Build with released typescript@7, drop detective-typescript

.github/workflows/release.yml

@@ -9,7 +9,7 @@
 # Setup required (one-time):
 #   - GitHub App with contents:write installed on this repo
 #   - Org (or repo) secret BOT_APP_PRIVATE_KEY: the App's .pem private key
-#   - Org (or repo) variable BOT_APP_ID: the App's numeric ID
+#   - Org (or repo) secret BOT_APP_ID: the App's numeric ID
 #   - The App listed in the "protect main" ruleset's bypass_actors
 
 name: Release
@@ -39,7 +39,7 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.BOT_APP_ID }}
+          app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
 
       - uses: actions/checkout@v7
@@ -57,31 +57,48 @@ jobs:
       - name: Configure git identity
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
         run: |
-          NAME="${{ steps.app-token.outputs.app-slug }}[bot]"
+          NAME="${APP_SLUG}[bot]"
           ID=$(gh api "/users/$NAME" --jq .id)
           git config user.name "$NAME"
           git config user.email "${ID}+${NAME}@users.noreply.github.com"
 
       - name: Apply version
         id: apply
+        env:
+          VERSION: ${{ inputs.version }}
+          BUMP: ${{ inputs.bump }}
         run: |
-          if [ -n "${{ inputs.version }}" ]; then
-            node bin/build.js version "${{ inputs.version }}" --set --apply
+          if [ -n "$VERSION" ]; then
+            node bin/build.js version "$VERSION" --set --apply
           else
-            node bin/build.js version --bump "${{ inputs.bump }}" --set --apply
+            node bin/build.js version --bump "$BUMP" --set --apply
           fi
-          echo "version=$(cat version.txt)" >> "$GITHUB_OUTPUT"
+          applied=$(cat version.txt)
+          # Expanded into later `run:` blocks before the shell sees it, so anything outside this set injects a
+          # command or a forged step output
+          case "$applied" in
+              "" | *[!0-9A-Za-z.+-]*)
+                  echo "::error::refusing to release unexpected version '$applied'"
+                  exit 1
+                  ;;
+          esac
+          echo "version=$applied" >> "$GITHUB_OUTPUT"
 
       - name: Commit
+        env:
+          VERSION: ${{ steps.apply.outputs.version }}
         run: |
           git add -A
-          git commit -m "Release ${{ steps.apply.outputs.version }}"
+          git commit -m "Release $VERSION"
 
       - name: Tag
         run: node bin/build.js version --tag
 
       - name: Push
+        env:
+          VERSION: ${{ steps.apply.outputs.version }}
         run: |
           git push origin HEAD:main
-          git push origin "v${{ steps.apply.outputs.version }}"
+          git push origin "v$VERSION"

README.md

@@ -7,7 +7,7 @@ Supports both flat single-package repos and multi-package npm workspaces.
 ## CLI commands
 
 * `nacho-build` -- build TypeScript packages (type checking, ESM/CJS transpilation); includes subcommands for
-  workspace maintenance (`configure`, `relock`, `version`, `cycles`, `docs`, etc.)
+  workspace maintenance (`configure`, `relock`, `version`, `cycles`, etc.)
 * `nacho-run` -- run a TypeScript script with automatic transpilation and source maps
 
 ## License