@dbx-tools/projen 0.9.6 → 0.9.8

package/README.md

@@ -254,7 +254,11 @@ and select `rust-lld` for the workspace build. Rust release rows restore and
 update dependency-only Cargo caches in the release branch's cache scope. The
 cache key excludes workspace version changes, and manual tag recovery restores
 without saving a tag-scoped copy. There is no separate cache workflow or
-sccache layer. Phase timings are written to each build log. Python generation executes the already-built
+sccache layer. After publishing the current raw Rust bundles and build manifests,
+the GitHub release job deletes those internal assets from published
+`vMAJOR.MINOR.PATCH` releases strictly lower than the current version while
+leaving versioned consumer binaries in place. Phase timings are written to each
+build log. Python generation executes the already-built
 `target/<triple>/release/<crate>-uniffi-bindgen` directly. Artifact packaging therefore
 does no Rust compilation after the main workspace build.
 

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.6";
+export const PACKAGE_VERSION = "0.9.8";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";
@@ -36,6 +36,7 @@ export * as tsconfig from "./src/tsconfig.ts";
 export * as uniffi from "./src/uniffi.ts";
 export * as vscode from "./src/vscode.ts";
 export * as watch from "./src/watch.ts";
+export * as workspaceLock from "./src/workspace-lock.ts";
 export * as workspaceVersion from "./src/workspace-version.ts";
 export { BUN_DEV_OVERRIDE, BUN_BUILD_OVERRIDE, BUN_APP_OVERRIDES, RootBunfigFile, BunfigFile, BunDevServerFile, BunBuildFile } from "./src/bun-app.ts";
 export { BUN_VERSION } from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.6",
-    "@dbx-tools/path": "^0.9.6",
-    "@dbx-tools/shared-core": "^0.9.6",
+    "@dbx-tools/core": "^0.9.8",
+    "@dbx-tools/path": "^0.9.8",
+    "@dbx-tools/shared-core": "^0.9.8",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -53,7 +53,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.6",
+  "version": "0.9.8",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/_rust-project.ts

@@ -26,6 +26,19 @@ export interface RustCliOptions {
   readonly command?: string;
   /** Root CLI help text. Defaults to the Rust package description. */
   readonly description?: string;
+  /** Keep the binary installable by registry lookup without exposing a root command. */
+  readonly hidden?: boolean;
+}
+
+/** One explicit Cargo binary target and its optional release registration. */
+export interface RustBinaryOptions {
+  readonly name: string;
+  readonly path: string;
+  readonly requiredFeatures?: readonly string[];
+  readonly release?: boolean;
+  readonly releaseExcludeOs?: readonly RustReleaseOs[];
+  readonly description?: string;
+  readonly cli?: boolean | RustCliOptions;
 }
 
 /** Explicit Cargo example target and the feature gate required to compile it. */
@@ -47,6 +60,8 @@ export interface RustCrateOptions {
   /** Omit this crate and any release binary artifact from these operating systems. */
   readonly releaseExcludeOs?: readonly RustReleaseOs[];
   readonly dependencies?: Readonly<Record<string, CargoDependency>>;
+  /** Cargo dependencies scoped by a target cfg expression. */
+  readonly targetDependencies?: Readonly<Record<string, Readonly<Record<string, CargoDependency>>>>;
   readonly devDependencies?: Readonly<Record<string, CargoDependency>>;
   readonly features?: Readonly<Record<string, readonly string[]>>;
   readonly defaultFeatures?: readonly string[];
@@ -54,6 +69,10 @@ export interface RustCrateOptions {
   readonly examples?: readonly CargoExampleOptions[];
   /** Cargo and release executable name. Defaults to the generated package name. */
   readonly binaryName?: string;
+  /** Additional Cargo binary targets owned by this crate. */
+  readonly binaries?: readonly RustBinaryOptions[];
+  /** Cargo binary selected by `cargo run` when this crate has multiple binaries. */
+  readonly defaultRun?: string;
   /** Publish this release binary through the generated `dbx` command registry. */
   readonly cli?: boolean | RustCliOptions;
   readonly bindings?: readonly ("node" | "python")[];
@@ -187,10 +206,12 @@ function packageOptions(
     ...(options.release !== undefined ? { release: options.release } : {}),
     ...(options.releaseExcludeOs ? { releaseExcludeOs: options.releaseExcludeOs } : {}),
     ...(options.dependencies ? { dependencies: options.dependencies } : {}),
+    ...(options.targetDependencies ? { targetDependencies: options.targetDependencies } : {}),
     ...(options.devDependencies ? { devDependencies: options.devDependencies } : {}),
     ...(options.features ? { features: options.features } : {}),
     ...(options.defaultFeatures ? { defaultFeatures: options.defaultFeatures } : {}),
     ...(options.binaryName ? { binaryName: options.binaryName } : {}),
+    ...(options.binaries ? { binaries: options.binaries } : {}),
     ...(options.cli !== undefined ? { cli: options.cli } : {}),
     ...(options.bindings ? { bindings: options.bindings } : {}),
     ...(options.uniffiConfig ? { uniffiConfig: options.uniffiConfig } : {}),
@@ -244,6 +265,7 @@ export class RustProject extends Project implements DBXToolsProject {
       ...(!workspace ? { workspace: {} } : {}),
       package: {
         name: this.crateName,
+        ...(options.defaultRun ? { "default-run": options.defaultRun } : {}),
         version: inheritedCargoValue(workspace, options.version, "0.1.0"),
         edition: inheritedCargoValue(workspace, options.edition, "2021"),
         "rust-version": inheritedCargoValue(workspace, options.rustVersion, "1.82"),
@@ -272,6 +294,13 @@ export class RustProject extends Project implements DBXToolsProject {
                 ? [{ name: `${this.crateName}-uniffi-bindgen`, path: "uniffi-bindgen.rs" }]
                 : []),
               ...(binary ? [{ name: binaryName, path: "src/main.rs" }] : []),
+              ...(options.binaries ?? []).map((target) => ({
+                name: target.name,
+                path: target.path,
+                ...(target.requiredFeatures?.length
+                  ? { "required-features": [...target.requiredFeatures] }
+                  : {}),
+              })),
             ],
           }
         : {}),
@@ -304,6 +333,23 @@ export class RustProject extends Project implements DBXToolsProject {
             ),
           }
         : {}),
+      ...(options.targetDependencies
+        ? {
+            target: Object.fromEntries(
+              Object.entries(options.targetDependencies).map(([target, dependencies]) => [
+                target,
+                {
+                  dependencies: Object.fromEntries(
+                    Object.entries(dependencies).map(([name, value]) => [
+                      name,
+                      cargoDependency(value, dependencyVersion),
+                    ]),
+                  ),
+                },
+              ]),
+            ),
+          }
+        : {}),
       ...(options.devDependencies
         ? {
             "dev-dependencies": Object.fromEntries(

package/src/_rust-release-workflow.ts

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { stringUtils } from "@dbx-tools/shared-core";
 import { TextFile, javascript } from "projen";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import type { RustProject } from "./_rust-project.ts";
@@ -127,6 +128,7 @@ interface RustReleaseBinaryPlan {
   readonly crate: string;
   readonly binary: string;
   readonly excludedOs: readonly RustReleaseOs[];
+  readonly requiredFeatures: readonly string[];
 }
 
 type RustReleaseTargetPlan = Readonly<Record<string, string | boolean | number>>;
@@ -164,13 +166,26 @@ export function planRustRelease(
     nodePackage: binding.nodePackage ?? "",
     pythonPackage: binding.pythonPackage ?? "",
   }));
-  const releaseBinaries = packages
-    .filter((pkg) => pkg.packageOptions.release)
-    .map((pkg) => ({
-      crate: pkg.crateName,
-      binary: pkg.packageOptions.binaryName ?? pkg.crateName,
-      excludedOs: pkg.packageOptions.releaseExcludeOs ?? [],
-    }));
+  const releaseBinaries = packages.flatMap((pkg) => [
+    ...(pkg.packageOptions.release
+      ? [
+          {
+            crate: pkg.crateName,
+            binary: pkg.packageOptions.binaryName ?? pkg.crateName,
+            excludedOs: pkg.packageOptions.releaseExcludeOs ?? [],
+            requiredFeatures: [],
+          },
+        ]
+      : []),
+    ...(pkg.packageOptions.binaries ?? [])
+      .filter((binary) => binary.release)
+      .map((binary) => ({
+        crate: pkg.crateName,
+        binary: binary.name,
+        excludedOs: binary.releaseExcludeOs ?? [],
+        requiredFeatures: binary.requiredFeatures ?? [],
+      })),
+  ]);
   const publicCrates = orderRustBindings(
     packages
       .filter((pkg) => !pkg.packageOptions.private)
@@ -337,7 +352,31 @@ function rustBinaryCommands(plan: RustReleasePlan, independent: boolean): string
   });
 }
 
+function rustAdditionalBinaryBuildCommands(plan: RustReleasePlan, independent: boolean): string[] {
+  return plan.releaseBinaries
+    .filter((binary) => binary.requiredFeatures.length)
+    .flatMap((binary) => {
+      const command = `cargo build --release --package "${binary.crate}" --bin "${binary.binary}" --features "${binary.requiredFeatures.join(",")}"${
+        plan.usesCargoLock ? " --locked" : ""
+      } --target "\${{ matrix.cargo }}"`;
+      const excludedCondition = binary.excludedOs
+        .map((os) => `[ "\${{ matrix.os }}" != "${os}" ]`)
+        .join(" && ");
+      const platformCommands = excludedCondition
+        ? [`if ${excludedCondition}; then`, `  ${command}`, "fi"]
+        : [command];
+      if (!independent) return platformCommands;
+      const unit = defaultReleaseUnitId("rust", binary.crate);
+      return [
+        `if jq -e --arg unit "${unit}" '.units[] | select(.id == $unit)' dist/release-plan.json >/dev/null; then`,
+        ...platformCommands.map((line) => `  ${line}`),
+        "fi",
+      ];
+    });
+}
+
 function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
+  const binaryCrates = [...new Set(plan.releaseBinaries.map((binary) => binary.crate))];
   return [
     ...plan.bindings.flatMap((binding) => [
       ...(binding.node
@@ -367,24 +406,35 @@ function rustArtifactSteps(plan: RustReleasePlan): JobStep[] {
           ]
         : []),
     ]),
-    ...plan.releaseBinaries.map((pkg) => ({
-      name: `Upload ${pkg.crate} release binary`,
-      uses: "actions/upload-artifact@v7",
-      ...(rustReleaseBinaryCondition(pkg.excludedOs)
-        ? { if: rustReleaseBinaryCondition(pkg.excludedOs) }
-        : {}),
-      with: {
-        name: `${pkg.crate}-\${{ matrix.node }}-binary`,
-        path: `dist/release/${pkg.crate}/\${{ matrix.node }}/binary/*`,
-        "retention-days": 7,
-      },
-    })),
+    ...binaryCrates.map((crate) => {
+      const binaries = plan.releaseBinaries.filter((binary) => binary.crate === crate);
+      const excludedOs =
+        binaries[0]?.excludedOs.filter((os) =>
+          binaries.every((binary) => binary.excludedOs.includes(os)),
+        ) ?? [];
+      return {
+        name: `Upload ${crate} release binary`,
+        uses: "actions/upload-artifact@v7",
+        ...(rustReleaseBinaryCondition(excludedOs)
+          ? { if: rustReleaseBinaryCondition(excludedOs) }
+          : {}),
+        with: {
+          name: `${crate}-\${{ matrix.node }}-binary`,
+          path: `dist/release/${crate}/\${{ matrix.node }}/binary/*`,
+          "retention-days": 7,
+        },
+      };
+    }),
   ];
 }
 
 export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly JobStep[]): Job {
   const bindingCommands = rustBindingCommands(plan, Boolean(independentSetup));
   const binaryCommands = rustBinaryCommands(plan, Boolean(independentSetup));
+  const additionalBinaryBuildCommands = rustAdditionalBinaryBuildCommands(
+    plan,
+    Boolean(independentSetup),
+  );
   return {
     if: independentSetup
       ? "${{ needs.release-plan.outputs.rust_targets != '[]' && (github.event_name == 'push' || inputs.stage != 'docs') }}"
@@ -482,29 +532,34 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
               id: "raw-native",
               shell: "bash",
               env: { GH_TOKEN: "${{ github.token }}" },
-              run: [
-                'KEY="${{ steps.rust-fingerprint.outputs.key }}"',
-                'test -n "$KEY"',
-                'ASSET="rust-raw-${{ matrix.node }}-$KEY.tar.gz"',
-                "mkdir -p dist/rust-raw",
-                'MATCH="$(gh api --paginate "repos/${{ github.repository }}/releases?per_page=100" --jq \'.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "\'"$ASSET"\'") | [$release.tag_name, .url] | @tsv\' | head -n 1)"',
-                'if [ -n "$MATCH" ]; then',
-                "  TAG=\"${MATCH%%$'\\t'*}\"",
-                "  URL=\"${MATCH#*$'\\t'}\"",
-                '  CHECKSUM_URL="$(gh api "repos/${{ github.repository }}/releases/tags/$TAG" --jq \'.assets[] | select(.name == "\'"$ASSET.sha256"\'") | .url\')"',
-                '  rm -rf "target/${{ matrix.cargo }}/release"',
-                '  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then',
-                '    echo "hit=true" >> "$GITHUB_OUTPUT"',
-                "  else",
-                '    rm -rf "target/${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"',
-                '    echo "::warning::matching raw Rust bundle failed validation; rebuilding"',
-                '    echo "hit=false" >> "$GITHUB_OUTPUT"',
-                "  fi",
-                "else",
-                '  echo "hit=false" >> "$GITHUB_OUTPUT"',
-                "fi",
-                'echo "asset=$ASSET" >> "$GITHUB_OUTPUT"',
-              ].join("\n"),
+              // prettier-ignore
+              run: stringUtils.dedent(
+                // ============================================================================
+                /*bash*/`
+                KEY="\${{ steps.rust-fingerprint.outputs.key }}"
+                test -n "$KEY"
+                ASSET="rust-raw-\${{ matrix.node }}-$KEY.tar.gz"
+                mkdir -p dist/rust-raw
+                MATCH="$(gh api --paginate "repos/\${{ github.repository }}/releases?per_page=100" --jq '.[] | select(.draft == false) | . as $release | .assets[] | select(.name == "'"$ASSET"'") | [$release.tag_name, .url] | @tsv' | head -n 1)"
+                if [ -n "$MATCH" ]; then
+                  TAG="\${MATCH%%$'\\t'*}"
+                  URL="\${MATCH#*$'\\t'}"
+                  CHECKSUM_URL="$(gh api "repos/\${{ github.repository }}/releases/tags/$TAG" --jq '.assets[] | select(.name == "'"$ASSET.sha256"'") | .url')"
+                  rm -rf "target/\${{ matrix.cargo }}/release"
+                  if test -n "$CHECKSUM_URL" && gh api "$URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET" && gh api "$CHECKSUM_URL" -H "Accept: application/octet-stream" > "dist/rust-raw/$ASSET.sha256" && (cd dist/rust-raw && if command -v sha256sum >/dev/null 2>&1; then sha256sum --check "$ASSET.sha256"; else shasum -a 256 --check "$ASSET.sha256"; fi) && tar -xzf "dist/rust-raw/$ASSET"; then
+                    echo "hit=true" >> "$GITHUB_OUTPUT"
+                  else
+                    rm -rf "target/\${{ matrix.cargo }}/release" "dist/rust-raw/$ASSET" "dist/rust-raw/$ASSET.sha256"
+                    echo "::warning::matching raw Rust bundle failed validation; rebuilding"
+                    echo "hit=false" >> "$GITHUB_OUTPUT"
+                  fi
+                else
+                  echo "hit=false" >> "$GITHUB_OUTPUT"
+                fi
+                echo "asset=$ASSET" >> "$GITHUB_OUTPUT"
+              `
+                // ============================================================================
+              ),
             },
           ]
         : []),
@@ -518,16 +573,19 @@ export function rustBuildJob(plan: RustReleasePlan, independentSetup?: readonly
         },
         run: timedBash(
           "rust_workspace",
-          independentSetup
-            ? [
-                "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
-                "PACKAGE_ARGS=()",
-                'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
-                `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
-              ].join("\n")
-            : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
-                plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
-              }`,
+          [
+            independentSetup
+              ? [
+                  "mapfile -t PACKAGES < <(jq -r '.[]' <<<'${{ toJSON(matrix.packages) }}')",
+                  "PACKAGE_ARGS=()",
+                  'for PACKAGE in "${PACKAGES[@]}"; do PACKAGE_ARGS+=(--package "$PACKAGE"); done',
+                  `cargo build --release --timings "\${PACKAGE_ARGS[@]}"${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"`,
+                ].join("\n")
+              : `cargo build --release --timings --workspace${plan.usesCargoLock ? " --locked" : ""} --target "\${{ matrix.cargo }}"${
+                  plan.hasReleaseExclusions ? " ${{ matrix.cargoExcludes }}" : ""
+                }`,
+            ...additionalBinaryBuildCommands,
+          ].join("\n"),
         ),
       },
       ...(!independentSetup
@@ -757,6 +815,53 @@ export function rustGitHubReleaseJob(): Job {
           target_commitish: RELEASE_SHA,
         },
       },
+      {
+        name: "Delete superseded raw Rust release assets",
+        uses: "actions/github-script@v8",
+        env: { CURRENT_RELEASE_TAG: RELEASE_TAG },
+        with: {
+          // prettier-ignore
+          script: stringUtils.dedent(
+            // ============================================================================
+            /*js*/`
+            const currentTag = process.env.CURRENT_RELEASE_TAG;
+            if (!currentTag) throw new Error("CURRENT_RELEASE_TAG is required");
+            const parseVersion = (tag) => {
+              const match = /^v(\\d+)\\.(\\d+)\\.(\\d+)$/.exec(tag);
+              return match ? match.slice(1).map(Number) : undefined;
+            };
+            const compareVersions = (left, right) => {
+              for (let index = 0; index < 3; index += 1) {
+                if (left[index] !== right[index]) return left[index] - right[index];
+              }
+              return 0;
+            };
+            const currentVersion = parseVersion(currentTag);
+            if (!currentVersion) throw new Error(\`Unsupported release tag: \${currentTag}\`);
+            const releases = await github.paginate(github.rest.repos.listReleases, {
+              ...context.repo,
+              per_page: 100,
+            });
+            const assets = releases.flatMap((release) => {
+              const version = parseVersion(release.tag_name);
+              if (release.draft || !version || compareVersions(version, currentVersion) >= 0) {
+                return [];
+              }
+              return release.assets.filter((asset) => /^rust-(?:raw|build)-/.test(asset.name));
+            });
+            for (const asset of assets) {
+              core.info(\`Deleting \${asset.name} (\${asset.id})\`);
+              await github.rest.repos.deleteReleaseAsset({
+                ...context.repo,
+                asset_id: asset.id,
+              });
+            }
+            core.info(\`Deleted \${assets.length} superseded raw Rust release assets\`);
+          `
+            // ============================================================================
+          ),
+        },
+      },
     ],
   };
 }

package/src/barrels.ts

@@ -523,10 +523,9 @@ const WRITE_ATTEMPTS = 3;
  * and the projenrc watcher's post-synth `generateBarrels()` sweep), so any gap
  * between `makeWritable` and the write is a window in which another process's
  * `makeReadonly` lands and this write fails with
- * `EACCES: permission denied, open '<pkg>/index.ts'`. The gap used to span all of
- * the oxc parsing done for export hoisting, which made it wide enough to hit
- * routinely. Keeping the unlock adjacent to the write shrinks it to nothing much,
- * and a retry absorbs what is left.
+ * `EACCES: permission denied, open '<pkg>/index.ts'`. Keeping the unlock adjacent
+ * to the write avoids a gap during export parsing, and a retry absorbs what is
+ * left.
  *
  * Do NOT "simplify" this back to a single unlock-then-write: the failure is
  * timing-dependent, so it looks fine until a full-repo sweep runs against a