@dbx-tools/projen 0.9.21 → 0.9.29

package/src/release.ts

@@ -6,14 +6,7 @@ import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflo
 import { BUN_VERSION, bunCacheRestoreSteps, bunCacheSaveStep } from "./bun-workflow.ts";
 import { projectReleaseBranch, type DBXToolsJavaScriptProject } from "./project-js.ts";
 import { applyTasks, taskScript } from "./project.ts";
-import {
-  RELEASE_SHA,
-  RELEASE_TAG,
-  RELEASE_VERSION,
-  releaseSourceSteps,
-  type ReleaseSummaryProviderName,
-} from "./release-dispatch.ts";
-import { readWorkspaceVersion } from "./workspace-version.ts";
+import { RELEASE_VERSION, releaseSourceSteps } from "./release-context.ts";
 
 const NODE_VERSION = "24";
 const NPM_VERSION = "11.4.2";
@@ -23,7 +16,7 @@ const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
 
 /** Independently recoverable portions of the release workflow. */
-export type ReleaseStage = "all" | "node" | "python" | "cargo" | "docs";
+export type ReleaseStage = "all" | "node" | "python" | "docs";
 
 /** GitHub Pages configuration included in the unified release workflow. */
 export interface ReleaseDocsOptions {
@@ -37,16 +30,6 @@ export interface ReleaseDocsOptions {
   readonly artifactPath: string;
 }
 
-/** Optional local AI summary generation during reviewed release preparation. */
-export interface ReleaseSummaryOptions {
-  /**
-   * Provider fallback order.
-   *
-   * @default ["cursor", "codex", "claude"]
-   */
-  readonly providers?: readonly ReleaseSummaryProviderName[];
-}
-
 /** Options for {@link DBXToolsRelease}. */
 export interface DBXToolsReleaseOptions {
   /** Git tag prefix. Defaults to `v`. */
@@ -55,15 +38,10 @@ export interface DBXToolsReleaseOptions {
   readonly nodeRelease?: boolean;
   /** Build and deploy generated documentation through GitHub Pages. */
   readonly docs?: ReleaseDocsOptions;
-  /** Python package root passed to local release preparation. */
+  /** Python package root used by attached Python publication jobs. */
   readonly pythonRoot?: string;
-  /** Repository task names run after VERSION generation and before candidate construction. */
+  /** Repository task names run after VERSION verification and before publication. */
   readonly validationTasks?: readonly string[];
-  /**
-   * Generate a versioned release summary locally. Defaults to enabled with the
-   * standard Cursor, Codex, Claude fallback order.
-   */
-  readonly summary?: boolean | ReleaseSummaryOptions;
 }
 
 /** Locate the unified workflow so attached language workspaces can add jobs. */
@@ -90,32 +68,22 @@ export function releaseTagPattern(project: DBXToolsJavaScriptProject): string {
   return `${prefix}*`;
 }
 
-/** Run a release stage on promotion or when selected for manual recovery. */
+/** Run a release stage after its prerequisite tag-build jobs succeed. */
 export function releaseStageCondition(
-  stage: Exclude<ReleaseStage, "all">,
+  _stage: Exclude<ReleaseStage, "all">,
   prerequisites: readonly string[] = [],
 ): string {
-  if (prerequisites.length === 0) {
-    return `\${{ github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}' }}`;
-  }
-  const prefix = prerequisites.length
-    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
-    : "";
-  return `\${{ ${prefix}(github.event_name == 'release' || inputs.stage == 'all' || inputs.stage == '${stage}') }}`;
+  if (prerequisites.length === 0) return "${{ success() }}";
+  return `\${{ always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
 }
 
-/** Publish a selected stage unless a manual run remains in dry-run mode. */
+/** Publish a release stage after its prerequisite tag-build jobs succeed. */
 export function releasePublishCondition(
-  stage: Exclude<ReleaseStage, "all">,
+  _stage: Exclude<ReleaseStage, "all">,
   prerequisites: readonly string[] = [],
 ): string {
-  if (prerequisites.length === 0) {
-    return `\${{ github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}')) }}`;
-  }
-  const prefix = prerequisites.length
-    ? `always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} && `
-    : "";
-  return `\${{ ${prefix}(github.event_name == 'release' || (inputs.dry_run != true && (inputs.stage == 'all' || inputs.stage == '${stage}'))) }}`;
+  if (prerequisites.length === 0) return "${{ success() }}";
+  return `\${{ always() && ${prerequisites.map((condition) => `(${condition})`).join(" && ")} }}`;
 }
 
 /** Shared Bun, Node, cache, and install setup for Node release jobs. */
@@ -142,17 +110,49 @@ export function nodeReleaseSetupSteps(project: DBXToolsJavaScriptProject): reado
 export function npmPublishEnvironment(): Record<string, string> {
   return {
     NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}",
-    NPM_CONFIG_PROVENANCE:
-      "${{ (github.event_name == 'release' || inputs.dry_run != true) && 'true' || 'false' }}",
-    DRY_RUN:
-      "${{ github.event_name == 'workflow_dispatch' && inputs.dry_run && '--dry-run' || '' }}",
+    NPM_CONFIG_PROVENANCE: "true",
+    DRY_RUN: "",
   };
 }
 
-function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
+/** Install uv and restore its download/build cache using Python manifests. */
+export function uvSetupStep(): JobStep {
+  return {
+    name: "Setup uv",
+    uses: "astral-sh/setup-uv@v7",
+    with: {
+      "enable-cache": true,
+      "cache-dependency-glob": "**/pyproject.toml",
+    },
+  };
+}
+
+function refreshDocsRegistryDependencies(workflow: GithubWorkflow): void {
+  const docs = workflow.getJob("build-docs") as Job | undefined;
+  if (!docs) return;
+  const registryJobs = Object.keys(workflow.jobs).filter(
+    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
+  );
+  if (registryJobs.length > 0) workflow.updateJob("build-docs", { ...docs, needs: registryJobs });
+}
+
+/** Keep documentation publication behind every configured package registry. */
+export function refreshReleaseDocsDependencies(project: DBXToolsJavaScriptProject): void {
+  const workflow = releaseWorkflows.get(project);
+  if (workflow) refreshDocsRegistryDependencies(workflow);
+}
+
+function verifyContextJob(
+  project: DBXToolsJavaScriptProject,
+  tagPrefix: string,
+  releaseBranch: string,
+  options: DBXToolsReleaseOptions,
+): Job {
   return {
     runsOn: ["ubuntu-latest"],
     permissions: { contents: JobPermission.READ },
+    timeoutMinutes: 30,
+    env: { BUN_VERSION, CI: "true" },
     outputs: {
       release_tag: { stepId: "release", outputName: "release_tag" },
       expected_sha: { stepId: "release", outputName: "expected_sha" },
@@ -163,24 +163,19 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
         name: "Checkout release source",
         uses: "actions/checkout@v6",
         with: {
-          ref: "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+          ref: "${{ github.ref_name }}",
           "fetch-depth": 0,
         },
       },
-      {
-        name: "Setup Bun",
-        uses: "oven-sh/setup-bun@v2",
-        with: { "bun-version": BUN_VERSION },
-      },
+      ...bunCacheRestoreSteps(project, { ignorePaths: project.workflowCacheIgnorePaths }),
       { name: "Install release validation dependencies", run: "bun install --frozen-lockfile" },
+      bunCacheSaveStep(),
       {
         name: "Verify release context",
         id: "release",
         shell: "bash",
         env: {
-          RELEASE_TAG:
-            "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
-          GH_TOKEN: "${{ github.token }}",
+          RELEASE_TAG: "${{ github.ref_name }}",
         },
         // prettier-ignore
         run: stringUtils.dedent(
@@ -194,17 +189,8 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           test "$(git cat-file -t "$RELEASE_TAG")" = "tag"
           RELEASE_SHA="$(git rev-parse "$RELEASE_TAG^{commit}")"
           test "$(git rev-parse HEAD)" = "$RELEASE_SHA"
-          git merge-base --is-ancestor "$RELEASE_SHA" "origin/${releaseBranch}"
+          test "$(git rev-parse "origin/${releaseBranch}")" = "$RELEASE_SHA"
           test "$(tr -d '\\r\\n' < VERSION)" = "$RELEASE_VERSION"
-          test "$(gh release view "$RELEASE_TAG" --json isDraft --jq .isDraft)" = "false"
-          rm -rf dist/release-candidate
-          mkdir -p dist/release-candidate
-          gh release download "$RELEASE_TAG" --dir dist/release-candidate
-          bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \
-            --directory dist/release-candidate \
-            --tag "$RELEASE_TAG" \
-            --sha "$RELEASE_SHA" \
-            --version "$RELEASE_VERSION"
           echo "release_tag=$RELEASE_TAG" >> "$GITHUB_OUTPUT"
           echo "expected_sha=$RELEASE_SHA" >> "$GITHUB_OUTPUT"
           echo "release_version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
@@ -212,6 +198,10 @@ function verifyContextJob(tagPrefix: string, releaseBranch: string): Job {
           // ============================================================================
         ),
       },
+      ...(options.validationTasks ?? []).map((task) => ({
+        name: `Validate ${task}`,
+        run: `bun run ${task}`,
+      })),
     ],
   };
 }
@@ -227,26 +217,9 @@ function nodePublishJob(project: DBXToolsJavaScriptProject): Job {
     steps: [
       ...nodeReleaseSetupSteps(project),
       {
-        name: "Download approved npm archives",
-        env: { GH_TOKEN: "${{ github.token }}", RELEASE_SHA, RELEASE_TAG, RELEASE_VERSION },
-        shell: "bash",
-        run: [
-          "rm -rf dist/release-download dist/npm-release",
-          "mkdir -p dist/release-download",
-          'gh release download "$RELEASE_TAG" --pattern release-manifest.json --pattern SHA256SUMS --pattern "*.tgz" --dir dist/release-download',
-          "bun node_modules/@dbx-tools/projen/tasks/release-manifest.ts verify \\",
-          "  --directory dist/release-download \\",
-          '  --tag "$RELEASE_TAG" \\',
-          '  --sha "$RELEASE_SHA" \\',
-          '  --version "$RELEASE_VERSION" \\',
-          "  --kind npm \\",
-          "  --output dist/npm-release",
-        ].join("\n"),
-      },
-      {
-        name: "Publish approved npm archives",
+        name: "Publish npm workspace",
         env: { RELEASE_VERSION, ...npmPublishEnvironment() },
-        run: 'bun node_modules/@dbx-tools/projen/tasks/publish-npm.ts --directory dist/npm-release --version "$RELEASE_VERSION" $DRY_RUN',
+        run: 'bun node_modules/@dbx-tools/projen/tasks/publish.ts "$RELEASE_VERSION" $DRY_RUN',
       },
     ],
   };
@@ -303,6 +276,7 @@ function addDocsJobs(
       },
     ],
   });
+  refreshDocsRegistryDependencies(workflow);
 }
 
 /** Owns the single release workflow and local release preparation tasks. */
@@ -311,18 +285,11 @@ export class DBXToolsRelease extends Component {
     super(project);
     const tagPrefix = options.tagPrefix ?? "v";
     const releaseBranch = projectReleaseBranch(project);
-    const summary = options.summary ?? true;
-    const summaryArgs =
-      summary === false || (typeof summary === "object" && summary.providers?.length === 0)
-        ? ["--no-release-summary"]
-        : typeof summary === "object" && summary.providers
-          ? [`--release-summary-providers ${summary.providers.join(",")}`]
-          : [];
     releaseTagPrefixes.set(project, tagPrefix);
     if (options.nodeRelease !== false) nodeReleaseProjects.add(project);
     applyTasks(project, {
       bump: {
-        exec: taskScript(project, "bump.ts", `--prefix ${tagPrefix}`),
+        exec: taskScript(project, "bump.ts"),
         receiveArgs: true,
         description: "Increment VERSION and synchronize generated workspace versions",
       },
@@ -335,33 +302,11 @@ export class DBXToolsRelease extends Component {
             release: {
               exec: taskScript(
                 project,
-                "release-pr.ts",
-                [
-                  `--prefix ${tagPrefix}`,
-                  `--base ${releaseBranch}`,
-                  ...(options.pythonRoot
-                    ? [`--python-root ${JSON.stringify(options.pythonRoot)}`]
-                    : []),
-                  ...(options.validationTasks ?? []).map(
-                    (task) => `--validate-task ${JSON.stringify(task)}`,
-                  ),
-                  ...summaryArgs,
-                ].join(" "),
-              ),
-              receiveArgs: true,
-              description:
-                "Prepare, validate, locally publish, and upload a draft release candidate",
-            },
-            "release:assets": {
-              exec: taskScript(
-                project,
-                "release-candidate.ts",
-                options.pythonRoot
-                  ? `--python-root ${JSON.stringify(options.pythonRoot)}`
-                  : undefined,
+                "release.ts",
+                `--prefix ${tagPrefix} --branch ${releaseBranch}`,
               ),
               receiveArgs: true,
-              description: "Rebuild and upload a complete draft release candidate",
+              description: "Run bump, commit it, and push an annotated release tag",
             },
           }
         : {}),
@@ -372,49 +317,22 @@ export class DBXToolsRelease extends Component {
       fileName: "release.yml",
       limitConcurrency: true,
       concurrencyOptions: {
-        group:
-          "release-${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}",
+        group: "release-${{ github.ref_name }}",
         cancelInProgress: false,
       },
     });
-    const version = readWorkspaceVersion(project.outdir);
-    workflow.runName =
-      `release ${version} ` +
-      "${{ github.event_name == 'release' && github.event.release.tag_name || inputs.release_tag }}";
+    releaseWorkflows.set(project, workflow);
+    workflow.runName = "release ${{ github.ref_name }}";
     workflow.on({
-      release: { types: ["published"] },
-      workflowDispatch: {
-        inputs: {
-          release_tag: {
-            description: "Annotated release tag to validate",
-            type: "string",
-            required: true,
-          },
-          stage: {
-            description: "Published release stage to validate or recover",
-            type: "choice",
-            options: ["all", "node", "python", "cargo", "docs"],
-            default: "all",
-            required: true,
-          },
-          dry_run: {
-            description: "Build and validate without publishing",
-            type: "boolean",
-            default: "true",
-            required: true,
-          },
-        },
-      },
+      push: { tags: [`${tagPrefix}*`] },
     });
     workflow.file?.addOverride("permissions.contents", "read");
-    workflow.file?.addOverride("on.workflow_dispatch.inputs.dry_run.default", true);
-    workflow.addJob("verify-context", verifyContextJob(tagPrefix, releaseBranch));
+    workflow.addJob("verify-context", verifyContextJob(project, tagPrefix, releaseBranch, options));
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob(project));
     }
     if (options.docs) {
       addDocsJobs(workflow, project, options.docs);
     }
-    releaseWorkflows.set(project, workflow);
   }
 }

package/tasks/bump.ts

@@ -6,43 +6,34 @@
  */
 import * as projectUtils from "@dbx-tools/core/project-utils";
 import { log } from "@dbx-tools/shared-core";
-import { Command } from "commander";
+import { Command, Option } from "commander";
+import { runTaskCommand } from "../src/_task-command.ts";
 import {
-  releaseArchitectureOption,
-  releaseLevelOption,
-  releaseOperatingSystemOption,
-  releasePlatformFilter,
-  type ReleaseArch,
-  type ReleaseOs,
+  resolveNextVersion,
   type VersionLevel,
-} from "../src/_release-platform.ts";
-import { runTaskCommand } from "../src/_task-command.ts";
-import { resolveNextVersion, writeWorkspaceVersion } from "../src/workspace-version.ts";
+  writeWorkspaceVersion,
+} from "../src/workspace-version.ts";
 
 const logger = log.logger("projen:bump");
 
 const program = new Command();
 program
   .description("Increment VERSION and synchronize generated workspace versions")
-  .addOption(releaseLevelOption())
-  .addOption(releaseOperatingSystemOption())
-  .addOption(releaseArchitectureOption())
+  .addOption(
+    new Option("-l, --level <level>", "semver increment")
+      .choices(["patch", "minor", "major"])
+      .default("patch"),
+  )
   .option("--no-synth", "write VERSION without synchronizing generated files")
-  .action((opts: { level: VersionLevel; os: ReleaseOs[]; arch: ReleaseArch[]; synth: boolean }) => {
+  .action((opts: { level: VersionLevel; synth: boolean }) => {
     const root = projectUtils.root() ?? process.cwd();
     const next = resolveNextVersion(root, opts.level);
-    const releasePlatforms = releasePlatformFilter(opts.os, opts.arch);
 
     logger.info(`bump ${next.base} -> ${next.version} (${opts.level})`);
     writeWorkspaceVersion(root, next.version);
 
     if (opts.synth) {
-      runTaskCommand(root, process.execPath, [".projenrc.ts"], {
-        env: {
-          ...process.env,
-          ...(releasePlatforms ? { DBX_TOOLS_RELEASE_PLATFORMS: releasePlatforms } : {}),
-        },
-      });
+      runTaskCommand(root, process.execPath, [".projenrc.ts"]);
     }
     logger.success(`workspace version synchronized at ${next.version}`);
   });

package/tasks/databricks-cli-assets.ts

@@ -0,0 +1,129 @@
+#!/usr/bin/env -S bun
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+import * as projectUtils from "@dbx-tools/core/project-utils";
+
+import { makeReadonly, makeWritable } from "../src/generated.ts";
+
+const MINIMUM_VERSION = "0.296.0";
+const REPOSITORY = "databricks/cli";
+const PLATFORM_ASSETS = {
+  "darwin-arm64": "darwin_arm64",
+  "darwin-x64": "darwin_amd64",
+  "linux-arm64": "linux_arm64",
+  "linux-x64": "linux_amd64",
+  "win32-arm64": "windows_arm64",
+  "win32-x64": "windows_amd64",
+} as const;
+
+interface GitHubAsset {
+  readonly browser_download_url: string;
+  readonly digest?: string;
+  readonly name: string;
+}
+
+interface GitHubRelease {
+  readonly assets: GitHubAsset[];
+  readonly published_at: string;
+  readonly tag_name: string;
+}
+
+interface CliAsset {
+  readonly sha256: string;
+  readonly url: string;
+}
+
+interface CliAssetManifest {
+  readonly schemaVersion: 1;
+  readonly dbxToolsVersion: string;
+  readonly minimumVersion: string;
+  readonly version: string;
+  readonly publishedAt: string;
+  readonly assets: Record<keyof typeof PLATFORM_ASSETS, CliAsset>;
+}
+
+function validManifest(value: unknown, dbxToolsVersion: string): value is CliAssetManifest {
+  if (!value || typeof value !== "object") return false;
+  const manifest = value as Partial<CliAssetManifest>;
+  return (
+    manifest.schemaVersion === 1 &&
+    manifest.dbxToolsVersion === dbxToolsVersion &&
+    manifest.minimumVersion === MINIMUM_VERSION &&
+    typeof manifest.version === "string" &&
+    typeof manifest.publishedAt === "string" &&
+    Boolean(manifest.assets) &&
+    Object.keys(PLATFORM_ASSETS).every((key) => {
+      const asset = manifest.assets?.[key as keyof typeof PLATFORM_ASSETS];
+      return (
+        typeof asset?.url === "string" &&
+        typeof asset.sha256 === "string" &&
+        /^[0-9a-f]{64}$/.test(asset.sha256)
+      );
+    })
+  );
+}
+
+async function latestManifest(dbxToolsVersion: string): Promise<CliAssetManifest> {
+  const response = await fetch(`https://api.github.com/repos/${REPOSITORY}/releases/latest`, {
+    headers: {
+      accept: "application/vnd.github+json",
+      "user-agent": `dbx-tools/${dbxToolsVersion}`,
+    },
+  });
+  if (!response.ok) {
+    throw new Error(`Could not resolve the latest Databricks CLI release (${response.status})`);
+  }
+  const release = (await response.json()) as GitHubRelease;
+  const version = release.tag_name.replace(/^v/, "");
+  const assets = Object.fromEntries(
+    Object.entries(PLATFORM_ASSETS).map(([platform, suffix]) => {
+      const name = `databricks_cli_${version}_${suffix}.tar.gz`;
+      const asset = release.assets.find((candidate) => candidate.name === name);
+      const sha256 = asset?.digest?.match(/^sha256:([0-9a-f]{64})$/i)?.[1]?.toLowerCase();
+      if (!asset || !sha256)
+        throw new Error(`Release ${release.tag_name} has no digest for ${name}`);
+      return [platform, { url: asset.browser_download_url, sha256 }];
+    }),
+  ) as CliAssetManifest["assets"];
+  return {
+    schemaVersion: 1,
+    dbxToolsVersion,
+    minimumVersion: MINIMUM_VERSION,
+    version,
+    publishedAt: release.published_at,
+    assets,
+  };
+}
+
+const { values } = parseArgs({
+  options: {
+    check: { type: "boolean", default: false },
+    root: { type: "string" },
+  },
+  strict: true,
+});
+const root = resolve(values.root ?? projectUtils.root() ?? process.cwd());
+const output = join(root, "packages/js/node/auth/src/generated/databricks-cli-assets.json");
+const dbxToolsVersion = readFileSync(join(root, "VERSION"), "utf8").trim();
+let current: unknown;
+if (existsSync(output)) {
+  try {
+    current = JSON.parse(readFileSync(output, "utf8"));
+  } catch {
+    current = undefined;
+  }
+}
+if (validManifest(current, dbxToolsVersion)) {
+  console.log(`verified ${output.slice(root.length + 1)}`);
+} else if (values.check) {
+  throw new Error("Databricks CLI asset manifest is missing or stale");
+} else {
+  const manifest = await latestManifest(dbxToolsVersion);
+  mkdirSync(dirname(output), { recursive: true });
+  makeWritable(output);
+  writeFileSync(output, `${JSON.stringify(manifest, undefined, 2)}\n`);
+  makeReadonly(output);
+  console.log(`generated ${output.slice(root.length + 1)}`);
+}