@dbx-tools/projen 0.9.18 → 0.9.19

package/README.md

@@ -274,28 +274,28 @@ architecture. Omit both filters to regenerate the complete maintained matrix.
 `DBX_TOOLS_RELEASE_PLATFORMS` can select the generated matrix without repeating
 environment parsing in a consumer.
 
-`bun run release --build auto` is the default. It selects a local build when
-the chosen GitHub CLI account has maintain/admin access, the host is macOS, and
-Cargo, Zig, cargo-zigbuild, cargo-xwin, LLVM, uv, and zip are available.
-Otherwise it selects the GitHub matrix. `--build local` and `--build remote`
-force the choice. Local mode builds the exact merged release SHA and uploads
-the archives plus a checksum manifest to the draft GitHub Release before
-registry publication continues. A manager can rerun an interrupted upload with
-`bun run release:assets --version <version> --tag <tag> --upload` from the
-matching release source.
+`bun run release` always prepares the production candidate locally. After the
+reviewed release pull request merges, the local process checks out the exact
+merge commit, builds the complete npm, Python, native binding, and Rust binary
+artifact set, then creates an annotated tag and draft GitHub Release. The draft
+contains `release-manifest.json`, `SHA256SUMS`, and every registry or binary
+artifact bound to that commit. A manager can rebuild an interrupted draft from
+the exact source with
+`bun run release:assets --version <version> --tag <tag> --sha <commit> --upload`.
+Publishing the draft is the production promotion event; `release.yml` verifies
+the tag, commit, version, manifest, checksums, and asset set before publishing
+the approved npm archives, Python distributions, and Cargo crates. GitHub-hosted
+runners never rebuild native release artifacts for singular-version releases.
 
 Public UniFFI facades are marked with `dbxToolsConfig.uniffi = true` in Node
 manifests and `[tool.dbx_tools.config] uniffi = true` in Python manifests. The
-Node jobs consume same-run artifacts, publish native archives first with npm
-provenance, compile and publish normal workspace packages including the Projen
-engine, then build facades from committed generated TypeScript without UBRN and
-publish them in binding dependency order. Local Verdaccio publication does not
-enable provenance. Set the `UNIFFI_FACADE_SMOKE` repository variable to `true`
-to run the optional nonblocking registry install and import check after facade
-publication. Python combines same-run platform wheels with standard wheel and
-source builds, then publishes each distribution through its own PyPI
-trusted-publisher environment. Binding publishers wait for their dependencies.
-Trusted-publisher instructions name `release.yml` and the release branch policy.
+approved npm archives are dependency-ordered and published through npm OIDC
+Trusted Publishing with provenance. Local Verdaccio publication does not enable
+provenance. Python publishes the exact approved wheels and source distributions
+through package-specific PyPI trusted-publisher environments; binding publishers
+wait for their dependencies. Trusted-publisher instructions name `release.yml`
+and the `v*` deployment tag policy. Cargo publication checks the approved source
+commit and skips an already-published version during recovery.
 The docs jobs generate README and TypeScript API content and deploy GitHub Pages
 from the same workflow. When a conventional Node binding path already belongs
 to a root subproject, Rust mapping reuses that project and adds binding

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.18";
+export const PACKAGE_VERSION = "0.9.19";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -29,9 +29,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.18",
-    "@dbx-tools/path": "^0.9.18",
-    "@dbx-tools/shared-core": "^0.9.18",
+    "@dbx-tools/core": "^0.9.19",
+    "@dbx-tools/path": "^0.9.19",
+    "@dbx-tools/shared-core": "^0.9.19",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -52,7 +52,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.18",
+  "version": "0.9.19",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/_rust-release-workflow.ts

@@ -17,19 +17,11 @@ import type {
   UniFFIReleaseTarget,
 } from "./project-rs.ts";
 import { defaultReleaseUnitId } from "./release-catalog.ts";
-import {
-  RELEASE_SHA,
-  RELEASE_SUMMARY_FILE,
-  RELEASE_TAG,
-  RELEASE_VERSION,
-  releaseSourceSteps,
-} from "./release-dispatch.ts";
+import { RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
 import {
   independentReleaseSetupSteps,
   npmPublishEnvironment,
-  nodeReleaseSetupSteps,
-  releaseArtifactSteps,
-  releaseStageCondition,
+  releasePublishCondition,
 } from "./release.ts";
 
 const require = createRequire(import.meta.url);
@@ -460,32 +452,24 @@ function rustCargoBuildCommand(plan: RustReleasePlan): string {
   ].join("\n");
 }
 
-export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep[]): Job {
-  const independent = Boolean(independentSetup);
-  const bindingCommands = rustBindingCommands(plan, independent);
-  const binaryCommands = rustBinaryCommands(plan, independent);
+export function rustBuildJob(plan: RustReleasePlan, setup: readonly JobStep[]): Job {
+  const bindingCommands = rustBindingCommands(plan, true);
+  const binaryCommands = rustBinaryCommands(plan, true);
   return {
-    if: independentSetup
-      ? "${{ needs.release-plan.outputs.rust_targets != '[]' && (github.event_name == 'push' || inputs.stage != 'docs') }}"
-      : "${{ needs.verify-context.outputs.build_mode == 'remote' && (github.event_name == 'push' || inputs.stage == 'all') }}",
+    if: "${{ needs.release-plan.outputs.rust_targets != '[]' && (github.event_name == 'push' || inputs.stage != 'docs') }}",
     name: "Rust / ${{ matrix.node }}",
-    needs: [independentSetup ? "release-plan" : "verify-context"],
+    needs: ["release-plan"],
     runsOn: ["${{ matrix.runner }}"],
     permissions: { contents: JobPermission.READ },
-    env: {
-      ...RUST_BUILD_ENV,
-      ...(independentSetup ? { BUN_VERSION } : {}),
-    },
+    env: { ...RUST_BUILD_ENV, BUN_VERSION },
     strategy: {
       failFast: false,
       matrix: {
-        include: independentSetup
-          ? ("${{ fromJSON(needs.release-plan.outputs.rust_targets) }}" as never)
-          : ([...plan.targets] as never),
+        include: "${{ fromJSON(needs.release-plan.outputs.rust_targets) }}" as never,
       },
     },
     steps: [
-      ...(independentSetup ?? releaseSourceSteps()),
+      ...setup,
       ...(plan.hasPythonBindings ? [{ name: "Setup uv", uses: "astral-sh/setup-uv@v7" }] : []),
       {
         name: "Setup Rust",
@@ -516,7 +500,6 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
             {
               name: "Package UniFFI outputs",
               shell: "bash",
-              ...(independentSetup ? {} : { env: { VERSION: RELEASE_VERSION } }),
               run: timedBash("uniffi_packaging", bindingCommands.join("\n")),
             },
           ]
@@ -535,50 +518,12 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
   };
 }
 
-/** Wait for the selected local or GitHub-hosted native build source. */
-export function rustAssetsJob(): Job {
+export function rustCargoPublishJob(plan: RustReleasePlan): Job {
   return {
-    if: "${{ always() && needs.verify-context.result == 'success' && (needs.verify-context.outputs.build_mode == 'local' || needs.rust-build.result == 'success') }}",
-    needs: ["verify-context", "rust-build"],
+    if: releasePublishCondition("cargo", ["needs.verify-context.result == 'success'"]),
+    needs: ["verify-context"],
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
-    steps: [
-      {
-        name: "Wait for locally uploaded release assets",
-        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          RELEASE_TAG: RELEASE_TAG,
-        },
-        shell: "bash",
-        run: [
-          "mkdir -p dist/local-release",
-          "for ATTEMPT in $(seq 1 360); do",
-          '  if gh release download "$RELEASE_TAG" --pattern rust-assets.json --dir dist/local-release --clobber; then exit 0; fi',
-          '  echo "waiting for local release assets ($ATTEMPT/360)"',
-          "  sleep 5",
-          "done",
-          'echo "::error::local release assets were not uploaded"',
-          "exit 1",
-        ].join("\n"),
-      },
-      {
-        name: "Confirm native release assets",
-        run: "true",
-      },
-    ],
-  };
-}
-
-export function rustCargoPublishJob(plan: RustReleasePlan, local: boolean): Job {
-  const registry = local ? '"${{ vars.LOCAL_CARGO_REGISTRY }}"' : "crates-io";
-  return {
-    if: local
-      ? "${{ github.event_name == 'push' && vars.LOCAL_REPOSITORIES == 'true' }}"
-      : "${{ github.event_name == 'push' }}",
-    needs: ["verify-context", ...(plan.hasTargetOutputs ? ["rust-assets"] : [])],
-    runsOn: [local ? "self-hosted" : "ubuntu-latest"],
-    permissions: { contents: JobPermission.READ },
     steps: [
       ...releaseSourceSteps(),
       {
@@ -586,14 +531,21 @@ export function rustCargoPublishJob(plan: RustReleasePlan, local: boolean): Job
         uses: `dtolnay/rust-toolchain@${plan.releaseRustVersion}`,
       },
       {
-        name: local ? "Publish Cargo crates locally" : "Publish public crates",
+        name: "Publish public crates",
         env: {
-          CARGO_REGISTRY_TOKEN: local
-            ? "${{ secrets.LOCAL_CARGO_TOKEN }}"
-            : "${{ secrets.CARGO_REGISTRY_TOKEN }}",
+          RELEASE_VERSION,
+          CARGO_REGISTRY_TOKEN: "${{ secrets.CARGO_REGISTRY_TOKEN }}",
         },
         run: plan.publicCrates
-          .map((crate) => `cargo publish --package "${crate}" --registry ${registry} --no-verify`)
+          .map((crate) =>
+            [
+              `if cargo info "${crate}@$RELEASE_VERSION" >/dev/null 2>&1; then`,
+              `  echo "skip published ${crate}@$RELEASE_VERSION"`,
+              "else",
+              `  cargo publish --package "${crate}" --registry crates-io --no-verify`,
+              "fi",
+            ].join("\n"),
+          )
           .join("\n"),
       },
     ],
@@ -681,50 +633,6 @@ export function independentRustGitHubReleaseJob(
   };
 }
 
-export function rustGitHubReleaseJob(plan: RustReleasePlan): Job {
-  return {
-    if: "${{ github.event_name == 'push' }}",
-    needs: ["verify-context", ...(plan.hasTargetOutputs ? ["rust-assets"] : [])],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.WRITE },
-    steps: [
-      ...releaseSourceSteps(),
-      {
-        name: "Download release binaries",
-        if: "${{ needs.verify-context.outputs.build_mode == 'remote' }}",
-        uses: "actions/download-artifact@v8",
-        with: {
-          pattern: "*-binary",
-          path: "dist/rust-release",
-          "merge-multiple": true,
-        },
-      },
-      {
-        name: "Publish GitHub release assets",
-        if: "${{ needs.verify-context.outputs.build_mode == 'remote' }}",
-        uses: "softprops/action-gh-release@v2",
-        with: {
-          files: "dist/rust-release/*",
-          body_path: RELEASE_SUMMARY_FILE,
-          generate_release_notes: true,
-          tag_name: RELEASE_TAG,
-          target_commitish: RELEASE_SHA,
-        },
-      },
-      {
-        name: "Publish locally built GitHub release",
-        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          RELEASE_NOTES: RELEASE_SUMMARY_FILE,
-          RELEASE_TAG,
-        },
-        run: 'gh release edit "$RELEASE_TAG" --draft=false --latest --notes-file "$RELEASE_NOTES"',
-      },
-    ],
-  };
-}
-
 export function independentRustNativeNpmPublishJob(project: DBXToolsJavaScriptProject): Job {
   return {
     if: "${{ needs.release-plan.outputs.node == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
@@ -788,88 +696,3 @@ export function independentRustNodeFacadePublishJob(
     ],
   };
 }
-
-export function rustNativeNpmPublishJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ always() && needs.verify-context.result == 'success' && needs.rust-assets.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-    needs: ["verify-context", "rust-assets"],
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      actions: JobPermission.READ,
-      contents: JobPermission.READ,
-      idToken: JobPermission.WRITE,
-    },
-    timeoutMinutes: 15,
-    env: { BUN_VERSION, CI: "true" },
-    steps: [
-      ...nodeReleaseSetupSteps(project),
-      ...releaseArtifactSteps({
-        currentName: "Download native npm packages",
-        recoveredName: "Download recovered native npm packages",
-        pattern: "*-npm",
-        path: "dist/uniffi/native",
-        condition: "needs.verify-context.outputs.build_mode == 'remote'",
-      }),
-      {
-        name: "Download locally built native npm packages",
-        if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
-        env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
-        run: [
-          "mkdir -p dist/uniffi/native",
-          'gh release download "$RELEASE_TAG" --pattern "*.tgz" --dir dist/uniffi/native',
-        ].join("\n"),
-      },
-      {
-        name: "Publish native npm packages",
-        env: { RELEASE_VERSION, ...npmPublishEnvironment() },
-        run: 'bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory dist/uniffi/native --version "$RELEASE_VERSION" $DRY_RUN',
-      },
-    ],
-  };
-}
-
-export function rustNodeFacadePublishJob(
-  project: DBXToolsJavaScriptProject,
-  bindings: readonly RustReleaseBinding[],
-): Job {
-  return {
-    if: releaseStageCondition("node"),
-    needs: ["verify-context", "publish-node"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
-    timeoutMinutes: 30,
-    env: { BUN_VERSION, CI: "true" },
-    steps: [
-      ...nodeReleaseSetupSteps(project),
-      {
-        name: "Build and publish UniFFI npm facades",
-        env: { RELEASE_VERSION, ...npmPublishEnvironment() },
-        run: bindings
-          .flatMap((binding) => {
-            const output = `dist/uniffi/facades/${binding.crate}`;
-            return [
-              `node .projen/uniffi-release.mjs facade --node "${binding.node}" --node-package "${binding.nodePackage}" --node-triple "linux-x64-gnu" --version "$RELEASE_VERSION" --output "${output}"`,
-              `bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory "${output}/npm-facade" --version "$RELEASE_VERSION" $DRY_RUN`,
-            ];
-          })
-          .join("\n"),
-      },
-      {
-        name: "Smoke test published UniFFI npm facades",
-        if: "${{ github.event_name == 'push' && vars.UNIFFI_FACADE_SMOKE == 'true' }}",
-        continueOnError: true,
-        env: { RELEASE_VERSION },
-        run: [
-          'SMOKE_DIR="$(mktemp -d)"',
-          "trap 'rm -rf \"$SMOKE_DIR\"' EXIT",
-          'cd "$SMOKE_DIR"',
-          "npm init --yes >/dev/null",
-          ...bindings.flatMap((binding) => [
-            `npm install --ignore-scripts --no-audit --no-fund --package-lock=false "${binding.nodePackage}@$RELEASE_VERSION"`,
-            `node -e 'import("${binding.nodePackage}")'`,
-          ]),
-        ].join("\n"),
-      },
-    ],
-  };
-}

package/src/project-py.ts

@@ -4,14 +4,19 @@ import { stringUtils } from "@dbx-tools/shared-core";
 import { Component, License, TextFile, type Project, javascript, python, vscode } from "projen";
 import { JobPermission } from "projen/lib/github/workflows-model";
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
-import { DBX_TOOLS_LICENSE, projectReleaseBranch, projectRepositoryUrl } from "./project-js.ts";
+import { DBX_TOOLS_LICENSE, projectRepositoryUrl } from "./project-js.ts";
 import { isDBXToolsJavaScriptProject } from "./project-predicate.ts";
 import type { DBXToolsProject, DBXToolsProjectOptions } from "./project.ts";
-import { RELEASE_TAG, RELEASE_VERSION, releaseSourceSteps } from "./release-dispatch.ts";
+import {
+  RELEASE_SHA,
+  RELEASE_TAG,
+  RELEASE_VERSION,
+  releaseSourceSteps,
+} from "./release-dispatch.ts";
 import {
   independentReleaseSetupSteps,
   registerIndependentPublicationJob,
-  releaseArtifactSteps,
+  releaseTagPattern,
   releasePublishCondition,
   releaseStageCondition,
   tryReleaseWorkflow,
@@ -545,12 +550,10 @@ export class DBXToolsPythonWorkspace extends Component {
       return;
     }
     workflow.addJob("build-python", {
-      if: usesRustArtifacts
-        ? "${{ always() && needs.verify-context.result == 'success' && needs.rust-assets.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'python') }}"
-        : releaseStageCondition("python"),
-      needs: ["verify-context", ...(usesRustArtifacts ? ["rust-assets"] : [])],
+      if: releaseStageCondition("python", ["needs.verify-context.result == 'success'"]),
+      needs: ["verify-context"],
       runsOn: ["ubuntu-latest"],
-      permissions: { actions: JobPermission.READ, contents: JobPermission.READ },
+      permissions: { contents: JobPermission.READ },
       timeoutMinutes: 20,
       env: { BUN_VERSION },
       steps: [
@@ -561,76 +564,60 @@ export class DBXToolsPythonWorkspace extends Component {
         { name: "Setup uv", uses: "astral-sh/setup-uv@v7" },
         { name: "Install release helpers", run: "bun install" },
         bunCacheSaveStep(),
-        ...uniffiPublications.flatMap((publication) =>
-          releaseArtifactSteps({
-            currentName: `Download ${publication.distribution} native wheels`,
-            recoveredName: `Download recovered ${publication.distribution} native wheels`,
-            pattern: `${publication.distribution}--*--python-wheel`,
-            path: `dist/${publication.directory}`,
-            condition: "needs.verify-context.outputs.build_mode == 'remote'",
-          }),
-        ),
-        ...(uniffiPublications.length
-          ? [
-              {
-                name: "Download locally built native wheels",
-                if: "${{ needs.verify-context.outputs.build_mode == 'local' }}",
-                env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
-                shell: "bash",
-                run: [
-                  "mkdir -p dist/local-wheels",
-                  'gh release download "$RELEASE_TAG" --pattern "*.whl" --dir dist/local-wheels',
-                  ...uniffiPublications.flatMap((publication) => [
-                    `mkdir -p dist/${publication.directory}`,
-                    `cp dist/local-wheels/${publication.distribution.replaceAll("-", "_")}-*.whl dist/${publication.directory}/`,
-                  ]),
-                ].join("\n"),
-              },
-            ]
-          : []),
         {
-          name: "Stamp workspace versions",
-          env: { VERSION: RELEASE_VERSION },
-          run: `bun node_modules/@dbx-tools/projen/tasks/stamp-python.ts "$VERSION" --root ${quote(this.repository.root)}`,
-        },
-        {
-          name: "Build distributions",
-          run: publications
-            .map(
-              (publication) =>
-                `uv build --package ${publication.distribution} --out-dir dist/${publication.directory}`,
-            )
-            .join("\n"),
+          name: "Download approved Python distributions",
+          env: { GH_TOKEN: "${{ github.token }}", RELEASE_TAG },
+          run: [
+            "rm -rf dist/release-download",
+            "mkdir -p dist/release-download",
+            'gh release download "$RELEASE_TAG" --pattern release-manifest.json --pattern SHA256SUMS --pattern "*.whl" --pattern "*.tar.gz" --dir dist/release-download',
+          ].join("\n"),
         },
-        {
-          name: "Validate distributions",
+        ...allPublications.map((publication) => ({
+          name: `Select ${publication.distribution} distributions`,
+          env: {
+            PACKAGE_NAME: publication.distribution.replaceAll("_", "-").toLowerCase(),
+            RELEASE_SHA,
+            RELEASE_TAG,
+            RELEASE_VERSION,
+          },
           run: [
-            ...publications.map(
-              (publication) =>
-                `test "$(find dist/${publication.directory} -maxdepth 1 -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) | wc -l | tr -d ' ')" -eq 2`,
-            ),
-            ...uniffiPublications.map(
-              (publication) =>
-                `find dist/${publication.directory} -maxdepth 1 -name '*.whl' -print -quit | grep -q .`,
-            ),
-            "find dist -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check",
+            "bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \\",
+            "  --directory dist/release-download \\",
+            '  --tag "$RELEASE_TAG" \\',
+            '  --sha "$RELEASE_SHA" \\',
+            '  --version "$RELEASE_VERSION" \\',
+            "  --kind pypi \\",
+            '  --package "$PACKAGE_NAME" \\',
+            `  --output dist/${publication.directory}`,
           ].join("\n"),
+        })),
+        {
+          name: "Validate approved distributions",
+          run: `find ${allPublications.map((publication) => `dist/${publication.directory}`).join(" ")} -type f \\( -name '*.whl' -o -name '*.tar.gz' \\) -print0 | xargs -0 uvx twine check`,
         },
         {
           name: "Upload distributions",
           uses: "actions/upload-artifact@v7",
-          with: { name: "python-distributions", path: "dist", "retention-days": 7 },
+          with: {
+            name: "python-distributions",
+            path: allPublications.map((publication) => `dist/${publication.directory}`).join("\n"),
+            "retention-days": 7,
+          },
         },
       ],
     });
     for (const publication of allPublications) {
+      const dependencyJobs = (publication.dependencies ?? []).map(
+        (dependency) => `publish-pypi-${dependency}`,
+      );
       workflow.addJob(`publish-pypi-${publication.directory}`, {
-        if: releasePublishCondition("python"),
-        needs: [
-          "verify-context",
-          "build-python",
-          ...(publication.dependencies ?? []).map((dependency) => `publish-pypi-${dependency}`),
-        ],
+        if: releasePublishCondition("python", [
+          "needs.verify-context.result == 'success'",
+          "needs.build-python.result == 'success'",
+          ...dependencyJobs.map((job) => `needs['${job}'].result == 'success'`),
+        ]),
+        needs: ["verify-context", "build-python", ...dependencyJobs],
         environment: {
           name: publication.environment,
           url:
@@ -710,15 +697,17 @@ export class DBXToolsPythonWorkspace extends Component {
   ): void {
     const repository = this.githubRepository();
     const publications = this.trustedPublisherPublications(options);
-    const releaseBranch = isDBXToolsJavaScriptProject()(project)
-      ? projectReleaseBranch(project)
-      : "main";
+    const releaseTag = isDBXToolsJavaScriptProject()(project)
+      ? project.releaseCatalog.mode === "independent"
+        ? "*-v*"
+        : releaseTagPattern(project)
+      : "v*";
     const linesBeforeAuthentication = [
       "# PyPI Trusted Publisher Setup Instructions",
       "",
       "Use the system browser to audit and configure the PyPI trusted publishers below.",
       "Do not use an in-app browser or embedded webview.",
-      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and branch value is provided below and is authoritative.",
+      "Do not visit GitHub or use the GitHub API or CLI. Every required GitHub owner, repository, workflow, environment, and tag value is provided below and is authoritative.",
       "Use only PyPI pages for this task.",
       "",
       "## Audit and confirmation",
@@ -736,7 +725,7 @@ export class DBXToolsPythonWorkspace extends Component {
       "",
       "## GitHub environment policy",
       "",
-      `- The supplied branch policy value is ${releaseBranch}.`,
+      `- The supplied deployment tag policy value is ${releaseTag}.`,
       "- Do not inspect or configure GitHub environments during this task.",
       "- GitHub environment administration is a separate task; use the supplied values only when comparing PyPI publisher entries.",
       "",
@@ -777,7 +766,7 @@ export class DBXToolsPythonWorkspace extends Component {
           `- Repository name: ${repository.name}`,
           "- Workflow name: release.yml",
           `- Environment name: ${publication.environment}`,
-          `- GitHub environment branch: ${releaseBranch}`,
+          `- GitHub environment tag: ${releaseTag}`,
           ...(publication.artifacts ? [`- Artifacts: ${publication.artifacts}`] : []),
           "",
         ];

package/src/project-rs.ts

@@ -19,7 +19,6 @@ import {
   type RustOpenApiOptions as RustOpenApiConfiguration,
 } from "./_rust-project.ts";
 import {
-  rustAssetsJob,
   configureRustReleaseTask,
   independentRustCargoPublishJob,
   independentRustGitHubReleaseJob,
@@ -29,9 +28,6 @@ import {
   planRustRelease,
   rustBuildJob,
   rustCargoPublishJob,
-  rustGitHubReleaseJob,
-  rustNativeNpmPublishJob,
-  rustNodeFacadePublishJob,
 } from "./_rust-release-workflow.ts";
 import { toPosix } from "./packages.ts";
 import {
@@ -1124,27 +1120,8 @@ export class DBXToolsRustWorkspace extends Component {
       }
       return;
     }
-    if (plan.targets.length) {
-      workflow.addJob("rust-build", rustBuildJob(plan));
-      workflow.addJob("rust-assets", rustAssetsJob());
-    }
     if (plan.publicCrates.length) {
-      workflow.addJob("publish-cargo", rustCargoPublishJob(plan, false));
-      workflow.addJob("publish-local-cargo", rustCargoPublishJob(plan, true));
-    }
-    if (plan.hasTargetOutputs) {
-      workflow.addJob("publish-github-release", rustGitHubReleaseJob(plan));
-    }
-    if (plan.nodeBindings.length && hasNodeRelease(project)) {
-      workflow.addJob("publish-native-npm", rustNativeNpmPublishJob(project));
-      const nodeJob = workflow.getJob("publish-node");
-      if ("uses" in nodeJob) throw new Error("publish-node must be a workflow job");
-      workflow.updateJob("publish-node", {
-        ...nodeJob,
-        if: "${{ always() && needs.verify-context.result == 'success' && needs.publish-native-npm.result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-        needs: ["verify-context", "publish-native-npm"],
-      });
-      workflow.addJob("publish-node-facades", rustNodeFacadePublishJob(project, plan.nodeBindings));
+      workflow.addJob("publish-cargo", rustCargoPublishJob(plan));
     }
   }
 }