@dbx-tools/projen 0.6.153 → 0.6.160

package/src/release-dispatch.ts

@@ -0,0 +1,36 @@
+/** Shared release events and immutable source verification. */
+export const DOWNSTREAM_RELEASE_EVENT = "release";
+export const RUST_RELEASE_EVENT = "rust-release";
+export const RELEASE_TAG =
+  "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.release_tag || inputs.release_tag }}";
+export const RELEASE_SHA =
+  "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.expected_sha || inputs.expected_sha }}";
+
+/** Check out and verify the exact commit carried by a release event. */
+export function releaseSourceSteps(): readonly Record<string, unknown>[] {
+  return [
+    {
+      name: "Checkout release commit",
+      uses: "actions/checkout@v6",
+      with: {
+        ref: RELEASE_SHA,
+        "fetch-depth": 1,
+      },
+    },
+    {
+      name: "Verify release source",
+      shell: "bash",
+      env: {
+        RELEASE_TAG,
+        EXPECTED_SHA: RELEASE_SHA,
+      },
+      run: [
+        'test -n "$RELEASE_TAG"',
+        'test -n "$EXPECTED_SHA"',
+        'git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
+        'test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$EXPECTED_SHA"',
+        'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"',
+      ].join("\n"),
+    },
+  ];
+}

package/src/release.ts

@@ -4,10 +4,20 @@
  * the project has a GitHub component - authors the tag-driven npm publish
  * workflow that the pushed tag triggers.
  */
-import { Component } from "projen";
+import { rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { Component, YamlFile } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
+import { object } from "@dbx-tools/shared-core";
 import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
+import {
+  DOWNSTREAM_RELEASE_EVENT,
+  RELEASE_SHA,
+  RELEASE_TAG,
+  RUST_RELEASE_EVENT,
+  releaseSourceSteps,
+} from "./release-dispatch.ts";
 
 const NODE_VERSION = "lts/*";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
@@ -168,10 +178,27 @@ export class DBXToolsRelease extends Component {
     this.standaloneReleases = options.standaloneReleases ?? [];
     this.upstreamWorkflow = options.upstreamWorkflow;
     this.workflowName = options.workflowName ?? "node-release";
+    if (project.github) this.authorReleaseDispatcher(project);
   }
 
   public override preSynthesize(): void {
     const project = this.project as DBXToolsNodeProject;
+    const rust = project.dbxToolsConfig.rust;
+    if (
+      !this.workflowName &&
+      this.standaloneReleases.length === 0 &&
+      typeof project.dbxToolsConfig.pythonReleaseWorkflow !== "string" &&
+      !(object.isRecord(rust) && typeof rust.releaseWorkflow === "string")
+    ) {
+      project.tryRemoveFile(".github/workflows/release-dispatch.yml");
+    }
+    const releaseEvent =
+      object.isRecord(rust) && typeof rust.releaseWorkflow === "string"
+        ? RUST_RELEASE_EVENT
+        : DOWNSTREAM_RELEASE_EVENT;
+    project
+      .tryFindObjectFile(".github/workflows/release-dispatch.yml")
+      ?.addOverride("jobs.dispatch.steps.1.env.RELEASE_EVENT", releaseEvent);
     // Release the standalone projects in the SAME run, at the same version. They
     // are not workspace members, so nothing else would ever bring them along.
     const siblingArgs = this.standaloneReleases
@@ -195,11 +222,60 @@ export class DBXToolsRelease extends Component {
     }
   }
 
+  public override postSynthesize(): void {
+    rmSync(resolve(this.project.outdir, ".github/workflows/rust-release-dispatch.yml"), {
+      force: true,
+    });
+  }
+
+  private authorReleaseDispatcher(project: DBXToolsNodeProject): void {
+    new YamlFile(project, ".github/workflows/release-dispatch.yml", {
+      obj: {
+        name: "release-dispatch",
+        on: { push: { tags: [`${this.tagPrefix}*`] } },
+        permissions: { contents: "write" },
+        jobs: {
+          dispatch: {
+            "runs-on": "ubuntu-latest",
+            steps: [
+              {
+                name: "Checkout release tag",
+                uses: "actions/checkout@v6",
+                with: { "fetch-depth": 1 },
+              },
+              {
+                name: "Dispatch release",
+                shell: "bash",
+                env: {
+                  GH_TOKEN: "${{ github.token }}",
+                  RELEASE_TAG: "${{ github.ref_name }}",
+                  RELEASE_EVENT: DOWNSTREAM_RELEASE_EVENT,
+                },
+                run: [
+                  `case "$RELEASE_TAG" in ${this.tagPrefix}*) ;; *) exit 1 ;; esac`,
+                  'EXPECTED_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
+                  [
+                    'gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches"',
+                    '--raw-field event_type="$RELEASE_EVENT"',
+                    '--raw-field "client_payload[release_tag]=$RELEASE_TAG"',
+                    '--raw-field "client_payload[expected_sha]=$EXPECTED_SHA"',
+                  ].join(" \\\n  "),
+                ].join("\n"),
+              },
+            ],
+          },
+        },
+      },
+    });
+  }
+
   /** Author the common tag trigger, concurrency policy, permissions, and publish job. */
   private authorPublishWorkflow(
     project: DBXToolsNodeProject,
     { name, tagPrefix, steps, workingDirectory, upstreamWorkflow }: PublishWorkflow,
   ): void {
+    const setupSteps = publishSetupSteps();
+    const branchDispatch = upstreamWorkflow === undefined;
     const workflow = new GithubWorkflow(project.github!, name, {
       // Serialize publishes so two tags landing together cannot race to the
       // registry, but never cancel a run already in flight: a half-published
@@ -209,14 +285,19 @@ export class DBXToolsRelease extends Component {
     });
     // Read-only floor for any job that does not declare its own permissions;
     // the publish job below overrides it with the `id-token` it needs.
-    workflow.file?.addOverride("permissions", { contents: "read" });
+    workflow.file?.addOverride("permissions", {
+      contents: "read",
+      ...(upstreamWorkflow ? { actions: "read" } : {}),
+    });
     if (upstreamWorkflow) {
       workflow.file?.addOverride("on.workflow_run", {
         workflows: [upstreamWorkflow],
         types: ["completed"],
       });
     } else {
-      workflow.on({ push: { tags: [`${tagPrefix}*`] } });
+      workflow.file?.addOverride("on.repository_dispatch", {
+        types: [DOWNSTREAM_RELEASE_EVENT],
+      });
     }
     // Manual trigger for testing the workflow WITHOUT reaching npm: a
     // `workflow_dispatch` run has no tag, so the publish script forces
@@ -224,6 +305,20 @@ export class DBXToolsRelease extends Component {
     // additionally lets a tag push be dry-run on demand.
     workflow.file?.addOverride("on.workflow_dispatch", {
       inputs: {
+        ...(branchDispatch
+          ? {
+              release_tag: {
+                description: "Release tag to package during a dry run",
+                type: "string",
+                required: true,
+              },
+              expected_sha: {
+                description: "Commit the release tag must reference",
+                type: "string",
+                required: true,
+              },
+            }
+          : {}),
         dry_run: {
           description: "Pack and validate but do not upload to npm",
           type: "boolean",
@@ -234,12 +329,16 @@ export class DBXToolsRelease extends Component {
     workflow.addJob("publish", {
       ...(upstreamWorkflow
         ? {
-            if: "${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'workflow_run') }}",
+            if: "${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.event == 'workflow_run' || github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'repository_dispatch')) }}",
           }
         : {}),
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
-      permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
+      permissions: {
+        ...(upstreamWorkflow ? { actions: JobPermission.READ } : {}),
+        contents: JobPermission.READ,
+        idToken: JobPermission.WRITE,
+      },
       timeoutMinutes: 30,
       // `DRY_RUN_INPUT` is `--dry-run` when the dispatch input is true, else empty;
       // the publish script also FORCES it on any `workflow_dispatch` run.
@@ -248,25 +347,65 @@ export class DBXToolsRelease extends Component {
         DRY_RUN_INPUT: "${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}",
       },
       steps: [
-        ...publishSetupSteps().map((step) =>
-          step.name === "Checkout" && upstreamWorkflow
+        ...(upstreamWorkflow
+          ? [
+              {
+                name: "Download release metadata",
+                uses: "actions/download-artifact@v8",
+                with: {
+                  name: "release-metadata",
+                  path: ".release",
+                  "run-id": "${{ github.event.workflow_run.id }}",
+                  "github-token": "${{ github.token }}",
+                },
+              },
+              {
+                name: "Read release metadata",
+                id: "release_metadata",
+                shell: "bash",
+                run: [
+                  'RELEASE_TAG="$(cat .release/tag)"',
+                  'EXPECTED_SHA="$(cat .release/sha)"',
+                  'test -n "$RELEASE_TAG"',
+                  'test -n "$EXPECTED_SHA"',
+                  'echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"',
+                  'echo "expected_sha=$EXPECTED_SHA" >> "$GITHUB_OUTPUT"',
+                ].join("\n"),
+              },
+            ]
+          : []),
+        {
+          ...setupSteps[0]!,
+          ...(upstreamWorkflow
             ? {
-                ...step,
                 with: {
-                  ...step.with,
-                  ref: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}",
+                  ...setupSteps[0]!.with,
+                  ref: "${{ steps.release_metadata.outputs.expected_sha }}",
+                  "fetch-depth": 0,
                 },
               }
-            : step,
-        ),
+            : {
+                with: {
+                  ...setupSteps[0]!.with,
+                  ref: RELEASE_SHA,
+                  "fetch-depth": 1,
+                },
+              }),
+        },
         ...(upstreamWorkflow
           ? [
               {
-                name: "Resolve release tag",
+                name: "Verify release source",
+                shell: "bash",
+                env: {
+                  SOURCE_RELEASE_TAG: "${{ steps.release_metadata.outputs.release_tag }}",
+                  EXPECTED_SHA: "${{ steps.release_metadata.outputs.expected_sha }}",
+                },
                 run: [
-                  'RELEASE_TAG="$(git tag --points-at HEAD --list "' +
-                    tagPrefix +
-                    '*" | sort -V | tail -1)"',
+                  'git fetch --force origin "+refs/tags/$SOURCE_RELEASE_TAG:refs/tags/$SOURCE_RELEASE_TAG"',
+                  'test "$(git rev-parse "$SOURCE_RELEASE_TAG^{commit}")" = "$EXPECTED_SHA"',
+                  'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"',
+                  `RELEASE_TAG="$(git tag --points-at HEAD --list "${tagPrefix}*" | sort -V | tail -1)"`,
                   'test -n "$RELEASE_TAG"',
                   'echo "RELEASE_TAG=$RELEASE_TAG" >> "$GITHUB_ENV"',
                   `echo "RELEASE_VERSION=\${RELEASE_TAG#${tagPrefix}}" >> "$GITHUB_ENV"`,
@@ -274,6 +413,36 @@ export class DBXToolsRelease extends Component {
               } satisfies JobStep,
             ]
           : []),
+        ...(branchDispatch ? releaseSourceSteps().slice(1) : []),
+        ...(branchDispatch
+          ? [
+              {
+                name: "Resolve package release tag",
+                shell: "bash",
+                env: {
+                  SOURCE_RELEASE_TAG: RELEASE_TAG,
+                  EXPECTED_SHA: RELEASE_SHA,
+                },
+                run: [
+                  `SOURCE_VERSION="\${SOURCE_RELEASE_TAG#${this.tagPrefix}}"`,
+                  `RELEASE_TAG="${tagPrefix}\${SOURCE_VERSION}"`,
+                  'git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
+                  'test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$EXPECTED_SHA"',
+                  'echo "RELEASE_TAG=$RELEASE_TAG" >> "$GITHUB_ENV"',
+                  `echo "RELEASE_VERSION=\${RELEASE_TAG#${tagPrefix}}" >> "$GITHUB_ENV"`,
+                  "mkdir -p .release",
+                  'printf "%s\\n" "$SOURCE_RELEASE_TAG" > .release/tag',
+                  'printf "%s\\n" "$EXPECTED_SHA" > .release/sha',
+                ].join("\n"),
+              } satisfies JobStep,
+            ]
+          : []),
+        ...setupSteps.slice(1),
+        {
+          name: "Upload release metadata",
+          uses: "actions/upload-artifact@v7",
+          with: { name: "release-metadata", path: ".release" },
+        },
         ...steps,
       ],
       ...(workingDirectory ? { defaults: { run: { workingDirectory } } } : {}),
@@ -344,6 +513,7 @@ export class DBXToolsRelease extends Component {
     this.authorPublishWorkflow(project, {
       name,
       tagPrefix,
+      upstreamWorkflow: this.upstreamWorkflow,
       steps: [
         {
           name: "Set version from tag and publish",
@@ -352,7 +522,7 @@ export class DBXToolsRelease extends Component {
             '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
             "  DRY_RUN=--dry-run",
             "else",
-            `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
+            `  VERSION="\${RELEASE_VERSION:-\${GITHUB_REF_NAME#${tagPrefix}}}"`,
             '  DRY_RUN="${DRY_RUN_INPUT}"',
             "fi",
             "chmod -R u+w . || true",

package/tasks/bump.ts

@@ -115,6 +115,16 @@ function git(args: string[], capture = false): string {
   return res.stdout?.trim() ?? "";
 }
 
+function assertReleaseTagsPointToHead(tags: readonly string[]): void {
+  const head = git(["rev-parse", "HEAD"], true);
+  for (const tag of tags) {
+    const target = git(["rev-parse", `${tag}^{commit}`], true);
+    if (!head || target !== head) {
+      throw new Error(`Release tag ${tag} does not point to the pushed HEAD commit`);
+    }
+  }
+}
+
 /**
  * Write ONLY the `version` field into a manifest projen owns (read-only, so
  * bracketed by a chmod that restores the mode). Used for the ROOT and the
@@ -324,9 +334,17 @@ program
 
       if (push) {
         git(["push", "origin", "HEAD"]);
-        // Push every tag in ONE invocation: each push triggers a workflow, and a
-        // partial push would release half the set at this version.
-        if (opts.tag) git(["push", "origin", ...tags]);
+        // The managed Databricks pre-push hook treats a newly created tag's
+        // all-zero remote SHA as a branch with no upstream and scans hundreds of
+        // historical commits. The release commit was already scanned by the
+        // branch push immediately above, and each annotated tag points to that
+        // exact commit, so bypass the hook only for the tag-ref transport.
+        // Push every tag in one invocation so a partial push cannot release
+        // only some namespaces at this version.
+        if (opts.tag) {
+          assertReleaseTagsPointToHead(tags);
+          git(["push", "--no-verify", "origin", ...tags]);
+        }
         logger.success(`pushed ${opts.tag ? tags.join(", ") : "HEAD"} to origin`);
       } else {
         logger.info("skipped push (--no-push / --no-publish)");

package/tasks/uniffi-release.mjs

@@ -47,9 +47,21 @@ const required = (name) => {
 };
 
 const root = resolve(parsed.values.root ?? process.cwd());
+const commandInvocation = (command, args) => {
+  if (process.platform !== "win32" || command !== "npm") return { command, args };
+  const npmCli = resolve(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js");
+  if (!existsSync(npmCli)) throw new Error(`Missing npm CLI ${npmCli}`);
+  return { command: process.execPath, args: [npmCli, ...args] };
+};
 const run = (command, args, cwd = root) => {
-  const result = spawnSync(command, args, { cwd, stdio: "inherit" });
-  if (result.status !== 0) throw new Error(`${command} exited with ${result.status}`);
+  const invocation = commandInvocation(command, args);
+  const result = spawnSync(invocation.command, invocation.args, { cwd, stdio: "inherit" });
+  if (result.error) {
+    throw new Error(`${invocation.command} failed: ${result.error.message}`, {
+      cause: result.error,
+    });
+  }
+  if (result.status !== 0) throw new Error(`${invocation.command} exited with ${result.status}`);
 };
 
 const replaceVersion = (source, version) =>