feat: monorepo support — independent per-package semver bumping

[ricogu]

Summary

Add monorepo support to pull-request-semver-bumper so that independently-versioned packages within a single repository can each be bumped based on what the PR actually touches.

Design

Full design spec: docs/superpowers/specs/2026-05-12-monorepo-support-design.md

How It Works

Monorepo mode is auto-activated when a bumper.monorepo.json file exists at the repo root — no changes to action.yml inputs required.

{
  "packages": [
    { "path": "packages/foo" },
    { "path": "packages/bar", "type": "maven" },
    { "path": "services/auth", "type": "npm" }
  ]
}

Behavior

• Changed-file detection — the action cross-references PR changed files against declared package paths. Only packages actually touched by the PR are bumped.
• Same bump level — a single bump level (major, minor, patch) is derived from PR commits and applied to all touched packages.
• Single combined commit — all version file changes are staged and committed atomically: version bump packages/foo@1.2.0 packages/bar@2.1.0
• Heterogeneous types — each package can be npm, maven, python, or version-file. If type is omitted, it's auto-detected from the package directory.
• No packages touched → no-op — if the PR doesn't touch any declared package, the action exits with bumped: false and makes no commit.

Config Schema

Field	Required	Description
path	Yes	Relative path to the package
type	No	npm, maven, python, version-file (auto-detected if omitted)
package-json-file	No	Per-package path override
pom-file	No	Per-package path override
pyproject-file	No	Per-package path override
version-file	No	Per-package path override
bump-command	No	Per-package custom bump command

Outputs in Monorepo Mode

Output	Value
bumped	true / false
new-version	JSON map: {"packages/foo":"1.2.0","packages/bar":"2.1.0"}
bumpLevel	Single level applied to all: "minor"

Code Changes

New files under .github/actions/core/src/monorepo/:

• load-config.ts — parse & validate bumper.monorepo.json
• detect-packages.ts — cross-reference PR changed files with package paths
• detect-type.ts — auto-detect package type from filesystem
• orchestrate.ts — main loop: bump each touched package, build combined commit

Existing code untouched except:

• index.ts — add config detection branch
• git/git.ts — add multi-file stage + combined commit message builder

What Is Not Changing

• Existing single-package mode is fully preserved
• action.yml inputs are unchanged
• All existing composite actions under .github/actions/version-bumping/ are untouched