@dbx-tools/projen 0.9.12 → 0.9.18

package/src/_rust-release-workflow.ts

@@ -6,7 +6,8 @@ import { fileURLToPath } from "node:url";
 import { stringUtils } from "@dbx-tools/shared-core";
 import { TextFile, javascript } from "projen";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
-import type { RustProject } from "./_rust-project.ts";
+import { releaseBinaryAssetName } from "./_release-platform.ts";
+import { UNIFFI_BINDGEN_FEATURE, type RustProject } from "./_rust-project.ts";
 import { BUN_VERSION } from "./bun-workflow.ts";
 import type { DBXToolsJavaScriptProject } from "./project-js.ts";
 import type {
@@ -35,29 +36,11 @@ const require = createRequire(import.meta.url);
 
 type RustPackageDependencyResolver = (pkg: RustProject) => RustProject[];
 
-const RUST_CACHE_ENV = {
+const RUST_BUILD_ENV = {
   CARGO_INCREMENTAL: "0",
   CARGO_TERM_COLOR: "always",
 } as const;
 
-function rustCacheSteps(sharedKey: string): readonly JobStep[] {
-  return [
-    {
-      name: "Cache Cargo registry and dependencies",
-      id: "cargo_cache",
-      uses: "Swatinem/rust-cache@v2.9.2",
-      with: {
-        "cache-targets": true,
-        "cache-workspace-crates": true,
-        "add-job-id-key": false,
-        "add-rust-environment-hash-key": true,
-        "shared-key": sharedKey,
-        "save-if": "${{ github.event_name == 'push' }}",
-      },
-    },
-  ];
-}
-
 function timedBash(phase: string, command: string): string {
   return [
     "SECONDS=0",
@@ -66,15 +49,6 @@ function timedBash(phase: string, command: string): string {
   ].join("\n");
 }
 
-export function releaseBinaryAssetName(
-  binaryName: string,
-  nodeTarget: string,
-  os: RustReleaseOs | "darwin" | "linux" | "win32",
-): string {
-  const extension = os === "win32" ? "zip" : "tar.gz";
-  return `${binaryName}-${nodeTarget}.${extension}`;
-}
-
 function taskSource(name: string): string {
   const sourceDirectory = dirname(fileURLToPath(import.meta.url));
   const candidates = [
@@ -117,39 +91,84 @@ export function orderRustBindings(bindings: readonly RustBindingMapping[]): Rust
   return ordered;
 }
 
-interface RustReleaseBinding extends RustBindingMapping {
+export interface RustReleaseBinding extends RustBindingMapping {
   readonly node: string;
   readonly python: string;
   readonly nodePackage: string;
   readonly pythonPackage: string;
 }
 
-interface RustReleaseBinaryPlan {
+export interface RustReleaseBinaryPlan {
   readonly crate: string;
   readonly binary: string;
   readonly excludedOs: readonly RustReleaseOs[];
   readonly requiredFeatures: readonly string[];
 }
 
-type RustReleaseTargetPlan = Readonly<Record<string, string | boolean | number>>;
+export interface RustReleaseTargetPlan {
+  readonly runner: string;
+  readonly cargo: string;
+  readonly node: string;
+  readonly python: string;
+  readonly os: RustReleaseOs;
+  readonly cpu: string;
+  readonly libc: string;
+  readonly glibcVersion: string;
+  readonly packages: readonly string[];
+  readonly binaries: readonly string[];
+  readonly features: readonly string[];
+  readonly localFeatures: readonly string[];
+}
+
+/** Generated release inputs shared by GitHub-hosted and local target builds. */
+export interface RustReleaseConfiguration {
+  readonly releaseRustVersion: string;
+  readonly usesCargoLock: boolean;
+  readonly bindings: readonly RustReleaseBinding[];
+  readonly binaries: readonly RustReleaseBinaryPlan[];
+  readonly targets: readonly RustReleaseTargetPlan[];
+}
 
 export interface RustReleasePlan {
   readonly releaseRustVersion: string;
   readonly releaseTask: string;
-  readonly releaseHelper: string;
-  readonly rustRoot: string;
   readonly bindings: readonly RustReleaseBinding[];
   readonly nodeBindings: readonly RustReleaseBinding[];
   readonly releaseBinaries: readonly RustReleaseBinaryPlan[];
   readonly publicCrates: readonly string[];
   readonly targets: readonly RustReleaseTargetPlan[];
-  readonly hasReleaseExclusions: boolean;
   readonly hasPythonBindings: boolean;
   readonly usesCargoLock: boolean;
   readonly usePreinstalledWindowsRust: boolean;
   readonly hasTargetOutputs: boolean;
 }
 
+function releaseTargetPlan(
+  target: UniFFIReleaseTarget,
+  packages: readonly RustProject[],
+  binaries: readonly string[],
+  features: readonly string[],
+  localFeatures: readonly string[],
+): RustReleaseTargetPlan {
+  const packageNames = packages.map((pkg) => pkg.crateName).sort();
+  const sortedBinaries = [...new Set(binaries)].sort();
+  const sortedFeatures = [...new Set(features)].sort();
+  return {
+    runner: target.runner,
+    cargo: target.cargo,
+    node: target.node,
+    python: target.python,
+    os: target.os,
+    cpu: target.cpu,
+    libc: target.libc ?? "",
+    glibcVersion: target.glibcVersion ?? "",
+    packages: packageNames,
+    binaries: sortedBinaries,
+    features: sortedFeatures,
+    localFeatures: [...new Set(localFeatures)].sort(),
+  };
+}
+
 export function planRustRelease(
   project: javascript.NodeProject,
   options: DBXToolsRustWorkspaceOptions,
@@ -195,39 +214,51 @@ export function planRustRelease(
         dependencies: packageDependencies(pkg).map((dependency) => dependency.crateName),
       })),
   ).map((pkg) => pkg.crate);
-  const hasReleaseExclusions = packages.some((pkg) => pkg.packageOptions.releaseExcludeOs?.length);
-  const plannedTargets: RustReleaseTargetPlan[] = targets.map((target) => {
-    const cargoExcludes = packages
-      .filter((pkg) => pkg.packageOptions.releaseExcludeOs?.includes(target.os))
-      .map((pkg) => `--exclude ${pkg.crateName}`)
-      .join(" ");
-    return {
-      runner: target.runner,
-      cargo: target.cargo,
-      node: target.node,
-      python: target.python,
-      os: target.os,
-      cpu: target.cpu,
-      ...(target.libc ? { libc: target.libc } : {}),
-      ...(hasReleaseExclusions ? { cargoExcludes } : {}),
-    };
+  const bindingPackages = packages.filter((pkg) =>
+    bindings.some((binding) => binding.crate === pkg.crateName),
+  );
+  const releaseTargets = targets.flatMap((target) => {
+    const selectedBinaries = releaseBinaries.filter(
+      (binary) => !binary.excludedOs.includes(target.os),
+    );
+    const binaryPackages = packages.filter((pkg) =>
+      selectedBinaries.some((binary) => binary.crate === pkg.crateName),
+    );
+    const selectedPackages = [...new Set([...bindingPackages, ...binaryPackages])];
+    if (!selectedPackages.length) return [];
+    const features = [
+      ...bindingPackages.map((pkg) => `${pkg.crateName}/${UNIFFI_BINDGEN_FEATURE}`),
+      ...selectedBinaries.flatMap((binary) =>
+        binary.requiredFeatures.map((feature) => `${binary.crate}/${feature}`),
+      ),
+    ];
+    const localFeatures = selectedPackages.flatMap((pkg) =>
+      (pkg.packageOptions.releaseLocalFeatures ?? []).map(
+        (feature) => `${pkg.crateName}/${feature}`,
+      ),
+    );
+    return [
+      releaseTargetPlan(
+        target,
+        selectedPackages,
+        selectedBinaries.map((binary) => binary.binary),
+        features,
+        localFeatures,
+      ),
+    ];
   });
-  const hasTargetOutputs =
-    bindings.length > 0 || releaseBinaries.length > 0 || publicCrates.length > 0;
-  if (hasTargetOutputs && plannedTargets.length === 0) {
+  const hasTargetOutputs = releaseTargets.length > 0;
+  if (hasTargetOutputs && targets.length === 0) {
     throw new Error("Rust release requires at least one target");
   }
   return {
     releaseRustVersion,
     releaseTask: ".projen/uniffi-release.mjs",
-    releaseHelper: ".projen/rust-release.mjs",
-    rustRoot: options.root ?? "packages/rs",
     bindings,
     nodeBindings: bindings.filter((binding) => Boolean(binding.node && binding.nodePackage)),
     releaseBinaries,
     publicCrates,
-    targets: plannedTargets,
-    hasReleaseExclusions,
+    targets: releaseTargets,
     hasPythonBindings: bindings.some((binding) => binding.python),
     usesCargoLock: existsSync(join(project.outdir, "Cargo.lock")),
     usePreinstalledWindowsRust: releaseRustVersion === "stable",
@@ -235,19 +266,39 @@ export function planRustRelease(
   };
 }
 
+function rustBuildJobIds(plan: RustReleasePlan): string[] {
+  return plan.targets.length ? ["rust-build"] : [];
+}
+
+function rustBuildResultCondition(plan: RustReleasePlan): string {
+  return rustBuildJobIds(plan)
+    .map((job) => `needs.${job}.result != 'failure' && needs.${job}.result != 'cancelled'`)
+    .join(" && ");
+}
+
 export function configureRustReleaseTask(
   project: javascript.NodeProject,
   plan: RustReleasePlan,
 ): void {
+  new TextFile(project, ".projen/rust-release.json", {
+    lines: JSON.stringify(
+      {
+        releaseRustVersion: plan.releaseRustVersion,
+        usesCargoLock: plan.usesCargoLock,
+        bindings: plan.bindings,
+        binaries: plan.releaseBinaries,
+        targets: plan.targets,
+      } satisfies RustReleaseConfiguration,
+      null,
+      2,
+    ).split("\n"),
+  });
   const bindingSupportFiles = [
     plan.releaseTask,
     ".projen/uniffi-python.js",
     ".projen/smol-toml.cjs",
     ".projen/smol-toml.LICENSE",
   ] as const;
-  new TextFile(project, plan.releaseHelper, {
-    lines: taskSource("rust-release.mjs").trimEnd().split("\n"),
-  });
   if (plan.bindings.length) {
     new TextFile(project, plan.releaseTask, {
       lines: taskSource("uniffi-release.mjs").trimEnd().split("\n"),
@@ -264,20 +315,7 @@ export function configureRustReleaseTask(
   } else {
     for (const path of bindingSupportFiles) project.tryRemoveFile(path);
   }
-  project.addTask("rs:release-fingerprint", {
-    description: "Write the version-independent Rust release build manifest",
-    exec: [
-      `node ${plan.releaseHelper} fingerprint`,
-      "--root .",
-      ...plan.targets.map(
-        (target) =>
-          `--target ${JSON.stringify(`${String(target.cargo)}|${String(target.cargoExcludes ?? "")}`)}`,
-      ),
-      `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
-      `--source ${JSON.stringify(plan.rustRoot)}`,
-      "--portable",
-    ].join(" "),
-  });
+  project.tryRemoveFile(".projen/rust-release.mjs");
 }
 
 function rustBindingCommands(plan: RustReleasePlan, independent: boolean): string[] {
@@ -352,29 +390,6 @@ function rustBinaryCommands(plan: RustReleasePlan, independent: boolean): string
   });
 }
 
-function rustAdditionalBinaryBuildCommands(plan: RustReleasePlan, independent: boolean): string[] {
-  return plan.releaseBinaries
-    .filter((binary) => binary.requiredFeatures.length)
-    .flatMap((binary) => {
-      const command = `cargo build --release --package "${binary.crate}" --bin "${binary.binary}" --features "${binary.requiredFeatures.join(",")}"${
-        plan.usesCargoLock ? " --locked" : ""
-      } --target "\${{ matrix.cargo }}"`;
-      const excludedCondition = binary.excludedOs
-        .map((os) => `[ "\${{ matrix.os }}" != "${os}" ]`)
-        .join(" && ");
-      const platformCommands = excludedCondition
-        ? [`if ${excludedCondition}; then`, `  ${command}`, "fi"]
-        : [command];
-      if (!independent) return platformCommands;
-      const unit = defaultReleaseUnitId("rust", binary.crate);
-      return [
-        `if jq -e --arg unit "${unit}" '.units[] | select(.id == $unit)' dist/release-plan.json >/dev/null; then`,
-        ...platformCommands.map((line) => `  ${line}`),
-        "fi",
-      ];
-    });
-}
-
 function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
   const binaryCrates = [...new Set(plan.releaseBinaries.map((binary) => binary.crate))];
   return [
@@ -428,23 +443,37 @@ function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
   ];
 }
 
+/** Build a Bash loop that preserves matrix values across LF and CRLF runners. */
+function matrixArgumentLoop(variable: string, field: string, flag: string): string {
+  return `while IFS= read -r ${variable}; do ${variable}="\${${variable}%$'\\r'}"; ${variable}_ARGS+=(${flag} "$${variable}"); done < <(jq -r '.[]' <<<'\${{ toJSON(matrix.${field}) }}')`;
+}
+
+function rustCargoBuildCommand(plan: RustReleasePlan): string {
+  return [
+    "PACKAGE_ARGS=()",
+    "FEATURE_ARGS=()",
+    matrixArgumentLoop("PACKAGE", "packages", "--package"),
+    matrixArgumentLoop("FEATURE", "features", "--features"),
+    `cargo build --release --timings "\${PACKAGE_ARGS[@]}" "\${FEATURE_ARGS[@]}"${
+      plan.usesCargoLock ? " --locked" : ""
+    } --target "\${{ matrix.cargo }}"`,
+  ].join("\n");
+}
+
 export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep[]): Job {
-  const bindingCommands = rustBindingCommands(plan, Boolean(independentSetup));
-  const binaryCommands = rustBinaryCommands(plan, Boolean(independentSetup));
-  const additionalBinaryBuildCommands = rustAdditionalBinaryBuildCommands(
-    plan,
-    Boolean(independentSetup),
-  );
+  const independent = Boolean(independentSetup);
+  const bindingCommands = rustBindingCommands(plan, independent);
+  const binaryCommands = rustBinaryCommands(plan, independent);
   return {
     if: independentSetup
       ? "${{ needs.release-plan.outputs.rust_targets != '[]' && (github.event_name == 'push' || inputs.stage != 'docs') }}"
-      : "${{ github.event_name == 'push' || inputs.stage == 'all' }}",
-    name: "${{ matrix.node }}",
+      : "${{ needs.verify-context.outputs.build_mode == 'remote' && (github.event_name == 'push' || inputs.stage == 'all') }}",
+    name: "Rust / ${{ matrix.node }}",
     needs: [independentSetup ? "release-plan" : "verify-context"],
     runsOn: ["${{ matrix.runner }}"],
     permissions: { contents: JobPermission.READ },
     env: {
-      ...RUST_CACHE_ENV,
+      ...RUST_BUILD_ENV,
       ...(independentSetup ? { BUN_VERSION } : {}),
     },
     strategy: {
@@ -452,7 +481,7 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
       matrix: {
         include: independentSetup
           ? ("${{ fromJSON(needs.release-plan.outputs.rust_targets) }}" as never)
-          : [...plan.targets],
+          : ([...plan.targets] as never),
       },
     },
     steps: [
@@ -460,168 +489,28 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
       ...(plan.hasPythonBindings ? [{ name: "Setup uv", uses: "astral-sh/setup-uv@v7" }] : []),
       {
         name: "Setup Rust",
-        ...(plan.usePreinstalledWindowsRust ? { if: "${{ matrix.os != 'win32' }}" } : {}),
         uses: `dtolnay/rust-toolchain@${plan.releaseRustVersion}`,
         with: { targets: "${{ matrix.cargo }}" },
       },
-      ...(plan.usePreinstalledWindowsRust
-        ? [
-            {
-              name: "Verify preinstalled Windows Rust",
-              if: "${{ matrix.os == 'win32' }}",
-              shell: "bash",
-              run: [
-                "rustc --version --verbose",
-                "cargo --version",
-                'rustup target list --installed | grep -Fx "${{ matrix.cargo }}"',
-                'test -f "$(rustc --print sysroot)/lib/rustlib/${{ matrix.cargo }}/bin/rust-lld.exe"',
-              ].join("\n"),
-            },
-          ]
-        : []),
-      {
-        name: "Install LLVM release tools",
-        shell: "bash",
-        run: "rustup component add llvm-tools-preview",
-      },
-      ...rustCacheSteps(`release-\${{ matrix.cargo }}-rust-${plan.releaseRustVersion}`),
       {
         name: "Install Linux native dependencies",
         if: "${{ matrix.os == 'linux' }}",
-        run: [
-          "sudo rm -f /etc/apt/sources.list.d/google-chrome.list",
-          "sudo apt-get update",
-          "sudo apt-get install --yes libdbus-1-dev pkg-config",
-        ].join("\n"),
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+            sudo rm -f /etc/apt/sources.list.d/google-chrome.list
+            sudo apt-get update
+            sudo apt-get install --yes libdbus-1-dev pkg-config
+          `
+          // ============================================================================
+        ),
       },
       {
-        name: "Verify Rust build fingerprint",
-        if: independentSetup
-          ? undefined
-          : "${{ github.event_name == 'push' || inputs.stage == 'all' }}",
-        ...(!independentSetup ? { id: "rust-fingerprint" } : {}),
+        name: "Build Rust release outputs",
         shell: "bash",
-        run: independentSetup
-          ? [
-              `node ${plan.releaseHelper} fingerprint --check --root .`,
-              '--target "${{ matrix.cargo }}|${{ matrix.cargoExcludes }}"',
-              `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
-              `--source ${JSON.stringify(plan.rustRoot)}`,
-              "--portable",
-            ].join(" ")
-          : [
-              'RUNTIME_MANIFEST="dist/rust-raw/rust-build-${{ matrix.node }}.json"',
-              'mkdir -p "$(dirname "$RUNTIME_MANIFEST")"',
-              [
-                `node ${plan.releaseHelper} fingerprint --root .`,
-                '--output "$RUNTIME_MANIFEST"',
-                '--target "${{ matrix.cargo }}|${{ matrix.cargoExcludes }}"',
-                `--toolchain ${JSON.stringify(plan.releaseRustVersion)}`,
-                `--source ${JSON.stringify(plan.rustRoot)}`,
-              ].join(" "),
-              'test "$(jq -r .rustSourceHash "$RUNTIME_MANIFEST")" = "$(jq -r .rustSourceHash .release/rust-build.json)"',
-              'KEY="$(jq -r --arg target "${{ matrix.cargo }}" \'.targets[$target] // empty\' "$RUNTIME_MANIFEST")"',
-              'test -n "$KEY"',
-              'echo "key=$KEY" >> "$GITHUB_OUTPUT"',
-            ].join("\n"),
+        run: timedBash("rust", rustCargoBuildCommand(plan)),
       },
-      ...(!independentSetup
-        ? [
-            {
-              name: "Reuse matching raw Rust outputs",
-              id: "raw-native",
-              shell: "bash",
-              env: { GH_TOKEN: "${{ github.token }}" },
-              // prettier-ignore
-              run: stringUtils.dedent(
-                // ============================================================================
-                /*bash*/`
-                KEY="\${{ steps.rust-fingerprint.outputs.key }}"
-                test -n "$KEY"
-                ASSET="rust-raw-\${{ matrix.node }}-$KEY.tar.gz"
-                mkdir -p dist/rust-raw
-                MATCH="$(gh api --paginate "repos/\${{ github.repository }}/releases?per_page=100" --jq '.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "'"$ASSET"'") | [$release.tag_name, .url] | @tsv' | head -n 1)"
-                if [ -n "$MATCH" ]; then
-                  TAG="\${MATCH%%$'\\t'*}"
-                  URL="\${MATCH#*$'\\t'}"
-                  CHECKSUM_URL="$(gh api "repos/\${{ github.repository }}/releases/tags/$TAG" --jq '.assets[] | select(.name == "'"$ASSET.sha256"'") | .url')"
-                  rm -rf "target/\${{ matrix.cargo }}/release"
-                  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then
-                    echo "hit=true" >> "$GITHUB_OUTPUT"
-                  else
-                    rm -rf "target/\${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"
-                    echo "::warning::matching raw Rust bundle failed validation; rebuilding"
-                    echo "hit=false" >> "$GITHUB_OUTPUT"
-                  fi
-                else
-                  echo "hit=false" >> "$GITHUB_OUTPUT"
-                fi
-                echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
-              `
-                // ============================================================================
-              ),
-            },
-          ]
-        : []),
-      {
-        name: "Build Rust outputs",
-        ...(independentSetup ? {} : { if: "${{ steps.raw-native.outputs.hit != 'true' }}" }),
-        shell: "bash",
-        env: {
-          CARGO_TARGET_X86_64_PC_WINDOWS_MSVC_LINKER:
-            "${{ matrix.os == 'win32' && 'rust-lld' || '' }}",
-        },
-        run: timedBash(
-          "rust_workspace",
-          [
-            independentSetup
-              ? [
-                  "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
-                  "PACKAGE_ARGS=()",
-                  'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
-                  `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
-                ].join("\n")
-              : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
-                  plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
-                }`,
-            ...additionalBinaryBuildCommands,
-          ].join("\n"),
-        ),
-      },
-      ...(!independentSetup
-        ? [
-            {
-              name: "Upload Cargo timings",
-              if: "${{ steps.raw-native.outputs.hit != 'true' }}",
-              uses: "actions/upload-artifact@v7",
-              with: {
-                name: "rust-${{ matrix.node }}-cargo-timings",
-                path: "target/cargo-timings/*",
-                "retention-days": 14,
-              },
-            },
-          ]
-        : []),
-      ...(!independentSetup
-        ? [
-            {
-              name: "Archive raw Rust outputs",
-              if: "${{ steps.raw-native.outputs.hit != 'true' }}",
-              shell: "bash",
-              run: [
-                "mkdir -p dist/rust-raw",
-                'tar -czf "dist/rust-raw/${{ steps.raw-native.outputs.asset }}" "target/${{ matrix.cargo }}/release"',
-                '(cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum "${{ steps.raw-native.outputs.asset }}"; else shasum -a 256 "${{ steps.raw-native.outputs.asset }}"; fi > "${{ steps.raw-native.outputs.asset }}.sha256")',
-              ].join("\n"),
-            },
-            {
-              name: "Stamp native release version",
-              shell: "bash",
-              env: { VERSION: RELEASE_VERSION },
-              run: `node ${plan.releaseHelper} stamp-tree --root "target/\${{ matrix.cargo }}/release" --version "$VERSION"`,
-            },
-          ]
-        : []),
       ...(bindingCommands.length
         ? [
             {
@@ -641,31 +530,53 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
             },
           ]
         : []),
-      ...(!independentSetup
-        ? [
-            {
-              name: "Upload reusable raw Rust outputs",
-              uses: "actions/upload-artifact@v7",
-              with: {
-                name: "rust-${{ matrix.node }}-raw",
-                path: "dist/rust-raw/*",
-                "retention-days": 7,
-              },
-            },
-          ]
-        : []),
       ...rustArtifactSteps(plan),
     ],
   };
 }
 
+/** Wait for the selected local or GitHub-hosted native build source. */
+export function rustAssetsJob(): Job {
+  return {
+    if: "${{ always() && needs.verify-context.result == 'success' && (needs.verify-context.outputs.build_mode == 'local' || needs.rust-build.result == 'success') }}",
+    needs: ["verify-context", "rust-build"],
+    runsOn: ["ubuntu-latest"],
+    permissions: { contents: JobPermission.READ },
+    steps: [
+      {
+        name: "Wait for locally uploaded release assets",
+        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
+        env: {
+          GH_TOKEN: "${{ github.token }}",
+          RELEASE_TAG: RELEASE_TAG,
+        },
+        shell: "bash",
+        run: [
+          "mkdir -p dist/local-release",
+          "for ATTEMPT in $(seq 1 360); do",
+          '  if gh release download "$RELEASE_TAG" --pattern rust-assets.json --dir dist/local-release --clobber; then exit 0; fi',
+          '  echo "waiting for local release assets ($ATTEMPT/360)"',
+          "  sleep 5",
+          "done",
+          'echo "::error::local release assets were not uploaded"',
+          "exit 1",
+        ].join("\n"),
+      },
+      {
+        name: "Confirm native release assets",
+        run: "true",
+      },
+    ],
+  };
+}
+
 export function rustCargoPublishJob(plan: RustReleasePlan, local: boolean): Job {
   const registry = local ? '"${{ vars.LOCAL_CARGO_REGISTRY }}"' : "crates-io";
   return {
     if: local
       ? "${{ github.event_name == 'push' && vars.LOCAL_REPOSITORIES == 'true' }}"
       : "${{ github.event_name == 'push' }}",
-    needs: ["verify-context", "rust-build"],
+    needs: ["verify-context", ...(plan.hasTargetOutputs ? ["rust-assets"] : [])],
     runsOn: [local ? "self-hosted" : "ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
     steps: [
@@ -705,11 +616,12 @@ export function independentRustCargoPublishJob(
       "fi",
     ].join("\n"),
   );
+  const buildCondition = rustBuildResultCondition(plan);
   return {
     if: plan.hasTargetOutputs
-      ? "${{ always() && needs.release-plan.outputs.rust == 'true' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'rust') }}"
+      ? `\${{ always() && needs.release-plan.outputs.rust == 'true' && ${buildCondition} && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'rust') }}`
       : "${{ needs.release-plan.outputs.rust == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'rust') }}",
-    needs: ["release-plan", ...(plan.hasTargetOutputs ? ["rust-build"] : [])],
+    needs: ["release-plan", ...rustBuildJobIds(plan)],
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
     env: { BUN_VERSION },
@@ -734,7 +646,7 @@ export function independentRustGitHubReleaseJob(
 ): Job {
   return {
     if: "${{ needs.release-plan.outputs.github == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'github') }}",
-    needs: ["release-plan", "rust-build"],
+    needs: ["release-plan", ...rustBuildJobIds(plan)],
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.WRITE },
     env: { BUN_VERSION },
@@ -749,15 +661,6 @@ export function independentRustGitHubReleaseJob(
           "merge-multiple": true,
         },
       },
-      {
-        name: "Download reusable raw Rust outputs",
-        uses: "actions/download-artifact@v8",
-        with: {
-          pattern: "*-raw",
-          path: "dist/rust-raw",
-          "merge-multiple": true,
-        },
-      },
       {
         name: "Upload affected GitHub release assets",
         env: { GH_TOKEN: "${{ github.token }}" },
@@ -778,16 +681,17 @@ export function independentRustGitHubReleaseJob(
   };
 }
 
-export function rustGitHubReleaseJob(): Job {
+export function rustGitHubReleaseJob(plan: RustReleasePlan): Job {
   return {
     if: "${{ github.event_name == 'push' }}",
-    needs: ["verify-context", "rust-build"],
+    needs: ["verify-context", ...(plan.hasTargetOutputs ? ["rust-assets"] : [])],
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.WRITE },
     steps: [
       ...releaseSourceSteps(),
       {
         name: "Download release binaries",
+        if: "${{ needs.verify-context.outputs.build_mode == 'remote' }}",
         uses: "actions/download-artifact@v8",
         with: {
           pattern: "*-binary",
@@ -795,20 +699,12 @@ export function rustGitHubReleaseJob(): Job {
           "merge-multiple": true,
         },
       },
-      {
-        name: "Download reusable raw Rust outputs",
-        uses: "actions/download-artifact@v8",
-        with: {
-          pattern: "*-raw",
-          path: "dist/rust-raw",
-          "merge-multiple": true,
-        },
-      },
       {
         name: "Publish GitHub release assets",
+        if: "${{ needs.verify-context.outputs.build_mode == 'remote' }}",
         uses: "softprops/action-gh-release@v2",
         with: {
-          files: ["dist/rust-release/*", "dist/rust-raw/*"].join("\n"),
+          files: "dist/rust-release/*",
           body_path: RELEASE_SUMMARY_FILE,
           generate_release_notes: true,
           tag_name: RELEASE_TAG,
@@ -816,51 +712,14 @@ export function rustGitHubReleaseJob(): Job {
         },
       },
       {
-        name: "Delete superseded raw Rust release assets",
-        uses: "actions/github-script@v8",
-        env: { CURRENT_RELEASE_TAG: RELEASE_TAG },
-        with: {
-          // prettier-ignore
-          script: stringUtils.dedent(
-            // ============================================================================
-            /*js*/`
-            const currentTag = process.env.CURRENT_RELEASE_TAG;
-            if (!currentTag) throw new Error("CURRENT_RELEASE_TAG is required");
-            const parseVersion = (tag) => {
-              const match = /^v(\\d+)\\.(\\d+)\\.(\\d+)$/.exec(tag);
-              return match ? match.slice(1).map(Number) : undefined;
-            };
-            const compareVersions = (left, right) => {
-              for (let index = 0; index < 3; index += 1) {
-                if (left[index] !== right[index]) return left[index] - right[index];
-              }
-              return 0;
-            };
-            const currentVersion = parseVersion(currentTag);
-            if (!currentVersion) throw new Error(\`Unsupported release tag: \${currentTag}\`);
-            const releases = await github.paginate(github.rest.repos.listReleases, {
-              ...context.repo,
-              per_page: 100,
-            });
-            const assets = releases.flatMap((release) => {
-              const version = parseVersion(release.tag_name);
-              if (release.draft || !version || compareVersions(version, currentVersion) >= 0) {
-                return [];
-              }
-              return release.assets.filter((asset) => /^rust-(?:raw|build)-/.test(asset.name));
-            });
-            for (const asset of assets) {
-              core.info(\`Deleting \${asset.name} (\${asset.id})\`);
-              await github.rest.repos.deleteReleaseAsset({
-                ...context.repo,
-                asset_id: asset.id,
-              });
-            }
-            core.info(\`Deleted \${assets.length} superseded raw Rust release assets\`);
-          `
-            // ============================================================================
-          ),
+        name: "Publish locally built GitHub release",
+        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
+        env: {
+          GH_TOKEN: "${{ github.token }}",
+          RELEASE_NOTES: RELEASE_SUMMARY_FILE,
+          RELEASE_TAG,
         },
+        run: 'gh release edit "$RELEASE_TAG" --draft=false --latest --notes-file "$RELEASE_NOTES"',
       },
     ],
   };
@@ -932,8 +791,8 @@ export function independentRustNodeFacadePublishJob(
 
 export function rustNativeNpmPublishJob(project: DBXToolsJavaScriptProject): Job {
   return {
-    if: "${{ always() && needs.verify-context.result == 'success' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-    needs: ["verify-context", "rust-build"],
+    if: "${{ always() && needs.verify-context.result == 'success' && needs.rust-assets.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
+    needs: ["verify-context", "rust-assets"],
     runsOn: ["ubuntu-latest"],
     permissions: {
       actions: JobPermission.READ,
@@ -949,7 +808,17 @@ export function rustNativeNpmPublishJob(project: DBXToolsJavaScriptProject): Job
         recoveredName: "Download recovered native npm packages",
         pattern: "*-npm",
         path: "dist/uniffi/native",
+        condition: "needs.verify-context.outputs.build_mode == 'remote'",
       }),
+      {
+        name: "Download locally built native npm packages",
+        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
+        env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
+        run: [
+          "mkdir -p dist/uniffi/native",
+          'gh release download "$RELEASE_TAG" --pattern "*.tgz" --dir dist/uniffi/native',
+        ].join("\n"),
+      },
       {
         name: "Publish native npm packages",
         env: { RELEASE_VERSION, ...npmPublishEnvironment() },