From dfdc446640beb00e8b006c096ff9f848b7839d92 Mon Sep 17 00:00:00 2001
From: Alexandr <hellbeast92@gmail.com>
Date: Fri, 6 Nov 2026 12:49:42 +0100
Subject: [PATCH] ci(changeset/check-coverage): require a changeset for runtime
 catalog bumps

A package now counts as changed when the branch edits a file inside it, or
when the branch changes a catalog entry that the package references via
`catalog:` / `catalog:<name>` from `dependencies` or `peerDependencies`.
Catalog entries referenced only from `devDependencies` or
`optionalDependencies` require nothing.

Changed files come from `git diff` against the merge base with the base
branch, not from `pnpm --filter "[<since>]"`. pnpm 11.28 / 12.7 made that
filter mark every catalog consumer as changed, devDependencies included,
which failed samples-and-data#140 on parse-h5ad and parse-seurat: both only
take block-tools from the catalog as a devDependency.

Restores the runtime catalog rule that de2b0ee dropped. Missing yq, a
missing merge base or an unreadable catalog now exit 2 instead of passing.
---
 actions/changeset/check-coverage/action.yaml  |  23 +-
 .../check-coverage/check-coverage.sh          | 257 +++++++++++++-----
 .../changeset/check-coverage/test/README.md   |  11 +-
 .../check-coverage/test/coverage.bats         | 100 ++++---
 .../test/fixtures/minimal-workspace/README.md |   7 +-
 .../packages/pkg-legacy/index.js              |   1 +
 .../packages/pkg-legacy/package.json          |   8 +
 .../packages/pkg-peer/index.js                |   1 +
 .../packages/pkg-peer/package.json            |   8 +
 .../minimal-workspace/pnpm-workspace.yaml     |   4 +
 .../check-coverage/test/helpers.bash          |  14 +-
 11 files changed, 310 insertions(+), 124 deletions(-)
 create mode 100644 actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/index.js
 create mode 100644 actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/package.json
 create mode 100644 actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/index.js
 create mode 100644 actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/package.json

diff --git a/actions/changeset/check-coverage/action.yaml b/actions/changeset/check-coverage/action.yaml
index 515557e0..f2514b89 100644
--- a/actions/changeset/check-coverage/action.yaml
+++ b/actions/changeset/check-coverage/action.yaml
@@ -1,16 +1,15 @@
 name: Check changeset coverage
 author: 'MiLaboratories'
 description: |
-  Fail if a PR's changesets don't cover every workspace package whose own
-  files it edits — e.g. editing block code under packages/<pkg>/ without
-  adding that package to the changeset.
+  Fail if a PR's changesets don't cover every published workspace package it
+  changes. A package is changed when the PR edits a file inside its directory,
+  or when the PR changes a catalog entry in pnpm-workspace.yaml that the
+  package references via `catalog:` from `dependencies` or `peerDependencies`.
+  A catalog entry referenced only from `devDependencies` or
+  `optionalDependencies` requires nothing.
 
-  Dependency-version bumps are intentionally NOT flagged, including catalog
-  bumps in pnpm-workspace.yaml. A catalog entry always pins an external
-  package, and `pnpm changeset` never requires a release for an external
-  dependency bump — it propagates versions through the internal dependency
-  chain automatically at `changeset version` time. Flagging consumers of a
-  bumped catalog dependency would over-report relative to `pnpm changeset`.
+  Changes are counted from the merge base with the base branch, so commits that
+  landed on the base branch after the PR branched off are not the PR's.
 
   An empty changeset (`pnpm changeset --empty`) added in the branch is a
   deliberate, in-repo "no release needed" opt-out and waives the requirement for
@@ -22,9 +21,9 @@ description: |
   caller workflow's job-level `if` (PR labels are only available on
   `pull_request` events).
 
-  Runs after `pnpm install`. Requires the runner to have `pnpm`, `jq` and `git`
-  on PATH — all pre-installed on GitHub-hosted ubuntu-latest images. `git` needs
-  full history (`fetch-depth: 0`) to see which changesets the branch added.
+  Runs after `pnpm install`. Requires `git`, `pnpm`, `jq` and `yq` (mikefarah,
+  v4+) on PATH. `git` needs full history (`fetch-depth: 0`) to find the merge
+  base with the base branch.
 
 inputs:
   base-branch:
diff --git a/actions/changeset/check-coverage/check-coverage.sh b/actions/changeset/check-coverage/check-coverage.sh
index 25c04187..b78f045b 100755
--- a/actions/changeset/check-coverage/check-coverage.sh
+++ b/actions/changeset/check-coverage/check-coverage.sh
@@ -1,33 +1,36 @@
 #!/usr/bin/env bash
 #
-# Verify the PR has a changeset for every workspace package whose own files
-# it edits. Exit 1 on a coverage gap; exit 2 on tooling failure; exit 0
+# Verify the PR has a changeset for every published workspace package it
+# changes. Exit 1 on a coverage gap; exit 2 on tooling failure; exit 0
 # otherwise.
 #
-# An empty changeset added in this branch (`pnpm changeset --empty`) waives the
-# requirement — see section 4.
+# A package is changed by the branch in two ways:
+#
+#   direct edit   — the branch changes a file inside the package directory. A
+#                   file belongs to the deepest package directory containing
+#                   it, so root-level paths (`.github/`, `docs/`,
+#                   `pnpm-workspace.yaml`, `README.md`) belong to the workspace
+#                   root, which is unnamed or private and never needs a bump.
 #
-# "Modified" means a direct edit to a workspace package's own files, detected
-# via `pnpm --filter '[<base>]' list` — pnpm runs the per-package git-diff
-# check itself. Root-level paths (`.github/`, `docs/`, `pnpm-workspace.yaml`,
-# `README.md`) live in no package directory, so they never trigger inclusion.
+#   catalog bump  — the branch changes a catalog entry in pnpm-workspace.yaml
+#                   that the package references as `catalog:` or
+#                   `catalog:<name>` from `dependencies` or `peerDependencies`.
+#                   Those dependencies ship with the package, so a new version
+#                   of one is a new version of the package. `devDependencies`
+#                   and `optionalDependencies` do not count.
 #
-# Dependency-version bumps never require a changeset — including catalog
-# bumps in pnpm-workspace.yaml. A catalog entry always pins an *external*
-# package (workspace packages are referenced via `workspace:*`, never
-# `catalog:`). `pnpm changeset` ignores such a bump twice over: it never
-# releases a package because an external dependency's version changed, and it
-# propagates internal bumps through the dependency chain automatically at
-# `changeset version` time. So requiring a hand-written changeset for a
-# package that only "changed" via a dependency bump over-reports relative to
-# `pnpm changeset` — see platforma-open/clonotype-space#95, where a
-# `@platforma-sdk/workflow-tengo` catalog bump spuriously failed the
-# untouched `.workflow` package.
+# "The branch changes" means the difference between the merge base with the
+# base branch and HEAD: commits that landed on the base branch after the
+# branch left it are not the branch's changes.
 #
-# Skips private (unpublished) workspace packages — they never appear in
-# the changeset's release set.
+# Private packages are skipped — they never appear in a changeset's release
+# set.
+#
+# An empty changeset added in this branch (`pnpm changeset --empty`) waives the
+# requirement — see section 4.
 #
-# Runs from the repo root after `pnpm install`.
+# Runs from the repo root after `pnpm install`. Needs `git` with the base
+# branch's history, `pnpm`, `jq` and `yq` (mikefarah, v4+).
 
 set -o nounset
 set -o errexit
@@ -38,43 +41,42 @@ set -o pipefail
 log()  { printf '%s\n' "$*" >&2; }
 err()  { printf '::error::%s\n' "$*" >&2; }
 
-# Associative arrays (`declare -A`) require bash 4+. The GitHub-hosted
-# ubuntu-latest runners ship bash 5+, so this guard is a no-op in CI today.
-# It matters when running locally on macOS: /bin/bash is still 3.2, and
-# without homebrew's bash earlier on PATH the script would otherwise abort
-# at the first `declare -A` with a cryptic `invalid option`. Fail fast with
-# a useful message instead.
+# Associative arrays (`declare -A`) need bash 4+. macOS ships bash 3.2 as
+# /bin/bash, where `declare -A` aborts with a cryptic `invalid option`.
 if [ "${BASH_VERSINFO[0]:-0}" -lt 4 ]; then
   err "check-coverage requires bash 4+ (found ${BASH_VERSION:-unknown})."
   exit 2
 fi
 
-# Use cwd-relative paths for tmp files — changeset's --output mis-handles
-# absolute paths on macOS (prepends cwd, causing ENOENT). Cwd-relative is
-# safe on every platform.
+for tool in git pnpm jq yq; do
+  if ! command -v "${tool}" >/dev/null 2>&1; then
+    err "${tool} not found on PATH."
+    exit 2
+  fi
+done
+
+# changeset's --output resolves an absolute path against the cwd on macOS, so
+# the status file takes a cwd-relative path.
 status_json=".changeset-coverage-status-$$.json"
+trap 'rm -f "${status_json}"' EXIT
 
 # ---------------------------------------------------------------------------
-# 1. Bumped set from `changeset status --output=...`.
+# 1. Bumped set: the packages the branch's changesets release.
 # ---------------------------------------------------------------------------
-trap 'rm -f "${status_json}"' EXIT
 
-# Invoke the binary directly. `pnpm exec` and `pnpm <script>` spawn subshells
-# that lose `node_modules/.bin` from PATH on repeated invocations. The action
-# runs from the repo root after `pnpm install`, so the binary is at this
-# fixed location in CI.
+# `pnpm exec` and `pnpm <script>` drop `node_modules/.bin` from PATH on repeated
+# invocations, so the binary is called by its path.
 changeset_bin='./node_modules/.bin/changeset'
 if [ ! -x "${changeset_bin}" ]; then
   err 'changeset binary not found. Did `pnpm install` run before this step?'
   exit 2
 fi
 
-# Capture stderr to distinguish the legitimate "no changesets yet" state
-# (exit 1 + "no changesets were found" message) from a real tooling failure.
-# The former is a coverage gap to report; the latter aborts with exit 2.
-cs_stdouterr=''
+# A branch without changesets makes `changeset status` exit 1 with "no
+# changesets were found". That is a coverage question to answer, not a tooling
+# failure, so it continues with an empty bumped set.
 set +e
-cs_stdouterr="$(
+cs_output="$(
   "${changeset_bin}" status \
     --output="${status_json}" \
     --since="origin/${BASE_BRANCH}" 2>&1
@@ -83,17 +85,12 @@ cs_exit=$?
 set -e
 
 if [ ! -s "${status_json}" ]; then
-  if printf '%s' "${cs_stdouterr}" | grep -q 'no changesets were found'; then
-    # Legitimate empty-changeset case — keep going so the coverage check
-    # surfaces every modified package as missing.
-    echo '{"releases":[]}' >"${status_json}"
-  elif [ "${cs_exit}" -ne 0 ]; then
+  if [ "${cs_exit}" -ne 0 ] && ! printf '%s' "${cs_output}" | grep -q 'no changesets were found'; then
     err "changeset status failed (exit ${cs_exit}):"
-    printf '%s\n' "${cs_stdouterr}" | sed 's/^/    /' >&2
+    printf '%s\n' "${cs_output}" | sed 's/^/    /' >&2
     exit 2
-  else
-    echo '{"releases":[]}' >"${status_json}"
   fi
+  echo '{"releases":[]}' >"${status_json}"
 fi
 
 declare -A bumped_set=()
@@ -108,37 +105,163 @@ else
 fi
 
 # ---------------------------------------------------------------------------
-# 2. Required-bump set.
+# 2. Required set: the published packages the branch changes.
 # ---------------------------------------------------------------------------
 declare -A required_set=()
 declare -A required_reason=()
 
 require_pkg() {
   local pkg="$1" reason="$2"
-  [ -z "${pkg}" ] && return 0
   required_set["${pkg}"]=1
   required_reason["${pkg}"]="${required_reason[${pkg}]:-}${reason}; "
 }
 
-# Direct workspace-package edits.
-#
-# `pnpm --filter '[<since>]' list` selects packages whose own files changed
-# (pnpm runs the per-package `git diff` itself). Root-level paths like
-# `.github/`, `docs/`, `pnpm-workspace.yaml`, or `README.md` are not in any
-# package directory and so don't trigger inclusion — no manual ignore list
-# needed, and a catalog bump in pnpm-workspace.yaml never reaches this filter.
-#
-# The jq filter drops private packages here (they never appear in a
-# changeset's release set), so `require_pkg` doesn't need to re-check.
-while IFS= read -r pkg; do
-  [ -n "${pkg}" ] && require_pkg "${pkg}" 'direct edit'
+if ! merge_base="$(git merge-base "origin/${BASE_BRANCH}" HEAD 2>/dev/null)"; then
+  err "No merge base between origin/${BASE_BRANCH} and HEAD. Check out with full history (fetch-depth: 0)."
+  exit 2
+fi
+
+# Workspace packages: directory relative to the repo root ('' for the root
+# itself) and the name to require ('' for an unnamed or private package).
+if ! packages_json="$(pnpm -r list --depth -1 --json 2>/dev/null)" \
+  || ! jq -e 'type == "array" and length > 0' >/dev/null <<<"${packages_json}"; then
+  err 'pnpm list did not return the workspace packages.'
+  exit 2
+fi
+
+pkg_dirs=()
+pkg_names=()
+while IFS=$'\t' read -r path name; do
+  rel=''
+  # pnpm prints absolute paths with symlinks resolved (macOS /tmp is
+  # /private/tmp), so either form of the cwd may prefix them.
+  for root in "$(pwd -P)" "$(pwd -L)"; do
+    case "${path}" in
+      "${root}")   rel='.' ;;
+      "${root}"/*) rel="${path#"${root}"/}" ;;
+    esac
+    [ -n "${rel}" ] && break
+  done
+  [ -z "${rel}" ] && continue
+  [ "${rel}" = '.' ] && rel=''
+  pkg_dirs+=("${rel}")
+  pkg_names+=("${name}")
 done < <(
-  pnpm -r --filter "[origin/${BASE_BRANCH}]" list --depth -1 --json 2>/dev/null \
-    | jq -r '.[] | select(.name != null and .name != "" and .private != true) | .name'
+  jq -r '.[] | [
+      (.path | rtrimstr("/")),
+      (if (.name // "") == "" or .private == true then "" else .name end)
+    ] | @tsv' <<<"${packages_json}"
 )
 
+# 2a. Direct edits.
+#
+# `--no-renames` lists both sides of a move, so moving a file out of a package
+# is an edit of that package.
+if ! changed_files="$(git diff --name-only --no-renames "${merge_base}" HEAD)"; then
+  err "git diff against the merge base with origin/${BASE_BRANCH} failed."
+  exit 2
+fi
+
+while IFS= read -r file; do
+  [ -z "${file}" ] && continue
+  owner=-1
+  owner_len=-1
+  for i in "${!pkg_dirs[@]}"; do
+    dir="${pkg_dirs[${i}]}"
+    if [ -z "${dir}" ] || [[ "${file}" == "${dir}/"* ]]; then
+      if [ "${#dir}" -gt "${owner_len}" ]; then
+        owner="${i}"
+        owner_len="${#dir}"
+      fi
+    fi
+  done
+  [ "${owner}" -lt 0 ] && continue
+  pkg="${pkg_names[${owner}]}"
+  [ -z "${pkg}" ] && continue
+  [ -n "${required_set[${pkg}]:-}" ] && continue
+  require_pkg "${pkg}" 'direct edit'
+done <<<"${changed_files}"
+
 log "Direct-edit packages: ${#required_set[@]}"
 
+# 2b. Catalog bumps.
+#
+# Both sides of pnpm-workspace.yaml are normalised to
+# { "<catalog name>": { "<dependency>": "<version>" } }. The top-level
+# `catalog:` is the catalog named `default`, the same one `catalogs.default`
+# names.
+catalogs_at() {
+  local rev="$1"
+  if ! git cat-file -e "${rev}:pnpm-workspace.yaml" 2>/dev/null; then
+    echo '{}'
+    return 0
+  fi
+  git show "${rev}:pnpm-workspace.yaml" \
+    | yq -o=json '.' \
+    | jq -c '
+        (. // {}) as $ws
+        | ($ws.catalogs // {}) + { default: (($ws.catalogs.default // {}) + ($ws.catalog // {})) }
+        | map_values(. // {} | map_values(tostring))
+      '
+}
+
+if ! base_catalogs="$(catalogs_at "${merge_base}")" \
+  || ! head_catalogs="$(catalogs_at HEAD)"; then
+  err 'Could not read the catalogs in pnpm-workspace.yaml.'
+  exit 2
+fi
+
+# { "<catalog name>": ["<dependency>", ...] } for every entry added, removed or
+# re-versioned.
+changed_catalogs="$(
+  jq -cn --argjson base "${base_catalogs}" --argjson head "${head_catalogs}" '
+    [ ($base | keys[]), ($head | keys[]) ] | unique
+    | map(. as $name
+        | {
+            key: $name,
+            value: (
+              [ ($base[$name] // {} | keys[]), ($head[$name] // {} | keys[]) ] | unique
+              | map(select($base[$name][.] != $head[$name][.]))
+            )
+          })
+    | map(select(.value | length > 0))
+    | from_entries
+  '
+)"
+
+catalog_required=0
+if [ "${changed_catalogs}" != '{}' ]; then
+  log "Changed catalog entries: $(jq -r 'to_entries | map("\(.key): \(.value | join(", "))") | join("; ")' <<<"${changed_catalogs}")"
+
+  for i in "${!pkg_dirs[@]}"; do
+    pkg="${pkg_names[${i}]}"
+    [ -z "${pkg}" ] && continue
+    manifest="${pkg_dirs[${i}]:-.}/package.json"
+    [ -f "${manifest}" ] || continue
+    if ! deps="$(
+      jq -r --argjson changed "${changed_catalogs}" '
+        [ .dependencies, .peerDependencies ]
+        | map(select(type == "object") | to_entries[]) | .[]
+        | select(.value | type == "string" and startswith("catalog:"))
+        | .key as $dep
+        | (.value | ltrimstr("catalog:") | if . == "" then "default" else . end) as $name
+        | select($changed[$name] // [] | any(. == $dep))
+        | $dep
+      ' "${manifest}" | sort -u
+    )"; then
+      err "Could not read ${manifest}."
+      exit 2
+    fi
+    while IFS= read -r dep; do
+      [ -z "${dep}" ] && continue
+      require_pkg "${pkg}" "catalog bump: ${dep}"
+      catalog_required=$((catalog_required + 1))
+    done <<<"${deps}"
+  done
+fi
+
+log "Catalog-bump requirements: ${catalog_required}"
+
 # ---------------------------------------------------------------------------
 # 3. Compare required vs bumped.
 # ---------------------------------------------------------------------------
@@ -188,7 +311,7 @@ while IFS= read -r f; do
     exit 0
   fi
 done < <(
-  git diff --name-only --diff-filter=A "origin/${BASE_BRANCH}...HEAD" -- .changeset 2>/dev/null || true
+  git diff --name-only --diff-filter=A "${merge_base}" HEAD -- .changeset 2>/dev/null || true
 )
 
 err 'Changeset coverage gap. The following packages were modified but not bumped:'
diff --git a/actions/changeset/check-coverage/test/README.md b/actions/changeset/check-coverage/test/README.md
index 39d6445c..d7866bdb 100644
--- a/actions/changeset/check-coverage/test/README.md
+++ b/actions/changeset/check-coverage/test/README.md
@@ -39,18 +39,17 @@ and a couple of git ops.
   the tar copy), commits, and synthesizes an `origin/main` ref.
 - Each test (`setup`) tars the base into `$BATS_TEST_TMPDIR/ws`, switches
   to a `feature` branch, applies mutations via the helpers
-  (`touch_file`, `add_changeset`, `add_empty_changeset`, `bump_catalog`),
+  (`touch_file`, `add_changeset`, `add_empty_changeset`, `bump_catalog`,
+  `edit_workspace_yaml`),
   and runs the script
   with `BASE_BRANCH=main`. The test asserts on the script's exit code and
   the captured `$output`.
 
 ## Fixture
 
-`fixtures/minimal-workspace/` — small pnpm workspace:
-
-- `packages/pkg-a`, `packages/pkg-b` — both consume `is-number` via `catalog:`
-- `packages/pkg-c` — consumes `is-string` via `catalog:`
-- `packages/pkg-private` — `"private": true`, never requires a bump
+`fixtures/minimal-workspace/` — small pnpm workspace; its `README.md` lists
+which package takes which dependency from which catalog, and in which
+dependency field.
 
 ## CI
 
diff --git a/actions/changeset/check-coverage/test/coverage.bats b/actions/changeset/check-coverage/test/coverage.bats
index fc42fc11..9ed7c229 100644
--- a/actions/changeset/check-coverage/test/coverage.bats
+++ b/actions/changeset/check-coverage/test/coverage.bats
@@ -67,59 +67,93 @@ setup() {
 }
 
 # ---------------------------------------------------------------------------
-# Catalog / dependency bumps — intentionally NOT a coverage requirement.
-#
-# A catalog entry always pins an *external* package: workspace packages are
-# referenced via `workspace:*`, never `catalog:`. `pnpm changeset` never adds
-# a package to its release plan because an external dependency's version
-# changed, and it propagates version bumps through the internal dependency
-# chain automatically at `changeset version` time. So a catalog bump on its
-# own requires no hand-written changeset — requiring one over-reports relative
-# to `pnpm changeset`.
-#
-# Regression: platforma-open/clonotype-space#95. The `.workflow` package listed
-# `@platforma-sdk/workflow-tengo` under `dependencies` as `catalog:`; the
-# catalog bumped it (5.25.0 → 6.3.2) while the package's own files were
-# untouched. The PR's changeset (model/ui/block) was complete per
-# `pnpm changeset`, yet the old check failed the PR on `.workflow`.
+# Branch scope: only what the branch changed since it left the base.
 # ---------------------------------------------------------------------------
 
-@test "catalog bump alone requires no changeset (consumer files untouched)" {
-  # pkg-a and pkg-b both consume is-number via `dependencies: { is-number: catalog: }`
-  # — exactly the clonotype-space `.workflow` → workflow-tengo shape. Bumping
-  # the catalog without touching either package must pass.
+@test "an edit that landed on the base after the branch left it is not the branch's" {
+  git -C "${WORKSPACE}" checkout --quiet main
+  touch_file 'packages/pkg-a/index.js'
   bump_catalog 'is-number' '^7.0.1'
+  git -C "${WORKSPACE}" update-ref refs/remotes/origin/main main
+  git -C "${WORKSPACE}" checkout --quiet feature
+  touch_file 'README.md' 'feature-branch readme edit'
   run_check
   [ "${status}" -eq 0 ]
 }
 
-@test "runtime vs dev catalog dep is irrelevant — neither is flagged" {
-  # is-string is a runtime dep of pkg-c and a devDependency of pkg-dev. Bumping
-  # it flags neither: a dependency-version bump never requires a changeset.
+@test "moving a file out of a package is an edit of that package" {
+  git -C "${WORKSPACE}" mv packages/pkg-a/index.js lib-index.js
+  git -C "${WORKSPACE}" commit --quiet -m 'move pkg-a index out'
+  run_check
+  [ "${status}" -eq 1 ]
+  [[ "${output}" == *'- @check-coverage-test/pkg-a  (direct edit)'* ]]
+}
+
+# ---------------------------------------------------------------------------
+# Catalog bumps.
+#
+# A package that takes a dependency from the catalog in `dependencies` or
+# `peerDependencies` ships that dependency, so a changed catalog entry is a
+# change of the package even when its own files are untouched.
+# `devDependencies` and `optionalDependencies` do not count.
+# ---------------------------------------------------------------------------
+
+@test "catalog bump requires every runtime consumer" {
+  bump_catalog 'is-number' '^7.0.1'
+  run_check
+  [ "${status}" -eq 1 ]
+  [[ "${output}" == *'- @check-coverage-test/pkg-a  (catalog bump: is-number)'* ]]
+  [[ "${output}" == *'- @check-coverage-test/pkg-b  (catalog bump: is-number)'* ]]
+  [[ "${output}" == *'- @check-coverage-test/pkg-peer  (catalog bump: is-number)'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-private'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-legacy'* ]]
+}
+
+@test "catalog bump does not require a devDependency consumer" {
+  # is-string is a runtime dependency of pkg-c and a devDependency of pkg-dev.
   bump_catalog 'is-string' '^1.0.8'
   run_check
+  [ "${status}" -eq 1 ]
+  [[ "${output}" == *'- @check-coverage-test/pkg-c  (catalog bump: is-string)'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-dev'* ]]
+}
+
+@test "catalog bump covered by a changeset passes" {
+  bump_catalog 'is-string' '^1.0.8'
+  add_changeset '"@check-coverage-test/pkg-c": patch' 'bump is-string'
+  run_check
   [ "${status}" -eq 0 ]
 }
 
-@test "catalog bump alongside a direct edit only requires the edited package" {
-  # The simultaneous is-number catalog bump adds no requirements: only pkg-c,
-  # whose own files changed, must be covered. pkg-a/pkg-b consume is-number but
-  # were not edited.
-  touch_file 'packages/pkg-c/index.js'
-  bump_catalog 'is-number' '^7.0.1'
+@test "named catalog bump requires only that catalog's consumers" {
+  edit_workspace_yaml '.catalogs.legacy."is-number" = "^6.0.1"' 'bump legacy is-number'
   run_check
   [ "${status}" -eq 1 ]
-  [[ "${output}" == *'@check-coverage-test/pkg-c'* ]]
-  [[ "${output}" != *'@check-coverage-test/pkg-a'* ]]
-  [[ "${output}" != *'@check-coverage-test/pkg-b'* ]]
+  [[ "${output}" == *'- @check-coverage-test/pkg-legacy  (catalog bump: is-number)'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-a'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-peer'* ]]
+}
+
+@test "a new catalog entry nobody consumes requires nothing" {
+  edit_workspace_yaml '.catalog."is-odd" = "^3.0.1"' 'add is-odd to the catalog'
+  run_check
+  [ "${status}" -eq 0 ]
 }
 
-@test "direct edit covered by a changeset passes even with a concurrent catalog bump" {
+@test "a pnpm-workspace.yaml change outside the catalogs requires nothing" {
+  edit_workspace_yaml '.minimumReleaseAgeExclude = ["@check-coverage-test/*"]' 'add a workspace setting'
+  run_check
+  [ "${status}" -eq 0 ]
+}
+
+@test "catalog bump and direct edit are both reported" {
   touch_file 'packages/pkg-c/index.js'
   bump_catalog 'is-number' '^7.0.1'
   add_changeset '"@check-coverage-test/pkg-c": patch' 'edit pkg-c'
   run_check
-  [ "${status}" -eq 0 ]
+  [ "${status}" -eq 1 ]
+  [[ "${output}" == *'- @check-coverage-test/pkg-a  (catalog bump: is-number)'* ]]
+  [[ "${output}" != *'- @check-coverage-test/pkg-c'* ]]
 }
 
 # ---------------------------------------------------------------------------
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/README.md b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/README.md
index 2f5885ba..d410cc43 100644
--- a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/README.md
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/README.md
@@ -2,8 +2,11 @@
 
 Minimal pnpm workspace used by `check-coverage` bats tests.
 
-- `packages/pkg-a` and `packages/pkg-b` both consume `is-number` via the catalog.
-- `packages/pkg-c` consumes `is-string` via the catalog.
+- `packages/pkg-a` and `packages/pkg-b` both consume `is-number` from the default catalog in `dependencies`.
+- `packages/pkg-c` consumes `is-string` from the default catalog in `dependencies`.
+- `packages/pkg-dev` consumes `is-string` from the default catalog in `devDependencies`.
+- `packages/pkg-peer` consumes `is-number` from the default catalog in `peerDependencies`.
+- `packages/pkg-legacy` consumes `is-number` from the `legacy` named catalog in `dependencies`.
 - `packages/pkg-private` is marked `private: true` and should never require a bump.
 
 Tests mutate this fixture inside a temp clone — the originals stay untouched.
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/index.js b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/index.js
new file mode 100644
index 00000000..02d53827
--- /dev/null
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/index.js
@@ -0,0 +1 @@
+module.exports = require('is-number');
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/package.json b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/package.json
new file mode 100644
index 00000000..523c4bb2
--- /dev/null
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-legacy/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@check-coverage-test/pkg-legacy",
+  "version": "1.0.0",
+  "main": "index.js",
+  "dependencies": {
+    "is-number": "catalog:legacy"
+  }
+}
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/index.js b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/index.js
new file mode 100644
index 00000000..02d53827
--- /dev/null
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/index.js
@@ -0,0 +1 @@
+module.exports = require('is-number');
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/package.json b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/package.json
new file mode 100644
index 00000000..35f6c913
--- /dev/null
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/packages/pkg-peer/package.json
@@ -0,0 +1,8 @@
+{
+  "name": "@check-coverage-test/pkg-peer",
+  "version": "1.0.0",
+  "main": "index.js",
+  "peerDependencies": {
+    "is-number": "catalog:"
+  }
+}
diff --git a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/pnpm-workspace.yaml b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/pnpm-workspace.yaml
index 31318b20..f1435f91 100644
--- a/actions/changeset/check-coverage/test/fixtures/minimal-workspace/pnpm-workspace.yaml
+++ b/actions/changeset/check-coverage/test/fixtures/minimal-workspace/pnpm-workspace.yaml
@@ -4,3 +4,7 @@ packages:
 catalog:
   is-number: ^7.0.0
   is-string: ^1.0.7
+
+catalogs:
+  legacy:
+    is-number: ^6.0.0
diff --git a/actions/changeset/check-coverage/test/helpers.bash b/actions/changeset/check-coverage/test/helpers.bash
index 95071aa7..37053536 100644
--- a/actions/changeset/check-coverage/test/helpers.bash
+++ b/actions/changeset/check-coverage/test/helpers.bash
@@ -98,11 +98,17 @@ touch_file() {
   git -C "${WORKSPACE}" commit --quiet -m "edit ${rel}"
 }
 
+# Apply a yq expression to pnpm-workspace.yaml and commit. Args: expression,
+# commit message.
+edit_workspace_yaml() {
+  local expression="$1" message="$2"
+  yq -i "${expression}" "${WORKSPACE}/pnpm-workspace.yaml"
+  git -C "${WORKSPACE}" add pnpm-workspace.yaml
+  git -C "${WORKSPACE}" commit --quiet -m "${message}"
+}
+
 # Bump a default-catalog entry in pnpm-workspace.yaml. Args: key, new-version.
 bump_catalog() {
   local key="$1" version="$2"
-  # yq edits in place.
-  yq -i ".catalog.\"${key}\" = \"${version}\"" "${WORKSPACE}/pnpm-workspace.yaml"
-  git -C "${WORKSPACE}" add pnpm-workspace.yaml
-  git -C "${WORKSPACE}" commit --quiet -m "bump catalog ${key} to ${version}"
+  edit_workspace_yaml ".catalog.\"${key}\" = \"${version}\"" "bump catalog ${key} to ${version}"
 }