pubm 0.2.2 → 0.2.4

package/README.md

@@ -70,6 +70,7 @@ pubm patch --preview
 | Flag | Purpose |
 |------|---------|
 | `-p, --preview` | Dry‑run: show tasks, no side‑effects |
+| `--preflight` | Simulate CI publish locally (token‑based auth + dry‑run) |
 | `--registry <list>` | Comma‑separated targets, e.g. `npm,jsr,https://registry.example.com` |
 | `--branch <name>` / `--any-branch` | Release branch guard control |
 | `--no-pre-check` / `--no-condition-check` | Skip guard stages |
@@ -84,9 +85,25 @@ pubm patch --preview
 2. **Required condition checks** – registry ping, login & permission, engine versions.
 3. **Test & build** *(optional)*
 4. **Version bump & tag** (SemVer)
-5. **Concurrent publish** – npm (OTP/provenance), jsr, plugins.
+5. **Concurrent publish** – npm (OTP/provenance), jsr, crates.io, plugins.
 6. **Git push & GitHub release draft**
 
+### Preflight Mode
+
+Validate that your CI publish pipeline will work **before** pushing:
+
+```bash
+pubm --preflight
+```
+
+Preflight collects registry tokens interactively, then runs the entire pipeline with `promptEnabled=false` (simulating CI). Publish steps are replaced with dry‑run. If a token is invalid, it re‑prompts and retries.
+
+After validation, pubm offers to sync tokens to GitHub Secrets via `gh secret set`. You can also sync manually:
+
+```bash
+pubm secrets sync
+```
+
 ---
 
 ## FAQ

package/bin/cli.js

@@ -4694,6 +4694,7 @@ function consoleError(error) {
 }
 
 // src/tasks/preflight.ts
+import { createHash as createHash2 } from "node:crypto";
 import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 import { exec as exec2 } from "tinyexec";
 
@@ -4846,13 +4847,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await exec2("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = exec2("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return createHash2("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(ListrEnquirerPromptAdapter).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -4863,6 +4880,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -6432,6 +6450,8 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { exec as exec6, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
 var NpmError = class extends AbstractError {
   constructor() {
@@ -6587,11 +6607,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await exec6("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: join(tmpdir(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof NonZeroExitError3 ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -7526,48 +7557,7 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
@@ -7651,12 +7641,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7751,7 +7748,7 @@ import micromatch from "micromatch";
 
 // src/monorepo/workspace.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { parse as parse2 } from "yaml";
 
 // src/monorepo/groups.ts
@@ -7994,7 +7991,7 @@ defaultCmd.action(
     };
     try {
       if (options.preflight) {
-        context.version = nextVersion || "0.0.0-preflight";
+        await requiredMissingInformationTasks().run(context);
       } else if (isCI3) {
         if (options.publishOnly) {
           const git = new Git();

package/dist/index.cjs

@@ -5914,6 +5914,8 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
+var import_node_os = require("os");
+var import_node_path6 = require("path");
 var import_tinyexec4 = require("tinyexec");
 var NpmError = class extends AbstractError {
   constructor() {
@@ -6069,11 +6071,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await (0, import_tinyexec4.exec)("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: (0, import_node_path6.join)((0, import_node_os.tmpdir)(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof import_tinyexec4.NonZeroExitError ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -6547,6 +6560,7 @@ var npmPublishTasks = {
 };
 
 // src/tasks/preflight.ts
+var import_node_crypto2 = require("crypto");
 var import_prompt_adapter_enquirer4 = require("@listr2/prompt-adapter-enquirer");
 var import_tinyexec5 = require("tinyexec");
 var PreflightError = class extends AbstractError {
@@ -6575,13 +6589,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await (0, import_tinyexec5.exec)("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = (0, import_tinyexec5.exec)("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(import_prompt_adapter_enquirer4.ListrEnquirerPromptAdapter).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -6592,6 +6622,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -7065,48 +7096,7 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
@@ -7190,12 +7180,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7321,11 +7318,11 @@ function generateChangelog(version2, entries, depUpdates) {
 
 // src/changeset/migrate.ts
 var import_node_fs2 = require("fs");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 var import_node_process9 = __toESM(require("process"), 1);
 var SKIPPED_FILES = /* @__PURE__ */ new Set(["config.json", "README.md"]);
 function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
-  const changesetDir = import_node_path6.default.join(cwd, ".changeset");
+  const changesetDir = import_node_path7.default.join(cwd, ".changeset");
   if (!(0, import_node_fs2.existsSync)(changesetDir)) {
     return {
       success: false,
@@ -7334,7 +7331,7 @@ function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
       configMigrated: false
     };
   }
-  const pubmDir = import_node_path6.default.join(cwd, ".pubm", "changesets");
+  const pubmDir = import_node_path7.default.join(cwd, ".pubm", "changesets");
   (0, import_node_fs2.mkdirSync)(pubmDir, { recursive: true });
   const files = (0, import_node_fs2.readdirSync)(changesetDir);
   const migratedFiles = [];
@@ -7349,15 +7346,15 @@ function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
     }
     if (file === "pre.json") {
       (0, import_node_fs2.copyFileSync)(
-        import_node_path6.default.join(changesetDir, file),
-        import_node_path6.default.resolve(cwd, ".pubm", "pre.json")
+        import_node_path7.default.join(changesetDir, file),
+        import_node_path7.default.resolve(cwd, ".pubm", "pre.json")
       );
       migratedFiles.push(file);
       continue;
     }
     if (file.endsWith(".md")) {
-      const src = import_node_path6.default.join(changesetDir, file);
-      const dest = import_node_path6.default.join(pubmDir, file);
+      const src = import_node_path7.default.join(changesetDir, file);
+      const dest = import_node_path7.default.join(pubmDir, file);
       (0, import_node_fs2.copyFileSync)(src, dest);
       migratedFiles.push(file);
     }
@@ -7404,10 +7401,10 @@ function parseChangeset(content, fileName) {
 
 // src/changeset/reader.ts
 var import_node_fs3 = require("fs");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path8 = __toESM(require("path"), 1);
 var import_node_process10 = __toESM(require("process"), 1);
 function readChangesets(cwd = import_node_process10.default.cwd()) {
-  const changesetsDir = import_node_path7.default.join(cwd, ".pubm", "changesets");
+  const changesetsDir = import_node_path8.default.join(cwd, ".pubm", "changesets");
   if (!(0, import_node_fs3.existsSync)(changesetsDir)) {
     return [];
   }
@@ -7417,7 +7414,7 @@ function readChangesets(cwd = import_node_process10.default.cwd()) {
     if (!file.endsWith(".md") || file === "README.md") {
       continue;
     }
-    const filePath = import_node_path7.default.join(changesetsDir, file);
+    const filePath = import_node_path8.default.join(changesetsDir, file);
     const content = (0, import_node_fs3.readFileSync)(filePath, "utf-8");
     changesets.push(parseChangeset(content, file));
   }
@@ -7487,7 +7484,7 @@ function calculateVersionBumps(currentVersions, cwd = import_node_process12.defa
 
 // src/changeset/writer.ts
 var import_node_fs4 = require("fs");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_path9 = __toESM(require("path"), 1);
 var import_node_process13 = __toESM(require("process"), 1);
 var import_yaml2 = require("yaml");
 var adjectives = [
@@ -7582,11 +7579,11 @@ ${summary}
   return content;
 }
 function writeChangeset(releases, summary, cwd = import_node_process13.default.cwd()) {
-  const changesetsDir = import_node_path8.default.join(cwd, ".pubm", "changesets");
+  const changesetsDir = import_node_path9.default.join(cwd, ".pubm", "changesets");
   (0, import_node_fs4.mkdirSync)(changesetsDir, { recursive: true });
   const id = generateChangesetId();
   const fileName = `${id}.md`;
-  const filePath = import_node_path8.default.join(changesetsDir, fileName);
+  const filePath = import_node_path9.default.join(changesetsDir, fileName);
   const content = generateChangesetContent(releases, summary);
   (0, import_node_fs4.writeFileSync)(filePath, content, "utf-8");
   return filePath;
@@ -7645,23 +7642,23 @@ function topologicalSort(graph) {
 
 // src/monorepo/discover.ts
 var import_node_fs6 = require("fs");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 var import_micromatch = __toESM(require("micromatch"), 1);
 
 // src/monorepo/workspace.ts
 var import_node_fs5 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var import_yaml3 = require("yaml");
 function detectWorkspace(cwd) {
   const root = cwd ?? process.cwd();
-  const pnpmWorkspacePath = (0, import_node_path9.join)(root, "pnpm-workspace.yaml");
+  const pnpmWorkspacePath = (0, import_node_path10.join)(root, "pnpm-workspace.yaml");
   if ((0, import_node_fs5.existsSync)(pnpmWorkspacePath)) {
     const content = (0, import_node_fs5.readFileSync)(pnpmWorkspacePath, "utf-8");
     const parsed = (0, import_yaml3.parse)(content);
     const packages = parsed?.packages ?? [];
     return { type: "pnpm", patterns: packages };
   }
-  const packageJsonPath = (0, import_node_path9.join)(root, "package.json");
+  const packageJsonPath = (0, import_node_path10.join)(root, "package.json");
   if ((0, import_node_fs5.existsSync)(packageJsonPath)) {
     const content = (0, import_node_fs5.readFileSync)(packageJsonPath, "utf-8");
     const pkg = JSON.parse(content);
@@ -7722,9 +7719,9 @@ function applyLinkedGroup(bumps, group) {
 
 // src/prerelease/pre.ts
 var import_node_fs7 = require("fs");
-var import_node_path11 = __toESM(require("path"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
 function getPreStatePath(cwd) {
-  return import_node_path11.default.resolve(cwd ?? process.cwd(), ".pubm", "pre.json");
+  return import_node_path12.default.resolve(cwd ?? process.cwd(), ".pubm", "pre.json");
 }
 function readPreState(cwd) {
   const filePath = getPreStatePath(cwd);
@@ -7741,7 +7738,7 @@ function enterPreMode(tag, cwd) {
       "Already in pre mode. Exit pre mode first before entering a new one."
     );
   }
-  const dir = import_node_path11.default.dirname(filePath);
+  const dir = import_node_path12.default.dirname(filePath);
   if (!(0, import_node_fs7.existsSync)(dir)) {
     (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
   }
@@ -7783,10 +7780,10 @@ function generateSnapshotVersion(options) {
 
 // src/validate/entry-points.ts
 var import_node_fs8 = require("fs");
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
 var SIMPLE_FIELDS = ["main", "module", "types", "typings"];
 function checkPath(filePath, cwd) {
-  return (0, import_node_fs8.existsSync)(import_node_path12.default.resolve(cwd, filePath));
+  return (0, import_node_fs8.existsSync)(import_node_path13.default.resolve(cwd, filePath));
 }
 function validateExports(exports2, cwd, prefix = "exports") {
   const errors = [];

package/dist/index.js

@@ -5879,6 +5879,8 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { exec as exec5, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
 var NpmError = class extends AbstractError {
   constructor() {
@@ -6034,11 +6036,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await exec5("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: join(tmpdir(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof NonZeroExitError3 ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -6512,6 +6525,7 @@ var npmPublishTasks = {
 };
 
 // src/tasks/preflight.ts
+import { createHash as createHash2 } from "node:crypto";
 import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter4 } from "@listr2/prompt-adapter-enquirer";
 import { exec as exec6 } from "tinyexec";
 var PreflightError = class extends AbstractError {
@@ -6540,13 +6554,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await exec6("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = exec6("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return createHash2("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(ListrEnquirerPromptAdapter4).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -6557,6 +6587,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -7029,48 +7060,7 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
@@ -7154,12 +7144,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7614,18 +7611,18 @@ import micromatch from "micromatch";
 
 // src/monorepo/workspace.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { parse as parse2 } from "yaml";
 function detectWorkspace(cwd) {
   const root = cwd ?? process.cwd();
-  const pnpmWorkspacePath = join(root, "pnpm-workspace.yaml");
+  const pnpmWorkspacePath = join2(root, "pnpm-workspace.yaml");
   if (existsSync3(pnpmWorkspacePath)) {
     const content = readFileSync3(pnpmWorkspacePath, "utf-8");
     const parsed = parse2(content);
     const packages = parsed?.packages ?? [];
     return { type: "pnpm", patterns: packages };
   }
-  const packageJsonPath = join(root, "package.json");
+  const packageJsonPath = join2(root, "package.json");
   if (existsSync3(packageJsonPath)) {
     const content = readFileSync3(packageJsonPath, "utf-8");
     const pkg = JSON.parse(content);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pubm",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "engines": {
     "node": ">=18",
     "git": ">=2.11.0"
@@ -33,7 +33,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest --run",
     "coverage": "vitest --run --coverage",
-    "release": "pnpm build && node bin/cli.js --no-publish",
+    "release": "pnpm build && node bin/cli.js --preflight",
     "ci:release": "node bin/cli.js --publish-only"
   },
   "dependencies": {