oakum 0.9.0

Added

check, status and the pull-request comment say how each changed package is covered. check prints a coverage: count and one line per way packages are covered: a bump file and its level, a none entry, a commit under commits-only intent, or commits that release nothing with their types (refactor, test); an empty bump file is named once as covering every changed package. An uncovered package names the path its change took, each commit on the branch asking to release it (short hash, subject, and its type: fix, feat, breaking or not conventional), the oakum add command that covers it at the highest level those commits ask for, and the oakum add --none command for a change that should release nothing. check --json carries this per package under the coverage look's changed, and status --json and templates as the top-level changed (covered_by, via, released_by, fix); where a document has changed, its uncovered is read from it. status and the comment list uncovered packages one per line with their path, the commits asking for a release and the oakum add command those commits imply, and a change that releases nothing under "Changed, releasing nothing".

The pull-request plan comment opens with the commit it describes, the pull request's head commit rather than the merge commit Actions checks out, and links the run that wrote it, so a plan left by an older run reads as older.

A ci pr-status run that cannot build the plan (a shallow clone, unreadable tags, a coverage look that could not run, a selection naming no package) still fails as before, and now marks oakum's comment stale instead of leaving it as current: a warning naming the commit and run with the reason, above the last plan oakum checked, collapsed. With --emit-comment it writes the reason to oakum-pr-comment.failed (artifact format 2), and ci post-comment composes the same banner and exits 0. The posting job and the artifact upload need if: always() for the banner to reach the pull request.

ci pr-status --emit-comment writes oakum-pr-comment.format beside the comment, recording the artifact's format and the oakum that wrote it, and ci post-comment refuses an artifact newer than it can read by naming both versions (exit 2, nothing touched) instead of misreading it. A directory without the record reads as format 1, so artifacts from earlier oakum still post.

Changed

The workflow oakum init and oakum migrate print for a Cargo repository pins taiki-e/install-action to v2.89.0 (was v2.87.30).

A change to a package oakum does not version, unmanaged or excluded, now counts as a change to every versioned package that depends on it at runtime (Cargo dependencies and build-dependencies; npm dependencies, peerDependencies and optionalDependencies), directly or through other unversioned packages. check --strict asks that package for coverage and names the path, as in app (cargo): changed (via store) with no covering intent, so a branch that changes only an internal crate is now refused until a bump file covers the package that ships it; oakum add --none --packages <package> covers it without a release. generate and the commits-only plan release it: a fix commit to the internal crate patches the package that ships it, where it used to reach no package. An excluded package nothing versioned depends on stays silent.

With change files and conventional commits both on, a branch's commits that release nothing now cover the packages they reach: a package changed only by refactor:, test:, chore: and other non-releasing commits passes check --strict without a bump file, each package judged on its own, so one fix commit to another package asks only that package for one. Merge commits are skipped. A git revert of a commit in the same range cancels both, for coverage, generate and the commits-only plan alike, so a fix and its revert on one branch no longer release a patch; a revert of a commit outside the range still releases.

Install oakum 0.9.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.9.0/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.9.0/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.9.0

Download oakum 0.9.0

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.8.3

Fixed

Removing a package no longer leaves check exiting 2 on its old tags. Delete the package and the lines that name it; its tags stay as history, and its published releases with them. A package renamed in place whose new name has no tags of its own still exits 2, now naming the tag to add (git tag <new>@<version> <commit>). An include/exclude entry or a bump file naming a removed package says to delete that line.

Install oakum 0.8.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.8.3/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.8.3/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.8.3

Download oakum 0.8.3

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.8.2

Fixed

oakum 0.8.1 was tagged, but its binaries, crates.io crate, npm package and Homebrew formula were never published: a scheduled brownout of GitHub's retiring macOS 14 runners cancelled its Apple Silicon build. This release builds that target on macOS 15 and publishes the same changes.

Install oakum 0.8.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.8.2/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.8.2/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.8.2

Download oakum 0.8.2

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.8.1

Fixed

oakum ci pr-status and oakum ci post-comment treat a pull request comment as theirs only when a bot wrote it and its body starts with oakum's marker. A bot comment that merely quoted the marker could be overwritten or deleted. When updating the plan, they now update or create it before removing older copies, so a removal that fails leaves the current plan up, and the message says the plan was posted and which removal failed rather than that nothing was posted.

oakum 0.8.0

Added

oakum ci post-comment DIR posts the comment ci pr-status --emit-comment DIR wrote, from a job that holds the write token and has no checkout. It updates oakum's plan comment, or removes it when the emitting run had none, under the same ownership rule pr-status uses. The pull request comes from that job's own event (pull_request, or a same-repository workflow_run), never from the artifact. The body must start with oakum's marker, end with the closing line --emit-comment writes, and fit GitHub's 65,536-character limit; one that does not start with the marker or is over the limit is refused (exit 1).

--emit-comment now always leaves exactly one file, written whole: oakum-pr-comment.md, or oakum-pr-comment.none when the run has no comment. A run that stops first leaves neither. post-comment refuses as unverified (exit 2) when the artifact cannot be trusted whole (neither file or both, a body cut short, an entry that is not a regular file) or the token cannot write, so a lost artifact never reads as nothing to post and an earlier run's comment is never reposted.

With commits-only intent, each commit's summary now reaches only the changelogs of the packages that commit names. Before, every package releasing from a range listed every commit in the range, prefixed with the package it belonged to, so alpha's changelog carried - beta: ... lines. Each commit now lands in its own section by its own level: a fix under ### Fixed, a feat under ### Added, where before all of a package's commits shared the section of its highest level.

A changelog template's file field for a commit-derived change now holds the commit's hash, where it read commits.

A Cargo crate and an npm package with the same name in one directory now both release from an unscoped commit that touches it, as coverage already counted. Before, commits-only planning refused with "commit-derived package <name> matches more than one workspace package".

oakum migrate from knope names each package's scopes list among the remaining steps, saying it was not carried over and that oakum attributes a commit whose scope names no package by the files it changes. The lists used to be dropped without a word.

oakum ci pr-status --emit-comment DIR with pr-status = "none" no longer refuses. It writes no comment or job summary, leaves the oakum-pr-comment.none marker in DIR, and exits 0 without calling GitHub, so the trusted job posting the emitted comment removes the old one after switching to none.

With conventional commits, a commit that asks for a release (feat, fix or breaking) and changes no package's files, under a scope that names no workspace package such as fix(gamma) or fix(alpha,beta), is now reported instead of dropped without a word. A merge under such a scope is reported too, since its paths are not read. A commit with no scope, or a non-conventional message, is not reported. status and ci pr-status list it under "Released by a commit but reaching no package", status --json and the title and commit-message templates carry it as unresolved_scopes (commit, scope), and check, version and generate name it on stderr. Exit codes do not change, --strict included. A commit that releases nothing is not reported, and its ambiguous scope (a Cargo crate and an npm package sharing the name) now falls back to its paths instead of refusing the run.

oakum status and the ci pr-status job summary say what to do next. An empty plan with no bump file pending says so and names oakum add, and oakum generate when conventional commits are on. An uncovered package is followed by the command that covers it, oakum add --packages <package>:<level>, plus oakum generate --from <base> where check would offer it (or a conventional commit naming it, in a commits-only repository), and the pull request comment carries the same line.

The version pull request body from oakum ci version-pr now quotes each package's changelog entry under Release notes, one collapsible block per package, so a reader on the Conversation tab or in email sees what ships, not only what bumps. The entry is read back from the changelog the branch writes. An entry that would take the body past GitHub's 65,536-character limit, or that holds raw HTML which could break the page, is named with its CHANGELOG.md path instead of being cut, and a body still over the limit stops the run before anything is pushed.

Changed

Running oakum with no command prints its help on stderr and exits 2, the usage-error code, where it printed oakum and exited 0. The help lists commands in the order a new user meets them (init, add, generate, status, check, then version, release and ci) and ends with the typical flow and a link to the guides.

check --strict coverage counts only a branch's own intent. A bump file already pending on the base branch no longer covers a pull request that changes the package it names; the branch needs its own bump file (oakum add), or an edit to the pending one. Under conventional commits only, only the branch's commits cover it, not unreleased commits on the base branch. status, status --json (uncovered) and the ci pr-status comment report coverage the same way. A base sharing no history with HEAD leaves coverage unverified (exit 2).

A package's CHANGELOG.md that is a symlink whose target does not exist no longer reads as absent. check reports it under "changelog(s) oakum version would refuse to append to" (exit 2), naming the link and the fix, and migrate lists it among the remaining steps; version already refused to write through it.

A manifest version set by hand above its highest tag, with no changelog section for that version, is now treated like an untagged hand-set version: version and ci version-pr refuse to bump past it (exit 1), and check names it as set by hand with the tag to cut, instead of stacking the next release on it. A version above its tag that has its section, as version writes, is still stacked on. A 0.0.0 or 0.1.0 manifest is checked against tags only when its changelog has a section for an older version, so a new package versions as before, while one whose changelog has one now needs full history: in a shallow clone version exits 2 rather than bump unchecked.

Help text states the --from default from one source: the merge-base with origin/main, else main, else master, with commit-derived intent starting at the highest reachable tag of each package oakum tags. version and ci version-pr say they read --from only for commit-derived intent. Options no longer cite ADR numbers, check --strict names both looks it gates (coverage and notes), and version describes itself in one line.

A manifest below its highest tag, such as 0.1.0 after v0.2.0 shipped, no longer plans a version already released or below one. check fails naming both versions and the fix ("N package(s) below their highest tag"), version and ci version-pr refuse before any write (exit 1), and status, status --json (hand_set) and the ci pr-status comment show the plan as blocked. To tell, these read tags whenever the plan bumps a package oakum tags, tagged yet or not, so in a shallow clone they now exit 2 (unverified) and ask for full history; a fresh 0.0.0 or 0.1.0 package with no earlier changelog section still versions there.

oakum migrate from knope compares plans when nothing is pending. knope's dry run prints nothing and exits 0 then, which migrate read as the tool being unavailable, ending unverified (exit 2) on the usual time to migrate, right after a release. When the workflow it ran has a PrepareRelease step (or knope.toml declares none, so knope's own defaults run), that silence is now an empty before-plan: nothing pending on either side is reported as such and exits 0, and a bump file oakum plans that knope does not is a finding (exit 1). Silence from a workflow with no PrepareRelease step, which knope gives whether or not anything is pending, stays unverified and says why, as does output oakum does not recognise.

check's staging look now sweeps the directory of every file version writes, including a nested workspace's Cargo.toml, Cargo.lock, pnpm-lock.yaml and catalog when they are regular files. A stray oakum staging file beside one of them (rust/.Cargo.lock.oakum-write.…) is reported as unverified (exit 2) instead of passing.

With conventional commits and change files off, the plan (status, version, check, ci pr-status, ci version-pr) now reads each package's commits since its own highest reachable tag, instead of merge-base(origin/main, HEAD)..HEAD. On the default branch that range was empty, so a commits-only repository planned nothing there unless every run passed --from; version now releases on main. A package never tagged reads all of its history. A package version released and no tag records yet (its manifest is above its tag and its changelog has the section) reads no commits until oakum release tags it, so the version pull request job running beside release does not plan the same release twice, wherever the release was cut; check --strict still reads the branch's commits for it, so a branch's own fix covers its change. status lists it under "Released, awaiting its tag", and status --json and the templates as awaiting_tag. A package oakum does not tag keeps the merge-base range. A shallow clone, a --no-tags remote, tags oakum cannot attribute, or one version tagged on two commits now make these commands unverified (exit 2) in commits-only mode, where the plan read no tags before. With a tag to read from, status no longer needs git merge-base for the plan, so a merge-base it cannot get now leaves only its coverage look unchecked (exit 0, "Coverage was not checked") rather than failing the run. --from still reads one range for every p...

oakum 0.7.0

Changed

A git listing that skipped part of what it was asked for is unverified (exit 2) instead of read as complete. Three cases that exited 0 before:

• A tag listing beside warning: ignoring broken ref (a tag ref holding garbage, or one git cannot read). git lists the other tags and exits 0, so the missing tag could be the last release.
• A worktree listing beside git's bare <path>: <system error> line, such as beta/src/lib.rs: Permission denied. git status drops a file it cannot lstat that way, so a changed package went unseen. Other unprefixed stderr, such as a clean filter's own output, still leaves the listing standing.
• A tag listing that git refs verify says could not open a directory under the repository's refs/tags, wherever its git directory lives: beside the worktree, inside a submodule's parent, or a separate git dir. git drops the tags in that directory without a word, and an empty listing read as never released. oakum now runs git refs verify after every tag listing. A git directory kept under a folder path holding refs/tags can't be told apart, so there an unopened directory in another namespace is unverified too. Its warnings about a ref's form, such as a missing newline or a symlink, change nothing. On a git older than 2.47, which has no refs verify, the listing stands as before.

A clone whose remote fetches only some branches (git clone --single-branch) is unverified (exit 2) where oakum reads every tag (release's check of local tags and migrate's tag-format derivation), instead of read as a complete tag set. git follows only the tags on the branches it fetches, so a release tagged on another branch was missing and the short set read as the whole. Readers of the tags on HEAD's history (check, version, reachable-tags) are unaffected: the fetched branch brought every tag on it.

oakum judges the remote it reads tags from (origin, else the first by name). It reports when no fetch refspec stores every branch, a negative refspec takes some branches back, or the remote has no refspec at all, unless tagOpt is --tags or a refspec stores every tag under refs/tags/. The message names the refspec and the fix: git config --replace-all remote.<name>.tagOpt --tags, then git fetch --tags -- <name>. actions/checkout at fetch-depth: 0 keeps the refspec for every branch and is unaffected.

The --no-tags check now follows what git fetches, too: a tagOpt value git does not recognise no longer hides an earlier --no-tags, a git clone --mirror (whose refspec stores every tag) is no longer reported as tag-suppressed, and a negative refspec that takes tags back counts against it. Remote settings are read with git config -z, so a remote whose name holds a space no longer breaks the read.

Known limits. Both checks read what the next fetch would bring, not what the last one did, so a remote widened (or set to tagOpt --tags) but not yet fetched reads as whole. In a single-branch clone, checking out a branch fetched by name into FETCH_HEAD alone leaves the tags on it unfetched, and the HEAD readers do not notice.

A bump-file note that keeps one section and loses another is now caught, as one that loses them all already was. A heading with nothing under it reaches no changelog, and when another heading in the same note rendered, the release looked complete while the empty section disappeared without a word. add refuses such a note before writing, and check reports it (refusing under --strict), each naming the empty heading: "has a heading with nothing under it (### Fixed)". A note that opens with a heading, an empty note, and a coverage-only note are unaffected.

add refuses, before writing, a bump file that releases a package the config does not version: one include/exclude leaves out, or a private package without private-packages.version = true. status, check and version all refused that file, so it could never release; the refusal now comes while the author is still there, naming the setting. A name:none entry is still written, since it releases nothing. check now accepts such an entry too: it refused one that status and version accepted.

With commits-only intent, a commit whose scope names a package the config keeps but cannot version is reported rather than dropped without a word. status prints "Named by a commit but not version-managed". status --json, the commit-message and title templates, and the version pull request's body carry it as named_unmanaged, and the ci pr-status comment lists it. check, version and ci version-pr print it on stderr without gating, --strict included, whether or not anything releases. A package already listed as changed but not version-managed is not repeated, and an excluded package stays silent.

Install oakum 0.7.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.7.0/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.7.0/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.7.0

Download oakum 0.7.0

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.6.4

Fixed

Two kinds of error message now say why. A GitHub request that fails names its cause, such as operation timed out or a refused connection, where it stopped at "error sending request for url". A file oakum reads or creates through a symlink it cannot use is named as one: a dangling link (as version meets on a dangling CHANGELOG.md) says the symlink's target does not exist instead of "File exists", and where cap-std reported "a path led outside of the filesystem", the message now says the file is reached through a path that leaves the repository, or through a symlink with an absolute target, neither of which oakum follows, or, for a link that is itself absolute, says just that. Exit codes are unchanged.

Install oakum 0.6.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.6.4/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.6.4/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.6.4

Download oakum 0.6.4

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.6.3

Fixed

When version fails creating a file and rolls back, a file it cannot check is named instead of being taken as never created. A stat that failed for any reason but the file being absent, before the create or after it, was read as nothing to clean up, so the failure report described a tree it had not checked. It now says it could not check whether the run created the file, and why, and to remove it only if the run did; the consume marker stays so the next version refuses rather than plan over it. A create refused because the file already exists names nothing, since it created nothing.

A YAML catalog pin that shares an anchor with another entry moves alone. version rewrote the anchored value, so a pin written as *caret also moved every other entry using &caret, including another package's, and the next pnpm install failed. Now an alias pin is written out as a quoted literal range and the anchor keeps its value; a pin that carries an anchor is rewritten and its aliases are written out, quoted, with the old value. An entry that reaches the pin through an alias of a whole table still moves with it. A line on stderr names each case once the files are written.

Recovery advice after a version that failed and rolled back is right in more cases. The consume marker is now marked as rolled back before the rollback's first step, so a run stopped partway through it is advised to keep none of its writes instead of being read as one whose writes landed. That advice points at git status and git diff rather than the failed run's own message, which may be gone, and says to keep edits made before the run. A marker that could not be marked says why, a marker overwritten in place keeps none of its old listing, and an empty marker beside a set-aside bump file is no longer read as a consume that landed, whose advice would remove bump files never applied. The advice for set-aside bump files of unknown state says to remove one the kept writes already applied.

Files oakum rewrites keep their permissions. version, a rollback, upgrade and migrate replace a file by renaming a new copy over it, and that copy was created with default permissions, so an executable manifest came back 644 (a mode change in git diff). The new copy now takes the old file's permissions; on a filesystem that cannot keep them, the file is still written and a warning says so. A file's owner and inode still change.

A file version rewrites through a symlink stays a symlink. version read a symlinked manifest through the link but replaced the link with a regular file, so the shared file it named kept the old version. Writes now follow the link: the file it names gets the new text, staged beside that file, and the link stays, and check looks for staging files beside a link's file too. A link oakum does not follow safely (one into a .git, one it cannot resolve, one whose file refuses the new text, or one whose file another write of the same run also names) is replaced by a regular file as before, and stderr names the file that did not get the new text.

A git, cargo metadata or pnpm child, or a source tool migrate runs, that goes past OAKUM_REMOTE_DEADLINE is killed together with what it started and is still waiting on, such as a signing program, a credential helper or an ssh ProxyCommand. The message names those programs: on stderr, and in migrate's report on stdout. Before, only the child was killed and the rest kept running. The tree is stopped before it is killed, so nothing it starts in the meantime escapes. A process whose parent had already exited is not reached. When oakum cannot vouch for the whole tree, the message says what the child started may still be running. That happens when oakum could not list the tree or kill a process in it, a process would not stop or exited before it could be stopped, the child kept starting processes faster than oakum could stop them, or a process could not be confirmed as still under the child and was let go rather than killed. A passphrase prompt that gpg's agent shows through pinentry belongs to the agent, not to git, so the agent decides when it closes.

version and ci version-pr name the lockfile entries left for pnpm install once the files are written, so a run refused after planning no longer lists entries it never wrote. The version pull request also lists catalog entries that share a YAML anchor with a bumped pin.

check and status no longer count a version commit's own writes as an uncovered change. A range holding the commit that ran version reported its packages as changed with no covering intent, and the suggested fix would have bumped them a second time. A commit that deletes a bump file now has its manifest, changelog, lockfile and catalog edits left out of coverage in each package directory whose CHANGELOG.md it also wrote, whatever its subject says. Its other edits, a merge's, and a later commit's still count.

Install oakum 0.6.3

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.6.3/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.6.3/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.6.3

Download oakum 0.6.3

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.6.2

Fixed

version finishes a pre-release instead of skipping past it. A patch bump on 2.0.0-rc.1 now gives 2.0.0 rather than 2.0.1; a minor bump on 2.1.0-rc.1 gives 2.1.0, and a major bump on 2.0.0-rc.1 gives 2.0.0. A bump that leaves the line the pre-release was heading toward still moves past it: a minor bump on 2.1.3-rc.1 gives 2.2.0. This matches node-semver's inc, which changesets uses. Under the default versioning = "zero-major", a major below 1.0.0 is still read as a minor first, so a major bump on 0.3.0-rc.1 gives 0.3.0; under versioning = "semver" it gives 1.0.0.

Discovery no longer writes pnpm-lock.yaml into a lock-free pnpm workspace that declares its package manager. pnpm 11 wrote one despite --config.lockfile=false under a devEngines.packageManager naming a version it accepted, and under a packageManager naming a newer pnpm; pnpm 12 did when a devEngines.packageManager switched it to an 11. Discovery now has the pnpm on PATH answer, so a declaration pnpm would refuse, such as a devEngines.packageManager array or onFail: "error" naming another pnpm, no longer stops discovery.

The workflow init and migrate print now takes the pnpm version from a devEngines.packageManager array that names an exact one, since pnpm/action-setup reads only the object form, instead of asking pnpm. An array naming a pnpm other than the one on PATH gets that pnpm as the workflow's version input rather than exiting unverified. An array whose version is not an exact one, such as a range, still asks pnpm, which under pnpm 11 can write a lockfile when the version matches it.

In a pnpm workspace, a dependency whose range the same-named member's current version does not satisfy, such as "is-number": "7.0.0" beside a workspace member is-number at 1.0.0, is no longer read as depending on that member. pnpm installs it from the registry, yet version rewrote it to the member's new version on a release that left the range. This covers plain ranges, npm: aliases and catalog: entries; a workspace: dependency still always counts as depending on the member.

oakum ci pr-status --emit-comment <dir> no longer writes the comment file when pr-status = "summary". It wrote oakum-pr-comment.md anyway, so a trusted job that posts whatever it finds there posted a comment the config had turned off. It now writes the job summary as configured, removes a comment file left by an earlier run, says on stderr that summary turned the comment off, and exits 0.

The leftover tag ambiguity refusal from check, version and release now says how to resolve it, on a line after the tags it names:

• Two versions of one package tagged on one commit: keep the tag for the version that commit's manifest names and delete the other, on the remote too if it was pushed.
• A bare v<version> tag with several packages tagged: use <package>/v<version>.
• A version-like tag in a shape oakum does not read: rename it to one it does.
• A tag naming a package the workspace no longer has, as after a rename: delete it, or tag the release with a current package's name.
• A tag whose package name exists in two ecosystems: rename the package it did not release.

The refusal and its exit code are unchanged, and so is the summary of its check --json refusal, which keeps the first line only.

Install oakum 0.6.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.6.2/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.6.2/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.6.2

Download oakum 0.6.2

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>

oakum 0.6.1

Fixed

Errors, warnings, prompts, and the summaries oakum status and oakum version print now escape bytes that could rewrite the terminal, such as an escape sequence or a bidi override in a bump file's name or a pnpm package name. So does the plan oakum ci pr-status prints to stdout when GITHUB_STEP_SUMMARY is unset; the job summary file keeps the text as rendered. Before, only some messages did: oakum status printed a bump file's name raw when refusing it, and the summaries printed such names raw. Error text quoted from pnpm, cargo, git or the old release tool prints without its colour codes. Combining accents print as written rather than as \u{301}. Output meant for scripts is unchanged: --json, and the paths, URLs and tags that commands print as their result.

oakum migrate runs bumpy, changesets and knope under OAKUM_REMOTE_DEADLINE like every other child: one whose answer has not arrived by then is named, and migrate exits 2 (unverified) instead of hanging.

migrate also finds those tools on PATH the way discovery finds pnpm, including a Git Bash PATH on Windows (/c/Users/..., or :-separated entries), which its lookup used to miss.

Both lookups now share one reading of PATH. On Windows, a quoted entry such as "C:\Program Files\knope" and a verbatim one such as \\?\C:\tools are each one directory, and only a name with a PATHEXT extension is taken, never an extensionless file. Elsewhere, PATH is read as the shell reads it, so /a/bin is a directory rather than drive A: and a bare pnpm wins over a pnpm.EXE beside it. On every system an empty PATH entry is skipped rather than read as the current directory, so it no longer runs a pnpm, bumpy, changeset or knope file from the repository being inspected.

Four messages now say what to do:

• A version no tag records (never released, but the manifest is 1.0.0) names the tag to cut, rendered from tag-format or the default: `git tag @demo/a/v1.0.0 <commit>`. A tag-format whose tag oakum could not read back as that version names none.
• In oakum check, a change with no covering intent names oakum add --packages <package>:<level>, and, when conventional commits are on, oakum generate --from <base> over the range check read.
• oakum add without --message says the bump file's changelog entry will be empty.
• oakum init and oakum migrate say why they reach GitHub when the lookup for the printed workflow's action pins fails, and that nothing was written.

Install oakum 0.6.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.6.1/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.6.1/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.6.1

Download oakum 0.6.1

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>