docs: fix stale bin/cli.js references in README

.github/FUNDING.yml

@@ -1 +1 @@
-github: monken
+github: nmccready

.github/dependabot.yml

@@ -8,4 +8,14 @@ updates:
   - package-ecosystem: "npm"
     directory: "/" # Location of package manifests
     schedule:
-      interval: "weekly"
+      interval: "daily"
+    cooldown: 
+      default-days: 7
+    groups:
+      all:
+        patterns:
+          - "*"
+    commit-message: # force conventional commits standard
+      prefix: fix
+      prefix-development: chore
+      include: scope

.github/workflows/auto-merge-dependabot.yml_disable

@@ -0,0 +1,13 @@
+name: Auto-merge Dependabot
+on: pull_request
+
+jobs:
+  automerge:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: peter-evans/enable-pull-request-automerge@v8
+        with:
+          token: ${{ secrets.GH_TOKEN || github.token }}
+          pull-request-number: ${{ github.event.pull_request.number }}
+          merge-method: squash

.github/workflows/publish.yml

@@ -1,28 +1,28 @@
-# TODO: ENABLE / UNCOMMENT WHEN NPM_TOKEN IS SET in secrets REPO
-# name: publish
+name: publish
 
-# on:
-#   push:
-#     tags:
-#       - "v*"
+on:
+  push:
+    tags:
+      - "v*"
 
-# jobs:
-#   tests:
-#     uses: ./.github/workflows/tests.yml
-#   publish-npm:
-#     needs: [tests]
-#     runs-on: ubuntu-latest
-#     steps:
-#       - uses: actions/checkout@v4
-#       - name: Use Node.js ${{ matrix.node-version }}
-#         uses: actions/setup-node@v3
-#         with:
-#           node-version: '20.x'
-#           registry-url: 'https://registry.npmjs.org'
-#       - name: Publish to npm
-#         run: |
-#           npm install
-#           npm publish --access public
-#         env:
-#           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-#           #kick
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  publish-npm:
+    needs: [tests]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write  # Required for OIDC
+    steps:
+      - uses: actions/checkout@v4
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v6
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Publish to npm
+        run: | # npm 11.15.1 for OIDC support
+          npm install -g npm@11
+          npm ci
+          npm install
+          npm publish --access public

.github/workflows/release.yml

@@ -1,38 +1,59 @@
 # TODO: ENABLE / UNCOMMENT WHEN NPM_TOKEN IS SET in secrets REPO
-# name: release
-
-# on:
-#   push:
-#     branches: ["master"]
-#     tags-ignore: ['**']
-
-# jobs:
-#   tests:
-#     uses: ./.github/workflows/tests.yml
-#   tag-release:
-#     runs-on: ubuntu-latest
-#     needs: [tests]
-#     steps:
-#       - uses: actions/checkout@v4
-#         with: # important, must be defined on checkout to kick publish (defining in setup/node doesn't work)
-#           token: ${{ secrets.GH_TOKEN }}
-#       - name: Use Node.js ${{ matrix.node-version }}
-#         uses: actions/setup-node@v3
-#         with:
-#           node-version: '20.x'
-#           # cache: "npm" # needs lockfile if enabled
-
-#       - name: tag release
-#         run: |
-#           # ignore if commit message is chore(release): ...
-#           if [[ $(git log -1 --pretty=%B) =~ ^chore\(release\):.* ]]; then
-#             echo "Commit message starts with 'chore(release):', skipping release"
-#             exit 0
-#           fi
-#           git config --local user.email "creadbot@github.com"
-#           git config --local user.name "creadbot_github"
-#           set -v
-#           npm install
-#           npx commit-and-tag-version
-#           git push
-#           git push --tags
+name: release
+
+on:
+  push:
+    branches: ["master"]
+    tags-ignore: ['**']
+
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  tag-release:
+    runs-on: ubuntu-latest
+    needs: [tests]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # important, must be defined on checkout to kick publish
+          token: ${{ secrets.GH_TOKEN }}
+          # Full history needed for conventional-changelog to detect breaking changes
+          fetch-depth: 0
+
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: '20.x'
+
+      - name: tag release
+        run: |
+          # ignore if commit message is chore(release): ...
+          if [[ $(git log -1 --pretty=%B) =~ ^chore\(release\):.* ]]; then
+            echo "Commit message starts with 'chore(release):', skipping release"
+            exit 0
+          fi
+
+          git config --local user.email "creadbot@github.com"
+          git config --local user.name "creadbot_github"
+
+          npm install
+
+          # Check for breaking changes in commits since last tag
+          # Look for feat!:, fix!:, or BREAKING CHANGE in commit messages
+          LAST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
+          if [ -n "$LAST_TAG" ]; then
+            RANGE="$LAST_TAG..HEAD"
+          else
+            RANGE="HEAD"
+          fi
+
+          # Check all commits (not just first-parent) for breaking changes
+          if git log $RANGE --format="%B" | grep -qE "(^[a-z]+!:|BREAKING CHANGE:)"; then
+            echo "Breaking change detected, forcing major version bump"
+            npx commit-and-tag-version --release-as major
+          else
+            npx commit-and-tag-version
+          fi
+
+          git push
+          git push --tags

.github/workflows/tests.yml

@@ -2,14 +2,16 @@ name: tests
 
 on:
   workflow_call:
+  push:
+    branches: ["master"]
   pull_request:
     branches: ["master"]
 
 jobs:
   test:
     strategy:
       matrix:
-        node-version: ['18.x', '20.x', '22.x']
+        node-version: ['20.x', '22.x', '24.x']
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4

.gitignore

@@ -31,4 +31,5 @@ tmp
 temp
 
 yarn.lock
-package-lock.json
+# package-lock.json # OIDC
+dist/

.versionrc.json

@@ -0,0 +1,13 @@
+{
+  "types": [
+    {"type": "feat", "section": "Features"},
+    {"type": "fix", "section": "Bug Fixes"},
+    {"type": "perf", "section": "Performance"},
+    {"type": "refactor", "section": "Refactor"},
+    {"type": "test", "section": "Tests"},
+    {"type": "docs", "section": "Documentation"},
+    {"type": "chore", "hidden": true}
+  ],
+  "commitUrlFormat": "https://github.com/brickhouse-tech/cfn-include/commit/{{hash}}",
+  "compareUrlFormat": "https://github.com/brickhouse-tech/cfn-include/compare/{{previousTag}}...{{currentTag}}"
+}