@dbx-tools/projen 0.6.163 → 0.6.174

package/src/project-py.ts

@@ -7,8 +7,8 @@ import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { parse, stringify } from "smol-toml";
 import { projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
-import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
+import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { DOWNSTREAM_RELEASE_EVENT, RELEASE_TAG, releaseSourceSteps } from "./release-dispatch.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
@@ -29,8 +29,8 @@ export interface PythonPackageOptions extends DBXToolsProjectOptions {
   /** Workspace package directories rendered as standalone Git dependencies. */
   readonly internalDependencies?: readonly string[];
   readonly scripts?: Readonly<Record<string, string>>;
-  /** Keep this package unpublished and out of public docs and releases. */
-  readonly private?: boolean;
+  /** Publish this package through the Rust UniFFI release flow instead of the Python workflow. */
+  readonly uniffi?: boolean;
   /** Generated source files excluded from strict static analysis. Package-relative. */
   readonly generatedSources?: readonly string[];
   /** Trusted publisher used outside the standard Python release workflow. */
@@ -75,6 +75,7 @@ interface PythonPublication {
   readonly environment: string;
   readonly workflowName: string;
   readonly artifacts?: string;
+  readonly dependencies?: readonly string[];
 }
 
 /** Options for {@link DBXToolsPythonWorkspace}. */
@@ -214,8 +215,8 @@ export class DBXToolsPythonProject extends python.PythonProject implements DBXTo
     if (pkg.scripts) {
       this.uv.file.addOverride("project.scripts", pkg.scripts);
     }
-    if (pkg.private) {
-      this.uv.file.addOverride("tool.dbx-tools.private", true);
+    if (pkg.uniffi !== undefined) {
+      this.uv.file.addOverride("tool.dbx_tools.config.uniffi", pkg.uniffi);
     }
     formatPyproject(this.uv.file);
     this.uv.file.readonly = true;
@@ -319,7 +320,7 @@ export class DBXToolsPythonWorkspace extends Component {
       projectVscode(project)?.settings.addSetting("python.defaultInterpreterPath", interpreterPath);
     }
 
-    if (options.release && this.packages.some((pkg) => !pkg.packageOptions.private)) {
+    if (options.release && this.packages.length > 0) {
       if (isDBXToolsJavaScriptProject()(project)) {
         project.dbxToolsConfig.pythonReleaseWorkflow =
           releaseOptions.workflowName ?? "python-release";
@@ -428,7 +429,10 @@ export class DBXToolsPythonWorkspace extends Component {
   private addReleaseWorkflow(project: javascript.NodeProject, options: PythonReleaseOptions): void {
     if (!project.github) return;
     const publications = this.publications(options);
-    if (publications.length === 0) return;
+    const uniffiPublications = this.uniffiPublications(options);
+    const allPublications = [...publications, ...uniffiPublications];
+    if (allPublications.length === 0) return;
+    const usesRustArtifacts = uniffiPublications.length > 0;
     const workflowName = options.workflowName ?? "python-release";
     const workflow = new GithubWorkflow(project.github, workflowName, {
       limitConcurrency: true,
@@ -436,7 +440,7 @@ export class DBXToolsPythonWorkspace extends Component {
     });
     workflow.file?.addOverride("permissions", {
       contents: "read",
-      ...(options.upstreamWorkflow ? { actions: "read" } : {}),
+      ...(options.upstreamWorkflow || usesRustArtifacts ? { actions: "read" } : {}),
     });
     const upstreamWorkflow = options.upstreamWorkflow;
     const branchDispatch = upstreamWorkflow === undefined && isDBXToolsJavaScriptProject()(project);
@@ -487,7 +491,7 @@ export class DBXToolsPythonWorkspace extends Component {
       runsOn: ["ubuntu-latest"],
       permissions: {
         contents: JobPermission.READ,
-        ...(upstreamWorkflow ? { actions: JobPermission.READ } : {}),
+        ...(upstreamWorkflow || usesRustArtifacts ? { actions: JobPermission.READ } : {}),
       },
       timeoutMinutes: 20,
       steps: [
@@ -555,6 +559,35 @@ export class DBXToolsPythonWorkspace extends Component {
             ]
           : []),
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
+        ...(usesRustArtifacts
+          ? [
+              {
+                name: "Require Rust artifact handoff",
+                if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
+                shell: "bash",
+                env: {
+                  RUST_RUN_ID:
+                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
+                  RUST_RUN_ATTEMPT:
+                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_attempt || github.event.workflow_run.run_attempt }}",
+                },
+                run: ['test -n "$RUST_RUN_ID"', 'test -n "$RUST_RUN_ATTEMPT"'].join("\n"),
+              },
+            ]
+          : []),
+        ...uniffiPublications.map((publication) => ({
+          name: `Download ${publication.distribution} native wheels`,
+          if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
+          uses: "actions/download-artifact@v8",
+          with: {
+            pattern: `${publication.distribution}--*--python-wheel`,
+            path: `dist/${publication.directory}`,
+            "merge-multiple": true,
+            "run-id":
+              "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
+            "github-token": "${{ github.token }}",
+          },
+        })),
         {
           name: "Stamp workspace versions",
           env: {
@@ -594,8 +627,15 @@ export class DBXToolsPythonWorkspace extends Component {
         {
           name: "Validate distributions",
           run: [
-            `test "$(find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq ${publications.length * 2}`,
-            "uvx twine check dist/*/*.whl dist/*/*.tar.gz",
+            ...publications.map(
+              (publication) =>
+                `test "$(find dist/${publication.directory} -maxdepth 1 -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq 2`,
+            ),
+            ...uniffiPublications.map(
+              (publication) =>
+                `if [ "$GITHUB_EVENT_NAME" = "repository_dispatch" ] || [ "$GITHUB_EVENT_NAME" = "workflow_run" ]; then find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .; fi`,
+            ),
+            "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
           ].join("\n"),
         },
         {
@@ -610,12 +650,15 @@ export class DBXToolsPythonWorkspace extends Component {
         },
       ],
     });
-    for (const publication of publications) {
+    for (const publication of allPublications) {
       workflow.addJob(`publish-${publication.directory}`, {
         if: branchDispatch
           ? "${{ github.event_name == 'repository_dispatch' }}"
           : "${{ github.event_name == 'push' || github.event_name == 'workflow_run' }}",
-        needs: ["build"],
+        needs: [
+          "build",
+          ...(publication.dependencies ?? []).map((dependency) => `publish-${dependency}`),
+        ],
         environment: {
           name: publication.environment,
           url:
@@ -643,7 +686,7 @@ export class DBXToolsPythonWorkspace extends Component {
 
   private publications(options: PythonReleaseOptions): readonly PythonPublication[] {
     return this.packages
-      .filter((pkg) => !pkg.packageOptions.private)
+      .filter((pkg) => pkg.packageOptions.uniffi !== true)
       .map((pkg) => ({
         directory: pkg.packageOptions.directory,
         distribution: pkg.packageOptions.name,
@@ -653,6 +696,22 @@ export class DBXToolsPythonWorkspace extends Component {
       }));
   }
 
+  private uniffiPublications(options: PythonReleaseOptions): readonly PythonPublication[] {
+    return this.packages
+      .filter((pkg) => pkg.packageOptions.uniffi === true)
+      .map((pkg) => ({
+        directory: pkg.packageOptions.directory,
+        distribution: pkg.packageOptions.name,
+        environment:
+          pkg.packageOptions.trustedPublisher?.environment ??
+          options.environments?.[pkg.packageOptions.name] ??
+          `pypi-${pkg.packageOptions.name}`,
+        workflowName: options.workflowName ?? "python-release",
+        artifacts: pkg.packageOptions.trustedPublisher?.artifacts,
+        dependencies: pkg.packageOptions.internalDependencies,
+      }));
+  }
+
   private trustedPublisherPublications(
     options: PythonReleaseOptions,
   ): readonly PythonPublication[] {
@@ -683,7 +742,10 @@ export class DBXToolsPythonWorkspace extends Component {
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
-      "Use a browser to audit and configure the PyPI trusted publishers below.",
+      "Use the system browser to audit and configure the PyPI trusted publishers below.",
+      "Do not use an in-app browser or embedded webview.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
+      "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
       "",
@@ -691,7 +753,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "- Confirm that the active PyPI account can administer the listed projects and pending publishers.",
       "- Start at https://pypi.org/manage/projects/ and determine which listed projects exist.",
-      "- Inspect every existing GitHub publisher for each project and compare its owner, repository name, workflow name, and environment name with the desired values below.",
+      "- On PyPI, inspect every existing GitHub Actions publisher for each project and compare its owner, repository name, workflow name, and environment name with the desired values below.",
       "- Identify duplicate and mismatched trusted publishers that must be replaced by removing the publisher entry and adding the correct one.",
       "- For projects that do not exist, identify the pending publisher that must be created.",
       "- Report the active account and a proposed reconciliation plan grouped by publishers that will be left unchanged, updated, replaced, created, or removed.",
@@ -700,9 +762,9 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- Configure every environment listed below to permit deployments from the ${releaseBranch} branch.`,
-      "- Branch-scoped release workflows use the environment names below; tag-only deployment policies reject their trusted-publishing jobs.",
-      "- Keep the GitHub environment name synchronized with the PyPI trusted publisher environment.",
+      `- The supplied branch policy value is ${releaseBranch}.`,
+      "- Do not inspect or configure GitHub environments during this task.",
+      "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
       "## Authentication",
       "",
@@ -714,7 +776,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## Efficient browser workflow",
       "",
-      "- Reuse or claim an existing PyPI browser tab when available.",
+      "- Reuse an existing PyPI tab in the system browser when available.",
       "- For an existing project, open its publisher page directly at https://pypi.org/manage/project/<project-name>/settings/publishing/.",
       "- For a project that does not exist, use the pending-publisher page at https://pypi.org/manage/account/publishing/.",
       "- Treat the publisher table shown after submission as authoritative confirmation of success, even if the navigation header unexpectedly appears signed out.",
@@ -769,7 +831,7 @@ export class DBXToolsPythonWorkspace extends Component {
       ],
     });
     project.root.addTask("pypiTrustedPublisherInstructions", {
-      description: "Print browser-agent instructions for PyPI trusted publishers",
+      description: "Print system-browser instructions for PyPI trusted publishers",
       exec: `node ${helper}`,
       receiveArgs: true,
     });