@smoothbricks/cli 0.1.0 → 0.1.1

package/src/release/npm-auth.ts

@@ -0,0 +1,122 @@
+import type { ReleasePackageInfo } from './core.js';
+
+export interface NpmPublishAuthFailureOptions {
+  useBootstrapToken: boolean;
+  tokenPresent: boolean;
+  repository?: string;
+}
+
+export interface NpmPublishDiagnosticShell {
+  publish(): Promise<void>;
+  versionExists(): Promise<boolean>;
+  log(message: string): void;
+  error(message: string): void;
+  appendSummary(markdown: string): Promise<void>;
+}
+
+export async function publishWithAuthDiagnostics(
+  pkg: Pick<ReleasePackageInfo, 'name' | 'version'>,
+  shell: NpmPublishDiagnosticShell,
+  options: NpmPublishAuthFailureOptions,
+): Promise<void> {
+  try {
+    await shell.publish();
+  } catch (error) {
+    const packageVersion = `${pkg.name}@${pkg.version}`;
+    if (await shell.versionExists()) {
+      shell.log(`${packageVersion}: publish result already visible on npm; continuing.`);
+      return;
+    }
+    shell.error(npmPublishAuthFailureMessage(pkg, options));
+    await shell.appendSummary(npmPublishAuthFailureMarkdown(pkg, options));
+    throw new Error(
+      `${packageVersion}: npm publish authentication failed. Run smoo release trust-publisher after the package exists on npm; see the warning banner above for details.`,
+      { cause: error },
+    );
+  }
+}
+
+export function npmPublishAuthFailureMessage(
+  pkg: Pick<ReleasePackageInfo, 'name' | 'version'>,
+  options: NpmPublishAuthFailureOptions,
+): string {
+  const packageVersion = `${pkg.name}@${pkg.version}`;
+  const lines = [
+    `::error title=npm publish authentication failed::${packageVersion} could not be published. This usually means npm trusted publishing is not configured for this package/workflow/repo, or the bootstrap NPM_TOKEN is missing/invalid.`,
+    '',
+    `🚨 npm publish authentication failed for ${packageVersion}`,
+    '',
+  ];
+  if (options.useBootstrapToken) {
+    lines.push(
+      'smoo expected a temporary npm automation token because this package does not exist on npm yet.',
+      options.tokenPresent
+        ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
+        : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set. Add a temporary NPM_TOKEN repository secret and rerun the Publish workflow.',
+      '',
+      'After the first successful publish, run:',
+      '  smoo release trust-publisher',
+      '',
+      'Then remove the temporary bootstrap token path for future releases.',
+    );
+    return lines.join('\n');
+  }
+
+  lines.push(
+    'smoo expected npm trusted publishing/OIDC because this package already exists on npm.',
+    options.tokenPresent
+      ? 'NODE_AUTH_TOKEN/NPM_TOKEN is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+      : 'NODE_AUTH_TOKEN/NPM_TOKEN is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.',
+    '',
+    'Fix:',
+    '1. Run locally: smoo release trust-publisher',
+    '2. Ensure the npm trusted publisher uses:',
+    `   repository: ${trustedPublisherRepository(options)}`,
+    '   workflow: publish.yml',
+    '3. Rerun the Publish workflow.',
+    '',
+    'For first-ever package publishes, add a temporary NPM_TOKEN repository secret, publish once, then run smoo release trust-publisher.',
+  );
+  return lines.join('\n');
+}
+
+export function npmPublishAuthFailureMarkdown(
+  pkg: Pick<ReleasePackageInfo, 'name' | 'version'>,
+  options: NpmPublishAuthFailureOptions,
+): string {
+  const packageVersion = `${pkg.name}@${pkg.version}`;
+  const lines = ['## 🚨 npm Publish Authentication Failed', '', `Package: \`${packageVersion}\``, ''];
+  if (options.useBootstrapToken) {
+    lines.push(
+      'smoo expected a temporary npm automation token because this package does not exist on npm yet.',
+      '',
+      options.tokenPresent
+        ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set, but npm still rejected the bootstrap publish. Check that the token is valid, has publish rights for this scope, and is available to this workflow.'
+        : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set. Add a temporary `NPM_TOKEN` repository secret and rerun the Publish workflow.',
+      '',
+      'After the first successful publish, run `smoo release trust-publisher`, then remove the temporary bootstrap token path for future releases.',
+    );
+    return lines.join('\n');
+  }
+
+  lines.push(
+    'smoo expected npm trusted publishing/OIDC because this package already exists on npm.',
+    '',
+    options.tokenPresent
+      ? '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is set but unused: smoo intentionally clears token auth for existing packages; npm must authenticate through trusted publishing instead.'
+      : '`NODE_AUTH_TOKEN`/`NPM_TOKEN` is not set, which is expected for trusted publishing; npm did not authenticate the workflow as a trusted publisher.',
+    '',
+    'Fix:',
+    '',
+    '1. Run locally: `smoo release trust-publisher`',
+    `2. Ensure the npm trusted publisher uses repository \`${trustedPublisherRepository(options)}\` and workflow \`publish.yml\``,
+    '3. Rerun the Publish workflow.',
+    '',
+    'For first-ever package publishes, add a temporary `NPM_TOKEN` repository secret, publish once, then run `smoo release trust-publisher`.',
+  );
+  return lines.join('\n');
+}
+
+function trustedPublisherRepository(options: Pick<NpmPublishAuthFailureOptions, 'repository'>): string {
+  return options.repository ?? 'the current GitHub repository';
+}

package/src/release/orchestration.ts

@@ -0,0 +1,186 @@
+import type { ReleasePackageInfo, ReleaseTarget } from './core.js';
+import { planPublishActions } from './publish-plan.js';
+
+export type ReleaseVersionMode = 'new' | 'none';
+
+export interface ReleaseSummary<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  sha: string;
+  dryRun: boolean;
+  packages: Package[];
+  pushed: boolean;
+  published: Package[];
+  alreadyPublished: Package[];
+  githubReleases: Package[];
+  rerunRequired: boolean;
+  noRelease: boolean;
+}
+
+export interface ReleaseCompletionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  gitHead(): Promise<string>;
+  pushReleaseRefs(packages: Package[]): Promise<boolean>;
+  listNpmMissingPackages(packages: Package[]): Promise<Package[]>;
+  buildReleaseCandidate(packages: Package[]): Promise<void>;
+  publishPackage(pkg: Package, distTag: string, dryRun: boolean): Promise<void>;
+  listGithubMissingPackages(packages: Package[]): Promise<Package[]>;
+  createGithubRelease(pkg: Package, dryRun: boolean): Promise<void>;
+}
+
+export interface ReleaseRepairShell<Package extends ReleasePackageInfo = ReleasePackageInfo>
+  extends ReleaseCompletionShell<Package> {
+  checkout(ref: string): Promise<void>;
+  withDevenvEnv<T>(runWithEnv: () => Promise<T>): Promise<T>;
+  beforeRepairTarget?(target: ReleaseTarget<Package>): void;
+  afterRepairTarget?(target: ReleaseTarget<Package>): void;
+}
+
+export interface ReleaseVersionShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  releasePackagesAtHead(): Promise<Package[]>;
+  ensureLocalReleaseTags(packages: Package[]): Promise<void>;
+  gitHead(): Promise<string>;
+  runNxReleaseVersion(bump: string, dryRun: boolean): Promise<void>;
+  assertCleanGitTree(): Promise<void>;
+}
+
+export interface ReleaseVersionResult<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  mode: ReleaseVersionMode;
+  packages: Package[];
+  status: 'already-release-target' | 'dry-run' | 'new-release' | 'no-release-needed';
+}
+
+export async function runReleaseVersion<Package extends ReleasePackageInfo>(
+  shell: ReleaseVersionShell<Package>,
+  options: { bump: string; dryRun: boolean },
+): Promise<ReleaseVersionResult<Package>> {
+  if (!options.dryRun) {
+    const localRelease = await shell.releasePackagesAtHead();
+    if (localRelease.length > 0) {
+      await shell.ensureLocalReleaseTags(localRelease);
+      return { mode: 'none', packages: localRelease, status: 'already-release-target' };
+    }
+  }
+
+  const headBeforeVersioning = await shell.gitHead();
+  await shell.runNxReleaseVersion(options.bump, options.dryRun);
+  if (options.dryRun) {
+    return { mode: 'none', packages: [], status: 'dry-run' };
+  }
+
+  await shell.assertCleanGitTree();
+  const headAfterVersioning = await shell.gitHead();
+  const releasedPackages = await shell.releasePackagesAtHead();
+  await shell.ensureLocalReleaseTags(releasedPackages);
+  if (headAfterVersioning === headBeforeVersioning) {
+    if (releasedPackages.length > 0) {
+      return { mode: 'none', packages: releasedPackages, status: 'already-release-target' };
+    }
+    if (options.bump !== 'auto') {
+      throw new Error(`Nx did not create a release commit for forced --bump ${options.bump}.`);
+    }
+    return { mode: 'none', packages: [], status: 'no-release-needed' };
+  }
+  if (releasedPackages.length === 0) {
+    throw new Error('Nx created a release commit without current package release tags at HEAD.');
+  }
+  return { mode: 'new', packages: releasedPackages, status: 'new-release' };
+}
+
+export async function completeReleaseAtHead<Package extends ReleasePackageInfo>(
+  shell: ReleaseCompletionShell<Package>,
+  packages: Package[],
+  dryRun: boolean,
+  rerunRequired: boolean,
+): Promise<ReleaseSummary<Package>> {
+  const npmMissingPackages = await shell.listNpmMissingPackages(packages);
+  const githubMissingPackages = dryRun ? packages : await shell.listGithubMissingPackages(packages);
+  return completePlannedRelease(shell, {
+    sha: await shell.gitHead(),
+    dryRun,
+    packages,
+    pushed: dryRun ? false : await shell.pushReleaseRefs(packages),
+    npmMissingPackages,
+    githubMissingPackages,
+    rerunRequired,
+  });
+}
+
+export async function repairPendingTargets<Package extends ReleasePackageInfo>(
+  shell: ReleaseRepairShell<Package>,
+  targets: Array<ReleaseTarget<Package>>,
+  restoreRef: string,
+  dryRun: boolean,
+): Promise<Array<ReleaseSummary<Package>>> {
+  const summaries: Array<ReleaseSummary<Package>> = [];
+  try {
+    for (const target of targets) {
+      await shell.checkout(target.sha);
+      if (target.packages.length === 0) {
+        throw new Error(`Release commit ${target.sha} has no release packages after checkout.`);
+      }
+      shell.beforeRepairTarget?.(target);
+      try {
+        summaries.push(await shell.withDevenvEnv(() => completeRepairTargetAtHead(shell, target, dryRun)));
+      } finally {
+        shell.afterRepairTarget?.(target);
+      }
+    }
+  } finally {
+    await shell.checkout(restoreRef);
+  }
+  return summaries;
+}
+
+export async function completeRepairTargetAtHead<Package extends ReleasePackageInfo>(
+  shell: ReleaseCompletionShell<Package>,
+  target: ReleaseTarget<Package>,
+  dryRun: boolean,
+): Promise<ReleaseSummary<Package>> {
+  return completePlannedRelease(shell, {
+    sha: await shell.gitHead(),
+    dryRun,
+    packages: target.packages,
+    pushed: dryRun ? false : await shell.pushReleaseRefs(target.packages),
+    npmMissingPackages: target.npmPackages,
+    githubMissingPackages: target.githubPackages,
+    rerunRequired: false,
+  });
+}
+
+async function completePlannedRelease<Package extends ReleasePackageInfo>(
+  shell: ReleaseCompletionShell<Package>,
+  input: {
+    sha: string;
+    dryRun: boolean;
+    packages: Package[];
+    pushed: boolean;
+    npmMissingPackages: Package[];
+    githubMissingPackages: Package[];
+    rerunRequired: boolean;
+  },
+): Promise<ReleaseSummary<Package>> {
+  const plan = planPublishActions({
+    releasePackages: input.packages,
+    npmMissingPackages: input.npmMissingPackages,
+    githubMissingPackages: input.githubMissingPackages,
+  });
+  if (plan.buildProjects.length > 0) {
+    await shell.buildReleaseCandidate(plan.publishPackages.map((action) => action.pkg));
+  }
+  for (const { pkg, distTag } of plan.publishPackages) {
+    await shell.publishPackage(pkg, distTag, input.dryRun);
+  }
+  for (const pkg of plan.githubReleasePackages) {
+    await shell.createGithubRelease(pkg, input.dryRun);
+  }
+
+  return {
+    sha: input.sha,
+    dryRun: input.dryRun,
+    packages: input.packages,
+    pushed: input.pushed,
+    published: input.dryRun ? [] : plan.publishPackages.map((action) => action.pkg),
+    alreadyPublished: input.packages.filter((pkg) => !input.npmMissingPackages.includes(pkg)),
+    githubReleases: input.dryRun ? [] : plan.githubReleasePackages,
+    rerunRequired: input.rerunRequired,
+    noRelease: false,
+  };
+}

package/src/release/publish-plan.ts

@@ -0,0 +1,37 @@
+import { npmDistTagForVersion, type ReleasePackageInfo } from './core.js';
+
+export interface PublishPackageAction<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  pkg: Package;
+  distTag: string;
+}
+
+export interface PublishPlan<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  buildProjects: string[];
+  publishPackages: Array<PublishPackageAction<Package>>;
+  githubReleasePackages: Package[];
+}
+
+export interface PublishPlanInput<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  releasePackages: Package[];
+  npmMissingPackages: Package[];
+  githubMissingPackages: Package[];
+}
+
+export function planPublishActions<Package extends ReleasePackageInfo>(
+  input: PublishPlanInput<Package>,
+): PublishPlan<Package> {
+  const npmMissingNames = packageNameSet(input.npmMissingPackages);
+  const githubMissingNames = packageNameSet(input.githubMissingPackages);
+  const npmPackages = input.releasePackages.filter((pkg) => npmMissingNames.has(pkg.name));
+  const githubReleasePackages = input.releasePackages.filter((pkg) => githubMissingNames.has(pkg.name));
+
+  return {
+    buildProjects: npmPackages.map((pkg) => pkg.name),
+    publishPackages: npmPackages.map((pkg) => ({ pkg, distTag: npmDistTagForVersion(pkg.version) })),
+    githubReleasePackages,
+  };
+}
+
+function packageNameSet(packages: ReleasePackageInfo[]): Set<string> {
+  return new Set(packages.map((pkg) => pkg.name));
+}

package/src/release/retag-unpublished.ts

@@ -0,0 +1,122 @@
+import { type ReleasePackageInfo, releasePackageForTag } from './core.js';
+
+export interface RetagUnpublishedOptions {
+  tags: string[];
+  toRef: string;
+  push: boolean;
+  dispatch: boolean;
+  dryRun: boolean;
+  branch: string;
+  workflow: string;
+}
+
+export interface RetagUnpublishedTagUpdate<Package extends ReleasePackageInfo = ReleasePackageInfo> {
+  tag: string;
+  pkg: Package;
+  expectedRemoteObject: string | null;
+}
+
+export interface RetagUnpublishedShell<Package extends Omit<ReleasePackageInfo, 'version'> = ReleasePackageInfo> {
+  listReleasePackages(): Package[];
+  resolveRef(ref: string): Promise<string>;
+  resolveDispatchRef(branch: string): Promise<string | null>;
+  packageVersionAtRef(packagePath: string, ref: string): Promise<string | null>;
+  npmVersionExists(name: string, version: string): Promise<boolean>;
+  githubReleaseExists(tag: string): Promise<boolean>;
+  remoteTagObject(tag: string): Promise<string | null>;
+  createOrMoveTag(tag: string, ref: string): Promise<void>;
+  pushTags(updates: Array<RetagUnpublishedTagUpdate<Package & { version: string }>>): Promise<void>;
+  dispatchPublishWorkflow(workflow: string, branch: string): Promise<void>;
+  log(message: string): void;
+}
+
+export async function retagUnpublished<Package extends Omit<ReleasePackageInfo, 'version'>>(
+  shell: RetagUnpublishedShell<Package>,
+  options: RetagUnpublishedOptions,
+): Promise<Array<RetagUnpublishedTagUpdate<Package & { version: string }>>> {
+  if (options.tags.length === 0) {
+    throw new Error('retag-unpublished requires at least one release tag.');
+  }
+  assertUniqueTags(options.tags);
+
+  const targetSha = await shell.resolveRef(options.toRef);
+  if (options.dispatch) {
+    const dispatchSha = await shell.resolveDispatchRef(options.branch);
+    if (!dispatchSha) {
+      throw new Error(`Cannot dispatch ${options.workflow}: remote branch ${options.branch} was not found.`);
+    }
+    if (dispatchSha !== targetSha) {
+      throw new Error(
+        `Cannot dispatch ${options.workflow}: ${options.toRef} resolves to ${targetSha.slice(0, 12)}, but ${
+          options.branch
+        } resolves to ${dispatchSha.slice(0, 12)}. Push the branch first or choose a ref already at the remote branch HEAD.`,
+      );
+    }
+  }
+
+  const packages = shell.listReleasePackages();
+  const updates: Array<RetagUnpublishedTagUpdate<Package & { version: string }>> = [];
+  for (const tag of options.tags) {
+    const match = releasePackageForTag(packages, tag);
+    if (!match) {
+      throw new Error(`Release tag ${tag} does not match an owned release package.`);
+    }
+    const versionAtRef = await shell.packageVersionAtRef(match.pkg.path, options.toRef);
+    if (versionAtRef !== match.version) {
+      throw new Error(
+        `Release tag ${tag} cannot move to ${options.toRef}: ${match.pkg.path}/package.json has version ${
+          versionAtRef ?? 'missing'
+        }, expected ${match.version}.`,
+      );
+    }
+    if (await shell.npmVersionExists(match.pkg.name, match.version)) {
+      throw new Error(`Cannot retag ${tag}: ${match.pkg.name}@${match.version} already exists on npm.`);
+    }
+    if (await shell.githubReleaseExists(tag)) {
+      throw new Error(`Cannot retag ${tag}: GitHub Release ${tag} already exists.`);
+    }
+
+    updates.push({
+      tag,
+      pkg: { ...match.pkg, version: match.version },
+      expectedRemoteObject: options.push ? await shell.remoteTagObject(tag) : null,
+    });
+  }
+
+  for (const update of updates) {
+    if (options.dryRun) {
+      shell.log(`Would move ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+    } else {
+      await shell.createOrMoveTag(update.tag, options.toRef);
+      shell.log(`Moved ${update.tag} to ${options.toRef} (${targetSha.slice(0, 12)}).`);
+    }
+  }
+  if (options.push) {
+    if (options.dryRun) {
+      shell.log(`Would push ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+    } else {
+      await shell.pushTags(updates);
+      shell.log(`Pushed ${updates.length} retagged release tag${updates.length === 1 ? '' : 's'}.`);
+    }
+  }
+  if (options.dispatch) {
+    if (options.dryRun) {
+      shell.log(`Would dispatch ${options.workflow} on ${options.branch} with bump=auto.`);
+    } else {
+      await shell.dispatchPublishWorkflow(options.workflow, options.branch);
+      shell.log(`Dispatched ${options.workflow} on ${options.branch} with bump=auto.`);
+    }
+  }
+
+  return updates;
+}
+
+function assertUniqueTags(tags: string[]): void {
+  const seen = new Set<string>();
+  for (const tag of tags) {
+    if (seen.has(tag)) {
+      throw new Error(`Release tag ${tag} was provided more than once.`);
+    }
+    seen.add(tag);
+  }
+}

package/managed/templates/github/workflows/publish.yml

@@ -1,136 +0,0 @@
-name: Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      bump:
-        type: choice
-        description:
-          Use auto for conventional commits, or force a semver bump. Prerelease publishes to next; all others publish to
-          latest.
-        options: [auto, patch, minor, major, prerelease]
-        default: auto
-      dry_run:
-        type: boolean
-        description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
-        default: false
-
-permissions:
-  contents: write
-  id-token: write
-
-concurrency:
-  group: release-${{ github.ref }}
-  cancel-in-progress: false
-
-defaults:
-  run:
-    working-directory: tooling/direnv
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    env:
-      NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      # --- Setup --------------------------------------------------------------
-
-      # Step 1: GitHub adds "Set up job" automatically
-      # Step 2
-      - name: 📥 Checkout
-        uses: actions/checkout@v6.0.2
-        with:
-          filter: blob:none
-          fetch-depth: 0
-
-      # Step 3. Composite action internals do not affect top-level job step
-      # anchors; update these comments if top-level steps move.
-      - name: 🧱 Setup Nix/devenv
-        id: setup
-        uses: ./.github/actions/setup-devenv
-
-      # --- Validation ---------------------------------------------------------
-
-      # Release validation intentionally does not restore persisted Nx task
-      # cache. Nx may reuse tasks produced earlier in this same job, but publish
-      # never relies on task outputs restored from CI cache.
-
-      # Step 4
-      - name: ✅ Check managed monorepo files
-        run: smoo monorepo check
-
-      # Step 5
-      - name: 📦 Resolve release projects
-        id: projects
-        run: echo "projects=$(smoo monorepo list-public-projects)" >> "$GITHUB_OUTPUT"
-
-      # Step 6
-      - name: 🔨 Build
-        run: smoo github-ci nx-run-many --targets build --projects "${{ steps.projects.outputs.projects }}"
-
-      # Step 7
-      - name: 🔍 Lint
-        run: smoo github-ci nx-run-many --targets lint --projects "${{ steps.projects.outputs.projects }}"
-
-      # Step 8
-      - name: 🧪 Unit Tests
-        run: smoo github-ci nx-run-many --targets test --projects "${{ steps.projects.outputs.projects }}"
-
-      # Step 9
-      - name: 📎 Upload trace DBs
-        if: ${{ failure() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: trace-results-${{ github.run_id }}
-          path: packages/*/.trace-results.db
-          if-no-files-found: ignore
-          retention-days: 14
-          include-hidden-files: true
-
-      # Step 10
-      - name: ✅ Validate monorepo config
-        run: smoo monorepo validate
-
-      # --- Release ------------------------------------------------------------
-
-      # Step 11
-      - name: 🤖 Configure release author
-        run:
-          git config user.name "github-actions[bot]" && git config user.email
-          "41898282+github-actions[bot]@users.noreply.github.com"
-
-      # Step 12
-      - name: 🏷️ Version, tag, and push packages
-        run: smoo release version --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"
-
-      # Step 13
-      - name: 🔖 Collect release tags
-        id: tags
-        run: echo "tags=$(git tag --points-at HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
-
-      # Step 14
-      - name: 📦 Publish packages
-        # smoo packs with Bun, then publishes tarballs with npm. npm uses OIDC
-        # trusted publishing when configured; NODE_AUTH_TOKEN is only a temporary
-        # bootstrap fallback before packages have trusted publishers.
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"
-
-      # Step 15
-      - name: 🚀 Create or update GitHub Releases
-        if: ${{ inputs.dry_run != true }}
-        run:
-          smoo release github-release --tags "${{ steps.tags.outputs.tags }}" --bump "${{ inputs.bump }}" --dry-run "${{
-          inputs.dry_run }}"
-
-      # --- Cleanup ------------------------------------------------------------
-
-      # Step 16
-      - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
-        uses: ./.github/actions/save-nix-devenv
-        with:
-          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
-          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}