@dbx-tools/projen 0.9.46 → 0.9.50

package/tasks/lib/publish-python.ts

@@ -1,213 +0,0 @@
-#!/usr/bin/env -S bun
-/**
- * Build selected uv workspace packages from isolated publication copies and
- * optionally publish the resulting distributions.
- */
-import {
-  chmodSync,
-  cpSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  readdirSync,
-  rmSync,
-  writeFileSync,
-} from "node:fs";
-import { tmpdir } from "node:os";
-import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import * as projectUtils from "@dbx-tools/core/project-utils";
-import { Command } from "commander";
-import { parse, stringify } from "smol-toml";
-import { preparePythonProjectForPublication, pythonProjectInfo } from "./python-release.ts";
-import { runTaskCommand } from "../../src/_task-command.ts";
-
-interface PythonProjectFile {
-  readonly directory: string;
-  readonly name: string;
-  readonly version: string;
-  readonly path: string;
-  readonly private: boolean;
-  readonly source: string;
-}
-
-/** Python wheel and source archives accepted by Twine and package indexes. */
-export function pythonDistributionPaths(directory: string): string[] {
-  return readdirSync(directory)
-    .filter((file) => file.endsWith(".whl") || file.endsWith(".tar.gz"))
-    .sort()
-    .map((file) => join(directory, file));
-}
-
-function pythonProjects(root: string): PythonProjectFile[] {
-  const packageFiles = readdirSync(root, { withFileTypes: true })
-    .filter((entry) => entry.isDirectory())
-    .map((entry) => resolve(root, entry.name, "pyproject.toml"))
-    .filter(existsSync)
-    .sort();
-  const allProjects: PythonProjectFile[] = packageFiles.map((path) => {
-    const source = readFileSync(path, "utf8");
-    const info = pythonProjectInfo(source, { parse });
-    return {
-      directory: basename(resolve(path, "..")),
-      name: info.name,
-      version: info.version,
-      path,
-      private: info.private,
-      source,
-    };
-  });
-  return allProjects;
-}
-
-export function publishPythonProjects(options: {
-  readonly dryRun?: boolean;
-  readonly indexUrl: string;
-  readonly publishUrl: string;
-  readonly root: string;
-  readonly version: string;
-}): void {
-  const root = resolve(options.root);
-  const workspace = projectUtils.root(root) ?? dirname(root);
-  const output = mkdtempSync(join(workspace, ".projen-python-publish-"));
-  try {
-    buildPythonProjects({ ...options, output });
-    runTaskCommand(
-      process.cwd(),
-      "uvx",
-      [
-        "--from",
-        "devpi-client",
-        "devpi",
-        "upload",
-        "--index",
-        options.publishUrl,
-        "--from-dir",
-        ...(options.dryRun ? ["--dry-run"] : []),
-        output,
-      ],
-      { env: { ...process.env, UV_DEFAULT_INDEX: options.indexUrl } },
-    );
-  } finally {
-    rmSync(output, { recursive: true, force: true });
-  }
-}
-
-/** Build the exact Python release distributions without publishing them. */
-export function buildPythonProjects(options: {
-  readonly allowEmpty?: boolean;
-  readonly output: string;
-  readonly packages?: readonly string[];
-  /** Place each package's artifacts in its directory beneath output. */
-  readonly packageDirectories?: boolean;
-  readonly root: string;
-  readonly version: string;
-}): void {
-  const root = resolve(options.root);
-  const output = resolve(options.output);
-  const workspace = projectUtils.root(root) ?? dirname(root);
-  const outputPath = relative(workspace, output);
-  if (!outputPath || outputPath.startsWith("..") || isAbsolute(outputPath)) {
-    throw new Error("Python release output must be a non-root directory inside the workspace");
-  }
-  rmSync(output, { recursive: true, force: true });
-  const allProjects = pythonProjects(root);
-  const requested = new Set(options.packages ?? []);
-  const missing = [...requested].filter(
-    (directory) => !allProjects.some((project) => project.directory === directory),
-  );
-  if (missing.length > 0) throw new Error(`Unknown Python packages: ${missing.join(", ")}`);
-  const projects = allProjects.filter(
-    (project) => !project.private && (requested.size === 0 || requested.has(project.directory)),
-  );
-  if (projects.length === 0 && options.allowEmpty) {
-    mkdirSync(output, { recursive: true });
-    return;
-  }
-  if (projects.length === 0) throw new Error(`No Python packages found under ${root}`);
-
-  const temporaryRoot = mkdtempSync(join(tmpdir(), "projen-python-release-"));
-  try {
-    mkdirSync(output, { recursive: true });
-    for (const project of projects) {
-      const packageRoot = join(temporaryRoot, project.directory);
-      cpSync(dirname(project.path), packageRoot, { recursive: true });
-      const manifestPath = join(packageRoot, "pyproject.toml");
-      chmodSync(manifestPath, 0o644);
-      writeFileSync(
-        manifestPath,
-        preparePythonProjectForPublication(project.source, {
-          packages: allProjects,
-          toml: { parse, stringify },
-          version: options.version,
-        }),
-      );
-      const packageOutput = options.packageDirectories ? join(output, project.directory) : output;
-      runTaskCommand(root, "uv", ["build", "--out-dir", packageOutput, packageRoot]);
-      if (pythonDistributionPaths(packageOutput).length === 0) {
-        throw new Error(`No Python distributions found for ${project.name}`);
-      }
-    }
-    const distributions = options.packageDirectories
-      ? projects.flatMap((project) => pythonDistributionPaths(join(output, project.directory)))
-      : pythonDistributionPaths(output);
-    if (distributions.length === 0) {
-      throw new Error(`No Python distributions found in ${output}`);
-    }
-    runTaskCommand(process.cwd(), "uvx", ["twine", "check", ...distributions]);
-  } finally {
-    rmSync(temporaryRoot, { recursive: true, force: true });
-  }
-}
-
-export async function main(): Promise<void> {
-  const program = new Command();
-  program
-    .argument("<version>", "Python package version")
-    .option("--index-url <url>", "devpi Simple API URL")
-    .option("--publish-url <url>", "devpi writable index URL")
-    .option("--root <path>", "Python workspace package root", "packages/py")
-    .option("--package <directory...>", "Build only selected package directories")
-    .option("--output <path>", "Build distributions into a directory without publishing")
-    .option(
-      "--package-directories",
-      "Keep each package's distributions in its own output directory",
-    )
-    .option("--dry-run", "build and inspect distributions without uploading")
-    .action(
-      (
-        version: string,
-        options: {
-          dryRun?: boolean;
-          indexUrl?: string;
-          package?: string[];
-          packageDirectories?: boolean;
-          publishUrl?: string;
-          root: string;
-          output?: string;
-        },
-      ) => {
-        if (options.output) {
-          buildPythonProjects({
-            output: options.output,
-            packages: options.package,
-            packageDirectories: options.packageDirectories,
-            root: options.root,
-            version,
-          });
-        } else {
-          if (!options.indexUrl || !options.publishUrl) {
-            throw new Error("--index-url and --publish-url are required when publishing");
-          }
-          publishPythonProjects({
-            dryRun: options.dryRun,
-            indexUrl: options.indexUrl,
-            publishUrl: options.publishUrl,
-            root: options.root,
-            version,
-          });
-        }
-      },
-    );
-  await program.parseAsync();
-}

package/tasks/lib/publish.ts

@@ -1,264 +0,0 @@
-#!/usr/bin/env -S bun
-/**
- * `bun tasks/publish.ts <version> [--registry <url>] [--exclude <dir>] [--dry-run] [--skip-compile]`
- * - verify every workspace member carries the release version, then pack and
- * publish each package owned by the standard Node release.
- *
- * Bun has no `pnpm -r publish`, so this loop is the recursive-publish stand-in.
- * It leans on native bun for everything bun already does:
- *
- *   - **version validation** fails when any member differs from the reviewed
- *     `VERSION`; publication never repairs committed release metadata;
- *   - **`workspace:` / `catalog:` rewriting** is NOT done here - `bun pm pack`
- *     strips both protocols in the PACKED tarball, resolving `workspace:*` to the
- *     sibling's version and `catalog:` to the root catalog entry. (Verified: a
- *     packed manifest shows `"@scope/x": "<version>"` and the real catalog range,
- *     while the on-disk manifest keeps the protocols.) Setting each member's
- *     version first is the only prerequisite, so a sibling resolves the release
- *   - **`publishConfig` substitution** (compiled `lib/` entry points) is done
- *     inside the temporary archive, NOT in the checkout: unlike pnpm/npm, `bun
- *     publish`/`bun pm pack` do NOT fold `publishConfig`'s `main`/`types`/`bin`/
- *     `exports` into the packed manifest (verified: the packed manifest keeps the
- *     raw `.ts` source paths and an inert `publishConfig`). Left unsubstituted, a
- *     published CLI's `bin` points at `./bin/x.ts`, and because the bin runs via
- *     its `#!/usr/bin/env node` shebang, node chokes on the `.ts`
- *     (ERR_UNKNOWN_FILE_EXTENSION). We merge `publishConfig` onto the top-level
- *     manifest after packing so the tarball advertises the compiled `lib/` tree;
- *   - **compiled output** is emitted once, before packing, by one root-level
- *     filtered `bun run` that fans out to every publishable member in parallel.
- *     Every package is then packed once with lifecycle scripts disabled. The
- *     exact validated archive is passed to `npm publish`, so upload never
- *     repacks or repeats a member's `prepack`. Packages retain `prepack` for
- *     standalone publishes.
- *   - **release recovery** compares each packed archive's integrity and
- *     repository identity with registry metadata. A matching immutable version
- *     is skipped, while any mismatch fails the retry.
- *
- * `--dry-run` forwards to `npm publish`: it packs + validates
- * but uploads nothing. `--registry` targets a non-default registry (a local
- * verdaccio); `--exclude <dir>` (repeatable, repo-relative) skips a member owned
- * by another publication flow.
- *
- * The checkout remains byte-for-byte unchanged. A stale manifest is a release
- * error rather than something publication repairs. Local lockfiles are ignored
- * because configured registries can leak into them.
- */
-import { copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
-import { asyncUtils, log } from "@dbx-tools/shared-core";
-import {
-  applyPublishConfig,
-  npmReleaseMatches,
-  packNpmPackage,
-  publishedNpmRelease,
-  readNpmArchiveIdentity,
-} from "./publish-npm.ts";
-import { runTaskCommand, runTaskCommandAsync } from "../../src/_task-command.ts";
-import { recordedPackages } from "../../src/packages.ts";
-
-const logger = log.logger("projen:publish");
-
-export { applyPublishConfig };
-
-/** Whether selected workspace members carry the reviewed workspace version. */
-function manifestsMatchVersion(members: readonly string[], version: string): boolean {
-  return members.every((dir) => {
-    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
-      version?: string;
-    };
-    return pkg.version === version;
-  });
-}
-
-/** Compiled files referenced by a publishConfig entry-point tree. */
-function compiledPublishTargets(value: unknown): string[] {
-  if (typeof value === "string") return value.startsWith("./lib/") ? [value] : [];
-  if (Array.isArray(value)) return value.flatMap(compiledPublishTargets);
-  if (!value || typeof value !== "object") return [];
-  return Object.values(value).flatMap(compiledPublishTargets);
-}
-
-/**
- * PATH with the workspace-root `node_modules/.bin` prepended. The root-level
- * compile reaches each package's projen/dax task, which resolves `tsc` off PATH;
- * under the hoisted linker `tsc` lives only in the root `.bin`.
- */
-function enrichedPath(root: string): string {
-  const binDir = join(root, "node_modules", ".bin");
-  const current = process.env.PATH ?? "";
-  return current.split(delimiter).includes(binDir) ? current : `${binDir}${delimiter}${current}`;
-}
-
-function outputDirectory(root: string, value: string | undefined): string | undefined {
-  if (!value) return undefined;
-  const output = resolve(root, value);
-  const path = relative(root, output);
-  if (!path || path.startsWith("..") || isAbsolute(path)) {
-    throw new Error("--output must be a non-root directory inside the workspace");
-  }
-  return output;
-}
-
-export async function main(argv: string[] = process.argv.slice(2)): Promise<void> {
-  const version = argv[0] && !argv[0].startsWith("--") ? argv[0] : undefined;
-  const rest = version ? argv.slice(1) : argv;
-  const root = process.cwd();
-  if (!version) {
-    logger.error(
-      "usage: bun tasks/publish.ts <version> [--registry <url>] [--output <dir>] [--exclude <dir>] [--dry-run] [--skip-compile]",
-    );
-    process.exit(1);
-  }
-  const registryIdx = rest.indexOf("--registry");
-  const registry = registryIdx >= 0 ? rest[registryIdx + 1] : undefined;
-  const outputIdx = rest.indexOf("--output");
-  const output = outputDirectory(root, outputIdx >= 0 ? rest[outputIdx + 1] : undefined);
-  const dryRun = rest.includes("--dry-run");
-  const skipCompile = rest.includes("--skip-compile");
-  const concurrencyIdx = rest.indexOf("--concurrency");
-  const parsedConcurrency = Number(concurrencyIdx >= 0 ? rest[concurrencyIdx + 1] : 4);
-  if (!Number.isInteger(parsedConcurrency) || parsedConcurrency < 1) {
-    throw new Error(`--concurrency must be a positive integer, got ${String(parsedConcurrency)}`);
-  }
-  const concurrency = parsedConcurrency;
-  const excluded = new Set(
-    rest.reduce<string[]>((acc, arg, i) => (arg === "--exclude" ? [...acc, rest[i + 1]] : acc), []),
-  );
-
-  const path = enrichedPath(root);
-  const allMembers = recordedPackages(root)
-    .map((pkg) => pkg.dir)
-    .filter((dir) => existsSync(join(dir, "package.json")))
-    .filter((dir) => !excluded.has(resolve(root, dir).replace(`${resolve(root)}/`, "")));
-  const members = allMembers;
-
-  if (!manifestsMatchVersion(members, version)) {
-    throw new Error(`workspace manifests do not match release ${version}; run projen`);
-  }
-  logger.info(`validated ${members.length} selected member manifests`);
-
-  const publishArgs = [
-    "--ignore-scripts",
-    ...(registry ? ["--registry", registry] : []),
-    ...(dryRun ? ["--dry-run"] : []),
-  ];
-  const publishable: Array<{
-    dir: string;
-    name: string;
-    version: string;
-    compile: boolean;
-    compiledTargets: string[];
-    access?: "public" | "restricted";
-  }> = [];
-  for (const dir of members) {
-    const pkg = JSON.parse(readFileSync(join(dir, "package.json"), "utf8")) as {
-      name?: string;
-      version?: string;
-      private?: boolean;
-      publishConfig?: { access?: unknown };
-    };
-    if (pkg.private) {
-      logger.info(`skip private ${pkg.name ?? dirname(dir)}`);
-      continue;
-    }
-    if (!pkg.version) throw new Error(`Missing package version for ${pkg.name ?? dirname(dir)}`);
-    const access = pkg.publishConfig?.access;
-    if (access !== undefined && access !== "public" && access !== "restricted") {
-      throw new Error(
-        `${pkg.name ?? dirname(dir)} has invalid publishConfig.access ${String(access)}`,
-      );
-    }
-    const compiledTargets = [...new Set(compiledPublishTargets(pkg.publishConfig))];
-    publishable.push({
-      dir,
-      name: pkg.name ?? dirname(dir),
-      version: pkg.version,
-      compile: compiledTargets.length > 0,
-      compiledTargets,
-      ...(access ? { access } : {}),
-    });
-  }
-
-  const compiled = publishable.filter((pkg) => pkg.compile);
-  if (compiled.length > 0) {
-    if (skipCompile) {
-      const missing = compiled.flatMap((pkg) =>
-        pkg.compiledTargets
-          .filter((target) => !existsSync(resolve(pkg.dir, target)))
-          .map((target) => `${pkg.name}:${target}`),
-      );
-      if (missing.length > 0) {
-        throw new Error(
-          `--skip-compile requires validated compiled output; missing ${missing.join(", ")}`,
-        );
-      }
-      logger.info(`reusing validated compiled output for ${compiled.length} publishable packages`);
-    } else {
-      logger.info(`compiling ${compiled.length} publishable packages from the workspace root`);
-      runTaskCommand(
-        root,
-        "bun",
-        ["run", ...compiled.flatMap((pkg) => ["--filter", pkg.name]), "compile"],
-        { env: { ...process.env, PATH: path } },
-      );
-    }
-  }
-
-  logger.info(
-    `${output ? "packing" : dryRun ? "dry-run packing" : "publishing"} ${publishable.length} packages with concurrency ${concurrency}`,
-  );
-  if (output) {
-    rmSync(output, { recursive: true, force: true });
-    mkdirSync(output, { recursive: true });
-  }
-  await asyncUtils.mapConcurrent(
-    publishable,
-    async ({ dir, name, version: packageVersion, access }) => {
-      const packed = mkdtempSync(join(tmpdir(), "projen-npm-release-"));
-      try {
-        const archive = packNpmPackage(dir, packed, path, applyPublishConfig);
-        const local = readNpmArchiveIdentity(archive);
-        if (local.name !== name || local.version !== packageVersion) {
-          throw new Error(
-            `Packed npm identity ${local.name}@${local.version} does not match ${name}@${packageVersion}`,
-          );
-        }
-        if (local.access !== access) {
-          throw new Error(
-            `Packed npm access ${String(local.access)} does not match ${String(access)} for ${name}`,
-          );
-        }
-        if (output) {
-          const destination = join(output, archive.split(/[\\/]/).at(-1)!);
-          if (existsSync(destination)) {
-            throw new Error(`Duplicate npm archive name: ${destination}`);
-          }
-          copyFileSync(archive, destination);
-          logger.info(`packed ${name} @ ${packageVersion}`);
-          return;
-        }
-        if (!dryRun) {
-          const published = await publishedNpmRelease(local.name, local.version, registry);
-          if (npmReleaseMatches(local, published)) {
-            logger.info(`skip published ${name} @ ${packageVersion}`);
-            return;
-          }
-        }
-        logger.info(`${dryRun ? "dry-run publishing" : "publishing"} ${name} @ ${packageVersion}`);
-        await runTaskCommandAsync(
-          dir,
-          "npm",
-          ["publish", ...(access ? ["--access", access] : []), ...publishArgs, archive],
-          { env: { ...process.env, PATH: path } },
-        );
-      } finally {
-        rmSync(packed, { recursive: true, force: true });
-      }
-    },
-    { concurrency, errorMode: "settle" },
-  );
-  logger.success(
-    `${output || dryRun ? "packed" : "published"} ${publishable.length} packages${output ? ` to ${output}` : ""}`,
-  );
-}