[theoephraim]

Adds a per-package sourcePaths option: globs for sources that live outside a package's directory. A changed file matching one marks the package as changed exactly as if it were inside it.

Motivating case: a published native-binary package (e.g. @varlock/native-helper-darwin in packages/native-helpers/darwin) whose binary is built from a separate private package (packages/encryption-binary-swift). Today bumpy can't see that, so no bump file is required when the native sources change.

"packages": {
  "@varlock/native-helper-darwin": {
    "sourcePaths": ["../../encryption-binary-swift/**", "!../../encryption-binary-swift/**/*.md"]
  }
}

• Package-relative, like every per-package glob (changedFilePatterns already is), whether declared in the root packages map (by name or glob — resolved per matched package) or in package.json "bumpy". Use ../ to reach out. Resolved to repo-root-relative globs once in loadPackageConfig.
• !-prefixed patterns exclude (also package-relative): a file counts when it matches any positive pattern and no negated one.
• Additive: changedFilePatterns still only filters files inside the package dir and doesn't apply to sourcePaths matches. A sourcePaths match is always a definite change (no package.json field diffing).
• Honored by findChangedPackages (bumpy check, pre-push hook, CI check, PR comment) and bumpy generate's file→package mapping.
• Schema, types, docs/configuration.md (incl. a note that all per-package globs are package-relative), and tests.

[github-actions]

The changes in this PR will be included in the next version bump.

Minor releases

• @varlock/bumpy 1.18.1 → 1.19.0

Bump files in this PR

• package-source-paths.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the complete sourcePaths implementation and its integration with package discovery, change checking, commit attribution, configuration surfaces, and tests.

• Matching semantics — Added repository-root-relative positive globs with ! exclusions and additive behavior alongside changedFilePatterns.
• Change detection — Applied effective per-package configuration to findChangedPackages, including root exact and glob package entries.
• Generate attribution — Extended file-to-package mapping to attribute external source changes to every configured consumer package.
• Public configuration — Updated TypeScript types, JSON schema, documentation, and release metadata.
• Verification — Focused check/generate tests passed with 28 tests, package type checking passed, and repository formatting passed.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the declaration-relative sourcePaths behavior added since the prior Pullfrog review.

• Path normalization — Resolved ./ and ../ patterns relative to the package directory when declared in package.json, while preserving repository-root semantics for plain patterns and root configuration.
• Integration coverage — Passed the repository root through change detection and workspace package loading so normalized paths apply consistently to checks and generated bump attribution.
• Configuration contract — Updated the schema, TypeScript documentation, user documentation, and focused tests for relative includes and exclusions.
• Verification — Focused check/generate tests passed with 31 tests, package type checking passed, and repository formatting passed.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the package-relative sourcePaths contract introduced since the prior Pullfrog review and its effects on normalized configuration, change detection, generated bump attribution, documentation, and tests.

• Unified path semantics — Made every sourcePaths pattern relative to the target package directory, including patterns from root exact and wildcard package entries.
• Post-merge normalization — Normalized the effective merged package configuration once into repository-root-relative globs consumed consistently by check and generate flows.
• Configuration guidance — Updated public types, schema text, documentation, examples, and release metadata to describe the package-relative contract and exclusion behavior.
• Regression coverage — Covered external matches, package-relative non-matches, exclusions, wildcard package entries, package JSON declarations, and additive interaction with changedFilePatterns; 30 focused tests, package type checking, and formatting passed.

  ^{｜ View workflow run ｜ Using gpt-5.6-sol ｜ 𝕏}