@dbx-tools/projen 0.6.78 → 0.6.79

package/README.md

@@ -260,6 +260,19 @@ a new package is covered without a re-synth. Work from the root:
 | `bun run barrels` | regenerate the read-only `index.ts` barrels        |
 | `bun run bump`    | version, tag, and publish                          |
 
+`bump` also mirrors a release into local registries when the active clients are
+pointed at loopback services. npm uses `npm config get registry` and publishes
+to a local Verdaccio automatically. Python prefers uv's default index and only
+treats a loopback `.../+simple/` URL as writable devpi; a read-only cache such as
+proxpi (`.../index/`) is deliberately ignored. The task stamps every Python
+member and its sibling dependencies to the release version, builds the workspace
+with uv, then runs `devpi upload --from-dir` against the derived writable index.
+Devpi client authentication remains in its normal `~/.devpi` state.
+
+Use `--local-registry false` or `--local-pypi false` to disable either local
+publish. An explicit `--local-pypi http://localhost:3141/user/index/` overrides
+auto-detection; `--python-root` defaults to `packages/py`.
+
 Members intentionally keep only the tasks that something OTHER than a human
 invokes, so there is no second place to run the same thing:
 

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "0.6.78",
-    "@dbx-tools/path": "0.6.78",
-    "@dbx-tools/shared-core": "0.6.78",
+    "@dbx-tools/core": "0.6.79",
+    "@dbx-tools/path": "0.6.79",
+    "@dbx-tools/shared-core": "0.6.79",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -47,7 +47,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.6.78",
+  "version": "0.6.79",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/tasks/bump.ts

@@ -30,12 +30,11 @@
  * `--publish` / `--no-publish` is an alias for `--push` (pushing the tag is
  * what publishes). The tag prefix comes from `--prefix` (default `v`).
  *
- * `--local-registry <value>` publishes the just-tagged version to a LOCAL
- * registry (e.g. a verdaccio) right after the git tag is pushed - so a local
- * `bun run bump` both fires the GitHub release (public npm) and populates your
- * local registry. Values:
+ * `--local-registry <value>` publishes npm packages to a LOCAL registry (e.g.
+ * verdaccio) right after the tag push. `--local-pypi <value>` does the same for
+ * Python packages through a writable devpi index. Values for both:
  *   - `auto` (default): publish only when `npm config get registry` is a
- *     loopback host (`localhost` / `127.0.0.0/8` / `::1`); otherwise skip.
+ *     loopback host, or uv's default index is a loopback devpi `+simple` URL.
  *   - `false`: never publish locally.
  *   - a URL: always publish to that registry.
  */
@@ -45,6 +44,7 @@ import { fileURLToPath } from "node:url";
 import { exec, project } from "@dbx-tools/core";
 import { log, net } from "@dbx-tools/shared-core";
 import { Command, Option } from "commander";
+import { activePythonIndex, resolveLocalPypi } from "./python-registry.ts";
 
 const logger = log.logger("projen:bump");
 const LEVELS = ["patch", "minor", "major"] as const;
@@ -188,6 +188,12 @@ program
     "publish locally after the tag push: 'auto' (only a loopback npm registry), 'false', or a registry URL",
     "auto",
   )
+  .option(
+    "--local-pypi <value>",
+    "publish Python packages locally: 'auto' (only a loopback devpi +simple index), 'false', or a devpi URL",
+    "auto",
+  )
+  .option("--python-root <path>", "Python workspace package root", "packages/py")
   .action(
     (opts: {
       level: Level;
@@ -199,7 +205,9 @@ program
       tag: boolean;
       push: boolean;
       publish: boolean;
+      localPypi: string;
       localRegistry: string;
+      pythonRoot: string;
     }) => {
       const pkgPath = resolve(process.cwd(), "package.json");
       if (!existsSync(pkgPath)) throw new Error(`no package.json in ${process.cwd()}`);
@@ -314,6 +322,45 @@ program
         logger.success(`published ${version} to ${localRegistry}`);
       }
 
+      const activeIndex = activePythonIndex();
+      const localPypi = resolveLocalPypi(opts.localPypi, activeIndex);
+      const pythonRoot = resolve(opts.pythonRoot);
+      if (
+        opts.localPypi.toLowerCase() === "auto" &&
+        activeIndex &&
+        net.isLoopbackHost(new URL(activeIndex)) &&
+        !localPypi
+      ) {
+        logger.info(`skipped local Python publish: ${activeIndex} is not a devpi +simple index`);
+      }
+      if (opts.version === false && localPypi) {
+        logger.info("skipped local Python publish (--no-version left packages unstamped)");
+      } else if (opts.version && localPypi && existsSync(pythonRoot)) {
+        logger.info(`publishing Python ${version} to local devpi ${localPypi.publishUrl}`);
+        const publishPythonScript = fileURLToPath(new URL("./publish-python.ts", import.meta.url));
+        exec.spawnSync(
+          "bun",
+          [
+            publishPythonScript,
+            version,
+            "--root",
+            pythonRoot,
+            "--index-url",
+            localPypi.indexUrl,
+            "--publish-url",
+            localPypi.publishUrl,
+          ],
+          {
+            cwd: process.cwd(),
+            stdout: "inherit",
+            stderr: "inherit",
+            stdin: "ignore",
+            check: true,
+          },
+        );
+        logger.success(`published Python ${version} to ${localPypi.publishUrl}`);
+      }
+
       // Publishing can run package lifecycle hooks, including a standalone
       // project's own projen synth, which rewrites its generated manifest back
       // to 0.0.0. Re-assert the release version last so root and every sibling

package/tasks/publish-python.ts

@@ -0,0 +1,146 @@
+#!/usr/bin/env -S bun
+import {
+  chmodSync,
+  existsSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+import { exec } from "@dbx-tools/core";
+import { Command } from "commander";
+
+interface PythonProjectFile {
+  readonly directory: string;
+  readonly mode: number;
+  readonly name: string;
+  readonly path: string;
+  readonly source: string;
+}
+
+function escapeRegExp(value: string): string {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+export function stampPythonProjects(root: string, version: string): () => void {
+  const packageFiles = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
+    .filter(existsSync)
+    .sort();
+  const projects: PythonProjectFile[] = packageFiles.map((path) => {
+    const source = readFileSync(path, "utf8");
+    const name = /^name = "([^"]+)"$/m.exec(source)?.[1];
+    if (!name) throw new Error(`Missing project name in ${path}`);
+    return {
+      directory: basename(resolve(path, "..")),
+      mode: statSync(path).mode,
+      name,
+      path,
+      source,
+    };
+  });
+  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
+
+  try {
+    for (const project of projects) {
+      let stamped = project.source.replace(/^version = "[^"]+"$/m, `version = "${version}"`);
+      if (stamped === project.source) {
+        throw new Error(`Expected one project version in ${project.path}`);
+      }
+      for (const sibling of projects) {
+        stamped = stamped.replace(
+          new RegExp(
+            `${escapeRegExp(sibling.name)} @ git\\+[^" ]+#subdirectory=[^" ]+/${escapeRegExp(sibling.directory)}`,
+            "g",
+          ),
+          `${sibling.name}==${version}`,
+        );
+      }
+      chmodSync(project.path, project.mode | 0o200);
+      writeFileSync(project.path, stamped);
+    }
+  } catch (error) {
+    for (const project of projects) {
+      chmodSync(project.path, project.mode | 0o200);
+      writeFileSync(project.path, project.source);
+      chmodSync(project.path, project.mode);
+    }
+    throw error;
+  }
+
+  return () => {
+    for (const project of projects) {
+      chmodSync(project.path, project.mode | 0o200);
+      writeFileSync(project.path, project.source);
+      chmodSync(project.path, project.mode);
+    }
+  };
+}
+
+export function publishPythonProjects(options: {
+  readonly dryRun?: boolean;
+  readonly indexUrl: string;
+  readonly publishUrl: string;
+  readonly root: string;
+  readonly version: string;
+}): void {
+  const root = resolve(options.root);
+  const output = mkdtempSync(join(tmpdir(), "dbx-tools-python-publish-"));
+  const restore = stampPythonProjects(root, options.version);
+  try {
+    exec.spawnSync("uv", ["build", "--all-packages", "--out-dir", output], {
+      cwd: process.cwd(),
+      stdout: "inherit",
+      stderr: "inherit",
+      stdin: "ignore",
+      check: true,
+    });
+    exec.spawnSync(
+      "uvx",
+      [
+        "--from",
+        "devpi-client",
+        "devpi",
+        "upload",
+        "--index",
+        options.publishUrl,
+        "--from-dir",
+        ...(options.dryRun ? ["--dry-run"] : []),
+        output,
+      ],
+      {
+        cwd: process.cwd(),
+        env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl },
+        stdout: "inherit",
+        stderr: "inherit",
+        stdin: "ignore",
+        check: true,
+      },
+    );
+  } finally {
+    restore();
+    rmSync(output, { recursive: true, force: true });
+  }
+}
+
+if (import.meta.main) {
+  const program = new Command();
+  program
+    .argument("<version>", "Python package version")
+    .requiredOption("--index-url <url>", "devpi Simple API URL")
+    .requiredOption("--publish-url <url>", "devpi writable index URL")
+    .option("--root <path>", "Python workspace package root", "packages/py")
+    .option("--dry-run", "build and inspect distributions without uploading")
+    .action(
+      (
+        version: string,
+        options: { dryRun?: boolean; indexUrl: string; publishUrl: string; root: string },
+      ) => publishPythonProjects({ ...options, version }),
+    );
+  await program.parseAsync();
+}

package/tasks/python-registry.ts

@@ -0,0 +1,87 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { resolve } from "node:path";
+import { exec } from "@dbx-tools/core";
+import { net } from "@dbx-tools/shared-core";
+
+export interface LocalPythonRegistry {
+  readonly indexUrl: string;
+  readonly publishUrl: string;
+}
+
+/** Read the default index URL from uv's TOML configuration. */
+export function parseUvDefaultIndex(source: string): string | undefined {
+  const blocks = source.split(/(?=^\[\[index\]\]\s*$)/m);
+  for (const block of blocks) {
+    if (!/^\[\[index\]\]\s*$/m.test(block) || !/^\s*default\s*=\s*true\s*$/m.test(block)) {
+      continue;
+    }
+    const url = /^\s*url\s*=\s*["']([^"']+)["']\s*$/m.exec(block)?.[1];
+    if (url) return url;
+  }
+  return undefined;
+}
+
+/** Convert a devpi Simple API URL into its writable index URL. */
+export function devpiRegistry(index: string): LocalPythonRegistry | undefined {
+  let url: URL;
+  try {
+    url = new URL(index);
+  } catch {
+    return undefined;
+  }
+  if (!net.isLoopbackHost(url)) return undefined;
+
+  const path = url.pathname.replace(/\/+$/, "");
+  if (!path.endsWith("/+simple")) return undefined;
+  url.pathname = `${path.slice(0, -"/+simple".length)}/`;
+  url.search = "";
+  url.hash = "";
+  return {
+    indexUrl: new URL("+simple/", url).href,
+    publishUrl: url.href,
+  };
+}
+
+/** The active Python package index, preferring uv because Python builds use uv. */
+export function activePythonIndex(): string | undefined {
+  for (const value of [process.env.UV_DEFAULT_INDEX, process.env.UV_INDEX_URL]) {
+    if (value?.trim()) return value.trim();
+  }
+
+  const uvConfig = process.env.UV_CONFIG_FILE ?? resolve(homedir(), ".config/uv/uv.toml");
+  if (existsSync(uvConfig)) {
+    const index = parseUvDefaultIndex(readFileSync(uvConfig, "utf8"));
+    if (index) return index;
+  }
+
+  if (process.env.PIP_INDEX_URL?.trim()) return process.env.PIP_INDEX_URL.trim();
+  const pip = exec.spawnSync("python", ["-m", "pip", "config", "get", "global.index-url"], {
+    cwd: process.cwd(),
+    stdout: "capture",
+    stderr: "ignore",
+    stdin: "ignore",
+    check: false,
+  });
+  return pip.stdout?.trim() || undefined;
+}
+
+/** Resolve `auto`, `false`, or an explicit devpi index/publish URL. */
+export function resolveLocalPypi(
+  value: string,
+  activeIndex: string | undefined = activePythonIndex(),
+): LocalPythonRegistry | undefined {
+  const trimmed = value.trim();
+  if (!trimmed || trimmed.toLowerCase() === "false") return undefined;
+  if (trimmed.toLowerCase() === "auto") {
+    return activeIndex ? devpiRegistry(activeIndex) : undefined;
+  }
+
+  const derived = devpiRegistry(trimmed);
+  if (derived) return derived;
+  const publishUrl = trimmed.endsWith("/") ? trimmed : `${trimmed}/`;
+  return {
+    publishUrl,
+    indexUrl: new URL("+simple/", publishUrl).href,
+  };
+}