v0.131.0

Releases build against the release checkout's own committed go.work, and every release gets a private RLSBL_RELEASE_BIN directory for its own builds of tools

Context

The release checkout sits inside the live repository, so Go found the working tree's uncommitted go.work from there and selfdoc's release failed. Releases now pin GOWORK to the checkout, the dep-locks check stops its go.work.sum search at the repository root, and a hook can build an unreleased tool into RLSBL_RELEASE_BIN without installing it for every other session.

Breaking

• In a workspace, batch_limits.exclusions in a member's own .rlsbl/config.json is now a hard error. Exclusions name lines of the releasable's changelog, so they belong in the releasable's .rlsbl-monorepo/releasables/<name>/config.json, where changelog add --allow-batch writes them and the release removes stale ones. A member list silently replaced the releasable's and was never cleaned at release. Move the entries to the releasable's config and delete the member's exclusions key.
• The strictcli schema dump moved to .strictmetadata/.cli-schema/schema.json. The release writes a strictcli program's help --json document there instead of .strictcli/schema.json, and rlsbl rewrite go-module-path rewrites the project_id of dumps at the new location only; a dump left at .strictcli/schema.json is no longer read or rewritten. Move it with selfdoc layout migrate (run --dry-run first). rlsbl's own test coverage now follows strictcli's source-tree root layout, .strictmetadata/.cli-test-coverage/.
• Only the go, npm, pypi, and spec release targets remain. The dart, deno, docker, flutter, hex, maven, native-android, native-ios, pgdesign, plain, swift, swift-apple, and zig targets are removed, along with their scaffold templates, the deno, hex, maven, maven-central, and docker pipeline types, the maven-central-metadata and mirror-required checks and their options, and the Dart and JVM import analysis. A targets entry in .rlsbl/config.json or in a releasable's config that names a target rlsbl does not register is now a hard error naming the config file and the supported targets, where it used to print a warning while the release went on without it: delete the entry or name a supported target, and delete the pipeline entries of a removed type. The Flutter delivery mode is removed with flutter, so a release file's [targets.<name>] table and a changelog line's release_type field now fail validation as unknown keys: delete the table or the field.

Features

• A release can run its own unreleased build of a tool. Every release gets a private, empty directory for binaries, named to every hook as RLSBL_RELEASE_BIN and placed first on PATH for the hooks and every step rlsbl runs. A pre-checks.sh that builds a tool there (GOBIN="$RLSBL_RELEASE_BIN" go install .) has the selfdoc steps and later hooks run that build, without installing it for every other session on the machine.

Fixes

• The npm lockfile step in rlsbl scaffold next steps now says to commit package-lock.json before releasing, not before pushing: releases are the only push.
• rlsbl scaffold no longer crashes with unresolved template variables: goreleaserMain, brewsSection on an npm+go project whose first registry is npm: every scaffolded file now renders with its own target's values, whichever registry is primary.
• A release no longer builds against the working tree's uncommitted go.work. The release checkout sits inside the live repository, so Go found the working tree's gitignored go.work from there: a hook's go install . failed with "main module does not contain package", and where it did not fail the release built against unreleased local modules. Every process a release starts now runs with the checkout's own committed go.work when the repository root tracks one, and with GOWORK=off otherwise.
• The dep-locks check no longer accepts sums from a go.work.sum outside the repository. Its search for a Go workspace's sums now stops at the repository root, so in the release checkout the working tree's uncommitted go.work.sum can no longer vouch for a module whose own go.sum is missing entries.
• rlsbl changelog add --allow-batch in a workspace now names the releasable's config.json it writes the batch exclusion to (.rlsbl-monorepo/releasables/<name>/config.json), in both the dry-run and the write message, instead of claiming .rlsbl/config.json.
• dead-modules no longer reports Go test helpers and go run programs as dead. An internal package imported by another package's _test.go files (a test helper such as internal/cli/clitest) now counts as used, and an internal package main directory is treated as an entry point. A package's own tests and files under testdata/ still never keep it alive.
• Every batch_limits message (the changelog add refusal over the commit limit, the changelog-batch-commits hint, and the invalid batch_limits errors) now names the config file the setting was actually read from. In a workspace that is the releasable's .rlsbl-monorepo/releasables/<name>/config.json unless the member's own .rlsbl/config.json declares the setting; before, every message named .rlsbl/config.json.
• rlsbl changelog add --allow-batch no longer crashes with FileNotFoundError in a workspace whose releasable has no config.json of its own; it creates the file with the exclusion.
• releasable-residue no longer fails on rlsbl scaffold's own output in Go members. The stub .rlsbl/go.mod scaffold writes into a Go member is accepted while its content is the stub's; any other go.mod there is still reported.
• The rlsbl changelog add refusal for an entry over max_commits_per_entry no longer suggests adding an exclusion by hand, which never cleared it; it names the fixes that work: split the entry, or re-run with --allow-batch, which records the exclusion in the config file it names.
• At a workspace root, changelog-batch-commits and changelog-batch-entries now check each releasable's changelog against that releasable's own batch_limits instead of the root's.
• releasable-residue no longer promises that rlsbl monorepo cleanup removes every per-package finding: each finding says whether cleanup removes it or it needs removing by hand, and the summary counts both.
• A release no longer runs the npm package's own install scripts when it refreshes package-lock.json. A wrapper package whose postinstall downloads the release asset of the version being released failed the release before its candidate was pushed. The refresh, and the dep-locks fix it names, are now npm install --package-lock-only --ignore-scripts.
• rlsbl now requires strictcli 0.46.0 or later. Its command definitions declare their source-tree root to strictcli, which older strictcli versions refuse with a TypeError when rlsbl is imported.
• The release workflow page, the README, and the check reference no longer say the release writes the project's new version to .rlsbl/version or that version-consistency compares it: the file names the rlsbl that last scaffolded or released the project.