@dbx-tools/projen 0.9.18 → 0.9.21

package/tasks/release-pr.ts

@@ -10,11 +10,9 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import * as exec from "@dbx-tools/core/exec";
 import * as projectUtils from "@dbx-tools/core/project-utils";
 import { asyncUtils, json, log, object } from "@dbx-tools/shared-core";
 import { Command } from "commander";
-import { publishLocalRelease } from "./local-publish.ts";
 import { hasLocalReleaseTargets, missingLocalReleaseTools } from "./release-assets.ts";
 import { generateReleaseSummary } from "./release-summary.ts";
 import {
@@ -26,7 +24,10 @@ import {
   type VersionLevel,
 } from "../src/_release-platform.ts";
 import {
+  captureGitTaskCommand,
   captureTaskCommand,
+  gitTaskCommandSucceeds,
+  runGitTaskCommand,
   runTaskCommand,
   runTaskCommandAsync,
   taskCommandSucceeds,
@@ -55,57 +56,8 @@ import {
 
 const logger = log.logger("projen:release");
 
-export type ReleaseBuildMode = "auto" | "local" | "remote";
-
-/** Resolve an explicit or environment-sensitive native release build mode. */
-export function resolveReleaseBuildMode(options: {
-  readonly requested: ReleaseBuildMode;
-  readonly canManage: boolean;
-  readonly localTools: readonly string[];
-  readonly hasLocalTargets: boolean;
-  readonly approve: boolean;
-  readonly wait: boolean;
-  readonly hostPlatform?: NodeJS.Platform;
-}): Exclude<ReleaseBuildMode, "auto"> {
-  const local =
-    options.canManage &&
-    options.hasLocalTargets &&
-    (options.hostPlatform ?? process.platform) === "darwin" &&
-    options.localTools.length === 0 &&
-    options.approve &&
-    options.wait;
-  if (options.requested === "auto") return local ? "local" : "remote";
-  if (options.requested === "remote") return "remote";
-  if (!options.canManage) throw new Error("--build local requires maintain or admin permission");
-  if (!options.hasLocalTargets) throw new Error("--build local requires Rust release targets");
-  if ((options.hostPlatform ?? process.platform) !== "darwin") {
-    throw new Error("--build local requires macOS");
-  }
-  if (options.localTools.length > 0) {
-    throw new Error(`--build local requires: ${options.localTools.join(", ")}`);
-  }
-  if (!options.approve || !options.wait) {
-    throw new Error("--build local requires automatic merge and waiting");
-  }
-  return "local";
-}
-
-function git(
-  root: string,
-  args: string[],
-  { capture = false, check = true }: { capture?: boolean; check?: boolean } = {},
-): string {
-  if (capture) return captureTaskCommand(root, "git", args, { check });
-  runTaskCommand(root, "git", args);
-  return "";
-}
-
 function pushCurrentBranch(root: string, branch: string): void {
-  git(root, ["push", "--set-upstream", "origin", `HEAD:${branch}`]);
-}
-
-function gitSucceeds(root: string, args: string[]): boolean {
-  return taskCommandSucceeds(root, "git", args);
+  runGitTaskCommand(root, ["push", "--set-upstream", "origin", `HEAD:${branch}`]);
 }
 
 /** Wait for required checks and return the merged pull request commit. */
@@ -115,6 +67,34 @@ async function waitForPullRequestMerge(
   env: NodeJS.ProcessEnv,
   timeoutMs: number,
 ): Promise<string> {
+  const checksDeadline = Date.now() + timeoutMs;
+  let checksReported = false;
+  while (Date.now() < checksDeadline) {
+    const count = Number(
+      captureTaskCommand(
+        root,
+        "gh",
+        [
+          "pr",
+          "view",
+          releaseBranch,
+          "--json",
+          "statusCheckRollup",
+          "--jq",
+          ".statusCheckRollup | length",
+        ],
+        { env },
+      ),
+    );
+    if (Number.isInteger(count) && count > 0) {
+      checksReported = true;
+      break;
+    }
+    await asyncUtils.sleep(2_000);
+  }
+  if (!checksReported) {
+    throw new Error(`Release pull request reported no checks within ${timeoutMs}ms`);
+  }
   await runTaskCommandAsync(
     root,
     "gh",
@@ -145,64 +125,6 @@ async function waitForPullRequestMerge(
   throw new Error(`Release pull request did not merge within ${timeoutMs}ms`);
 }
 
-/** Find and watch the release workflow for an exact merged commit. */
-async function waitForReleaseWorkflow(
-  root: string,
-  baseBranch: string,
-  mergeSha: string,
-  env: NodeJS.ProcessEnv,
-  timeoutMs: number,
-): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  let runId = "";
-  while (Date.now() < deadline) {
-    runId = captureTaskCommand(
-      root,
-      "gh",
-      [
-        "run",
-        "list",
-        "--workflow",
-        "release.yml",
-        "--branch",
-        baseBranch,
-        "--event",
-        "push",
-        "--commit",
-        mergeSha,
-        "--limit",
-        "1",
-        "--json",
-        "databaseId",
-        "--jq",
-        ".[0].databaseId // empty",
-      ],
-      { env },
-    );
-    if (runId) break;
-    await asyncUtils.sleep(5_000);
-  }
-  if (!runId) throw new Error(`Release workflow did not start within ${timeoutMs}ms`);
-  await runTaskCommandAsync(root, "gh", ["run", "watch", runId, "--exit-status"], {
-    env,
-    signal: AbortSignal.timeout(timeoutMs),
-  });
-}
-
-async function waitForGitHubRelease(
-  root: string,
-  tag: string,
-  env: NodeJS.ProcessEnv,
-  timeoutMs: number,
-): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    if (taskCommandSucceeds(root, "gh", ["release", "view", tag], { env })) return;
-    await asyncUtils.sleep(2_000);
-  }
-  throw new Error(`GitHub Release ${tag} did not appear within ${timeoutMs}ms`);
-}
-
 function githubAccount(root: string): {
   hostname: string;
   owner: string;
@@ -214,27 +136,22 @@ function githubAccount(root: string): {
   const repository = projectUtils.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
   const identity = githubRepositoryIdentity(repository);
-  const status = exec
-    .spawnSync("gh", ["auth", "status", "--hostname", identity.hostname, "--json", "hosts"], {
-      cwd: root,
-      stdout: "capture",
-      stderr: "ignore",
-      stdin: "ignore",
-      check: false,
-    })
-    .stdout?.trim();
-  const accounts = githubAuthenticatedAccounts(status ?? "", identity.hostname);
+  const status = captureTaskCommand(root, "gh", [
+    "auth",
+    "status",
+    "--hostname",
+    identity.hostname,
+    "--json",
+    "hosts",
+  ]);
+  const accounts = githubAuthenticatedAccounts(status, identity.hostname);
   for (const account of accounts) {
     if (!githubAccountSupportsWorkflowChanges(account)) continue;
-    const token = exec
-      .spawnSync("gh", githubTokenArguments(identity.hostname, account.login), {
-        cwd: root,
-        stdout: "capture",
-        stderr: "ignore",
-        stdin: "ignore",
-        check: false,
-      })
-      .stdout?.trim();
+    const token = captureTaskCommand(
+      root,
+      "gh",
+      githubTokenArguments(identity.hostname, account.login),
+    );
     if (!token) continue;
     const tokenEnvironment = {
       ...process.env,
@@ -242,16 +159,11 @@ function githubAccount(root: string): {
       GH_REPO: githubRepositorySpecifier(identity),
       [githubTokenEnvironmentName(identity.hostname)]: token,
     };
-    const repositoryResult = exec.spawnSync("gh", ["api", githubRepositoryApiPath(identity)], {
-      cwd: root,
-      env: tokenEnvironment,
-      stdout: "capture",
-      stderr: "ignore",
-      stdin: "ignore",
-      check: false,
-    });
-    const repositoryData =
-      repositoryResult.exitCode === 0 ? json.parseRecord(repositoryResult.stdout ?? "") : undefined;
+    const repositoryData = json.parseRecord(
+      captureTaskCommand(root, "gh", ["api", githubRepositoryApiPath(identity)], {
+        env: tokenEnvironment,
+      }),
+    );
     const permissions = githubRepositoryPermissions(repositoryData);
     if (!permissions.push && !permissions.maintain && !permissions.admin) {
       continue;
@@ -303,12 +215,12 @@ program
   .addOption(releaseLevelOption())
   .option("--prefix <prefix>", "release tag prefix", "v")
   .option("--base <branch>", "release pull request base branch", "main")
+  .option("--python-root <path>", "Python package root", "packages/py")
   .option("--message <message>", "commit message for pending source work", "chore: prepare release")
   .addOption(releaseOperatingSystemOption())
   .addOption(releaseArchitectureOption())
   .option("--local-registry <value>", "local npm registry: auto, false, or an explicit URL", "auto")
   .option("--local-pypi <value>", "local PyPI index: auto, false, or an explicit URL", "auto")
-  .option("--python-root <path>", "Python workspace package root")
   .option(
     "--validate-task <task>",
     "repository task to run before release validation; repeatable",
@@ -323,12 +235,11 @@ program
   .option("--no-validate", "skip repository validation tasks, Rust tests, and TypeScript compile")
   .option("--no-local-publish", "skip local npm, PyPI, and Cargo publication")
   .option("--no-local-cargo", "skip local Cargo publication")
-  .option("--build <mode>", "native release build: auto, local, or remote", "auto")
   .option("--no-approve", "open the release pull request without enabling automatic merge")
   .option("--no-wait", "return after enabling automatic merge without watching publication")
   .option(
     "--wait-timeout-minutes <minutes>",
-    "maximum time for pull request checks, merge, and publication",
+    "maximum time for pull request checks and merge",
     "120",
   )
   .action(
@@ -336,19 +247,18 @@ program
       level: VersionLevel;
       prefix: string;
       base: string;
+      pythonRoot: string;
       message: string;
       os: ReleaseOs[];
       arch: ReleaseArch[];
       localRegistry: string;
       localPypi: string;
-      pythonRoot?: string;
       validateTask: string[];
       releaseSummary: boolean;
       releaseSummaryProviders?: string;
       validate: boolean;
       localPublish: boolean;
       localCargo: boolean;
-      build: ReleaseBuildMode;
       approve: boolean;
       wait: boolean;
       waitTimeoutMinutes: string;
@@ -367,35 +277,26 @@ program
           throw new Error("--wait-timeout-minutes must be a positive integer");
         }
         const waitTimeoutMs = waitTimeoutMinutes * 60_000;
-        const currentBranch = git(root, ["branch", "--show-current"], { capture: true });
+        if (opts.approve && !opts.wait) {
+          throw new Error("automatic merge requires waiting so the draft candidate can be built");
+        }
+        const currentBranch = captureGitTaskCommand(root, ["branch", "--show-current"], {
+          check: true,
+        });
         if (!currentBranch) throw new Error("Release preparation requires a local branch");
         const account = githubAccount(root);
-        if (!["auto", "local", "remote"].includes(opts.build)) {
-          throw new Error("--build must be auto, local, or remote");
+        if (!account.canManage) {
+          throw new Error("Release preparation requires maintain or admin permission");
         }
-        const inspectLocalTools =
-          opts.build === "local" || (opts.build === "auto" && account.canManage);
-        const localTools = inspectLocalTools ? missingLocalReleaseTools(root) : [];
-        const buildMode = resolveReleaseBuildMode({
-          requested: opts.build,
-          canManage: account.canManage,
-          localTools,
-          hasLocalTargets: hasLocalReleaseTargets(root),
-          approve: opts.approve,
-          wait: opts.wait,
-        });
-        logger.info("selected native release build", {
-          requested: opts.build,
-          resolved: buildMode,
-          manager: account.canManage,
-          ...(localTools.length > 0 ? { missing: localTools } : {}),
-        });
-        git(root, ["fetch", "--tags", "origin", opts.base]);
-        const comparisonBase = resolveBaseVersion(root, [opts.prefix], {
-          fetch: false,
-          includeComponentTags: false,
-        }).version;
-        const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
+        if (hasLocalReleaseTargets(root)) {
+          const localTools = missingLocalReleaseTools(root);
+          if (localTools.length > 0) {
+            throw new Error(`Local release candidate build requires: ${localTools.join(", ")}`);
+          }
+        }
+        runGitTaskCommand(root, ["fetch", "--tags", "origin", opts.base]);
+        const comparisonBase = resolveBaseVersion(root);
+        const next = resolveNextVersion(root, opts.level);
         const releaseVersionScript = fileURLToPath(
           new URL("./release-version.ts", import.meta.url),
         );
@@ -409,236 +310,278 @@ program
         ]);
         const releaseTag = `${opts.prefix}${next.version}`;
         const releaseBranch = `release/${releaseTag}`;
-        const releaseRoot = join(root, ".worktrees", releaseTag);
         if (currentBranch.startsWith("release/")) {
           throw new Error("Release preparation must start from a source branch");
         }
         if (
-          git(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`], {
-            capture: true,
-            check: false,
-          })
+          captureGitTaskCommand(root, ["ls-remote", "--tags", "origin", `refs/tags/${releaseTag}`])
         ) {
           throw new Error(`Release tag already exists: ${releaseTag}`);
         }
 
-        const status = git(root, ["status", "--porcelain=v1", "--untracked-files=all"], {
-          capture: true,
-        });
+        const status = captureGitTaskCommand(
+          root,
+          ["status", "--porcelain=v1", "--untracked-files=all"],
+          { check: true },
+        );
         if (status) {
-          git(root, ["add", "-A"]);
-          git(root, ["commit", "-m", opts.message]);
+          runGitTaskCommand(root, ["add", "-A"]);
+          runGitTaskCommand(root, ["commit", "-m", opts.message]);
         }
-        if (!gitSucceeds(root, ["merge-base", "--is-ancestor", `origin/${opts.base}`, "HEAD"])) {
-          git(root, ["merge", "--no-edit", `origin/${opts.base}`]);
+        if (
+          !gitTaskCommandSucceeds(root, [
+            "merge-base",
+            "--is-ancestor",
+            `origin/${opts.base}`,
+            "HEAD",
+          ])
+        ) {
+          runGitTaskCommand(root, ["merge", "--no-edit", `origin/${opts.base}`]);
         }
         pushCurrentBranch(root, currentBranch);
-
-        const worktreeExists = existsSync(join(releaseRoot, ".git"));
-        if (!worktreeExists) {
-          git(root, ["worktree", "prune"]);
-          const localBranch = git(root, ["branch", "--list", releaseBranch], { capture: true });
-          const remoteBranch = git(
-            root,
-            ["ls-remote", "--heads", "origin", `refs/heads/${releaseBranch}`],
-            { capture: true, check: false },
-          );
-          if (localBranch || remoteBranch) {
-            throw new Error(`Release branch already exists without its worktree: ${releaseBranch}`);
-          }
-          git(root, ["worktree", "add", "-b", releaseBranch, releaseRoot, "HEAD"]);
-        } else {
-          const releaseStatus = git(
-            releaseRoot,
-            ["status", "--porcelain=v1", "--untracked-files=all"],
-            { capture: true },
-          );
-          if (releaseStatus) {
-            git(releaseRoot, [
-              "stash",
-              "push",
-              "--include-untracked",
-              "--message",
-              "release-resume",
+        const localBranch = Boolean(
+          captureGitTaskCommand(root, ["branch", "--list", releaseBranch]),
+        );
+        const remoteBranch = Boolean(
+          captureGitTaskCommand(root, [
+            "ls-remote",
+            "--heads",
+            "origin",
+            `refs/heads/${releaseBranch}`,
+          ]),
+        );
+        let releaseCompleted = false;
+        try {
+          if (localBranch) {
+            runGitTaskCommand(root, ["switch", releaseBranch]);
+          } else if (remoteBranch) {
+            runGitTaskCommand(root, [
+              "switch",
+              "--track",
+              "-c",
+              releaseBranch,
+              `origin/${releaseBranch}`,
             ]);
+          } else {
+            runGitTaskCommand(root, ["switch", "-c", releaseBranch]);
           }
-          if (!gitSucceeds(releaseRoot, ["merge-base", "--is-ancestor", currentBranch, "HEAD"])) {
-            git(releaseRoot, ["merge", "--no-edit", currentBranch]);
-          }
-          if (releaseStatus) {
-            git(releaseRoot, ["stash", "pop"]);
+          const resumableStash = captureGitTaskCommand(root, [
+            "stash",
+            "list",
+            "--format=%gd%x09%s",
+          ])
+            .split("\n")
+            .find((line) => line.includes(`release-resume:${releaseBranch}`))
+            ?.split("\t")[0];
+          if (resumableStash) runGitTaskCommand(root, ["stash", "pop", resumableStash]);
+          if (
+            !gitTaskCommandSucceeds(root, ["merge-base", "--is-ancestor", currentBranch, "HEAD"])
+          ) {
+            runGitTaskCommand(root, ["merge", "--no-edit", currentBranch]);
           }
-          logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
-        }
-        runTaskCommand(releaseRoot, process.execPath, ["install"]);
-
-        const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
-        const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
-        runTaskCommand(releaseRoot, process.execPath, [
-          bumpScript,
-          "--level",
-          opts.level,
-          "--prefix",
-          opts.prefix,
-          ...opts.os.flatMap((value) => ["--os", value]),
-          ...opts.arch.flatMap((value) => ["--arch", value]),
-        ]);
-        if (readWorkspaceVersion(releaseRoot) !== next.version) {
-          throw new Error(`Release preparation did not produce ${next.version}`);
-        }
+          runTaskCommand(root, process.execPath, ["install"]);
 
-        runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
-        if (opts.validate) {
-          for (const task of opts.validateTask) {
-            runTaskCommand(releaseRoot, process.execPath, ["run", task]);
-          }
-          if (existsSync(join(releaseRoot, "Cargo.toml"))) {
-            runTaskCommand(releaseRoot, "cargo", [
-              "test",
-              "--workspace",
-              ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
+          const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
+          const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
+          const preparedVersion = readWorkspaceVersion(root);
+          if (preparedVersion !== next.version) {
+            if (preparedVersion !== comparisonBase) {
+              throw new Error(
+                `${releaseBranch} carries ${preparedVersion}; expected ${comparisonBase} or ${next.version}`,
+              );
+            }
+            runTaskCommand(root, process.execPath, [
+              bumpScript,
+              "--level",
+              opts.level,
+              ...opts.os.flatMap((value) => ["--os", value]),
+              ...opts.arch.flatMap((value) => ["--arch", value]),
             ]);
+          } else {
+            logger.info(`resuming prepared ${releaseTag}`);
+          }
+          if (readWorkspaceVersion(root) !== next.version) {
+            throw new Error(`Release preparation did not produce ${next.version}`);
           }
-          runTaskCommand(releaseRoot, process.execPath, ["run", "compile"]);
-        } else {
-          logger.warn("release validation skipped by --no-validate");
-        }
-        if (opts.localPublish) {
-          await publishLocalRelease({
-            root: releaseRoot,
-            version: next.version,
-            localRegistry: opts.localRegistry,
-            localPypi: opts.localPypi,
-            pythonRoot: opts.pythonRoot,
-            localCargo: opts.localCargo,
-            reuseValidatedNodeCompile: opts.validate,
-          });
-        } else {
-          logger.info("local publication skipped by --no-local-publish");
-        }
-        runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
-        const releaseSummary = opts.releaseSummary
-          ? await generateReleaseSummary({
-              root: releaseRoot,
-              version: next.version,
-              fromRef: `${opts.prefix}${comparisonBase}`,
-              providers: releaseSummaryProviders(opts.releaseSummaryProviders),
-            })
-          : undefined;
 
-        git(releaseRoot, ["add", "-A"]);
-        const staged = git(releaseRoot, ["diff", "--cached", "--name-only"], { capture: true });
-        if (staged) {
-          git(releaseRoot, [
-            "commit",
-            "-m",
-            `chore(release): ${next.version}`,
-            "-m",
-            `Release-Build: ${buildMode}`,
-          ]);
-        } else if (!worktreeExists) {
-          throw new Error("Release preparation produced no changes");
-        }
-        // The source push and release commit hooks have already scanned every new
-        // byte. A new remote branch has no upstream comparison point, so the
-        // managed pre-push hook would rescan the repository's complete history.
-        git(releaseRoot, ["push", "--no-verify", "--set-upstream", "origin", releaseBranch]);
+          runTaskCommand(root, process.execPath, [versionCheckScript]);
+          if (opts.validate) {
+            for (const task of opts.validateTask) {
+              runTaskCommand(root, process.execPath, ["run", task]);
+            }
+            if (existsSync(join(root, "Cargo.toml"))) {
+              runTaskCommand(root, "cargo", [
+                "test",
+                "--workspace",
+                ...(existsSync(join(root, "Cargo.lock")) ? ["--locked"] : []),
+              ]);
+            }
+            runTaskCommand(root, process.execPath, ["run", "compile"]);
+          } else {
+            logger.warn("release validation skipped by --no-validate");
+          }
+          runTaskCommand(root, process.execPath, [versionCheckScript]);
+          const releaseSummary = opts.releaseSummary
+            ? await generateReleaseSummary({
+                root,
+                version: next.version,
+                fromRef: `${opts.prefix}${comparisonBase}`,
+                providers: releaseSummaryProviders(opts.releaseSummaryProviders),
+              })
+            : undefined;
 
-        const title = `chore(release): ${next.version}`;
-        const body = [
-          `Release ${releaseTag}.`,
-          "",
-          `Source commit: ${git(releaseRoot, ["rev-parse", `${releaseBranch}^`], { capture: true })}`,
-          "",
-          "Merging this PR updates VERSION on main and starts the public release workflow.",
-          "",
-          `Native build: ${buildMode}.`,
-          ...(releaseSummary ? ["", releaseSummary] : []),
-        ].join("\n");
-        const githubEnvironment = {
-          ...process.env,
-          GH_HOST: account.hostname,
-          GH_REPO: githubRepositorySpecifier(account),
-          [githubTokenEnvironmentName(account.hostname)]: account.token,
-        };
-        const ensurePullRequest = (): void => {
+          runGitTaskCommand(root, ["add", "-A"]);
+          const staged = captureGitTaskCommand(root, ["diff", "--cached", "--name-only"], {
+            check: true,
+          });
+          if (staged) {
+            runGitTaskCommand(root, ["commit", "-m", `chore(release): ${next.version}`]);
+          } else if (!localBranch && !remoteBranch) {
+            throw new Error("Release preparation produced no changes");
+          }
+          runGitTaskCommand(root, ["push", "--set-upstream", "origin", releaseBranch]);
+
+          const title = `chore(release): ${next.version}`;
+          const body = [
+            `Release ${releaseTag}.`,
+            "",
+            `Source commit: ${captureGitTaskCommand(root, ["rev-parse", `${releaseBranch}^`], { check: true })}`,
+            "",
+            "Merging this PR updates VERSION on main and prepares a draft GitHub Release.",
+            ...(releaseSummary ? ["", releaseSummary] : []),
+          ].join("\n");
+          const githubEnvironment = {
+            ...process.env,
+            GH_HOST: account.hostname,
+            GH_REPO: githubRepositorySpecifier(account),
+            [githubTokenEnvironmentName(account.hostname)]: account.token,
+          };
           if (
-            taskCommandSucceeds(root, "gh", ["pr", "view", releaseBranch], {
+            !taskCommandSucceeds(root, "gh", ["pr", "view", releaseBranch], {
               env: githubEnvironment,
             })
           ) {
-            return;
-          }
-          runTaskCommand(
-            root,
-            "gh",
-            [
-              "pr",
-              "create",
-              "--base",
-              opts.base,
-              "--head",
-              releaseBranch,
-              "--title",
-              title,
-              "--body",
-              body,
-            ],
-            { env: githubEnvironment },
-          );
-        };
-        ensurePullRequest();
-        if (opts.approve) {
-          runTaskCommand(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], {
-            env: githubEnvironment,
-          });
-        }
-        if (opts.approve && opts.wait) {
-          const mergeSha = await waitForPullRequestMerge(
-            root,
-            releaseBranch,
-            githubEnvironment,
-            waitTimeoutMs,
-          );
-          logger.info("release pull request merged", { releaseBranch, mergeSha });
-          if (buildMode === "local") {
-            git(root, ["fetch", "origin", opts.base]);
-            git(releaseRoot, ["switch", "--detach", mergeSha]);
-            runTaskCommand(releaseRoot, process.execPath, ["install"]);
-            await waitForGitHubRelease(root, releaseTag, githubEnvironment, waitTimeoutMs);
-            const releaseAssetsScript = join(
-              releaseRoot,
-              "node_modules/@dbx-tools/projen/tasks/release-assets.ts",
-            );
             runTaskCommand(
-              releaseRoot,
-              process.execPath,
+              root,
+              "gh",
               [
-                releaseAssetsScript,
-                "--root",
-                releaseRoot,
-                "--version",
-                next.version,
-                "--tag",
-                releaseTag,
-                "--upload",
+                "pr",
+                "create",
+                "--base",
+                opts.base,
+                "--head",
+                releaseBranch,
+                "--title",
+                title,
+                "--body",
+                body,
               ],
               { env: githubEnvironment },
             );
           }
-          git(root, ["worktree", "remove", "--force", releaseRoot]);
-          git(root, ["branch", "--delete", "--force", releaseBranch]);
-          await waitForReleaseWorkflow(root, opts.base, mergeSha, githubEnvironment, waitTimeoutMs);
-          logger.success(`published ${releaseTag} from ${mergeSha}`);
-          return;
+          if (opts.approve) {
+            runTaskCommand(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], {
+              env: githubEnvironment,
+            });
+          }
+          if (opts.approve && opts.wait) {
+            const mergeSha = await waitForPullRequestMerge(
+              root,
+              releaseBranch,
+              githubEnvironment,
+              waitTimeoutMs,
+            );
+            logger.info("release pull request merged", { releaseBranch, mergeSha });
+            runGitTaskCommand(root, ["fetch", "origin", opts.base]);
+            runGitTaskCommand(root, ["switch", "--detach", mergeSha]);
+            runTaskCommand(root, process.execPath, ["install"]);
+            const releaseCandidateScript = join(
+              root,
+              "node_modules/@dbx-tools/projen/tasks/release-candidate.ts",
+            );
+            const candidateArguments = [
+              releaseCandidateScript,
+              "--root",
+              root,
+              "--version",
+              next.version,
+              "--tag",
+              releaseTag,
+              "--sha",
+              mergeSha,
+              "--python-root",
+              opts.pythonRoot,
+              "--notes-file",
+              `docs/releases/v${next.version}.md`,
+            ];
+            runTaskCommand(root, process.execPath, candidateArguments, {
+              env: githubEnvironment,
+            });
+            if (opts.localPublish) {
+              const localPublishScript = join(
+                root,
+                "node_modules/@dbx-tools/projen/tasks/local-publish.ts",
+              );
+              runTaskCommand(
+                root,
+                process.execPath,
+                [
+                  localPublishScript,
+                  "--root",
+                  root,
+                  "--candidate-directory",
+                  "dist/release/upload",
+                  "--version",
+                  next.version,
+                  "--tag",
+                  releaseTag,
+                  "--sha",
+                  mergeSha,
+                  "--local-registry",
+                  opts.localRegistry,
+                  "--local-pypi",
+                  opts.localPypi,
+                  ...(opts.localCargo ? ["--local-cargo"] : []),
+                ],
+                { env: githubEnvironment },
+              );
+            } else {
+              logger.info("local publication skipped by --no-local-publish");
+            }
+            runTaskCommand(root, process.execPath, [...candidateArguments, "--upload-existing"], {
+              env: githubEnvironment,
+            });
+            logger.success(`prepared draft ${releaseTag} from ${mergeSha}`);
+          } else {
+            logger.success(`opened ${releaseBranch} for ${releaseTag}`);
+          }
+          releaseCompleted = true;
+        } finally {
+          const activeBranch = captureGitTaskCommand(root, ["branch", "--show-current"]);
+          if (activeBranch !== currentBranch) {
+            const releaseStatus = captureGitTaskCommand(
+              root,
+              ["status", "--porcelain=v1", "--untracked-files=all"],
+              { check: true },
+            );
+            if (releaseStatus) {
+              runGitTaskCommand(root, [
+                "stash",
+                "push",
+                "--include-untracked",
+                "--message",
+                `release-resume:${releaseBranch}`,
+              ]);
+            }
+            runGitTaskCommand(root, ["switch", currentBranch]);
+          }
+          if (
+            releaseCompleted &&
+            captureGitTaskCommand(root, ["branch", "--list", releaseBranch])
+          ) {
+            runGitTaskCommand(root, ["branch", "--delete", "--force", releaseBranch]);
+          }
         }
-        git(root, ["worktree", "remove", "--force", releaseRoot]);
-        git(root, ["branch", "--delete", "--force", releaseBranch]);
-        logger.success(
-          `${
-            opts.approve ? "enabled automatic merge for" : "opened"
-          } ${releaseBranch} for ${releaseTag}${opts.approve && !opts.wait ? " without waiting" : ""}`,
-        );
       });
     },
   );