@geenius/release-toolkit

Canonical release toolkit for every Geenius package and boilerplate. One CLI (geenius-release) replaces the per-package supply-chain / license / SBOM / smoke-packed / gauntlet scripts that previously lived as 26–36 hand-copied duplicates.

Dev-only. Add to devDependencies; never appears in your runtime bundle.

pnpm add -D @geenius/release-toolkit

Quick start

Wire the canonical scripts into your package.json:

{
  "scripts": {
    "audit:supply-chain": "geenius-release supply-chain",
    "audit:license":      "geenius-release license",
    "audit:sbom":         "geenius-release sbom",
    "test:smoke-packed":  "geenius-release smoke-packed",
    "test:gauntlet":      "geenius-release gauntlet"
  }
}

No config file required — the toolkit ships ecosystem-sensible defaults. Add release-toolkit.config.json next to package.json to override.

Subcommands (v0.1)

Subcommand	Replaces	Description
`supply-chain`	26 per-package scripts	pnpm audit + osv-scanner + Socket + license, all required/optional configurable
`license`	36 copies of `license-check.mjs`	Forbidden-license scan over installed deps
`sbom`	36 copies of `sbom.mjs`	CycloneDX 1.5 JSON SBOM (optional SPDX via `syft`)
`smoke-packed`	36 copies of `smoke-packed-imports.mjs`	Pack, install, dynamic-import every subpath in `package.json:exports`
`gauntlet`	The `&&`-chained `pnpm test:gauntlet` macro	Compose the configured step sequence into one structured report

v0.2 adds coverage-report, diff-coverage, mutation-report, a11y-report, size-check. v0.3 adds storybook, publint, attw, perf-smoke.

Opting out of Socket

Socket requires a free account. To opt out:

{
  "supplyChain": {
    "scanners": { "socket": { "required": false } }
  }
}

required: false is the default for every boilerplate. Internal @geenius/* packages opt-in to strict mode in CI via SOCKET_API_TOKEN. Env override for one-off CI runs:

GEENIUS_SUPPLY_CHAIN_SOCKET=off geenius-release supply-chain

Configuration reference

See .docs/DOCS/PACKAGES/RELEASE_TOOLKIT.md for the full config schema and examples, and .docs/PRDS/packages/PACKAGE_RELEASE_TOOLKIT_PRD.md for the design rationale.

Exit codes

Code	Meaning
`0`	Required steps passed (optional steps may have skipped)
`1`	At least one required step failed
`2`	Configuration error
`3`	Environment error (missing pnpm, missing lockfile)
`4`	Internal toolkit bug

Stable across versions. CI integrations can rely on them.

Optional git hooks

The toolkit ships a non-blocking pre-push hook template at templates/husky/pre-push. It runs pnpm run audit:supply-chain before each push and reports findings without blocking the push (remove the trailing || exit 0 in the script to make findings blocking).

Install per-repo:

cp node_modules/@geenius/release-toolkit/templates/husky/pre-push .husky/pre-push
chmod +x .husky/pre-push

The hook is not auto-installed by adding the toolkit as a dependency — adoption is opt-in.

Reports

Every subcommand writes a JSON report at .eval/release-toolkit/<command>.json. The shape is documented in src/types.ts and is consumed by CI integrations and downstream report aggregators.

Development

pnpm install
pnpm build
pnpm test
pnpm lint
pnpm exec geenius-release gauntlet   # dogfood

License

FSL-1.1-Apache-2.0