pkg.config = withVars(pkg, await resolveConfig(this.dirname, pkg.dirname, cache, pkg.name));
         }
+        if (this.monorepo)
+            this.rootPackage.config = this.config;
     }
     _updateDependencies() {
         const deps = {};
@@ -111,7 +148,7 @@ export class Repository extends Package {
                 ...pkg.json.peerDependencies,
                 ...pkg.json.optionalDependencies,
             };
-            const configDeps = pkg.config.packages?.[pkg.name]?.dependencies;
+            const configDeps = pkg.config.dependencies;
             if (configDeps) {
                 if (Array.isArray(configDeps))
                     configDeps.forEach(x => (o[x] = o[x] || '*'));
@@ -205,3 +242,30 @@ function topoSortPackages(packages) {
         return 0;
     });
 }
+/** `git` facts for a `${{ repository.git.* }}` expression. Synchronous on purpose: it backs a lazy
+ *  getter, and a getter cannot await. Everything is `undefined` outside a git checkout - not an
+ *  error, just a repository without one. */
+function readGitScope(dirname) {
+    const run = (args) => {
+        try {
+            return execFileSync('git', args, { cwd: dirname, stdio: ['ignore', 'pipe', 'ignore'] })
+                .toString()
+                .trim();
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const sha = run(['rev-parse', 'HEAD']);
+    if (sha === undefined)
+        return { branch: undefined, sha: undefined, shortSha: undefined, dirty: undefined };
+    const status = run(['status', '--porcelain']);
+    return {
+        // Empty on a detached HEAD, which is what a CI checkout often is - reported as undefined
+        // rather than an empty string, so `?? 'detached'` in an expression works.
+        branch: run(['branch', '--show-current']) || undefined,
+        sha,
+        shortSha: sha.slice(0, 7),
+        dirty: status === undefined ? undefined : status.length > 0,
+    };
+}