@dbx-tools/projen 0.6.199 → 0.6.201

package/README.md

@@ -130,8 +130,9 @@ without Rust crates start no Rust watcher. When Rust projects are detected,
 Cargo is required and the focused task fails immediately if it is unavailable.
 `rs:bindings` is explicit rather than part of root `pre-compile`, so ordinary
 JavaScript PR builds type-check committed generated bindings without performing
-a host Rust build. Release preparation runs Cargo workspace tests and
-regenerates bindings before JavaScript validation.
+a host Rust build. Regenerate bindings through the focused watcher or explicit
+task while changing a UniFFI API. Release preparation runs Cargo workspace tests
+without invoking UBRN.
 
 The workspace generates one `release.yml` workflow for every ecosystem. A push
 to the configured release branch starts it only when `VERSION` changed. The
@@ -399,14 +400,17 @@ a new package is covered without a re-synth. Work from the root:
 | `bun run version:check` | verify every version surface matches `VERSION`          |
 | `bun run release`       | run full local preflight and open a reviewed release PR |
 
-`release` commits pending work on the current branch, pushes it, creates a
-dedicated `release/v<version>` branch, invokes the pure `bump` task, validates
-the complete workspace, runs local publication, and opens a PR into the
-configured release branch. `--message` sets the source commit message. The task
-never merges the PR unless `--approve` is passed; that option requests an
-immediate admin merge so the main release can start without waiting for PR
-checks. npm uses `npm config get registry` and publishes to a local Verdaccio
-automatically. Publishable JavaScript members compile once
+`release` commits pending work on the current branch, merges the latest remote
+release branch when needed, and pushes it. It prepares the dedicated
+`release/v<version>` branch inside `.worktrees/<tag>`, leaving the source
+checkout on its current branch throughout validation, local publication, and
+PR creation. Failed preparation can resume from that worktree; success removes
+it. `--message` sets the source commit message. The task never merges
+the PR unless `--approve` is passed; that option merges the release branch
+directly through GitHub's merge API so no PR checks are created. A repository
+that blocks direct merges falls back to an immediate admin-merged PR. npm uses
+`npm config get registry` and publishes to a local Verdaccio automatically.
+Publishable JavaScript members compile once
 from the root in parallel, then upload through a bounded pool without rerunning
 their `prepack` tasks. Python prefers uv's default index and only
 treats a loopback `.../+simple/` URL as writable devpi; a read-only cache such as
@@ -422,8 +426,8 @@ auto-detection; `--python-root` defaults to `packages/py`.
 
 The GitHub PR workflow runs synth plus the workspace TypeScript compile rather
 than the complete root build. Release preparation has already run Rust tests,
-binding generation, workspace tests, and local package preflight before opening
-the PR.
+workspace type-checking, and local package preflight before opening the PR.
+JavaScript behavior tests remain an explicit developer task.
 
 The configured release branch publishes only when a reviewed PR changes
 `VERSION`. Its workflow creates the annotated `v*` public release boundary.

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.6.199";
+export const PACKAGE_VERSION = "0.6.201";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -25,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.199",
-    "@dbx-tools/path": "0.6.199",
-    "@dbx-tools/shared-core": "0.6.199",
+    "@dbx-tools/core": "0.6.201",
+    "@dbx-tools/path": "0.6.201",
+    "@dbx-tools/shared-core": "0.6.201",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.199",
+  "version": "0.6.201",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -863,17 +863,36 @@ class WorkflowDefaults extends Component {
       }
     }
     const build = this.project.tryFindObjectFile(".github/workflows/build.yml");
+    build?.addOverride("on.pull_request.types", ["opened", "synchronize", "reopened", "closed"]);
+    build?.addOverride(
+      "jobs.build.if",
+      "${{ github.event_name != 'pull_request' || github.event.action != 'closed' }}",
+    );
     for (const job of ["build", "self-mutation"]) {
       build?.addOverride(`jobs.${job}.timeout-minutes`, 30);
     }
-    this.project
-      .tryFindObjectFile(".github/workflows/pull-request-lint.yml")
-      ?.addOverride("jobs.validate.timeout-minutes", 10);
+    const pullRequestLint = this.project.tryFindObjectFile(
+      ".github/workflows/pull-request-lint.yml",
+    );
+    pullRequestLint?.addOverride("on.pull_request_target.types", [
+      "labeled",
+      "opened",
+      "synchronize",
+      "reopened",
+      "ready_for_review",
+      "edited",
+      "closed",
+    ]);
+    pullRequestLint?.addOverride(
+      "jobs.validate.if",
+      "(github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'",
+    );
+    pullRequestLint?.addOverride("jobs.validate.timeout-minutes", 10);
     for (const name of ["build", "pull-request-lint"]) {
       const workflow = this.project.tryFindObjectFile(`.github/workflows/${name}.yml`);
       workflow?.addOverride("permissions", { contents: "read" });
       workflow?.addOverride("concurrency", {
-        group: "${{ github.workflow }}-${{ github.ref }}",
+        group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}",
         "cancel-in-progress": true,
       });
     }

package/src/project-rs.ts

@@ -340,7 +340,7 @@ if (process.env.GITHUB_OUTPUT) {
 /** Keep tracked workspace package versions in Cargo.lock aligned with VERSION. */
 class RustWorkspaceVersionLock extends Component {
   public override postSynthesize(): void {
-    exec.spawnSync("cargo", ["metadata", "--format-version", "1", "--no-deps"], {
+    exec.spawnSync("cargo", ["metadata", "--format-version", "1"], {
       cwd: this.project.outdir,
       stdout: "ignore",
       stderr: "inherit",

package/tasks/release-pr.ts

@@ -95,11 +95,21 @@ function run(root: string, command: string, args: string[], env?: NodeJS.Process
   });
 }
 
-function githubAccount(root: string): { owner: string; token: string } {
+function runIgnoringStdout(root: string, command: string, args: string[]): void {
+  exec.spawnSync(command, args, {
+    cwd: root,
+    stdout: "ignore",
+    stderr: "inherit",
+    stdin: "ignore",
+    check: true,
+  });
+}
+
+function githubAccount(root: string): { owner: string; repository: string; token: string } {
   const repository = project.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
-  const owner = new URL(repository).pathname.split("/").filter(Boolean)[0];
-  if (!owner) throw new Error(`Cannot determine GitHub owner from ${repository}`);
+  const [owner, name] = new URL(repository).pathname.split("/").filter(Boolean);
+  if (!owner || !name) throw new Error(`Cannot determine GitHub identity from ${repository}`);
   const token = exec
     .spawnSync("gh", ["auth", "token", "--user", owner], {
       cwd: root,
@@ -110,7 +120,7 @@ function githubAccount(root: string): { owner: string; token: string } {
     })
     .stdout?.trim();
   if (!token) throw new Error(`No GitHub CLI authentication found for ${owner}`);
-  return { owner, token };
+  return { owner, repository: name.replace(/\.git$/, ""), token };
 }
 
 const program = new Command();
@@ -138,7 +148,7 @@ program
   .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
   .option("--python-root <path>", "Python workspace package root", "packages/py")
   .option("--no-local-cargo", "skip local Cargo publication")
-  .option("--approve", "merge the release PR immediately with admin bypass")
+  .option("--approve", "merge the release branch directly into the release base")
   .action(
     async (opts: {
       level: VersionLevel;
@@ -161,9 +171,9 @@ program
       const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
       const releaseTag = `${opts.prefix}${next.version}`;
       const releaseBranch = `release/${releaseTag}`;
-      const resuming = currentBranch === releaseBranch;
-      if (currentBranch.startsWith("release/") && !resuming) {
-        throw new Error(`Expected release branch ${releaseBranch}, got ${currentBranch}`);
+      const releaseRoot = join(root, ".worktrees", releaseTag);
+      if (currentBranch.startsWith("release/")) {
+        throw new Error("Release preparation must start from a source branch");
       }
       if (
         git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
@@ -174,19 +184,21 @@ program
         throw new Error(`Release tag already exists: ${releaseTag}`);
       }
 
-      if (!resuming) {
-        if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
-          throw new Error(`Current branch must contain origin/${opts.base}`);
-        }
-        const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
-          capture: true,
-        });
-        if (status) {
-          git(root, ["add", "-A"]);
-          git(root, ["commit", "-m", opts.message]);
-        }
-        pushCurrentBranch(root, currentBranch);
+      const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
+        capture: true,
+      });
+      if (status) {
+        git(root, ["add", "-A"]);
+        git(root, ["commit", "-m", opts.message]);
+      }
+      if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
+        git(root, ["merge", "--no-edit", `origin/${opts.base}`]);
+      }
+      pushCurrentBranch(root, currentBranch);
 
+      const worktreeExists = existsSync(join(releaseRoot, ".git"));
+      if (!worktreeExists) {
+        git(root, ["worktree", "prune"]);
         const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
         const remoteBranch = git(
           root,
@@ -194,16 +206,31 @@ program
           { capture: true, check: false },
         );
         if (localBranch || remoteBranch) {
-          throw new Error(`Release branch already exists: ${releaseBranch}`);
+          throw new Error(`Release branch already exists without its worktree: ${releaseBranch}`);
         }
-        git(root, ["switch", "--create", releaseBranch]);
+        git(root, ["worktree", "add", "-b", releaseBranch, releaseRoot, "HEAD"]);
+        run(releaseRoot, process.execPath, ["install"]);
       } else {
-        logger.info(`resuming ${releaseBranch}`);
+        const releaseStatus = git(
+          releaseRoot,
+          ["status", "--porcelain=v1", "--untracked-files=all"],
+          { capture: true },
+        );
+        if (releaseStatus) {
+          git(releaseRoot, ["stash", "push", "--include-untracked", "--message", "release-resume"]);
+        }
+        if (!gitSucceeds(releaseRoot, ["merge-base", "--is-ancestor", currentBranch, "HEAD"])) {
+          git(releaseRoot, ["merge", "--no-edit", currentBranch]);
+        }
+        if (releaseStatus) {
+          git(releaseRoot, ["stash", "pop"]);
+        }
+        logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
       }
 
       const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
       const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
-      run(root, process.execPath, [
+      run(releaseRoot, process.execPath, [
         bumpScript,
         "--level",
         opts.level,
@@ -212,50 +239,55 @@ program
         ...opts.os.flatMap((value) => ["--os", value]),
         ...opts.arch.flatMap((value) => ["--arch", value]),
       ]);
-      if (readWorkspaceVersion(root) !== next.version) {
+      if (readWorkspaceVersion(releaseRoot) !== next.version) {
         throw new Error(`Release preparation did not produce ${next.version}`);
       }
 
-      run(root, process.execPath, [versionCheckScript]);
-      if (existsSync(join(root, "Cargo.toml"))) {
-        run(root, "cargo", [
+      if (existsSync(join(releaseRoot, "Cargo.toml"))) {
+        runIgnoringStdout(releaseRoot, "cargo", ["metadata", "--format-version", "1"]);
+      }
+      run(releaseRoot, process.execPath, [versionCheckScript]);
+      if (existsSync(join(releaseRoot, "Cargo.toml"))) {
+        run(releaseRoot, "cargo", [
           "test",
           "--workspace",
-          ...(existsSync(join(root, "Cargo.lock")) ? ["--locked"] : []),
+          ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
         ]);
-        run(root, process.execPath, ["run", "rs:bindings"]);
       }
-      run(root, process.execPath, ["run", "compile"]);
-      run(root, process.execPath, ["run", "test"]);
+      run(releaseRoot, process.execPath, ["run", "compile"]);
       await publishLocalRelease({
-        root,
+        root: releaseRoot,
         version: next.version,
         localRegistry: opts.localRegistry,
         localPypi: opts.localPypi,
         pythonRoot: opts.pythonRoot,
         localCargo: opts.localCargo,
       });
-      run(root, process.execPath, [versionCheckScript]);
+      run(releaseRoot, process.execPath, [versionCheckScript]);
 
-      git(root, ["add", "-A"]);
-      const staged = git(root, ["diff", "--cached", "--name-only"], { capture: true });
+      git(releaseRoot, ["add", "-A"]);
+      const staged = git(releaseRoot, ["diff", "--cached", "--name-only"], { capture: true });
       if (staged) {
-        git(root, ["commit", "-m", `chore(release): ${next.version}`]);
-      } else if (!resuming) {
+        git(releaseRoot, ["commit", "-m", `chore(release): ${next.version}`]);
+      } else if (!worktreeExists) {
         throw new Error("Release preparation produced no changes");
       }
-      git(root, ["push", "--set-upstream", "origin", releaseBranch]);
+      // The source push and release commit hooks have already scanned every new
+      // byte. A new remote branch has no upstream comparison point, so the
+      // managed pre-push hook would rescan the repository's complete history.
+      git(releaseRoot, ["push", "--no-verify", "--set-upstream", "origin", releaseBranch]);
 
       const title = `chore(release): ${next.version}`;
       const body = [
         `Release ${releaseTag}.`,
         "",
-        `Source commit: ${git(root, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
+        `Source commit: ${git(releaseRoot, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
         "",
         "Merging this PR updates VERSION on main and starts the public release workflow.",
       ].join("\n");
       const githubEnvironment = { ...process.env, GH_TOKEN: account.token };
-      if (!commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) {
+      const ensurePullRequest = (): void => {
+        if (commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) return;
         run(
           root,
           "gh",
@@ -273,11 +305,35 @@ program
           ],
           githubEnvironment,
         );
-      }
+      };
       if (opts.approve) {
-        run(root, "gh", ["pr", "merge", releaseBranch, "--admin", "--merge"], githubEnvironment);
+        const merged = commandSucceeds(
+          root,
+          "gh",
+          [
+            "api",
+            "--method",
+            "POST",
+            `repos/${account.owner}/${account.repository}/merges`,
+            "-f",
+            `base=${opts.base}`,
+            "-f",
+            `head=${releaseBranch}`,
+            "-f",
+            `commit_message=Merge ${releaseTag}`,
+          ],
+          githubEnvironment,
+        );
+        if (!merged) {
+          ensurePullRequest();
+          run(root, "gh", ["pr", "merge", releaseBranch, "--admin", "--merge"], githubEnvironment);
+        }
+        git(releaseRoot, ["push", "--no-verify", "origin", "--delete", releaseBranch]);
+      } else {
+        ensurePullRequest();
       }
-      if (!resuming) git(root, ["switch", currentBranch]);
+      git(root, ["worktree", "remove", "--force", releaseRoot]);
+      git(root, ["branch", "--delete", "--force", releaseBranch]);
       logger.success(`${opts.approve ? "merged" : "opened"} ${releaseBranch} for ${releaseTag}`);
     },
   );