@dbx-tools/projen 0.6.15 → 0.6.27

package/README.md

@@ -95,7 +95,12 @@ barrels.generateBarrels();
 
 `generateCodegen()` reads `package.json` `codegen.inputs` and writes generated
 schema modules. `generateBarrels()` writes package-root `index.ts` barrels with
-module namespaces and flat unique type exports.
+module namespaces and flat unique type exports, returning the number that
+actually changed. A barrel whose export surface is unchanged is left untouched,
+read-only bit included, so concurrent writers never collide over it. Every
+package is attempted even if one fails; the failures are re-thrown together as an
+`AggregateError` naming each package, rather than the first one abandoning the
+rest of the sweep.
 
 ## Generate OpenAPI Clients
 

package/package.json

@@ -32,7 +32,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.15",
+  "version": "0.6.27",
   "types": "index.ts",
   "type": "module",
   "exports": {
@@ -51,6 +51,7 @@
     "clobber": "projen clobber",
     "compile": "projen compile",
     "default": "projen default",
+    "demo": "projen demo",
     "eject": "projen eject",
     "package": "projen package",
     "post-compile": "projen post-compile",

package/src/barrels.ts

@@ -36,19 +36,13 @@
  * The result gets a do-not-edit header + read-only bit (see `./generated`).
  */
 import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, relative } from "node:path";
 import { find } from "@dbx-tools/path";
 import { string } from "@dbx-tools/shared-core";
 import isIdentifier from "is-identifier";
-import {
-  header,
-  makeReadonly,
-  makeWritable,
-  stampGenerated,
-  type HeaderOpts,
-} from "./generated.ts";
+import { header, makeReadonly, makeWritable, type HeaderOpts } from "./generated.ts";
 import { moduleExports, moduleStatements, type ModuleExport } from "./module-exports.ts";
-import { isModuleFile, toPosix, recordedPackages } from "./packages.ts";
+import { isModuleFile, toPosix, recordedPackages, repoRoot } from "./packages.ts";
 
 /**
  * A `src`-relative posix path excluded from the root barrel:
@@ -292,9 +286,6 @@ function generateForPackage(pkgDir: string): number {
     return 0;
   }
 
-  // Unlock the read-only barrel so the rewrite below can replace it.
-  makeWritable(rootBarrel);
-
   // `./src/<path>` with the module's REAL extension, namespaced by its path
   // segments (camelCase; invalid identifiers suffixed with `Module`). The
   // extension is written because `tsc` rewrites it on emit
@@ -315,30 +306,90 @@ function generateForPackage(pkgDir: string): number {
   content = mergeCustomExports(content, pkgDir);
 
   // The barrel only *changes* when its set of exporting modules does. If the
-  // stamped result matches what's already on disk, restore the read-only bit we
-  // cleared above and report no change (0) - this keeps the watcher quiet on
-  // ordinary in-file edits (which leave the export * as … list identical).
+  // stamped result matches what's already on disk, leave the file - and its
+  // read-only bit - completely untouched and report no change (0). This keeps the
+  // watcher quiet on ordinary in-file edits (which leave the export * as … list
+  // identical), and it is also what keeps a no-op cycle off the read-only bit
+  // entirely: see {@link writeBarrel} for why unlocking a barrel we are not about
+  // to rewrite is what produced spurious EACCES failures.
   content = `${content.replace(/\n+$/, "")}\n`;
   const next = `${header(BARREL_HEADER)}\n${content}`;
-  if (before === next) {
-    makeReadonly(rootBarrel);
-    return 0;
-  }
+  if (before === next) return 0;
 
-  writeFileSync(rootBarrel, content);
-  stampGenerated(rootBarrel, BARREL_HEADER);
+  // Written whole (header included) rather than via `stampGenerated`, which would
+  // re-read and rewrite the file to prepend the same header - a second write, and
+  // therefore a second window in which the read-only bit can come back. `next` is
+  // byte-for-byte what the comparison above accepted, so the two cannot drift.
+  writeBarrel(rootBarrel, next);
+  makeReadonly(rootBarrel);
   return 1;
 }
 
+/**
+ * Attempts at unlocking and writing a barrel before giving up. A sibling process
+ * can restore the read-only bit between the two.
+ */
+const WRITE_ATTEMPTS = 3;
+
+/**
+ * Unlock a read-only barrel and replace it, retrying on `EACCES`.
+ *
+ * The unlock cannot be hoisted to the top of {@link generateForPackage}: several
+ * processes write barrels concurrently under `sync --watch` (the barrels watcher,
+ * and the projenrc watcher's post-synth `generateBarrels()` sweep), so any gap
+ * between `makeWritable` and the write is a window in which another process's
+ * `makeReadonly` lands and this write fails with
+ * `EACCES: permission denied, open '<pkg>/index.ts'`. The gap used to span all of
+ * the oxc parsing done for export hoisting, which made it wide enough to hit
+ * routinely. Keeping the unlock adjacent to the write shrinks it to nothing much,
+ * and a retry absorbs what is left.
+ *
+ * Do NOT "simplify" this back to a single unlock-then-write: the failure is
+ * timing-dependent, so it looks fine until a full-repo sweep runs against a
+ * concurrent one.
+ */
+function writeBarrel(file: string, content: string): void {
+  for (let attempt = 1; ; attempt++) {
+    makeWritable(file);
+    try {
+      writeFileSync(file, content);
+      return;
+    } catch (err) {
+      const code = (err as NodeJS.ErrnoException).code;
+      if (code !== "EACCES" || attempt >= WRITE_ATTEMPTS) throw err;
+    }
+  }
+}
+
 /**
  * Rebuild barrels for the given package dirs (default: every package recorded in
  * `pnpm-workspace.yaml` - the source of truth, read via `recordedPackages()`).
  * Returns the number of barrels whose contents actually changed (an unchanged
  * export surface is a no-op), so callers can stay quiet when nothing moved.
+ *
+ * Every package is attempted even if an earlier one fails, and the failures are
+ * re-thrown together as an `AggregateError` naming each package. Letting the first
+ * failure propagate instead abandoned every package after it in the iteration
+ * order, so one unwritable barrel silently left the rest of the repo stale with
+ * nothing in the log to say which packages had been skipped.
  */
 export function generateBarrels(opts: { dirs?: string[] } = {}): number {
   const dirs = opts.dirs ?? recordedPackages().map((p) => p.dir);
   let total = 0;
-  for (const dir of dirs) total += generateForPackage(dir);
+  const failures: { dir: string; err: unknown }[] = [];
+  for (const dir of dirs) {
+    try {
+      total += generateForPackage(dir);
+    } catch (err) {
+      failures.push({ dir, err });
+    }
+  }
+  if (failures.length) {
+    const names = failures.map((f) => relative(repoRoot, f.dir) || f.dir);
+    throw new AggregateError(
+      failures.map((f) => f.err),
+      `${string.pluralize(failures.length, "barrel")} failed: ${names.join(", ")}`,
+    );
+  }
   return total;
 }

package/src/release.ts

@@ -6,9 +6,38 @@
  */
 import { Component } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
-import { JobPermission } from "projen/lib/github/workflows-model";
+import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
 import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
 
+const NODE_VERSION = "lts/*";
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const PNPM_VERSION = "10.33.0";
+
+interface PublishWorkflow {
+  readonly name: string;
+  readonly tagPrefix: string;
+  readonly steps: readonly JobStep[];
+  readonly workingDirectory?: string;
+}
+
+/** Shared checkout and toolchain setup for every npm publish workflow. */
+function publishSetupSteps(): JobStep[] {
+  return [
+    { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
+    { name: "Setup pnpm", uses: "pnpm/action-setup@v5", with: { version: PNPM_VERSION } },
+    {
+      name: "Setup Node.js",
+      uses: "actions/setup-node@v6",
+      // setup-node writes the temporary npmrc that maps NODE_AUTH_TOKEN onto
+      // npmjs. Omitting this leaves the secret in the environment but gives npm
+      // no registry-scoped auth entry, and every publish fails with ENEEDAUTH.
+      with: { "node-version": NODE_VERSION, "registry-url": NPM_REGISTRY_URL },
+    },
+    // The lockfile is intentionally untracked and may be absent or stale in CI.
+    { name: "Install", run: "pnpm install --no-frozen-lockfile" },
+  ];
+}
+
 /**
  * A standalone project that lives in a repo SUBDIRECTORY but is NOT a member of
  * this pnpm workspace (e.g. the `@dbx-tools/projen` engine in `projen/`), yet
@@ -115,43 +144,44 @@ export class DBXToolsRelease extends Component {
     }
   }
 
-  /**
-   * Emit the `release` GitHub workflow: push `<prefix>1.2.3` and every
-   * publishable package is published to npm at 1.2.3. Setting the
-   * version on every package first makes the pushed tag the published version
-   * (no bump math).
-   */
-  private authorReleaseWorkflow(project: DBXToolsNodeProject): void {
-    const workflow = new GithubWorkflow(project.github!, "release", {
+  /** Author the common tag trigger, concurrency policy, permissions, and publish job. */
+  private authorPublishWorkflow(
+    project: DBXToolsNodeProject,
+    { name, tagPrefix, steps, workingDirectory }: PublishWorkflow,
+  ): void {
+    const workflow = new GithubWorkflow(project.github!, name, {
       // Serialize publishes so two tags landing together cannot race to the
       // registry, but never cancel a run already in flight: a half-published
       // release is worse than a queued one.
       limitConcurrency: true,
-      concurrencyOptions: { group: "release", cancelInProgress: false },
+      concurrencyOptions: { group: name, cancelInProgress: false },
     });
     // Read-only floor for any job that does not declare its own permissions;
     // the publish job below overrides it with the `id-token` it needs.
     workflow.file?.addOverride("permissions", { contents: "read" });
-    workflow.on({ push: { tags: [`${this.tagPrefix}*`] } });
+    workflow.on({ push: { tags: [`${tagPrefix}*`] } });
     workflow.addJob("publish", {
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
       permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
       timeoutMinutes: 30,
       env: { CI: "true" },
+      steps: [...publishSetupSteps(), ...steps],
+      ...(workingDirectory ? { defaults: { run: { workingDirectory } } } : {}),
+    });
+  }
+
+  /**
+   * Emit the `release` GitHub workflow: push `<prefix>1.2.3` and every
+   * publishable package is published to npm at 1.2.3. Setting the
+   * version on every package first makes the pushed tag the published version
+   * (no bump math).
+   */
+  private authorReleaseWorkflow(project: DBXToolsNodeProject): void {
+    this.authorPublishWorkflow(project, {
+      name: "release",
+      tagPrefix: this.tagPrefix,
       steps: [
-        { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
-        { name: "Setup pnpm", uses: "pnpm/action-setup@v5", with: { version: "10.33.0" } },
-        {
-          name: "Setup Node.js",
-          uses: "actions/setup-node@v6",
-          with: { "node-version": "lts/*", "registry-url": "https://registry.npmjs.org" },
-        },
-        // NOT frozen. The lockfile is gitignored by policy (it can carry a
-        // private-registry fingerprint), so CI often has none or a stale one -
-        // and `--frozen-lockfile` turns that into a hard release failure rather
-        // than resolving. A blocked publish is worse here than a resolved one.
-        { name: "Install", run: "pnpm install --no-frozen-lockfile" },
         // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Set it on
         // every package (manifests are projen-readonly, so unlock them first).
         {
@@ -189,32 +219,11 @@ export class DBXToolsRelease extends Component {
     project: DBXToolsNodeProject,
     { name, directory, tagPrefix }: StandaloneRelease,
   ): void {
-    const workflow = new GithubWorkflow(project.github!, name, {
-      limitConcurrency: true,
-      concurrencyOptions: { group: name, cancelInProgress: false },
-    });
-    workflow.file?.addOverride("permissions", { contents: "read" });
-    workflow.on({ push: { tags: [`${tagPrefix}*`] } });
-    workflow.addJob("publish", {
-      runsOn: ["ubuntu-latest"],
-      // `id-token: write` lets npm mint the OIDC token for provenance attestation.
-      permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
-      timeoutMinutes: 30,
-      defaults: { run: { workingDirectory: directory } },
-      env: { CI: "true" },
+    this.authorPublishWorkflow(project, {
+      name,
+      tagPrefix,
+      workingDirectory: directory,
       steps: [
-        { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
-        { name: "Setup pnpm", uses: "pnpm/action-setup@v5", with: { version: "10.33.0" } },
-        {
-          name: "Setup Node.js",
-          uses: "actions/setup-node@v6",
-          with: { "node-version": "lts/*", "registry-url": "https://registry.npmjs.org" },
-        },
-        // NOT frozen. The lockfile is gitignored by policy (it can carry a
-        // private-registry fingerprint), so CI often has none or a stale one -
-        // and `--frozen-lockfile` turns that into a hard release failure rather
-        // than resolving. A blocked publish is worse here than a resolved one.
-        { name: "Install", run: "pnpm install --no-frozen-lockfile" },
         // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. package.json
         // is projen-generated read-only, so unlock it before `npm version` writes.
         {

package/tasks/barrels.ts

@@ -19,11 +19,28 @@ if (process.argv.includes("--watch")) {
   watchLoop("barrels", watchRoots(), (changed) => {
     const pkgDirs = recordedPackages().map((p) => p.dir);
     const dirs = new Set<string>();
+    const unowned: string[] = [];
     for (const p of changed) {
       const owner = ownerPackageDir(p, pkgDirs);
       if (owner) dirs.add(owner);
+      else unowned.push(p);
     }
-    const n = generateBarrels(dirs.size ? { dirs: [...dirs] } : {});
+    // A change under a package root that no RECORDED package owns is almost always a
+    // NEW package folder: it has no `pnpm-workspace.yaml` member yet, so there is no
+    // barrel for this watcher to target and only a re-synth can create one. Say so,
+    // rather than rebuilding every barrel in the repo - the previous fallback, which
+    // did a full-repo sweep on behalf of a file it could not barrel anyway, and in
+    // doing so raced the projenrc watcher's own post-synth sweep.
+    if (dirs.size === 0) {
+      if (unowned.length) {
+        logger.warn(
+          `no recorded package owns ${string.pluralize(unowned.length, "change")}; ` +
+            "run `pnpm exec projen` (or touch .projenrc.ts) to pick up a new package folder",
+        );
+      }
+      return;
+    }
+    const n = generateBarrels({ dirs: [...dirs] });
     if (n) logger.success(`rebuilt ${string.pluralize(n, "barrel")}`);
   });
 } else {

package/tasks/bump.ts

@@ -39,11 +39,11 @@
  *   - `false`: never publish locally.
  *   - a URL: always publish to that registry.
  */
-import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { Command, Option } from "commander";
 import { exec, project } from "@dbx-tools/core";
 import { log, net } from "@dbx-tools/shared-core";
+import { Command, Option } from "commander";
+import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
 
 const logger = log.logger("projen:bump");
 const LEVELS = ["patch", "minor", "major"] as const;
@@ -229,7 +229,7 @@ program
       const tags = prefixes.map((prefix) => `${prefix}${version}`);
       logger.info(
         `bump ${base.join(".")} -> ${version} (${opts.level}); tags ${tags.join(", ")}` +
-          `${tagged.length ? "" : " [no remote tag]"}`,
+        `${tagged.length ? "" : " [no remote tag]"}`,
       );
       for (const t of tagged) {
         if (compareSemver(t.version, base) < 0) {
@@ -288,8 +288,7 @@ program
             stdin: "ignore",
             check: true,
           });
-        const runInRepo = (command: string, args: string[]) =>
-          runIn(process.cwd(), command, args);
+        const runInRepo = (command: string, args: string[]) => runIn(process.cwd(), command, args);
         // Each package keeps `version: 0.0.0` on disk (projen owns the
         // manifest); the root bump above only touched the root. Mirror the CI
         // `release` workflow: stamp the release version on EVERY package (they're