chore(release): scope per-package CHANGELOG via GIT_CHANGELOG_PATH by oorabona · Pull Request #116 · oorabona/node-liblzma

oorabona · 2026-04-29T23:12:26Z

Summary

Future workspace-package releases (tar-xz, nxz-cli) now produce CHANGELOGs containing only commits whose diffs touched their own package subtree.

Why

packages/tar-xz/CHANGELOG.md v6.1.0 captured commits that did not belong to tar-xz:

node-liblzma C++/wasm commits — (native) and (wasm) entries (e.g. PR feat(wasm): wire memlimit option through unxzAsync/unxz #111 wasm memlimit, PR feat(native): wire memlimit through N-API decoder #112 native memlimit)
~30 Dependabot chore(deps): refresh lockfile repo-root entries
Repo-wide CI tweaks (pin pnpm/action-setup, regenerate pnpm-lock.yaml, use squash merge in Dependabot auto-merge, etc.)

Root cause : the populate-unreleased-changelog.js script (run via before:bump hook) ran git log repo-wide regardless of cwd. The recent cleanup commit 4d24fde only deleted stale .changeset/*.md artifacts ; the underlying scoping bug remained.

How

@oorabona/release-it-preset v0.11.0 (published upstream 2026-04-29, commit 0b4f857) introduces an opt-in GIT_CHANGELOG_PATH env var that scopes the script's git log to a subtree (with security validation : rejects absolute paths, .. traversal, shell metacharacters).

This PR :

Bumps @oorabona/release-it-preset ^0.9.0 → ^0.11.0.
In .github/workflows/release.yml, sets GIT_CHANGELOG_PATH=. on the workspace-bump step (after cd "$PKG_DIR", the . resolves to the package's own subtree). Root node-liblzma step is unchanged — the root release captures the whole repo by design.
Removes the dormant changesets pipeline : .github/workflows/changesets.yml (62 LOC, was opening unused "Version Packages" PRs), .changeset/ directory (only config.json + README.md left after 4d24fde), and the @changesets/cli + @changesets/changelog-github devDeps. ~90 transitive lockfile entries are dropped as a side-effect.
TODO.md updated : Phase 1 (upstream preset v0.11.0 ship) marked ✅ ; Phase 2 (this PR) is the work in flight.

Net diff : 7 files, +15/-606 (pnpm-lock.yaml accounts for -519 of those deletions).

Testing

Locally on the branch :

pnpm install --frozen-lockfile → EXIT 0
pnpm type-check → EXIT 0
pnpm lint → EXIT 0
pnpm test → EXIT 0 (489 root + 158 tar-xz + 27 nxz = 674 tests, 3 pre-existing skips in tar-xz)
Dry-run of populate-unreleased-changelog.js with GIT_CHANGELOG_PATH=. from packages/tar-xz/ cwd : EXIT 0, zero diff produced (consistent with the fact that no commit since tar-xz@6.1.0 touches packages/tar-xz/). The env var is honored by the published preset ; the scoping logic itself is verified by the preset's own 9 vitest cases (incl. security validation).

Out-of-scope

chore(deps-dev): bump the dev-dependencies group with 3 updates #26 (nxz-cli 6.0.0 → 6.1.0 visibility bump) — deferred to a follow-up PR after this one merges and the clean CHANGELOG is verified on a real release.
Body-fragment parser issue (multi-line commit bodies leaking as ### Changed entries) — tracked upstream in release-it-preset TODO as a v0.11+ "Out-of-scope follow-up" ; not addressed by path scoping.
Historical CHANGELOG entries — the existing packages/tar-xz/CHANGELOG.md v6.1.0 entry still contains the legacy leakage. We do not rewrite shipped release notes ; the fix only affects future releases.

Test plan

CI passes (lint, typecheck, tests)
Copilot review surfaces no S/M findings
After merge, a follow-up dry-run release of tar-xz produces a CHANGELOG entry scoped to packages/tar-xz/ commits only
No regressions on the root node-liblzma release path (workspace-bump step is the only step touched)

- Bump `@oorabona/release-it-preset` 0.9.0 → 0.11.0 to enable `GIT_CHANGELOG_PATH` environment variable for scoping `git log` to package subtrees in `release.yml` workspace-bump step. - Each package's CHANGELOG now contains only commits whose diffs touched that package's directory, preventing unrelated commits from polluting per-package release notes. - Remove dormant changesets pipeline: `.changeset/` directory, `@changesets/cli` and `@changesets/changelog-github` devDeps, and `changesets.yml` workflow that had been opening unused "Version Packages" PRs. - Clean up TODO.md entries for completed cleanup work.

Copilot

Pull request overview

This PR updates the repo’s release automation so workspace-package releases (tar-xz, nxz-cli) generate CHANGELOG entries scoped to commits that touched only that package’s subtree, and removes the dormant Changesets-based versioning pipeline.

Changes:

Bump @oorabona/release-it-preset to ^0.11.0 (introduces GIT_CHANGELOG_PATH scoping support).
Set GIT_CHANGELOG_PATH=. in the workspace-package release step after cd "$PKG_DIR" to scope git log to the package subtree.
Remove the unused Changesets workflow and .changeset/ artifacts, and drop @changesets/* devDependencies (lockfile pruned accordingly).

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
pnpm-lock.yaml	Removes Changesets dependency graph; updates `@oorabona/release-it-preset` lock entry.
package.json	Drops Changesets devDeps; bumps `@oorabona/release-it-preset` version range.
TODO.md	Updates release backlog notes to reflect the new CHANGELOG scoping work and follow-ups.
.github/workflows/release.yml	Exports `GIT_CHANGELOG_PATH=.` for workspace package releases to scope changelog generation.
.github/workflows/changesets.yml	Deletes unused Changesets “Version Packages” workflow.
.changeset/config.json	Deletes Changesets configuration (pipeline removal).
.changeset/README.md	Deletes Changesets folder documentation (pipeline removal).

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

-    "@changesets/changelog-github": "^0.6.0",
-    "@changesets/cli": "^2.31.0",
-    "@oorabona/release-it-preset": "^0.9.0",
+    "@oorabona/release-it-preset": "^0.11.0",


+    resolution: {integrity: sha512-2fEd4v0rGX7VBhOZ7gnrDk7NUxa2XOeo9hU11vlZR/hVt5iuK+nQYdsnKv1kYTtTI12KL9kLm6cleoaK0hGXMQ==}
    engines: {node: '>=18.0.0'}
    hasBin: true
    peerDependencies:
-      release-it: ^19.0.0
+      release-it: ^20.0.0


-_None_
+- [ ] 🟡 [Release] **#25 — Per-package CHANGELOG scoping (release-it)** (2026-04-29). Pollution observed in `packages/tar-xz/CHANGELOG.md` v6.1.0: node-liblzma commits leak (#111 wasm, #112 native), ~30 Dependabot lockfile refreshes, repo-wide CI tweaks, commit-body fragments parsed as entries. Root cause: `populate-unreleased-changelog.ts` git log has no path filter. Decision 2026-04-29: opt-in env var in `@oorabona/release-it-preset` (single source of truth, ~5 LOC upstream + ~15 LOC test). Resolves "changesets vs release-it" architecture question (originally raised 2026-04-27 commit `adfbc99` → cleanup `4d24fde` left the noise problem unsolved).
+  - [x] ✅ **Phase 1** — `oorabona/release-it-preset` v0.11.0 shipped (2026-04-29, upstream commit `0b4f857` tag `v0.11.0`, npm published). `GIT_CHANGELOG_PATH` env var wired in `dist/scripts/populate-unreleased-changelog.js:184` via existing `deps.getEnv()` DI pattern. 9 vitest cases covering path scoping + security validation (rejects `../` traversal + absolute paths — bonus security hardening not in original spec). Multi-line commit body parser issue tracked separately as v0.11+ "Out-of-scope follow-up" in preset's TODO.
+  - [ ] 🟡 **Phase 2** — node-liblzma (this repo): bump `@oorabona/release-it-preset` 0.9.0 → 0.11.0, set `GIT_CHANGELOG_PATH=packages/tar-xz` env in tar-xz release flow (workflow step OR `.release-it.json` hook — TBD during /workflow), idem `packages/nxz` with `packages/nxz`. Remove dormant changesets pipeline: `.github/workflows/changesets.yml` (62 LOC), `.changeset/` dir (config.json + README.md only post-cleanup), `@changesets/cli`+`@changesets/changelog-github` devDeps (~90 transitive lockfile entries). Dry-run `release.yml` for tar-xz to verify CHANGELOG no longer captures node-liblzma/Dependabot commits before merge.


- `@oorabona/release-it-preset@0.11.0` declares a peerDep on `release-it ^20`; install was resolving against `release-it@19.2.4` causing a peer mismatch that could surface as warnings or release-time inconsistencies. - Bump pinned `release-it` from `^19.2.4` to `^20.0.0`; lockfile now resolves preset@0.11.0 against release-it@20.0.1 cleanly with no peer warnings. - Cite `GIT_CHANGELOG_PATH` env var explicitly in the release.yml comment so future grep-by-name lands the rationale. - Sync TODO Phase 2 wording with the shipped placement form (`GIT_CHANGELOG_PATH=.` after `cd "$PKG_DIR"`).

Copilot

Pull request overview

Updates the release tooling so workspace package releases generate per-package scoped CHANGELOG entries (based on commits touching only that package subtree), and removes the unused Changesets-based versioning pipeline.

Changes:

Bump @oorabona/release-it-preset to ^0.11.0 (and release-it to ^20.0.0) and drop @changesets/* dev deps.
Scope workspace package CHANGELOG generation in release.yml via GIT_CHANGELOG_PATH=..
Remove the dormant Changesets workflow and .changeset/ directory artifacts.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
`pnpm-lock.yaml`	Reflects dependency bumps (`release-it`, preset) and removal of Changesets transitive deps.
`package.json`	Drops Changesets devDeps; bumps release preset and `release-it` major.
`TODO.md`	Updates backlog/status notes for the release-it scoping work and follow-ups.
`.github/workflows/release.yml`	Sets `GIT_CHANGELOG_PATH=.` for workspace package release step to scope CHANGELOG commits.
`.github/workflows/changesets.yml`	Removes unused Changesets “Version Packages” PR automation workflow.
`.changeset/config.json`	Deletes Changesets configuration (no longer used).
`.changeset/README.md`	Deletes Changesets README (no longer used).

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

oorabona · 2026-04-29T23:28:16Z

    "nano-staged": "^0.9.0",
    "prebuildify": "^6.0.1",
-    "release-it": "^19.2.4",
+    "release-it": "^20.0.0",
    "simple-git-hooks": "^2.13.1",
    "tsd": "^0.33.0",


Acknowledged but classified L (not addressed in this PR) — rationale :

engines.node describes the library's RUNTIME requirement for consumers, who don't run release-it. The library itself works on Node 22.0+ (no v22.13 syntax/API dependencies). The release-it@20 engine stricter range applies only to maintainers running release commands.

Concrete impact :

Library users at Node 22.0–22.12 → unaffected (engines is checked at install against >=22.0.0, which is still satisfied; release-it isn't a runtime dep).

Contributors at Node 22.0–22.12 → pnpm warning at install (no engine-strict in .npmrc), and pnpm release* would fail to start. Affects only the release flow, not normal development.

CI → NODE_VERSION: 22 resolves to latest 22.x (≥22.18 today) → fine.

Bumping engines.node to >=22.13.0 would be a soft-breaking change for library consumers on older 22.x with no actual library-side benefit. Tracked in TODO under "[Release] Consider engines.node bump when 22.0–22.12 usage drops" for a future minor.

Mark Phase 1 + Phase 2 ✅ with merging SHA `68d6d91`. Move closed story to Completed section. Add LOW follow-ups: #26 nxz-cli visibility bump (now ready), `engines.node` bump consideration (Copilot R2 finding rejected with rationale).

Copilot AI review requested due to automatic review settings April 29, 2026 23:12

Copilot started reviewing on behalf of oorabona April 29, 2026 23:12 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

oorabona requested a review from Copilot April 29, 2026 23:21

Copilot started reviewing on behalf of oorabona April 29, 2026 23:21 View session

Copilot AI reviewed Apr 29, 2026

View reviewed changes

oorabona enabled auto-merge (squash) April 29, 2026 23:28

oorabona merged commit 68d6d91 into master Apr 29, 2026
22 checks passed

oorabona deleted the chore/release-it-changelog-scoping branch April 29, 2026 23:35

This was referenced Apr 30, 2026

feat(nxz): add --memlimit-decompress flag to CLI #117

Merged

chore(deps): bump @oorabona/release-it-preset 0.11.0 → 0.12.0 #118

Merged

Consider bumping engines.node to >=22.13.0 (deferred — wait-and-see) #139

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(release): scope per-package CHANGELOG via GIT_CHANGELOG_PATH#116

chore(release): scope per-package CHANGELOG via GIT_CHANGELOG_PATH#116
oorabona merged 2 commits into
masterfrom
chore/release-it-changelog-scoping

oorabona commented Apr 29, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

oorabona Apr 29, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

oorabona commented Apr 29, 2026

Summary

Why

How

Testing

Out-of-scope

Test plan

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

oorabona Apr 29, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants