@mnci/cli 4.34.0 → 4.36.0

package/dist/cli.js

@@ -695,6 +695,10 @@ var ESLINT_CONFIG_VERSION = ">=0.1.0 <1.0.0";
 function eslintConfigSpec() {
   return process.env.MNCI_ESLINT_CONFIG_SPEC ?? ESLINT_CONFIG_VERSION;
 }
+var CLI_VERSION = ">=4.0.0 <5.0.0";
+function cliSpec() {
+  return process.env.MNCI_CLI_SPEC ?? CLI_VERSION;
+}
 var ESLINT_VERSION = "^10.8.0";
 function devcontainerJson(workspaceName) {
   return `${toJson({
@@ -713,9 +717,9 @@ function devcontainerJson(workspaceName) {
       // precisely the drift this file exists to remove.
       `npm install -g npm@${NPM_VERSION}`,
       "npm ci",
-      "npm run python:install",
-      GOLANGCI_LINT_INSTALL_GUARD,
-      FLUTTER_SDK_INSTALL_GUARD
+      // The same command the pipeline runs: the Python, Go and Flutter toolchains, each
+      // skipped when the workspace has no project in that language.
+      "npx mnci ci setup"
     ].join(" && "),
     // The same recommendations the `.code-workspace` file carries, so opening
     // the folder in a container suggests the identical toolset.
@@ -786,6 +790,9 @@ function eslintToolchainDependencies(nxVersion) {
     "@mnci/eslint-config": eslintConfigSpec()
   };
 }
+function mnciToolchainDependencies(nxVersion) {
+  return { ...eslintToolchainDependencies(nxVersion), "@mnci/cli": cliSpec() };
+}
 var RETIRED_FORMATTER_FILES = [
   ".prettierrc",
   ".prettierrc.json",
@@ -1151,13 +1158,7 @@ function nugetConfigContent(registry, scope) {
 }
 var PYTHON_INSTALL_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py+' -m pip install -r requirements-dev.txt',{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PYTHON_WORKSPACE_INSTALL_GUARD = `node -e "const fs=require('node:fs'),path=require('node:path');const editableDirs=[...fs.globSync('apps/*/pyproject.toml'),...fs.globSync('python-packages/*/pyproject.toml'),...fs.globSync('libs/*/pyproject.toml')].map((p)=>path.dirname(p));const requirementsFiles=fs.globSync('apps/*/requirements.txt');if(editableDirs.length===0&&requirementsFiles.length===0){console.log('No Python projects - skipping.');process.exit(0)}const args=['-m','pip','install','--quiet',...editableDirs.flatMap((d)=>['-e',d]),...requirementsFiles.flatMap((f)=>['-r',f])];const py=process.platform==='win32'?'python':'python3';process.exit(require('node:child_process').spawnSync(py,args,{stdio:'inherit'}).status ?? 1)"`;
-var PIP_AUDIT_GUARD = `node -e "if(!require('node:fs').existsSync('requirements-dev.txt')){console.log('No Python projects - skipping.');process.exit(0)}const py=process.platform==='win32'?'python':'python3';require('node:child_process').spawnSync(py,['-m','pip_audit'],{stdio:'inherit'});process.exit(0)"`;
-var GO_MODULE_DOWNLOAD_GUARD = `node -e "if(!require('node:fs').existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('go',['mod','download'],{stdio:'inherit'}).status ?? 1)"`;
 var GOLANGCI_LINT_VERSION = "2.14.0";
-var GOLANGCI_LINT_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process'),path=require('node:path'),os=require('node:os'),crypto=require('node:crypto');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}if(cp.spawnSync('golangci-lint',['--version'],{stdio:'ignore'}).status===0){console.log('golangci-lint already installed - skipping.');process.exit(0)}const v='${GOLANGCI_LINT_VERSION}';const fallback=reason=>{console.log('Prebuilt golangci-lint '+v+' unavailable ('+reason+') - building it with go install instead.');process.exit(cp.spawnSync('go',['install','github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v'+v],{stdio:'inherit'}).status ?? 1)};const plat={linux:'linux',darwin:'darwin',win32:'windows'}[process.platform],arch={x64:'amd64',arm64:'arm64'}[process.arch];if(!plat||!arch)fallback('no prebuilt release for '+process.platform+'/'+process.arch);const gopath=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(gopath.status!==0)fallback('go env GOPATH failed');const name='golangci-lint-'+v+'-'+plat+'-'+arch,file=name+(plat==='windows'?'.zip':'.tar.gz'),base='https://github.com/golangci/golangci-lint/releases/download/v'+v+'/';const get=async u=>{const r=await fetch(u,{signal:AbortSignal.timeout(60000)});if(!r.ok)throw new Error('HTTP '+r.status+' for '+u);return Buffer.from(await r.arrayBuffer())};(async()=>{` + String.raw`const sums=(await get(base+'golangci-lint-'+v+'-checksums.txt')).toString('utf8').split('\n').map(l=>l.trim().split(' ').filter(Boolean));` + `const entry=sums.find(p=>p[1]===file);if(!entry)throw new Error(file+' is not in the release checksums');const archive=await get(base+file);if(crypto.createHash('sha256').update(archive).digest('hex')!==entry[0])throw new Error('checksum mismatch for '+file);const tmp=fs.mkdtempSync(path.join(os.tmpdir(),'golangci-lint-')),archivePath=path.join(tmp,file);fs.writeFileSync(archivePath,archive);const tar=plat==='windows'?path.join(process.env.SystemRoot||'','System32','tar.exe'):'tar';const x=cp.spawnSync(tar,['-xf',archivePath,'-C',tmp],{stdio:'inherit'});if(x.status!==0)throw new Error('could not extract '+file);const exe='golangci-lint'+(plat==='windows'?'.exe':''),bin=path.join(gopath.stdout.trim(),'bin');fs.mkdirSync(bin,{recursive:true});fs.copyFileSync(path.join(tmp,name,exe),path.join(bin,exe));fs.chmodSync(path.join(bin,exe),0o755);fs.rmSync(tmp,{recursive:true,force:true});console.log('golangci-lint '+v+' installed from its checksum-verified prebuilt release into '+bin)})().catch(error=>fallback(error.message))"`;
-var GO_TOOL_PATH_PRELUDE = "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('go.mod')){console.log('No Go projects - skipping.');process.exit(0)}const r=cp.spawnSync('go',['env','GOPATH'],{encoding:'utf8'});if(r.status!==0){console.log('Could not resolve GOPATH - skipping.');process.exit(0)}const bin=require('node:path').join(r.stdout.trim(),'bin');";
-var GO_TOOL_PATH_AZURE = `node -e "${GO_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
-var GO_TOOL_PATH_GITHUB = `node -e "${GO_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
 var FLUTTER_SDK_VERSION = "3.44.8";
 var NODE_VERSION = "24";
 var ACTION_VERSIONS = {
@@ -1170,24 +1171,10 @@ var ACTION_VERSIONS = {
 var NPM_VERSION = "11";
 var DOTNET_SDK_VERSION = "10.0.x";
 var DOTNET_DETECT_AZURE = `node -e "const fs=require('node:fs');const has=[...fs.globSync('apps/*/*.csproj'),...fs.globSync('packages/*/*.csproj'),...fs.globSync('libs/*/*.csproj')].length>0;console.log('##vso[task.setvariable variable=hasDotnetProjects]'+has)"`;
-var FLUTTER_SDK_DIRECTORY_EXPRESSION = `require('node:path').join(require('node:os').homedir(),'.mnci-flutter-${FLUTTER_SDK_VERSION}')`;
-var FLUTTER_SDK_INSTALL_GUARD = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}if(cp.spawnSync('flutter',['--version'],{stdio:'ignore',shell:process.platform==='win32'}).status===0){console.log('Flutter SDK already on PATH - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(fs.existsSync(sdk)){console.log('Flutter SDK already installed at '+sdk+' - skipping.');process.exit(0)}process.exit(cp.spawnSync('git',['clone','--depth','1','--branch','${FLUTTER_SDK_VERSION}','https://github.com/flutter/flutter.git',sdk],{stdio:'inherit'}).status ?? 1)"`;
-var FLUTTER_TOOL_PATH_PRELUDE = `const fs=require('node:fs'),path=require('node:path');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}const sdk=${FLUTTER_SDK_DIRECTORY_EXPRESSION};if(!fs.existsSync(sdk)){console.log('Flutter SDK was not installed by mnci (already on PATH) - skipping.');process.exit(0)}const bin=path.join(sdk,'bin');`;
-var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log('##vso[task.prependpath]'+bin)"`;
-var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
-var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
-var NPM_AUDIT_STEP = `node -e "const cp=require('node:child_process');const r=cp.spawnSync('npm',['audit','--json'],{encoding:'utf8',shell:process.platform==='win32',maxBuffer:33554432});let d;try{d=JSON.parse(r.stdout)}catch{console.log('npm audit produced no JSON (exit '+r.status+') - not blocking on a broken audit.');process.exit(0)}const all=Object.values(d.vulnerabilities||{});const BLOCK=['critical','high','moderate'];const major=v=>v.fixAvailable&&typeof v.fixAvailable==='object'&&v.fixAvailable.isSemVerMajor;const act=all.filter(v=>v.fixAvailable&&BLOCK.includes(v.severity)&&!major(v));const rest=all.filter(v=>!act.includes(v));for(const v of rest)console.log('  note ['+v.severity+'] '+v.name+(!v.fixAvailable?' - NO fix available upstream, nothing to do here':major(v)?' - only a semver-major change would remove it (often a parent downgrade), not applied automatically':' - fix available, below the blocking threshold'));if(act.length===0){console.log('npm audit - '+all.length+' advisory(ies), none actionable at moderate or above.');process.exit(0)}for(const v of act)console.log('  BLOCKING ['+v.severity+'] '+v.name+' - fix available');console.log('Each has a published fix. Add a targeted overrides entry in package.json rather than npm audit fix --force.');process.exit(1)"`;
 var VERIFY_TARGETS = "lint,typecheck,test,build";
-function affectedOrAllGuard(exclude = "") {
-  const extra = exclude === "" ? "" : `+' ${exclude}'`;
-  return `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T${extra},{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base${extra},{stdio:'inherit',shell:true}).status ?? 1)"`;
-}
-var AFFECTED_OR_ALL_GUARD = affectedOrAllGuard();
-var AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE = affectedOrAllGuard(`--exclude=tag:${GO_CGO_TAG}`);
 var NATIVE_TARGETS = "lint,test,build-native,package-native";
-var NATIVE_BUILD_COMMAND = `npx nx run-many -t ${NATIVE_TARGETS} --projects=tag:${GO_CGO_TAG}`;
 var NATIVE_LINUX_PREREQUISITES = "sudo apt-get update && sudo apt-get install -y gcc pkg-config";
-function githubNativeJob(npmAuthName, npmAuthValue, onMain) {
+function githubNativeJob(npmAuthName, npmAuthValue) {
   return `
   # Apps that need a C toolchain (mnci add go-app --cgo) cannot be cross-compiled
   # from the job above, so each is linted, tested, built and packaged here, on a
@@ -1222,14 +1209,10 @@ function githubNativeJob(npmAuthName, npmAuthValue, onMain) {
         env:
           ${npmAuthName}: ${npmAuthValue}
 
-      - run: ${GO_MODULE_DOWNLOAD_GUARD}
-        name: Download Go module dependencies
-
-      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
-        name: Install golangci-lint
-
-      - run: ${GO_TOOL_PATH_GITHUB}
-        name: Add Go tool bin to PATH
+      # The Go toolchain: the modules, and a checksum-verified golangci-lint put
+      # on PATH. The other toolchains are skipped cleanly when absent.
+      - run: npx mnci ci setup
+        name: Set up the Go toolchain
 
       # A C compiler and pkg-config, which is all mnci can know a cgo app needs.
       # Add the -dev packages your app links to this line, for example
@@ -1239,22 +1222,20 @@ function githubNativeJob(npmAuthName, npmAuthValue, onMain) {
         name: Install native prerequisites (Linux)
         if: \${{ runner.os == 'Linux' }}
 
-      - run: ${NATIVE_BUILD_COMMAND}
+      # Lints, tests, builds and packages the native apps on this OS. On a push to
+      # main, a releasable native app (--cgo with --release) also gets this OS's zip
+      # attached to the GitHub Release the ci job just created, stamped with the
+      # tag's version.
+      - run: npx mnci ci native
         name: Lint, test, build and package the native apps
+        env:
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
 
       - uses: actions/upload-artifact@${ACTION_VERSIONS["actions/upload-artifact"]}
         with:
           name: native-\${{ matrix.os }}
           path: dist/drop
           if-no-files-found: ignore
-
-      # A releasable native app (--cgo with --release) gets this OS's zip attached to
-      # the GitHub Release the ci job just created, stamped with the tag's version.
-      - run: node tools/go-app-release.cjs assets --native
-        name: Attach this OS's zip to the GitHub Release (releasable native apps)
-        if: \${{ ${onMain} && hashFiles('tools/go-app-release.cjs') != '' }}
-        env:
-          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
 `;
 }
 function indentYaml(text, spaces) {
@@ -1299,40 +1280,12 @@ ${matrix}
 ${indentYaml(nativeSteps, 4)}
 `;
 }
-var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});const hasProjectJson=fs.globSync('apps/*/project.json').length>0;const hasInlineNx=fs.globSync('apps/*/package.json').some((f)=>{try{return Boolean(JSON.parse(fs.readFileSync(f,'utf8')).nx)}catch{return false}});const hasCsproj=fs.globSync('apps/*/*.csproj').length>0;if(!hasProjectJson&&!hasInlineNx&&!hasCsproj){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
-var NPM_AUTH_PREFLIGHT = `node -e "const fs=require('node:fs'),cp=require('node:child_process');if(fs.globSync('packages/*/package.json').length===0){console.log('No npm packages to release - skipping.');process.exit(0)}if(!process.env.NODE_AUTH_TOKEN){console.error('NPM_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly NPM_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret. Use an npm Automation token - a Publish token is refused by 2FA in CI.');process.exit(1)}const r=cp.spawnSync('npm',['whoami','--registry=https://registry.npmjs.org/'],{encoding:'utf8',shell:process.platform==='win32'});if(r.status!==0){console.error('NPM_TOKEN is set but the registry rejected it - '+((r.stderr||'')+(r.stdout||'')).trim()+'. Check that it has not expired and that it grants publish rights on this scope.');process.exit(1)}console.log('npm auth OK as '+r.stdout.trim())"`;
-function npmAuthPreflight(registryKind) {
-  return registryKind === "npm" ? NPM_AUTH_PREFLIGHT : "";
-}
-var PYPI_RELEASE_PREFLIGHT = String.raw`node -e "const fs=require('node:fs');const files=fs.globSync('python-packages/*/pyproject.toml');if(files.length===0){console.log('No Python packages to release - skipping.');process.exit(0)}if(!process.env.PYPI_TOKEN){console.error('PYPI_TOKEN is empty or unset, so the publish would fail AFTER nx release has already tagged. Add it as a repository secret named exactly PYPI_TOKEN - under Actions, not the Dependabot or Codespaces tab, and not an Environment secret.');process.exit(1)}if(!process.env.PYPI_TOKEN.startsWith('pypi-')){console.error('PYPI_TOKEN does not look like a PyPI API token - every one of them begins with pypi-. A password or a truncated paste is rejected only at upload time, which is AFTER nx release has tagged.');process.exit(1)}const names=files.map(f=>{const t=fs.readFileSync(f,'utf8');const b=t.slice(t.indexOf('[project]'));const l=b.split('\n').find(x=>x.trim().startsWith('name'));return l?l.split('=')[1].replace(/[^a-zA-Z0-9._-]/g,''):''}).filter(Boolean);(async()=>{const fresh=[];for(const n of names){try{const r=await fetch('https://pypi.org/pypi/'+n.toLowerCase().replace(/[-_.]+/g,'-')+'/json',{signal:AbortSignal.timeout(10000)});if(r.status===404)fresh.push(n)}catch{console.log('Could not reach PyPI to check '+n+' - continuing.')}}if(fresh.length===0){console.log('Every Python package already exists on PyPI - this release creates none.');return}console.log('NOTE - this release may CREATE '+fresh.length+' new PyPI project(s) - '+fresh.join(', ')+'. Project creation is rate limited per account, and a 429 there arrives AFTER nx release has tagged - leaving those versions tagged with nothing published, and skipped forever, because the next run resolves the current version from the newest tag. If that happens, delete the tags for the versions that did not publish before releasing again. PyPI offers no way to check the limit, or the token, in advance.')})()"`;
-function pypiReleasePreflight(registryKind) {
-  return registryKind === "npm" ? PYPI_RELEASE_PREFLIGHT : "";
-}
-var SHALLOW_CLONE_GUARD = `node -e "const r=require('node:child_process').spawnSync('git',['rev-parse','--is-shallow-repository'],{encoding:'utf8'});if(r.status!==0){console.error('Could not determine whether this checkout has full history (git rev-parse --is-shallow-repository failed) - refusing to release. '+(r.stderr||'').trim());process.exit(1)}if(r.stdout.trim()==='true'){console.error('This checkout is a shallow clone. nx release resolves the current version of each package from its git tag, and silently falls back to the permanently-stale on-disk version when a tag cannot be found - which can propose, and publish, a version DOWNGRADE. Fetch full history before releasing - set fetchDepth (Azure) or fetch-depth (GitHub) to 0.');process.exit(1)}"`;
-function releaseGuard(pythonPublishEnv, nugetPublishEnv) {
-  return String.raw`node -e "const fs=require('node:fs'),cp=require('node:child_process');const npmCount=fs.globSync('packages/*/package.json').length;const csharpCount=fs.globSync('packages/*/*.csproj').length;const pythonCount=fs.globSync('python-packages/*/pyproject.toml').length;const dartCount=fs.globSync('packages/*/pubspec.yaml').length;const vscodeCount=fs.globSync('apps/*/package.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).nx?.tags||[]).includes('${VSCODE_EXTENSION_TAG}')}catch{return false}}).length;const goCount=fs.globSync('apps/*/project.json').filter(p=>{try{return(JSON.parse(fs.readFileSync(p,'utf8')).tags||[]).includes('${GO_RELEASE_TAG}')}catch{return false}}).length;const hasNpm=npmCount>0;const hasPython=pythonCount>0;const hasCsharp=csharpCount>0;const hasDart=dartCount>0;const hasVscode=vscodeCount>0;const hasGo=goCount>0;if(!hasNpm&&!hasPython&&!hasCsharp&&!hasDart&&!hasVscode&&!hasGo){console.log('Nothing to release - skipping.');process.exit(0)}const specifier=process.env.RELEASE_SPECIFIER||'';let releaseCmd='npx nx release --yes';if(specifier){if(!/^(major|minor|patch|\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?)$/.test(specifier)){console.error('RELEASE_SPECIFIER value \''+specifier+'\' is invalid - use major, minor, patch, or an exact version like 1.2.3.');process.exit(1)}const releaseProjectCount=npmCount+csharpCount+pythonCount+dartCount+vscodeCount+goCount;if(/^(major|minor|patch)$/.test(specifier)&&releaseProjectCount>1){console.error('RELEASE_SPECIFIER is a keyword (\''+specifier+'\') but this workspace has '+releaseProjectCount+' releasable packages - a keyword under-bumps interdependent packages, because nx computes the dependency-bump pass from a stale cached version. Set RELEASE_SPECIFIER to an exact version instead, or clear it.');process.exit(1)}releaseCmd='npx nx release '+specifier+' --yes'}const env={...process.env};${pythonPublishEnv}${nugetPublishEnv}process.exit(cp.spawnSync(releaseCmd,{stdio:'inherit',shell:true,env}).status ?? 1)"`;
-}
 var PYPI_TOKEN_VARIABLE = "PYPI_TOKEN";
 var AZURE_PAT_VARIABLE = "PAT";
-function azurePatPreflight(countExpression, subject) {
-  return `if(!process.env.${AZURE_PAT_VARIABLE}){console.error('This workspace has '+${countExpression}+' ${subject} package(s) to publish to Azure Artifacts but ${AZURE_PAT_VARIABLE} is empty. Add your base64-encoded Azure DevOps PAT as a secret named ${AZURE_PAT_VARIABLE}, or remove the ${subject} packages from release.projects.');process.exit(1)}`;
-}
 function pypiTokenEnvLine(registryKind, variableReference, indent) {
   return registryKind === "npm" ? `
 ${indent}${PYPI_TOKEN_VARIABLE}: ${variableReference(PYPI_TOKEN_VARIABLE)}` : "";
 }
-function pythonPublishEnvFragment(pythonPublishUrl2, registryKind) {
-  if (pythonPublishUrl2 !== void 0) {
-    return `if(hasPython){${azurePatPreflight("pythonCount", "Python")}env.TWINE_REPOSITORY_URL='${pythonPublishUrl2}';env.TWINE_USERNAME='AzureArtifacts';env.TWINE_PASSWORD=Buffer.from(process.env.${AZURE_PAT_VARIABLE},'base64').toString()}`;
-  }
-  if (registryKind !== "npm") {
-    return "";
-  }
-  return `if(hasPython){if(!process.env.${PYPI_TOKEN_VARIABLE}){console.error('This workspace has '+pythonCount+' Python package(s) to publish but ${PYPI_TOKEN_VARIABLE} is empty. Add a PyPI API token as a secret named ${PYPI_TOKEN_VARIABLE}, or remove the Python packages from release.projects.');process.exit(1)}env.TWINE_USERNAME='__token__';env.TWINE_PASSWORD=process.env.${PYPI_TOKEN_VARIABLE};env.TWINE_NON_INTERACTIVE='1'}`;
-}
-function nugetPublishEnvFragment(nugetFeedUrl2) {
-  return nugetFeedUrl2 ? `if(hasCsharp){${azurePatPreflight("csharpCount", "C#")}env.NUGET_PAT=Buffer.from(process.env.${AZURE_PAT_VARIABLE},'base64').toString()}` : "";
-}
 function npmAuthEnvVariable(registryKind, variableReference) {
   return registryKind === "npm" ? ["NODE_AUTH_TOKEN", variableReference("NPM_TOKEN")] : [AZURE_PAT_VARIABLE, variableReference(AZURE_PAT_VARIABLE)];
 }
@@ -1476,66 +1429,25 @@ steps:
 ${npmAuthenticateStep}  - script: npm ci
     displayName: Install dependencies${npmCiEnv}
 
+  # Everything from here to the release is a command of the mnci CLI, a
+  # devDependency of this workspace, so the version is the lockfile's and a
+  # developer reproduces CI by running the same line. The guards that used to be
+  # inline here are tested TypeScript in the CLI's ci-pipeline slice. Node, the
+  # checkout and 'npm ci' stay above: Node must exist before 'npx' can run.
+
+  # The language toolchains the workspace needs: Python (ruff, pytest, build,
+  # twine, and every project installed into one shared environment), Go (the
+  # modules and a checksum-verified golangci-lint, put on PATH) and Flutter (the
+  # pinned SDK, put on PATH, and one pub get). Each is skipped cleanly when the
+  # workspace has no project in that language.
+  - script: npx mnci ci setup
+    displayName: Set up the language toolchains (Python, Go, Flutter)
+
   # Fails ONLY on an advisory that has a published fix, at moderate or above;
-  # anything upstream has not fixed is printed and passes. See NPM_AUDIT_STEP's
-  # remarks for why that split replaced a warn-only step.
-  - script: ${NPM_AUDIT_STEP}
-    displayName: npm audit (fails on an actionable advisory)
-
-  # Installs the fixed Python toolchain (ruff, pytest, build, twine, pip-audit)
-  # \u2014 written by 'mnci add' to requirements-dev.txt on the first Python
-  # project. Plain pip, no uv/Poetry: portable guard skips cleanly on a
-  # workspace with none.
-  - script: ${PYTHON_INSTALL_GUARD}
-    displayName: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
-
-  # Editable-installs every Python project into one shared environment, the
-  # pip-world counterpart of 'npm install' hoisting every workspace package
-  # into one root node_modules \u2014 so a project that imports an internal lib
-  # (normally vendored only at build time) can resolve that import at
-  # lint/test time too. Portable guard skips cleanly on a workspace with none.
-  - script: ${PYTHON_WORKSPACE_INSTALL_GUARD}
-    displayName: Install Python project dependencies (editable, workspace-wide)
-
-  # Non-blocking, same reasoning as the npm audit step above. Runs after the
-  # workspace-wide install so it scans the workspace's actual dependency set,
-  # not just the fixed toolchain.
-  - script: ${PIP_AUDIT_GUARD}
-    displayName: pip-audit (non-blocking)
-
-  # Go, if the workspace has any: hosted agents ship the toolchain, so only
-  # the module cache and the linter need seeding. Both guards skip cleanly on
-  # a workspace with no root go.mod.
-  - script: ${GO_MODULE_DOWNLOAD_GUARD}
-    displayName: Download Go module dependencies
-
-  # golangci-lint is what the generated Go lint target actually runs (the
-  # plugin's own default is 'go fmt', which only reformats). The pinned,
-  # checksum-verified prebuilt release lands in GOPATH/bin (go install at the
-  # same version is the fallback), which is not on PATH by default on a hosted
-  # agent \u2014 so prepend it for every later step in the job.
-  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
-    displayName: Install golangci-lint
-
-  - script: ${GO_TOOL_PATH_AZURE}
-    displayName: Add Go tool bin to PATH
-
-  # Flutter, if the workspace has any. Unlike Python and Go, hosted agents do
-  # NOT ship the Flutter SDK, so this installs it (shallow git clone at a
-  # pinned tag) and puts it on PATH. All three guards skip cleanly on a
-  # workspace with no root pubspec.yaml, and the install also skips when an
-  # SDK is already on PATH.
-  - script: ${FLUTTER_SDK_INSTALL_GUARD}
-    displayName: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
-
-  - script: ${FLUTTER_TOOL_PATH_AZURE}
-    displayName: Add the Flutter SDK to PATH
-
-  # One command resolves EVERY Dart dependency, internal and external, for the
-  # whole workspace: the projects are pub workspace members, so this writes a
-  # single root pubspec.lock they all share.
-  - script: ${FLUTTER_PUB_GET_GUARD}
-    displayName: Resolve Dart dependencies (one pub get for the whole workspace)
+  # anything upstream has not fixed is printed and passes. pip-audit only
+  # reports: its output has no "a fix exists" field to draw that line with.
+  - script: npx mnci ci audit
+    displayName: Audit dependencies (fails on an actionable npm advisory)
 
   # .NET, if the workspace has any. Azure's 'condition:' expression language
   # has no glob function, so this script step detects C# projects first and
@@ -1551,29 +1463,18 @@ ${npmAuthenticateStep}  - script: npm ci
     inputs:
       version: ${DOTNET_SDK_VERSION}
 
-  # Fails fast, with an unambiguous message, when a stale TypeScript project
-  # reference (or another sync generator's drift) was never synced+committed
-  # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
-  # CI still needs its own explicit, early check rather than surfacing this as
-  # a confusing failure buried inside the build step below.
-  - script: npx nx sync:check
-    displayName: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
-
-  # The one verify step, and deliberately the only one: affected projects on a
-  # pull request, EVERY project on anything else (a push to main included, so a
-  # release is always verified in full). Every fallback \u2014 no target branch, an
-  # unresolvable merge-base \u2014 takes the full path, because a run that verifies
-  # too little still reports green.
-  #
-  # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
-  # below, so adding it back as its own step would only duplicate work \u2014 and on
-  # a pull request it would re-lint every project, discarding the point of this.
-  - script: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
-    displayName: Verify (affected on a PR, every project on main)
+  # Fails fast on a stale TypeScript project reference, then the one verify
+  # step, and deliberately the only one: affected projects on a pull request,
+  # EVERY project on anything else (a push to main included, so a release is
+  # always verified in full). Every fallback takes the full path, because a run
+  # that verifies too little still reports green. Apps that need a C toolchain
+  # are left to the native job.
+  - script: npx mnci ci verify
+    displayName: Verify (sync check, then affected on a PR, every project on main)
 
   # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
-  # target. Portable guard: skip cleanly when the workspace has no apps yet.
-  - script: ${PACK_APPS_GUARD}
+  # target; skipped cleanly when the workspace has no apps yet.
+  - script: npx mnci ci pack
     displayName: Pack all apps (one zip per app -> dist/drop)
     condition: ${onMain}
 
@@ -1591,56 +1492,23 @@ ${npmAuthenticateStep}  - script: npm ci
     displayName: Tag the run per app (type-name)
     condition: ${onMain}
 
-  # nx release resolves each package's current version from its git tag, and
-  # falls back to the (permanently stale, since git.commit is false) on-disk
-  # version when a tag cannot be resolved \u2014 which happens whenever this
-  # checkout lacks full history. This is currently guaranteed by fetchDepth 0
-  # above plus the explicit fetch below, but neither is expressed as a
-  # dependency anywhere else, so this makes it a hard, loud precondition
-  # instead of a silently wrong version discovered after release.
-  - script: ${SHALLOW_CLONE_GUARD}
-    displayName: Verify this is a full checkout (nx release needs the real tag history)
-    condition: ${onMain}
-${npmAuthPreflight(registryKind) ? `
-  # Prove npm will accept us BEFORE anything irreversible happens. nx release
-  # tags first and publishes last, so a rejected token leaves a version tagged
-  # with nothing on the registry - and that number is then skipped forever,
-  # because the next run resolves the current version from the newest tag.
-  - script: ${npmAuthPreflight(registryKind)}
-    displayName: Preflight \u2014 npm must accept the token before anything is tagged
-    condition: ${onMain}
-    env:
-      NODE_AUTH_TOKEN: $(NPM_TOKEN)
-` : ""}${pypiReleasePreflight(registryKind) ? `
-  # PyPI cannot be asked whether a token is good - the only endpoint that
-  # authenticates is the upload itself - so this checks the token's SHAPE and
-  # names the projects this release would have to CREATE. Project creation is
-  # rate limited per account, and a 429 arrives AFTER nx release has tagged.
-  - script: ${pypiReleasePreflight(registryKind)}
-    displayName: Preflight \u2014 name the PyPI projects this release would create
-    condition: ${onMain}
-    env:
-      PYPI_TOKEN: $(PYPI_TOKEN)
-` : ""}
-  # Version + tag + publish, in one release, for npm (packages/*), Python
-  # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional commits,
-  # tag-only push. Portable guard: nx release errors on an empty scope, so
-  # skip cleanly when there is nothing to release. When there are Python or
-  # C# packages and an Azure feed, twine/NuGet publish credentials are
-  # exported (raw PAT, decoded from the base64 variable).
+  # The release, in the order that keeps a failure safe: refuse a shallow
+  # clone, prove the npm token and name the PyPI projects it would create (all
+  # BEFORE anything is tagged), then version + tag + publish in one 'nx release'
+  # for npm, Python, C# and VS Code, then push the tags explicitly (nx release's
+  # own push never runs without a remote GitHub/GitLab Release configured, which
+  # this pipeline never does). Which registry is in use is read from the 'mnci'
+  # block of nx.json, not baked into this file. The secrets are mapped here, in
+  # the one place a command cannot reach.
   #
-  # RELEASE_SPECIFIER (the pipeline variable above) overrides the bump nx
-  # would compute from conventional commits for THIS run. In a workspace with
-  # more than one releasable package, a bare keyword ('major'/'minor'/'patch')
-  # is unreliable \u2014 nx versions interdependent packages in two passes (a
-  # dependency-bump pass, then the specifier pass), and the second pass
-  # computes from a version cached before the first pass ran, silently
-  # landing back on the same patch bump either way. An exact version ('1.2.3')
-  # does not have this problem, since both passes apply it verbatim \u2014 prefer
-  # it whenever more than one package is releasable. The guard below fails
-  # the run rather than under-bumping silently: clear the variable back to
-  # '' once the override is no longer needed.
-  - script: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
+  # RELEASE_SPECIFIER (the pipeline variable above) overrides the bump nx would
+  # compute from conventional commits for THIS run: 'major', 'minor', 'patch', or
+  # an exact version ('1.2.3'). With more than one releasable package a bare
+  # keyword is unreliable (nx versions interdependent packages in two passes, and
+  # the second computes from a version cached before the first), so the command
+  # fails the run rather than under-bumping silently: prefer an exact version,
+  # and clear the variable back to '' once the override is no longer needed.
+  - script: npx mnci ci release
     displayName: Release \u2014 version, tag and publish (npm + Python + C# + VS Code)
     condition: ${onMain}
     env:
@@ -1649,15 +1517,6 @@ ${npmAuthPreflight(registryKind) ? `
       # A VS Code extension publishes with it; tools/vscode-extension.cjs skips the
       # Marketplace when it is unset, including when Azure leaves it as '$(VSCE_PAT)'.
       VSCE_PAT: $(VSCE_PAT)
-
-  # nx release's own git push (release.git.push) is deliberately left off: it
-  # only runs when a remote GitHub/GitLab Release is configured, which this
-  # pipeline never does, so it would never push the tag the step above just
-  # created. Pushed explicitly, unconditionally (a no-op when nothing released)
-  # once tagging is guaranteed to have already happened.
-  - script: git push origin --tags
-    displayName: Push release tags (nx release's own push never runs without a remote Release configured)
-    condition: ${onMain}
 `;
   if (!nativeApps) {
     return document;
@@ -1680,14 +1539,10 @@ ${npmAuthPreflight(registryKind) ? `
 ${npmAuthenticateStep}  - script: npm ci
     displayName: Install dependencies${npmCiEnv}
 
-  - script: ${GO_MODULE_DOWNLOAD_GUARD}
-    displayName: Download Go module dependencies
-
-  - script: ${GOLANGCI_LINT_INSTALL_GUARD}
-    displayName: Install golangci-lint
-
-  - script: ${GO_TOOL_PATH_AZURE}
-    displayName: Add Go tool bin to PATH
+  # The Go toolchain: the modules, and a checksum-verified golangci-lint put on
+  # PATH. The other toolchains are skipped cleanly when absent.
+  - script: npx mnci ci setup
+    displayName: Set up the Go toolchain
 
   # A C compiler and pkg-config, which is all mnci can know a cgo app needs. Add the
   # -dev packages your app links to this line, for example libgtk-3-dev and
@@ -1697,7 +1552,7 @@ ${npmAuthenticateStep}  - script: npm ci
     displayName: Install native prerequisites (Linux)
     condition: eq(variables['Agent.OS'], 'Linux')
 
-  - script: ${NATIVE_BUILD_COMMAND}
+  - script: npx mnci ci native
     displayName: Lint, test, build and package the native apps
 
   - task: PublishBuildArtifacts@1
@@ -1788,66 +1643,25 @@ jobs:
         env:
           ${npmAuthName}: ${npmAuthValue}
 
-      # Fails ONLY on an advisory that has a published fix, at moderate or
-      # above; anything upstream has not fixed is printed and passes. See
-      # NPM_AUDIT_STEP's remarks for why that split replaced a warn-only step.
-      - run: ${NPM_AUDIT_STEP}
-        name: npm audit (fails on an actionable advisory)
-
-      # Installs the fixed Python toolchain (ruff, pytest, build, twine,
-      # pip-audit) \u2014 written by 'mnci add' to requirements-dev.txt on the
-      # first Python project. Plain pip, no uv/Poetry: portable guard skips
-      # cleanly on a workspace with none.
-      - run: ${PYTHON_INSTALL_GUARD}
-        name: Install Python dependencies (ruff, pytest, build, twine, pip-audit)
-
-      # Editable-installs every Python project into one shared environment, the
-      # pip-world counterpart of 'npm install' hoisting every workspace package
-      # into one root node_modules \u2014 so a project that imports an internal lib
-      # (normally vendored only at build time) can resolve that import at
-      # lint/test time too. Portable guard skips cleanly on a workspace with none.
-      - run: ${PYTHON_WORKSPACE_INSTALL_GUARD}
-        name: Install Python project dependencies (editable, workspace-wide)
-
-      # Non-blocking, same reasoning as the npm audit step above. Runs after
-      # the workspace-wide install so it scans the workspace's actual
-      # dependency set, not just the fixed toolchain.
-      - run: ${PIP_AUDIT_GUARD}
-        name: pip-audit (non-blocking)
-
-      # Go, if the workspace has any: hosted runners ship the toolchain, so
-      # only the module cache and the linter need seeding. Both guards skip
-      # cleanly on a workspace with no root go.mod.
-      - run: ${GO_MODULE_DOWNLOAD_GUARD}
-        name: Download Go module dependencies
-
-      # golangci-lint is what the generated Go lint target actually runs (the
-      # plugin's own default is 'go fmt', which only reformats). The pinned,
-      # checksum-verified prebuilt release lands in GOPATH/bin (go install at the
-      # same version is the fallback), which is not on PATH by default on a
-      # hosted runner \u2014 so publish it for every later step in the job.
-      - run: ${GOLANGCI_LINT_INSTALL_GUARD}
-        name: Install golangci-lint
-
-      - run: ${GO_TOOL_PATH_GITHUB}
-        name: Add Go tool bin to PATH
-
-      # Flutter, if the workspace has any. Unlike Python and Go, hosted runners
-      # do NOT ship the Flutter SDK, so this installs it (shallow git clone at
-      # a pinned tag) and puts it on PATH. All three guards skip cleanly on a
-      # workspace with no root pubspec.yaml, and the install also skips when an
-      # SDK is already on PATH.
-      - run: ${FLUTTER_SDK_INSTALL_GUARD}
-        name: Install the Flutter SDK (${FLUTTER_SDK_VERSION})
-
-      - run: ${FLUTTER_TOOL_PATH_GITHUB}
-        name: Add the Flutter SDK to PATH
-
-      # One command resolves EVERY Dart dependency, internal and external, for
-      # the whole workspace: the projects are pub workspace members, so this
-      # writes a single root pubspec.lock they all share.
-      - run: ${FLUTTER_PUB_GET_GUARD}
-        name: Resolve Dart dependencies (one pub get for the whole workspace)
+      # Everything from here to the release is a command of the mnci CLI, a
+      # devDependency of this workspace, so the version is the lockfile's and a
+      # developer reproduces CI by running the same line. The guards that used to be
+      # inline here are tested TypeScript in the CLI's ci-pipeline slice. Node,
+      # the checkout and 'npm ci' stay above: Node must exist before 'npx' can run.
+
+      # The language toolchains the workspace needs: Python (ruff, pytest, build,
+      # twine, and every project installed into one shared environment), Go (the
+      # modules and a checksum-verified golangci-lint, put on PATH) and Flutter (the
+      # pinned SDK, put on PATH, and one pub get). Each is skipped cleanly when the
+      # workspace has no project in that language.
+      - run: npx mnci ci setup
+        name: Set up the language toolchains (Python, Go, Flutter)
+
+      # Fails ONLY on an advisory that has a published fix, at moderate or above;
+      # anything upstream has not fixed is printed and passes. pip-audit only
+      # reports: its output has no "a fix exists" field to draw that line with.
+      - run: npx mnci ci audit
+        name: Audit dependencies (fails on an actionable npm advisory)
 
       # .NET, if the workspace has any. actions/setup-dotnet is the
       # maintained, cached installer GitHub itself ships, so this uses it
@@ -1859,30 +1673,18 @@ jobs:
         with:
           dotnet-version: ${DOTNET_SDK_VERSION}
 
-      # Fails fast, with an unambiguous message, when a stale TypeScript project
-      # reference (or another sync generator's drift) was never synced+committed
-      # locally \u2014 sync.applyChanges (nx.json) only auto-applies interactively, so
-      # CI still needs its own explicit, early check rather than surfacing this as
-      # a confusing failure buried inside the build step below.
-      - run: npx nx sync:check
-        name: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
-
-      # The one verify step, and deliberately the only one: affected projects on
-      # a pull request, EVERY project on anything else (a push to main included,
-      # so a release is always verified in full). Every fallback \u2014 no target
-      # branch, an unresolvable merge-base \u2014 takes the full path, because a run
-      # that verifies too little still reports green.
-      #
-      # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
-      # below, so adding it back as its own step would only duplicate work \u2014 and
-      # on a pull request it would re-lint every project, discarding the point
-      # of this.
-      - run: ${nativeApps ? AFFECTED_OR_ALL_GUARD_WITHOUT_NATIVE : AFFECTED_OR_ALL_GUARD}
-        name: Verify (affected on a PR, every project on main)
+      # Fails fast on a stale TypeScript project reference, then the one verify
+      # step, and deliberately the only one: affected projects on a pull request,
+      # EVERY project on anything else (a push to main included, so a release is
+      # always verified in full). Every fallback takes the full path, because a run
+      # that verifies too little still reports green. Apps that need a C toolchain
+      # are left to the native job.
+      - run: npx mnci ci verify
+        name: Verify (sync check, then affected on a PR, every project on main)
 
       # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
-      # target. Portable guard: skip cleanly when the workspace has no apps yet.
-      - run: ${PACK_APPS_GUARD}
+      # target; skipped cleanly when the workspace has no apps yet.
+      - run: npx mnci ci pack
         name: Pack all apps (one zip per app -> dist/drop)
         if: \${{ ${onMain} }}
 
@@ -1893,65 +1695,6 @@ jobs:
           path: dist/drop
           if-no-files-found: ignore
 
-      # nx release resolves each package's current version from its git tag,
-      # and falls back to the (permanently stale, since git.commit is false)
-      # on-disk version when a tag cannot be resolved \u2014 which happens
-      # whenever this checkout lacks full history. This is currently
-      # guaranteed by fetch-depth 0 above plus the explicit fetch below, but
-      # neither is expressed as a dependency anywhere else, so this makes it
-      # a hard, loud precondition instead of a silently wrong version
-      # discovered after release.
-      - run: ${SHALLOW_CLONE_GUARD}
-        name: Verify this is a full checkout (nx release needs the real tag history)
-        if: \${{ ${onMain} }}
-${npmAuthPreflight(registryKind) ? `
-      # Prove npm will accept us BEFORE anything irreversible happens. nx
-      # release tags first and publishes last, so a rejected token leaves a
-      # version tagged with nothing on the registry - and that number is then
-      # skipped forever, because the next run resolves the current version
-      # from the newest tag.
-      - run: ${npmAuthPreflight(registryKind)}
-        name: Preflight \u2014 npm must accept the token before anything is tagged
-        if: \${{ ${onMain} }}
-        env:
-          NODE_AUTH_TOKEN: \${{ secrets.NPM_TOKEN }}
-` : ""}${pypiReleasePreflight(registryKind) ? `
-      # PyPI cannot be asked whether a token is good - the only endpoint that
-      # authenticates is the upload itself - so this checks the token's SHAPE
-      # and names the projects this release would have to CREATE. Project
-      # creation is rate limited per account, and a 429 arrives AFTER nx
-      # release has tagged.
-      - run: ${pypiReleasePreflight(registryKind)}
-        name: Preflight \u2014 name the PyPI projects this release would create
-        if: \${{ ${onMain} }}
-        env:
-          PYPI_TOKEN: \${{ secrets.PYPI_TOKEN }}
-` : ""}
-      # Version + tag + publish, in one release, for npm (packages/*), Python
-      # (python-packages/*) AND C# (packages/*/*.csproj) \u2014 conventional
-      # commits, tag-only push. Portable guard: nx release errors on an empty
-      # scope, so skip cleanly when there is nothing to release. When there
-      # are Python or C# packages and an Azure feed, twine/NuGet publish
-      # credentials are exported (raw PAT, decoded from the base64 secret).
-      #
-      # RELEASE_SPECIFIER (repository variable, Settings -> Secrets and
-      # variables -> Actions -> Variables) overrides the bump nx would compute
-      # from conventional commits for THIS run: 'major', 'minor', 'patch', or
-      # an exact version ('1.2.3'). In a workspace with more than one
-      # releasable package, a bare keyword is unreliable \u2014 nx versions
-      # interdependent packages in two passes (a dependency-bump pass, then
-      # the specifier pass), and the second pass computes from a version
-      # cached before the first pass ran, silently landing back on the same
-      # patch bump either way. An exact version does not have this problem,
-      # since both passes apply it verbatim \u2014 prefer it whenever more than one
-      # package is releasable. The guard below fails the run rather than
-      # under-bumping silently: unset or clear the variable once the override
-      # is no longer needed.${githubReleases ? `
-      # This provider also creates a per-project GitHub Release (changelog
-      # generated from conventional commits since that project's last tag),
-      # which is why 'nx release' pushes the tag itself here \u2014 see
-      # releaseConfig's remarks for why that is safe on this Nx version and
-      # why every other provider combination keeps the explicit push step below.` : ""}
       # Signs in to Microsoft Entra ID as the Marketplace publishing identity (an
       # app registration with a federated credential for this repository's main
       # branch), so the release step publishes VS Code extensions with
@@ -1967,7 +1710,23 @@ ${npmAuthPreflight(registryKind) ? `
           tenant-id: \${{ vars.AZURE_TENANT_ID }}
           allow-no-subscriptions: true
 
-      - run: ${releaseGuard(pythonPublishEnvFragment(pythonPublishUrl2, registryKind), nugetPublishEnvFragment(nugetFeedUrl2))}
+      # The release, in the order that keeps a failure safe: refuse a shallow
+      # clone, prove the npm token and name the PyPI projects it would create (all
+      # BEFORE anything is tagged), then version + tag + publish in one 'nx release'
+      # for npm, Python, C# and VS Code, then attach a releasable Go app's zips and
+      # push the tags. Which registry, and whether GitHub Releases are on, are read
+      # from the 'mnci' block of nx.json, not baked into this file. The secrets are
+      # mapped here, in the one place a command cannot reach.
+      #
+      # RELEASE_SPECIFIER (repository variable, Settings -> Secrets and
+      # variables -> Actions -> Variables) overrides the bump nx would compute
+      # from conventional commits for THIS run: 'major', 'minor', 'patch', or an
+      # exact version ('1.2.3'). With more than one releasable package a bare
+      # keyword is unreliable (nx versions interdependent packages in two passes,
+      # and the second computes from a version cached before the first), so the
+      # command fails the run rather than under-bumping silently: prefer an exact
+      # version, and clear the variable once the override is no longer needed.
+      - run: npx mnci ci release
         name: Release \u2014 version, tag${githubReleases ? ", publish and GitHub Release" : " and publish"} (npm + Python + C# + VS Code)
         if: \${{ ${onMain} }}
         env:
@@ -1978,28 +1737,9 @@ ${npmAuthPreflight(registryKind) ? `
           # tools/vscode-extension.cjs skips the Marketplace with neither.
           VSCE_AUTH: \${{ vars.AZURE_CLIENT_ID != '' && 'entra' || '' }}
           VSCE_PAT: \${{ secrets.VSCE_PAT }}${githubReleases ? `
-          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
-${githubReleases ? `
-      # A releasable Go app (mnci add go-app --release) is versioned by its git
-      # tag, and its per-platform zips are attached to the GitHub Release the step
-      # above just created. Built here, after tagging, with VERSION set to the tag's
-      # version so the binary reports it. A run that released no Go app uploads
-      # nothing, and a workspace without one skips the step.
-      - run: node tools/go-app-release.cjs assets
-        name: Attach the per-platform zips to the GitHub Release (releasable Go apps)
-        if: \${{ ${onMain} && hashFiles('tools/go-app-release.cjs') != '' }}
-        env:
-          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
-` : `
-      # nx release's own git push (release.git.push) is deliberately left off: it
-      # only runs when a remote GitHub/GitLab Release is configured, which this
-      # workflow never does, so it would never push the tag the step above just
-      # created. Pushed explicitly, unconditionally (a no-op when nothing released)
-      # once tagging is guaranteed to have already happened.
-      - run: git push origin --tags
-        name: Push release tags (nx release's own push never runs without a remote Release configured)
-        if: \${{ ${onMain} }}
-`}${nativeApps ? githubNativeJob(npmAuthName, npmAuthValue, onMain) : ""}`;
+          GITHUB_TOKEN: \${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}` : ""}
+${nativeApps ? githubNativeJob(npmAuthName, npmAuthValue) : ""}`;
 }
 var PIP_PROJECT_GLOBS = ["apps", "python-packages", "libs"];
 var PUB_PROJECT_GLOBS = ["apps", "packages", "libs"];
@@ -2235,7 +1975,7 @@ function applyOverlay(workspaceRoot, options, onProgress = () => {
       ...existingDevDeps,
       ...TS_COMPILER_DEPENDENCIES,
       // The preset pins `nx` itself; the ESLint plugins must match it exactly.
-      ...eslintToolchainDependencies(existingDevDeps?.nx ?? "latest")
+      ...mnciToolchainDependencies(existingDevDeps?.nx ?? "latest")
     }),
     LOCAL_REGISTRY_SCAFFOLDING.devDependency
   );
@@ -2366,7 +2106,7 @@ function runNative(workspaceRoot, dependencies = {}) {
   if (built !== 0) {
     return built;
   }
-  if (!isMainPush(environment) || !(0, import_node_fs5.existsSync)((0, import_node_path4.join)(workspaceRoot, "tools", "go-app-release.cjs"))) {
+  if (host !== "github" || !isMainPush(environment) || !(0, import_node_fs5.existsSync)((0, import_node_path4.join)(workspaceRoot, "tools", "go-app-release.cjs"))) {
     return 0;
   }
   return inGroup("Attach this OS's zip to the GitHub Release", "node", ["tools/go-app-release.cjs", "assets", "--native"]);
@@ -2550,14 +2290,22 @@ function runReleaseCommand(workspaceRoot, registry, counts, environment, process
   }
   return processes.run("npx", ["nx", "release", ...extra, "--yes"]);
 }
-function afterRelease(workspaceRoot, processes) {
-  if ((0, import_node_fs7.existsSync)((0, import_node_path6.join)(workspaceRoot, "tools", "go-app-release.cjs"))) {
+function nxPushesTags(workspaceRoot) {
+  try {
+    const nx = JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path6.join)(workspaceRoot, "nx.json"), "utf8"));
+    return nx.release?.git?.push === true;
+  } catch {
+    return false;
+  }
+}
+function afterRelease(workspaceRoot, processes, githubReleases) {
+  if (githubReleases && (0, import_node_fs7.existsSync)((0, import_node_path6.join)(workspaceRoot, "tools", "go-app-release.cjs"))) {
     const assets = processes.run("node", ["tools/go-app-release.cjs", "assets"]);
     if (assets !== 0) {
       return assets;
     }
   }
-  return processes.run("git", ["push", "origin", "--tags"]);
+  return githubReleases ? 0 : processes.run("git", ["push", "origin", "--tags"]);
 }
 async function runRelease(workspaceRoot, dependencies = {}) {
   const environment = dependencies.environment ?? process.env;
@@ -2598,7 +2346,7 @@ async function runRelease(workspaceRoot, dependencies = {}) {
   if (released !== 0) {
     return close(released);
   }
-  return close(afterRelease(workspaceRoot, processes));
+  return close(afterRelease(workspaceRoot, processes, nxPushesTags(workspaceRoot)));
 }
 
 // src/ci-pipeline/setup.use-case.ts
@@ -8517,6 +8265,7 @@ function runUpgrade(workspaceRoot, options) {
   );
   runFormatter(workspaceRoot);
   logger.success("Done. Review the changes with `git diff` before committing.");
+  logger.info("Run `npm install` and commit package-lock.json too: the overlay may have added or moved a dependency, and CI installs with `npm ci`, which refuses a stale lockfile.");
 }
 
 // src/workspace-creation/interactive-wizard.use-case.ts