plop-pack-git-commit

PlopJS action pack that stages changes, creates a git commit, and pushes to origin.

Inspired by plop-pack-git-init, but focused on committing existing or generated files in an already initialized repository.

Installation

pnpm add plop-pack-git-commit
# or
npm i plop-pack-git-commit

Usage

module.exports = function (plop) {
  plop.load("plop-pack-git-commit");

  plop.setGenerator("example", {
    prompts: [],
    actions: [
      {
        type: "add",
        path: "notes/{{name}}.md",
        template: "# {{name}}\n",
      },
      {
        type: "gitCommit",
        path: process.cwd(),
        message: "docs: add {{name}} note",
        files: "notes/{{name}}.md",
      },
    ],
  });
};

Commit specific file(s)

{
  type: "gitCommit",
  path: process.cwd(),
  message: "docs: add contact note",
  files: "notes/contacto.md",
}

files accepts a string or an array of strings.

Commit everything pending

{
  type: "gitCommit",
  path: process.cwd(),
  message: "chore: sync generated files",
  all: true,
}

This runs git add -A before committing.

Options

Option	Type	Default	Description
path	string	process.cwd()	Repository path
message	string	required	Commit message
files	string | string[]	—	Stage only these paths
all	boolean	—	Stage all changes with git add -A
verbose	boolean	false	Stream git output to the terminal
skipEmpty	boolean	true	Resolve instead of failing when there is nothing to commit

Provide either files or all: true. They are mutually exclusive.

Push behavior

After a successful commit, the action always runs:

git push origin HEAD

• If there was nothing to commit (skipEmpty), push is skipped.
• If origin is missing or push fails, the action resolves with a warning instead of failing the generator. The commit remains local.

Schema export

You can validate action configs outside Plop:

import { gitCommitConfigSchema } from "plop-pack-git-commit";

const result = gitCommitConfigSchema.safeParse({
  path: process.cwd(),
  message: "feat: add generator output",
  all: true,
});

Requirements

• git available in PATH
• Git user identity configured (user.name, user.email)
• Remote origin configured when you expect push to succeed

Development

pnpm install
pnpm check   # lint + test + build
pnpm lint
pnpm test
pnpm build

GitHub Actions

Workflow	Trigger	Purpose
CI	push/PR to main	lint, test, build
Security audit	push/PR + weekly	pnpm audit fails on high/critical
Dependency review	pull requests	blocks PRs that add vulnerable deps
CodeQL	push/PR + weekly	static analysis for TypeScript/JavaScript
Release	GitHub Release published	verify tag, pnpm check, publish to npm

Dependabot opens weekly PRs to update dependencies.

Security releases (automated)

When a Dependabot security PR is merged to main:

1. Security release prepare checks:
   • PR author is dependabot[bot]
   • PR body/labels reference security advisories (GHSA/CVE)
   • pnpm audit shows fewer vulnerabilities than before the merge
2. If all pass, it opens a review PR (security-release/x.y.z) that bumps the patch version (z) and prepends a Security section to CHANGELOG.md (packages, versions, advisories).
3. If audit does not improve, no release PR is created.
4. When you merge the security release PR, Security release publish tags vx.y.z, creates a GitHub Release titled Security release x.y.z, and publishes to npm.

Manual feature releases still use the Release workflow (GitHub Release UI). Bot-authored security releases use the dedicated publish workflow to avoid duplicate npm publishes.

Releasing to npm (manual)

1. Bump version in package.json (e.g. 0.1.1).
2. Commit, push to main, and create a GitHub Release with tag v0.1.1 (must match package.json).
3. The Release workflow runs pnpm check and publishes with npm provenance.

Repository secret required:

Secret	Purpose
NPM_TOKEN	npm automation token with publish access to this package

Enable Dependabot alerts and Code scanning under repository Settings → Code security.

License

MIT