@dbx-tools/projen 0.6.200 → 0.6.202

package/README.md

@@ -406,9 +406,11 @@ release branch when needed, and pushes it. It prepares the dedicated
 checkout on its current branch throughout validation, local publication, and
 PR creation. Failed preparation can resume from that worktree; success removes
 it. `--message` sets the source commit message. The task never merges
-the PR unless `--approve` is passed; that option requests an immediate admin
-merge so the main release can start without waiting for PR checks. npm uses
-`npm config get registry` and publishes to a local Verdaccio automatically.
+the PR unless `--approve` is passed; that option merges the release branch
+directly through GitHub's merge API so no PR checks are created. A repository
+that blocks direct merges falls back to an immediate admin-merged PR. The task
+then fast-forwards the still-active source branch to the release commit. npm
+uses `npm config get registry` and publishes to a local Verdaccio automatically.
 Publishable JavaScript members compile once
 from the root in parallel, then upload through a bounded pool without rerunning
 their `prepack` tasks. Python prefers uv's default index and only

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.6.200";
+export const PACKAGE_VERSION = "0.6.202";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -25,9 +25,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.200",
-    "@dbx-tools/path": "0.6.200",
-    "@dbx-tools/shared-core": "0.6.200",
+    "@dbx-tools/core": "0.6.202",
+    "@dbx-tools/path": "0.6.202",
+    "@dbx-tools/shared-core": "0.6.202",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.200",
+  "version": "0.6.202",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-js.ts

@@ -13,7 +13,7 @@ import { ignore, match } from "@dbx-tools/path";
 import { object, string, type OneOrMany } from "@dbx-tools/shared-core";
 import { type IConstruct } from "constructs";
 import { Component, IgnoreFile, Project, type TaskOptions, javascript, typescript } from "projen";
-import type { JobStep } from "projen/lib/github/workflows-model";
+import { JobPermission, type JobStep } from "projen/lib/github/workflows-model";
 import { ReleaseTrigger } from "projen/lib/release";
 import { mixin } from "..";
 import { generateBarrels } from "./barrels.ts";
@@ -456,6 +456,10 @@ function defaultProjectOptions(
         }
       : {}),
     ...options,
+    githubOptions: {
+      ...options.githubOptions,
+      pullRequestLint: false,
+    },
     ...copiedGitIgnoreOptions(options),
   };
 }
@@ -861,6 +865,23 @@ class WorkflowDefaults extends Component {
             ? () => rewrite(configuredSteps())
             : rewrite(configuredSteps);
       }
+      workflow.addJob("pr-title", {
+        name: "Validate PR title",
+        runsOn: ["ubuntu-latest"],
+        permissions: { pullRequests: JobPermission.READ },
+        if: "${{ github.event_name == 'pull_request' && github.event.action != 'closed' }}",
+        steps: [
+          {
+            name: "Validate semantic title",
+            uses: "amannn/action-semantic-pull-request@v6",
+            env: { GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" },
+            with: {
+              types: ["feat", "fix", "chore"].join("\n"),
+              requireScope: false,
+            },
+          },
+        ],
+      });
     }
     const build = this.project.tryFindObjectFile(".github/workflows/build.yml");
     build?.addOverride("on.pull_request.types", ["opened", "synchronize", "reopened", "closed"]);
@@ -871,31 +892,11 @@ class WorkflowDefaults extends Component {
     for (const job of ["build", "self-mutation"]) {
       build?.addOverride(`jobs.${job}.timeout-minutes`, 30);
     }
-    const pullRequestLint = this.project.tryFindObjectFile(
-      ".github/workflows/pull-request-lint.yml",
-    );
-    pullRequestLint?.addOverride("on.pull_request_target.types", [
-      "labeled",
-      "opened",
-      "synchronize",
-      "reopened",
-      "ready_for_review",
-      "edited",
-      "closed",
-    ]);
-    pullRequestLint?.addOverride(
-      "jobs.validate.if",
-      "(github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'",
-    );
-    pullRequestLint?.addOverride("jobs.validate.timeout-minutes", 10);
-    for (const name of ["build", "pull-request-lint"]) {
-      const workflow = this.project.tryFindObjectFile(`.github/workflows/${name}.yml`);
-      workflow?.addOverride("permissions", { contents: "read" });
-      workflow?.addOverride("concurrency", {
-        group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}",
-        "cancel-in-progress": true,
-      });
-    }
+    build?.addOverride("permissions", { contents: "read" });
+    build?.addOverride("concurrency", {
+      group: "${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}",
+      "cancel-in-progress": true,
+    });
   }
 }
 

package/tasks/release-pr.ts

@@ -105,11 +105,11 @@ function runIgnoringStdout(root: string, command: string, args: string[]): void
   });
 }
 
-function githubAccount(root: string): { owner: string; token: string } {
+function githubAccount(root: string): { owner: string; repository: string; token: string } {
   const repository = project.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
-  const owner = new URL(repository).pathname.split("/").filter(Boolean)[0];
-  if (!owner) throw new Error(`Cannot determine GitHub owner from ${repository}`);
+  const [owner, name] = new URL(repository).pathname.split("/").filter(Boolean);
+  if (!owner || !name) throw new Error(`Cannot determine GitHub identity from ${repository}`);
   const token = exec
     .spawnSync("gh", ["auth", "token", "--user", owner], {
       cwd: root,
@@ -120,7 +120,7 @@ function githubAccount(root: string): { owner: string; token: string } {
     })
     .stdout?.trim();
   if (!token) throw new Error(`No GitHub CLI authentication found for ${owner}`);
-  return { owner, token };
+  return { owner, repository: name.replace(/\.git$/, ""), token };
 }
 
 const program = new Command();
@@ -148,7 +148,7 @@ program
   .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
   .option("--python-root <path>", "Python workspace package root", "packages/py")
   .option("--no-local-cargo", "skip local Cargo publication")
-  .option("--approve", "merge the release PR immediately with admin bypass")
+  .option("--approve", "merge the release branch directly into the release base")
   .action(
     async (opts: {
       level: VersionLevel;
@@ -209,7 +209,6 @@ program
           throw new Error(`Release branch already exists without its worktree: ${releaseBranch}`);
         }
         git(root, ["worktree", "add", "-b", releaseBranch, releaseRoot, "HEAD"]);
-        run(releaseRoot, process.execPath, ["install"]);
       } else {
         const releaseStatus = git(
           releaseRoot,
@@ -227,6 +226,7 @@ program
         }
         logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
       }
+      run(releaseRoot, process.execPath, ["install"]);
 
       const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
       const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
@@ -272,7 +272,10 @@ program
       } else if (!worktreeExists) {
         throw new Error("Release preparation produced no changes");
       }
-      git(releaseRoot, ["push", "--set-upstream", "origin", releaseBranch]);
+      // The source push and release commit hooks have already scanned every new
+      // byte. A new remote branch has no upstream comparison point, so the
+      // managed pre-push hook would rescan the repository's complete history.
+      git(releaseRoot, ["push", "--no-verify", "--set-upstream", "origin", releaseBranch]);
 
       const title = `chore(release): ${next.version}`;
       const body = [
@@ -283,7 +286,8 @@ program
         "Merging this PR updates VERSION on main and starts the public release workflow.",
       ].join("\n");
       const githubEnvironment = { ...process.env, GH_TOKEN: account.token };
-      if (!commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) {
+      const ensurePullRequest = (): void => {
+        if (commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) return;
         run(
           root,
           "gh",
@@ -301,9 +305,35 @@ program
           ],
           githubEnvironment,
         );
-      }
+      };
       if (opts.approve) {
-        run(root, "gh", ["pr", "merge", releaseBranch, "--admin", "--merge"], githubEnvironment);
+        const merged = commandSucceeds(
+          root,
+          "gh",
+          [
+            "api",
+            "--method",
+            "POST",
+            `repos/${account.owner}/${account.repository}/merges`,
+            "-f",
+            `base=${opts.base}`,
+            "-f",
+            `head=${releaseBranch}`,
+            "-f",
+            `commit_message=Merge ${releaseTag}`,
+          ],
+          githubEnvironment,
+        );
+        if (!merged) {
+          ensurePullRequest();
+          run(root, "gh", ["pr", "merge", releaseBranch, "--admin", "--merge"], githubEnvironment);
+        }
+        git(releaseRoot, ["push", "--no-verify", "origin", "--delete", releaseBranch]);
+        git(root, ["fetch", "origin", opts.base]);
+        git(root, ["merge", "--ff-only", `origin/${opts.base}`]);
+        git(root, ["push", "origin", currentBranch]);
+      } else {
+        ensurePullRequest();
       }
       git(root, ["worktree", "remove", "--force", releaseRoot]);
       git(root, ["branch", "--delete", "--force", releaseBranch]);