@dbx-tools/projen 0.9.4 → 0.9.6

package/tasks/publish.ts

@@ -1,8 +1,8 @@
 #!/usr/bin/env -S bun
 /**
- * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run]`
+ * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]`
  * - verify every workspace member and the Bun lock carry the release version,
- * then publish each package owned by the standard Node release with `bun publish`.
+ * then pack and publish each package owned by the standard Node release.
  *
  * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
  * It leans on native bun for everything bun already does:
@@ -26,14 +26,15 @@
  *     its `#!/usr/bin/env node` shebang, node chokes on the `.ts`
  *     (ERR_UNKNOWN_FILE_EXTENSION). We merge `publishConfig` onto the top-level
  *     manifest before packing so the tarball advertises the compiled `lib/` tree;
- *   - **compiled output** is emitted once, before publishing, by one root-level
+ *   - **compiled output** is emitted once, before packing, by one root-level
  *     filtered `bun run` that fans out to every publishable member in parallel.
- *     The later `bun publish --ignore-scripts` calls therefore pack the already
- *     compiled `lib/` trees instead of serially repeating each member's
- *     `prepack`. Packages retain their `prepack` task for standalone publishes.
- *   - **release recovery** packs each exact version before upload and compares
- *     its integrity and repository identity with registry metadata. A matching
- *     immutable version is skipped, while any mismatch fails the retry.
+ *     Every package is then packed once with lifecycle scripts disabled. The
+ *     exact validated archive is passed to `bun publish`, so upload never
+ *     repacks or repeats a member's `prepack`. Packages retain `prepack` for
+ *     standalone publishes.
+ *   - **release recovery** compares each packed archive's integrity and
+ *     repository identity with registry metadata. A matching immutable version
+ *     is skipped, while any mismatch fails the retry.
  *
  * `--dry-run` forwards to `bun publish`: it packs + validates
  * but uploads nothing, so the `release` workflow is testable end-to-end via a
@@ -63,8 +64,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
-import { log } from "@dbx-tools/shared-core";
+import { asyncUtils, log } from "@dbx-tools/shared-core";
 import ts from "typescript";
 import { parse } from "yaml";
 import {
@@ -73,9 +73,11 @@ import {
   publishedNpmRelease,
   readNpmArchiveIdentity,
 } from "./publish-npm.ts";
+import { runTaskCommand, runTaskCommandAsync } from "../src/_task-command.ts";
+import { toPosix } from "../src/packages.ts";
 import type { ReleasePlan } from "../src/release-plan.ts";
 
-const logger = log.logger("dbx-tools:publish");
+const logger = log.logger("projen:publish");
 
 /** A manifest's on-disk bytes + mode, captured before this task edits it. */
 interface ManifestBackup {
@@ -115,7 +117,7 @@ function manifestsMatchVersions(
     const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
       version?: string;
     };
-    const path = dir.slice(resolve(root).length + 1).replaceAll("\\", "/");
+    const path = toPosix(dir.slice(resolve(root).length + 1));
     return pkg.version === expected.get(path);
   });
 }
@@ -134,10 +136,7 @@ function lockfileMatchesManifestVersions(root: string, members: readonly string[
       const manifest = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
         version?: string;
       };
-      const relative = dir
-        .slice(resolve(root).length + 1)
-        .split("\\")
-        .join("/");
+      const relative = toPosix(dir.slice(resolve(root).length + 1));
       return lock.workspaces?.[relative]?.version === manifest.version;
     });
   } catch {
@@ -145,51 +144,6 @@ function lockfileMatchesManifestVersions(root: string, members: readonly string[
   }
 }
 
-/** Spawn `command` in `cwd` with `PATH` overridden, failing the task on non-zero. */
-function run(cwd: string, command: string, args: string[], path: string): void {
-  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
-  exec.spawnSync(executable, args, {
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    check: true,
-    env: { ...process.env, PATH: path },
-  });
-}
-
-/** Asynchronous counterpart used for bounded parallel stamping and publishing. */
-async function runAsync(cwd: string, command: string, args: string[], path: string): Promise<void> {
-  const executable = command === "bun" && process.versions.bun ? process.execPath : command;
-  await exec.spawn(executable, args, {
-    cwd,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    check: true,
-    env: { ...process.env, PATH: path },
-  });
-}
-
-/** Run independent jobs with a small fixed worker pool. */
-async function runConcurrent<T>(
-  values: readonly T[],
-  concurrency: number,
-  worker: (value: T) => Promise<void>,
-): Promise<void> {
-  let next = 0;
-  const results = await Promise.allSettled(
-    Array.from({ length: Math.min(concurrency, values.length) }, async () => {
-      while (next < values.length) {
-        const value = values[next++];
-        await worker(value);
-      }
-    }),
-  );
-  const failure = results.find((result) => result.status === "rejected");
-  if (failure?.status === "rejected") throw failure.reason;
-}
-
 /**
  * Make a projen-readonly manifest writable so the publishConfig projection can
  * edit it, recording its original bytes and mode for {@link restoreManifests}
@@ -228,6 +182,14 @@ function restoreManifests(): void {
 /** Entry-point fields projen writes as `.ts` source in-repo and rewrites to `lib/` for publish. */
 const PUBLISH_CONFIG_ENTRY_FIELDS = ["main", "types", "bin", "exports"] as const;
 
+/** Compiled files referenced by a publishConfig entry-point tree. */
+function compiledPublishTargets(value: unknown): string[] {
+  if (typeof value === "string") return value.startsWith("./lib/") ? [value] : [];
+  if (Array.isArray(value)) return value.flatMap(compiledPublishTargets);
+  if (!value || typeof value !== "object") return [];
+  return Object.values(value).flatMap(compiledPublishTargets);
+}
+
 /**
  * Fold a package's `publishConfig` entry-point fields onto the top-level manifest,
  * the way pnpm/npm do at pack time but `bun publish` does NOT (see the module
@@ -272,13 +234,14 @@ const plan =
     : undefined;
 if (!version && !plan) {
   logger.error(
-    "usage: bun tasks/publish.ts <version> [--plan <path>] [--registry <url>] [--exclude <dir>] [--dry-run]",
+    "usage: bun tasks/publish.ts <version> [--plan <path>] [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]",
   );
   process.exit(1);
 }
 const registryIdx = rest.indexOf("--registry");
 const registry = registryIdx >= 0 ? rest[registryIdx + 1] : undefined;
 const dryRun = rest.includes("--dry-run");
+const skipCompile = rest.includes("--skip-compile");
 const concurrencyIdx = rest.indexOf("--concurrency");
 const parsedConcurrency = Number(concurrencyIdx >= 0 ? rest[concurrencyIdx + 1] : 4);
 if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
@@ -302,15 +265,10 @@ const allMembers = workspaceMembers(root)
 const expectedVersions = new Map(
   plan
     ? plan.nodePackages.map((pkg) => [pkg.path, pkg.version] as const)
-    : allMembers.map((dir) => [
-        dir.slice(resolve(root).length + 1).replaceAll("\\", "/"),
-        version!,
-      ]),
+    : allMembers.map((dir) => [toPosix(dir.slice(resolve(root).length + 1)), version!]),
 );
 const members = plan
-  ? allMembers.filter((dir) =>
-      expectedVersions.has(dir.slice(resolve(root).length + 1).replaceAll("\\", "/")),
-    )
+  ? allMembers.filter((dir) => expectedVersions.has(toPosix(dir.slice(resolve(root).length + 1))))
   : allMembers;
 
 if (!manifestsMatchVersions(root, members, expectedVersions)) {
@@ -328,12 +286,10 @@ if (lockfileMatchesManifestVersions(root, allMembers)) {
 } else {
   if (existsSync(lockfile)) rmSync(lockfile);
   logger.info("refreshing lockfile so workspace deps resolve to the release version");
-  run(root, "bun", ["install"], path);
+  runTaskCommand(root, "bun", ["install"], { env: { ...process.env, PATH: path } });
 }
 
 const publishArgs = [
-  "--access",
-  "public",
   "--ignore-scripts",
   ...(registry ? ["--registry", registry] : []),
   ...(dryRun ? ["--dry-run"] : []),
@@ -343,6 +299,8 @@ const publishable: Array<{
   name: string;
   version: string;
   compile: boolean;
+  compiledTargets: string[];
+  access?: "public" | "restricted";
 }> = [];
 for (const dir of members) {
   const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
@@ -350,7 +308,7 @@ for (const dir of members) {
     version?: string;
     private?: boolean;
     dbxToolsConfig?: { uniffi?: boolean };
-    scripts?: Record<string, string>;
+    publishConfig?: { access?: unknown };
   };
   if (pkg.private) {
     logger.info(`skip private ${pkg.name ?? dirname(dir)}`);
@@ -361,18 +319,46 @@ for (const dir of members) {
     continue;
   }
   if (!pkg.version) throw new Error(`Missing package version for ${pkg.name ?? dirname(dir)}`);
+  const access = pkg.publishConfig?.access;
+  if (access !== undefined && access !== "public" && access !== "restricted") {
+    throw new Error(
+      `${pkg.name ?? dirname(dir)} has invalid publishConfig.access ${String(access)}`,
+    );
+  }
+  const compiledTargets = [...new Set(compiledPublishTargets(pkg.publishConfig))];
   publishable.push({
     dir,
     name: pkg.name ?? dirname(dir),
     version: pkg.version,
-    compile: Boolean(pkg.scripts && typeof pkg.scripts === "object" && "prepack" in pkg.scripts),
+    compile: compiledTargets.length > 0,
+    compiledTargets,
+    ...(access ? { access } : {}),
   });
 }
 
 const compiled = publishable.filter((pkg) => pkg.compile);
 if (compiled.length > 0) {
-  logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
-  run(root, "bun", ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"], path);
+  if (skipCompile) {
+    const missing = compiled.flatMap((pkg) =>
+      pkg.compiledTargets
+        .filter((target) => !existsSync(resolve(pkg.dir, target)))
+        .map((target) => `${pkg.name}:${target}`),
+    );
+    if (missing.length > 0) {
+      throw new Error(
+        `--skip-compile requires validated compiled output; missing ${missing.join(", ")}`,
+      );
+    }
+    logger.info(`reusing validated compiled output for ${compiled.length} publishable packages`);
+  } else {
+    logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
+    runTaskCommand(
+      root,
+      "bun",
+      ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"],
+      { env: { ...process.env, PATH: path } },
+    );
+  }
 }
 
 // Compile against workspace source exports first. Switching manifests to their
@@ -387,9 +373,10 @@ for (const { dir } of publishable) {
 logger.info(
   `${dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
 );
-await runConcurrent(publishable, concurrency, async ({ dir, name, version: packageVersion }) => {
-  if (!dryRun) {
-    const packed = mkdtempSync(join(tmpdir(), "dbx-tools-npm-release-"));
+await asyncUtils.mapConcurrent(
+  publishable,
+  async ({ dir, name, version: packageVersion, access }) => {
+    const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
     try {
       const archive = packNpmPackage(dir, packed, path);
       const local = readNpmArchiveIdentity(archive);
@@ -398,16 +385,29 @@ await runConcurrent(publishable, concurrency, async ({ dir, name, version: packa
           `Packed npm identity ${local.name}@${local.version} does not match ${name}@${packageVersion}`,
         );
       }
-      const published = await publishedNpmRelease(local.name, local.version, registry);
-      if (npmReleaseMatches(local, published)) {
-        logger.info(`skip published ${name} @ ${packageVersion}`);
-        return;
+      if (local.access !== access) {
+        throw new Error(
+          `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
+        );
+      }
+      if (!dryRun) {
+        const published = await publishedNpmRelease(local.name, local.version, registry);
+        if (npmReleaseMatches(local, published)) {
+          logger.info(`skip published ${name} @ ${packageVersion}`);
+          return;
+        }
       }
+      logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
+      await runTaskCommandAsync(
+        dir,
+        "bun",
+        ["publish", ...(access ? ["--access", access] : []), ...publishArgs, archive],
+        { env: { ...process.env, PATH: path } },
+      );
     } finally {
       rmSync(packed, { recursive: true, force: true });
     }
-  }
-  logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
-  await runAsync(dir, "bun", ["publish", ...publishArgs], path);
-});
+  },
+  { concurrency, errorMode: "settle" },
+);
 logger.success(`${dryRun ? "dry-run: packed" : "published"} ${publishable.length} packages`);

package/tasks/python-registry.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { net } from "@dbx-tools/shared-core";
 
 export interface LocalPythonRegistry {

package/tasks/release-bootstrap.ts

@@ -3,7 +3,7 @@
 
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { project } from "@dbx-tools/core";
+import * as projectUtils from "@dbx-tools/core/project-utils";
 import { json, log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import type { ReleaseUnitGraph } from "../src/release-catalog.ts";
@@ -53,7 +53,7 @@ if (import.meta.main) {
   new Command()
     .option("--root <path>", "repository root")
     .action((options: { root?: string }) => {
-      bootstrapReleaseUnits(resolve(options.root ?? project.root() ?? process.cwd()));
+      bootstrapReleaseUnits(resolve(options.root ?? projectUtils.root() ?? process.cwd()));
     })
     .parse();
 }

package/tasks/release-plan.ts

@@ -3,7 +3,7 @@
 
 import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { json, log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import type { ReleaseUnitGraph } from "../src/release-catalog.ts";

package/tasks/release-please.ts

@@ -3,7 +3,7 @@
 
 import { appendFileSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { exec } from "@dbx-tools/core";
+import * as exec from "@dbx-tools/core/exec";
 import { log } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import { GitHub } from "release-please";

package/tasks/release-pr.ts

@@ -10,8 +10,9 @@
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { exec, project } from "@dbx-tools/core";
-import { async as asyncModule, json, log, object } from "@dbx-tools/shared-core";
+import * as exec from "@dbx-tools/core/exec";
+import * as projectUtils from "@dbx-tools/core/project-utils";
+import { asyncUtils, json, log, object } from "@dbx-tools/shared-core";
 import { Command } from "commander";
 import { publishLocalRelease } from "./local-publish.ts";
 import { generateReleaseSummary } from "./release-summary.ts";
@@ -23,6 +24,16 @@ import {
   type ReleaseOs,
   type VersionLevel,
 } from "../src/_release-platform.ts";
+import {
+  captureTaskCommand,
+  runTaskCommand,
+  runTaskCommandAsync,
+  taskCommandSucceeds,
+} from "../src/_task-command.ts";
+import {
+  RELEASE_SUMMARY_PROVIDER_NAMES,
+  type ReleaseSummaryProviderName,
+} from "../src/release-dispatch.ts";
 import {
   githubAccountSupportsWorkflowChanges,
   githubAuthenticatedAccounts,
@@ -32,10 +43,6 @@ import {
   githubTokenArguments,
   githubTokenEnvironmentName,
 } from "../src/release-github.ts";
-import {
-  RELEASE_SUMMARY_PROVIDER_NAMES,
-  type ReleaseSummaryProviderName,
-} from "../src/release-dispatch.ts";
 import {
   readWorkspaceVersion,
   resolveBaseVersion,
@@ -49,14 +56,9 @@ function git(
   args: string[],
   { capture = false, check = true }: { capture?: boolean; check?: boolean } = {},
 ): string {
-  const result = exec.spawnSync("git", args, {
-    cwd: root,
-    stdout: capture ? "capture" : "inherit",
-    stderr: capture ? "ignore" : "inherit",
-    stdin: "ignore",
-    check,
-  });
-  return result.stdout?.trim() ?? "";
+  if (capture) return captureTaskCommand(root, "git", args, { check });
+  runTaskCommand(root, "git", args);
+  return "";
 }
 
 function pushCurrentBranch(root: string, branch: string): void {
@@ -68,84 +70,7 @@ function pushCurrentBranch(root: string, branch: string): void {
 }
 
 function gitSucceeds(root: string, args: string[]): boolean {
-  return (
-    exec.spawnSync("git", args, {
-      cwd: root,
-      stdout: "ignore",
-      stderr: "ignore",
-      stdin: "ignore",
-      check: false,
-    }).exitCode === 0
-  );
-}
-
-function commandSucceeds(
-  root: string,
-  command: string,
-  args: string[],
-  env?: NodeJS.ProcessEnv,
-): boolean {
-  return (
-    exec.spawnSync(command, args, {
-      cwd: root,
-      env,
-      stdout: "ignore",
-      stderr: "ignore",
-      stdin: "ignore",
-      check: false,
-    }).exitCode === 0
-  );
-}
-
-function run(root: string, command: string, args: string[], env?: NodeJS.ProcessEnv): void {
-  exec.spawnSync(command, args, {
-    cwd: root,
-    env,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    check: true,
-  });
-}
-
-/** Run one release command with inherited output and a hard timeout. */
-async function runWithTimeout(
-  root: string,
-  command: string,
-  args: string[],
-  env: NodeJS.ProcessEnv,
-  timeoutMs: number,
-): Promise<void> {
-  await exec.spawn(command, args, {
-    cwd: root,
-    env,
-    stdout: "inherit",
-    stderr: "inherit",
-    stdin: "ignore",
-    signal: AbortSignal.timeout(timeoutMs),
-    check: true,
-  });
-}
-
-/** Capture one non-interactive command without throwing on a nonzero exit. */
-function captureCommand(
-  root: string,
-  command: string,
-  args: string[],
-  env: NodeJS.ProcessEnv,
-): string {
-  return (
-    exec
-      .spawnSync(command, args, {
-        cwd: root,
-        env,
-        stdout: "capture",
-        stderr: "ignore",
-        stdin: "ignore",
-        check: false,
-      })
-      .stdout?.trim() ?? ""
-  );
+  return taskCommandSucceeds(root, "git", args);
 }
 
 /** Wait for required checks and return the merged pull request commit. */
@@ -155,16 +80,15 @@ async function waitForPullRequestMerge(
   env: NodeJS.ProcessEnv,
   timeoutMs: number,
 ): Promise<string> {
-  await runWithTimeout(
+  await runTaskCommandAsync(
     root,
     "gh",
     ["pr", "checks", releaseBranch, "--watch", "--fail-fast", "--required", "--interval", "10"],
-    env,
-    timeoutMs,
+    { env, signal: AbortSignal.timeout(timeoutMs) },
   );
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
-    const state = captureCommand(
+    const state = captureTaskCommand(
       root,
       "gh",
       [
@@ -176,12 +100,12 @@ async function waitForPullRequestMerge(
         "--jq",
         '[.state, (.mergeCommit.oid // "")] | @tsv',
       ],
-      env,
+      { env },
     );
     const [status, mergeSha] = state.split("\t");
     if (status === "MERGED" && mergeSha) return mergeSha;
     if (status === "CLOSED") throw new Error(`Release pull request closed without merging`);
-    await asyncModule.sleep(2_000);
+    await asyncUtils.sleep(2_000);
   }
   throw new Error(`Release pull request did not merge within ${timeoutMs}ms`);
 }
@@ -197,7 +121,7 @@ async function waitForReleaseWorkflow(
   const deadline = Date.now() + timeoutMs;
   let runId = "";
   while (Date.now() < deadline) {
-    runId = captureCommand(
+    runId = captureTaskCommand(
       root,
       "gh",
       [
@@ -218,13 +142,16 @@ async function waitForReleaseWorkflow(
         "--jq",
         ".[0].databaseId // empty",
       ],
-      env,
+      { env },
     );
     if (runId) break;
-    await asyncModule.sleep(5_000);
+    await asyncUtils.sleep(5_000);
   }
   if (!runId) throw new Error(`Release workflow did not start within ${timeoutMs}ms`);
-  await runWithTimeout(root, "gh", ["run", "watch", runId, "--exit-status"], env, timeoutMs);
+  await runTaskCommandAsync(root, "gh", ["run", "watch", runId, "--exit-status"], {
+    env,
+    signal: AbortSignal.timeout(timeoutMs),
+  });
 }
 
 function githubAccount(root: string): {
@@ -234,7 +161,7 @@ function githubAccount(root: string): {
   login: string;
   token: string;
 } {
-  const repository = project.repositoryUrl(root);
+  const repository = projectUtils.repositoryUrl(root);
   if (!repository) throw new Error("Release preparation requires a GitHub repository");
   const identity = githubRepositoryIdentity(repository);
   const status = exec
@@ -375,7 +302,7 @@ program
       wait: boolean;
       waitTimeoutMinutes: string;
     }) => {
-      const root = project.root() ?? process.cwd();
+      const root = projectUtils.root() ?? process.cwd();
       const waitTimeoutMinutes = object.toNumber(opts.waitTimeoutMinutes, {
         separators: false,
         percent: false,
@@ -397,6 +324,15 @@ program
         includeComponentTags: false,
       }).version;
       const next = resolveNextVersion(root, [opts.prefix], opts.level, { fetch: false });
+      const releaseVersionScript = fileURLToPath(new URL("./release-version.ts", import.meta.url));
+      runTaskCommand(root, process.execPath, [
+        releaseVersionScript,
+        "--version",
+        next.version,
+        "--prefix",
+        opts.prefix,
+        "--assert-next",
+      ]);
       const releaseTag = `${opts.prefix}${next.version}`;
       const releaseBranch = `release/${releaseTag}`;
       const releaseRoot = join(root, ".worktrees", releaseTag);
@@ -454,11 +390,11 @@ program
         }
         logger.info(`resuming ${releaseBranch} in ${releaseRoot}`);
       }
-      run(releaseRoot, process.execPath, ["install"]);
+      runTaskCommand(releaseRoot, process.execPath, ["install"]);
 
       const bumpScript = fileURLToPath(new URL("./bump.ts", import.meta.url));
       const versionCheckScript = fileURLToPath(new URL("./version-check.ts", import.meta.url));
-      run(releaseRoot, process.execPath, [
+      runTaskCommand(releaseRoot, process.execPath, [
         bumpScript,
         "--level",
         opts.level,
@@ -471,19 +407,19 @@ program
         throw new Error(`Release preparation did not produce ${next.version}`);
       }
 
-      run(releaseRoot, process.execPath, [versionCheckScript]);
+      runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
       if (opts.validate) {
         for (const task of opts.validateTask) {
-          run(releaseRoot, process.execPath, ["run", task]);
+          runTaskCommand(releaseRoot, process.execPath, ["run", task]);
         }
         if (existsSync(join(releaseRoot, "Cargo.toml"))) {
-          run(releaseRoot, "cargo", [
+          runTaskCommand(releaseRoot, "cargo", [
             "test",
             "--workspace",
             ...(existsSync(join(releaseRoot, "Cargo.lock")) ? ["--locked"] : []),
           ]);
         }
-        run(releaseRoot, process.execPath, ["run", "compile"]);
+        runTaskCommand(releaseRoot, process.execPath, ["run", "compile"]);
       } else {
         logger.warn("release validation skipped by --no-validate");
       }
@@ -495,11 +431,12 @@ program
           localPypi: opts.localPypi,
           pythonRoot: opts.pythonRoot,
           localCargo: opts.localCargo,
+          reuseValidatedNodeCompile: opts.validate,
         });
       } else {
         logger.info("local publication skipped by --no-local-publish");
       }
-      run(releaseRoot, process.execPath, [versionCheckScript]);
+      runTaskCommand(releaseRoot, process.execPath, [versionCheckScript]);
       const releaseSummary = opts.releaseSummary
         ? await generateReleaseSummary({
             root: releaseRoot,
@@ -537,8 +474,14 @@ program
         [githubTokenEnvironmentName(account.hostname)]: account.token,
       };
       const ensurePullRequest = (): void => {
-        if (commandSucceeds(root, "gh", ["pr", "view", releaseBranch], githubEnvironment)) return;
-        run(
+        if (
+          taskCommandSucceeds(root, "gh", ["pr", "view", releaseBranch], {
+            env: githubEnvironment,
+          })
+        ) {
+          return;
+        }
+        runTaskCommand(
           root,
           "gh",
           [
@@ -553,12 +496,14 @@ program
             "--body",
             body,
           ],
-          githubEnvironment,
+          { env: githubEnvironment },
         );
       };
       ensurePullRequest();
       if (opts.approve) {
-        run(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], githubEnvironment);
+        runTaskCommand(root, "gh", ["pr", "merge", releaseBranch, "--auto", "--merge"], {
+          env: githubEnvironment,
+        });
       }
       git(root, ["worktree", "remove", "--force", releaseRoot]);
       git(root, ["branch", "--delete", "--force", releaseBranch]);