docs(releaser): add documentation URL https://releaser.k3nny.fr

- README.md: add Documentation link below the release badge - ROADMAP.md: update shipped docs-site entry with live URL - docs/hugo.toml: set baseURL to the live site address Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
build(ci): release v1.6.2 — staticcheck in task ci, SA4006 fix
2026-07-11 22:56:39 +02:00 · 2026-07-11 21:47:39 +02:00 · 2026-07-11 21:45:49 +02:00 · 2026-07-11 21:38:26 +02:00 · 2026-07-11 21:10:41 +02:00 · 2026-07-11 17:59:13 +02:00
32 changed files with 3058 additions and 97 deletions
@@ -0,0 +1,67 @@
 name: docs
 on:
  push:
    branches:
      - main
    paths:
      - 'docs/**'
      - '.gitea/workflows/docs.yml'
 vars:
  HUGO_VERSION: "0.128.2"
  GEEKDOC_VERSION: "v4.1.1"
 jobs:
  deploy:
    name: Build and deploy docs
    runs-on: ubuntu-latest
    container:
      image: alpine:latest
    steps:
      - name: Install tools
        run: apk add --no-cache curl git tar
      - name: Checkout
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SERVER_URL: ${{ github.server_url }}
          REPO: ${{ github.repository }}
        run: |
          git clone --depth 1 \
            "$(echo "$SERVER_URL" | sed "s|https://|https://oauth2:${TOKEN}@|")/${REPO}.git" .
      - name: Install Hugo
        env:
          HUGO_VERSION: ${{ vars.HUGO_VERSION }}
        run: |
          curl -sSL "https://github.com/gohugoio/hugo/releases/download/v${HUGO_VERSION}/hugo_${HUGO_VERSION}_Linux-64bit.tar.gz" \
            | tar xz -C /usr/local/bin hugo
      - name: Download Geekdoc theme
        env:
          GEEKDOC_VERSION: ${{ vars.GEEKDOC_VERSION }}
        run: |
          mkdir -p docs/themes/geekdoc
          curl -sSL "https://github.com/thegeeklab/hugo-geekdoc/releases/download/${GEEKDOC_VERSION}/hugo-geekdoc.tar.gz" \
            | tar xz -C docs/themes/geekdoc
      - name: Build
        run: hugo --source docs --destination public --minify
      - name: Deploy to pages branch
        env:
          TOKEN: ${{ secrets.GITHUB_TOKEN }}
          SERVER_URL: ${{ github.server_url }}
          REPO: ${{ github.repository }}
        run: |
          cd docs/public
          git init
          git config user.email "ci@git.k3nny.fr"
          git config user.name "Gitea CI"
          git add .
          git commit -m "deploy docs $(date +%Y-%m-%dT%H:%M:%SZ)"
          git push --force \
            "$(echo "$SERVER_URL" | sed "s|https://|https://oauth2:${TOKEN}@|")/${REPO}.git" \
            HEAD:gh-pages
@@ -6,3 +6,7 @@ releaser-*
 coverage.out
 coverage.html
 # docs build artifacts (downloaded at build time)
 /docs/themes/
 /docs/public/
@@ -19,10 +19,48 @@ git:
  # author_name: ""
  # author_email: ""
-maven:
+  # Limit which commit types trigger a release (default: fix, feat, breaking).
-  # Path to pom.xml, relative to the repository root.
+  # releasable_types:
  #   - fix
  #   - feat
  #   - breaking
  # Configure which version component each commit type bumps.
  # Valid values: "patch" (default) or "minor".
  # bump_rules:
  #   breaking: "minor"
  #   feat: "patch"
  #   fix: "patch"
 # maven:
  # Single pom.xml path, relative to the repository root.
  # pom_path: "pom.xml"
  # Multiple pom.xml paths for multi-module projects (overrides pom_path).
  # pom_paths:
  #   - "pom.xml"
  #   - "module-a/pom.xml"
 # node:
  # Single package.json path (node processing is opt-in — no default).
  # package_json: "package.json"
  # Multiple package.json paths for monorepos (overrides package_json).
  # package_jsons:
  #   - "packages/frontend/package.json"
  #   - "packages/backend/package.json"
 # gradle:
  # Single build.gradle or build.gradle.kts path (opt-in — no default).
  # Both Groovy DSL (single-quoted) and Kotlin DSL (double-quoted) are supported.
  # build_file: "build.gradle"
  # Multiple build files for multi-module projects (overrides build_file).
  # build_files:
  #   - "build.gradle"
  #   - "module-a/build.gradle"
  #   - "module-b/build.gradle"
 gitlab:
  # GitLab instance URL. Falls back to the CI_SERVER_URL environment variable.
  # url: "https://gitlab.example.com"
@@ -3,6 +3,59 @@
 All notable changes to this project will be documented in this file.
 Format: [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 ## [1.6.2] - 2026-07-11
 ### Changed
 - **`task ci` now runs `go tool staticcheck ./...`** — runs between `go vet` and `go test`; matches the step already present in the Gitea CI workflow
 ### Fixed
 - **SA4006 in `TestLatestTagTagsIterFails`** — `err` from `gogit.PlainOpen` was assigned then immediately overwritten without being read; added the missing `if err != nil { t.Fatalf(...) }` check
 ## [1.6.1] - 2026-07-11
 ### Fixed
 - **CI root-permission failures** — four tests that used `os.Chmod` to force error paths were failing in Docker CI (which runs as root, where chmod has no enforcement effect); each now skips with `os.Getuid() == 0`; the gitutil test had broken skip logic that only fired if `Chmod` itself errored — replaced with the same upfront UID check
 ## [1.6.0] - 2026-07-11
 ### Added
 - **Gradle support** — new `internal/gradle` package; reads and writes the version assignment in `build.gradle` (Groovy DSL, single-quoted) and `build.gradle.kts` (Kotlin DSL, double-quoted); original quote style preserved on write; `regexp.QuoteMeta` ensures version strings with dots or special chars are safe
 - **`gradle.build_file` / `gradle.build_files` config** — opt-in, no default; `build_files` list overrides `build_file` for multi-module projects; follows the same multi-value pattern as `maven.pom_paths` and `node.package_jsons`
 - **`--gradle <path>` flag** — overrides `gradle.build_file` from config and clears `gradle.build_files`; mirrored in verbose config table as `gradle.paths`
 - **`FuzzReadVersion` / `FuzzWriteVersion`** in `internal/gradle` — 100% per-package statement coverage maintained across all 13 packages
 ## [1.5.1] - 2026-07-11
 ### Added
 - **Documentation site** — Hugo + Geekdoc theme; content covers installation, CLI reference, configuration, CI integration, and changelog; deployed to `gh-pages` via Gitea CI on push to `main`
 - **`docs:setup` / `docs:serve` / `docs:build` Taskfile tasks** — `docs:setup` downloads the Geekdoc theme bundle (idempotent); `docs:serve` runs Hugo with live reload; `docs:build` produces a minified static site
 - **`FuzzUpdate`** in `internal/changelog` — fuzzes arbitrary existing file content paired with a commit message, covering the `\n## [` insertion logic and idempotency guard
 - **`FuzzWriteVersion`** in `internal/node` — mirrors `FuzzReplaceProjectVersion` in `internal/maven`; fuzzes arbitrary JSON content with arbitrary old/new version strings
 ### Changed
 - **CLAUDE.md** — new "Fuzzing" section: authoritative table of which packages require fuzz tests and why, list of exempt packages with rationale, seed corpus guidelines
 ## [1.5.0] - 2026-07-11
 ### Added
 - **Multi-module Maven support** — `maven.pom_paths: [...]` lists multiple `pom.xml` paths (e.g. root + sub-modules); overrides `pom_path`; each path is updated and committed in the same release commit
 - **Node.js `package.json` support** — opt-in via `node.package_json` (single path) or `node.package_jsons` (list, overrides the single path); version is bumped in-place alongside `pom.xml` and `CHANGELOG.md`
 - **`git.bump_rules` config** — controls which version component each commit type bumps: `breaking`, `feat`, `fix` each accept `"patch"` (default) or `"minor"`; allows e.g. `feat: "minor"` to bump the minor component instead of patch
 - **Injectable function vars in `cmd/main.go`** — `absPath`, `gitAllCommits`, `gitCommitsSince`, `gitCommitFiles` are now package-level vars overridable in tests to inject errors, enabling 100% per-package statement coverage across all 12 packages
 ### Changed
 - **`--pom` flag** now clears `maven.pom_paths` before setting `maven.pom_path`, ensuring the CLI flag always wins over a multi-path config file entry
 - **`version.Next()` signature** — accepts a `map[commits.Type]semver.BumpLevel` bump-rules map as a sixth parameter; `nil` defaults to all-patch (no change to existing behaviour)
 - **Verbose config table** — now includes `git.bump_rules.breaking/feat/fix`, `maven.pom_paths` (effective list), and `node.paths` rows
 ## [1.4.0] - 2026-07-11
 ### Added
@@ -0,0 +1,97 @@
 # CLAUDE.md — project guidelines for releaser
 ## Overview
 `releaser` is a single-binary Go tool for GitFlow-based release automation. It targets Conventional Commits, versioned release branches (`release/X.Y`), and GitLab / GitHub release creation.
 ## Architecture
 ```
 cmd/main.go          — CLI entrypoint (cobra), run() pipeline, verbose output
 internal/branch/     — branch name parser → major/minor
 internal/changelog/  — CHANGELOG.md writer
 internal/commits/    — Conventional Commits parser (non-strict)
 internal/config/     — .releaser.yml loader + env var overlay + source tracking
 internal/ghclient/   — minimal GitHub Releases API client
 internal/gitutil/    — go-git helpers: tag discovery, commit walker, push
 internal/glclient/   — minimal GitLab Releases API client
 internal/maven/      — pom.xml version reader/writer
 internal/node/       — package.json version reader/writer
 internal/notes/      — release notes body generator
 internal/version/    — semver next-version calculator
 ```
 ## Code conventions
 - **No third-party test frameworks** — stdlib `testing` only.
 - **No interfaces for mocking** — inject function variables (`var absPath = filepath.Abs`) to test error paths.
 - **No comments explaining what** — only comments explaining *why* (hidden constraints, invariants, non-obvious workarounds).
 - **No error handling for impossible paths** — trust internal invariants; only validate at system boundaries.
 - **No abstractions ahead of need** — three similar lines beats a premature helper.
 ## Test coverage
 **100% per-package statement coverage is required** across all packages. Run:
 ```bash
 go test ./... -cover
 ```
 Every package must show `coverage: 100.0% of statements`.
 Strategies used in this project:
 - **Error path injection**: override `var absPath`, `var gitAllCommits`, etc. to return injected errors.
 - **Filesystem tricks**: `os.Mkdir` where a file is expected (invisible to go-git dirty check; fails os.WriteFile/os.ReadFile); `os.Chmod(..., 0444)` to make files read-only.
 - **Null byte paths**: `"path\x00name"` causes `os.Stat` to return `EINVAL` (not `ErrNotExist`), useful for testing stat-error paths that differ from file-not-found.
 - **In-memory git repos**: use go-git `PlainInit` + local bare remote for push tests.
 - **Direct function calls**: call unexported helpers (e.g. `printVerboseConfig`) directly with crafted inputs to cover branches that are dead via normal CLI flow.
 ## Fuzzing
 **Every package that parses free-form text or reads/writes arbitrary file content must have at least one fuzz test.** Run the full seed corpus with:
 ```bash
 go test -run='^Fuzz' ./...
 ```
 All seed cases must pass. The table below is authoritative — keep it in sync when adding packages or parsers:
 | Package | Fuzz target(s) | Why |
 |---------|---------------|-----|
 | `internal/branch` | `FuzzParse` | parses branch name strings |
 | `internal/changelog` | `FuzzUpdate` | rewrites arbitrary existing file content |
 | `internal/commits` | `FuzzParse` | parses arbitrary commit message strings |
 | `internal/gradle` | `FuzzReadVersion`, `FuzzWriteVersion` | reads/rewrites arbitrary Gradle build file content |
 | `internal/glclient` | `FuzzEncodeProjectPath` | encodes arbitrary project path strings |
 | `internal/maven` | `FuzzReadVersion`, `FuzzReplaceProjectVersion` | reads/rewrites arbitrary XML file content |
 | `internal/node` | `FuzzReadVersion`, `FuzzWriteVersion` | reads/rewrites arbitrary JSON file content |
 | `internal/notes` | `FuzzGenerate` | generates notes from arbitrary commit messages |
 Packages **not** requiring fuzz tests (no free-form text parsing): `internal/config` (yaml.v3 handles parsing), `internal/ghclient` (HTTP client, no text parsing), `internal/gitutil` (git operations), `internal/version` (typed inputs only), `cmd` (CLI orchestration). When adding a new package, check whether it parses text or rewrites files — if yes, add a row above.
 Fuzz seed corpus guidelines:
 - Include a realistic happy-path input as the first seed.
 - Include empty string, binary/non-UTF-8 bytes (`"\x00\xff"`), and inputs that stress known branches (e.g. existing `## [version]` heading for changelog).
 - The fuzz body must never assert on return values — only verify no panic.
 ## Dependency rules
 - **No new external dependencies** unless absolutely necessary. The project deliberately avoids pulling in large ecosystems.
 - go-git (`github.com/go-git/go-git/v5`) for all git operations.
 - cobra for CLI parsing.
 - gopkg.in/yaml.v3 for config.
 ## Config design
 - New config fields go in the appropriate `*Config` struct in `internal/config/config.go`.
 - `defaultSources()` must be updated to include every new key.
 - `LoadWithSources` overlay detection must cover every new field.
 - `printVerboseConfig` in `cmd/main.go` must show every new config value.
 ## Multi-value config pattern
 When a config supports both a single value and multiple values (like `pom_path` / `pom_paths`):
 - Single field: `PomPath string`
 - Multi field: `PomPaths []string`
 - `EffectivePomPaths()` method: `PomPaths` wins if non-empty, else `PomPath` if set, else default.
 - `--pom` CLI flag clears `PomPaths` and sets `PomPath` only.
@@ -1,9 +1,11 @@
 # releaser
-![release](https://img.shields.io/badge/release-v1.4.0-blue.svg)
+![release](https://img.shields.io/badge/release-v1.6.2-blue.svg)
 A CI-friendly release automation tool for GitFlow workflows using Conventional Commits.
 **[Documentation](https://releaser.k3nny.fr)**
 ## Problem
 Standard tools like `semantic-release` are designed for trunk-based development. In a GitFlow setup with versioned release branches (`release/1.1`, `release/1.2`), they either fail to respect the branch's version range or require brittle configuration.
@@ -23,16 +25,18 @@ release/1.2 branch
 2. **Tag discovery** — finds the latest tag matching `major.minor.*` on the current branch
 3. **Commit analysis** — parses Conventional Commits between last tag and HEAD
 4. **Version bump** — increments patch (the minor is owned by the branch)
-5. **Release** — updates `pom.xml`, commits, tags, creates GitLab or GitHub release
+5. **Release** — updates `pom.xml` / `package.json` / `build.gradle`, commits, tags, creates GitLab or GitHub release
 ## Version bump rules
-| Commit type      | Bump    | Notes                                      |
+By default, all releasable commits bump the **patch** component (minor is pinned to the branch). You can override this per commit type via `git.bump_rules` in `.releaser.yml`:
-|------------------|---------|--------------------------------------------|
+
-| `fix:`           | patch   |                                            |
+| Commit type      | Default | Configurable via `bump_rules`                  |
-| `feat:`          | patch   | minor is pinned to branch                  |
+|------------------|---------|------------------------------------------------|
-| `feat!:` / `BREAKING CHANGE` | patch | same — branch defines the minor boundary |
+| `fix:`           | patch   | `fix: "minor"` to bump minor instead           |
-| `chore:`, `docs:`, etc. | none |                                        |
+| `feat:`          | patch   | `feat: "minor"` to bump minor instead          |
 | `feat!:` / `BREAKING CHANGE` | patch | `breaking: "minor"` to bump minor  |
 | `chore:`, `docs:`, etc. | none   | —                                       |
 | unparseable msg  | none    | non-strict mode: silently ignored              |
 ## Usage
@@ -95,9 +99,29 @@ git:
    - fix
    - feat
    - breaking
  bump_rules:                                        # which version component each type bumps
    breaking: "patch"                                # "minor" to bump minor on breaking changes
    feat: "patch"
    fix: "patch"
 maven:
-  pom_path: "pom.xml"                                # relative to repo root
+  pom_path: "pom.xml"                                # single pom.xml, relative to repo root
  # pom_paths:                                       # multi-module: list overrides pom_path
  #   - "pom.xml"
  #   - "module-a/pom.xml"
  #   - "module-b/pom.xml"
 node:                                                # opt-in — no default; omit to skip
  # package_json: "package.json"                     # single path
  # package_jsons:                                   # monorepo: list overrides package_json
  #   - "packages/frontend/package.json"
  #   - "packages/backend/package.json"
 gradle:                                              # opt-in — no default; omit to skip
  # build_file: "build.gradle"                       # Groovy or Kotlin DSL; single path
  # build_files:                                     # multi-module: list overrides build_file
  #   - "build.gradle"
  #   - "module-a/build.gradle"
 gitlab:
  url: "https://gitlab.example.com"                  # or env CI_SERVER_URL
@@ -74,12 +74,16 @@
 - [x] ~~GitHub release support~~ — ✓ shipped v1.4.0 (`internal/ghclient`, `GITHUB_TOKEN` env, `github.token`/`github.repo` config; GitHub takes precedence over GitLab)
 - [x] ~~SSH agent push~~ — ✓ shipped v1.4.0 (go-git `gitssh.NewSSHAgentAuth` for `git@`/`ssh://` remotes)
 - [x] ~~Configurable bump rules~~ — ✓ shipped v1.4.0 (`git.releasable_types` config; filter which commit types trigger a release)
- [ ] Documentation site
+- [x] ~~Documentation site~~ — ✓ shipped v1.5.1 (Hugo + Geekdoc; installation, CLI reference, configuration, CI integration pages; live at https://releaser.k3nny.fr)
 ## v1.5 — Multi-module, Node.js, configurable bump rules ✅
 - [x] Multi-module Maven support (`maven.pom_paths: [...]` updates multiple `pom.xml` files in one release)
 - [x] `package.json` version bump for Node.js projects (`node.package_json` / `node.package_jsons`)
 - [x] Configurable bump rules per commit type (`git.bump_rules.breaking/feat/fix: "minor" | "patch"`)
 - [x] 100% per-package statement coverage across all 12 packages
 ## Future / backlog
- Multi-module Maven support (multiple `pom.xml` paths)
+- ~~Gradle support (`build.gradle` / `build.gradle.kts`)~~ — ✓ shipped v1.6.0 (`internal/gradle`; Groovy + Kotlin DSL; multi-module via `gradle.build_files`; `--gradle` flag)
 - Gradle support (`build.gradle` / `build.gradle.kts`)
 - `package.json` version bump support (Node.js projects)
 - Slack / Teams notification on release
 - Configurable bump rules (e.g. treat `feat:` as minor on `main` branch)
@@ -4,6 +4,7 @@ vars:
  BIN: ./bin/releaser
  PKG: ./...
  FUZZ_TIME: 30s
  GEEKDOC_VERSION: "v4.1.1"
 tasks:
  default:
@@ -76,7 +77,7 @@ tasks:
      - go test -run='^Fuzz' {{.PKG}}
  ci:
-    desc: Full CI pipeline — tidy check, vet, test
+    desc: Full CI pipeline — tidy check, vet, staticcheck, test
    cmds:
      - task: tidy
      - |
@@ -85,6 +86,7 @@ tasks:
          exit 1
        fi
      - task: lint
      - go tool staticcheck ./...
      - task: test
  clean:
@@ -105,3 +107,23 @@ tasks:
      TAG: '{{.TAG | default "releaser:dev"}}'
    cmds:
      - docker run --rm {{.TAG}} {{.CLI_ARGS}}
  docs:setup:
    desc: Download Geekdoc theme into docs/themes/geekdoc/
    cmds:
      - mkdir -p docs/themes/geekdoc
      - curl -sSL "https://github.com/thegeeklab/hugo-geekdoc/releases/download/{{.GEEKDOC_VERSION}}/hugo-geekdoc.tar.gz" | tar xz -C docs/themes/geekdoc
    status:
      - test -f docs/themes/geekdoc/theme.toml
  docs:serve:
    desc: Serve docs locally with live reload (requires hugo)
    deps: [docs:setup]
    cmds:
      - hugo server --source docs
  docs:build:
    desc: Build docs to docs/public/ (requires hugo)
    deps: [docs:setup]
    cmds:
      - hugo --source docs --destination public --minify
@@ -18,7 +18,9 @@ import (
 	"git.k3nny.fr/releaser/internal/ghclient"
 	"git.k3nny.fr/releaser/internal/gitutil"
 	"git.k3nny.fr/releaser/internal/glclient"
 	"git.k3nny.fr/releaser/internal/gradle"
 	"git.k3nny.fr/releaser/internal/maven"
 	"git.k3nny.fr/releaser/internal/node"
 	"git.k3nny.fr/releaser/internal/notes"
 	semver "git.k3nny.fr/releaser/internal/version"
 )
@@ -50,10 +52,44 @@ git:
  #   - feat
  #   - breaking
  # Configure which version component each commit type bumps.
  # Valid values: "patch" (default) or "minor".
  # bump_rules:
  #   breaking: "minor"   # bump minor version instead of patch on breaking changes
  #   feat: "patch"
  #   fix: "patch"
 maven:
-  # Path to pom.xml, relative to the repository root.
+  # Single pom.xml path, relative to the repository root.
  # pom_path: "pom.xml"
  # Multiple pom.xml paths for multi-module projects (overrides pom_path).
  # pom_paths:
  #   - "pom.xml"
  #   - "module-a/pom.xml"
  #   - "module-b/pom.xml"
 node:
  # Single package.json path (node processing is opt-in — no default).
  # package_json: "package.json"
  # Multiple package.json paths for monorepos (overrides package_json).
  # package_jsons:
  #   - "package.json"
  #   - "packages/frontend/package.json"
  #   - "packages/backend/package.json"
 gradle:
  # Single build.gradle or build.gradle.kts path (opt-in — no default).
  # Both Groovy DSL (single-quoted) and Kotlin DSL (double-quoted) are supported.
  # build_file: "build.gradle"
  # Multiple build files for multi-module projects (overrides build_file).
  # build_files:
  #   - "build.gradle"
  #   - "module-a/build.gradle"
  #   - "module-b/build.gradle"
 gitlab:
  # GitLab instance URL. Falls back to the CI_SERVER_URL environment variable.
  # url: "https://gitlab.example.com"
@@ -84,6 +120,14 @@ var (
 // exitFn is a variable so tests can intercept os.Exit calls.
 var exitFn = os.Exit
 // injectable function variables for testing error paths.
 var (
 	absPath        = filepath.Abs
 	gitAllCommits  = gitutil.AllCommits
 	gitCommitsSince = gitutil.CommitsSince
 	gitCommitFiles = gitutil.CommitFiles
 )
 // releasePublisher is implemented by both glclient and ghclient.
 type releasePublisher interface {
 	CreateRelease(ctx context.Context, tagName, body string) error
@@ -117,6 +161,7 @@ func newRootCmd() *cobra.Command {
 		branchOverride  string
 		repoPath        string
 		pomOverride     string
 		gradleOverride  string
 		changelogFile   string
 		tagPrefixFlag   string
 		tagPrefixSet    bool
@@ -139,6 +184,7 @@ func newRootCmd() *cobra.Command {
 				repoPath:       repoPath,
 				branchOverride: branchOverride,
 				pomOverride:    pomOverride,
 				gradleOverride: gradleOverride,
 				changelogFile:  changelogFile,
 				tagPrefixFlag:  tagPrefixFlag,
 				tagPrefixSet:   tagPrefixSet,
@@ -164,6 +210,7 @@ func newRootCmd() *cobra.Command {
 	root.Flags().StringVar(&branchOverride, "branch", "", "override branch name detection (required in detached HEAD)")
 	root.Flags().StringVar(&repoPath, "repo", ".", "path to git repository")
 	root.Flags().StringVar(&pomOverride, "pom", "", "override maven.pom_path from config")
 	root.Flags().StringVar(&gradleOverride, "gradle", "", "override gradle.build_file from config")
 	root.Flags().StringVar(&changelogFile, "changelog-file", "CHANGELOG.md", "path to changelog file relative to repo root")
 	root.Flags().StringVar(&tagPrefixFlag, "tag-prefix", "", "override git.tag_prefix from config")
 	root.Flags().StringVar(&patternFlag, "branch-pattern", "", "override git.branch_pattern from config")
@@ -188,6 +235,7 @@ type options struct {
 	repoPath        string
 	branchOverride  string
 	pomOverride     string
 	gradleOverride  string
 	changelogFile   string
 	tagPrefixFlag   string
 	tagPrefixSet    bool
@@ -215,7 +263,39 @@ func printVerboseConfig(cfg config.Config, src config.Sources) {
 			}
 			return strings.Join(cfg.Git.ReleasableTypes, ", ")
 		}()},
-		{"maven.pom_path", cfg.Maven.PomPath},
+		{"git.bump_rules.breaking", func() string {
 			if cfg.Git.BumpRules.Breaking == "" {
 				return "patch"
 			}
 			return cfg.Git.BumpRules.Breaking
 		}()},
 		{"git.bump_rules.feat", func() string {
 			if cfg.Git.BumpRules.Feat == "" {
 				return "patch"
 			}
 			return cfg.Git.BumpRules.Feat
 		}()},
 		{"git.bump_rules.fix", func() string {
 			if cfg.Git.BumpRules.Fix == "" {
 				return "patch"
 			}
 			return cfg.Git.BumpRules.Fix
 		}()},
 		{"maven.pom_paths", strings.Join(cfg.Maven.EffectivePomPaths(), ", ")},
 		{"node.paths", func() string {
 			paths := cfg.Node.EffectivePaths()
 			if len(paths) == 0 {
 				return "(not configured)"
 			}
 			return strings.Join(paths, ", ")
 		}()},
 		{"gradle.paths", func() string {
 			paths := cfg.Gradle.EffectiveBuildFiles()
 			if len(paths) == 0 {
 				return "(not configured)"
 			}
 			return strings.Join(paths, ", ")
 		}()},
 		{"gitlab.url", cfg.GitLab.URL},
 		{"gitlab.token", func() string {
 			if cfg.GitLab.Token != "" {
@@ -257,11 +337,25 @@ func initConfig(absRepo string) error {
 	return nil
 }
 func parseBumpRules(rules config.BumpRulesConfig) map[commits.Type]semver.BumpLevel {
 	m := map[commits.Type]semver.BumpLevel{}
 	if rules.Breaking == "minor" {
 		m[commits.TypeBreaking] = semver.BumpMinor
 	}
 	if rules.Feat == "minor" {
 		m[commits.TypeFeat] = semver.BumpMinor
 	}
 	if rules.Fix == "minor" {
 		m[commits.TypeFix] = semver.BumpMinor
 	}
 	return m
 }
 func run(o options) error {
 	logHeader(version)
 	// --- Config ---
-	absRepo, err := filepath.Abs(o.repoPath)
+	absRepo, err := absPath(o.repoPath)
 	if err != nil {
 		return fmt.Errorf("resolve repo path: %w", err)
 	}
@@ -286,7 +380,13 @@ func run(o options) error {
 	}
 	if o.pomOverride != "" {
 		cfg.Maven.PomPath = o.pomOverride
-		src["maven.pom_path"] = "flag: --pom"
+		cfg.Maven.PomPaths = nil
 		src["maven.pom_paths"] = "flag: --pom"
 	}
 	if o.gradleOverride != "" {
 		cfg.Gradle.BuildFile = o.gradleOverride
 		cfg.Gradle.BuildFiles = nil
 		src["gradle.build_files"] = "flag: --gradle"
 	}
 	if o.patternSet {
 		cfg.Git.BranchPattern = o.patternFlag
@@ -345,9 +445,9 @@ func run(o options) error {
 	// --- Commit range ---
 	var messages []string
 	if lastTag == "" {
-		messages, err = gitutil.AllCommits(repo)
+		messages, err = gitAllCommits(repo)
 	} else {
-		messages, err = gitutil.CommitsSince(repo, lastTag)
+		messages, err = gitCommitsSince(repo, lastTag)
 	}
 	if err != nil {
 		return fmt.Errorf("read commits: %w", err)
@@ -398,7 +498,7 @@ func run(o options) error {
 	}
 	releasable := commits.ReleasableSet(cfg.Git.ReleasableTypes)
-	nextVersion, ok := semver.Next(info.Major, info.Minor, currentPatch, types, releasable)
+	nextVersion, ok := semver.Next(info.Major, info.Minor, currentPatch, types, releasable, parseBumpRules(cfg.Git.BumpRules))
 	if !ok {
 		logWarn("no releasable commits found")
 		return errNothingToRelease
@@ -440,14 +540,17 @@ func run(o options) error {
 	if !o.tagOnly {
 		var filesToCommit []string
-		// pom.xml
+		// pom.xml (supports multi-module via pom_paths)
-		pomPath := filepath.Join(absRepo, cfg.Maven.PomPath)
+		anyPom := false
 		for _, relPomPath := range cfg.Maven.EffectivePomPaths() {
 			pomPath := filepath.Join(absRepo, relPomPath)
 			_, statErr := os.Stat(pomPath)
 			hasPom := !errors.Is(statErr, os.ErrNotExist)
 			if statErr != nil && hasPom {
 				return fmt.Errorf("check pom path: %w", statErr)
 			}
 			if hasPom {
 				anyPom = true
 				currentPomVersion, err := maven.ReadVersion(pomPath)
 				if err != nil {
 					return fmt.Errorf("read pom version: %w", err)
@@ -455,12 +558,42 @@ func run(o options) error {
 				if err := maven.WriteVersion(pomPath, currentPomVersion, nextVersion); err != nil {
 					return fmt.Errorf("update pom version: %w", err)
 				}
-			logDone("pom.xml: %s → %s", currentPomVersion, nextVersion)
+				logDone("%s: %s → %s", relPomPath, currentPomVersion, nextVersion)
-			filesToCommit = append(filesToCommit, cfg.Maven.PomPath)
+				filesToCommit = append(filesToCommit, relPomPath)
-		} else {
+			}
 		}
 		if !anyPom {
 			logWarn("no pom.xml — skipping version bump")
 		}
 		// package.json (opt-in via node.package_json / node.package_jsons)
 		for _, relPkgPath := range cfg.Node.EffectivePaths() {
 			pkgPath := filepath.Join(absRepo, relPkgPath)
 			currentNodeVersion, err := node.ReadVersion(pkgPath)
 			if err != nil {
 				return fmt.Errorf("read package.json version: %w", err)
 			}
 			if err := node.WriteVersion(pkgPath, currentNodeVersion, nextVersion); err != nil {
 				return fmt.Errorf("update package.json version: %w", err)
 			}
 			logDone("%s: %s → %s", relPkgPath, currentNodeVersion, nextVersion)
 			filesToCommit = append(filesToCommit, relPkgPath)
 		}
 		// build.gradle / build.gradle.kts (opt-in via gradle.build_file / gradle.build_files)
 		for _, relGradlePath := range cfg.Gradle.EffectiveBuildFiles() {
 			gradlePath := filepath.Join(absRepo, relGradlePath)
 			currentGradleVersion, err := gradle.ReadVersion(gradlePath)
 			if err != nil {
 				return fmt.Errorf("read gradle version: %w", err)
 			}
 			if err := gradle.WriteVersion(gradlePath, currentGradleVersion, nextVersion); err != nil {
 				return fmt.Errorf("update gradle version: %w", err)
 			}
 			logDone("%s: %s → %s", relGradlePath, currentGradleVersion, nextVersion)
 			filesToCommit = append(filesToCommit, relGradlePath)
 		}
 		// CHANGELOG.md
 		changelogAbsPath := filepath.Join(absRepo, o.changelogFile)
 		if err := changelog.Update(changelogAbsPath, nextTag, nextVersion, messages); err != nil {
@@ -483,7 +616,7 @@ func run(o options) error {
 			authorEmail = cfg.Git.AuthorEmail
 		}
 		commitMsg := strings.ReplaceAll(cfg.Git.CommitMessage, "{version}", nextTag)
-		if _, err := gitutil.CommitFiles(repo, filesToCommit, commitMsg, authorName, authorEmail); err != nil {
+		if _, err := gitCommitFiles(repo, filesToCommit, commitMsg, authorName, authorEmail); err != nil {
 			return fmt.Errorf("commit: %w", err)
 		}
 		logDone("committed: %s", commitMsg)
@@ -2,6 +2,7 @@ package main
 import (
 	"errors"
 	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -15,6 +16,8 @@ import (
 	gitcfg "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	"git.k3nny.fr/releaser/internal/config"
 )
 // ── helpers ──────────────────────────────────────────────────────────────────
@@ -742,3 +745,579 @@ func TestRunVerbose(t *testing.T) {
 		}
 	}
 }
 // ── ui.go coverage ────────────────────────────────────────────────────────────
 func TestPaintColor(t *testing.T) {
 	old := useColor
 	useColor = true
 	defer func() { useColor = old }()
 	got := paint(ansiGreen, "hello")
 	if !strings.Contains(got, "hello") || !strings.Contains(got, ansiReset) || !strings.Contains(got, ansiGreen) {
 		t.Errorf("paint with color = %q", got)
 	}
 }
 func TestFmtSourceEnv(t *testing.T) {
 	old := useColor
 	useColor = false
 	defer func() { useColor = old }()
 	got := fmtSource("env: GITLAB_TOKEN")
 	if got != "[env: GITLAB_TOKEN]" {
 		t.Errorf("fmtSource env = %q", got)
 	}
 }
 func TestFmtSourceFlag(t *testing.T) {
 	old := useColor
 	useColor = false
 	defer func() { useColor = old }()
 	got := fmtSource("flag: --tag-prefix")
 	if got != "[flag: --tag-prefix]" {
 		t.Errorf("fmtSource flag = %q", got)
 	}
 }
 func TestFmtSourceConfigFile(t *testing.T) {
 	old := useColor
 	useColor = false
 	defer func() { useColor = old }()
 	got := fmtSource("config file")
 	if got != "[config file]" {
 		t.Errorf("fmtSource config file = %q", got)
 	}
 }
 // ── buildPublisher coverage ───────────────────────────────────────────────────
 func TestBuildPublisherGitHub(t *testing.T) {
 	cfg := config.Config{
 		GitHub: config.GitHubConfig{Token: "ghtoken", Repo: "owner/repo"},
 	}
 	pub, err := buildPublisher(cfg)
 	if err != nil {
 		t.Fatalf("buildPublisher GitHub: %v", err)
 	}
 	if pub == nil {
 		t.Fatal("expected non-nil publisher for GitHub config")
 	}
 }
 func TestBuildPublisherGitLabNoToken(t *testing.T) {
 	cfg := config.Config{
 		GitLab: config.GitLabConfig{URL: "https://gitlab.example.com", Project: "42"},
 	}
 	_, err := buildPublisher(cfg)
 	if err == nil {
 		t.Fatal("expected error when GitLab URL+Project set but token is empty")
 	}
 }
 // ── printVerboseConfig coverage ───────────────────────────────────────────────
 func TestPrintVerboseConfigDirect(t *testing.T) {
 	// Use a sparse Sources map (missing keys → source == "" → hits "default" branch).
 	// Also set non-empty ReleasableTypes and both tokens to cover those branches.
 	cfg := config.Config{
 		Git: config.GitConfig{
 			ReleasableTypes: []string{"fix", "feat"},
 		},
 		GitLab: config.GitLabConfig{Token: "secret"},
 		GitHub: config.GitHubConfig{Token: "ghsecret"},
 	}
 	src := config.Sources{} // empty → all lookups return ""
 	old := os.Stderr
 	r, w, _ := os.Pipe()
 	os.Stderr = w
 	printVerboseConfig(cfg, src)
 	w.Close()
 	os.Stderr = old
 	out, _ := io.ReadAll(r)
 	if !strings.Contains(string(out), "fix, feat") {
 		t.Error("expected releasable types joined in output")
 	}
 	if !strings.Contains(string(out), "(set)") {
 		t.Error("expected '(set)' for configured tokens")
 	}
 }
 // ── initConfig coverage ───────────────────────────────────────────────────────
 func TestInitConfigWriteFails(t *testing.T) {
 	if os.Getuid() == 0 {
 		t.Skip("skipping: chmod restrictions do not apply when running as root")
 	}
 	dir := t.TempDir()
 	os.Chmod(dir, 0555)
 	defer os.Chmod(dir, 0755)
 	err := initConfig(dir)
 	if err == nil {
 		t.Fatal("expected error writing .releaser.yml to read-only directory")
 	}
 }
 // ── run() injectable error paths ─────────────────────────────────────────────
 func TestRunVerboseInit(t *testing.T) {
 	dir := t.TempDir()
 	err := execCmd(t, "--init", "--verbose", "--repo", dir)
 	if err != nil {
 		t.Fatalf("--init --verbose: %v", err)
 	}
 	if _, err := os.Stat(filepath.Join(dir, ".releaser.yml")); err != nil {
 		t.Error("expected .releaser.yml to be created")
 	}
 }
 func TestRunAbsPathError(t *testing.T) {
 	old := absPath
 	absPath = func(string) (string, error) { return "", fmt.Errorf("injected abs error") }
 	defer func() { absPath = old }()
 	err := execCmd(t, "--repo", ".")
 	if err == nil {
 		t.Fatal("expected error when filepath.Abs fails")
 	}
 }
 func TestRunWorkingTreeCheckFails(t *testing.T) {
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	// Corrupt the git index so IsWorkingTreeClean fails.
 	os.WriteFile(filepath.Join(dir, ".git", "index"), []byte("garbage"), 0644)
 	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error for corrupt git index")
 	}
 }
 func TestRunLatestTagFails(t *testing.T) {
 	if os.Getuid() == 0 {
 		t.Skip("skipping: chmod restrictions do not apply when running as root")
 	}
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	tagsDir := filepath.Join(dir, ".git", "refs", "tags")
 	os.Chmod(tagsDir, 0000)
 	defer os.Chmod(tagsDir, 0755)
 	err := execCmd(t, "--dry-run", "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error for unreadable tags directory")
 	}
 }
 func TestRunAllCommitsError(t *testing.T) {
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	old := gitAllCommits
 	gitAllCommits = func(_ *gogit.Repository) ([]string, error) {
 		return nil, fmt.Errorf("injected AllCommits error")
 	}
 	defer func() { gitAllCommits = old }()
 	err := execCmd(t, "--dry-run", "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error from AllCommits")
 	}
 }
 func TestRunCommitsSinceError(t *testing.T) {
 	repo, dir := setupRepo(t)
 	head, _ := repo.Head()
 	repo.CreateTag("1.2.0", head.Hash(), nil)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	old := gitCommitsSince
 	gitCommitsSince = func(_ *gogit.Repository, _ string) ([]string, error) {
 		return nil, fmt.Errorf("injected CommitsSince error")
 	}
 	defer func() { gitCommitsSince = old }()
 	err := execCmd(t, "--dry-run", "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error from CommitsSince")
 	}
 }
 // ── verbose commit section coverage ──────────────────────────────────────────
 func TestRunVerboseBreakingAndFix(t *testing.T) {
 	// Covers: verbose "since: lastTag", message truncation (>70 chars),
 	// TypeBreaking color (ansiRed+ansiBold), TypeFix color (ansiGreen).
 	repo, dir := setupRepo(t)
 	head, _ := repo.Head()
 	repo.CreateTag("1.2.0", head.Hash(), nil)
 	w, _ := repo.Worktree()
 	addFile(t, dir, "a.go", "a")
 	w.Add("a.go")
 	w.Commit("feat!: redesign the entire public API surface which is a very long commit message header", &gogit.CommitOptions{Author: testSig()})
 	addFile(t, dir, "b.go", "b")
 	w.Add("b.go")
 	w.Commit("fix: correct null pointer in edge case handler", &gogit.CommitOptions{Author: testSig()})
 	old := os.Stderr
 	r, wp, _ := os.Pipe()
 	os.Stderr = wp
 	err := execCmd(t, "--dry-run", "--verbose", "--branch", "release/1.2", "--repo", dir)
 	wp.Close()
 	os.Stderr = old
 	io.ReadAll(r)
 	if err != nil {
 		t.Fatalf("verbose breaking+fix: unexpected error: %v", err)
 	}
 }
 // ── release.env write error ───────────────────────────────────────────────────
 func TestRunReleaseEnvWriteFails(t *testing.T) {
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	// Empty directory is invisible to git — dirty check passes.
 	os.Mkdir(filepath.Join(dir, "release.env"), 0755)
 	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error when release.env is a directory")
 	}
 }
 // ── pom stat error ────────────────────────────────────────────────────────────
 func TestRunPomStatError(t *testing.T) {
 	// A null byte in the path makes os.Stat return EINVAL (not ErrNotExist),
 	// so hasPom=true and the stat error is propagated.
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	err := execCmd(t, "--branch", "release/1.2", "--repo", dir, "--pom", "pom\x00.xml")
 	if err == nil {
 		t.Fatal("expected error for pom path with null byte (EINVAL)")
 	}
 }
 // ── changelog update error ────────────────────────────────────────────────────
 func TestRunChangelogUpdateFails(t *testing.T) {
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	// Empty directory is invisible to git — dirty check passes.
 	// changelog.Update will fail trying to ReadFile on a directory.
 	os.Mkdir(filepath.Join(dir, "CHANGELOG.md"), 0755)
 	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error when CHANGELOG.md is a directory")
 	}
 }
 // ── CommitFiles error ─────────────────────────────────────────────────────────
 func TestRunCommitFilesError(t *testing.T) {
 	_, dir := setupRepo(t)
 	addFile(t, dir, "x.go", "// fix")
 	repo, _ := gogit.PlainOpen(dir)
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: patch something", &gogit.CommitOptions{Author: testSig()})
 	old := gitCommitFiles
 	gitCommitFiles = func(_ *gogit.Repository, _ []string, _, _, _ string) (plumbing.Hash, error) {
 		return plumbing.ZeroHash, fmt.Errorf("injected commit error")
 	}
 	defer func() { gitCommitFiles = old }()
 	err := execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error from CommitFiles")
 	}
 }
 // ── parseBumpRules coverage ───────────────────────────────────────────────────
 func TestParseBumpRules(t *testing.T) {
 	rules := config.BumpRulesConfig{Breaking: "minor", Feat: "minor", Fix: "minor"}
 	m := parseBumpRules(rules)
 	if len(m) != 3 {
 		t.Errorf("expected 3 entries in bump rules map, got %d", len(m))
 	}
 }
 // ── printVerboseConfig — bump_rules and node rows ─────────────────────────────
 func TestPrintVerboseConfigBumpRulesAndNode(t *testing.T) {
 	cfg := config.Config{
 		Git: config.GitConfig{
 			BumpRules: config.BumpRulesConfig{Breaking: "minor", Feat: "minor", Fix: "minor"},
 		},
 		Node:   config.NodeConfig{PackageJSON: "package.json"},
 		Gradle: config.GradleConfig{BuildFile: "build.gradle"},
 	}
 	src := config.Sources{}
 	old := os.Stderr
 	r, wp, _ := os.Pipe()
 	os.Stderr = wp
 	printVerboseConfig(cfg, src)
 	wp.Close()
 	os.Stderr = old
 	out, _ := io.ReadAll(r)
 	output := string(out)
 	if !strings.Contains(output, "minor") {
 		t.Error("expected 'minor' in output for bump_rules")
 	}
 	if !strings.Contains(output, "package.json") {
 		t.Error("expected 'package.json' in output for node.paths")
 	}
 	if !strings.Contains(output, "build.gradle") {
 		t.Error("expected 'build.gradle' in output for gradle.paths")
 	}
 }
 // ── node package.json handling ────────────────────────────────────────────────
 func writePackageJSON(t *testing.T, dir, ver string) {
 	t.Helper()
 	content := fmt.Sprintf(`{"name": "my-app", "version": "%s"}`, ver)
 	if err := os.WriteFile(filepath.Join(dir, "package.json"), []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestRunNodeVersionBump(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	writePackageJSON(t, dir, "0.0.0")
 	commitAll(t, repo, dir, "chore: init")
 	// .releaser.yml is untracked — go-git IsClean ignores untracked files
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("node:\n  package_json: \"package.json\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	err = execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir)
 	if err != nil {
 		t.Fatalf("node version bump: unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(filepath.Join(dir, "package.json"))
 	if !strings.Contains(string(data), `"version": "1.2.0"`) {
 		t.Errorf("expected version 1.2.0 in package.json, got: %s", data)
 	}
 }
 func TestRunNodeReadVersionFails(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// invalid JSON — ReadVersion will fail
 	os.WriteFile(filepath.Join(dir, "package.json"), []byte(`{not json`), 0644)
 	commitAll(t, repo, dir, "chore: init")
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("node:\n  package_json: \"package.json\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	err = execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error when package.json has invalid JSON")
 	}
 }
 func TestRunNodeWriteVersionFails(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	writePackageJSON(t, dir, "0.0.0")
 	commitAll(t, repo, dir, "chore: init")
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("node:\n  package_json: \"package.json\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	// Make package.json read-only so WriteVersion fails
 	os.Chmod(filepath.Join(dir, "package.json"), 0444)
 	defer os.Chmod(filepath.Join(dir, "package.json"), 0644)
 	err = execCmd(t, "--branch", "release/1.2", "--repo", dir)
 	if err == nil {
 		t.Fatal("expected error when package.json is read-only")
 	}
 }
 // ── gradle build file handling ────────────────────────────────────────────────
 func writeGradleFile(t *testing.T, dir, ver string) {
 	t.Helper()
 	content := fmt.Sprintf("group = \"com.example\"\nversion = \"%s\"\n", ver)
 	if err := os.WriteFile(filepath.Join(dir, "build.gradle"), []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 }
 func TestRunGradleVersionBump(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	writeGradleFile(t, dir, "0.0.0")
 	commitAll(t, repo, dir, "chore: init")
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir); err != nil {
 		t.Fatalf("gradle version bump: unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(filepath.Join(dir, "build.gradle"))
 	if !strings.Contains(string(data), `version = "1.2.0"`) {
 		t.Errorf("expected version 1.2.0 in build.gradle, got: %s", data)
 	}
 }
 func TestRunGradleOverrideFlag(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// Write gradle file at custom path
 	if err := os.MkdirAll(filepath.Join(dir, "sub"), 0755); err != nil {
 		t.Fatal(err)
 	}
 	content := "version = \"0.0.0\"\n"
 	os.WriteFile(filepath.Join(dir, "sub", "build.gradle"), []byte(content), 0644)
 	commitAll(t, repo, dir, "chore: init")
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	if err := execCmd(t, "--no-push", "--branch", "release/1.2", "--repo", dir, "--gradle", "sub/build.gradle"); err != nil {
 		t.Fatalf("--gradle flag: unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(filepath.Join(dir, "sub", "build.gradle"))
 	if !strings.Contains(string(data), `version = "1.2.0"`) {
 		t.Errorf("expected version 1.2.0, got: %s", data)
 	}
 }
 func TestRunGradleReadVersionFails(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// build.gradle with no version assignment
 	os.WriteFile(filepath.Join(dir, "build.gradle"), []byte(`group = "com.example"`), 0644)
 	commitAll(t, repo, dir, "chore: init")
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
 		t.Fatal("expected error when build.gradle has no version assignment")
 	}
 }
 func TestRunGradleWriteVersionFails(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, false)
 	if err != nil {
 		t.Fatal(err)
 	}
 	writeGradleFile(t, dir, "0.0.0")
 	commitAll(t, repo, dir, "chore: init")
 	os.WriteFile(filepath.Join(dir, ".releaser.yml"), []byte("gradle:\n  build_file: \"build.gradle\"\n"), 0644)
 	addFile(t, dir, "x.go", "// fix")
 	w, _ := repo.Worktree()
 	w.Add("x.go")
 	w.Commit("fix: something", &gogit.CommitOptions{Author: testSig()})
 	os.Chmod(filepath.Join(dir, "build.gradle"), 0444)
 	defer os.Chmod(filepath.Join(dir, "build.gradle"), 0644)
 	if err := execCmd(t, "--branch", "release/1.2", "--repo", dir); err == nil {
 		t.Fatal("expected error when build.gradle is read-only")
 	}
 }
@@ -0,0 +1,24 @@
 ---
 title: releaser
 ---
 **CI-friendly release automation for GitFlow workflows using Conventional Commits.**
 Standard tools like `semantic-release` are designed for trunk-based development. In a GitFlow setup with versioned release branches (`release/1.1`, `release/1.2`), they either fail to respect the branch's version range or require brittle configuration.
 `releaser` is built for this exact workflow: it reads the branch name to pin the `major.minor`, parses Conventional Commits to determine the patch increment, and handles everything from `pom.xml` / `package.json` update to GitLab/GitHub tag and release creation.
 ## How it works
 ```
 release/1.2 branch
  └─ last tag: 1.2.3 (or none → start at 1.2.0)
       └─ commits since tag → Conventional Commits analysis
            └─ next version: 1.2.4
 ```
 1. **Branch parsing** — extracts `major.minor` from branch name (`release/1.2` → `1.2`)
 2. **Tag discovery** — finds the latest tag matching `major.minor.*` on the current branch
 3. **Commit analysis** — parses Conventional Commits between last tag and HEAD
 4. **Version bump** — increments patch (or minor, if configured via `bump_rules`)
 5. **Release** — updates `pom.xml` / `package.json`, commits, tags, creates GitLab or GitHub release
@@ -0,0 +1,76 @@
 ---
 title: Changelog
 weight: 50
 ---
 ## v1.6.0 — 2026-07-11
 ### Added
 - **Gradle support** — opt-in via `gradle.build_file` (single path) or `gradle.build_files` (list, overrides single); supports both Groovy DSL (`version = '1.2.3'`) and Kotlin DSL (`version = "1.2.3"`); original quote style preserved on write; `--gradle <path>` CLI flag for one-off overrides
 ## v1.5.1 — 2026-07-11
 ### Added
 - **Documentation site** — Hugo + Geekdoc; installation, CLI reference, configuration, CI integration, and changelog pages; deployed to `gh-pages` via Gitea CI on push to `main`
 - **`FuzzUpdate`** in `internal/changelog` and **`FuzzWriteVersion`** in `internal/node` — complete fuzz coverage for all file-rewriting packages
 ### Changed
 - **CLAUDE.md** — fuzzing completeness guidelines with authoritative table
 ## v1.5.0 — 2026-07-11
 ### Added
 - **Multi-module Maven support** — `maven.pom_paths: [...]` lists multiple `pom.xml` paths; overrides `pom_path`; each path is updated and committed in the same release commit
 - **Node.js `package.json` support** — opt-in via `node.package_json` (single path) or `node.package_jsons` (list); version bumped in-place alongside `pom.xml` and `CHANGELOG.md`
 - **`git.bump_rules` config** — controls which version component each commit type bumps: `breaking`, `feat`, `fix` each accept `"patch"` (default) or `"minor"`
 - **100% per-package statement coverage** across all 12 packages via injectable function vars
 ### Changed
 - **`--pom` flag** now clears `maven.pom_paths` before setting `maven.pom_path`
 - **`version.Next()` signature** — accepts a bump-rules map as a sixth parameter; `nil` defaults to all-patch
 - **Verbose config table** — now includes `git.bump_rules.*`, `maven.pom_paths`, and `node.paths` rows
 ## v1.4.0 — 2026-07-11
 ### Added
 - **GitHub release support** — `internal/ghclient` package; configured via `github.token` + `github.repo`; GitHub takes precedence over GitLab when both are configured
 - **SSH agent push** — go-git `gitssh.NewSSHAgentAuth` for `git@` / `ssh://` remotes
 - **`--release-env-file` flag** — override dotenv artifact path; pass `""` to disable
 - **`git.releasable_types` config** — opt-in list of commit types that count as releasable
 - **CHANGELOG deduplication guard** — `changelog.Update()` is idempotent; skips write if section already exists
 ## v1.3.0 — 2026-07-07
 ### Added
 - **`release.env` dotenv artifact** — written on every real release containing `NEXT_VERSION=<tag>`; never committed; exposes the version to downstream GitLab CI jobs
 ## v1.2.0 — 2026-07-07
 ### Added
 - **`--verbose` flag** — prints config table, commit list with parsed types, and version decision
 - **Colored, structured CLI output** — `·` / `✓` / `!` prefix symbols; TTY-aware ANSI colors; respects `NO_COLOR` and `TERM=dumb`
 - **Name and version header** on every invocation
 ### Changed
 - **Default `tag_prefix` is now empty** — bare version numbers (`1.2.3`) by default; add `tag_prefix: "v"` to opt in
 ## v1.1.0 — 2026-07-07
 ### Added
 - **CHANGELOG.md auto-update** — new dated section written on every release, grouped by commit type
 - **`--changelog-file` flag** — override changelog path
 - **`--init` flag** — scaffolds a fully-commented `.releaser.yml`
 ## v1.0 and earlier
 See the [full CHANGELOG](https://git.k3nny.fr/releaser/src/branch/main/CHANGELOG.md) in the repository.
@@ -0,0 +1,109 @@
 ---
 title: CI Integration
 weight: 40
 ---
 ## GitLab CI
 The simplest setup uses the reusable job template shipped alongside `releaser`:
 ```yaml
 # .gitlab-ci.yml
 include:
  - project: releaser/releaser
    file: .releaser.gitlab-ci.yml
 release:
  extends: .releaser
  variables:
    GITLAB_TOKEN: $RELEASE_TOKEN   # project/group variable with api + write_repository scope
 ```
 Or write it inline:
 ```yaml
 release:
  stage: release
  image: registry.example.com/releaser:latest
  rules:
    - if: $CI_COMMIT_BRANCH =~ /^release\/.+$/
  variables:
    GITLAB_TOKEN: $RELEASE_TOKEN
  script:
    - releaser
  artifacts:
    reports:
      dotenv: release.env          # exposes NEXT_VERSION to downstream jobs
 ```
 ### Consuming `NEXT_VERSION` downstream
 The `release.env` dotenv artifact exports `NEXT_VERSION=<tag>` automatically. Downstream jobs can use it:
 ```yaml
 deploy:
  stage: deploy
  needs:
    - job: release
      artifacts: true
  script:
    - echo "Deploying version $NEXT_VERSION"
 ```
 Disable the dotenv artifact (e.g. for local runs):
 ```bash
 releaser --release-env-file ""
 ```
 Write it to a custom path:
 ```bash
 releaser --release-env-file deploy/version.env
 ```
 ## GitHub Actions / Gitea Actions
 ```yaml
 name: release
 on:
  push:
    branches:
      - 'release/**'
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0          # full history needed for tag discovery
      - name: Run releaser
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          curl -sSL https://git.k3nny.fr/releaser/releases/latest/download/releaser-linux-amd64 \
            -o /usr/local/bin/releaser
          chmod +x /usr/local/bin/releaser
          releaser
 ```
 {{< hint warning >}}
 `fetch-depth: 0` is required. A shallow clone (`--depth 1`) hides the previous tag, causing `releaser` to treat every commit as the first release.
 {{< /hint >}}
 ## Detached HEAD
 In CI environments where `git checkout` leaves the repository in detached HEAD state, pass the branch name explicitly:
 ```yaml
 script:
  - releaser --branch "$CI_COMMIT_BRANCH"
 ```
 ## SSH push
 When pushing over SSH (`git@host:...` or `ssh://...` remotes), `releaser` attempts go-git SSH agent auth automatically — no extra configuration needed as long as the CI runner has an SSH agent socket available.
 For HTTPS remotes without a token, `releaser` delegates to the system `git` binary so credential helpers and `netrc` work as expected.
@@ -0,0 +1,150 @@
 ---
 title: Configuration
 weight: 30
 ---
 `releaser` reads `.releaser.yml` from the repository root. All fields are optional — missing values fall back to the defaults shown below. Run `releaser --init` to scaffold the file with annotations.
 ## Full reference
 ```yaml
 git:
  tag_prefix: ""                                     # default: no prefix; "v" for v1.2.3 style
  branch_pattern: "^(?:.*/)?release/(\\d+)\\.(\\d+)$"  # two capture groups: major, minor
  commit_message: "chore(release): {version} [skip ci]"
  author_name: ""                                    # defaults to git config user.name
  author_email: ""                                   # defaults to git config user.email
  # Limit which commit types trigger a release (default: all three).
  releasable_types:
    - fix
    - feat
    - breaking
  # Control which version component each commit type bumps.
  # Valid values: "patch" (default) or "minor".
  bump_rules:
    breaking: "patch"
    feat: "patch"
    fix: "patch"
 maven:
  pom_path: "pom.xml"                                # single pom.xml, relative to repo root
  # Multi-module: list overrides pom_path.
  # pom_paths:
  #   - "pom.xml"
  #   - "module-a/pom.xml"
  #   - "module-b/pom.xml"
 node:                                                # opt-in — omit section to skip
  # package_json: "package.json"                     # single path
  # Monorepo: list overrides package_json.
  # package_jsons:
  #   - "packages/frontend/package.json"
  #   - "packages/backend/package.json"
 gradle:                                              # opt-in — omit section to skip
  # build_file: "build.gradle"                       # Groovy or Kotlin DSL; single path
  # Multi-module: list overrides build_file.
  # build_files:
  #   - "build.gradle"
  #   - "module-a/build.gradle"
 gitlab:
  url: "https://gitlab.example.com"                  # or env CI_SERVER_URL
  token: ""                                          # prefer env GITLAB_TOKEN
  project: ""                                        # prefer env CI_PROJECT_ID or CI_PROJECT_PATH
 github:
  token: ""                                          # prefer env GITHUB_TOKEN
  repo: ""                                           # "owner/repo" format
 ```
 {{< hint info >}}
 When both `github.*` and `gitlab.*` are configured, GitHub takes precedence.
 {{< /hint >}}
 ## Environment variables
 | Variable | Used for |
 |----------|----------|
 | `GITLAB_TOKEN` | GitLab API auth + HTTPS push auth |
 | `CI_SERVER_URL` | GitLab instance URL |
 | `CI_PROJECT_ID` | GitLab project identifier (numeric) |
 | `CI_PROJECT_PATH` | GitLab project identifier (fallback) |
 | `GITHUB_TOKEN` | GitHub API auth |
 ## Config sources
 Run `releaser --verbose --dry-run` to see every config key, its resolved value, and where it came from (`default` / `config file` / `env: VARNAME` / `flag: --name`).
 ## `git.releasable_types`
 By default `fix`, `feat`, and `breaking` commits all trigger a release. Use `releasable_types` to restrict this — for example, on a maintenance branch where you want only bug fixes to release:
 ```yaml
 git:
  releasable_types:
    - fix
 ```
 ## `git.bump_rules`
 By default every releasable commit bumps the **patch** component. The `bump_rules` map lets you promote specific types to bump **minor** instead. This is useful on a branch that manages its own minor versioning:
 ```yaml
 git:
  bump_rules:
    feat: "minor"      # feat: commits bump minor, not patch
    breaking: "minor"  # breaking changes bump minor too
    fix: "patch"       # fix: stays patch (this is the default)
 ```
 ## Multi-module Maven
 `pom_paths` accepts a list and overrides `pom_path`. All listed files are updated and committed in the same release commit:
 ```yaml
 maven:
  pom_paths:
    - "pom.xml"
    - "module-a/pom.xml"
    - "module-b/pom.xml"
 ```
 The `--pom` CLI flag sets a single path and clears `pom_paths`.
 ## Node.js support
 The `node` section is opt-in — if omitted, no `package.json` is touched. Use `package_jsons` for monorepos:
 ```yaml
 node:
  package_jsons:
    - "packages/frontend/package.json"
    - "packages/backend/package.json"
 ```
 ## Gradle support
 The `gradle` section is opt-in — if omitted, no build file is touched. Both Groovy DSL (`version = '1.2.3'`) and Kotlin DSL (`version = "1.2.3"`) are supported; the original quote style is preserved on write.
 ```yaml
 gradle:
  build_file: "build.gradle"
 ```
 Use `build_files` for multi-module projects:
 ```yaml
 gradle:
  build_files:
    - "build.gradle"
    - "module-a/build.gradle"
    - "module-b/build.gradle"
 ```
 The `--gradle <path>` CLI flag sets a single build file path and clears `build_files`.
@@ -0,0 +1,59 @@
 ---
 title: Installation
 weight: 10
 ---
 ## Pre-built binaries
 Download the latest release for your platform from the [Releases page](https://git.k3nny.fr/releaser/releases).
 ```bash
 # Linux (amd64)
 curl -sSL https://git.k3nny.fr/releaser/releases/download/v1.5.0/releaser-v1.5.0-linux-amd64 \
  -o /usr/local/bin/releaser
 chmod +x /usr/local/bin/releaser
 ```
 Available platforms: `linux-amd64`, `linux-arm64`, `darwin-amd64`, `darwin-arm64`, `windows-amd64.exe`.
 ## Docker
 ```bash
 docker pull git.k3nny.fr/releaser/releaser:latest
 # Run in the current repository
 docker run --rm \
  -v "$PWD:/repo" \
  -e GITLAB_TOKEN="$GITLAB_TOKEN" \
  git.k3nny.fr/releaser/releaser:latest
 ```
 ## Build from source
 Requires Go 1.21+.
 ```bash
 git clone https://git.k3nny.fr/releaser/releaser.git
 cd releaser
 go build -o /usr/local/bin/releaser ./cmd
 ```
 ## Verify
 ```bash
 releaser --version
 ```
 ## First run
 Scaffold a default `.releaser.yml` in your repository root:
 ```bash
 releaser --init
 ```
 Then do a dry run to check the version that would be produced:
 ```bash
 releaser --dry-run
 ```
@@ -0,0 +1,70 @@
 ---
 title: CLI Reference
 weight: 20
 ---
 ## Common workflows
 ```bash
 # Scaffold a default .releaser.yml
 releaser --init
 # Preview next version (no side effects)
 releaser --dry-run
 # Full release: bump versions, commit, tag, push, create release
 releaser
 # Commit and tag locally — skip push and release creation
 releaser --no-push
 # Push commit and tag but skip creating the release
 releaser --no-release
 # Update files but stop before committing
 releaser --no-commit
 # ... review changes, then commit manually and re-run:
 releaser --tag-only
 # Verbose mode: show config sources, commit analysis, version decision
 releaser --verbose --dry-run
 ```
 ## Flags
 | Flag | Default | Description |
 |------|---------|-------------|
 | `--dry-run` | false | Print next version and exit without making any changes |
 | `--branch <name>` | auto-detected | Override branch name (useful in detached HEAD / CI) |
 | `--branch-pattern <regex>` | `^(?:.*/)?release/(\d+)\.(\d+)$` | Override branch pattern (two capture groups: major, minor) |
 | `--tag-prefix <prefix>` | `""` | Prefix for version tags (e.g. `v` → `v1.2.3`) |
 | `--pom <path>` | `pom.xml` | Path to pom.xml relative to repo root |
 | `--gradle <path>` | — | Override `gradle.build_file` from config |
 | `--changelog-file <path>` | `CHANGELOG.md` | Path to changelog file |
 | `--release-env-file <path>` | `release.env` | Path for dotenv artifact; pass `""` to disable |
 | `--no-commit` | false | Update version files but stop before committing |
 | `--no-push` | false | Commit and tag locally, skip push and release |
 | `--no-release` | false | Push branch and tag but skip release creation |
 | `--tag-only` | false | Skip version file updates — tag HEAD and push |
 | `--init` | false | Scaffold a default `.releaser.yml` and exit |
 | `--verbose` | false | Print config table, commit analysis, and version decision |
 ## Exit codes
 | Code | Meaning |
 |------|---------|
 | `0` | Success |
 | `1` | Error (config, git, API, etc.) |
 | `2` | No releasable commits found — nothing to do |
 ## Version bump rules
 By default all releasable commits bump the **patch** component (minor is pinned to the branch). Override per commit type via `git.bump_rules` in `.releaser.yml`:
 | Commit type | Default | Configurable via `bump_rules` |
 |-------------|---------|-------------------------------|
 | `fix:` | patch | `fix: "minor"` to bump minor |
 | `feat:` | patch | `feat: "minor"` to bump minor |
 | `feat!:` / `BREAKING CHANGE` | patch | `breaking: "minor"` to bump minor |
 | `chore:`, `docs:`, etc. | none | — |
 | unparseable message | none | non-strict: silently ignored |
@@ -0,0 +1,16 @@
 main:
  - name: Installation
    ref: /installation
    weight: 10
  - name: CLI Reference
    ref: /usage
    weight: 20
  - name: Configuration
    ref: /configuration
    weight: 30
  - name: CI Integration
    ref: /ci-integration
    weight: 40
  - name: Changelog
    ref: /changelog
    weight: 50
@@ -0,0 +1,21 @@
 baseURL = "https://releaser.k3nny.fr/"
 title = "releaser"
 theme = "geekdoc"
 pygmentsUseClasses = true
 pygmentsCodeFences = true
 [markup]
  [markup.goldmark.renderer]
    unsafe = true
  [markup.tableOfContents]
    startLevel = 1
    endLevel = 9
 [params]
  geekdocRepo = "https://git.k3nny.fr/releaser"
  geekdocEditPath = "edit/main/docs/content"
  geekdocSearch = true
  geekdocMenuBundle = true
  geekdocBreadcrumb = false
  geekdocToC = true
@@ -99,6 +99,28 @@ func TestUpdateBreakingSection(t *testing.T) {
 	}
 }
 func TestUpdateExistingFileNoHeading(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "CHANGELOG.md")
 	// File with content but no ## [ heading — new section appended at bottom.
 	os.WriteFile(path, []byte("# Changelog\n\nSome preamble.\n"), 0644)
 	err := Update(path, "v1.0.0", "1.0.0", []string{"fix: something"})
 	if err != nil {
 		t.Fatal(err)
 	}
 	data, _ := os.ReadFile(path)
 	s := string(data)
 	if !strings.Contains(s, "## [1.0.0]") {
 		t.Error("expected version header appended")
 	}
 	if !strings.Contains(s, "# Changelog") {
 		t.Error("expected original content preserved")
 	}
 }
 func TestUpdateReadError(t *testing.T) {
 	dir := t.TempDir()
 	// Create a directory where the file should be — ReadFile will error.
@@ -109,3 +131,40 @@ func TestUpdateReadError(t *testing.T) {
 		t.Error("expected error when path is a directory")
 	}
 }
 func TestUpdateIdempotent(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "CHANGELOG.md")
 	// Pre-seed with the version heading already present.
 	os.WriteFile(path, []byte("# Changelog\n\n## [1.0.0] - 2026-01-01\n\n- fix: something\n"), 0644)
 	// Second call must be a no-op (returns nil, file unchanged).
 	if err := Update(path, "v1.0.0", "1.0.0", []string{"fix: something"}); err != nil {
 		t.Fatalf("idempotent Update should not error, got: %v", err)
 	}
 	data, _ := os.ReadFile(path)
 	if strings.Count(string(data), "## [1.0.0]") != 1 {
 		t.Error("version heading should appear exactly once after idempotent call")
 	}
 }
 // FuzzUpdate verifies Update never panics on arbitrary existing file content or commit messages.
 func FuzzUpdate(f *testing.F) {
 	f.Add("", "feat: add thing")
 	f.Add("# Changelog\n\n## [1.0.0] - 2026-01-01\n\n### Added\n- something\n", "fix: something")
 	f.Add("some preamble\n", "feat!: breaking change")
 	f.Add("\n## [2.0.0] - 2026-01-01\n", "feat: another thing")
 	f.Add("", "chore: no release")
 	f.Add("", "")
 	f.Fuzz(func(t *testing.T, existing, message string) {
 		dir := t.TempDir()
 		path := filepath.Join(dir, "CHANGELOG.md")
 		if existing != "" {
 			os.WriteFile(path, []byte(existing), 0644) //nolint:errcheck
 		}
 		Update(path, "v1.0.0", "1.0.0", []string{message}) //nolint:errcheck
 	})
 }
@@ -83,6 +83,14 @@ func TestReleasableSet(t *testing.T) {
 	if !only[TypeFix] || only[TypeFeat] || only[TypeBreaking] {
 		t.Errorf("fix-only set: %v", only)
 	}
 	onlyFeat := ReleasableSet([]string{"feat"})
 	if onlyFeat[TypeFix] || !onlyFeat[TypeFeat] || onlyFeat[TypeBreaking] {
 		t.Errorf("feat-only set: %v", onlyFeat)
 	}
 	onlyBreaking := ReleasableSet([]string{"breaking"})
 	if onlyBreaking[TypeFix] || onlyBreaking[TypeFeat] || !onlyBreaking[TypeBreaking] {
 		t.Errorf("breaking-only set: %v", onlyBreaking)
 	}
 }
 func TestTypeString(t *testing.T) {
@@ -16,6 +16,8 @@ const filename = ".releaser.yml"
 type Config struct {
 	Git    GitConfig    `yaml:"git"`
 	Maven  MavenConfig  `yaml:"maven"`
 	Node   NodeConfig   `yaml:"node"`
 	Gradle GradleConfig `yaml:"gradle"`
 	GitLab GitLabConfig `yaml:"gitlab"`
 	GitHub GitHubConfig `yaml:"github"`
 }
@@ -27,10 +29,66 @@ type GitConfig struct {
 	AuthorName      string         `yaml:"author_name"`
 	AuthorEmail     string         `yaml:"author_email"`
 	ReleasableTypes []string       `yaml:"releasable_types"`
 	BumpRules       BumpRulesConfig `yaml:"bump_rules"`
 }
 // BumpRulesConfig controls what version component each commit type bumps.
 // Valid values: "patch" (default) or "minor".
 type BumpRulesConfig struct {
 	Breaking string `yaml:"breaking"`
 	Feat     string `yaml:"feat"`
 	Fix      string `yaml:"fix"`
 }
 type MavenConfig struct {
-	PomPath string `yaml:"pom_path"`
+	PomPath  string   `yaml:"pom_path"`  // single path (default: "pom.xml")
 	PomPaths []string `yaml:"pom_paths"` // multiple paths; overrides PomPath when set
 }
 // EffectivePomPaths returns the list of pom.xml paths to process.
 // PomPaths takes precedence over PomPath; falls back to ["pom.xml"].
 func (m MavenConfig) EffectivePomPaths() []string {
 	if len(m.PomPaths) > 0 {
 		return m.PomPaths
 	}
 	if m.PomPath != "" {
 		return []string{m.PomPath}
 	}
 	return []string{"pom.xml"}
 }
 type NodeConfig struct {
 	PackageJSON  string   `yaml:"package_json"`  // single path
 	PackageJSONs []string `yaml:"package_jsons"` // multiple paths; overrides PackageJSON when set
 }
 // EffectivePaths returns the list of package.json paths to process.
 // Returns nil when no node paths are configured (node processing is opt-in).
 func (n NodeConfig) EffectivePaths() []string {
 	if len(n.PackageJSONs) > 0 {
 		return n.PackageJSONs
 	}
 	if n.PackageJSON != "" {
 		return []string{n.PackageJSON}
 	}
 	return nil
 }
 type GradleConfig struct {
 	BuildFile  string   `yaml:"build_file"`  // single path (opt-in, no default)
 	BuildFiles []string `yaml:"build_files"` // multiple paths; overrides BuildFile
 }
 // EffectiveBuildFiles returns the list of Gradle build file paths to process.
 // Returns nil when no gradle paths are configured (gradle processing is opt-in).
 func (g GradleConfig) EffectiveBuildFiles() []string {
 	if len(g.BuildFiles) > 0 {
 		return g.BuildFiles
 	}
 	if g.BuildFile != "" {
 		return []string{g.BuildFile}
 	}
 	return nil
 }
 type GitLabConfig struct {
@@ -70,7 +128,15 @@ func defaultSources() Sources {
 		"git.author_name":         "default",
 		"git.author_email":        "default",
 		"git.releasable_types":    "default",
 		"git.bump_rules.breaking": "default",
 		"git.bump_rules.feat":     "default",
 		"git.bump_rules.fix":      "default",
 		"maven.pom_path":          "default",
 		"maven.pom_paths":         "default",
 		"node.package_json":       "default",
 		"node.package_jsons":      "default",
 		"gradle.build_file":       "default",
 		"gradle.build_files":      "default",
 		"gitlab.url":              "default",
 		"gitlab.token":            "default",
 		"gitlab.project":          "default",
@@ -126,9 +192,33 @@ func LoadWithSources(dir string) (Config, Sources, error) {
 	if len(overlay.Git.ReleasableTypes) > 0 {
 		src["git.releasable_types"] = "config file"
 	}
 	if overlay.Git.BumpRules.Breaking != "" {
 		src["git.bump_rules.breaking"] = "config file"
 	}
 	if overlay.Git.BumpRules.Feat != "" {
 		src["git.bump_rules.feat"] = "config file"
 	}
 	if overlay.Git.BumpRules.Fix != "" {
 		src["git.bump_rules.fix"] = "config file"
 	}
 	if overlay.Maven.PomPath != "" {
 		src["maven.pom_path"] = "config file"
 	}
 	if len(overlay.Maven.PomPaths) > 0 {
 		src["maven.pom_paths"] = "config file"
 	}
 	if overlay.Node.PackageJSON != "" {
 		src["node.package_json"] = "config file"
 	}
 	if len(overlay.Node.PackageJSONs) > 0 {
 		src["node.package_jsons"] = "config file"
 	}
 	if overlay.Gradle.BuildFile != "" {
 		src["gradle.build_file"] = "config file"
 	}
 	if len(overlay.Gradle.BuildFiles) > 0 {
 		src["gradle.build_files"] = "config file"
 	}
 	if overlay.GitLab.URL != "" {
 		src["gitlab.url"] = "config file"
 	}
@@ -123,6 +123,221 @@ func TestApplyEnvProjectPathFallback(t *testing.T) {
 	}
 }
 func TestLoadWithSourcesFullConfig(t *testing.T) {
 	dir := t.TempDir()
 	content := `
 git:
  tag_prefix: "v"
  branch_pattern: "^release/(\\d+)$"
  commit_message: "release {version}"
  author_name: "Bot"
  author_email: "bot@example.com"
  releasable_types: ["fix", "feat"]
  bump_rules:
    breaking: "minor"
    feat: "patch"
    fix: "patch"
 maven:
  pom_path: "sub/pom.xml"
  pom_paths:
    - "a/pom.xml"
    - "b/pom.xml"
 node:
  package_json: "frontend/package.json"
  package_jsons:
    - "pkg-a/package.json"
    - "pkg-b/package.json"
 gitlab:
  url: "https://gitlab.example.com"
  token: "gitlab-token"
  project: "42"
 github:
  token: "github-token"
  repo: "owner/repo"
 `
 	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 	_, src, err := LoadWithSources(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
 	wantConfigFile := []string{
 		"git.tag_prefix", "git.branch_pattern", "git.commit_message",
 		"git.author_name", "git.author_email", "git.releasable_types",
 		"git.bump_rules.breaking", "git.bump_rules.feat", "git.bump_rules.fix",
 		"maven.pom_path", "maven.pom_paths",
 		"node.package_json", "node.package_jsons",
 		"gitlab.url", "gitlab.token", "gitlab.project",
 		"github.token", "github.repo",
 	}
 	for _, key := range wantConfigFile {
 		if got := src[key]; got != "config file" {
 			t.Errorf("src[%q] = %q, want %q", key, got, "config file")
 		}
 	}
 }
 func TestEffectivePomPaths(t *testing.T) {
 	cases := []struct {
 		name string
 		cfg  MavenConfig
 		want []string
 	}{
 		{"default", MavenConfig{PomPath: "pom.xml"}, []string{"pom.xml"}},
 		{"single override", MavenConfig{PomPath: "sub/pom.xml"}, []string{"sub/pom.xml"}},
 		{"multi overrides single", MavenConfig{PomPath: "pom.xml", PomPaths: []string{"a/pom.xml", "b/pom.xml"}}, []string{"a/pom.xml", "b/pom.xml"}},
 		{"empty falls back to default", MavenConfig{}, []string{"pom.xml"}},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			got := c.cfg.EffectivePomPaths()
 			if len(got) != len(c.want) {
 				t.Fatalf("got %v, want %v", got, c.want)
 			}
 			for i := range got {
 				if got[i] != c.want[i] {
 					t.Errorf("[%d] got %q, want %q", i, got[i], c.want[i])
 				}
 			}
 		})
 	}
 }
 func TestNodeEffectivePaths(t *testing.T) {
 	cases := []struct {
 		name string
 		cfg  NodeConfig
 		want []string
 	}{
 		{"empty — opt-in, skip by default", NodeConfig{}, nil},
 		{"single", NodeConfig{PackageJSON: "package.json"}, []string{"package.json"}},
 		{"multi overrides single", NodeConfig{PackageJSON: "package.json", PackageJSONs: []string{"a/package.json", "b/package.json"}}, []string{"a/package.json", "b/package.json"}},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			got := c.cfg.EffectivePaths()
 			if len(got) != len(c.want) {
 				t.Fatalf("got %v, want %v", got, c.want)
 			}
 			for i := range got {
 				if got[i] != c.want[i] {
 					t.Errorf("[%d] got %q, want %q", i, got[i], c.want[i])
 				}
 			}
 		})
 	}
 }
 func TestApplyEnvWithSourcesCIProjectID(t *testing.T) {
 	t.Setenv("CI_PROJECT_ID", "123")
 	t.Setenv("CI_PROJECT_PATH", "")
 	cfg := defaults()
 	src := defaultSources()
 	cfg.ApplyEnvWithSources(src)
 	if src["gitlab.project"] != "env: CI_PROJECT_ID" {
 		t.Errorf("src[gitlab.project] = %q, want %q", src["gitlab.project"], "env: CI_PROJECT_ID")
 	}
 }
 func TestApplyEnvWithSourcesGitHubToken(t *testing.T) {
 	t.Setenv("GITHUB_TOKEN", "ghtoken")
 	cfg := defaults()
 	src := defaultSources()
 	cfg.ApplyEnvWithSources(src)
 	if src["github.token"] != "env: GITHUB_TOKEN" {
 		t.Errorf("src[github.token] = %q, want %q", src["github.token"], "env: GITHUB_TOKEN")
 	}
 }
 func TestApplyEnvWithSourcesCIProjectPath(t *testing.T) {
 	t.Setenv("CI_PROJECT_ID", "")
 	t.Setenv("CI_PROJECT_PATH", "group/project")
 	cfg := defaults()
 	src := defaultSources()
 	cfg.ApplyEnvWithSources(src)
 	if src["gitlab.project"] != "env: CI_PROJECT_PATH" {
 		t.Errorf("src[gitlab.project] = %q, want %q", src["gitlab.project"], "env: CI_PROJECT_PATH")
 	}
 }
 func TestApplyEnvWithSourcesGitLabToken(t *testing.T) {
 	t.Setenv("GITLAB_TOKEN", "mytoken")
 	cfg := defaults()
 	src := defaultSources()
 	cfg.ApplyEnvWithSources(src)
 	if src["gitlab.token"] != "env: GITLAB_TOKEN" {
 		t.Errorf("src[gitlab.token] = %q, want %q", src["gitlab.token"], "env: GITLAB_TOKEN")
 	}
 }
 func TestApplyEnvWithSourcesCIServerURL(t *testing.T) {
 	t.Setenv("CI_SERVER_URL", "https://gitlab.example.com")
 	cfg := defaults()
 	src := defaultSources()
 	cfg.ApplyEnvWithSources(src)
 	if src["gitlab.url"] != "env: CI_SERVER_URL" {
 		t.Errorf("src[gitlab.url] = %q, want %q", src["gitlab.url"], "env: CI_SERVER_URL")
 	}
 }
 func TestGradleEffectiveBuildFiles(t *testing.T) {
 	// Neither set → nil (opt-in)
 	if got := (GradleConfig{}).EffectiveBuildFiles(); got != nil {
 		t.Errorf("empty config: got %v, want nil", got)
 	}
 	// BuildFile only
 	if got := (GradleConfig{BuildFile: "build.gradle"}).EffectiveBuildFiles(); len(got) != 1 || got[0] != "build.gradle" {
 		t.Errorf("BuildFile only: got %v", got)
 	}
 	// BuildFiles wins over BuildFile
 	g := GradleConfig{BuildFile: "build.gradle", BuildFiles: []string{"a/build.gradle", "b/build.gradle"}}
 	if got := g.EffectiveBuildFiles(); len(got) != 2 || got[0] != "a/build.gradle" {
 		t.Errorf("BuildFiles priority: got %v", got)
 	}
 }
 func TestLoadGradleSources(t *testing.T) {
 	dir := t.TempDir()
 	content := "gradle:\n  build_file: \"build.gradle\"\n"
 	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 	_, src, err := LoadWithSources(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if src["gradle.build_file"] != "config file" {
 		t.Errorf("src[gradle.build_file] = %q, want %q", src["gradle.build_file"], "config file")
 	}
 }
 func TestLoadGradleBuildFilesSources(t *testing.T) {
 	dir := t.TempDir()
 	content := "gradle:\n  build_files:\n    - \"a/build.gradle\"\n    - \"b/build.gradle\"\n"
 	if err := os.WriteFile(filepath.Join(dir, filename), []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 	_, src, err := LoadWithSources(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
 	if src["gradle.build_files"] != "config file" {
 		t.Errorf("src[gradle.build_files] = %q, want %q", src["gradle.build_files"], "config file")
 	}
 }
 func TestLoadPartialOverride(t *testing.T) {
 	dir := t.TempDir()
 	// Only override tag_prefix — commit_message should keep its default
@@ -0,0 +1,138 @@
 package ghclient
 import (
 	"context"
 	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
 	"testing"
 )
 func TestNew(t *testing.T) {
 	c := New("tok", "owner/repo")
 	if c.token != "tok" || c.repo != "owner/repo" || c.httpClient == nil {
 		t.Fatalf("New fields: token=%q repo=%q httpClient=%v", c.token, c.repo, c.httpClient)
 	}
 }
 func TestCreateReleaseSuccess(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodPost {
 			t.Errorf("method = %q, want POST", r.Method)
 		}
 		if !strings.HasSuffix(r.URL.Path, "/releases") {
 			t.Errorf("path = %q, want .../releases", r.URL.Path)
 		}
 		if r.Header.Get("Authorization") != "Bearer test-token" {
 			t.Errorf("Authorization = %q", r.Header.Get("Authorization"))
 		}
 		var req struct {
 			TagName string `json:"tag_name"`
 			Name    string `json:"name"`
 			Body    string `json:"body"`
 		}
 		json.NewDecoder(r.Body).Decode(&req)
 		if req.TagName != "v1.0.0" {
 			t.Errorf("tag_name = %q, want v1.0.0", req.TagName)
 		}
 		w.WriteHeader(http.StatusCreated)
 		io.WriteString(w, `{}`)
 	}))
 	defer srv.Close()
 	c := New("test-token", "owner/repo")
 	c.httpClient = srv.Client()
 	// Override the URL by pointing the client at the test server.
 	// We can't easily override the URL without a custom transport, so use a
 	// round-trip wrapper instead.
 	c.httpClient.Transport = rewriteTransport{base: http.DefaultTransport, target: srv.URL}
 	if err := c.CreateRelease(context.Background(), "v1.0.0", "release notes"); err != nil {
 		t.Fatalf("CreateRelease: %v", err)
 	}
 }
 func TestCreateReleaseAPIError(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusUnprocessableEntity)
 		io.WriteString(w, `{"message":"Validation Failed"}`)
 	}))
 	defer srv.Close()
 	c := New("tok", "owner/repo")
 	c.httpClient = &http.Client{Transport: rewriteTransport{base: http.DefaultTransport, target: srv.URL}}
 	err := c.CreateRelease(context.Background(), "v1.0.0", "body")
 	if err == nil {
 		t.Fatal("expected error for 422 response")
 	}
 	if !strings.Contains(err.Error(), "422") {
 		t.Errorf("error should mention status code: %v", err)
 	}
 }
 func TestCreateReleaseAPIErrorNoMessage(t *testing.T) {
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusInternalServerError)
 		io.WriteString(w, `not json`)
 	}))
 	defer srv.Close()
 	c := New("tok", "owner/repo")
 	c.httpClient = &http.Client{Transport: rewriteTransport{base: http.DefaultTransport, target: srv.URL}}
 	err := c.CreateRelease(context.Background(), "v1.0.0", "body")
 	if err == nil {
 		t.Fatal("expected error for 500 response")
 	}
 	if !strings.Contains(err.Error(), "500") {
 		t.Errorf("error should mention status code: %v", err)
 	}
 }
 func TestCreateReleaseRequestFails(t *testing.T) {
 	c := New("tok", "owner/repo")
 	// Use a transport that always fails.
 	c.httpClient = &http.Client{Transport: alwaysFailTransport{}}
 	err := c.CreateRelease(context.Background(), "v1.0.0", "body")
 	if err == nil {
 		t.Fatal("expected error when HTTP request fails")
 	}
 }
 func TestCreateReleaseBadURL(t *testing.T) {
 	// A repo containing a null byte makes the URL unparseable by http.NewRequestWithContext.
 	c := New("tok", "owner/repo\x00bad")
 	err := c.CreateRelease(context.Background(), "v1.0.0", "body")
 	if err == nil {
 		t.Fatal("expected error for invalid URL")
 	}
 }
 // rewriteTransport redirects all requests to a test server URL.
 type rewriteTransport struct {
 	base   http.RoundTripper
 	target string
 }
 func (rt rewriteTransport) RoundTrip(req *http.Request) (*http.Response, error) {
 	req2 := req.Clone(req.Context())
 	req2.URL.Scheme = "http"
 	req2.URL.Host = strings.TrimPrefix(rt.target, "http://")
 	return rt.base.RoundTrip(req2)
 }
 // alwaysFailTransport returns an error for every request.
 type alwaysFailTransport struct{}
 func (alwaysFailTransport) RoundTrip(*http.Request) (*http.Response, error) {
 	return nil, &testTransportError{"connection refused"}
 }
 type testTransportError struct{ msg string }
 func (e *testTransportError) Error() string { return e.msg }
@@ -85,23 +85,21 @@ func LatestTag(repo *gogit.Repository, info branch.Info) (string, int, error) {
 			return nil
 		}
-		commitHash, err := resolveTagToCommit(repo, ref)
+		tagCommit, err := resolveTagToCommitObj(repo, ref)
 		if err != nil {
 			return nil // silently skip malformed tags
 		}
 		tagCommit, err := repo.CommitObject(commitHash)
 		if err != nil {
 			return nil
 		}
 		if tagCommit.Hash == headCommit.Hash {
 			candidates = append(candidates, tagCandidate{name, patch})
 			return nil
 		}
 		anc, err := tagCommit.IsAncestor(headCommit)
-		if err != nil || !anc {
+		if err != nil {
 			return err
 		}
 		if !anc {
 			return nil
 		}
@@ -241,6 +239,12 @@ func CreateTag(repo *gogit.Repository, tagName string) error {
 	return nil
 }
 // sshPush is the function used for SSH agent push; replaced in tests to avoid requiring a live agent.
 var sshPush = pushWithSSHAgent
 // newSSHAgentAuth creates an SSH agent auth method; replaced in tests.
 var newSSHAgentAuth = gitssh.NewSSHAgentAuth
 // Push pushes the given branch and tag to the "origin" remote.
 // When token is non-empty, go-git is used with HTTPS basic auth (oauth2/token) — suitable for CI.
 // When token is empty and the remote URL is SSH, go-git SSH agent auth is attempted first.
@@ -253,7 +257,7 @@ func Push(repo *gogit.Repository, branchName, tagName, token string) error {
 	if remote, err := repo.Remote("origin"); err == nil {
 		urls := remote.Config().URLs
 		if len(urls) > 0 && isSSHURL(urls[0]) {
-			if err := pushWithSSHAgent(repo, branchName, tagName); err == nil {
+			if err := sshPush(repo, branchName, tagName); err == nil {
 				return nil
 			}
 		}
@@ -266,7 +270,7 @@ func isSSHURL(u string) bool {
 }
 func pushWithSSHAgent(repo *gogit.Repository, branchName, tagName string) error {
-	auth, err := gitssh.NewSSHAgentAuth("git")
+	auth, err := newSSHAgentAuth("git")
 	if err != nil {
 		return err
 	}
@@ -331,22 +335,31 @@ func pushWithCLI(repo *gogit.Repository, branchName, tagName string) error {
 	return nil
 }
-// resolveTagToCommit follows tag objects until it reaches a commit.
+// resolveTagToCommitObj follows tag objects until it reaches a commit and returns it.
 // Handles both lightweight tags (ref → commit) and annotated tags (ref → tag object → … → commit).
-func resolveTagToCommit(repo *gogit.Repository, ref *plumbing.Reference) (plumbing.Hash, error) {
+func resolveTagToCommitObj(repo *gogit.Repository, ref *plumbing.Reference) (*object.Commit, error) {
 	hash := ref.Hash()
 	for {
 		obj, err := repo.Object(plumbing.AnyObject, hash)
 		if err != nil {
-			return plumbing.ZeroHash, err
+			return nil, err
 		}
 		switch o := obj.(type) {
 		case *object.Commit:
-			return o.Hash, nil
+			return o, nil
 		case *object.Tag:
 			hash = o.Target
 		default:
-			return plumbing.ZeroHash, fmt.Errorf("unexpected object type %s at %s", obj.Type(), hash)
+			return nil, fmt.Errorf("unexpected object type %s at %s", obj.Type(), hash)
 		}
 	}
 }
 // resolveTagToCommit follows tag objects until it reaches a commit and returns its hash.
 func resolveTagToCommit(repo *gogit.Repository, ref *plumbing.Reference) (plumbing.Hash, error) {
 	c, err := resolveTagToCommitObj(repo, ref)
 	if err != nil {
 		return plumbing.ZeroHash, err
 	}
 	return c.Hash, nil
 }
@@ -1,6 +1,7 @@
 package gitutil
 import (
 	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
@@ -11,6 +12,7 @@ import (
 	gitconfig "github.com/go-git/go-git/v5/config"
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/object"
 	gitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
 	"git.k3nny.fr/releaser/internal/branch"
 )
@@ -699,3 +701,410 @@ func TestPushWithBareRemote(t *testing.T) {
 		t.Fatalf("second Push returned unexpected error: %v", err)
 	}
 }
 // ── IsWorkingTreeClean: w.Status() error path ────────────────────────────────
 func TestIsWorkingTreeCleanCorruptIndex(t *testing.T) {
 	// Use a filesystem repo so we can corrupt the on-disk index.
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "chore: init", "initial")
 	// Overwrite .git/index with garbage so go-git fails to parse it.
 	indexPath := filepath.Join(dir, ".git", "index")
 	if err := os.WriteFile(indexPath, []byte("not a valid git index"), 0644); err != nil {
 		t.Fatal(err)
 	}
 	// Reopen — fresh repository object with no cached index.
 	repo2, err := gogit.PlainOpen(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
 	_, err = IsWorkingTreeClean(repo2)
 	if err == nil {
 		t.Error("expected error when git index is corrupt")
 	}
 }
 // ── LatestTag: head commit object missing ────────────────────────────────────
 func TestLatestTagHeadCommitMissing(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.2.0")
 	// Detach HEAD to a fake hash that has no backing commit object.
 	fakeHash := plumbing.NewHash("deadbeefdeadbeefdeadbeefdeadbeefdeadbeef")
 	if err := repo.Storer.SetReference(plumbing.NewHashReference(plumbing.HEAD, fakeHash)); err != nil {
 		t.Fatal(err)
 	}
 	_, _, err := LatestTag(repo, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})
 	if err == nil {
 		t.Error("expected error when HEAD commit object is missing")
 	}
 }
 // ── LatestTag: Tags() iterator fails ────────────────────────────────────────
 func TestLatestTagTagsIterFails(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	if os.Getuid() == 0 {
 		t.Skip("skipping: chmod restrictions do not apply when running as root")
 	}
 	// Make .git/refs/tags/ unreadable so that go-git's walkReferencesTree
 	// returns EPERM when it tries to list the directory, triggering the
 	// Tags() error path.
 	tagsDir := filepath.Join(dir, ".git", "refs", "tags")
 	os.Chmod(tagsDir, 0000)
 	t.Cleanup(func() { os.Chmod(tagsDir, 0755) })
 	// Reopen so the filesystem storer holds no cached state.
 	repo2, err := gogit.PlainOpen(dir)
 	if err != nil {
 		t.Fatalf("PlainOpen: %v", err)
 	}
 	_, _, err = LatestTag(repo2, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})
 	if err == nil {
 		t.Error("expected error when refs/tags is unreadable")
 	}
 }
 // ── LatestTag: IsAncestor fails → ForEach propagates error ───────────────────
 func TestLatestTagIsAncestorFails(t *testing.T) {
 	// Topology: c0 (base) → c1 (sibling branch, tagged v1.2.0)
 	//                      → c2 (master HEAD — diverged from sibling)
 	// The tag is NOT an ancestor of HEAD. IsAncestor must walk master's history
 	// all the way back to c0; corrupting c0 makes that walk fail.
 	repo, dir := newTestRepo(t)
 	c0 := addCommit(t, repo, dir, "chore: base", "base")
 	w, _ := repo.Worktree()
 	if err := w.Checkout(&gogit.CheckoutOptions{
 		Branch: plumbing.NewBranchReferenceName("sibling"),
 		Hash:   c0,
 		Create: true,
 	}); err != nil {
 		t.Fatal(err)
 	}
 	addCommit(t, repo, dir, "feat: sibling work", "sibling")
 	addTag(t, repo, "v1.2.0") // tag on the sibling commit (not an ancestor of master)
 	if err := w.Checkout(&gogit.CheckoutOptions{
 		Branch: plumbing.NewBranchReferenceName("master"),
 	}); err != nil {
 		t.Fatal(err)
 	}
 	addCommit(t, repo, dir, "fix: mainline", "mainline") // HEAD on master
 	// Corrupt c0 (the common base) so that IsAncestor's commit-graph walk
 	// fails when it tries to read c0 as a parent of the master HEAD commit.
 	hashStr := c0.String()
 	objPath := filepath.Join(dir, ".git", "objects", hashStr[:2], hashStr[2:])
 	if err := os.Chmod(objPath, 0644); err != nil {
 		t.Fatalf("chmod object: %v", err)
 	}
 	if err := os.WriteFile(objPath, []byte("corrupt"), 0444); err != nil {
 		t.Fatal(err)
 	}
 	repo2, err := gogit.PlainOpen(dir)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// The ForEach callback propagates the IsAncestor error, so LatestTag
 	// must return a non-nil error (covers the refs.ForEach error path).
 	_, _, err = LatestTag(repo2, branch.Info{Major: 1, Minor: 2, TagPrefix: "v"})
 	if err == nil {
 		t.Error("expected error when commit graph is corrupt during IsAncestor")
 	}
 }
 // ── CommitsSince: repo.Head() fails after tag resolve ────────────────────────
 func TestCommitsSinceHeadRemoved(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.2.0")
 	// Remove HEAD so repo.Head() returns ErrReferenceNotFound.
 	if err := repo.Storer.RemoveReference(plumbing.HEAD); err != nil {
 		t.Fatal(err)
 	}
 	_, err := CommitsSince(repo, "v1.2.0")
 	if err == nil {
 		t.Error("expected error when HEAD reference is missing")
 	}
 }
 // ── CommitsSince: repo.Log() fails ───────────────────────────────────────────
 func TestCommitsSinceFakeHead(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.2.0")
 	addCommit(t, repo, dir, "fix: c2", "v2")
 	// Point HEAD directly to a non-existent commit hash.
 	// repo.Head() succeeds (returns the hash) but repo.Log() fails eagerly.
 	fakeHash := plumbing.NewHash("cafebabecafebabecafebabecafebabecafebabe")
 	if err := repo.Storer.SetReference(plumbing.NewHashReference(plumbing.HEAD, fakeHash)); err != nil {
 		t.Fatal(err)
 	}
 	_, err := CommitsSince(repo, "v1.2.0")
 	if err == nil {
 		t.Error("expected error when HEAD commit object is missing")
 	}
 }
 // ── AllCommits: repo.Log() fails ─────────────────────────────────────────────
 func TestAllCommitsFakeHead(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	// Point HEAD to a non-existent commit hash so repo.Log() fails eagerly.
 	fakeHash := plumbing.NewHash("deadbeefdeadbeefdeadbeefdeadbeefdeadbeef")
 	if err := repo.Storer.SetReference(plumbing.NewHashReference(plumbing.HEAD, fakeHash)); err != nil {
 		t.Fatal(err)
 	}
 	_, err := AllCommits(repo)
 	if err == nil {
 		t.Error("expected error when HEAD commit object is missing")
 	}
 }
 // ── CommitFiles: w.Commit() fails ────────────────────────────────────────────
 func TestCommitFilesUnchanged(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "chore: init", "initial")
 	// test.txt already committed and unchanged — w.Add succeeds, w.Commit fails
 	// (go-git rejects empty commits when AllowEmptyCommits is false).
 	_, err := CommitFiles(repo, []string{"test.txt"}, "chore: empty", "Test", "t@t.com")
 	if err == nil {
 		t.Error("expected error when committing unchanged file (empty commit)")
 	}
 }
 // ── Push: SSH agent success / failure paths ──────────────────────────────────
 func TestPushSSHAgentSucceeds(t *testing.T) {
 	// Mock sshPush so it succeeds without a real SSH agent.
 	orig := sshPush
 	sshPush = func(_ *gogit.Repository, _, _ string) error { return nil }
 	defer func() { sshPush = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{"git@example.com:owner/repo.git"},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	if err := Push(repo, "master", "v1.0.0", ""); err != nil {
 		t.Fatalf("Push with mocked SSH agent should succeed: %v", err)
 	}
 }
 func TestPushSSHAgentFailsFallsBackToCLI(t *testing.T) {
 	// SSH URL remote + sshPush fails → falls through to pushWithCLI.
 	orig := sshPush
 	sshPush = func(_ *gogit.Repository, _, _ string) error { return fmt.Errorf("no agent") }
 	defer func() { sshPush = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{"git@example.com:owner/repo.git"},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	// CLI push will fail (no real remote) — we just verify it ran at all.
 	err := Push(repo, "master", "v1.0.0", "")
 	if err == nil {
 		t.Error("expected error after SSH fallback to CLI with unreachable remote")
 	}
 }
 // ── pushWithSSHAgent internals ────────────────────────────────────────────────
 func TestPushWithSSHAgentAuthFails(t *testing.T) {
 	orig := newSSHAgentAuth
 	newSSHAgentAuth = func(_ string) (*gitssh.PublicKeysCallback, error) {
 		return nil, fmt.Errorf("SSH_AUTH_SOCK not set")
 	}
 	defer func() { newSSHAgentAuth = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	err := pushWithSSHAgent(repo, "master", "v1.0.0")
 	if err == nil {
 		t.Error("expected error when SSH agent auth fails")
 	}
 }
 func TestPushWithSSHAgentNoRemote(t *testing.T) {
 	orig := newSSHAgentAuth
 	newSSHAgentAuth = func(user string) (*gitssh.PublicKeysCallback, error) {
 		return &gitssh.PublicKeysCallback{User: user}, nil
 	}
 	defer func() { newSSHAgentAuth = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	// No remote configured → repo.Remote("origin") fails.
 	err := pushWithSSHAgent(repo, "master", "v1.0.0")
 	if err == nil {
 		t.Error("expected error when no origin remote is configured")
 	}
 }
 func TestPushWithSSHAgentPushFails(t *testing.T) {
 	orig := newSSHAgentAuth
 	newSSHAgentAuth = func(user string) (*gitssh.PublicKeysCallback, error) {
 		return &gitssh.PublicKeysCallback{User: user}, nil
 	}
 	defer func() { newSSHAgentAuth = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.0.0")
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{"/nonexistent/bare/repo"},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	err := pushWithSSHAgent(repo, "master", "v1.0.0")
 	if err == nil {
 		t.Error("expected error when remote push fails")
 	}
 }
 func TestPushWithSSHAgentSuccess(t *testing.T) {
 	remoteDir := t.TempDir()
 	if _, err := gogit.PlainInit(remoteDir, true); err != nil {
 		t.Fatal(err)
 	}
 	orig := newSSHAgentAuth
 	newSSHAgentAuth = func(user string) (*gitssh.PublicKeysCallback, error) {
 		return &gitssh.PublicKeysCallback{User: user}, nil
 	}
 	defer func() { newSSHAgentAuth = orig }()
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.0.0")
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{remoteDir},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	// Local transport ignores auth — push succeeds regardless of the mock callback.
 	if err := pushWithSSHAgent(repo, "master", "v1.0.0"); err != nil {
 		t.Fatalf("expected success pushing to local bare remote: %v", err)
 	}
 }
 // ── pushWithGoGit error paths ─────────────────────────────────────────────────
 func TestPushWithGoGitNoRemote(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	// No remote → repo.Remote("origin") fails inside pushWithGoGit.
 	err := Push(repo, "master", "v1.0.0", "some-token")
 	if err == nil {
 		t.Error("expected error when no origin remote is configured")
 	}
 }
 func TestPushWithGoGitPushFails(t *testing.T) {
 	repo, dir := newTestRepo(t)
 	addCommit(t, repo, dir, "fix: c1", "v1")
 	addTag(t, repo, "v1.0.0")
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{"/nonexistent/bare/repo"},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	err := Push(repo, "master", "v1.0.0", "some-token")
 	if err == nil {
 		t.Error("expected error when remote push fails")
 	}
 }
 // ── pushWithCLI: bare repo → no worktree ────────────────────────────────────
 func TestPushWithCLIBareRepo(t *testing.T) {
 	dir := t.TempDir()
 	repo, err := gogit.PlainInit(dir, true)
 	if err != nil {
 		t.Fatal(err)
 	}
 	// No token, no SSH URL → goes to pushWithCLI → Worktree() fails for bare repo.
 	err = Push(repo, "master", "v1.0.0", "")
 	if err == nil {
 		t.Error("expected error for bare repo (no worktree)")
 	}
 }
 func TestPushWithCLISuccess(t *testing.T) {
 	// Non-bare repo + local bare remote + no token + no SSH URL → pushWithCLI → success.
 	repo, dir := newTestRepo(t)
 	sig := testSig()
 	wt, _ := repo.Worktree()
 	if err := os.WriteFile(filepath.Join(dir, "f.txt"), []byte("x"), 0644); err != nil {
 		t.Fatal(err)
 	}
 	wt.Add("f.txt")
 	hash, err := wt.Commit("init", &gogit.CommitOptions{Author: sig})
 	if err != nil {
 		t.Fatal(err)
 	}
 	if _, err := repo.CreateTag("v1.0.0", hash, nil); err != nil {
 		t.Fatal(err)
 	}
 	remoteDir := t.TempDir()
 	if _, err := gogit.PlainInit(remoteDir, true); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := repo.CreateRemote(&gitconfig.RemoteConfig{
 		Name: "origin",
 		URLs: []string{remoteDir},
 	}); err != nil {
 		t.Fatal(err)
 	}
 	// Detect default branch name (go-git uses "master" but git config may differ).
 	head, _ := repo.Head()
 	branchName := head.Name().Short()
 	if err := Push(repo, branchName, "v1.0.0", ""); err != nil {
 		t.Fatalf("pushWithCLI success: %v", err)
 	}
 }
@@ -0,0 +1,54 @@
 package gradle
 import (
 	"fmt"
 	"os"
 	"regexp"
 )
 // versionRe matches a Gradle/Kotlin DSL version assignment on its own line.
 // Group 1 captures the version string (without quotes).
 // Handles both double-quoted (Kotlin/Groovy) and single-quoted (Groovy) forms,
 // with or without spaces around =.
 var versionRe = regexp.MustCompile(`(?m)^[ \t]*version\s*=\s*["']([^"']+)["']`)
 // ReadVersion returns the version value from a build.gradle or build.gradle.kts file.
 func ReadVersion(path string) (string, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return "", fmt.Errorf("read %s: %w", path, err)
 	}
 	m := versionRe.FindStringSubmatch(string(data))
 	if m == nil {
 		return "", fmt.Errorf("no version assignment found in %s", path)
 	}
 	return m[1], nil
 }
 // WriteVersion replaces the version assignment in a build.gradle or build.gradle.kts
 // file in-place. oldVersion must match what ReadVersion returned. Quote style is preserved.
 func WriteVersion(path, oldVersion, newVersion string) error {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return fmt.Errorf("read %s: %w", path, err)
 	}
 	updated, ok := replaceVersion(string(data), oldVersion, newVersion)
 	if !ok {
 		return fmt.Errorf("version %q not found in %s", oldVersion, path)
 	}
 	return os.WriteFile(path, []byte(updated), 0644)
 }
 // replaceVersion finds and replaces the first version assignment line in a Gradle build file.
 // Quote style (single or double) of the original line is preserved.
 // Returns the updated content and true if a replacement was made.
 func replaceVersion(content, oldVersion, newVersion string) (string, bool) {
 	re := regexp.MustCompile(`(?m)^([ \t]*version\s*=\s*)(["'])` + regexp.QuoteMeta(oldVersion) + `["']`)
 	m := re.FindStringSubmatchIndex(content)
 	if m == nil {
 		return content, false
 	}
 	prefix := content[m[2]:m[3]] // "version = " etc., preserving whitespace
 	quote := content[m[4]:m[5]]  // " or '
 	return content[:m[0]] + prefix + quote + newVersion + quote + content[m[1]:], true
 }
@@ -0,0 +1,183 @@
 package gradle
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 const gradleGroovy = `plugins {
    id 'java'
 }
 group = 'com.example'
 version = '1.2.3'
 description = 'My project'
 `
 const gradleKotlin = `plugins {
    kotlin("jvm") version "1.9.0"
 }
 group = "com.example"
 version = "1.2.3"
 description = "My project"
 `
 func writeGradle(t *testing.T, content string) string {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "build.gradle")
 	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 	return path
 }
 // ── ReadVersion ──────────────────────────────────────────────────────────────
 func TestReadVersionGroovy(t *testing.T) {
 	got, err := ReadVersion(writeGradle(t, gradleGroovy))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if got != "1.2.3" {
 		t.Errorf("got %q, want 1.2.3", got)
 	}
 }
 func TestReadVersionKotlin(t *testing.T) {
 	got, err := ReadVersion(writeGradle(t, gradleKotlin))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if got != "1.2.3" {
 		t.Errorf("got %q, want 1.2.3", got)
 	}
 }
 func TestReadVersionNoSpaces(t *testing.T) {
 	got, err := ReadVersion(writeGradle(t, `version="1.0.0"`))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if got != "1.0.0" {
 		t.Errorf("got %q, want 1.0.0", got)
 	}
 }
 func TestReadVersionMissingFile(t *testing.T) {
 	_, err := ReadVersion(filepath.Join(t.TempDir(), "build.gradle"))
 	if err == nil {
 		t.Error("expected error for missing file")
 	}
 }
 func TestReadVersionNoVersionField(t *testing.T) {
 	_, err := ReadVersion(writeGradle(t, `group = "com.example"`))
 	if err == nil {
 		t.Error("expected error when no version assignment is present")
 	}
 }
 // ── WriteVersion ─────────────────────────────────────────────────────────────
 func TestWriteVersionKotlin(t *testing.T) {
 	path := writeGradle(t, gradleKotlin)
 	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(path)
 	if !strings.Contains(string(data), `version = "1.2.4"`) {
 		t.Errorf("expected updated version; got:\n%s", data)
 	}
 	// plugin version declaration must not be touched
 	if !strings.Contains(string(data), `kotlin("jvm") version "1.9.0"`) {
 		t.Error("plugin version was incorrectly modified")
 	}
 }
 func TestWriteVersionGroovy(t *testing.T) {
 	path := writeGradle(t, gradleGroovy)
 	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(path)
 	if !strings.Contains(string(data), `version = '1.2.4'`) {
 		t.Errorf("expected updated version with single quotes; got:\n%s", data)
 	}
 }
 func TestWriteVersionMissingFile(t *testing.T) {
 	err := WriteVersion(filepath.Join(t.TempDir(), "build.gradle"), "1.0.0", "1.0.1")
 	if err == nil {
 		t.Error("expected error for missing file")
 	}
 }
 func TestWriteVersionNotFound(t *testing.T) {
 	path := writeGradle(t, gradleKotlin)
 	err := WriteVersion(path, "9.9.9", "9.9.10")
 	if err == nil {
 		t.Error("expected error when old version not found in file")
 	}
 }
 func TestWriteVersionReadOnly(t *testing.T) {
 	if os.Getuid() == 0 {
 		t.Skip("skipping: chmod restrictions do not apply when running as root")
 	}
 	path := writeGradle(t, gradleKotlin)
 	os.Chmod(path, 0444)
 	defer os.Chmod(path, 0644)
 	err := WriteVersion(path, "1.2.3", "1.2.4")
 	if err == nil {
 		t.Error("expected error writing to read-only file")
 	}
 }
 // ── replaceVersion ────────────────────────────────────────────────────────────
 func TestReplaceVersionNotFound(t *testing.T) {
 	content := `group = "com.example"`
 	got, ok := replaceVersion(content, "1.0.0", "1.0.1")
 	if ok {
 		t.Error("expected ok=false when version not present")
 	}
 	if got != content {
 		t.Error("content should be unchanged when not found")
 	}
 }
 // ── fuzz ──────────────────────────────────────────────────────────────────────
 // FuzzReadVersion verifies ReadVersion never panics on arbitrary file content.
 func FuzzReadVersion(f *testing.F) {
 	f.Add(gradleGroovy)
 	f.Add(gradleKotlin)
 	f.Add(`version="1.0.0"`)
 	f.Add(`group = "com.example"`)
 	f.Add("")
 	f.Add("\x00\xff")
 	f.Fuzz(func(t *testing.T, content string) {
 		path := filepath.Join(t.TempDir(), "build.gradle")
 		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
 		ReadVersion(path)                          //nolint:errcheck
 	})
 }
 // FuzzWriteVersion verifies WriteVersion never panics on arbitrary content or version strings.
 func FuzzWriteVersion(f *testing.F) {
 	f.Add(gradleGroovy, "1.2.3", "1.2.4")
 	f.Add(gradleKotlin, "1.2.3", "1.2.4")
 	f.Add(`version="1.0.0"`, "1.0.0", "1.0.1")
 	f.Add("", "1.0.0", "1.0.1")
 	f.Add(`version = "1.0.0"`, "", "1.0.1")
 	f.Fuzz(func(t *testing.T, content, oldVersion, newVersion string) {
 		path := filepath.Join(t.TempDir(), "build.gradle")
 		os.WriteFile(path, []byte(content), 0644)  //nolint:errcheck
 		WriteVersion(path, oldVersion, newVersion)  //nolint:errcheck
 	})
 }
@@ -0,0 +1,42 @@
 package node
 import (
 	"encoding/json"
 	"fmt"
 	"os"
 	"strings"
 )
 // ReadVersion returns the version field from a package.json file.
 func ReadVersion(path string) (string, error) {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return "", fmt.Errorf("read %s: %w", path, err)
 	}
 	var pkg struct {
 		Version string `json:"version"`
 	}
 	if err := json.Unmarshal(data, &pkg); err != nil {
 		return "", fmt.Errorf("parse %s: %w", path, err)
 	}
 	if pkg.Version == "" {
 		return "", fmt.Errorf("no version field in %s", path)
 	}
 	return pkg.Version, nil
 }
 // WriteVersion replaces the version field in a package.json file in-place.
 // oldVersion must match what ReadVersion returned. Formatting is preserved.
 func WriteVersion(path, oldVersion, newVersion string) error {
 	data, err := os.ReadFile(path)
 	if err != nil {
 		return fmt.Errorf("read %s: %w", path, err)
 	}
 	old := `"version": "` + oldVersion + `"`
 	repl := `"version": "` + newVersion + `"`
 	if !strings.Contains(string(data), old) {
 		return fmt.Errorf("version %q not found in %s", oldVersion, path)
 	}
 	updated := strings.Replace(string(data), old, repl, 1)
 	return os.WriteFile(path, []byte(updated), 0644)
 }
@@ -0,0 +1,114 @@
 package node
 import (
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"
 )
 func writeJSON(t *testing.T, content string) string {
 	t.Helper()
 	path := filepath.Join(t.TempDir(), "package.json")
 	if err := os.WriteFile(path, []byte(content), 0644); err != nil {
 		t.Fatal(err)
 	}
 	return path
 }
 const simplePackage = `{
  "name": "my-app",
  "version": "1.2.3",
  "description": "test"
 }`
 func TestReadVersion(t *testing.T) {
 	got, err := ReadVersion(writeJSON(t, simplePackage))
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if got != "1.2.3" {
 		t.Errorf("got %q, want 1.2.3", got)
 	}
 }
 func TestReadVersionMissingFile(t *testing.T) {
 	_, err := ReadVersion(filepath.Join(t.TempDir(), "package.json"))
 	if err == nil {
 		t.Error("expected error for missing file")
 	}
 }
 func TestReadVersionInvalidJSON(t *testing.T) {
 	_, err := ReadVersion(writeJSON(t, `{not valid json`))
 	if err == nil {
 		t.Error("expected error for invalid JSON")
 	}
 }
 func TestReadVersionNoVersionField(t *testing.T) {
 	_, err := ReadVersion(writeJSON(t, `{"name":"app"}`))
 	if err == nil {
 		t.Error("expected error when version field is absent")
 	}
 }
 func TestWriteVersion(t *testing.T) {
 	path := writeJSON(t, simplePackage)
 	if err := WriteVersion(path, "1.2.3", "1.2.4"); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	data, _ := os.ReadFile(path)
 	if !strings.Contains(string(data), `"version": "1.2.4"`) {
 		t.Errorf("expected updated version in file; got:\n%s", data)
 	}
 	// name and description must be preserved
 	if !strings.Contains(string(data), `"name": "my-app"`) {
 		t.Error("name field was lost")
 	}
 }
 func TestWriteVersionMissingFile(t *testing.T) {
 	err := WriteVersion(filepath.Join(t.TempDir(), "package.json"), "1.0.0", "1.0.1")
 	if err == nil {
 		t.Error("expected error for missing file")
 	}
 }
 func TestWriteVersionNotFound(t *testing.T) {
 	err := WriteVersion(writeJSON(t, simplePackage), "9.9.9", "9.9.10")
 	if err == nil {
 		t.Error("expected error when old version not found")
 	}
 }
 // FuzzWriteVersion verifies WriteVersion never panics on arbitrary content or version strings.
 func FuzzWriteVersion(f *testing.F) {
 	f.Add(simplePackage, "1.2.3", "1.2.4")
 	f.Add(`{"version":"0.0.1"}`, "0.0.1", "0.0.2")
 	f.Add(`{}`, "1.0.0", "1.0.1")
 	f.Add("", "1.0.0", "1.0.1")
 	f.Add(`{"name":"app","version":"1.0.0","version":"dup"}`, "1.0.0", "1.0.1")
 	f.Fuzz(func(t *testing.T, content, oldVersion, newVersion string) {
 		path := filepath.Join(t.TempDir(), "package.json")
 		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
 		WriteVersion(path, oldVersion, newVersion) //nolint:errcheck
 	})
 }
 // FuzzReadVersion verifies ReadVersion never panics on arbitrary content.
 func FuzzReadVersion(f *testing.F) {
 	f.Add(simplePackage)
 	f.Add(`{}`)
 	f.Add(`{"version":"1.0.0"}`)
 	f.Add(`not json at all`)
 	f.Add(``)
 	f.Add("\x00\xff")
 	f.Fuzz(func(t *testing.T, content string) {
 		path := filepath.Join(t.TempDir(), "package.json")
 		os.WriteFile(path, []byte(content), 0644) //nolint:errcheck
 		ReadVersion(path)                          //nolint:errcheck
 	})
 }
@@ -6,18 +6,38 @@ import (
 	"git.k3nny.fr/releaser/internal/commits"
 )
 // BumpLevel controls which version component is incremented.
 type BumpLevel int
 const (
 	BumpPatch BumpLevel = iota
 	BumpMinor
 )
 // Next computes the next version string (without tag prefix, e.g. "1.2.4").
 // currentPatch is -1 when no tag exists yet (first release will be X.Y.0).
 // releasable is the set of commit types that trigger a bump; nil defaults to all three.
 // bumpRules maps each type to its bump level; nil defaults to BumpPatch for all.
 // Returns ("", false) when there are no releasable commits.
-func Next(major, minor, currentPatch int, types []commits.Type, releasable map[commits.Type]bool) (string, bool) {
+func Next(major, minor, currentPatch int, types []commits.Type, releasable map[commits.Type]bool, bumpRules map[commits.Type]BumpLevel) (string, bool) {
 	if releasable == nil {
 		releasable = commits.ReleasableSet(nil)
 	}
 	found := false
 	useMinor := false
 	for _, t := range types {
 		if releasable[t] {
-			return fmt.Sprintf("%d.%d.%d", major, minor, currentPatch+1), true
+			found = true
 			if bumpRules[t] == BumpMinor {
 				useMinor = true
 			}
 		}
 	}
 	if !found {
 		return "", false
 	}
 	if useMinor {
 		return fmt.Sprintf("%d.%d.0", major, minor+1), true
 	}
 	return fmt.Sprintf("%d.%d.%d", major, minor, currentPatch+1), true
 }
@@ -30,7 +30,7 @@ func TestNext(t *testing.T) {
 			wantOk: true,
 		},
 		{
-			desc:         "breaking change still bumps patch on release branch",
+			desc:         "breaking change still bumps patch by default",
 			major:        2, minor: 0, currentPatch: 1,
 			types:  []commits.Type{commits.TypeBreaking},
 			want:   "2.0.2",
@@ -61,7 +61,7 @@ func TestNext(t *testing.T) {
 	for _, c := range cases {
 		t.Run(c.desc, func(t *testing.T) {
-			got, ok := Next(c.major, c.minor, c.currentPatch, c.types, nil)
+			got, ok := Next(c.major, c.minor, c.currentPatch, c.types, nil, nil)
 			if ok != c.wantOk {
 				t.Errorf("ok=%v, want %v", ok, c.wantOk)
 			}
@@ -71,3 +71,73 @@ func TestNext(t *testing.T) {
 		})
 	}
 }
 func TestNextMinorBump(t *testing.T) {
 	rules := map[commits.Type]BumpLevel{
 		commits.TypeBreaking: BumpMinor,
 	}
 	cases := []struct {
 		desc         string
 		major, minor int
 		currentPatch int
 		types        []commits.Type
 		want         string
 	}{
 		{
 			desc:         "breaking → minor bump",
 			major:        1, minor: 2, currentPatch: 3,
 			types: []commits.Type{commits.TypeBreaking},
 			want:  "1.3.0",
 		},
 		{
 			desc:         "feat (patch rule) with breaking (minor rule) → minor wins",
 			major:        1, minor: 2, currentPatch: 3,
 			types: []commits.Type{commits.TypeFeat, commits.TypeBreaking},
 			want:  "1.3.0",
 		},
 		{
 			desc:         "fix only — no minor rule → patch bump",
 			major:        1, minor: 2, currentPatch: 3,
 			types: []commits.Type{commits.TypeFix},
 			want:  "1.2.4",
 		},
 		{
 			desc:         "first release with minor bump",
 			major:        2, minor: 0, currentPatch: -1,
 			types: []commits.Type{commits.TypeBreaking},
 			want:  "2.1.0",
 		},
 	}
 	for _, c := range cases {
 		t.Run(c.desc, func(t *testing.T) {
 			got, ok := Next(c.major, c.minor, c.currentPatch, c.types, nil, rules)
 			if !ok {
 				t.Fatal("expected ok=true")
 			}
 			if got != c.want {
 				t.Errorf("got %q, want %q", got, c.want)
 			}
 		})
 	}
 }
 func TestNextAllMinorRules(t *testing.T) {
 	rules := map[commits.Type]BumpLevel{
 		commits.TypeBreaking: BumpMinor,
 		commits.TypeFeat:     BumpMinor,
 		commits.TypeFix:      BumpMinor,
 	}
 	got, ok := Next(1, 4, 2, []commits.Type{commits.TypeFix}, nil, rules)
 	if !ok || got != "1.5.0" {
 		t.Errorf("got %q ok=%v, want 1.5.0 true", got, ok)
 	}
 }
 func TestNextNilBumpRulesDefaultsToPatch(t *testing.T) {
 	got, ok := Next(1, 2, 5, []commits.Type{commits.TypeBreaking}, nil, nil)
 	if !ok || got != "1.2.6" {
 		t.Errorf("got %q ok=%v, want 1.2.6 true", got, ok)
 	}
 }
Author	SHA1	Message	Date
k3nny	104167d7d2	docs(releaser): add documentation URL https://releaser.k3nny.fr ci / vet, staticcheck, test, build (push) Successful in 3m12s Details - README.md: add Documentation link below the release badge - ROADMAP.md: update shipped docs-site entry with live URL - docs/hugo.toml: set baseURL to the live site address Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 22:56:39 +02:00
k3nny	88ed87b095	build(ci): release v1.6.2 — staticcheck in task ci, SA4006 fix ci / vet, staticcheck, test, build (push) Successful in 3m5s Details ci / vet, staticcheck, test, build (pull_request) Failing after 12s Details Add go tool staticcheck ./... to the task ci pipeline (between vet and test), consistent with the Gitea CI workflow. Fix the SA4006 it surfaced in TestLatestTagTagsIterFails where err from PlainOpen was assigned but never read before being overwritten. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 21:47:39 +02:00
k3nny	6381a6440b	build(ci): add staticcheck to CI pipeline; fix SA4006 in gitutil test ci / vet, staticcheck, test, build (push) Successful in 3m5s Details Add `go tool staticcheck ./...` between vet and test in the `task ci` pipeline. Fix the SA4006 finding it surfaced: the PlainOpen error in TestLatestTagTagsIterFails was assigned but never read (the nil check was lost when the skip logic was simplified). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 21:45:49 +02:00
k3nny	4f933bf130	fix(ci): release v1.6.1 — skip chmod tests when running as root ci / vet, staticcheck, test, build (push) Failing after 3m0s Details Four tests relied on os.Chmod to force error paths but were failing in Docker CI (golang:1.26-alpine runs as root, where chmod restrictions have no effect). Added os.Getuid() == 0 skip guards to: - internal/gradle: TestWriteVersionReadOnly - internal/gitutil: TestLatestTagTagsIterFails (replaced broken skip logic that only fired if Chmod itself errored) - cmd: TestInitConfigWriteFails, TestRunLatestTagFails Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 21:38:26 +02:00
k3nny	a4cd00cc4d	test(ci): skip chmod-dependent tests when running as root ci / vet, staticcheck, test, build (push) Failing after 2m54s Details Docker CI containers run as root by default (golang:1.26-alpine), where os.Chmod has no effect and permission restrictions don't apply. Four tests were failing because they relied on chmod to force error paths: - gradle: TestWriteVersionReadOnly - cmd: TestInitConfigWriteFails, TestRunLatestTagFails - gitutil: TestLatestTagTagsIterFails (had broken skip logic that only fired if Chmod itself errored, which never happens as root) Replace all four with an upfront os.Getuid() == 0 check so they are skipped cleanly in root environments and still run (and must pass) on non-root local development. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 21:10:41 +02:00
k3nny	dfdf2b019a	feat(gradle): release v1.6.0 — Gradle build file version bump ci / vet, staticcheck, test, build (push) Failing after 3m1s Details release / Build and publish release (push) Successful in 5m1s Details Add internal/gradle package with ReadVersion and WriteVersion for build.gradle (Groovy DSL, single-quoted) and build.gradle.kts (Kotlin DSL, double-quoted). Quote style is preserved on write. regexp.QuoteMeta ensures version strings with dots or special characters are safe. Config follows the established multi-value pattern: - gradle.build_file: single path (opt-in, no default) - gradle.build_files: list for multi-module projects (overrides build_file) - --gradle flag overrides build_file and clears build_files 100% per-package statement coverage maintained across all 13 packages; FuzzReadVersion and FuzzWriteVersion added per fuzzing guidelines. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 17:59:13 +02:00
k3nny	e2d4214405	docs(releaser): release v1.5.1 — documentation site, fuzzing completeness ci / vet, staticcheck, test, build (push) Failing after 3m50s Details - Add Hugo + Geekdoc documentation site (docs/): installation, CLI reference, configuration, CI integration, and changelog pages; explicit menu bundle nav so all pages appear in the sidebar on every page - Add Gitea CI workflow (.gitea/workflows/docs.yml): builds on push to main when docs/** changes, deploys minified site to gh-pages branch - Add docs:setup / docs:serve / docs:build Taskfile tasks; theme bundle downloaded at build time (not committed) - Add FuzzUpdate to internal/changelog and FuzzWriteVersion to internal/node to complete fuzz coverage for all file-rewriting packages - Add fuzzing completeness guidelines to CLAUDE.md: authoritative table, exempt-package rationale, seed corpus rules Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 17:47:26 +02:00
k3nny	f07220b0c6	feat(releaser): release v1.5.0 — Node.js, multi-module Maven, configurable bump rules ci / vet, staticcheck, test, build (push) Failing after 4m11s Details release / Build and publish release (push) Successful in 5m7s Details - Add internal/node package: reads/writes package.json version (single or multi-path via node.package_json / node.package_jsons) - Add maven.pom_paths support: update multiple pom.xml files in one release commit; pom_paths overrides pom_path; --pom flag clears pom_paths - Add git.bump_rules config: per-type control of which version component bumps (breaking/feat/fix accept "patch" or "minor"); wired through version.Next() as a new sixth parameter - Extract injectable function vars (absPath, gitAllCommits, gitCommitsSince, gitCommitFiles) to enable error-path testing without interfaces - Achieve 100% per-package statement coverage across all 12 packages Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-11 16:59:28 +02:00