@dbx-tools/projen 0.6.160 → 0.6.163

package/README.md

@@ -115,18 +115,28 @@ Cargo/sccache once,
 builds the Rust workspace once, then packages every discovered output from that
 shared build. Bun and the workspace install are present only when a Node binding
 needs TypeScript generation; uv is present only when a Python wheel is needed.
+A new dispatch cancels queued and in-progress release and docs workflows before
+starting, and each workflow's concurrency group also cancels its previous run.
 A binary-only workspace therefore installs neither. `rustVersion` remains the
 MSRV recorded in package manifests, while `releaseRustVersion` independently
 defaults release compilation to `stable`. UBRN uses that same release toolchain
 unless `ubrnRustVersion` explicitly selects another one.
 
-The Node generator's Rust CLI can be cached under one target directory keyed by
-its pinned UBRN version, Rust version, runner OS, and runner architecture. Set
-the repository variable `CACHE_UBRN_TARGET=true` to enable that archive while
-comparing its transfer cost with the default sccache-only path. Cargo registry
-caches and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain
-across version tags. Cache keys, restore results, sccache statistics, and phase
-timings are written to each build log. Python generation executes the already-built
+Generated build and release workflows share the Bun cache helpers from
+`bun-workflow.ts`. One `BUN_VERSION` value drives setup and cache keys, while a
+generated dependency-only fingerprint keeps release version bumps from
+invalidating Bun's global package cache. `node_modules` remains uncached.
+
+The final host UBRN executable is cached by pinned UBRN version, Rust toolchain,
+runner OS, and runner architecture. A hit skips both the workspace `bun install`
+and the UBRN Cargo build. Release packaging passes the cached executable directly
+to the Node binding generator and keeps the package barrel copied from source,
+so it does not need the installed projen dependency graph. A miss saves the
+validated executable immediately, before workspace build and packaging can fail.
+Bun runtime setup still runs because the binding generator is TypeScript. Cargo registry caches
+and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
+version tags. Cache keys, restore results, sccache statistics, and phase timings
+are written to each build log. Python generation executes the already-built
 `target/<triple>/release/uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 

package/index.ts

@@ -5,6 +5,7 @@
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
+export * as bunWorkflow from "./src/bun-workflow.ts";
 export * as clean from "./src/clean.ts";
 export * as codegen from "./src/codegen.ts";
 export * as dbxToolsConfig from "./src/dbx-tools-config.ts";
@@ -31,6 +32,8 @@ export * as vscode from "./src/vscode.ts";
 export * as watch from "./src/watch.ts";
 export * as workspaceVersion from "./src/workspace-version.ts";
 export { BUN_DEV_OVERRIDE, BUN_BUILD_OVERRIDE, BUN_APP_OVERRIDES, RootBunfigFile, BunfigFile, BunDevServerFile, BunBuildFile } from "./src/bun-app.ts";
+export { BUN_VERSION } from "./src/bun-workflow.ts";
+export type { BunWorkflowCacheOptions } from "./src/bun-workflow.ts";
 export { DBXToolsConfig } from "./src/dbx-tools-config.ts";
 export type { DBXToolsConfigOptions } from "./src/dbx-tools-config.ts";
 export { resolvePkgRoot } from "./src/engine-root.ts";

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.160",
-    "@dbx-tools/path": "0.6.160",
-    "@dbx-tools/shared-core": "0.6.160",
+    "@dbx-tools/core": "0.6.163",
+    "@dbx-tools/path": "0.6.163",
+    "@dbx-tools/shared-core": "0.6.163",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -48,7 +48,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.160",
+  "version": "0.6.163",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/bun-workflow.ts

@@ -0,0 +1,145 @@
+/** Shared Bun setup and package-cache steps for generated workflows. */
+import { TextFile, javascript } from "projen";
+
+export const BUN_VERSION = "1.3.14";
+
+const cacheKeyScript = `#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const root = process.cwd();
+const ignored = new Set([
+  ".git",
+  ".docs-build",
+  ".venv",
+  ".worktrees",
+  "coverage",
+  "dist",
+  "lib",
+  "node_modules",
+  "target",
+]);
+const manifests = [];
+const walk = (directory) => {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    if (ignored.has(entry.name)) continue;
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) walk(path);
+    else if (entry.name === "package.json") manifests.push(path);
+  }
+};
+walk(root);
+
+const dependencyFields = [
+  "catalog",
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "overrides",
+  "peerDependencies",
+  "peerDependenciesMeta",
+  "resolutions",
+  "trustedDependencies",
+];
+const canonical = (value) => {
+  if (Array.isArray(value)) return value.map(canonical);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(
+    Object.entries(value)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, child]) => [key, canonical(child)]),
+  );
+};
+const dependencies = manifests
+  .sort()
+  .map((path) => {
+    const manifest = JSON.parse(readFileSync(path, "utf8"));
+    return [
+      path.slice(root.length + 1),
+      Object.fromEntries(
+        dependencyFields
+          .filter((field) => manifest[field] !== undefined)
+          .map((field) => [field, canonical(manifest[field])]),
+      ),
+    ];
+  });
+process.stdout.write(createHash("sha256").update(JSON.stringify(dependencies)).digest("hex"));
+`;
+
+const configured = new WeakSet<javascript.NodeProject>();
+
+function ensureCacheKeyScript(project: javascript.NodeProject): void {
+  if (configured.has(project)) return;
+  new TextFile(project.root, ".projen/bun-cache-key.mjs", {
+    lines: cacheKeyScript.trimEnd().split("\n"),
+  });
+  configured.add(project);
+}
+
+function stepCondition(condition: string | undefined, cacheMiss = false): string | undefined {
+  const expressions = [
+    condition,
+    ...(cacheMiss ? ["steps.bun_cache.outputs.cache-hit != 'true'"] : []),
+  ].filter(Boolean);
+  return expressions.length ? `\${{ ${expressions.join(" && ")} }}` : undefined;
+}
+
+export interface BunWorkflowCacheOptions {
+  readonly setupCondition?: string;
+  readonly condition?: string;
+}
+
+/** Set up Bun and restore its global package cache. */
+export function bunCacheRestoreSteps(
+  project: javascript.NodeProject,
+  options: BunWorkflowCacheOptions = {},
+): readonly Record<string, unknown>[] {
+  ensureCacheKeyScript(project);
+  const condition = stepCondition(options.condition);
+  const setupCondition = stepCondition(options.setupCondition);
+  return [
+    {
+      name: "Setup Bun",
+      ...(setupCondition ? { if: setupCondition } : {}),
+      uses: "oven-sh/setup-bun@v2",
+      with: { "bun-version": "${{ env.BUN_VERSION }}" },
+    },
+    {
+      name: "Resolve Bun cache",
+      id: "bun_cache_metadata",
+      ...(condition ? { if: condition } : {}),
+      shell: "bash",
+      run: [
+        'echo "path=$(bun pm cache)" >> "$GITHUB_OUTPUT"',
+        'echo "dependency_hash=$(node .projen/bun-cache-key.mjs)" >> "$GITHUB_OUTPUT"',
+      ].join("\n"),
+    },
+    {
+      name: "Restore Bun cache",
+      id: "bun_cache",
+      ...(condition ? { if: condition } : {}),
+      uses: "actions/cache/restore@v5",
+      with: {
+        path: "${{ steps.bun_cache_metadata.outputs.path }}",
+        key: `bun-\${{ runner.os }}-\${{ runner.arch }}-\${{ env.BUN_VERSION }}-\${{ steps.bun_cache_metadata.outputs.dependency_hash }}`,
+        "restore-keys": `bun-\${{ runner.os }}-\${{ runner.arch }}-\${{ env.BUN_VERSION }}-`,
+      },
+    },
+  ];
+}
+
+/** Save Bun's global package cache immediately after installation. */
+export function bunCacheSaveStep(
+  options: BunWorkflowCacheOptions = {},
+): Readonly<Record<string, unknown>> {
+  return {
+    name: "Save Bun cache",
+    if: stepCondition(options.condition, true),
+    uses: "actions/cache/save@v5",
+    with: {
+      path: "${{ steps.bun_cache_metadata.outputs.path }}",
+      key: "${{ steps.bun_cache.outputs.cache-primary-key }}",
+    },
+  };
+}

package/src/project-js.ts

@@ -13,6 +13,7 @@ import { ignore, match } from "@dbx-tools/path";
 import { object, string, type OneOrMany } from "@dbx-tools/shared-core";
 import { type IConstruct } from "constructs";
 import { Component, IgnoreFile, Project, type TaskOptions, javascript, typescript } from "projen";
+import type { JobStep } from "projen/lib/github/workflows-model";
 import { ReleaseTrigger } from "projen/lib/release";
 import { mixin } from "..";
 import { generateBarrels } from "./barrels.ts";
@@ -23,6 +24,7 @@ import {
   BunfigFile,
   RootBunfigFile,
 } from "./bun-app.ts";
+import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
 import { codegenModulePaths, generateCodegen } from "./codegen.ts";
 import { DBXToolsConfig, type DBXToolsConfigOptions } from "./dbx-tools-config.ts";
 import { resolvePkgRoot } from "./engine-root.ts";
@@ -642,6 +644,24 @@ export class DBXToolsNodeProject
     initProject(this, options);
   }
 
+  public override renderWorkflowSetup(options?: javascript.RenderWorkflowSetupOptions): JobStep[] {
+    const steps = super.renderWorkflowSetup(options);
+    if (this.parent) return steps;
+    return steps.flatMap((step) => {
+      if (step.uses === "oven-sh/setup-bun@v2") return [...bunCacheRestoreSteps(this)];
+      if (step.run === "bun install") {
+        return [
+          step,
+          bunCacheSaveStep({
+            condition:
+              "github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository",
+          }),
+        ];
+      }
+      return [step];
+    }) as JobStep[];
+  }
+
   public override preSynthesize(): void {
     if (this.rootInstallOnly) this.with(ROOT_INSTALL_ONLY_MIXIN);
     super.preSynthesize();
@@ -1066,6 +1086,7 @@ function initProject(
   // a plain `bun` exec rather than any wrapper: the default task is spawned by
   // nested installs/synths, and a wrapper that exported `npm_config_*` broke them.
   project.defaultTask?.reset("bun .projenrc.ts");
+  project.buildWorkflow?.workflow.file?.addOverride("jobs.build.env.BUN_VERSION", BUN_VERSION);
 
   // Pin bun's hoisted linker workspace-wide (see RootBunfigFile) so a peer dep
   // resolves to one copy and singletons/types stay coherent.

package/src/project-py.ts

@@ -429,7 +429,11 @@ export class DBXToolsPythonWorkspace extends Component {
     if (!project.github) return;
     const publications = this.publications(options);
     if (publications.length === 0) return;
-    const workflow = new GithubWorkflow(project.github, options.workflowName ?? "python-release");
+    const workflowName = options.workflowName ?? "python-release";
+    const workflow = new GithubWorkflow(project.github, workflowName, {
+      limitConcurrency: true,
+      concurrencyOptions: { group: workflowName, cancelInProgress: true },
+    });
     workflow.file?.addOverride("permissions", {
       contents: "read",
       ...(options.upstreamWorkflow ? { actions: "read" } : {}),

package/src/project-rs.ts

@@ -5,6 +5,7 @@ import { fileURLToPath } from "node:url";
 import { project as coreProject } from "@dbx-tools/core";
 import { string } from "@dbx-tools/shared-core";
 import { Project, TextFile, YamlFile, javascript } from "projen";
+import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
 import type { DBXToolsProject } from "./project.ts";
 import {
   DBXToolsTypeScriptProject,
@@ -641,6 +642,10 @@ export class DBXToolsRustWorkspace {
       ubrnRustVersion === releaseRustVersion
         ? ""
         : `rustup toolchain install ${ubrnRustVersion} --profile minimal\n`;
+    const ubrnExecutable =
+      "${{ github.workspace }}/.cache/ubrn/uniffi-bindgen-react-native${{ matrix.target.os == 'win32' && '.exe' || '' }}";
+    const builtUbrnExecutable =
+      "target/ubrn/debug/uniffi-bindgen-react-native${{ matrix.target.os == 'win32' && '.exe' || '' }}";
     const releaseBranch = projectReleaseBranch(project);
     const bindings = this.bindingMappings.map((binding) => ({
       ...binding,
@@ -685,7 +690,7 @@ export class DBXToolsRustWorkspace {
         `--node-package "${binding.nodePackage}"`,
         `--python-package "${binding.pythonPackage}"`,
         ...(binding.node
-          ? ['--node-generator "node_modules/@dbx-tools/projen/tasks/uniffi.ts"']
+          ? ['--node-generator "projen/tasks/uniffi.ts"', '--ubrn "$UBRN_EXECUTABLE"']
           : []),
         '--cargo-target "${{ matrix.target.cargo }}"',
         '--node-triple "${{ matrix.target.node }}"',
@@ -762,6 +767,7 @@ export class DBXToolsRustWorkspace {
       "runs-on": "${{ matrix.target.runner }}",
       env: {
         ...RUST_CACHE_ENV,
+        BUN_VERSION,
         SCCACHE_GHA_VERSION: `release-\${{ matrix.target.cargo }}-rust-${releaseRustVersion}`,
       },
       strategy: {
@@ -770,15 +776,6 @@ export class DBXToolsRustWorkspace {
       },
       steps: [
         ...releaseSourceSteps(),
-        ...(hasNodeBindings
-          ? [
-              {
-                name: "Setup Bun",
-                uses: "oven-sh/setup-bun@v2",
-                with: { "bun-version": "1.3.14" },
-              },
-            ]
-          : []),
         ...(hasPythonBindings ? [{ name: "Setup uv", uses: "astral-sh/setup-uv@v7" }] : []),
         {
           name: "Setup Rust",
@@ -789,17 +786,21 @@ export class DBXToolsRustWorkspace {
         ...(hasNodeBindings
           ? [
               {
-                name: "Cache UBRN generator",
+                name: "Restore UBRN executable",
                 id: "ubrn_cache",
-                if: "${{ vars.CACHE_UBRN_TARGET == 'true' }}",
-                uses: "actions/cache@v5",
+                uses: "actions/cache/restore@v5",
                 with: {
-                  path: "target/ubrn",
-                  key: `ubrn-\${{ runner.os }}-\${{ runner.arch }}-rust-${ubrnRustVersion}-${UBRN_VERSION}`,
+                  path: ".cache/ubrn",
+                  key: `ubrn-executable-\${{ runner.os }}-\${{ runner.arch }}-rust-${ubrnRustVersion}-${UBRN_VERSION}`,
                 },
               },
             ]
           : []),
+        ...(hasNodeBindings
+          ? bunCacheRestoreSteps(project, {
+              condition: "steps.ubrn_cache.outputs.cache-hit != 'true'",
+            })
+          : []),
         {
           name: "Log cache configuration",
           shell: "bash",
@@ -811,9 +812,8 @@ export class DBXToolsRustWorkspace {
             `echo "ubrn_rust_toolchain=${ubrnRustVersion}"`,
             ...(hasNodeBindings
               ? [
-                  "echo \"ubrn_target_cache_enabled=${{ vars.CACHE_UBRN_TARGET == 'true' }}\"",
-                  `echo "ubrn_target_cache_key=ubrn-\${{ runner.os }}-\${{ runner.arch }}-rust-${ubrnRustVersion}-${UBRN_VERSION}"`,
-                  'echo "ubrn_target_cache_hit=${{ steps.ubrn_cache.outputs.cache-hit }}"',
+                  `echo "ubrn_executable_cache_key=ubrn-executable-\${{ runner.os }}-\${{ runner.arch }}-rust-${ubrnRustVersion}-${UBRN_VERSION}"`,
+                  'echo "ubrn_executable_cache_hit=${{ steps.ubrn_cache.outputs.cache-hit }}"',
                 ]
               : []),
           ].join("\n"),
@@ -827,24 +827,50 @@ export class DBXToolsRustWorkspace {
           ? [
               {
                 name: "Install Node tooling",
+                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
                 shell: "bash",
                 run: timedBash("node_tooling", "bun install"),
               },
+              bunCacheSaveStep({
+                condition: "steps.ubrn_cache.outputs.cache-hit != 'true'",
+              }),
             ]
           : []),
         ...(hasNodeBindings
           ? [
               {
                 name: "Prepare UBRN generator",
+                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
                 env: {
                   CARGO_TARGET_DIR: "${{ github.workspace }}/target/ubrn",
+                  UBRN_EXECUTABLE: ubrnExecutable,
                 },
                 shell: "bash",
                 run: timedBash(
                   "ubrn_generator",
-                  `${ubrnToolchainInstall}cargo +${ubrnRustVersion} build --manifest-path node_modules/uniffi-bindgen-react-native/crates/ubrn_cli/Cargo.toml`,
+                  [
+                    `${ubrnToolchainInstall}cargo +${ubrnRustVersion} build --manifest-path node_modules/uniffi-bindgen-react-native/crates/ubrn_cli/Cargo.toml`,
+                    'mkdir -p "$(dirname "$UBRN_EXECUTABLE")"',
+                    `cp "${builtUbrnExecutable}" "$UBRN_EXECUTABLE"`,
+                    'chmod +x "$UBRN_EXECUTABLE"',
+                  ].join("\n"),
                 ),
               },
+              {
+                name: "Verify UBRN executable",
+                env: { UBRN_EXECUTABLE: ubrnExecutable },
+                shell: "bash",
+                run: 'test -f "$UBRN_EXECUTABLE"',
+              },
+              {
+                name: "Save UBRN executable",
+                if: "${{ steps.ubrn_cache.outputs.cache-hit != 'true' }}",
+                uses: "actions/cache/save@v5",
+                with: {
+                  path: ".cache/ubrn",
+                  key: "${{ steps.ubrn_cache.outputs.cache-primary-key }}",
+                },
+              },
             ]
           : []),
         {
@@ -864,7 +890,7 @@ export class DBXToolsRustWorkspace {
                   VERSION: RELEASE_TAG,
                   ...(hasNodeBindings
                     ? {
-                        CARGO_TARGET_DIR: "${{ github.workspace }}/target/ubrn",
+                        UBRN_EXECUTABLE: ubrnExecutable,
                       }
                     : {}),
                 },
@@ -990,6 +1016,10 @@ export class DBXToolsRustWorkspace {
             },
           },
         },
+        concurrency: {
+          group: workflowName,
+          "cancel-in-progress": true,
+        },
         permissions: { contents: "read" },
         jobs: {
           "verify-context": {

package/src/release.ts

@@ -4,12 +4,13 @@
  * the project has a GitHub component - authors the tag-driven npm publish
  * workflow that the pushed tag triggers.
  */
-import { rmSync } from "node:fs";
+import { existsSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
 import { Component, YamlFile } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
 import { object } from "@dbx-tools/shared-core";
+import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
 import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
 import {
   DOWNSTREAM_RELEASE_EVENT,
@@ -21,7 +22,6 @@ import {
 
 const NODE_VERSION = "lts/*";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-const BUN_VERSION = "1.3.14";
 
 /**
  * The `release` workflow's version-stamp + publish step, as a shell script.
@@ -73,10 +73,10 @@ interface PublishWorkflow {
 }
 
 /** Shared checkout and toolchain setup for every npm publish workflow. */
-function publishSetupSteps(): JobStep[] {
+function publishSetupSteps(project: DBXToolsNodeProject): JobStep[] {
   return [
     { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
-    { name: "Setup Bun", uses: "oven-sh/setup-bun@v2", with: { "bun-version": BUN_VERSION } },
+    ...bunCacheRestoreSteps(project),
     {
       name: "Setup Node.js",
       uses: "actions/setup-node@v6",
@@ -88,6 +88,7 @@ function publishSetupSteps(): JobStep[] {
     },
     // Bun's install; the lockfile may be absent or stale in CI so it is not frozen.
     { name: "Install", run: "bun install" },
+    bunCacheSaveStep(),
   ];
 }
 
@@ -196,9 +197,23 @@ export class DBXToolsRelease extends Component {
       object.isRecord(rust) && typeof rust.releaseWorkflow === "string"
         ? RUST_RELEASE_EVENT
         : DOWNSTREAM_RELEASE_EVENT;
-    project
-      .tryFindObjectFile(".github/workflows/release-dispatch.yml")
-      ?.addOverride("jobs.dispatch.steps.1.env.RELEASE_EVENT", releaseEvent);
+    const dispatcher = project.tryFindObjectFile(".github/workflows/release-dispatch.yml");
+    dispatcher?.addOverride("jobs.dispatch.steps.1.env.RELEASE_EVENT", releaseEvent);
+    const releaseWorkflows = [
+      ...(object.isRecord(rust) && typeof rust.releaseWorkflow === "string"
+        ? [rust.releaseWorkflow]
+        : []),
+      ...(typeof project.dbxToolsConfig.pythonReleaseWorkflow === "string"
+        ? [project.dbxToolsConfig.pythonReleaseWorkflow]
+        : []),
+      ...(this.workflowName ? [this.workflowName] : []),
+      ...this.standaloneReleases.map(({ name }) => name),
+      ...(existsSync(resolve(project.outdir, ".github/workflows/docs.yml")) ? ["docs"] : []),
+    ];
+    dispatcher?.addOverride(
+      "jobs.dispatch.steps.1.env.RELEASE_WORKFLOWS",
+      [...new Set(releaseWorkflows)].join(","),
+    );
     // Release the standalone projects in the SAME run, at the same version. They
     // are not workspace members, so nothing else would ever bring them along.
     const siblingArgs = this.standaloneReleases
@@ -233,7 +248,11 @@ export class DBXToolsRelease extends Component {
       obj: {
         name: "release-dispatch",
         on: { push: { tags: [`${this.tagPrefix}*`] } },
-        permissions: { contents: "write" },
+        concurrency: {
+          group: "release-dispatch",
+          "cancel-in-progress": true,
+        },
+        permissions: { actions: "write", contents: "write" },
         jobs: {
           dispatch: {
             "runs-on": "ubuntu-latest",
@@ -250,10 +269,19 @@ export class DBXToolsRelease extends Component {
                   GH_TOKEN: "${{ github.token }}",
                   RELEASE_TAG: "${{ github.ref_name }}",
                   RELEASE_EVENT: DOWNSTREAM_RELEASE_EVENT,
+                  RELEASE_WORKFLOWS: "",
                 },
                 run: [
                   `case "$RELEASE_TAG" in ${this.tagPrefix}*) ;; *) exit 1 ;; esac`,
                   'EXPECTED_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
+                  'IFS="," read -r -a workflows <<< "$RELEASE_WORKFLOWS"',
+                  'for workflow in "${workflows[@]}"; do',
+                  "  for status in in_progress queued requested waiting pending action_required; do",
+                  "    while IFS= read -r run_id; do",
+                  '      if [ -n "$run_id" ]; then gh run cancel "$run_id"; fi',
+                  '    done < <(gh run list --workflow "$workflow.yml" --status "$status" --limit 100 --json databaseId --jq \'.[].databaseId\')',
+                  "  done",
+                  "done",
                   [
                     'gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches"',
                     '--raw-field event_type="$RELEASE_EVENT"',
@@ -274,14 +302,13 @@ export class DBXToolsRelease extends Component {
     project: DBXToolsNodeProject,
     { name, tagPrefix, steps, workingDirectory, upstreamWorkflow }: PublishWorkflow,
   ): void {
-    const setupSteps = publishSetupSteps();
+    const setupSteps = publishSetupSteps(project);
     const branchDispatch = upstreamWorkflow === undefined;
     const workflow = new GithubWorkflow(project.github!, name, {
-      // Serialize publishes so two tags landing together cannot race to the
-      // registry, but never cancel a run already in flight: a half-published
-      // release is worse than a queued one.
+      // A newer release supersedes an older run even when publication has
+      // started; the dispatcher also cancels active ecosystem runs immediately.
       limitConcurrency: true,
-      concurrencyOptions: { group: name, cancelInProgress: false },
+      concurrencyOptions: { group: name, cancelInProgress: true },
     });
     // Read-only floor for any job that does not declare its own permissions;
     // the publish job below overrides it with the `id-token` it needs.
@@ -343,6 +370,7 @@ export class DBXToolsRelease extends Component {
       // `DRY_RUN_INPUT` is `--dry-run` when the dispatch input is true, else empty;
       // the publish script also FORCES it on any `workflow_dispatch` run.
       env: {
+        BUN_VERSION,
         CI: "true",
         DRY_RUN_INPUT: "${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}",
       },

package/tasks/uniffi-release.mjs

@@ -26,6 +26,7 @@ const parsed = parseArgs({
     python: { type: "string" },
     "node-package": { type: "string" },
     "node-generator": { type: "string" },
+    ubrn: { type: "string" },
     "python-package": { type: "string" },
     "cargo-target": { type: "string" },
     "node-triple": { type: "string" },
@@ -149,6 +150,7 @@ const packageNode = ({
     required("cargo-target"),
     "--node-package-base",
     `${nodePackage}-`,
+    ...(parsed.values.ubrn ? ["--ubrn", parsed.values.ubrn, "--skip-barrels"] : []),
     "--skip-build",
   ]);
   mkdirSync(resolve(output, "npm-facade"), { recursive: true });

package/tasks/uniffi.ts

@@ -29,7 +29,9 @@ const { values } = parseArgs({
     python: { type: "string" },
     "cargo-target": { type: "string" },
     "node-package-base": { type: "string" },
+    ubrn: { type: "string" },
     "skip-build": { type: "boolean" },
+    "skip-barrels": { type: "boolean" },
   },
 });
 if (!values.crate || (!values.node && !values.python)) {
@@ -109,7 +111,7 @@ if (!existsSync(library)) throw new Error(`Missing compiled UniFFI library: ${li
 if (values.node) {
   const nodeSource = resolve(root, values.node, "src");
   const nodeOutput = mkdtempSync(join(tmpdir(), `${libraryName}-node-`));
-  run(join(root, "node_modules/.bin/ubrn"), [
+  run(values.ubrn ? resolve(values.ubrn) : join(root, "node_modules/.bin/ubrn"), [
     "generate",
     "napi",
     "bindings",
@@ -187,11 +189,13 @@ if (values.node) {
   }
   rmSync(resolve(root, values.node, "src/generated"), { recursive: true, force: true });
   rmSync(nodeOutput, { recursive: true, force: true });
-  run(process.execPath, [
-    resolve(dirname(fileURLToPath(import.meta.url)), "barrels.ts"),
-    "--dir",
-    resolve(root, values.node),
-  ]);
+  if (!values["skip-barrels"]) {
+    run(process.execPath, [
+      resolve(dirname(fileURLToPath(import.meta.url)), "barrels.ts"),
+      "--dir",
+      resolve(root, values.node),
+    ]);
+  }
 }
 
 if (values.python) {