@dbx-tools/projen 0.6.194 → 0.6.196

package/tasks/local-publish.ts

@@ -0,0 +1,166 @@
+/** Local registry preflight shared by release preparation. */
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { exec, project } from "@dbx-tools/core";
+import { log, net } from "@dbx-tools/shared-core";
+import { activePythonIndexes, resolveLocalPypi } from "./python-registry.ts";
+import { readDbxToolsConfig } from "../src/packages.ts";
+
+const logger = log.logger("projen:local-publish");
+
+/** Options for publishing one release candidate to configured loopback registries. */
+export interface LocalPublishOptions {
+  readonly root: string;
+  readonly version: string;
+  readonly localRegistry: string;
+  readonly localPypi: string;
+  readonly pythonRoot: string;
+  readonly localCargo: boolean;
+}
+
+function resolveLocalRegistry(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.toLowerCase() === "false") return undefined;
+  if (trimmed.toLowerCase() === "auto") {
+    const registry = project.npmRegistry();
+    return registry && net.isLoopbackHost(registry) ? registry.href : undefined;
+  }
+  return trimmed;
+}
+
+function localCargoRegistry(): string | undefined {
+  if (process.env.LOCAL_CARGO_REGISTRY) return process.env.LOCAL_CARGO_REGISTRY;
+  const config = join(homedir(), ".cargo", "config.toml");
+  if (!existsSync(config)) return undefined;
+  const source = readFileSync(config, "utf8");
+  const sections = [
+    ...source.matchAll(/^\[registries\.([^\]]+)\]\s*\n([\s\S]*?)(?=^\[|(?![\s\S]))/gm),
+  ];
+  for (const section of sections) {
+    const index = section[2]?.match(/^\s*index\s*=\s*["']([^"']+)["']/m)?.[1];
+    if (index && net.isLoopbackHost(index.replace(/^sparse\+/, ""))) return section[1];
+  }
+  return undefined;
+}
+
+/** Publish the exact release candidate to local npm, PyPI, and Cargo mirrors. */
+export async function publishLocalRelease(options: LocalPublishOptions): Promise<void> {
+  const localRegistry = resolveLocalRegistry(options.localRegistry);
+  const activeIndexes = activePythonIndexes();
+  const localPypi = resolveLocalPypi(options.localPypi, activeIndexes);
+  const pythonRoot = resolve(options.root, options.pythonRoot);
+  const localPublishes: Promise<unknown>[] = [];
+
+  if (
+    options.localPypi.toLowerCase() === "auto" &&
+    activeIndexes.some((index) => net.isLoopbackHost(index)) &&
+    !localPypi
+  ) {
+    logger.info(
+      `skipped local Python publish: no active index (${activeIndexes.join(", ")}) is a devpi +simple index`,
+    );
+  }
+
+  if (localRegistry) {
+    const publishScript = fileURLToPath(new URL("./publish.ts", import.meta.url));
+    logger.info(`publishing ${options.version} to local registry ${localRegistry}`);
+    localPublishes.push(
+      exec
+        .spawn(process.execPath, [publishScript, options.version, "--registry", localRegistry], {
+          cwd: options.root,
+          stdout: "inherit",
+          stderr: "inherit",
+          stdin: "ignore",
+          check: true,
+        })
+        .then(() => logger.success(`published ${options.version} to ${localRegistry}`)),
+    );
+  }
+
+  if (localPypi && existsSync(pythonRoot)) {
+    const publishPythonScript = fileURLToPath(new URL("./publish-python.ts", import.meta.url));
+    logger.info(`publishing Python ${options.version} to local devpi ${localPypi.publishUrl}`);
+    localPublishes.push(
+      exec
+        .spawn(
+          process.execPath,
+          [
+            publishPythonScript,
+            options.version,
+            "--root",
+            pythonRoot,
+            "--index-url",
+            localPypi.indexUrl,
+            "--publish-url",
+            localPypi.publishUrl,
+          ],
+          {
+            cwd: options.root,
+            stdout: "inherit",
+            stderr: "inherit",
+            stdin: "ignore",
+            check: true,
+          },
+        )
+        .then(() =>
+          logger.success(`published Python ${options.version} to ${localPypi.publishUrl}`),
+        ),
+    );
+  }
+
+  await Promise.all(localPublishes);
+  if (localRegistry || localPypi) {
+    const publishUniFFIScript = fileURLToPath(
+      new URL("./publish-uniffi-local.ts", import.meta.url),
+    );
+    await exec.spawn(
+      process.execPath,
+      [
+        publishUniFFIScript,
+        "--version",
+        options.version,
+        ...(localRegistry ? ["--registry", localRegistry] : []),
+        ...(localPypi ? ["--pypi-publish-url", localPypi.publishUrl] : []),
+      ],
+      {
+        cwd: options.root,
+        stdout: "inherit",
+        stderr: "inherit",
+        stdin: "ignore",
+        check: true,
+      },
+    );
+    logger.success(`published host-native bindings for ${options.version}`);
+  }
+
+  const rust = readDbxToolsConfig(options.root)?.rust;
+  const hasRustCrates = Boolean(
+    rust &&
+    typeof rust === "object" &&
+    !Array.isArray(rust) &&
+    Array.isArray((rust as { crates?: unknown }).crates) &&
+    (rust as { crates: unknown[] }).crates.length > 0,
+  );
+  if (options.localCargo && hasRustCrates) {
+    const cargoRegistry = localCargoRegistry();
+    if (cargoRegistry) {
+      const publishUniFFIScript = fileURLToPath(
+        new URL("./publish-uniffi-local.ts", import.meta.url),
+      );
+      await exec.spawn(
+        process.execPath,
+        [publishUniFFIScript, "--version", options.version, "--cargo-registry", cargoRegistry],
+        {
+          cwd: options.root,
+          stdout: "inherit",
+          stderr: "inherit",
+          stdin: "ignore",
+          check: true,
+        },
+      );
+      logger.success(`published Rust ${options.version} to ${cargoRegistry}`);
+    }
+  }
+}

package/tasks/publish-uniffi-local.ts

@@ -5,9 +5,12 @@ import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
+import { log } from "@dbx-tools/shared-core";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
+const logger = log.logger("projen:publish-uniffi-local");
+
 const parsed = parseArgs({
   options: {
     version: { type: "string" },
@@ -85,7 +88,16 @@ function artifacts(directory: string, suffix: string): string[] {
     .map((name) => join(directory, name));
 }
 
-function publishCargo(config: RustWorkspaceMapping, registry: string): void {
+function cargoVersionExists(crateName: string, version: string, registry: string): boolean {
+  return (
+    spawnSync("cargo", ["info", `${crateName}@${version}`, "--registry", registry], {
+      cwd: repoRoot,
+      stdio: "ignore",
+    }).status === 0
+  );
+}
+
+function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {
   const manifests = config.crates
     .map((crate) => resolve(repoRoot, crate, "Cargo.toml"))
     .filter((manifest) => !/^publish = false$/m.test(readFileSync(manifest, "utf8")));
@@ -115,6 +127,10 @@ function publishCargo(config: RustWorkspaceMapping, registry: string): void {
     }
     for (const crateName of crateNames) {
       if (!crateName) continue;
+      if (cargoVersionExists(crateName, version, registry)) {
+        logger.info(`skip published ${crateName} @ ${version}`);
+        continue;
+      }
       run("cargo", [
         "publish",
         "--package",
@@ -180,12 +196,18 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
   ]);
 
   if (includeNode) {
-    const packages = [
-      ...artifacts(join(output, "npm"), ".tgz"),
-      ...artifacts(join(output, "npm-facade"), ".tgz"),
-    ];
-    for (const packageFile of packages) {
-      run("npm", ["publish", packageFile, "--registry", registry!]);
+    const publishNpmScript = resolve(dirname(fileURLToPath(import.meta.url)), "publish-npm.ts");
+    for (const directory of [join(output, "npm"), join(output, "npm-facade")]) {
+      if (artifacts(directory, ".tgz").length === 0) continue;
+      run(process.execPath, [
+        publishNpmScript,
+        "--directory",
+        directory,
+        "--version",
+        version,
+        "--registry",
+        registry!,
+      ]);
     }
   }
   if (includePython) {
@@ -215,5 +237,5 @@ if (config?.bindings.length) {
 }
 const cargoRegistry = parsed.values["cargo-registry"];
 if (cargoRegistry && config?.crates.length) {
-  publishCargo(config, cargoRegistry);
+  publishCargo(config, cargoRegistry, version);
 }

package/tasks/publish.ts

@@ -1,27 +1,22 @@
 #!/usr/bin/env -S bun
 /**
  * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
- * - ensure every workspace member and the Bun lock carry the release version,
+ * - verify every workspace member and the Bun lock carry the release version,
  * then publish each package owned by the standard Node release with `bun publish`.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
  *
- *   - **version stamping**, when needed, is `bun pm pkg set version=<version>`
- *     per member (bun's native package.json editor - idempotent, edits only that
- *     dir's manifest, no git side effects; `bun pm version` is for bumping and
- *     errors on an unchanged version, so `pkg set` is the right tool for an exact
- *     release value);
+ *   - **version validation** fails when any member differs from the reviewed
+ *     `VERSION`; publication never repairs committed release metadata;
  *   - **`workspace:` / `catalog:` rewriting** is NOT done here - `bun publish`
  *     strips both protocols in the PACKED tarball, resolving `workspace:*` to the
  *     sibling's version and `catalog:` to the root catalog entry. (Verified: a
  *     packed manifest shows `"@scope/x": "<version>"` and the real catalog range,
  *     while the on-disk manifest keeps the protocols.) Setting each member's
  *     version first is the only prerequisite, so a sibling resolves the release
- *     version; the disk manifest already carries the workspace `VERSION`, and
- *     this makes doubly sure it matches the value being published. When every
- *     manifest and Bun's workspace lock already carry the version, both this
- *     stamp and the lockfile refresh are skipped;
+ *     version. When Bun's workspace lock already carries the version, its
+ *     refresh is skipped;
  *   - **`publishConfig` substitution** (compiled `lib/` entry points) is done
  *     HERE, by {@link applyPublishConfig}, NOT by bun: unlike pnpm/npm, `bun
  *     publish`/`bun pm pack` do NOT fold `publishConfig`'s `main`/`types`/`bin`/
@@ -46,14 +41,12 @@
  * non-default registry (a local verdaccio); `--exclude <dir>` (repeatable,
  * repo-relative) skips a member owned by another publication flow.
  *
- * `--no-restore` keeps the edits on disk instead of undoing them at exit. Only
- * needed when a LATER process must still see them - `--stamp-only` implies it,
- * since its whole job is to stamp the workspace for a `bun publish` that runs
- * afterwards from another directory.
+ * `--no-restore` keeps the transient publishConfig edits on disk instead of
+ * undoing them at exit.
  *
  * The disk manifests carry the workspace `VERSION` (projen owns them, read-only);
  * this unlocks each only long enough to fold in the `publishConfig` entry points
- * (and re-affirm the version) + publish, then RESTORES every one it touched
+ * and publish, then RESTORES every one it touched
  * byte-for-byte (and re-locks the mode) on the way out - see
  * {@link restoreManifests}. Restore returns each manifest to its committed
  * content, which already equals the release version, so the worktree is never
@@ -92,17 +85,9 @@ interface ManifestBackup {
 /**
  * Original state of every manifest this task has unlocked, keyed by path.
  *
- * Publishing has to mutate manifests projen owns (the version stamp, so a
- * `workspace:*` sibling resolves to the release version, and the `publishConfig`
- * entry-point substitution bun won't do itself). Those edits are only ever meant
- * to reach the packed TARBALL, so every one is undone by {@link restoreManifests}
- * before the process ends.
- *
- * Leaving them on disk is what used to strand a local `bun run bump` with ~34
- * modified `package.json` files - version stamps and `lib/` entry points - after
- * the release commit was already made, so the tree diverged from the commit that
- * was just pushed and every subsequent `git status` needed a manual revert. CI
- * never noticed because a fresh checkout is discarded.
+ * Bun does not apply `publishConfig` while packing, so publication temporarily
+ * projects those entry points onto projen-owned manifests. The projection is
+ * only meant for the packed tarball and is restored before the process exits.
  */
 const manifestBackups = new Map<string, ManifestBackup>();
 
@@ -201,11 +186,9 @@ async function runConcurrent<T>(
 }
 
 /**
- * Make a projen-readonly manifest writable so `bun pm pkg set` / `bun publish` can
- * edit it, recording its original bytes + mode for {@link restoreManifests} the
- * first time it is seen. Idempotent, so a manifest unlocked twice (version stamp,
- * then `publishConfig`) keeps its PRE-EDIT backup rather than overwriting it with
- * the already-stamped content.
+ * Make a projen-readonly manifest writable so the publishConfig projection can
+ * edit it, recording its original bytes and mode for {@link restoreManifests}
+ * the first time it is seen.
  */
 function unlockManifest(pkgPath: string): void {
   const mode = statSync(pkgPath).mode;
@@ -220,11 +203,9 @@ function unlockManifest(pkgPath: string): void {
  *
  * Runs from an `exit` handler so a clean finish and a failure partway through the
  * publish loop are covered alike - a `bun publish` that dies on package 12 of 34
- * must not leave the first 11 stamped. Best-effort per file: one unwritable
+ * must not leave the first 11 projected. Best-effort per file: one unwritable
  * manifest is logged and the rest are still restored, since a partial restore
  * beats none.
- *
- * Not registered under `--stamp-only`, where the stamps ARE the deliverable.
  */
 function restoreManifests(): void {
   for (const [pkgPath, backup] of manifestBackups) {
@@ -248,8 +229,7 @@ const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const
  * doc). Idempotent, writes only when something changes, and leaves `publishConfig`
  * in place (npm ignores it once the top-level fields already point at `lib/`). The
  * manifest must already be unlocked. {@link restoreManifests} puts the `.ts` entry
- * points back at exit, so this only ever affects the packed tarball - like the
- * version stamp.
+ * points back at exit, so this only ever affects the packed tarball.
  */
 function applyPublishConfig(pkgPath: string): void {
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as Record<string, unknown>;
@@ -292,13 +272,8 @@ if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
   throw new Error(`--concurrency must be a positive integer, got ${String(parsedConcurrency)}`);
 }
 const concurrency = parsedConcurrency;
-// `--stamp-only`: set versions + refresh the lockfile, then STOP (no publish).
-// A separate package command can use this when its own publish process needs
-// workspace sibling versions resolved before it starts.
-const stampOnly = rest.includes("--stamp-only");
-// Undo the manifest edits at exit unless a later process still needs them. Implied
-// off by `--stamp-only`, whose stamps exist precisely for a subsequent `bun publish`.
-const restore = !stampOnly && !rest.includes("--no-restore");
+// Undo transient publishConfig edits at exit.
+const restore = !rest.includes("--no-restore");
 const excluded = new Set(
   rest.reduce<string[]>((acc, arg, i) => (arg === "--exclude" ? [...acc, rest[i + 1]] : acc), []),
 );
@@ -313,18 +288,11 @@ const members = workspaceMembers(root)
   .filter((dir) => existsSync(join(dir, "package.json")))
   .filter((dir) => !excluded.has(resolve(root, dir).replace(`${resolve(root)}/`, "")));
 
-// Ensure every member carries the release version before packing. A normal bump
-// already synthesized it everywhere; dry runs and standalone invocations may not
-// have, so retain the native `bun pm pkg set` fallback for those paths.
-if (manifestsMatchVersion(members, version)) {
-  logger.info(`all ${members.length} member manifests already carry ${version}`);
-} else {
-  logger.info(`setting ${version} across ${members.length} members`);
-  await runConcurrent(members, concurrency, async (dir) => {
-    unlockManifest(join(dir, "package.json"));
-    await runAsync(dir, "bun", ["pm", "pkg", "set", `version=${version}`], path);
-  });
+// Publication consumes the reviewed version state and never repairs it.
+if (!manifestsMatchVersion(members, version)) {
+  throw new Error(`workspace manifests do not all match release version ${version}; run projen`);
 }
+logger.info(`all ${members.length} member manifests carry ${version}`);
 
 // Ensure the lockfile resolves each `workspace:*` to the release version.
 // `bun publish`/`pm pack` reads workspace versions from the LOCKFILE, not just
@@ -339,11 +307,6 @@ if (lockfileMatchesVersion(root, members, version)) {
   run(root, "bun", ["install"], path);
 }
 
-if (stampOnly) {
-  logger.success(`stamped ${members.length} members @ ${version} (no publish)`);
-  process.exit(0);
-}
-
 const publishArgs = [
   "--access",
   "public",

package/tasks/release-pr.ts

@@ -0,0 +1,259 @@
+#!/usr/bin/env -S bun
+/**
+ * Prepare a reviewed release pull request from the current branch.
+ *
+ * Pending work is committed and the current branch is pushed first. A dedicated
+ * release branch then receives the VERSION change, generated files, validation,
+ * and local registry preflight. Public publication remains owned by the
+ * main-branch release workflow.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { exec, project } from "@dbx-tools/core";
+import { log } from "@dbx-tools/shared-core";
+import { Command, Option } from "commander";
+import { publishLocalRelease } from "./local-publish.ts";
+import {
+  type VersionLevel,
+  readWorkspaceVersion,
+  resolveNextVersion,
+} from "../src/workspace-version.ts";
+
+const logger = log.logger("projen:release");
+const LEVELS = ["patch", "minor", "major"] as const;
+const RELEASE_OSES = ["darwin", "linux", "win32"] as const;
+const RELEASE_ARCHES = ["arm64", "x64"] as const;
+type ReleaseOs = (typeof RELEASE_OSES)[number];
+type ReleaseArch = (typeof RELEASE_ARCHES)[number];
+
+function collectValue<T extends string>(value: T, previous: T[]): T[] {
+  return [...previous, value];
+}
+
+function git(
+  root: string,
+  args: string[],
+  { capture = false, check = true }: { capture?: boolean; check?: boolean } = {},
+): string {
+  const result = exec.spawnSync("git", args, {
+    cwd: root,
+    stdout: capture ? "capture" : "inherit",
+    stderr: capture ? "ignore" : "inherit",
+    stdin: "ignore",
+    check,
+  });
+  return result.stdout?.trim() ?? "";
+}
+
+function pushCurrentBranch(root: string, branch: string): void {
+  const upstream = git(root, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], {
+    capture: true,
+    check: false,
+  });
+  git(root, upstream ? ["push"] : ["push", "--set-upstream", "origin", branch]);
+}
+
+function gitSucceeds(root: string, args: string[]): boolean {
+  return (
+    exec.spawnSync("git", args, {
+      cwd: root,
+      stdout: "ignore",
+      stderr: "ignore",
+      stdin: "ignore",
+      check: false,
+    }).exitCode === 0
+  );
+}
+
+function run(root: string, command: string, args: string[], env?: NodeJS.ProcessEnv): void {
+  exec.spawnSync(command, args, {
+    cwd: root,
+    env,
+    stdout: "inherit",
+    stderr: "inherit",
+    stdin: "ignore",
+    check: true,
+  });
+}
+
+function githubAccount(root: string): { owner: string; token: string } {
+  const repository = project.repositoryUrl(root);
+  if (!repository) throw new Error("Release preparation requires a GitHub repository");
+  const owner = new URL(repository).pathname.split("/").filter(Boolean)[0];
+  if (!owner) throw new Error(`Cannot determine GitHub owner from ${repository}`);
+  const token = exec
+    .spawnSync("gh", ["auth", "token", "--user", owner], {
+      cwd: root,
+      stdout: "capture",
+      stderr: "ignore",
+      stdin: "ignore",
+      check: true,
+    })
+    .stdout?.trim();
+  if (!token) throw new Error(`No GitHub CLI authentication found for ${owner}`);
+  return { owner, token };
+}
+
+const program = new Command();
+program
+  .description("Prepare, validate, locally publish, and open a reviewed release PR")
+  .addOption(
+    new Option("-l, --level <level>", "semver increment").choices([...LEVELS]).default("patch"),
+  )
+  .option("--prefix <prefix>", "release tag prefix", "v")
+  .option("--base <branch>", "release pull request base branch", "main")
+  .option("--message <message>", "commit message for pending source work", "chore: prepare release")
+  .addOption(
+    new Option("--os <os>", "release operating system, repeatable; crossed with every --arch")
+      .choices([...RELEASE_OSES])
+      .argParser((value, previous: ReleaseOs[]) => collectValue(value as ReleaseOs, previous))
+      .default([] as ReleaseOs[]),
+  )
+  .addOption(
+    new Option("--arch <arch>", "release CPU architecture, repeatable; crossed with every --os")
+      .choices([...RELEASE_ARCHES])
+      .argParser((value, previous: ReleaseArch[]) => collectValue(value as ReleaseArch, previous))
+      .default([] as ReleaseArch[]),
+  )
+  .option("--local-registry <value>", "local npm registry: auto, false, or an explicit URL", "auto")
+  .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
+  .option("--python-root <path>", "Python workspace package root", "packages/py")
+  .option("--no-local-cargo", "skip local Cargo publication")
+  .action(
+    async (opts: {
+      level: VersionLevel;
+      prefix: string;
+      base: string;
+      message: string;
+      os: ReleaseOs[];
+      arch: ReleaseArch[];
+      localRegistry: string;
+      localPypi: string;
+      pythonRoot: string;
+      localCargo: boolean;
+    }) => {
+      const root = project.root() ?? process.cwd();
+      const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
+      if (!currentBranch) throw new Error("Release preparation requires a local branch");
+      const account = githubAccount(root);
+      git(root, ["fetch", "--tags", "origin", opts.base]);
+      const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
+      const releaseTag = `${opts.prefix}${next.version}`;
+      const releaseBranch = `release/${releaseTag}`;
+      const resuming = currentBranch === releaseBranch;
+      if (currentBranch.startsWith("release/") && !resuming) {
+        throw new Error(`Expected release branch ${releaseBranch}, got ${currentBranch}`);
+      }
+      if (
+        git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
+          capture: true,
+          check: false,
+        })
+      ) {
+        throw new Error(`Release tag already exists: ${releaseTag}`);
+      }
+
+      if (!resuming) {
+        if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
+          throw new Error(`Current branch must contain origin/${opts.base}`);
+        }
+        const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
+          capture: true,
+        });
+        if (status) {
+          git(root, ["add", "-A"]);
+          git(root, ["commit", "-m", opts.message]);
+        }
+        pushCurrentBranch(root, currentBranch);
+
+        const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
+        const remoteBranch = git(
+          root,
+          ["ls-remote", "--heads", "origin", `refs/heads/${releaseBranch}`],
+          { capture: true, check: false },
+        );
+        if (localBranch || remoteBranch) {
+          throw new Error(`Release branch already exists: ${releaseBranch}`);
+        }
+        git(root, ["switch", "--create", releaseBranch]);
+      } else {
+        logger.info(`resuming ${releaseBranch}`);
+      }
+
+      const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
+      const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
+      run(root, process.execPath, [
+        bumpScript,
+        "--level",
+        opts.level,
+        "--prefix",
+        opts.prefix,
+        ...opts.os.flatMap((value) => ["--os", value]),
+        ...opts.arch.flatMap((value) => ["--arch", value]),
+      ]);
+      if (readWorkspaceVersion(root) !== next.version) {
+        throw new Error(`Release preparation did not produce ${next.version}`);
+      }
+
+      run(root, process.execPath, [versionCheckScript]);
+      if (existsSync(join(root, "Cargo.toml"))) {
+        run(root, "cargo", [
+          "test",
+          "--workspace",
+          ...(existsSync(join(root, "Cargo.lock")) ? ["--locked"] : []),
+        ]);
+        run(root, process.execPath, ["run", "rs:bindings"]);
+      }
+      run(root, process.execPath, ["run", "compile"]);
+      run(root, process.execPath, ["run", "test"]);
+      await publishLocalRelease({
+        root,
+        version: next.version,
+        localRegistry: opts.localRegistry,
+        localPypi: opts.localPypi,
+        pythonRoot: opts.pythonRoot,
+        localCargo: opts.localCargo,
+      });
+      run(root, process.execPath, [versionCheckScript]);
+
+      git(root, ["add", "-A"]);
+      const staged = git(root, ["diff", "--cached", "--name-only"], { capture: true });
+      if (staged) {
+        git(root, ["commit", "-m", `chore(release): ${next.version}`]);
+      } else if (!resuming) {
+        throw new Error("Release preparation produced no changes");
+      }
+      git(root, ["push", "--set-upstream", "origin", releaseBranch]);
+
+      const title = `chore(release): ${next.version}`;
+      const body = [
+        `Release ${releaseTag}.`,
+        "",
+        `Source commit: ${git(root, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
+        "",
+        "Merging this PR updates VERSION on main and starts the public release workflow.",
+      ].join("\n");
+      run(
+        root,
+        "gh",
+        [
+          "pr",
+          "create",
+          "--base",
+          opts.base,
+          "--head",
+          releaseBranch,
+          "--title",
+          title,
+          "--body",
+          body,
+        ],
+        { ...process.env, GH_TOKEN: account.token },
+      );
+      if (!resuming) git(root, ["switch", currentBranch]);
+      logger.success(`opened ${releaseBranch} for ${releaseTag}`);
+    },
+  );
+
+await program.parseAsync();