@dbx-tools/projen 0.6.163 → 0.6.174

package/src/release.ts

@@ -6,11 +6,16 @@
  */
 import { existsSync, rmSync } from "node:fs";
 import { resolve } from "node:path";
+import { object } from "@dbx-tools/shared-core";
 import { Component, YamlFile } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
-import { object } from "@dbx-tools/shared-core";
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
+import {
+  orderRustBindings,
+  type RustBindingMapping,
+  type RustWorkspaceMapping,
+} from "./project-rs.ts";
 import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
 import {
   DOWNSTREAM_RELEASE_EVENT,
@@ -70,6 +75,7 @@ interface PublishWorkflow {
   readonly steps: readonly JobStep[];
   readonly workingDirectory?: string;
   readonly upstreamWorkflow?: string;
+  readonly rustArtifacts?: boolean;
 }
 
 /** Shared checkout and toolchain setup for every npm publish workflow. */
@@ -300,7 +306,7 @@ export class DBXToolsRelease extends Component {
   /** Author the common tag trigger, concurrency policy, permissions, and publish job. */
   private authorPublishWorkflow(
     project: DBXToolsNodeProject,
-    { name, tagPrefix, steps, workingDirectory, upstreamWorkflow }: PublishWorkflow,
+    { name, tagPrefix, steps, workingDirectory, upstreamWorkflow, rustArtifacts }: PublishWorkflow,
   ): void {
     const setupSteps = publishSetupSteps(project);
     const branchDispatch = upstreamWorkflow === undefined;
@@ -314,7 +320,7 @@ export class DBXToolsRelease extends Component {
     // the publish job below overrides it with the `id-token` it needs.
     workflow.file?.addOverride("permissions", {
       contents: "read",
-      ...(upstreamWorkflow ? { actions: "read" } : {}),
+      ...(upstreamWorkflow || rustArtifacts ? { actions: "read" } : {}),
     });
     if (upstreamWorkflow) {
       workflow.file?.addOverride("on.workflow_run", {
@@ -362,7 +368,7 @@ export class DBXToolsRelease extends Component {
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
       permissions: {
-        ...(upstreamWorkflow ? { actions: JobPermission.READ } : {}),
+        ...(upstreamWorkflow || rustArtifacts ? { actions: JobPermission.READ } : {}),
         contents: JobPermission.READ,
         idToken: JobPermission.WRITE,
       },
@@ -483,14 +489,112 @@ export class DBXToolsRelease extends Component {
    * version on every package first makes the pushed tag the published version
    * (no bump math).
    */
+  private nodeBindingReleaseSteps(project: DBXToolsNodeProject): {
+    before: JobStep[];
+    after: JobStep[];
+  } {
+    const config = project.dbxToolsConfig.rust;
+    if (!object.isRecord(config) || !Array.isArray(config.bindings)) {
+      return { before: [], after: [] };
+    }
+    const bindings = orderRustBindings(config.bindings as RustWorkspaceMapping["bindings"]).filter(
+      (binding): binding is RustBindingMapping & { node: string; nodePackage: string } =>
+        Boolean(binding.node && binding.nodePackage),
+    );
+    if (bindings.length === 0) return { before: [], after: [] };
+
+    const before: JobStep[] = [
+      {
+        name: "Require Rust artifact handoff",
+        if: "${{ github.event_name == 'repository_dispatch' }}",
+        shell: "bash",
+        env: {
+          RUST_RUN_ID: "${{ github.event.client_payload.rust_run_id }}",
+          RUST_RUN_ATTEMPT: "${{ github.event.client_payload.rust_run_attempt }}",
+        },
+        run: ['test -n "$RUST_RUN_ID"', 'test -n "$RUST_RUN_ATTEMPT"'].join("\n"),
+      },
+      {
+        name: "Download native npm packages",
+        if: "${{ github.event_name == 'repository_dispatch' }}",
+        uses: "actions/download-artifact@v8",
+        with: {
+          pattern: "*-npm",
+          path: "dist/uniffi/native",
+          "merge-multiple": true,
+          "run-id": "${{ github.event.client_payload.rust_run_id }}",
+          "github-token": "${{ github.token }}",
+        },
+      },
+      {
+        name: "Publish native npm packages",
+        if: "${{ github.event_name == 'repository_dispatch' }}",
+        env: {
+          NPM_CONFIG_PROVENANCE: "true",
+          NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
+          NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+        },
+        run: [
+          "test \"$(find dist/uniffi/native -name '*.tgz' | wc -l | tr -d ' ')\" -gt 0",
+          'for package in dist/uniffi/native/*.tgz; do npm publish "$package" --access public; done',
+        ].join("\n"),
+      },
+      {
+        name: "Refresh workspace after native publication",
+        if: "${{ github.event_name == 'repository_dispatch' }}",
+        run: "bun install --force",
+      },
+    ];
+
+    const facadeCommands = [
+      'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+      '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
+      "  DRY_RUN=--dry-run",
+      "else",
+      '  VERSION="$RELEASE_VERSION"',
+      "  DRY_RUN=",
+      "fi",
+      ...bindings.flatMap((binding) => {
+        const output = `dist/uniffi/facades/${binding.crate}`;
+        return [
+          `NATIVE_ARG=""`,
+          'if [ "$GITHUB_EVENT_NAME" = "repository_dispatch" ]; then',
+          `  NATIVE_PACKAGE="$(find dist/uniffi/native -name '${binding.crate}-linux-x64-gnu-*.tgz' -print -quit)"`,
+          '  test -n "$NATIVE_PACKAGE"',
+          '  NATIVE_ARG="--native-package $NATIVE_PACKAGE"',
+          "fi",
+          `node .projen/uniffi-release.mjs facade --node "${binding.node}" --node-package "${binding.nodePackage}" --node-triple "linux-x64-gnu" --version "$VERSION" --output "${output}" $NATIVE_ARG`,
+          `for package in ${output}/npm-facade/*.tgz; do npm publish "$package" --access public $DRY_RUN; done`,
+        ];
+      }),
+    ];
+    return {
+      before,
+      after: [
+        {
+          name: "Build and publish UniFFI npm facades",
+          env: {
+            NPM_CONFIG_PROVENANCE: "true",
+            NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
+            NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+          },
+          run: facadeCommands.join("\n"),
+        },
+      ],
+    };
+  }
+
   private authorReleaseWorkflow(project: DBXToolsNodeProject): void {
     if (!this.workflowName) return;
     if (this.workflowName !== "release") project.tryRemoveFile(".github/workflows/release.yml");
+    const bindingSteps = this.nodeBindingReleaseSteps(project);
     this.authorPublishWorkflow(project, {
       name: this.workflowName,
       tagPrefix: this.tagPrefix,
       upstreamWorkflow: this.upstreamWorkflow,
+      rustArtifacts: bindingSteps.before.length > 0,
       steps: [
+        ...bindingSteps.before,
         // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Stamp it on
         // every workspace package (manifests are projen-readonly, so unlock
         // first), rewriting `workspace:*` sibling deps to `^<version>` so the
@@ -512,6 +616,7 @@ export class DBXToolsRelease extends Component {
             NPM_CONFIG_PROVENANCE: "true",
           },
         },
+        ...bindingSteps.after,
       ],
     });
   }

package/src/uniffi.ts

@@ -36,6 +36,14 @@ export interface TypeScriptBindingModule {
   readonly source: string;
 }
 
+/** Add source extensions to UBRN's generated relative binding imports. */
+export const addTypeScriptExtensionsToBindingImports = (source: string): string =>
+  source.replace(
+    /(["'])\.\/_bindings(-ffi)?\1/g,
+    (_specifier, quote: string, suffix: string | undefined) =>
+      `${quote}./_bindings${suffix ?? ""}.ts${quote}`,
+  );
+
 /** Add explicit type exports for interfaces that TypeScript misses through UBRN's star exports. */
 export const addExplicitInterfaceReexports = (
   facade: string,
@@ -48,3 +56,40 @@ export const addExplicitInterfaceReexports = (
   if (exports.length === 0) return facade;
   return `${facade.trimEnd()}\n${exports.join("\n")}\n`;
 };
+
+const GENERATED_BINDINGS_HEADER = "GENERATED by UniFFI binding generation";
+
+function pythonAllNames(source: string, file: string): string[] {
+  const body = /^__all__\s*=\s*\[([\s\S]*?)\]/m.exec(source)?.[1];
+  if (body === undefined) {
+    throw new Error(`Python exports must define a literal __all__ list: ${file}`);
+  }
+  return [...body.matchAll(/["']([^"']+)["']/g)].map((match) => match[1]!);
+}
+
+/** Generate one package root from the binding module's explicit exports. */
+export function mergePythonBindingExports(
+  initSource: string,
+  bindingsSource: string,
+  options: { readonly crate: string; readonly file: string },
+): string {
+  if (initSource.trim() && !initSource.includes(GENERATED_BINDINGS_HEADER)) {
+    throw new Error(`Cannot replace non-generated Python package exports: ${options.file}`);
+  }
+  const bindingNames = pythonAllNames(bindingsSource, options.file);
+  const publicNames = [...bindingNames].sort((left, right) =>
+    left < right ? -1 : left > right ? 1 : 0,
+  );
+  return [
+    "# GENERATED by UniFFI binding generation - DO NOT EDIT.",
+    `# Regenerated from the ${options.crate} Rust exports.`,
+    "# Hand edits are overwritten on the next watch; this file is read-only.",
+    "",
+    "from .bindings import *",
+    "",
+    "__all__ = [",
+    ...publicNames.map((name) => `    ${JSON.stringify(name)},`),
+    "]",
+    "",
+  ].join("\n");
+}

package/tasks/bump.ts

@@ -135,8 +135,8 @@ function assertReleaseTagsPointToHead(tags: readonly string[]): void {
  * (not-yet-published) version into the COMMITTED manifest breaks the release
  * workflow's initial `bun install`, which checks out that commit before anything
  * is published. Sibling versions are resolved transiently at publish time instead:
- * `projen-release` runs `tasks/publish.ts --stamp-only` (set versions + refresh
- * lockfile), then `bun publish` in `projen/` strips `workspace:*` to those versions.
+ * The bump stamps every workspace member before committing so independently
+ * synthesized members and the Bun lock resolve the same release version.
  */
 function writeManifestVersion(pkgPath: string, version: string): void {
   const { mode } = statSync(pkgPath);
@@ -306,6 +306,16 @@ program
           },
         });
       }
+      if (opts.version) {
+        const publishScript = fileURLToPath(new URL("./publish.ts", import.meta.url));
+        exec.spawnSync("bun", [publishScript, version, "--stamp-only"], {
+          cwd: process.cwd(),
+          stdout: "inherit",
+          stderr: "inherit",
+          stdin: "ignore",
+          check: true,
+        });
+      }
 
       if (opts.commit) {
         // Stage the whole tree so the release commit captures the version bump

package/tasks/publish-uniffi-local.ts

@@ -1,10 +1,10 @@
 #!/usr/bin/env -S bun
+import { spawnSync } from "node:child_process";
 import { chmodSync, existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
-import { spawnSync } from "node:child_process";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
@@ -155,8 +155,6 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
     includePython ? binding.python! : "",
     "--node-package",
     includeNode ? binding.nodePackage! : "",
-    "--node-generator",
-    "projen/tasks/uniffi.ts",
     "--python-package",
     includePython ? binding.pythonPackage! : "",
     "--cargo-target",
@@ -184,8 +182,9 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
       ...artifacts(join(output, "npm"), ".tgz"),
       ...artifacts(join(output, "npm-facade"), ".tgz"),
     ];
-    for (const packageFile of packages)
+    for (const packageFile of packages) {
       run("npm", ["publish", packageFile, "--registry", registry!]);
+    }
   }
   if (includePython) {
     const wheels = artifacts(join(output, "python"), ".whl");

package/tasks/publish.ts

@@ -2,7 +2,7 @@
 /**
  * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
  * - ensure every workspace member and the Bun lock carry the release version,
- * then publish each non-private one with `bun publish`.
+ * then publish each package owned by the standard Node release with `bun publish`.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
@@ -41,8 +41,7 @@
  * but uploads nothing, so the `release` workflow is testable end-to-end via a
  * `workflow_dispatch` run without anything reaching npm. `--registry` targets a
  * non-default registry (a local verdaccio); `--exclude <dir>` (repeatable,
- * repo-relative) skips a member that releases on its OWN tag namespace (e.g.
- * `projen`, published by `projen-release`, not the main `release`).
+ * repo-relative) skips a member owned by another publication flow.
  *
  * `--no-restore` keeps the edits on disk instead of undoing them at exit. Only
  * needed when a LATER process must still see them - `--stamp-only` implies it,
@@ -140,7 +139,8 @@ function lockfileMatchesVersion(
 
 /** Spawn `command` in `cwd` with `PATH` overridden, failing the task on non-zero. */
 function run(cwd: string, command: string, args: string[], path: string): void {
-  exec.spawnSync(command, args, {
+  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
+  exec.spawnSync(executable, args, {
     cwd,
     stdout: "inherit",
     stderr: "inherit",
@@ -152,7 +152,8 @@ function run(cwd: string, command: string, args: string[], path: string): void {
 
 /** Asynchronous counterpart used for bounded parallel stamping and publishing. */
 async function runAsync(cwd: string, command: string, args: string[], path: string): Promise<void> {
-  await exec.spawn(command, args, {
+  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
+  await exec.spawn(executable, args, {
     cwd,
     stdout: "inherit",
     stderr: "inherit",
@@ -274,9 +275,8 @@ if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
 }
 const concurrency = parsedConcurrency;
 // `--stamp-only`: set versions + refresh the lockfile, then STOP (no publish).
-// The standalone `projen-release` uses this to version-stamp the workspace so its
-// own `bun publish` (run separately, in `projen/`) resolves `workspace:*` siblings
-// to the release version; publishing every member here would double-publish them.
+// A separate package command can use this when its own publish process needs
+// workspace sibling versions resolved before it starts.
 const stampOnly = rest.includes("--stamp-only");
 // Undo the manifest edits at exit unless a later process still needs them. Implied
 // off by `--stamp-only`, whose stamps exist precisely for a subsequent `bun publish`.
@@ -338,17 +338,17 @@ for (const dir of members) {
   const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
     name?: string;
     private?: boolean;
+    dbxToolsConfig?: { uniffi?: boolean };
     scripts?: Record<string, string>;
   };
   if (pkg.private) {
     logger.info(`skip private ${pkg.name ?? dirname(dir)}`);
     continue;
   }
-  // bun won't fold publishConfig into the packed manifest, so do it ourselves -
-  // otherwise the tarball's `bin`/`main`/`exports` stay pointed at `.ts` source.
-  const manifestPath = join(dir, "package.json");
-  unlockManifest(manifestPath);
-  applyPublishConfig(manifestPath);
+  if (pkg.dbxToolsConfig?.uniffi === true) {
+    logger.info(`skip UniFFI ${pkg.name ?? dirname(dir)}`);
+    continue;
+  }
   publishable.push({
     dir,
     name: pkg.name ?? dirname(dir),
@@ -362,6 +362,15 @@ if (compiled.length > 0) {
   run(root, "bun", ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"], path);
 }
 
+// Compile against workspace source exports first. Switching manifests to their
+// publishConfig entries before compilation makes consumers resolve sibling
+// `lib/*.d.ts` files that have not been emitted yet in a clean checkout.
+for (const { dir } of publishable) {
+  const manifestPath = join(dir, "package.json");
+  unlockManifest(manifestPath);
+  applyPublishConfig(manifestPath);
+}
+
 logger.info(
   `${dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
 );

package/tasks/rust.ts

@@ -8,6 +8,7 @@ import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import {
   discoverRustCrates,
   hasUniFFIBindings,
+  orderRustBindings,
   type RustBindingMapping,
   type RustWorkspaceMapping,
 } from "../src/project-rs.ts";
@@ -84,6 +85,19 @@ function generate(binding: RustBindingMapping): void {
   if (result.status !== 0) throw new Error(`binding generation exited with ${result.status}`);
 }
 
+export function affectedRustBindings(
+  bindings: readonly RustBindingMapping[],
+  changed: ReadonlySet<string>,
+): RustBindingMapping[] {
+  const affected = new Set(changed);
+  const ordered = orderRustBindings(bindings);
+  for (const binding of ordered) {
+    if (binding.dependencies?.some((dependency) => affected.has(dependency)))
+      affected.add(binding.crate);
+  }
+  return ordered.filter((binding) => affected.has(binding.crate));
+}
+
 const config = rustConfig();
 
 async function main(): Promise<void> {
@@ -92,7 +106,7 @@ async function main(): Promise<void> {
     throw new Error("Cargo is required because Rust projects were detected");
   }
   if (!process.argv.includes("--watch")) {
-    for (const binding of config.bindings) generate(binding);
+    for (const binding of orderRustBindings(config.bindings)) generate(binding);
     return;
   }
 
@@ -109,7 +123,7 @@ async function main(): Promise<void> {
         const binding = ownerBinding(path, refreshed.bindings);
         if (binding) targets.set(binding.crate, binding);
       }
-      for (const binding of targets.values()) {
+      for (const binding of affectedRustBindings(refreshed.bindings, new Set(targets.keys()))) {
         logger.start(`generating ${binding.crate} bindings`);
         generate(binding);
         logger.success(`generated ${binding.crate} bindings`);
@@ -121,7 +135,7 @@ async function main(): Promise<void> {
       const binding = ownerBinding(path, latest.bindings);
       if (binding) targets.set(binding.crate, binding);
     }
-    for (const binding of targets.values()) {
+    for (const binding of affectedRustBindings(latest.bindings, new Set(targets.keys()))) {
       logger.start(`generating ${binding.crate} bindings`);
       generate(binding);
       logger.success(`generated ${binding.crate} bindings`);