@dbx-tools/projen 0.9.167 → 0.9.173

package/README.md

@@ -626,9 +626,14 @@ and profile are not recorded in the annotated tag.
 
 After bump and configured validation, release writes
 `docs/releases/vX.Y.Z.md` with `dbx genie exec -C "$PWD" --sandbox read-only
---ephemeral -o`. The standard prompt cannot run validation commands. Failures
-fall back to a short git-log summary. Notes are committed with the version bump,
-not stored in the annotated tag, and are omitted for an existing committed bump.
+--ephemeral -o`. It first finds the newest tag whose GitHub Actions release
+workflow succeeded, then asks Genie for cumulative notes from that deployed
+baseline through HEAD. Newer failed-release tags and their notes remain source
+material instead of shortening the delta to a retry-only workflow fix. The
+standard prompt cannot run validation commands. Failures fall back to a short
+git-log summary from the same successful baseline. Notes are committed with the
+version bump, not stored in the annotated tag, and are omitted for an existing
+committed bump.
 
 Automatic installation retains Projen's manifest-based install trigger; the
 other install modes force installation or reuse the current dependency tree.

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.167";
+export const PACKAGE_VERSION = "0.9.173";
 export * as appkitWorkspace from "./src/appkit-workspace.ts";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";

package/package.json

@@ -30,11 +30,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/auth": "^0.9.167",
-    "@dbx-tools/cli-args": "^0.9.167",
-    "@dbx-tools/core": "^0.9.167",
-    "@dbx-tools/path": "^0.9.167",
-    "@dbx-tools/shared-core": "^0.9.167",
+    "@dbx-tools/auth": "^0.9.173",
+    "@dbx-tools/cli-args": "^0.9.173",
+    "@dbx-tools/core": "^0.9.173",
+    "@dbx-tools/path": "^0.9.173",
+    "@dbx-tools/shared-core": "^0.9.173",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -56,7 +56,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.167",
+  "version": "0.9.173",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/tasks/publish.ts

@@ -50,6 +50,7 @@ import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:pa
 import { log, mapConcurrent, sequence } from "@dbx-tools/shared-core";
 import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions, taskPositionals, taskRoot } from "./cli.ts";
+import { publishNpmArchives } from "./publish-npm.ts";
 import {
   TaskConcurrencyOptionSchema,
   TaskDirectoriesOptionSchema,
@@ -59,7 +60,7 @@ import {
 } from "./options.ts";
 import { runTaskCommand } from "../src/_task-command.ts";
 import { applyPublishConfig, packNpmPackage } from "../src/npm-packaging.ts";
-import { publishNpmArchive, readNpmArchiveIdentity } from "../src/npm-release.ts";
+import { readNpmArchiveIdentity } from "../src/npm-release.ts";
 import { recordedPackages } from "../src/packages.ts";
 
 const logger = log.logger("projen:publish");
@@ -212,58 +213,52 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
     }
   }
 
-  logger.info(
-    `${output ? "packing" : dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
-  );
-  if (output) {
-    rmSync(output, { recursive: true, force: true });
-    mkdirSync(output, { recursive: true });
-  }
-  await mapConcurrent(
-    publishable,
-    async ({ dir, name, version: packageVersion, access }) => {
-      const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
-      try {
-        const archive = packNpmPackage(dir, packed, path, applyPublishConfig);
-        const local = readNpmArchiveIdentity(archive);
-        if (local.name !== name || local.version !== packageVersion) {
-          throw new Error(
-            `Packed npm identity ${local.name}@${local.version} does not match ${name}@${packageVersion}`,
-          );
-        }
-        if (local.access !== access) {
-          throw new Error(
-            `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
-          );
-        }
-        if (output) {
-          const destination = join(output, archive.split(/[\\/]/).at(-1)!);
+  logger.info(`packing ${publishable.length} packages with concurrency ${concurrency}`);
+  const archiveDirectory = output ?? mkdtempSync(join(tmpdir(), "projen-npm-publish-"));
+  if (output) rmSync(archiveDirectory, { recursive: true, force: true });
+  mkdirSync(archiveDirectory, { recursive: true });
+  try {
+    await mapConcurrent(
+      publishable,
+      async ({ dir, name, version: packageVersion, access }) => {
+        const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
+        try {
+          const archive = packNpmPackage(dir, packed, path, applyPublishConfig);
+          const local = readNpmArchiveIdentity(archive);
+          if (local.name !== name || local.version !== packageVersion) {
+            throw new Error(
+              `Packed npm identity ${local.name}@${local.version} does not match ${name}@${packageVersion}`,
+            );
+          }
+          if (local.access !== access) {
+            throw new Error(
+              `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
+            );
+          }
+          const destination = join(archiveDirectory, archive.split(/[\\/]/).at(-1)!);
           if (existsSync(destination)) {
             throw new Error(`Duplicate npm archive name: ${destination}`);
           }
           copyFileSync(archive, destination);
           logger.info(`packed ${name} @ ${packageVersion}`);
-          return;
+        } finally {
+          rmSync(packed, { recursive: true, force: true });
         }
-        const outcome = await publishNpmArchive({
-          archive,
-          identity: local,
-          cwd: dir,
-          dryRun,
-          env: { ...process.env, PATH: path },
-          registry,
-        });
-        if (outcome === "skipped") {
-          logger.info(`skip published ${name} @ ${packageVersion}`);
-          return;
-        }
-        logger.info(`${dryRun ? "dry-run published" : "published"} ${name} @ ${packageVersion}`);
-      } finally {
-        rmSync(packed, { recursive: true, force: true });
-      }
-    },
-    { concurrency, errorMode: "settle" },
-  );
+      },
+      { concurrency, errorMode: "settle" },
+    );
+    if (!output) {
+      await publishNpmArchives({
+        concurrency,
+        directory: archiveDirectory,
+        dryRun,
+        registry,
+        version,
+      });
+    }
+  } finally {
+    if (!output) rmSync(archiveDirectory, { recursive: true, force: true });
+  }
   logger.success(
     `${output || dryRun ? "packed" : "published"} ${publishable.length} packages${output ? ` to ${output}` : ""}`,
   );

package/tasks/release-notes.ts

@@ -16,7 +16,17 @@ import { captureTaskCommand, tryTaskCommand } from "../src/_task-command.ts";
 const logger = log.logger("projen:release-notes");
 
 const GENIE_PROMPT =
-  "Compare HEAD and the working tree against the latest v* tag. Produce concise user-facing release notes. Ignore generated-file churn and test-only changes. Include breaking changes, fixes, and validation results. The configured release validation phase has already completed, so do not run tests or other validation commands and do not invent validation counts. Do not modify files.";
+  "Produce concise user-facing release notes. Ignore generated-file churn and test-only changes. Include breaking changes, fixes, and validation results. The configured release validation phase has already completed, so do not run tests or other validation commands and do not invent validation counts. Do not modify files.";
+
+/** Inputs that define the release-note comparison and optional caller guidance. */
+export interface ReleaseNotesPromptOptions {
+  /** Release tag whose GitHub Actions release workflow most recently succeeded. */
+  readonly successfulTag?: string;
+  /** Extra agent instructions appended after the standard release-note requirements. */
+  readonly instructions?: string;
+  /** Release tag prefix used when no successful GitHub baseline exists. */
+  readonly prefix: string;
+}
 
 /** Inputs for one notes write. */
 export interface WriteReleaseNotesOptions {
@@ -28,15 +38,21 @@ export interface WriteReleaseNotesOptions {
   readonly instructions?: string;
   readonly prefix: string;
   readonly root: string;
+  /** Release tag whose GitHub Actions release workflow most recently succeeded. */
+  readonly successfulTag?: string;
   readonly version: string;
   /** Override Genie invocation; return false to force the git-log fallback. */
   readonly runGenie?: (args: readonly string[]) => boolean;
 }
 
-/** Compose the stable release-note prompt with optional caller guidance. */
-export function releaseNotesPrompt(instructions?: string): string {
-  const additional = instructions?.trim();
-  return additional ? `${GENIE_PROMPT}\n\nAdditional instructions:\n${additional}` : GENIE_PROMPT;
+/** Compose the stable release-note prompt with the deployed baseline and caller guidance. */
+export function releaseNotesPrompt(options: ReleaseNotesPromptOptions): string {
+  const baseline = options.successfulTag
+    ? `The latest GitHub release workflow that completed successfully is ${options.successfulTag}. Compare ${options.successfulTag}..HEAD plus the working tree. Treat any newer ${options.prefix}* tags and their release-note files as failed release attempts: combine their user-facing changes into this release, verify them against the cumulative code delta, and do not shorten the comparison to those failed tags. Do not reduce the notes to retry-only deployment or workflow fixes such as \"changed workflow X\" when unreleased product changes are part of the same cumulative delta.`
+    : `No successful GitHub release workflow baseline was found. Do not assume the latest ${options.prefix}* tag deployed successfully. Inspect the available release-note files, tags, git history, HEAD, and the working tree, then produce cumulative notes for the user-facing changes not known to have shipped successfully. Do not reduce the notes to retry-only deployment or workflow fixes when unreleased product changes are present.`;
+  const prompt = `${baseline}\n\n${GENIE_PROMPT}`;
+  const additional = options.instructions?.trim();
+  return additional ? `${prompt}\n\nAdditional instructions:\n${additional}` : prompt;
 }
 
 /** Path of the notes file for one workspace version. */
@@ -92,7 +108,11 @@ export function writeReleaseNotes(options: WriteReleaseNotesOptions): string {
     "--ephemeral",
     "-o",
     relative,
-    releaseNotesPrompt(options.instructions),
+    releaseNotesPrompt({
+      instructions: options.instructions,
+      prefix,
+      successfulTag: options.successfulTag,
+    }),
   ] as const;
   const ran =
     options.runGenie?.([...genieArgs]) ??
@@ -101,20 +121,14 @@ export function writeReleaseNotes(options: WriteReleaseNotesOptions): string {
     logger.info("wrote Genie release notes", { path: relative });
     return destination;
   }
-  const previousTag = captureTaskCommand(root, "git", [
-    "describe",
-    "--tags",
-    "--abbrev=0",
-    `--match=${prefix}*`,
-  ]);
-  const logArgs = previousTag
-    ? ["log", "--no-merges", "--pretty=format:%s", `${previousTag}..HEAD`]
+  const logArgs = options.successfulTag
+    ? ["log", "--no-merges", "--pretty=format:%s", `${options.successfulTag}..HEAD`]
     : ["log", "--no-merges", "--pretty=format:%s", "-15"];
   const commits = captureTaskCommand(root, "git", logArgs)
     .split("\n")
     .map((line) => line.trim())
     .filter(Boolean);
-  writeFileSync(destination, fallbackReleaseNotes(version, commits, previousTag || undefined));
+  writeFileSync(destination, fallbackReleaseNotes(version, commits, options.successfulTag));
   logger.warn("Genie release notes unavailable; wrote git-log summary", { path: relative });
   return destination;
 }

package/tasks/release.ts

@@ -81,6 +81,18 @@ export type ReleaseGithubActionsWatcher = (
   options: WatchReleaseGithubActionsOptions,
 ) => Promise<void>;
 
+/** Inputs required to find the newest successfully deployed release tag. */
+export interface ResolveSuccessfulReleaseTagOptions {
+  readonly account: ProjectGhAccount;
+  readonly prefix: string;
+  readonly root: string;
+}
+
+/** Successful release lookup boundary replaceable by release tests. */
+export type SuccessfulReleaseTagResolver = (
+  options: ResolveSuccessfulReleaseTagOptions,
+) => string | undefined;
+
 function githubRepository(account: ProjectGhAccount): string {
   return account.host === "github.com"
     ? account.remote.repository
@@ -146,6 +158,61 @@ function reportGithubProgress(
   }
 }
 
+/** Find the newest release tag whose GitHub Actions release workflow succeeded. */
+export function resolveSuccessfulReleaseTag(
+  options: ResolveSuccessfulReleaseTagOptions,
+): string | undefined {
+  const { account, prefix, root } = options;
+  const output = captureTaskCommand(
+    root,
+    "gh",
+    [
+      "run",
+      "list",
+      "--repo",
+      githubRepository(account),
+      "--workflow",
+      RELEASE_WORKFLOW_FILE,
+      "--event",
+      "push",
+      "--status",
+      "success",
+      "--limit",
+      "100",
+      "--json",
+      "databaseId,headBranch,headSha,status,url",
+    ],
+    { env: account.env, stderr: "inherit" },
+  );
+  const parsed = z.array(GithubReleaseRunSchema).safeParse(parse(output, []));
+  if (!parsed.success) {
+    logger.warn("GitHub returned invalid successful release workflow metadata", {
+      error: parsed.error,
+      repository: account.remote.repository,
+    });
+    return undefined;
+  }
+  for (const run of parsed.data) {
+    if (!run.headBranch.startsWith(prefix)) continue;
+    const tagHead = gitHead(root, `refs/tags/${run.headBranch}^{}`);
+    if (tagHead !== run.headSha) continue;
+    if (!taskCommandSucceeds(root, "git", ["merge-base", "--is-ancestor", tagHead, "HEAD"])) {
+      continue;
+    }
+    logger.info("using successful GitHub release as the release-note baseline", {
+      repository: account.remote.repository,
+      runId: run.databaseId,
+      tag: run.headBranch,
+      url: run.url,
+    });
+    return run.headBranch;
+  }
+  logger.info("no successful GitHub release baseline was found", {
+    repository: account.remote.repository,
+  });
+  return undefined;
+}
+
 /** Whether this release selection has remote work worth watching. */
 export function shouldWatchReleaseGithubActions(
   options: Pick<ReleaseSelectionOptions, "publish"> & { readonly watchGithubActions?: boolean },
@@ -247,7 +314,8 @@ export async function watchReleaseGithubActions(
         root,
         "gh",
         ["run", "view", String(run.databaseId), "--repo", repository, "--log-failed"],
-        { env: account.env },
+        // gh pipes TTY log output through its pager; release logs must stream inline.
+        { env: { ...account.env, GH_PAGER: "cat" } },
       );
     }
   } catch (error) {
@@ -482,11 +550,21 @@ export async function runRelease(
     readonly watchGithubActions?: boolean;
     readonly githubActionsWatcher?: ReleaseGithubActionsWatcher;
     readonly resolveGithubAccount?: typeof resolveProjectGhAccount;
+    readonly resolveSuccessfulReleaseTag?: SuccessfulReleaseTagResolver;
   },
 ): Promise<string> {
   const { branch, prefix, remote, root } = options;
   const selection = releaseStepSelection(options);
   const install = options.install ?? "auto";
+  let githubAccount: ProjectGhAccount | undefined;
+  let githubAccountResolved = false;
+  const getGithubAccount = (): ProjectGhAccount | undefined => {
+    if (!githubAccountResolved) {
+      githubAccount = (options.resolveGithubAccount ?? resolveProjectGhAccount)(root, { remote });
+      githubAccountResolved = true;
+    }
+    return githubAccount;
+  };
 
   if (options.releaseNotesText !== undefined && options.releaseNotesFile !== undefined) {
     throw new Error("--release-notes-text and --release-notes-file are mutually exclusive");
@@ -539,9 +617,25 @@ export async function runRelease(
     runTaskCommand(root, "bun", ["run", task]);
   }
   if ((options.releaseNotes ?? true) && (options.bump ?? true)) {
+    let successfulTag: string | undefined;
+    if (options.releaseNotesText === undefined && options.releaseNotesFile === undefined) {
+      const account = getGithubAccount();
+      if (account) {
+        successfulTag = (options.resolveSuccessfulReleaseTag ?? resolveSuccessfulReleaseTag)({
+          account,
+          prefix,
+          root,
+        });
+      } else {
+        logger.info("successful GitHub release baseline is unavailable: no authenticated account", {
+          remote,
+        });
+      }
+    }
     (options.writeReleaseNotes ?? writeReleaseNotes)({
       prefix,
       root,
+      successfulTag,
       version,
       content: options.releaseNotesText,
       file: options.releaseNotesFile,
@@ -619,9 +713,7 @@ export async function runRelease(
   }
 
   if (shouldWatchReleaseGithubActions(options, selection)) {
-    const account = (options.resolveGithubAccount ?? resolveProjectGhAccount)(root, {
-      remote,
-    });
+    const account = getGithubAccount();
     if (account) {
       await (options.githubActionsWatcher ?? watchReleaseGithubActions)({
         account,