@dbx-tools/projen 0.6.40 → 0.6.41

package/src/release.ts

@@ -11,7 +11,44 @@ import { applyTasks, taskScript, type DBXToolsNodeProject } from "./project.ts";
 
 const NODE_VERSION = "lts/*";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-const PNPM_VERSION = "10.33.0";
+const BUN_VERSION = "1.3.14";
+
+/**
+ * The `release` workflow's version-stamp + publish step, as a shell script.
+ *
+ * Bun has no `pnpm -r publish` equivalent, so this drives the engine's
+ * `tasks/publish.ts` (shipped in the engine tarball, run via bun): it reads the
+ * workspace members from the root `package.json`, stamps the tag version onto
+ * every manifest (rewriting `@dbx-tools/*` `workspace:*` sibling deps to
+ * `^<version>` so the tarballs resolve each other), then `bun publish`es each
+ * non-`private` package. `bun publish` substitutes `publishConfig` (the compiled
+ * `lib/` entry points) at pack time, runs `prepack` (compile) so `lib/` exists,
+ * and honors `NPM_CONFIG_PROVENANCE`.
+ *
+ * Two ways in: a pushed `<prefix>*` tag (the real release - `GITHUB_REF_NAME` is
+ * the version) and a manual `workflow_dispatch` (no tag, so a throwaway
+ * `0.0.0-dry.<run>` version is used and `--dry-run` is FORCED regardless of the
+ * input, since a dispatch never has a tag to publish as). The `dry_run` input
+ * (default true) is what lets a maintainer exercise the whole workflow - setup,
+ * install, stamp, compile, pack, validate - with nothing reaching npm.
+ */
+function BUN_PUBLISH_SCRIPT(tagPrefix: string, excludeDirs: readonly string[]): string {
+  const script = "node_modules/@dbx-tools/projen/tasks/publish.ts";
+  const excludes = excludeDirs.map((dir) => ` --exclude ${dir}`).join("");
+  return [
+    'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+    // A manual run has no tag: use a throwaway version and never really publish.
+    '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
+    "  DRY_RUN=--dry-run",
+    "else",
+    `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
+    // A tag push honors the input too, so a dry-run tag can be tested if wanted.
+    '  DRY_RUN="${DRY_RUN_INPUT}"',
+    "fi",
+    "chmod -R u+w . || true",
+    `bun ${script} "$VERSION"${excludes} $DRY_RUN`,
+  ].join("\n");
+}
 
 interface PublishWorkflow {
   readonly name: string;
@@ -24,17 +61,18 @@ interface PublishWorkflow {
 function publishSetupSteps(): JobStep[] {
   return [
     { name: "Checkout", uses: "actions/checkout@v6", with: { "fetch-depth": 0 } },
-    { name: "Setup pnpm", uses: "pnpm/action-setup@v5", with: { version: PNPM_VERSION } },
+    { name: "Setup Bun", uses: "oven-sh/setup-bun@v2", with: { "bun-version": BUN_VERSION } },
     {
       name: "Setup Node.js",
       uses: "actions/setup-node@v6",
       // setup-node writes the temporary npmrc that maps NODE_AUTH_TOKEN onto
       // npmjs. Omitting this leaves the secret in the environment but gives npm
       // no registry-scoped auth entry, and every publish fails with ENEEDAUTH.
+      // (Bun installs deps; publishing still goes through `npm publish`.)
       with: { "node-version": NODE_VERSION, "registry-url": NPM_REGISTRY_URL },
     },
-    // The lockfile is intentionally untracked and may be absent or stale in CI.
-    { name: "Install", run: "pnpm install --no-frozen-lockfile" },
+    // Bun's install; the lockfile may be absent or stale in CI so it is not frozen.
+    { name: "Install", run: "bun install" },
   ];
 }
 
@@ -160,12 +198,30 @@ export class DBXToolsRelease extends Component {
     // the publish job below overrides it with the `id-token` it needs.
     workflow.file?.addOverride("permissions", { contents: "read" });
     workflow.on({ push: { tags: [`${tagPrefix}*`] } });
+    // Manual trigger for testing the workflow WITHOUT reaching npm: a
+    // `workflow_dispatch` run has no tag, so the publish script forces
+    // `--dry-run` (pack + validate only). The `dry_run` input (default true)
+    // additionally lets a tag push be dry-run on demand.
+    workflow.file?.addOverride("on.workflow_dispatch", {
+      inputs: {
+        dry_run: {
+          description: "Pack and validate but do not upload to npm",
+          type: "boolean",
+          default: true,
+        },
+      },
+    });
     workflow.addJob("publish", {
       runsOn: ["ubuntu-latest"],
       // `id-token: write` lets npm mint the OIDC token for provenance attestation.
       permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
       timeoutMinutes: 30,
-      env: { CI: "true" },
+      // `DRY_RUN_INPUT` is `--dry-run` when the dispatch input is true, else empty;
+      // the publish script also FORCES it on any `workflow_dispatch` run.
+      env: {
+        CI: "true",
+        DRY_RUN_INPUT: "${{ github.event.inputs.dry_run == 'true' && '--dry-run' || '' }}",
+      },
       steps: [...publishSetupSteps(), ...steps],
       ...(workingDirectory ? { defaults: { run: { workingDirectory } } } : {}),
     });
@@ -182,26 +238,25 @@ export class DBXToolsRelease extends Component {
       name: "release",
       tagPrefix: this.tagPrefix,
       steps: [
-        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Set it on
-        // every package (manifests are projen-readonly, so unlock them first).
+        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. Stamp it on
+        // every workspace package (manifests are projen-readonly, so unlock
+        // first), rewriting `workspace:*` sibling deps to `^<version>` so the
+        // published tarballs resolve each other. `bun publish` honors
+        // `publishConfig` (compiled `lib/` entry points) and provenance.
         {
-          name: "Set version from tag",
-          run: [
-            `VERSION="\${GITHUB_REF_NAME#${this.tagPrefix}}"`,
-            "chmod -R u+w . || true",
-            'pnpm -r exec npm version "$VERSION" --no-git-tag-version --allow-same-version',
-          ].join("\n"),
-        },
-        {
-          name: "Publish to npm",
-          // `pnpm -r publish` publishes every non-private package,
-          // rewriting `workspace:*` deps to the published version. Provenance is
-          // opt-in (omitted from each package's `publishConfig` so local
-          // publishes work); CI turns it on here via `npm_config_provenance`.
-          run: "pnpm -r publish --no-git-checks --access public",
+          name: "Set version from tag and publish",
+          // Exclude every standalone-release dir (e.g. `projen`): it publishes on
+          // its own `<prefix>-v*` tag via its own workflow, not the main `v*` one.
+          run: BUN_PUBLISH_SCRIPT(
+            this.tagPrefix,
+            this.standaloneReleases.map((s) => s.directory),
+          ),
           env: {
+            // `bun publish` authenticates via NPM_CONFIG_TOKEN (not NODE_AUTH_TOKEN,
+            // which is the `npm publish` convention). Set both so either tool works.
+            NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
             NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
-            npm_config_provenance: "true",
+            NPM_CONFIG_PROVENANCE: "true",
           },
         },
       ],
@@ -210,34 +265,55 @@ export class DBXToolsRelease extends Component {
 
   /**
    * Emit a {@link StandaloneRelease}'s workflow: push `<prefix>1.2.3` and the
-   * single package in `directory` (a non-workspace-member project) is published
-   * at 1.2.3 via `npm pack` + `npm publish`. Its `package.json` is
-   * projen-generated read-only, so it is unlocked before `npm version` rewrites
-   * it. No bump math - the pushed tag IS the published version.
+   * single package in `directory` is published at 1.2.3 via `bun publish`.
+   *
+   * `directory` (e.g. `projen/`) is a WORKSPACE MEMBER whose `@dbx-tools/*` deps
+   * are `workspace:*`. `bun publish` resolves those to whatever version its
+   * SIBLINGS carry (via the lockfile), so before publishing we set the version on
+   * the package AND its in-scope siblings, then refresh the lockfile - otherwise
+   * the published engine would depend on the siblings' on-disk `0.0.0`. The
+   * `Install` step already ran `bun install` from the repo root (the member
+   * subdir walks up to it), so the workspace is linked. The manifests are
+   * projen-readonly, hence the `chmod`. A manual `workflow_dispatch` run has no
+   * tag, so it uses a throwaway version and forces `--dry-run` (nothing to npm).
    */
   private authorStandaloneReleaseWorkflow(
     project: DBXToolsNodeProject,
     { name, directory, tagPrefix }: StandaloneRelease,
   ): void {
+    // The engine's release also stamps its in-scope siblings so `bun publish`
+    // resolves their `workspace:*` to the release version. Stamping the WHOLE
+    // workspace is simplest and harmless (only `directory` is published here).
+    const stampScript = "node_modules/@dbx-tools/projen/tasks/publish.ts";
     this.authorPublishWorkflow(project, {
       name,
       tagPrefix,
-      workingDirectory: directory,
       steps: [
-        // The pushed tag is the version: `<prefix>1.2.3` -> `1.2.3`. package.json
-        // is projen-generated read-only, so unlock it before `npm version` writes.
         {
-          name: "Set version from tag",
+          name: "Set version from tag and publish",
           run: [
-            "chmod u+w package.json",
-            `npm version "\${GITHUB_REF_NAME#${tagPrefix}}" --no-git-tag-version --allow-same-version`,
+            'if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then',
+            '  VERSION="0.0.0-dry.${GITHUB_RUN_NUMBER}"',
+            "  DRY_RUN=--dry-run",
+            "else",
+            `  VERSION="\${GITHUB_REF_NAME#${tagPrefix}}"`,
+            '  DRY_RUN="${DRY_RUN_INPUT}"',
+            "fi",
+            "chmod -R u+w . || true",
+            // Set the version across every member + refresh the lockfile (the
+            // publish task's stamp phase), so bun resolves the engine's
+            // `workspace:*` sibling deps to the release version at pack time.
+            `bun ${stampScript} "$VERSION" --stamp-only`,
+            // Then publish ONLY the standalone directory.
+            `cd ${directory} && bun publish --access public $DRY_RUN`,
           ].join("\n"),
-        },
-        { name: "Pack", run: "pnpm pack --pack-destination dist/js" },
-        {
-          name: "Publish to npm",
-          run: "npm publish dist/js/*.tgz --access public",
-          env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" },
+          env: {
+            // `bun publish` authenticates via NPM_CONFIG_TOKEN (not NODE_AUTH_TOKEN,
+            // which is the `npm publish` convention). Set both so either tool works.
+            NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
+            NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+            NPM_CONFIG_PROVENANCE: "true",
+          },
         },
       ],
     });

package/src/tags.ts

@@ -15,6 +15,7 @@
  */
 import type { IMixin as ConstructsMixin } from "constructs";
 import { javascript } from "projen";
+import { BunBuildFile, BunDevServerFile, BunfigFile } from "./bun-app.ts";
 import { create } from "./mixin.ts";
 import {
   addPackageFiles,
@@ -25,7 +26,6 @@ import {
   srcModuleExports,
 } from "./project.ts";
 import * as projectPredicate from "./project-predicate.ts";
-import { ViteConfigFile } from "./vite.ts";
 
 /** Node compiler options: ES2022 lib + node types, deliberately no DOM. */
 const NODE_COMPILER_OPTIONS: javascript.TypeScriptCompilerOptions = {
@@ -81,30 +81,42 @@ export const PACKAGE_TAG_MIXINS = {
       "./package.json": "./package.json",
     });
   }),
-  // `app`: a full browser app built + served by Vite (needs an `index.html`
-  // entry). Self-contained React app: React + DOM lib + JSX + the vite toolchain
-  // and app tasks (`dev`/`build`/`preview`). `build` resets the compile task, so
-  // `compile` bundles with vite rather than `tsc`.
+  // `app`: a full browser app built + served by BUN (needs an `index.html`
+  // entry). Self-contained React app: React + DOM lib + JSX + bun's fullstack
+  // dev server (`dev.ts`, `Bun.serve` + HMR) and production bundle (`build.ts`,
+  // `Bun.build`). Tailwind v4 is compiled by `bun-plugin-tailwind` (wired in the
+  // generated `bunfig.toml`). No Vite.
   app: create(projectPredicate.hasTag("app"), (p) => {
     p.addDeps("react@catalog:", "react-dom@catalog:");
     p.addDevDeps(
-      "vite@catalog:",
-      "@vitejs/plugin-react@catalog:",
       "@types/react@catalog:",
       "@types/react-dom@catalog:",
+      // The Tailwind plugin the dev server + build load. Tailwind itself is a
+      // catalog dep the app declares (it also owns the Tailwind entry CSS).
+      "bun-plugin-tailwind@catalog:",
     );
     applyCompilerOptions(p, {
       target: "ES2022",
       lib: [...DOM_LIB],
       jsx: javascript.TypeScriptJsxMode.REACT_JSX,
-      types: ["vite/client"],
+      // `@types/bun` (a root/subproject devDep) supplies the `Bun.*` globals the
+      // generated `dev.ts`/`build.ts` use; no `vite/client`.
+      types: ["bun"],
+      // `@/` -> `src/` alias, resolved by both tsc and bun's bundler (bun reads
+      // tsconfig `paths`). Replaces the old Vite `resolve.alias` for `@`.
+      baseUrl: ".",
+      paths: { "@/*": ["./src/*"] },
     });
+    // bun runs the generated scripts directly. `build` resets the compile task so
+    // `compile` bundles with `Bun.build` rather than `tsc`.
     applyTasks(p, {
-      dev: { exec: "vite" },
-      build: { exec: "vite build" },
-      preview: { exec: "vite preview" },
+      dev: { exec: "bun dev.ts" },
+      build: { exec: "bun build.ts" },
+      preview: { exec: "bun dev.ts" },
     });
-    new ViteConfigFile(p);
+    new BunfigFile(p);
+    new BunDevServerFile(p);
+    new BunBuildFile(p);
     // An app has a single root entry, not a component library's subpaths - so it
     // replaces the `ui` tag's `./react`/`./styles.css` surface with a `.` root.
     applyExports(p, {
@@ -147,9 +159,11 @@ export const PACKAGE_TAG_MIXINS = {
       ...NODE_COMPILER_OPTIONS,
       experimentalDecorators: true,
     });
+    // bun runs the server `.ts` directly (native TS, no tsx). `--watch` restarts
+    // on change - the tsx-watch replacement.
     applyTasks(p, {
-      dev: { exec: "tsx watch src/server.ts" },
-      start: { exec: "tsx src/server.ts" },
+      dev: { exec: "bun --watch src/server.ts" },
+      start: { exec: "bun src/server.ts" },
     });
   }),
   node: create(projectPredicate.hasTag("node"), (p) => {

package/tasks/bump.ts

@@ -1,4 +1,4 @@
-#!/usr/bin/env -S npx tsx
+#!/usr/bin/env -S bun
 /**
  * `projen bump` - synth, compute the next release version, then (by default)
  * commit, tag, and push it. Pushing the tag is what triggers the release
@@ -11,9 +11,9 @@
  *   - the local `package.json` version,
  * then incremented by `--level` (patch | minor | major; default patch).
  *
- * `--sibling <dir>:<tagPrefix>` (repeatable) releases a standalone in-repo
- * project - one that is NOT a pnpm workspace member, so `pnpm -r` cannot see it -
- * at the SAME version as the root, in the same run: its manifest is stamped, its
+ * `--sibling <dir>:<tagPrefix>` (repeatable) releases an in-repo project that
+ * publishes on its OWN tag namespace (e.g. `projen/`, tagged `projen-v*`) at the
+ * SAME version as the root, in the same run: its manifest version is stamped, its
  * `<tagPrefix><version>` tag is cut and pushed (triggering its own workflow), and
  * it is included in the local-registry publish. Taking the base version from
  * every prefix at once is what keeps the two in lockstep: the engine sat at
@@ -32,7 +32,7 @@
  *
  * `--local-registry <value>` publishes the just-tagged version to a LOCAL
  * registry (e.g. a verdaccio) right after the git tag is pushed - so a local
- * `pnpm run bump` both fires the GitHub release (public npm) and populates your
+ * `bun run bump` both fires the GitHub release (public npm) and populates your
  * local registry. Values:
  *   - `auto` (default): publish only when `npm config get registry` is a
  *     loopback host (`localhost` / `127.0.0.0/8` / `::1`); otherwise skip.
@@ -44,15 +44,10 @@ import { log, net } from "@dbx-tools/shared-core";
 import { Command, Option } from "commander";
 import { chmodSync, existsSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const logger = log.logger("projen:bump");
 const LEVELS = ["patch", "minor", "major"] as const;
-const DEPENDENCY_FIELDS = [
-  "dependencies",
-  "devDependencies",
-  "optionalDependencies",
-  "peerDependencies",
-] as const;
 type Level = (typeof LEVELS)[number];
 
 /** A standalone in-repo project released alongside the root, on its own tag prefix. */
@@ -126,39 +121,30 @@ function readPackageVersion(pkgPath: string): [number, number, number] {
 }
 
 /**
- * Write `version` into a manifest projen owns. Those are emitted read-only, so
- * the write is bracketed by a chmod; the mode is restored afterwards to leave the
- * tree exactly as synth left it.
+ * Write ONLY the `version` field into a manifest projen owns (read-only, so
+ * bracketed by a chmod that restores the mode). Used for the ROOT and the
+ * standalone `projen/` sibling so the committed release marks the version.
+ *
+ * It deliberately does NOT rewrite `@scope/*` dep ranges. `projen/` is a workspace
+ * member with `workspace:*` sibling deps; baking a `^version` for the just-bumped
+ * (not-yet-published) version into the COMMITTED manifest breaks the release
+ * workflow's initial `bun install`, which checks out that commit before anything
+ * is published. Sibling versions are resolved transiently at publish time instead:
+ * `projen-release` runs `tasks/publish.ts --stamp-only` (set versions + refresh
+ * lockfile), then `bun publish` in `projen/` strips `workspace:*` to those versions.
  */
-function writeManifestVersion(pkgPath: string, version: string, dependencyScope?: string): void {
+function writeManifestVersion(pkgPath: string, version: string): void {
   const { mode } = statSync(pkgPath);
   chmodSync(pkgPath, mode | 0o200);
   try {
     const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as Record<string, unknown>;
     pkg.version = version;
-    if (dependencyScope) {
-      for (const field of DEPENDENCY_FIELDS) {
-        const dependencies = pkg[field];
-        if (!dependencies || typeof dependencies !== "object") continue;
-        for (const name of Object.keys(dependencies)) {
-          if (name.startsWith(dependencyScope)) {
-            (dependencies as Record<string, string>)[name] = `^${version}`;
-          }
-        }
-      }
-    }
     writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
   } finally {
     chmodSync(pkgPath, mode);
   }
 }
 
-/** Scoped package prefix (`@scope/`) shared by the root's release packages. */
-function releaseDependencyScope(pkgPath: string): string | undefined {
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { name?: string };
-  return /^@[^/]+\//.exec(pkg.name ?? "")?.[0];
-}
-
 /**
  * Resolve the `--local-registry` value to a registry URL to publish to, or
  * `undefined` to skip. `false` skips; a URL is used as-is; `auto` uses the
@@ -217,7 +203,6 @@ program
     }) => {
       const pkgPath = resolve(process.cwd(), "package.json");
       if (!existsSync(pkgPath)) throw new Error(`no package.json in ${process.cwd()}`);
-      const dependencyScope = releaseDependencyScope(pkgPath);
 
       const siblings = opts.sibling.map((s) => ({ ...s, pkgPath: resolve(s.dir, "package.json") }));
       for (const s of siblings) {
@@ -228,7 +213,7 @@ program
       // manifests, workspace file, tasks, ...) rather than a stale one.
       if (opts.synth) {
         logger.info("synthesizing (projen)");
-        exec.spawnSync("pnpm", ["exec", "projen"], {
+        exec.spawnSync("bun", [".projenrc.ts"], {
           cwd: process.cwd(),
           stdout: "inherit",
           stderr: "inherit",
@@ -265,7 +250,7 @@ program
 
       if (opts.version) {
         writeManifestVersion(pkgPath, version);
-        for (const s of siblings) writeManifestVersion(s.pkgPath, version, dependencyScope);
+        for (const s of siblings) writeManifestVersion(s.pkgPath, version);
         const also = siblings.length ? ` (and ${siblings.map((s) => s.dir).join(", ")})` : "";
         logger.info(`wrote version ${version} to package.json${also}`);
       }
@@ -304,57 +289,26 @@ program
       }
       if (publishToLocalRegistry) {
         logger.info(`publishing ${version} to local registry ${localRegistry}`);
-        const runIn = (cwd: string, command: string, args: string[]) =>
-          exec.spawnSync(command, args, {
-            cwd,
-            stdout: "inherit",
-            stderr: "inherit",
-            stdin: "ignore",
-            check: true,
-          });
-        const runInRepo = (command: string, args: string[]) => runIn(process.cwd(), command, args);
-        // Each package keeps `version: 0.0.0` on disk (projen owns the
-        // manifest); the root bump above only touched the root. Mirror the CI
-        // `release` workflow: stamp the release version on EVERY package (they're
-        // projen-readonly, so unlock first) so `pnpm -r publish` publishes them
-        // as `version` (and rewrites `workspace:*` sibling pins to it) instead of
-        // `0.0.0`. No restore needed - the next `projen` synth rewrites these
-        // manifests back to `0.0.0`; the release version lives in the git tag.
-        runInRepo("chmod", ["-R", "u+w", "."]);
-        runInRepo("pnpm", [
-          "-r",
-          "exec",
-          "npm",
-          "version",
-          version,
-          "--no-git-tag-version",
-          "--allow-same-version",
-        ]);
-        // Provenance is opt-in (see `.projenrc.ts`): the generated
-        // `publishConfig` omits it, so local (verdaccio) publishes never try to
-        // attest. CI turns it on with `npm_config_provenance=true`.
-        runInRepo("pnpm", [
-          "-r",
-          "publish",
-          "--registry",
-          localRegistry,
-          "--no-git-checks",
-          "--access",
-          "public",
-        ]);
-        // `pnpm -r` cannot see a sibling (not a workspace member), so publish each
-        // one on its own. Skipping this is what left a local registry serving a
-        // current CLI against a months-old engine.
-        for (const s of siblings) {
-          runIn(s.dir, "pnpm", [
-            "publish",
-            "--registry",
-            localRegistry,
-            "--no-git-checks",
-            "--access",
-            "public",
-          ]);
-        }
+        // Mirror the CI `release` workflow via the shared publish task: it sets
+        // the release version on every workspace member (`bun pm pkg set`; they
+        // keep `0.0.0` on disk, projen-owned, so it unlocks each briefly), then
+        // `bun publish`es each non-private one - and bun natively strips the
+        // `workspace:`/`catalog:` protocols in the packed tarball, resolving each
+        // to the version just set. The next `projen` synth restores the manifests
+        // to `0.0.0`; the release version lives in the git tag. Provenance is off
+        // for a local registry (no OIDC), so `NPM_CONFIG_PROVENANCE` is unset.
+        // `publish.ts` is this task's SIBLING in the engine's `tasks/` dir; resolve
+        // it off `import.meta.url` (works whether the engine is source-linked in-repo
+        // or installed under node_modules) rather than a repo-relative `tasks/...`
+        // that only exists inside `projen/`.
+        const publishScript = fileURLToPath(new URL("./publish.ts", import.meta.url));
+        exec.spawnSync("bun", [publishScript, version, "--registry", localRegistry], {
+          cwd: process.cwd(),
+          stdout: "inherit",
+          stderr: "inherit",
+          stdin: "ignore",
+          check: true,
+        });
         logger.success(`published ${version} to ${localRegistry}`);
       }
 
@@ -364,7 +318,7 @@ program
       // manifest finish the bump in lockstep.
       if (opts.version) {
         writeManifestVersion(pkgPath, version);
-        for (const s of siblings) writeManifestVersion(s.pkgPath, version, dependencyScope);
+        for (const s of siblings) writeManifestVersion(s.pkgPath, version);
         logger.info(`synchronized release manifests at ${version}`);
       }
     },