@dbx-tools/projen 0.6.195 → 0.6.196

package/tasks/publish-uniffi-local.ts

@@ -5,9 +5,12 @@ import { arch, platform } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { parseArgs } from "node:util";
+import { log } from "@dbx-tools/shared-core";
 import { readDbxToolsConfig, repoRoot } from "../src/packages.ts";
 import type { RustBindingMapping, RustWorkspaceMapping } from "../src/project-rs.ts";
 
+const logger = log.logger("projen:publish-uniffi-local");
+
 const parsed = parseArgs({
   options: {
     version: { type: "string" },
@@ -85,7 +88,16 @@ function artifacts(directory: string, suffix: string): string[] {
     .map((name) => join(directory, name));
 }
 
-function publishCargo(config: RustWorkspaceMapping, registry: string): void {
+function cargoVersionExists(crateName: string, version: string, registry: string): boolean {
+  return (
+    spawnSync("cargo", ["info", `${crateName}@${version}`, "--registry", registry], {
+      cwd: repoRoot,
+      stdio: "ignore",
+    }).status === 0
+  );
+}
+
+function publishCargo(config: RustWorkspaceMapping, registry: string, version: string): void {
   const manifests = config.crates
     .map((crate) => resolve(repoRoot, crate, "Cargo.toml"))
     .filter((manifest) => !/^publish = false$/m.test(readFileSync(manifest, "utf8")));
@@ -115,6 +127,10 @@ function publishCargo(config: RustWorkspaceMapping, registry: string): void {
     }
     for (const crateName of crateNames) {
       if (!crateName) continue;
+      if (cargoVersionExists(crateName, version, registry)) {
+        logger.info(`skip published ${crateName} @ ${version}`);
+        continue;
+      }
       run("cargo", [
         "publish",
         "--package",
@@ -180,12 +196,18 @@ function buildAndPublish(binding: RustBindingMapping, version: string): void {
   ]);
 
   if (includeNode) {
-    const packages = [
-      ...artifacts(join(output, "npm"), ".tgz"),
-      ...artifacts(join(output, "npm-facade"), ".tgz"),
-    ];
-    for (const packageFile of packages) {
-      run("npm", ["publish", packageFile, "--registry", registry!]);
+    const publishNpmScript = resolve(dirname(fileURLToPath(import.meta.url)), "publish-npm.ts");
+    for (const directory of [join(output, "npm"), join(output, "npm-facade")]) {
+      if (artifacts(directory, ".tgz").length === 0) continue;
+      run(process.execPath, [
+        publishNpmScript,
+        "--directory",
+        directory,
+        "--version",
+        version,
+        "--registry",
+        registry!,
+      ]);
     }
   }
   if (includePython) {
@@ -215,5 +237,5 @@ if (config?.bindings.length) {
 }
 const cargoRegistry = parsed.values["cargo-registry"];
 if (cargoRegistry && config?.crates.length) {
-  publishCargo(config, cargoRegistry);
+  publishCargo(config, cargoRegistry, version);
 }

package/tasks/publish.ts

@@ -1,27 +1,22 @@
 #!/usr/bin/env -S bun
 /**
  * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
- * - ensure every workspace member and the Bun lock carry the release version,
+ * - verify every workspace member and the Bun lock carry the release version,
  * then publish each package owned by the standard Node release with `bun publish`.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
  *
- *   - **version stamping**, when needed, is `bun pm pkg set version=<version>`
- *     per member (bun's native package.json editor - idempotent, edits only that
- *     dir's manifest, no git side effects; `bun pm version` is for bumping and
- *     errors on an unchanged version, so `pkg set` is the right tool for an exact
- *     release value);
+ *   - **version validation** fails when any member differs from the reviewed
+ *     `VERSION`; publication never repairs committed release metadata;
  *   - **`workspace:` / `catalog:` rewriting** is NOT done here - `bun publish`
  *     strips both protocols in the PACKED tarball, resolving `workspace:*` to the
  *     sibling's version and `catalog:` to the root catalog entry. (Verified: a
  *     packed manifest shows `"@scope/x": "<version>"` and the real catalog range,
  *     while the on-disk manifest keeps the protocols.) Setting each member's
  *     version first is the only prerequisite, so a sibling resolves the release
- *     version; the disk manifest already carries the workspace `VERSION`, and
- *     this makes doubly sure it matches the value being published. When every
- *     manifest and Bun's workspace lock already carry the version, both this
- *     stamp and the lockfile refresh are skipped;
+ *     version. When Bun's workspace lock already carries the version, its
+ *     refresh is skipped;
  *   - **`publishConfig` substitution** (compiled `lib/` entry points) is done
  *     HERE, by {@link applyPublishConfig}, NOT by bun: unlike pnpm/npm, `bun
  *     publish`/`bun pm pack` do NOT fold `publishConfig`'s `main`/`types`/`bin`/
@@ -46,14 +41,12 @@
  * non-default registry (a local verdaccio); `--exclude <dir>` (repeatable,
  * repo-relative) skips a member owned by another publication flow.
  *
- * `--no-restore` keeps the edits on disk instead of undoing them at exit. Only
- * needed when a LATER process must still see them - `--stamp-only` implies it,
- * since its whole job is to stamp the workspace for a `bun publish` that runs
- * afterwards from another directory.
+ * `--no-restore` keeps the transient publishConfig edits on disk instead of
+ * undoing them at exit.
  *
  * The disk manifests carry the workspace `VERSION` (projen owns them, read-only);
  * this unlocks each only long enough to fold in the `publishConfig` entry points
- * (and re-affirm the version) + publish, then RESTORES every one it touched
+ * and publish, then RESTORES every one it touched
  * byte-for-byte (and re-locks the mode) on the way out - see
  * {@link restoreManifests}. Restore returns each manifest to its committed
  * content, which already equals the release version, so the worktree is never
@@ -92,17 +85,9 @@ interface ManifestBackup {
 /**
  * Original state of every manifest this task has unlocked, keyed by path.
  *
- * Publishing has to mutate manifests projen owns (the version stamp, so a
- * `workspace:*` sibling resolves to the release version, and the `publishConfig`
- * entry-point substitution bun won't do itself). Those edits are only ever meant
- * to reach the packed TARBALL, so every one is undone by {@link restoreManifests}
- * before the process ends.
- *
- * Leaving them on disk is what used to strand a local `bun run bump` with ~34
- * modified `package.json` files - version stamps and `lib/` entry points - after
- * the release commit was already made, so the tree diverged from the commit that
- * was just pushed and every subsequent `git status` needed a manual revert. CI
- * never noticed because a fresh checkout is discarded.
+ * Bun does not apply `publishConfig` while packing, so publication temporarily
+ * projects those entry points onto projen-owned manifests. The projection is
+ * only meant for the packed tarball and is restored before the process exits.
  */
 const manifestBackups = new Map<string, ManifestBackup>();
 
@@ -201,11 +186,9 @@ async function runConcurrent<T>(
 }
 
 /**
- * Make a projen-readonly manifest writable so `bun pm pkg set` / `bun publish` can
- * edit it, recording its original bytes + mode for {@link restoreManifests} the
- * first time it is seen. Idempotent, so a manifest unlocked twice (version stamp,
- * then `publishConfig`) keeps its PRE-EDIT backup rather than overwriting it with
- * the already-stamped content.
+ * Make a projen-readonly manifest writable so the publishConfig projection can
+ * edit it, recording its original bytes and mode for {@link restoreManifests}
+ * the first time it is seen.
  */
 function unlockManifest(pkgPath: string): void {
   const mode = statSync(pkgPath).mode;
@@ -220,11 +203,9 @@ function unlockManifest(pkgPath: string): void {
  *
  * Runs from an `exit` handler so a clean finish and a failure partway through the
  * publish loop are covered alike - a `bun publish` that dies on package 12 of 34
- * must not leave the first 11 stamped. Best-effort per file: one unwritable
+ * must not leave the first 11 projected. Best-effort per file: one unwritable
  * manifest is logged and the rest are still restored, since a partial restore
  * beats none.
- *
- * Not registered under `--stamp-only`, where the stamps ARE the deliverable.
  */
 function restoreManifests(): void {
   for (const [pkgPath, backup] of manifestBackups) {
@@ -248,8 +229,7 @@ const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const
  * doc). Idempotent, writes only when something changes, and leaves `publishConfig`
  * in place (npm ignores it once the top-level fields already point at `lib/`). The
  * manifest must already be unlocked. {@link restoreManifests} puts the `.ts` entry
- * points back at exit, so this only ever affects the packed tarball - like the
- * version stamp.
+ * points back at exit, so this only ever affects the packed tarball.
  */
 function applyPublishConfig(pkgPath: string): void {
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as Record<string, unknown>;
@@ -292,13 +272,8 @@ if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
   throw new Error(`--concurrency must be a positive integer, got ${String(parsedConcurrency)}`);
 }
 const concurrency = parsedConcurrency;
-// `--stamp-only`: set versions + refresh the lockfile, then STOP (no publish).
-// A separate package command can use this when its own publish process needs
-// workspace sibling versions resolved before it starts.
-const stampOnly = rest.includes("--stamp-only");
-// Undo the manifest edits at exit unless a later process still needs them. Implied
-// off by `--stamp-only`, whose stamps exist precisely for a subsequent `bun publish`.
-const restore = !stampOnly && !rest.includes("--no-restore");
+// Undo transient publishConfig edits at exit.
+const restore = !rest.includes("--no-restore");
 const excluded = new Set(
   rest.reduce<string[]>((acc, arg, i) => (arg === "--exclude" ? [...acc, rest[i + 1]] : acc), []),
 );
@@ -313,18 +288,11 @@ const members = workspaceMembers(root)
   .filter((dir) => existsSync(join(dir, "package.json")))
   .filter((dir) => !excluded.has(resolve(root, dir).replace(`${resolve(root)}/`, "")));
 
-// Ensure every member carries the release version before packing. A normal bump
-// already synthesized it everywhere; dry runs and standalone invocations may not
-// have, so retain the native `bun pm pkg set` fallback for those paths.
-if (manifestsMatchVersion(members, version)) {
-  logger.info(`all ${members.length} member manifests already carry ${version}`);
-} else {
-  logger.info(`setting ${version} across ${members.length} members`);
-  await runConcurrent(members, concurrency, async (dir) => {
-    unlockManifest(join(dir, "package.json"));
-    await runAsync(dir, "bun", ["pm", "pkg", "set", `version=${version}`], path);
-  });
+// Publication consumes the reviewed version state and never repairs it.
+if (!manifestsMatchVersion(members, version)) {
+  throw new Error(`workspace manifests do not all match release version ${version}; run projen`);
 }
+logger.info(`all ${members.length} member manifests carry ${version}`);
 
 // Ensure the lockfile resolves each `workspace:*` to the release version.
 // `bun publish`/`pm pack` reads workspace versions from the LOCKFILE, not just
@@ -339,11 +307,6 @@ if (lockfileMatchesVersion(root, members, version)) {
   run(root, "bun", ["install"], path);
 }
 
-if (stampOnly) {
-  logger.success(`stamped ${members.length} members @ ${version} (no publish)`);
-  process.exit(0);
-}
-
 const publishArgs = [
   "--access",
   "public",

package/tasks/release-pr.ts

@@ -0,0 +1,259 @@
+#!/usr/bin/env -S bun
+/**
+ * Prepare a reviewed release pull request from the current branch.
+ *
+ * Pending work is committed and the current branch is pushed first. A dedicated
+ * release branch then receives the VERSION change, generated files, validation,
+ * and local registry preflight. Public publication remains owned by the
+ * main-branch release workflow.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { exec, project } from "@dbx-tools/core";
+import { log } from "@dbx-tools/shared-core";
+import { Command, Option } from "commander";
+import { publishLocalRelease } from "./local-publish.ts";
+import {
+  type VersionLevel,
+  readWorkspaceVersion,
+  resolveNextVersion,
+} from "../src/workspace-version.ts";
+
+const logger = log.logger("projen:release");
+const LEVELS = ["patch", "minor", "major"] as const;
+const RELEASE_OSES = ["darwin", "linux", "win32"] as const;
+const RELEASE_ARCHES = ["arm64", "x64"] as const;
+type ReleaseOs = (typeof RELEASE_OSES)[number];
+type ReleaseArch = (typeof RELEASE_ARCHES)[number];
+
+function collectValue<T extends string>(value: T, previous: T[]): T[] {
+  return [...previous, value];
+}
+
+function git(
+  root: string,
+  args: string[],
+  { capture = false, check = true }: { capture?: boolean; check?: boolean } = {},
+): string {
+  const result = exec.spawnSync("git", args, {
+    cwd: root,
+    stdout: capture ? "capture" : "inherit",
+    stderr: capture ? "ignore" : "inherit",
+    stdin: "ignore",
+    check,
+  });
+  return result.stdout?.trim() ?? "";
+}
+
+function pushCurrentBranch(root: string, branch: string): void {
+  const upstream = git(root, ["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{upstream}"], {
+    capture: true,
+    check: false,
+  });
+  git(root, upstream ? ["push"] : ["push", "--set-upstream", "origin", branch]);
+}
+
+function gitSucceeds(root: string, args: string[]): boolean {
+  return (
+    exec.spawnSync("git", args, {
+      cwd: root,
+      stdout: "ignore",
+      stderr: "ignore",
+      stdin: "ignore",
+      check: false,
+    }).exitCode === 0
+  );
+}
+
+function run(root: string, command: string, args: string[], env?: NodeJS.ProcessEnv): void {
+  exec.spawnSync(command, args, {
+    cwd: root,
+    env,
+    stdout: "inherit",
+    stderr: "inherit",
+    stdin: "ignore",
+    check: true,
+  });
+}
+
+function githubAccount(root: string): { owner: string; token: string } {
+  const repository = project.repositoryUrl(root);
+  if (!repository) throw new Error("Release preparation requires a GitHub repository");
+  const owner = new URL(repository).pathname.split("/").filter(Boolean)[0];
+  if (!owner) throw new Error(`Cannot determine GitHub owner from ${repository}`);
+  const token = exec
+    .spawnSync("gh", ["auth", "token", "--user", owner], {
+      cwd: root,
+      stdout: "capture",
+      stderr: "ignore",
+      stdin: "ignore",
+      check: true,
+    })
+    .stdout?.trim();
+  if (!token) throw new Error(`No GitHub CLI authentication found for ${owner}`);
+  return { owner, token };
+}
+
+const program = new Command();
+program
+  .description("Prepare, validate, locally publish, and open a reviewed release PR")
+  .addOption(
+    new Option("-l, --level <level>", "semver increment").choices([...LEVELS]).default("patch"),
+  )
+  .option("--prefix <prefix>", "release tag prefix", "v")
+  .option("--base <branch>", "release pull request base branch", "main")
+  .option("--message <message>", "commit message for pending source work", "chore: prepare release")
+  .addOption(
+    new Option("--os <os>", "release operating system, repeatable; crossed with every --arch")
+      .choices([...RELEASE_OSES])
+      .argParser((value, previous: ReleaseOs[]) => collectValue(value as ReleaseOs, previous))
+      .default([] as ReleaseOs[]),
+  )
+  .addOption(
+    new Option("--arch <arch>", "release CPU architecture, repeatable; crossed with every --os")
+      .choices([...RELEASE_ARCHES])
+      .argParser((value, previous: ReleaseArch[]) => collectValue(value as ReleaseArch, previous))
+      .default([] as ReleaseArch[]),
+  )
+  .option("--local-registry <value>", "local npm registry: auto, false, or an explicit URL", "auto")
+  .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
+  .option("--python-root <path>", "Python workspace package root", "packages/py")
+  .option("--no-local-cargo", "skip local Cargo publication")
+  .action(
+    async (opts: {
+      level: VersionLevel;
+      prefix: string;
+      base: string;
+      message: string;
+      os: ReleaseOs[];
+      arch: ReleaseArch[];
+      localRegistry: string;
+      localPypi: string;
+      pythonRoot: string;
+      localCargo: boolean;
+    }) => {
+      const root = project.root() ?? process.cwd();
+      const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
+      if (!currentBranch) throw new Error("Release preparation requires a local branch");
+      const account = githubAccount(root);
+      git(root, ["fetch", "--tags", "origin", opts.base]);
+      const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
+      const releaseTag = `${opts.prefix}${next.version}`;
+      const releaseBranch = `release/${releaseTag}`;
+      const resuming = currentBranch === releaseBranch;
+      if (currentBranch.startsWith("release/") && !resuming) {
+        throw new Error(`Expected release branch ${releaseBranch}, got ${currentBranch}`);
+      }
+      if (
+        git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
+          capture: true,
+          check: false,
+        })
+      ) {
+        throw new Error(`Release tag already exists: ${releaseTag}`);
+      }
+
+      if (!resuming) {
+        if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
+          throw new Error(`Current branch must contain origin/${opts.base}`);
+        }
+        const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
+          capture: true,
+        });
+        if (status) {
+          git(root, ["add", "-A"]);
+          git(root, ["commit", "-m", opts.message]);
+        }
+        pushCurrentBranch(root, currentBranch);
+
+        const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
+        const remoteBranch = git(
+          root,
+          ["ls-remote", "--heads", "origin", `refs/heads/${releaseBranch}`],
+          { capture: true, check: false },
+        );
+        if (localBranch || remoteBranch) {
+          throw new Error(`Release branch already exists: ${releaseBranch}`);
+        }
+        git(root, ["switch", "--create", releaseBranch]);
+      } else {
+        logger.info(`resuming ${releaseBranch}`);
+      }
+
+      const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
+      const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
+      run(root, process.execPath, [
+        bumpScript,
+        "--level",
+        opts.level,
+        "--prefix",
+        opts.prefix,
+        ...opts.os.flatMap((value) => ["--os", value]),
+        ...opts.arch.flatMap((value) => ["--arch", value]),
+      ]);
+      if (readWorkspaceVersion(root) !== next.version) {
+        throw new Error(`Release preparation did not produce ${next.version}`);
+      }
+
+      run(root, process.execPath, [versionCheckScript]);
+      if (existsSync(join(root, "Cargo.toml"))) {
+        run(root, "cargo", [
+          "test",
+          "--workspace",
+          ...(existsSync(join(root, "Cargo.lock")) ? ["--locked"] : []),
+        ]);
+        run(root, process.execPath, ["run", "rs:bindings"]);
+      }
+      run(root, process.execPath, ["run", "compile"]);
+      run(root, process.execPath, ["run", "test"]);
+      await publishLocalRelease({
+        root,
+        version: next.version,
+        localRegistry: opts.localRegistry,
+        localPypi: opts.localPypi,
+        pythonRoot: opts.pythonRoot,
+        localCargo: opts.localCargo,
+      });
+      run(root, process.execPath, [versionCheckScript]);
+
+      git(root, ["add", "-A"]);
+      const staged = git(root, ["diff", "--cached", "--name-only"], { capture: true });
+      if (staged) {
+        git(root, ["commit", "-m", `chore(release): ${next.version}`]);
+      } else if (!resuming) {
+        throw new Error("Release preparation produced no changes");
+      }
+      git(root, ["push", "--set-upstream", "origin", releaseBranch]);
+
+      const title = `chore(release): ${next.version}`;
+      const body = [
+        `Release ${releaseTag}.`,
+        "",
+        `Source commit: ${git(root, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
+        "",
+        "Merging this PR updates VERSION on main and starts the public release workflow.",
+      ].join("\n");
+      run(
+        root,
+        "gh",
+        [
+          "pr",
+          "create",
+          "--base",
+          opts.base,
+          "--head",
+          releaseBranch,
+          "--title",
+          title,
+          "--body",
+          body,
+        ],
+        { ...process.env, GH_TOKEN: account.token },
+      );
+      if (!resuming) git(root, ["switch", currentBranch]);
+      logger.success(`opened ${releaseBranch} for ${releaseTag}`);
+    },
+  );
+
+await program.parseAsync();

package/tasks/version-check.ts

@@ -0,0 +1,85 @@
+#!/usr/bin/env -S bun
+/** Verify that every committed package version matches the workspace VERSION. */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { exec, project } from "@dbx-tools/core";
+import { find } from "@dbx-tools/path";
+import { json, log, object } from "@dbx-tools/shared-core";
+import { parse } from "smol-toml";
+import { recordedPackages } from "../src/packages.ts";
+import { readWorkspaceVersion } from "../src/workspace-version.ts";
+
+const logger = log.logger("projen:version-check");
+
+function manifestVersion(path: string): string | undefined {
+  const manifest = json.parseRecord(readFileSync(path, "utf8"));
+  return typeof manifest?.version === "string" ? manifest.version : undefined;
+}
+
+function pythonVersion(path: string): string | undefined {
+  const manifest = parse(readFileSync(path, "utf8")) as {
+    project?: { version?: unknown };
+  };
+  return typeof manifest.project?.version === "string" ? manifest.project.version : undefined;
+}
+
+function cargoVersions(root: string): Array<{ name: string; version: string }> {
+  if (!existsSync(join(root, "Cargo.toml"))) return [];
+  const locked = existsSync(join(root, "Cargo.lock"));
+  const result = exec.spawnSync(
+    "cargo",
+    ["metadata", ...(locked ? ["--locked"] : []), "--format-version", "1", "--no-deps"],
+    {
+      cwd: root,
+      stdout: "capture",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    },
+  );
+  const metadata = json.parseRecord(result.stdout ?? "");
+  if (!Array.isArray(metadata?.packages)) return [];
+  return metadata.packages.flatMap((candidate) => {
+    if (
+      !object.isRecord(candidate) ||
+      typeof candidate.name !== "string" ||
+      typeof candidate.version !== "string"
+    ) {
+      return [];
+    }
+    return [{ name: candidate.name, version: candidate.version }];
+  });
+}
+
+function main(): void {
+  const root = project.root() ?? process.cwd();
+  const version = readWorkspaceVersion(root);
+  const mismatches: string[] = [];
+  const check = (name: string, actual: string | undefined): void => {
+    if (actual !== version) mismatches.push(`${name}: ${actual ?? "missing"} != ${version}`);
+  };
+
+  check("package.json", manifestVersion(join(root, "package.json")));
+  for (const pkg of recordedPackages(root)) {
+    check(`${pkg.path}/package.json`, manifestVersion(join(pkg.dir, "package.json")));
+    const barrel = join(pkg.dir, "index.ts");
+    if (existsSync(barrel)) {
+      const actual = /export const PACKAGE_VERSION = "([^"]+)";/.exec(
+        readFileSync(barrel, "utf8"),
+      )?.[1];
+      check(`${pkg.path}/index.ts`, actual);
+    }
+  }
+
+  for (const path of find.findFiles("**/pyproject.toml", { cwd: root })) {
+    check(path, pythonVersion(join(root, path)));
+  }
+  for (const pkg of cargoVersions(root)) check(`Cargo package ${pkg.name}`, pkg.version);
+
+  if (mismatches.length > 0) {
+    throw new Error(`Workspace version mismatch:\n${mismatches.join("\n")}`);
+  }
+  logger.success(`all workspace versions match ${version}`);
+}
+
+main();