@dbx-tools/projen 0.9.68 → 0.9.70

package/README.md

@@ -490,8 +490,9 @@ bun run release --release-notes-instructions "Focus on operator-visible changes.
 
 `--demo-deploy` is off by default. After tagging and any local registry
 publication it runs `bun run demo:deploy`, which stages the AppKit demo
-and deploys it to the FEVM workspace. That step is local only and is not
-recorded in the annotated tag.
+from locally compiled Node packages and locally built Python wheels, resolves
+the configured/default workspace profile through `@dbx-tools/auth`, and deploys
+it. That step is local only and is not recorded in the annotated tag.
 
 After bump and configured validation, release writes
 `docs/releases/vX.Y.Z.md` with `dbx genie exec -C "$PWD" --sandbox read-only

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.68";
+export const PACKAGE_VERSION = "0.9.70";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.68",
-    "@dbx-tools/path": "^0.9.68",
-    "@dbx-tools/shared-core": "^0.9.68",
+    "@dbx-tools/core": "^0.9.70",
+    "@dbx-tools/path": "^0.9.70",
+    "@dbx-tools/shared-core": "^0.9.70",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -54,11 +54,12 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.68",
+  "version": "0.9.70",
   "types": "index.ts",
   "type": "module",
   "exports": {
     ".": "./index.ts",
+    "./python-release-packaging": "./tasks/publish-python.ts",
     "./release-packaging": "./tasks/publish-npm.ts",
     "./package.json": "./package.json"
   },

package/tasks/release.ts

@@ -41,6 +41,116 @@ function assertAncestor(root: string, ancestor: string, descendant: string, mess
   }
 }
 
+/** Replace the local annotated tag object with the tag object created on the remote. */
+export function refreshReleaseTagFromRemote(options: {
+  readonly expectedObject: string;
+  readonly remote: string;
+  readonly root: string;
+  readonly tag: string;
+}): void {
+  const { expectedObject, remote, root, tag } = options;
+  const ref = `refs/tags/${tag}`;
+  runTaskCommand(root, "git", ["fetch", "--force", remote, `${ref}:${ref}`]);
+  const localObject = captureTaskCommand(root, "git", ["rev-parse", ref], { check: true });
+  if (localObject !== expectedObject) {
+    throw new Error(
+      `remote ${tag} resolved to ${localObject || "<empty>"}, expected ${expectedObject}`,
+    );
+  }
+}
+
+function pushAnnotatedReleaseTag(options: {
+  readonly annotation: string;
+  readonly branch: string;
+  readonly head: string;
+  readonly remote: string;
+  readonly root: string;
+  readonly tag: string;
+}): void {
+  const { annotation, branch, head, remote, root, tag } = options;
+  runTaskCommand(root, "git", ["tag", "--annotate", tag, "--message", annotation]);
+  const githubAccount = projectUtils.resolveProjectGhAccount(root, { remote });
+  if (!githubAccount) {
+    logger.warn("no authenticated GitHub account can access the release repository; using git push");
+    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
+    return;
+  }
+
+  const remoteBranch = captureTaskCommand(
+    root,
+    "git",
+    ["ls-remote", remote, `refs/heads/${branch}`],
+    { check: true },
+  )
+    .split(/\s+/)[0]
+    ?.trim();
+  if (remoteBranch !== head) {
+    throw new Error(
+      `cannot tag ${githubAccount.remote.repository}: ${remote}/${branch} does not equal local HEAD`,
+    );
+  }
+  let remoteRefCreated = false;
+  try {
+    const tagObject = captureTaskCommand(
+      root,
+      "gh",
+      [
+        "api",
+        "--hostname",
+        githubAccount.host,
+        "--method",
+        "POST",
+        `repos/${githubAccount.remote.repository}/git/tags`,
+        "-f",
+        `tag=${tag}`,
+        "-f",
+        `message=${annotation}`,
+        "-f",
+        `object=${head}`,
+        "-f",
+        "type=commit",
+        "--jq",
+        ".sha",
+      ],
+      { check: true, env: githubAccount.env, stderr: "inherit" },
+    );
+    if (!tagObject) throw new Error(`GitHub did not return an annotated tag object for ${tag}`);
+    runTaskCommand(
+      root,
+      "gh",
+      [
+        "api",
+        "--hostname",
+        githubAccount.host,
+        "--method",
+        "POST",
+        `repos/${githubAccount.remote.repository}/git/refs`,
+        "-f",
+        `ref=refs/tags/${tag}`,
+        "-f",
+        `sha=${tagObject}`,
+        "--silent",
+      ],
+      { env: githubAccount.env },
+    );
+    remoteRefCreated = true;
+    refreshReleaseTagFromRemote({ expectedObject: tagObject, remote, root, tag });
+    logger.info(`created ${tag} through the GitHub API`, {
+      account: githubAccount.login,
+      host: githubAccount.host,
+      repository: githubAccount.remote.repository,
+      sha: head,
+    });
+  } catch (error) {
+    if (remoteRefCreated) throw error;
+    logger.warn("GitHub API tag creation failed; using git push", {
+      error,
+      repository: githubAccount.remote.repository,
+    });
+    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
+  }
+}
+
 function prepareReleaseBranch(options: {
   readonly branch: string;
   readonly remote: string;
@@ -191,17 +301,19 @@ export async function runRelease(
   }
 
   runTaskCommand(root, "git", ["push", remote, `HEAD:${branch}`]);
-  runTaskCommand(root, "git", [
-    "tag",
-    "--annotate",
-    tag,
-    "--message",
-    releaseTagAnnotation(tag, selection),
-  ]);
   try {
-    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
+    pushAnnotatedReleaseTag({
+      annotation: releaseTagAnnotation(tag, selection),
+      branch,
+      head,
+      remote,
+      root,
+      tag,
+    });
   } catch (error) {
-    runTaskCommand(root, "git", ["tag", "--delete", tag]);
+    if (taskCommandSucceeds(root, "git", ["rev-parse", "--verify", `refs/tags/${tag}`])) {
+      runTaskCommand(root, "git", ["tag", "--delete", tag]);
+    }
     throw error;
   }
   logger.success(`released ${tag}`, { sha: head });