versionary 0.26.1 → 0.28.0

package/README.md

@@ -172,6 +172,9 @@ For a quick trial, use:
   - `off` (default): do not post comments
   - `best-effort`: post comments and continue on API/permission failures
   - `strict`: fail release if comment posting fails
+  - comments are authored by the account that owns the configured token; see
+    [Comment and commit author identity](#comment-and-commit-author-identity)
+    to post them under a bot identity
 - optional monorepo planning with `monorepo-mode` and `packages`:
   - `independent` computes package bumps per path
   - `fixed` computes one shared bump across configured package paths
@@ -416,6 +419,33 @@ the composite action. This means release-branch force-pushes are attributed to
 that token and can trigger downstream workflows when using a PAT/App token.
 (`github-token` remains as a deprecated alias for backward compatibility.)
 
+#### Comment and commit author identity
+
+Two distinct identities are at play; keep them apart.
+
+**Release-reference comments, the GitHub Release, and the tag/branch push** are
+attributed to the account that owns the token you provide. There is no GitHub
+API to set a custom author independent of the token, so this identity always
+follows the token's account:
+
+- the workflow's default `GITHUB_TOKEN` acts as `github-actions[bot]` — the
+  common case, and what most `semantic-release` setups show
+- a **personal access token (PAT)** acts as your own user
+- a **dedicated bot user account** acts as that account (for example
+  `semantic-release`'s own `@semantic-release-bot`): create a separate GitHub
+  user, generate a PAT for it, and store it as the release token
+- a **GitHub App installation token** (e.g. minted with
+  `actions/create-github-app-token`) acts as `<app-name>[bot]`
+
+**The release commit's committer** comes from git's `user.name`/`user.email`,
+not the token. When neither is configured (e.g. a bare CI runner), Versionary
+defaults it to `github-actions[bot]`, so no `git config` step is needed in your
+workflow; an existing identity (local, global, or the one the GitHub Action
+wrapper sets) is left untouched.
+
+The release-reference comment body itself is signed by Versionary regardless of
+which account posts it.
+
 Action outputs:
 
 - `action`: `noop`, `pr-prepared`, `release-published`, `release-skipped`

package/dist/git/identity.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Default committer identity Versionary uses when a repository has no
+ * `user.name`/`user.email` configured (for example a bare CI runner).
+ *
+ * This intentionally mirrors the GitHub Action entrypoint
+ * (`src/action/index.ts`), which is a standalone bundle and cannot import this
+ * module, so release commits are attributed to the same bot regardless of how
+ * Versionary is invoked (composite action vs. running the CLI from source).
+ */
+export declare const DEFAULT_GIT_AUTHOR_NAME = "github-actions[bot]";
+export declare const DEFAULT_GIT_AUTHOR_EMAIL = "41898282+github-actions[bot]@users.noreply.github.com";
+/**
+ * Ensure git has a committer identity before Versionary creates release
+ * commits. This only fills the gap: if `user.name`/`user.email` already resolve
+ * (local, global, or system config), they are left untouched. Otherwise a
+ * repository-local default is set so `git commit` does not fail with
+ * "Please tell me who you are".
+ */
+export declare function ensureGitIdentity(cwd: string): void;

package/dist/git/identity.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_GIT_AUTHOR_EMAIL = exports.DEFAULT_GIT_AUTHOR_NAME = void 0;
+exports.ensureGitIdentity = ensureGitIdentity;
+const node_child_process_1 = require("node:child_process");
+/**
+ * Default committer identity Versionary uses when a repository has no
+ * `user.name`/`user.email` configured (for example a bare CI runner).
+ *
+ * This intentionally mirrors the GitHub Action entrypoint
+ * (`src/action/index.ts`), which is a standalone bundle and cannot import this
+ * module, so release commits are attributed to the same bot regardless of how
+ * Versionary is invoked (composite action vs. running the CLI from source).
+ */
+exports.DEFAULT_GIT_AUTHOR_NAME = "github-actions[bot]";
+exports.DEFAULT_GIT_AUTHOR_EMAIL = "41898282+github-actions[bot]@users.noreply.github.com";
+function hasGitConfig(cwd, key) {
+    try {
+        (0, node_child_process_1.execFileSync)("git", ["config", key], {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Ensure git has a committer identity before Versionary creates release
+ * commits. This only fills the gap: if `user.name`/`user.email` already resolve
+ * (local, global, or system config), they are left untouched. Otherwise a
+ * repository-local default is set so `git commit` does not fail with
+ * "Please tell me who you are".
+ */
+function ensureGitIdentity(cwd) {
+    if (!hasGitConfig(cwd, "user.name")) {
+        (0, node_child_process_1.execFileSync)("git", ["config", "user.name", exports.DEFAULT_GIT_AUTHOR_NAME], {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+    if (!hasGitConfig(cwd, "user.email")) {
+        (0, node_child_process_1.execFileSync)("git", ["config", "user.email", exports.DEFAULT_GIT_AUTHOR_EMAIL], {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+    }
+}

package/dist/release/changelog.js

@@ -226,7 +226,7 @@ function prependChangelog(cwd, changelogFile, section, format = "markdown-change
     }
     const heading = "# Changelog\n\n";
     const bodyWithoutHeading = existing.replace(/^# Changelog\s*/u, "");
-    const separator = existing.length > 0 ? "\n" : "";
+    const separator = bodyWithoutHeading.length > 0 ? "\n\n" : "";
     const next = `${`${heading}${section}${separator}${bodyWithoutHeading}`.trimEnd()}\n`;
     node_fs_1.default.writeFileSync(changelogPath, next, "utf8");
 }

package/dist/release/pr.js

@@ -19,6 +19,7 @@ const node_child_process_1 = require("node:child_process");
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const load_config_js_1 = require("../config/load-config.js");
+const identity_js_1 = require("../git/identity.js");
 const client_js_1 = require("../scm/client.js");
 const package_context_js_1 = require("../strategy/package-context.js");
 const artifact_rules_js_1 = require("./artifact-rules.js");
@@ -156,13 +157,6 @@ function fetchRemoteReleaseBranch(cwd, branch) {
     });
     return remoteRef;
 }
-function resolveReleaseName(cwd, packagePath, packageConfig, strategy, strategyConfig) {
-    const configuredName = packageConfig["package-name"]?.trim();
-    if (configuredName) {
-        return configuredName;
-    }
-    return strategy.readPackageName?.(cwd, strategyConfig) ?? packagePath;
-}
 function buildReleaseTargets(cwd, plan, loadedConfig) {
     const releaseTargets = plan.packages
         ? plan.packages
@@ -177,7 +171,7 @@ function buildReleaseTargets(cwd, plan, loadedConfig) {
             }
             const packageConfig = loadedConfig.packages?.[pkg.path] ?? {};
             const packageContext = (0, package_context_js_1.resolvePackageStrategyContext)(loadedConfig, pkg.path, packageConfig);
-            const releaseName = resolveReleaseName(cwd, pkg.path, packageConfig, packageContext.strategy, packageContext.config);
+            const releaseName = (0, package_context_js_1.resolveReleaseName)(cwd, pkg.path, packageConfig, packageContext.strategy, packageContext.config);
             const tagPrefix = normalizeReleaseNameForTag(releaseName);
             return {
                 path: pkg.path,
@@ -210,7 +204,7 @@ function buildPackageReleaseMetadata(cwd, plan, loadedConfig) {
         }
         const packageConfig = loadedConfig.packages?.[pkg.path] ?? {};
         const packageContext = (0, package_context_js_1.resolvePackageStrategyContext)(loadedConfig, pkg.path, packageConfig);
-        const releaseName = resolveReleaseName(cwd, pkg.path, packageConfig, packageContext.strategy, packageContext.config);
+        const releaseName = (0, package_context_js_1.resolveReleaseName)(cwd, pkg.path, packageConfig, packageContext.strategy, packageContext.config);
         metadataByPath[pkg.path] = {
             releaseName,
             tagPrefix: normalizeReleaseNameForTag(releaseName),
@@ -349,6 +343,7 @@ function prepareReleasePr(cwd = process.cwd(), options = {}) {
         cwd,
         stdio: ["ignore", "pipe", "ignore"],
     });
+    (0, identity_js_1.ensureGitIdentity)(cwd);
     (0, node_child_process_1.execFileSync)("git", ["commit", "-m", title, "-m", VERSIONARY_RELEASE_TRAILER], {
         cwd,
         stdio: ["ignore", "pipe", "ignore"],
@@ -387,7 +382,7 @@ function renderSimpleReviewRequestBody(version, previousVersion, commits, plan =
         }
         const packageConfig = loadedConfig.packages?.[packagePath] ?? {};
         const packageContext = (0, package_context_js_1.resolvePackageStrategyContext)(loadedConfig, packagePath, packageConfig);
-        const releaseName = resolveReleaseName(cwd, packagePath, packageConfig, packageContext.strategy, packageContext.config);
+        const releaseName = (0, package_context_js_1.resolveReleaseName)(cwd, packagePath, packageConfig, packageContext.strategy, packageContext.config);
         return normalizeReleaseNameForTag(releaseName);
     };
     if (plan?.packages && plan.packages.length > 1) {

package/dist/release/release.d.ts

@@ -1,5 +1,6 @@
 import type { VersionaryConfig } from "../types/config.js";
 import type { VersionaryPluginContext } from "../types/plugins.js";
+export declare function resolveTargetPackageName(cwd: string, config: VersionaryConfig, targetPath: string): string | undefined;
 export declare function extractReleaseNotes(content: string, version: string, changelogFormat: "markdown-changelog" | "r-news"): string;
 export declare function extractClosingReferencesFromNotes(notes: string): number[];
 export declare function resolveTargetChangelogFile(config: VersionaryConfig, rootChangelogFile: string, targetPath: string): string;

package/dist/release/release.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTargetPackageName = resolveTargetPackageName;
 exports.extractReleaseNotes = extractReleaseNotes;
 exports.extractClosingReferencesFromNotes = extractClosingReferencesFromNotes;
 exports.resolveTargetChangelogFile = resolveTargetChangelogFile;
@@ -15,6 +16,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const load_config_js_1 = require("../config/load-config.js");
 const client_js_1 = require("../scm/client.js");
+const package_context_js_1 = require("../strategy/package-context.js");
 const resolve_js_1 = require("../strategy/resolve.js");
 const plan_js_1 = require("./plan.js");
 const pr_js_1 = require("./pr.js");
@@ -23,6 +25,15 @@ const state_js_1 = require("./state.js");
 function escapeRegExp(input) {
     return input.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
+function resolveTargetPackageName(cwd, config, targetPath) {
+    const packageConfig = config.packages?.[targetPath] ?? {};
+    const { strategy, config: strategyConfig } = (0, package_context_js_1.resolvePackageStrategyContext)(config, targetPath, packageConfig);
+    const resolved = (0, package_context_js_1.resolveReleaseName)(cwd, targetPath, packageConfig, strategy, strategyConfig);
+    if (!resolved || resolved === targetPath) {
+        return undefined;
+    }
+    return resolved;
+}
 function extractReleaseNotes(content, version, changelogFormat) {
     const lines = content.split("\n");
     const shortVersion = version.replace(/\.\d+$/u, "");
@@ -172,12 +183,12 @@ async function runReleaseDetailed(cwd = process.cwd(), options = {}) {
     }
     const scmClient = (0, client_js_1.getScmClient)();
     const releases = [];
-    const referencesByTag = new Map();
+    const referenceReleases = [];
     for (const target of targets) {
         const targetChangelogFile = resolveTargetChangelogFile(loaded.config, changelogFile, target.path);
         const targetChangelogFormat = resolveTargetChangelogFormat(loaded.config, target.path);
         const releaseNotes = readReleaseNotes(cwd, target.version, targetChangelogFile, targetChangelogFormat);
-        referencesByTag.set(target.tag, extractClosingReferencesFromNotes(releaseNotes));
+        const references = extractClosingReferencesFromNotes(releaseNotes);
         const outcome = await (0, recovery_js_1.executeIdempotentReleaseTarget)(cwd, {
             tag: target.tag,
             version: target.version,
@@ -197,21 +208,27 @@ async function runReleaseDetailed(cwd = process.cwd(), options = {}) {
             tagStatus: outcome.tagStatus,
             metadataStatus: outcome.metadataStatus,
         });
-        const references = referencesByTag.get(outcome.tag) ?? [];
-        if (references.length > 0 &&
-            referenceCommentMode !== "off" &&
-            scmClient.createReleaseReferenceComments) {
-            await scmClient.createReleaseReferenceComments({
+        if (references.length > 0) {
+            referenceReleases.push({
+                name: resolveTargetPackageName(cwd, loaded.config, target.path),
+                tag: outcome.tag,
                 version: target.version,
                 releaseUrl: outcome.url,
                 references,
-                mode: referenceCommentMode,
-            }, {
-                cwd,
-                logger: options.logger,
             });
         }
     }
+    if (referenceReleases.length > 0 &&
+        referenceCommentMode !== "off" &&
+        scmClient.createReleaseReferenceComments) {
+        await scmClient.createReleaseReferenceComments({
+            releases: referenceReleases,
+            mode: referenceCommentMode,
+        }, {
+            cwd,
+            logger: options.logger,
+        });
+    }
     const published = releases.map((outcome) => `${outcome.tag}: ${outcome.url} (tag=${outcome.tagStatus}, metadata=${outcome.metadataStatus})`);
     return {
         action: "release-published",

package/dist/scm/github-plugin.js

@@ -86,6 +86,42 @@ async function ensureLabels(octokit, repo, pullNumber, labels, branchContext) {
         throw new Error(`Failed applying labels to pull request #${pullNumber}: [${repoRef(repo)} base=${branchContext.baseBranch} head=${branchContext.headBranch}] ${message}`);
     }
 }
+function groupReleasesByIssue(releases) {
+    const byIssue = new Map();
+    for (const release of releases) {
+        for (const reference of release.references) {
+            const bucket = byIssue.get(reference) ?? [];
+            if (!bucket.some((entry) => entry.tag === release.tag)) {
+                bucket.push(release);
+            }
+            byIssue.set(reference, bucket);
+        }
+    }
+    for (const bucket of byIssue.values()) {
+        bucket.sort((a, b) => a.tag.localeCompare(b.tag));
+    }
+    return new Map([...byIssue.entries()].sort(([a], [b]) => a - b));
+}
+function renderReleaseLink(release) {
+    if (release.name) {
+        return `[\`${release.name}\` v${release.version}](${release.releaseUrl})`;
+    }
+    return `[version ${release.version}](${release.releaseUrl})`;
+}
+function renderReleaseReferenceCommentBody(releases) {
+    const footer = "Released by [Versionary](https://github.com/jolars/versionary).";
+    if (releases.length === 1) {
+        const release = releases[0];
+        if (!release) {
+            throw new Error("Expected at least one release for comment body.");
+        }
+        return `This is included in ${renderReleaseLink(release)}. :tada:\n\n${footer}`;
+    }
+    const bullets = releases
+        .map((release) => `- ${renderReleaseLink(release)}`)
+        .join("\n");
+    return `This is included in the following releases: :tada:\n\n${bullets}\n\n${footer}`;
+}
 function createGitHubPlugin() {
     return {
         name: "github",
@@ -275,13 +311,11 @@ function createGitHubPlugin() {
         async createReleaseReferenceComments(input, context) {
             const repo = getRepoFromEnv();
             const octokit = new rest_1.Octokit({ auth: getGitHubToken() });
-            const uniqueReferences = [...new Set(input.references)].sort((a, b) => a - b);
-            const commented = [];
             const mode = input.mode ?? "best-effort";
-            for (const reference of uniqueReferences) {
-                const body = reference >= 1_000_000_000
-                    ? `This pull request is included in [version ${input.version}](${input.releaseUrl}).`
-                    : `This issue has been resolved in [version ${input.version}](${input.releaseUrl}).`;
+            const releasesByIssue = groupReleasesByIssue(input.releases);
+            const commented = [];
+            for (const [reference, releases] of releasesByIssue) {
+                const body = renderReleaseReferenceCommentBody(releases);
                 try {
                     await octokit.issues.createComment({
                         owner: repo.owner,

package/dist/scm/types.d.ts

@@ -41,10 +41,15 @@ export interface ScmReleaseMetadataResult {
     url: string;
     status?: "created" | "exists";
 }
-export interface ScmReleaseReferenceCommentsInput {
+export interface ScmReleaseReferenceCommentsRelease {
+    name?: string;
+    tag: string;
     version: string;
     releaseUrl: string;
     references: number[];
+}
+export interface ScmReleaseReferenceCommentsInput {
+    releases: ScmReleaseReferenceCommentsRelease[];
     mode?: "best-effort" | "strict";
 }
 export interface ScmReleaseReferenceCommentsResult {

package/dist/strategy/package-context.d.ts

@@ -1,5 +1,6 @@
 import type { VersionaryConfig, VersionaryPackage } from "../types/config.js";
 import type { VersionStrategy } from "./types.js";
+export declare function resolveReleaseName(cwd: string, packagePath: string, packageConfig: VersionaryPackage, strategy: VersionStrategy, strategyConfig: VersionaryConfig): string;
 export declare function resolvePackageStrategyContext(rootConfig: VersionaryConfig, packagePath: string, packageConfig: VersionaryPackage): {
     strategy: VersionStrategy;
     config: VersionaryConfig;

package/dist/strategy/package-context.js

@@ -3,9 +3,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveReleaseName = resolveReleaseName;
 exports.resolvePackageStrategyContext = resolvePackageStrategyContext;
 const node_path_1 = __importDefault(require("node:path"));
 const resolve_js_1 = require("./resolve.js");
+function resolveReleaseName(cwd, packagePath, packageConfig, strategy, strategyConfig) {
+    const configuredName = packageConfig["package-name"]?.trim();
+    if (configuredName) {
+        return configuredName;
+    }
+    return strategy.readPackageName?.(cwd, strategyConfig) ?? packagePath;
+}
 function withVersionFile(config, versionFile) {
     return {
         ...config,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "versionary",
-  "version": "0.26.1",
+  "version": "0.28.0",
   "description": "Automatic release framework based on conventional commits and semantic versioning",
   "keywords": [
     "releasing",