@dbx-tools/projen 0.9.19 → 0.9.28

package/src/release.ts

@@ -6,24 +6,17 @@ import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflo
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
 import { projectReleaseBranch, type DBXToolsJavaScriptProject } from "./project-js.ts";
 import { applyTasks, taskScript } from "./project.ts";
-import {
-  RELEASE_SHA,
-  RELEASE_TAG,
-  RELEASE_VERSION,
-  releaseSourceSteps,
-  type ReleaseSummaryProviderName,
-} from "./release-dispatch.ts";
-import { readWorkspaceVersion } from "./workspace-version.ts";
+import { RELEASE_VERSION, releaseSourceSteps } from "./release-context.ts";
 
 const NODE_VERSION = "24";
+const NPM_VERSION = "11.4.2";
 const NPM_REGISTRY_URL = "https://registry.npmjs.org";
 const nodeReleaseProjects = new WeakSet<DBXToolsJavaScriptProject>();
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
-const independentPublicationJobs = new WeakMap<GithubWorkflow, Set<string>>();
 
 /** Independently recoverable portions of the release workflow. */
-export type ReleaseStage = "all" | "node" | "python" | "cargo" | "docs";
+export type ReleaseStage = "all" | "node" | "python" | "docs";
 
 /** GitHub Pages configuration included in the unified release workflow. */
 export interface ReleaseDocsOptions {
@@ -37,16 +30,6 @@ export interface ReleaseDocsOptions {
   readonly artifactPath: string;
 }
 
-/** Optional local AI summary generation during reviewed release preparation. */
-export interface ReleaseSummaryOptions {
-  /**
-   * Provider fallback order.
-   *
-   * @default ["cursor", "codex", "claude"]
-   */
-  readonly providers?: readonly ReleaseSummaryProviderName[];
-}
-
 /** Options for {@link DBXToolsRelease}. */
 export interface DBXToolsReleaseOptions {
   /** Git tag prefix. Defaults to `v`. */
@@ -55,21 +38,10 @@ export interface DBXToolsReleaseOptions {
   readonly nodeRelease?: boolean;
   /** Build and deploy generated documentation through GitHub Pages. */
   readonly docs?: ReleaseDocsOptions;
-  /** Python package root passed to local release preparation. */
+  /** Python package root used by attached Python publication jobs. */
   readonly pythonRoot?: string;
-  /** Repository task names run in the release worktree before expensive validation and publication. */
+  /** Repository task names run after VERSION verification and before publication. */
   readonly validationTasks?: readonly string[];
-  /**
-   * Existing source branch safely fast-forwarded after publication.
-   *
-   * Missing or diverged branches are left untouched.
-   */
-  readonly syncBranch?: string | false;
-  /**
-   * Generate a versioned release summary locally. Defaults to enabled with the
-   * standard Cursor, Codex, Claude fallback order.
-   */
-  readonly summary?: boolean | ReleaseSummaryOptions;
 }
 
 /** Locate the unified workflow so attached language workspaces can add jobs. */
@@ -84,13 +56,6 @@ export function tryReleaseWorkflow(project: DBXToolsJavaScriptProject): GithubWo
   return releaseWorkflows.get(project);
 }
 
-/** Register one publication job for the independent release completion barrier. */
-export function registerIndependentPublicationJob(workflow: GithubWorkflow, jobId: string): void {
-  const jobs = independentPublicationJobs.get(workflow) ?? new Set<string>();
-  jobs.add(jobId);
-  independentPublicationJobs.set(workflow, jobs);
-}
-
 /** Whether the unified workflow publishes the normal npm workspace. */
 export function hasNodeRelease(project: DBXToolsJavaScriptProject): boolean {
   return nodeReleaseProjects.has(project);
@@ -103,32 +68,22 @@ export function releaseTagPattern(project: DBXToolsJavaScriptProject): string {
   return `${prefix}*`;
 }
 
-/** Run a release stage on promotion or when selected for manual recovery. */
+/** Run a release stage after its prerequisite tag-build jobs succeed. */
 export function releaseStageCondition(
-  stage: Exclude<ReleaseStage, "all">,
+  _stage: Exclude<ReleaseStage, "all">,
   prerequisites: readonly string[] = [],
 ): string {
-  if (prerequisites.length === 0) {
-    return `\${{ github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}' }}`;
-  }
-  const prefix = prerequisites.length
-    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
-    : "";
-  return `\${{ ${prefix}(github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}') }}`;
+  if (prerequisites.length === 0) return "${{ success() }}";
+  return `\${{ always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
 }
 
-/** Publish a selected stage unless a manual run remains in dry-run mode. */
+/** Publish a release stage after its prerequisite tag-build jobs succeed. */
 export function releasePublishCondition(
-  stage: Exclude<ReleaseStage, "all">,
+  _stage: Exclude<ReleaseStage, "all">,
   prerequisites: readonly string[] = [],
 ): string {
-  if (prerequisites.length === 0) {
-    return `\${{ github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}')) }}`;
-  }
-  const prefix = prerequisites.length
-    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
-    : "";
-  return `\${{ ${prefix}(github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}'))) }}`;
+  if (prerequisites.length === 0) return "${{ success() }}";
+  return `\${{ always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
 }
 
 /** Shared Bun, Node, cache, and install setup for Node release jobs. */
@@ -145,25 +100,59 @@ export function nodeReleaseSetupSteps(project: DBXToolsJavaScriptProject): reado
         "package-manager-cache": false,
       },
     },
+    { name: "Install npm CLI", run: `npm install --global npm@${NPM_VERSION}` },
     { name: "Install", run: "bun install" },
     bunCacheSaveStep(),
   ];
 }
 
-/** Authentication, provenance, and dry-run values shared by npm publishers. */
+/** Token authentication, GitHub provenance, and dry-run values shared by npm publishers. */
 export function npmPublishEnvironment(): Record<string, string> {
   return {
-    NPM_CONFIG_PROVENANCE:
-      "${{ (github.event_name == 'release' || inputs.dry_run != true) && 'true' || 'false' }}",
-    DRY_RUN:
-      "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && '--dry-run' || '' }}",
+    NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
+    NPM_CONFIG_PROVENANCE: "true",
+    DRY_RUN: "",
   };
 }
 
-function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
+/** Install uv and restore its download/build cache using Python manifests. */
+export function uvSetupStep(): JobStep {
+  return {
+    name: "Setup uv",
+    uses: "astral-sh/setup-uv@v7",
+    with: {
+      "enable-cache": true,
+      "cache-dependency-glob": "**/pyproject.toml",
+    },
+  };
+}
+
+function refreshDocsRegistryDependencies(workflow: GithubWorkflow): void {
+  const docs = workflow.getJob("build-docs") as Job | undefined;
+  if (!docs) return;
+  const registryJobs = Object.keys(workflow.jobs).filter(
+    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
+  );
+  if (registryJobs.length > 0) workflow.updateJob("build-docs", { ...docs, needs: registryJobs });
+}
+
+/** Keep documentation publication behind every configured package registry. */
+export function refreshReleaseDocsDependencies(project: DBXToolsJavaScriptProject): void {
+  const workflow = releaseWorkflows.get(project);
+  if (workflow) refreshDocsRegistryDependencies(workflow);
+}
+
+function verifyContextJob(
+  project: DBXToolsJavaScriptProject,
+  tagPrefix: string,
+  releaseBranch: string,
+  options: DBXToolsReleaseOptions,
+): Job {
   return {
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
+    timeoutMinutes: 30,
+    env: { BUN_VERSION, CI: "true" },
     outputs: {
       release_tag: { stepId: "release", outputName: "release_tag" },
       expected_sha: { stepId: "release", outputName: "expected_sha" },
@@ -174,24 +163,19 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
         name: "Checkout release source",
         uses: "actions/checkout@v6",
         with: {
-          ref: "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+          ref: "${{ github.ref_name }}",
           "fetch-depth": 0,
         },
       },
-      {
-        name: "Setup Bun",
-        uses: "oven-sh/setup-bun@v2",
-        with: { "bun-version": BUN_VERSION },
-      },
+      ...bunCacheRestoreSteps(project, { ignorePaths: project.workflowCacheIgnorePaths }),
       { name: "Install release validation dependencies", run: "bun install --frozen-lockfile" },
+      bunCacheSaveStep(),
       {
         name: "Verify release context",
         id: "release",
         shell: "bash",
         env: {
-          RELEASE_TAG:
-            "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
-          GH_TOKEN: "${{ github.token }}",
+          RELEASE_TAG: "${{ github.ref_name }}",
         },
         // prettier-ignore
         run: stringUtils.dedent(
@@ -205,17 +189,8 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
           RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
-          git merge-base --is-ancestor "$RELEASE_SHA" "origin/${releaseBranch}"
+          test "$(git rev-parse "origin/${releaseBranch}")" = "$RELEASE_SHA"
           test "$(tr -d '\\r\\n' < VERSION)" = "$RELEASE_VERSION"
-          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" = "false"
-          rm -rf dist/release-candidate
-          mkdir -p dist/release-candidate
-          gh release download "$RELEASE_TAG" --dir dist/release-candidate
-          bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \
-            --directory dist/release-candidate \
-            --tag "$RELEASE_TAG" \
-            --sha "$RELEASE_SHA" \
-            --version "$RELEASE_VERSION"
           echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
           echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
@@ -223,6 +198,10 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           // ============================================================================
         ),
       },
+      ...(options.validationTasks ?? []).map((task) => ({
+        name: `Validate ${task}`,
+        run: `bun run ${task}`,
+      })),
     ],
   };
 }
@@ -238,26 +217,9 @@ function nodePublishJob(project: DBXToolsJavaScriptProject): Job {
     steps: [
       ...nodeReleaseSetupSteps(project),
       {
-        name: "Download approved npm archives",
-        env: { GH_TOKEN: "${{ github.token }}", RELEASE_SHA, RELEASE_TAG, RELEASE_VERSION },
-        shell: "bash",
-        run: [
-          "rm -rf dist/release-download dist/npm-release",
-          "mkdir -p dist/release-download",
-          'gh release download "$RELEASE_TAG" --pattern release-manifest.json --pattern SHA256SUMS --pattern "*.tgz" --dir dist/release-download',
-          "bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \\",
-          "  --directory dist/release-download \\",
-          '  --tag "$RELEASE_TAG" \\',
-          '  --sha "$RELEASE_SHA" \\',
-          '  --version "$RELEASE_VERSION" \\',
-          "  --kind npm \\",
-          "  --output dist/npm-release",
-        ].join("\n"),
-      },
-      {
-        name: "Publish approved npm archives",
+        name: "Publish npm workspace",
         env: { RELEASE_VERSION, ...npmPublishEnvironment() },
-        run: 'bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory dist/npm-release --version "$RELEASE_VERSION" $DRY_RUN',
+        run: 'bun node_modules/@dbx-tools/projen/tasks/publish.ts "$RELEASE_VERSION" $DRY_RUN',
       },
     ],
   };
@@ -314,643 +276,20 @@ function addDocsJobs(
       },
     ],
   });
-}
-
-function independentReleasePleaseJob(project: DBXToolsJavaScriptProject, branch: string): Job {
-  return {
-    if: "${{ github.event_name == 'push' || inputs.automatic == true }}",
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      actions: JobPermission.WRITE,
-      contents: JobPermission.WRITE,
-      pullRequests: JobPermission.WRITE,
-    },
-    timeoutMinutes: 30,
-    env: { BUN_VERSION },
-    outputs: {
-      releases_created: { stepId: "release", outputName: "releases_created" },
-      prs_created: { stepId: "release", outputName: "prs_created" },
-      releases: { stepId: "release", outputName: "releases" },
-      prs: { stepId: "release", outputName: "prs" },
-      docs_changed: { stepId: "changes", outputName: "docs_changed" },
-      recovery_requested: { stepId: "recovery", outputName: "requested" },
-      recovery_component: { stepId: "recovery", outputName: "component" },
-      recovery_version: { stepId: "recovery", outputName: "version" },
-    },
-    steps: [
-      {
-        name: "Checkout source",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: "Refresh Release Please state",
-        id: "release",
-        env: { GITHUB_TOKEN: "${{ github.token }}" },
-        run: [
-          'OWNER="${GITHUB_REPOSITORY%%/*}"',
-          'REPO="${GITHUB_REPOSITORY#*/}"',
-          `bun node_modules/@dbx-tools/projen/tasks/release-please.ts --owner "$OWNER" --repo "$REPO" --target-branch ${JSON.stringify(branch)}`,
-        ].join("\n"),
-      },
-      {
-        name: "Detect documentation changes",
-        id: "changes",
-        shell: "bash",
-        run: [
-          "if git diff --quiet HEAD^ HEAD -- README.md AGENTS.md ':(glob)**/README.md' docs ':(exclude)docs/releases/**' ':(exclude).release-notes/**'; then",
-          '  echo "docs_changed=false" >> "$GITHUB_OUTPUT"',
-          "else",
-          '  echo "docs_changed=true" >> "$GITHUB_OUTPUT"',
-          "fi",
-        ].join("\n"),
-      },
-      {
-        name: "Detect committed recovery request",
-        id: "recovery",
-        shell: "bash",
-        run: [
-          "if [ -f .release-recovery.json ]; then",
-          '  echo "requested=true" >> "$GITHUB_OUTPUT"',
-          '  echo "component=$(jq -r .component .release-recovery.json)" >> "$GITHUB_OUTPUT"',
-          '  echo "version=$(jq -r .version .release-recovery.json)" >> "$GITHUB_OUTPUT"',
-          "else",
-          '  echo "requested=false" >> "$GITHUB_OUTPUT"',
-          "fi",
-        ].join("\n"),
-      },
-      {
-        name: "Reconcile generated release PR files",
-        if: "${{ steps.release.outputs.prs_created == 'true' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          RELEASE_BRANCH: branch,
-          RELEASE_PRS: "${{ steps.release.outputs.prs }}",
-        },
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          BRANCH="$(jq -r '.[0].headBranchName' <<<"$RELEASE_PRS")"
-          test -n "$BRANCH" && test "$BRANCH" != "null"
-          git fetch origin "$BRANCH"
-          git switch --force-create "$BRANCH" "origin/$BRANCH"
-          bun install
-          bunx projen
-          bun node_modules/@dbx-tools/projen/tasks/version-check.ts
-          bun node_modules/@dbx-tools/projen/tasks/release-plan.ts --base-ref origin/${branch}
-          bun node_modules/@dbx-tools/projen/tasks/release-summary-units.ts --from-ref origin/${branch}
-          if ! git diff --quiet || test -n "$(git ls-files --others --exclude-standard)"; then
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git add -A
-            git commit -m "chore: reconcile release metadata"
-            git push origin "HEAD:$BRANCH"
-          fi
-          MERGED="false"
-          for ATTEMPT in $(seq 1 15); do
-            STATE="$(gh pr view "$BRANCH" --json state,mergeable --jq '[.state,.mergeable] | join(" ")')"
-            if [[ "$STATE" == MERGED* ]]; then MERGED="true"; break; fi
-            if [ "$STATE" = "OPEN CONFLICTING" ]; then
-              echo "::error::release pull request has merge conflicts"
-              exit 1
-            fi
-            if [ "$STATE" = "OPEN MERGEABLE" ] && gh pr merge "$BRANCH" --merge; then
-              MERGED="true"
-              break
-            fi
-            echo "release pull request is not mergeable yet (attempt $ATTEMPT/15)"
-            sleep 2
-          done
-          if [ "$MERGED" != "true" ]; then
-            echo "::error::release pull request did not become mergeable"
-            exit 1
-          fi
-          gh workflow run release.yml --ref "$RELEASE_BRANCH" -f automatic=true
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  };
-}
-
-function configureReleaseRequestWorkflow(
-  project: DBXToolsJavaScriptProject,
-  baseBranch: string,
-): void {
-  if (!project.github) return;
-  const workflow = new GithubWorkflow(project.github, "release-request", {
-    fileName: "release-request.yml",
-    limitConcurrency: true,
-    concurrencyOptions: {
-      group: "release-request-${{ github.ref_name }}",
-      cancelInProgress: false,
-    },
-  });
-  workflow.runName = "release request ${{ github.ref_name }}";
-  workflow.on({ push: {} });
-  workflow.file?.addOverride("permissions.contents", "read");
-  workflow.addJob("request", {
-    if: `\${{ github.ref_name != '${baseBranch}' }}`,
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      actions: JobPermission.WRITE,
-      contents: JobPermission.WRITE,
-      pullRequests: JobPermission.WRITE,
-    },
-    steps: [
-      {
-        name: "Checkout source branch",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      {
-        name: "Read release request",
-        id: "request",
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          MESSAGE="$(git log -1 --format=%B)"
-          if ! grep -q "^Release-Request: true$" <<<"$MESSAGE"; then
-            echo "requested=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          git fetch origin ${JSON.stringify(baseBranch)}
-          if git diff --quiet "origin/${baseBranch}...HEAD"; then
-            echo "requested=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          echo "requested=true" >> "$GITHUB_OUTPUT"
-          echo "branch=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
-          echo "notes_path=$(sed -n 's/^Release-Notes-Path: //p' <<<"$MESSAGE" | tail -1)" >> "$GITHUB_OUTPUT"
-          echo "title=$(git log -1 --skip=1 --format=%s)" >> "$GITHUB_OUTPUT"
-        `
-          // ============================================================================
-        ),
-      },
-      {
-        name: "Create, merge, and release source pull request",
-        if: "${{ steps.request.outputs.requested == 'true' }}",
-        env: {
-          GH_TOKEN: "${{ github.token }}",
-          SOURCE_BRANCH: "${{ steps.request.outputs.branch }}",
-          BASE_BRANCH: baseBranch,
-          TITLE: "${{ steps.request.outputs.title }}",
-          NOTES_PATH: "${{ steps.request.outputs.notes_path }}",
-        },
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          test -f "$NOTES_PATH"
-          NOTES="$(cat "$NOTES_PATH")"
-          BODY="$(printf '## Release notes\\n\\n%s\\n' "$NOTES")"
-          PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number // empty')"
-          if [ -n "$PR" ]; then
-            gh pr edit "$PR" --title "$TITLE" --body "$BODY"
-          else
-            gh pr create --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --title "$TITLE" --body "$BODY"
-            PR="$(gh pr list --head "$SOURCE_BRANCH" --base "$BASE_BRANCH" --state open --json number --jq '.[0].number')"
-          fi
-          gh pr merge "$PR" --merge
-          gh workflow run release.yml --repo "$GITHUB_REPOSITORY" --ref "$BASE_BRANCH" -f automatic=true
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  });
-}
-
-function independentReleasePlanJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ always() && ((github.event_name == 'workflow_dispatch' && inputs.automatic != true) || needs.release-please.outputs.releases_created == 'true' || (needs.release-please.outputs.docs_changed == 'true' && needs.release-please.outputs.prs_created != 'true') || needs.release-please.outputs.recovery_requested == 'true') }}",
-    needs: ["release-please"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.READ },
-    timeoutMinutes: 15,
-    env: { BUN_VERSION },
-    outputs: {
-      release_sha: { stepId: "plan", outputName: "release_sha" },
-      rust: { stepId: "plan", outputName: "rust" },
-      python: { stepId: "plan", outputName: "python" },
-      node: { stepId: "plan", outputName: "node" },
-      github: { stepId: "plan", outputName: "github" },
-      docs: { stepId: "plan", outputName: "docs" },
-      units: { stepId: "plan", outputName: "units" },
-      python_packages: { stepId: "plan", outputName: "python_packages" },
-      rust_packages: { stepId: "plan", outputName: "rust_packages" },
-      artifacts: { stepId: "plan", outputName: "artifacts" },
-      rust_targets: { stepId: "plan", outputName: "rust_targets" },
-    },
-    steps: [
-      {
-        name: "Checkout release source",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 2 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: "Build affected release plan",
-        id: "plan",
-        shell: "bash",
-        env: {
-          COMPONENT:
-            "${{ inputs.component || needs.release-please.outputs.recovery_component || '' }}",
-          VERSION: "${{ inputs.version || needs.release-please.outputs.recovery_version || '' }}",
-          DOCS_CHANGED: "${{ needs.release-please.outputs.docs_changed || 'false' }}",
-        },
-        run: [
-          "ARGS=()",
-          'if [ -n "$COMPONENT" ]; then ARGS+=(--component "$COMPONENT" --version "$VERSION"); fi',
-          'if [ "$DOCS_CHANGED" = "true" ]; then ARGS+=(--docs); fi',
-          'bun node_modules/@dbx-tools/projen/tasks/release-plan.ts "${ARGS[@]}"',
-        ].join("\n"),
-      },
-      {
-        name: "Upload release plan",
-        uses: "actions/upload-artifact@v7",
-        with: {
-          name: "release-plan",
-          path: "dist/release-plan.json",
-          "if-no-files-found": "error",
-        },
-      },
-    ],
-  };
-}
-
-/** Checkout and install the immutable source selected by an independent release plan. */
-export function independentReleaseSetupSteps(
-  project: DBXToolsJavaScriptProject,
-): readonly JobStep[] {
-  return [
-    {
-      name: "Checkout release source",
-      uses: "actions/checkout@v6",
-      with: { ref: "${{ needs.release-plan.outputs.release_sha }}", "fetch-depth": 1 },
-    },
-    ...bunCacheRestoreSteps(project, {
-      ignorePaths: project.workflowCacheIgnorePaths,
-    }),
-    { name: "Install dependencies", run: "bun install" },
-    {
-      name: "Download release plan",
-      uses: "actions/download-artifact@v8",
-      with: { name: "release-plan", path: "dist" },
-    },
-  ];
-}
-
-function independentNodePublishJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ needs.release-plan.outputs.node == 'true' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'node') }}",
-    needs: ["release-plan"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.READ, idToken: JobPermission.WRITE },
-    timeoutMinutes: 60,
-    env: { BUN_VERSION, CI: "true" },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      {
-        name: "Publish affected npm packages",
-        env: npmPublishEnvironment(),
-        run: "bun node_modules/@dbx-tools/projen/tasks/publish.ts --plan dist/release-plan.json",
-      },
-    ],
-  };
-}
-
-function independentReleaseNotesJob(project: DBXToolsJavaScriptProject): Job {
-  return {
-    if: "${{ needs.release-plan.outputs.units != '[]' }}",
-    needs: ["release-plan"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.WRITE },
-    env: { BUN_VERSION },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      {
-        name: "Publish component release notes",
-        env: { GH_TOKEN: "${{ github.token }}" },
-        shell: "bash",
-        run: [
-          "jq -c '.units[]' dist/release-plan.json | while read -r UNIT; do",
-          '  COMPONENT="$(jq -r .component <<<"$UNIT")"',
-          '  VERSION="$(jq -r .newVersion <<<"$UNIT")"',
-          '  gh release edit "$COMPONENT-v$VERSION" --notes-file ".release-notes/final/$COMPONENT-v$VERSION.md"',
-          "done",
-        ].join("\n"),
-      },
-      {
-        name: "Remove consumed release notes",
-        shell: "bash",
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          git fetch origin ${JSON.stringify(projectReleaseBranch(project))}
-          if [ "$(git rev-parse origin/${projectReleaseBranch(project)})" != "$(git rev-parse HEAD)" ]; then
-            echo "::warning::main advanced before release-note cleanup; leaving temporary notes for the next release"
-            exit 0
-          fi
-          git rm -r --ignore-unmatch .release-notes
-          if ! git diff --cached --quiet; then
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git commit -m "chore: remove consumed release notes"
-            git push origin "HEAD:${projectReleaseBranch(project)}"
-          fi
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  };
-}
-
-function addIndependentDocsJobs(
-  workflow: GithubWorkflow,
-  project: DBXToolsJavaScriptProject,
-  options: ReleaseDocsOptions,
-): void {
-  workflow.addJob("build-docs", {
-    if: "${{ always() && needs['release-plan'].outputs.docs == 'true' && needs['publication-complete'].result == 'success' && (github.event_name == 'push' || inputs.stage == 'all' || inputs.stage == 'docs') }}",
-    needs: ["release-plan", "publication-complete"],
-    runsOn: ["ubuntu-latest"],
-    permissions: {
-      contents: JobPermission.READ,
-      pages: JobPermission.WRITE,
-      idToken: JobPermission.WRITE,
-    },
-    timeoutMinutes: 30,
-    env: {
-      BUN_VERSION,
-      DOCS_SITE_URL: options.siteUrl,
-      DOCS_BASE: options.base ?? "/",
-    },
-    steps: [
-      ...independentReleaseSetupSteps(project),
-      ...options.prepareSteps,
-      bunCacheSaveStep(),
-      ...options.buildSteps,
-      {
-        name: "Upload Pages artifact",
-        uses: "actions/upload-pages-artifact@v4",
-        with: { path: options.artifactPath },
-      },
-    ],
-  });
-  workflow.addJob("deploy-docs", {
-    if: "${{ always() && needs['build-docs'].result == 'success' }}",
-    needs: ["build-docs"],
-    environment: {
-      name: "github-pages",
-      url: "${{ steps.deployment.outputs.page_url }}",
-    },
-    runsOn: ["ubuntu-latest"],
-    permissions: { pages: JobPermission.WRITE, idToken: JobPermission.WRITE },
-    timeoutMinutes: 15,
-    steps: [
-      {
-        name: "Deploy to GitHub Pages",
-        id: "deployment",
-        uses: "actions/deploy-pages@v4",
-      },
-    ],
-  });
-}
-
-function addIndependentBranchSyncJob(
-  workflow: GithubWorkflow,
-  project: DBXToolsJavaScriptProject,
-  branch: string,
-): void {
-  const releaseBranch = projectReleaseBranch(project);
-  workflow.addJob("sync-release-branch", {
-    if: "${{ always() && (github.event_name == 'push' || inputs.automatic == true) && needs['publication-complete'].result == 'success' }}",
-    needs: ["publication-complete"],
-    runsOn: ["ubuntu-latest"],
-    permissions: { contents: JobPermission.WRITE },
-    env: { BUN_VERSION },
-    steps: [
-      {
-        name: "Checkout released main",
-        uses: "actions/checkout@v6",
-        with: { "fetch-depth": 0 },
-      },
-      ...bunCacheRestoreSteps(project, {
-        ignorePaths: project.workflowCacheIgnorePaths,
-      }),
-      { name: "Install dependencies", run: "bun install" },
-      {
-        name: `Safely sync ${branch}`,
-        shell: "bash",
-        env: { SOURCE_BRANCH: branch, RELEASE_BRANCH: releaseBranch },
-        // prettier-ignore
-        run: stringUtils.dedent(
-          // ============================================================================
-          /*bash*/`
-          if ! git ls-remote --exit-code --heads origin "refs/heads/$SOURCE_BRANCH" >/dev/null 2>&1; then
-            echo "source branch $SOURCE_BRANCH no longer exists; nothing to sync"
-            exit 0
-          fi
-          git fetch origin "refs/heads/$SOURCE_BRANCH:refs/remotes/origin/$SOURCE_BRANCH"
-          git fetch origin "refs/heads/$RELEASE_BRANCH:refs/remotes/origin/$RELEASE_BRANCH"
-          if git merge-base --is-ancestor "origin/$SOURCE_BRANCH" "origin/$RELEASE_BRANCH"; then
-            git push origin "refs/remotes/origin/$RELEASE_BRANCH:refs/heads/$SOURCE_BRANCH"
-          elif git merge-base --is-ancestor "origin/$RELEASE_BRANCH" "origin/$SOURCE_BRANCH"; then
-            echo "source branch $SOURCE_BRANCH already contains released main"
-          else
-            git config user.name "github-actions[bot]"
-            git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-            git switch --force-create "$SOURCE_BRANCH" "origin/$SOURCE_BRANCH"
-            if git merge --no-ff --no-edit "origin/$RELEASE_BRANCH"; then
-              git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
-            else
-              SAFE_GENERATED="true"
-              while IFS= read -r FILE; do
-                case "$FILE" in
-                  .projen/release-units.json|.release-please-manifest.json|.release-units/*/source.json|.release-units/*/version.txt|.release-units/*/CHANGELOG.md|Cargo.lock|*/Cargo.toml|*/package.json|*/pyproject.toml|*/index.ts) ;;
-                  *) SAFE_GENERATED="false" ;;
-                esac
-              done < <(git diff --name-only --diff-filter=U)
-              if [ "$SAFE_GENERATED" = "true" ] && bunx projen; then
-                git add -A
-                if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
-                  git commit --no-edit
-                  git push origin "HEAD:refs/heads/$SOURCE_BRANCH"
-                  exit 0
-                fi
-              fi
-              git merge --abort
-              echo "::warning::source branch $SOURCE_BRANCH has handwritten or unresolved conflicts with released main; leaving it untouched"
-            fi
-          fi
-        `
-          // ============================================================================
-        ),
-      },
-    ],
-  });
-}
-
-class IndependentReleaseFinalizer extends Component {
-  private finalized = false;
-
-  constructor(
-    project: DBXToolsJavaScriptProject,
-    private readonly workflow: GithubWorkflow,
-    private readonly docs: ReleaseDocsOptions | undefined,
-    private readonly syncBranch: string | undefined,
-  ) {
-    super(project);
-  }
-
-  public override preSynthesize(): void {
-    if (this.finalized) return;
-    this.finalized = true;
-    const jobs = [...(independentPublicationJobs.get(this.workflow) ?? [])].sort();
-    const successful = jobs
-      .map((job) => `needs.${job}.result != 'failure' && needs.${job}.result != 'cancelled'`)
-      .join(" && ");
-    this.workflow.addJob("publication-complete", {
-      if: `\${{ always()${successful ? ` && ${successful}` : ""} }}`,
-      needs: jobs,
-      runsOn: ["ubuntu-latest"],
-      permissions: { contents: JobPermission.READ },
-      steps: [{ name: "Confirm publication stages", run: "true" }],
-    });
-    if (this.docs) {
-      addIndependentDocsJobs(this.workflow, this.project as DBXToolsJavaScriptProject, this.docs);
-    }
-    if (this.syncBranch) {
-      addIndependentBranchSyncJob(
-        this.workflow,
-        this.project as DBXToolsJavaScriptProject,
-        this.syncBranch,
-      );
-    }
-  }
-}
-
-function configureIndependentRelease(
-  project: DBXToolsJavaScriptProject,
-  options: DBXToolsReleaseOptions,
-): void {
-  const branch = projectReleaseBranch(project);
-  if (options.nodeRelease !== false) nodeReleaseProjects.add(project);
-  applyTasks(project, {
-    "version:check": {
-      exec: taskScript(project, "version-check.ts"),
-      description: "Verify every package against its release unit",
-    },
-    "release:plan": {
-      exec: taskScript(project, "release-plan.ts"),
-      receiveArgs: true,
-      description: "Build the affected release plan",
-    },
-    release: {
-      exec: taskScript(project, "release-request.ts", `--base ${JSON.stringify(branch)}`),
-      receiveArgs: true,
-      description: "Commit, annotate, and push a source release request",
-    },
-    "release:refresh": {
-      exec: taskScript(project, "release-please.ts", `--target-branch ${JSON.stringify(branch)}`),
-      receiveArgs: true,
-      description: "Refresh Release Please PRs, tags, and GitHub Releases",
-    },
-  });
-  if (!project.github) return;
-  const workflow = new GithubWorkflow(project.github, "release", {
-    fileName: "release.yml",
-    limitConcurrency: true,
-    concurrencyOptions: { group: "release", cancelInProgress: false },
-  });
-  workflow.runName =
-    "release units " +
-    "${{ github.event_name == 'push' && github.sha || inputs.automatic && 'automatic' || inputs.component }}";
-  workflow.on({
-    push: { branches: [branch] },
-    workflowDispatch: {
-      inputs: {
-        automatic: {
-          description: "Continue an automatically merged Release Please pull request",
-          type: "boolean",
-          default: "false",
-          required: false,
-        },
-        component: {
-          description: "Component to recover",
-          type: "string",
-          default: "",
-          required: false,
-        },
-        version: {
-          description: "Component version to recover",
-          type: "string",
-          default: "",
-          required: false,
-        },
-        stage: {
-          description: "Publication target to recover",
-          type: "choice",
-          options: ["all", "node", "python", "rust", "github", "docs"],
-          default: "all",
-          required: true,
-        },
-      },
-    },
-  });
-  workflow.file?.addOverride("on.workflow_dispatch.inputs.automatic.default", false);
-  workflow.file?.addOverride("permissions.contents", "read");
-  workflow.addJob("release-please", independentReleasePleaseJob(project, branch));
-  workflow.addJob("release-plan", independentReleasePlanJob(project));
-  workflow.addJob("publish-release-notes", independentReleaseNotesJob(project));
-  registerIndependentPublicationJob(workflow, "publish-release-notes");
-  if (options.nodeRelease !== false) {
-    workflow.addJob("publish-node", independentNodePublishJob(project));
-    registerIndependentPublicationJob(workflow, "publish-node");
-  }
-  new IndependentReleaseFinalizer(project, workflow, options.docs, options.syncBranch || undefined);
-  configureReleaseRequestWorkflow(project, branch);
-  releaseWorkflows.set(project, workflow);
+  refreshDocsRegistryDependencies(workflow);
 }
 
 /** Owns the single release workflow and local release preparation tasks. */
 export class DBXToolsRelease extends Component {
   constructor(project: DBXToolsJavaScriptProject, options: DBXToolsReleaseOptions = {}) {
     super(project);
-    if (project.releaseCatalog.mode === "independent") {
-      configureIndependentRelease(project, options);
-      return;
-    }
     const tagPrefix = options.tagPrefix ?? "v";
     const releaseBranch = projectReleaseBranch(project);
-    const summary = options.summary ?? true;
-    const summaryArgs =
-      summary === false || (typeof summary === "object" && summary.providers?.length === 0)
-        ? ["--no-release-summary"]
-        : typeof summary === "object" && summary.providers
-          ? [`--release-summary-providers ${summary.providers.join(",")}`]
-          : [];
     releaseTagPrefixes.set(project, tagPrefix);
     if (options.nodeRelease !== false) nodeReleaseProjects.add(project);
     applyTasks(project, {
       bump: {
-        exec: taskScript(project, "bump.ts", `--prefix ${tagPrefix}`),
+        exec: taskScript(project, "bump.ts"),
         receiveArgs: true,
         description: "Increment VERSION and synchronize generated workspace versions",
       },
@@ -963,27 +302,11 @@ export class DBXToolsRelease extends Component {
             release: {
               exec: taskScript(
                 project,
-                "release-pr.ts",
-                [
-                  `--prefix ${tagPrefix}`,
-                  `--base ${releaseBranch}`,
-                  ...(options.pythonRoot
-                    ? [`--python-root ${JSON.stringify(options.pythonRoot)}`]
-                    : []),
-                  ...(options.validationTasks ?? []).map(
-                    (task) => `--validate-task ${JSON.stringify(task)}`,
-                  ),
-                  ...summaryArgs,
-                ].join(" "),
+                "release.ts",
+                `--prefix ${tagPrefix} --branch ${releaseBranch}`,
               ),
               receiveArgs: true,
-              description:
-                "Prepare, validate, locally publish, and upload a draft release candidate",
-            },
-            "release:assets": {
-              exec: taskScript(project, "release-candidate.ts"),
-              receiveArgs: true,
-              description: "Rebuild and upload a complete draft release candidate",
+              description: "Run bump, commit it, and push an annotated release tag",
             },
           }
         : {}),
@@ -994,49 +317,22 @@ export class DBXToolsRelease extends Component {
       fileName: "release.yml",
       limitConcurrency: true,
       concurrencyOptions: {
-        group:
-          "release-${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+        group: "release-${{ github.ref_name }}",
         cancelInProgress: false,
       },
     });
-    const version = readWorkspaceVersion(project.outdir);
-    workflow.runName =
-      `release ${version} ` +
-      "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}";
+    releaseWorkflows.set(project, workflow);
+    workflow.runName = "release ${{ github.ref_name }}";
     workflow.on({
-      release: { types: ["published"] },
-      workflowDispatch: {
-        inputs: {
-          release_tag: {
-            description: "Annotated release tag to validate",
-            type: "string",
-            required: true,
-          },
-          stage: {
-            description: "Published release stage to validate or recover",
-            type: "choice",
-            options: ["all", "node", "python", "cargo", "docs"],
-            default: "all",
-            required: true,
-          },
-          dry_run: {
-            description: "Build and validate without publishing",
-            type: "boolean",
-            default: "true",
-            required: true,
-          },
-        },
-      },
+      push: { tags: [`${tagPrefix}*`] },
     });
     workflow.file?.addOverride("permissions.contents", "read");
-    workflow.file?.addOverride("on.workflow_dispatch.inputs.dry_run.default", true);
-    workflow.addJob("verify-context", verifyContextJob(tagPrefix, releaseBranch));
+    workflow.addJob("verify-context", verifyContextJob(project, tagPrefix, releaseBranch, options));
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob(project));
     }
     if (options.docs) {
       addDocsJobs(workflow, project, options.docs);
     }
-    releaseWorkflows.set(project, workflow);
   }
 }