rvlib-shipkit 0.17.0 → 0.17.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.17.2
+
+- **A release no longer probes the world.** The release gate runs only the checks that can BLOCK. A check declaring `blocking: false` cannot change the outcome, so running it spent time and a third party API call per publish to learn whether a DNS provider was reachable. `release.requireHealthy` still makes those failures fatal, and then they run.
+- **The release gate stopped busting the check caches.** 0.17.0's gate ran fresh, so every cached probe refired on every publish. Caching exists to rate-limit exactly those calls.
+- **New `release.skipTasks`.** Names the repo-wide tasks a release does not need, for a monorepo whose commit gate runs every package's suite. Releasing one unit already runs that unit's own tests and typecheck, and the other packages are not in its tarball.
+
+
+## 0.17.1
+
+- **Fixed: `shipkit ci`'s fix pass ignored `defaults: { 'imports:check': false }`** and rewrote every relative import anyway. Reported from a repo that deliberately keeps relative imports: one plain `shipkit ci` rewrote 215 files with no tsconfig paths wired, so typecheck and the tests went red on the gate's own repair. A fix slot repairs the same concern its floor task checks, so one disable governs both directions now.
+- **A disabled fixer says so.** The fix pass had no skipped-by-config vocabulary and printed `ok: fix pass clean` whether a slot was off or merely had nothing to do, so a cold agent read that as "imports are canonical here". Disabled slots print `skip: <id> (skipped-by-config …)`, the same line the task side already prints one row above.
+
 ## 0.17.0
 
 **Correction to 0.16.0.** Its notes and its `--frozen` flag description claimed some combination of flags made `shipkit ci` write nothing. None does: STATUS.md is refreshed on every run unless a caller passes `status: false`. If you wired `ci --no-fix --frozen` into CI expecting a read-only run, it leaves STATUS.md behind, and `--json` is the only output that writes nothing. 0.16.0 also flipped rule SK005 from warning to BLOCKING without saying so: a `link:` dependency that no longer resolves, or a declared dependency that is not installed, now fails the gate.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "rvlib-shipkit",
-    "version": "0.17.0",
+    "version": "0.17.2",
     "description": "All-in-one repo companion: ci gate (task DAG), auto-discovered health checks, release-contract fulfillness, asks queue, md-wiki tools, asset atelier, live tui",
     "license": "MIT",
     "type": "module",

package/src/core/run-check.ts

@@ -36,6 +36,12 @@ export type CheckOpts = {
      *  decides severity and the engine that runs the rules must read the same
      *  object, or a blocking rule failure silently reclassifies as a probe */
     config?: RepoConfig
+    /** run only the checks that can BLOCK. A check declaring blocking:false
+     *  cannot change the outcome, so running it is pure cost: a release does
+     *  not need to know whether a DNS provider is reachable, and probing one
+     *  spends a third-party API call per publish. Undeclared checks are still
+     *  collected, because an unclassified check stays fatal. */
+    onlyBlocking?: boolean
 }
 
 export type CheckRun = {
@@ -78,13 +84,15 @@ export async function collectChecks(root: string, o: CheckOpts = {}): Promise<Ch
         t.failed = false
         t.warned = true
     }
-    for (const rule of [...RULES, ...(c.rules ?? [])])
+    for (const rule of [...RULES, ...(c.rules ?? [])]) {
+        if (o.onlyBlocking === true && !rule.blocking) continue
         suite.addCheck({
             name: rule.title,
             remainValidFor: rule.ttl,
             cacheExtra: rule.cacheKey != null ? () => rule.cacheKey!({ root, config: c }) : undefined,
             logic: async (t) => { await runRuleLint(rule, t, { root, config: c }); demote(t, rule.blocking, rule.title) },
         })
+    }
     const childEnv: Record<string, string | undefined> = {
         ...process.env,
         ...(o.fresh === true ? { SHIPKIT_FRESH: '1', RV_CHECK_FRESH: '1' } : {}),
@@ -95,6 +103,7 @@ export async function collectChecks(root: string, o: CheckOpts = {}): Promise<Ch
         // check is an error, never a guess
         const blocking = d.blocking ?? c.checkDefaults?.blocking
         if (blocking == null) undeclared.push(rel)
+        if (o.onlyBlocking === true && blocking !== true) continue
         suite.addCheck({
             name: d.name,
             remainValidFor: d.selfCached ? undefined : DISCOVERED_TTL,

package/src/core/run-ci.ts

@@ -27,9 +27,11 @@ export type CiOpts = {
     fix?: boolean
     /** also apply the structural SK rule fixers during the fix pass */
     fixRules?: boolean
-    /** bust every check's TTL cache. A release gates with this on: a blocking
-     *  rule replaying a clean pass from hours ago is not a gate. */
-    fresh?: boolean
+    /** run only the checks that can block (core/run-check onlyBlocking) */
+    onlyBlockingChecks?: boolean
+    /** task ids the caller does not need. A sub-unit release skips the tasks
+     *  that gate the whole repo, since the unit's own gate already ran. */
+    skipTaskIds?: string[]
     /** report-only for self-maintaining rules and checks (SHIPKIT_FROZEN
      *  travels to child checks). The release path passes it: a rule that
      *  rewrites package.json between the gate and `npm publish` packs a tree
@@ -76,7 +78,11 @@ export async function runCi(root: string, o: CiOpts = {}): Promise<number> {
     if (o.fix !== false)
         fixFailed = (await runFixPass(root, c, { rules: o.fixRules !== false, print: sink })).failed
     else sink('skip: fix pass (--no-fix)')
-    const { tasks, disabled, unfilled } = allTasks(c, root)
+    const all = allTasks(c, root)
+    const { disabled, unfilled } = all
+    const skipIds = new Set(o.skipTaskIds ?? [])
+    const tasks = all.tasks.filter((t) => !skipIds.has(t.id))
+    for (const t of all.tasks) if (skipIds.has(t.id)) sink(`skip: ${t.id} (not part of this release, the unit's own gate covers it)`)
     for (const d of disabled) sink(`skip: ${d} (skipped-by-config)`)
     // a floor slot nothing could fill is VISIBLE — a thin gate must never
     // look like a full one (the fresh-repo floor gap)
@@ -96,7 +102,7 @@ export async function runCi(root: string, o: CiOpts = {}): Promise<number> {
     // declares whether it blocks, and that is the only question about it.
     const checks = o.skipChecks === true
         ? { lines: [], blocked: false, advisoryFailures: [], undeclared: [] }
-        : await collectChecks(root, { status: false, config: c, frozen: o.frozen, fresh: o.fresh })
+        : await collectChecks(root, { status: false, config: c, frozen: o.frozen, onlyBlocking: o.onlyBlockingChecks })
     const color = process.stdout.isTTY && process.env.NO_COLOR == null
     for (const l of checks.lines) { collected.push(formatLine(l, false)); print(formatLine(l, color)) }
     for (const u of checks.undeclared) {

package/src/core/run-fixers.ts

@@ -27,13 +27,21 @@ export type FixerResolution = {
     slots: FixerSlot[]
     /** slots nothing could fill, printed, never silent */
     unfilled: { id: string; reason: string }[]
+    /** slots the repo turned off, printed with the same vocabulary the task
+     *  side uses, so a disable is never invisible in the output */
+    disabled: { id: string; reason: string }[]
 }
 
+// a fix slot repairs the same concern a floor task checks, so ONE disable
+// governs both. Turning a check off and having the fixer rewrite the files
+// anyway is the config saying one thing and the tool doing another.
+const GOVERNED_BY: Record<string, string> = { 'imports:fix': 'imports:check' }
+
 // one fixer per mechanical concern. `fmt` accepts the two names the house
 // vocabulary allows so a repo that calls it `format` is not silently unfixed.
 const FMT_SCRIPTS = ['fmt', 'format'] as const
 
-export function resolveFixers(root: string): FixerResolution {
+export function resolveFixers(root: string, config?: RepoConfig): FixerResolution {
     const pkgPath = join(root, 'package.json')
     let scripts: Record<string, string> = {}
     if (existsSync(pkgPath)) {
@@ -42,19 +50,28 @@ export function resolveFixers(root: string): FixerResolution {
     }
     const slots: FixerSlot[] = []
     const unfilled: { id: string; reason: string }[] = []
+    const disabled: { id: string; reason: string }[] = []
+    const offByConfig = (id: string): boolean => {
+        const governing = GOVERNED_BY[id]
+        if (governing == null) return false
+        if (config?.defaults?.[governing] !== false) return false
+        disabled.push({ id, reason: `skipped-by-config (defaults: { '${governing}': false })` })
+        return true
+    }
 
     const fmtName = FMT_SCRIPTS.find((n) => scripts[n] != null)
     if (fmtName != null) slots.push({ id: 'fmt', cmd: ['bun', 'run', fmtName], source: 'package.json script' })
     else unfilled.push({ id: 'fmt', reason: `no 'fmt' or 'format' script — formatting stays a manual step` })
 
-    if (scripts['imports:fix'] != null) slots.push({ id: 'imports:fix', cmd: ['bun', 'run', 'imports:fix'], source: 'package.json script' })
+    if (offByConfig('imports:fix')) { /* the repo said no, in the one place that governs both directions */ }
+    else if (scripts['imports:fix'] != null) slots.push({ id: 'imports:fix', cmd: ['bun', 'run', 'imports:fix'], source: 'package.json script' })
     else {
         let cli: string | null = null
         try { cli = fileURLToPath(import.meta.resolve('rvlib-ts-tools/src/cli.ts')) } catch { cli = null }
         if (cli == null) unfilled.push({ id: 'imports:fix', reason: `no 'imports:fix' script and rvlib-ts-tools is unresolvable` })
         else slots.push({ id: 'imports:fix', cmd: ['bun', cli, 'imports', '--fix'], source: 'built-in (rvlib-ts-tools)' })
     }
-    return { slots, unfilled }
+    return { slots, unfilled, disabled }
 }
 
 /** worktree fingerprint: every dirty path mapped to `<status>:<content hash>`,
@@ -103,8 +120,9 @@ export async function runFixPass(root: string, config: RepoConfig, o: FixPassOpt
     // verify mode: same fixers, but rewriting anything means the COMMIT was
     // not clean, and the gate says so instead of quietly repairing it
     const verify = process.env.CI != null && process.env.CI !== ''
-    const { slots, unfilled } = resolveFixers(root)
+    const { slots, unfilled, disabled } = resolveFixers(root, config)
     for (const u of unfilled) o.print(`skip: ${u.id} (${u.reason})`)
+    for (const d of disabled) o.print(`skip: ${d.id} (${d.reason})`)
     const before = treeState(root)
 
     for (const s of slots) {

package/src/release/run-release.ts

@@ -39,6 +39,11 @@ export type ReleaseConfig = {
     /** repo-relative tsconfig for the ROOT unit's own typecheck (default
      *  '<root>/tsconfig.json' when it exists) */
     tsconfig?: string
+    /** task ids the release gate skips. A monorepo's repo-wide task (every
+     *  package's suite, a full matrix build) re-proves for six units what the
+     *  released unit's own gate already proved for one. Naming them here is
+     *  the repo saying which tasks are about the REPO rather than the release. */
+    skipTasks?: string[]
     /** `shipkit bump` run from a feature branch merges it into the release
      *  branch first, with a merge commit. Default true. A branch is a GATE, so
      *  this is deliberately reachable ONLY by running bump by hand. */
@@ -92,11 +97,13 @@ export async function runReleaseGate(root: string, config: RepoConfig, print: (l
         fix: o.fix ?? false,
         frozen: true,
         status: false,
-        // a release must not gate on a clean pass cached hours ago: SK005's
-        // blocking branches are local facts (a link: that stopped resolving, a
-        // dep nobody installed) and a TTL replays them as green
-        fresh: true,
         config,
+        // a check that cannot block cannot change the outcome, so a release
+        // never probes the world: publishing a lib does not depend on whether
+        // a DNS provider answers, and asking spends an API call per publish.
+        // requireHealthy is the repo saying it wants them fatal, so then they run.
+        onlyBlockingChecks: config.release?.requireHealthy !== true,
+        skipTaskIds: config.release?.skipTasks ?? [],
         failOnAdvisory: config.release?.requireHealthy === true,
         print: (l) => print(`      ${l}`),
     })