@dbx-tools/projen 0.6.176 → 0.6.179

package/README.md

@@ -128,22 +128,36 @@ removing a crate or `setup_scaffolding!()` marker triggers a full synth. Repos
 without Rust crates start no Rust watcher. When Rust projects are detected,
 Cargo is required and the focused task fails immediately if it is unavailable.
 
-The workspace also generates a `rust-release` workflow from discovered crates,
-UniFFI bindings, and release-enabled binaries. The root `release-dispatch`
-workflow resolves the annotated release tag and sends the tag plus commit SHA to
-`rust-release` when Rust is present. The Rust workflow runs in the configured release
-branch cache scope, checks out the supplied SHA, fetches the tag, and requires
-both the tag target and `HEAD` to equal that SHA before building. Its matrix has
-one row per target. Each row installs native dependencies and restores
-Cargo/sccache once,
-builds the Rust workspace once, then packages every discovered output from that
-shared build. Rust rows package native npm archives and Python wheels; they do
-not install Bun or UBRN and do not build Node facades.
-A new dispatch cancels queued and in-progress release and docs workflows before
-starting, and each workflow's concurrency group also cancels its previous run.
-A binary-only workspace therefore installs no language package tool. `rustVersion` remains the
-MSRV recorded in package manifests, while `releaseRustVersion` independently
-defaults release compilation to `stable`.
+The workspace generates one `release.yml` workflow for every ecosystem. An
+annotated `v*` tag starts it directly. The context job resolves the tag to a
+commit, requires the tag object to be annotated, and exposes the verified tag,
+commit, and version to every source job. A manual run accepts that same tag and
+commit but requires dry-run mode, so it builds and validates without publishing
+packages or deploying documentation. One `release` concurrency group cancels a
+superseded run.
+
+Release generation writes `release.yml` without scanning for or removing other
+workflow files. Consumers explicitly delete exact workflow files they no longer
+want.
+
+Failed-job reruns consume successful Rust artifacts from the same workflow run.
+For a separate recovery run, choose `node`, `python`, or `docs` instead of
+`all`. Node and Python recovery can supply the prior `release.yml` run ID; the
+workflow verifies that run used the commit selected by the annotated release
+tag before downloading its artifacts. Dispatch the workflow with the release
+tag as its Git ref so environment tag policies still apply. Manual recovery
+defaults to dry-run and publishes only when `dry_run` is cleared. npm retries skip an exact version only
+after the local archive integrity and repository identity match registry
+metadata. PyPI retries enable Twine's hash-aware existing-file behavior, which
+skips matching files and fails when an existing filename has different content.
+
+The Rust matrix has one row per target. Each row installs native dependencies,
+restores Cargo and sccache once, builds the Cargo workspace once, then packages
+every discovered output from that shared build. Rust rows prepare native npm
+archives and Python wheels; they do not install Bun or UBRN and do not build
+Node facades. A binary-only row therefore installs no language package tool.
+`rustVersion` remains the MSRV recorded in package manifests, while
+`releaseRustVersion` independently defaults release compilation to `stable`.
 Stable Windows rows verify and use the hosted runner's installed Rust toolchain
 and select `rust-lld` for the workspace build. Cargo registry caches
 and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
@@ -152,10 +166,9 @@ are written to each build log. Python generation executes the already-built
 `target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 
-Artifacts identify their crate, target, and type. `rust-release` publishes
-non-private Cargo crates with `cargo publish --no-verify`, uploads requested
-binary assets to the GitHub release, then dispatches the verified Rust run id
-with the tag and SHA. It never publishes npm or PyPI packages.
+Artifacts identify their crate, target, and type. Rust jobs publish non-private
+Cargo crates with `cargo publish --no-verify` and upload requested binary assets
+to the GitHub release. Rust jobs never publish npm or PyPI packages.
 
 Set `LOCAL_CARGO_REGISTRY` to a named Cargo registry such as a loopback
 [Kellnr](https://kellnr.io/) instance and provide `LOCAL_CARGO_TOKEN`. Public
@@ -170,21 +183,20 @@ environment parsing in a consumer.
 
 Public UniFFI facades are marked with `dbxToolsConfig.uniffi = true` in Node
 manifests and `[tool.dbx_tools.config] uniffi = true` in Python manifests. The
-Node release downloads and publishes native archives first, publishes normal
-workspace packages, then builds and publishes facades from the committed
-generated TypeScript in dependency order. The Python release downloads every
-platform wheel and publishes them from one trusted-publisher job per
-distribution. The docs generators include them because they are publicly installable.
-When a conventional Node binding path already belongs to a root subproject,
-Rust mapping reuses that project and adds binding dependencies and metadata to
-its existing manifest.
-After Rust's artifacts finish, it dispatches the downstream `release` event
-with its run id and attempt. Python, Node, and docs consume that event
-independently with the same verified tag and SHA. Without Rust,
-`release-dispatch` sends that event immediately. Configure release GitHub
-environments to permit the generated release branch; the trusted-publisher
-instructions list that branch with the workflow and environment identity PyPI
-verifies.
+Node jobs consume same-run artifacts, publish native archives first with npm
+provenance, compile and publish normal workspace packages including the Projen
+engine, then build facades from committed generated TypeScript without UBRN and
+publish them in binding dependency order. Local Verdaccio publication does not
+enable provenance. Set the `UNIFFI_FACADE_SMOKE` repository variable to `true`
+to run the optional nonblocking registry install and import check after facade
+publication. Python combines same-run platform wheels with standard wheel and
+source builds, then publishes each distribution through its own PyPI
+trusted-publisher environment. Binding publishers wait for their dependencies.
+Trusted-publisher instructions name `release.yml` and the release tag policy.
+The docs jobs generate README and TypeScript API content and deploy GitHub Pages
+from the same workflow. When a conventional Node binding path already belongs
+to a root subproject, Rust mapping reuses that project and adds binding
+dependencies and metadata to its existing manifest.
 
 ## Customize Packages With Mixins
 

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.6.175";
+export const PACKAGE_VERSION = "0.6.178";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -54,8 +54,8 @@ export { RustReleaseOs, RustReleaseCpu, UNIFFI_RELEASE_TARGETS, DBXToolsRustProj
 export type { CargoDependencyOptions, CargoDependency, RustPackageOptions, DBXToolsRustWorkspaceOptions, RustReleasePlatform, UniFFIReleaseTarget, RustBindingMapping, RustWorkspaceMapping } from "./src/project-rs.ts";
 export { COMPILED_DIR, COMPILED_COMPILER_OPTIONS } from "./src/publish.ts";
 export { DBXToolsRelease } from "./src/release.ts";
-export type { StandaloneRelease, DBXToolsReleaseOptions } from "./src/release.ts";
-export { DOWNSTREAM_RELEASE_EVENT, RUST_RELEASE_EVENT, RELEASE_TAG, RELEASE_SHA } from "./src/release-dispatch.ts";
+export type { ReleaseStage, ReleaseDocsOptions, DBXToolsReleaseOptions } from "./src/release.ts";
+export { RELEASE_TAG, RELEASE_SHA, RELEASE_VERSION } from "./src/release-dispatch.ts";
 export { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS } from "./src/tags.ts";
 export type { PackageTag } from "./src/tags.ts";
 export { DBXToolsRootTsconfig } from "./src/tsconfig.ts";

package/package.json

@@ -25,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.176",
-    "@dbx-tools/path": "0.6.176",
-    "@dbx-tools/shared-core": "0.6.176",
+    "@dbx-tools/core": "0.6.179",
+    "@dbx-tools/path": "0.6.179",
+    "@dbx-tools/shared-core": "0.6.179",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.176",
+  "version": "0.6.179",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -40,7 +40,7 @@ import {
 import { PnpmWorkspaceState, type DBXToolsPNPMWorkspaceOptions } from "./pnpm-workspace.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions as CommonProjectOptions } from "./project.ts";
 import { applyCompiledPublish } from "./publish.ts";
-import { DBXToolsRelease, type StandaloneRelease } from "./release.ts";
+import { DBXToolsRelease, type ReleaseDocsOptions } from "./release.ts";
 import { AGNOSTIC_COMPILER_OPTIONS, PACKAGE_TAG_MIXINS, type PackageTag } from "./tags.ts";
 import { DBXToolsRootTsconfig } from "./tsconfig.ts";
 import { DBXToolsVsCode } from "./vscode.ts";
@@ -549,18 +549,10 @@ export interface DBXToolsJavaScriptProjectOptions
    * (alongside `.projenrc.ts`). Repo-relative, e.g. `".example.projenrc.ts"`.
    */
   readonly syncResynthPaths?: readonly string[];
-  /**
-   * Standalone in-repo projects (NOT workspace members) that each get their own
-   * tag-driven release workflow authored alongside the root's `release`
-   * workflow - see {@link StandaloneRelease}. Use for a project that lives in a
-   * repo subdirectory but releases on its own tag prefix (e.g. the
-   * `@dbx-tools/projen` engine in `projen/`, tagged `projen-v*`).
-   */
-  readonly standaloneReleases?: readonly StandaloneRelease[];
-  /** Workflow that must finish successfully before the main Node release runs. */
-  readonly releaseUpstreamWorkflow?: string;
-  /** Main Node release workflow name. Defaults to `node-release`. */
-  readonly nodeReleaseWorkflowName?: string | false;
+  /** GitHub Pages documentation included in the unified release workflow. */
+  readonly releaseDocs?: ReleaseDocsOptions;
+  /** Set to `false` to omit normal npm workspace publication. */
+  readonly nodeRelease?: boolean;
   /**
    * Extra workspace member paths (repo-relative, POSIX) to list in the workspace
    * config ALONGSIDE the discovered `packageRoots` members - for a package that
@@ -1264,9 +1256,8 @@ function initProject(
   // authors. Independent of projen's own `release` component.
   new DBXToolsRelease(project as DBXToolsNodeProject, {
     tagPrefix: options.releaseTagPrefix,
-    standaloneReleases: options.standaloneReleases,
-    upstreamWorkflow: options.releaseUpstreamWorkflow,
-    workflowName: options.nodeReleaseWorkflowName ?? options.releaseWorkflowName,
+    nodeRelease: options.nodeRelease,
+    docs: options.releaseDocs,
   });
 }
 

package/src/project-py.ts

@@ -3,13 +3,20 @@ import { project as coreProject } from "@dbx-tools/core";
 import { string } from "@dbx-tools/shared-core";
 import { Component, TextFile, type Project, javascript, python, vscode } from "projen";
 import type { IResolver } from "projen/lib/file";
-import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { parse, stringify } from "smol-toml";
-import { projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
+import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
+import { projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
-import { DOWNSTREAM_RELEASE_EVENT, RELEASE_TAG, releaseSourceSteps } from "./release-dispatch.ts";
+import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
+import {
+  releaseArtifactSteps,
+  releasePublishCondition,
+  releaseStageCondition,
+  releaseTagPattern,
+  releaseWorkflow,
+} from "./release.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
 /** Git location used by direct `#subdirectory=` package dependencies. */
@@ -44,7 +51,6 @@ interface ResolvedPythonPackageOptions extends PythonPackageOptions {
 
 /** GitHub Actions publisher for a Python package released by another workflow. */
 export interface PythonTrustedPublisherOptions {
-  readonly workflowName: string;
   readonly environment: string;
   readonly artifacts?: string;
 }
@@ -61,9 +67,6 @@ export interface DBXToolsPythonProjectOptions extends DBXToolsProjectOptions {
 
 /** Python release workflow configuration. */
 export interface PythonReleaseOptions {
-  readonly workflowName?: string;
-  /** Run after this workflow completes successfully instead of directly on tags. */
-  readonly upstreamWorkflow?: string;
   /** GitHub environment by Python distribution name. Defaults to `pypi-<name>`. */
   readonly environments?: Readonly<Record<string, string>>;
   readonly environmentUrl?: string;
@@ -73,7 +76,6 @@ interface PythonPublication {
   readonly directory: string;
   readonly distribution: string;
   readonly environment: string;
-  readonly workflowName: string;
   readonly artifacts?: string;
   readonly dependencies?: readonly string[];
 }
@@ -321,10 +323,6 @@ export class DBXToolsPythonWorkspace extends Component {
     }
 
     if (options.release && this.packages.length > 0) {
-      if (isDBXToolsJavaScriptProject()(project)) {
-        project.dbxToolsConfig.pythonReleaseWorkflow =
-          releaseOptions.workflowName ?? "python-release";
-      }
       this.addReleaseWorkflow(project, releaseOptions);
     }
   }
@@ -427,193 +425,40 @@ export class DBXToolsPythonWorkspace extends Component {
   }
 
   private addReleaseWorkflow(project: javascript.NodeProject, options: PythonReleaseOptions): void {
-    if (!project.github) return;
+    if (!project.github || !isDBXToolsJavaScriptProject()(project)) return;
     const publications = this.publications(options);
     const uniffiPublications = this.uniffiPublications(options);
     const allPublications = [...publications, ...uniffiPublications];
     if (allPublications.length === 0) return;
     const usesRustArtifacts = uniffiPublications.length > 0;
-    const workflowName = options.workflowName ?? "python-release";
-    const workflow = new GithubWorkflow(project.github, workflowName, {
-      limitConcurrency: true,
-      concurrencyOptions: { group: workflowName, cancelInProgress: true },
-    });
-    workflow.file?.addOverride("permissions", {
-      contents: "read",
-      ...(options.upstreamWorkflow || usesRustArtifacts ? { actions: "read" } : {}),
-    });
-    const upstreamWorkflow = options.upstreamWorkflow;
-    const branchDispatch = upstreamWorkflow === undefined && isDBXToolsJavaScriptProject()(project);
-    if (upstreamWorkflow) {
-      workflow.file?.addOverride("on.workflow_run", {
-        workflows: [upstreamWorkflow],
-        types: ["completed"],
-      });
-      workflow.on({ workflowDispatch: {} });
-    } else if (branchDispatch) {
-      workflow.file?.addOverride("on.repository_dispatch", {
-        types: [DOWNSTREAM_RELEASE_EVENT],
-      });
-      workflow.on({ workflowDispatch: {} });
-    } else {
-      workflow.on({ push: { tags: ["v*"] }, workflowDispatch: {} });
-    }
-    workflow.file?.addOverride("on.workflow_dispatch", {
-      inputs: {
-        ...(branchDispatch
-          ? {
-              release_tag: {
-                description: "Release tag to package during a dry run",
-                type: "string",
-                required: true,
-              },
-              expected_sha: {
-                description: "Commit the release tag must reference",
-                type: "string",
-                required: true,
-              },
-            }
-          : {
-              version: {
-                description: "Python package version to build",
-                type: "string",
-                required: true,
-              },
-            }),
-      },
-    });
-    workflow.addJob("build", {
-      ...(upstreamWorkflow
-        ? {
-            if: "${{ github.event_name != 'workflow_run' || (github.event.workflow_run.conclusion == 'success' && (github.event.workflow_run.event == 'push' || github.event.workflow_run.event == 'repository_dispatch')) }}",
-          }
-        : {}),
+    const workflow = releaseWorkflow(project);
+    workflow.addJob("build-python", {
+      if: usesRustArtifacts
+        ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
+        : releaseStageCondition("python"),
+      needs: ["verify-context", ...(usesRustArtifacts ? ["rust-build"] : [])],
       runsOn: ["ubuntu-latest"],
-      permissions: {
-        contents: JobPermission.READ,
-        ...(upstreamWorkflow || usesRustArtifacts ? { actions: JobPermission.READ } : {}),
-      },
+      permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
       timeoutMinutes: 20,
+      env: { BUN_VERSION },
       steps: [
-        ...(upstreamWorkflow
-          ? [
-              {
-                name: "Download release metadata",
-                if: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.event == 'repository_dispatch' }}",
-                uses: "actions/download-artifact@v8",
-                with: {
-                  name: "release-metadata",
-                  path: ".release",
-                  "run-id": "${{ github.event.workflow_run.id }}",
-                  "github-token": "${{ github.token }}",
-                },
-              },
-              {
-                name: "Read release metadata",
-                id: "release_metadata",
-                if: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.event == 'repository_dispatch' }}",
-                shell: "bash",
-                run: [
-                  'RELEASE_TAG="$(cat .release/tag)"',
-                  'EXPECTED_SHA="$(cat .release/sha)"',
-                  'test -n "$RELEASE_TAG"',
-                  'test -n "$EXPECTED_SHA"',
-                  'echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"',
-                  'echo "expected_sha=$EXPECTED_SHA" >> "$GITHUB_OUTPUT"',
-                ].join("\n"),
-              },
-            ]
-          : []),
-        ...(branchDispatch
-          ? releaseSourceSteps()
-          : [
-              {
-                name: "Checkout",
-                uses: "actions/checkout@v6",
-                with: {
-                  "fetch-depth": 0,
-                  ...(upstreamWorkflow
-                    ? {
-                        ref: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.event == 'repository_dispatch' && steps.release_metadata.outputs.expected_sha || github.event_name == 'workflow_run' && github.event.workflow_run.head_sha || github.sha }}",
-                      }
-                    : {}),
-                },
-              },
-            ]),
-        ...(upstreamWorkflow
-          ? [
-              {
-                name: "Verify release source",
-                if: "${{ github.event_name == 'workflow_run' && github.event.workflow_run.event == 'repository_dispatch' }}",
-                shell: "bash",
-                env: {
-                  RELEASE_TAG: "${{ steps.release_metadata.outputs.release_tag }}",
-                  EXPECTED_SHA: "${{ steps.release_metadata.outputs.expected_sha }}",
-                },
-                run: [
-                  'git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
-                  'test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$EXPECTED_SHA"',
-                  'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"',
-                ].join("\n"),
-              },
-            ]
-          : []),
+        ...releaseSourceSteps(),
+        ...bunCacheRestoreSteps(project),
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
-        ...(usesRustArtifacts
-          ? [
-              {
-                name: "Require Rust artifact handoff",
-                if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
-                shell: "bash",
-                env: {
-                  RUST_RUN_ID:
-                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
-                  RUST_RUN_ATTEMPT:
-                    "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_attempt || github.event.workflow_run.run_attempt }}",
-                },
-                run: ['test -n "$RUST_RUN_ID"', 'test -n "$RUST_RUN_ATTEMPT"'].join("\n"),
-              },
-            ]
-          : []),
-        ...uniffiPublications.map((publication) => ({
-          name: `Download ${publication.distribution} native wheels`,
-          if: "${{ github.event_name == 'repository_dispatch' || github.event_name == 'workflow_run' }}",
-          uses: "actions/download-artifact@v8",
-          with: {
+        { name: "Install release helpers", run: "bun install" },
+        bunCacheSaveStep(),
+        ...uniffiPublications.flatMap((publication) =>
+          releaseArtifactSteps({
+            currentName: `Download ${publication.distribution} native wheels`,
+            recoveredName: `Download recovered ${publication.distribution} native wheels`,
             pattern: `${publication.distribution}--*--python-wheel`,
             path: `dist/${publication.directory}`,
-            "merge-multiple": true,
-            "run-id":
-              "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.rust_run_id || github.event.workflow_run.id }}",
-            "github-token": "${{ github.token }}",
-          },
-        })),
+          }),
+        ),
         {
           name: "Stamp workspace versions",
-          env: {
-            VERSION: branchDispatch
-              ? RELEASE_TAG
-              : "${{ github.event_name == 'push' && github.ref_name || github.event_name == 'workflow_run' && github.event.workflow_run.event == 'repository_dispatch' && steps.release_metadata.outputs.release_tag || inputs.version }}",
-          },
-          run: upstreamWorkflow
-            ? [
-                'if [ "$GITHUB_EVENT_NAME" = "workflow_run" ]; then',
-                '  if [ "${{ github.event.workflow_run.event }}" != "repository_dispatch" ]; then',
-                '    VERSION="$(git tag --points-at HEAD --list "v*" | sort -V | tail -1)"',
-                "  fi",
-                '  test -n "$VERSION"',
-                "fi",
-                this.renderVersionStampScript(),
-                "mkdir -p .release",
-                'printf "%s\\n" "$VERSION" > .release/tag',
-                "git rev-parse HEAD > .release/sha",
-              ].join("\n")
-            : [
-                this.renderVersionStampScript(),
-                "mkdir -p .release",
-                'printf "%s\\n" "$VERSION" > .release/tag',
-                "git rev-parse HEAD > .release/sha",
-              ].join("\n"),
+          env: { VERSION: RELEASE_VERSION },
+          run: `bun node_modules/@dbx-tools/projen/tasks/stamp-python.ts "$VERSION" --root ${quote(this.repository.root)}`,
         },
         {
           name: "Build distributions",
@@ -633,7 +478,7 @@ export class DBXToolsPythonWorkspace extends Component {
             ),
             ...uniffiPublications.map(
               (publication) =>
-                `if [ "$GITHUB_EVENT_NAME" = "repository_dispatch" ] || [ "$GITHUB_EVENT_NAME" = "workflow_run" ]; then find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .; fi`,
+                `find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .`,
             ),
             "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
           ].join("\n"),
@@ -641,23 +486,17 @@ export class DBXToolsPythonWorkspace extends Component {
         {
           name: "Upload distributions",
           uses: "actions/upload-artifact@v7",
-          with: { name: "python-distributions", path: "dist" },
-        },
-        {
-          name: "Upload release metadata",
-          uses: "actions/upload-artifact@v7",
-          with: { name: "release-metadata", path: ".release" },
+          with: { name: "python-distributions", path: "dist", "retention-days": 7 },
         },
       ],
     });
     for (const publication of allPublications) {
-      workflow.addJob(`publish-${publication.directory}`, {
-        if: branchDispatch
-          ? "${{ github.event_name == 'repository_dispatch' }}"
-          : "${{ github.event_name == 'push' || github.event_name == 'workflow_run' }}",
+      workflow.addJob(`publish-pypi-${publication.directory}`, {
+        if: releasePublishCondition("python"),
         needs: [
-          "build",
-          ...(publication.dependencies ?? []).map((dependency) => `publish-${dependency}`),
+          "verify-context",
+          "build-python",
+          ...(publication.dependencies ?? []).map((dependency) => `publish-pypi-${dependency}`),
         ],
         environment: {
           name: publication.environment,
@@ -677,7 +516,10 @@ export class DBXToolsPythonWorkspace extends Component {
           {
             name: `Publish ${publication.distribution} to PyPI`,
             uses: "pypa/gh-action-pypi-publish@release/v1",
-            with: { "packages-dir": `dist/${publication.directory}` },
+            with: {
+              "packages-dir": `dist/${publication.directory}`,
+              "skip-existing": true,
+            },
           },
         ],
       });
@@ -692,7 +534,6 @@ export class DBXToolsPythonWorkspace extends Component {
         distribution: pkg.packageOptions.name,
         environment:
           options.environments?.[pkg.packageOptions.name] ?? `pypi-${pkg.packageOptions.name}`,
-        workflowName: options.workflowName ?? "python-release",
       }));
   }
 
@@ -706,7 +547,6 @@ export class DBXToolsPythonWorkspace extends Component {
           pkg.packageOptions.trustedPublisher?.environment ??
           options.environments?.[pkg.packageOptions.name] ??
           `pypi-${pkg.packageOptions.name}`,
-        workflowName: options.workflowName ?? "python-release",
         artifacts: pkg.packageOptions.trustedPublisher?.artifacts,
         dependencies: pkg.packageOptions.internalDependencies,
       }));
@@ -725,7 +565,6 @@ export class DBXToolsPythonWorkspace extends Component {
         directory: pkg.packageOptions.directory,
         distribution: pkg.packageOptions.name,
         environment: publisher.environment,
-        workflowName: publisher.workflowName,
         artifacts: publisher.artifacts,
       });
     }
@@ -738,13 +577,13 @@ export class DBXToolsPythonWorkspace extends Component {
   ): void {
     const repository = this.githubRepository();
     const publications = this.trustedPublisherPublications(options);
-    const releaseBranch = projectReleaseBranch(project);
+    const releaseTags = isDBXToolsJavaScriptProject()(project) ? releaseTagPattern(project) : "v*";
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
       "Use the system browser to audit and configure the PyPI trusted publishers below.",
       "Do not use an in-app browser or embedded webview.",
-      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and tag value is provided below and is authoritative.",
       "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
@@ -762,7 +601,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- The supplied branch policy value is ${releaseBranch}.`,
+      `- The supplied tag policy value is ${releaseTags}.`,
       "- Do not inspect or configure GitHub environments during this task.",
       "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
@@ -797,14 +636,13 @@ export class DBXToolsPythonWorkspace extends Component {
       "Publisher type: GitHub Actions",
       "",
       ...publications.flatMap((publication) => {
-        const workflowName = `${publication.workflowName}.yml`;
         return [
           `## ${publication.distribution}`,
           `- Owner: ${repository.owner}`,
           `- Repository name: ${repository.name}`,
-          `- Workflow name: ${workflowName}`,
+          "- Workflow name: release.yml",
           `- Environment name: ${publication.environment}`,
-          `- GitHub environment branch: ${releaseBranch}`,
+          `- GitHub environment tag: ${releaseTags}`,
           ...(publication.artifacts ? [`- Artifacts: ${publication.artifacts}`] : []),
           "",
         ];
@@ -846,44 +684,4 @@ export class DBXToolsPythonWorkspace extends Component {
     }
     return { owner: match[1], name: match[2] };
   }
-
-  private renderVersionStampScript(): string {
-    return [
-      `chmod -R u+w ${this.repository.root}`,
-      "python - <<'PY'",
-      "from pathlib import Path",
-      "import os",
-      "import re",
-      "",
-      'version = os.environ["VERSION"].removeprefix("v")',
-      `package_files = sorted(Path(${quote(this.repository.root)}).glob("*/pyproject.toml"))`,
-      "packages = {}",
-      "for path in package_files:",
-      '    source = path.read_text(encoding="utf-8")',
-      '    name = re.search(r\'^name = "([^"]+)"$\', source, re.MULTILINE)',
-      "    if name is None:",
-      '        raise ValueError(f"Missing project name in {path}")',
-      "    packages[name.group(1)] = path.parent.name",
-      "",
-      "for path in package_files:",
-      '    source = path.read_text(encoding="utf-8")',
-      "    source, count = re.subn(",
-      '        r\'^version = "[^"]+"$\',',
-      "        f'version = \"{version}\"',",
-      "        source,",
-      "        count=1,",
-      "        flags=re.MULTILINE,",
-      "    )",
-      "    if count != 1:",
-      '        raise ValueError(f"Expected one project version in {path}")',
-      "    for name, directory in packages.items():",
-      "        source = re.sub(",
-      `            rf'{re.escape(name)} @ git\\+[^" ]+#subdirectory=${this.repository.root}/{re.escape(directory)}',`,
-      '            f"{name}=={version}",',
-      "            source,",
-      "        )",
-      '    path.write_text(source, encoding="utf-8")',
-      "PY",
-    ].join("\n");
-  }
 }