chore: template-oss@4.2.0lk/template-osslk/cli-template-oss

57 files changed, 769 insertions, 649 deletions

diff --git a/.commitlintrc.js b/.commitlintrc.js
new file mode 100644
index 000000000..5b0b1a523
--- /dev/null
+++ b/.commitlintrc.js
@@ -0,0 +1,10 @@
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+module.exports = {
+  extends: ['@commitlint/config-conventional'],
+  rules: {
+    'type-enum': [2, 'always', ['feat', 'fix', 'docs', 'deps', 'chore']],
+    'header-max-length': [2, 'always', 80],
+    'subject-case': [0, 'always', ['lower-case', 'sentence-case', 'start-case']],
+  },
+}
diff --git a/.eslintrc.js b/.eslintrc.js
index 1718f033c..d7c739159 100644
--- a/.eslintrc.js
+++ b/.eslintrc.js
@@ -1,3 +1,7 @@
+/* This file is automatically added by @npmcli/template-oss. Do not edit. */
+
+'use strict'
+
 const { readdirSync: readdir } = require('fs')
 
 const localConfigs = readdir(__dirname)
@@ -6,6 +10,22 @@ const localConfigs = readdir(__dirname)
 
 module.exports = {
   root: true,
+  ignorePatterns: [
+    'docs',
+    'smoke-tests',
+    'workspaces/arborist',
+    'workspaces/libnpmaccess',
+    'workspaces/libnpmdiff',
+    'workspaces/libnpmexec',
+    'workspaces/libnpmfund',
+    'workspaces/libnpmhook',
+    'workspaces/libnpmorg',
+    'workspaces/libnpmpack',
+    'workspaces/libnpmpublish',
+    'workspaces/libnpmsearch',
+    'workspaces/libnpmteam',
+    'workspaces/libnpmversion',
+  ],
   extends: [
     '@npmcli',
     ...localConfigs,
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index ef8743136..2c54b0d25 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1 +1,3 @@
-*	@npm/cli-team
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+* @npm/cli-team
diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
new file mode 100644
index 000000000..69e21c329
--- /dev/null
+++ b/.github/workflows/audit.yml
@@ -0,0 +1,26 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Audit
+
+on:
+  workflow_dispatch:
+  schedule:
+    # "At 08:00 UTC (01:00 PT) on Monday" https://crontab.guru/#0_8_*_*_1
+    - cron: "0 8 * * 1"
+
+jobs:
+  audit:
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+          cache: npm
+      - run: node . run resetdeps
+      - run: node . audit
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
index dd8a43192..265343606 100644
--- a/.github/workflows/ci-docs.yml
+++ b/.github/workflows/ci-docs.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -30,19 +31,17 @@ jobs:
           git config --global user.name "npm CLI robot"
       - uses: actions/setup-node@v3
         with:
-          node-version: 16
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w docs
+          node-version: 18.x
+      - run: node . run resetdeps
+      - run: node . run lint -w docs
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
         node-version:
-          - 16
+          - 18.x
         platform:
           - os: ubuntu-latest
             shell: bash
@@ -63,25 +62,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w docs
+      - run: node . test --ignore-scripts -w docs
diff --git a/.github/workflows/ci-libnpmaccess.yml b/.github/workflows/ci-libnpmaccess.yml
index 6f27d9555..baeb67c98 100644
--- a/.github/workflows/ci-libnpmaccess.yml
+++ b/.github/workflows/ci-libnpmaccess.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmaccess
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmaccess
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmaccess
+      - run: node . test --ignore-scripts -w libnpmaccess
diff --git a/.github/workflows/ci-libnpmdiff.yml b/.github/workflows/ci-libnpmdiff.yml
index daba1324d..c034d1667 100644
--- a/.github/workflows/ci-libnpmdiff.yml
+++ b/.github/workflows/ci-libnpmdiff.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmdiff
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmdiff
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmdiff
+      - run: node . test --ignore-scripts -w libnpmdiff
diff --git a/.github/workflows/ci-libnpmexec.yml b/.github/workflows/ci-libnpmexec.yml
index e7cd77124..d8504e56c 100644
--- a/.github/workflows/ci-libnpmexec.yml
+++ b/.github/workflows/ci-libnpmexec.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmexec
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmexec
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmexec
+      - run: node . test --ignore-scripts -w libnpmexec
diff --git a/.github/workflows/ci-libnpmfund.yml b/.github/workflows/ci-libnpmfund.yml
index 268db59da..df55d1d44 100644
--- a/.github/workflows/ci-libnpmfund.yml
+++ b/.github/workflows/ci-libnpmfund.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmfund
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmfund
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmfund
+      - run: node . test --ignore-scripts -w libnpmfund
diff --git a/.github/workflows/ci-libnpmhook.yml b/.github/workflows/ci-libnpmhook.yml
index 81eb7fe68..f98768a23 100644
--- a/.github/workflows/ci-libnpmhook.yml
+++ b/.github/workflows/ci-libnpmhook.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmhook
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmhook
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmhook
+      - run: node . test --ignore-scripts -w libnpmhook
diff --git a/.github/workflows/ci-libnpmorg.yml b/.github/workflows/ci-libnpmorg.yml
index 26e5a26dd..5a07174a8 100644
--- a/.github/workflows/ci-libnpmorg.yml
+++ b/.github/workflows/ci-libnpmorg.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmorg
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmorg
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmorg
+      - run: node . test --ignore-scripts -w libnpmorg
diff --git a/.github/workflows/ci-libnpmpack.yml b/.github/workflows/ci-libnpmpack.yml
index 4bd344e76..0163e6dcf 100644
--- a/.github/workflows/ci-libnpmpack.yml
+++ b/.github/workflows/ci-libnpmpack.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmpack
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmpack
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmpack
+      - run: node . test --ignore-scripts -w libnpmpack
diff --git a/.github/workflows/ci-libnpmpublish.yml b/.github/workflows/ci-libnpmpublish.yml
index cad4ea600..633e67ed9 100644
--- a/.github/workflows/ci-libnpmpublish.yml
+++ b/.github/workflows/ci-libnpmpublish.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmpublish
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmpublish
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmpublish
+      - run: node . test --ignore-scripts -w libnpmpublish
diff --git a/.github/workflows/ci-libnpmsearch.yml b/.github/workflows/ci-libnpmsearch.yml
index 83341b465..4a07f5289 100644
--- a/.github/workflows/ci-libnpmsearch.yml
+++ b/.github/workflows/ci-libnpmsearch.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmsearch
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmsearch
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmsearch
+      - run: node . test --ignore-scripts -w libnpmsearch
diff --git a/.github/workflows/ci-libnpmteam.yml b/.github/workflows/ci-libnpmteam.yml
index 38d77d209..85b692dab 100644
--- a/.github/workflows/ci-libnpmteam.yml
+++ b/.github/workflows/ci-libnpmteam.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmteam
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmteam
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmteam
+      - run: node . test --ignore-scripts -w libnpmteam
diff --git a/.github/workflows/ci-libnpmversion.yml b/.github/workflows/ci-libnpmversion.yml
index 023fd8b7a..1a29b040c 100644
--- a/.github/workflows/ci-libnpmversion.yml
+++ b/.github/workflows/ci-libnpmversion.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w libnpmversion
+      - run: node . run resetdeps
+      - run: node . run lint -w libnpmversion
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w libnpmversion
+      - run: node . test --ignore-scripts -w libnpmversion
diff --git a/.github/workflows/ci-npmcli-arborist.yml b/.github/workflows/ci-npmcli-arborist.yml
index d2c83de9e..2ba261d6b 100644
--- a/.github/workflows/ci-npmcli-arborist.yml
+++ b/.github/workflows/ci-npmcli-arborist.yml
@@ -21,6 +21,7 @@ on:
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -31,13 +32,11 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
-      - run: npm run lint -w @npmcli/arborist
+      - run: node . run resetdeps
+      - run: node . run lint -w @npmcli/arborist
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -68,25 +67,7 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
-      - name: Update to workable npm (windows)
-        # node 12 and 14 ship with npm@6, which is known to fail when updating itself in windows
-        if: matrix.platform.os == 'windows-latest' && (startsWith(matrix.node-version, '12.') || startsWith(matrix.node-version, '14.'))
-        run: |
-          curl -sO https://registry.npmjs.org/npm/-/npm-7.5.4.tgz
-          tar xf npm-7.5.4.tgz
-          cd package
-          node lib/npm.js install --no-fund --no-audit -g ..\npm-7.5.4.tgz
-          cd ..
-          rmdir /s /q package
-      - name: Update npm to 7
-        # If we do test on npm 10 it needs npm7
-        if: startsWith(matrix.node-version, '10.')
-        run: npm i --prefer-online --no-fund --no-audit -g npm@7
-      - name: Update npm to latest
-        if: ${{ !startsWith(matrix.node-version, '10.') }}
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+      - run: node . run resetdeps
       - name: add tap problem matcher
         run: echo "::add-matcher::.github/matchers/tap.json"
-      - run: npm test --ignore-scripts -w @npmcli/arborist
+      - run: node . test --ignore-scripts -w @npmcli/arborist
diff --git a/.github/workflows/ci-smoke-tests.yml b/.github/workflows/ci-smoke-tests.yml
new file mode 100644
index 000000000..3ac1ebefe
--- /dev/null
+++ b/.github/workflows/ci-smoke-tests.yml
@@ -0,0 +1,73 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: CI - smoke-tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - '*'
+    paths:
+      - smoke-tests/**
+  push:
+    branches:
+      - main
+      - latest
+    paths:
+      - smoke-tests/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
+
+jobs:
+  lint:
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+      - run: node . run resetdeps
+      - run: node . run lint -w smoke-tests
+
+  test:
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version:
+          - 14.17.0
+          - 14.x
+          - 16.13.0
+          - 16.x
+          - 18.0.0
+          - 18.x
+        platform:
+          - os: ubuntu-latest
+            shell: bash
+          - os: macos-latest
+            shell: bash
+          - os: windows-latest
+            shell: cmd
+    runs-on: ${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: ${{ matrix.platform.shell }}
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+      - run: node . run resetdeps
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: node . test --ignore-scripts -w smoke-tests
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8914fa041..df6c20a31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,3 +1,5 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
 name: CI - cli
 
 on:
@@ -5,63 +7,91 @@ on:
   pull_request:
     branches:
       - '*'
+    paths-ignore:
+      - docs/**
+      - smoke-tests/**
+      - workspaces/**
   push:
     branches:
+      - main
       - latest
+    paths-ignore:
+      - docs/**
+      - smoke-tests/**
+      - workspaces/**
+  schedule:
+    # "At 09:00 UTC (02:00 PT) on Monday" https://crontab.guru/#0_9_*_*_1
+    - cron: "0 9 * * 1"
 
 jobs:
   lint:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 18.x
           cache: npm
-      - run: node bin/npm-cli.js run resetdeps
-      - run: node bin/npm-cli.js run lint
+      - run: node . run resetdeps
+      - run: node . run lint
 
   check_docs:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 18.x
           cache: npm
+      - run: node . run resetdeps
       - run: make freshdocs
       - run: node scripts/git-dirty.js
 
   licenses:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 18.x
           cache: npm
-      - run: node bin/npm-cli.js run resetdeps
-      - run: node bin/npm-cli.js run licenses
-  
+      - run: node . run resetdeps
+      - run: node . run licenses
+
   smoke-tests:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 18.x
           cache: npm
-      - run: node bin/npm-cli.js run resetdeps
-      - run: node bin/npm-cli.js test -w smoke-tests --ignore-scripts
-      - name: git status
-        if: matrix.platform.os != 'windows-latest'
-        run: node scripts/git-dirty.js
+      - run: node . run resetdeps
+      - run: node . test -w smoke-tests --ignore-scripts
+      - run: node scripts/git-dirty.js
 
   test:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -84,14 +114,17 @@ jobs:
       run:
         shell: ${{ matrix.platform.shell }}
     steps:
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: npm
-    - run: node bin/npm-cli.js run resetdeps
-    - run: node bin/npm-cli.js run test --ignore-scripts
-    - name: git status
-      if: matrix.platform.os != 'windows-latest'
-      run: node scripts/git-dirty.js
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+      - run: node . run resetdeps
+      - run: node . run test --ignore-scripts
+      - name: git status
+        if: matrix.platform.os != 'windows-latest'
+        run: node scripts/git-dirty.js
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
new file mode 100644
index 000000000..cfd0db300
--- /dev/null
+++ b/.github/workflows/codeql-analysis.yml
@@ -0,0 +1,44 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: "CodeQL"
+
+on:
+  push:
+    branches:
+      - main
+      - latest
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches:
+      - main
+      - latest
+  schedule:
+    # "At 10:00 UTC (03:00 PT) on Monday" https://crontab.guru/#0_10_*_*_1
+    - cron: "0 10 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript ]
+
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v1
+        with:
+          languages: ${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v1
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
new file mode 100644
index 000000000..2b9059b1c
--- /dev/null
+++ b/.github/workflows/pull-request.yml
@@ -0,0 +1,36 @@
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Pull Request Linting
+
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - edited
+      - synchronize
+
+jobs:
+  check:
+    name: Check PR Title or Commits
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
+        with:
+          node-version: 18.x
+          cache: npm
+      - run: node . run resetdeps
+      - name: Check commits or PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          npx --offline commitlint -V --from origin/latest --to ${{ github.event.pull_request.head.sha }} \
+            || echo $PR_TITLE | npx --offline commitlint -V
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index edd39d0ba..071ace6e8 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -14,10 +14,11 @@ permissions:
 
 jobs:
   release-please:
-    runs-on: ubuntu-latest
     outputs:
       pr: ${{ steps.release.outputs.pr }}
       release: ${{ steps.release.outputs.release }}
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
       - name: Setup git user
@@ -27,10 +28,8 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+          cache: npm
+      - run: node . run resetdeps
       - name: Release Please
         id: release
         run: npx --offline template-oss-release-please ${{ github.ref_name }}
@@ -58,15 +57,13 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+          cache: npm
+      - run: node . run resetdeps
       - name: Post pull request actions
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npm run rp-pull-request --ignore-scripts --if-present -ws -iwr
+          node . run rp-pull-request --ignore-scripts --if-present -ws -iwr
           git commit -am "chore: post pull request" || true
           git push
 
@@ -79,7 +76,7 @@ jobs:
 
   post-release:
     needs: release-please
-    if: needs.release-please.outputs.release
+    if: github.repository_owner == 'npm' && needs.release-please.outputs.release
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -90,12 +87,10 @@ jobs:
       - uses: actions/setup-node@v3
         with:
           node-version: 18.x
-      - name: Update npm to latest
-        run: npm i --prefer-online --no-fund --no-audit -g npm@latest
-      - run: npm -v
-      - run: npm i --ignore-scripts --no-audit --no-fund
+          cache: npm
+      - run: node . run resetdeps
       - name: Post release actions
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          npm run rp-release --ignore-scripts --if-present -ws -iwr
+          node . run rp-release --ignore-scripts --if-present -ws -iwr
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5035e2651..979d9b4fd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,6 @@
-name: Release - cli
+# This file is automatically added by @npmcli/template-oss. Do not edit.
+
+name: Release
 
 on:
   workflow_call:
@@ -9,20 +11,25 @@ on:
 
 jobs:
   lint-all:
+    if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
         with:
           ref: ${{ inputs.ref }}
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: 18.x
           cache: npm
-      - run: node bin/npm-cli.js run resetdeps
-      - run: node bin/npm-cli.js run lint-all --ignore-scripts
+      - run: node . run resetdeps
+      - run: node . run lint -ws -iwr --if-present
 
-  smoke-publish:
+  test-all:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -38,8 +45,8 @@ jobs:
             shell: bash
           - os: macos-latest
             shell: bash
-        # XXX: this should be possible in windows also
-        # but resetdeps cant be a bash script
+          - os: windows-latest
+            shell: cmd
     runs-on: ${{ matrix.platform.os }}
     defaults:
       run:
@@ -50,29 +57,19 @@ jobs:
           ref: ${{ inputs.ref }}
       - name: Setup git user
         run: |
-          git config --global user.email "ops+npm-cli@npmjs.com"
-          git config --global user.name "npm cli ops bot"
-      - name: Use Node.js 16.x
-        uses: actions/setup-node@v3
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
-          node-version: 16.x
+          node-version: ${{ matrix.node-version }}
           cache: npm
-      - name: Pack
-        run: |
-          NPM_VERSION="$(node bin/npm-cli.js --version)-$GITHUB_SHA.0"
-          node bin/npm-cli.js version $NPM_VERSION --ignore-scripts
-          node bin/npm-cli.js run resetdeps
-          git clean -fd
-          node bin/npm-cli.js ls --production >/dev/null
-          node bin/npm-cli.js prune --production --no-save --no-audit --no-fund
-          node scripts/git-dirty.js
-          node bin/npm-cli.js pack --pack-destination=$RUNNER_TEMP
-          node bin/npm-cli.js install -g $RUNNER_TEMP/npm-$NPM_VERSION.tgz
-          node bin/npm-cli.js install -w smoke-tests --ignore-scripts --no-audit --no-fund
-          rm -rf {lib,bin,index.js}
-          SMOKE_PUBLISH_NPM=1 npm test -w smoke-tests --ignore-scripts
-            
-  test-all:
+      - run: node . run resetdeps
+      - name: add tap problem matcher
+        run: echo "::add-matcher::.github/matchers/tap.json"
+      - run: node . run test -ws -iwr --if-present
+
+  smoke-publish:
+    if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
       matrix:
@@ -98,14 +95,26 @@ jobs:
       - uses: actions/checkout@v3
         with:
           ref: ${{ inputs.ref }}
-      - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v3
+      - name: Setup git user
+        run: |
+          git config --global user.email "npm-cli+bot@github.com"
+          git config --global user.name "npm CLI robot"
+      - uses: actions/setup-node@v3
         with:
           node-version: ${{ matrix.node-version }}
           cache: npm
-      - run: node bin/npm-cli.js run resetdeps
-      - run: node bin/npm-cli.js link -f --ignore-scripts
-      - run: node bin/npm-cli.js run test-all --ignore-scripts
-      - name: git status
-        if: matrix.platform.os != 'windows-latest'
-        run: node scripts/git-dirty.js
+      - run: node . run resetdeps
+      - name: Pack
+        run: |
+          NPM_VERSION="$(node bin/npm-cli.js --version)-$GITHUB_SHA.0"
+          node bin/npm-cli.js version $NPM_VERSION --ignore-scripts
+          node bin/npm-cli.js run resetdeps
+          git clean -fd
+          node bin/npm-cli.js ls --production >/dev/null
+          node bin/npm-cli.js prune --production --no-save --no-audit --no-fund
+          node scripts/git-dirty.js
+          node bin/npm-cli.js pack --pack-destination=$RUNNER_TEMP
+          node bin/npm-cli.js install -g $RUNNER_TEMP/npm-$NPM_VERSION.tgz
+          node bin/npm-cli.js install -w smoke-tests --ignore-scripts --no-audit --no-fund
+          rm -rf {lib,bin,index.js}
+          SMOKE_PUBLISH_NPM=1 npm test -w smoke-tests --ignore-scripts
diff --git a/.gitignore b/.gitignore
index 94f6b413c..370f45df4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,38 +1,59 @@
-/*
+# This file is automatically added by @npmcli/template-oss. Do not edit.
 
-!/.github/
-!/bin/
-!/changelogs/
-!/docs/
-!/lib/
-!/node_modules/
-/node_modules/.bin/
-/node_modules/.cache/
-!/scripts/
-!/smoke-tests/
-!/tap-snapshots/
-!/test/
-!/workspaces/
+# ignore everything in the root
+/*
 
-!/.release-please-manifest.json
-!/release-please-config.json
+# keep these
+!**/.gitignore
+!/.commitlintrc.js
 !/.eslintrc.js
-!/.eslintrc.local.json
+!/.eslintrc.local.*
 !/.gitattributes
+!/.github/
 !/.gitignore
 !/.licensee.json
 !/.mailmap
 !/.npmrc
+!/.release-please-manifest.json
 !/AUTHORS
-!/CHANGELOG.md
+!/bin/
+!/CHANGELOG*
+!/changelogs/
+!/CODE_OF_CONDUCT.md
 !/configure
 !/CONTRIBUTING.md
+!/DEPENDENCIES.md
+!/docs/
 !/index.js
-!/LICENSE
+!/lib/
+!/LICENSE*
 !/make.bat
 !/Makefile
+!/map.js
+!/node_modules/
+/node_modules/.bin/
+/node_modules/.cache/
 !/package-lock.json
 !/package.json
-!/README.md
+!/README*
+!/release-please-config.json
+!/scripts/
 !/SECURITY.md
-!/DEPENDENCIES.md
+!/tap-snapshots/
+!/test/
+!/docs/
+!/smoke-tests/
+!/workspaces/
+/workspaces/*
+!/workspaces/arborist/
+!/workspaces/libnpmaccess/
+!/workspaces/libnpmdiff/
+!/workspaces/libnpmexec/
+!/workspaces/libnpmfund/
+!/workspaces/libnpmhook/
+!/workspaces/libnpmorg/
+!/workspaces/libnpmpack/
+!/workspaces/libnpmpublish/
+!/workspaces/libnpmsearch/
+!/workspaces/libnpmteam/
+!/workspaces/libnpmversion/
diff --git a/.npmrc b/.npmrc
index e69de29bb..63cd3a3b1 100644
--- a/.npmrc
+++ b/.npmrc
@@ -0,0 +1,3 @@
+; This file is automatically added by @npmcli/template-oss. Do not edit.
+
+package-lock=true
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 000000000..167043c29
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,7 @@
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+All interactions in this repo are covered by the [npm Code of
+Conduct](https://docs.npmjs.com/policies/conduct)
+
+The npm cli team may, at its own discretion, moderate, remove, or edit
+any interactions such as pull requests, issues, and comments.
diff --git a/SECURITY.md b/SECURITY.md
index 41b76c246..a93106d0c 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1 +1,3 @@
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
 Please send vulnerability reports through [hackerone](https://hackerone.com/github).
diff --git a/docs/.gitignore b/docs/.gitignore
index 2231d46ac..c09c2f4a2 100644
--- a/docs/.gitignore
+++ b/docs/.gitignore
@@ -4,20 +4,20 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
 !/content/
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/nav.yml
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/node_modules/.gitignore b/node_modules/.gitignore
index ce939861b..37530342b 100644
--- a/node_modules/.gitignore
+++ b/node_modules/.gitignore
@@ -379,6 +379,7 @@ __pycache__
 /jsonpath
 /JSONStream
 /jsprim
+/just-deep-map-values
 /kind-of
 /lcov-parse
 /levn
diff --git a/package-lock.json b/package-lock.json
index 0cb2bb110..30091896e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -169,7 +169,7 @@
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
         "@npmcli/promise-spawn": "^3.0.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "fs-minipass": "^2.1.0",
         "licensee": "^8.2.0",
         "minimatch": "^5.1.0",
@@ -189,7 +189,7 @@
         "@npmcli/eslint-config": "^3.1.0",
         "@npmcli/fs": "^2.1.0",
         "@npmcli/promise-spawn": "^3.0.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "cmark-gfm": "^0.9.0",
         "jsdom": "^18.1.0",
         "marked-man": "^0.7.0",
@@ -198,7 +198,7 @@
         "yaml": "^1.10.0"
       },
       "engines": {
-        "node": ">=16.0.0"
+        "node": ">=18.0.0"
       }
     },
     "node_modules/@actions/core": {
@@ -2362,9 +2362,9 @@
       }
     },
     "node_modules/@npmcli/template-oss": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/template-oss/-/template-oss-4.1.2.tgz",
-      "integrity": "sha512-BS9YZeRtLsZ+lnCcQV3tZQa25K+MbUz/MgX5ZFzRmU+gTgCGthfajXZ7r8jJTjSiNgrElS0Ty/+x6Ds6B7oFdw==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/template-oss/-/template-oss-4.2.0.tgz",
+      "integrity": "sha512-p4mgKyxfAA8E38MMcGGF429bGq4OaiCjQBSfsTT5wqRFLiAXdY+Jm3UzI5OC/XtTXlwTgO8yQk+KCEGo4iw4YQ==",
       "dev": true,
       "hasInstallScript": true,
       "dependencies": {
@@ -2381,6 +2381,7 @@
         "handlebars": "^4.7.7",
         "hosted-git-info": "^5.0.0",
         "json-parse-even-better-errors": "^2.3.1",
+        "just-deep-map-values": "^1.1.1",
         "just-diff": "^5.0.1",
         "lodash": "^4.17.21",
         "npm-package-arg": "^9.0.1",
@@ -6959,6 +6960,12 @@
         "node": ">=0.6.0"
       }
     },
+    "node_modules/just-deep-map-values": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/just-deep-map-values/-/just-deep-map-values-1.1.1.tgz",
+      "integrity": "sha512-hCMqPI0FjM2wpOWBYgvrdZlmFZF+7PeC/IzBxvt7dgUsK/OFeFOwJ1kv40Vx5I3RJiWv7ninPUxjk2Af0YiDAw==",
+      "dev": true
+    },
     "node_modules/just-diff": {
       "version": "5.1.1",
       "resolved": "https://registry.npmjs.org/just-diff/-/just-diff-5.1.1.tgz",
@@ -13844,7 +13851,7 @@
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
         "@npmcli/promise-spawn": "^3.0.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "minify-registry-metadata": "^2.2.0",
         "rimraf": "^3.0.2",
         "tap": "^16.0.1",
@@ -13901,7 +13908,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "benchmark": "^2.1.4",
         "chalk": "^4.1.0",
         "minify-registry-metadata": "^2.1.0",
@@ -13922,7 +13929,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "nock": "^13.2.4",
         "tap": "^16.0.1"
       },
@@ -13945,7 +13952,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "tap": "^16.0.1"
       },
       "engines": {
@@ -13973,7 +13980,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "bin-links": "^3.0.3",
         "minify-registry-metadata": "^2.2.0",
         "mkdirp": "^1.0.4",
@@ -13991,7 +13998,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "tap": "^16.0.1"
       },
       "engines": {
@@ -14007,7 +14014,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "nock": "^13.2.4",
         "tap": "^16.0.1"
       },
@@ -14024,7 +14031,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "minipass": "^3.1.1",
         "nock": "^13.2.4",
         "tap": "^16.0.1"
@@ -14043,7 +14050,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "nock": "^13.0.7",
         "tap": "^16.0.1"
       },
@@ -14063,7 +14070,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "libnpmpack": "^5.0.0-pre.0",
         "lodash.clonedeep": "^4.5.0",
         "nock": "^13.2.4",
@@ -14081,7 +14088,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "nock": "^13.2.4",
         "tap": "^16.0.1"
       },
@@ -14098,7 +14105,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "nock": "^13.2.4",
         "tap": "^16.0.1"
       },
@@ -14118,7 +14125,7 @@
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^3.1.0",
-        "@npmcli/template-oss": "4.1.2",
+        "@npmcli/template-oss": "4.2.0",
         "require-inject": "^1.4.4",
         "tap": "^16.0.1"
       },
diff --git a/package.json b/package.json
index 21b41d2e6..790efe092 100644
--- a/package.json
+++ b/package.json
@@ -8,11 +8,11 @@
     "workspaces/*"
   ],
   "files": [
+    "bin/",
+    "lib/",
     "index.js",
-    "bin",
     "docs/content/**/*.md",
     "docs/output/**/*.html",
-    "lib",
     "man"
   ],
   "keywords": [
@@ -26,10 +26,10 @@
     "publishtest": false
   },
   "homepage": "https://docs.npmjs.com/",
-  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+  "author": "GitHub Inc.",
   "repository": {
     "type": "git",
-    "url": "https://github.com/npm/cli"
+    "url": "https://github.com/npm/cli.git"
   },
   "bugs": {
     "url": "https://github.com/npm/cli/issues"
@@ -206,7 +206,7 @@
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
     "@npmcli/promise-spawn": "^3.0.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "fs-minipass": "^2.1.0",
     "licensee": "^8.2.0",
     "minimatch": "^5.1.0",
@@ -220,19 +220,21 @@
     "authors": "bash scripts/update-authors.sh",
     "licenses": "licensee --production --errors-only",
     "test": "tap",
-    "test-all": "npm run test --if-present --workspaces --include-workspace-root",
+    "test-all": "node . run test -ws -iwr --if-present",
     "snap": "tap",
     "postsnap": "make -s docs",
     "test:nocleanup": "NO_TEST_CLEANUP=1 npm run test --",
     "sudotest": "sudo npm run test --",
     "sudotest:nocleanup": "sudo NO_TEST_CLEANUP=1 npm run test --",
-    "posttest": "npm run lint",
+    "posttest": "node . run lint",
     "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "lint-all": "npm run lint --if-present --workspaces --include-workspace-root",
+    "lintfix": "node . run lint -- --fix",
+    "lint-all": "node . run lint -ws -iwr --if-present",
     "prelint": "rimraf test/npm_cache*",
     "resetdeps": "bash scripts/resetdeps.sh",
-    "rp-pull-request": "npm run resetdeps && npm run authors"
+    "rp-pull-request": "npm run resetdeps && npm run authors",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force"
   },
   "tap": {
     "test-env": [
@@ -243,13 +245,19 @@
     "timeout": 600,
     "nyc-arg": [
       "--exclude",
+      "docs/**",
+      "--exclude",
+      "smoke-tests/**",
+      "--exclude",
       "workspaces/**",
       "--exclude",
       "tap-snapshots/**"
-    ]
+    ],
+    "test-ignore": "^(docs|smoke-tests|workspaces)/"
   },
   "templateOSS": {
-    "version": "4.1.2",
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.2.0",
     "content": "./scripts/template-oss/root.js"
   },
   "license": "Artistic-2.0",
diff --git a/smoke-tests/.gitignore b/smoke-tests/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/smoke-tests/.gitignore
+++ b/smoke-tests/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/smoke-tests/package.json b/smoke-tests/package.json
index d9f40e10d..d8bad2803 100644
--- a/smoke-tests/package.json
+++ b/smoke-tests/package.json
@@ -7,10 +7,10 @@
     "lint": "eslint \"**/*.js\"",
     "postlint": "template-oss-check",
     "template-oss-apply": "template-oss-apply --force",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node .. run lint -- --fix",
     "snap": "tap",
     "test": "tap",
-    "posttest": "npm run lint"
+    "posttest": "node .. run lint"
   },
   "repository": {
     "type": "git",
@@ -20,7 +20,7 @@
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
     "@npmcli/promise-spawn": "^3.0.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "minify-registry-metadata": "^2.2.0",
     "rimraf": "^3.0.2",
     "tap": "^16.0.1",
@@ -30,13 +30,17 @@
   "license": "ISC",
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../scripts/template-oss/index.js"
   },
   "tap": {
     "no-coverage": true,
     "timeout": 300,
-    "files": "test/index.js"
+    "files": "test/index.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "files": [
     "bin/",
diff --git a/workspaces/arborist/.gitignore b/workspaces/arborist/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/arborist/.gitignore
+++ b/workspaces/arborist/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 32926b913..165015e00 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "benchmark": "^2.1.4",
     "chalk": "^4.1.0",
     "minify-registry-metadata": "^2.1.0",
@@ -52,13 +52,13 @@
   },
   "scripts": {
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "snap": "tap",
     "postsnap": "npm run lintfix",
     "test-proxy": "ARBORIST_TEST_PROXY=1 tap --snapshot",
     "eslint": "eslint",
     "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "benchmark": "node scripts/benchmark.js",
     "benchclean": "rm -rf scripts/benchmark/*/",
     "npmclilint": "npmcli-lint",
@@ -93,14 +93,18 @@
       "--no-warnings",
       "--no-deprecation"
     ],
-    "timeout": "360"
+    "timeout": "360",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "engines": {
     "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
   }
 }
diff --git a/workspaces/libnpmaccess/.gitignore b/workspaces/libnpmaccess/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmaccess/.gitignore
+++ b/workspaces/libnpmaccess/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmaccess/package.json b/workspaces/libnpmaccess/package.json
index 9dd96bd0a..2e1013375 100644
--- a/workspaces/libnpmaccess/package.json
+++ b/workspaces/libnpmaccess/package.json
@@ -9,14 +9,14 @@
     "lint": "eslint \"**/*.js\"",
     "test": "tap",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "nock": "^13.2.4",
     "tap": "^16.0.1"
   },
@@ -40,7 +40,13 @@
   ],
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmdiff/.gitignore b/workspaces/libnpmdiff/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmdiff/.gitignore
+++ b/workspaces/libnpmdiff/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index 072a89bef..7cb40580b 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -34,16 +34,16 @@
   "scripts": {
     "eslint": "eslint",
     "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "snap": "tap",
     "postlint": "template-oss-check",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
@@ -58,7 +58,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmexec/.gitignore b/workspaces/libnpmexec/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmexec/.gitignore
+++ b/workspaces/libnpmexec/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index 1b64d55a2..83bfd7766 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -34,20 +34,24 @@
   "license": "ISC",
   "scripts": {
     "lint": "eslint \"**/*.js\"",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "test": "tap",
     "snap": "tap",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "template-oss-apply": "template-oss-apply --force"
   },
   "tap": {
     "color": true,
-    "files": "test/*.js"
+    "files": "test/*.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "bin-links": "^3.0.3",
     "minify-registry-metadata": "^2.2.0",
     "mkdirp": "^1.0.4",
@@ -71,7 +75,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
   }
 }
diff --git a/workspaces/libnpmfund/.gitignore b/workspaces/libnpmfund/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmfund/.gitignore
+++ b/workspaces/libnpmfund/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmfund/package.json b/workspaces/libnpmfund/package.json
index 5bad7c427..94e4eacad 100644
--- a/workspaces/libnpmfund/package.json
+++ b/workspaces/libnpmfund/package.json
@@ -33,8 +33,8 @@
   "scripts": {
     "eslint": "eslint",
     "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "posttest": "npm run lint",
+    "lintfix": "node ../.. run lint -- --fix",
+    "posttest": "node ../.. run lint",
     "test": "tap",
     "snap": "tap",
     "postlint": "template-oss-check",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
@@ -53,7 +53,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmhook/.gitignore b/workspaces/libnpmhook/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmhook/.gitignore
+++ b/workspaces/libnpmhook/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmhook/package.json b/workspaces/libnpmhook/package.json
index c027ebebf..e3e011ea5 100644
--- a/workspaces/libnpmhook/package.json
+++ b/workspaces/libnpmhook/package.json
@@ -13,9 +13,9 @@
     "test": "tap",
     "lint": "eslint \"**/*.js\"",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "template-oss-apply": "template-oss-apply --force"
   },
   "repository": {
@@ -37,7 +37,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "nock": "^13.2.4",
     "tap": "^16.0.1"
   },
@@ -46,7 +46,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmorg/.gitignore b/workspaces/libnpmorg/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmorg/.gitignore
+++ b/workspaces/libnpmorg/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmorg/package.json b/workspaces/libnpmorg/package.json
index 6a2d28fa9..f0321ac90 100644
--- a/workspaces/libnpmorg/package.json
+++ b/workspaces/libnpmorg/package.json
@@ -16,9 +16,9 @@
   "scripts": {
     "lint": "eslint \"**/*.js\"",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
     "template-oss-apply": "template-oss-apply --force"
   },
@@ -28,7 +28,7 @@
   ],
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "minipass": "^3.1.1",
     "nock": "^13.2.4",
     "tap": "^16.0.1"
@@ -49,7 +49,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmpack/.gitignore b/workspaces/libnpmpack/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmpack/.gitignore
+++ b/workspaces/libnpmpack/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index 45e19e57d..c5d81aaa2 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -15,15 +15,15 @@
   "scripts": {
     "lint": "eslint \"**/*.js\"",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "nock": "^13.0.7",
     "tap": "^16.0.1"
   },
@@ -44,7 +44,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmpublish/.gitignore b/workspaces/libnpmpublish/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmpublish/.gitignore
+++ b/workspaces/libnpmpublish/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index d239633e7..0f10b9079 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -16,16 +16,16 @@
   "scripts": {
     "eslint": "eslint",
     "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "postlint": "template-oss-check",
     "snap": "tap",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "libnpmpack": "^5.0.0-pre.0",
     "lodash.clonedeep": "^4.5.0",
     "nock": "^13.2.4",
@@ -50,7 +50,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmsearch/.gitignore b/workspaces/libnpmsearch/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmsearch/.gitignore
+++ b/workspaces/libnpmsearch/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmsearch/package.json b/workspaces/libnpmsearch/package.json
index 17b63e8cb..35aba5325 100644
--- a/workspaces/libnpmsearch/package.json
+++ b/workspaces/libnpmsearch/package.json
@@ -16,17 +16,17 @@
   ],
   "license": "ISC",
   "scripts": {
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "test": "tap",
     "lint": "eslint \"**/*.js\"",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "nock": "^13.2.4",
     "tap": "^16.0.1"
   },
@@ -45,7 +45,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmteam/.gitignore b/workspaces/libnpmteam/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmteam/.gitignore
+++ b/workspaces/libnpmteam/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmteam/package.json b/workspaces/libnpmteam/package.json
index 7059603f4..03ecf61f3 100644
--- a/workspaces/libnpmteam/package.json
+++ b/workspaces/libnpmteam/package.json
@@ -8,15 +8,15 @@
   "scripts": {
     "lint": "eslint \"**/*.js\"",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "snap": "tap",
     "template-oss-apply": "template-oss-apply --force"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "nock": "^13.2.4",
     "tap": "^16.0.1"
   },
@@ -39,7 +39,13 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }
diff --git a/workspaces/libnpmversion/.gitignore b/workspaces/libnpmversion/.gitignore
index 617e50ca0..79af2bfca 100644
--- a/workspaces/libnpmversion/.gitignore
+++ b/workspaces/libnpmversion/.gitignore
@@ -4,18 +4,18 @@
 /*
 
 # keep these
-!/.eslintrc.local.*
 !**/.gitignore
-!/docs/
-!/tap-snapshots/
-!/test/
-!/map.js
-!/scripts/
-!/README*
-!/LICENSE*
-!/CHANGELOG*
 !/.eslintrc.js
+!/.eslintrc.local.*
 !/.gitignore
 !/bin/
+!/CHANGELOG*
+!/docs/
 !/lib/
+!/LICENSE*
+!/map.js
 !/package.json
+!/README*
+!/scripts/
+!/tap-snapshots/
+!/test/
diff --git a/workspaces/libnpmversion/package.json b/workspaces/libnpmversion/package.json
index e06f17afb..0693a9053 100644
--- a/workspaces/libnpmversion/package.json
+++ b/workspaces/libnpmversion/package.json
@@ -17,18 +17,22 @@
   "scripts": {
     "lint": "eslint \"**/*.js\"",
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "node ../.. run lint",
     "snap": "tap",
     "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
+    "lintfix": "node ../.. run lint -- --fix",
     "template-oss-apply": "template-oss-apply --force"
   },
   "tap": {
-    "coverage-map": "map.js"
+    "coverage-map": "map.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.1.2",
+    "@npmcli/template-oss": "4.2.0",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
   },
@@ -44,7 +48,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.1.2",
+    "version": "4.2.0",
     "content": "../../scripts/template-oss/index.js"
   }
 }