feat(release) automate releases with release-it

.github/workflows/ncc-release.yaml

@@ -1,19 +1,11 @@
 name: flatlock-release
 run-name: >
-  (#${{ github.run_number }}) flatlock release ${{ inputs.version }}
+  (#${{ github.run_number }}) flatlock release ${{ github.ref_name }}
 
 on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release version (e.g., 1.0.0)'
-        required: true
-        type: string
-      prerelease:
-        description: 'Mark as pre-release'
-        required: false
-        type: boolean
-        default: false
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
 
 permissions: {}
 
@@ -99,9 +91,8 @@ jobs:
       - name: Create GitHub Release
         uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         with:
-          tag_name: ${{ inputs.version }}
-          name: flatlock ${{ inputs.version }}
-          prerelease: ${{ inputs.prerelease }}
+          tag_name: ${{ github.ref_name }}
+          name: flatlock ${{ github.ref_name }}
           generate_release_notes: true
           files: |
             binaries/flatlock-linux-x64
@@ -111,7 +102,7 @@ jobs:
             binaries/flatcover-linux-arm64
             binaries/flatcover-darwin-arm64
           body: |
-            ## flatlock ${{ inputs.version }}
+            ## flatlock ${{ github.ref_name }}
 
             The Matlock of lockfile parsers - extracts packages without building dependency graphs.
 
@@ -128,20 +119,20 @@ jobs:
 
             ```bash
             # Linux (x64)
-            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatlock-linux-x64
-            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatcover-linux-x64
+            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatlock-linux-x64
+            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatcover-linux-x64
             chmod +x flatlock flatcover
             mv flatlock flatcover /usr/local/bin/
 
             # Linux (ARM64)
-            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatlock-linux-arm64
-            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatcover-linux-arm64
+            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatlock-linux-arm64
+            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatcover-linux-arm64
             chmod +x flatlock flatcover
             mv flatlock flatcover /usr/local/bin/
 
             # macOS (Apple Silicon)
-            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatlock-darwin-arm64
-            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ inputs.version }}/flatcover-darwin-arm64
+            curl -L -o flatlock https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatlock-darwin-arm64
+            curl -L -o flatcover https://github.com/${{ github.repository }}/releases/download/${{ github.ref_name }}/flatcover-darwin-arm64
             chmod +x flatlock flatcover
             mv flatlock flatcover /usr/local/bin/
             ```

.github/workflows/release.yml

@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      increment:
+        description: 'Version increment'
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
+
+permissions: {}
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          registry-url: 'https://registry.npmjs.org'
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Release
+        run: pnpm exec release-it --ci --increment ${{ inputs.increment }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.release-it.json

@@ -0,0 +1,22 @@
+{
+  "git": {
+    "tagName": "${version}",
+    "commitMessage": "chore: release ${version}",
+    "tagMatch": "[0-9]*.[0-9]*.[0-9]*",
+    "requireCleanWorkingDir": true,
+    "push": true
+  },
+  "npm": {
+    "publish": true,
+    "provenance": true
+  },
+  "github": {
+    "release": false
+  },
+  "plugins": {
+    "@release-it/keep-a-changelog": {
+      "filename": "doc/CHANGELOG.md",
+      "strictLatest": false
+    }
+  }
+}

doc/CHANGELOG.md

@@ -173,10 +173,11 @@ Initial release of flatlock - the Matlock of lockfile parsers.
 - Designed for use cases that need package enumeration without dependency resolution: SBOM generation, vulnerability scanning, license compliance, integrity verification
 - For full dependency tree analysis ("why is X installed?"), use `@npmcli/arborist` instead
 
-[unreleased]: https://github.com/indexzero/flatlock/compare/v1.5.0...HEAD
-[1.5.0]: https://github.com/indexzero/flatlock/compare/v1.4.0...v1.5.0
-[1.4.0]: https://github.com/indexzero/flatlock/compare/v1.3.0...v1.4.0
-[1.3.0]: https://github.com/indexzero/flatlock/compare/1.2.0...v1.3.0
+[unreleased]: https://github.com/indexzero/flatlock/compare/1.5.1...HEAD
+[1.5.1]: https://github.com/indexzero/flatlock/compare/1.5.0...1.5.1
+[1.5.0]: https://github.com/indexzero/flatlock/compare/1.4.0...1.5.0
+[1.4.0]: https://github.com/indexzero/flatlock/compare/1.3.0...1.4.0
+[1.3.0]: https://github.com/indexzero/flatlock/compare/1.2.0...1.3.0
 [1.2.0]: https://github.com/indexzero/flatlock/compare/1.1.0...1.2.0
 [1.1.0]: https://github.com/indexzero/flatlock/compare/1.0.0...1.1.0
 [1.0.1]: https://github.com/indexzero/flatlock/compare/1.0.0...1.0.1

package.json

@@ -61,7 +61,8 @@
     "check": "biome check src test && pnpm run build:types",
     "check:fix": "biome check --write src test",
     "build:ncc": "./bin/ncc.sh",
-    "prepublishOnly": "pnpm run build:types"
+    "prepublishOnly": "pnpm run build:types",
+    "release": "gh workflow run release.yml --repo indexzero/flatlock -f increment="
   },
   "dependencies": {
     "@yarnpkg/lockfile": "^1.1.0",
@@ -71,14 +72,16 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.8",
-    "@vercel/ncc": "^0.38.4",
+    "@release-it/keep-a-changelog": "^7.0.1",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^22.10.2",
+    "@vercel/ncc": "^0.38.4",
     "c8": "^10.1.3",
     "chalk": "^5.6.2",
     "fast-glob": "^3.3.3",
     "jackspeak": "^4.1.1",
     "markdownlint-cli2": "^0.17.2",
+    "release-it": "^19.2.4",
     "snyk-nodejs-lockfile-parser": "^1.55.0",
     "tinyexec": "^1.0.2",
     "typescript": "^5.7.2"