feat!: line-weighted coverage aggregation, per-unit floor, and Biome as the only TypeScript linter

.bulwark.yml

@@ -12,11 +12,11 @@
 # directories on disk, and does not read dependabot.yml. Nothing enforces the
 # Dependabot entry, so a pin can still be added that no bot ever bumps.
 rust:
-  exclude: ["eslint-pin", "biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
+  exclude: ["biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
 typescript:
-  exclude: ["eslint-pin", "biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
+  exclude: ["biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
 go:
-  exclude: ["eslint-pin", "biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
+  exclude: ["biome-pin", "cargo-audit-pin", "cargo-deny-pin", "go-pin"]
 
 # Who produces the coverage this repo is gated on.
 #

.github/dependabot.yml

@@ -39,7 +39,7 @@ updates:
       default-days: 7
     open-pull-requests-limit: 25
 
-  # The ESLint stack (internal/typescript).
+  # Biome (internal/typescript), the only TypeScript linter.
   #
   # One of the tool version pins. bulwark pins every tool it runs, and these
   # manifests exist so those pins are visible to Dependabot rather than frozen
@@ -50,22 +50,6 @@ updates:
   # Each pin directory is also excluded in .bulwark.yml: they are real
   # manifests, so detection would otherwise treat them as packages to lint or
   # modules to scan.
-  - package-ecosystem: "npm"
-    directory: "/internal/typescript/eslint-pin"
-    schedule:
-      interval: "weekly"
-    # Dependabot's commit message is also its PR title, and PRs are
-    # squash-merged, so the prefix is what keeps dependency updates inside
-    # Conventional Commits. `include: scope` appends the dependency scope,
-    # producing e.g. `build(deps): bump …`.
-    commit-message:
-      prefix: "build"
-      include: scope
-    cooldown:
-      default-days: 7
-    open-pull-requests-limit: 25
-
-  # Biome (internal/typescript), used when a repo sets typescript.linter: biome.
   - package-ecosystem: "npm"
     directory: "/internal/typescript/biome-pin"
     schedule:

.github/workflows/release.yml

@@ -44,11 +44,39 @@ jobs:
           go-version-file: go.mod
           cache: true
 
+      # goreleaser derives the release body from commit subjects, which can say
+      # what landed but not what it means: a change to how a coverage number is
+      # computed, or an upgrade step a consumer has to take, has no commit
+      # subject that conveys it. docs/release-notes/<tag>.md is where that gets
+      # written, and this is what puts it in front of the changelog rather than
+      # in a file nobody visits.
+      #
+      # A missing notes file is not an error. Most releases are patches whose
+      # commit list genuinely is the whole story, and failing a release over a
+      # file the release did not need would make every release depend on
+      # remembering a step — the exact failure mode the major-alias move below
+      # was automated to fix.
+      - name: Assemble the release header
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+
+          cat docs/release-notes/_header.md > release-header.md
+          notes="docs/release-notes/${TAG}.md"
+          if [[ -f "$notes" ]]; then
+            printf '\n---\n\n' >> release-header.md
+            cat "$notes" >> release-header.md
+            echo "Release body carries ${notes}." >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "No ${notes}; release body is the header plus the generated changelog." >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Run goreleaser
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           version: "~> v2"
-          args: release --clean --parallelism 1
+          args: release --clean --parallelism 1 --release-header=release-header.md
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.gitignore

@@ -11,6 +11,9 @@ go.work.sum
 # goreleaser build artifacts
 dist/
 
+# Release body assembled by release.yml from docs/release-notes/
+/release-header.md
+
 # Agentic toolkit generated config
 /.claude/
 /CLAUDE.md

.goreleaser.yml

@@ -62,16 +62,9 @@ release:
     name: bulwark
   extra_files:
     - glob: scripts/install.sh
-  header: |
-    ## bulwark
-
-    Unified code-quality and security scanning for Rust, TypeScript, and Go —
-    one CLI, run identically locally and in CI.
-
-    **Install / update**
-
-    ```sh
-    curl -fsSL https://github.com/wardnet/bulwark/releases/latest/download/install.sh | sh
-    ```
-
-    `bulwark update` self-updates the CLI in place.
+  # No `header:` here. The release body's header is assembled by release.yml
+  # and passed with --release-header, so it can carry that version's notes from
+  # docs/release-notes/<tag>.md above the generated commit changelog. A commit
+  # list cannot explain a change in what a number means, which is the whole
+  # reason those files exist; docs/release-notes/_header.md holds the invariant
+  # preamble the assembled header starts with.

.gt-repo.yaml

@@ -22,9 +22,9 @@ dependabot:
   - ecosystem: github-actions
     directory: /
   - ecosystem: npm
-    directory: /internal/typescript/eslint-pin
+    directory: /internal/typescript/biome-pin
     note: |
-      The ESLint stack (internal/typescript).
+      Biome (internal/typescript), the only TypeScript linter.
 
       One of the tool version pins. bulwark pins every tool it runs, and these
       manifests exist so those pins are visible to Dependabot rather than frozen
@@ -35,10 +35,6 @@ dependabot:
       Each pin directory is also excluded in .bulwark.yml: they are real
       manifests, so detection would otherwise treat them as packages to lint or
       modules to scan.
-  - ecosystem: npm
-    directory: /internal/typescript/biome-pin
-    note: |
-      Biome (internal/typescript), used when a repo sets typescript.linter: biome.
   - ecosystem: cargo
     directory: /internal/rust/cargo-audit-pin
     note: |