oakum 0.6.2

Fixed

version finishes a pre-release instead of skipping past it. A patch bump on 2.0.0-rc.1 now gives 2.0.0 rather than 2.0.1; a minor bump on 2.1.0-rc.1 gives 2.1.0, and a major bump on 2.0.0-rc.1 gives 2.0.0. A bump that leaves the line the pre-release was heading toward still moves past it: a minor bump on 2.1.3-rc.1 gives 2.2.0. This matches node-semver's inc, which changesets uses. Under the default versioning = "zero-major", a major below 1.0.0 is still read as a minor first, so a major bump on 0.3.0-rc.1 gives 0.3.0; under versioning = "semver" it gives 1.0.0.

Discovery no longer writes pnpm-lock.yaml into a lock-free pnpm workspace that declares its package manager. pnpm 11 wrote one despite --config.lockfile=false under a devEngines.packageManager naming a version it accepted, and under a packageManager naming a newer pnpm; pnpm 12 did when a devEngines.packageManager switched it to an 11. Discovery now has the pnpm on PATH answer, so a declaration pnpm would refuse, such as a devEngines.packageManager array or onFail: "error" naming another pnpm, no longer stops discovery.

The workflow init and migrate print now takes the pnpm version from a devEngines.packageManager array that names an exact one, since pnpm/action-setup reads only the object form, instead of asking pnpm. An array naming a pnpm other than the one on PATH gets that pnpm as the workflow's version input rather than exiting unverified. An array whose version is not an exact one, such as a range, still asks pnpm, which under pnpm 11 can write a lockfile when the version matches it.

In a pnpm workspace, a dependency whose range the same-named member's current version does not satisfy, such as "is-number": "7.0.0" beside a workspace member is-number at 1.0.0, is no longer read as depending on that member. pnpm installs it from the registry, yet version rewrote it to the member's new version on a release that left the range. This covers plain ranges, npm: aliases and catalog: entries; a workspace: dependency still always counts as depending on the member.

oakum ci pr-status --emit-comment <dir> no longer writes the comment file when pr-status = "summary". It wrote oakum-pr-comment.md anyway, so a trusted job that posts whatever it finds there posted a comment the config had turned off. It now writes the job summary as configured, removes a comment file left by an earlier run, says on stderr that summary turned the comment off, and exits 0.

The leftover tag ambiguity refusal from check, version and release now says how to resolve it, on a line after the tags it names:

• Two versions of one package tagged on one commit: keep the tag for the version that commit's manifest names and delete the other, on the remote too if it was pushed.
• A bare v<version> tag with several packages tagged: use <package>/v<version>.
• A version-like tag in a shape oakum does not read: rename it to one it does.
• A tag naming a package the workspace no longer has, as after a rename: delete it, or tag the release with a current package's name.
• A tag whose package name exists in two ecosystems: rename the package it did not release.

The refusal and its exit code are unchanged, and so is the summary of its check --json refusal, which keeps the first line only.

Install oakum 0.6.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/oakoss/oakum/releases/download/v0.6.2/oakum-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://github.com/oakoss/oakum/releases/download/v0.6.2/oakum-installer.ps1 | iex"

Install prebuilt binaries via Homebrew

brew install oakoss/tap/oakum

Install prebuilt binaries into your npm project

npm install @oakoss/oakum@0.6.2

Download oakum 0.6.2

File	Platform	Checksum
oakum-aarch64-apple-darwin.tar.xz	Apple Silicon macOS	checksum
oakum-x86_64-apple-darwin.tar.xz	Intel macOS	checksum
oakum-x86_64-pc-windows-msvc.zip	x64 Windows	checksum
oakum-aarch64-unknown-linux-gnu.tar.xz	ARM64 Linux	checksum
oakum-x86_64-unknown-linux-gnu.tar.xz	x64 Linux	checksum
oakum-x86_64-unknown-linux-musl.tar.xz	x64 MUSL Linux	checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo oakoss/oakum

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>