@dbx-tools/projen 0.9.18 → 0.9.19

package/tasks/release-manifest.ts

@@ -0,0 +1,273 @@
+#!/usr/bin/env -S bun
+/** Create, verify, and select immutable release-candidate assets. */
+
+import { createHash } from "node:crypto";
+import {
+  copyFileSync,
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+export type ReleaseArtifactKind = "binary" | "npm" | "pypi";
+export type ReleaseArtifactRole = "facade" | "native" | "workspace";
+
+export interface ReleaseArtifactInput {
+  readonly kind: ReleaseArtifactKind;
+  readonly packageName?: string;
+  readonly packageVersion?: string;
+  readonly path: string;
+  readonly role?: ReleaseArtifactRole;
+}
+
+export interface ReleaseArtifact {
+  readonly kind: ReleaseArtifactKind;
+  readonly name: string;
+  readonly packageName?: string;
+  readonly packageVersion?: string;
+  readonly role?: ReleaseArtifactRole;
+  readonly sha256: string;
+  readonly size: number;
+}
+
+export interface ReleaseManifest {
+  readonly schemaVersion: 1;
+  readonly tag: string;
+  readonly version: string;
+  readonly gitSha: string;
+  readonly artifacts: readonly ReleaseArtifact[];
+}
+
+function sha256(path: string): string {
+  return createHash("sha256").update(readFileSync(path)).digest("hex");
+}
+
+/** Copy release artifacts into one upload directory and write its trust manifest. */
+export function writeReleaseManifest(options: {
+  readonly artifacts: readonly ReleaseArtifactInput[];
+  readonly directory: string;
+  readonly gitSha: string;
+  readonly tag: string;
+  readonly version: string;
+}): ReleaseManifest {
+  const directory = resolve(options.directory);
+  rmSync(directory, { recursive: true, force: true });
+  mkdirSync(directory, { recursive: true });
+  const names = new Set<string>();
+  const artifacts = options.artifacts
+    .map((artifact): ReleaseArtifact => {
+      const source = resolve(artifact.path);
+      if (!existsSync(source)) throw new Error(`Missing release artifact: ${source}`);
+      const name = basename(source);
+      if (names.has(name)) throw new Error(`Duplicate release artifact name: ${name}`);
+      names.add(name);
+      copyFileSync(source, join(directory, name));
+      return {
+        kind: artifact.kind,
+        name,
+        ...(artifact.packageName ? { packageName: artifact.packageName } : {}),
+        ...(artifact.packageVersion ? { packageVersion: artifact.packageVersion } : {}),
+        ...(artifact.role ? { role: artifact.role } : {}),
+        sha256: sha256(source),
+        size: statSync(source).size,
+      };
+    })
+    .sort((left, right) => left.name.localeCompare(right.name));
+  const manifest: ReleaseManifest = {
+    schemaVersion: 1,
+    tag: options.tag,
+    version: options.version,
+    gitSha: options.gitSha,
+    artifacts,
+  };
+  writeFileSync(join(directory, "release-manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+  writeFileSync(
+    join(directory, "SHA256SUMS"),
+    `${artifacts.map((artifact) => `${artifact.sha256}  ${artifact.name}`).join("\n")}\n`,
+  );
+  return manifest;
+}
+
+function readManifest(directory: string): ReleaseManifest {
+  const value = JSON.parse(
+    readFileSync(join(directory, "release-manifest.json"), "utf8"),
+  ) as unknown;
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error("Unsupported release manifest");
+  }
+  const record = value as Record<string, unknown>;
+  if (
+    record.schemaVersion !== 1 ||
+    typeof record.tag !== "string" ||
+    typeof record.version !== "string" ||
+    typeof record.gitSha !== "string" ||
+    !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(record.gitSha) ||
+    !Array.isArray(record.artifacts)
+  ) {
+    throw new Error("Unsupported release manifest");
+  }
+  const names = new Set<string>();
+  const artifacts = record.artifacts.map((value): ReleaseArtifact => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new Error("Invalid release artifact");
+    }
+    const artifact = value as Record<string, unknown>;
+    if (
+      !["binary", "npm", "pypi"].includes(String(artifact.kind)) ||
+      typeof artifact.name !== "string" ||
+      basename(artifact.name) !== artifact.name ||
+      artifact.name === "." ||
+      artifact.name === ".." ||
+      typeof artifact.sha256 !== "string" ||
+      !/^[0-9a-f]{64}$/.test(artifact.sha256) ||
+      !Number.isSafeInteger(artifact.size) ||
+      Number(artifact.size) < 0
+    ) {
+      throw new Error("Invalid release artifact");
+    }
+    if (names.has(artifact.name)) {
+      throw new Error(`Duplicate release artifact name: ${artifact.name}`);
+    }
+    names.add(artifact.name);
+    const kind = artifact.kind as ReleaseArtifactKind;
+    const packageName = artifact.packageName;
+    const packageVersion = artifact.packageVersion;
+    const role = artifact.role;
+    if (
+      (packageName !== undefined && typeof packageName !== "string") ||
+      (packageVersion !== undefined && typeof packageVersion !== "string") ||
+      (role !== undefined && !["facade", "native", "workspace"].includes(String(role))) ||
+      (kind !== "binary" && (!packageName || !packageVersion))
+    ) {
+      throw new Error(`Invalid release artifact metadata: ${artifact.name}`);
+    }
+    return {
+      kind,
+      name: artifact.name,
+      ...(packageName ? { packageName } : {}),
+      ...(packageVersion ? { packageVersion } : {}),
+      ...(role ? { role: role as ReleaseArtifactRole } : {}),
+      sha256: artifact.sha256,
+      size: Number(artifact.size),
+    };
+  });
+  return {
+    schemaVersion: 1,
+    tag: record.tag,
+    version: record.version,
+    gitSha: record.gitSha,
+    artifacts,
+  };
+}
+
+/** Verify a release bundle and optionally extract one registry/package subset. */
+export function verifyReleaseManifest(options: {
+  readonly directory: string;
+  readonly gitSha: string;
+  readonly kind?: ReleaseArtifactKind;
+  readonly output?: string;
+  readonly packageName?: string;
+  readonly tag: string;
+  readonly version: string;
+}): readonly ReleaseArtifact[] {
+  const directory = resolve(options.directory);
+  const manifest = readManifest(directory);
+  if (manifest.tag !== options.tag) {
+    throw new Error(`Release manifest tag ${manifest.tag} does not match ${options.tag}`);
+  }
+  if (manifest.version !== options.version) {
+    throw new Error(
+      `Release manifest version ${manifest.version} does not match ${options.version}`,
+    );
+  }
+  if (manifest.gitSha !== options.gitSha) {
+    throw new Error(`Release manifest SHA ${manifest.gitSha} does not match ${options.gitSha}`);
+  }
+  for (const artifact of manifest.artifacts) {
+    if (artifact.kind !== "binary" && artifact.packageVersion !== options.version) {
+      throw new Error(
+        `Release artifact ${artifact.name} carries ${String(artifact.packageVersion)}, expected ${options.version}`,
+      );
+    }
+  }
+  const expectedChecksums = `${manifest.artifacts
+    .map((artifact) => `${artifact.sha256}  ${artifact.name}`)
+    .join("\n")}\n`;
+  const checksums = readFileSync(join(directory, "SHA256SUMS"), "utf8");
+  if (checksums !== expectedChecksums) throw new Error("SHA256SUMS does not match the manifest");
+  const selected = manifest.artifacts.filter(
+    (artifact) =>
+      (!options.kind || artifact.kind === options.kind) &&
+      (!options.packageName || artifact.packageName === options.packageName),
+  );
+  if ((options.kind || options.packageName) && selected.length === 0) {
+    throw new Error("Release manifest selection matched no artifacts");
+  }
+  if (!options.kind && !options.packageName) {
+    const expected = new Set([
+      "release-manifest.json",
+      "SHA256SUMS",
+      ...manifest.artifacts.map((artifact) => artifact.name),
+    ]);
+    const present = readdirSync(directory).filter((name) => !name.startsWith("."));
+    const unexpected = present.filter((name) => !expected.has(name));
+    if (unexpected.length > 0) {
+      throw new Error(`Release contains unmanifested assets: ${unexpected.sort().join(", ")}`);
+    }
+  }
+  const output = options.output ? resolve(options.output) : undefined;
+  if (output) {
+    rmSync(output, { recursive: true, force: true });
+    mkdirSync(output, { recursive: true });
+  }
+  for (const artifact of selected) {
+    const source = join(directory, artifact.name);
+    if (!existsSync(source)) throw new Error(`Missing release asset: ${artifact.name}`);
+    if (statSync(source).size !== artifact.size) {
+      throw new Error(`Release asset size does not match: ${artifact.name}`);
+    }
+    if (sha256(source) !== artifact.sha256) {
+      throw new Error(`Release asset checksum does not match: ${artifact.name}`);
+    }
+    if (output) copyFileSync(source, join(output, artifact.name));
+  }
+  return selected;
+}
+
+if (import.meta.main) {
+  const { positionals, values } = parseArgs({
+    args: process.argv.slice(2),
+    allowPositionals: true,
+    options: {
+      directory: { type: "string" },
+      kind: { type: "string" },
+      output: { type: "string" },
+      package: { type: "string" },
+      sha: { type: "string" },
+      tag: { type: "string" },
+      version: { type: "string" },
+    },
+  });
+  if (positionals[0] !== "verify") throw new Error("Expected verify command");
+  if (!values.directory || !values.sha || !values.tag || !values.version) {
+    throw new Error("verify requires --directory, --sha, --tag, and --version");
+  }
+  if (values.kind && !["binary", "npm", "pypi"].includes(values.kind)) {
+    throw new Error(`Unknown release artifact kind: ${values.kind}`);
+  }
+  verifyReleaseManifest({
+    directory: values.directory,
+    gitSha: values.sha,
+    ...(values.kind ? { kind: values.kind as ReleaseArtifactKind } : {}),
+    ...(values.output ? { output: values.output } : {}),
+    ...(values.package ? { packageName: values.package } : {}),
+    tag: values.tag,
+    version: values.version,
+  });
+}

package/tasks/release-pr.ts

@@ -55,41 +55,6 @@ import {
 
 const logger = log.logger("projen:release");
 
-export type ReleaseBuildMode = "auto" | "local" | "remote";
-
-/** Resolve an explicit or environment-sensitive native release build mode. */
-export function resolveReleaseBuildMode(options: {
-  readonly requested: ReleaseBuildMode;
-  readonly canManage: boolean;
-  readonly localTools: readonly string[];
-  readonly hasLocalTargets: boolean;
-  readonly approve: boolean;
-  readonly wait: boolean;
-  readonly hostPlatform?: NodeJS.Platform;
-}): Exclude<ReleaseBuildMode, "auto"> {
-  const local =
-    options.canManage &&
-    options.hasLocalTargets &&
-    (options.hostPlatform ?? process.platform) === "darwin" &&
-    options.localTools.length === 0 &&
-    options.approve &&
-    options.wait;
-  if (options.requested === "auto") return local ? "local" : "remote";
-  if (options.requested === "remote") return "remote";
-  if (!options.canManage) throw new Error("--build local requires maintain or admin permission");
-  if (!options.hasLocalTargets) throw new Error("--build local requires Rust release targets");
-  if ((options.hostPlatform ?? process.platform) !== "darwin") {
-    throw new Error("--build local requires macOS");
-  }
-  if (options.localTools.length > 0) {
-    throw new Error(`--build local requires: ${options.localTools.join(", ")}`);
-  }
-  if (!options.approve || !options.wait) {
-    throw new Error("--build local requires automatic merge and waiting");
-  }
-  return "local";
-}
-
 function git(
   root: string,
   args: string[],
@@ -115,6 +80,34 @@ async function waitForPullRequestMerge(
   env: NodeJS.ProcessEnv,
   timeoutMs: number,
 ): Promise<string> {
+  const checksDeadline = Date.now() + timeoutMs;
+  let checksReported = false;
+  while (Date.now() < checksDeadline) {
+    const count = Number(
+      captureTaskCommand(
+        root,
+        "gh",
+        [
+          "pr",
+          "view",
+          releaseBranch,
+          "--json",
+          "statusCheckRollup",
+          "--jq",
+          ".statusCheckRollup | length",
+        ],
+        { env },
+      ),
+    );
+    if (Number.isInteger(count) && count > 0) {
+      checksReported = true;
+      break;
+    }
+    await asyncUtils.sleep(2_000);
+  }
+  if (!checksReported) {
+    throw new Error(`Release pull request reported no checks within ${timeoutMs}ms`);
+  }
   await runTaskCommandAsync(
     root,
     "gh",
@@ -145,64 +138,6 @@ async function waitForPullRequestMerge(
   throw new Error(`Release pull request did not merge within ${timeoutMs}ms`);
 }
 
-/** Find and watch the release workflow for an exact merged commit. */
-async function waitForReleaseWorkflow(
-  root: string,
-  baseBranch: string,
-  mergeSha: string,
-  env: NodeJS.ProcessEnv,
-  timeoutMs: number,
-): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  let runId = "";
-  while (Date.now() < deadline) {
-    runId = captureTaskCommand(
-      root,
-      "gh",
-      [
-        "run",
-        "list",
-        "--workflow",
-        "release.yml",
-        "--branch",
-        baseBranch,
-        "--event",
-        "push",
-        "--commit",
-        mergeSha,
-        "--limit",
-        "1",
-        "--json",
-        "databaseId",
-        "--jq",
-        ".[0].databaseId // empty",
-      ],
-      { env },
-    );
-    if (runId) break;
-    await asyncUtils.sleep(5_000);
-  }
-  if (!runId) throw new Error(`Release workflow did not start within ${timeoutMs}ms`);
-  await runTaskCommandAsync(root, "gh", ["run", "watch", runId, "--exit-status"], {
-    env,
-    signal: AbortSignal.timeout(timeoutMs),
-  });
-}
-
-async function waitForGitHubRelease(
-  root: string,
-  tag: string,
-  env: NodeJS.ProcessEnv,
-  timeoutMs: number,
-): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (taskCommandSucceeds(root, "gh", ["release", "view", tag], { env })) return;
-    await asyncUtils.sleep(2_000);
-  }
-  throw new Error(`GitHub Release ${tag} did not appear within ${timeoutMs}ms`);
-}
-
 function githubAccount(root: string): {
   hostname: string;
   owner: string;
@@ -323,12 +258,11 @@ program
   .option("--no-validate", "skip repository validation tasks, Rust tests, and TypeScript compile")
   .option("--no-local-publish", "skip local npm, PyPI, and Cargo publication")
   .option("--no-local-cargo", "skip local Cargo publication")
-  .option("--build <mode>", "native release build: auto, local, or remote", "auto")
   .option("--no-approve", "open the release pull request without enabling automatic merge")
   .option("--no-wait", "return after enabling automatic merge without watching publication")
   .option(
     "--wait-timeout-minutes <minutes>",
-    "maximum time for pull request checks, merge, and publication",
+    "maximum time for pull request checks and merge",
     "120",
   )
   .action(
@@ -348,7 +282,6 @@ program
       validate: boolean;
       localPublish: boolean;
       localCargo: boolean;
-      build: ReleaseBuildMode;
       approve: boolean;
       wait: boolean;
       waitTimeoutMinutes: string;
@@ -367,29 +300,21 @@ program
           throw new Error("--wait-timeout-minutes must be a positive integer");
         }
         const waitTimeoutMs = waitTimeoutMinutes * 60_000;
+        if (opts.approve && !opts.wait) {
+          throw new Error("automatic merge requires waiting so the draft candidate can be built");
+        }
         const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
         if (!currentBranch) throw new Error("Release preparation requires a local branch");
         const account = githubAccount(root);
-        if (!["auto", "local", "remote"].includes(opts.build)) {
-          throw new Error("--build must be auto, local, or remote");
+        if (!account.canManage) {
+          throw new Error("Release preparation requires maintain or admin permission");
+        }
+        if (hasLocalReleaseTargets(root)) {
+          const localTools = missingLocalReleaseTools(root);
+          if (localTools.length > 0) {
+            throw new Error(`Local release candidate build requires: ${localTools.join(", ")}`);
+          }
         }
-        const inspectLocalTools =
-          opts.build === "local" || (opts.build === "auto" && account.canManage);
-        const localTools = inspectLocalTools ? missingLocalReleaseTools(root) : [];
-        const buildMode = resolveReleaseBuildMode({
-          requested: opts.build,
-          canManage: account.canManage,
-          localTools,
-          hasLocalTargets: hasLocalReleaseTargets(root),
-          approve: opts.approve,
-          wait: opts.wait,
-        });
-        logger.info("selected native release build", {
-          requested: opts.build,
-          resolved: buildMode,
-          manager: account.canManage,
-          ...(localTools.length > 0 ? { missing: localTools } : {}),
-        });
         git(root, ["fetch", "--tags", "origin", opts.base]);
         const comparisonBase = resolveBaseVersion(root, [opts.prefix], {
           fetch: false,
@@ -529,13 +454,7 @@ program
         git(releaseRoot, ["add", "-A"]);
         const staged = git(releaseRoot, ["diff", "--cached", "--name-only"], { capture: true });
         if (staged) {
-          git(releaseRoot, [
-            "commit",
-            "-m",
-            `chore(release): ${next.version}`,
-            "-m",
-            `Release-Build: ${buildMode}`,
-          ]);
+          git(releaseRoot, ["commit", "-m", `chore(release): ${next.version}`]);
         } else if (!worktreeExists) {
           throw new Error("Release preparation produced no changes");
         }
@@ -550,9 +469,7 @@ program
           "",
           `Source commit: ${git(releaseRoot, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
           "",
-          "Merging this PR updates VERSION on main and starts the public release workflow.",
-          "",
-          `Native build: ${buildMode}.`,
+          "Merging this PR updates VERSION on main and prepares a draft GitHub Release.",
           ...(releaseSummary ? ["", releaseSummary] : []),
         ].join("\n");
         const githubEnvironment = {
@@ -601,35 +518,35 @@ program
             waitTimeoutMs,
           );
           logger.info("release pull request merged", { releaseBranch, mergeSha });
-          if (buildMode === "local") {
-            git(root, ["fetch", "origin", opts.base]);
-            git(releaseRoot, ["switch", "--detach", mergeSha]);
-            runTaskCommand(releaseRoot, process.execPath, ["install"]);
-            await waitForGitHubRelease(root, releaseTag, githubEnvironment, waitTimeoutMs);
-            const releaseAssetsScript = join(
-              releaseRoot,
-              "node_modules/@dbx-tools/projen/tasks/release-assets.ts",
-            );
-            runTaskCommand(
+          git(root, ["fetch", "origin", opts.base]);
+          git(releaseRoot, ["switch", "--detach", mergeSha]);
+          runTaskCommand(releaseRoot, process.execPath, ["install"]);
+          const releaseCandidateScript = join(
+            releaseRoot,
+            "node_modules/@dbx-tools/projen/tasks/release-candidate.ts",
+          );
+          runTaskCommand(
+            releaseRoot,
+            process.execPath,
+            [
+              releaseCandidateScript,
+              "--root",
               releaseRoot,
-              process.execPath,
-              [
-                releaseAssetsScript,
-                "--root",
-                releaseRoot,
-                "--version",
-                next.version,
-                "--tag",
-                releaseTag,
-                "--upload",
-              ],
-              { env: githubEnvironment },
-            );
-          }
+              "--version",
+              next.version,
+              "--tag",
+              releaseTag,
+              "--sha",
+              mergeSha,
+              "--notes-file",
+              `docs/releases/v${next.version}.md`,
+              "--upload",
+            ],
+            { env: githubEnvironment },
+          );
           git(root, ["worktree", "remove", "--force", releaseRoot]);
           git(root, ["branch", "--delete", "--force", releaseBranch]);
-          await waitForReleaseWorkflow(root, opts.base, mergeSha, githubEnvironment, waitTimeoutMs);
-          logger.success(`published ${releaseTag} from ${mergeSha}`);
+          logger.success(`prepared draft ${releaseTag} from ${mergeSha}`);
           return;
         }
         git(root, ["worktree", "remove", "--force", releaseRoot]);