@dbx-tools/projen 0.9.17 → 0.9.19

package/src/project-js.ts

@@ -1064,18 +1064,14 @@ class GeneratedSource extends Component {
  *
  * projen gives a monorepo root empty `compile`/`test` tasks - a child's tasks
  * are the child's business - so `bun run build` at the root type-checked nothing
- * and ran no package tests. The fan-out is delegated to bun's own workspace
- * filter rather than one `exec` per member, which matters three ways: bun runs
- * the members in PARALLEL (measured ~2.5x faster across this repo than the
- * sequential per-`cwd` form), a member that does not define the script is
- * skipped instead of needing a guard, and the filter reads the workspace from
- * `package.json` - so it stays correct when a package is added without a
- * re-synth. A non-zero member exit still fails the run.
+ * and ran no package tests. Compilation groups ordinary `tsc --build` members
+ * into a few TypeScript processes and runs custom compile tasks alongside them. Tests
+ * still use Bun's filtered workspace fan-out. Both read the current workspace
+ * list from `package.json`, so a newly added member needs no re-synth.
  *
- * `*` matches every workspace MEMBER and never the root itself, so the root
+ * `*` matches every workspace MEMBER and never the root itself, so the test
  * task delegating to it cannot recurse. Members declared outside the scanned
- * package roots (`extraWorkspaceMembers`) are workspace members too, so they are
- * covered by the same filter.
+ * package roots (`extraWorkspaceMembers`) are covered by both tasks.
  */
 class WorkspaceValidationTasks extends Component {
   private configured = false;
@@ -1087,9 +1083,8 @@ class WorkspaceValidationTasks extends Component {
     if (project.subprojects.length === 0 && project.extraWorkspaceMembers.length === 0) {
       return;
     }
-    for (const task of [project.compileTask, project.testTask]) {
-      task.exec(`bun run --filter '*' ${task.name}`);
-    }
+    project.compileTask.exec(taskScript(project, "compile-workspace.ts"));
+    project.testTask.exec("bun run --filter '*' test");
   }
 }
 

package/src/project-py.ts

@@ -4,14 +4,19 @@ import { stringUtils } from "@dbx-tools/shared-core";
 import { Component, License, TextFile, type Project, javascript, python, vscode } from "projen";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
-import { DBX_TOOLS_LICENSE, projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
+import { DBX_TOOLS_LICENSE, projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
-import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
+import {
+  RELEASE_SHA,
+  RELEASE_TAG,
+  RELEASE_VERSION,
+  releaseSourceSteps,
+} from "./release-dispatch.ts";
 import {
   independentReleaseSetupSteps,
   registerIndependentPublicationJob,
-  releaseArtifactSteps,
+  releaseTagPattern,
   releasePublishCondition,
   releaseStageCondition,
   tryReleaseWorkflow,
@@ -465,9 +470,9 @@ export class DBXToolsPythonWorkspace extends Component {
     if (project.releaseCatalog.mode === "independent") {
       workflow.addJob("build-python", {
         if: usesRustArtifacts
-          ? "${{ always() && needs.release-plan.outputs.python == 'true' && needs.rust-uniffi.result != 'failure' && needs.rust-uniffi.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
+          ? "${{ always() && needs.release-plan.outputs.python == 'true' && needs.rust-build.result != 'failure' && needs.rust-build.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
           : "${{ needs.release-plan.outputs.python == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}",
-        needs: ["release-plan", ...(usesRustArtifacts ? ["rust-uniffi"] : [])],
+        needs: ["release-plan", ...(usesRustArtifacts ? ["rust-build"] : [])],
         runsOn: ["ubuntu-latest"],
         permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
         timeoutMinutes: 20,
@@ -545,12 +550,10 @@ export class DBXToolsPythonWorkspace extends Component {
       return;
     }
     workflow.addJob("build-python", {
-      if: usesRustArtifacts
-        ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-uniffi.result != 'failure' && needs.rust-uniffi.result != 'cancelled' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
-        : releaseStageCondition("python"),
-      needs: ["verify-context", ...(usesRustArtifacts ? ["rust-uniffi"] : [])],
+      if: releaseStageCondition("python", ["needs.verify-context.result == 'success'"]),
+      needs: ["verify-context"],
       runsOn: ["ubuntu-latest"],
-      permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
+      permissions: { contents: JobPermission.READ },
       timeoutMinutes: 20,
       env: { BUN_VERSION },
       steps: [
@@ -561,57 +564,60 @@ export class DBXToolsPythonWorkspace extends Component {
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
         { name: "Install release helpers", run: "bun install" },
         bunCacheSaveStep(),
-        ...uniffiPublications.flatMap((publication) =>
-          releaseArtifactSteps({
-            currentName: `Download ${publication.distribution} native wheels`,
-            recoveredName: `Download recovered ${publication.distribution} native wheels`,
-            pattern: `${publication.distribution}--*--python-wheel`,
-            path: `dist/${publication.directory}`,
-          }),
-        ),
         {
-          name: "Stamp workspace versions",
-          env: { VERSION: RELEASE_VERSION },
-          run: `bun node_modules/@dbx-tools/projen/tasks/stamp-python.ts "$VERSION" --root ${quote(this.repository.root)}`,
-        },
-        {
-          name: "Build distributions",
-          run: publications
-            .map(
-              (publication) =>
-                `uv build --package ${publication.distribution} --out-dir dist/${publication.directory}`,
-            )
-            .join("\n"),
+          name: "Download approved Python distributions",
+          env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
+          run: [
+            "rm -rf dist/release-download",
+            "mkdir -p dist/release-download",
+            'gh release download "$RELEASE_TAG" --pattern release-manifest.json --pattern SHA256SUMS --pattern "*.whl" --pattern "*.tar.gz" --dir dist/release-download',
+          ].join("\n"),
         },
-        {
-          name: "Validate distributions",
+        ...allPublications.map((publication) => ({
+          name: `Select ${publication.distribution} distributions`,
+          env: {
+            PACKAGE_NAME: publication.distribution.replaceAll("_", "-").toLowerCase(),
+            RELEASE_SHA,
+            RELEASE_TAG,
+            RELEASE_VERSION,
+          },
           run: [
-            ...publications.map(
-              (publication) =>
-                `test "$(find dist/${publication.directory} -maxdepth 1 -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq 2`,
-            ),
-            ...uniffiPublications.map(
-              (publication) =>
-                `find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .`,
-            ),
-            "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
+            "bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \\",
+            "  --directory dist/release-download \\",
+            '  --tag "$RELEASE_TAG" \\',
+            '  --sha "$RELEASE_SHA" \\',
+            '  --version "$RELEASE_VERSION" \\',
+            "  --kind pypi \\",
+            '  --package "$PACKAGE_NAME" \\',
+            `  --output dist/${publication.directory}`,
           ].join("\n"),
+        })),
+        {
+          name: "Validate approved distributions",
+          run: `find ${allPublications.map((publication) => `dist/${publication.directory}`).join(" ")} -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check`,
         },
         {
           name: "Upload distributions",
           uses: "actions/upload-artifact@v7",
-          with: { name: "python-distributions", path: "dist", "retention-days": 7 },
+          with: {
+            name: "python-distributions",
+            path: allPublications.map((publication) => `dist/${publication.directory}`).join("\n"),
+            "retention-days": 7,
+          },
         },
       ],
     });
     for (const publication of allPublications) {
+      const dependencyJobs = (publication.dependencies ?? []).map(
+        (dependency) => `publish-pypi-${dependency}`,
+      );
       workflow.addJob(`publish-pypi-${publication.directory}`, {
-        if: releasePublishCondition("python"),
-        needs: [
-          "verify-context",
-          "build-python",
-          ...(publication.dependencies ?? []).map((dependency) => `publish-pypi-${dependency}`),
-        ],
+        if: releasePublishCondition("python", [
+          "needs.verify-context.result == 'success'",
+          "needs.build-python.result == 'success'",
+          ...dependencyJobs.map((job) => `needs['${job}'].result == 'success'`),
+        ]),
+        needs: ["verify-context", "build-python", ...dependencyJobs],
         environment: {
           name: publication.environment,
           url:
@@ -691,15 +697,17 @@ export class DBXToolsPythonWorkspace extends Component {
   ): void {
     const repository = this.githubRepository();
     const publications = this.trustedPublisherPublications(options);
-    const releaseBranch = isDBXToolsJavaScriptProject()(project)
-      ? projectReleaseBranch(project)
-      : "main";
+    const releaseTag = isDBXToolsJavaScriptProject()(project)
+      ? project.releaseCatalog.mode === "independent"
+        ? "*-v*"
+        : releaseTagPattern(project)
+      : "v*";
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
       "Use the system browser to audit and configure the PyPI trusted publishers below.",
       "Do not use an in-app browser or embedded webview.",
-      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and tag value is provided below and is authoritative.",
       "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
@@ -717,7 +725,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- The supplied branch policy value is ${releaseBranch}.`,
+      `- The supplied deployment tag policy value is ${releaseTag}.`,
       "- Do not inspect or configure GitHub environments during this task.",
       "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
@@ -758,7 +766,7 @@ export class DBXToolsPythonWorkspace extends Component {
           `- Repository name: ${repository.name}`,
           "- Workflow name: release.yml",
           `- Environment name: ${publication.environment}`,
-          `- GitHub environment branch: ${releaseBranch}`,
+          `- GitHub environment tag: ${releaseTag}`,
           ...(publication.artifacts ? [`- Artifacts: ${publication.artifacts}`] : []),
           "",
         ];

package/src/project-rs.ts

@@ -4,6 +4,7 @@ import { dirname, join, relative, resolve } from "node:path";
 import * as projectUtils from "@dbx-tools/core/project-utils";
 import { stringUtils } from "@dbx-tools/shared-core";
 import { Component, Project, TextFile, TomlFile, javascript } from "projen";
+import { releaseBinaryAssetName } from "./_release-platform.ts";
 import {
   RustProject,
   type CargoExampleOptions as RustCargoExampleOptions,
@@ -25,12 +26,8 @@ import {
   independentRustNodeFacadePublishJob,
   orderRustBindings,
   planRustRelease,
-  releaseBinaryAssetName,
   rustBuildJob,
   rustCargoPublishJob,
-  rustGitHubReleaseJob,
-  rustNativeNpmPublishJob,
-  rustNodeFacadePublishJob,
 } from "./_rust-release-workflow.ts";
 import { toPosix } from "./packages.ts";
 import {
@@ -118,6 +115,7 @@ export interface UniFFIReleaseTarget {
   readonly os: RustReleaseOs;
   readonly cpu: RustReleaseCpu;
   readonly libc?: "glibc";
+  readonly glibcVersion?: string;
 }
 
 /** Native targets built on matching GitHub-hosted runners. */
@@ -130,6 +128,7 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
     os: RustReleaseOs.LINUX,
     cpu: RustReleaseCpu.X64,
     libc: "glibc",
+    glibcVersion: "2.35",
   },
   {
     runner: "ubuntu-24.04-arm",
@@ -139,6 +138,7 @@ export const UNIFFI_RELEASE_TARGETS: readonly UniFFIReleaseTarget[] = [
     os: RustReleaseOs.LINUX,
     cpu: RustReleaseCpu.ARM64,
     libc: "glibc",
+    glibcVersion: "2.39",
   },
   {
     runner: "macos-15-intel",
@@ -1098,17 +1098,8 @@ export class DBXToolsRustWorkspace extends Component {
     }
     configureRustReleaseTask(project, plan);
     if (project.releaseCatalog.mode === "independent") {
-      if (plan.uniffiTargets.length) {
-        workflow.addJob(
-          "rust-uniffi",
-          rustBuildJob(plan, "uniffi", independentReleaseSetupSteps(project)),
-        );
-      }
-      if (plan.binaryTargets.length) {
-        workflow.addJob(
-          "rust-binaries",
-          rustBuildJob(plan, "binaries", independentReleaseSetupSteps(project)),
-        );
+      if (plan.targets.length) {
+        workflow.addJob("rust-build", rustBuildJob(plan, independentReleaseSetupSteps(project)));
       }
       if (plan.publicCrates.length) {
         workflow.addJob("publish-cargo", independentRustCargoPublishJob(project, plan));
@@ -1129,29 +1120,8 @@ export class DBXToolsRustWorkspace extends Component {
       }
       return;
     }
-    if (plan.uniffiTargets.length) {
-      workflow.addJob("rust-uniffi", rustBuildJob(plan, "uniffi"));
-    }
-    if (plan.binaryTargets.length) {
-      workflow.addJob("rust-binaries", rustBuildJob(plan, "binaries"));
-    }
     if (plan.publicCrates.length) {
-      workflow.addJob("publish-cargo", rustCargoPublishJob(plan, false));
-      workflow.addJob("publish-local-cargo", rustCargoPublishJob(plan, true));
-    }
-    if (plan.releaseBinaries.length) {
-      workflow.addJob("publish-github-release", rustGitHubReleaseJob(plan));
-    }
-    if (plan.nodeBindings.length && hasNodeRelease(project)) {
-      workflow.addJob("publish-native-npm", rustNativeNpmPublishJob(project));
-      const nodeJob = workflow.getJob("publish-node");
-      if ("uses" in nodeJob) throw new Error("publish-node must be a workflow job");
-      workflow.updateJob("publish-node", {
-        ...nodeJob,
-        if: "${{ always() && needs.verify-context.result == 'success' && needs.publish-native-npm.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-        needs: ["verify-context", "publish-native-npm"],
-      });
-      workflow.addJob("publish-node-facades", rustNodeFacadePublishJob(project, plan.nodeBindings));
+      workflow.addJob("publish-cargo", rustCargoPublishJob(plan));
     }
   }
 }

package/src/release-github.ts

@@ -28,6 +28,29 @@ export interface GithubAuthenticatedAccount {
   scopes: string[];
 }
 
+/** Repository capabilities returned for one authenticated actor. */
+export interface GithubRepositoryPermissions {
+  readonly push: boolean;
+  readonly maintain: boolean;
+  readonly admin: boolean;
+}
+
+/** Read normalized repository permissions from a GitHub repository response. */
+export function githubRepositoryPermissions(value: unknown): GithubRepositoryPermissions {
+  const repository = object.isRecord(value) ? value : undefined;
+  const permissions = object.isRecord(repository?.permissions) ? repository.permissions : undefined;
+  return {
+    push: permissions?.push === true,
+    maintain: permissions?.maintain === true,
+    admin: permissions?.admin === true,
+  };
+}
+
+/** Whether the actor can manage releases rather than only push source. */
+export function githubRepositoryCanManage(permissions: GithubRepositoryPermissions): boolean {
+  return permissions.maintain || permissions.admin;
+}
+
 /** Parse successful GitHub CLI accounts with the active account first. */
 export function githubAuthenticatedAccounts(
   statusOutput: string,

package/src/release-plan.ts

@@ -47,10 +47,10 @@ export interface PlannedRustTarget {
   readonly runner: string;
   readonly python: string;
   readonly libc: string;
+  readonly glibcVersion: string;
   readonly packages: readonly string[];
   readonly binaries: readonly string[];
   readonly features: readonly string[];
-  readonly fingerprintConfig: string;
 }
 
 /** Complete plan persisted as a workflow artifact and used for recovery. */
@@ -62,8 +62,7 @@ export interface ReleasePlan {
   readonly pythonPackages: readonly PlannedPackage[];
   readonly rustPackages: readonly PlannedPackage[];
   readonly artifacts: readonly PlannedArtifact[];
-  readonly rustUniffiTargets: readonly PlannedRustTarget[];
-  readonly rustBinaryTargets: readonly PlannedRustTarget[];
+  readonly rustTargets: readonly PlannedRustTarget[];
   readonly stages: {
     readonly rust: boolean;
     readonly python: boolean;
@@ -133,53 +132,52 @@ export function buildReleasePlan(
       ]);
     }
   }
-  const rustTargetsByKind = {
-    uniffi: new Map<string, PlannedRustTarget>(),
-    binaries: new Map<string, PlannedRustTarget>(),
-  };
+  const rustTargets = new Map<string, PlannedRustTarget>();
   for (const artifact of artifacts) {
     const targets = artifact.data?.targets;
     if (!Array.isArray(targets)) continue;
-    const kind = artifact.kind === "github-binary" ? "binaries" : "uniffi";
+    const binary = artifact.kind === "github-binary";
     for (const value of targets) {
       if (!value || typeof value !== "object" || Array.isArray(value)) continue;
       const target = value as Record<string, unknown>;
       const required = ["os", "cpu", "node", "cargo", "runner", "python"] as const;
       if (!required.every((field) => typeof target[field] === "string")) continue;
       const key = String(target.node);
-      const targetsByKey = rustTargetsByKind[kind];
-      const currentTarget = targetsByKey.get(key);
+      const currentTarget = rustTargets.get(key);
       const packages = [
         ...new Set([
           ...(currentTarget?.packages ?? []),
           ...(rustPackagesByUnit.get(artifact.unit) ?? []),
         ]),
       ].sort();
-      const binaries =
-        kind === "binaries"
-          ? [
-              ...new Set([
-                ...(currentTarget?.binaries ?? []),
-                ...(typeof artifact.data?.binary === "string" ? [artifact.data.binary] : []),
-              ]),
-            ].sort()
-          : [];
+      const binaries = binary
+        ? [
+            ...new Set([
+              ...(currentTarget?.binaries ?? []),
+              ...(typeof artifact.data?.binary === "string" ? [artifact.data.binary] : []),
+            ]),
+          ].sort()
+        : (currentTarget?.binaries ?? []);
       const configuredFeatures = Array.isArray(artifact.data?.features)
         ? artifact.data.features.filter((feature): feature is string => typeof feature === "string")
         : [];
       const crate = typeof artifact.data?.crate === "string" ? artifact.data.crate : undefined;
-      const features =
-        kind === "uniffi"
-          ? packages.map((pkg) => `${pkg}/uniffi-bindgen`)
-          : [
-              ...new Set([
-                ...(currentTarget?.features ?? []),
-                ...(crate
-                  ? configuredFeatures.map((feature) => `${crate}/${feature}`)
-                  : configuredFeatures),
-              ]),
-            ].sort();
-      targetsByKey.set(key, {
+      const features = binary
+        ? [
+            ...new Set([
+              ...(currentTarget?.features ?? []),
+              ...(crate
+                ? configuredFeatures.map((feature) => `${crate}/${feature}`)
+                : configuredFeatures),
+            ]),
+          ].sort()
+        : [
+            ...new Set([
+              ...(currentTarget?.features ?? []),
+              ...packages.map((pkg) => `${pkg}/uniffi-bindgen`),
+            ]),
+          ].sort();
+      rustTargets.set(key, {
         os: String(target.os),
         cpu: String(target.cpu),
         node: String(target.node),
@@ -187,19 +185,14 @@ export function buildReleasePlan(
         runner: String(target.runner),
         python: String(target.python),
         libc: typeof target.libc === "string" ? target.libc : "",
+        glibcVersion: typeof target.glibcVersion === "string" ? target.glibcVersion : "",
         packages,
         binaries,
         features,
-        fingerprintConfig: JSON.stringify({ packages, binaries, features }),
       });
     }
   }
-  const rustUniffiTargets = [...rustTargetsByKind.uniffi.values()].sort((a, b) =>
-    a.node.localeCompare(b.node),
-  );
-  const rustBinaryTargets = [...rustTargetsByKind.binaries.values()].sort((a, b) =>
-    a.node.localeCompare(b.node),
-  );
+  const plannedRustTargets = [...rustTargets.values()].sort((a, b) => a.node.localeCompare(b.node));
   const publishBatches = current.publishBatches
     .map((batch) => batch.filter((unit) => selected.has(unit)))
     .filter((batch) => batch.length > 0);
@@ -226,8 +219,7 @@ export function buildReleasePlan(
     pythonPackages,
     rustPackages,
     artifacts,
-    rustUniffiTargets,
-    rustBinaryTargets,
+    rustTargets: plannedRustTargets,
     stages,
     omittedStages,
   };