@dbx-tools/projen 0.9.17 → 0.9.19

package/src/release.ts

@@ -7,13 +7,15 @@ import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workf
 import { projectReleaseBranch, type DBXToolsJavaScriptProject } from "./project-js.ts";
 import { applyTasks, taskScript } from "./project.ts";
 import {
+  RELEASE_SHA,
+  RELEASE_TAG,
   RELEASE_VERSION,
   releaseSourceSteps,
   type ReleaseSummaryProviderName,
 } from "./release-dispatch.ts";
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
-const NODE_VERSION = "lts/*";
+const NODE_VERSION = "24";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const nodeReleaseProjects = new WeakSet<DBXToolsJavaScriptProject>();
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
@@ -21,7 +23,7 @@ const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>(
 const independentPublicationJobs = new WeakMap<GithubWorkflow, Set<string>>();
 
 /** Independently recoverable portions of the release workflow. */
-export type ReleaseStage = "all" | "node" | "python" | "docs";
+export type ReleaseStage = "all" | "node" | "python" | "cargo" | "docs";
 
 /** GitHub Pages configuration included in the unified release workflow. */
 export interface ReleaseDocsOptions {
@@ -101,47 +103,32 @@ export function releaseTagPattern(project: DBXToolsJavaScriptProject): string {
   return `${prefix}*`;
 }
 
-/** Run a release stage on default-branch pushes or when selected for manual recovery. */
-export function releaseStageCondition(stage: Exclude<ReleaseStage, "all">): string {
-  return `\${{ github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == '${stage}' }}`;
+/** Run a release stage on promotion or when selected for manual recovery. */
+export function releaseStageCondition(
+  stage: Exclude<ReleaseStage, "all">,
+  prerequisites: readonly string[] = [],
+): string {
+  if (prerequisites.length === 0) {
+    return `\${{ github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}' }}`;
+  }
+  const prefix = prerequisites.length
+    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
+    : "";
+  return `\${{ ${prefix}(github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}') }}`;
 }
 
 /** Publish a selected stage unless a manual run remains in dry-run mode. */
-export function releasePublishCondition(stage: Exclude<ReleaseStage, "all">): string {
-  return `\${{ github.event_name == 'push' || (inputs.dry_run == false && (inputs.stage == 'all' || inputs.stage == '${stage}')) }}`;
-}
-
-/** Download release artifacts from this run or a verified earlier run. */
-export function releaseArtifactSteps(options: {
-  readonly currentName: string;
-  readonly recoveredName: string;
-  readonly pattern: string;
-  readonly path: string;
-}): readonly JobStep[] {
-  const shared = {
-    pattern: options.pattern,
-    path: options.path,
-    "merge-multiple": true,
-  };
-  return [
-    {
-      name: options.currentName,
-      if: "${{ inputs.source_run_id == '' }}",
-      uses: "actions/download-artifact@v8",
-      with: shared,
-    },
-    {
-      name: options.recoveredName,
-      if: "${{ inputs.source_run_id != '' }}",
-      uses: "actions/download-artifact@v8",
-      with: {
-        ...shared,
-        "run-id": "${{ inputs.source_run_id }}",
-        "github-token": "${{ github.token }}",
-        repository: "${{ github.repository }}",
-      },
-    },
-  ];
+export function releasePublishCondition(
+  stage: Exclude<ReleaseStage, "all">,
+  prerequisites: readonly string[] = [],
+): string {
+  if (prerequisites.length === 0) {
+    return `\${{ github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}')) }}`;
+  }
+  const prefix = prerequisites.length
+    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
+    : "";
+  return `\${{ ${prefix}(github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}'))) }}`;
 }
 
 /** Shared Bun, Node, cache, and install setup for Node release jobs. */
@@ -152,7 +139,11 @@ export function nodeReleaseSetupSteps(project: DBXToolsJavaScriptProject): reado
     {
       name: "Setup Node.js",
       uses: "actions/setup-node@v6",
-      with: { "node-version": NODE_VERSION, "registry-url": NPM_REGISTRY_URL },
+      with: {
+        "node-version": NODE_VERSION,
+        "registry-url": NPM_REGISTRY_URL,
+        "package-manager-cache": false,
+      },
     },
     { name: "Install", run: "bun install" },
     bunCacheSaveStep(),
@@ -163,9 +154,7 @@ export function nodeReleaseSetupSteps(project: DBXToolsJavaScriptProject): reado
 export function npmPublishEnvironment(): Record<string, string> {
   return {
     NPM_CONFIG_PROVENANCE:
-      "${{ (github.event_name == 'push' || inputs.dry_run == false) && 'true' || 'false' }}",
-    NPM_CONFIG_TOKEN: "${{ secrets.NPM_TOKEN }}",
-    NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+      "${{ (github.event_name == 'release' || inputs.dry_run != true) && 'true' || 'false' }}",
     DRY_RUN:
       "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && '--dry-run' || '' }}",
   };
@@ -174,7 +163,7 @@ export function npmPublishEnvironment(): Record<string, string> {
 function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
   return {
     runsOn: ["ubuntu-latest"],
-    permissions: { actions: JobPermission.READ, contents: JobPermission.WRITE },
+    permissions: { contents: JobPermission.READ },
     outputs: {
       release_tag: { stepId: "release", outputName: "release_tag" },
       expected_sha: { stepId: "release", outputName: "expected_sha" },
@@ -185,8 +174,8 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
         name: "Checkout release source",
         uses: "actions/checkout@v6",
         with: {
-          ref: "${{ github.event_name == 'push' && github.sha || inputs.expected_sha }}",
-          "fetch-depth": 2,
+          ref: "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+          "fetch-depth": 0,
         },
       },
       {
@@ -201,51 +190,32 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
         shell: "bash",
         env: {
           RELEASE_TAG:
-            "${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || '' }}",
-          EXPECTED_SHA:
-            "${{ github.event_name == 'workflow_dispatch' && inputs.expected_sha || '' }}",
-          DRY_RUN: "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run || false }}",
+            "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+          GH_TOKEN: "${{ github.token }}",
         },
         // prettier-ignore
         run: stringUtils.dedent(
           // ============================================================================
           /*bash*/`
-          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
-            test "$GITHUB_REF_TYPE" = "branch"
-            test "$GITHUB_REF_NAME" = "${releaseBranch}"
-            RELEASE_SHA="$GITHUB_SHA"
-            test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
-            RELEASE_VERSION="$(tr -d '\\r\\n' < VERSION)"
-            bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"
-            PREVIOUS_VERSION="$(git show "$RELEASE_SHA^:VERSION" | tr -d '\\r\\n')"
-            test "$PREVIOUS_VERSION" != "$RELEASE_VERSION"
-            RELEASE_TAG="${tagPrefix}$RELEASE_VERSION"
-            if git ls-remote --exit-code --tags origin "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
-              git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-              test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
-              test "$(git rev-parse "$RELEASE_TAG^{commit}")" = "$RELEASE_SHA"
-            else
-              git fetch --force --tags origin
-              bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION" --prefix ${JSON.stringify(tagPrefix)} --assert-next
-              git config user.name "github-actions[bot]"
-              git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-              git tag -a "$RELEASE_TAG" "$RELEASE_SHA" -m "$RELEASE_TAG"
-              git push origin "refs/tags/$RELEASE_TAG"
-            fi
-          else
-            case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac
-            RELEASE_VERSION="\${RELEASE_TAG#${tagPrefix}}"
-            bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"
-            git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
-            test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
-            RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"
-            test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
-            test "$RELEASE_SHA" = "$EXPECTED_SHA"
-            if [ -n "\${{ inputs.source_run_id }}" ]; then
-              case "\${{ inputs.stage }}" in node|python) ;; *) exit 1 ;; esac
-              case "\${{ inputs.source_run_id }}" in *[!0-9]*|"") exit 1 ;; esac
-            fi
-          fi
+          case "$RELEASE_TAG" in ${tagPrefix}*) ;; *) exit 1 ;; esac
+          RELEASE_VERSION="\${RELEASE_TAG#${tagPrefix}}"
+          bun node_modules/@dbx-tools/projen/tasks/release-version.ts --version "$RELEASE_VERSION"
+          git fetch --force origin "+refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          git fetch --force origin "+refs/heads/${releaseBranch}:refs/remotes/origin/${releaseBranch}"
+          test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
+          RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"
+          test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
+          git merge-base --is-ancestor "$RELEASE_SHA" "origin/${releaseBranch}"
+          test "$(tr -d '\\r\\n' < VERSION)" = "$RELEASE_VERSION"
+          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" = "false"
+          rm -rf dist/release-candidate
+          mkdir -p dist/release-candidate
+          gh release download "$RELEASE_TAG" --dir dist/release-candidate
+          bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \
+            --directory dist/release-candidate \
+            --tag "$RELEASE_TAG" \
+            --sha "$RELEASE_SHA" \
+            --version "$RELEASE_VERSION"
           echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
           echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
@@ -253,31 +223,6 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           // ============================================================================
         ),
       },
-      {
-        name: "Verify source artifact run",
-        if: "${{ inputs.source_run_id != '' }}",
-        uses: "actions/github-script@v8",
-        env: {
-          EXPECTED_SHA: "${{ steps.release.outputs.expected_sha }}",
-          SOURCE_RUN_ID: "${{ inputs.source_run_id }}",
-        },
-        with: {
-          // prettier-ignore
-          script: stringUtils.dedent(
-            // ============================================================================
-            /*js*/`
-            const run = await github.rest.actions.getWorkflowRun({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              run_id: Number(process.env.SOURCE_RUN_ID),
-            });
-            if (run.data.path !== ".github/workflows/release.yml") core.setFailed("Source run is not release.yml");
-            if (run.data.head_sha !== process.env.EXPECTED_SHA) core.setFailed("Source run commit does not match the release tag");
-          `
-            // ============================================================================
-          ),
-        },
-      },
     ],
   };
 }
@@ -293,13 +238,27 @@ function nodePublishJob(project: DBXToolsJavaScriptProject): Job {
     steps: [
       ...nodeReleaseSetupSteps(project),
       {
-        name: "Compile, package, and publish npm workspace",
-        env: { RELEASE_VERSION, ...npmPublishEnvironment() },
+        name: "Download approved npm archives",
+        env: { GH_TOKEN: "${{ github.token }}", RELEASE_SHA, RELEASE_TAG, RELEASE_VERSION },
+        shell: "bash",
         run: [
-          "chmod -R u+w . || true",
-          'bun node_modules/@dbx-tools/projen/tasks/publish.ts "$RELEASE_VERSION" $DRY_RUN',
+          "rm -rf dist/release-download dist/npm-release",
+          "mkdir -p dist/release-download",
+          'gh release download "$RELEASE_TAG" --pattern release-manifest.json --pattern SHA256SUMS --pattern "*.tgz" --dir dist/release-download',
+          "bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \\",
+          "  --directory dist/release-download \\",
+          '  --tag "$RELEASE_TAG" \\',
+          '  --sha "$RELEASE_SHA" \\',
+          '  --version "$RELEASE_VERSION" \\',
+          "  --kind npm \\",
+          "  --output dist/npm-release",
         ].join("\n"),
       },
+      {
+        name: "Publish approved npm archives",
+        env: { RELEASE_VERSION, ...npmPublishEnvironment() },
+        run: 'bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory dist/npm-release --version "$RELEASE_VERSION" $DRY_RUN',
+      },
     ],
   };
 }
@@ -591,8 +550,7 @@ function independentReleasePlanJob(project: DBXToolsJavaScriptProject): Job {
       python_packages: { stepId: "plan", outputName: "python_packages" },
       rust_packages: { stepId: "plan", outputName: "rust_packages" },
       artifacts: { stepId: "plan", outputName: "artifacts" },
-      rust_uniffi_targets: { stepId: "plan", outputName: "rust_uniffi_targets" },
-      rust_binary_targets: { stepId: "plan", outputName: "rust_binary_targets" },
+      rust_targets: { stepId: "plan", outputName: "rust_targets" },
     },
     steps: [
       {
@@ -1020,7 +978,12 @@ export class DBXToolsRelease extends Component {
               ),
               receiveArgs: true,
               description:
-                "Prepare, validate, locally publish, and automatically merge a release PR",
+                "Prepare, validate, locally publish, and upload a draft release candidate",
+            },
+            "release:assets": {
+              exec: taskScript(project, "release-candidate.ts"),
+              receiveArgs: true,
+              description: "Rebuild and upload a complete draft release candidate",
             },
           }
         : {}),
@@ -1030,14 +993,18 @@ export class DBXToolsRelease extends Component {
     const workflow = new GithubWorkflow(project.github, "release", {
       fileName: "release.yml",
       limitConcurrency: true,
-      concurrencyOptions: { group: "release", cancelInProgress: false },
+      concurrencyOptions: {
+        group:
+          "release-${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+        cancelInProgress: false,
+      },
     });
     const version = readWorkspaceVersion(project.outdir);
     workflow.runName =
       `release ${version} ` +
-      "${{ github.event_name == 'push' && github.sha || inputs.release_tag }}";
+      "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}";
     workflow.on({
-      push: { branches: [releaseBranch], paths: ["VERSION"] },
+      release: { types: ["published"] },
       workflowDispatch: {
         inputs: {
           release_tag: {
@@ -1045,24 +1012,13 @@ export class DBXToolsRelease extends Component {
             type: "string",
             required: true,
           },
-          expected_sha: {
-            description: "Commit the release tag must reference",
-            type: "string",
-            required: true,
-          },
           stage: {
-            description: "Release stage to build, validate, or recover",
+            description: "Published release stage to validate or recover",
             type: "choice",
-            options: ["all", "node", "python", "docs"],
+            options: ["all", "node", "python", "cargo", "docs"],
             default: "all",
             required: true,
           },
-          source_run_id: {
-            description: "Earlier release workflow run containing Rust artifacts",
-            type: "string",
-            default: "",
-            required: false,
-          },
           dry_run: {
             description: "Build and validate without publishing",
             type: "boolean",

package/tasks/compile-workspace.ts

@@ -0,0 +1,121 @@
+#!/usr/bin/env -S bun
+/** Compile source-first workspace packages in a few TypeScript processes. */
+import { existsSync, readFileSync } from "node:fs";
+import { availableParallelism } from "node:os";
+import { join, resolve } from "node:path";
+import * as exec from "@dbx-tools/core/exec";
+
+interface PackageManifest {
+  readonly name?: string;
+  readonly scripts?: Record<string, string>;
+  readonly workspaces?: string[];
+}
+
+interface TaskManifest {
+  readonly tasks?: {
+    readonly compile?: {
+      readonly steps?: Array<{ readonly execArgs?: string[] }>;
+    };
+  };
+}
+
+export interface CompilePlan {
+  readonly typescriptConfigs: string[];
+  readonly customPackages: Array<{ readonly name: string; readonly directory: string }>;
+}
+
+function readJson<T>(path: string): T {
+  return JSON.parse(readFileSync(path, "utf8")) as T;
+}
+
+function plainTypeScriptBuild(steps: unknown): boolean {
+  if (!Array.isArray(steps) || steps.length !== 1) return false;
+  const step = steps[0] as { execArgs?: string[] };
+  if (!step || typeof step !== "object") return false;
+  return (
+    Object.keys(step).length === 1 &&
+    step.execArgs?.length === 2 &&
+    step.execArgs[0] === "tsc" &&
+    step.execArgs[1] === "--build"
+  );
+}
+
+/** Read the root's concrete workspace paths on every run, including newly added members. */
+export function compilePlan(root: string): CompilePlan {
+  const workspace = readJson<PackageManifest>(join(root, "package.json"));
+  const typescriptConfigs: string[] = [];
+  const customPackages: CompilePlan["customPackages"] = [];
+  for (const member of workspace.workspaces ?? []) {
+    const directory = resolve(root, member);
+    const manifest = readJson<PackageManifest>(join(directory, "package.json"));
+    const script = manifest.scripts?.compile;
+    if (!script) continue;
+    const taskPath = join(directory, ".projen", "tasks.json");
+    const steps = existsSync(taskPath)
+      ? readJson<TaskManifest>(taskPath).tasks?.compile?.steps
+      : undefined;
+    if (
+      script === "projen compile" &&
+      !manifest.scripts?.precompile &&
+      !manifest.scripts?.postcompile &&
+      plainTypeScriptBuild(steps)
+    ) {
+      typescriptConfigs.push(join(directory, "tsconfig.json"));
+    } else {
+      customPackages.push({ name: manifest.name ?? member, directory });
+    }
+  }
+  return { typescriptConfigs, customPackages };
+}
+
+const emoji = /[\p{Extended_Pictographic}\uFE0F\u200D]/gu;
+
+async function main(): Promise<void> {
+  const root = process.cwd();
+  const plan = compilePlan(root);
+  const jobs: Array<{ name: string; result: Promise<exec.ExecResult> }> = [];
+  if (plan.typescriptConfigs.length > 0) {
+    const batchCount = Math.min(4, availableParallelism(), plan.typescriptConfigs.length);
+    const batches = Array.from({ length: batchCount }, () => [] as string[]);
+    plan.typescriptConfigs.forEach((config, index) => batches[index % batchCount]!.push(config));
+    console.log(
+      `Type-checking ${plan.typescriptConfigs.length} workspaces in ${batchCount} batches`,
+    );
+    for (const [index, batch] of batches.entries()) {
+      jobs.push({
+        name: `TypeScript batch ${index + 1}`,
+        result: exec.spawn("bunx", ["tsc", "--build", ...batch], {
+          cwd: root,
+          stdin: "ignore",
+          stdout: "inherit",
+          stderr: "inherit",
+        }),
+      });
+    }
+  }
+  for (const pkg of plan.customPackages) {
+    jobs.push({
+      name: pkg.name,
+      result: exec.spawn("bun", ["run", "compile"], {
+        cwd: pkg.directory,
+        stdin: "ignore",
+        stdout: (line) => console.log(`${pkg.name}: ${line.replace(emoji, "")}`),
+        stderr: (line) => console.error(`${pkg.name}: ${line.replace(emoji, "")}`),
+      }),
+    });
+  }
+  const results = await Promise.allSettled(jobs.map((job) => job.result));
+  let failed = false;
+  for (const [index, result] of results.entries()) {
+    if (result.status === "rejected") {
+      console.error(`${jobs[index]!.name} compile failed:`, result.reason);
+      failed = true;
+    } else if (result.value.exitCode !== 0) {
+      console.error(`${jobs[index]!.name} compile exited with ${result.value.exitCode}`);
+      failed = true;
+    }
+  }
+  if (failed) process.exitCode = 1;
+}
+
+if (import.meta.main) await main();

package/tasks/publish-npm.ts

@@ -28,6 +28,15 @@ export interface NpmReleaseIdentity {
   readonly version: string;
 }
 
+interface NpmArchiveManifest {
+  readonly dependencies?: Readonly<Record<string, string>>;
+  readonly optionalDependencies?: Readonly<Record<string, string>>;
+  readonly name?: string;
+  readonly publishConfig?: { readonly access?: unknown };
+  readonly repository?: unknown;
+  readonly version?: string;
+}
+
 function normalizedRepository(value: unknown): string | undefined {
   const url =
     typeof value === "string"
@@ -120,7 +129,7 @@ export async function publishedNpmRelease(
   };
 }
 
-export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
+function readNpmArchiveManifest(path: string): NpmArchiveManifest {
   const result = exec.spawnSync("tar", ["-xOf", path, "package/package.json"], {
     cwd: process.cwd(),
     stdout: "capture",
@@ -131,12 +140,11 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
   if (result.exitCode !== 0 || !result.stdout) {
     throw new Error(`Cannot read npm package manifest from ${path}: ${result.stderr}`);
   }
-  const manifest = JSON.parse(result.stdout) as {
-    name?: string;
-    publishConfig?: { access?: unknown };
-    repository?: unknown;
-    version?: string;
-  };
+  return JSON.parse(result.stdout) as NpmArchiveManifest;
+}
+
+export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
+  const manifest = readNpmArchiveManifest(path);
   if (!manifest.name || !manifest.version) {
     throw new Error(`npm archive has no package name or version: ${path}`);
   }
@@ -154,6 +162,48 @@ export function readNpmArchiveIdentity(path: string): NpmReleaseIdentity {
   };
 }
 
+function orderNpmArchives(archives: readonly string[]): string[] {
+  const byName = new Map(
+    archives.map((archive) => {
+      const manifest = readNpmArchiveManifest(archive);
+      if (!manifest.name) throw new Error(`npm archive has no package name: ${archive}`);
+      return [manifest.name, { archive, manifest }] as const;
+    }),
+  );
+  if (byName.size !== archives.length) throw new Error("Release contains duplicate npm packages");
+  const remaining = new Map(
+    [...byName].map(([name, value]) => [
+      name,
+      new Set(
+        [
+          ...Object.keys(value.manifest.dependencies ?? {}),
+          ...Object.keys(value.manifest.optionalDependencies ?? {}),
+        ].filter((dependency) => byName.has(dependency)),
+      ),
+    ]),
+  );
+  const ordered: string[] = [];
+  while (remaining.size > 0) {
+    const ready = [...remaining]
+      .filter(([, dependencies]) => dependencies.size === 0)
+      .map(([name]) => name)
+      .sort();
+    if (ready.length === 0) {
+      throw new Error(
+        `Cyclic npm release dependencies: ${[...remaining.keys()].sort().join(", ")}`,
+      );
+    }
+    for (const name of ready) {
+      ordered.push(byName.get(name)!.archive);
+      remaining.delete(name);
+    }
+    for (const dependencies of remaining.values()) {
+      for (const name of ready) dependencies.delete(name);
+    }
+  }
+  return ordered;
+}
+
 /** Hash paths, executable bits, symlink targets, and bytes while ignoring tar metadata. */
 export function npmArchiveContentDigest(path: string): string {
   const temp = mkdtempSync(join(tmpdir(), "projen-npm-content-"));
@@ -219,10 +269,12 @@ export async function publishNpmArchives(options: {
   readonly version?: string;
 }): Promise<void> {
   const directory = resolve(options.directory);
-  const archives = readdirSync(directory)
-    .filter((file) => file.endsWith(".tgz"))
-    .sort()
-    .map((file) => join(directory, file));
+  const archives = orderNpmArchives(
+    readdirSync(directory)
+      .filter((file) => file.endsWith(".tgz"))
+      .sort()
+      .map((file) => join(directory, file)),
+  );
   if (archives.length === 0) throw new Error(`No npm archives found in ${directory}`);
 
   for (const archive of archives) {