trustci 0.3.0 → 0.3.1

package/README.md

@@ -10,7 +10,7 @@ Setting up trusted publishing one package at a time is tedious in a monorepo.
 
 ## Requirements
 
-- **npm** 11.5.1 or later (for `npm trust`)
+- **npm** 11.15.0 or later (for `npm trust` with `--allow-publish` / `--allow-stage-publish`)
 - **Node** 22.14.0 or later
 
 ## Usage
@@ -32,7 +32,7 @@ npx trustci list
 | ---------- | ---------------------------------------------------------------------------------------------- | --------------- |
 | `github`   | `--repo <owner/repo>` `--file <workflow>`                                                       | `--env <name>`  |
 | `gitlab`   | `--project <group/project>` (or `--repo`) `--file <workflow>`                                   | `--env <name>`  |
-| `circleci` | Either all of `--org-id` `--project-id` `--pipeline-definition-id`, or a CircleCI token | `--vcs-origin <host/owner/repo>`, `--circle-token`, `--file`, `--context-id` (repeatable) |
+| `circleci` | A CircleCI token, or all of `--org-id` `--project-id` `--pipeline-definition-id` | `--vcs-origin <host/owner/repo>` (inferred), `--circle-token`, `--file`, `--context-id` (repeatable) |
 
 At least one of `--allow-publish` / `--allow-stage-publish` is required.
 
@@ -40,7 +40,12 @@ At least one of `--allow-publish` / `--allow-stage-publish` is required.
 # GitLab
 npx trustci --provider gitlab --project me/repo --file .gitlab-ci.yml --allow-publish -y
 
-# CircleCI (vcs-origin is host/owner/repo; a leading https:// is stripped automatically)
+# CircleCI — minimal form: UUIDs are resolved via the API and --vcs-origin
+# is inferred, so a token (here via the environment) is all you need to add
+CIRCLE_TOKEN=... npx trustci --provider circleci --allow-publish
+
+# CircleCI — fully explicit form
+# (vcs-origin is host/owner/repo; a leading https:// is stripped automatically)
 npx trustci --provider circleci \
   --org-id <uuid> --project-id <uuid> --pipeline-definition-id <uuid> \
   --vcs-origin github.com/me/repo \
@@ -73,6 +78,22 @@ prints which one it used (never the token itself):
 The OS keychain, where circleci CLI v1 and chunk store tokens by default, is not read.
 When all three UUIDs are given, no token is looked up.
 
+#### CircleCI pipeline definitions and `--file`
+
+A missing `--pipeline-definition-id` is resolved by listing the project's
+pipeline definitions. When there is exactly one, it is used automatically.
+When the project has several — e.g. a config sourced from another repository
+alongside `.circleci/config.yml` — pass `--file` with either the definition's
+config file path or its name; the error message lists the candidates:
+
+```bash
+npx trustci --provider circleci --allow-publish \
+  --file workflows/publish/npm-polyrepo-bun-semantic-release.yaml
+```
+
+`--file` is only used for this lookup — it is not passed to `npm trust`, and
+it has no effect when `--pipeline-definition-id` is given explicitly.
+
 ### Common options
 
 | Flag                     | Description                                          |
@@ -95,6 +116,18 @@ Patterns are read from the first of:
 Packages marked `"private": true` are always excluded. On a real (non-dry) run,
 packages not yet published to the registry are skipped with a warning.
 
+## Agent skill
+
+The repository ships an [Agent Skill](https://agentskills.io/) at
+[`skills/trustci/SKILL.md`](https://github.com/hideokamoto/trustci/blob/main/skills/trustci/SKILL.md)
+that teaches coding agents (Claude Code, Codex, Cursor, …) to run trustci safely:
+dry-run first, then a real run only after you confirm. Install it with the
+[`skills`](https://github.com/vercel-labs/skills) CLI:
+
+```bash
+npx skills add hideokamoto/trustci
+```
+
 ## Development
 
 Built with [Bun](https://bun.sh), ships zero runtime dependencies, and the
@@ -107,6 +140,15 @@ bun run typecheck
 bun run build   # -> dist/cli.js (npx entry point), via `bun build --target node`
 ```
 
+The documentation site lives in `docs/` ([Astro Starlight](https://starlight.astro.build/)):
+
+```bash
+cd docs
+bun install
+bun run dev     # local preview
+bun run build   # -> docs/dist
+```
+
 `bun install` also enables a husky `commit-msg` hook that runs
 [commitlint](https://commitlint.js.org/) with `@commitlint/config-conventional`,
 so every commit must be a [Conventional Commit](https://www.conventionalcommits.org/).

package/dist/cli.js

@@ -438,7 +438,7 @@ async function resolveCircleciOptions(parsed, deps = defaultResolveDeps) {
 
 // src/npm.ts
 var MIN_NODE = "22.14.0";
-var MIN_NPM = "11.5.1";
+var MIN_NPM = "11.15.0";
 function cmpVersion(a, b) {
   const pa = a.split(".").map((n) => parseInt(n, 10) || 0);
   const pb = b.split(".").map((n) => parseInt(n, 10) || 0);
@@ -723,6 +723,9 @@ function discoverPackages(root) {
   const dirs = expandPatterns(root, patterns);
   const all = [];
   const seen = new Set;
+  if (existsSync(path2.join(root, "pnpm-workspace.yaml"))) {
+    dirs.unshift(path2.resolve(root));
+  }
   for (const dir of dirs) {
     const pkg = readPkg(dir);
     if (pkg && !seen.has(pkg.name)) {
@@ -750,7 +753,7 @@ function filterPackages(all, only, exclude) {
   });
 }
 // package.json
-var version = "0.3.0";
+var version = "0.3.1";
 
 // src/cli.ts
 var VERSION = version;
@@ -760,6 +763,11 @@ Usage:
   trustci [trust] --provider <github|gitlab|circleci> [provider flags] [options]
   trustci list [package] [--dry-run]
 
+Commands:
+  trust      register a trusted publisher for every public workspace package
+             (the default; "trust" may be omitted)
+  list       run \`npm trust list\` for <package>, or for every public workspace package
+
 Providers:
   github     --repo <owner/repo> --file <workflow> [--env <name>]
   gitlab     --project <group/project> --file <workflow> [--env <name>]
@@ -769,34 +777,43 @@ Providers:
              [--context-id <uuid> ...]
              --vcs-origin defaults to the root package.json "repository", then
              \`git remote get-url origin\`.
-             Missing UUIDs are resolved via CircleCI API v2 using a token from
-             --circle-token, $CIRCLE_TOKEN, $CIRCLECI_TOKEN, $CIRCLE_CLI_TOKEN,
-             $CIRCLECI_CLI_TOKEN, or ~/.circleci/cli.yml (in that order).
+             Missing UUIDs are resolved via CircleCI API v2 (also under --dry-run)
+             using a token from --circle-token, $CIRCLE_TOKEN, $CIRCLECI_TOKEN,
+             $CIRCLE_CLI_TOKEN, $CIRCLECI_CLI_TOKEN, or ~/.circleci/cli.yml (in that order).
              Explicit UUIDs override auto-resolution; with all three, no token is needed.
+             --file selects the pipeline definition by config path or name (needed
+             when the project has more than one); it is not passed to npm trust.
 
 Permissions (at least one required):
   --allow-publish           allow npm publish
   --allow-stage-publish     allow npm stage publish
 
 Options:
-  --dry-run                 print the npm trust commands without executing them
+  --dry-run                 print the npm commands without executing them
   --only <name-glob>        only include packages matching (repeatable)
   --exclude <name-glob>     exclude packages matching (repeatable)
-  -y, --yes                 skip the confirmation prompt (and npm's)
+                            globs match the whole name; * also matches "/"
+  -y, --yes                 skip the confirmation prompt (and npm's);
+                            required when stdin is not a terminal
   -h, --help                show this help
   -v, --version             show the trustci version
 
 Workspaces are detected from pnpm-workspace.yaml, package.json "workspaces",
 or lerna.json. If no workspace config is found, the root package.json is used
 as a single-package fallback. Private packages ("private": true) are always excluded.
+On a real run, packages not yet published to the registry are skipped.
 
 Examples:
   trustci --dry-run --provider github --repo me/repo --file release.yml --allow-publish
   trustci --provider gitlab --project me/repo --file .gitlab-ci.yml --allow-publish -y
   CIRCLE_TOKEN=... trustci --provider circleci --allow-publish
+  trustci --provider circleci --file .circleci/config.yml --allow-publish
   trustci --provider circleci --org-id <uuid> --project-id <uuid> \\
     --pipeline-definition-id <uuid> --vcs-origin github.com/me/repo --allow-publish
   trustci list
+
+Requires npm >= 11.15.0 and Node >= 22.14.0.
+Documentation: https://trustci.hidetaka.dev
 `;
 async function confirm(question) {
   const rl = createInterface({ input: process2.stdin, output: process2.stderr });
@@ -844,6 +861,9 @@ async function runTrust(parsed) {
   const candidates = filterPackages(all, parsed.only, parsed.exclude);
   if (candidates.length === 0) {
     console.error(`No public packages matched (out of ${all.length} discovered via ${source}).`);
+    for (const pkg of all) {
+      console.error(`  - ${pkg.name}${pkg.private ? " (private)" : ""}`);
+    }
     return 1;
   }
   console.error(`Detected ${all.length} package(s) via ${source}; ${candidates.length} public after filters.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustci",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Bulk-register npm Trusted Publishers (npm trust) across all public packages in a monorepo. Supports GitHub, GitLab and CircleCI.",
   "type": "module",
   "bin": {
@@ -11,7 +11,7 @@
   ],
   "engines": {
     "node": ">=22.14.0",
-    "npm": ">=11.5.1"
+    "npm": ">=11.15.0"
   },
   "scripts": {
     "build": "bun build src/cli.ts --target node --outfile dist/cli.js",