@dbx-tools/projen 0.9.1 → 0.9.3

package/README.md

@@ -173,26 +173,20 @@ a host Rust build. Regenerate bindings through the focused watcher or explicit
 task while changing a UniFFI API. Release preparation runs Cargo workspace tests
 without invoking UBRN.
 
-The workspace generates one `release.yml` workflow for every ecosystem.
-Independent mode runs Release Please on default-branch pushes. It owns the
-combined release PR, per-component semantic increments, component-qualified
-tags, and GitHub Releases. A Projen reconciliation pass reads the reviewed
-manifest, regenerates every owned version surface, validates a clean second
-synthesis, and commits component-qualified release notes to the release PR.
-One non-cancelling `release` concurrency group serializes publication.
+The workspace generates one `release.yml` workflow for every ecosystem. One
+root `VERSION` drives every Node, Python, Cargo, native, and GitHub artifact.
+`bun run release` prepares one reviewed PR into `main`; it enables automatic
+merge by default and accepts `--no-approve` for a human-controlled merge. One
+non-cancelling `release` concurrency group serializes publication.
 
 Release generation writes `release.yml` without scanning for or removing other
 workflow files. Consumers explicitly delete exact workflow files they no longer
 want.
 
-The release-plan job compares the previous and reviewed release-unit graphs and
-selects only changed units, required dependents, packages, native targets,
-assets, and docs. A Node-only release allocates no Rust runner. Manual recovery
-names one component, reviewed version, and publication stage; it reconstructs
-that component's plan without changing any other version. npm retries compare
-archive content and repository identity, PyPI uses hash-aware existing-file
-behavior, Cargo checks existing versions, and GitHub assets upload to the
-component release.
+The release workflow accepts stage-specific manual recovery only for the exact
+annotated tag and expected SHA. npm retries compare archive content and
+repository identity, PyPI uses hash-aware existing-file behavior, Cargo checks
+existing versions, and GitHub assets upload to the single repository release.
 
 Set `releaseSyncBranch` when a repository retains a long-lived source branch.
 After publication the workflow fast-forwards a branch that is behind, skips a
@@ -437,37 +431,34 @@ Every repo-wide task lives on the root, and the root's `compile` / `test`
 delegate with `bun run --filter '*'` rather than emitting a step per member - so
 a new package is covered without a re-synth. Work from the root:
 
-| Task                        | What it does                                          |
-| --------------------------- | ----------------------------------------------------- |
-| `bun run build`             | synth + workspace compile and tests                   |
-| `bun run compile`           | `tsc --build` in each member, in parallel             |
-| `bun run test`              | `eslint` once, then each member's tests               |
-| `bun run sync`              | re-synth (`--watch` to keep synthing)                 |
-| `bun run barrels`           | regenerate the read-only `index.ts` barrels           |
-| `bun run release:bootstrap` | initialize writable Release Please state once         |
-| `bun run release:plan`      | emit the affected component and publication plan      |
-| `bun run version:check`     | verify every package against its owning release unit  |
-| `bun run release`           | commit, annotate, and push one source release request |
-| `bun run release:refresh`   | refresh Release Please PRs, tags, and releases        |
-
-`release` first proves the branch differs from `main`; an unchanged branch exits
-before notes, AI, commits, pushes, or PR creation. It commits dirty source,
-writes custom `--notes` / `--notes-file` content or a bounded Cursor, Codex,
-Claude, then Git fallback to `.release-notes/requests/<branch>.md`, adds one
-request commit, and pushes. The generated workflow creates or updates the source
-PR, merges it directly with `GITHUB_TOKEN`, and dispatches release planning, so
-no UI approval or merge is required. GitHub may briefly record
-`action_required` for the bot-authored PR validation; it is not a required gate.
-
-After the source PR merges, Release Please retains direct conventional semantic
-increments and applies required dependent patches. Reconciliation copies the
-readable request Markdown into one temporary
-`.release-notes/final/<component>-v<version>.md` per affected component and
-deletes the consumed request file in the release PR, then merges that generated
-PR and explicitly dispatches publication. A source merge with no affected
-release units creates no release PR or publication work. Publication applies
-each file to its matching GitHub Release, then removes the temporary notes tree
-in a cleanup commit. Request and final notes never count as source changes.
+| Task                           | What it does                                         |
+| ------------------------------ | ---------------------------------------------------- |
+| `bun run build`                | synth + workspace compile and tests                  |
+| `bun run compile`              | `tsc --build` in each member, in parallel            |
+| `bun run test`                 | `eslint` once, then each member's tests              |
+| `bun run sync`                 | re-synth (`--watch` to keep synthing)                |
+| `bun run barrels`              | regenerate the read-only `index.ts` barrels          |
+| `bun run bump`                 | increment `VERSION` and regenerate version surfaces  |
+| `bun run version:check`        | verify every generated version against `VERSION`     |
+| `bun run release`              | validate, open, and automatically merge a release PR |
+| `bun run release --no-approve` | open the release PR without automatic merge          |
+
+`release` commits and pushes pending source work, creates a release worktree,
+increments `VERSION`, synthesizes manifests and registries, runs validation and
+local publication, writes the release summary, and opens one PR. It enables
+automatic merge unless `--no-approve` is supplied. The merged `VERSION` change
+starts publication from the exact `main` SHA and creates one `v<version>` tag;
+the command waits for that workflow by default. Use `--no-wait` to return after
+requesting auto-merge, `--no-validate` to skip repository tests/compile, or
+`--no-local-publish` to skip local registry preflight.
+Version resolution considers both repository tags and historical
+`<component>-v<version>` tags, ensuring a singular release starts above every
+component version left by an independent-version migration.
+The repository host and owner are derived from the Git remote. If the GitHub CLI
+has multiple accounts for that host, release preparation selects the first
+authenticated account with write access to the detected repository. Classic
+tokens must include the `workflow` scope so the release PR can update the
+generated workflow.
 
 The GitHub PR workflow runs the explicit `pr:validate` task through Projen's
 public `BuildWorkflow` `buildTask` option. That task runs synth plus the
@@ -476,10 +467,9 @@ preparation has already run Rust tests, workspace type-checking, and local
 package preflight before opening the PR. JavaScript behavior tests remain an
 explicit developer task.
 
-The generated workflow runs Release Please on the configured branch. A merged
-release PR produces an affected plan, then selected Rust, Python, Node, GitHub
-asset, and docs jobs run behind a publication barrier. A stage with no selected
-outputs is skipped before runner allocation.
+The generated workflow publishes the complete public workspace at the singular
+version. Rust, Python, Node, GitHub asset, and docs stages share the verified tag
+and SHA. Documentation generation runs only on this version-triggered workflow.
 
 Members intentionally keep only the tasks that something OTHER than a human
 invokes, so there is no second place to run the same thing:
@@ -506,14 +496,8 @@ from the root instead.
 
 ## Versioning
 
-`DBXToolsReleaseCatalog` is the language-neutral version seam. It generates
-`.projen/release-units.json` from attached projects, explicit external members,
-UniFFI families, and binary assets. Independent mode reads component versions
-from `.release-please-manifest.json`; fixed mode reads `VERSION`.
-
-Every unit has `.release-units/<component>/source.json`, generated from
-release-affecting inputs. Release Please owns the adjacent `version.txt` and
-`CHANGELOG.md`. Real package manifests remain Projen-owned and reproduce the
-reviewed manifest exactly. `versioningMode: "fixed"` remains the default for
-consumers during migration; `versioningMode: "independent"` enables the
-Release Please and affected-workflow surface.
+`VERSION` is the language-neutral version seam. Real package manifests remain
+Projen-owned and reproduce it exactly across JavaScript, Python, Rust, UniFFI
+bindings, native package metadata, and runtime binary registries. Package and
+artifact discovery still supplies publication order and target inventory; it
+does not create independent version ownership.

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.1";
+export const PACKAGE_VERSION = "0.9.3";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -63,7 +63,7 @@ export { DBXToolsReleaseCatalog } from "./src/release-catalog.ts";
 export type { DBXToolsVersioningMode, ReleaseProjectLanguage, ReleaseArtifactKind, ReleaseEdgeKind, ReleasePropagation, ReleaseUnitRule, DBXToolsReleaseCatalogOptions, ReleaseDependencyInput, ReleaseProjectRegistration, ExternalReleaseProjectRegistration, ReleaseArtifactRegistration, ReleaseProjectNode, ReleaseArtifact, ReleaseDependencyEdge, ReleaseUnit, ReleaseUnitGraph } from "./src/release-catalog.ts";
 export { RELEASE_TAG, RELEASE_SHA, RELEASE_VERSION, RELEASE_SUMMARY_DIRECTORY, RELEASE_SUMMARY_PROVIDER_NAMES, RELEASE_SUMMARY_FILE } from "./src/release-dispatch.ts";
 export type { ReleaseSummaryProviderName } from "./src/release-dispatch.ts";
-export type { GithubRepositoryIdentity } from "./src/release-github.ts";
+export type { GithubRepositoryIdentity, GithubAuthenticatedAccount } from "./src/release-github.ts";
 export type { ReleaseReason, PlannedReleaseUnit, PlannedPackage, PlannedArtifact, PlannedRustTarget, ReleasePlan } from "./src/release-plan.ts";
 export { ReleaseUnitWorkspacePlugin } from "./src/release-please.ts";
 export type { ReleaseUnitWorkspacePluginOptions } from "./src/release-please.ts";

package/package.json

@@ -26,9 +26,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.6.229",
-    "@dbx-tools/path": "^0.6.229",
-    "@dbx-tools/shared-core": "^0.6.229",
+    "@dbx-tools/core": "^0.9.3",
+    "@dbx-tools/path": "^0.9.3",
+    "@dbx-tools/shared-core": "^0.9.3",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -50,7 +50,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-rs.ts

@@ -1,9 +1,9 @@
 /** Filesystem-discovered Rust workspaces and UniFFI binding package wiring. */
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { exec, project as coreProject } from "@dbx-tools/core";
+import { project as coreProject } from "@dbx-tools/core";
 import { string } from "@dbx-tools/shared-core";
 import { Component, Project, TextFile, TomlFile, javascript } from "projen";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
@@ -287,16 +287,39 @@ function smolTomlSource(name: "dist/index.cjs" | "LICENSE"): string {
   );
 }
 
+/** Update only source-less workspace package entries in Cargo.lock. */
+export function synchronizeCargoLockVersions(
+  content: string,
+  packageNames: ReadonlySet<string>,
+  version: string,
+): string {
+  return content
+    .split("[[package]]")
+    .map((block, index) => {
+      if (index === 0 || /^source = /m.test(block)) return block;
+      const name = /^name = "([^"]+)"$/m.exec(block)?.[1];
+      if (!name || !packageNames.has(name)) return block;
+      return block.replace(/^version = "[^"]+"$/m, `version = "${version}"`);
+    })
+    .join("[[package]]");
+}
+
 /** Keep tracked workspace package versions in Cargo.lock aligned with VERSION. */
 class RustWorkspaceVersionLock extends Component {
+  constructor(
+    project: Project,
+    private readonly packageNames: ReadonlySet<string>,
+    private readonly version: string,
+  ) {
+    super(project);
+  }
+
   public override postSynthesize(): void {
-    exec.spawnSync("cargo", ["metadata", "--format-version", "1"], {
-      cwd: this.project.outdir,
-      stdout: "ignore",
-      stderr: "inherit",
-      stdin: "ignore",
-      check: true,
-    });
+    const path = join(this.project.outdir, "Cargo.lock");
+    if (!existsSync(path)) return;
+    const content = readFileSync(path, "utf8");
+    const next = synchronizeCargoLockVersions(content, this.packageNames, this.version);
+    if (next !== content) writeFileSync(path, next);
   }
 }
 
@@ -1011,7 +1034,11 @@ function configureRustWorkspaceFiles(
       },
     },
   });
-  new RustWorkspaceVersionLock(project);
+  new RustWorkspaceVersionLock(
+    project,
+    new Set(packages.map((pkg) => pkg.crateName)),
+    readWorkspaceVersion(project.outdir),
+  );
 }
 
 function configureRustWorkspaceTasks(project: javascript.NodeProject): void {
@@ -1149,6 +1176,18 @@ function configureRustReleaseTask(project: javascript.NodeProject, plan: RustRel
   } else {
     for (const path of supportFiles) project.tryRemoveFile(path);
   }
+  project.addTask("rs:release-fingerprint", {
+    description: "Write the version-independent Rust release build manifest",
+    exec: [
+      "cargo run --quiet --package dbx-tools-release-tools -- fingerprint",
+      ...plan.targets.map(
+        (target) =>
+          `--target ${JSON.stringify(`${String(target.cargo)}|${String(target.cargoExcludes ?? "")}`)}`,
+      ),
+      `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
+      "--portable",
+    ].join(" "),
+  });
 }
 
 function rustBindingCommands(plan: RustReleasePlan, independent: boolean): string[] {
@@ -1329,8 +1368,71 @@ function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep
           "sudo apt-get install --yes libdbus-1-dev pkg-config",
         ].join("\n"),
       },
+      {
+        name: "Verify Rust build fingerprint",
+        if: independentSetup
+          ? undefined
+          : "${{ github.event_name == 'push' || inputs.stage == 'all' }}",
+        ...(!independentSetup ? { id: "rust-fingerprint" } : {}),
+        shell: "bash",
+        run: independentSetup
+          ? [
+              "cargo run --quiet --package dbx-tools-release-tools -- fingerprint --check",
+              '--target "${{ matrix.cargo }}|${{ matrix.cargoExcludes }}"',
+              `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
+              "--portable",
+            ].join(" ")
+          : [
+              'RUNTIME_MANIFEST="dist/rust-raw/rust-build-${{ matrix.node }}.json"',
+              'mkdir -p "$(dirname "$RUNTIME_MANIFEST")"',
+              [
+                "cargo run --quiet --package dbx-tools-release-tools -- fingerprint",
+                '--output "$RUNTIME_MANIFEST"',
+                '--target "${{ matrix.cargo }}|${{ matrix.cargoExcludes }}"',
+                `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
+              ].join(" "),
+              'test "$(jq -r .rustSourceHash "$RUNTIME_MANIFEST")" = "$(jq -r .rustSourceHash .release/rust-build.json)"',
+              'KEY="$(jq -r --arg target "${{ matrix.cargo }}" \'.targets[$target] // empty\' "$RUNTIME_MANIFEST")"',
+              'test -n "$KEY"',
+              'echo "key=$KEY" >> "$GITHUB_OUTPUT"',
+            ].join("\n"),
+      },
+      ...(!independentSetup
+        ? [
+            {
+              name: "Reuse matching raw Rust outputs",
+              id: "raw-native",
+              shell: "bash",
+              env: { GH_TOKEN: "${{ github.token }}" },
+              run: [
+                'KEY="${{ steps.rust-fingerprint.outputs.key }}"',
+                'test -n "$KEY"',
+                'ASSET="rust-raw-${{ matrix.node }}-$KEY.tar.gz"',
+                "mkdir -p dist/rust-raw",
+                'MATCH="$(gh api --paginate "repos/${{ github.repository }}/releases?per_page=100" --jq \'.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "\'"$ASSET"\'") | [$release.tag_name, .url] | @tsv\' | head -n 1)"',
+                'if [ -n "$MATCH" ]; then',
+                "  TAG=\"${MATCH%%$'\\t'*}\"",
+                "  URL=\"${MATCH#*$'\\t'}\"",
+                '  CHECKSUM_URL="$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq \'.assets[] | select(.name == "\'"$ASSET.sha256"\'") | .url\')"',
+                '  rm -rf "target/${{ matrix.cargo }}/release"',
+                '  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then',
+                '    echo "hit=true" >> "$GITHUB_OUTPUT"',
+                "  else",
+                '    rm -rf "target/${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"',
+                '    echo "::warning::matching raw Rust bundle failed validation; rebuilding"',
+                '    echo "hit=false" >> "$GITHUB_OUTPUT"',
+                "  fi",
+                "else",
+                '  echo "hit=false" >> "$GITHUB_OUTPUT"',
+                "fi",
+                'echo "asset=$ASSET" >> "$GITHUB_OUTPUT"',
+              ].join("\n"),
+            },
+          ]
+        : []),
       {
         name: "Build Rust outputs",
+        ...(independentSetup ? {} : { if: "${{ steps.raw-native.outputs.hit != 'true' }}" }),
         shell: "bash",
         env: {
           CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER:
@@ -1343,13 +1445,47 @@ function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep
                 "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
                 "PACKAGE_ARGS=()",
                 'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
-                `cargo build --release "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
+                `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
               ].join("\n")
-            : `cargo build --release --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
+            : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
                 plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
               }`,
         ),
       },
+      ...(!independentSetup
+        ? [
+            {
+              name: "Upload Cargo timings",
+              if: "${{ steps.raw-native.outputs.hit != 'true' }}",
+              uses: "actions/upload-artifact@v7",
+              with: {
+                name: "rust-${{ matrix.node }}-cargo-timings",
+                path: "target/cargo-timings/*",
+                "retention-days": 14,
+              },
+            },
+          ]
+        : []),
+      ...(!independentSetup
+        ? [
+            {
+              name: "Archive raw Rust outputs",
+              if: "${{ steps.raw-native.outputs.hit != 'true' }}",
+              shell: "bash",
+              run: [
+                "mkdir -p dist/rust-raw",
+                'tar -czf "dist/rust-raw/${{ steps.raw-native.outputs.asset }}" "target/${{ matrix.cargo }}/release"',
+                '(cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum "${{ steps.raw-native.outputs.asset }}"; else shasum -a 256 "${{ steps.raw-native.outputs.asset }}"; fi > "${{ steps.raw-native.outputs.asset }}.sha256")',
+              ].join("\n"),
+            },
+            {
+              name: "Stamp native release version",
+              shell: "bash",
+              env: { VERSION: RELEASE_VERSION },
+              run: 'cargo run --quiet --package dbx-tools-release-tools -- stamp-tree --root "target/${{ matrix.cargo }}/release" --version "$VERSION"',
+            },
+          ]
+        : []),
       ...(bindingCommands.length
         ? [
             {
@@ -1369,6 +1505,19 @@ function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep
             },
           ]
         : []),
+      ...(!independentSetup
+        ? [
+            {
+              name: "Upload reusable raw Rust outputs",
+              uses: "actions/upload-artifact@v7",
+              with: {
+                name: "rust-${{ matrix.node }}-raw",
+                path: "dist/rust-raw/*",
+                "retention-days": 7,
+              },
+            },
+          ]
+        : []),
       ...rustArtifactSteps(plan),
     ],
   };
@@ -1464,6 +1613,15 @@ function independentRustGitHubReleaseJob(
           "merge-multiple": true,
         },
       },
+      {
+        name: "Download reusable raw Rust outputs",
+        uses: "actions/download-artifact@v8",
+        with: {
+          pattern: "*-raw",
+          path: "dist/rust-raw",
+          "merge-multiple": true,
+        },
+      },
       {
         name: "Upload affected GitHub release assets",
         env: { GH_TOKEN: "${{ github.token }}" },
@@ -1505,7 +1663,7 @@ function rustGitHubReleaseJob(): Job {
         name: "Publish GitHub release assets",
         uses: "softprops/action-gh-release@v2",
         with: {
-          files: "dist/rust-release/*",
+          files: ["dist/rust-release/*", "dist/rust-raw/*"].join("\n"),
           body_path: RELEASE_SUMMARY_FILE,
           generate_release_notes: true,
           tag_name: RELEASE_TAG,

package/src/release-catalog.ts

@@ -268,12 +268,12 @@ export class DBXToolsReleaseCatalog extends Component {
     this.bootstrapSha = options.bootstrapSha;
     this.rules = [...(options.units ?? [])];
     for (const external of options.externalProjects ?? []) this.registerExternalProject(external);
-    new JsonFile(project, this.graphFile, {
-      marker: false,
-      readonly: true,
-      obj: () => this.graph(),
-    });
     if (this.mode === "independent") {
+      new JsonFile(project, this.graphFile, {
+        marker: false,
+        readonly: true,
+        obj: () => this.graph(),
+      });
       new JsonFile(project, this.releasePleaseConfigFile, {
         marker: false,
         readonly: true,
@@ -284,6 +284,9 @@ export class DBXToolsReleaseCatalog extends Component {
           description: "Bootstrap Release Please state from release units",
         })
         .exec("bun node_modules/@dbx-tools/projen/tasks/release-bootstrap.ts");
+    } else {
+      project.tryRemoveFile(this.graphFile);
+      project.tryRemoveFile(this.releasePleaseConfigFile);
     }
   }
 

package/src/release-github.ts

@@ -1,3 +1,5 @@
+import { json, object } from "@dbx-tools/shared-core";
+
 /** GitHub repository identity used by release preparation. */
 export interface GithubRepositoryIdentity {
   hostname: string;
@@ -19,9 +21,51 @@ export function githubRepositoryIdentity(repositoryUrl: string): GithubRepositor
   };
 }
 
-/** Ask GitHub CLI for the current actor's token on the repository host. */
-export function githubTokenArguments(hostname: string): string[] {
-  return ["auth", "token", "--hostname", hostname];
+/** One authenticated GitHub CLI account available on a repository host. */
+export interface GithubAuthenticatedAccount {
+  login: string;
+  active: boolean;
+  scopes: string[];
+}
+
+/** Parse successful GitHub CLI accounts with the active account first. */
+export function githubAuthenticatedAccounts(
+  statusOutput: string,
+  hostname: string,
+): GithubAuthenticatedAccount[] {
+  const status = json.parseRecord(statusOutput);
+  const hosts = object.isRecord(status?.hosts) ? status.hosts : undefined;
+  const entries = hosts?.[hostname];
+  if (!Array.isArray(entries)) return [];
+  return entries
+    .flatMap((entry) => {
+      if (!object.isRecord(entry) || entry.state !== "success" || typeof entry.login !== "string") {
+        return [];
+      }
+      const scopes =
+        typeof entry.scopes === "string"
+          ? entry.scopes
+              .split(",")
+              .map((scope) => scope.trim())
+              .filter(Boolean)
+          : [];
+      return [{ login: entry.login, active: entry.active === true, scopes }];
+    })
+    .filter(
+      (account, index, accounts) =>
+        accounts.findIndex((candidate) => candidate.login === account.login) === index,
+    )
+    .sort((left, right) => Number(right.active) - Number(left.active));
+}
+
+/** Whether an account can update workflow files when using a classic OAuth token. */
+export function githubAccountSupportsWorkflowChanges(account: GithubAuthenticatedAccount): boolean {
+  return !account.scopes.includes("repo") || account.scopes.includes("workflow");
+}
+
+/** Ask GitHub CLI for one account token on the repository host. */
+export function githubTokenArguments(hostname: string, user?: string): string[] {
+  return ["auth", "token", "--hostname", hostname, ...(user ? ["--user", user] : [])];
 }
 
 /** GitHub CLI token variable for a public, data-residency, or enterprise host. */
@@ -35,3 +79,8 @@ export function githubTokenEnvironmentName(hostname: string): "GH_TOKEN" | "GH_E
 export function githubRepositorySpecifier(identity: GithubRepositoryIdentity): string {
   return `${identity.hostname}/${identity.owner}/${identity.repository}`;
 }
+
+/** GitHub REST path for the detected repository. */
+export function githubRepositoryApiPath(identity: GithubRepositoryIdentity): string {
+  return `repos/${identity.owner}/${identity.repository}`;
+}

package/src/release.ts

@@ -217,11 +217,10 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           "  else",
           "    git fetch --force --tags origin",
           '    LATEST_VERSION=""',
-          `    for TAG in $(git tag --sort=-version:refname --list '${tagPrefix}*'); do`,
-          `      CANDIDATE="\${TAG#${tagPrefix}}"`,
+          `    for TAG in $(git tag --list '${tagPrefix}*' '*-${tagPrefix}*'); do`,
+          `      if [[ "$TAG" == ${tagPrefix}* ]]; then CANDIDATE="\${TAG#${tagPrefix}}"; else CANDIDATE="\${TAG##*-${tagPrefix}}"; fi`,
           '      if [[ "$CANDIDATE" =~ ^[0-9]+\\.[0-9]+\\.[0-9]+$ ]]; then',
-          '        LATEST_VERSION="$CANDIDATE"',
-          "        break",
+          '        if [ -z "$LATEST_VERSION" ] || node -e \'const a=process.argv[1].split(".").map(Number); const b=process.argv[2].split(".").map(Number); process.exit(b[0]>a[0] || b[0]===a[0] && (b[1]>a[1] || b[1]===a[1] && b[2]>a[2]) ? 0 : 1)\' "$LATEST_VERSION" "$CANDIDATE"; then LATEST_VERSION="$CANDIDATE"; fi',
           "      fi",
           "    done",
           '    if [ -n "$LATEST_VERSION" ]; then',
@@ -238,8 +237,6 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           '  test "$(git cat-file -t "$RELEASE_TAG")" = "tag"',
           '  RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"',
           '  test "$(git rev-parse HEAD)" = "$RELEASE_SHA"',
-          '  test "$GITHUB_REF_TYPE" = "tag"',
-          '  test "$GITHUB_REF_NAME" = "$RELEASE_TAG"',
           '  test "$RELEASE_SHA" = "$EXPECTED_SHA"',
           '  if [ -n "${{ inputs.source_run_id }}" ]; then',
           '    case "${{ inputs.stage }}" in node|python) ;; *) exit 1 ;; esac',
@@ -728,6 +725,7 @@ function addIndependentDocsJobs(
     ],
   });
   workflow.addJob("deploy-docs", {
+    if: "${{ always() && needs['build-docs'].result == 'success' }}",
     needs: ["build-docs"],
     environment: {
       name: "github-pages",
@@ -985,7 +983,8 @@ export class DBXToolsRelease extends Component {
                 ].join(" "),
               ),
               receiveArgs: true,
-              description: "Prepare, validate, locally publish, and open a reviewed release PR",
+              description:
+                "Prepare, validate, locally publish, and automatically merge a release PR",
             },
           }
         : {}),

package/src/workspace-version.ts

@@ -137,22 +137,53 @@ export function latestTagVersion(cwd: string, prefix: string): Semver | undefine
   return undefined;
 }
 
+/** Highest historical `<component>-<prefix><semver>` tag, or `undefined`. */
+export function latestComponentTagVersion(cwd: string, prefix: string): Semver | undefined {
+  const marker = `-${prefix}`;
+  const out = gitCapture(cwd, [
+    "-c",
+    "versionsort.suffix=-",
+    "tag",
+    "--sort=-version:refname",
+    "--list",
+    `*${marker}*`,
+  ]);
+  let best: Semver | undefined;
+  for (const tag of out.split("\n")) {
+    const index = tag.lastIndexOf(marker);
+    const raw = index >= 0 ? tag.slice(index + marker.length) : "";
+    if (!/^\d+\.\d+\.\d+$/.test(raw)) continue;
+    const version = parseSemver(raw);
+    if (version && (!best || compareSemver(version, best) > 0)) best = version;
+  }
+  return best;
+}
+
 /**
- * Highest published version across every tag prefix, or `undefined` when the
- * remote is unreachable or no matching tag exists. Fetches tags first (best
- * effort) so a release made elsewhere is respected; a fetch failure just means
- * the local tag list is used, and callers fall back to the `VERSION` file.
+ * Highest published version across repository and historical component tags,
+ * or `undefined` when the remote is unreachable or no matching tag exists.
+ * Fetches tags first (best effort) so a release made elsewhere is respected; a
+ * fetch failure just means the local tag list is used, and callers fall back to
+ * the `VERSION` file.
  */
 export function resolveRemoteVersion(
   cwd: string,
   prefixes: readonly string[],
-  { fetch = true }: { fetch?: boolean } = {},
+  {
+    fetch = true,
+    includeComponentTags = true,
+  }: { fetch?: boolean; includeComponentTags?: boolean } = {},
 ): string | undefined {
   if (fetch) gitCapture(cwd, ["fetch", "--tags", "--quiet"]);
   let best: Semver | undefined;
   for (const prefix of prefixes) {
-    const v = latestTagVersion(cwd, prefix);
-    if (v && (!best || compareSemver(v, best) > 0)) best = v;
+    const versions = [
+      latestTagVersion(cwd, prefix),
+      ...(includeComponentTags ? [latestComponentTagVersion(cwd, prefix)] : []),
+    ];
+    for (const version of versions) {
+      if (version && (!best || compareSemver(version, best) > 0)) best = version;
+    }
   }
   return best ? best.join(".") : undefined;
 }
@@ -165,7 +196,7 @@ export function resolveRemoteVersion(
 export function resolveBaseVersion(
   root: string,
   prefixes: readonly string[],
-  options: { fetch?: boolean } = {},
+  options: { fetch?: boolean; includeComponentTags?: boolean } = {},
 ): { version: string; source: "remote" | "local" } {
   const remote = resolveRemoteVersion(root, prefixes, options);
   if (remote) return { version: remote, source: "remote" };
@@ -177,7 +208,7 @@ export function resolveNextVersion(
   root: string,
   prefixes: readonly string[],
   level: VersionLevel,
-  options: { fetch?: boolean } = {},
+  options: { fetch?: boolean; includeComponentTags?: boolean } = {},
 ): { base: string; version: string; source: "remote" | "local" } {
   const base = resolveBaseVersion(root, prefixes, options);
   const parsed = parseSemver(base.version) ?? [0, 0, 1];

package/tasks/release-pr.ts

@@ -11,7 +11,7 @@ import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { exec, project } from "@dbx-tools/core";
-import { log } from "@dbx-tools/shared-core";
+import { async as asyncModule, json, log, object } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import { publishLocalRelease } from "./local-publish.ts";
 import { generateReleaseSummary } from "./release-summary.ts";
@@ -24,6 +24,9 @@ import {
   type VersionLevel,
 } from "../src/_release-platform.ts";
 import {
+  githubAccountSupportsWorkflowChanges,
+  githubAuthenticatedAccounts,
+  githubRepositoryApiPath,
   githubRepositoryIdentity,
   githubRepositorySpecifier,
   githubTokenArguments,
@@ -33,7 +36,11 @@ import {
   RELEASE_SUMMARY_PROVIDER_NAMES,
   type ReleaseSummaryProviderName,
 } from "../src/release-dispatch.ts";
-import { readWorkspaceVersion, resolveNextVersion } from "../src/workspace-version.ts";
+import {
+  readWorkspaceVersion,
+  resolveBaseVersion,
+  resolveNextVersion,
+} from "../src/workspace-version.ts";
 
 const logger = log.logger("projen:release");
 
@@ -101,38 +108,201 @@ function run(root: string, command: string, args: string[], env?: NodeJS.Process
   });
 }
 
-function runIgnoringStdout(root: string, command: string, args: string[]): void {
-  exec.spawnSync(command, args, {
+/** Run one release command with inherited output and a hard timeout. */
+async function runWithTimeout(
+  root: string,
+  command: string,
+  args: string[],
+  env: NodeJS.ProcessEnv,
+  timeoutMs: number,
+): Promise<void> {
+  await exec.spawn(command, args, {
     cwd: root,
-    stdout: "ignore",
+    env,
+    stdout: "inherit",
     stderr: "inherit",
     stdin: "ignore",
+    signal: AbortSignal.timeout(timeoutMs),
     check: true,
   });
 }
 
+/** Capture one non-interactive command without throwing on a nonzero exit. */
+function captureCommand(
+  root: string,
+  command: string,
+  args: string[],
+  env: NodeJS.ProcessEnv,
+): string {
+  return (
+    exec
+      .spawnSync(command, args, {
+        cwd: root,
+        env,
+        stdout: "capture",
+        stderr: "ignore",
+        stdin: "ignore",
+        check: false,
+      })
+      .stdout?.trim() ?? ""
+  );
+}
+
+/** Wait for required checks and return the merged pull request commit. */
+async function waitForPullRequestMerge(
+  root: string,
+  releaseBranch: string,
+  env: NodeJS.ProcessEnv,
+  timeoutMs: number,
+): Promise<string> {
+  await runWithTimeout(
+    root,
+    "gh",
+    ["pr", "checks", releaseBranch, "--watch", "--fail-fast", "--required", "--interval", "10"],
+    env,
+    timeoutMs,
+  );
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    const state = captureCommand(
+      root,
+      "gh",
+      [
+        "pr",
+        "view",
+        releaseBranch,
+        "--json",
+        "state,mergeCommit",
+        "--jq",
+        '[.state, (.mergeCommit.oid // "")] | @tsv',
+      ],
+      env,
+    );
+    const [status, mergeSha] = state.split("\t");
+    if (status === "MERGED" && mergeSha) return mergeSha;
+    if (status === "CLOSED") throw new Error(`Release pull request closed without merging`);
+    await asyncModule.sleep(2_000);
+  }
+  throw new Error(`Release pull request did not merge within ${timeoutMs}ms`);
+}
+
+/** Find and watch the release workflow for an exact merged commit. */
+async function waitForReleaseWorkflow(
+  root: string,
+  baseBranch: string,
+  mergeSha: string,
+  env: NodeJS.ProcessEnv,
+  timeoutMs: number,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  let runId = "";
+  while (Date.now() < deadline) {
+    runId = captureCommand(
+      root,
+      "gh",
+      [
+        "run",
+        "list",
+        "--workflow",
+        "release.yml",
+        "--branch",
+        baseBranch,
+        "--event",
+        "push",
+        "--commit",
+        mergeSha,
+        "--limit",
+        "1",
+        "--json",
+        "databaseId",
+        "--jq",
+        ".[0].databaseId // empty",
+      ],
+      env,
+    );
+    if (runId) break;
+    await asyncModule.sleep(5_000);
+  }
+  if (!runId) throw new Error(`Release workflow did not start within ${timeoutMs}ms`);
+  await runWithTimeout(root, "gh", ["run", "watch", runId, "--exit-status"], env, timeoutMs);
+}
+
 function githubAccount(root: string): {
   hostname: string;
   owner: string;
   repository: string;
+  login: string;
   token: string;
 } {
   const repository = project.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
   const identity = githubRepositoryIdentity(repository);
-  const token = exec
-    .spawnSync("gh", githubTokenArguments(identity.hostname), {
+  const status = exec
+    .spawnSync("gh", ["auth", "status", "--hostname", identity.hostname, "--json", "hosts"], {
       cwd: root,
       stdout: "capture",
       stderr: "ignore",
       stdin: "ignore",
-      check: true,
+      check: false,
     })
     .stdout?.trim();
-  if (!token) {
-    throw new Error(`No GitHub CLI authentication found for ${identity.hostname}`);
+  const accounts = githubAuthenticatedAccounts(status ?? "", identity.hostname);
+  for (const account of accounts) {
+    if (!githubAccountSupportsWorkflowChanges(account)) continue;
+    const token = exec
+      .spawnSync("gh", githubTokenArguments(identity.hostname, account.login), {
+        cwd: root,
+        stdout: "capture",
+        stderr: "ignore",
+        stdin: "ignore",
+        check: false,
+      })
+      .stdout?.trim();
+    if (!token) continue;
+    const tokenEnvironment = {
+      ...process.env,
+      GH_HOST: identity.hostname,
+      GH_REPO: githubRepositorySpecifier(identity),
+      [githubTokenEnvironmentName(identity.hostname)]: token,
+    };
+    const repositoryResult = exec.spawnSync("gh", ["api", githubRepositoryApiPath(identity)], {
+      cwd: root,
+      env: tokenEnvironment,
+      stdout: "capture",
+      stderr: "ignore",
+      stdin: "ignore",
+      check: false,
+    });
+    const repositoryData =
+      repositoryResult.exitCode === 0 ? json.parseRecord(repositoryResult.stdout ?? "") : undefined;
+    const permissions = object.isRecord(repositoryData?.permissions)
+      ? repositoryData.permissions
+      : undefined;
+    if (
+      permissions?.push !== true &&
+      permissions?.maintain !== true &&
+      permissions?.admin !== true
+    ) {
+      continue;
+    }
+    logger.info("selected GitHub CLI account", {
+      login: account.login,
+      repository: `${identity.owner}/${identity.repository}`,
+    });
+    return { ...identity, login: account.login, token };
   }
-  return { ...identity, token };
+  const detected =
+    accounts
+      .map((account) => {
+        const workflow = githubAccountSupportsWorkflowChanges(account)
+          ? "workflow-capable"
+          : "missing workflow scope";
+        return `${account.login} (${workflow})`;
+      })
+      .join(", ") || "none";
+  throw new Error(
+    `No authenticated GitHub CLI account can write release workflow changes to ${identity.owner}/${identity.repository} on ${identity.hostname}; detected accounts: ${detected}`,
+  );
 }
 
 function releaseSummaryProviders(
@@ -174,8 +344,16 @@ program
     "--release-summary-providers <providers>",
     "comma-separated provider order: cursor,codex,claude",
   )
+  .option("--no-validate", "skip repository validation tasks, Rust tests, and TypeScript compile")
+  .option("--no-local-publish", "skip local npm, PyPI, and Cargo publication")
   .option("--no-local-cargo", "skip local Cargo publication")
-  .option("--approve", "merge the release branch directly into the release base")
+  .option("--no-approve", "open the release pull request without enabling automatic merge")
+  .option("--no-wait", "return after enabling automatic merge without watching publication")
+  .option(
+    "--wait-timeout-minutes <minutes>",
+    "maximum time for pull request checks, merge, and publication",
+    "120",
+  )
   .action(
     async (opts: {
       level: VersionLevel;
@@ -190,14 +368,34 @@ program
       validateTask: string[];
       releaseSummary: boolean;
       releaseSummaryProviders?: string;
+      validate: boolean;
+      localPublish: boolean;
       localCargo: boolean;
       approve: boolean;
+      wait: boolean;
+      waitTimeoutMinutes: string;
     }) => {
       const root = project.root() ?? process.cwd();
+      const waitTimeoutMinutes = object.toNumber(opts.waitTimeoutMinutes, {
+        separators: false,
+        percent: false,
+      });
+      if (
+        waitTimeoutMinutes === undefined ||
+        !Number.isInteger(waitTimeoutMinutes) ||
+        waitTimeoutMinutes <= 0
+      ) {
+        throw new Error("--wait-timeout-minutes must be a positive integer");
+      }
+      const waitTimeoutMs = waitTimeoutMinutes * 60_000;
       const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
       if (!currentBranch) throw new Error("Release preparation requires a local branch");
       const account = githubAccount(root);
       git(root, ["fetch", "--tags", "origin", opts.base]);
+      const comparisonBase = resolveBaseVersion(root, [opts.prefix], {
+        fetch: false,
+        includeComponentTags: false,
+      }).version;
       const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
       const releaseTag = `${opts.prefix}${next.version}`;
       const releaseBranch = `release/${releaseTag}`;
@@ -273,35 +471,40 @@ program
         throw new Error(`Release preparation did not produce ${next.version}`);
       }
 
-      if (existsSync(join(releaseRoot, "Cargo.toml"))) {
-        runIgnoringStdout(releaseRoot, "cargo", ["metadata", "--format-version", "1"]);
-      }
       run(releaseRoot, process.execPath, [versionCheckScript]);
-      for (const task of opts.validateTask) {
-        run(releaseRoot, process.execPath, ["run", task]);
+      if (opts.validate) {
+        for (const task of opts.validateTask) {
+          run(releaseRoot, process.execPath, ["run", task]);
+        }
+        if (existsSync(join(releaseRoot, "Cargo.toml"))) {
+          run(releaseRoot, "cargo", [
+            "test",
+            "--workspace",
+            ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
+          ]);
+        }
+        run(releaseRoot, process.execPath, ["run", "compile"]);
+      } else {
+        logger.warn("release validation skipped by --no-validate");
       }
-      if (existsSync(join(releaseRoot, "Cargo.toml"))) {
-        run(releaseRoot, "cargo", [
-          "test",
-          "--workspace",
-          ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
-        ]);
+      if (opts.localPublish) {
+        await publishLocalRelease({
+          root: releaseRoot,
+          version: next.version,
+          localRegistry: opts.localRegistry,
+          localPypi: opts.localPypi,
+          pythonRoot: opts.pythonRoot,
+          localCargo: opts.localCargo,
+        });
+      } else {
+        logger.info("local publication skipped by --no-local-publish");
       }
-      run(releaseRoot, process.execPath, ["run", "compile"]);
-      await publishLocalRelease({
-        root: releaseRoot,
-        version: next.version,
-        localRegistry: opts.localRegistry,
-        localPypi: opts.localPypi,
-        pythonRoot: opts.pythonRoot,
-        localCargo: opts.localCargo,
-      });
       run(releaseRoot, process.execPath, [versionCheckScript]);
       const releaseSummary = opts.releaseSummary
         ? await generateReleaseSummary({
             root: releaseRoot,
             version: next.version,
-            fromRef: `${opts.prefix}${next.base}`,
+            fromRef: `${opts.prefix}${comparisonBase}`,
             providers: releaseSummaryProviders(opts.releaseSummaryProviders),
           })
         : undefined;
@@ -353,38 +556,29 @@ program
           githubEnvironment,
         );
       };
+      ensurePullRequest();
       if (opts.approve) {
-        const merged = commandSucceeds(
+        run(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], githubEnvironment);
+      }
+      git(root, ["worktree", "remove", "--force", releaseRoot]);
+      git(root, ["branch", "--delete", "--force", releaseBranch]);
+      if (opts.approve && opts.wait) {
+        const mergeSha = await waitForPullRequestMerge(
           root,
-          "gh",
-          [
-            "api",
-            "--method",
-            "POST",
-            `repos/${account.owner}/${account.repository}/merges`,
-            "-f",
-            `base=${opts.base}`,
-            "-f",
-            `head=${releaseBranch}`,
-            "-f",
-            `commit_message=Merge ${releaseTag}`,
-          ],
+          releaseBranch,
           githubEnvironment,
+          waitTimeoutMs,
         );
-        if (!merged) {
-          ensurePullRequest();
-          run(root, "gh", ["pr", "merge", releaseBranch, "--admin", "--merge"], githubEnvironment);
-        }
-        git(releaseRoot, ["push", "--no-verify", "origin", "--delete", releaseBranch]);
-        git(root, ["fetch", "origin", opts.base]);
-        git(root, ["merge", "--ff-only", `origin/${opts.base}`]);
-        git(root, ["push", "origin", currentBranch]);
-      } else {
-        ensurePullRequest();
+        logger.info("release pull request merged", { releaseBranch, mergeSha });
+        await waitForReleaseWorkflow(root, opts.base, mergeSha, githubEnvironment, waitTimeoutMs);
+        logger.success(`published ${releaseTag} from ${mergeSha}`);
+        return;
       }
-      git(root, ["worktree", "remove", "--force", releaseRoot]);
-      git(root, ["branch", "--delete", "--force", releaseBranch]);
-      logger.success(`${opts.approve ? "merged" : "opened"} ${releaseBranch} for ${releaseTag}`);
+      logger.success(
+        `${
+          opts.approve ? "enabled automatic merge for" : "opened"
+        } ${releaseBranch} for ${releaseTag}${opts.approve && !opts.wait ? " without waiting" : ""}`,
+      );
     },
   );
 

package/tasks/release-summary.ts

@@ -126,6 +126,42 @@ function eventDetail(event: Record<string, unknown>): string | undefined {
   return undefined;
 }
 
+function eventToolName(event: Record<string, unknown>): string | undefined {
+  const item = object.isRecord(event.item) ? event.item : undefined;
+  for (const value of [event.tool_name, event.toolName, event.name, item?.tool_name, item?.name]) {
+    if (typeof value === "string") return string.trimToNull(value) ?? undefined;
+  }
+  const toolCall = object.isRecord(event.tool_call)
+    ? event.tool_call
+    : object.isRecord(event.toolCall)
+      ? event.toolCall
+      : undefined;
+  const wrapper = toolCall
+    ? Object.keys(toolCall).find(
+        (key) => key.endsWith("ToolCall") && object.isRecord(toolCall[key]),
+      )
+    : undefined;
+  return wrapper ? wrapper.slice(0, -"ToolCall".length) : undefined;
+}
+
+/** Normalize one provider event into the fields retained in release logs. */
+export function releaseSummaryProviderEvent(event: Record<string, unknown>): {
+  type: string;
+  text?: string;
+  detail?: string;
+  tool?: string;
+} {
+  const text = eventText(event);
+  const detail = eventDetail(event);
+  const tool = eventToolName(event);
+  return {
+    type: eventType(event),
+    ...(text ? { text } : {}),
+    ...(detail ? { detail } : {}),
+    ...(tool ? { tool } : {}),
+  };
+}
+
 async function runProvider(
   provider: ReleaseSummaryProvider,
   root: string,
@@ -133,7 +169,15 @@ async function runProvider(
 ): Promise<string | undefined> {
   if (!capture(root, provider.command, [...provider.probeArgs])) return undefined;
   let summary: string | undefined;
+  let previousEventKey: string | undefined;
   const textOutput: string[] = [];
+  const logEvent = (event: Record<string, unknown>) => {
+    const fields = { provider: provider.name, ...event };
+    const key = JSON.stringify(fields);
+    if (key === previousEventKey) return;
+    previousEventKey = key;
+    logger.info("provider-event", fields);
+  };
   const child = exec.spawn(provider.command, provider.args(root, prompt), {
     cwd: root,
     stdout: [
@@ -144,19 +188,13 @@ async function runProvider(
           const text = string.trimToNull(line);
           if (text) {
             textOutput.push(text);
-            logger.info("provider-event", { provider: provider.name, type: "text", text });
+            logEvent({ type: "text", text });
           }
           return;
         }
-        const text = eventText(event);
-        const detail = eventDetail(event);
-        if (text) summary = text;
-        logger.info("provider-event", {
-          provider: provider.name,
-          type: eventType(event),
-          ...(text ? { text } : {}),
-          ...(detail ? { detail } : {}),
-        });
+        const fields = releaseSummaryProviderEvent(event);
+        if (fields.text) summary = fields.text;
+        logEvent(fields);
       },
     ],
     stderr: (line) => {