@dbx-tools/projen 0.9.19 → 0.9.21

package/src/release.ts

@@ -16,11 +16,11 @@ import {
 import { readWorkspaceVersion } from "./workspace-version.ts";
 
 const NODE_VERSION = "24";
+const NPM_VERSION = "11.4.2";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const nodeReleaseProjects = new WeakSet<DBXToolsJavaScriptProject>();
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
-const independentPublicationJobs = new WeakMap<GithubWorkflow, Set<string>>();
 
 /** Independently recoverable portions of the release workflow. */
 export type ReleaseStage = "all" | "node" | "python" | "cargo" | "docs";
@@ -57,14 +57,8 @@ export interface DBXToolsReleaseOptions {
   readonly docs?: ReleaseDocsOptions;
   /** Python package root passed to local release preparation. */
   readonly pythonRoot?: string;
-  /** Repository task names run in the release worktree before expensive validation and publication. */
+  /** Repository task names run after VERSION generation and before candidate construction. */
   readonly validationTasks?: readonly string[];
-  /**
-   * Existing source branch safely fast-forwarded after publication.
-   *
-   * Missing or diverged branches are left untouched.
-   */
-  readonly syncBranch?: string | false;
   /**
    * Generate a versioned release summary locally. Defaults to enabled with the
    * standard Cursor, Codex, Claude fallback order.
@@ -84,13 +78,6 @@ export function tryReleaseWorkflow(project: DBXToolsJavaScriptProject): GithubWo
   return releaseWorkflows.get(project);
 }
 
-/** Register one publication job for the independent release completion barrier. */
-export function registerIndependentPublicationJob(workflow: GithubWorkflow, jobId: string): void {
-  const jobs = independentPublicationJobs.get(workflow) ?? new Set<string>();
-  jobs.add(jobId);
-  independentPublicationJobs.set(workflow, jobs);
-}
-
 /** Whether the unified workflow publishes the normal npm workspace. */
 export function hasNodeRelease(project: DBXToolsJavaScriptProject): boolean {
   return nodeReleaseProjects.has(project);
@@ -145,14 +132,16 @@ export function nodeReleaseSetupSteps(project: DBXToolsJavaScriptProject): reado
         "package-manager-cache": false,
       },
     },
+    { name: "Install npm CLI", run: `npm install --global npm@${NPM_VERSION}` },
     { name: "Install", run: "bun install" },
     bunCacheSaveStep(),
   ];
 }
 
-/** Authentication, provenance, and dry-run values shared by npm publishers. */
+/** Token authentication, GitHub provenance, and dry-run values shared by npm publishers. */
 export function npmPublishEnvironment(): Record<string, string> {
   return {
+    NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
     NPM_CONFIG_PROVENANCE:
       "${{ (github.event_name == 'release' || inputs.dry_run != true) && 'true' || 'false' }}",
     DRY_RUN:
@@ -316,627 +305,10 @@ function addDocsJobs(
   });
 }
 
-function independentReleasePleaseJob(project: DBXToolsJavaScriptProject, branch: string): Job {
-  return {
-    if: "${{ github.event_name == 'push' || inputs.automatic == true }}",
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      actions: JobPermission.WRITE,
-      contents: JobPermission.WRITE,
-      pullRequests: JobPermission.WRITE,
-    },
-    timeoutMinutes: 30,
-    env: { BUN_VERSION },
-    outputs: {
-      releases_created: { stepId: "release", outputName: "releases_created" },
-      prs_created: { stepId: "release", outputName: "prs_created" },
-      releases: { stepId: "release", outputName: "releases" },
-      prs: { stepId: "release", outputName: "prs" },
-      docs_changed: { stepId: "changes", outputName: "docs_changed" },
-      recovery_requested: { stepId: "recovery", outputName: "requested" },
-      recovery_component: { stepId: "recovery", outputName: "component" },
-      recovery_version: { stepId: "recovery", outputName: "version" },
-    },
-    steps: [
-      {
-        name: "Checkout source",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: "Refresh Release Please state",
-        id: "release",
-        env: { GITHUB_TOKEN: "${{ github.token }}" },
-        run: [
-          'OWNER="${GITHUB_REPOSITORY%%/*}"',
-          'REPO="${GITHUB_REPOSITORY#*/}"',
-          `bun node_modules/@dbx-tools/projen/tasks/release-please.ts --owner "$OWNER" --repo "$REPO" --target-branch ${JSON.stringify(branch)}`,
-        ].join("\n"),
-      },
-      {
-        name: "Detect documentation changes",
-        id: "changes",
-        shell: "bash",
-        run: [
-          "if git diff --quiet HEAD^ HEAD -- README.md AGENTS.md ':(glob)**/README.md' docs ':(exclude)docs/releases/**' ':(exclude).release-notes/**'; then",
-          '  echo "docs_changed=false" >> "$GITHUB_OUTPUT"',
-          "else",
-          '  echo "docs_changed=true" >> "$GITHUB_OUTPUT"',
-          "fi",
-        ].join("\n"),
-      },
-      {
-        name: "Detect committed recovery request",
-        id: "recovery",
-        shell: "bash",
-        run: [
-          "if [ -f .release-recovery.json ]; then",
-          '  echo "requested=true" >> "$GITHUB_OUTPUT"',
-          '  echo "component=$(jq -r .component .release-recovery.json)" >> "$GITHUB_OUTPUT"',
-          '  echo "version=$(jq -r .version .release-recovery.json)" >> "$GITHUB_OUTPUT"',
-          "else",
-          '  echo "requested=false" >> "$GITHUB_OUTPUT"',
-          "fi",
-        ].join("\n"),
-      },
-      {
-        name: "Reconcile generated release PR files",
-        if: "${{ steps.release.outputs.prs_created == 'true' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          RELEASE_BRANCH: branch,
-          RELEASE_PRS: "${{ steps.release.outputs.prs }}",
-        },
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          BRANCH="$(jq -r '.[0].headBranchName' <<<"$RELEASE_PRS")"
-          test -n "$BRANCH" && test "$BRANCH" != "null"
-          git fetch origin "$BRANCH"
-          git switch --force-create "$BRANCH" "origin/$BRANCH"
-          bun install
-          bunx projen
-          bun node_modules/@dbx-tools/projen/tasks/version-check.ts
-          bun node_modules/@dbx-tools/projen/tasks/release-plan.ts --base-ref origin/${branch}
-          bun node_modules/@dbx-tools/projen/tasks/release-summary-units.ts --from-ref origin/${branch}
-          if ! git diff --quiet || test -n "$(git ls-files --others --exclude-standard)"; then
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git add -A
-            git commit -m "chore: reconcile release metadata"
-            git push origin "HEAD:$BRANCH"
-          fi
-          MERGED="false"
-          for ATTEMPT in $(seq 1 15); do
-            STATE="$(gh pr view "$BRANCH" --json state,mergeable --jq '[.state,.mergeable] | join(" ")')"
-            if [[ "$STATE" == MERGED* ]]; then MERGED="true"; break; fi
-            if [ "$STATE" = "OPEN CONFLICTING" ]; then
-              echo "::error::release pull request has merge conflicts"
-              exit 1
-            fi
-            if [ "$STATE" = "OPEN MERGEABLE" ] && gh pr merge "$BRANCH" --merge; then
-              MERGED="true"
-              break
-            fi
-            echo "release pull request is not mergeable yet (attempt $ATTEMPT/15)"
-            sleep 2
-          done
-          if [ "$MERGED" != "true" ]; then
-            echo "::error::release pull request did not become mergeable"
-            exit 1
-          fi
-          gh workflow run release.yml --ref "$RELEASE_BRANCH" -f automatic=true
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  };
-}
-
-function configureReleaseRequestWorkflow(
-  project: DBXToolsJavaScriptProject,
-  baseBranch: string,
-): void {
-  if (!project.github) return;
-  const workflow = new GithubWorkflow(project.github, "release-request", {
-    fileName: "release-request.yml",
-    limitConcurrency: true,
-    concurrencyOptions: {
-      group: "release-request-${{ github.ref_name }}",
-      cancelInProgress: false,
-    },
-  });
-  workflow.runName = "release request ${{ github.ref_name }}";
-  workflow.on({ push: {} });
-  workflow.file?.addOverride("permissions.contents", "read");
-  workflow.addJob("request", {
-    if: `\${{ github.ref_name != '${baseBranch}' }}`,
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      actions: JobPermission.WRITE,
-      contents: JobPermission.WRITE,
-      pullRequests: JobPermission.WRITE,
-    },
-    steps: [
-      {
-        name: "Checkout source branch",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      {
-        name: "Read release request",
-        id: "request",
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          MESSAGE="$(git log -1 --format=%B)"
-          if ! grep -q "^Release-Request: true$" <<<"$MESSAGE"; then
-            echo "requested=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          git fetch origin ${JSON.stringify(baseBranch)}
-          if git diff --quiet "origin/${baseBranch}...HEAD"; then
-            echo "requested=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "requested=true" >> "$GITHUB_OUTPUT"
-          echo "branch=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
-          echo "notes_path=$(sed -n 's/^Release-Notes-Path: //p' <<<"$MESSAGE" | tail -1)" >> "$GITHUB_OUTPUT"
-          echo "title=$(git log -1 --skip=1 --format=%s)" >> "$GITHUB_OUTPUT"
-        `
-          // ============================================================================
-        ),
-      },
-      {
-        name: "Create, merge, and release source pull request",
-        if: "${{ steps.request.outputs.requested == 'true' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          SOURCE_BRANCH: "${{ steps.request.outputs.branch }}",
-          BASE_BRANCH: baseBranch,
-          TITLE: "${{ steps.request.outputs.title }}",
-          NOTES_PATH: "${{ steps.request.outputs.notes_path }}",
-        },
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          test -f "$NOTES_PATH"
-          NOTES="$(cat "$NOTES_PATH")"
-          BODY="$(printf '## Release notes\\n\\n%s\\n' "$NOTES")"
-          PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number // empty')"
-          if [ -n "$PR" ]; then
-            gh pr edit "$PR" --title "$TITLE" --body "$BODY"
-          else
-            gh pr create --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --title "$TITLE" --body "$BODY"
-            PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number')"
-          fi
-          gh pr merge "$PR" --merge
-          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$BASE_BRANCH" -f automatic=true
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  });
-}
-
-function independentReleasePlanJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ always() && ((github.event_name == 'workflow_dispatch' && inputs.automatic != true) || needs.release-please.outputs.releases_created == 'true' || (needs.release-please.outputs.docs_changed == 'true' && needs.release-please.outputs.prs_created != 'true') || needs.release-please.outputs.recovery_requested == 'true') }}",
-    needs: ["release-please"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.READ },
-    timeoutMinutes: 15,
-    env: { BUN_VERSION },
-    outputs: {
-      release_sha: { stepId: "plan", outputName: "release_sha" },
-      rust: { stepId: "plan", outputName: "rust" },
-      python: { stepId: "plan", outputName: "python" },
-      node: { stepId: "plan", outputName: "node" },
-      github: { stepId: "plan", outputName: "github" },
-      docs: { stepId: "plan", outputName: "docs" },
-      units: { stepId: "plan", outputName: "units" },
-      python_packages: { stepId: "plan", outputName: "python_packages" },
-      rust_packages: { stepId: "plan", outputName: "rust_packages" },
-      artifacts: { stepId: "plan", outputName: "artifacts" },
-      rust_targets: { stepId: "plan", outputName: "rust_targets" },
-    },
-    steps: [
-      {
-        name: "Checkout release source",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: "Build affected release plan",
-        id: "plan",
-        shell: "bash",
-        env: {
-          COMPONENT:
-            "${{ inputs.component || needs.release-please.outputs.recovery_component || '' }}",
-          VERSION: "${{ inputs.version || needs.release-please.outputs.recovery_version || '' }}",
-          DOCS_CHANGED: "${{ needs.release-please.outputs.docs_changed || 'false' }}",
-        },
-        run: [
-          "ARGS=()",
-          'if [ -n "$COMPONENT" ]; then ARGS+=(--component "$COMPONENT" --version "$VERSION"); fi',
-          'if [ "$DOCS_CHANGED" = "true" ]; then ARGS+=(--docs); fi',
-          'bun node_modules/@dbx-tools/projen/tasks/release-plan.ts "${ARGS[@]}"',
-        ].join("\n"),
-      },
-      {
-        name: "Upload release plan",
-        uses: "actions/upload-artifact@v7",
-        with: {
-          name: "release-plan",
-          path: "dist/release-plan.json",
-          "if-no-files-found": "error",
-        },
-      },
-    ],
-  };
-}
-
-/** Checkout and install the immutable source selected by an independent release plan. */
-export function independentReleaseSetupSteps(
-  project: DBXToolsJavaScriptProject,
-): readonly JobStep[] {
-  return [
-    {
-      name: "Checkout release source",
-      uses: "actions/checkout@v6",
-      with: { ref: "${{ needs.release-plan.outputs.release_sha }}", "fetch-depth": 1 },
-    },
-    ...bunCacheRestoreSteps(project, {
-      ignorePaths: project.workflowCacheIgnorePaths,
-    }),
-    { name: "Install dependencies", run: "bun install" },
-    {
-      name: "Download release plan",
-      uses: "actions/download-artifact@v8",
-      with: { name: "release-plan", path: "dist" },
-    },
-  ];
-}
-
-function independentNodePublishJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ needs.release-plan.outputs.node == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-    needs: ["release-plan"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
-    timeoutMinutes: 60,
-    env: { BUN_VERSION, CI: "true" },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      {
-        name: "Publish affected npm packages",
-        env: npmPublishEnvironment(),
-        run: "bun node_modules/@dbx-tools/projen/tasks/publish.ts --plan dist/release-plan.json",
-      },
-    ],
-  };
-}
-
-function independentReleaseNotesJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ needs.release-plan.outputs.units != '[]' }}",
-    needs: ["release-plan"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.WRITE },
-    env: { BUN_VERSION },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      {
-        name: "Publish component release notes",
-        env: { GH_TOKEN: "${{ github.token }}" },
-        shell: "bash",
-        run: [
-          "jq -c '.units[]' dist/release-plan.json | while read -r UNIT; do",
-          '  COMPONENT="$(jq -r .component <<<"$UNIT")"',
-          '  VERSION="$(jq -r .newVersion <<<"$UNIT")"',
-          '  gh release edit "$COMPONENT-v$VERSION" --notes-file ".release-notes/final/$COMPONENT-v$VERSION.md"',
-          "done",
-        ].join("\n"),
-      },
-      {
-        name: "Remove consumed release notes",
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          git fetch origin ${JSON.stringify(projectReleaseBranch(project))}
-          if [ "$(git rev-parse origin/${projectReleaseBranch(project)})" != "$(git rev-parse HEAD)" ]; then
-            echo "::warning::main advanced before release-note cleanup; leaving temporary notes for the next release"
-            exit 0
-          fi
-          git rm -r --ignore-unmatch .release-notes
-          if ! git diff --cached --quiet; then
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git commit -m "chore: remove consumed release notes"
-            git push origin "HEAD:${projectReleaseBranch(project)}"
-          fi
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  };
-}
-
-function addIndependentDocsJobs(
-  workflow: GithubWorkflow,
-  project: DBXToolsJavaScriptProject,
-  options: ReleaseDocsOptions,
-): void {
-  workflow.addJob("build-docs", {
-    if: "${{ always() && needs['release-plan'].outputs.docs == 'true' && needs['publication-complete'].result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'docs') }}",
-    needs: ["release-plan", "publication-complete"],
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      contents: JobPermission.READ,
-      pages: JobPermission.WRITE,
-      idToken: JobPermission.WRITE,
-    },
-    timeoutMinutes: 30,
-    env: {
-      BUN_VERSION,
-      DOCS_SITE_URL: options.siteUrl,
-      DOCS_BASE: options.base ?? "/",
-    },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      ...options.prepareSteps,
-      bunCacheSaveStep(),
-      ...options.buildSteps,
-      {
-        name: "Upload Pages artifact",
-        uses: "actions/upload-pages-artifact@v4",
-        with: { path: options.artifactPath },
-      },
-    ],
-  });
-  workflow.addJob("deploy-docs", {
-    if: "${{ always() && needs['build-docs'].result == 'success' }}",
-    needs: ["build-docs"],
-    environment: {
-      name: "github-pages",
-      url: "${{ steps.deployment.outputs.page_url }}",
-    },
-    runsOn: ["ubuntu-latest"],
-    permissions: { pages: JobPermission.WRITE, idToken: JobPermission.WRITE },
-    timeoutMinutes: 15,
-    steps: [
-      {
-        name: "Deploy to GitHub Pages",
-        id: "deployment",
-        uses: "actions/deploy-pages@v4",
-      },
-    ],
-  });
-}
-
-function addIndependentBranchSyncJob(
-  workflow: GithubWorkflow,
-  project: DBXToolsJavaScriptProject,
-  branch: string,
-): void {
-  const releaseBranch = projectReleaseBranch(project);
-  workflow.addJob("sync-release-branch", {
-    if: "${{ always() && (github.event_name == 'push' || inputs.automatic == true) && needs['publication-complete'].result == 'success' }}",
-    needs: ["publication-complete"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.WRITE },
-    env: { BUN_VERSION },
-    steps: [
-      {
-        name: "Checkout released main",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 0 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: `Safely sync ${branch}`,
-        shell: "bash",
-        env: { SOURCE_BRANCH: branch, RELEASE_BRANCH: releaseBranch },
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          if ! git ls-remote --exit-code --heads origin "refs/heads/$SOURCE_BRANCH" >/dev/null 2>&1; then
-            echo "source branch $SOURCE_BRANCH no longer exists; nothing to sync"
-            exit 0
-          fi
-          git fetch origin "refs/heads/$SOURCE_BRANCH:refs/remotes/origin/$SOURCE_BRANCH"
-          git fetch origin "refs/heads/$RELEASE_BRANCH:refs/remotes/origin/$RELEASE_BRANCH"
-          if git merge-base --is-ancestor "origin/$SOURCE_BRANCH" "origin/$RELEASE_BRANCH"; then
-            git push origin "refs/remotes/origin/$RELEASE_BRANCH:refs/heads/$SOURCE_BRANCH"
-          elif git merge-base --is-ancestor "origin/$RELEASE_BRANCH" "origin/$SOURCE_BRANCH"; then
-            echo "source branch $SOURCE_BRANCH already contains released main"
-          else
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git switch --force-create "$SOURCE_BRANCH" "origin/$SOURCE_BRANCH"
-            if git merge --no-ff --no-edit "origin/$RELEASE_BRANCH"; then
-              git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
-            else
-              SAFE_GENERATED="true"
-              while IFS= read -r FILE; do
-                case "$FILE" in
-                  .projen/release-units.json|.release-please-manifest.json|.release-units/*/source.json|.release-units/*/version.txt|.release-units/*/CHANGELOG.md|Cargo.lock|*/Cargo.toml|*/package.json|*/pyproject.toml|*/index.ts) ;;
-                  *) SAFE_GENERATED="false" ;;
-                esac
-              done < <(git diff --name-only --diff-filter=U)
-              if [ "$SAFE_GENERATED" = "true" ] && bunx projen; then
-                git add -A
-                if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
-                  git commit --no-edit
-                  git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
-                  exit 0
-                fi
-              fi
-              git merge --abort
-              echo "::warning::source branch $SOURCE_BRANCH has handwritten or unresolved conflicts with released main; leaving it untouched"
-            fi
-          fi
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  });
-}
-
-class IndependentReleaseFinalizer extends Component {
-  private finalized = false;
-
-  constructor(
-    project: DBXToolsJavaScriptProject,
-    private readonly workflow: GithubWorkflow,
-    private readonly docs: ReleaseDocsOptions | undefined,
-    private readonly syncBranch: string | undefined,
-  ) {
-    super(project);
-  }
-
-  public override preSynthesize(): void {
-    if (this.finalized) return;
-    this.finalized = true;
-    const jobs = [...(independentPublicationJobs.get(this.workflow) ?? [])].sort();
-    const successful = jobs
-      .map((job) => `needs.${job}.result != 'failure' && needs.${job}.result != 'cancelled'`)
-      .join(" && ");
-    this.workflow.addJob("publication-complete", {
-      if: `\${{ always()${successful ? ` && ${successful}` : ""} }}`,
-      needs: jobs,
-      runsOn: ["ubuntu-latest"],
-      permissions: { contents: JobPermission.READ },
-      steps: [{ name: "Confirm publication stages", run: "true" }],
-    });
-    if (this.docs) {
-      addIndependentDocsJobs(this.workflow, this.project as DBXToolsJavaScriptProject, this.docs);
-    }
-    if (this.syncBranch) {
-      addIndependentBranchSyncJob(
-        this.workflow,
-        this.project as DBXToolsJavaScriptProject,
-        this.syncBranch,
-      );
-    }
-  }
-}
-
-function configureIndependentRelease(
-  project: DBXToolsJavaScriptProject,
-  options: DBXToolsReleaseOptions,
-): void {
-  const branch = projectReleaseBranch(project);
-  if (options.nodeRelease !== false) nodeReleaseProjects.add(project);
-  applyTasks(project, {
-    "version:check": {
-      exec: taskScript(project, "version-check.ts"),
-      description: "Verify every package against its release unit",
-    },
-    "release:plan": {
-      exec: taskScript(project, "release-plan.ts"),
-      receiveArgs: true,
-      description: "Build the affected release plan",
-    },
-    release: {
-      exec: taskScript(project, "release-request.ts", `--base ${JSON.stringify(branch)}`),
-      receiveArgs: true,
-      description: "Commit, annotate, and push a source release request",
-    },
-    "release:refresh": {
-      exec: taskScript(project, "release-please.ts", `--target-branch ${JSON.stringify(branch)}`),
-      receiveArgs: true,
-      description: "Refresh Release Please PRs, tags, and GitHub Releases",
-    },
-  });
-  if (!project.github) return;
-  const workflow = new GithubWorkflow(project.github, "release", {
-    fileName: "release.yml",
-    limitConcurrency: true,
-    concurrencyOptions: { group: "release", cancelInProgress: false },
-  });
-  workflow.runName =
-    "release units " +
-    "${{ github.event_name == 'push' && github.sha || inputs.automatic && 'automatic' || inputs.component }}";
-  workflow.on({
-    push: { branches: [branch] },
-    workflowDispatch: {
-      inputs: {
-        automatic: {
-          description: "Continue an automatically merged Release Please pull request",
-          type: "boolean",
-          default: "false",
-          required: false,
-        },
-        component: {
-          description: "Component to recover",
-          type: "string",
-          default: "",
-          required: false,
-        },
-        version: {
-          description: "Component version to recover",
-          type: "string",
-          default: "",
-          required: false,
-        },
-        stage: {
-          description: "Publication target to recover",
-          type: "choice",
-          options: ["all", "node", "python", "rust", "github", "docs"],
-          default: "all",
-          required: true,
-        },
-      },
-    },
-  });
-  workflow.file?.addOverride("on.workflow_dispatch.inputs.automatic.default", false);
-  workflow.file?.addOverride("permissions.contents", "read");
-  workflow.addJob("release-please", independentReleasePleaseJob(project, branch));
-  workflow.addJob("release-plan", independentReleasePlanJob(project));
-  workflow.addJob("publish-release-notes", independentReleaseNotesJob(project));
-  registerIndependentPublicationJob(workflow, "publish-release-notes");
-  if (options.nodeRelease !== false) {
-    workflow.addJob("publish-node", independentNodePublishJob(project));
-    registerIndependentPublicationJob(workflow, "publish-node");
-  }
-  new IndependentReleaseFinalizer(project, workflow, options.docs, options.syncBranch || undefined);
-  configureReleaseRequestWorkflow(project, branch);
-  releaseWorkflows.set(project, workflow);
-}
-
 /** Owns the single release workflow and local release preparation tasks. */
 export class DBXToolsRelease extends Component {
   constructor(project: DBXToolsJavaScriptProject, options: DBXToolsReleaseOptions = {}) {
     super(project);
-    if (project.releaseCatalog.mode === "independent") {
-      configureIndependentRelease(project, options);
-      return;
-    }
     const tagPrefix = options.tagPrefix ?? "v";
     const releaseBranch = projectReleaseBranch(project);
     const summary = options.summary ?? true;
@@ -981,7 +353,13 @@ export class DBXToolsRelease extends Component {
                 "Prepare, validate, locally publish, and upload a draft release candidate",
             },
             "release:assets": {
-              exec: taskScript(project, "release-candidate.ts"),
+              exec: taskScript(
+                project,
+                "release-candidate.ts",
+                options.pythonRoot
+                  ? `--python-root ${JSON.stringify(options.pythonRoot)}`
+                  : undefined,
+              ),
               receiveArgs: true,
               description: "Rebuild and upload a complete draft release candidate",
             },