diff --git a/.bumpy/ci-comment-fork-pr-resolution.md b/.bumpy/ci-comment-fork-pr-resolution.md deleted file mode 100644 index b2e756b..0000000 --- a/.bumpy/ci-comment-fork-pr-resolution.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@varlock/bumpy': patch ---- - -Fix `bumpy ci comment` failing to resolve the target PR for fork PRs. Under `workflow_run`, the PR was looked up via `GET commits/{head_sha}/pulls`, which only knows about commits in the base repo's own branches — for a fork PR it returns nothing, so the command exited with "Could not resolve a target PR" (defeating the whole point of the fork-safe `pull_request` + `workflow_run` split). When that lookup is empty, bumpy now scans the repo's open PRs (paginated) and matches `head.sha` against the trusted `workflow_run.head_sha`. The target still derives only from the trusted event, never from the artifact or from `workflow_run.pull_requests[]` (which GitHub leaves empty for forks). diff --git a/.bumpy/dependency-update-bump-files.md b/.bumpy/dependency-update-bump-files.md deleted file mode 100644 index 98cf349..0000000 --- a/.bumpy/dependency-update-bump-files.md +++ /dev/null @@ -1,7 +0,0 @@ ---- -'@varlock/bumpy': minor ---- - -Add `bumpy ci deps` for Dependabot / Renovate PRs (modeled on changesets-dependencies-action). It diffs each package's `dependencies` / `peerDependencies` / `optionalDependencies` (plus `releaseTriggeringDevDeps`, and catalog updates) against the base branch, writes one patch bump file per affected package listing the added / updated / removed deps, and commits + pushes them to the PR branch. Re-running is idempotent and removes stale files. `bumpy generate --deps` does the same locally without committing. - -Also fix `ci check` on PRs into a channel branch: the `package.json` field diff and catalog diff compared against `baseBranch` instead of the PR's base, so dependency drift already merged into the channel was attributed to every later PR. diff --git a/.bumpy/direct-bump-and-fixed-sync.md b/.bumpy/direct-bump-and-fixed-sync.md deleted file mode 100644 index 5999833..0000000 --- a/.bumpy/direct-bump-and-fixed-sync.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@varlock/bumpy': minor ---- - -Added `directBump: false` per-package config for packages that only receive propagated bumps (e.g. platform binary packages in a fixed group with their core package) — they are excluded from `bumpy add`/`bumpy generate`, rejected when a bump file names them directly, and `bumpy check` points at their fixed-group members instead. Fixed groups now sync drifted members to a bump of the group's highest version so they reconverge. diff --git a/.bumpy/generate-catalog-consumers.md b/.bumpy/generate-catalog-consumers.md deleted file mode 100644 index 6f5edd6..0000000 --- a/.bumpy/generate-catalog-consumers.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@varlock/bumpy': patch ---- - -`bumpy generate` now maps commits that change a catalog entry (`pnpm-workspace.yaml`, `.yarnrc.yml`, root `package.json`) to the packages consuming it via `catalog:`, so a catalog bump produces the bump file `bumpy check` asks for. diff --git a/.bumpy/prerelease-counter-no-latest-tag.md b/.bumpy/prerelease-counter-no-latest-tag.md deleted file mode 100644 index c52db7f..0000000 --- a/.bumpy/prerelease-counter-no-latest-tag.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@varlock/bumpy': patch ---- - -Fixed prerelease counters restarting at `.0` on registries that don't set a `latest` dist-tag (e.g. GCP Artifact Registry). `npm info versions` resolves through `latest` and prints nothing when it's missing, so bumpy now falls back to the channel's dist-tag and warns if the version list still can't be read. Snapshot idempotency now checks the exact version, and the OIDC new-package check no longer misreports packages without `latest` as missing. diff --git a/.bumpy/replace-semver-with-verkit.md b/.bumpy/replace-semver-with-verkit.md deleted file mode 100644 index 4af93cc..0000000 --- a/.bumpy/replace-semver-with-verkit.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'@varlock/bumpy': patch ---- - -Replaced the `semver` dependency with [verkit](https://github.com/sxzz/verkit) — a smaller, tree-shakeable, zero-dependency SemVer library. No behavior changes, except invalid snapshot versions are now also refused (previously only stable versions were). diff --git a/bun.lock b/bun.lock index d14c42d..f52fbf4 100644 --- a/bun.lock +++ b/bun.lock @@ -14,7 +14,7 @@ }, "packages/bumpy": { "name": "@varlock/bumpy", - "version": "1.18.1", + "version": "1.19.0", "bin": { "bumpy": "./dist/cli.mjs", }, diff --git a/packages/bumpy/CHANGELOG.md b/packages/bumpy/CHANGELOG.md index 2ed0cbe..39af578 100644 --- a/packages/bumpy/CHANGELOG.md +++ b/packages/bumpy/CHANGELOG.md @@ -1,5 +1,25 @@ # Changelog +## 1.19.0 + +2026-10-15 + +- [#155](https://github.com/dmno-dev/bumpy/pull/155) _(minor)_ + Added `directBump: false` per-package config for packages that only receive propagated bumps (e.g. platform binary packages in a fixed group with their core package) — they are excluded from `bumpy add`/`bumpy generate`, rejected when a bump file names them directly, and `bumpy check` points at their fixed-group members instead. Fixed groups now sync drifted members to a bump of the group's highest version so they reconverge. +- [#161](https://github.com/dmno-dev/bumpy/pull/161) _(minor)_ + Add `bumpy ci deps` for Dependabot / Renovate PRs (modeled on changesets-dependencies-action). It diffs each package's `dependencies` / `peerDependencies` / `optionalDependencies` (plus `releaseTriggeringDevDeps`, and catalog updates) against the base branch, writes one patch bump file per affected package listing the added / updated / removed deps, and commits + pushes them to the PR branch. Re-running is idempotent and removes stale files. `bumpy generate --deps` does the same locally without committing. + + Also fix `ci check` on PRs into a channel branch: the `package.json` field diff and catalog diff compared against `baseBranch` instead of the PR's base, so dependency drift already merged into the channel was attributed to every later PR. + +- [#158](https://github.com/dmno-dev/bumpy/pull/158) _(patch)_ + Replaced the `semver` dependency with [verkit](https://github.com/sxzz/verkit) — a smaller, tree-shakeable, zero-dependency SemVer library. No behavior changes, except invalid snapshot versions are now also refused (previously only stable versions were). +- [#160](https://github.com/dmno-dev/bumpy/pull/160) _(patch)_ + Fix `bumpy ci comment` failing to resolve the target PR for fork PRs. Under `workflow_run`, the PR was looked up via `GET commits/{head_sha}/pulls`, which only knows about commits in the base repo's own branches — for a fork PR it returns nothing, so the command exited with "Could not resolve a target PR" (defeating the whole point of the fork-safe `pull_request` + `workflow_run` split). When that lookup is empty, bumpy now scans the repo's open PRs (paginated) and matches `head.sha` against the trusted `workflow_run.head_sha`. The target still derives only from the trusted event, never from the artifact or from `workflow_run.pull_requests[]` (which GitHub leaves empty for forks). +- [#164](https://github.com/dmno-dev/bumpy/pull/164) _(patch)_ + Fixed prerelease counters restarting at `.0` on registries that don't set a `latest` dist-tag (e.g. GCP Artifact Registry). `npm info versions` resolves through `latest` and prints nothing when it's missing, so bumpy now falls back to the channel's dist-tag and warns if the version list still can't be read. Snapshot idempotency now checks the exact version, and the OIDC new-package check no longer misreports packages without `latest` as missing. +- [#166](https://github.com/dmno-dev/bumpy/pull/166) _(patch)_ + `bumpy generate` now maps commits that change a catalog entry (`pnpm-workspace.yaml`, `.yarnrc.yml`, root `package.json`) to the packages consuming it via `catalog:`, so a catalog bump produces the bump file `bumpy check` asks for. + ## 1.18.1 2026-07-03 diff --git a/packages/bumpy/package.json b/packages/bumpy/package.json index e9cb19f..28e88e4 100644 --- a/packages/bumpy/package.json +++ b/packages/bumpy/package.json @@ -1,6 +1,6 @@ { "name": "@varlock/bumpy", - "version": "1.18.1", + "version": "1.19.0", "description": "Modern monorepo versioning and changelog tool", "keywords": [ "bump",