feat: use nunjucks

.github/CODEOWNERS

@@ -1,3 +1,3 @@
-# This file is automatically added by @npmcli/template-oss. Do not edit.
+This file is automatically added by @npmcli/template-oss. Do not edit.
 
 * @npm/cli-team

.github/actions/deps/action.yml

@@ -18,4 +18,5 @@ runs:
   steps:
     - name: Install Dependencies
       shell: ${{ inputs.shell }}
-      run: npm ${{ inputs.command }} ${{ inputs.flags }}
+      run: |
+        npm ${{ inputs.command }} ${{ inputs.flags }}

.github/actions/get-workspaces/action.yml

@@ -0,0 +1,16 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: 'Get Workspaces'
+description: 'Get workspaces'
+
+inputs:
+  files:
+    description: 'files'
+
+outputs:
+  flags:
+    description: 'workspace flags'
+
+runs:
+  using: 'node16'
+  main: 'index.js'

.github/actions/release-manager/action.yml

@@ -0,0 +1,16 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: 'Get Workspaces'
+description: 'Get workspaces'
+
+inputs:
+  files:
+    description: 'files'
+
+outputs:
+  flags:
+    description: 'workspace flags'
+
+runs:
+  using: 'node16'
+  main: 'index.js'

.github/actions/release-please/action.yml

@@ -0,0 +1,16 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: 'Get Workspaces'
+description: 'Get workspaces'
+
+inputs:
+  files:
+    description: 'files'
+
+outputs:
+  flags:
+    description: 'workspace flags'
+
+runs:
+  using: 'node16'
+  main: 'index.js'

.github/actions/setup/action.yml

@@ -69,16 +69,19 @@ runs:
     - name: Install npm@7
       if: inputs.npm-version && steps.node-version.outputs.ten-or-lower
       shell: ${{ inputs.shell }}
-      run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      run: |
+        npm i --prefer-online --no-fund --no-audit -g npm@7
 
     - name: Install npm@${{ inputs.npm-version }}
       if: inputs.npm-version && !steps.node-version.outputs.ten-or-lower
       shell: ${{ inputs.shell }}
-      run: npm i --prefer-online --no-fund --no-audit -g npm@${{ inputs.npm-version }}
+      run: |
+        npm i --prefer-online --no-fund --no-audit -g npm@${{ inputs.npm-version }}
 
     - name: npm Version
       shell: ${{ inputs.shell }}
-      run: npm -v
+      run: |
+        npm -v
 
     - name: Setup Dependencies
       if: inputs.deps == 'true'

.github/actions/test/action.yml

@@ -15,4 +15,5 @@ runs:
   steps:
     - name: Test
       shell: ${{ inputs.shell }}
-      run: npm test --ignore-scripts ${{ inputs.flags }}
+      run: |
+        npm test --ignore-scripts ${{ inputs.flags }}

.github/workflows/audit.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   audit:
     name: Audit Dependencies
-    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npm-cli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
+    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npmcli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ on:
 jobs:
   lint:
     name: Lint
-    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npm-cli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
+    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npmcli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -78,7 +78,7 @@ jobs:
 
   test:
     name: Test - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
-    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npm-cli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
+    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npmcli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
     runs-on: ${{ matrix.platform.os }}
     defaults:
       run:

.github/workflows/codeql-analysis.yml

@@ -27,7 +27,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npm-cli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
+    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npmcli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/post-dependabot.yml

@@ -16,7 +16,6 @@ jobs:
       contents: write
     outputs:
       sha: ${{ steps.sha.outputs.sha }}
-    # TODO: remove head_ref check after testing
     if: github.repository_owner == 'npm' && github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     defaults:

.github/workflows/pull-request.yml

@@ -25,7 +25,7 @@ on:
 jobs:
   commitlint:
     name: Lint Commits
-    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npm-cli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
+    if: github.repository_owner == 'npm' && !(!inputs.force && github.event_name == 'pull_request' && ((startsWith(github.head_ref, 'dependabot/') && contains(github.head_ref, '/npmcli/template-oss')) || startsWith(github.head_ref, 'release/v*')))
     runs-on: ubuntu-latest
     defaults:
       run:

.github/workflows/release.yml

@@ -126,7 +126,8 @@ jobs:
           RELEASE_PR_NUMBER: ${{ needs.release.outputs.pr-number }}
           RELEASE_COMMENT_ID: ${{ needs.release.outputs.comment-id }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm run rp-pull-request --ignore-scripts -ws -iwr --if-present
+        run: |
+          npm run rp-pull-request --ignore-scripts -ws -iwr --if-present
 
       - name: Commit
         id: commit

.gitignore

@@ -5,13 +5,16 @@
 
 # keep these
 !**/.gitignore
+!/.commitlintrc.js
 !/.eslintrc.js
 !/.eslintrc.local.*
 !/.github/
 !/.gitignore
+!/.npmrc
 !/.release-please-manifest.json
 !/bin/
 !/CHANGELOG*
+!/CODE_OF_CONDUCT.md
 !/docs/
 !/lib/
 !/LICENSE*
@@ -20,6 +23,7 @@
 !/README*
 !/release-please-config.json
 !/scripts/
+!/SECURITY.md
 !/tap-snapshots/
 !/test/
 !/workspaces/

lib/config.js

@@ -1,29 +1,26 @@
-const { merge: _merge } = require('lodash')
+const { merge: _merge, pick, omit } = require('lodash')
 const { resolvePath } = require('./resolve-config.js')
 
 const merge = (...o) => _merge({}, ...o)
 
 // Lookup a key in any config. First lookup the toplevel key
 // and then lookup the same key in either the toplevel `root`
 // or `workspace` objects
-const getConfigs = (config, key, options) => {
-  const shared = config[key]
-  return [
-    shared,
-    options.isRoot ? config.root?.[key] : config.workspace?.[key],
-  ]
+const getConfigs = (config, keys, options) => {
+  const shared = pick(config, keys)
+  const pkg = options.pkg.isRoot ? config.root : config.workspace
+  return [shared, pkg].map(c => pick(c, keys))
 }
 
 // Get the `data` config object and run it through the `postData`
 // config function at each layer and then merge the results
 const getData = (options) => {
   const dataLayers = options.pkg.config.map(c => {
     const res = []
-    const datas = getConfigs(c.config, 'data', options)
-    const postDatas = getConfigs(c.config, 'postData', options)
-    for (const [index, data] of Object.entries(datas)) {
-      const postData = typeof postDatas[index] === 'function' ? postDatas[index](data, options) : {}
-      res.push(merge(data, postData))
+    const datas = getConfigs(c.config, ['data', 'postData'], options)
+    for (const { data, postData } of datas) {
+      const pData = typeof postData === 'function' ? postData(data, options) : {}
+      res.push(merge(data, pData))
     }
     return merge(...res)
   })
@@ -59,9 +56,13 @@ const getRules = (command, options) => {
 
     if (ruleCommands) {
       const rule = merge(...ruleLayers.map(ruleLayer => {
+        const mergeKeys = ['files', 'rootFiles']
         const layerRuleConfig = {
           ...ruleLayer,
-          options: merge(...getConfigs(ruleLayer, 'options', options)),
+          options: {
+            ...omit(ruleLayer.options, mergeKeys),
+            ...merge(...getConfigs(ruleLayer.options, mergeKeys, options)),
+          },
           baseDir,
         }
         return config ? config(layerRuleConfig, options) : layerRuleConfig

test/apply/engines.js

@@ -55,7 +55,7 @@ t.test('latest ci versions in workspace', async (t) => {
         'source.json': '{ "node": {{{ json engines }}} }',
         'index.js': `module.exports={
           rootRepo:{add:{'target.json':'source.json'}},
-          workspaceRepo:{add:{'target-{{ pkgNameFs }}.json':'source.json'}}
+          workspaceRepo:{add:{'target-{$ pkgNameFs $}.json':'source.json'}}
         }`,
       },
     },

workspaces/config/lib/actions/audit.yml

@@ -6,16 +6,16 @@ runs:
     - name: Run Full Audit
       shell: bash
       run: |
-        if ! {{ rootNpmPath }} audit; then
-          COUNT=$({{ rootNpmPath }} audit --audit-level=none --json | jq -r '.metadata.vulnerabilities.total')
+        if ! {$ rootNpmPath $} audit; then
+          COUNT=$({$ rootNpmPath $} audit --audit-level=none --json | jq -r '.metadata.vulnerabilities.total')
           echo "::warning title=All Vulnerabilities::Found $COUNT"
         fi
 
     - name: Run Production Audit
       shell: bash
       run: |
-        if ! {{ rootNpmPath }} audit --omit=dev; then
-          COUNT=$({{ rootNpmPath }} audit --omit=dev --audit-level=none --json | jq -r '.metadata.vulnerabilities.total')
+        if ! {$ rootNpmPath $} audit --omit=dev; then
+          COUNT=$({$ rootNpmPath $} audit --omit=dev --audit-level=none --json | jq -r '.metadata.vulnerabilities.total')
           echo "::error title=Production Vulnerabilities::Found $COUNT"
           exit 1
         fi

workspaces/config/lib/actions/changed-files.yml

@@ -7,7 +7,7 @@ inputs:
 
 outputs:
   names:
-    value: $\{{ steps.files.outputs.result }}
+    value: ${{ steps.files.outputs.result }}
 
 runs:
   using: composite
@@ -16,7 +16,7 @@ runs:
       uses: actions/github-script@v6
       id: files
       with:
-        github-token: $\{{ inputs.token }}
+        github-token: ${{ inputs.token }}
         script: |
           const { repo: { owner, repo }, eventName, payload, sha } = context
           let files

workspaces/config/lib/actions/changed-workspaces.yml

@@ -8,22 +8,22 @@ inputs:
 
 outputs:
   flags:
-    value: $\{{ steps.workspaces.outputs.flags }}
+    value: ${{ steps.workspaces.outputs.flags }}
 
 runs:
   using: composite
   steps:
     - name: Get Changed Files
       uses: ./.github/actions/changed-files
-      if: $\{{ !inputs.files }}
+      if: ${{ !inputs.files }}
       id: files
       with:
-        token: $\{{ inputs.token }}
+        token: ${{ inputs.token }}
 
     - name: Get Workspaces
       shell: bash
       id: workspaces
       uses: ./.github/actions/get-workspaces
       with:
-        files: $\{{ inputs.files || steps.files.outputs.names }}
+        files: ${{ inputs.files || steps.files.outputs.names }}
 

workspaces/config/lib/actions/conclude-check.yml

@@ -18,6 +18,6 @@ runs:
     - name: Conclude Check
       uses: LouisBrunner/checks-action@v1.5.0
       with:
-        token: $\{{ inputs.token }}
-        conclusion: $\{{ inputs.conclusion }}
-        check_id: $\{{ inputs.check-id }}
+        token: ${{ inputs.token }}
+        conclusion: ${{ inputs.conclusion }}
+        check_id: ${{ inputs.check-id }}

workspaces/config/lib/actions/create-check.yml

@@ -18,7 +18,7 @@ inputs:
 outputs:
   check-id:
     description: The ID of the check that was created
-    value: $\{{ steps.check.outputs.check_id }}
+    value: ${{ steps.check.outputs.check_id }}
 
 runs:
   using: composite
@@ -27,9 +27,9 @@ runs:
       uses: actions/github-script@v6
       id: workflow-job
       env:
-        JOB_NAME: $\{{ inputs.job-name }}
+        JOB_NAME: ${{ inputs.job-name }}
       with:
-        github-token: $\{{ inputs.token }}
+        github-token: ${{ inputs.token }}
         script: |
           const { JOB_NAME } = process.env
           const { repo: { owner, repo }, runId, serverUrl } = context
@@ -46,7 +46,7 @@ runs:
 
           console.log(`found job: ${JSON.stringify(job, null, 2)}`)
 
-          const shaUrl = `${serverUrl}/${owner}/${repo}/commit/$\{{ inputs.sha }}`
+          const shaUrl = `${serverUrl}/${owner}/${repo}/commit/${{ inputs.sha }}`
           const summary = `This check is assosciated with ${shaUrl}\n\n`
           const message = job?.html_url
             ? `For run logs, click here: ${job.html_url}`
@@ -60,8 +60,8 @@ runs:
       uses: LouisBrunner/checks-action@v1.5.0
       id: check
       with:
-        token: $\{{ inputs.token }}
-        status: $\{{ inputs.job-status }}
-        name: $\{{ inputs.job-name }}
-        sha: $\{{ inputs.sha }}
-        output: $\{{ steps.workflow-job.outputs.result }}
+        token: ${{ inputs.token }}
+        status: ${{ inputs.job-status }}
+        name: ${{ inputs.job-name }}
+        sha: ${{ inputs.sha }}
+        output: ${{ steps.workflow-job.outputs.result }}

workspaces/config/lib/actions/deps.yml

@@ -9,11 +9,12 @@ inputs:
     default: ''
   shell:
     description: shell to run on
-    default: '{{ shell }}'
+    default: '{$ shell $}'
 
 runs:
   using: composite
   steps:
     - name: Install Dependencies
-      shell: $\{{ inputs.shell }}
-      run: {{ rootNpmPath }} $\{{ inputs.command }} $\{{ inputs.flags }}
+      shell: ${{ inputs.shell }}
+      run: |
+        {$ rootNpmPath $} ${{ inputs.command }} ${{ inputs.flags }}

workspaces/config/lib/actions/lint.yml

@@ -11,8 +11,8 @@ runs:
     - name: Lint
       shell: bash
       run: |
-        {{ rootNpmPath }} run lint --ignore-scripts $\{{ inputs.flags }}
+        {$ rootNpmPath $} run lint --ignore-scripts ${{ inputs.flags }}
     - name: Post Lint
       shell: bash
       run: |
-        {{ rootNpmPath }} run postlint --ignore-scripts $\{{ inputs.flags }}
+        {$ rootNpmPath $} run postlint --ignore-scripts ${{ inputs.flags }}