rman 1.0.4 → 1.0.6

package/README.md

@@ -91,7 +91,7 @@ worked examples of every single command, see **[docs/cli.md](docs/cli.md)**.
 | [`diff [package]`](#rman-diff-package) | Shows the git diff since a package's (or the repo's) last release tag. |
 | [`changelog`](#rman-changelog) | Generates a changelog per package from unreleased commits. |
 | [`version [bump]`](#rman-version-bump) | Bumps versions of changed packages (and their dependents). |
-| [`publish`](#rman-publish) | Publishes every non-private package not already on the registry. |
+| [`publish`](#rman-publish) | Publishes every package to its configured target(s) - npm and/or Docker. |
 | [`import <path>`](#rman-import-path) | Imports an external git repository as a new package, with history. |
 
 Options shared across several commands:
@@ -264,7 +264,8 @@ algorithm, prerelease semantics, and `"workspace:"` dependency-range handling.
 
 ### `rman publish`
 
-Publishes every non-private package whose local version isn't already on the registry.
+Publishes every package to its configured target(s) - `npm` by default, or whatever each package's
+own `.rmanrc "publish.target"` says (`"npm"`, `"docker"`, or both).
 
 ```bash
 rman publish                              # show the plan, then ask for confirmation
@@ -275,12 +276,17 @@ rman publish --tag next
 rman publish --otp 123456
 rman publish --registry https://registry.example.com --userconfig ./ci.npmrc
 rman publish --package-manager pnpm
+rman publish --target docker              # only the packages configured for the "docker" target
 ```
 
 A `"workspace:*"`/`"workspace:^"`/`"workspace:~"` dependency range is automatically rewritten to a
 real, registry-consumable range immediately before each package's publish, and restored right
 after - see [docs/api.md#publishservice](docs/api.md#publishservice).
 
+A package opts into building/pushing a Docker image via `.rmanrc "publish.target": ["docker"]` plus
+a `"publish.docker"` block (`image`, `platforms`, `buildContexts`, `buildArgs`, ...) - see
+[docs/cli/publish.md#docker-publishing-publishdocker](docs/cli/publish.md#docker-publishing-publishdocker).
+
 ### `rman import <path>`
 
 Imports an external git repository as a new package, preserving its **entire commit history**

package/cli.js

@@ -65,7 +65,7 @@ export async function runCli(options) {
         changedCommand.initCli(repository, program);
         diffCommand.initCli(repository, program);
         importCommand.initCli(repository, program);
-        program.demandCommand(1).strict().completion();
+        program.demandCommand(1).strict().recommendCommands().completion();
         if (!_argv.length)
             program.showHelp();
         else

package/commands/publish.command.js

@@ -1,17 +1,19 @@
 import readline from 'node:readline/promises';
 import colors from 'ansi-colors';
 import { CiService } from '../services/ci.service.js';
+import { DockerPublishService } from '../services/docker-publish.service.js';
 import { PublishService } from '../services/publish.service.js';
 import { applyBranchGuardOptions, assertAllowedBranch, readBranchGuardOptions } from '../utils/branch-guard.js';
 import { applyPackageFilterOptions, readPackageFilterOptions } from '../utils/package-filter.js';
 export function initCli(repository, program) {
     program.command({
         command: 'publish',
-        describe: 'Publishes every non-private package whose local version is not already on the registry',
+        describe: 'Publishes every package to its configured target(s) (npm by default, or .rmanrc "publish.target")',
         builder: cmd => applyBranchGuardOptions(applyPackageFilterOptions(cmd))
             .example('$0 publish', '# Show the plan, then ask for confirmation')
             .example('$0 publish --yes', '# Publish immediately, no confirmation')
             .example('$0 publish --dry-run', '# Only show the plan, never publish')
+            .example('$0 publish --target docker', '# Only the packages configured for the "docker" target')
             .option('yes', {
             alias: 'y',
             describe: 'Skip the confirmation prompt and publish immediately',
@@ -20,6 +22,14 @@ export function initCli(repository, program) {
             .option('dry-run', {
             describe: 'Only show the plan - never publishes, regardless of --yes',
             type: 'boolean',
+        })
+            .option('target', {
+            describe: 'Restrict this run to just these publish target(s) ("npm"/"docker", repeatable) - default: ' +
+                'every target each package itself is configured for (.rmanrc "publish.target", "npm" when unset). ' +
+                'A package that opts into "docker" but has no "publish.docker" config errors clearly instead of ' +
+                'being silently skipped.',
+            type: 'array',
+            choices: ['npm', 'docker'],
         })
             .option('ignore-dirty', {
             describe: 'Exclude a package with uncommitted local changes instead of aborting the whole run',
@@ -53,27 +63,52 @@ export function initCli(repository, program) {
             describe: "Subdirectory to publish from, relative to each package's own directory - only consulted when a " +
                 'package has no "publishConfig.directory" of its own (that always wins when present)',
             type: 'string',
+        })
+            .option('docker-namespace', {
+            describe: 'Prefixed onto a bare (no "/") "publish.docker.image" - default: the DOCKERHUB_NAMESPACE ' +
+                'environment variable.',
+            type: 'string',
         }),
         handler: async (args) => {
             await assertAllowedBranch(repository, readBranchGuardOptions(args));
-            const options = {
+            const targets = resolveTargets(args.target);
+            const explicitDockerTarget = !!args.target?.length && targets.has('docker');
+            const ignoreDirty = args.ignoreDirty;
+            const npmOptions = {
                 ...readPackageFilterOptions(args),
-                ignoreDirty: args.ignoreDirty,
+                ignoreDirty,
                 registry: args.registry,
                 userconfig: args.userconfig,
             };
-            const plan = await PublishService.getPlan(repository, options);
-            printPlan(plan);
-            const errors = plan.filter(e => e.status === 'error');
+            const dockerOptions = {
+                ...readPackageFilterOptions(args),
+                ignoreDirty,
+                namespace: args.dockerNamespace,
+            };
+            const npmPlan = targets.has('npm') ? await PublishService.getPlan(repository, npmOptions) : [];
+            const dockerPlan = targets.has('docker') ? await DockerPublishService.getPlan(repository, dockerOptions) : [];
+            printPlan(npmPlan);
+            printPlan(dockerPlan, 'docker');
+            if (explicitDockerTarget && !dockerPlan.length) {
+                const message = '--target docker was given, but no package\'s .rmanrc configures "publish.docker".';
+                console.log(colors.red(message));
+                const err = new Error(message);
+                err.logged = true;
+                throw err;
+            }
+            const errors = [...npmPlan, ...dockerPlan].filter(e => e.status === 'error');
             if (errors.length) {
-                const message = `${errors.length} package(s) have uncommitted local changes ` +
-                    '(pass --ignore-dirty to exclude them instead of aborting)';
+                const allDirty = errors.every(e => e.reason === 'uncommitted local changes');
+                const message = allDirty
+                    ? `${errors.length} package(s) have uncommitted local changes ` +
+                        '(pass --ignore-dirty to exclude them instead of aborting)'
+                    : `${errors.length} package(s) failed to prepare for publish - see the errors above`;
                 console.log(colors.red(message));
                 const err = new Error(message);
                 err.logged = true;
                 throw err;
             }
-            if (!plan.some(e => e.status === 'publish')) {
+            if (!npmPlan.some(e => e.status === 'publish') && !dockerPlan.some(e => e.status === 'publish')) {
                 console.log(colors.gray('Nothing to publish.'));
                 return;
             }
@@ -89,24 +124,37 @@ export function initCli(repository, program) {
             }
             if (!proceed)
                 return;
-            const applied = await PublishService.applyPlan(repository, plan, {
-                ...options,
-                packageManager: args.packageManager,
-                access: args.access,
-                tag: args.tag,
-                otp: args.otp,
-                contents: args.contents,
-            });
+            const appliedNpm = targets.has('npm')
+                ? await PublishService.applyPlan(repository, npmPlan, {
+                    ...npmOptions,
+                    packageManager: args.packageManager,
+                    access: args.access,
+                    tag: args.tag,
+                    otp: args.otp,
+                    contents: args.contents,
+                })
+                : [];
+            const appliedDocker = targets.has('docker') ? await DockerPublishService.applyPlan(repository, dockerPlan) : [];
             let failed = false;
-            for (const entry of applied) {
+            for (const entry of appliedNpm) {
                 if (entry.status === 'publish') {
                     console.log(colors.green('published'), colors.cyan(entry.package.name), entry.version);
                 }
-                else if (entry.status === 'error' && plan.find(e => e.package === entry.package)?.status === 'publish') {
+                else if (entry.status === 'error' && npmPlan.find(e => e.package === entry.package)?.status === 'publish') {
                     failed = true;
                     console.log(colors.red('failed'), colors.cyan(entry.package.name), colors.red(entry.reason ?? ''));
                 }
             }
+            for (const entry of appliedDocker) {
+                if (entry.status === 'publish') {
+                    console.log(colors.green('published'), colors.gray('[docker]'), colors.cyan(entry.package.name), entry.image);
+                }
+                else if (entry.status === 'error' &&
+                    dockerPlan.find(e => e.package === entry.package)?.status === 'publish') {
+                    failed = true;
+                    console.log(colors.red('failed'), colors.gray('[docker]'), colors.cyan(entry.package.name), colors.red(entry.reason ?? ''));
+                }
+            }
             if (failed) {
                 const err = new Error('"publish" failed');
                 err.logged = true;
@@ -115,9 +163,15 @@ export function initCli(repository, program) {
         },
     });
 }
-function printPlan(entries) {
+function resolveTargets(input) {
+    if (!input?.length)
+        return new Set(['npm', 'docker']);
+    return new Set(input);
+}
+function printPlan(entries, label) {
+    const prefix = label ? colors.gray(`[${label}] `) : '';
     for (const e of entries) {
-        const name = colors.cyan(e.package.name);
+        const name = prefix + colors.cyan(e.package.name);
         switch (e.status) {
             case 'publish':
                 console.log(colors.green('publish'), name, e.version, colors.gray(e.reason ?? ''));

package/commands/version.command.js

@@ -1,5 +1,6 @@
 import readline from 'node:readline/promises';
 import colors from 'ansi-colors';
+import EasyTable from 'easy-table';
 import { VersionService } from '../services/version.service.js';
 import { applyBranchGuardOptions, assertAllowedBranch, readBranchGuardOptions } from '../utils/branch-guard.js';
 import { applyPackageFilterOptions, readPackageFilterOptions } from '../utils/package-filter.js';
@@ -29,6 +30,13 @@ export function initCli(repository, program) {
             type: 'boolean',
         })
             .conflicts('show', 'interactive')
+            .option('yes', {
+            alias: 'y',
+            describe: 'Skip the confirmation prompt and apply the computed plan immediately - auto-detected ' +
+                'severity included, no explicit bump keyword required (same idea as "publish --yes").',
+            type: 'boolean',
+        })
+            .conflicts('yes', 'interactive')
             .option('ignore-dirty', {
             describe: 'Exclude a package with uncommitted local changes instead of aborting the whole run',
             type: 'boolean',
@@ -82,12 +90,12 @@ export function initCli(repository, program) {
                 console.log(colors.gray('Preview only (--show) - nothing was written.'));
                 return;
             }
-            let apply = !!bump;
+            let apply = !!bump || !!args.yes;
             if (args.interactive) {
                 apply = await confirm('Apply these changes?');
             }
-            else if (!bump) {
-                console.log(colors.gray('Run again with an explicit bump, or --interactive, to apply.'));
+            else if (!apply) {
+                console.log(colors.gray('Run again with an explicit bump, --interactive, or --yes, to apply.'));
                 return;
             }
             if (!apply)
@@ -106,23 +114,29 @@ export function initCli(repository, program) {
     });
 }
 function printPlan(entries) {
+    const table = new EasyTable();
     for (const e of entries) {
-        const name = colors.cyan(e.package.name);
-        const group = colors.gray(`(${e.group})`);
-        switch (e.status) {
-            case 'bump':
-                console.log(colors.green('bump'), name, group, e.from, '->', colors.yellow(e.to), colors.gray(e.reason ?? ''));
-                break;
-            case 'no-change':
-                console.log(colors.gray('no-change'), name, group, e.from);
-                break;
-            case 'skip':
-                console.log(colors.cyan('skip'), name, group, colors.gray(e.reason ?? ''));
-                break;
-            case 'error':
-                console.log(colors.red('error'), name, group, colors.red(e.reason ?? ''));
-                break;
-        }
+        table.cell('Status', statusLabel(e.status));
+        table.cell('Package', colors.cyan(e.package.name));
+        table.cell('Group', colors.gray(`(${e.group})`));
+        table.cell('From', e.from);
+        table.cell('', e.status === 'bump' ? '->' : '');
+        table.cell('To', e.status === 'bump' ? colors.yellow(e.to) : '');
+        table.cell('Reason', e.status === 'error' ? colors.red(e.reason ?? '') : colors.gray(e.reason ?? ''));
+        table.newRow();
+    }
+    console.log(table.toString().trim());
+}
+function statusLabel(status) {
+    switch (status) {
+        case 'bump':
+            return colors.green('bump');
+        case 'no-change':
+            return colors.gray('no-change');
+        case 'skip':
+            return colors.cyan('skip');
+        case 'error':
+            return colors.red('error');
     }
 }
 async function confirm(question) {

package/constants.js

@@ -1 +1 @@
-export const version = '1.0.4';
+export const version = '1.0.6';

package/core/config.d.ts

@@ -15,6 +15,7 @@ export interface RmanConfig {
     version?: RmanConfig.VersionOptions;
     changelog?: RmanConfig.ChangelogOptions;
     clean?: RmanConfig.CleanOptions;
+    publish?: RmanConfig.PublishOptions;
     /** Keyed by npm script name (e.g. `"build"`, `"lint"`, `"test"`). */
     run?: Record<string, RmanConfig.RunScriptOptions>;
     /** Keyed by the in-repo package's own name. */
@@ -55,6 +56,39 @@ export declare namespace RmanConfig {
     interface PackageOptions {
         dependencies?: string[] | Record<string, string>;
     }
+    interface PublishOptions {
+        /** Which registries `publish` should target for this package - default `['npm']` (every
+         *  existing repo keeps working unchanged). A package that only ever wants Docker images
+         *  (typically also `"private": true`, since it's not meant for npm at all) sets `['docker']`;
+         *  one that publishes both sets `['npm', 'docker']`. */
+        target?: PublishTarget | PublishTarget[];
+        docker?: DockerPublishOptions;
+    }
+    type PublishTarget = 'npm' | 'docker';
+    /** Required once `"docker"` is one of this package's `publish.target`s - `publish --target
+     *  docker` errors clearly on a package that opts in here but leaves this out. */
+    interface DockerPublishOptions {
+        /** DockerHub image name/repository - bare (e.g. `"my-app"`) to be prefixed with
+         *  `--docker-namespace`/`DOCKERHUB_NAMESPACE`, or already-namespaced (contains a `/`) to use
+         *  verbatim. */
+        image: string;
+        /** Relative to the package's own directory. Default `"Dockerfile"`. */
+        dockerfile?: string;
+        /** Default `["linux/amd64"]`. */
+        platforms?: string[];
+        /** Build `cwd` override, relative to the repository root - only needed when the Dockerfile's
+         *  own `COPY`/`ADD` paths expect something other than the package's own directory (rare). */
+        cwd?: string;
+        /** Named `docker buildx build --build-context <name>=<path>` entries, keyed by name - each
+         *  path is relative to the package's own directory (or absolute). */
+        buildContexts?: Record<string, string>;
+        /** `docker buildx build --build-arg <name>=<value>` entries - a value of exactly `"$NAME"`
+         *  expands to `process.env.NAME` at build time (e.g. to pass a CI secret through). */
+        buildArgs?: Record<string, string>;
+        /** A file (relative to the package's own directory) whose contents become the DockerHub repo's
+         *  full description, if present. Default `"DOCKER_README.md"`. */
+        readme?: string;
+    }
 }
 /**
  * Identity helper for authoring a `.rmanrc.cjs`/`.mjs`/`.js` config with full type-checking and

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "rman",
   "description": "Repository manager",
-  "version": "1.0.4",
+  "version": "1.0.6",
   "author": "Panates",
   "license": "MIT",
   "dependencies": {

package/rmanrc.schema.json

@@ -104,6 +104,25 @@
         }
       }
     },
+    "publish": {
+      "type": "object",
+      "description": "Options for the \"publish\" command/PublishService and DockerPublishService. Per-package cascaded.",
+      "additionalProperties": false,
+      "properties": {
+        "target": {
+          "description": "Which registries \"publish\" targets for this package. Default [\"npm\"]. A package that only ships Docker images (typically also \"private\": true) sets [\"docker\"]; one that publishes both sets [\"npm\", \"docker\"].",
+          "default": ["npm"],
+          "oneOf": [
+            { "$ref": "#/definitions/publishTarget" },
+            { "type": "array", "items": { "$ref": "#/definitions/publishTarget" } }
+          ]
+        },
+        "docker": {
+          "$ref": "#/definitions/dockerPublishConfig",
+          "description": "Required once \"docker\" is one of this package's \"publish.target\"s."
+        }
+      }
+    },
     "run": {
       "type": "object",
       "description": "Per-script options for \"run\"/\"build\"/\"test\"/RunService, keyed by npm script name (e.g. \"build\", \"lint\", \"test\").",
@@ -138,6 +157,52 @@
         { "type": "array", "items": { "type": "string", "minLength": 1 } }
       ]
     },
+    "publishTarget": {
+      "type": "string",
+      "enum": ["npm", "docker"]
+    },
+    "dockerPublishConfig": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["image"],
+      "properties": {
+        "image": {
+          "type": "string",
+          "minLength": 1,
+          "description": "DockerHub image name/repository - bare (e.g. \"my-app\") to be prefixed with --docker-namespace/DOCKERHUB_NAMESPACE, or already-namespaced (contains a \"/\") to use verbatim."
+        },
+        "dockerfile": {
+          "type": "string",
+          "default": "Dockerfile",
+          "description": "Relative to the package's own directory."
+        },
+        "platforms": {
+          "type": "array",
+          "items": { "type": "string" },
+          "default": ["linux/amd64"],
+          "description": "\"docker buildx build --platform\" targets."
+        },
+        "cwd": {
+          "type": "string",
+          "description": "Build cwd override, relative to the repository root - only needed when the Dockerfile's own COPY/ADD paths expect something other than the package's own directory."
+        },
+        "buildContexts": {
+          "type": "object",
+          "additionalProperties": { "type": "string" },
+          "description": "Named \"docker buildx build --build-context <name>=<path>\" entries, keyed by name - each path relative to the package's own directory (or absolute)."
+        },
+        "buildArgs": {
+          "type": "object",
+          "additionalProperties": { "type": "string" },
+          "description": "\"docker buildx build --build-arg <name>=<value>\" entries - a value of exactly \"$NAME\" expands to the NAME environment variable at build time."
+        },
+        "readme": {
+          "type": "string",
+          "default": "DOCKER_README.md",
+          "description": "A file (relative to the package's own directory) whose contents become the DockerHub repo's full description, if present."
+        }
+      }
+    },
     "runScriptConfig": {
       "type": "object",
       "additionalProperties": false,

package/services/docker-publish.service.d.ts

@@ -0,0 +1,52 @@
+import type { Package } from '../core/package.js';
+import type { Repository } from '../core/repository.js';
+import { type PackageFilterOptions } from '../utils/package-filter.js';
+export declare namespace DockerPublishService {
+    /** Injectable "does this tag already exist" check - mainly for tests, so they don't depend on
+     *  network access or a real Docker daemon. Same shape as `PublishService.Deps.npmViewVersion`. */
+    interface Deps {
+        imageExists?: (image: string, tag: string) => Promise<boolean>;
+    }
+    interface Options extends PackageFilterOptions {
+        /** A package with uncommitted local changes is excluded (status `'skip'`) instead of aborting
+         *  the whole plan (status `'error'`) - same as `version`/`publish --target npm`'s own option. */
+        ignoreDirty?: boolean;
+        /** Prefixed onto a bare (no `/`) `publish.docker.image` - falls back to the
+         *  `DOCKERHUB_NAMESPACE` environment variable. */
+        namespace?: string;
+    }
+    type ApplyOptions = Options;
+    /** One package's outcome in a docker-publish plan - see `getPlan`. */
+    interface Entry {
+        package: Package;
+        version: string;
+        status: 'publish' | 'skip' | 'up-to-date' | 'error';
+        /** The fully-qualified `<namespace>/<image>` this entry publishes to - unset only when the
+         *  package's own `publish.docker.image` config is missing entirely (an `'error'` entry). */
+        image?: string;
+        reason?: string;
+    }
+    /**
+     * Computes what `publish --target docker` *would* do. Unlike the npm side (opt-out via
+     * `"private"`), the docker target is opt-in: only packages whose own (cascaded) `.rmanrc
+     * "publish.target"` includes `"docker"` are candidates at all - everything else is left out of
+     * the plan entirely, not shown as `'skip'`, since most packages in a repo aren't docker images.
+     *
+     * A candidate missing the required `publish.docker.image` config is `'error'` - a clear, blocking
+     * misconfiguration (opted into the target, forgot the config) rather than a silent no-op. A
+     * candidate with uncommitted local changes is `'error'` too, unless `options.ignoreDirty`
+     * downgrades it to `'skip'` - same rule the npm side uses. Otherwise, whether `<image>:<version>`
+     * already exists on the registry (via `docker manifest inspect`, queried concurrently) decides
+     * the rest: `'up-to-date'` if so, `'publish'` if not.
+     */
+    function getPlan(repository: Repository, options?: Options, deps?: Deps): Promise<Entry[]>;
+    /**
+     * Publishes every `'publish'` entry in `plan`: one `docker login` and one `docker buildx create`
+     * up front (each package's own build reuses them), then per package a single `docker buildx
+     * build --push` using that package's `publish.docker` config (platforms, named build-contexts,
+     * build-args, an optional `cwd` override). A package's `publish.docker.readme` file (default
+     * `DOCKER_README.md`), if present, updates the DockerHub repo description afterward. A package's
+     * own failure doesn't stop unrelated packages elsewhere in the plan.
+     */
+    function applyPlan(repository: Repository, plan: Entry[]): Promise<Entry[]>;
+}

package/services/docker-publish.service.js

@@ -0,0 +1,192 @@
+import { execFile } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { promisify } from 'node:util';
+import { exec } from '../utils/exec.js';
+import { GitHelper } from '../utils/git.js';
+import { filterPackages } from '../utils/package-filter.js';
+export var DockerPublishService;
+(function (DockerPublishService) {
+    /**
+     * Computes what `publish --target docker` *would* do. Unlike the npm side (opt-out via
+     * `"private"`), the docker target is opt-in: only packages whose own (cascaded) `.rmanrc
+     * "publish.target"` includes `"docker"` are candidates at all - everything else is left out of
+     * the plan entirely, not shown as `'skip'`, since most packages in a repo aren't docker images.
+     *
+     * A candidate missing the required `publish.docker.image` config is `'error'` - a clear, blocking
+     * misconfiguration (opted into the target, forgot the config) rather than a silent no-op. A
+     * candidate with uncommitted local changes is `'error'` too, unless `options.ignoreDirty`
+     * downgrades it to `'skip'` - same rule the npm side uses. Otherwise, whether `<image>:<version>`
+     * already exists on the registry (via `docker manifest inspect`, queried concurrently) decides
+     * the rest: `'up-to-date'` if so, `'publish'` if not.
+     */
+    async function getPlan(repository, options = {}, deps = {}) {
+        const git = new GitHelper({ cwd: repository.dirname });
+        const packages = filterPackages(repository.getPackages({ toposort: true }), options).filter(targetsDocker);
+        const dirtyFiles = await git.listDirtyFiles({ absolute: true });
+        const isDirty = (pkg) => dirtyFiles.some(f => !path.relative(pkg.dirname, f).startsWith('..'));
+        const imageExists = deps.imageExists ?? defaultImageExists;
+        const entries = new Map();
+        const toCheck = [];
+        for (const pkg of packages) {
+            const docker = pkg.config.publish?.docker;
+            if (!docker?.image) {
+                entries.set(pkg.name, {
+                    package: pkg,
+                    version: pkg.version,
+                    status: 'error',
+                    reason: '"docker" is a publish target but "publish.docker.image" is not configured',
+                });
+                continue;
+            }
+            let image;
+            try {
+                image = resolveImageRef(docker.image, options.namespace);
+            }
+            catch (e) {
+                entries.set(pkg.name, { package: pkg, version: pkg.version, status: 'error', reason: e.message });
+                continue;
+            }
+            if (isDirty(pkg)) {
+                entries.set(pkg.name, {
+                    package: pkg,
+                    version: pkg.version,
+                    image,
+                    status: options.ignoreDirty ? 'skip' : 'error',
+                    reason: 'uncommitted local changes',
+                });
+                continue;
+            }
+            toCheck.push({ pkg, image });
+        }
+        await Promise.all(toCheck.map(async ({ pkg, image }) => {
+            const exists = await imageExists(image, pkg.version);
+            entries.set(pkg.name, {
+                package: pkg,
+                version: pkg.version,
+                image,
+                status: exists ? 'up-to-date' : 'publish',
+                reason: exists ? `registry already has ${image}:${pkg.version}` : 'never published',
+            });
+        }));
+        return packages.map(pkg => entries.get(pkg.name));
+    }
+    DockerPublishService.getPlan = getPlan;
+    /**
+     * Publishes every `'publish'` entry in `plan`: one `docker login` and one `docker buildx create`
+     * up front (each package's own build reuses them), then per package a single `docker buildx
+     * build --push` using that package's `publish.docker` config (platforms, named build-contexts,
+     * build-args, an optional `cwd` override). A package's `publish.docker.readme` file (default
+     * `DOCKER_README.md`), if present, updates the DockerHub repo description afterward. A package's
+     * own failure doesn't stop unrelated packages elsewhere in the plan.
+     */
+    async function applyPlan(repository, plan) {
+        const toPublish = plan.filter(e => e.status === 'publish');
+        if (!toPublish.length)
+            return plan;
+        await dockerLogin(repository.dirname);
+        await exec('docker buildx create --use', { cwd: repository.dirname, stdio: 'inherit', throwOnError: false });
+        const result = [];
+        for (const entry of plan) {
+            if (entry.status !== 'publish') {
+                result.push(entry);
+                continue;
+            }
+            try {
+                await buildAndPush(repository, entry);
+                await updateDescription(entry);
+                result.push(entry);
+            }
+            catch (e) {
+                result.push({ ...entry, status: 'error', reason: e.message });
+            }
+        }
+        return result;
+    }
+    DockerPublishService.applyPlan = applyPlan;
+})(DockerPublishService || (DockerPublishService = {}));
+const execFileAsync = promisify(execFile);
+/** `docker manifest inspect <image>:<tag>` - `false` for any failure (tag doesn't exist yet, no
+ *  network, not logged in, ...), same catch-everything shape as `PublishService`'s own
+ *  `defaultNpmViewVersion`. */
+async function defaultImageExists(image, tag) {
+    try {
+        await execFileAsync('docker', ['manifest', 'inspect', `${image}:${tag}`]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function targetsDocker(pkg) {
+    const target = pkg.config.publish?.target;
+    const targets = Array.isArray(target) ? target : target ? [target] : ['npm'];
+    return targets.includes('docker');
+}
+function resolveImageRef(image, namespaceOverride) {
+    if (image.includes('/'))
+        return image;
+    const namespace = namespaceOverride || process.env.DOCKERHUB_NAMESPACE;
+    if (!namespace) {
+        throw new Error(`"publish.docker.image" ("${image}") has no namespace and no --docker-namespace/DOCKERHUB_NAMESPACE is set`);
+    }
+    return `${namespace}/${image}`;
+}
+/** A value of exactly `"$NAME"` expands to `process.env.NAME` (empty string if unset) - anything
+ *  else (including a value with `$` only as part of a larger string) is passed through verbatim. */
+function expandEnvValue(value) {
+    const match = /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(value);
+    return match ? (process.env[match[1]] ?? '') : value;
+}
+async function dockerLogin(cwd) {
+    const username = process.env.DOCKERHUB_USERNAME;
+    const password = process.env.DOCKERHUB_PASSWORD;
+    if (!username || !password) {
+        throw new Error('DOCKERHUB_USERNAME/DOCKERHUB_PASSWORD environment variables are required to publish to Docker');
+    }
+    await exec(`echo "${password}" | docker login --username "${username}" --password-stdin`, { cwd, stdio: 'inherit' });
+}
+async function buildAndPush(repository, entry) {
+    const pkg = entry.package;
+    const docker = pkg.config.publish.docker;
+    const platforms = docker.platforms?.length ? docker.platforms : ['linux/amd64'];
+    const dockerfile = path.resolve(pkg.dirname, docker.dockerfile || 'Dockerfile');
+    const cwd = docker.cwd ? path.resolve(repository.dirname, docker.cwd) : pkg.dirname;
+    const args = ['buildx', 'build', '--platform', platforms.join(',')];
+    for (const [name, dir] of Object.entries(docker.buildContexts ?? {})) {
+        args.push('--build-context', `${name}="${path.resolve(pkg.dirname, dir)}"`);
+    }
+    for (const [name, value] of Object.entries(docker.buildArgs ?? {})) {
+        args.push('--build-arg', `${name}="${expandEnvValue(value)}"`);
+    }
+    args.push('-f', `"${dockerfile}"`, '-t', `"${entry.image}:${entry.version}"`, '-t', `"${entry.image}:latest"`, '--push', '.');
+    await exec(`docker ${args.join(' ')}`, { cwd, stdio: 'inherit' });
+}
+async function updateDescription(entry) {
+    const pkg = entry.package;
+    const docker = pkg.config.publish.docker;
+    const readmeFile = path.join(pkg.dirname, docker.readme || 'DOCKER_README.md');
+    if (!fs.existsSync(readmeFile))
+        return;
+    const username = process.env.DOCKERHUB_USERNAME;
+    const password = process.env.DOCKERHUB_PASSWORD;
+    const loginRes = await fetch('https://hub.docker.com/v2/users/login/', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ username, password }),
+    });
+    if (!loginRes.ok)
+        throw new Error(`DockerHub login (for description update) failed: ${loginRes.status}`);
+    const { token } = await loginRes.json();
+    const slashIdx = entry.image.indexOf('/');
+    const namespace = entry.image.slice(0, slashIdx);
+    const imageName = entry.image.slice(slashIdx + 1);
+    const readme = fs.readFileSync(readmeFile, 'utf-8');
+    const res = await fetch(`https://hub.docker.com/v2/repositories/${namespace}/${imageName}/`, {
+        method: 'PATCH',
+        headers: { Authorization: `JWT ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ description: pkg.json.description, full_description: readme }),
+    });
+    if (!res.ok)
+        throw new Error(`DockerHub description update failed: ${res.status}`);
+}

package/services/list.service.d.ts

@@ -1,3 +1,4 @@
+import type { RmanConfig } from '../core/config.js';
 import type { Repository } from '../core/repository.js';
 import { type PackageFilterOptions } from '../utils/package-filter.js';
 export declare namespace ListService {
@@ -18,6 +19,12 @@ export declare namespace ListService {
         /** In-repo package names this one depends on - enough to build a dependency graph without a
          *  second call, e.g. `Object.fromEntries(items.map(i => [i.name, i.dependencies]))`. */
         dependencies: string[];
+        /** This package's own (cascaded) `.rmanrc "publish.target"` - `["npm"]` when unset, same
+         *  default `publish` itself uses. */
+        publishTargets: RmanConfig.PublishTarget[];
+        /** Present only when `"docker"` is one of `publishTargets` and `publish.docker` is configured -
+         *  the raw `.rmanrc` config, unresolved (no namespace prefixing - see `DockerPublishService`). */
+        docker?: RmanConfig.DockerPublishOptions;
     }
     /** `list`: every package in the repository (or, with `changed`/`changedSince`, only the ones
      *  that have actually changed), each with its version, location, private flag, and change

package/services/list.service.js

@@ -9,14 +9,20 @@ export var ListService;
     async function getPackages(repository, options = {}) {
         const packages = filterPackages(repository.getPackages({ toposort: options.toposort }), options);
         const status = await repository.listStatus({ hash: options.changedSince });
-        let items = packages.map(p => ({
-            name: p.name,
-            version: p.version,
-            location: path.relative(repository.dirname, p.dirname) || '.',
-            private: p.isPrivate,
-            status: status[p.name],
-            dependencies: [...p.dependencies],
-        }));
+        let items = packages.map(p => {
+            const target = p.config.publish?.target;
+            const publishTargets = Array.isArray(target) ? target : target ? [target] : ['npm'];
+            return {
+                name: p.name,
+                version: p.version,
+                location: path.relative(repository.dirname, p.dirname) || '.',
+                private: p.isPrivate,
+                status: status[p.name],
+                dependencies: [...p.dependencies],
+                publishTargets: [...publishTargets],
+                docker: publishTargets.includes('docker') ? p.config.publish?.docker : undefined,
+            };
+        });
         if (options.changed || options.changedSince)
             items = items.filter(it => it.status !== 'clean');
         return items;

package/services.d.ts

@@ -1,6 +1,7 @@
 export { ChangelogService } from './services/changelog.service.js';
 export { CiService } from './services/ci.service.js';
 export { CleanService } from './services/clean.service.js';
+export { DockerPublishService } from './services/docker-publish.service.js';
 export { ExecService } from './services/exec.service.js';
 export { ImportService } from './services/import.service.js';
 export { ListService } from './services/list.service.js';

package/services.js

@@ -1,6 +1,7 @@
 export { ChangelogService } from './services/changelog.service.js';
 export { CiService } from './services/ci.service.js';
 export { CleanService } from './services/clean.service.js';
+export { DockerPublishService } from './services/docker-publish.service.js';
 export { ExecService } from './services/exec.service.js';
 export { ImportService } from './services/import.service.js';
 export { ListService } from './services/list.service.js';