@smoothbricks/cli 0.10.1 → 0.10.3

package/src/monorepo/package-policy.ts

@@ -371,6 +371,7 @@ export function validatePublicPackageMetadata(root: string): number {
 
 export function validateWorkspaceDependencies(root: string, options: PackageTargetPolicyOptions = {}): number {
   let failures = 0;
+  failures += validateCiSkipTags(root, options);
   const workspaceNames = new Set(getWorkspacePackages(root).map((pkg) => pkg.name));
   for (const pkg of listPackageJsonRecords(root)) {
     for (const field of workspaceDependencyFields) {
@@ -404,6 +405,33 @@ export function validateWorkspaceDependencies(root: string, options: PackageTarg
   return failures;
 }
 
+const ciSkipTagPrefix = 'ci:skip:';
+const invalidCiSkipTargetSyntax = /[,*?[\]{}]/;
+
+function validateCiSkipTags(root: string, options: PackageTargetPolicyOptions): number {
+  let failures = 0;
+  for (const pkg of getWorkspacePackages(root)) {
+    const resolved = options.resolvedTargetsByProject?.get(pkg.projectName);
+    const resolvedTargets = resolved && 'targets' in resolved ? resolved.targets : resolved;
+    for (const tag of pkg.tags) {
+      if (tag !== 'ci:skip' && !tag.startsWith(ciSkipTagPrefix)) {
+        continue;
+      }
+      const target = tag.startsWith(ciSkipTagPrefix) ? tag.slice(ciSkipTagPrefix.length) : '';
+      if (!target || invalidCiSkipTargetSyntax.test(target)) {
+        console.error(`${pkg.path}: nx tag ${tag} must use ci:skip:<target> with one exact Nx target name`);
+        failures++;
+        continue;
+      }
+      if (resolvedTargets && !resolvedTargets.has(target)) {
+        console.error(`${pkg.path}: nx tag ${tag} names missing Nx target ${target}`);
+        failures++;
+      }
+    }
+  }
+  return failures;
+}
+
 // ---------------------------------------------------------------------------
 // Helpers kept in CLI (not Nx-specific)
 // ---------------------------------------------------------------------------

package/src/monorepo/packs/index.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'bun:test';
 import type { MonorepoPack } from './index.js';
-import { runValidatePacks } from './index.js';
+import { resolvedTargetsByProject, runValidatePacks } from './index.js';
 
 const ctx = { root: '/workspace', syncRuntime: false };
 
@@ -186,4 +186,21 @@ describe('monorepo validation pack phases', () => {
     expect(result).toEqual({ failures: 1, failedChecks: 1 });
     expect(events).toEqual(['pre-fix', 'build']);
   });
+
+  it('propagates parsed target dependencies through the production adapter', () => {
+    const targetDependencies = new Map([
+      ['build', ['compile-linux']],
+      ['compile-linux', ['package-linux']],
+    ]);
+
+    const resolved = resolvedTargetsByProject([
+      {
+        project: 'native',
+        targets: ['build', 'compile-linux', 'package-linux'],
+        targetDependencies,
+      },
+    ]);
+
+    expect(resolved.get('native')?.targetDependencies).toBe(targetDependencies);
+  });
 });

package/src/monorepo/packs/index.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
-import { readProjectTargets } from '../../nx/index.js';
+import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateManagedFiles } from '../managed-files.js';
 import { fixNxSync, validateNxSync } from '../nx-sync.js';
@@ -400,14 +400,14 @@ function printCapturedOutput(output: CapturedOutput): void {
   }
 }
 
-async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<string, ResolvedProjectTargets>> {
-  const projects = await readProjectTargets(ctx.root);
+export function resolvedTargetsByProject(projects: ProjectTargets[]): Map<string, ResolvedProjectTargets> {
   return new Map(
     projects.map((project) => [
       project.project,
       {
         targets: new Set(project.targets),
         ...(project.buildDependsOn ? { buildDependsOn: project.buildDependsOn } : {}),
+        ...(project.targetDependencies ? { targetDependencies: project.targetDependencies } : {}),
         ...(project.targetExecutors ? { targetExecutors: project.targetExecutors } : {}),
         ...(project.targetScripts ? { targetScripts: project.targetScripts } : {}),
       },
@@ -415,6 +415,10 @@ async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<s
   );
 }
 
+async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<string, ResolvedProjectTargets>> {
+  return resolvedTargetsByProject(await readProjectTargets(ctx.root));
+}
+
 function ensureLocalSmooShim(root: string): void {
   const shim = join(root, 'tooling', 'smoo');
   if (!existsSync(shim)) {

package/src/monorepo/publish-workflow.ts

@@ -1,5 +1,19 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+
+import synchronizedPrettier from '@prettier/sync';
+import {
+  LINUX_PLATFORM_TARGET_GLOBS,
+  MACOS_PLATFORM_TARGET_GLOBS,
+} from '@smoothbricks/nx-plugin/workspace-config-policy';
+import type { Options as PrettierOptions } from 'prettier';
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 
+const PUBLISH_WORKFLOW_FORMAT_OPTIONS = Object.freeze({
+  parser: 'yaml',
+  printWidth: 120,
+  proseWrap: 'always',
+} satisfies PrettierOptions);
+
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
 export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
@@ -40,6 +54,7 @@ export interface PublishWorkflowDefinitionOptions {
   deploy?: boolean;
   deployProvider?: 'cloudflare';
   repoName?: string;
+  platformTargetGlobs?: readonly string[];
 }
 
 export interface PublishWorkflowInputs {
@@ -254,8 +269,19 @@ function shouldRunStep(
 }
 
 export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOptions = {}): string {
-  const steps = definePublishWorkflow(options).steps;
-  return `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
+  let workflow: string;
+  if (hasMacosPlatformTargets(options)) {
+    workflow = renderPlatformPublishWorkflowYaml(options);
+  } else if (hasLinuxPlatformTargets(options)) {
+    workflow = `${renderPublishWorkflowHeader(options)}${renderSingleJobPublishWorkflowSteps(
+      definePublishWorkflow(options).steps,
+      options,
+    )}`;
+  } else {
+    const steps = definePublishWorkflow(options).steps;
+    workflow = `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
+  }
+  return synchronizedPrettier.format(workflow, PUBLISH_WORKFLOW_FORMAT_OPTIONS);
 }
 
 function renderPublishWorkflowHeader(options: PublishWorkflowDefinitionOptions): string {
@@ -473,6 +499,459 @@ function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
   return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
 }
 
+function renderSingleJobPublishWorkflowSteps(
+  steps: PublishWorkflowStep[],
+  options: PublishWorkflowDefinitionOptions,
+): string {
+  const lines: string[] = [];
+  for (const step of steps) {
+    lines.push(...sectionLinesBefore(step));
+    lines.push(...commentLinesForStep(step));
+    lines.push(...yamlLinesForStep(step, options));
+    lines.push('');
+    if (step.kind === PublishWorkflowStepKind.Build) {
+      lines.push(
+        '      - name: 🐧 Build supplemental Linux targets',
+        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression(
+          'steps.version.outputs.projects',
+        )}"`,
+        '',
+      );
+    }
+  }
+  return `${lines.join('\n').trimEnd()}\n`;
+}
+
+function renderPlatformPublishWorkflowYaml(options: PublishWorkflowDefinitionOptions): string {
+  const deployInput =
+    options.deploy === true
+      ? `
+      deploy_environment:
+        type: choice
+        description: Deploy live systems after a successful publish.
+        options: [none, production]
+        default: none`
+      : '';
+  const steps = definePublishWorkflow(options).steps;
+  return `name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        type: choice
+        description:
+          Use auto for conventional commits, or force a semver bump. Prerelease publishes to next; all others publish to
+          latest.
+        options: [auto, patch, minor, major, prerelease]
+        default: auto
+      dry_run:
+        type: boolean
+        description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
+        default: false${deployInput}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${githubExpression('github.ref')}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: tooling/direnv
+
+jobs:
+  linux-release-candidate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: none
+    outputs:
+      mode: ${githubExpression('steps.version.outputs.mode')}
+      release-sha: ${githubExpression('steps.release-state.outputs.sha')}
+    env:
+      NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
+      GH_TOKEN: ${githubExpression('github.token')}
+    steps:
+${renderLinuxReleaseCandidateSteps(steps, options)}
+
+  macos-platform:
+    runs-on: macos-latest
+    permissions:
+      contents: read
+      id-token: none
+    env:
+      NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
+      GH_TOKEN: ${githubExpression('github.token')}
+    steps:
+${renderMacosPlatformSteps(options)}
+
+  publish-on-linux:
+    needs: [linux-release-candidate, macos-platform]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
+      GH_TOKEN: ${githubExpression('github.token')}
+    steps:
+${renderFinalLinuxPublishSteps(options)}
+`;
+}
+
+function renderLinuxReleaseCandidateSteps(
+  steps: PublishWorkflowStep[],
+  options: PublishWorkflowDefinitionOptions,
+): string {
+  const lines: string[] = [];
+  let stepNumber = 2;
+  for (const step of steps) {
+    if (
+      step.kind === PublishWorkflowStepKind.RepairPendingReleases ||
+      step.kind === PublishWorkflowStepKind.PublishRelease ||
+      step.kind === PublishWorkflowStepKind.DeployProduction ||
+      step.kind === PublishWorkflowStepKind.SaveNixDevenv
+    ) {
+      continue;
+    }
+    lines.push(...sectionLinesBefore(step));
+    if (step.kind === PublishWorkflowStepKind.Checkout) {
+      lines.push('      # Step 1: GitHub adds "Set up job" automatically', `      # Step ${stepNumber}`);
+    } else if (step.kind === PublishWorkflowStepKind.SetupDevenv) {
+      lines.push(
+        `      # Step ${stepNumber}. Composite action internals do not affect top-level job step`,
+        '      # anchors; update these comments if top-level steps move.',
+      );
+    } else {
+      lines.push(`      # Step ${stepNumber}`);
+    }
+    if (step.kind === PublishWorkflowStepKind.Checkout) {
+      lines.push(
+        `      - name: ${step.name}`,
+        '        uses: actions/checkout@v6.0.2',
+        '        with:',
+        `          ref: ${githubExpression('github.sha')}`,
+        '          filter: blob:none',
+        '          fetch-depth: 0',
+      );
+    } else if (step.kind === PublishWorkflowStepKind.Build) {
+      lines.push(
+        `      - name: ${step.name}`,
+        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        '        run:',
+        `          smoo github-ci nx-run-many --targets build --projects "${githubExpression(
+          'steps.version.outputs.projects',
+        )}" --collect-outputs "${githubExpression('runner.temp')}/release-build-outputs"`,
+      );
+    } else {
+      lines.push(...yamlLinesForStep(step, options));
+    }
+    stepNumber += 1;
+    if (step.kind === PublishWorkflowStepKind.VersionRelease) {
+      lines.push(
+        '',
+        `      # Step ${stepNumber}`,
+        '      - name: 🔒 Capture candidate release SHA',
+        '        id: release-state',
+        '        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"',
+      );
+      stepNumber += 1;
+    }
+    if (step.kind === PublishWorkflowStepKind.Build && hasLinuxPlatformTargets(options)) {
+      lines.push(
+        '',
+        `      # Step ${stepNumber}`,
+        '      - name: 🐧 Build supplemental Linux targets',
+        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        '        run:',
+        `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(
+          ',',
+        )}" --projects "${githubExpression(
+          'steps.version.outputs.projects',
+        )}" --collect-outputs "${githubExpression('runner.temp')}/linux-platform-outputs"`,
+      );
+      stepNumber += 1;
+    }
+    lines.push('');
+  }
+  lines.push(
+    '      # --- Candidate transfer --------------------------------------------------',
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📦 Bundle validated release state',
+    '        run:',
+    `          mkdir -p "${githubExpression('runner.temp')}/publish-release-state" && git bundle create`,
+    `          "${githubExpression('runner.temp')}/publish-release-state/release-state.bundle" HEAD --tags && git rev-parse HEAD >`,
+    `          "${githubExpression('runner.temp')}/publish-release-state/release-head"`,
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📤 Upload validated release state',
+    '        uses: actions/upload-artifact@v7.0.1',
+    '        with:',
+    `          name: publish-release-state-${githubExpression('github.run_id')}`,
+    `          path: ${githubExpression('runner.temp')}/publish-release-state`,
+    '          if-no-files-found: error',
+    '          retention-days: 1',
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📤 Upload validated build outputs',
+    `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+    '        uses: actions/upload-artifact@v7.0.1',
+    '        with:',
+    `          name: publish-release-outputs-${githubExpression('github.run_id')}`,
+    `          path: ${githubExpression('runner.temp')}/release-build-outputs`,
+    '          if-no-files-found: error',
+    '          retention-days: 1',
+    '          include-hidden-files: true',
+  );
+  if (hasLinuxPlatformTargets(options)) {
+    lines.push(
+      '',
+      `      # Step ${stepNumber++}`,
+      '      - name: 📤 Upload supplemental Linux outputs',
+      `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+      '        uses: actions/upload-artifact@v7.0.1',
+      '        with:',
+      `          name: publish-linux-outputs-${githubExpression('github.run_id')}`,
+      `          path: ${githubExpression('runner.temp')}/linux-platform-outputs`,
+      '          if-no-files-found: error',
+      '          retention-days: 1',
+      '          include-hidden-files: true',
+    );
+  }
+  lines.push(
+    '',
+    '      # --- Cleanup ------------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber}`,
+    '      - name: 🧹 Cleanup and cache Nix/devenv',
+    `        if: ${githubExpression('always()')}`,
+    '        uses: ./.github/actions/save-nix-devenv',
+    '        with:',
+    `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
+    `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`,
+  );
+  return lines.join('\n').trimEnd();
+}
+
+function renderMacosPlatformSteps(options: PublishWorkflowDefinitionOptions): string {
+  let stepNumber = 4;
+  const lines = [
+    '      # --- Setup --------------------------------------------------------------',
+    '',
+    '      # Step 1: GitHub adds "Set up job" automatically',
+    '      # Step 2',
+    '      - name: 📥 Checkout dispatch commit',
+    '        uses: actions/checkout@v6.0.2',
+    '        with:',
+    `          ref: ${githubExpression('github.sha')}`,
+    '          filter: blob:none',
+    '          fetch-depth: 0',
+    '',
+    '      # Step 3. Composite action internals do not affect top-level job step',
+    '      # anchors; update these comments if top-level steps move.',
+    '      - name: 🧱 Setup Nix/devenv',
+    '        id: setup',
+    '        uses: ./.github/actions/setup-devenv',
+  ];
+  if (isSmoothBricksCodebasePackageName(options.repoName)) {
+    lines.push(
+      '',
+      `      # Step ${stepNumber++}`,
+      '      - name: 🏗️ Build self-hosted smoo',
+      '        # SmoothBricks self-hosts smoo from source for release commands.',
+      '        run: nx build cli',
+    );
+  }
+  lines.push(
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 🍎 Build selected macOS and iOS release outputs',
+    '        run:',
+    `          smoo release build-platform-outputs --bump "${githubExpression(
+      'inputs.bump',
+    )}" --ref "${githubExpression('github.sha')}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}" --output`,
+    `          "${githubExpression('runner.temp')}/macos-platform-outputs"`,
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📤 Upload macOS platform outputs',
+    '        uses: actions/upload-artifact@v7.0.1',
+    '        with:',
+    `          name: publish-macos-outputs-${githubExpression('github.run_id')}`,
+    `          path: ${githubExpression('runner.temp')}/macos-platform-outputs`,
+    '          if-no-files-found: error',
+    '          retention-days: 1',
+    '          include-hidden-files: true',
+    '',
+    '      # --- Cleanup ------------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber}`,
+    '      - name: 🧹 Cleanup and cache Nix/devenv',
+    `        if: ${githubExpression('always()')}`,
+    '        uses: ./.github/actions/save-nix-devenv',
+    '        with:',
+    `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
+    `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`,
+  );
+  return lines.join('\n').trimEnd();
+}
+
+function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions): string {
+  const mode = 'needs.linux-release-candidate.outputs.mode';
+  let stepNumber = 2;
+  const lines = [
+    '      # --- Setup --------------------------------------------------------------',
+    '',
+    '      # Step 1: GitHub adds "Set up job" automatically',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📥 Checkout dispatch commit',
+    '        uses: actions/checkout@v6.0.2',
+    '        with:',
+    `          ref: ${githubExpression('github.sha')}`,
+    '          filter: blob:none',
+    '          fetch-depth: 0',
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📥 Download candidate artifacts',
+    '        uses: actions/download-artifact@v8.0.1',
+    '        with:',
+    `          pattern: publish-*-${githubExpression('github.run_id')}`,
+    `          path: ${githubExpression('runner.temp')}/publish-artifacts`,
+    '          merge-multiple: false',
+    '',
+    `      # Step ${stepNumber}. Composite action internals do not affect top-level job step`,
+    '      # anchors; update these comments if top-level steps move.',
+    '      - name: 🧱 Setup Nix/devenv',
+    '        id: setup',
+    '        uses: ./.github/actions/setup-devenv',
+    '',
+    `      # Step ${++stepNumber}`,
+    '      - name: 🤖 Configure release author',
+    '        run:',
+    '          git config user.name "github-actions[bot]" && git config user.email',
+    '          "41898282+github-actions[bot]@users.noreply.github.com"',
+  ];
+  stepNumber += 1;
+  if (isSmoothBricksCodebasePackageName(options.repoName)) {
+    lines.push(
+      '',
+      `      # Step ${stepNumber++}`,
+      '      - name: 🏗️ Build self-hosted smoo',
+      '        # SmoothBricks self-hosts smoo from source for release commands.',
+      '        run: nx build cli',
+    );
+  }
+  lines.push(
+    '',
+    '      # --- Repair -------------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 🧯 Repair pending releases',
+    '        run:',
+    `          smoo release repair-pending --ref "${githubExpression(
+      'github.sha',
+    )}" --platform-outputs "${githubExpression(
+      'runner.temp',
+    )}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/repairs" --dry-run`,
+    `          "${githubExpression('inputs.dry_run')}"`,
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: ♻️ Restore validated release state',
+    '        run:',
+    `          git fetch "${githubExpression(
+      'runner.temp',
+    )}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-state.bundle" HEAD --tags && git reset`,
+    `          --hard "$(cat "${githubExpression(
+      'runner.temp',
+    )}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-head")"`,
+  );
+  lines.push(
+    '',
+    '      # --- Validation ---------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 📦 Apply verified Linux outputs',
+    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    '        run:',
+    `          smoo github-ci apply-outputs --source-sha "${githubExpression(
+      'needs.linux-release-candidate.outputs.release-sha',
+    )}"`,
+    `          "${githubExpression('runner.temp')}/publish-artifacts/publish-release-outputs-${githubExpression(
+      'github.run_id',
+    )}"`,
+  );
+  if (hasLinuxPlatformTargets(options)) {
+    lines.push(
+      `          "${githubExpression('runner.temp')}/publish-artifacts/publish-linux-outputs-${githubExpression(
+        'github.run_id',
+      )}"`,
+    );
+  }
+  lines.push(
+    '',
+    `      # Step ${stepNumber++}`,
+    '      - name: 🍎 Apply verified macOS outputs',
+    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    '        run:',
+    `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`,
+    `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression(
+      'github.run_id',
+    )}/current"`,
+    '',
+    `      # Step ${stepNumber++}`,
+    `      - name: ✅ Validate restored release (${githubExpression(mode)})`,
+    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    '        run: smoo monorepo validate',
+    '',
+    '      # --- Release ------------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber++}`,
+    `      - name: 📦 Publish release (${githubExpression(mode)})`,
+    '        # smoo packs with Bun, then publishes tarballs with npm. Existing',
+    '        # packages must already exist on npm and use trusted publishing/OIDC.',
+    '        # Missing package names are bootstrapped locally before trust setup.',
+    `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression(
+      'inputs.dry_run',
+    )}"`,
+  );
+  if (options.deploy === true) {
+    lines.push(
+      '',
+      `      # Step ${stepNumber++}`,
+      '      - name: 🚀 Deploy production',
+      '        if:',
+      "          ${{ needs.linux-release-candidate.outputs.mode != 'none' && inputs.deploy_environment == 'production' &&",
+      "          inputs.dry_run != 'true' }}",
+      ...deployEnvLines(options),
+      '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+    );
+  }
+  lines.push(
+    '',
+    '      # --- Cleanup ------------------------------------------------------------',
+    '',
+    `      # Step ${stepNumber}`,
+    '      - name: 🧹 Cleanup and cache Nix/devenv',
+    `        if: ${githubExpression('always()')}`,
+    '        uses: ./.github/actions/save-nix-devenv',
+    '        with:',
+    `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
+    `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`,
+  );
+  return lines.join('\n').trimEnd();
+}
+
+function hasMacosPlatformTargets(options: PublishWorkflowDefinitionOptions): boolean {
+  return MACOS_PLATFORM_TARGET_GLOBS.some((glob) => options.platformTargetGlobs?.includes(glob) === true);
+}
+
+function hasLinuxPlatformTargets(options: PublishWorkflowDefinitionOptions): boolean {
+  return LINUX_PLATFORM_TARGET_GLOBS.some((glob) => options.platformTargetGlobs?.includes(glob) === true);
+}
+
 function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }