@dbx-tools/projen 0.6.194 → 0.6.195

package/README.md

@@ -129,13 +129,14 @@ removing a crate or `setup_scaffolding!()` marker triggers a full synth. Repos
 without Rust crates start no Rust watcher. When Rust projects are detected,
 Cargo is required and the focused task fails immediately if it is unavailable.
 
-The workspace generates one `release.yml` workflow for every ecosystem. An
-annotated `v*` tag starts it directly. The context job resolves the tag to a
-commit, requires the tag object to be annotated, and exposes the verified tag,
-commit, and version to every source job. A manual run accepts that same tag and
+The workspace generates one `release.yml` workflow for every ecosystem. A push
+to the configured release branch starts it. The context job reads `VERSION`,
+creates the corresponding annotated `v*` tag, and exposes the verified tag,
+commit, and version to every source job. If the tag already exists, it must be
+annotated and reference the same commit. A manual run accepts that same tag and
 commit but requires dry-run mode, so it builds and validates without publishing
-packages or deploying documentation. One `release` concurrency group cancels a
-superseded run.
+packages or deploying documentation. One non-cancelling `release` concurrency
+group serializes publication.
 
 Release generation writes `release.yml` without scanning for or removing other
 workflow files. Consumers explicitly delete exact workflow files they no longer
@@ -146,15 +147,15 @@ For a separate recovery run, choose `node`, `python`, or `docs` instead of
 `all`. Node and Python recovery can supply the prior `release.yml` run ID; the
 workflow verifies that run used the commit selected by the annotated release
 tag before downloading its artifacts. Dispatch the workflow with the release
-tag as its Git ref so environment tag policies still apply. Manual recovery
+tag as its Git ref so recovery checks out the immutable release boundary. Manual recovery
 defaults to dry-run and publishes only when `dry_run` is cleared. npm retries skip an exact version only
 after the local archive integrity and repository identity match registry
 metadata. PyPI retries enable Twine's hash-aware existing-file behavior, which
 skips matching files and fails when an existing filename has different content.
 
 The Rust matrix has one row per target. Each row installs native dependencies,
-restores Cargo and sccache once, builds the Cargo workspace once, then packages
-every discovered output from that shared build. Set a source-only crate's or
+builds the Cargo workspace once, then packages every discovered output from
+that shared build. Set a source-only crate's or
 release-enabled binary's `releaseExcludeOs` package option to omit it from
 incompatible rows through Cargo `--exclude`. Release binary packaging and
 artifact upload are skipped in those rows. UniFFI crates cannot use this option
@@ -171,10 +172,11 @@ Node facades. A binary-only row therefore installs no language package tool.
 `rustVersion` remains the MSRV recorded in package manifests, while
 `releaseRustVersion` independently defaults release compilation to `stable`.
 Stable Windows rows verify and use the hosted runner's installed Rust toolchain
-and select `rust-lld` for the workspace build. Cargo registry caches
-and the `SCCACHE_GHA_VERSION` namespace stay stable per target/toolchain across
-version tags. Cache keys, restore results, sccache statistics, and phase timings
-are written to each build log. Python generation executes the already-built
+and select `rust-lld` for the workspace build. Rust release rows restore and
+update dependency-only Cargo caches in the release branch's cache scope. The
+cache key excludes workspace version changes, and manual tag recovery restores
+without saving a tag-scoped copy. There is no separate cache workflow or
+sccache layer. Phase timings are written to each build log. Python generation executes the already-built
 `target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 
@@ -204,7 +206,7 @@ to run the optional nonblocking registry install and import check after facade
 publication. Python combines same-run platform wheels with standard wheel and
 source builds, then publishes each distribution through its own PyPI
 trusted-publisher environment. Binding publishers wait for their dependencies.
-Trusted-publisher instructions name `release.yml` and the release tag policy.
+Trusted-publisher instructions name `release.yml` and the release branch policy.
 The docs jobs generate README and TypeScript API content and deploy GitHub Pages
 from the same workflow. When a conventional Node binding path already belongs
 to a root subproject, Rust mapping reuses that project and adds binding
@@ -388,7 +390,7 @@ a new package is covered without a re-synth. Work from the root:
 | `bun run test`    | `eslint` once, then each member's tests               |
 | `bun run sync`    | re-synth (`--watch` to keep synthing)                 |
 | `bun run barrels` | regenerate the read-only `index.ts` barrels           |
-| `bun run bump`    | version, tag, and publish                             |
+| `bun run bump`    | version, commit, and push the current branch          |
 
 `bump` also mirrors a release into local registries when the active clients are
 pointed at loopback services. npm uses `npm config get registry` and publishes
@@ -408,12 +410,14 @@ Use `--local-registry false` or `--local-pypi false` to disable either local
 publish. An explicit `--local-pypi http://localhost:3141/user/index/` overrides
 auto-detection; `--python-root` defaults to `packages/py`.
 
-The pushed `v*` tag is also the public release boundary. Available workflow
+The configured release branch is the publication trigger. Its workflow creates
+the annotated `v*` public release boundary from `VERSION`. Available workflow
 stages form the generated chain Rust -> Python -> Node -> docs: Rust builds and
 publishes native artifacts and Cargo crates, Python publishes standard
 distributions, Node publishes standard workspace packages, and docs deploys
-after publication. A stage with no corresponding outputs is omitted. Ordinary
-pushes to `main` publish none of those surfaces.
+after publication. A stage with no corresponding outputs is omitted. Keep
+ongoing development on another branch when every release-branch update should
+publish.
 
 Members intentionally keep only the tasks that something OTHER than a human
 invokes, so there is no second place to run the same thing:

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.6.193";
+export const PACKAGE_VERSION = "0.6.194";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -25,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.194",
-    "@dbx-tools/path": "0.6.194",
-    "@dbx-tools/shared-core": "0.6.194",
+    "@dbx-tools/core": "0.6.195",
+    "@dbx-tools/path": "0.6.195",
+    "@dbx-tools/shared-core": "0.6.195",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.194",
+  "version": "0.6.195",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -416,7 +416,7 @@ function defaultProjectOptions(
     // the block to render, giving the root a `publishConfig` it does not have
     // today. Provenance is never written to a manifest here (projen only reads it
     // in its own `Publisher`, and `release: false` means none exists); the
-    // tag-driven `release` workflow opts in per-run via `npm_config_provenance`
+    // The release workflow opts in per run through `npm_config_provenance`.
     // instead, so LOCAL publishes to a verdaccio still work with no CI OIDC
     // provider. See {@link DBXToolsRelease}.
     ...(isRoot ? {} : { npmAccess: javascript.NpmAccess.PUBLIC }),

package/src/project-py.ts

@@ -6,7 +6,7 @@ import type { IResolver } from "projen/lib/file";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { parse, stringify } from "smol-toml";
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
-import { projectRepositoryUrl } from "./project-js.ts";
+import { projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
 import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
@@ -14,7 +14,6 @@ import {
   releaseArtifactSteps,
   releasePublishCondition,
   releaseStageCondition,
-  releaseTagPattern,
   releaseWorkflow,
 } from "./release.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
@@ -577,13 +576,15 @@ export class DBXToolsPythonWorkspace extends Component {
   ): void {
     const repository = this.githubRepository();
     const publications = this.trustedPublisherPublications(options);
-    const releaseTags = isDBXToolsJavaScriptProject()(project) ? releaseTagPattern(project) : "v*";
+    const releaseBranch = isDBXToolsJavaScriptProject()(project)
+      ? projectReleaseBranch(project)
+      : "main";
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
       "Use the system browser to audit and configure the PyPI trusted publishers below.",
       "Do not use an in-app browser or embedded webview.",
-      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and tag value is provided below and is authoritative.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
       "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
@@ -601,7 +602,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- The supplied tag policy value is ${releaseTags}.`,
+      `- The supplied branch policy value is ${releaseBranch}.`,
       "- Do not inspect or configure GitHub environments during this task.",
       "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
@@ -642,7 +643,7 @@ export class DBXToolsPythonWorkspace extends Component {
           `- Repository name: ${repository.name}`,
           "- Workflow name: release.yml",
           `- Environment name: ${publication.environment}`,
-          `- GitHub environment tag: ${releaseTags}`,
+          `- GitHub environment branch: ${releaseBranch}`,
           ...(publication.artifacts ? [`- Artifacts: ${publication.artifacts}`] : []),
           "",
         ];

package/src/project-rs.ts

@@ -5,7 +5,6 @@ import { fileURLToPath } from "node:url";
 import { project as coreProject } from "@dbx-tools/core";
 import { string } from "@dbx-tools/shared-core";
 import { Project, TextFile, javascript } from "projen";
-import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
 import { BUN_VERSION } from "./bun-workflow.ts";
 import { DBXToolsTypeScriptProject, projectRepositoryUrl } from "./project-js.ts";
@@ -84,7 +83,7 @@ export interface DBXToolsRustWorkspaceOptions {
   readonly pythonRoot?: string;
   readonly pythonModulePrefix?: string;
   readonly private?: boolean;
-  /** Generate tag-driven cross-platform UniFFI package releases. */
+  /** Generate release-branch-driven cross-platform UniFFI package releases. */
   readonly release?: boolean;
   /** Native release targets; defaults to the maintained GitHub-hosted matrix. */
   readonly releaseTargets?: readonly UniFFIReleaseTarget[];
@@ -174,30 +173,35 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
   },
 ] as const;
 
+const UBRN_VERSION = "0.31.0-5";
+const RELEASE_PLATFORMS_ENV = "DBX_TOOLS_RELEASE_PLATFORMS";
 const RUST_CACHE_ENV = {
   CARGO_INCREMENTAL: "0",
   CARGO_TERM_COLOR: "always",
 } as const;
-const UBRN_VERSION = "0.31.0-5";
-const RELEASE_PLATFORMS_ENV = "DBX_TOOLS_RELEASE_PLATFORMS";
 
-function rustCacheSteps(
-  sharedKey: string,
-  idPrefix = "",
-  saveIf = true,
-): readonly Record<string, unknown>[] {
+function cargoCacheKeyStep(): Record<string, unknown> {
+  return {
+    name: "Resolve Cargo dependency cache key",
+    id: "cargo_cache_key",
+    run: "node .projen/cargo-cache-key.mjs",
+  };
+}
+
+function rustCacheSteps(sharedKey: string): readonly Record<string, unknown>[] {
   return [
     {
-      name: "Cache Cargo registry and targets",
-      id: `${idPrefix}cargo_cache`,
+      name: "Cache Cargo registry and dependencies",
+      id: "cargo_cache",
       uses: "Swatinem/rust-cache@v2.9.2",
       with: {
         "cache-targets": true,
         "cache-workspace-crates": false,
         "add-job-id-key": false,
-        "add-rust-environment-hash-key": true,
+        "add-rust-environment-hash-key": false,
+        key: "${{ steps.cargo_cache_key.outputs.key }}",
         "shared-key": sharedKey,
-        "save-if": saveIf,
+        "save-if": "${{ github.event_name == 'push' }}",
       },
     },
   ];
@@ -273,6 +277,66 @@ function uniffiReleaseTaskSource(): string {
   return readFileSync(source, "utf8");
 }
 
+function cargoCacheKeySource(): string {
+  return `#!/usr/bin/env node
+import { createHash } from "node:crypto";
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+
+function command(command, args) {
+  const result = spawnSync(command, args, { encoding: "utf8" });
+  if (result.error) throw result.error;
+  if (result.status !== 0) throw new Error(\`\${command} exited with \${result.status}\`);
+  return result.stdout;
+}
+
+const hasLock = existsSync("Cargo.lock");
+const metadata = JSON.parse(
+  command("cargo", [
+    "metadata",
+    ...(hasLock ? ["--locked"] : []),
+    "--format-version",
+    "1",
+    "--no-deps",
+  ]),
+);
+const workspaceNames = new Set(metadata.packages.map((pkg) => pkg.name));
+const dependencyLock = hasLock
+  ? readFileSync("Cargo.lock", "utf8")
+      .split("[[package]]")
+      .slice(1)
+      .filter((block) => {
+        const name = /^\\s*name = "([^"]+)"/m.exec(block)?.[1];
+        return name && !workspaceNames.has(name);
+      })
+      .map((block) => \`[[package]]\${block}\`)
+      .join("")
+  : "";
+const manifests = [
+  metadata.workspace_root + "/Cargo.toml",
+  ...metadata.packages.map((pkg) => pkg.manifest_path),
+]
+  .map((path) =>
+    readFileSync(path, "utf8").replace(/^version = "[0-9]+\\.[0-9]+\\.[0-9]+"\\s*$/gm, ""),
+  )
+  .join("\\n");
+const config = existsSync(".cargo/config.toml")
+  ? readFileSync(".cargo/config.toml", "utf8")
+  : "";
+const key = createHash("sha256")
+  .update(dependencyLock)
+  .update(manifests)
+  .update(config)
+  .update(command("rustc", ["-vV"]))
+  .digest("hex");
+if (process.env.GITHUB_OUTPUT) {
+  appendFileSync(process.env.GITHUB_OUTPUT, \`key=\${key}\\n\`);
+} else {
+  process.stdout.write(\`\${key}\\n\`);
+}
+`;
+}
+
 /** Persisted mapping consumed by the focused Rust source watcher. */
 export interface RustBindingMapping {
   readonly crate: string;
@@ -842,112 +906,13 @@ export class DBXToolsRustWorkspace {
     }
     project.removeTask("rs:bindings:demo");
     if (releaseEnabled) {
-      this.addCacheWorkflow(project, options, nativeTargets);
+      new TextFile(project, ".projen/cargo-cache-key.mjs", {
+        lines: cargoCacheKeySource().trimEnd().split("\n"),
+      });
       this.addReleaseWorkflow(project, options, nativeTargets);
     }
   }
 
-  private addCacheWorkflow(
-    project: javascript.NodeProject,
-    options: DBXToolsRustWorkspaceOptions,
-    targets: readonly UniFFIReleaseTarget[],
-  ): void {
-    if (!project.github || !isDBXToolsJavaScriptProject()(project) || targets.length === 0) return;
-    const releaseRustVersion = options.releaseRustVersion ?? "stable";
-    const usePreinstalledWindowsRust = releaseRustVersion === "stable";
-    const usesCargoLock = existsSync(join(project.outdir, "Cargo.lock"));
-    const hasReleaseExclusions = this.packages.some(
-      (pkg) => pkg.packageOptions.releaseExcludeOs?.length,
-    );
-    const matrix = targets.map((target) => ({
-      ...target,
-      ...(hasReleaseExclusions
-        ? {
-            cargoExcludes: this.packages
-              .filter((pkg) => pkg.packageOptions.releaseExcludeOs?.includes(target.os))
-              .map((pkg) => `--exclude ${pkg.crateName}`)
-              .join(" "),
-          }
-        : {}),
-    }));
-    const workflow = new GithubWorkflow(project.github, "rust-cache", {
-      fileName: "rust-cache.yml",
-      limitConcurrency: true,
-      concurrencyOptions: { group: "rust-cache", cancelInProgress: true },
-    });
-    workflow.on({
-      push: {
-        branches: ["main"],
-        paths: [
-          ".cargo/**",
-          ".github/workflows/rust-cache.yml",
-          "Cargo.lock",
-          "Cargo.toml",
-          "packages/rs/**",
-        ],
-      },
-      workflowDispatch: {},
-    });
-    workflow.addJob("prime", {
-      name: "${{ matrix.node }}",
-      runsOn: ["${{ matrix.runner }}"],
-      permissions: { contents: JobPermission.READ },
-      env: RUST_CACHE_ENV,
-      strategy: {
-        failFast: false,
-        matrix: { include: matrix },
-      },
-      steps: [
-        { name: "Checkout", uses: "actions/checkout@v6" },
-        {
-          name: "Setup Rust",
-          ...(usePreinstalledWindowsRust ? { if: "${{ matrix.os != 'win32' }}" } : {}),
-          uses: `dtolnay/rust-toolchain@${releaseRustVersion}`,
-          with: { targets: "${{ matrix.cargo }}" },
-        },
-        ...(usePreinstalledWindowsRust
-          ? [
-              {
-                name: "Verify preinstalled Windows Rust",
-                if: "${{ matrix.os == 'win32' }}",
-                shell: "bash",
-                run: [
-                  "rustc --version --verbose",
-                  "cargo --version",
-                  'rustup target list --installed | grep -Fx "${{ matrix.cargo }}"',
-                  'test -f "$(rustc --print sysroot)/lib/rustlib/${{ matrix.cargo }}/bin/rust-lld.exe"',
-                ].join("\n"),
-              },
-            ]
-          : []),
-        ...rustCacheSteps(`release-\${{ matrix.cargo }}-rust-${releaseRustVersion}`),
-        {
-          name: "Install Linux native dependencies",
-          if: "${{ matrix.os == 'linux' }}",
-          run: [
-            "sudo rm -f /etc/apt/sources.list.d/google-chrome.list",
-            "sudo apt-get update",
-            "sudo apt-get install --yes libdbus-1-dev pkg-config",
-          ].join("\n"),
-        },
-        {
-          name: "Prime Cargo target cache",
-          shell: "bash",
-          env: {
-            CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER:
-              "${{ matrix.os == 'win32' && 'rust-lld' || '' }}",
-          },
-          run: timedBash(
-            "rust_cache",
-            `cargo build --release --workspace${usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
-              hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
-            }`,
-          ),
-        },
-      ],
-    });
-  }
-
   private addReleaseWorkflow(
     project: javascript.NodeProject,
     options: DBXToolsRustWorkspaceOptions,
@@ -1142,15 +1107,8 @@ export class DBXToolsRustWorkspace {
               },
             ]
           : []),
-        ...rustCacheSteps(`release-\${{ matrix.cargo }}-rust-${releaseRustVersion}`, "", false),
-        {
-          name: "Log cache configuration",
-          shell: "bash",
-          run: [
-            `echo "cargo_cache_namespace=release-\${{ matrix.cargo }}-rust-${releaseRustVersion}"`,
-            'echo "cargo_cache_hit=${{ steps.cargo_cache.outputs.cache-hit }}"',
-          ].join("\n"),
-        },
+        cargoCacheKeyStep(),
+        ...rustCacheSteps(`release-\${{ matrix.cargo }}-rust-${releaseRustVersion}`),
         {
           name: "Install Linux native dependencies",
           if: "${{ matrix.os == 'linux' }}",

package/src/release.ts

@@ -1,9 +1,9 @@
-/** Unified tag-driven release workflow generation. */
+/** Unified default-branch release workflow generation. */
 import { Component } from "projen";
 import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
-import type { DBXToolsJavaScriptProject } from "./project-js.ts";
+import { projectReleaseBranch, type DBXToolsJavaScriptProject } from "./project-js.ts";
 import { applyTasks, taskScript } from "./project.ts";
 import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
 
@@ -44,14 +44,14 @@ export function hasNodeRelease(project: DBXToolsJavaScriptProject): boolean {
   return nodeReleaseProjects.has(project);
 }
 
-/** Tag pattern accepted by release jobs and GitHub environments. */
+/** Tag pattern created by release jobs and accepted by manual recovery. */
 export function releaseTagPattern(project: DBXToolsJavaScriptProject): string {
   const prefix = releaseTagPrefixes.get(project);
   if (!prefix) throw new Error("Release workflow is not configured");
   return `${prefix}*`;
 }
 
-/** Run a release stage on tag pushes or when selected for manual recovery. */
+/** Run a release stage on default-branch pushes or when selected for manual recovery. */
 export function releaseStageCondition(stage: Exclude<ReleaseStage, "all">): string {
   return `\${{ github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == '${stage}' }}`;
 }
@@ -121,10 +121,10 @@ export function npmPublishEnvironment(): Record<string, string> {
   };
 }
 
-function verifyContextJob(tagPrefix: string): Job {
+function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
   return {
     runsOn: ["ubuntu-latest"],
-    permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
+    permissions: { actions: JobPermission.READ, contents: JobPermission.WRITE },
     outputs: {
       release_tag: { stepId: "release", outputName: "release_tag" },
       expected_sha: { stepId: "release", outputName: "expected_sha" },
@@ -132,10 +132,10 @@ function verifyContextJob(tagPrefix: string): Job {
     },
     steps: [
       {
-        name: "Checkout release tag",
+        name: "Checkout release source",
         uses: "actions/checkout@v6",
         with: {
-          ref: "${{ github.event_name == 'push' && github.ref || inputs.expected_sha }}",
+          ref: "${{ github.event_name == 'push' && github.sha || inputs.expected_sha }}",
           "fetch-depth": 1,
         },
       },
@@ -145,18 +145,36 @@ function verifyContextJob(tagPrefix: string): Job {
         shell: "bash",
         env: {
           RELEASE_TAG:
-            "${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}",
+            "${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || '' }}",
           EXPECTED_SHA:
             "${{ github.event_name == 'workflow_dispatch' && inputs.expected_sha || '' }}",
           DRY_RUN: "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}",
         },
         run: [
-          `case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac`,
-          'git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
-          'test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
-          'RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
-          'test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
-          'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+          'if [ "$GITHUB_EVENT_NAME" = "push" ]; then',
+          '  test "$GITHUB_REF_TYPE" = "branch"',
+          `  test "$GITHUB_REF_NAME" = "${releaseBranch}"`,
+          '  RELEASE_SHA="$GITHUB_SHA"',
+          '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
+          "  RELEASE_VERSION=\"$(tr -d '\\r\\n' < VERSION)\"",
+          '  [[ "$RELEASE_VERSION" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+$ ]]',
+          `  RELEASE_TAG="${tagPrefix}$RELEASE_VERSION"`,
+          '  if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then',
+          '    git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
+          '    test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
+          '    test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$RELEASE_SHA"',
+          "  else",
+          '    git config user.name "github-actions[bot]"',
+          '    git config user.email "41898282+github-actions[bot]@users.noreply.github.com"',
+          '    git tag -a "$RELEASE_TAG" "$RELEASE_SHA" -m "$RELEASE_TAG"',
+          '    git push origin "refs/tags/$RELEASE_TAG"',
+          "  fi",
+          "else",
+          `  case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac`,
+          '  git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"',
+          '  test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
+          '  RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
+          '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
           '  test "$GITHUB_REF_TYPE" = "tag"',
           '  test "$GITHUB_REF_NAME" = "$RELEASE_TAG"',
           '  test "$RELEASE_SHA" = "$EXPECTED_SHA"',
@@ -294,13 +312,14 @@ export class DBXToolsRelease extends Component {
   constructor(project: DBXToolsJavaScriptProject, options: DBXToolsReleaseOptions = {}) {
     super(project);
     const tagPrefix = options.tagPrefix ?? "v";
+    const releaseBranch = projectReleaseBranch(project);
     releaseTagPrefixes.set(project, tagPrefix);
     if (options.nodeRelease !== false) nodeReleaseProjects.add(project);
     applyTasks(project, {
       bump: {
         exec: taskScript(project, "bump.ts", `--prefix ${tagPrefix}`),
         receiveArgs: true,
-        description: "Bump the release version (default patch), then commit, tag, and push it",
+        description: "Bump the release version (default patch), then commit and push it",
       },
     });
     if (!project.github) return;
@@ -308,12 +327,12 @@ export class DBXToolsRelease extends Component {
     const workflow = new GithubWorkflow(project.github, "release", {
       fileName: "release.yml",
       limitConcurrency: true,
-      concurrencyOptions: { group: "release", cancelInProgress: true },
+      concurrencyOptions: { group: "release", cancelInProgress: false },
     });
     workflow.runName =
-      "release ${{ github.event_name == 'push' && github.ref_name || inputs.release_tag }}";
+      "release ${{ github.event_name == 'push' && github.sha || inputs.release_tag }}";
     workflow.on({
-      push: { tags: [`${tagPrefix}*`] },
+      push: { branches: [releaseBranch] },
       workflowDispatch: {
         inputs: {
           release_tag: {
@@ -350,7 +369,7 @@ export class DBXToolsRelease extends Component {
     });
     workflow.file?.addOverride("permissions.contents", "read");
     workflow.file?.addOverride("on.workflow_dispatch.inputs.dry_run.default", true);
-    workflow.addJob("verify-context", verifyContextJob(tagPrefix));
+    workflow.addJob("verify-context", verifyContextJob(tagPrefix, releaseBranch));
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob(project));
     }

package/tasks/bump.ts

@@ -2,7 +2,8 @@
 /**
  * `projen bump` - compute the next release version, write it to the workspace
  * `VERSION` file, synth so every manifest copies it, then (by default) commit,
- * tag, and push. Pushing the tag is what triggers the release workflow.
+ * and push. Pushing the release branch triggers the workflow, which creates the
+ * annotated version tag before publishing.
  *
  * The base version is the HIGHEST published git tag across `<prefix>` and every
  * `--sibling` prefix (fetched from the remote so a release cut elsewhere wins),
@@ -22,27 +23,28 @@
  * tags. Both draw the fallback from the one root `VERSION` file, so the engine
  * and the packages share a single source of truth.
  *
- * Flags (all default ON; negate with the `--no-` form, per commander):
+ * Flags default ON unless noted; negate with the `--no-` form, per commander:
  *   --synth   / --no-synth     synth after writing VERSION so manifests copy it
  *   --version / --no-version   write the bumped version into `VERSION`
  *   --commit  / --no-commit    commit the release (staged with `git add -A`)
- *   --tag     / --no-tag       create the `<prefix><version>` git tag
- *   --push    / --no-push      push the CURRENT branch + tag to origin
+ *   --tag                       create the `<prefix><version>` git tag locally (default OFF)
+ *   --push    / --no-push      push the CURRENT branch to origin
  *
- * `--publish` / `--no-publish` is an alias for `--push` (pushing the tag is
- * what publishes). The tag prefix comes from `--prefix` (default `v`).
+ * `--publish` / `--no-publish` is an alias for `--push`. A push publishes only
+ * when the current branch is the configured release branch. The tag prefix
+ * comes from `--prefix` (default `v`).
  *
  * `--local-registry <value>` publishes npm packages to a LOCAL registry (e.g.
- * verdaccio) right after the tag push. `--local-pypi <value>` does the same for
+ * verdaccio) right after the branch push. `--local-pypi <value>` does the same for
  * Python packages through a writable devpi index. Values for both:
  *   - `auto` (default): publish only when `npm config get registry` is a
- *     loopback host, or when ANY active Python index — the primary
- *     `index-url` OR any `extra-index-url`, across uv and pip — is a loopback
+ *     loopback host, or when ANY active Python index - the primary
+ *     `index-url` OR any `extra-index-url`, across uv and pip - is a loopback
  *     devpi URL. Scanning the extras is what lets the corp proxy stay the
  *     primary index while a local devpi added as an extra is the detected
  *     publish target. The deploy endpoint for that index is taken from the
- *     GLOBAL uv config — an explicit `publish-url` on the matching `[[index]]`
- *     (or `UV_PUBLISH_URL`) — falling back to deriving it from the `+simple`
+ *     GLOBAL uv config - an explicit `publish-url` on the matching `[[index]]`
+ *     (or `UV_PUBLISH_URL`) - falling back to deriving it from the `+simple`
  *     URL shape when no such setting exists.
  *   - `false`: never publish locally.
  *   - a URL: always publish to that registry.
@@ -182,7 +184,7 @@ function localCargoRegistry(): string | undefined {
 
 const program = new Command();
 program
-  .description("Bump the release version, then commit, tag, and push it")
+  .description("Bump the release version, then commit and push it")
   .addOption(
     new Option("-l, --level <level>", "semver increment").choices([...LEVELS]).default("patch"),
   )
@@ -211,13 +213,13 @@ program
   .option("--no-synth", "do not run `projen` (synth) before bumping")
   .option("--no-version", "do not write the bumped version into package.json")
   .option("--no-commit", "do not commit the version change")
-  .option("--no-tag", "do not create the git tag")
-  .option("--no-push", "do not push the branch and tag to origin")
-  // `--publish` is a friendlier alias for `--push` (pushing the tag publishes).
+  .option("--tag", "create the release tag locally instead of leaving it to the workflow")
+  .option("--no-push", "do not push the current branch to origin")
+  // `--publish` is a friendlier alias for `--push`.
   .option("--no-publish", "alias for --no-push")
   .option(
     "--local-registry <value>",
-    "publish locally after the tag push: 'auto' (only a loopback npm registry), 'false', or a registry URL",
+    "publish locally after the branch push: 'auto' (only a loopback npm registry), 'false', or a registry URL",
     "auto",
   )
   .option(
@@ -280,6 +282,7 @@ program
       }
 
       const push = opts.push && opts.publish;
+      const createTags = opts.tag || siblings.length > 0;
 
       // Write the source of truth first, then synth so every generated manifest
       // COPIES it - synth never invents, resets, or drifts a version on its own.
@@ -338,7 +341,7 @@ program
             "-m",
             `chore(release): ${version}`,
             "-m",
-            "🌸 Shipped with Kanna — https://kanna.sh",
+            "Shipped with Kanna - https://kanna.sh",
             "-m",
             "Co-Authored-By: Kanna <noreply@kanna.sh>\nKanna-Agent: codex/databricks-gpt-5-6-sol",
           ]);
@@ -347,32 +350,24 @@ program
         }
       }
 
-      if (opts.tag) {
+      if (createTags) {
         for (const t of tags) git(["tag", "-a", t, "-m", t]);
         logger.info(`tagged ${tags.join(", ")}`);
       }
 
       if (push) {
         git(["push", "origin", "HEAD"]);
-        // The managed Databricks pre-push hook treats a newly created tag's
-        // all-zero remote SHA as a branch with no upstream and scans hundreds of
-        // historical commits. The release commit was already scanned by the
-        // branch push immediately above, and each annotated tag points to that
-        // exact commit, so bypass the hook only for the tag-ref transport.
-        // Push every tag in one invocation so a partial push cannot release
-        // only some namespaces at this version.
-        if (opts.tag) {
+        if (createTags) {
           assertReleaseTagsPointToHead(tags);
           git(["push", "--no-verify", "origin", ...tags]);
         }
-        logger.success(`pushed ${opts.tag ? tags.join(", ") : "HEAD"} to origin`);
+        logger.success(`pushed ${createTags ? tags.join(", ") : "HEAD"} to origin`);
       } else {
         logger.info("skipped push (--no-push / --no-publish)");
       }
 
-      // Local registry (e.g. verdaccio): publish AFTER the tag push so the
-      // GitHub release still owns the public registry. Skipped under
-      // `--no-version` (nothing bumped to publish).
+      // Local registry publication starts after the branch push so the GitHub
+      // release workflow can own public publication independently.
       const localRegistry = resolveLocalRegistry(opts.localRegistry);
       const publishToLocalRegistry = opts.version && localRegistry;
       if (opts.version === false && localRegistry) {