From e19ebc3270f3e563e206e474c9e0cff3c7dcd742 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 16:52:29 -0700
Subject: [PATCH 01/16] fix: properly ignore workspace paths from root during
 ci (#209)

---
 lib/content/_on-ci.yml                                | 4 ++--
 tap-snapshots/test/apply/source-snapshots.js.test.cjs | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/content/_on-ci.yml b/lib/content/_on-ci.yml
index 1352a8b1..151b31ba 100644
--- a/lib/content/_on-ci.yml
+++ b/lib/content/_on-ci.yml
@@ -6,7 +6,7 @@ pull_request:
   {{/if}}
   {{#if isRootMono}}
   paths-ignore:
-    {{#each workspaceGlob}}
+    {{#each workspaceGlobs}}
     - {{ . }}
     {{/each}}
   {{/if}}
@@ -21,7 +21,7 @@ push:
   {{/if}}
   {{#if isRootMono}}
   paths-ignore:
-    {{#each workspaceGlob}}
+    {{#each workspaceGlobs}}
     - {{ . }}
     {{/each}}
   {{/if}}
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 2f578df1..6f4b7228 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -1665,11 +1665,15 @@ on:
   workflow_dispatch:
   pull_request:
     paths-ignore:
+      - workspaces/a/**
+      - workspaces/b/**
   push:
     branches:
       - main
       - latest
     paths-ignore:
+      - workspaces/a/**
+      - workspaces/b/**
   schedule:
     # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
     - cron: "0 9 * * 1"

From 2fdcddd615066178cd1e84e2cd2144e9b4c566ef Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 16:53:55 -0700
Subject: [PATCH 02/16] feat: make template-oss postinstall commit a breaking
 change for majors (#180)

When we ship things like `engines` changes we will release a semver
major update to template-oss, and the resulting dependabot PRs will get
a `feat!` commit to indicate that they will all need major releases as
well. This doesn't assume anything about the contents of the breaking
change, but will instead set the correct conventional commit type and
fail the PR so that it can be followed up manually.
---
 .github/workflows/post-dependabot.yml         |   35 +-
 lib/content/post-dependabot.yml               |   38 +-
 .../test/apply/full-content.js.test.cjs       | 2579 +++++++++++++++++
 .../test/apply/source-snapshots.js.test.cjs   |  105 +-
 4 files changed, 2736 insertions(+), 21 deletions(-)
 create mode 100644 tap-snapshots/test/apply/full-content.js.test.cjs

diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index 98acf69c..86f83ec4 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -60,6 +60,15 @@ jobs:
           if [[ `git status --porcelain` ]]; then
             echo "::set-output name=changes::true"
           fi
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # this PR check will fail and the commit will be amended with stafftools
+          if [[ "${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            prefix='feat!'
+          else
+            prefix='chore!'
+          fi
+          echo "::set-output name=message::$prefix: postinstall for dependabot template-oss PR"
 
       # This step will fail if template-oss has made any workflow updates. It is impossible
       # for a workflow to update other workflows. In the case it does fail, we continue
@@ -71,21 +80,39 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "${{ steps.apply.outputs.message }}"
           git push
 
-      - name: Push All Changes Except Workflows
-        if: steps.push.outcome == 'failure'
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git reset HEAD~
           git checkout HEAD -- .github/workflows/
           git clean -fd .github/workflows/
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "${{ steps.apply.outputs.message }}"
           git push
 
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run `lint` and `postlint` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
       - name: Check Changes
         if: steps.apply.outputs.changes
         run: |
           npm exec --offline ${{ steps.flags.outputs.workspace }} -- template-oss-check
+
+      - name: Fail on Breaking Change
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        run: |
+          echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
+          echo "for more information on how to fix this with a BREAKING CHANGE footer."
+          exit 1
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index 52506961..53f66f78 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -39,6 +39,15 @@ jobs:
           if [[ `git status --porcelain` ]]; then
             echo "::set-output name=changes::true"
           fi
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # this PR check will fail and the commit will be amended with stafftools
+          if [[ "$\{{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            prefix='feat!'
+          else
+            prefix='chore!'
+          fi
+          echo "::set-output name=message::$prefix: postinstall for dependabot template-oss PR"
 
       # This step will fail if template-oss has made any workflow updates. It is impossible
       # for a workflow to update other workflows. In the case it does fail, we continue
@@ -50,21 +59,40 @@ jobs:
         env:
           GITHUB_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
         run: |
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "$\{{ steps.apply.outputs.message }}"
           git push
-
-      - name: Push All Changes Except Workflows
-        if: steps.push.outcome == 'failure'
+      
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
         run: |
           git reset HEAD~
           git checkout HEAD -- .github/workflows/
           git clean -fd .github/workflows/
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "$\{{ steps.apply.outputs.message }}"
           git push
 
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run `lint` and `postlint` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
       - name: Check Changes
         if: steps.apply.outputs.changes
         run: |
           {{ rootNpmPath }} exec --offline $\{{ steps.flags.outputs.workspace }} -- template-oss-check
+
+      - name: Fail on Breaking Change
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        run: |
+          echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
+          echo "for more information on how to fix this with a BREAKING CHANGE footer."
+          exit 1
+          
diff --git a/tap-snapshots/test/apply/full-content.js.test.cjs b/tap-snapshots/test/apply/full-content.js.test.cjs
new file mode 100644
index 00000000..1e9b84aa
--- /dev/null
+++ b/tap-snapshots/test/apply/full-content.js.test.cjs
@@ -0,0 +1,2579 @@
+/* IMPORTANT
+ * This snapshot file is auto-generated, but designed for humans.
+ * It should be checked into source control and tracked carefully.
+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
+ * Make sure to inspect the output below.  Do not ignore changes!
+ */
+'use strict'
+exports[`test/apply/full-content.js TAP default > expect resolving Promise 1`] = `
+.commitlintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'type-enum': [2, 'always', ['feat', 'fix', 'docs', 'deps', 'chore']],
+    'header-max-length': [2, 'always', 80],
+    'subject-case': [0, 'always', ['lower-case', 'sentence-case', 'start-case']],
+  },
+}
+
+.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+.github/CODEOWNERS
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+* @npm/cli-team
+
+.github/ISSUE_TEMPLATE/bug.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Bug
+description: File a bug/issue
+title: "[BUG] <title>"
+labels: [ Bug, Needs Triage ]
+
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please [search here](./issues) to see if an issue already exists for your problem.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Current Behavior
+      description: A clear & concise description of what you're experiencing.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: A clear & concise description of what you expected to happen.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Steps To Reproduce
+      description: Steps to reproduce the behavior.
+      value: |
+        1. In this environment...
+        2. With this config...
+        3. Run '...'
+        4. See error...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        examples:
+          - **npm**: 7.6.3
+          - **Node**: 13.14.0
+          - **OS**: Ubuntu 20.04
+          - **platform**: Macbook Pro
+      value: |
+        - npm:
+        - Node:
+        - OS:
+        - platform:
+    validations:
+      required: false
+
+.github/ISSUE_TEMPLATE/config.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+blank_issues_enabled: true
+
+.github/dependabot.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: daily
+    allow:
+      - dependency-type: direct
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: deps
+      prefix-development: chore
+    labels:
+      - "Dependencies"
+
+.github/matchers/tap.json
+========================================
+{
+  "//@npmcli/template-oss": "This file is automatically added by @npmcli/template-oss. Do not edit.",
+  "problemMatcher": [
+    {
+      "owner": "tap",
+      "pattern": [
+        {
+          "regexp": "^/s*not ok /d+ - (.*)",
+          "message": 1
+        },
+        {
+          "regexp": "^/s*---"
+        },
+        {
+          "regexp": "^/s*at:"
+        },
+        {
+          "regexp": "^/s*line:/s*(/d+)",
+          "line": 1
+        },
+        {
+          "regexp": "^/s*column:/s*(/d+)",
+          "column": 1
+        },
+        {
+          "regexp": "^/s*file:/s*(.*)",
+          "file": 1
+        }
+      ]
+    }
+  ]
+}
+
+.github/workflows/audit.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Audit
+
+on:
+  workflow_dispatch:
+  schedule:
+    # "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
+    - cron: "0 8 * * 1"
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund --package-lock
+      - run: npm audit
+
+.github/workflows/ci.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+  push:
+    branches:
+      - main
+      - latest
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts
+
+.github/workflows/codeql-analysis.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+      - main
+      - latest
+  schedule:
+    # "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
+    - cron: "0 10 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: \${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
+
+.github/workflows/post-dependabot.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Post Dependabot Actions
+
+on: pull_request
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: write
+
+jobs:
+  template-oss-apply:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ github.event.pull_request.head_ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: "\${{ secrets.GITHUB_TOKEN }}"
+
+      # A new version of template-oss will always have changes
+      # so we dont need to check the git status here
+      - name: Apply changes
+        if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
+        id: apply
+        run: |
+          npx --offline template-oss-apply --force
+          echo "::set-output name=changes::true"
+
+      # If we are updating to a semver major version, then we should treat the result
+      # of template-oss-apply as a breaking change
+      - name: Set commit prefix
+        id: commit
+        if: steps.apply.outputs.changes
+        run: |
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # the commit should be \`--amend\`-ed manually with stafftools.
+          if [[ "\${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            echo "::set-output name=prefix::feat!"
+          else
+            echo "::set-output name=prefix::chore"
+          fi
+
+      # This step will fail if template-oss has made any workflow updates. It is impossible
+      # for a workflow to update other workflows. In this case it does fail, we continue
+      # and try to apply only a portion of the changes
+      - name: Commit and push all changes
+        if: steps.apply.outputs.changes
+        id: push
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git commit -am "\${{ steps.commit.outputs.prefix }}: postinstall for dependabot template-oss PR"
+          git push
+
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git reset HEAD~
+          git clean -fd .github/workflows/
+          git commit -am "\${{ steps.commit.outputs.prefix }}: postinstall for dependabot template-oss PR"
+          git push
+
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run \`lint\` and \`postlint\` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
+      - name: Check for changes
+        if: steps.apply.outputs.changes
+        run: npx --offline template-oss-check
+
+.github/workflows/pull-request.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Pull Request Linting
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+jobs:
+  check:
+    name: Check PR Title or Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Check commits or PR title
+        env:
+          PR_TITLE: \${{ github.event.pull_request.title }}
+        run: |
+          npx --offline commitlint -V --from origin/main --to \${{ github.event.pull_request.head.sha }} /
+            || echo $PR_TITLE | npx --offline commitlint -V
+
+.github/workflows/release-please.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      pr: \${{ steps.release.outputs.pr }}
+      release: \${{ steps.release.outputs.release }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Release Please
+        id: release
+        run: npx --offline template-oss-release-please
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+
+  post-pr:
+    needs: release-please
+    if: needs.release-please.outputs.pr
+    runs-on: ubuntu-latest
+    outputs:
+      ref: \${{ steps.ref.outputs.branch }}
+    steps:
+      - name: Output ref
+        id: ref
+        run: echo "::set-output name=branch::\${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}"
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ steps.ref.outputs.branch }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post pull request actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-pull-request --ignore-scripts --if-present -ws -iwr
+          git commit -am "chore: post pull request" || true
+          git push
+
+  release-test:
+    needs: post-pr
+    if: needs.post-pr.outputs.ref
+    uses: ./.github/workflows/release-test.yml
+    with:
+      ref: \${{ needs.post-pr.outputs.ref }}
+
+  post-release:
+    needs: release-please
+    if: needs.release-please.outputs.release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post release actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-release --ignore-scripts --if-present -ws -iwr
+
+.github/workflows/release-test.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
+jobs:
+  lint-all:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint --if-present --workspaces --include-workspace-root
+
+  test-all:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm run test --if-present --workspaces --include-workspace-root
+
+.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.commitlintrc.js
+!/.eslintrc.js
+!/.github/
+!/.gitignore
+!/.npmrc
+!/.release-please-manifest.json
+!/CODE_OF_CONDUCT.md
+!/SECURITY.md
+!/bin/
+!/lib/
+!/package.json
+!/release-please-config.json
+
+.npmrc
+========================================
+; This file is automatically added by @npmcli/template-oss. Do not edit.
+
+package-lock=false
+
+.release-please-manifest.json
+========================================
+{
+  ".": "1.0.0"
+}
+
+CODE_OF_CONDUCT.md
+========================================
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+All interactions in this repo are covered by the [npm Code of
+Conduct](https://docs.npmjs.com/policies/conduct)
+
+The npm cli team may, at its own discretion, moderate, remove, or edit
+any interactions such as pull requests, issues, and comments.
+
+SECURITY.md
+========================================
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+Please send vulnerability reports through [hackerone](https://hackerone.com/github).
+
+package.json
+========================================
+{
+  "name": "testpkg",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+
+release-please-config.json
+========================================
+{
+  "exclude-packages-from-root": true,
+  "group-pull-request-title-pattern": "chore: release \${version}",
+  "pull-request-title-pattern": "chore: release\${component} \${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features",
+      "hidden": false
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes",
+      "hidden": false
+    },
+    {
+      "type": "docs",
+      "section": "Documentation",
+      "hidden": false
+    },
+    {
+      "type": "deps",
+      "section": "Dependencies",
+      "hidden": false
+    },
+    {
+      "type": "chore",
+      "hidden": true
+    }
+  ],
+  "packages": {
+    ".": {
+      "package-name": ""
+    }
+  }
+}
+`
+
+exports[`test/apply/full-content.js TAP workspaces + everything > expect resolving Promise 1`] = `
+.commitlintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'type-enum': [2, 'always', ['feat', 'fix', 'docs', 'deps', 'chore']],
+    'header-max-length': [2, 'always', 80],
+    'subject-case': [0, 'always', ['lower-case', 'sentence-case', 'start-case']],
+  },
+}
+
+.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+.eslintrc.local.yml
+========================================
+KEEP
+
+.github/CODEOWNERS
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+* @npm/cli-team
+
+.github/ISSUE_TEMPLATE/bug.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Bug
+description: File a bug/issue
+title: "[BUG] <title>"
+labels: [ Bug, Needs Triage ]
+
+body:
+  - type: checkboxes
+    attributes:
+      label: Is there an existing issue for this?
+      description: Please [search here](./issues) to see if an issue already exists for your problem.
+      options:
+        - label: I have searched the existing issues
+          required: true
+  - type: textarea
+    attributes:
+      label: Current Behavior
+      description: A clear & concise description of what you're experiencing.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: A clear & concise description of what you expected to happen.
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Steps To Reproduce
+      description: Steps to reproduce the behavior.
+      value: |
+        1. In this environment...
+        2. With this config...
+        3. Run '...'
+        4. See error...
+    validations:
+      required: false
+  - type: textarea
+    attributes:
+      label: Environment
+      description: |
+        examples:
+          - **npm**: 7.6.3
+          - **Node**: 13.14.0
+          - **OS**: Ubuntu 20.04
+          - **platform**: Macbook Pro
+      value: |
+        - npm:
+        - Node:
+        - OS:
+        - platform:
+    validations:
+      required: false
+
+.github/ISSUE_TEMPLATE/config.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+blank_issues_enabled: true
+
+.github/dependabot.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+version: 2
+
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: daily
+    allow:
+      - dependency-type: direct
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: deps
+      prefix-development: chore
+    labels:
+      - "Dependencies"
+
+.github/matchers/tap.json
+========================================
+{
+  "//@npmcli/template-oss": "This file is automatically added by @npmcli/template-oss. Do not edit.",
+  "problemMatcher": [
+    {
+      "owner": "tap",
+      "pattern": [
+        {
+          "regexp": "^/s*not ok /d+ - (.*)",
+          "message": 1
+        },
+        {
+          "regexp": "^/s*---"
+        },
+        {
+          "regexp": "^/s*at:"
+        },
+        {
+          "regexp": "^/s*line:/s*(/d+)",
+          "line": 1
+        },
+        {
+          "regexp": "^/s*column:/s*(/d+)",
+          "column": 1
+        },
+        {
+          "regexp": "^/s*file:/s*(.*)",
+          "file": 1
+        }
+      ]
+    }
+  ]
+}
+
+.github/workflows/audit.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Audit
+
+on:
+  workflow_dispatch:
+  schedule:
+    # "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
+    - cron: "0 8 * * 1"
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund --package-lock
+      - run: npm audit
+
+.github/workflows/ci-bbb.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - bbb
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - workspaces/b/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - workspaces/b/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint -w bbb
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts -w bbb
+
+.github/workflows/ci-name-aaaa.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - @name/aaaa
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - workspaces/a/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - workspaces/a/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint -w @name/aaaa
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts -w @name/aaaa
+
+.github/workflows/ci.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+  push:
+    branches:
+      - main
+      - latest
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts
+
+.github/workflows/codeql-analysis.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+      - main
+      - latest
+  schedule:
+    # "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
+    - cron: "0 10 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: \${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
+
+.github/workflows/post-dependabot.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Post Dependabot Actions
+
+on: pull_request
+
+# https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
+permissions:
+  contents: write
+
+jobs:
+  template-oss-apply:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ github.event.pull_request.head_ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@v1
+        with:
+          github-token: "\${{ secrets.GITHUB_TOKEN }}"
+
+      # A new version of template-oss will always have changes
+      # so we dont need to check the git status here
+      - name: Apply changes
+        if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
+        id: apply
+        run: |
+          npx --offline template-oss-apply --force
+          echo "::set-output name=changes::true"
+
+      # If we are updating to a semver major version, then we should treat the result
+      # of template-oss-apply as a breaking change
+      - name: Set commit prefix
+        id: commit
+        if: steps.apply.outputs.changes
+        run: |
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # the commit should be \`--amend\`-ed manually with stafftools.
+          if [[ "\${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            echo "::set-output name=prefix::feat!"
+          else
+            echo "::set-output name=prefix::chore"
+          fi
+
+      # This step will fail if template-oss has made any workflow updates. It is impossible
+      # for a workflow to update other workflows. In this case it does fail, we continue
+      # and try to apply only a portion of the changes
+      - name: Commit and push all changes
+        if: steps.apply.outputs.changes
+        id: push
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git commit -am "\${{ steps.commit.outputs.prefix }}: postinstall for dependabot template-oss PR"
+          git push
+
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git reset HEAD~
+          git clean -fd .github/workflows/
+          git commit -am "\${{ steps.commit.outputs.prefix }}: postinstall for dependabot template-oss PR"
+          git push
+
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run \`lint\` and \`postlint\` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
+      - name: Check for changes
+        if: steps.apply.outputs.changes
+        run: npx --offline template-oss-check
+
+.github/workflows/pull-request.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Pull Request Linting
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+jobs:
+  check:
+    name: Check PR Title or Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Check commits or PR title
+        env:
+          PR_TITLE: \${{ github.event.pull_request.title }}
+        run: |
+          npx --offline commitlint -V --from origin/main --to \${{ github.event.pull_request.head.sha }} /
+            || echo $PR_TITLE | npx --offline commitlint -V
+
+.github/workflows/release-please.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      pr: \${{ steps.release.outputs.pr }}
+      release: \${{ steps.release.outputs.release }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Release Please
+        id: release
+        run: npx --offline template-oss-release-please
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+
+  post-pr:
+    needs: release-please
+    if: needs.release-please.outputs.pr
+    runs-on: ubuntu-latest
+    outputs:
+      ref: \${{ steps.ref.outputs.branch }}
+    steps:
+      - name: Output ref
+        id: ref
+        run: echo "::set-output name=branch::\${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}"
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ steps.ref.outputs.branch }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post pull request actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-pull-request --ignore-scripts --if-present -ws -iwr
+          git commit -am "chore: post pull request" || true
+          git push
+
+  release-test:
+    needs: post-pr
+    if: needs.post-pr.outputs.ref
+    uses: ./.github/workflows/release-test.yml
+    with:
+      ref: \${{ needs.post-pr.outputs.ref }}
+
+  post-release:
+    needs: release-please
+    if: needs.release-please.outputs.release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post release actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-release --ignore-scripts --if-present -ws -iwr
+
+.github/workflows/release-test.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
+jobs:
+  lint-all:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint --if-present --workspaces --include-workspace-root
+
+  test-all:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm run test --if-present --workspaces --include-workspace-root
+
+.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.commitlintrc.js
+!/.eslintrc.js
+!/.github/
+!/.gitignore
+!/.npmrc
+!/.release-please-manifest.json
+!/CODE_OF_CONDUCT.md
+!/SECURITY.md
+!/bin/
+!/lib/
+!/package.json
+!/release-please-config.json
+!/workspaces/
+
+.npmrc
+========================================
+; This file is automatically added by @npmcli/template-oss. Do not edit.
+
+package-lock=false
+
+.release-please-manifest.json
+========================================
+{
+  ".": "1.0.0",
+  "workspaces/a": "1.0.0",
+  "workspaces/b": "1.0.0"
+}
+
+CODE_OF_CONDUCT.md
+========================================
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+All interactions in this repo are covered by the [npm Code of
+Conduct](https://docs.npmjs.com/policies/conduct)
+
+The npm cli team may, at its own discretion, moderate, remove, or edit
+any interactions such as pull requests, issues, and comments.
+
+SECURITY.md
+========================================
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+Please send vulnerability reports through [hackerone](https://hackerone.com/github).
+
+package.json
+========================================
+{
+  "name": "testpkg",
+  "version": "1.0.0",
+  "workspaces": [
+    "workspaces/a",
+    "workspaces/b"
+  ],
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+
+release-please-config.json
+========================================
+{
+  "plugins": [
+    "node-workspace",
+    "workspace-deps"
+  ],
+  "exclude-packages-from-root": true,
+  "group-pull-request-title-pattern": "chore: release \${version}",
+  "pull-request-title-pattern": "chore: release\${component} \${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features",
+      "hidden": false
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes",
+      "hidden": false
+    },
+    {
+      "type": "docs",
+      "section": "Documentation",
+      "hidden": false
+    },
+    {
+      "type": "deps",
+      "section": "Dependencies",
+      "hidden": false
+    },
+    {
+      "type": "chore",
+      "hidden": true
+    }
+  ],
+  "packages": {
+    ".": {
+      "package-name": ""
+    },
+    "workspaces/a": {},
+    "workspaces/b": {}
+  }
+}
+
+workspaces/a/.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+workspaces/a/.eslintrc.local.yml
+========================================
+KEEP
+
+workspaces/a/.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.eslintrc.js
+!/.gitignore
+!/bin/
+!/lib/
+!/package.json
+
+workspaces/a/package.json
+========================================
+{
+  "name": "@name/aaaa",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+
+workspaces/b/.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+workspaces/b/.eslintrc.local.yml
+========================================
+KEEP
+
+workspaces/b/.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.eslintrc.js
+!/.gitignore
+!/bin/
+!/lib/
+!/package.json
+
+workspaces/b/package.json
+========================================
+{
+  "name": "bbb",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+`
+
+exports[`test/apply/full-content.js TAP workspaces only > expect resolving Promise 1`] = `
+.github/matchers/tap.json
+========================================
+{
+  "//@npmcli/template-oss": "This file is automatically added by @npmcli/template-oss. Do not edit.",
+  "problemMatcher": [
+    {
+      "owner": "tap",
+      "pattern": [
+        {
+          "regexp": "^/s*not ok /d+ - (.*)",
+          "message": 1
+        },
+        {
+          "regexp": "^/s*---"
+        },
+        {
+          "regexp": "^/s*at:"
+        },
+        {
+          "regexp": "^/s*line:/s*(/d+)",
+          "line": 1
+        },
+        {
+          "regexp": "^/s*column:/s*(/d+)",
+          "column": 1
+        },
+        {
+          "regexp": "^/s*file:/s*(.*)",
+          "file": 1
+        }
+      ]
+    }
+  ]
+}
+
+.github/workflows/ci-a.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - a
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - workspaces/a/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - workspaces/a/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint -w a
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts -w a
+
+.github/workflows/ci-b.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - b
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - workspaces/b/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - workspaces/b/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint -w b
+
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm test --ignore-scripts -w b
+
+.github/workflows/release-please.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    outputs:
+      pr: \${{ steps.release.outputs.pr }}
+      release: \${{ steps.release.outputs.release }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Release Please
+        id: release
+        run: npx --offline template-oss-release-please
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+
+  post-pr:
+    needs: release-please
+    if: needs.release-please.outputs.pr
+    runs-on: ubuntu-latest
+    outputs:
+      ref: \${{ steps.ref.outputs.branch }}
+    steps:
+      - name: Output ref
+        id: ref
+        run: echo "::set-output name=branch::\${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}"
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ steps.ref.outputs.branch }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post pull request actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-pull-request --ignore-scripts --if-present -ws -iwr
+          git commit -am "chore: post pull request" || true
+          git push
+
+  release-test:
+    needs: post-pr
+    if: needs.post-pr.outputs.ref
+    uses: ./.github/workflows/release-test.yml
+    with:
+      ref: \${{ needs.post-pr.outputs.ref }}
+
+  post-release:
+    needs: release-please
+    if: needs.release-please.outputs.release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: Post release actions
+        env:
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+        run: |
+          npm run rp-release --ignore-scripts --if-present -ws -iwr
+
+.github/workflows/release-test.yml
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release
+
+on:
+  workflow_call:
+    inputs:
+      ref:
+        required: true
+        type: string
+
+jobs:
+  lint-all:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 16.x
+      - name: Update npm to latest
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: npm run lint --if-present --workspaces --include-workspace-root
+
+  test-all:
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 12.13.0
+          - 12.x
+          - 14.15.0
+          - 14.x
+          - 16.0.0
+          - 16.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          ref: \${{ inputs.ref }}
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update to workable npm (windows)
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Update npm to 7
+        # If we do test on npm 10 it needs npm7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Update npm to latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - run: npm -v
+      - run: npm i --ignore-scripts --no-audit --no-fund
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: npm run test --if-present --workspaces --include-workspace-root
+
+.release-please-manifest.json
+========================================
+{
+  "workspaces/a": "1.0.0",
+  "workspaces/b": "1.0.0"
+}
+
+package.json
+========================================
+{
+  "templateOSS": {
+    "rootRepo": false,
+    "rootModule": false,
+    "version": "{{VERSION}}"
+  },
+  "name": "testpkg",
+  "version": "1.0.0",
+  "workspaces": [
+    "workspaces/a",
+    "workspaces/b"
+  ]
+}
+
+release-please-config.json
+========================================
+{
+  "plugins": [
+    "node-workspace",
+    "workspace-deps"
+  ],
+  "exclude-packages-from-root": true,
+  "group-pull-request-title-pattern": "chore: release \${version}",
+  "pull-request-title-pattern": "chore: release\${component} \${version}",
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features",
+      "hidden": false
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes",
+      "hidden": false
+    },
+    {
+      "type": "docs",
+      "section": "Documentation",
+      "hidden": false
+    },
+    {
+      "type": "deps",
+      "section": "Dependencies",
+      "hidden": false
+    },
+    {
+      "type": "chore",
+      "hidden": true
+    }
+  ],
+  "packages": {
+    "workspaces/a": {},
+    "workspaces/b": {}
+  }
+}
+
+workspaces/a/.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+workspaces/a/.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.eslintrc.js
+!/.gitignore
+!/bin/
+!/lib/
+!/package.json
+
+workspaces/a/package.json
+========================================
+{
+  "name": "a",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+
+workspaces/b/.eslintrc.js
+========================================
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
+const { readdirSync: readdir } = require('fs')
+
+const localConfigs = readdir(__dirname)
+  .filter((file) => file.startsWith('.eslintrc.local.'))
+  .map((file) => \`./\${file}\`)
+
+module.exports = {
+  root: true,
+  extends: [
+    '@npmcli',
+    ...localConfigs,
+  ],
+}
+
+workspaces/b/.gitignore
+========================================
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+# ignore everything in the root
+/*
+
+# keep these
+!/.eslintrc.local.*
+!**/.gitignore
+!/docs/
+!/tap-snapshots/
+!/test/
+!/map.js
+!/scripts/
+!/README*
+!/LICENSE*
+!/CHANGELOG*
+!/.eslintrc.js
+!/.gitignore
+!/bin/
+!/lib/
+!/package.json
+
+workspaces/b/package.json
+========================================
+{
+  "name": "b",
+  "version": "1.0.0",
+  "scripts": {
+    "lint": "eslint /"**/*.js/"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "snap": "tap",
+    "test": "tap",
+    "posttest": "npm run lint"
+  },
+  "author": "GitHub Inc.",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "{{VERSION}}"
+  }
+}
+`
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 6f4b7228..844981e5 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -575,6 +575,15 @@ jobs:
           if [[ \`git status --porcelain\` ]]; then
             echo "::set-output name=changes::true"
           fi
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # this PR check will fail and the commit will be amended with stafftools
+          if [[ "\${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            prefix='feat!'
+          else
+            prefix='chore!'
+          fi
+          echo "::set-output name=message::$prefix: postinstall for dependabot template-oss PR"
 
       # This step will fail if template-oss has made any workflow updates. It is impossible
       # for a workflow to update other workflows. In the case it does fail, we continue
@@ -586,25 +595,43 @@ jobs:
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
-      - name: Push All Changes Except Workflows
-        if: steps.push.outcome == 'failure'
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
           git reset HEAD~
           git checkout HEAD -- .github/workflows/
           git clean -fd .github/workflows/
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run \`lint\` and \`postlint\` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
       - name: Check Changes
         if: steps.apply.outputs.changes
         run: |
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
+      - name: Fail on Breaking Change
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        run: |
+          echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
+          echo "for more information on how to fix this with a BREAKING CHANGE footer."
+          exit 1
+
 .github/workflows/pull-request.yml
 ========================================
 # This file is automatically added by @npmcli/template-oss. Do not edit.
@@ -1876,6 +1903,15 @@ jobs:
           if [[ \`git status --porcelain\` ]]; then
             echo "::set-output name=changes::true"
           fi
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # this PR check will fail and the commit will be amended with stafftools
+          if [[ "\${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            prefix='feat!'
+          else
+            prefix='chore!'
+          fi
+          echo "::set-output name=message::$prefix: postinstall for dependabot template-oss PR"
 
       # This step will fail if template-oss has made any workflow updates. It is impossible
       # for a workflow to update other workflows. In the case it does fail, we continue
@@ -1887,25 +1923,43 @@ jobs:
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
-      - name: Push All Changes Except Workflows
-        if: steps.push.outcome == 'failure'
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
           git reset HEAD~
           git checkout HEAD -- .github/workflows/
           git clean -fd .github/workflows/
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run \`lint\` and \`postlint\` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
       - name: Check Changes
         if: steps.apply.outputs.changes
         run: |
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
+      - name: Fail on Breaking Change
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        run: |
+          echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
+          echo "for more information on how to fix this with a BREAKING CHANGE footer."
+          exit 1
+
 .github/workflows/pull-request.yml
 ========================================
 # This file is automatically added by @npmcli/template-oss. Do not edit.
@@ -3022,6 +3076,15 @@ jobs:
           if [[ \`git status --porcelain\` ]]; then
             echo "::set-output name=changes::true"
           fi
+          # This only sets the conventional commit prefix. This workflow can't reliably determine
+          # what the breaking change is though. If a BREAKING CHANGE message is required then
+          # this PR check will fail and the commit will be amended with stafftools
+          if [[ "\${{ steps.dependabot-metadata.outputs.update-type }}" == "version-update:semver-major" ]]; then
+            prefix='feat!'
+          else
+            prefix='chore!'
+          fi
+          echo "::set-output name=message::$prefix: postinstall for dependabot template-oss PR"
 
       # This step will fail if template-oss has made any workflow updates. It is impossible
       # for a workflow to update other workflows. In the case it does fail, we continue
@@ -3033,25 +3096,43 @@ jobs:
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
-      - name: Push All Changes Except Workflows
-        if: steps.push.outcome == 'failure'
+      # If the previous step failed, then reset the commit and remove any workflow changes
+      # and attempt to commit and push again. This is helpful because we will have a commit
+      # with the correct prefix that we can then --amend with @npmcli/stafftools later.
+      - name: Commit and push all changes except workflows
+        if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
         run: |
           git reset HEAD~
           git checkout HEAD -- .github/workflows/
           git clean -fd .github/workflows/
-          git commit -am "chore: postinstall for dependabot template-oss PR"
+          git commit -am "\${{ steps.apply.outputs.message }}"
           git push
 
+      # Check if all the necessary template-oss changes were applied. Since we continued
+      # on errors in one of the previous steps, this check will fail if our follow up
+      # only applied a portion of the changes and we need to followup manually.
+      #
+      # Note that this used to run \`lint\` and \`postlint\` but that will fail this action
+      # if we've also shipped any linting changes separate from template-oss. We do
+      # linting in another action, so we want to fail this one only if there are
+      # template-oss changes that could not be applied.
       - name: Check Changes
         if: steps.apply.outputs.changes
         run: |
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
+      - name: Fail on Breaking Change
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        run: |
+          echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
+          echo "for more information on how to fix this with a BREAKING CHANGE footer."
+          exit 1
+
 .github/workflows/release.yml
 ========================================
 # This file is automatically added by @npmcli/template-oss. Do not edit.

From 99f394564552d43cd97becb5431daef0c3c0e464 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 19:09:56 -0700
Subject: [PATCH 03/16] fix: make tap test-ignore a regex instead of a glob
 (#210)

---
 lib/content/pkg.json                                  | 2 +-
 tap-snapshots/test/apply/source-snapshots.js.test.cjs | 2 +-
 tap-snapshots/test/check/snapshots.js.test.cjs        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/content/pkg.json b/lib/content/pkg.json
index d93cbd80..387626ef 100644
--- a/lib/content/pkg.json
+++ b/lib/content/pkg.json
@@ -33,7 +33,7 @@
   "standard": {{{ del }}},
   "tap": {
     {{#if workspacePaths}}
-    "test-ignore": "^({{ join workspacePaths "|" }})/**",
+    "test-ignore": "^({{ join workspacePaths "|" }})/",
     {{/if}}
     "nyc-arg": [
       {{#each workspaceGlobs}}
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 844981e5..591a76d6 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -2340,7 +2340,7 @@ package.json
     "version": "{{VERSION}}"
   },
   "tap": {
-    "test-ignore": "^(workspaces/a|workspaces/b)/**",
+    "test-ignore": "^(workspaces/a|workspaces/b)/",
     "nyc-arg": [
       "--exclude",
       "workspaces/a/**",
diff --git a/tap-snapshots/test/check/snapshots.js.test.cjs b/tap-snapshots/test/check/snapshots.js.test.cjs
index 961d7173..af8da9ee 100644
--- a/tap-snapshots/test/check/snapshots.js.test.cjs
+++ b/tap-snapshots/test/check/snapshots.js.test.cjs
@@ -332,7 +332,7 @@ The module file package.json needs to be updated:
     "lint-all": "npm run lint -ws -iwr --if-present"
   }
   "tap" is missing, expected {
-    "test-ignore": "^(workspaces/a|workspaces/b)/**",
+    "test-ignore": "^(workspaces/a|workspaces/b)/",
     "nyc-arg": [
       "--exclude",
       "workspaces/a/**",

From 88f8387ee90d7ee964ad40b4b90570c18b602ce5 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 19:10:11 -0700
Subject: [PATCH 04/16] feat: add a strict engines check to ci (#212)

---
 .github/workflows/ci.yml                      |  50 +++
 lib/content/ci.yml                            |   9 +
 lib/util/template.js                          |   1 +
 .../test/apply/source-snapshots.js.test.cjs   | 300 ++++++++++++++++++
 .../test/check/diff-snapshots.js.test.cjs     |   2 +-
 5 files changed, 361 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7043ab9e..aadd60a8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,6 +14,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: ${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: ${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: ${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
diff --git a/lib/content/ci.yml b/lib/content/ci.yml
index 0226d0c3..83338a9e 100644
--- a/lib/content/ci.yml
+++ b/lib/content/ci.yml
@@ -4,6 +4,15 @@ on:
   {{> onCi }}
 
 jobs:
+  engines:
+    {{> jobMatrix
+      jobName="Engines"
+      jobDepFlags="--engines-strict"
+      macCI=false
+      windowsCI=false
+      ciVersions=(reject ciVersions '\.x$')
+    }}
+
   lint:
     {{> job jobName="Lint" }}
       {{> stepLint jobRunFlags=pkgFlags }}
diff --git a/lib/util/template.js b/lib/util/template.js
index 20910b79..fa51092d 100644
--- a/lib/util/template.js
+++ b/lib/util/template.js
@@ -14,6 +14,7 @@ const setupHandlebars = (...partialDirs) => {
   Handlebars.registerHelper('obj', ({ hash }) => Object.fromEntries(safeValues(hash)))
   Handlebars.registerHelper('join', (arr, sep) => arr.join(typeof sep === 'string' ? sep : ', '))
   Handlebars.registerHelper('pluck', (arr, key) => arr.map(a => a[key]))
+  Handlebars.registerHelper('reject', (arr, re) => arr.filter(a => !new RegExp(re).test(a)))
   Handlebars.registerHelper('quote', (arr) => arr.map(a => `'${a}'`))
   Handlebars.registerHelper('last', (arr) => arr[arr.length - 1])
   Handlebars.registerHelper('json', (c) => JSON.stringify(c))
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 591a76d6..73741d40 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -378,6 +378,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
@@ -1319,6 +1369,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
@@ -1433,6 +1533,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
@@ -1706,6 +1856,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
@@ -2649,6 +2849,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
@@ -2763,6 +3013,56 @@ on:
     - cron: "0 9 * * 1"
 
 jobs:
+  engines:
+    name: Engines - \${{ matrix.platform.name }} - \${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 14.17.0
+          - 16.13.0
+          - 18.0.0
+    runs-on: \${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: \${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Git User
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Setup Node
+        uses: actions/setup-node@v3
+        with:
+          node-version: \${{ matrix.node-version }}
+      - name: Update Windows npm
+        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
+        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
+        run: |
+          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
+          tar xf npm-7.5.4.tgz
+          cd package
+          node lib/npm.js install --no-fund --no-audit -g ../npm-7.5.4.tgz
+          cd ..
+          rmdir /s /q package
+      - name: Install npm@7
+        if: startsWith(matrix.node-version, '10.')
+        run: npm i --prefer-online --no-fund --no-audit -g npm@7
+      - name: Install npm@latest
+        if: \${{ !startsWith(matrix.node-version, '10.') }}
+        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
+      - name: npm Version
+        run: npm -v
+      - name: Install Dependencies
+        run: npm i --ignore-scripts --no-audit --no-fund --engines-strict
+
   lint:
     name: Lint
     if: github.repository_owner == 'npm'
diff --git a/tap-snapshots/test/check/diff-snapshots.js.test.cjs b/tap-snapshots/test/check/diff-snapshots.js.test.cjs
index 64499514..20d0c502 100644
--- a/tap-snapshots/test/check/diff-snapshots.js.test.cjs
+++ b/tap-snapshots/test/check/diff-snapshots.js.test.cjs
@@ -171,7 +171,7 @@ The repo file ci.yml needs to be updated:
 
   .github/workflows/ci.yml
   ========================================
-  @@ -83,5 +83,25 @@
+  @@ -133,5 +133,25 @@
              node-version: \${{ matrix.node-version }}
          - name: Update Windows npm
            # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows

From d4ddfca7d1c9077dedbf0e751bb133b9c79ed1b6 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 19:48:14 -0700
Subject: [PATCH 05/16] feat: allow extending partials (#213)

---
 lib/util/template.js | 34 ++++++++++++++++++----------------
 test/apply/index.js  |  3 +++
 2 files changed, 21 insertions(+), 16 deletions(-)

diff --git a/lib/util/template.js b/lib/util/template.js
index fa51092d..aa882d4f 100644
--- a/lib/util/template.js
+++ b/lib/util/template.js
@@ -10,7 +10,21 @@ const partialName = (s) => basename(s, extname(s)) // remove extension
   .replace(/^_/, '') // remove leading underscore
   .replace(/-([a-z])/g, (_, g) => g.toUpperCase()) // camelcase
 
-const setupHandlebars = (...partialDirs) => {
+const makePartials = (dir, setDefault) => {
+  const partials = fs.readdirSync(dir).reduce((acc, f) => {
+    const partial = fs.readFileSync(join(dir, f)).toString()
+    const name = partialName(f)
+    acc[name] = partial
+    if (setDefault && f.startsWith('_')) {
+      acc[partialName(`default-${name}`)] = partial
+    }
+    return acc
+  }, {})
+
+  Handlebars.registerPartial(partials)
+}
+
+const setupHandlebars = (baseDir, ...otherDirs) => {
   Handlebars.registerHelper('obj', ({ hash }) => Object.fromEntries(safeValues(hash)))
   Handlebars.registerHelper('join', (arr, sep) => arr.join(typeof sep === 'string' ? sep : ', '))
   Handlebars.registerHelper('pluck', (arr, key) => arr.map(a => a[key]))
@@ -20,21 +34,9 @@ const setupHandlebars = (...partialDirs) => {
   Handlebars.registerHelper('json', (c) => JSON.stringify(c))
   Handlebars.registerHelper('del', () => JSON.stringify(DELETE))
 
-  // Load all files as camelcase partial names.
-  // all other content dirs only get special underscore leading
-  // files as partials. this prevents recursion loops when overwriting
-  // a filename to use as a enw file
-  let isBase = true
-  for (const dir of partialDirs) {
-    for (const f of fs.readdirSync(dir)) {
-      if (f.startsWith('_') || isBase) {
-        Handlebars.registerPartial(
-          partialName(f),
-          fs.readFileSync(join(dir, f)).toString()
-        )
-      }
-    }
-    isBase = false
+  makePartials(baseDir, true)
+  for (const dir of otherDirs) {
+    makePartials(dir)
   }
 }
 
diff --git a/test/apply/index.js b/test/apply/index.js
index e7c24ec0..3ecc7e9a 100644
--- a/test/apply/index.js
+++ b/test/apply/index.js
@@ -220,13 +220,16 @@ t.test('content can override partials', async (t) => {
     testdir: {
       content_dir: {
         '_step-deps.yml': '- run: INSTALL\n',
+        '_step-test.yml': '- run: TEST\n{{> defaultStepTest }}\n',
       },
     },
   })
   await s.apply()
   const ci = await s.readFile(join('.github', 'workflows', 'ci.yml'))
   t.ok(ci.includes('- run: INSTALL'))
+  t.ok(ci.includes('- run: TEST'))
   t.notOk(ci.includes('npm i --ignore-scripts --no-audit --no-fund'))
+  t.ok(ci.includes('npm test --ignore-scripts'))
 })
 
 t.test('content can extend files', async (t) => {

From 0e952980f78b72097123b157cb220bd6c44b5199 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 20:20:42 -0700
Subject: [PATCH 06/16] fix: properly quote strings with exclamation marks
 (#214)

---
 .github/workflows/post-dependabot.yml                 | 2 +-
 lib/content/post-dependabot.yml                       | 2 +-
 tap-snapshots/test/apply/source-snapshots.js.test.cjs | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index 86f83ec4..7bb2efc9 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -111,7 +111,7 @@ jobs:
           npm exec --offline ${{ steps.flags.outputs.workspace }} -- template-oss-check
 
       - name: Fail on Breaking Change
-        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!')
         run: |
           echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
           echo "for more information on how to fix this with a BREAKING CHANGE footer."
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index 53f66f78..ea71ec07 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -90,7 +90,7 @@ jobs:
           {{ rootNpmPath }} exec --offline $\{{ steps.flags.outputs.workspace }} -- template-oss-check
 
       - name: Fail on Breaking Change
-        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!')
         run: |
           echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
           echo "for more information on how to fix this with a BREAKING CHANGE footer."
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 73741d40..53088025 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -676,7 +676,7 @@ jobs:
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
       - name: Fail on Breaking Change
-        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!')
         run: |
           echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
           echo "for more information on how to fix this with a BREAKING CHANGE footer."
@@ -2154,7 +2154,7 @@ jobs:
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
       - name: Fail on Breaking Change
-        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!')
         run: |
           echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
           echo "for more information on how to fix this with a BREAKING CHANGE footer."
@@ -3427,7 +3427,7 @@ jobs:
           npm exec --offline \${{ steps.flags.outputs.workspace }} -- template-oss-check
 
       - name: Fail on Breaking Change
-        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, "feat!")
+        if: steps.apply.outputs.changes && startsWith(steps.apply.outputs.message, 'feat!')
         run: |
           echo "This PR has a breaking change. Run 'npx -p @npmcli/stafftools gh template-oss-fix'"
           echo "for more information on how to fix this with a BREAKING CHANGE footer."

From 132a4661520e86248ea3b57f0369c104a59d0347 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 21 Sep 2022 20:31:08 -0700
Subject: [PATCH 07/16] chore: release 4.4.0 (#211)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 14 ++++++++++++++
 package.json                  |  2 +-
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ba69c9cf..fb1f343c 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.3.2"
+  ".": "4.4.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 30e64ee5..f2f840e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,19 @@
 # Changelog
 
+## [4.4.0](https://github.com/npm/template-oss/compare/v4.3.2...v4.4.0) (2022-09-22)
+
+### Features
+
+* [`d4ddfca`](https://github.com/npm/template-oss/commit/d4ddfca7d1c9077dedbf0e751bb133b9c79ed1b6) [#213](https://github.com/npm/template-oss/pull/213) allow extending partials (#213) (@lukekarrys)
+* [`88f8387`](https://github.com/npm/template-oss/commit/88f8387ee90d7ee964ad40b4b90570c18b602ce5) [#212](https://github.com/npm/template-oss/pull/212) add a strict engines check to ci (#212) (@lukekarrys)
+* [`2fdcddd`](https://github.com/npm/template-oss/commit/2fdcddd615066178cd1e84e2cd2144e9b4c566ef) [#180](https://github.com/npm/template-oss/pull/180) make template-oss postinstall commit a breaking change for majors (#180) (@lukekarrys)
+
+### Bug Fixes
+
+* [`0e95298`](https://github.com/npm/template-oss/commit/0e952980f78b72097123b157cb220bd6c44b5199) [#214](https://github.com/npm/template-oss/pull/214) properly quote strings with exclamation marks (#214) (@lukekarrys)
+* [`99f3945`](https://github.com/npm/template-oss/commit/99f394564552d43cd97becb5431daef0c3c0e464) [#210](https://github.com/npm/template-oss/pull/210) make tap test-ignore a regex instead of a glob (#210) (@lukekarrys)
+* [`e19ebc3`](https://github.com/npm/template-oss/commit/e19ebc3270f3e563e206e474c9e0cff3c7dcd742) [#209](https://github.com/npm/template-oss/pull/209) properly ignore workspace paths from root during ci (#209) (@lukekarrys)
+
 ## [4.3.2](https://github.com/npm/template-oss/compare/v4.3.1...v4.3.2) (2022-09-19)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index af8702f5..b7d8979e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.3.2",
+  "version": "4.4.0",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {

From 1649552c86016ae422407610f9be848b0dfd8bae Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 21 Sep 2022 21:12:34 -0700
Subject: [PATCH 08/16] fix: only extend underscore partial files

---
 lib/util/template.js | 13 ++++++++++---
 test/apply/index.js  |  8 ++++++++
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/lib/util/template.js b/lib/util/template.js
index aa882d4f..e0578b76 100644
--- a/lib/util/template.js
+++ b/lib/util/template.js
@@ -10,14 +10,21 @@ const partialName = (s) => basename(s, extname(s)) // remove extension
   .replace(/^_/, '') // remove leading underscore
   .replace(/-([a-z])/g, (_, g) => g.toUpperCase()) // camelcase
 
-const makePartials = (dir, setDefault) => {
+const makePartials = (dir, isBase) => {
   const partials = fs.readdirSync(dir).reduce((acc, f) => {
     const partial = fs.readFileSync(join(dir, f)).toString()
     const name = partialName(f)
-    acc[name] = partial
-    if (setDefault && f.startsWith('_')) {
+
+    if (isBase) {
+      // in the default dir, everything is a partial
+      // and also gets set with a default prefix for extending
+      acc[name] = partial
       acc[partialName(`default-${name}`)] = partial
+    } else if (f.startsWith('_')) {
+      // otherwise only _ files get set as partials
+      acc[name] = partial
     }
+
     return acc
   }, {})
 
diff --git a/test/apply/index.js b/test/apply/index.js
index 3ecc7e9a..a26ea1bf 100644
--- a/test/apply/index.js
+++ b/test/apply/index.js
@@ -219,6 +219,12 @@ t.test('content can override partials', async (t) => {
     },
     testdir: {
       content_dir: {
+        'index.js': `module.exports={
+          rootRepo:{
+            add:{'.github/workflows/ci-release.yml': 'ci-release.yml'}
+          }
+        }`,
+        'ci-release.yml': '{{> ciRelease }}\n  job: 1',
         '_step-deps.yml': '- run: INSTALL\n',
         '_step-test.yml': '- run: TEST\n{{> defaultStepTest }}\n',
       },
@@ -226,10 +232,12 @@ t.test('content can override partials', async (t) => {
   })
   await s.apply()
   const ci = await s.readFile(join('.github', 'workflows', 'ci.yml'))
+  const release = await s.readFile(join('.github', 'workflows', 'ci-release.yml'))
   t.ok(ci.includes('- run: INSTALL'))
   t.ok(ci.includes('- run: TEST'))
   t.notOk(ci.includes('npm i --ignore-scripts --no-audit --no-fund'))
   t.ok(ci.includes('npm test --ignore-scripts'))
+  t.ok(release.includes('job: 1'))
 })
 
 t.test('content can extend files', async (t) => {

From 2f5786411b9d866e70a2cd683a6fe0c456dbb2e6 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 22 Sep 2022 04:14:43 +0000
Subject: [PATCH 09/16] chore: release 4.4.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 6 ++++++
 package.json                  | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index fb1f343c..f4b3cc51 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.4.0"
+  ".": "4.4.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index f2f840e5..23fd6b76 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [4.4.1](https://github.com/npm/template-oss/compare/v4.4.0...v4.4.1) (2022-09-22)
+
+### Bug Fixes
+
+* [`1649552`](https://github.com/npm/template-oss/commit/1649552c86016ae422407610f9be848b0dfd8bae) only extend underscore partial files (@lukekarrys)
+
 ## [4.4.0](https://github.com/npm/template-oss/compare/v4.3.2...v4.4.0) (2022-09-22)
 
 ### Features
diff --git a/package.json b/package.json
index b7d8979e..d4d22c26 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {

From 53bb928258aa271c65a9b6d77c8e4cf6d60bbebe Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Thu, 22 Sep 2022 17:11:20 -0700
Subject: [PATCH 10/16] deps: @npmcli/release-please@14.2.5

---
 lib/release-please/index.js | 14 +++++++++++++-
 package.json                |  2 +-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/lib/release-please/index.js b/lib/release-please/index.js
index ffc9f908..ba8112fd 100644
--- a/lib/release-please/index.js
+++ b/lib/release-please/index.js
@@ -20,9 +20,21 @@ const main = async ({ repo: fullRepo, token, dryRun, branch }) => {
 
   const [owner, repo] = fullRepo.split('/')
   const github = await RP.GitHub.create({ owner, repo, token })
+
+  // This is mostly for testing and debugging. Use environs with the
+  // format `RELEASE_PLEASE_<manfiestOverrideConfigName>` (eg
+  // `RELEASE_PLEASE_lastReleaseSha=<SHA>`) to set one-off config items
+  // for the release please run without needing to commit and push the config.
+  const manifestOverrides = Object.entries(process.env)
+    .filter(([k, v]) => k.startsWith('RELEASE_PLEASE_') && v != null)
+    .map(([k, v]) => [k.replace('RELEASE_PLEASE_', ''), v])
+
   const manifest = await RP.Manifest.fromManifest(
     github,
-    branch ?? github.repository.defaultBranch
+    branch ?? github.repository.defaultBranch,
+    undefined,
+    undefined,
+    Object.fromEntries(manifestOverrides)
   )
 
   const pullRequests = await (dryRun ? manifest.buildPullRequests() : manifest.createPullRequests())
diff --git a/package.json b/package.json
index d4d22c26..2b48b4dc 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
     "lodash": "^4.17.21",
     "npm-package-arg": "^9.0.1",
     "proc-log": "^2.0.0",
-    "release-please": "npm:@npmcli/release-please@^14.2.4",
+    "release-please": "npm:@npmcli/release-please@^14.2.5",
     "semver": "^7.3.5",
     "yaml": "^2.1.1"
   },

From 8e16dc76d9a469dd9caa73062e0983bef6792c82 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Thu, 22 Sep 2022 14:57:15 -0700
Subject: [PATCH 11/16] fix: remove leading slash from dependabot metadata dir

This is so it work with the workspace flag we call with it
---
 .github/workflows/post-dependabot.yml         |  9 ++++---
 lib/content/post-dependabot.yml               |  9 ++++---
 .../test/apply/source-snapshots.js.test.cjs   | 27 ++++++++++++-------
 3 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index 7bb2efc9..c8688ab2 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -46,10 +46,13 @@ jobs:
         if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
         id: flags
         run: |
-          if [[ "${{ steps.metadata.outputs.directory }}" == "/" ]]; then
+          dependabot_dir="${{ steps.metadata.outputs.directory }}"
+          if [[ "$dependabot_dir" == "/" ]]; then
             echo "::set-output name=workspace::-iwr"
           else
-            echo "::set-output name=workspace::-w ${{ steps.metadata.outputs.directory }}"
+            # strip leading slash from directory so it works as a
+            # a path to the workspace flag
+            echo "::set-output name=workspace::-w ${dependabot_dir#/}"
           fi
 
       - name: Apply Changes
@@ -86,7 +89,7 @@ jobs:
       # If the previous step failed, then reset the commit and remove any workflow changes
       # and attempt to commit and push again. This is helpful because we will have a commit
       # with the correct prefix that we can then --amend with @npmcli/stafftools later.
-      - name: Commit and push all changes except workflows
+      - name: Push All Changes Except Workflows
         if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index ea71ec07..2f2742e6 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -25,10 +25,13 @@ jobs:
         if: contains(steps.metadata.outputs.dependency-names, '{{ __NAME__ }}')
         id: flags
         run: |
-          if [[ "$\{{ steps.metadata.outputs.directory }}" == "/" ]]; then
+          dependabot_dir="$\{{ steps.metadata.outputs.directory }}"
+          if [[ "$dependabot_dir" == "/" ]]; then
             echo "::set-output name=workspace::-iwr"
           else
-            echo "::set-output name=workspace::-w $\{{ steps.metadata.outputs.directory }}"
+            # strip leading slash from directory so it works as a
+            # a path to the workspace flag
+            echo "::set-output name=workspace::-w ${dependabot_dir#/}"
           fi
 
       - name: Apply Changes
@@ -65,7 +68,7 @@ jobs:
       # If the previous step failed, then reset the commit and remove any workflow changes
       # and attempt to commit and push again. This is helpful because we will have a commit
       # with the correct prefix that we can then --amend with @npmcli/stafftools later.
-      - name: Commit and push all changes except workflows
+      - name: Push All Changes Except Workflows
         if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 53088025..99913774 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -611,10 +611,13 @@ jobs:
         if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
         id: flags
         run: |
-          if [[ "\${{ steps.metadata.outputs.directory }}" == "/" ]]; then
+          dependabot_dir="\${{ steps.metadata.outputs.directory }}"
+          if [[ "$dependabot_dir" == "/" ]]; then
             echo "::set-output name=workspace::-iwr"
           else
-            echo "::set-output name=workspace::-w \${{ steps.metadata.outputs.directory }}"
+            # strip leading slash from directory so it works as a
+            # a path to the workspace flag
+            echo "::set-output name=workspace::-w \${dependabot_dir#/}"
           fi
 
       - name: Apply Changes
@@ -651,7 +654,7 @@ jobs:
       # If the previous step failed, then reset the commit and remove any workflow changes
       # and attempt to commit and push again. This is helpful because we will have a commit
       # with the correct prefix that we can then --amend with @npmcli/stafftools later.
-      - name: Commit and push all changes except workflows
+      - name: Push All Changes Except Workflows
         if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
@@ -2089,10 +2092,13 @@ jobs:
         if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
         id: flags
         run: |
-          if [[ "\${{ steps.metadata.outputs.directory }}" == "/" ]]; then
+          dependabot_dir="\${{ steps.metadata.outputs.directory }}"
+          if [[ "$dependabot_dir" == "/" ]]; then
             echo "::set-output name=workspace::-iwr"
           else
-            echo "::set-output name=workspace::-w \${{ steps.metadata.outputs.directory }}"
+            # strip leading slash from directory so it works as a
+            # a path to the workspace flag
+            echo "::set-output name=workspace::-w \${dependabot_dir#/}"
           fi
 
       - name: Apply Changes
@@ -2129,7 +2135,7 @@ jobs:
       # If the previous step failed, then reset the commit and remove any workflow changes
       # and attempt to commit and push again. This is helpful because we will have a commit
       # with the correct prefix that we can then --amend with @npmcli/stafftools later.
-      - name: Commit and push all changes except workflows
+      - name: Push All Changes Except Workflows
         if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
@@ -3362,10 +3368,13 @@ jobs:
         if: contains(steps.metadata.outputs.dependency-names, '@npmcli/template-oss')
         id: flags
         run: |
-          if [[ "\${{ steps.metadata.outputs.directory }}" == "/" ]]; then
+          dependabot_dir="\${{ steps.metadata.outputs.directory }}"
+          if [[ "$dependabot_dir" == "/" ]]; then
             echo "::set-output name=workspace::-iwr"
           else
-            echo "::set-output name=workspace::-w \${{ steps.metadata.outputs.directory }}"
+            # strip leading slash from directory so it works as a
+            # a path to the workspace flag
+            echo "::set-output name=workspace::-w \${dependabot_dir#/}"
           fi
 
       - name: Apply Changes
@@ -3402,7 +3411,7 @@ jobs:
       # If the previous step failed, then reset the commit and remove any workflow changes
       # and attempt to commit and push again. This is helpful because we will have a commit
       # with the correct prefix that we can then --amend with @npmcli/stafftools later.
-      - name: Commit and push all changes except workflows
+      - name: Push All Changes Except Workflows
         if: steps.apply.outputs.changes && steps.push-all.outcome == 'failure'
         env:
           GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}

From fbe3232f4b56a903c6325d1c04c2eb96e6397a96 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 23 Sep 2022 00:12:36 +0000
Subject: [PATCH 12/16] chore: release 4.4.2

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 10 ++++++++++
 package.json                  |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index f4b3cc51..7cb89f2d 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.4.1"
+  ".": "4.4.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23fd6b76..d50e2e0e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## [4.4.2](https://github.com/npm/template-oss/compare/v4.4.1...v4.4.2) (2022-09-23)
+
+### Bug Fixes
+
+* [`8e16dc7`](https://github.com/npm/template-oss/commit/8e16dc76d9a469dd9caa73062e0983bef6792c82) [#216](https://github.com/npm/template-oss/pull/216) remove leading slash from dependabot metadata dir (@lukekarrys)
+
+### Dependencies
+
+* [`53bb928`](https://github.com/npm/template-oss/commit/53bb928258aa271c65a9b6d77c8e4cf6d60bbebe) `@npmcli/release-please@14.2.5`
+
 ## [4.4.1](https://github.com/npm/template-oss/compare/v4.4.0...v4.4.1) (2022-09-22)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index 2b48b4dc..6a53f1cd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.4.1",
+  "version": "4.4.2",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {

From e21239e0dea2dae585102878a4fc13e8ae7cae7a Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 28 Sep 2022 12:44:42 -0700
Subject: [PATCH 13/16] fix: checkout head ref name in post dependabot

---
 .github/workflows/post-dependabot.yml                 | 2 +-
 lib/content/post-dependabot.yml                       | 2 +-
 tap-snapshots/test/apply/source-snapshots.js.test.cjs | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index c8688ab2..88ac4035 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: ${{ github.event.pull_request.head_ref }}
+          ref: ${{ github.event.pull_request.head.ref }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index 2f2742e6..7dba72e6 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -11,7 +11,7 @@ jobs:
     {{> job
       jobName="template-oss"
       jobIf="github.actor == 'dependabot[bot]'"
-      jobCheckout=(obj ref="${{ github.event.pull_request.head_ref }}")
+      jobCheckout=(obj ref="${{ github.event.pull_request.head.ref }}")
     }}
       - name: Fetch Dependabot Metadata
         id: metadata
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 99913774..440120a9 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -584,7 +584,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head_ref }}
+          ref: \${{ github.event.pull_request.head.ref }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
@@ -2065,7 +2065,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head_ref }}
+          ref: \${{ github.event.pull_request.head.ref }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
@@ -3341,7 +3341,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head_ref }}
+          ref: \${{ github.event.pull_request.head.ref }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"

From 84ef8af654d7e66e56a0d0578f4ee997134439c9 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 29 Sep 2022 18:42:53 +0000
Subject: [PATCH 14/16] chore: release 4.4.3

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 6 ++++++
 package.json                  | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 7cb89f2d..465e1a2a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.4.2"
+  ".": "4.4.3"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d50e2e0e..5602871b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [4.4.3](https://github.com/npm/template-oss/compare/v4.4.2...v4.4.3) (2022-09-29)
+
+### Bug Fixes
+
+* [`e21239e`](https://github.com/npm/template-oss/commit/e21239e0dea2dae585102878a4fc13e8ae7cae7a) [#218](https://github.com/npm/template-oss/pull/218) checkout head ref name in post dependabot (@lukekarrys)
+
 ## [4.4.2](https://github.com/npm/template-oss/compare/v4.4.1...v4.4.2) (2022-09-23)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index 6a53f1cd..28591aac 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.4.2",
+  "version": "4.4.3",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {

From 6a2b97b2dafcef7d795c51d3b01830c4fcda7c25 Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Thu, 29 Sep 2022 14:32:21 -0700
Subject: [PATCH 15/16] fix: use github.ref_name for post dependabot checkout

---
 .github/workflows/post-dependabot.yml                 | 2 +-
 lib/content/post-dependabot.yml                       | 2 +-
 tap-snapshots/test/apply/source-snapshots.js.test.cjs | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/post-dependabot.yml b/.github/workflows/post-dependabot.yml
index 88ac4035..e854e127 100644
--- a/.github/workflows/post-dependabot.yml
+++ b/.github/workflows/post-dependabot.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: ${{ github.event.pull_request.head.ref }}
+          ref: ${{ github.ref_name }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
diff --git a/lib/content/post-dependabot.yml b/lib/content/post-dependabot.yml
index 7dba72e6..77b21cf7 100644
--- a/lib/content/post-dependabot.yml
+++ b/lib/content/post-dependabot.yml
@@ -11,7 +11,7 @@ jobs:
     {{> job
       jobName="template-oss"
       jobIf="github.actor == 'dependabot[bot]'"
-      jobCheckout=(obj ref="${{ github.event.pull_request.head.ref }}")
+      jobCheckout=(obj ref="${{ github.ref_name }}")
     }}
       - name: Fetch Dependabot Metadata
         id: metadata
diff --git a/tap-snapshots/test/apply/source-snapshots.js.test.cjs b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
index 440120a9..3249cc0d 100644
--- a/tap-snapshots/test/apply/source-snapshots.js.test.cjs
+++ b/tap-snapshots/test/apply/source-snapshots.js.test.cjs
@@ -584,7 +584,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head.ref }}
+          ref: \${{ github.ref_name }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
@@ -2065,7 +2065,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head.ref }}
+          ref: \${{ github.ref_name }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"
@@ -3341,7 +3341,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
         with:
-          ref: \${{ github.event.pull_request.head.ref }}
+          ref: \${{ github.ref_name }}
       - name: Setup Git User
         run: |
           git config --global user.email "npm-cli+bot@github.com"

From 651ffb5dc2163fecacf62930e141adc2f5ec6b7c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 30 Sep 2022 00:11:30 +0000
Subject: [PATCH 16/16] chore: release 4.4.4

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 6 ++++++
 package.json                  | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 465e1a2a..e575b70e 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.4.3"
+  ".": "4.4.4"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5602871b..9934d1c7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [4.4.4](https://github.com/npm/template-oss/compare/v4.4.3...v4.4.4) (2022-09-30)
+
+### Bug Fixes
+
+* [`6a2b97b`](https://github.com/npm/template-oss/commit/6a2b97b2dafcef7d795c51d3b01830c4fcda7c25) use github.ref_name for post dependabot checkout (@lukekarrys)
+
 ## [4.4.3](https://github.com/npm/template-oss/compare/v4.4.2...v4.4.3) (2022-09-29)
 
 ### Bug Fixes
diff --git a/package.json b/package.json
index 28591aac..6df3d93a 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/template-oss",
-  "version": "4.4.3",
+  "version": "4.4.4",
   "description": "templated files used in npm CLI team oss projects",
   "main": "lib/content/index.js",
   "bin": {