@dbx-tools/projen 0.6.145 → 0.6.148

package/index.ts

@@ -44,7 +44,7 @@ export type { DBXToolsProjectLanguage, DBXToolsProjectOptions, DBXToolsProject,
 export { PackageIdentifier, PROJEN_VERSION, DBXToolsNodeProject, ROOT_INSTALL_ONLY_MIXIN, DBXToolsTypeScriptProject } from "./src/project-js.ts";
 export type { DBXToolsJavaScriptProject, DBXToolsJavaScriptProjectOptions, DBXToolsTypeScriptProjectOptions } from "./src/project-js.ts";
 export { DBXToolsPythonProject, DBXToolsPythonWorkspace } from "./src/project-py.ts";
-export type { PythonRepositoryOptions, PythonPackageOptions, DBXToolsPythonProjectOptions, PythonReleaseOptions, DBXToolsPythonWorkspaceOptions } from "./src/project-py.ts";
+export type { PythonRepositoryOptions, PythonPackageOptions, PythonTrustedPublisherOptions, DBXToolsPythonProjectOptions, PythonReleaseOptions, DBXToolsPythonWorkspaceOptions } from "./src/project-py.ts";
 export { UNIFFI_RELEASE_TARGETS, DBXToolsRustProject, DBXToolsRustWorkspace } from "./src/project-rs.ts";
 export type { CargoDependencyOptions, CargoDependency, RustPackageOptions, DBXToolsRustWorkspaceOptions, UniFFIReleaseTarget, RustBindingMapping, RustWorkspaceMapping } from "./src/project-rs.ts";
 export { COMPILED_DIR, COMPILED_COMPILER_OPTIONS } from "./src/publish.ts";

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.145",
-    "@dbx-tools/path": "0.6.145",
-    "@dbx-tools/shared-core": "0.6.145",
+    "@dbx-tools/core": "0.6.148",
+    "@dbx-tools/path": "0.6.148",
+    "@dbx-tools/shared-core": "0.6.148",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -48,7 +48,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.145",
+  "version": "0.6.148",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -515,6 +515,10 @@ export interface DBXToolsJavaScriptProjectOptions
    * `@dbx-tools/projen` engine in `projen/`, tagged `projen-v*`).
    */
   readonly standaloneReleases?: readonly StandaloneRelease[];
+  /** Workflow that must finish successfully before the main Node release runs. */
+  readonly releaseUpstreamWorkflow?: string;
+  /** Main Node release workflow name. Defaults to `node-release`. */
+  readonly releaseWorkflowName?: string | false;
   /**
    * Extra workspace member paths (repo-relative, POSIX) to list in the workspace
    * config ALONGSIDE the discovered `packageRoots` members - for a package that
@@ -1183,6 +1187,8 @@ function initProject(
   new DBXToolsRelease(project as DBXToolsNodeProject, {
     tagPrefix: options.releaseTagPrefix,
     standaloneReleases: options.standaloneReleases,
+    upstreamWorkflow: options.releaseUpstreamWorkflow,
+    workflowName: options.releaseWorkflowName,
   });
 }
 

package/src/project-py.ts

@@ -1,6 +1,6 @@
 /** Reusable uv workspace generation for Python packages hosted in a projen tree. */
 import { string } from "@dbx-tools/shared-core";
-import { Component, type Project, javascript, python, vscode } from "projen";
+import { Component, TextFile, type Project, javascript, python, vscode } from "projen";
 import type { IResolver } from "projen/lib/file";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission } from "projen/lib/github/workflows-model";
@@ -25,6 +25,15 @@ export interface PythonPackageOptions extends DBXToolsProjectOptions {
   readonly scripts?: Readonly<Record<string, string>>;
   /** Keep this package unpublished and out of public docs and releases. */
   readonly private?: boolean;
+  /** Trusted publisher used outside the standard Python release workflow. */
+  readonly trustedPublisher?: PythonTrustedPublisherOptions;
+}
+
+/** GitHub Actions publisher for a Python package released by another workflow. */
+export interface PythonTrustedPublisherOptions {
+  readonly workflowName: string;
+  readonly environment: string;
+  readonly artifacts?: string;
 }
 
 /** Options for one projen-native Python workspace member. */
@@ -40,11 +49,21 @@ export interface DBXToolsPythonProjectOptions extends DBXToolsProjectOptions {
 /** Python release workflow configuration. */
 export interface PythonReleaseOptions {
   readonly workflowName?: string;
+  /** Run after this workflow completes successfully instead of directly on tags. */
+  readonly upstreamWorkflow?: string;
   /** GitHub environment by Python distribution name. Defaults to `pypi-<name>`. */
   readonly environments?: Readonly<Record<string, string>>;
   readonly environmentUrl?: string;
 }
 
+interface PythonPublication {
+  readonly directory: string;
+  readonly distribution: string;
+  readonly environment: string;
+  readonly workflowName: string;
+  readonly artifacts?: string;
+}
+
 /** Options for {@link DBXToolsPythonWorkspace}. */
 export interface DBXToolsPythonWorkspaceOptions {
   readonly packages: readonly PythonPackageOptions[];
@@ -231,13 +250,16 @@ export class DBXToolsPythonWorkspace extends Component {
     }
     this.addTasks(project, options);
 
+    const releaseOptions = options.release === true ? {} : options.release || {};
+    this.addTrustedPublisherInstructionsTask(project, releaseOptions);
+
     const interpreterPath = options.interpreterPath ?? "${workspaceFolder}/.venv/bin/python";
     if (interpreterPath !== false) {
       projectVscode(project)?.settings.addSetting("python.defaultInterpreterPath", interpreterPath);
     }
 
     if (options.release) {
-      this.addReleaseWorkflow(project, options.release === true ? {} : options.release);
+      this.addReleaseWorkflow(project, releaseOptions);
     }
   }
 
@@ -331,11 +353,20 @@ export class DBXToolsPythonWorkspace extends Component {
 
   private addReleaseWorkflow(project: javascript.NodeProject, options: PythonReleaseOptions): void {
     if (!project.github) return;
-    const publishablePackages = this.packages.filter((pkg) => !pkg.packageOptions.private);
-    if (publishablePackages.length === 0) return;
+    const publications = this.publications(options);
+    if (publications.length === 0) return;
     const workflow = new GithubWorkflow(project.github, options.workflowName ?? "python-release");
     workflow.file?.addOverride("permissions", { contents: "read" });
-    workflow.on({ push: { tags: ["v*"] }, workflowDispatch: {} });
+    const upstreamWorkflow = options.upstreamWorkflow;
+    if (upstreamWorkflow) {
+      workflow.file?.addOverride("on.workflow_run", {
+        workflows: [upstreamWorkflow],
+        types: ["completed"],
+      });
+      workflow.on({ workflowDispatch: {} });
+    } else {
+      workflow.on({ push: { tags: ["v*"] }, workflowDispatch: {} });
+    }
     workflow.file?.addOverride("on.workflow_dispatch", {
       inputs: {
         version: {
@@ -346,32 +377,56 @@ export class DBXToolsPythonWorkspace extends Component {
       },
     });
     workflow.addJob("build", {
+      ...(upstreamWorkflow
+        ? {
+            if: "${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push') }}",
+          }
+        : {}),
       runsOn: ["ubuntu-latest"],
       permissions: { contents: JobPermission.READ },
       timeoutMinutes: 20,
       steps: [
-        { name: "Checkout", uses: "actions/checkout@v6" },
+        {
+          name: "Checkout",
+          uses: "actions/checkout@v6",
+          with: {
+            "fetch-depth": 0,
+            ...(upstreamWorkflow
+              ? {
+                  ref: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}",
+                }
+              : {}),
+          },
+        },
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
         {
           name: "Stamp workspace versions",
           env: {
             VERSION: "${{ github.event_name == 'push' && github.ref_name || inputs.version }}",
           },
-          run: this.renderVersionStampScript(),
+          run: upstreamWorkflow
+            ? [
+                'if [ "$GITHUB_EVENT_NAME" = "workflow_run" ]; then',
+                '  VERSION="$(git tag --points-at HEAD --list "v*" | sort -V | tail -1)"',
+                '  test -n "$VERSION"',
+                "fi",
+                this.renderVersionStampScript(),
+              ].join("\n")
+            : this.renderVersionStampScript(),
         },
         {
           name: "Build distributions",
-          run: publishablePackages
+          run: publications
             .map(
-              (pkg) =>
-                `uv build --package ${pkg.packageOptions.name} --out-dir dist/${pkg.packageOptions.directory}`,
+              (publication) =>
+                `uv build --package ${publication.distribution} --out-dir dist/${publication.directory}`,
             )
             .join("\n"),
         },
         {
           name: "Validate distributions",
           run: [
-            `test "$(find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq ${publishablePackages.length * 2}`,
+            `test "$(find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq ${publications.length * 2}`,
             "uvx twine check dist/*/*.whl dist/*/*.tar.gz",
           ].join("\n"),
         },
@@ -382,16 +437,15 @@ export class DBXToolsPythonWorkspace extends Component {
         },
       ],
     });
-    for (const pkg of publishablePackages) {
-      workflow.addJob(`publish-${pkg.packageOptions.directory}`, {
-        if: "${{ github.event_name == 'push' }}",
+    for (const publication of publications) {
+      workflow.addJob(`publish-${publication.directory}`, {
+        if: "${{ github.event_name == 'push' || github.event_name == 'workflow_run' }}",
         needs: ["build"],
         environment: {
-          name:
-            options.environments?.[pkg.packageOptions.name] ?? `pypi-${pkg.packageOptions.name}`,
+          name: publication.environment,
           url:
             options.environmentUrl ??
-            `https://pypi.org/project/${pkg.packageOptions.name.replaceAll("_", "-")}/`,
+            `https://pypi.org/project/${publication.distribution.replaceAll("_", "-")}/`,
         },
         runsOn: ["ubuntu-latest"],
         permissions: { idToken: JobPermission.WRITE },
@@ -403,15 +457,154 @@ export class DBXToolsPythonWorkspace extends Component {
             with: { name: "python-distributions", path: "dist" },
           },
           {
-            name: `Publish ${pkg.packageOptions.name} to PyPI`,
+            name: `Publish ${publication.distribution} to PyPI`,
             uses: "pypa/gh-action-pypi-publish@release/v1",
-            with: { "packages-dir": `dist/${pkg.packageOptions.directory}` },
+            with: { "packages-dir": `dist/${publication.directory}` },
           },
         ],
       });
     }
   }
 
+  private publications(options: PythonReleaseOptions): readonly PythonPublication[] {
+    return this.packages
+      .filter((pkg) => !pkg.packageOptions.private)
+      .map((pkg) => ({
+        directory: pkg.packageOptions.directory,
+        distribution: pkg.packageOptions.name,
+        environment:
+          options.environments?.[pkg.packageOptions.name] ?? `pypi-${pkg.packageOptions.name}`,
+        workflowName: options.workflowName ?? "python-release",
+      }));
+  }
+
+  private trustedPublisherPublications(
+    options: PythonReleaseOptions,
+  ): readonly PythonPublication[] {
+    const standard = new Map(
+      this.publications(options).map((publication) => [publication.distribution, publication]),
+    );
+    for (const pkg of this.packages) {
+      const publisher = pkg.packageOptions.trustedPublisher;
+      if (!publisher || standard.has(pkg.packageOptions.name)) continue;
+      standard.set(pkg.packageOptions.name, {
+        directory: pkg.packageOptions.directory,
+        distribution: pkg.packageOptions.name,
+        environment: publisher.environment,
+        workflowName: publisher.workflowName,
+        artifacts: publisher.artifacts,
+      });
+    }
+    return [...standard.values()];
+  }
+
+  private addTrustedPublisherInstructionsTask(
+    project: javascript.NodeProject,
+    options: PythonReleaseOptions,
+  ): void {
+    const repository = this.githubRepository();
+    const publications = this.trustedPublisherPublications(options);
+    const linesBeforeAuthentication = [
+      "# PyPI Trusted Publisher Setup Instructions",
+      "",
+      "Use a browser to audit and configure the PyPI trusted publishers below.",
+      "",
+      "## Audit and confirmation",
+      "",
+      "Before making any changes, complete a read-only audit:",
+      "",
+      `- Confirm that the active PyPI account is ${repository.owner}.`,
+      "- Start at https://pypi.org/manage/projects/ and determine which listed projects exist.",
+      "- Inspect every existing GitHub publisher for each project and compare its repository owner, repository name, workflow filename, and environment with the desired values below.",
+      "- Identify duplicate and mismatched trusted publishers that must be replaced by removing the publisher entry and adding the correct one.",
+      "- For projects that do not exist, identify the pending publisher that must be created.",
+      "- Report the active account and a proposed reconciliation plan grouped by publishers that will be left unchanged, updated, replaced, created, or removed.",
+      "- Ask the user to confirm the complete proposed plan before submitting any change.",
+      "- After confirmation, perform the authorized plan without asking for additional confirmation unless authentication or a CAPTCHA requires user action.",
+      "",
+      "## Authentication",
+      "",
+    ];
+    const linesAfterAuthentication = [
+      `- If the active account is not ${repository.owner}, pause and ask the user to sign in to the correct account.`,
+      "- Pause and ask the user to complete every CAPTCHA. Do not attempt to solve or bypass a CAPTCHA.",
+      "- After the user completes an authentication or CAPTCHA step, continue from the current browser session.",
+      "",
+      "## Efficient browser workflow",
+      "",
+      "- Reuse or claim an existing PyPI browser tab when available.",
+      "- For an existing project, open its publisher page directly at https://pypi.org/manage/project/<project-name>/settings/publishing/.",
+      "- For a project that does not exist, use the pending-publisher page at https://pypi.org/manage/account/publishing/.",
+      "- Treat the publisher table shown after submission as authoritative confirmation of success, even if the navigation header unexpectedly appears signed out.",
+      "- Platform-specific wheels for different operating systems and CPU architectures do not require separate PyPI projects or trusted publishers.",
+      "",
+      "## Reconciliation rules",
+      "",
+      "- Never delete a PyPI project or package. Every remove or delete action in these instructions applies only to a trusted publisher entry.",
+      "- Treat editing or updating a trusted publisher as replacing that publisher: remove the existing publisher entry, then add the correct one.",
+      "- If exactly one publisher matches, leave it unchanged.",
+      "- If a publisher is mismatched, remove that trusted publisher entry and add the correct one.",
+      "- If no publisher exists, create it.",
+      "- Remove duplicates so exactly one matching publisher remains for each PyPI project and workflow.",
+      "- Use a pending publisher only when the PyPI project does not exist.",
+      "- After every change, verify that the resulting table displays the exact desired configuration.",
+      "- At completion, report which publishers were unchanged, updated, replaced, created, or removed.",
+      "",
+      "Publisher type: GitHub Actions",
+      "",
+      ...publications.flatMap((publication) => {
+        const workflowName = `${publication.workflowName}.yml`;
+        return [
+          `## ${publication.distribution}`,
+          `- PyPI project: ${publication.distribution}`,
+          `- GitHub repository: ${repository.owner}/${repository.name}`,
+          `- Repository owner: ${repository.owner}`,
+          `- Repository name: ${repository.name}`,
+          `- GitHub environment: ${publication.environment}`,
+          `- Workflow filename: ${workflowName}`,
+          `- Workflow path: .github/workflows/${workflowName}`,
+          ...(publication.artifacts ? [`- Artifacts: ${publication.artifacts}`] : []),
+          "",
+        ];
+      }),
+    ];
+    const helper = ".projen/pypi-trusted-publisher-instructions.mjs";
+    new TextFile(project.root, helper, {
+      lines: [
+        "#!/usr/bin/env node",
+        'import { parseArgs } from "node:util";',
+        "",
+        "const { values } = parseArgs({",
+        '  options: { secretFile: { type: "string" } },',
+        "});",
+        `const beforeAuthentication = ${JSON.stringify(linesBeforeAuthentication)};`,
+        `const afterAuthentication = ${JSON.stringify(linesAfterAuthentication)};`,
+        "const authentication = values.secretFile",
+        "  ? [",
+        "      `- If browser authentication is required, read credentials from ${values.secretFile} directly into the browser without printing, logging, or exposing secret values.`,",
+        "      `- If ${values.secretFile} is absent, invalid, or insufficient for authentication, pause and ask the user to complete authentication.`,",
+        "    ]",
+        '  : ["- If browser authentication is required, pause and ask the user to complete authentication."];',
+        'process.stdout.write(`${[...beforeAuthentication, ...authentication, ...afterAuthentication].join("\\n").trimEnd()}\\n`);',
+      ],
+    });
+    project.root.addTask("pypiTrustedPublisherInstructions", {
+      description: "Print browser-agent instructions for PyPI trusted publishers",
+      exec: `node ${helper}`,
+      receiveArgs: true,
+    });
+  }
+
+  private githubRepository(): { readonly owner: string; readonly name: string } {
+    const match = this.repository.url
+      .replace(/\.git$/, "")
+      .match(/github\.com(?:[/:])([^/]+)\/([^/]+)$/);
+    if (!match?.[1] || !match[2]) {
+      throw new Error(`Python repository must be hosted on GitHub: ${this.repository.url}`);
+    }
+    return { owner: match[1], name: match[2] };
+  }
+
   private renderVersionStampScript(): string {
     return [
       `chmod -R u+w ${this.repository.root}`,

package/src/project-rs.ts

@@ -7,6 +7,8 @@ import type { DBXToolsProject } from "./project.ts";
 import { DBXToolsTypeScriptProject } from "./project-js.ts";
 import type { PythonPackageOptions } from "./project-py.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
+import { mixin } from "../index.ts";
+import { isDBXToolsJavaScriptProject, isDBXToolsProject } from "./project-predicate.ts";
 
 export interface CargoDependencyOptions {
   readonly version?: string;
@@ -24,6 +26,8 @@ export interface RustPackageOptions {
   readonly description?: string;
   /** Keep this crate unpublished and out of public docs. */
   readonly private?: boolean;
+  /** Build this crate's binary for each target and attach it to the GitHub release. */
+  readonly release?: boolean;
   readonly dependencies?: Readonly<Record<string, CargoDependency>>;
   readonly devDependencies?: Readonly<Record<string, CargoDependency>>;
   readonly features?: Readonly<Record<string, readonly string[]>>;
@@ -47,10 +51,13 @@ export interface DBXToolsRustWorkspaceOptions {
   readonly nodeRoot?: string;
   readonly pythonRoot?: string;
   readonly pythonModulePrefix?: string;
+  readonly private?: boolean;
   /** Generate tag-driven cross-platform UniFFI package releases. */
   readonly release?: boolean;
   /** Native release targets; defaults to the maintained GitHub-hosted matrix. */
   readonly releaseTargets?: readonly UniFFIReleaseTarget[];
+  /** Workflow name used by downstream release stages. Defaults to `rust-release`. */
+  readonly releaseWorkflowName?: string;
 }
 
 export interface UniFFIReleaseTarget {
@@ -332,7 +339,9 @@ export class DBXToolsRustWorkspace {
       crates: this.packages.map((pkg) => `${root}/${pkg.packageOptions.directory}`),
       bindings: this.bindingMappings,
     };
-    project.dbxToolsConfig.rust = this.workspaceMapping;
+    if (isDBXToolsJavaScriptProject()(project)) {
+      project.dbxToolsConfig.rust = this.workspaceMapping;
+    }
     this.pythonPackages = bindings
       .filter((pkg) => (pkg.packageOptions.bindings ?? ["node", "python"]).includes("python"))
       .map((pkg) => ({
@@ -344,6 +353,15 @@ export class DBXToolsRustWorkspace {
         module: `${options.pythonModulePrefix ?? options.scope.replaceAll("-", "_")}.${pkg.packageOptions.directory.replaceAll("-", "_")}`,
         description: `Python bindings for ${pkg.crateName}`,
         private: true,
+        trustedPublisher: {
+          workflowName: options.releaseWorkflowName ?? "rust-release",
+          environment: `native-${pkg.crateName}`,
+          artifacts: `platform-specific wheels for ${(
+            options.releaseTargets ?? UNIFFI_RELEASE_TARGETS
+          )
+            .map((target) => `${target.os}-${target.cpu}`)
+            .join(", ")}; all architectures publish to this one PyPI project`,
+        },
       }));
 
     const existing = new Map(
@@ -449,13 +467,17 @@ export class DBXToolsRustWorkspace {
         ]),
       ].join(" && "),
     });
-    if ((options.release ?? true) && this.bindingMappings.length > 0) {
-      this.addReleaseWorkflow(project, options.releaseTargets ?? UNIFFI_RELEASE_TARGETS);
+    if (
+      (options.release ?? true) &&
+      (this.bindingMappings.length > 0 || this.packages.some((pkg) => pkg.packageOptions.release))
+    ) {
+      this.addReleaseWorkflow(project, options, options.releaseTargets ?? UNIFFI_RELEASE_TARGETS);
     }
   }
 
   private addReleaseWorkflow(
     project: javascript.NodeProject,
+    options: DBXToolsRustWorkspaceOptions,
     targets: readonly UniFFIReleaseTarget[],
   ): void {
     if (!project.github) return;
@@ -472,9 +494,104 @@ export class DBXToolsRustWorkspace {
         target: { ...target, facade: index === 0 },
       })),
     );
-    new YamlFile(project, ".github/workflows/rust-release.yml", {
+    const releaseBinaries = this.packages
+      .filter((pkg) => pkg.packageOptions.release)
+      .map((pkg) => ({
+        crate: pkg.crateName,
+        binary: pkg.packageOptions.binaryName ?? pkg.crateName,
+      }));
+    const binaryMatrix = releaseBinaries.flatMap((pkg) =>
+      targets.map((target) => ({ package: pkg, target })),
+    );
+    const buildJob = {
+      name: "${{ matrix.binding.crate }} / ${{ matrix.target.node }}",
+      "runs-on": "${{ matrix.target.runner }}",
+      strategy: {
+        "fail-fast": false,
+        matrix: { include: matrix },
+      },
+      steps: [
+        { name: "Checkout", uses: "actions/checkout@v6" },
+        {
+          name: "Setup Bun",
+          uses: "oven-sh/setup-bun@v2",
+          with: { "bun-version": "1.3.14" },
+        },
+        { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
+        {
+          name: "Setup Rust",
+          uses: "dtolnay/rust-toolchain@stable",
+          with: { targets: "${{ matrix.target.cargo }}" },
+        },
+        {
+          name: "Install Linux native dependencies",
+          if: "${{ matrix.target.os == 'linux' }}",
+          run: "sudo apt-get update && sudo apt-get install --yes libdbus-1-dev pkg-config",
+        },
+        { name: "Install", run: "bun install" },
+        {
+          name: "Build thin native packages",
+          shell: "bash",
+          env: {
+            VERSION: "${{ github.event_name == 'push' && github.ref_name || inputs.version }}",
+          },
+          run: 'bun node_modules/@dbx-tools/projen/tasks/uniffi-release.ts build --crate "${{ matrix.binding.crate }}" --rust "${{ matrix.binding.rust }}" --node "${{ matrix.binding.node }}" --python "${{ matrix.binding.python }}" --node-package "${{ matrix.binding.nodePackage }}" --python-package "${{ matrix.binding.pythonPackage }}" --cargo-target "${{ matrix.target.cargo }}" --node-triple "${{ matrix.target.node }}" --python-tag "${{ matrix.target.python }}" --os "${{ matrix.target.os }}" --cpu "${{ matrix.target.cpu }}" --libc "${{ matrix.target.libc }}" --facade "${{ matrix.target.facade }}" --version "${VERSION#v}"',
+        },
+        {
+          name: "Upload native packages",
+          uses: "actions/upload-artifact@v7",
+          with: {
+            name: "${{ matrix.binding.crate }}-${{ matrix.target.node }}",
+            path: [
+              "dist/uniffi/npm/*.tgz",
+              "dist/uniffi/npm-facade/*.tgz",
+              "dist/uniffi/python/*.whl",
+            ].join("\n"),
+          },
+        },
+      ],
+    };
+    const binaryBuildJob = {
+      name: "${{ matrix.package.crate }} / ${{ matrix.target.node }}",
+      "runs-on": "${{ matrix.target.runner }}",
+      strategy: { "fail-fast": false, matrix: { include: binaryMatrix } },
+      steps: [
+        { name: "Checkout", uses: "actions/checkout@v6" },
+        {
+          name: "Setup Rust",
+          uses: "dtolnay/rust-toolchain@stable",
+          with: { targets: "${{ matrix.target.cargo }}" },
+        },
+        {
+          name: "Install Linux native dependencies",
+          if: "${{ matrix.target.os == 'linux' }}",
+          run: "sudo apt-get update && sudo apt-get install --yes libdbus-1-dev pkg-config",
+        },
+        {
+          name: "Build release binary",
+          shell: "bash",
+          run: [
+            'cargo build --release --package "${{ matrix.package.crate }}" --bin "${{ matrix.package.binary }}" --target "${{ matrix.target.cargo }}"',
+            "mkdir -p dist/rust-release",
+            "SOURCE=\"target/${{ matrix.target.cargo }}/release/${{ matrix.package.binary }}${{ matrix.target.os == 'win32' && '.exe' || '' }}\"",
+            "DESTINATION=\"dist/rust-release/${{ matrix.package.binary }}-${{ matrix.target.node }}${{ matrix.target.os == 'win32' && '.exe' || '' }}\"",
+            'cp "$SOURCE" "$DESTINATION"',
+          ].join("\n"),
+        },
+        {
+          name: "Upload release binary",
+          uses: "actions/upload-artifact@v7",
+          with: {
+            name: "release-${{ matrix.package.crate }}-${{ matrix.target.node }}",
+            path: "dist/rust-release/*",
+          },
+        },
+      ],
+    };
+    const workflowName = options.releaseWorkflowName ?? "rust-release";
+    new YamlFile(project, `.github/workflows/${workflowName}.yml`, {
       obj: {
-        name: "rust-release",
+        name: workflowName,
         on: {
           push: { tags: ["v*"] },
           workflow_dispatch: {
@@ -489,118 +606,63 @@ export class DBXToolsRustWorkspace {
         },
         permissions: { contents: "read" },
         jobs: {
-          build: {
-            name: "${{ matrix.binding.crate }} / ${{ matrix.target.node }}",
-            "runs-on": "${{ matrix.target.runner }}",
-            strategy: {
-              "fail-fast": false,
-              matrix: { include: matrix },
-            },
-            steps: [
-              { name: "Checkout", uses: "actions/checkout@v6" },
-              {
-                name: "Setup Bun",
-                uses: "oven-sh/setup-bun@v2",
-                with: { "bun-version": "1.3.14" },
-              },
-              { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
-              {
-                name: "Setup Rust",
-                uses: "dtolnay/rust-toolchain@stable",
-                with: { targets: "${{ matrix.target.cargo }}" },
-              },
-              {
-                name: "Install Linux native dependencies",
-                if: "${{ matrix.target.os == 'linux' }}",
-                run: "sudo apt-get update && sudo apt-get install --yes libdbus-1-dev pkg-config",
-              },
-              { name: "Install", run: "bun install" },
-              {
-                name: "Build thin native packages",
-                shell: "bash",
-                env: {
-                  VERSION:
-                    "${{ github.event_name == 'push' && github.ref_name || inputs.version }}",
+          ...(matrix.length ? { build: buildJob } : {}),
+          ...(binaryMatrix.length ? { "build-binaries": binaryBuildJob } : {}),
+          ...(bindings.length
+            ? {
+                publish: {
+                  if: "${{ github.event_name == 'push' }}",
+                  needs: ["build"],
+                  "runs-on": "ubuntu-latest",
+                  strategy: { matrix: { binding: bindings } },
+                  permissions: { contents: "read", "id-token": "write" },
+                  environment: { name: "native-${{ matrix.binding.crate }}" },
+                  steps: [
+                    { name: "Checkout", uses: "actions/checkout@v6" },
+                    {
+                      name: "Setup Node.js",
+                      uses: "actions/setup-node@v6",
+                      with: { "registry-url": "https://registry.npmjs.org" },
+                    },
+                    {
+                      name: "Setup Bun",
+                      uses: "oven-sh/setup-bun@v2",
+                      with: { "bun-version": "1.3.14" },
+                    },
+                    { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
+                    { name: "Install", run: "bun install" },
+                    {
+                      name: "Download packages",
+                      uses: "actions/download-artifact@v8",
+                      with: {
+                        pattern: "${{ matrix.binding.crate }}-*",
+                        path: "dist/uniffi",
+                        "merge-multiple": true,
+                      },
+                    },
+                    {
+                      name: "Publish npm packages",
+                      env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
+                      run: 'for package in dist/uniffi/npm/*.tgz; do npm publish "$package" --access public; done',
+                    },
+                    {
+                      name: "Publish npm facades",
+                      if: "${{ matrix.binding.node != '' }}",
+                      env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
+                      run: 'for package in dist/uniffi/npm-facade/*.tgz; do npm publish "$package" --access public; done',
+                    },
+                    {
+                      name: "Publish Python wheels",
+                      if: "${{ matrix.binding.python != '' }}",
+                      run: "uv publish --trusted-publishing always dist/uniffi/python/*.whl",
+                    },
+                  ],
                 },
-                run: 'bun node_modules/@dbx-tools/projen/tasks/uniffi-release.ts build --crate "${{ matrix.binding.crate }}" --rust "${{ matrix.binding.rust }}" --node "${{ matrix.binding.node }}" --python "${{ matrix.binding.python }}" --node-package "${{ matrix.binding.nodePackage }}" --python-package "${{ matrix.binding.pythonPackage }}" --cargo-target "${{ matrix.target.cargo }}" --node-triple "${{ matrix.target.node }}" --python-tag "${{ matrix.target.python }}" --os "${{ matrix.target.os }}" --cpu "${{ matrix.target.cpu }}" --libc "${{ matrix.target.libc }}" --facade "${{ matrix.target.facade }}" --version "${VERSION#v}"',
-              },
-              {
-                name: "Upload native packages",
-                uses: "actions/upload-artifact@v7",
-                with: {
-                  name: "${{ matrix.binding.crate }}-${{ matrix.target.node }}",
-                  path: [
-                    "dist/uniffi/npm/*.tgz",
-                    "dist/uniffi/npm-facade/*.tgz",
-                    "dist/uniffi/python/*.whl",
-                  ].join("\n"),
-                },
-              },
-            ],
-          },
-          publish: {
-            if: "${{ github.event_name == 'push' }}",
-            needs: ["build"],
-            "runs-on": "ubuntu-latest",
-            strategy: { matrix: { binding: bindings } },
-            permissions: { contents: "read", "id-token": "write" },
-            environment: { name: "native-${{ matrix.binding.crate }}" },
-            steps: [
-              { name: "Checkout", uses: "actions/checkout@v6" },
-              {
-                name: "Setup Node.js",
-                uses: "actions/setup-node@v6",
-                with: { "registry-url": "https://registry.npmjs.org" },
-              },
-              {
-                name: "Setup Bun",
-                uses: "oven-sh/setup-bun@v2",
-                with: { "bun-version": "1.3.14" },
-              },
-              { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
-              { name: "Install", run: "bun install" },
-              {
-                name: "Publish workspace npm dependencies",
-                if: "${{ matrix.binding.node != '' }}",
-                env: {
-                  NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
-                  NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
-                },
-                run: [
-                  'VERSION="${GITHUB_REF_NAME#v}"',
-                  'bun node_modules/@dbx-tools/projen/tasks/publish.ts "$VERSION" --exclude projen --exclude "${{ matrix.binding.node }}"',
-                ].join("\n"),
-              },
-              {
-                name: "Download packages",
-                uses: "actions/download-artifact@v8",
-                with: {
-                  pattern: "${{ matrix.binding.crate }}-*",
-                  path: "dist/uniffi",
-                  "merge-multiple": true,
-                },
-              },
-              {
-                name: "Publish npm packages",
-                env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
-                run: 'for package in dist/uniffi/npm/*.tgz; do npm publish "$package" --access public; done',
-              },
-              {
-                name: "Publish npm facades",
-                if: "${{ matrix.binding.node != '' }}",
-                env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
-                run: 'for package in dist/uniffi/npm-facade/*.tgz; do npm publish "$package" --access public; done',
-              },
-              {
-                name: "Publish Python wheels",
-                if: "${{ matrix.binding.python != '' }}",
-                run: "uv publish --trusted-publishing always dist/uniffi/python/*.whl",
-              },
-            ],
-          },
+              }
+            : {}),
           "publish-cargo": {
             if: "${{ github.event_name == 'push' }}",
-            needs: ["build"],
+            needs: [matrix.length ? "build" : "build-binaries"],
             "runs-on": "ubuntu-latest",
             permissions: { contents: "read" },
             steps: [
@@ -642,6 +704,35 @@ export class DBXToolsRustWorkspace {
               },
             ],
           },
+          ...(binaryMatrix.length
+            ? {
+                "publish-github-release": {
+                  if: "${{ github.event_name == 'push' }}",
+                  needs: ["build-binaries"],
+                  "runs-on": "ubuntu-latest",
+                  permissions: { contents: "write" },
+                  steps: [
+                    {
+                      name: "Download release binaries",
+                      uses: "actions/download-artifact@v8",
+                      with: {
+                        pattern: "release-*",
+                        path: "dist/rust-release",
+                        "merge-multiple": true,
+                      },
+                    },
+                    {
+                      name: "Publish GitHub release assets",
+                      uses: "softprops/action-gh-release@v2",
+                      with: {
+                        files: "dist/rust-release/*",
+                        "generate-release-notes": true,
+                      },
+                    },
+                  ],
+                },
+              }
+            : {}),
         },
       },
     });

package/src/release.ts

@@ -41,6 +41,9 @@ function BUN_PUBLISH_SCRIPT(tagPrefix: string, excludeDirs: readonly string[]):
     // A manual run has no tag: use a throwaway version and never really publish.
     '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
     "  DRY_RUN=--dry-run",
+    'elif [ -n "${RELEASE_VERSION:-}" ]; then',
+    '  VERSION="$RELEASE_VERSION"',
+    "  DRY_RUN=",
     "else",
     `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
     // A tag push honors the input too, so a dry-run tag can be tested if wanted.
@@ -56,6 +59,7 @@ interface PublishWorkflow {
   readonly tagPrefix: string;
   readonly steps: readonly JobStep[];
   readonly workingDirectory?: string;
+  readonly upstreamWorkflow?: string;
 }
 
 /** Shared checkout and toolchain setup for every npm publish workflow. */
@@ -120,6 +124,10 @@ export interface DBXToolsReleaseOptions {
    * component. Defaults to none.
    */
   readonly standaloneReleases?: readonly StandaloneRelease[];
+  /** Run the main Node release after this workflow completes successfully. */
+  readonly upstreamWorkflow?: string;
+  /** Main Node release workflow name. Defaults to `node-release`. */
+  readonly workflowName?: string | false;
 }
 
 /**
@@ -151,11 +159,15 @@ export interface DBXToolsReleaseOptions {
 export class DBXToolsRelease extends Component {
   private readonly tagPrefix: string;
   private readonly standaloneReleases: readonly StandaloneRelease[];
+  private readonly upstreamWorkflow?: string;
+  private readonly workflowName: string | false;
 
   constructor(project: DBXToolsNodeProject, options: DBXToolsReleaseOptions = {}) {
     super(project);
     this.tagPrefix = options.tagPrefix ?? "v";
     this.standaloneReleases = options.standaloneReleases ?? [];
+    this.upstreamWorkflow = options.upstreamWorkflow;
+    this.workflowName = options.workflowName ?? "node-release";
   }
 
   public override preSynthesize(): void {
@@ -176,7 +188,7 @@ export class DBXToolsRelease extends Component {
     // Author the tag-driven publish workflows only when GitHub is enabled - they
     // live in `.github/`, which requires projen's GitHub component.
     if (project.github) {
-      this.authorReleaseWorkflow(project);
+      if (this.workflowName) this.authorReleaseWorkflow(project);
       for (const standalone of this.standaloneReleases) {
         this.authorStandaloneReleaseWorkflow(project, standalone);
       }
@@ -186,7 +198,7 @@ export class DBXToolsRelease extends Component {
   /** Author the common tag trigger, concurrency policy, permissions, and publish job. */
   private authorPublishWorkflow(
     project: DBXToolsNodeProject,
-    { name, tagPrefix, steps, workingDirectory }: PublishWorkflow,
+    { name, tagPrefix, steps, workingDirectory, upstreamWorkflow }: PublishWorkflow,
   ): void {
     const workflow = new GithubWorkflow(project.github!, name, {
       // Serialize publishes so two tags landing together cannot race to the
@@ -198,7 +210,14 @@ export class DBXToolsRelease extends Component {
     // Read-only floor for any job that does not declare its own permissions;
     // the publish job below overrides it with the `id-token` it needs.
     workflow.file?.addOverride("permissions", { contents: "read" });
-    workflow.on({ push: { tags: [`${tagPrefix}*`] } });
+    if (upstreamWorkflow) {
+      workflow.file?.addOverride("on.workflow_run", {
+        workflows: [upstreamWorkflow],
+        types: ["completed"],
+      });
+    } else {
+      workflow.on({ push: { tags: [`${tagPrefix}*`] } });
+    }
     // Manual trigger for testing the workflow WITHOUT reaching npm: a
     // `workflow_dispatch` run has no tag, so the publish script forces
     // `--dry-run` (pack + validate only). The `dry_run` input (default true)
@@ -213,6 +232,11 @@ export class DBXToolsRelease extends Component {
       },
     });
     workflow.addJob("publish", {
+      ...(upstreamWorkflow
+        ? {
+            if: "${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'workflow_run') }}",
+          }
+        : {}),
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
       permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
@@ -223,7 +247,35 @@ export class DBXToolsRelease extends Component {
         CI: "true",
         DRY_RUN_INPUT: "${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}",
       },
-      steps: [...publishSetupSteps(), ...steps],
+      steps: [
+        ...publishSetupSteps().map((step) =>
+          step.name === "Checkout" && upstreamWorkflow
+            ? {
+                ...step,
+                with: {
+                  ...step.with,
+                  ref: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}",
+                },
+              }
+            : step,
+        ),
+        ...(upstreamWorkflow
+          ? [
+              {
+                name: "Resolve release tag",
+                run: [
+                  'RELEASE_TAG="$(git tag --points-at HEAD --list "' +
+                    tagPrefix +
+                    '*" | sort -V | tail -1)"',
+                  'test -n "$RELEASE_TAG"',
+                  'echo "RELEASE_TAG=$RELEASE_TAG" >> "$GITHUB_ENV"',
+                  `echo "RELEASE_VERSION=\${RELEASE_TAG#${tagPrefix}}" >> "$GITHUB_ENV"`,
+                ].join("\n"),
+              } satisfies JobStep,
+            ]
+          : []),
+        ...steps,
+      ],
       ...(workingDirectory ? { defaults: { run: { workingDirectory } } } : {}),
     });
   }
@@ -235,9 +287,12 @@ export class DBXToolsRelease extends Component {
    * (no bump math).
    */
   private authorReleaseWorkflow(project: DBXToolsNodeProject): void {
+    if (!this.workflowName) return;
+    if (this.workflowName !== "release") project.tryRemoveFile(".github/workflows/release.yml");
     this.authorPublishWorkflow(project, {
-      name: "release",
+      name: this.workflowName,
       tagPrefix: this.tagPrefix,
+      upstreamWorkflow: this.upstreamWorkflow,
       steps: [
         // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Stamp it on
         // every workspace package (manifests are projen-readonly, so unlock

package/tasks/uniffi.ts

@@ -65,7 +65,13 @@ const replaceGenerated = (source: string, destination: string): void => {
   mkdirSync(dirname(destination), { recursive: true });
   makeWritable(destination);
   rmSync(destination, { force: true });
-  renameSync(source, destination);
+  try {
+    renameSync(source, destination);
+  } catch (error) {
+    if (!(error instanceof Error) || !("code" in error) || error.code !== "EXDEV") throw error;
+    cpSync(source, destination);
+    rmSync(source, { force: true });
+  }
 };
 
 const stampGeneratedPython = (file: string): void => {