From 0a9fa5807b1b7a189ada175c7d21d997d8dc5665 Mon Sep 17 00:00:00 2001
From: Fuchsi* Huber <fuchsi.huber@climate-resource.com>
Date: Thu, 20 Aug 2026 21:54:31 +0200
Subject: [PATCH 1/3] feat: support for yarn projects; improvement: rewrote
 bump script in python

---
 .github/workflows/bump.yaml |  46 +++-
 .github/workflows/tests.yml |  34 +++
 .gitignore                  |   3 +
 bump-version/README.md      | 130 ++++++++---
 bump-version/action.yml     | 208 +++++------------
 bump-version/bump.py        | 437 ++++++++++++++++++++++++++++++++++++
 changelog/27.feature.md     |   1 +
 changelog/27.fix.md         |   1 +
 changelog/27.improvement.md |   1 +
 pyproject.toml              |  10 +-
 tests/conftest.py           |  24 ++
 tests/test_bump.py          | 194 ++++++++++++++++
 uv.lock                     |  96 ++++++--
 13 files changed, 968 insertions(+), 217 deletions(-)
 create mode 100644 .github/workflows/tests.yml
 create mode 100755 bump-version/bump.py
 create mode 100644 changelog/27.feature.md
 create mode 100644 changelog/27.fix.md
 create mode 100644 changelog/27.improvement.md
 create mode 100644 tests/conftest.py
 create mode 100644 tests/test_bump.py

diff --git a/.github/workflows/bump.yaml b/.github/workflows/bump.yaml
index 165ba1c..732373b 100644
--- a/.github/workflows/bump.yaml
+++ b/.github/workflows/bump.yaml
@@ -23,14 +23,24 @@ name: Bump
 on:
   workflow_call:
     inputs:
+      project-type:
+        description: >
+          Kind of project to bump: 'uv' (Python) or 'yarn' (Node). See the bump-version
+          action for how bump-rule/pre-release-base/pre-release-bump differ per type.
+        required: false
+        type: string
+        default: "uv"
       bump-rule:
-        description: | 
-          Whitespace-separated list of segments passed to uv version --bump. 
-          Each segment becomes a separate --bump. 
-          
-          Examples: "patch",  "minor", "major", "stable", "minor alpha", "patch rc". 
-          
+        description: |
+          For project-type 'uv': whitespace-separated list of segments passed to
+          uv version --bump. Each segment becomes a separate --bump.
+
+          Examples: "patch",  "minor", "major", "stable", "minor alpha", "patch rc".
+
           From a stable version, prerelease segments (alpha, beta, rc, dev) must be combined with a release segment.
+
+          For project-type 'yarn': passed through verbatim as arguments to
+          `npm version <bump-rule words...>`, e.g. "patch" or "preminor --preid alpha".
         required: true
         type: string
       pre-release-base:
@@ -60,7 +70,10 @@ on:
         type: boolean
         default: true
       workspace-packages:
-        description: "Newline-separated uv workspace packages to mirror the version onto."
+        description: >
+          Newline-separated workspace packages to mirror the version onto: uv package
+          names for project-type 'uv', or paths relative to the repo root for
+          project-type 'yarn'.
         required: false
         type: string
         default: ""
@@ -75,7 +88,12 @@ on:
         type: string
         default: ""
       python-version:
-        description: "Python version to install via setup-uv."
+        description: "Python version to install via setup-uv. Also used to run towncrier (via uvx) for project-type 'yarn'."
+        required: false
+        type: string
+        default: ""
+      node-version:
+        description: "Node version to install via actions/setup-node. Only used for project-type 'yarn'."
         required: false
         type: string
         default: ""
@@ -167,10 +185,22 @@ jobs:
         with:
           python-version: ${{ inputs.python-version }}
 
+      - name: Setup Node
+        if: inputs.project-type == 'yarn'
+        uses: actions/setup-node@v7.0.0
+        with:
+          node-version: ${{ inputs.node-version }}
+
+      - name: Enable corepack
+        if: inputs.project-type == 'yarn'
+        shell: bash
+        run: corepack enable
+
       - name: Bump version
         id: bump
         uses: climate-resource/github-actions/bump-version@v1.4.3
         with:
+          project-type: ${{ inputs.project-type }}
           bump-rule: ${{ inputs.bump-rule }}
           pre-release-bump: ${{ inputs.pre-release-bump }}
           pre-release-base: ${{ inputs.pre-release-base }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 0000000..753d80d
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,34 @@
+name: Tests
+
+on:
+  pull_request:
+    paths:
+      - "**/*.py"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/tests.yml"
+  push:
+    branches:
+      - main
+    paths:
+      - "**/*.py"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/tests.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  pytest:
+    runs-on: gus-small
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6.0.2
+
+      - name: Setup uv
+        uses: ./setup-uv
+
+      - name: Run tests
+        shell: bash
+        run: uv run --group dev pytest
diff --git a/.gitignore b/.gitignore
index e43b0f9..007a5a1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,4 @@
 .DS_Store
+__pycache__/
+.pytest_cache/
+.venv/
diff --git a/bump-version/README.md b/bump-version/README.md
index 854598d..eed2857 100644
--- a/bump-version/README.md
+++ b/bump-version/README.md
@@ -1,32 +1,47 @@
 # bump-version
 
-Composite action that bumps a Python project's version with `uv version --bump`,
-updates the CHANGELOG via towncrier, commits, tags, pushes, and (by default)
-lands a follow-up commit that moves `main` onto a pre-release version so future commits don't share the tagged version.
+Composite action that bumps a project's version, updates the CHANGELOG via
+towncrier, commits, tags, pushes, and (by default) lands a follow-up commit that
+moves the branch onto a pre-release version so future commits don't share the
+tagged version.
 
-## Prerequisites
+Two project types are supported, selected with `project-type`:
+
+| `project-type` | Version lives in | Bumped with |
+| --- | --- | --- |
+| `uv` (default) | `pyproject.toml` | `uv version --bump` |
+| `yarn` | `package.json` | `npm version` |
+
+For `yarn`, `npm version` is used purely as a version-bumping CLI — yarn remains
+the package manager and owns the lockfile.
 
-The action assumes:
+The logic lives in [`bump.py`](bump.py), which `action.yml` invokes with
+`uv run --script`. Its unit tests are in [`../tests/test_bump.py`](../tests/test_bump.py).
 
-- `uv` is on PATH (use [`setup-uv`](../setup-uv) before this action).
+## Prerequisites
+
+- **`uv` is on PATH for both project types** (use [`setup-uv`](../setup-uv)
+  before this action). It runs the script itself, so it is required even for
+  `project-type: yarn`, where it also provides towncrier via `uvx`.
+- For `project-type: yarn`, `node`, `npm` and `yarn` must be on PATH (use
+  `actions/setup-node` and `corepack enable`).
 - The checked-out repo has full history (`fetch-depth: 0`).
-  The default  `GITHUB_TOKEN` is sufficient to push the bump commit and tag.
+  The default `GITHUB_TOKEN` is sufficient to push the bump commit and tag.
   Check out with a PAT only when branch protection blocks the `github-actions` bot,
   or when downstream workflows must fire from the tag push (a push made with `GITHUB_TOKEN` does not trigger other workflows).
-- The project's `pyproject.toml` is managed by `uv` (i.e. `uv version --short` returns the current version).
-- `towncrier` is available via `uv run` when `update-changelog: true` (the default).
 
 ## Inputs
 
 | Input | Default | Description |
 | --- | --- | --- |
-| `bump-rule` | _required_ | Whitespace-separated list of segments passed to `uv version --bump`. Each segment becomes a separate `--bump`. Examples: `patch`, `minor`, `major`, `stable`, `minor alpha`, `patch rc`. From a stable version, prerelease segments (`alpha`, `beta`, `rc`, `dev`) must be combined with a release segment. |
-| `pre-release-bump` | `dev` | Pre-release segment for the second commit (`dev`, `alpha`, `beta`, `rc`). Use `none` to skip the second commit. |
-| `pre-release-base` | `patch` | Base bump applied before the pre-release segment in the second commit. Use `none` to add the pre-release marker without bumping the base. |
-| `update-changelog` | `true` | Run `uv run towncrier build` for the new version. |
+| `project-type` | `uv` | `uv` for a Python project, `yarn` for a Node project. |
+| `bump-rule` | _required_ | Whitespace-separated arguments describing the bump. For `uv`, each segment becomes a separate `--bump`: `patch`, `minor`, `major`, `stable`, `minor alpha`, `patch rc`. From a stable version, prerelease segments (`alpha`, `beta`, `rc`, `dev`) must be combined with a release segment. For `yarn`, passed verbatim to `npm version`: `patch`, `preminor --preid alpha`, `prerelease --preid rc`. |
+| `pre-release-bump` | `dev` | Pre-release segment for the second commit. For `uv`: `dev`, `alpha`, `beta`, `rc`. For `yarn`: verbatim `npm version` arguments, e.g. `--preid dev`. Use `none` to skip the second commit. |
+| `pre-release-base` | `patch` | Base bump applied before the pre-release segment in the second commit. For `uv`: a bump rule (`patch`, `minor`, `major`, …). For `yarn`: an `npm version` strategy word, e.g. `prepatch`. Use `none` to add the pre-release marker without bumping the base. |
+| `update-changelog` | `true` | Build the CHANGELOG with towncrier for the new version. |
 | `commit-email` | `ci-runner@climate-resource.invalid` | Author email for both commits. |
-| `workspace-packages` | _empty_ | Newline-separated workspace package names to mirror the version onto. |
-| `lock` | `true` | Run `uv lock` after each version change. |
+| `workspace-packages` | _empty_ | Newline-separated workspace packages to mirror the version onto. For `uv`: package names. For `yarn`: directory paths relative to the repo root, e.g. `apps/analysis-portal`. |
+| `lock` | `true` | Refresh the lockfile after each version change (`uv lock`, or `yarn install --mode=update-lockfile`). |
 | `pre-commit-command` | _empty_ | Shell command run after the changelog build and before each bump commit. Use it to regenerate version-derived files (e.g. an OpenAPI schema) so they stay in sync in the tagged commit. The command must succeed; a non-zero exit aborts the bump. |
 | `pre-commit-skip` | `false` | Pass `-n` to `git commit` to bypass pre-commit hooks. |
 | `push` | `true` | Push the bump commit, tag, and pre-release commit. |
@@ -38,27 +53,40 @@ The action assumes:
 | `base-version` | Version before the bump. |
 | `new-version` | Tagged version (no `v` prefix). |
 | `tag` | New git tag, with `v` prefix. |
-| `dev-version` | Pre-release version landed on `main` after tagging (when applicable). |
-| `is-prerelease` | `'true'` when the tagged version matches `(a\|b\|rc\|dev)`. Use to gate downstream release steps. |
+| `dev-version` | Pre-release version landed on the branch after tagging (when applicable). |
+| `is-prerelease` | `'true'` when the tagged version is a pre-release. Use to gate downstream release steps. |
+
+`base-version`, `new-version`, `tag` and `is-prerelease` are written as soon as
+the release is tagged, so they remain available to later steps even if the
+pre-release commit fails.
 
 ## Behaviour
 
-1. Reads the current version (`BASE_VERSION = uv version --short`).
-2. `uv version --frozen --bump <bump-rule>` to obtain `NEW_VERSION`.
-3. Mirrors `NEW_VERSION` to each `workspace-packages` entry.
-4. If `update-changelog: true`, runs
-   `uv run towncrier build --yes --version v$NEW_VERSION`.
-5. Optionally `uv lock`.
-6. If `pre-commit-command` is set, runs it (so version-derived files are
-   regenerated before the commit).
-7. `git commit -a -m "bump: version $BASE_VERSION -> $NEW_VERSION"`.
-8. `git tag v$NEW_VERSION`.
-9. Pushes the commit and tag.
-10. If `pre-release-bump != none` and the tagged version is not already a
-    pre-release, applies `pre-release-base` (default `patch`) then
-    `pre-release-bump` (default `dev`), mirrors workspace packages, locks, runs
-    `pre-commit-command` again, and creates a `bump(<pre-release-bump>): ...`
-    commit which is pushed.
+**Phase 1 — tag the release**
+
+1. Read the current version (`base-version`).
+2. Apply `bump-rule` to the root project to obtain `new-version`.
+3. Mirror `new-version` onto each `workspace-packages` entry.
+4. Refresh the lockfile, if `lock: true`.
+5. Build the CHANGELOG with towncrier, if `update-changelog: true`.
+6. Run `pre-commit-command`, if set.
+7. `git commit -a -m "bump: version <base-version> -> <new-version>"`.
+8. `git tag v<new-version>`, then push the commit and tag if `push: true`.
+
+**Phase 2 — land the pre-release**
+
+Skipped entirely when `pre-release-bump: none`, or when the tagged version is
+already a pre-release. Otherwise it applies `pre-release-base` then
+`pre-release-bump`, repeats the mirror / lock / `pre-commit-command` steps, and
+creates a `bump(<label>): ...` commit which is pushed.
+
+The `<label>` scope is the pre-release identifier, not the raw input. For `uv`
+that is the `pre-release-bump` word itself (`bump(dev)`); for `yarn` it is read
+back off the version `npm version` produced, so `--preid dev` landing on
+`1.2.5-dev.0` gives `bump(dev)` rather than `bump(--preid dev)`.
+
+Pre-release detection is version-scheme aware: PEP 440 for `uv` (via
+`packaging`), semver for `yarn`.
 
 ## Example
 
@@ -71,3 +99,39 @@ The action assumes:
       bookshelf
       bookshelf-producer
 ```
+
+A Node project needs Node on PATH as well as uv:
+
+```yaml
+- uses: climate-resource/github-actions/setup-uv@v1
+- uses: actions/setup-node@v7.0.0
+  with:
+    node-version: "22"
+- run: corepack enable
+  shell: bash
+- uses: climate-resource/github-actions/bump-version@v1
+  with:
+    project-type: yarn
+    bump-rule: patch
+    pre-release-base: prepatch
+    pre-release-bump: --preid dev
+    workspace-packages: |
+      apps/analysis-portal
+```
+
+## Developing
+
+The script is a self-contained [PEP 723](https://peps.python.org/pep-0723/)
+script, so it can be run directly against a scratch repository:
+
+```bash
+cd /path/to/a/throwaway/clone
+PROJECT_TYPE=uv BUMP_RULE=patch UPDATE_CHANGELOG=false DO_PUSH=false \
+  uv run --script /path/to/github-actions/bump-version/bump.py
+```
+
+Unit tests cover argument assembly, pre-release detection and input parsing:
+
+```bash
+uv run --group dev pytest
+```
diff --git a/bump-version/action.yml b/bump-version/action.yml
index 7c65bfc..0428bbf 100644
--- a/bump-version/action.yml
+++ b/bump-version/action.yml
@@ -1,32 +1,56 @@
 name: "Bump version"
 description: >
-  Bump a Python project's version using `uv version --bump`, 
+  Bump a Python (uv) or Node/yarn project's version,
   update the CHANGELOG via towncrier, commit, tag, push,
   and optionally land a second commit bumping main onto a pre-release version.
 
 inputs:
+  project-type:
+    description: >
+      Kind of project to bump: 'uv' (Python, pyproject.toml via `uv version`) or
+      'yarn' (Node, package.json via `npm version` — used purely as a version-bumping
+      CLI, not as the package manager).
+    required: false
+    default: "uv"
   bump-rule:
     description: >
-      Whitespace-separated list of segments passed to `uv version --bump`.
-      Each segment becomes a separate `--bump <segment>` argument, 
-      so values like `patch`, `minor`, `major`, `stable`, `minor alpha`, `patch rc`, or `major beta` are all valid. 
-      uv requires a release component (patch, minor, major, stable) alongside any prerelease segment (alpha, beta, rc, dev) when the current version is a stable release.
+      Whitespace-separated arguments describing the bump.
+
+      For project-type 'uv', each segment becomes a separate `--bump <segment>`
+      argument to `uv version --bump`, so values like `patch`, `minor`, `major`,
+      `stable`, `minor alpha`, `patch rc`, or `major beta` are all valid. uv requires
+      a release component (patch, minor, major, stable) alongside any prerelease
+      segment (alpha, beta, rc, dev) when the current version is a stable release.
+
+      For project-type 'yarn', the value is passed through verbatim as arguments to
+      `npm version <bump-rule words...> --no-git-tag-version`, e.g. `patch`,
+      `preminor --preid alpha`, or `prerelease --preid rc`. The caller is responsible
+      for passing a combination that is valid for the current version; invalid
+      combinations simply fail the `npm version` call.
     required: true
   pre-release-bump:
     description: >
-      Pre-release segment to bump main to after tagging, so future commits do not share the tagged version. 
-      
-      One of: dev, alpha, beta, rc, none.
-      
+      Segment(s) appended after pre-release-base to bump main to a pre-release after
+      tagging, so future commits do not share the tagged version.
+
+      For project-type 'uv': one of dev, alpha, beta, rc, none.
+
+      For project-type 'yarn': verbatim `npm version` arguments (e.g. `--preid dev`),
+      or 'none'.
+
       Use 'none' to skip the second commit.
     required: false
     default: "dev"
   pre-release-base:
     description: >
-      Bump rule applied to the base version before adding the pre-release
-      segment in the second commit. Defaults to 'patch'. 
-      
-      Use 'none' to skip bumping the base (only add the pre-release segment).
+      Segment(s) applied before pre-release-bump in the second commit.
+
+      For project-type 'uv': a bump rule (patch, minor, major, ...), defaults to 'patch'.
+
+      For project-type 'yarn': a verbatim `npm version` strategy word (e.g. `prepatch`),
+      combined with pre-release-bump's arguments in the same `npm version` call.
+
+      Use 'none' to skip the base and only apply pre-release-bump.
     required: false
     default: "patch"
   update-changelog:
@@ -39,20 +63,28 @@ inputs:
     default: "ci-runner@climate-resource.invalid"
   workspace-packages:
     description: >
-      Optional newline-separated list of uv workspace package names to mirror
-      the bumped version onto (in addition to the root project).
+      Optional newline-separated list of workspace packages to mirror the bumped
+      version onto (in addition to the root project).
+
+      For project-type 'uv': uv workspace package names.
+
+      For project-type 'yarn': paths (relative to the repo root) to the workspace
+      packages' directories, e.g. `apps/analysis-portal`.
     required: false
     default: ""
   lock:
-    description: "If 'true', run `uv lock` after each version change."
+    description: >
+      If 'true', refresh the lockfile after each version change
+      (`uv lock` for project-type 'uv', `yarn install --mode=update-lockfile` for
+      project-type 'yarn').
     required: false
     default: "true"
   pre-commit-command:
     description: >
-      Optional shell command run after the changelog build and before each bump commit. 
-      
-      Use it to regenerate version-derived files (e.g. an OpenAPI schema) so they stay in sync in the tagged commit. 
-      The commit uses `git commit -a`, so any files the command regenerates are picked up automatically. 
+      Optional shell command run after the changelog build and before each bump commit.
+
+      Use it to regenerate version-derived files (e.g. an OpenAPI schema) so they stay in sync in the tagged commit.
+      The commit uses `git commit -a`, so any files the command regenerates are picked up automatically.
       The command must succeed; a non-zero exit aborts the bump.
     required: false
     default: ""
@@ -64,11 +96,6 @@ inputs:
     description: "If 'true', push the bump commit, tag, and pre-release commit."
     required: false
     default: "true"
-  submodules:
-    description: "Check out submodules. Default: '' (don't check out submodules), Options: 'true', 'recursive'"
-    required: false
-    type: string
-    default: ''
 
 outputs:
   base-version:
@@ -100,6 +127,7 @@ runs:
       id: bump
       shell: bash
       env:
+        PROJECT_TYPE: ${{ inputs.project-type }}
         BUMP_RULE: ${{ inputs.bump-rule }}
         PRE_RELEASE_BUMP: ${{ inputs.pre-release-bump }}
         PRE_RELEASE_BASE: ${{ inputs.pre-release-base }}
@@ -109,129 +137,7 @@ runs:
         PRE_COMMIT_COMMAND: ${{ inputs.pre-commit-command }}
         COMMIT_SKIP_HOOKS: ${{ inputs.pre-commit-skip }}
         DO_PUSH: ${{ inputs.push }}
-        SUBMODULES: ${{ inputs.submodules }}
-      run: |
-        set -euo pipefail -x
-
-        if [[ "${SUBMODULES}" == "recursive" ]]; then
-          echo "Checking out submoules recursively"
-          git submodules update --init --recursive
-        elif [[ "${SUBMODULES}" == "true" ]]; then
-          echo "Checking out submoules"
-          git submodules update --init
-        elif [[ "${SUBMODULES}" != "" ]]; then
-          echo "Invalid submodules option '${SUBMODULES}'" >&2
-          exit 1
-        fi
-
-        commit_args=()
-        if [[ "${COMMIT_SKIP_HOOKS}" == "true" ]]; then
-          commit_args+=(-n)
-        fi
-
-        mirror_workspace() {
-          local version="$1"
-          if [[ -z "${WORKSPACE_PACKAGES//[[:space:]]/}" ]]; then
-            return 0
-          fi
-          while IFS= read -r pkg; do
-            pkg="${pkg// /}"
-            [[ -z "${pkg}" ]] && continue
-            echo "Mirroring version ${version} onto workspace package ${pkg}"
-            uv version --frozen --package "${pkg}" "${version}"
-          done <<< "${WORKSPACE_PACKAGES}"
-        }
-
-        maybe_lock() {
-          if [[ "${RUN_LOCK}" == "true" ]]; then
-            uv lock
-          fi
-        }
-
-        run_pre_commit_command() {
-          if [[ -n "${PRE_COMMIT_COMMAND}" ]]; then
-            echo "Running pre-commit command"
-            bash -c "${PRE_COMMIT_COMMAND}"
-          fi
-        }
-
-        BASE_VERSION="$(uv version --short)"
-        echo "Bumping from version ${BASE_VERSION}"
-
-        read -r -a bump_segments <<< "${BUMP_RULE}"
-        if [[ ${#bump_segments[@]} -eq 0 ]]; then
-          echo "bump-rule must not be empty" >&2
-          exit 1
-        fi
-        bump_cli_args=()
-        for seg in "${bump_segments[@]}"; do
-          bump_cli_args+=(--bump "${seg}")
-        done
-
-        uv version --frozen "${bump_cli_args[@]}"
-        NEW_VERSION="$(uv version --short)"
-        echo "Bumped to version ${NEW_VERSION}"
-
-        mirror_workspace "${NEW_VERSION}"
-        maybe_lock
-
-        if [[ "${UPDATE_CHANGELOG}" == "true" ]]; then
-          uv run towncrier build --yes --version "v${NEW_VERSION}"
-        else
-          echo "Skipping changelog update"
-        fi
-
-        run_pre_commit_command
-
-        git commit "${commit_args[@]}" -a -m "bump: version ${BASE_VERSION} -> ${NEW_VERSION}"
-        git tag "v${NEW_VERSION}"
-
-        if [[ "${DO_PUSH}" == "true" ]]; then
-          git push
-          git push --tags
-        fi
-
-        if [[ "${NEW_VERSION}" =~ (a|b|rc|dev) ]]; then
-          IS_PRERELEASE="true"
-        else
-          IS_PRERELEASE="false"
-        fi
-
-        echo "base-version=${BASE_VERSION}" >> "${GITHUB_OUTPUT}"
-        echo "new-version=${NEW_VERSION}" >> "${GITHUB_OUTPUT}"
-        echo "tag=v${NEW_VERSION}" >> "${GITHUB_OUTPUT}"
-        echo "is-prerelease=${IS_PRERELEASE}" >> "${GITHUB_OUTPUT}"
-
-        # Skip the dev bump if the tagged version is already a pre-release or
-        # the caller opted out.
-        if [[ "${PRE_RELEASE_BUMP}" == "none" ]]; then
-          echo "Skipping pre-release bump (pre-release-bump=none)"
-          exit 0
-        fi
-        if [[ "${IS_PRERELEASE}" == "true" ]]; then
-          echo "Skipping pre-release bump; tagged version is already a pre-release"
-          exit 0
-        fi
-
-        PREV_VERSION="${NEW_VERSION}"
-        bump_args=()
-        if [[ "${PRE_RELEASE_BASE}" != "none" ]]; then
-          bump_args+=(--bump "${PRE_RELEASE_BASE}")
-        fi
-        bump_args+=(--bump "${PRE_RELEASE_BUMP}")
-        uv version --frozen "${bump_args[@]}"
-
-        DEV_VERSION="$(uv version --short)"
-        echo "Bumping main onto pre-release ${PREV_VERSION} > ${DEV_VERSION}"
-
-        mirror_workspace "${DEV_VERSION}"
-        maybe_lock
-        run_pre_commit_command
-
-        git commit "${commit_args[@]}" -a -m "bump(${PRE_RELEASE_BUMP}): version ${PREV_VERSION} > ${DEV_VERSION}"
-
-        if [[ "${DO_PUSH}" == "true" ]]; then
-          git push
-        fi
-
-        echo "dev-version=${DEV_VERSION}" >> "${GITHUB_OUTPUT}"
+      # The logic lives in bump.py so it gets syntax highlighting, linting and
+      # unit tests. `uv run --script` provisions its interpreter and
+      # dependencies from the PEP 723 header in that file.
+      run: uv run --script "${GITHUB_ACTION_PATH}/bump.py"
diff --git a/bump-version/bump.py b/bump-version/bump.py
new file mode 100755
index 0000000..ff7c7d8
--- /dev/null
+++ b/bump-version/bump.py
@@ -0,0 +1,437 @@
+#!/usr/bin/env -S uv run --script
+# /// script
+# requires-python = ">=3.13"
+# dependencies = ["packaging>=24.0"]
+# ///
+"""Bump a project's version, update the CHANGELOG, commit, tag and push.
+
+Run by the `bump-version` composite action. Every setting arrives as an
+environment variable mapped from an action input, so `action.yml` stays a
+declaration of the interface and this file holds the behaviour.
+
+The work happens in two phases:
+
+1. `tag_release` bumps the version, mirrors it onto workspace packages, builds
+   the changelog, commits and tags it, and pushes.
+2. `land_prerelease` optionally lands a second commit moving the branch onto a
+   pre-release version, so later commits do not share the tagged version.
+
+Everything that differs between project types lives behind `Backend`; the two
+phases themselves never branch on the project type.
+"""
+
+import os
+import shlex
+import subprocess
+import sys
+from collections.abc import Generator, Sequence
+from contextlib import contextmanager
+from dataclasses import dataclass
+from typing import Protocol, Self
+
+from packaging.version import InvalidVersion, Version
+
+# Sentinel accepted by pre-release-base and pre-release-bump to skip that part
+# of the second commit.
+NONE = "none"
+
+
+class BumpError(Exception):
+    """A failure that should end the action with a readable message."""
+
+
+# --------------------------------------------------------------------------
+# Process plumbing
+# --------------------------------------------------------------------------
+
+
+def log(message: str) -> None:
+    print(message, flush=True)
+
+
+@contextmanager
+def group(title: str) -> Generator[None]:
+    """Fold a phase of the run into a collapsible section of the Actions log."""
+    log(f"::group::{title}")
+    try:
+        yield
+    finally:
+        log("::endgroup::")
+
+
+def run(command: Sequence[str], *, capture: bool = False) -> str:
+    """Run `command`, echoing it first so the log shows what was executed.
+
+    With `capture`, stdout is returned instead of being written to the log;
+    stderr always flows straight through so failures stay visible.
+    """
+    log(f"+ {shlex.join(command)}")
+    try:
+        result = subprocess.run(
+            command,
+            check=True,
+            text=True,
+            stdout=subprocess.PIPE if capture else None,
+        )
+    except FileNotFoundError as error:
+        raise BumpError(f"command not found: {command[0]}") from error
+    except subprocess.CalledProcessError as error:
+        if error.stdout:
+            log(error.stdout)
+        raise BumpError(
+            f"command failed with exit code {error.returncode}: {shlex.join(command)}"
+        ) from error
+    return (result.stdout or "").strip()
+
+
+def write_output(name: str, value: str) -> None:
+    """Publish a step output for downstream steps to consume."""
+    output_file = os.environ.get("GITHUB_OUTPUT")
+    if not output_file:
+        # Running outside Actions (e.g. a local dry run); just show the value.
+        log(f"[output] {name}={value}")
+        return
+    with open(output_file, "a", encoding="utf-8") as handle:
+        handle.write(f"{name}={value}\n")
+
+
+# --------------------------------------------------------------------------
+# Project-type backends
+# --------------------------------------------------------------------------
+
+
+class Backend(Protocol):
+    """The project-type-specific half of a bump.
+
+    The `*_command` methods build argument lists without running anything,
+    which keeps the argument assembly (where the fiddly cases live) directly
+    testable.
+    """
+
+    name: str
+
+    def read_version(self) -> str:
+        """Return the project's current version."""
+
+    def bump_command(self, segments: Sequence[str]) -> list[str]:
+        """Build the command applying `bump-rule` segments to the root project."""
+
+    def prerelease_command(self, base: str, bump: str) -> list[str]:
+        """Build the command applying the post-tag pre-release bump."""
+
+    def workspace_command(self, package: str, version: str) -> list[str]:
+        """Build the command pinning a workspace package to `version`."""
+
+    def lock_command(self) -> list[str]:
+        """Build the command refreshing the lockfile."""
+
+    def changelog_command(self, version: str) -> list[str]:
+        """Build the towncrier command assembling the CHANGELOG."""
+
+    def is_prerelease(self, version: str) -> bool:
+        """Return whether `version` is a pre-release."""
+
+    def prerelease_label(self, requested: str, version: str) -> str:
+        """Return the scope for the second commit's `bump(...)` message.
+
+        `requested` is the raw `pre-release-bump` input and `version` the
+        pre-release it produced, so a backend can use whichever reads better.
+        """
+
+
+class UvBackend:
+    """Python projects whose version lives in `pyproject.toml`, managed by uv."""
+
+    name = "uv"
+
+    def read_version(self) -> str:
+        return run(["uv", "version", "--short"], capture=True)
+
+    def bump_command(self, segments: Sequence[str]) -> list[str]:
+        command = ["uv", "version", "--frozen"]
+        for segment in segments:
+            command += ["--bump", segment]
+        return command
+
+    def prerelease_command(self, base: str, bump: str) -> list[str]:
+        # Each of base and bump is a single uv bump segment, never a word list.
+        segments = [] if base == NONE else [base]
+        segments.append(bump)
+        return self.bump_command(segments)
+
+    def workspace_command(self, package: str, version: str) -> list[str]:
+        return ["uv", "version", "--frozen", "--package", package, version]
+
+    def lock_command(self) -> list[str]:
+        return ["uv", "lock"]
+
+    def changelog_command(self, version: str) -> list[str]:
+        return ["uv", "run", "towncrier", "build", "--yes", "--version", f"v{version}"]
+
+    def is_prerelease(self, version: str) -> bool:
+        try:
+            # Covers alpha, beta, rc and dev releases in one check.
+            return Version(version).is_prerelease
+        except InvalidVersion as error:
+            raise BumpError(f"'{version}' is not a valid PEP 440 version") from error
+
+    def prerelease_label(self, requested: str, version: str) -> str:
+        # The input is already a single readable word: dev, alpha, beta, rc.
+        return requested
+
+
+class YarnBackend:
+    """Node projects whose version lives in `package.json`.
+
+    `npm version` is used purely as a version-bumping CLI; yarn stays the
+    package manager.
+    """
+
+    name = "yarn"
+
+    def read_version(self) -> str:
+        return run(["node", "-p", "require('./package.json').version"], capture=True)
+
+    def bump_command(self, segments: Sequence[str]) -> list[str]:
+        return ["npm", "version", *segments, "--no-git-tag-version"]
+
+    def prerelease_command(self, base: str, bump: str) -> list[str]:
+        # Both values are verbatim `npm version` arguments, so they are split
+        # into words and concatenated into a single call.
+        segments = [] if base == NONE else base.split()
+        segments += bump.split()
+        return self.bump_command(segments)
+
+    def workspace_command(self, package: str, version: str) -> list[str]:
+        return ["npm", "version", "--no-git-tag-version", "--prefix", package, version]
+
+    def lock_command(self) -> list[str]:
+        return ["yarn", "install", "--mode=update-lockfile"]
+
+    def changelog_command(self, version: str) -> list[str]:
+        # No project virtualenv to run towncrier from, so fetch it on the fly.
+        return ["uvx", "towncrier", "build", "--yes", "--version", f"v{version}"]
+
+    def is_prerelease(self, version: str) -> bool:
+        # In semver the pre-release is the `-...` part, which build metadata
+        # (`+...`) may itself contain, so drop the metadata before looking.
+        return "-" in version.split("+", 1)[0]
+
+    def prerelease_label(self, requested: str, version: str) -> str:
+        # The input is a list of npm arguments, so `bump(--preid dev)` would be
+        # a poor commit scope. Read the identifier back off the version npm
+        # produced instead: 1.2.5-dev.0 -> dev.
+        _, _, prerelease = version.split("+", 1)[0].partition("-")
+        for identifier in prerelease.split("."):
+            if identifier and not identifier.isdigit():
+                return identifier
+        # npm was asked for a bare `prerelease` with no --preid, giving a
+        # numeric-only identifier such as 1.2.4-0.
+        return "prerelease"
+
+
+BACKENDS: dict[str, type[Backend]] = {"uv": UvBackend, "yarn": YarnBackend}
+
+
+# --------------------------------------------------------------------------
+# Configuration
+# --------------------------------------------------------------------------
+
+
+def as_bool(value: str) -> bool:
+    return value.strip().lower() == "true"
+
+
+def as_lines(value: str) -> tuple[str, ...]:
+    return tuple(line.strip() for line in value.splitlines() if line.strip())
+
+
+@dataclass(frozen=True)
+class Config:
+    project_type: str
+    bump_rule: str
+    pre_release_bump: str
+    pre_release_base: str
+    update_changelog: bool
+    workspace_packages: tuple[str, ...]
+    run_lock: bool
+    pre_commit_command: str
+    commit_skip_hooks: bool
+    do_push: bool
+
+    @classmethod
+    def from_env(cls, env: dict[str, str] | None = None) -> Self:
+        source = os.environ if env is None else env
+
+        def get(name: str, default: str = "") -> str:
+            return source.get(name, default)
+
+        return cls(
+            project_type=get("PROJECT_TYPE", "uv").strip(),
+            bump_rule=get("BUMP_RULE"),
+            pre_release_bump=get("PRE_RELEASE_BUMP", "dev").strip(),
+            pre_release_base=get("PRE_RELEASE_BASE", "patch").strip(),
+            update_changelog=as_bool(get("UPDATE_CHANGELOG", "true")),
+            workspace_packages=as_lines(get("WORKSPACE_PACKAGES")),
+            run_lock=as_bool(get("RUN_LOCK", "true")),
+            pre_commit_command=get("PRE_COMMIT_COMMAND").strip(),
+            commit_skip_hooks=as_bool(get("COMMIT_SKIP_HOOKS", "false")),
+            do_push=as_bool(get("DO_PUSH", "true")),
+        )
+
+    @property
+    def bump_segments(self) -> list[str]:
+        return self.bump_rule.split()
+
+    def backend(self) -> Backend:
+        if self.project_type not in BACKENDS:
+            raise BumpError(
+                f"project-type must be one of {', '.join(sorted(BACKENDS))}, "
+                f"got '{self.project_type}'"
+            )
+        if not self.bump_segments:
+            raise BumpError("bump-rule must not be empty")
+        return BACKENDS[self.project_type]()
+
+
+# --------------------------------------------------------------------------
+# Shared steps
+# --------------------------------------------------------------------------
+
+
+def mirror_workspace(config: Config, backend: Backend, version: str) -> None:
+    for package in config.workspace_packages:
+        log(f"Mirroring version {version} onto workspace package {package}")
+        run(backend.workspace_command(package, version), capture=True)
+
+
+def refresh_lock(config: Config, backend: Backend) -> None:
+    if not config.run_lock:
+        return
+    run(backend.lock_command())
+
+
+def run_pre_commit_command(config: Config) -> None:
+    if not config.pre_commit_command:
+        return
+    log("Running pre-commit command")
+    run(["bash", "-c", config.pre_commit_command])
+
+
+def commit(config: Config, message: str) -> None:
+    command = ["git", "commit"]
+    if config.commit_skip_hooks:
+        command.append("-n")
+    command += ["-a", "-m", message]
+    run(command)
+
+
+# --------------------------------------------------------------------------
+# Phases
+# --------------------------------------------------------------------------
+
+
+@dataclass(frozen=True)
+class Release:
+    base_version: str
+    new_version: str
+    is_prerelease: bool
+
+
+def tag_release(config: Config, backend: Backend) -> Release:
+    """Bump the version, build the changelog, then commit, tag and push."""
+    base_version = backend.read_version()
+    log(f"Bumping from version {base_version}")
+
+    with group("Bump version"):
+        run(backend.bump_command(config.bump_segments))
+        new_version = backend.read_version()
+        log(f"Bumped to version {new_version}")
+        mirror_workspace(config, backend, new_version)
+        refresh_lock(config, backend)
+
+    with group("Update changelog"):
+        if config.update_changelog:
+            run(backend.changelog_command(new_version))
+        else:
+            log("Skipping changelog update")
+
+    with group("Commit and tag"):
+        run_pre_commit_command(config)
+        commit(config, f"bump: version {base_version} -> {new_version}")
+        run(["git", "tag", f"v{new_version}"])
+        if config.do_push:
+            run(["git", "push"])
+            run(["git", "push", "--tags"])
+
+    return Release(
+        base_version=base_version,
+        new_version=new_version,
+        is_prerelease=backend.is_prerelease(new_version),
+    )
+
+
+def land_prerelease(config: Config, backend: Backend, release: Release) -> str | None:
+    """Land a second commit moving the branch onto a pre-release version.
+
+    Returns the new pre-release version, or None when the bump was skipped.
+    """
+    if config.pre_release_bump == NONE:
+        log("Skipping pre-release bump (pre-release-bump=none)")
+        return None
+    if release.is_prerelease:
+        log("Skipping pre-release bump; tagged version is already a pre-release")
+        return None
+
+    with group("Bump onto pre-release"):
+        run(
+            backend.prerelease_command(config.pre_release_base, config.pre_release_bump)
+        )
+        dev_version = backend.read_version()
+        log(f"Bumping main onto pre-release {release.new_version} > {dev_version}")
+
+        mirror_workspace(config, backend, dev_version)
+        refresh_lock(config, backend)
+        run_pre_commit_command(config)
+
+        label = backend.prerelease_label(config.pre_release_bump, dev_version)
+        commit(
+            config,
+            f"bump({label}): version {release.new_version} > {dev_version}",
+        )
+        if config.do_push:
+            run(["git", "push"])
+
+    return dev_version
+
+
+# --------------------------------------------------------------------------
+# Entry point
+# --------------------------------------------------------------------------
+
+
+def main() -> int:
+    try:
+        config = Config.from_env()
+        backend = config.backend()
+
+        release = tag_release(config, backend)
+
+        # Published before the pre-release phase so a failure there still
+        # leaves the tagged release's outputs available to later steps.
+        write_output("base-version", release.base_version)
+        write_output("new-version", release.new_version)
+        write_output("tag", f"v{release.new_version}")
+        write_output("is-prerelease", str(release.is_prerelease).lower())
+
+        dev_version = land_prerelease(config, backend, release)
+        if dev_version is not None:
+            write_output("dev-version", dev_version)
+    except BumpError as error:
+        log(f"::error::{error}")
+        return 1
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/changelog/27.feature.md b/changelog/27.feature.md
new file mode 100644
index 0000000..9fb2c6e
--- /dev/null
+++ b/changelog/27.feature.md
@@ -0,0 +1 @@
+Added support for `yarn` projects for the bump action using the new `project-type` input parameter.
diff --git a/changelog/27.fix.md b/changelog/27.fix.md
new file mode 100644
index 0000000..e383f75
--- /dev/null
+++ b/changelog/27.fix.md
@@ -0,0 +1 @@
+Fixed pre-release detection in `bump-version`, which matched a bare `a`, `b`, `rc` or `dev` anywhere in the version string. A version carrying a local segment such as `1.2.3+abc` was misread as a pre-release, silently skipping both the follow-up dev bump and the draft GitHub release. Detection is now version-scheme aware: PEP 440 for `project-type: uv`, semver for `project-type: yarn`.
diff --git a/changelog/27.improvement.md b/changelog/27.improvement.md
new file mode 100644
index 0000000..7fab9c3
--- /dev/null
+++ b/changelog/27.improvement.md
@@ -0,0 +1 @@
+Moved `bump-version`'s logic out of `action.yml` and into a self-contained `bump-version/bump.py`, run via `uv run --script`.
diff --git a/pyproject.toml b/pyproject.toml
index 554dee4..2d831f7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,13 +3,21 @@ name = "github-actions"
 version = "1.4.3"
 description = "Reusable GitHub Actions for Climate Resource"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.13"
 
 [dependency-groups]
 dev = [
     "towncrier>=23.6.0",
+    "packaging>=24.0",
+    "pytest>=8.0.0",
 ]
 
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+# tests/conftest.py loads bump-version/bump.py by path; importing it as
+# `from conftest import bump` needs the tests directory on sys.path.
+pythonpath = ["tests"]
+
 [tool.towncrier]
 filename = "CHANGELOG.md"
 directory = "changelog/"
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..2e05401
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,24 @@
+"""Load bump-version/bump.py by path.
+
+The repo is a collection of actions rather than an installable package, so the
+script is imported directly from its action directory.
+"""
+
+import importlib.util
+import sys
+from pathlib import Path
+from types import ModuleType
+
+BUMP_SCRIPT = Path(__file__).parents[1] / "bump-version" / "bump.py"
+
+
+def _load() -> ModuleType:
+    spec = importlib.util.spec_from_file_location("bump", BUMP_SCRIPT)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+bump = _load()
diff --git a/tests/test_bump.py b/tests/test_bump.py
new file mode 100644
index 0000000..ce9d18a
--- /dev/null
+++ b/tests/test_bump.py
@@ -0,0 +1,194 @@
+"""Unit tests for the bump-version script's decision logic.
+
+These cover the parts that decide *what* to run — argument assembly, version
+classification and input parsing — rather than the subprocess plumbing.
+"""
+
+import pytest
+
+from conftest import bump
+
+
+@pytest.fixture
+def uv() -> bump.UvBackend:
+    return bump.UvBackend()
+
+
+@pytest.fixture
+def yarn() -> bump.YarnBackend:
+    return bump.YarnBackend()
+
+
+class TestUvBumpCommands:
+    def test_single_segment(self, uv):
+        assert uv.bump_command(["patch"]) == [
+            "uv", "version", "--frozen", "--bump", "patch",
+        ]
+
+    def test_each_segment_becomes_its_own_bump_flag(self, uv):
+        assert uv.bump_command(["minor", "alpha"]) == [
+            "uv", "version", "--frozen", "--bump", "minor", "--bump", "alpha",
+        ]
+
+    def test_prerelease_applies_base_then_bump(self, uv):
+        assert uv.prerelease_command("patch", "dev") == [
+            "uv", "version", "--frozen", "--bump", "patch", "--bump", "dev",
+        ]
+
+    def test_prerelease_base_none_is_skipped(self, uv):
+        assert uv.prerelease_command("none", "dev") == [
+            "uv", "version", "--frozen", "--bump", "dev",
+        ]
+
+    def test_workspace_pins_exact_version(self, uv):
+        assert uv.workspace_command("bookshelf", "1.2.3") == [
+            "uv", "version", "--frozen", "--package", "bookshelf", "1.2.3",
+        ]
+
+    def test_changelog_uses_project_environment(self, uv):
+        assert uv.changelog_command("1.2.3") == [
+            "uv", "run", "towncrier", "build", "--yes", "--version", "v1.2.3",
+        ]
+
+
+class TestYarnBumpCommands:
+    def test_segments_pass_through_verbatim(self, yarn):
+        assert yarn.bump_command(["preminor", "--preid", "alpha"]) == [
+            "npm", "version", "preminor", "--preid", "alpha", "--no-git-tag-version",
+        ]
+
+    def test_prerelease_concatenates_base_and_bump_words(self, yarn):
+        assert yarn.prerelease_command("prepatch", "--preid dev") == [
+            "npm", "version", "prepatch", "--preid", "dev", "--no-git-tag-version",
+        ]
+
+    def test_prerelease_base_none_is_skipped(self, yarn):
+        assert yarn.prerelease_command("none", "prerelease --preid rc") == [
+            "npm", "version", "prerelease", "--preid", "rc", "--no-git-tag-version",
+        ]
+
+    def test_workspace_targets_package_directory(self, yarn):
+        assert yarn.workspace_command("apps/portal", "1.2.3") == [
+            "npm", "version", "--no-git-tag-version",
+            "--prefix", "apps/portal", "1.2.3",
+        ]
+
+    def test_changelog_fetches_towncrier_on_the_fly(self, yarn):
+        assert yarn.changelog_command("1.2.3") == [
+            "uvx", "towncrier", "build", "--yes", "--version", "v1.2.3",
+        ]
+
+
+class TestUvPrereleaseDetection:
+    @pytest.mark.parametrize(
+        "version", ["1.2.3a1", "1.2.3b2", "1.2.3rc1", "1.2.4.dev0", "2.0.0a0"]
+    )
+    def test_prerelease_versions(self, uv, version):
+        assert uv.is_prerelease(version) is True
+
+    @pytest.mark.parametrize("version", ["1.2.3", "0.1.0", "10.20.30"])
+    def test_stable_versions(self, uv, version):
+        assert uv.is_prerelease(version) is False
+
+    @pytest.mark.parametrize("version", ["1.2.3+abc", "1.2.3+build.5", "1.2.3+deb1"])
+    def test_local_version_segments_are_not_prereleases(self, uv, version):
+        # The previous shell implementation matched a bare `a`, `b`, `rc` or
+        # `dev` anywhere in the string, so these were misread as pre-releases
+        # and silently skipped both the dev bump and the GitHub release.
+        assert uv.is_prerelease(version) is False
+
+    def test_invalid_version_is_reported(self, uv):
+        with pytest.raises(bump.BumpError, match="not a valid PEP 440 version"):
+            uv.is_prerelease("not-a-version")
+
+
+class TestYarnPrereleaseDetection:
+    @pytest.mark.parametrize("version", ["1.2.3-alpha.0", "1.2.3-rc.1", "1.2.3-dev.0"])
+    def test_prerelease_versions(self, yarn, version):
+        assert yarn.is_prerelease(version) is True
+
+    @pytest.mark.parametrize("version", ["1.2.3", "0.1.0"])
+    def test_stable_versions(self, yarn, version):
+        assert yarn.is_prerelease(version) is False
+
+    def test_hyphen_in_build_metadata_is_not_a_prerelease(self, yarn):
+        assert yarn.is_prerelease("1.2.3+build-5") is False
+
+
+class TestPrereleaseLabel:
+    """The scope of the second commit's `bump(<label>): ...` message."""
+
+    @pytest.mark.parametrize(
+        ("requested", "version"),
+        [("dev", "1.2.5.dev1"), ("alpha", "1.3.0a1"), ("rc", "1.3.0rc1")],
+    )
+    def test_uv_uses_the_requested_word(self, uv, requested, version):
+        assert uv.prerelease_label(requested, version) == requested
+
+    @pytest.mark.parametrize(
+        ("requested", "version", "expected"),
+        [
+            ("--preid dev", "1.2.5-dev.0", "dev"),
+            ("prerelease --preid rc", "1.2.4-rc.0", "rc"),
+            ("--preid alpha", "2.0.0-alpha.12", "alpha"),
+        ],
+    )
+    def test_yarn_reads_the_identifier_off_the_version(
+        self, yarn, requested, version, expected
+    ):
+        # Using the raw input would give a scope like `bump(--preid dev)`.
+        assert yarn.prerelease_label(requested, version) == expected
+
+    def test_yarn_falls_back_when_no_preid_was_given(self, yarn):
+        assert yarn.prerelease_label("prerelease", "1.2.4-0") == "prerelease"
+
+    def test_yarn_ignores_build_metadata(self, yarn):
+        assert yarn.prerelease_label("--preid dev", "1.2.5-dev.0+build-7") == "dev"
+
+
+class TestConfig:
+    def test_defaults_match_the_action_inputs(self):
+        config = bump.Config.from_env({"BUMP_RULE": "patch"})
+        assert config.project_type == "uv"
+        assert config.pre_release_base == "patch"
+        assert config.pre_release_bump == "dev"
+        assert config.update_changelog is True
+        assert config.run_lock is True
+        assert config.do_push is True
+        assert config.commit_skip_hooks is False
+        assert config.workspace_packages == ()
+
+    def test_booleans_only_true_enables(self):
+        config = bump.Config.from_env(
+            {"BUMP_RULE": "patch", "UPDATE_CHANGELOG": "false", "DO_PUSH": "no"}
+        )
+        assert config.update_changelog is False
+        assert config.do_push is False
+
+    def test_workspace_packages_split_on_newlines(self):
+        config = bump.Config.from_env(
+            {"BUMP_RULE": "patch", "WORKSPACE_PACKAGES": "  one \n\n two\n"}
+        )
+        assert config.workspace_packages == ("one", "two")
+
+    def test_bump_rule_splits_on_whitespace(self):
+        config = bump.Config.from_env({"BUMP_RULE": " minor  alpha "})
+        assert config.bump_segments == ["minor", "alpha"]
+
+    def test_backend_selected_by_project_type(self):
+        uv_config = bump.Config.from_env({"BUMP_RULE": "patch"})
+        yarn_config = bump.Config.from_env(
+            {"BUMP_RULE": "patch", "PROJECT_TYPE": "yarn"}
+        )
+        assert isinstance(uv_config.backend(), bump.UvBackend)
+        assert isinstance(yarn_config.backend(), bump.YarnBackend)
+
+    def test_unknown_project_type_is_rejected(self):
+        config = bump.Config.from_env({"BUMP_RULE": "patch", "PROJECT_TYPE": "poetry"})
+        with pytest.raises(bump.BumpError, match="project-type must be one of"):
+            config.backend()
+
+    def test_empty_bump_rule_is_rejected(self):
+        config = bump.Config.from_env({"BUMP_RULE": "   "})
+        with pytest.raises(bump.BumpError, match="bump-rule must not be empty"):
+            config.backend()
diff --git a/uv.lock b/uv.lock
index c63c4d3..caa90f7 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,6 +1,18 @@
 version = 1
 revision = 3
-requires-python = ">=3.11"
+requires-python = ">=3.13"
+
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P7D"
+
+[options.exclude-newer-package]
+ndcs = false
+ndc-temperature-assessment = false
+ndc-tool-api = false
+ndc-api-v2 = false
+ndc-release = false
+ndc-quantification = false
 
 [[package]]
 name = "click"
@@ -30,13 +42,28 @@ source = { virtual = "." }
 
 [package.dev-dependencies]
 dev = [
+    { name = "packaging" },
+    { name = "pytest" },
     { name = "towncrier" },
 ]
 
 [package.metadata]
 
 [package.metadata.requires-dev]
-dev = [{ name = "towncrier", specifier = ">=23.6.0" }]
+dev = [
+    { name = "packaging", specifier = ">=24.0" },
+    { name = "pytest", specifier = ">=8.0.0" },
+    { name = "towncrier", specifier = ">=23.6.0" },
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
 
 [[package]]
 name = "jinja2"
@@ -56,28 +83,6 @@ version = "3.0.3"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/7e/99/7690b6d4034fffd95959cbe0c02de8deb3098cc577c67bb6a24fe5d7caa7/markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698", size = 80313, upload-time = "2025-09-27T18:37:40.426Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/08/db/fefacb2136439fc8dd20e797950e749aa1f4997ed584c62cfb8ef7c2be0e/markupsafe-3.0.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad", size = 11631, upload-time = "2025-09-27T18:36:18.185Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/2e/5898933336b61975ce9dc04decbc0a7f2fee78c30353c5efba7f2d6ff27a/markupsafe-3.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a", size = 12058, upload-time = "2025-09-27T18:36:19.444Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/09/adf2df3699d87d1d8184038df46a9c80d78c0148492323f4693df54e17bb/markupsafe-3.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50", size = 24287, upload-time = "2025-09-27T18:36:20.768Z" },
-    { url = "https://files.pythonhosted.org/packages/30/ac/0273f6fcb5f42e314c6d8cd99effae6a5354604d461b8d392b5ec9530a54/markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf", size = 22940, upload-time = "2025-09-27T18:36:22.249Z" },
-    { url = "https://files.pythonhosted.org/packages/19/ae/31c1be199ef767124c042c6c3e904da327a2f7f0cd63a0337e1eca2967a8/markupsafe-3.0.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f", size = 21887, upload-time = "2025-09-27T18:36:23.535Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/76/7edcab99d5349a4532a459e1fe64f0b0467a3365056ae550d3bcf3f79e1e/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a", size = 23692, upload-time = "2025-09-27T18:36:24.823Z" },
-    { url = "https://files.pythonhosted.org/packages/a4/28/6e74cdd26d7514849143d69f0bf2399f929c37dc2b31e6829fd2045b2765/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115", size = 21471, upload-time = "2025-09-27T18:36:25.95Z" },
-    { url = "https://files.pythonhosted.org/packages/62/7e/a145f36a5c2945673e590850a6f8014318d5577ed7e5920a4b3448e0865d/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a", size = 22923, upload-time = "2025-09-27T18:36:27.109Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/62/d9c46a7f5c9adbeeeda52f5b8d802e1094e9717705a645efc71b0913a0a8/markupsafe-3.0.3-cp311-cp311-win32.whl", hash = "sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19", size = 14572, upload-time = "2025-09-27T18:36:28.045Z" },
-    { url = "https://files.pythonhosted.org/packages/83/8a/4414c03d3f891739326e1783338e48fb49781cc915b2e0ee052aa490d586/markupsafe-3.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01", size = 15077, upload-time = "2025-09-27T18:36:29.025Z" },
-    { url = "https://files.pythonhosted.org/packages/35/73/893072b42e6862f319b5207adc9ae06070f095b358655f077f69a35601f0/markupsafe-3.0.3-cp311-cp311-win_arm64.whl", hash = "sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c", size = 13876, upload-time = "2025-09-27T18:36:29.954Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/72/147da192e38635ada20e0a2e1a51cf8823d2119ce8883f7053879c2199b5/markupsafe-3.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e", size = 11615, upload-time = "2025-09-27T18:36:30.854Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/81/7e4e08678a1f98521201c3079f77db69fb552acd56067661f8c2f534a718/markupsafe-3.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce", size = 12020, upload-time = "2025-09-27T18:36:31.971Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/2c/799f4742efc39633a1b54a92eec4082e4f815314869865d876824c257c1e/markupsafe-3.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d", size = 24332, upload-time = "2025-09-27T18:36:32.813Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/2e/8d0c2ab90a8c1d9a24f0399058ab8519a3279d1bd4289511d74e909f060e/markupsafe-3.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d", size = 22947, upload-time = "2025-09-27T18:36:33.86Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/54/887f3092a85238093a0b2154bd629c89444f395618842e8b0c41783898ea/markupsafe-3.0.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a", size = 21962, upload-time = "2025-09-27T18:36:35.099Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/2f/336b8c7b6f4a4d95e91119dc8521402461b74a485558d8f238a68312f11c/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b", size = 23760, upload-time = "2025-09-27T18:36:36.001Z" },
-    { url = "https://files.pythonhosted.org/packages/32/43/67935f2b7e4982ffb50a4d169b724d74b62a3964bc1a9a527f5ac4f1ee2b/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f", size = 21529, upload-time = "2025-09-27T18:36:36.906Z" },
-    { url = "https://files.pythonhosted.org/packages/89/e0/4486f11e51bbba8b0c041098859e869e304d1c261e59244baa3d295d47b7/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b", size = 23015, upload-time = "2025-09-27T18:36:37.868Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/e1/78ee7a023dac597a5825441ebd17170785a9dab23de95d2c7508ade94e0e/markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d", size = 14540, upload-time = "2025-09-27T18:36:38.761Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/5b/bec5aa9bbbb2c946ca2733ef9c4ca91c91b6a24580193e891b5f7dbe8e1e/markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c", size = 15105, upload-time = "2025-09-27T18:36:39.701Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/f1/216fc1bbfd74011693a4fd837e7026152e89c4bcf3e77b6692fba9923123/markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f", size = 13906, upload-time = "2025-09-27T18:36:40.689Z" },
     { url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
     { url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
     { url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
@@ -124,6 +129,49 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
 ]
 
+[[package]]
+name = "packaging"
+version = "26.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/fa/3944b40b07da9ce895c0e6303a5ab7d53da063554f534556b134a54d6093/packaging-26.3.tar.gz", hash = "sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79", size = 313412, upload-time = "2026-08-04T18:15:28.737Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/63/34/ba1c580383c9eada3711951fef0795c80b829a078d72188184bcab9dd527/packaging-26.3-py3-none-any.whl", hash = "sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c", size = 129956, upload-time = "2026-08-04T18:15:27.159Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
+]
+
 [[package]]
 name = "towncrier"
 version = "25.8.0"

From be5d5d65b588f9198029da626188f8def5ff3a37 Mon Sep 17 00:00:00 2001
From: Fuchsi* Huber <fuchsi.huber@climate-resource.com>
Date: Thu, 20 Aug 2026 22:13:50 +0200
Subject: [PATCH 2/3] chore: add github templates for PRs and releases

---
 .github/pull_request_template.md | 9 +++++++++
 .github/release_template.md      | 7 +++++++
 tests/test_bump.py               | 1 -
 3 files changed, 16 insertions(+), 1 deletion(-)
 create mode 100644 .github/pull_request_template.md
 create mode 100644 .github/release_template.md

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..7ff7065
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,9 @@
+## Description
+
+## Checklist
+
+Please confirm that this pull request has done the following:
+
+- [ ] Tests added
+- [ ] Documentation added (where applicable)
+- [ ] Changelog item added to `changelog/`
diff --git a/.github/release_template.md b/.github/release_template.md
new file mode 100644
index 0000000..c07018c
--- /dev/null
+++ b/.github/release_template.md
@@ -0,0 +1,7 @@
+## Announcements
+
+* Announcement 1
+
+## Changes
+
+* Change 1
diff --git a/tests/test_bump.py b/tests/test_bump.py
index ce9d18a..93dfc4b 100644
--- a/tests/test_bump.py
+++ b/tests/test_bump.py
@@ -5,7 +5,6 @@
 """
 
 import pytest
-
 from conftest import bump
 
 

From 3b0ee064992ef127f69cef1d80df46ab3945ca5f Mon Sep 17 00:00:00 2001
From: Fuchsi* Huber <fuchsi.huber@climate-resource.com>
Date: Fri, 21 Aug 2026 10:39:51 +0200
Subject: [PATCH 3/3] feature: added pnpm and npm project support to the bump
 script as well

---
 .github/workflows/bump.yaml |  23 +++++---
 bump-version/README.md      |  43 +++++++-------
 bump-version/action.yml     |  26 +++++----
 bump-version/bump.py        |  36 ++++++++++--
 changelog/27.feature.md     |   2 +-
 tests/test_bump.py          | 108 +++++++++++++++++++++++++-----------
 6 files changed, 160 insertions(+), 78 deletions(-)

diff --git a/.github/workflows/bump.yaml b/.github/workflows/bump.yaml
index 732373b..e5dd553 100644
--- a/.github/workflows/bump.yaml
+++ b/.github/workflows/bump.yaml
@@ -25,8 +25,11 @@ on:
     inputs:
       project-type:
         description: >
-          Kind of project to bump: 'uv' (Python) or 'yarn' (Node). See the bump-version
-          action for how bump-rule/pre-release-base/pre-release-bump differ per type.
+          Kind of project to bump, named after the package manager that owns the
+          lockfile: 'uv' (Python), or 'yarn' / 'npm' / 'pnpm' (Node). The Node types
+          behave identically apart from which lockfile is refreshed. See the
+          bump-version action for how bump-rule/pre-release-base/pre-release-bump
+          differ per type.
         required: false
         type: string
         default: "uv"
@@ -39,7 +42,7 @@ on:
 
           From a stable version, prerelease segments (alpha, beta, rc, dev) must be combined with a release segment.
 
-          For project-type 'yarn': passed through verbatim as arguments to
+          For the Node project types: passed through verbatim as arguments to
           `npm version <bump-rule words...>`, e.g. "patch" or "preminor --preid alpha".
         required: true
         type: string
@@ -72,8 +75,8 @@ on:
       workspace-packages:
         description: >
           Newline-separated workspace packages to mirror the version onto: uv package
-          names for project-type 'uv', or paths relative to the repo root for
-          project-type 'yarn'.
+          names for project-type 'uv', or paths relative to the repo root for the
+          Node project types.
         required: false
         type: string
         default: ""
@@ -88,12 +91,12 @@ on:
         type: string
         default: ""
       python-version:
-        description: "Python version to install via setup-uv. Also used to run towncrier (via uvx) for project-type 'yarn'."
+        description: "Python version to install via setup-uv. Also used to run towncrier (via uvx) for the Node project types."
         required: false
         type: string
         default: ""
       node-version:
-        description: "Node version to install via actions/setup-node. Only used for project-type 'yarn'."
+        description: "Node version to install via actions/setup-node. Only used for the Node project types."
         required: false
         type: string
         default: ""
@@ -186,13 +189,15 @@ jobs:
           python-version: ${{ inputs.python-version }}
 
       - name: Setup Node
-        if: inputs.project-type == 'yarn'
+        if: contains(fromJSON('["yarn", "npm", "pnpm"]'), inputs.project-type)
         uses: actions/setup-node@v7.0.0
         with:
           node-version: ${{ inputs.node-version }}
 
+      # corepack provisions yarn and pnpm from the project's packageManager
+      # field. npm ships with Node, so it needs nothing here.
       - name: Enable corepack
-        if: inputs.project-type == 'yarn'
+        if: contains(fromJSON('["yarn", "pnpm"]'), inputs.project-type)
         shell: bash
         run: corepack enable
 
diff --git a/bump-version/README.md b/bump-version/README.md
index eed2857..ee4178c 100644
--- a/bump-version/README.md
+++ b/bump-version/README.md
@@ -5,26 +5,31 @@ towncrier, commits, tags, pushes, and (by default) lands a follow-up commit that
 moves the branch onto a pre-release version so future commits don't share the
 tagged version.
 
-Two project types are supported, selected with `project-type`:
+`project-type` selects the backend, and is named after the package manager that
+owns the lockfile:
 
-| `project-type` | Version lives in | Bumped with |
-| --- | --- | --- |
-| `uv` (default) | `pyproject.toml` | `uv version --bump` |
-| `yarn` | `package.json` | `npm version` |
+| `project-type` | Version lives in | Bumped with | `lock: true` runs |
+| --- | --- | --- | --- |
+| `uv` (default) | `pyproject.toml` | `uv version --bump` | `uv lock` |
+| `yarn` | `package.json` | `npm version` | `yarn install --mode=update-lockfile` |
+| `npm` | `package.json` | `npm version` | `npm install --package-lock-only` |
+| `pnpm` | `package.json` | `npm version` | `pnpm install --lockfile-only` |
 
-For `yarn`, `npm version` is used purely as a version-bumping CLI — yarn remains
-the package manager and owns the lockfile.
+The three Node types behave identically apart from that last column. `npm
+version` is used purely as a version-bumping CLI — it ships with Node, and the
+package manager you named stays in charge of the lockfile.
 
 The logic lives in [`bump.py`](bump.py), which `action.yml` invokes with
 `uv run --script`. Its unit tests are in [`../tests/test_bump.py`](../tests/test_bump.py).
 
 ## Prerequisites
 
-- **`uv` is on PATH for both project types** (use [`setup-uv`](../setup-uv)
+- **`uv` is on PATH for all project types** (use [`setup-uv`](../setup-uv)
   before this action). It runs the script itself, so it is required even for
-  `project-type: yarn`, where it also provides towncrier via `uvx`.
-- For `project-type: yarn`, `node`, `npm` and `yarn` must be on PATH (use
-  `actions/setup-node` and `corepack enable`).
+  the Node project types, where it also provides towncrier via `uvx`.
+- For the Node project types, `node` and `npm` must be on PATH, plus `yarn` or
+  `pnpm` if `lock: true` (use `actions/setup-node`, and `corepack enable` for
+  yarn/pnpm).
 - The checked-out repo has full history (`fetch-depth: 0`).
   The default `GITHUB_TOKEN` is sufficient to push the bump commit and tag.
   Check out with a PAT only when branch protection blocks the `github-actions` bot,
@@ -34,14 +39,14 @@ The logic lives in [`bump.py`](bump.py), which `action.yml` invokes with
 
 | Input | Default | Description |
 | --- | --- | --- |
-| `project-type` | `uv` | `uv` for a Python project, `yarn` for a Node project. |
-| `bump-rule` | _required_ | Whitespace-separated arguments describing the bump. For `uv`, each segment becomes a separate `--bump`: `patch`, `minor`, `major`, `stable`, `minor alpha`, `patch rc`. From a stable version, prerelease segments (`alpha`, `beta`, `rc`, `dev`) must be combined with a release segment. For `yarn`, passed verbatim to `npm version`: `patch`, `preminor --preid alpha`, `prerelease --preid rc`. |
-| `pre-release-bump` | `dev` | Pre-release segment for the second commit. For `uv`: `dev`, `alpha`, `beta`, `rc`. For `yarn`: verbatim `npm version` arguments, e.g. `--preid dev`. Use `none` to skip the second commit. |
-| `pre-release-base` | `patch` | Base bump applied before the pre-release segment in the second commit. For `uv`: a bump rule (`patch`, `minor`, `major`, …). For `yarn`: an `npm version` strategy word, e.g. `prepatch`. Use `none` to add the pre-release marker without bumping the base. |
+| `project-type` | `uv` | `uv` for a Python project; `yarn`, `npm` or `pnpm` for a Node project. See the table above. |
+| `bump-rule` | _required_ | Whitespace-separated arguments describing the bump. For `uv`, each segment becomes a separate `--bump`: `patch`, `minor`, `major`, `stable`, `minor alpha`, `patch rc`. From a stable version, prerelease segments (`alpha`, `beta`, `rc`, `dev`) must be combined with a release segment. For the Node types, passed verbatim to `npm version`: `patch`, `preminor --preid alpha`, `prerelease --preid rc`. |
+| `pre-release-bump` | `dev` | Pre-release segment for the second commit. For `uv`: `dev`, `alpha`, `beta`, `rc`. For the Node types: verbatim `npm version` arguments, e.g. `--preid dev`. Use `none` to skip the second commit. |
+| `pre-release-base` | `patch` | Base bump applied before the pre-release segment in the second commit. For `uv`: a bump rule (`patch`, `minor`, `major`, …). For the Node types: an `npm version` strategy word, e.g. `prepatch`. Use `none` to add the pre-release marker without bumping the base. |
 | `update-changelog` | `true` | Build the CHANGELOG with towncrier for the new version. |
 | `commit-email` | `ci-runner@climate-resource.invalid` | Author email for both commits. |
-| `workspace-packages` | _empty_ | Newline-separated workspace packages to mirror the version onto. For `uv`: package names. For `yarn`: directory paths relative to the repo root, e.g. `apps/analysis-portal`. |
-| `lock` | `true` | Refresh the lockfile after each version change (`uv lock`, or `yarn install --mode=update-lockfile`). |
+| `workspace-packages` | _empty_ | Newline-separated workspace packages to mirror the version onto. For `uv`: package names. For the Node types: directory paths relative to the repo root, e.g. `apps/analysis-portal`. |
+| `lock` | `true` | Refresh the lockfile after each version change, using the command for the project type (see the table above). |
 | `pre-commit-command` | _empty_ | Shell command run after the changelog build and before each bump commit. Use it to regenerate version-derived files (e.g. an OpenAPI schema) so they stay in sync in the tagged commit. The command must succeed; a non-zero exit aborts the bump. |
 | `pre-commit-skip` | `false` | Pass `-n` to `git commit` to bypass pre-commit hooks. |
 | `push` | `true` | Push the bump commit, tag, and pre-release commit. |
@@ -81,12 +86,12 @@ already a pre-release. Otherwise it applies `pre-release-base` then
 creates a `bump(<label>): ...` commit which is pushed.
 
 The `<label>` scope is the pre-release identifier, not the raw input. For `uv`
-that is the `pre-release-bump` word itself (`bump(dev)`); for `yarn` it is read
+that is the `pre-release-bump` word itself (`bump(dev)`); for Node it is read
 back off the version `npm version` produced, so `--preid dev` landing on
 `1.2.5-dev.0` gives `bump(dev)` rather than `bump(--preid dev)`.
 
 Pre-release detection is version-scheme aware: PEP 440 for `uv` (via
-`packaging`), semver for `yarn`.
+`packaging`), semver for the Node types.
 
 ## Example
 
diff --git a/bump-version/action.yml b/bump-version/action.yml
index 0428bbf..5dcf76f 100644
--- a/bump-version/action.yml
+++ b/bump-version/action.yml
@@ -1,15 +1,19 @@
 name: "Bump version"
 description: >
-  Bump a Python (uv) or Node/yarn project's version,
+  Bump a Python (uv) or Node (yarn/npm/pnpm) project's version,
   update the CHANGELOG via towncrier, commit, tag, push,
   and optionally land a second commit bumping main onto a pre-release version.
 
 inputs:
   project-type:
     description: >
-      Kind of project to bump: 'uv' (Python, pyproject.toml via `uv version`) or
-      'yarn' (Node, package.json via `npm version` — used purely as a version-bumping
-      CLI, not as the package manager).
+      Kind of project to bump, named after the package manager that owns the lockfile:
+
+      'uv' — Python, version in pyproject.toml, bumped with `uv version`.
+
+      'yarn', 'npm', 'pnpm' — Node, version in package.json, bumped with `npm version`
+      (used purely as a version-bumping CLI, never as the package manager). The three
+      differ only in which lockfile the `lock` input refreshes.
     required: false
     default: "uv"
   bump-rule:
@@ -22,7 +26,7 @@ inputs:
       a release component (patch, minor, major, stable) alongside any prerelease
       segment (alpha, beta, rc, dev) when the current version is a stable release.
 
-      For project-type 'yarn', the value is passed through verbatim as arguments to
+      For the Node project types, the value is passed through verbatim as arguments to
       `npm version <bump-rule words...> --no-git-tag-version`, e.g. `patch`,
       `preminor --preid alpha`, or `prerelease --preid rc`. The caller is responsible
       for passing a combination that is valid for the current version; invalid
@@ -35,7 +39,7 @@ inputs:
 
       For project-type 'uv': one of dev, alpha, beta, rc, none.
 
-      For project-type 'yarn': verbatim `npm version` arguments (e.g. `--preid dev`),
+      For the Node project types: verbatim `npm version` arguments (e.g. `--preid dev`),
       or 'none'.
 
       Use 'none' to skip the second commit.
@@ -47,7 +51,7 @@ inputs:
 
       For project-type 'uv': a bump rule (patch, minor, major, ...), defaults to 'patch'.
 
-      For project-type 'yarn': a verbatim `npm version` strategy word (e.g. `prepatch`),
+      For the Node project types: a verbatim `npm version` strategy word (e.g. `prepatch`),
       combined with pre-release-bump's arguments in the same `npm version` call.
 
       Use 'none' to skip the base and only apply pre-release-bump.
@@ -68,15 +72,15 @@ inputs:
 
       For project-type 'uv': uv workspace package names.
 
-      For project-type 'yarn': paths (relative to the repo root) to the workspace
+      For the Node project types: paths (relative to the repo root) to the workspace
       packages' directories, e.g. `apps/analysis-portal`.
     required: false
     default: ""
   lock:
     description: >
-      If 'true', refresh the lockfile after each version change
-      (`uv lock` for project-type 'uv', `yarn install --mode=update-lockfile` for
-      project-type 'yarn').
+      If 'true', refresh the lockfile after each version change, using the command
+      for the project type: `uv lock`, `yarn install --mode=update-lockfile`,
+      `npm install --package-lock-only`, or `pnpm install --lockfile-only`.
     required: false
     default: "true"
   pre-commit-command:
diff --git a/bump-version/bump.py b/bump-version/bump.py
index ff7c7d8..c401944 100755
--- a/bump-version/bump.py
+++ b/bump-version/bump.py
@@ -180,14 +180,17 @@ def prerelease_label(self, requested: str, version: str) -> str:
         return requested
 
 
-class YarnBackend:
+class NodeBackend:
     """Node projects whose version lives in `package.json`.
 
-    `npm version` is used purely as a version-bumping CLI; yarn stays the
-    package manager.
+    Every Node project type reads and bumps the same way: `npm version` ships
+    with Node and is used purely as a version-bumping CLI, never as the package
+    manager. The package manager only owns the lockfile, so subclasses supply
+    nothing but a name and a `lock` command.
     """
 
-    name = "yarn"
+    name: str
+    lock: tuple[str, ...]
 
     def read_version(self) -> str:
         return run(["node", "-p", "require('./package.json').version"], capture=True)
@@ -206,7 +209,7 @@ def workspace_command(self, package: str, version: str) -> list[str]:
         return ["npm", "version", "--no-git-tag-version", "--prefix", package, version]
 
     def lock_command(self) -> list[str]:
-        return ["yarn", "install", "--mode=update-lockfile"]
+        return list(self.lock)
 
     def changelog_command(self, version: str) -> list[str]:
         # No project virtualenv to run towncrier from, so fetch it on the fly.
@@ -230,7 +233,28 @@ def prerelease_label(self, requested: str, version: str) -> str:
         return "prerelease"
 
 
-BACKENDS: dict[str, type[Backend]] = {"uv": UvBackend, "yarn": YarnBackend}
+class YarnBackend(NodeBackend):
+    name = "yarn"
+    # Yarn Berry; `--mode=update-lockfile` skips fetching packages.
+    lock = ("yarn", "install", "--mode=update-lockfile")
+
+
+class NpmBackend(NodeBackend):
+    name = "npm"
+    lock = ("npm", "install", "--package-lock-only")
+
+
+class PnpmBackend(NodeBackend):
+    name = "pnpm"
+    lock = ("pnpm", "install", "--lockfile-only")
+
+
+BACKENDS: dict[str, type[Backend]] = {
+    "uv": UvBackend,
+    "yarn": YarnBackend,
+    "npm": NpmBackend,
+    "pnpm": PnpmBackend,
+}
 
 
 # --------------------------------------------------------------------------
diff --git a/changelog/27.feature.md b/changelog/27.feature.md
index 9fb2c6e..7d9a8e7 100644
--- a/changelog/27.feature.md
+++ b/changelog/27.feature.md
@@ -1 +1 @@
-Added support for `yarn` projects for the bump action using the new `project-type` input parameter.
+Added support for `yarn`, `npm` and `pnpm` projects for the bump action using the new `project-type` input parameter. All three Node types read and bump `package.json` through the `npm version` CLI and differ only in the lockfile `lock: true` refreshes: `yarn install --mode=update-lockfile`, `npm install --package-lock-only`, or `pnpm install --lockfile-only`.
diff --git a/tests/test_bump.py b/tests/test_bump.py
index 93dfc4b..ee8f181 100644
--- a/tests/test_bump.py
+++ b/tests/test_bump.py
@@ -18,6 +18,13 @@ def yarn() -> bump.YarnBackend:
     return bump.YarnBackend()
 
 
+# Every Node project type shares its read/bump/mirror behaviour, so the shared
+# cases run against all of them.
+@pytest.fixture(params=["yarn", "npm", "pnpm"])
+def node(request) -> bump.NodeBackend:
+    return bump.BACKENDS[request.param]()
+
+
 class TestUvBumpCommands:
     def test_single_segment(self, uv):
         assert uv.bump_command(["patch"]) == [
@@ -50,34 +57,58 @@ def test_changelog_uses_project_environment(self, uv):
         ]
 
 
-class TestYarnBumpCommands:
-    def test_segments_pass_through_verbatim(self, yarn):
-        assert yarn.bump_command(["preminor", "--preid", "alpha"]) == [
+class TestNodeBumpCommands:
+    """Shared across yarn, npm and pnpm — all bump via the npm CLI."""
+
+    def test_segments_pass_through_verbatim(self, node):
+        assert node.bump_command(["preminor", "--preid", "alpha"]) == [
             "npm", "version", "preminor", "--preid", "alpha", "--no-git-tag-version",
         ]
 
-    def test_prerelease_concatenates_base_and_bump_words(self, yarn):
-        assert yarn.prerelease_command("prepatch", "--preid dev") == [
+    def test_prerelease_concatenates_base_and_bump_words(self, node):
+        assert node.prerelease_command("prepatch", "--preid dev") == [
             "npm", "version", "prepatch", "--preid", "dev", "--no-git-tag-version",
         ]
 
-    def test_prerelease_base_none_is_skipped(self, yarn):
-        assert yarn.prerelease_command("none", "prerelease --preid rc") == [
+    def test_prerelease_base_none_is_skipped(self, node):
+        assert node.prerelease_command("none", "prerelease --preid rc") == [
             "npm", "version", "prerelease", "--preid", "rc", "--no-git-tag-version",
         ]
 
-    def test_workspace_targets_package_directory(self, yarn):
-        assert yarn.workspace_command("apps/portal", "1.2.3") == [
+    def test_workspace_targets_package_directory(self, node):
+        assert node.workspace_command("apps/portal", "1.2.3") == [
             "npm", "version", "--no-git-tag-version",
             "--prefix", "apps/portal", "1.2.3",
         ]
 
-    def test_changelog_fetches_towncrier_on_the_fly(self, yarn):
-        assert yarn.changelog_command("1.2.3") == [
+    def test_changelog_fetches_towncrier_on_the_fly(self, node):
+        assert node.changelog_command("1.2.3") == [
             "uvx", "towncrier", "build", "--yes", "--version", "v1.2.3",
         ]
 
 
+class TestNodeLockCommands:
+    """The lockfile is the only thing that differs between Node backends."""
+
+    @pytest.mark.parametrize(
+        ("project_type", "expected"),
+        [
+            ("yarn", ["yarn", "install", "--mode=update-lockfile"]),
+            ("npm", ["npm", "install", "--package-lock-only"]),
+            ("pnpm", ["pnpm", "install", "--lockfile-only"]),
+        ],
+    )
+    def test_each_backend_refreshes_its_own_lockfile(self, project_type, expected):
+        assert bump.BACKENDS[project_type]().lock_command() == expected
+
+    def test_lock_command_is_a_fresh_list(self, node):
+        # The command is stored as a class-level tuple; callers must not be able
+        # to mutate it for every later invocation.
+        command = node.lock_command()
+        command.append("--frozen")
+        assert node.lock_command() != command
+
+
 class TestUvPrereleaseDetection:
     @pytest.mark.parametrize(
         "version", ["1.2.3a1", "1.2.3b2", "1.2.3rc1", "1.2.4.dev0", "2.0.0a0"]
@@ -101,17 +132,17 @@ def test_invalid_version_is_reported(self, uv):
             uv.is_prerelease("not-a-version")
 
 
-class TestYarnPrereleaseDetection:
+class TestNodePrereleaseDetection:
     @pytest.mark.parametrize("version", ["1.2.3-alpha.0", "1.2.3-rc.1", "1.2.3-dev.0"])
-    def test_prerelease_versions(self, yarn, version):
-        assert yarn.is_prerelease(version) is True
+    def test_prerelease_versions(self, node, version):
+        assert node.is_prerelease(version) is True
 
     @pytest.mark.parametrize("version", ["1.2.3", "0.1.0"])
-    def test_stable_versions(self, yarn, version):
-        assert yarn.is_prerelease(version) is False
+    def test_stable_versions(self, node, version):
+        assert node.is_prerelease(version) is False
 
-    def test_hyphen_in_build_metadata_is_not_a_prerelease(self, yarn):
-        assert yarn.is_prerelease("1.2.3+build-5") is False
+    def test_hyphen_in_build_metadata_is_not_a_prerelease(self, node):
+        assert node.is_prerelease("1.2.3+build-5") is False
 
 
 class TestPrereleaseLabel:
@@ -132,17 +163,17 @@ def test_uv_uses_the_requested_word(self, uv, requested, version):
             ("--preid alpha", "2.0.0-alpha.12", "alpha"),
         ],
     )
-    def test_yarn_reads_the_identifier_off_the_version(
-        self, yarn, requested, version, expected
+    def test_node_reads_the_identifier_off_the_version(
+        self, node, requested, version, expected
     ):
         # Using the raw input would give a scope like `bump(--preid dev)`.
-        assert yarn.prerelease_label(requested, version) == expected
+        assert node.prerelease_label(requested, version) == expected
 
-    def test_yarn_falls_back_when_no_preid_was_given(self, yarn):
-        assert yarn.prerelease_label("prerelease", "1.2.4-0") == "prerelease"
+    def test_node_falls_back_when_no_preid_was_given(self, node):
+        assert node.prerelease_label("prerelease", "1.2.4-0") == "prerelease"
 
-    def test_yarn_ignores_build_metadata(self, yarn):
-        assert yarn.prerelease_label("--preid dev", "1.2.5-dev.0+build-7") == "dev"
+    def test_node_ignores_build_metadata(self, node):
+        assert node.prerelease_label("--preid dev", "1.2.5-dev.0+build-7") == "dev"
 
 
 class TestConfig:
@@ -174,17 +205,30 @@ def test_bump_rule_splits_on_whitespace(self):
         config = bump.Config.from_env({"BUMP_RULE": " minor  alpha "})
         assert config.bump_segments == ["minor", "alpha"]
 
-    def test_backend_selected_by_project_type(self):
-        uv_config = bump.Config.from_env({"BUMP_RULE": "patch"})
-        yarn_config = bump.Config.from_env(
-            {"BUMP_RULE": "patch", "PROJECT_TYPE": "yarn"}
+    @pytest.mark.parametrize(
+        ("project_type", "expected"),
+        [
+            ("uv", bump.UvBackend),
+            ("yarn", bump.YarnBackend),
+            ("npm", bump.NpmBackend),
+            ("pnpm", bump.PnpmBackend),
+        ],
+    )
+    def test_backend_selected_by_project_type(self, project_type, expected):
+        config = bump.Config.from_env(
+            {"BUMP_RULE": "patch", "PROJECT_TYPE": project_type}
         )
-        assert isinstance(uv_config.backend(), bump.UvBackend)
-        assert isinstance(yarn_config.backend(), bump.YarnBackend)
+        assert isinstance(config.backend(), expected)
+
+    def test_backend_name_matches_its_project_type(self):
+        for project_type, backend in bump.BACKENDS.items():
+            assert backend.name == project_type
 
     def test_unknown_project_type_is_rejected(self):
         config = bump.Config.from_env({"BUMP_RULE": "patch", "PROJECT_TYPE": "poetry"})
-        with pytest.raises(bump.BumpError, match="project-type must be one of"):
+        with pytest.raises(
+            bump.BumpError, match="project-type must be one of npm, pnpm, uv, yarn"
+        ):
             config.backend()
 
     def test_empty_bump_rule_is_rejected(self):