@dbx-tools/projen 0.9.69 → 0.9.70

package/README.md

@@ -490,8 +490,9 @@ bun run release --release-notes-instructions "Focus on operator-visible changes.
 
 `--demo-deploy` is off by default. After tagging and any local registry
 publication it runs `bun run demo:deploy`, which stages the AppKit demo
-and deploys it to the FEVM workspace. That step is local only and is not
-recorded in the annotated tag.
+from locally compiled Node packages and locally built Python wheels, resolves
+the configured/default workspace profile through `@dbx-tools/auth`, and deploys
+it. That step is local only and is not recorded in the annotated tag.
 
 After bump and configured validation, release writes
 `docs/releases/vX.Y.Z.md` with `dbx genie exec -C "$PWD" --sandbox read-only

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.69";
+export const PACKAGE_VERSION = "0.9.70";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
 export * as bunWorkflow from "./src/bun-workflow.ts";

package/package.json

@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/core": "^0.9.69",
-    "@dbx-tools/path": "^0.9.69",
-    "@dbx-tools/shared-core": "^0.9.69",
+    "@dbx-tools/core": "^0.9.70",
+    "@dbx-tools/path": "^0.9.70",
+    "@dbx-tools/shared-core": "^0.9.70",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -54,11 +54,12 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.69",
+  "version": "0.9.70",
   "types": "index.ts",
   "type": "module",
   "exports": {
     ".": "./index.ts",
+    "./python-release-packaging": "./tasks/publish-python.ts",
     "./release-packaging": "./tasks/publish-npm.ts",
     "./package.json": "./package.json"
   },

package/tasks/release.ts

@@ -41,31 +41,22 @@ function assertAncestor(root: string, ancestor: string, descendant: string, mess
   }
 }
 
-/** Parse a GitHub repository slug from an HTTPS or SSH remote URL. */
-export function githubRepositoryFromRemoteUrl(remoteUrl: string): string | undefined {
-  const value = remoteUrl.trim().replace(/\.git$/, "");
-  const https = /^https?:\/\/github\.com\/([^/]+)\/([^/]+)$/i.exec(value);
-  if (https) return `${https[1]}/${https[2]}`;
-  const ssh = /^(?:ssh:\/\/)?git@([^/:]+)[:/]([^/]+)\/([^/]+)$/i.exec(value);
-  if (!ssh || !/^github(?:[.-].+)?$/i.test(ssh[1]!)) return undefined;
-  return `${ssh[2]}/${ssh[3]}`;
-}
-
-/** Infer the `gh auth` account encoded by a `git@github-<account>:` SSH alias. */
-export function githubAccountFromRemoteUrl(remoteUrl: string): string | undefined {
-  return /^git@github-([^:]+):/i.exec(remoteUrl.trim())?.[1];
-}
-
-function githubApiEnvironment(root: string, remoteUrl: string): NodeJS.ProcessEnv | undefined {
-  const account = githubAccountFromRemoteUrl(remoteUrl);
-  if (!account) return undefined;
-  const token = captureTaskCommand(
-    root,
-    "gh",
-    ["auth", "token", "--hostname", "github.com", "--user", account],
-    { check: true, stderr: "inherit" },
-  );
-  return token ? { ...process.env, GH_TOKEN: token } : undefined;
+/** Replace the local annotated tag object with the tag object created on the remote. */
+export function refreshReleaseTagFromRemote(options: {
+  readonly expectedObject: string;
+  readonly remote: string;
+  readonly root: string;
+  readonly tag: string;
+}): void {
+  const { expectedObject, remote, root, tag } = options;
+  const ref = `refs/tags/${tag}`;
+  runTaskCommand(root, "git", ["fetch", "--force", remote, `${ref}:${ref}`]);
+  const localObject = captureTaskCommand(root, "git", ["rev-parse", ref], { check: true });
+  if (localObject !== expectedObject) {
+    throw new Error(
+      `remote ${tag} resolved to ${localObject || "<empty>"}, expected ${expectedObject}`,
+    );
+  }
 }
 
 function pushAnnotatedReleaseTag(options: {
@@ -78,15 +69,12 @@ function pushAnnotatedReleaseTag(options: {
 }): void {
   const { annotation, branch, head, remote, root, tag } = options;
   runTaskCommand(root, "git", ["tag", "--annotate", tag, "--message", annotation]);
-  const remoteUrl = captureTaskCommand(root, "git", ["remote", "get-url", remote], {
-    check: true,
-  });
-  const repository = githubRepositoryFromRemoteUrl(remoteUrl);
-  if (!repository || !taskCommandSucceeds(root, "gh", ["--version"])) {
+  const githubAccount = projectUtils.resolveProjectGhAccount(root, { remote });
+  if (!githubAccount) {
+    logger.warn("no authenticated GitHub account can access the release repository; using git push");
     runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
     return;
   }
-  const githubEnv = githubApiEnvironment(root, remoteUrl);
 
   const remoteBranch = captureTaskCommand(
     root,
@@ -97,48 +85,70 @@ function pushAnnotatedReleaseTag(options: {
     .split(/\s+/)[0]
     ?.trim();
   if (remoteBranch !== head) {
-    throw new Error(`cannot tag ${repository}: ${remote}/${branch} does not equal local HEAD`);
+    throw new Error(
+      `cannot tag ${githubAccount.remote.repository}: ${remote}/${branch} does not equal local HEAD`,
+    );
+  }
+  let remoteRefCreated = false;
+  try {
+    const tagObject = captureTaskCommand(
+      root,
+      "gh",
+      [
+        "api",
+        "--hostname",
+        githubAccount.host,
+        "--method",
+        "POST",
+        `repos/${githubAccount.remote.repository}/git/tags`,
+        "-f",
+        `tag=${tag}`,
+        "-f",
+        `message=${annotation}`,
+        "-f",
+        `object=${head}`,
+        "-f",
+        "type=commit",
+        "--jq",
+        ".sha",
+      ],
+      { check: true, env: githubAccount.env, stderr: "inherit" },
+    );
+    if (!tagObject) throw new Error(`GitHub did not return an annotated tag object for ${tag}`);
+    runTaskCommand(
+      root,
+      "gh",
+      [
+        "api",
+        "--hostname",
+        githubAccount.host,
+        "--method",
+        "POST",
+        `repos/${githubAccount.remote.repository}/git/refs`,
+        "-f",
+        `ref=refs/tags/${tag}`,
+        "-f",
+        `sha=${tagObject}`,
+        "--silent",
+      ],
+      { env: githubAccount.env },
+    );
+    remoteRefCreated = true;
+    refreshReleaseTagFromRemote({ expectedObject: tagObject, remote, root, tag });
+    logger.info(`created ${tag} through the GitHub API`, {
+      account: githubAccount.login,
+      host: githubAccount.host,
+      repository: githubAccount.remote.repository,
+      sha: head,
+    });
+  } catch (error) {
+    if (remoteRefCreated) throw error;
+    logger.warn("GitHub API tag creation failed; using git push", {
+      error,
+      repository: githubAccount.remote.repository,
+    });
+    runTaskCommand(root, "git", ["push", remote, `refs/tags/${tag}`]);
   }
-
-  const tagObject = captureTaskCommand(
-    root,
-    "gh",
-    [
-      "api",
-      "--method",
-      "POST",
-      `repos/${repository}/git/tags`,
-      "-f",
-      `tag=${tag}`,
-      "-f",
-      `message=${annotation}`,
-      "-f",
-      `object=${head}`,
-      "-f",
-      "type=commit",
-      "--jq",
-      ".sha",
-    ],
-    { check: true, env: githubEnv, stderr: "inherit" },
-  );
-  if (!tagObject) throw new Error(`GitHub did not return an annotated tag object for ${tag}`);
-  runTaskCommand(
-    root,
-    "gh",
-    [
-      "api",
-      "--method",
-      "POST",
-      `repos/${repository}/git/refs`,
-      "-f",
-      `ref=refs/tags/${tag}`,
-      "-f",
-      `sha=${tagObject}`,
-      "--silent",
-    ],
-    { env: githubEnv },
-  );
-  logger.info(`created ${tag} through the GitHub API`, { repository, sha: head });
 }
 
 function prepareReleaseBranch(options: {