oakum 0.5.0

Changed

oakum version no longer loses bump files when it is killed or fails while consuming them. It used to delete each consumed bump file and hold the only copy in memory, so a signal, an OOM kill or a cancelled CI job in that window removed files with nothing on stderr, and a later failure could leave some unrestorable. Consumed files are now moved aside to .<name>.oakum-consume.* names and removed only after every write has landed, and a failure moves them back. While it writes and consumes, version also holds a .version.oakum-consume.* marker in .changeset/. A run killed partway leaves these files behind. The next check names them and exits 2, where it used to pass. The next version and ci version-pr refuse (exit 1) rather than apply the bump files left beside them a second time. The refusal says whether the writes landed and how to recover. If a set-aside file cannot be moved back, version names it and the move that restores it. If every write landed but a set-aside file cannot be removed, version prints what it wrote, then names the file and why, and exits 1.

oakum release now tags the first version oakum version writes, whether 0.1.0 or 0.0.x. An untagged package was owed a tag only above 0.1.0, so the 0.1.0 or 0.0.1 that oakum version writes from 0.0.0 read as an untouched starting version: check passed and release printed nothing to release. Now, with no reachable tag, only a manifest at 0.0.0 or 0.1.0 whose CHANGELOG.md has no section for that version is a starting version. Every other untagged version is owed a tag: release cuts it, and check refuses (exit 1) until it does. That includes a hand-set 0.0.5, which check used to pass. A version with a changelog section is named as waiting for oakum release; one without still says to tag the version you meant. To release a cargo init crate at 0.1.0 as-is, add a ## 0.1.0 section to its changelog. When an untagged 0.0.0 or 0.1.0 has a changelog oakum cannot read, a dangling symlink included, the tags look reports it unverified (exit 2) and release refuses rather than skipping it; the other packages' findings still print. Above those versions an unreadable changelog only changes the wording.

oakum version no longer bumps past a version someone set by hand. When the plan would bump a package, cascades included, whose manifest version has no tag and no changelog section, such as a 0.1.1 or 0.0.5 someone typed, version and ci version-pr exit 1 before writing anything and name every such package. The fix is to tag the version you meant, or to run git fetch --tags if its tag exists on a remote; check now gives that second option too. A hand-set version the plan leaves alone does not stop the run; check still reports it. A placeholder 0.0.0 or 0.1.0 is still bumped from, and an untagged version that has its changelog section (one version wrote and release has not tagged yet) is still stacked on. When the changelog or the tags cannot be read for such a package, version exits 2 rather than guess, so a shallow or no-tags clone now stops it whenever a package it bumps has no changelog section for its current version.

oakum add, generate and plan-intent now refuse an include or exclude entry that names no package in the workspace, as status, check, version and release already did. They used to accept it, so add and generate wrote a bump file that every later step then rejected. The refusal, from every command, now names .changeset/_config.toml and lists the workspace packages to choose from (the first 20).

Commits now count only toward packages the config versions, both in generate and when commits are the plan's intent: a package include/exclude leaves out, or a private package without private-packages.version = true, is skipped. A commit touching only such a package no longer makes version refuse in commits-only mode, and generate writes no bump file for it, naming the packages it skipped and the setting to change; a commit touching several packages names only the versioned ones.

A changelog template must now render a heading oakum can read back. check and release find a version by its changelog heading, and a template that wrote, for example, ## demo@0.1.0 left the first 0.1.0 looking like an untouched placeholder, so release never tagged it. Headings of the form ## <name>@<version> are now read for the package they name, alongside ## <version>, ## [<version>] and ## v<version>. version exits 1 before writing anything when the template renders any other heading, such as ### {{ version }} or ## Version {{ version }}, and names the shapes that work. It also exits 1 when the template renders nothing for a bumped version, such as a cascade whose template writes only when there are notes; that version would otherwise have no section. Whatever the template, version exits 1 when a new entry leaves a code fence open, for example a bump file note that ends inside one, or when a fence the existing changelog leaves open would hide a new heading; either would hide headings from check and release.

Fixed

The workflow oakum init and oakum migrate print for a Cargo repository now installs oakum with taiki-e/install-action (tool: oakum@<tool-version>), pinned to a release oakum ships with. The step it replaces, run: cargo binstall --no-confirm oakum@<tool-version>, cannot run on ubuntu-latest, which does not ship cargo-binstall. For the same reason migrate no longer tells a Cargo repository without a pin to add cargo binstall to it; the printed workflow is the pin it offers. check's refusal for a repository with no pin names the install-action step as its example instead of cargo binstall. oakum is not in install-action's own tool list, so the action installs cargo-binstall and uses it; cargo-binstall 1.24.0 resolves oakum@0.4.0 for x86_64-unknown-linux-gnu from the GitHub release (dry run). oakum check reads the new step as the install pin, as it read the old one. npm workspaces are unchanged.

Oakum notices sooner that a git child has finished: the wait polled every 5 ms, so each child cost up to a poll's worth of idle time after git had already exited, and a command can run many of them. It now polls every 1 ms. Measured on macOS, oakum check in this repository dropped from 185 ms to 153 ms (fastest of 15 alternating runs). Output is unchanged.

oakum check, oakum release and the other commands that verify the install pin no longer hang when a pin file is a FIFO. The look opened package.json, .mise.toml, mise.toml and .github/actions/*/action.yml with a blocking open, so a FIFO nobody wrote to stalled the command forever. It now opens them non-blocking, as oakum's other file readers do, and refuses as unverified (exit 2), naming the file that is not a regular file. A missing file and a dangling symlink still read as no pin there. A cargo or pnpm reached through a mise shim reads mise.toml itself, so on such a PATH a FIFO there can still block before oakum looks.

When this binary is older than the repository's tool-version, the refusal no longer tells you to run oakum upgrade. Following that advice rewrote tool-version down to the older binary and exited 0, so a contributor with a stale local install downgraded the repository by doing what the error said. The refusal now names the pinned version to install and says upgrade would downgrade the repository. A binary newer than the pin still names oakum upgrade. Stderr only; the exit code is unchanged.

An exported GIT_LITERAL_PATHSPECS, GIT_GLOB_PATHSPECS, GIT_NOGLOB_PATHSPECS or GIT_ICASE_PATHSPECS no longer changes what oakum asks git. Oakum writes its pathspecs for git's defaults, and under GIT_LITERAL_PATHSPECS=1 the exclusions in oakum migrate's gate look became literal file names: the look searched nothing, and a repository whose hook names .bumpy/ was told no file names the old bump-file directory. Under GIT_ICASE_PATHSPECS=1, oakum release refused before tagging, because git rejects the :(literal) pathspec it reads the changelog through. Oakum now clears these variables for every git child it runs, as it already clears git's trace variables.

Under pnpm 12, discovery no longer writes pnpm-lock.yaml into a pnpm workspace, or rewrites the one it has. Every pnpm call oakum makes (pnpm list, pnpm root -w, and the pnpm --version that oakum init runs) created a lockfile, mode 0600, in a lock-free workspace that declares its package manager, so oakum status, and any other command that discovers packages, left an untracked file behind; under an array-form devEngines.packageManager, init also rewrote an existing lockfile. Oakum now passes --config.lockfile=false on each call. Measured on pnpm 8.15.9, 9.15.9, 10.34.5, 11.25.0, 12.5.1 and 12.6.0: each accepts the flag and prints the same output with it. pnpm 11 still writes one under a devEngines.packageManager declaration or a packageManager naming pnpm 12; the flag does not stop it there. Output and exit codes are unchanged.

Install oakum 0.5.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.5.0/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.5.0/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.5.0

Download oakum 0.5.0

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>