@dbx-tools/projen 0.9.68 → 0.9.69

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.68";
+export const PACKAGE_VERSION = "0.9.69";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.68",
-    "@dbx-tools/path": "^0.9.68",
-    "@dbx-tools/shared-core": "^0.9.68",
+    "@dbx-tools/core": "^0.9.69",
+    "@dbx-tools/path": "^0.9.69",
+    "@dbx-tools/shared-core": "^0.9.69",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -54,7 +54,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.68",
+  "version": "0.9.69",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/tasks/release.ts

@@ -41,6 +41,106 @@ function assertAncestor(root: string, ancestor: string, descendant: string, mess
   }
 }
 
+/** Parse a GitHub repository slug from an HTTPS or SSH remote URL. */
+export function githubRepositoryFromRemoteUrl(remoteUrl: string): string | undefined {
+  const value = remoteUrl.trim().replace(/\.git$/, "");
+  const https = /^https?:\/\/github\.com\/([^/]+)\/([^/]+)$/i.exec(value);
+  if (https) return `${https[1]}/${https[2]}`;
+  const ssh = /^(?:ssh:\/\/)?git@([^/:]+)[:/]([^/]+)\/([^/]+)$/i.exec(value);
+  if (!ssh || !/^github(?:[.-].+)?$/i.test(ssh[1]!)) return undefined;
+  return `${ssh[2]}/${ssh[3]}`;
+}
+
+/** Infer the `gh auth` account encoded by a `git@github-<account>:` SSH alias. */
+export function githubAccountFromRemoteUrl(remoteUrl: string): string | undefined {
+  return /^git@github-([^:]+):/i.exec(remoteUrl.trim())?.[1];
+}
+
+function githubApiEnvironment(root: string, remoteUrl: string): NodeJS.ProcessEnv | undefined {
+  const account = githubAccountFromRemoteUrl(remoteUrl);
+  if (!account) return undefined;
+  const token = captureTaskCommand(
+    root,
+    "gh",
+    ["auth", "token", "--hostname", "github.com", "--user", account],
+    { check: true, stderr: "inherit" },
+  );
+  return token ? { ...process.env, GH_TOKEN: token } : undefined;
+}
+
+function pushAnnotatedReleaseTag(options: {
+  readonly annotation: string;
+  readonly branch: string;
+  readonly head: string;
+  readonly remote: string;
+  readonly root: string;
+  readonly tag: string;
+}): void {
+  const { annotation, branch, head, remote, root, tag } = options;
+  runTaskCommand(root, "git", ["tag", "--annotate", tag, "--message", annotation]);
+  const remoteUrl = captureTaskCommand(root, "git", ["remote", "get-url", remote], {
+    check: true,
+  });
+  const repository = githubRepositoryFromRemoteUrl(remoteUrl);
+  if (!repository || !taskCommandSucceeds(root, "gh", ["--version"])) {
+    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
+    return;
+  }
+  const githubEnv = githubApiEnvironment(root, remoteUrl);
+
+  const remoteBranch = captureTaskCommand(
+    root,
+    "git",
+    ["ls-remote", remote, `refs/heads/${branch}`],
+    { check: true },
+  )
+    .split(/\s+/)[0]
+    ?.trim();
+  if (remoteBranch !== head) {
+    throw new Error(`cannot tag ${repository}: ${remote}/${branch} does not equal local HEAD`);
+  }
+
+  const tagObject = captureTaskCommand(
+    root,
+    "gh",
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${repository}/git/tags`,
+      "-f",
+      `tag=${tag}`,
+      "-f",
+      `message=${annotation}`,
+      "-f",
+      `object=${head}`,
+      "-f",
+      "type=commit",
+      "--jq",
+      ".sha",
+    ],
+    { check: true, env: githubEnv, stderr: "inherit" },
+  );
+  if (!tagObject) throw new Error(`GitHub did not return an annotated tag object for ${tag}`);
+  runTaskCommand(
+    root,
+    "gh",
+    [
+      "api",
+      "--method",
+      "POST",
+      `repos/${repository}/git/refs`,
+      "-f",
+      `ref=refs/tags/${tag}`,
+      "-f",
+      `sha=${tagObject}`,
+      "--silent",
+    ],
+    { env: githubEnv },
+  );
+  logger.info(`created ${tag} through the GitHub API`, { repository, sha: head });
+}
+
 function prepareReleaseBranch(options: {
   readonly branch: string;
   readonly remote: string;
@@ -191,17 +291,19 @@ export async function runRelease(
   }
 
   runTaskCommand(root, "git", ["push", remote, `HEAD:${branch}`]);
-  runTaskCommand(root, "git", [
-    "tag",
-    "--annotate",
-    tag,
-    "--message",
-    releaseTagAnnotation(tag, selection),
-  ]);
   try {
-    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
+    pushAnnotatedReleaseTag({
+      annotation: releaseTagAnnotation(tag, selection),
+      branch,
+      head,
+      remote,
+      root,
+      tag,
+    });
   } catch (error) {
-    runTaskCommand(root, "git", ["tag", "--delete", tag]);
+    if (taskCommandSucceeds(root, "git", ["rev-parse", "--verify", `refs/tags/${tag}`])) {
+      runTaskCommand(root, "git", ["tag", "--delete", tag]);
+    }
     throw error;
   }
   logger.success(`released ${tag}`, { sha: head });