@dbx-tools/projen 0.6.177 → 0.6.179

package/src/project-rs.ts

@@ -4,22 +4,27 @@ import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { project as coreProject } from "@dbx-tools/core";
 import { string } from "@dbx-tools/shared-core";
-import { Project, TextFile, YamlFile, javascript } from "projen";
-import {
-  DBXToolsTypeScriptProject,
-  projectReleaseBranch,
-  projectRepositoryUrl,
-} from "./project-js.ts";
+import { Project, TextFile, javascript } from "projen";
+import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
+import { BUN_VERSION } from "./bun-workflow.ts";
+import { DBXToolsTypeScriptProject, projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import { pythonModuleName, type PythonPackageOptions } from "./project-py.ts";
 import type { DBXToolsProject } from "./project.ts";
 import {
-  DOWNSTREAM_RELEASE_EVENT,
   RELEASE_SHA,
   RELEASE_TAG,
-  RUST_RELEASE_EVENT,
+  RELEASE_VERSION,
   releaseSourceSteps,
 } from "./release-dispatch.ts";
+import {
+  hasNodeRelease,
+  npmPublishEnvironment,
+  nodeReleaseSetupSteps,
+  releaseArtifactSteps,
+  releaseStageCondition,
+  releaseWorkflow,
+} from "./release.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
 export interface CargoDependencyOptions {
@@ -75,12 +80,6 @@ export interface DBXToolsRustWorkspaceOptions {
   readonly releaseTargets?: readonly UniFFIReleaseTarget[];
   /** Maintained OS/CPU combinations to release. Defaults to every supported target. */
   readonly releasePlatforms?: readonly RustReleasePlatform[];
-  /** Workflow name used by downstream release stages. Defaults to `rust-release`. */
-  readonly releaseWorkflowName?: string;
-  /** Workflow that publishes generated Python wheels. Defaults to `python-release`. */
-  readonly pythonReleaseWorkflowName?: string;
-  /** Tag prefix dispatched into the branch-scoped release workflow. Defaults to `v`. */
-  readonly releaseTagPrefix?: string;
 }
 
 export enum RustReleaseOs {
@@ -258,7 +257,6 @@ export interface RustWorkspaceMapping {
   readonly root: string;
   readonly crates: readonly string[];
   readonly bindings: readonly RustBindingMapping[];
-  readonly releaseWorkflow?: string;
 }
 
 export function orderRustBindings(bindings: readonly RustBindingMapping[]): RustBindingMapping[] {
@@ -552,7 +550,6 @@ export class DBXToolsRustWorkspace {
       root,
       crates: this.packages.map((pkg) => `${root}/${pkg.packageOptions.directory}`),
       bindings: this.bindingMappings,
-      ...(releaseEnabled ? { releaseWorkflow: options.releaseWorkflowName ?? "rust-release" } : {}),
     };
     if (dbxToolsProject) {
       dbxToolsProject.dbxToolsConfig.rust = this.workspaceMapping;
@@ -594,7 +591,6 @@ export class DBXToolsRustWorkspace {
             `src/${module.replaceAll(".", "/")}/__init__.py`,
           ],
           trustedPublisher: {
-            workflowName: options.pythonReleaseWorkflowName ?? "python-release",
             environment: `pypi-${pkg.crateName}`,
             artifacts: `platform-specific wheels for ${releaseTargets(options)
               .map((target) => `${target.os}-${target.cpu}`)
@@ -721,11 +717,8 @@ export class DBXToolsRustWorkspace {
     options: DBXToolsRustWorkspaceOptions,
     targets: readonly UniFFIReleaseTarget[],
   ): void {
-    if (!project.github) return;
-    const workflowName = options.releaseWorkflowName ?? "rust-release";
-    const releaseTagPrefix = options.releaseTagPrefix ?? "v";
+    if (!project.github || !isDBXToolsJavaScriptProject()(project)) return;
     const releaseRustVersion = options.releaseRustVersion ?? "stable";
-    const releaseBranch = projectReleaseBranch(project);
     const bindings = this.bindingMappings.map((binding) => ({
       ...binding,
       node: binding.node ?? "",
@@ -739,14 +732,19 @@ export class DBXToolsRustWorkspace {
         crate: pkg.crateName,
         binary: pkg.packageOptions.binaryName ?? pkg.crateName,
       }));
+    const orderedBindingCrates = this.bindingMappings.map((binding) => binding.crate);
     const publicCrates = this.packages
       .filter((pkg) => !pkg.packageOptions.private)
       .sort((first, second) => {
-        const order = this.bindingMappings.map((binding) => binding.crate);
-        return order.indexOf(first.crateName) - order.indexOf(second.crateName);
+        // Binding crates publish in topological order before release-only crates that may consume them.
+        const firstIndex = orderedBindingCrates.indexOf(first.crateName);
+        const secondIndex = orderedBindingCrates.indexOf(second.crateName);
+        if (firstIndex < 0) return secondIndex < 0 ? 0 : 1;
+        if (secondIndex < 0) return -1;
+        return firstIndex - secondIndex;
       })
       .map((pkg) => pkg.crateName);
-    const targetMatrix = targets.map((target) => ({ target }));
+    const targetMatrix = targets.map((target) => ({ ...target }));
     const hasPythonBindings = bindings.some((binding) => binding.python);
     const usePreinstalledWindowsRust = releaseRustVersion === "stable";
     const hasTargetOutputs =
@@ -770,30 +768,30 @@ export class DBXToolsRustWorkspace {
         `--python "${binding.python}"`,
         `--node-package "${binding.nodePackage}"`,
         `--python-package "${binding.pythonPackage}"`,
-        '--cargo-target "${{ matrix.target.cargo }}"',
-        '--node-triple "${{ matrix.target.node }}"',
-        '--python-tag "${{ matrix.target.python }}"',
-        '--os "${{ matrix.target.os }}"',
-        '--cpu "${{ matrix.target.cpu }}"',
-        '--libc "${{ matrix.target.libc }}"',
-        `--version "\${VERSION#${releaseTagPrefix}}"`,
-        `--output "dist/release/${binding.crate}/\${{ matrix.target.node }}"`,
+        '--cargo-target "${{ matrix.cargo }}"',
+        '--node-triple "${{ matrix.node }}"',
+        '--python-tag "${{ matrix.python }}"',
+        '--os "${{ matrix.os }}"',
+        '--cpu "${{ matrix.cpu }}"',
+        '--libc "${{ matrix.libc }}"',
+        '--version "$VERSION"',
+        `--output "dist/release/${binding.crate}/\${{ matrix.node }}"`,
         "--skip-build",
       ].join(" \\\n  "),
     );
     const binaryCommands = releaseBinaries.flatMap((pkg) => [
-      `mkdir -p "dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/stage"`,
-      `SOURCE="target/\${{ matrix.target.cargo }}/release/${pkg.binary}\${{ matrix.target.os == 'win32' && '.exe' || '' }}"`,
-      `DESTINATION="dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/stage/${pkg.binary}\${{ matrix.target.os == 'win32' && '.exe' || '' }}"`,
+      `mkdir -p "dist/release/${pkg.crate}/\${{ matrix.node }}/binary/stage"`,
+      `SOURCE="target/\${{ matrix.cargo }}/release/${pkg.binary}\${{ matrix.os == 'win32' && '.exe' || '' }}"`,
+      `DESTINATION="dist/release/${pkg.crate}/\${{ matrix.node }}/binary/stage/${pkg.binary}\${{ matrix.os == 'win32' && '.exe' || '' }}"`,
       'cp "$SOURCE" "$DESTINATION"',
-      'if [ "${{ matrix.target.os }}" = "win32" ]; then',
-      `  7z a "dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/${pkg.binary}-\${{ matrix.target.node }}.zip" "$DESTINATION"`,
+      'if [ "${{ matrix.os }}" = "win32" ]; then',
+      `  7z a "dist/release/${pkg.crate}/\${{ matrix.node }}/binary/${pkg.binary}-\${{ matrix.node }}.zip" "$DESTINATION"`,
       "else",
-      `  tar -C "dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/stage" -czf "dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/${pkg.binary}-\${{ matrix.target.node }}.tar.gz" "${pkg.binary}"`,
+      `  tar -C "dist/release/${pkg.crate}/\${{ matrix.node }}/binary/stage" -czf "dist/release/${pkg.crate}/\${{ matrix.node }}/binary/${pkg.binary}-\${{ matrix.node }}.tar.gz" "${pkg.binary}"`,
       "fi",
-      `rm -rf "dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/stage"`,
+      `rm -rf "dist/release/${pkg.crate}/\${{ matrix.node }}/binary/stage"`,
     ]);
-    const artifactSteps = [
+    const artifactSteps: JobStep[] = [
       ...bindings.flatMap((binding) => [
         ...(binding.node
           ? [
@@ -801,8 +799,8 @@ export class DBXToolsRustWorkspace {
                 name: `Upload ${binding.crate} native npm package`,
                 uses: "actions/upload-artifact@v7",
                 with: {
-                  name: `${binding.crate}-\${{ matrix.target.node }}-npm`,
-                  path: `dist/release/${binding.crate}/\${{ matrix.target.node }}/npm/*.tgz`,
+                  name: `${binding.crate}-\${{ matrix.node }}-npm`,
+                  path: `dist/release/${binding.crate}/\${{ matrix.node }}/npm/*.tgz`,
                   "retention-days": 7,
                 },
               },
@@ -814,8 +812,8 @@ export class DBXToolsRustWorkspace {
                 name: `Upload ${binding.crate} Python wheel`,
                 uses: "actions/upload-artifact@v7",
                 with: {
-                  name: `${binding.crate}--\${{ matrix.target.python }}--python-wheel`,
-                  path: `dist/release/${binding.crate}/\${{ matrix.target.node }}/python/*.whl`,
+                  name: `${binding.crate}--\${{ matrix.python }}--python-wheel`,
+                  path: `dist/release/${binding.crate}/\${{ matrix.node }}/python/*.whl`,
                   "retention-days": 7,
                 },
               },
@@ -826,22 +824,24 @@ export class DBXToolsRustWorkspace {
         name: `Upload ${pkg.crate} release binary`,
         uses: "actions/upload-artifact@v7",
         with: {
-          name: `${pkg.crate}-\${{ matrix.target.node }}-binary`,
-          path: `dist/release/${pkg.crate}/\${{ matrix.target.node }}/binary/*`,
+          name: `${pkg.crate}-\${{ matrix.node }}-binary`,
+          path: `dist/release/${pkg.crate}/\${{ matrix.node }}/binary/*`,
           "retention-days": 7,
         },
       })),
     ];
     const buildJob = {
-      name: "${{ matrix.target.node }}",
+      if: "${{ github.event_name == 'push' || inputs.stage == 'all' }}",
+      name: "${{ matrix.node }}",
       needs: ["verify-context"],
-      "runs-on": "${{ matrix.target.runner }}",
+      runsOn: ["${{ matrix.runner }}"],
+      permissions: { contents: JobPermission.READ },
       env: {
         ...RUST_CACHE_ENV,
-        SCCACHE_GHA_VERSION: `release-\${{ matrix.target.cargo }}-rust-${releaseRustVersion}`,
+        SCCACHE_GHA_VERSION: `release-\${{ matrix.cargo }}-rust-${releaseRustVersion}`,
       },
       strategy: {
-        "fail-fast": false,
+        failFast: false,
         matrix: { include: targetMatrix },
       },
       steps: [
@@ -849,31 +849,31 @@ export class DBXToolsRustWorkspace {
         ...(hasPythonBindings ? [{ name: "Setup uv", uses: "astral-sh/setup-uv@v7" }] : []),
         {
           name: "Setup Rust",
-          ...(usePreinstalledWindowsRust ? { if: "${{ matrix.target.os != 'win32' }}" } : {}),
+          ...(usePreinstalledWindowsRust ? { if: "${{ matrix.os != 'win32' }}" } : {}),
           uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
-          with: { targets: "${{ matrix.target.cargo }}" },
+          with: { targets: "${{ matrix.cargo }}" },
         },
         ...(usePreinstalledWindowsRust
           ? [
               {
                 name: "Verify preinstalled Windows Rust",
-                if: "${{ matrix.target.os == 'win32' }}",
+                if: "${{ matrix.os == 'win32' }}",
                 shell: "bash",
                 run: [
                   "rustc --version --verbose",
                   "cargo --version",
-                  'rustup target list --installed | grep -Fx "${{ matrix.target.cargo }}"',
-                  'test -f "$(rustc --print sysroot)/lib/rustlib/${{ matrix.target.cargo }}/bin/rust-lld.exe"',
+                  'rustup target list --installed | grep -Fx "${{ matrix.cargo }}"',
+                  'test -f "$(rustc --print sysroot)/lib/rustlib/${{ matrix.cargo }}/bin/rust-lld.exe"',
                 ].join("\n"),
               },
             ]
           : []),
-        ...rustCacheSteps(`release-\${{ matrix.target.cargo }}-rust-${releaseRustVersion}`),
+        ...rustCacheSteps(`release-\${{ matrix.cargo }}-rust-${releaseRustVersion}`),
         {
           name: "Log cache configuration",
           shell: "bash",
           run: [
-            `echo "cargo_cache_namespace=release-\${{ matrix.target.cargo }}-rust-${releaseRustVersion}"`,
+            `echo "cargo_cache_namespace=release-\${{ matrix.cargo }}-rust-${releaseRustVersion}"`,
             'echo "cargo_cache_hit=${{ steps.cargo_cache.outputs.cache-hit }}"',
             'echo "sccache_scope=${{ github.ref }}"',
             'echo "sccache_namespace=${SCCACHE_GHA_VERSION}"',
@@ -881,7 +881,7 @@ export class DBXToolsRustWorkspace {
         },
         {
           name: "Install Linux native dependencies",
-          if: "${{ matrix.target.os == 'linux' }}",
+          if: "${{ matrix.os == 'linux' }}",
           run: "sudo apt-get update && sudo apt-get install --yes libdbus-1-dev pkg-config",
         },
         {
@@ -889,11 +889,11 @@ export class DBXToolsRustWorkspace {
           shell: "bash",
           env: {
             CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER:
-              "${{ matrix.target.os == 'win32' && 'rust-lld' || '' }}",
+              "${{ matrix.os == 'win32' && 'rust-lld' || '' }}",
           },
           run: timedBash(
             "rust_workspace",
-            'cargo build --release --workspace --target "${{ matrix.target.cargo }}"',
+            'cargo build --release --workspace --target "${{ matrix.cargo }}"',
           ),
         },
         ...(bindingCommands.length
@@ -901,7 +901,7 @@ export class DBXToolsRustWorkspace {
               {
                 name: "Package UniFFI outputs",
                 shell: "bash",
-                env: { VERSION: RELEASE_TAG },
+                env: { VERSION: RELEASE_VERSION },
                 run: timedBash("uniffi_packaging", bindingCommands.join("\n")),
               },
             ]
@@ -924,194 +924,160 @@ export class DBXToolsRustWorkspace {
         },
       ],
     };
-    const releaseCompletionJobs = [
-      "build",
-      ...(publicCrates.length ? ["publish-cargo"] : []),
-      ...(releaseBinaries.length ? ["publish-github-release"] : []),
-    ];
-    new YamlFile(project, `.github/workflows/${workflowName}.yml`, {
-      obj: {
-        name: workflowName,
-        "run-name": `${workflowName} ${RELEASE_TAG}`,
-        on: {
-          repository_dispatch: {
-            types: [RUST_RELEASE_EVENT],
+    const workflow = releaseWorkflow(project);
+    if (hasTargetOutputs && targetMatrix.length) {
+      workflow.addJob("rust-build", buildJob);
+    }
+    if (publicCrates.length) {
+      workflow.addJob("publish-cargo", {
+        if: "${{ github.event_name == 'push' }}",
+        needs: ["verify-context", "rust-build"],
+        runsOn: ["ubuntu-latest"],
+        permissions: { contents: JobPermission.READ },
+        steps: [
+          ...releaseSourceSteps(),
+          {
+            name: "Setup Rust",
+            uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
           },
-          workflow_dispatch: {
-            inputs: {
-              release_tag: {
-                description: "Annotated release tag to build",
-                type: "string",
-                required: true,
-              },
-              expected_sha: {
-                description: "Commit the release tag must reference",
-                type: "string",
-                required: true,
-              },
+          {
+            name: "Publish public crates",
+            env: { CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}" },
+            run: publicCrates
+              .map((crate) => `cargo publish --package "${crate}" --registry crates-io --no-verify`)
+              .join("\n"),
+          },
+        ],
+      });
+      workflow.addJob("publish-local-cargo", {
+        if: "${{ github.event_name == 'push' && vars.LOCAL_REPOSITORIES == 'true' }}",
+        needs: ["verify-context", "rust-build"],
+        runsOn: ["self-hosted"],
+        permissions: { contents: JobPermission.READ },
+        steps: [
+          ...releaseSourceSteps(),
+          {
+            name: "Setup Rust",
+            uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
+          },
+          {
+            name: "Publish Cargo crates locally",
+            env: { CARGO_REGISTRY_TOKEN: "${{ secrets.LOCAL_CARGO_TOKEN }}" },
+            run: publicCrates
+              .map(
+                (crate) =>
+                  `cargo publish --package "${crate}" --registry "\${{ vars.LOCAL_CARGO_REGISTRY }}" --no-verify`,
+              )
+              .join("\n"),
+          },
+        ],
+      });
+    }
+    if (releaseBinaries.length) {
+      workflow.addJob("publish-github-release", {
+        if: "${{ github.event_name == 'push' }}",
+        needs: ["verify-context", "rust-build"],
+        runsOn: ["ubuntu-latest"],
+        permissions: { contents: JobPermission.WRITE },
+        steps: [
+          {
+            name: "Download release binaries",
+            uses: "actions/download-artifact@v8",
+            with: {
+              pattern: "*-binary",
+              path: "dist/rust-release",
+              "merge-multiple": true,
             },
           },
+          {
+            name: "Publish GitHub release assets",
+            uses: "softprops/action-gh-release@v2",
+            with: {
+              files: "dist/rust-release/*",
+              "generate-release-notes": true,
+              tag_name: RELEASE_TAG,
+              target_commitish: RELEASE_SHA,
+            },
+          },
+        ],
+      });
+    }
+
+    const nodeBindings = bindings.filter((binding) => Boolean(binding.node && binding.nodePackage));
+    if (nodeBindings.length && hasNodeRelease(project)) {
+      workflow.addJob("publish-native-npm", {
+        if: "${{ always() && needs.verify-context.result == 'success' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
+        needs: ["verify-context", "rust-build"],
+        runsOn: ["ubuntu-latest"],
+        permissions: {
+          actions: JobPermission.READ,
+          contents: JobPermission.READ,
+          idToken: JobPermission.WRITE,
         },
-        concurrency: {
-          group: workflowName,
-          "cancel-in-progress": true,
-        },
-        permissions: { contents: "read" },
-        jobs: {
-          "verify-context": {
-            "runs-on": "ubuntu-latest",
-            steps: [
-              {
-                name: "Require the default branch cache scope",
-                shell: "bash",
-                env: {
-                  RELEASE_BRANCH: releaseBranch,
-                },
-                run: 'test "$GITHUB_REF_NAME" = "$RELEASE_BRANCH"',
-              },
-              {
-                name: "Write release metadata",
-                shell: "bash",
-                env: {
-                  RELEASE_TAG,
-                  EXPECTED_SHA: RELEASE_SHA,
-                },
-                run: [
-                  "mkdir -p .release",
-                  'printf "%s\\n" "$RELEASE_TAG" > .release/tag',
-                  'printf "%s\\n" "$EXPECTED_SHA" > .release/sha',
-                ].join("\n"),
-              },
-              {
-                name: "Upload release metadata",
-                uses: "actions/upload-artifact@v7",
-                with: {
-                  name: "release-metadata",
-                  path: ".release",
-                },
-              },
-            ],
+        timeoutMinutes: 15,
+        env: { BUN_VERSION, CI: "true" },
+        steps: [
+          ...nodeReleaseSetupSteps(project),
+          ...releaseArtifactSteps({
+            currentName: "Download native npm packages",
+            recoveredName: "Download recovered native npm packages",
+            pattern: "*-npm",
+            path: "dist/uniffi/native",
+          }),
+          {
+            name: "Publish native npm packages",
+            env: { RELEASE_VERSION, ...npmPublishEnvironment() },
+            run: 'bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory dist/uniffi/native --version "$RELEASE_VERSION" $DRY_RUN',
           },
-          ...(hasTargetOutputs && targetMatrix.length ? { build: buildJob } : {}),
-          ...(publicCrates.length
-            ? {
-                "publish-cargo": {
-                  if: "${{ github.event_name == 'repository_dispatch' }}",
-                  needs: ["build"],
-                  "runs-on": "ubuntu-latest",
-                  permissions: { contents: "read" },
-                  steps: [
-                    ...releaseSourceSteps(),
-                    {
-                      name: "Setup Rust",
-                      uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
-                    },
-                    {
-                      name: "Publish public crates",
-                      env: { CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}" },
-                      run: publicCrates
-                        .map(
-                          (crate) =>
-                            `cargo publish --package "${crate}" --registry crates-io --no-verify`,
-                        )
-                        .join("\n"),
-                    },
-                  ],
-                },
-              }
-            : {}),
-          ...(publicCrates.length
-            ? {
-                "publish-local-cargo": {
-                  if: "${{ github.event_name == 'repository_dispatch' && vars.LOCAL_REPOSITORIES == 'true' }}",
-                  needs: ["build"],
-                  "runs-on": ["self-hosted"],
-                  permissions: { contents: "read" },
-                  steps: [
-                    ...releaseSourceSteps(),
-                    {
-                      name: "Setup Rust",
-                      uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
-                    },
-                    {
-                      name: "Publish Cargo crates locally",
-                      env: {
-                        CARGO_REGISTRY_TOKEN: "${{ secrets.LOCAL_CARGO_TOKEN }}",
-                      },
-                      run: publicCrates
-                        .map(
-                          (crate) =>
-                            `cargo publish --package "${crate}" --registry "\${{ vars.LOCAL_CARGO_REGISTRY }}" --no-verify`,
-                        )
-                        .join("\n"),
-                    },
-                  ],
-                },
-              }
-            : {}),
-          ...(releaseBinaries.length
-            ? {
-                "publish-github-release": {
-                  if: "${{ github.event_name == 'repository_dispatch' }}",
-                  needs: ["build"],
-                  "runs-on": "ubuntu-latest",
-                  permissions: { contents: "write" },
-                  steps: [
-                    {
-                      name: "Download release binaries",
-                      uses: "actions/download-artifact@v8",
-                      with: {
-                        pattern: "*-binary",
-                        path: "dist/rust-release",
-                        "merge-multiple": true,
-                      },
-                    },
-                    {
-                      name: "Publish GitHub release assets",
-                      uses: "softprops/action-gh-release@v2",
-                      with: {
-                        files: "dist/rust-release/*",
-                        "generate-release-notes": true,
-                        tag_name: RELEASE_TAG,
-                        target_commitish: RELEASE_SHA,
-                      },
-                    },
-                  ],
-                },
-              }
-            : {}),
-          "dispatch-downstream": {
-            if: "${{ github.event_name == 'repository_dispatch' }}",
-            needs: releaseCompletionJobs,
-            "runs-on": "ubuntu-latest",
-            permissions: { contents: "write" },
-            steps: [
-              {
-                name: "Dispatch downstream releases",
-                shell: "bash",
-                env: {
-                  GH_TOKEN: "${{ github.token }}",
-                  RELEASE_TAG,
-                  EXPECTED_SHA: RELEASE_SHA,
-                  RELEASE_EVENT: DOWNSTREAM_RELEASE_EVENT,
-                  RUST_RUN_ID: "${{ github.run_id }}",
-                  RUST_RUN_ATTEMPT: "${{ github.run_attempt }}",
-                },
-                run: [
-                  [
-                    'gh api --method POST "repos/$GITHUB_REPOSITORY/dispatches"',
-                    '--raw-field event_type="$RELEASE_EVENT"',
-                    '--raw-field "client_payload[release_tag]=$RELEASE_TAG"',
-                    '--raw-field "client_payload[expected_sha]=$EXPECTED_SHA"',
-                    '--raw-field "client_payload[rust_run_id]=$RUST_RUN_ID"',
-                    '--raw-field "client_payload[rust_run_attempt]=$RUST_RUN_ATTEMPT"',
-                  ].join(" \\\n  "),
-                ].join("\n"),
-              },
-            ],
+        ],
+      });
+      const nodeJob = workflow.getJob("publish-node");
+      if ("uses" in nodeJob) throw new Error("publish-node must be a workflow job");
+      workflow.updateJob("publish-node", {
+        ...nodeJob,
+        if: "${{ always() && needs.verify-context.result == 'success' && needs.publish-native-npm.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
+        needs: ["verify-context", "publish-native-npm"],
+      });
+      workflow.addJob("publish-node-facades", {
+        if: releaseStageCondition("node"),
+        needs: ["verify-context", "publish-node"],
+        runsOn: ["ubuntu-latest"],
+        permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
+        timeoutMinutes: 30,
+        env: { BUN_VERSION, CI: "true" },
+        steps: [
+          ...nodeReleaseSetupSteps(project),
+          {
+            name: "Build and publish UniFFI npm facades",
+            env: { RELEASE_VERSION, ...npmPublishEnvironment() },
+            run: nodeBindings
+              .flatMap((binding) => {
+                const output = `dist/uniffi/facades/${binding.crate}`;
+                return [
+                  `node .projen/uniffi-release.mjs facade --node "${binding.node}" --node-package "${binding.nodePackage}" --node-triple "linux-x64-gnu" --version "$RELEASE_VERSION" --output "${output}"`,
+                  `bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory "${output}/npm-facade" --version "$RELEASE_VERSION" $DRY_RUN`,
+                ];
+              })
+              .join("\n"),
           },
-        },
-      },
-    });
+          {
+            name: "Smoke test published UniFFI npm facades",
+            if: "${{ github.event_name == 'push' && vars.UNIFFI_FACADE_SMOKE == 'true' }}",
+            continueOnError: true,
+            env: { RELEASE_VERSION },
+            run: [
+              'SMOKE_DIR="$(mktemp -d)"',
+              "trap 'rm -rf \"$SMOKE_DIR\"' EXIT",
+              'cd "$SMOKE_DIR"',
+              "npm init --yes >/dev/null",
+              ...nodeBindings.flatMap((binding) => [
+                `npm install --ignore-scripts --no-audit --no-fund --package-lock=false "${binding.nodePackage}@$RELEASE_VERSION"`,
+                `node -e 'import("${binding.nodePackage}")'`,
+              ]),
+            ].join("\n"),
+          },
+        ],
+      });
+    }
   }
 }

package/src/release-dispatch.ts

@@ -1,13 +1,12 @@
-/** Shared release events and immutable source verification. */
-export const DOWNSTREAM_RELEASE_EVENT = "release";
-export const RUST_RELEASE_EVENT = "rust-release";
-export const RELEASE_TAG =
-  "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.release_tag || inputs.release_tag }}";
-export const RELEASE_SHA =
-  "${{ github.event_name == 'repository_dispatch' && github.event.client_payload.expected_sha || inputs.expected_sha }}";
+/** Verified release context shared by every job in the unified workflow. */
+import type { JobStep } from "projen/lib/github/workflows-model";
 
-/** Check out and verify the exact commit carried by a release event. */
-export function releaseSourceSteps(): readonly Record<string, unknown>[] {
+export const RELEASE_TAG = "${{ needs.verify-context.outputs.release_tag }}";
+export const RELEASE_SHA = "${{ needs.verify-context.outputs.expected_sha }}";
+export const RELEASE_VERSION = "${{ needs.verify-context.outputs.release_version }}";
+
+/** Check out and verify the immutable commit selected by the release tag. */
+export function releaseSourceSteps(): readonly JobStep[] {
   return [
     {
       name: "Checkout release commit",
@@ -25,9 +24,8 @@ export function releaseSourceSteps(): readonly Record<string, unknown>[] {
         EXPECTED_SHA: RELEASE_SHA,
       },
       run: [
-        'test -n "$RELEASE_TAG"',
-        'test -n "$EXPECTED_SHA"',
         'git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
+        'test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
         'test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$EXPECTED_SHA"',
         'test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"',
       ].join("\n"),