@smoothbricks/cli 0.11.16 → 0.11.18

package/dist/monorepo/ci-workflow.js

@@ -1,4 +1,5 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+import { cargoCrossTestArchiveFile, cargoCrossTestArchiveTargetName, cargoCrossTestTargetName, } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
 import { renderRunsOnLine } from './github-runs-on.js';
 export var CiWorkflowStepKind;
@@ -13,6 +14,11 @@ export var CiWorkflowStepKind;
     CiWorkflowStepKind["BrowserTests"] = "browser-tests";
     CiWorkflowStepKind["Lint"] = "lint";
     CiWorkflowStepKind["UnitTests"] = "unit-tests";
+    CiWorkflowStepKind["CrossToolchainPreflight"] = "cross-toolchain-preflight";
+    CiWorkflowStepKind["CrossTestArchives"] = "cross-test-archives";
+    CiWorkflowStepKind["UploadCrossTestArchives"] = "upload-cross-test-archives";
+    CiWorkflowStepKind["DownloadCrossTestArchives"] = "download-cross-test-archives";
+    CiWorkflowStepKind["CrossTests"] = "cross-tests";
     CiWorkflowStepKind["ManagedFilesCheck"] = "managed-files-check";
     CiWorkflowStepKind["ManagedFilesDispatch"] = "managed-files-dispatch";
     CiWorkflowStepKind["Deploy"] = "deploy";
@@ -33,6 +39,15 @@ export function defineCiWorkflow(options) {
         steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Stage' });
     }
     steps.push({ kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' }, { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' });
+    if (options.crossTestArchives?.length) {
+        if (options.platformProducer !== undefined) {
+            steps.push({
+                kind: CiWorkflowStepKind.CrossToolchainPreflight,
+                name: 'Check cross-platform toolchain prerequisites',
+            });
+        }
+        steps.push({ kind: CiWorkflowStepKind.CrossTestArchives, name: '🎯 Build cross-target test archives' }, { kind: CiWorkflowStepKind.UploadCrossTestArchives, name: '📤 Upload cross-target test archives' });
+    }
     if (options.browserTests) {
         steps.push({ kind: CiWorkflowStepKind.BrowserTests, name: '🌐 Browser Tests' });
     }
@@ -44,6 +59,7 @@ export function renderCiWorkflowYaml(options) {
     return [
         renderCiWorkflowHeader(options),
         renderCiWorkflowSteps(steps, options),
+        renderCrossTestExecutionJob(options),
         renderE2eDeploymentJob(options),
         renderProductionDeployJob(options),
     ].join('');
@@ -64,12 +80,19 @@ permissions:
 ${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 concurrency:
-  # One in-flight run per ref. Pushes to the staging push branch queue behind a
-  # running workflow instead of canceling it, so a newer push never cancels a
-  # production deployment mid-flight. Pull requests and other branches keep
-  # canceling superseded runs.
+${options.deploy
+        ? `  # One in-flight run per ref. Pushes to the staging push branch queue behind a
+  # running workflow instead of canceling it, so a newer push never cancels the
+  # deploy job mid-flight. Pull requests and other branches keep canceling
+  # superseded runs.
   group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}
+  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}`
+        : `  # This workflow validates and never deploys, so there is no in-flight
+  # deployment for a newer push to protect: every ref cancels its superseded
+  # runs. Queuing them instead serializes the staging branch, and a burst of
+  # pushes then reports the newest commit one full run per queued push late.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true`}
 
 defaults:
   run:
@@ -209,6 +232,61 @@ function yamlLinesForStep(step, options) {
             return nxSmartStep(step, 'lint', 'Lint');
         case CiWorkflowStepKind.UnitTests:
             return nxSmartStep(step, 'test', 'Unit Tests');
+        case CiWorkflowStepKind.CrossToolchainPreflight:
+            // The repository's own preflight, the same one the publish workflow's
+            // cross artifact job runs — an SDK to provision, a linker to check.
+            // `working-directory: .` because this workflow's steps default to the
+            // direnv shell directory while a preflight is repository-relative.
+            return [
+                `      - name: ${step.name}`,
+                '        working-directory: .',
+                ...platformProducerStepEnvLines(options),
+                '        run: |',
+                '          set -euo pipefail',
+                ...crossToolchainPreflight(options).map((line) => `          ${line}`),
+            ];
+        case CiWorkflowStepKind.CrossTestArchives:
+            // Cross-COMPILES the workspace's test binaries for each declared foreign
+            // triple and packs them; runs nothing. `nx-run-many` rather than
+            // `nx-smart`, because an affected-graph selection would skip the archive
+            // on a commit that changed nothing Rust — and the sibling job that
+            // executes it has no way to build one.
+            return [
+                `      - name: ${step.name}`,
+                ...platformProducerStepEnvLines(options),
+                `        run: smoo github-ci nx-run-many --targets "${crossArchiveTargetNames(options).join(',')}"`,
+            ];
+        case CiWorkflowStepKind.UploadCrossTestArchives:
+            // retention-days: 1 — the only consumer is the sibling job in this same
+            // run, and these archives are the whole workspace's test binaries.
+            return artifactStepLines(options.actionsProvider, step.name, 'upload', [
+                `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+                'path: |',
+                ...crossTestArchives(options).map((archive) => `  ${archive.path}`),
+                // error, not ignore: a missing archive means the cross build silently
+                // produced nothing, and the execute job would then have nothing to run
+                // and no reason to say so.
+                'if-no-files-found: error',
+                'retention-days: 1',
+            ]);
+        case CiWorkflowStepKind.DownloadCrossTestArchives:
+            // Restores each archive at the path its own Nx target declares as output,
+            // which is where the runner target reads it from. upload-artifact roots
+            // the artifact at the least common ancestor of what it uploaded, so the
+            // download path is that shared directory.
+            return artifactStepLines(options.actionsProvider, step.name, 'download', [
+                `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+                `path: ${crossTestArchiveDirectory(options)}`,
+            ]);
+        case CiWorkflowStepKind.CrossTests:
+            // EXECUTES, and that is all it can do: every one of these targets is
+            // `nextest run --archive-file`, which extracts prebuilt binaries into its
+            // own temporary directory. nextest never invokes cargo on this path
+            // (measured), so nothing here can compile even if a toolchain is present.
+            return [
+                `      - name: ${step.name}`,
+                `        run: smoo github-ci nx-run-many --targets "${darwinCrossTestTargetNames(options).join(',')}"`,
+            ];
         case CiWorkflowStepKind.ManagedFilesCheck:
             // The authoritative drift check is nearly free here (devenv is already
             // up). --warn never fails the job and publishes the step output
@@ -758,12 +836,13 @@ function renderYamlList(values, spaces) {
     const indent = ' '.repeat(spaces);
     return values.map((value) => `${indent}- ${value}`).join('\n');
 }
-function followUpStepNumbers(options) {
+function followUpStepNumbers(options, middleSteps = 1) {
     let number = 3;
     const cargo = options.cargoCredentials !== undefined ? number++ : undefined;
     const sources = options.sourceCheckouts?.length ? number++ : undefined;
     const setup = number++;
-    const middle = number++;
+    const middle = number;
+    number += middleSteps;
     const cleanup = number++;
     return { cargo, sources, setup, middle, cleanup };
 }
@@ -787,6 +866,131 @@ function followUpSetupSteps(options, numbers) {
 function followUpCleanupStep(numbers) {
     return [{ kind: CiWorkflowStepKind.SaveNixDevenv, name: '🧹 Cleanup and cache Nix/devenv', number: numbers.cleanup }];
 }
+/**
+ * How long the darwin execution job may take, download included. Generous
+ * because the archive is the whole workspace's test binaries, and bounded
+ * because the runner behind `macosRunsOn` may be one person's laptop: an
+ * unreachable runner queues, and this number is when the run says so.
+ */
+const CROSS_TEST_JOB_TIMEOUT_MINUTES = 30;
+/** Rust names every Apple-desktop triple this way; iOS and simulator do not. */
+const DARWIN_TRIPLE_SUFFIX = '-apple-darwin';
+/** One artifact carrying every triple's archive, scoped to the run that built it. */
+const CROSS_TEST_ARCHIVE_ARTIFACT = `cross-test-archives-${githubExpression('github.run_id')}`;
+/**
+ * Executes the cross-built test binaries on a machine where they are native.
+ *
+ * This job COMPILES NOTHING, and cannot: its only Rust input is the archive the
+ * Validate job uploaded, and `nextest run --archive-file` extracts prebuilt
+ * binaries rather than invoking cargo (measured: zero cargo invocations). It
+ * needs the checkout for the workspace `--workspace-remap .` points at and for
+ * Nx to resolve the target, and setup-devenv for `nx` and `cargo-nextest`
+ * themselves — the repository's ordinary shell, not a cross toolchain, no SDK,
+ * no `rustup target add`.
+ *
+ * `needs: main` and a success gate rather than `!cancelled()`: an archive that
+ * was never uploaded cannot be executed, and a job that starts anyway would
+ * fail on a missing artifact and report it as a test failure.
+ *
+ * Only `*-apple-darwin` archives run here, because macOS runner labels are the
+ * only native runner this declaration names. A repository declaring some other
+ * foreign triple still gets its archive BUILT — which proves that triple
+ * compiles — and no execution job, which is the honest rendering of having
+ * nowhere to run it.
+ */
+function renderCrossTestExecutionJob(options) {
+    const archives = darwinCrossTestArchives(options);
+    if (archives.length === 0)
+        return '';
+    const numbers = followUpStepNumbers(options, 2);
+    const middleSteps = [
+        {
+            kind: CiWorkflowStepKind.DownloadCrossTestArchives,
+            name: '📥 Download cross-target test archives',
+            number: numbers.middle,
+        },
+        { kind: CiWorkflowStepKind.CrossTests, name: '🧪 Cross-Target Unit Tests', number: numbers.middle + 1 },
+    ];
+    return `
+  macos-cross-tests:
+    name: Unit Tests (${archives.map((archive) => archive.triple).join(', ')})
+    needs: main
+${options.macosRunsOn === undefined ? '    runs-on: macos-latest' : renderRunsOnLine(options.macosRunsOn)}
+    timeout-minutes: ${CROSS_TEST_JOB_TIMEOUT_MINUTES}
+    if: \${{ needs.main.result == 'success' }}
+    env:
+      GH_TOKEN: \${{ github.token }}
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
+${renderCiWorkflowSteps(middleSteps, options)}
+${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
+}
+/**
+ * The declared archives, checked against the naming the Nx graph would have
+ * produced. A path that is not `cargoCrossTestArchiveFile(triple)` under some
+ * project root cannot have come from that target, so it is refused here rather
+ * than uploaded as an artifact nothing on the other side can find.
+ */
+function crossTestArchives(options) {
+    return (options.crossTestArchives ?? []).map((archive) => {
+        const suffix = cargoCrossTestArchiveFile(archive.triple);
+        const path = archive.path.split('\\').join('/');
+        if (!/^[a-z0-9][a-z0-9._-]*$/.test(archive.triple)) {
+            throw new Error(`smoo cross test archive triple must be a target triple, got ${JSON.stringify(archive.triple)}`);
+        }
+        if (path !== suffix && !path.endsWith(`/${suffix}`)) {
+            throw new Error(`smoo cross test archive for ${archive.triple} must be a repository-relative ${suffix}, got ${archive.path}`);
+        }
+        if (path.startsWith('/') || path.split('/').includes('..')) {
+            throw new Error(`smoo cross test archive path must stay inside the repository, got ${archive.path}`);
+        }
+        return { triple: archive.triple, path };
+    });
+}
+function crossArchiveTargetNames(options) {
+    return crossTestArchives(options).map((archive) => cargoCrossTestArchiveTargetName(archive.triple));
+}
+/**
+ * The declared preflight, as lines. A declaration with nothing in it is a
+ * mechanism error, and it surfaces here at render time rather than as a step
+ * whose `run:` block is empty.
+ */
+function crossToolchainPreflight(options) {
+    const preflight = options.platformProducer?.preflight ?? '';
+    if (preflight.trim().length === 0) {
+        throw new Error('smoo.github.platformProducer requires a nonempty toolchain preflight command.');
+    }
+    return preflight.split('\n');
+}
+/** The producer environment, step-scoped, quoted exactly as the publish workflow quotes it. */
+function platformProducerStepEnvLines(options) {
+    const entries = Object.entries(options.platformProducer?.env ?? {});
+    if (entries.length === 0)
+        return [];
+    return ['        env:', ...entries.map(([name, value]) => `          ${name}: ${JSON.stringify(value)}`)];
+}
+function darwinCrossTestArchives(options) {
+    return crossTestArchives(options).filter((archive) => archive.triple.endsWith(DARWIN_TRIPLE_SUFFIX));
+}
+function darwinCrossTestTargetNames(options) {
+    return darwinCrossTestArchives(options).map((archive) => cargoCrossTestTargetName(archive.triple));
+}
+/**
+ * Where the download lands. upload-artifact roots an artifact at the least
+ * common ancestor of the files it uploaded, so every archive in one artifact
+ * has to share a parent directory for the restored layout to be the one the
+ * runner targets read — true for one cargo workspace, false the moment a
+ * second one also declares cross targets, which is refused here instead of
+ * silently restoring the archives one directory too high.
+ */
+function crossTestArchiveDirectory(options) {
+    const directories = new Set(darwinCrossTestArchives(options).map((archive) => archive.path.slice(0, archive.path.lastIndexOf('/') + 1) || './'));
+    if (directories.size > 1) {
+        throw new Error(`smoo cross test archives must share one directory to travel as one artifact, got ${[...directories].join(', ')}`);
+    }
+    const [directory] = [...directories];
+    return (directory ?? './').replace(/\/$/, '');
+}
 function renderE2eDeploymentJob(options) {
     if (!options.e2eDeployment)
         return '';
@@ -828,6 +1032,7 @@ function renderProductionDeployJob(options) {
     needs: ${needs}
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 30
+    # prettier-ignore
     if: \${{ !cancelled() && github.event_name == 'push' && github.ref == ${stagingRefLiteral(options)} && needs.main.result == 'success'${e2eGate} }}
 ${environmentLine(options.environments?.production)}    env:
       GH_TOKEN: \${{ github.token }}
@@ -835,7 +1040,8 @@ ${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(optio
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: 🚀 Deploy Production
-${renderOptionalLines(deployStepSecretEnvLines(options))}        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
+${renderOptionalLines(deployStepSecretEnvLines(options))}        # prettier-ignore
+        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
 
 ${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
 }

package/dist/monorepo/managed-files.d.ts

@@ -1,5 +1,6 @@
 import { type NonEmptyArray, type PackageCargoCredentialsConfig, type PackagePrivateNpmConfig, type PackageRemoteCacheConfig, type PackageSmooGithub, type PackageSmooGithubEnvironments, type PackageSourceCheckoutConfig } from '../lib/json.js';
 import { type NxProjects } from '../nx/index.js';
+import { type CiCrossTestArchive } from './ci-workflow.js';
 /**
  * Repos may append their own content to a managed file below this marker —
  * e.g. extra merge drivers in .gitattributes. Everything from the marker
@@ -81,6 +82,12 @@ export interface ManagedFileContext {
     cargoCredentials?: PackageCargoCredentialsConfig;
     /** Declared self-hosted Nx remote cache from the root smoo config; absent means local caching only. */
     remoteCache?: PackageRemoteCacheConfig;
+    /**
+     * Cross-built test archives the graph can produce, one per foreign target
+     * triple the cargo workspace declares. Empty for a repository that declares
+     * none, which renders a CI workflow with no cross steps and no macOS job.
+     */
+    crossTestArchives: CiCrossTestArchive[];
 }
 interface DeployTargetInfo {
     exists: boolean;
@@ -94,6 +101,22 @@ export declare function applyManagedFiles(root: string, mode: 'update' | 'check'
 /** Renders a generated workflow through its real managed-file descriptor, so the context wiring is covered. */
 export declare function renderManagedWorkflowForTest(source: 'ci-workflow' | 'publish-workflow', context: ManagedFileContext): string;
 export declare function hasExactTargetForTest(targetNames: Iterable<string>, target: string): boolean;
+/**
+ * Test seam: the cross-built test archives this graph can produce, read back
+ * out of the inferred `cargo-cross-test-archive-<triple>` targets.
+ *
+ * Derived, not configured. The triple is declared exactly once — in the cargo
+ * workspace's own `[workspace.metadata.smoothbricks.test] cross-targets`, where
+ * a Rust target triple belongs — and both halves of the workflow are rendered
+ * from the targets that declaration produced. A second copy in `smoo.github`
+ * could name a triple the graph cannot build, and CI would discover that only
+ * on the runner.
+ *
+ * The path is the target's own output location, so the artifact the Linux job
+ * uploads and the file the macOS job's runner opens are the same string
+ * computed once.
+ */
+export declare function crossTestArchivesForTest(projects: NxProjects): CiCrossTestArchive[];
 /**
  * The platform families the release workflow produces: the graph's families
  * minus the ones the repository excludes. Excluding a family the graph does not

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAkB,KAAK,UAAU,EAA2B,MAAM,gBAAgB,CAAC;AAS1F;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAIhH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA6CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA0HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAY1G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAqED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AASA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,6BAA6B,EAElC,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,iBAAiB,EACtB,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EAEjC,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAEL,KAAK,UAAU,EAIhB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,kBAAkB,EAAmD,MAAM,kBAAkB,CAAC;AAO5G;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAW3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAkCxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAuBtF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,uBAAuB,EAAE,OAAO,CAAC;IACjC,0BAA0B,EAAE,OAAO,CAAC;IACpC,qBAAqB,EAAE,OAAO,CAAC;IAC/B,uBAAuB,EAAE,OAAO,CAAC;IACjC,8BAA8B,EAAE,OAAO,CAAC;IACxC,qBAAqB,CAAC,EAAE,YAAY,CAAC;IACrC,wBAAwB,CAAC,EAAE,YAAY,CAAC;IACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,yFAAyF;IACzF,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qFAAqF;IACrF,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,0BAA0B,EAAE,MAAM,EAAE,CAAC;IACrC,wFAAwF;IACxF,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD,kGAAkG;IAClG,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,uGAAuG;IACvG,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC;;;;OAIG;IACH,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;CACzC;AAED,UAAU,gBAAgB;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAwID,eAAO,MAAM,yBAAyB;;;GAAyE,CAAC;AAIhH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAG9G;AA6CD,+GAA+G;AAC/G,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,aAAa,GAAG,kBAAkB,EAC1C,OAAO,EAAE,kBAAkB,GAC1B,MAAM,CAMR;AA8HD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,GAAG,kBAAkB,EAAE,CAiBnF;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,mBAAmB,EAAE,SAAS,MAAM,EAAE,EACtC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GACtC,MAAM,EAAE,CAIV;AAED,wBAAgB,0BAA0B,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAMlF;AAED;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAezF;AAED,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,GAAG,gBAAgB,CAY1G;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAElF;AAqED,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQxE;AAED,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAY/D;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE"}

package/dist/monorepo/managed-files.js

@@ -1,11 +1,12 @@
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { cargoCrossTestArchiveFile, cargoCrossTestTripleFromArchiveTarget, } from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
 import { ciPushBranches, readValidatedPackageJson, } from '../lib/json.js';
 import { listReleasePackages, packageInfo } from '../lib/workspace.js';
-import { loadNxProjects, targetNamesFromProjects } from '../nx/index.js';
+import { loadNxProjects, projectRootFromNxProjectJson, targetNamesFromNxProjectJson, targetNamesFromProjects, } from '../nx/index.js';
 import { resolvePrivateNpmWorkflowConfig } from '../release/private-npm.js';
 import { privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderRunsOnLine } from './github-runs-on.js';
@@ -305,6 +306,9 @@ function getManagedContent(file, context) {
                 deploySecrets: context.ciDeploySecrets,
                 e2eSecrets: context.ciE2eSecrets,
                 productionOnPush: context.hasProductionPushDeployTargets,
+                crossTestArchives: context.crossTestArchives,
+                macosRunsOn: context.macosRunsOn,
+                platformProducer: context.platformProducer,
             });
         }
         if (file.source === 'publish-workflow') {
@@ -397,11 +401,45 @@ async function getManagedFileContext(root) {
             ? macosPlatformArchitecturesForTest(targetNames)
             : [],
         privateNpm,
+        crossTestArchives: crossTestArchivesForTest(nxProjects),
     };
 }
 export function hasExactTargetForTest(targetNames, target) {
     return [...targetNames].includes(target);
 }
+/**
+ * Test seam: the cross-built test archives this graph can produce, read back
+ * out of the inferred `cargo-cross-test-archive-<triple>` targets.
+ *
+ * Derived, not configured. The triple is declared exactly once — in the cargo
+ * workspace's own `[workspace.metadata.smoothbricks.test] cross-targets`, where
+ * a Rust target triple belongs — and both halves of the workflow are rendered
+ * from the targets that declaration produced. A second copy in `smoo.github`
+ * could name a triple the graph cannot build, and CI would discover that only
+ * on the runner.
+ *
+ * The path is the target's own output location, so the artifact the Linux job
+ * uploads and the file the macOS job's runner opens are the same string
+ * computed once.
+ */
+export function crossTestArchivesForTest(projects) {
+    const archives = [];
+    for (const project of Object.values(projects)) {
+        const projectRoot = projectRootFromNxProjectJson(project);
+        for (const targetName of targetNamesFromNxProjectJson(project)) {
+            const triple = cargoCrossTestTripleFromArchiveTarget(targetName);
+            if (triple === null) {
+                continue;
+            }
+            const file = cargoCrossTestArchiveFile(triple);
+            archives.push({
+                triple,
+                path: projectRoot === undefined || projectRoot === '.' ? file : `${projectRoot}/${file}`,
+            });
+        }
+    }
+    return archives.sort((left, right) => left.triple.localeCompare(right.triple));
+}
 /**
  * The platform families the release workflow produces: the graph's families
  * minus the ones the repository excludes. Excluding a family the graph does not

package/dist/monorepo/publish-workflow.d.ts

@@ -2,7 +2,7 @@ import type { PackageCargoCredentialsConfig, PackagePrivateNpmConfig, PackageRem
 import { type DeployStepSecretConfig } from './ci-workflow.js';
 import { type WorkflowRunsOn } from './github-runs-on.js';
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
-export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'deploy-production-standalone' | 'failure' | 'always';
+export type PublishWorkflowCondition = 'plan-mode-not-none' | 'version-mode-not-none' | 'deploy-production' | 'deploy-production-standalone' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
 export type PublishWorkflowDeployStage = 'none' | 'production';
 export declare enum PublishWorkflowStepKind {
@@ -13,6 +13,7 @@ export declare enum PublishWorkflowStepKind {
     ConfigureReleaseAuthor = "configure-release-author",
     BuildNxVersionActions = "build-nx-version-actions",
     RepairPendingReleases = "repair-pending-releases",
+    PlanRelease = "plan-release",
     VersionRelease = "version-release",
     CheckManagedMonorepoFiles = "check-managed-monorepo-files",
     Build = "build",
@@ -105,6 +106,14 @@ export interface PublishWorkflowCallbacks {
         bump: PublishWorkflowBump;
         dryRun: boolean;
     }): Promise<PublishWorkflowVersionOutputs>;
+    /**
+     * The selection the bump WILL make, computed without writing anything, so the
+     * gates that run before the version commit know what to run over. Defaults to
+     * a dry-run `versionRelease` when a caller supplies none.
+     */
+    planRelease?(input: {
+        bump: PublishWorkflowBump;
+    }): Promise<PublishWorkflowVersionOutputs>;
     checkManagedMonorepoFiles(): Promise<void>;
     nxRunMany(input: {
         target: PublishWorkflowNxTarget;

package/dist/monorepo/publish-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,sBAAsB,EAI5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAsBxG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAChC,uBAAuB,GACvB,mBAAmB,GACnB,8BAA8B,GAC9B,SAAS,GACT,QAAQ,CAAC;AACb,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/D,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,qBAAqB,6BAA6B;IAClD,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAiC,SAAQ,sBAAsB;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,mGAAmG;IACnG,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,mEAAmE;IACnE,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,0BAA0B,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAiF/G;AAkCD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA6EnC;AAuBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CA0BhG"}
+{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,sBAAsB,EAI5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAsBxG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,uBAAuB,GACvB,mBAAmB,GACnB,8BAA8B,GAC9B,SAAS,GACT,QAAQ,CAAC;AACb,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/D,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,qBAAqB,6BAA6B;IAClD,qBAAqB,4BAA4B;IACjD,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAiC,SAAQ,sBAAsB;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,mGAAmG;IACnG,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,mEAAmE;IACnE,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,0BAA0B,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G;;;;OAIG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC3F,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CA2F/G;AAkCD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAwFnC;AA2BD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CA0BhG"}

package/dist/monorepo/publish-workflow.js

@@ -31,6 +31,7 @@ export var PublishWorkflowStepKind;
     PublishWorkflowStepKind["ConfigureReleaseAuthor"] = "configure-release-author";
     PublishWorkflowStepKind["BuildNxVersionActions"] = "build-nx-version-actions";
     PublishWorkflowStepKind["RepairPendingReleases"] = "repair-pending-releases";
+    PublishWorkflowStepKind["PlanRelease"] = "plan-release";
     PublishWorkflowStepKind["VersionRelease"] = "version-release";
     PublishWorkflowStepKind["CheckManagedMonorepoFiles"] = "check-managed-monorepo-files";
     PublishWorkflowStepKind["Build"] = "build";
@@ -45,6 +46,9 @@ export var PublishWorkflowStepKind;
 })(PublishWorkflowStepKind || (PublishWorkflowStepKind = {}));
 export function definePublishWorkflow(options = {}) {
     const versionMode = githubExpression('steps.version.outputs.mode');
+    // Steps that run before the bump must label themselves from the plan: the
+    // version step's outputs do not exist yet, so the interpolation renders empty.
+    const planMode = githubExpression('steps.plan.outputs.mode');
     if (options.release === false) {
         return { steps: defineDeployOnlyWorkflowSteps(options) };
     }
@@ -86,30 +90,37 @@ export function definePublishWorkflow(options = {}) {
                 kind: PublishWorkflowStepKind.RepairPendingReleases,
                 name: '🧯 Repair pending releases',
             },
-            { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+            // Plan first, gate second, bump third. Lint and test hash the source, so
+            // running them BEFORE the version commit means their task hashes match
+            // the ones ci already computed for the same source — the publish reuses
+            // that cache instead of re-running 189 tasks. Build stays after the bump
+            // on purpose: an artifact built from pre-bump sources would ship the
+            // previous version string.
+            { kind: PublishWorkflowStepKind.PlanRelease, name: '🧭 Plan release', id: 'plan' },
             {
                 kind: PublishWorkflowStepKind.CheckManagedMonorepoFiles,
-                name: `✅ Check managed monorepo files (${versionMode})`,
-                condition: 'version-mode-not-none',
-            },
-            {
-                kind: PublishWorkflowStepKind.Build,
-                name: `🔨 Build (${versionMode})`,
-                condition: 'version-mode-not-none',
-                nxTarget: 'build',
+                name: `✅ Check managed monorepo files (${planMode})`,
+                condition: 'plan-mode-not-none',
             },
             {
                 kind: PublishWorkflowStepKind.Lint,
-                name: `🔍 Lint (${versionMode})`,
-                condition: 'version-mode-not-none',
+                name: `🔍 Lint (${planMode})`,
+                condition: 'plan-mode-not-none',
                 nxTarget: 'lint',
             },
             {
                 kind: PublishWorkflowStepKind.UnitTests,
-                name: `🧪 Unit Tests (${versionMode})`,
-                condition: 'version-mode-not-none',
+                name: `🧪 Unit Tests (${planMode})`,
+                condition: 'plan-mode-not-none',
                 nxTarget: 'test',
             },
+            { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+            {
+                kind: PublishWorkflowStepKind.Build,
+                name: `🔨 Build (${versionMode})`,
+                condition: 'version-mode-not-none',
+                nxTarget: 'build',
+            },
             { kind: PublishWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs', condition: 'failure' },
             {
                 kind: PublishWorkflowStepKind.ValidateMonorepoConfig,
@@ -158,10 +169,11 @@ function numberWorkflowSteps(steps) {
 export async function runPublishWorkflow(workflow, context) {
     let setupOutputs = { nixCacheHit: '', devenvCacheHit: '' };
     let version = { mode: 'none', projects: [] };
+    let plan = { mode: 'none', projects: [] };
     let failed = false;
     let failure;
     for (const step of workflow.steps) {
-        if (!shouldRunStep(step, version, failed, context.inputs)) {
+        if (!shouldRunStep(step, version, failed, context.inputs, plan)) {
             continue;
         }
         try {
@@ -187,6 +199,11 @@ export async function runPublishWorkflow(workflow, context) {
                         dryRun: context.inputs.dryRun,
                     });
                     break;
+                case PublishWorkflowStepKind.PlanRelease:
+                    plan = context.callbacks.planRelease
+                        ? await context.callbacks.planRelease({ bump: context.inputs.bump })
+                        : await context.callbacks.versionRelease({ bump: context.inputs.bump, dryRun: true });
+                    break;
                 case PublishWorkflowStepKind.VersionRelease:
                     version = await context.callbacks.versionRelease(context.inputs);
                     break;
@@ -199,7 +216,12 @@ export async function runPublishWorkflow(workflow, context) {
                     if (!step.nxTarget) {
                         throw new Error(`Workflow step ${step.kind} is missing an Nx target.`);
                     }
-                    await context.callbacks.nxRunMany({ target: step.nxTarget, projects: version.projects });
+                    // Lint and test run before the bump exists, so they select from the
+                    // plan; build runs after it and selects from the written version.
+                    await context.callbacks.nxRunMany({
+                        target: step.nxTarget,
+                        projects: step.kind === PublishWorkflowStepKind.Build ? version.projects : plan.projects,
+                    });
                     break;
                 case PublishWorkflowStepKind.UploadTraceDbs:
                     await context.callbacks.uploadTraceDbs();
@@ -234,7 +256,10 @@ export async function runPublishWorkflow(workflow, context) {
     }
     return { version, failed };
 }
-function shouldRunStep(step, version, failed, inputs) {
+function shouldRunStep(step, version, failed, inputs, plan = version) {
+    if (step.condition === 'plan-mode-not-none') {
+        return plan.mode !== 'none';
+    }
     if (step.condition === 'version-mode-not-none') {
         return version.mode !== 'none';
     }
@@ -421,6 +446,16 @@ function yamlLinesForStep(step, options) {
                 ...privateNpmPublisherStepEnv(options),
                 `        run: smoo release repair-pending --dry-run "${githubExpression('inputs.dry_run')}"`,
             ];
+        case PublishWorkflowStepKind.PlanRelease:
+            // The same selection the bump will make, computed without writing: the
+            // gates need `mode` and `projects` before any version commit exists.
+            return [
+                `      - name: ${step.name}`,
+                '        id: plan',
+                '        run:',
+                `          smoo release version --bump "${githubExpression('inputs.bump')}" --projects "${githubExpression('inputs.projects')}" --dry-run "true" --github-output`,
+                '          "$GITHUB_OUTPUT"',
+            ];
         case PublishWorkflowStepKind.VersionRelease:
             return [
                 `      - name: ${step.name}`,
@@ -436,9 +471,9 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.Build:
             return conditionalRunStep(step, `smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}"`);
         case PublishWorkflowStepKind.Lint:
-            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.version.outputs.projects')}"`);
+            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.plan.outputs.projects')}"`);
         case PublishWorkflowStepKind.UnitTests:
-            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.version.outputs.projects')}"`);
+            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.plan.outputs.projects')}"`);
         case PublishWorkflowStepKind.UploadTraceDbs:
             return artifactStepLines(options.actionsProvider, step.name, 'upload', [
                 `name: trace-results-${githubExpression('github.run_id')}`,
@@ -513,8 +548,11 @@ function deployProductionStep(step, options) {
     ];
 }
 function conditionalRunStep(step, run) {
-    const condition = "steps.version.outputs.mode != 'none'";
-    return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
+    // A step gated on the plan must read the PLAN's mode: it runs before the
+    // version step exists, and `steps.version.outputs.mode` is empty there, which
+    // silently skips the gate rather than running it.
+    const source = step.condition === 'plan-mode-not-none' ? 'plan' : 'version';
+    return [`      - name: ${step.name}`, `        if: steps.${source}.outputs.mode != 'none'`, `        run: ${run}`];
 }
 function siblingSourceCheckoutStepLines(options) {
     const checkouts = options.sourceCheckouts;