zx-bulk-release 3.1.8 → 3.1.10

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## [3.1.10](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.9...v3.1.10) (2026-04-13)
+
+### Fixes & improvements
+* docs: add architecture notes ([8760bb8](https://github.com/semrel-extra/zx-bulk-release/commit/8760bb8b9a73593ae192a0d16eea10b731efd206))
+
+## [3.1.9](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.8...v3.1.9) (2026-04-13)
+
+### Fixes & improvements
+* perf: replace cosmiconfig with own config reader ([f980590](https://github.com/semrel-extra/zx-bulk-release/commit/f980590edbf9aa9311110207e24849c6373c0feb))
+
 ## [3.1.8](https://github.com/semrel-extra/zx-bulk-release/compare/v3.1.7...v3.1.8) (2026-04-13)
 
 ### Fixes & improvements

package/README.md

@@ -1,5 +1,5 @@
 # zx-bulk-release
-> [zx](https://github.com/google/zx)-based alternative for [multi-semantic-release](https://github.com/dhoulb/multi-semantic-release)
+> A [zx](https://github.com/google/zx)-based tool for [conventional-commits](https://www.conventionalcommits.org/en/v1.0.0/)-driven secure release workflow for monorepos. Inspired by [multi-semantic-release](https://github.com/dhoulb/multi-semantic-release).
 
 [![CI](https://github.com/semrel-extra/zx-bulk-release/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/semrel-extra/zx-bulk-release/actions/workflows/ci.yml)
 [![Maintainability](https://qlty.sh/gh/semrel-extra/projects/zx-bulk-release/maintainability.svg)](https://qlty.sh/gh/semrel-extra/projects/zx-bulk-release)
@@ -18,7 +18,7 @@
 * **Coordinated delivery**: multiple release agents can safely serve the same monorepo concurrently via git-tag-based semaphores.
 
 > [!NOTE]
-> **[Migration guide v2 → v3](./MIGRATION_V2_V3.md)** | **[Delivery specification](./DELIVER_SPEC.md)** | **[Security model](./SECURITY.md)**
+> **[Migration guide v2 → v3](./docs/MIGRATION_V2_V3.md)** | **[Delivery specification](./docs/DELIVER_SPEC.md)** | **[Security model](./docs/SECURITY.md)** | **[Architecture](./docs/ARCHITECTURE.md)**
 
 ## Roadmap
 * [x] Store release metrics to `meta`.
@@ -122,7 +122,7 @@ jobs:
 ```
 
 #### Four phases: receive + pack + verify + deliver
-Maximum supply chain security. Each phase has strict trust boundaries. See [SECURITY.md](./SECURITY.md) for the threat model.
+Maximum supply chain security. Each phase has strict trust boundaries. See [SECURITY.md](./docs/SECURITY.md) for the threat model.
 
 - **receive** — runs *before* `yarn install`, consumes rebuild signals, analyzes, writes trusted context
 - **pack** — runs *after* deps install with zero credentials, builds and packs tars
@@ -212,8 +212,8 @@ await run({
 ```
 
 ## Config
-### cosmiconfig
-Any [cosmiconfig](https://github.com/davidtheclark/cosmiconfig) compliant format: `.releaserc`, `.release.json`, `.release.yaml`, etc in the package root or in the repo root dir.
+### Config files
+[cosmiconfig](https://github.com/davidtheclark/cosmiconfig)-compatible lookup: `.releaserc`, `.release.json`, `.release.yaml`, `.releaserc.js`, `release.config.js`, or `release` key in `package.json`. Searched from the package root up to the repo root.
 ```json
 {
   "buildCmd": "yarn && yarn build",
@@ -405,7 +405,7 @@ parcel.{sha7}.{channel}.{name}.{version}.{hash6}.tar
 ```
 The `sha7` prefix groups all parcels of one commit. `name` is the sanitized package name (`@scope/pkg` → `scope-pkg`). The `hash6` suffix is a content hash for deduplication — two builds of the same commit producing identical content yield the same filename (last-writer-wins), while different content gets a different hash.
 
-A **directive** meta-parcel (`parcel.{sha7}.directive.{ts}.tar`) is generated alongside regular parcels. It contains the complete delivery map: package queue, per-package channel steps, and an authoritative list of parcel filenames. The directive enables coordinated delivery — see [DELIVER_SPEC.md](./DELIVER_SPEC.md).
+A **directive** meta-parcel (`parcel.{sha7}.directive.{ts}.tar`) is generated alongside regular parcels. It contains the complete delivery map: package queue, per-package channel steps, and an authoritative list of parcel filenames. The directive enables coordinated delivery — see [DELIVER_SPEC.md](./docs/DELIVER_SPEC.md).
 
 The manifest contains `${{ENV_VAR}}` placeholders that are resolved by the courier at delivery time via `resolveManifest()`. This ensures credentials never touch the build phase.
 
@@ -432,7 +432,7 @@ When multiple zbr processes target the same monorepo concurrently, delivery is c
 4. **Conflict resolution** — if `git-tag` returns `conflict`, all parcels of that package are marked, and a `zbr-rebuild.{sha7}` tag signals CI to rebuild with fresh versions.
 5. **Partial delivery** — skipped parcels (missing credentials) remain valid tarballs. Another process with the right credentials can pick them up later.
 
-See [DELIVER_SPEC.md](./DELIVER_SPEC.md) for the full protocol specification.
+See [DELIVER_SPEC.md](./docs/DELIVER_SPEC.md) for the full protocol specification.
 
 ### Credential flow
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "zx-bulk-release",
   "alias": "bulk-release",
-  "version": "3.1.8",
+  "version": "3.1.10",
   "description": "zx-based alternative for multi-semantic-release",
   "type": "module",
   "exports": {
@@ -19,25 +19,24 @@
   ],
   "scripts": {
     "test": "npm run test:unit",
-    "test:unit": "uvu ./src/test -i fixtures -i utils -i integration",
+    "test:unit": "vitest run --dir src/test/js --exclude '**/integration*' --exclude '**/fixtures/**' --exclude '**/utils/**'",
     "test:it": "node ./src/test/js/integration.test.js",
-    "test:cov": "c8 sh -c 'npx uvu ./src/test -i fixtures -i utils -i integration && node ./src/test/js/integration.test.js' && c8 report -r lcov",
+    "test:cov": "vitest run --coverage --dir src/test/js --exclude '**/fixtures/**' --exclude '**/utils/**'",
     "docs": "mkdir -p docs && cp ./README.md ./docs/README.md",
     "publish:beta": "npm publish --tag beta --no-git-tag-version",
     "build": "esbuild src/main/js/index.js --platform=node --outdir=target --bundle --format=esm --external:typescript"
   },
   "dependencies": {
     "@semrel-extra/topo": "^1.14.1",
-    "cosmiconfig": "^9.0.1",
     "queuefy": "^1.2.1",
     "tar-stream": "^3.1.8",
     "zx-extra": "4.0.20"
   },
   "devDependencies": {
-    "c8": "^11.0.0",
+    "@vitest/coverage-v8": "^4.1.4",
     "esbuild": "^0.28.0",
-    "uvu": "^0.5.6",
-    "verdaccio": "6.5.0"
+    "verdaccio": "6.5.0",
+    "vitest": "^4.1.4"
   },
   "publishConfig": {
     "access": "public"
@@ -47,10 +46,5 @@
     "url": "git+https://github.com/semrel-extra/zx-bulk-release.git"
   },
   "author": "Anton Golub <antongolub@antongolub.com>",
-  "license": "MIT",
-  "c8": {
-    "exclude": [
-      "src/test/**"
-    ]
-  }
+  "license": "MIT"
 }

package/src/main/js/config.js

@@ -1,4 +1,4 @@
-import { cosmiconfig } from 'cosmiconfig'
+import { fs, path, YAML } from 'zx'
 import { asArray, camelize, memoizeBy } from './util.js'
 import { GH_URL, resolveGhApiUrl } from './post/api/gh.js'
 import { DEFAULT_GIT_COMMITTER_NAME, DEFAULT_GIT_COMMITTER_EMAIL } from './post/api/git.js'
@@ -29,12 +29,41 @@ export const defaultConfig = {
 export const getPkgConfig = async (cwd, env) =>
   normalizePkgConfig((await Promise.all(asArray(cwd).map(readPkgConfig))).find(Boolean) || defaultConfig, env)
 
-export const readPkgConfig = memoizeBy(async (cwd) => cosmiconfig(CONFIG_NAME, {
-  searchPlaces: CONFIG_FILES,
-  searchStrategy: 'global', // https://github.com/cosmiconfig/cosmiconfig/releases/tag/v9.0.0
-})
-  .search(cwd)
-  .then(r => r?.config))
+export const cosmiconfig = (name, {searchPlaces}) => {
+  const load = async (filePath) => {
+    if (filePath.endsWith('.js') || filePath.endsWith('.cjs'))
+      return (await import(filePath)).default
+    const raw = await fs.readFile(filePath, 'utf8')
+    if (filePath.endsWith('.yaml') || filePath.endsWith('.yml'))
+      return YAML.parse(raw)
+    try { return JSON.parse(raw) } catch { return YAML.parse(raw) }
+  }
+
+  const search = async (cwd) => {
+    let dir = path.resolve(cwd)
+    while (true) {
+      for (const file of searchPlaces) {
+        const filePath = path.resolve(dir, file)
+        if (!await fs.pathExists(filePath)) continue
+        if (file === 'package.json') {
+          const pkg = await fs.readJson(filePath)
+          if (pkg[name]) return pkg[name]
+          continue
+        }
+        return load(filePath)
+      }
+      const parent = path.dirname(dir)
+      if (parent === dir) return
+      dir = parent
+    }
+  }
+
+  return {search}
+}
+
+export const readPkgConfig = memoizeBy(async (cwd) =>
+  cosmiconfig(CONFIG_NAME, {searchPlaces: CONFIG_FILES}).search(cwd)
+)
 
 export const normalizePkgConfig = (config, env) => {
   const envConfig = parseEnv(env)