pubm 0.2.3 → 0.2.5

package/bin/cli.js

@@ -4694,6 +4694,7 @@ function consoleError(error) {
 }
 
 // src/tasks/preflight.ts
+import { createHash as createHash2 } from "node:crypto";
 import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 import { exec as exec2 } from "tinyexec";
 
@@ -4846,13 +4847,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await exec2("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = exec2("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return createHash2("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(ListrEnquirerPromptAdapter).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -4863,6 +4880,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -5448,7 +5466,7 @@ import process14 from "node:process";
 import npmCli3 from "@npmcli/promise-spawn";
 import SemVer from "semver";
 import { isCI as isCI2 } from "std-env";
-import { exec as exec8 } from "tinyexec";
+import { exec as exec9 } from "tinyexec";
 
 // src/utils/cli.ts
 var warningBadge = color.bgYellow(" Warning ");
@@ -5460,6 +5478,7 @@ function link2(text, url) {
 import { readFile, stat as stat2, writeFile } from "node:fs/promises";
 import path8 from "node:path";
 import { parse, stringify } from "smol-toml";
+import { exec as exec4 } from "tinyexec";
 
 // src/ecosystem/ecosystem.ts
 var Ecosystem = class {
@@ -5502,6 +5521,28 @@ var RustEcosystem = class extends Ecosystem {
     pkg.version = newVersion;
     await writeFile(filePath, stringify(cargo));
   }
+  async syncLockfile() {
+    const lockfilePath = await this.findLockfile();
+    if (!lockfilePath) return void 0;
+    const name = await this.packageName();
+    await exec4("cargo", ["update", "--package", name], {
+      nodeOptions: { cwd: path8.dirname(lockfilePath) }
+    });
+    return lockfilePath;
+  }
+  async findLockfile() {
+    let dir = this.packagePath;
+    const { root } = path8.parse(dir);
+    while (dir !== root) {
+      const candidate = path8.join(dir, "Cargo.lock");
+      try {
+        if ((await stat2(candidate)).isFile()) return candidate;
+      } catch {
+      }
+      dir = path8.dirname(dir);
+    }
+    return void 0;
+  }
   async dependencies() {
     const cargo = await this.readCargoToml();
     const deps = [];
@@ -5809,10 +5850,19 @@ async function replaceVersion(version2, packages) {
           { cause: error }
         );
       }
-      return path9.join(pkg.path, "Cargo.toml");
+      let lockfilePath;
+      try {
+        lockfilePath = await eco.syncLockfile();
+      } catch (error) {
+        throw new AbstractError(
+          `Failed to sync Cargo.lock at ${pkg.path}: ${error instanceof Error ? error.message : error}`,
+          { cause: error }
+        );
+      }
+      return [path9.join(pkg.path, "Cargo.toml"), lockfilePath];
     })
   ]);
-  return results.filter((v) => v);
+  return [...new Set(results.flat().filter((v) => !!v))];
 }
 
 // src/utils/package-manager.ts
@@ -5851,7 +5901,7 @@ function collectRegistries(ctx) {
 
 // src/registry/crates.ts
 import path10 from "node:path";
-import { exec as exec4, NonZeroExitError } from "tinyexec";
+import { exec as exec5, NonZeroExitError } from "tinyexec";
 
 // src/registry/registry.ts
 var Registry = class {
@@ -5891,7 +5941,7 @@ var CratesRegistry = class extends Registry {
   }
   async isInstalled() {
     try {
-      await exec4("cargo", ["--version"]);
+      await exec5("cargo", ["--version"]);
       return true;
     } catch {
       return false;
@@ -5932,7 +5982,7 @@ var CratesRegistry = class extends Registry {
       if (manifestDir) {
         args.push("--manifest-path", path10.join(manifestDir, "Cargo.toml"));
       }
-      await exec4("cargo", args, { throwOnError: true });
+      await exec5("cargo", args, { throwOnError: true });
       return true;
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
@@ -5947,7 +5997,7 @@ ${stderr}` : "Failed to run `cargo publish`";
       if (manifestDir) {
         args.push("--manifest-path", path10.join(manifestDir, "Cargo.toml"));
       }
-      await exec4("cargo", args, { throwOnError: true });
+      await exec5("cargo", args, { throwOnError: true });
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
       const message = stderr ? `Failed to run \`cargo publish --dry-run\`:
@@ -6045,7 +6095,7 @@ var cratesPublishTasks = createCratesPublishTask();
 import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter2 } from "@listr2/prompt-adapter-enquirer";
 
 // src/registry/jsr.ts
-import { exec as exec5, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
+import { exec as exec6, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
 
 // src/utils/package-name.ts
 import { builtinModules } from "node:module";
@@ -6112,7 +6162,7 @@ var JsrRegisry = class extends Registry {
     this.client = new JsrClient(getApiEndpoint(this.registry));
   }
   async jsr(args) {
-    const { stdout } = await exec5("jsr", args, { throwOnError: true });
+    const { stdout } = await exec6("jsr", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -6128,7 +6178,7 @@ var JsrRegisry = class extends Registry {
   }
   async ping() {
     try {
-      const { stdout } = await exec5(
+      const { stdout } = await exec6(
         "ping",
         [new URL(this.registry).hostname, "-c", "1"],
         { throwOnError: true }
@@ -6143,7 +6193,7 @@ var JsrRegisry = class extends Registry {
   }
   async publish() {
     try {
-      await exec5(
+      await exec6(
         "jsr",
         ["publish", "--allow-dirty", "--token", `${JsrClient.token}`],
         {
@@ -6174,7 +6224,7 @@ ${stderr}` : ""}`,
   }
   async dryRunPublish() {
     try {
-      await exec5(
+      await exec6(
         "jsr",
         [
           "publish",
@@ -6432,7 +6482,9 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
-import { exec as exec6, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { exec as exec7, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
 var NpmError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -6445,7 +6497,7 @@ var NpmRegistry = class extends Registry {
     __publicField(this, "registry", "https://registry.npmjs.org");
   }
   async npm(args) {
-    const { stdout } = await exec6("npm", args, { throwOnError: true });
+    const { stdout } = await exec7("npm", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -6556,7 +6608,7 @@ var NpmRegistry = class extends Registry {
   }
   async ping() {
     try {
-      await exec6("npm", ["ping"], { throwOnError: true });
+      await exec7("npm", ["ping"], { throwOnError: true });
       return true;
     } catch (error) {
       throw new NpmError("Failed to run `npm ping`", { cause: error });
@@ -6587,11 +6639,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await exec7("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: join(tmpdir(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof NonZeroExitError3 ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -7214,10 +7277,10 @@ var prerequisitesCheckTask = (options) => {
 import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter6 } from "@listr2/prompt-adapter-enquirer";
 
 // src/registry/custom-registry.ts
-import { exec as exec7 } from "tinyexec";
+import { exec as exec8 } from "tinyexec";
 var CustomRegistry = class extends NpmRegistry {
   async npm(args) {
-    const { stdout } = await exec7(
+    const { stdout } = await exec8(
       "npm",
       args.concat("--registry", this.registry),
       { throwOnError: true }
@@ -7526,55 +7589,14 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
+              await exec9(packageManager, ["run", ctx2.testScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7591,7 +7613,7 @@ async function run(options) {
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
+              await exec9(packageManager, ["run", ctx2.buildScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7651,12 +7673,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7751,7 +7780,7 @@ import micromatch from "micromatch";
 
 // src/monorepo/workspace.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { parse as parse2 } from "yaml";
 
 // src/monorepo/groups.ts
@@ -7994,7 +8023,7 @@ defaultCmd.action(
     };
     try {
       if (options.preflight) {
-        context.version = nextVersion || "0.0.0-preflight";
+        await requiredMissingInformationTasks().run(context);
       } else if (isCI3) {
         if (options.publishOnly) {
           const git = new Git();

package/dist/index.cjs

@@ -4486,7 +4486,7 @@ var Listr = (_a23 = class {
 // src/tasks/runner.ts
 var import_semver3 = __toESM(require("semver"), 1);
 var import_std_env = require("std-env");
-var import_tinyexec7 = require("tinyexec");
+var import_tinyexec8 = require("tinyexec");
 
 // src/error.ts
 var AbstractError = class extends Error {
@@ -4818,6 +4818,7 @@ function link2(text, url) {
 var import_promises2 = require("fs/promises");
 var import_node_path2 = __toESM(require("path"), 1);
 var import_smol_toml = require("smol-toml");
+var import_tinyexec2 = require("tinyexec");
 
 // src/ecosystem/ecosystem.ts
 var Ecosystem = class {
@@ -4860,6 +4861,28 @@ var RustEcosystem = class extends Ecosystem {
     pkg.version = newVersion;
     await (0, import_promises2.writeFile)(filePath, (0, import_smol_toml.stringify)(cargo));
   }
+  async syncLockfile() {
+    const lockfilePath = await this.findLockfile();
+    if (!lockfilePath) return void 0;
+    const name = await this.packageName();
+    await (0, import_tinyexec2.exec)("cargo", ["update", "--package", name], {
+      nodeOptions: { cwd: import_node_path2.default.dirname(lockfilePath) }
+    });
+    return lockfilePath;
+  }
+  async findLockfile() {
+    let dir = this.packagePath;
+    const { root } = import_node_path2.default.parse(dir);
+    while (dir !== root) {
+      const candidate = import_node_path2.default.join(dir, "Cargo.lock");
+      try {
+        if ((await (0, import_promises2.stat)(candidate)).isFile()) return candidate;
+      } catch {
+      }
+      dir = import_node_path2.default.dirname(dir);
+    }
+    return void 0;
+  }
   async dependencies() {
     const cargo = await this.readCargoToml();
     const deps = [];
@@ -5167,10 +5190,19 @@ async function replaceVersion(version2, packages) {
           { cause: error }
         );
       }
-      return import_node_path3.default.join(pkg.path, "Cargo.toml");
+      let lockfilePath;
+      try {
+        lockfilePath = await eco.syncLockfile();
+      } catch (error) {
+        throw new AbstractError(
+          `Failed to sync Cargo.lock at ${pkg.path}: ${error instanceof Error ? error.message : error}`,
+          { cause: error }
+        );
+      }
+      return [import_node_path3.default.join(pkg.path, "Cargo.toml"), lockfilePath];
     })
   ]);
-  return results.filter((v) => v);
+  return [...new Set(results.flat().filter((v) => !!v))];
 }
 
 // src/utils/package-manager.ts
@@ -5332,7 +5364,7 @@ function injectTokensToEnv(tokens) {
 
 // src/registry/crates.ts
 var import_node_path5 = __toESM(require("path"), 1);
-var import_tinyexec2 = require("tinyexec");
+var import_tinyexec3 = require("tinyexec");
 
 // src/registry/registry.ts
 var Registry = class {
@@ -5372,7 +5404,7 @@ var CratesRegistry = class extends Registry {
   }
   async isInstalled() {
     try {
-      await (0, import_tinyexec2.exec)("cargo", ["--version"]);
+      await (0, import_tinyexec3.exec)("cargo", ["--version"]);
       return true;
     } catch {
       return false;
@@ -5413,10 +5445,10 @@ var CratesRegistry = class extends Registry {
       if (manifestDir) {
         args.push("--manifest-path", import_node_path5.default.join(manifestDir, "Cargo.toml"));
       }
-      await (0, import_tinyexec2.exec)("cargo", args, { throwOnError: true });
+      await (0, import_tinyexec3.exec)("cargo", args, { throwOnError: true });
       return true;
     } catch (error) {
-      const stderr = error instanceof import_tinyexec2.NonZeroExitError ? error.output?.stderr : void 0;
+      const stderr = error instanceof import_tinyexec3.NonZeroExitError ? error.output?.stderr : void 0;
       const message = stderr ? `Failed to run \`cargo publish\`:
 ${stderr}` : "Failed to run `cargo publish`";
       throw new CratesError(message, { cause: error });
@@ -5428,9 +5460,9 @@ ${stderr}` : "Failed to run `cargo publish`";
       if (manifestDir) {
         args.push("--manifest-path", import_node_path5.default.join(manifestDir, "Cargo.toml"));
       }
-      await (0, import_tinyexec2.exec)("cargo", args, { throwOnError: true });
+      await (0, import_tinyexec3.exec)("cargo", args, { throwOnError: true });
     } catch (error) {
-      const stderr = error instanceof import_tinyexec2.NonZeroExitError ? error.output?.stderr : void 0;
+      const stderr = error instanceof import_tinyexec3.NonZeroExitError ? error.output?.stderr : void 0;
       const message = stderr ? `Failed to run \`cargo publish --dry-run\`:
 ${stderr}` : "Failed to run `cargo publish --dry-run`";
       throw new CratesError(message, { cause: error });
@@ -5526,7 +5558,7 @@ var cratesPublishTasks = createCratesPublishTask();
 var import_prompt_adapter_enquirer = require("@listr2/prompt-adapter-enquirer");
 
 // src/registry/jsr.ts
-var import_tinyexec3 = require("tinyexec");
+var import_tinyexec4 = require("tinyexec");
 
 // src/utils/package-name.ts
 var import_node_module = require("module");
@@ -5594,7 +5626,7 @@ var JsrRegisry = class extends Registry {
     this.client = new JsrClient(getApiEndpoint(this.registry));
   }
   async jsr(args) {
-    const { stdout } = await (0, import_tinyexec3.exec)("jsr", args, { throwOnError: true });
+    const { stdout } = await (0, import_tinyexec4.exec)("jsr", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -5610,7 +5642,7 @@ var JsrRegisry = class extends Registry {
   }
   async ping() {
     try {
-      const { stdout } = await (0, import_tinyexec3.exec)(
+      const { stdout } = await (0, import_tinyexec4.exec)(
         "ping",
         [new URL(this.registry).hostname, "-c", "1"],
         { throwOnError: true }
@@ -5625,7 +5657,7 @@ var JsrRegisry = class extends Registry {
   }
   async publish() {
     try {
-      await (0, import_tinyexec3.exec)(
+      await (0, import_tinyexec4.exec)(
         "jsr",
         ["publish", "--allow-dirty", "--token", `${JsrClient.token}`],
         {
@@ -5635,7 +5667,7 @@ var JsrRegisry = class extends Registry {
       this.packageCreationUrls = void 0;
       return true;
     } catch (error) {
-      const stderr = error instanceof import_tinyexec3.NonZeroExitError ? error.output?.stderr : void 0;
+      const stderr = error instanceof import_tinyexec4.NonZeroExitError ? error.output?.stderr : void 0;
       if (stderr?.includes("don't exist")) {
         const urls = [...stderr.matchAll(/https:\/\/jsr\.io\/new\S+/g)].map(
           (m) => m[0]
@@ -5656,7 +5688,7 @@ ${stderr}` : ""}`,
   }
   async dryRunPublish() {
     try {
-      await (0, import_tinyexec3.exec)(
+      await (0, import_tinyexec4.exec)(
         "jsr",
         [
           "publish",
@@ -5914,7 +5946,9 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
-var import_tinyexec4 = require("tinyexec");
+var import_node_os = require("os");
+var import_node_path6 = require("path");
+var import_tinyexec5 = require("tinyexec");
 var NpmError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -5927,7 +5961,7 @@ var NpmRegistry = class extends Registry {
     __publicField(this, "registry", "https://registry.npmjs.org");
   }
   async npm(args) {
-    const { stdout } = await (0, import_tinyexec4.exec)("npm", args, { throwOnError: true });
+    const { stdout } = await (0, import_tinyexec5.exec)("npm", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -5971,7 +6005,7 @@ var NpmRegistry = class extends Registry {
       await this.npm(["whoami"]);
       return true;
     } catch (error) {
-      if (error instanceof import_tinyexec4.NonZeroExitError) {
+      if (error instanceof import_tinyexec5.NonZeroExitError) {
         return false;
       }
       throw new NpmError("Failed to run `npm whoami`", { cause: error });
@@ -6038,7 +6072,7 @@ var NpmRegistry = class extends Registry {
   }
   async ping() {
     try {
-      await (0, import_tinyexec4.exec)("npm", ["ping"], { throwOnError: true });
+      await (0, import_tinyexec5.exec)("npm", ["ping"], { throwOnError: true });
       return true;
     } catch (error) {
       throw new NpmError("Failed to run `npm ping`", { cause: error });
@@ -6049,7 +6083,7 @@ var NpmRegistry = class extends Registry {
       await this.npm(["publish", "--provenance", "--access", "public"]);
       return true;
     } catch (error) {
-      if (error instanceof import_tinyexec4.NonZeroExitError && error.output?.stderr.includes("EOTP")) {
+      if (error instanceof import_tinyexec5.NonZeroExitError && error.output?.stderr.includes("EOTP")) {
         return false;
       }
       throw this.classifyPublishError(error);
@@ -6061,7 +6095,7 @@ var NpmRegistry = class extends Registry {
       await this.npm(args);
       return true;
     } catch (error) {
-      if (error instanceof import_tinyexec4.NonZeroExitError && error.output?.stderr.includes("EOTP")) {
+      if (error instanceof import_tinyexec5.NonZeroExitError && error.output?.stderr.includes("EOTP")) {
         return false;
       }
       throw this.classifyPublishError(error);
@@ -6069,11 +6103,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await (0, import_tinyexec5.exec)("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: (0, import_node_path6.join)((0, import_node_os.tmpdir)(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof import_tinyexec5.NonZeroExitError ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -6095,7 +6140,7 @@ var NpmRegistry = class extends Registry {
     };
   }
   classifyPublishError(error) {
-    if (error instanceof import_tinyexec4.NonZeroExitError) {
+    if (error instanceof import_tinyexec5.NonZeroExitError) {
       const stderr = error.output?.stderr ?? "";
       if (stderr.includes("EOTP")) {
         return new NpmError("OTP required for publishing", { cause: error });
@@ -6547,8 +6592,9 @@ var npmPublishTasks = {
 };
 
 // src/tasks/preflight.ts
+var import_node_crypto2 = require("crypto");
 var import_prompt_adapter_enquirer4 = require("@listr2/prompt-adapter-enquirer");
-var import_tinyexec5 = require("tinyexec");
+var import_tinyexec6 = require("tinyexec");
 var PreflightError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -6575,13 +6621,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await (0, import_tinyexec5.exec)("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = (0, import_tinyexec6.exec)("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return (0, import_node_crypto2.createHash)("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(import_prompt_adapter_enquirer4.ListrEnquirerPromptAdapter).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -6592,6 +6654,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -6752,10 +6815,10 @@ var prerequisitesCheckTask = (options) => {
 var import_prompt_adapter_enquirer6 = require("@listr2/prompt-adapter-enquirer");
 
 // src/registry/custom-registry.ts
-var import_tinyexec6 = require("tinyexec");
+var import_tinyexec7 = require("tinyexec");
 var CustomRegistry = class extends NpmRegistry {
   async npm(args) {
-    const { stdout } = await (0, import_tinyexec6.exec)(
+    const { stdout } = await (0, import_tinyexec7.exec)(
       "npm",
       args.concat("--registry", this.registry),
       { throwOnError: true }
@@ -7065,55 +7128,14 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.testScript], {
+              await (0, import_tinyexec8.exec)(packageManager, ["run", ctx2.testScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7130,7 +7152,7 @@ async function run(options) {
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await (0, import_tinyexec7.exec)(packageManager, ["run", ctx2.buildScript], {
+              await (0, import_tinyexec8.exec)(packageManager, ["run", ctx2.buildScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7190,12 +7212,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7321,11 +7350,11 @@ function generateChangelog(version2, entries, depUpdates) {
 
 // src/changeset/migrate.ts
 var import_node_fs2 = require("fs");
-var import_node_path6 = __toESM(require("path"), 1);
+var import_node_path7 = __toESM(require("path"), 1);
 var import_node_process9 = __toESM(require("process"), 1);
 var SKIPPED_FILES = /* @__PURE__ */ new Set(["config.json", "README.md"]);
 function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
-  const changesetDir = import_node_path6.default.join(cwd, ".changeset");
+  const changesetDir = import_node_path7.default.join(cwd, ".changeset");
   if (!(0, import_node_fs2.existsSync)(changesetDir)) {
     return {
       success: false,
@@ -7334,7 +7363,7 @@ function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
       configMigrated: false
     };
   }
-  const pubmDir = import_node_path6.default.join(cwd, ".pubm", "changesets");
+  const pubmDir = import_node_path7.default.join(cwd, ".pubm", "changesets");
   (0, import_node_fs2.mkdirSync)(pubmDir, { recursive: true });
   const files = (0, import_node_fs2.readdirSync)(changesetDir);
   const migratedFiles = [];
@@ -7349,15 +7378,15 @@ function migrateFromChangesets(cwd = import_node_process9.default.cwd()) {
     }
     if (file === "pre.json") {
       (0, import_node_fs2.copyFileSync)(
-        import_node_path6.default.join(changesetDir, file),
-        import_node_path6.default.resolve(cwd, ".pubm", "pre.json")
+        import_node_path7.default.join(changesetDir, file),
+        import_node_path7.default.resolve(cwd, ".pubm", "pre.json")
       );
       migratedFiles.push(file);
       continue;
     }
     if (file.endsWith(".md")) {
-      const src = import_node_path6.default.join(changesetDir, file);
-      const dest = import_node_path6.default.join(pubmDir, file);
+      const src = import_node_path7.default.join(changesetDir, file);
+      const dest = import_node_path7.default.join(pubmDir, file);
       (0, import_node_fs2.copyFileSync)(src, dest);
       migratedFiles.push(file);
     }
@@ -7404,10 +7433,10 @@ function parseChangeset(content, fileName) {
 
 // src/changeset/reader.ts
 var import_node_fs3 = require("fs");
-var import_node_path7 = __toESM(require("path"), 1);
+var import_node_path8 = __toESM(require("path"), 1);
 var import_node_process10 = __toESM(require("process"), 1);
 function readChangesets(cwd = import_node_process10.default.cwd()) {
-  const changesetsDir = import_node_path7.default.join(cwd, ".pubm", "changesets");
+  const changesetsDir = import_node_path8.default.join(cwd, ".pubm", "changesets");
   if (!(0, import_node_fs3.existsSync)(changesetsDir)) {
     return [];
   }
@@ -7417,7 +7446,7 @@ function readChangesets(cwd = import_node_process10.default.cwd()) {
     if (!file.endsWith(".md") || file === "README.md") {
       continue;
     }
-    const filePath = import_node_path7.default.join(changesetsDir, file);
+    const filePath = import_node_path8.default.join(changesetsDir, file);
     const content = (0, import_node_fs3.readFileSync)(filePath, "utf-8");
     changesets.push(parseChangeset(content, file));
   }
@@ -7487,7 +7516,7 @@ function calculateVersionBumps(currentVersions, cwd = import_node_process12.defa
 
 // src/changeset/writer.ts
 var import_node_fs4 = require("fs");
-var import_node_path8 = __toESM(require("path"), 1);
+var import_node_path9 = __toESM(require("path"), 1);
 var import_node_process13 = __toESM(require("process"), 1);
 var import_yaml2 = require("yaml");
 var adjectives = [
@@ -7582,11 +7611,11 @@ ${summary}
   return content;
 }
 function writeChangeset(releases, summary, cwd = import_node_process13.default.cwd()) {
-  const changesetsDir = import_node_path8.default.join(cwd, ".pubm", "changesets");
+  const changesetsDir = import_node_path9.default.join(cwd, ".pubm", "changesets");
   (0, import_node_fs4.mkdirSync)(changesetsDir, { recursive: true });
   const id = generateChangesetId();
   const fileName = `${id}.md`;
-  const filePath = import_node_path8.default.join(changesetsDir, fileName);
+  const filePath = import_node_path9.default.join(changesetsDir, fileName);
   const content = generateChangesetContent(releases, summary);
   (0, import_node_fs4.writeFileSync)(filePath, content, "utf-8");
   return filePath;
@@ -7645,23 +7674,23 @@ function topologicalSort(graph) {
 
 // src/monorepo/discover.ts
 var import_node_fs6 = require("fs");
-var import_node_path10 = __toESM(require("path"), 1);
+var import_node_path11 = __toESM(require("path"), 1);
 var import_micromatch = __toESM(require("micromatch"), 1);
 
 // src/monorepo/workspace.ts
 var import_node_fs5 = require("fs");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 var import_yaml3 = require("yaml");
 function detectWorkspace(cwd) {
   const root = cwd ?? process.cwd();
-  const pnpmWorkspacePath = (0, import_node_path9.join)(root, "pnpm-workspace.yaml");
+  const pnpmWorkspacePath = (0, import_node_path10.join)(root, "pnpm-workspace.yaml");
   if ((0, import_node_fs5.existsSync)(pnpmWorkspacePath)) {
     const content = (0, import_node_fs5.readFileSync)(pnpmWorkspacePath, "utf-8");
     const parsed = (0, import_yaml3.parse)(content);
     const packages = parsed?.packages ?? [];
     return { type: "pnpm", patterns: packages };
   }
-  const packageJsonPath = (0, import_node_path9.join)(root, "package.json");
+  const packageJsonPath = (0, import_node_path10.join)(root, "package.json");
   if ((0, import_node_fs5.existsSync)(packageJsonPath)) {
     const content = (0, import_node_fs5.readFileSync)(packageJsonPath, "utf-8");
     const pkg = JSON.parse(content);
@@ -7722,9 +7751,9 @@ function applyLinkedGroup(bumps, group) {
 
 // src/prerelease/pre.ts
 var import_node_fs7 = require("fs");
-var import_node_path11 = __toESM(require("path"), 1);
+var import_node_path12 = __toESM(require("path"), 1);
 function getPreStatePath(cwd) {
-  return import_node_path11.default.resolve(cwd ?? process.cwd(), ".pubm", "pre.json");
+  return import_node_path12.default.resolve(cwd ?? process.cwd(), ".pubm", "pre.json");
 }
 function readPreState(cwd) {
   const filePath = getPreStatePath(cwd);
@@ -7741,7 +7770,7 @@ function enterPreMode(tag, cwd) {
       "Already in pre mode. Exit pre mode first before entering a new one."
     );
   }
-  const dir = import_node_path11.default.dirname(filePath);
+  const dir = import_node_path12.default.dirname(filePath);
   if (!(0, import_node_fs7.existsSync)(dir)) {
     (0, import_node_fs7.mkdirSync)(dir, { recursive: true });
   }
@@ -7783,10 +7812,10 @@ function generateSnapshotVersion(options) {
 
 // src/validate/entry-points.ts
 var import_node_fs8 = require("fs");
-var import_node_path12 = __toESM(require("path"), 1);
+var import_node_path13 = __toESM(require("path"), 1);
 var SIMPLE_FIELDS = ["main", "module", "types", "typings"];
 function checkPath(filePath, cwd) {
-  return (0, import_node_fs8.existsSync)(import_node_path12.default.resolve(cwd, filePath));
+  return (0, import_node_fs8.existsSync)(import_node_path13.default.resolve(cwd, filePath));
 }
 function validateExports(exports2, cwd, prefix = "exports") {
   const errors = [];

package/dist/index.js

@@ -4453,7 +4453,7 @@ var Listr = (_a23 = class {
 // src/tasks/runner.ts
 import SemVer from "semver";
 import { isCI as isCI2 } from "std-env";
-import { exec as exec8 } from "tinyexec";
+import { exec as exec9 } from "tinyexec";
 
 // src/error.ts
 var AbstractError = class extends Error {
@@ -4785,6 +4785,7 @@ function link2(text, url) {
 import { readFile, stat as stat2, writeFile } from "node:fs/promises";
 import path2 from "node:path";
 import { parse, stringify } from "smol-toml";
+import { exec as exec3 } from "tinyexec";
 
 // src/ecosystem/ecosystem.ts
 var Ecosystem = class {
@@ -4827,6 +4828,28 @@ var RustEcosystem = class extends Ecosystem {
     pkg.version = newVersion;
     await writeFile(filePath, stringify(cargo));
   }
+  async syncLockfile() {
+    const lockfilePath = await this.findLockfile();
+    if (!lockfilePath) return void 0;
+    const name = await this.packageName();
+    await exec3("cargo", ["update", "--package", name], {
+      nodeOptions: { cwd: path2.dirname(lockfilePath) }
+    });
+    return lockfilePath;
+  }
+  async findLockfile() {
+    let dir = this.packagePath;
+    const { root } = path2.parse(dir);
+    while (dir !== root) {
+      const candidate = path2.join(dir, "Cargo.lock");
+      try {
+        if ((await stat2(candidate)).isFile()) return candidate;
+      } catch {
+      }
+      dir = path2.dirname(dir);
+    }
+    return void 0;
+  }
   async dependencies() {
     const cargo = await this.readCargoToml();
     const deps = [];
@@ -5134,10 +5157,19 @@ async function replaceVersion(version2, packages) {
           { cause: error }
         );
       }
-      return path3.join(pkg.path, "Cargo.toml");
+      let lockfilePath;
+      try {
+        lockfilePath = await eco.syncLockfile();
+      } catch (error) {
+        throw new AbstractError(
+          `Failed to sync Cargo.lock at ${pkg.path}: ${error instanceof Error ? error.message : error}`,
+          { cause: error }
+        );
+      }
+      return [path3.join(pkg.path, "Cargo.toml"), lockfilePath];
     })
   ]);
-  return results.filter((v) => v);
+  return [...new Set(results.flat().filter((v) => !!v))];
 }
 
 // src/utils/package-manager.ts
@@ -5298,7 +5330,7 @@ function injectTokensToEnv(tokens) {
 
 // src/registry/crates.ts
 import path5 from "node:path";
-import { exec as exec3, NonZeroExitError } from "tinyexec";
+import { exec as exec4, NonZeroExitError } from "tinyexec";
 
 // src/registry/registry.ts
 var Registry = class {
@@ -5338,7 +5370,7 @@ var CratesRegistry = class extends Registry {
   }
   async isInstalled() {
     try {
-      await exec3("cargo", ["--version"]);
+      await exec4("cargo", ["--version"]);
       return true;
     } catch {
       return false;
@@ -5379,7 +5411,7 @@ var CratesRegistry = class extends Registry {
       if (manifestDir) {
         args.push("--manifest-path", path5.join(manifestDir, "Cargo.toml"));
       }
-      await exec3("cargo", args, { throwOnError: true });
+      await exec4("cargo", args, { throwOnError: true });
       return true;
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
@@ -5394,7 +5426,7 @@ ${stderr}` : "Failed to run `cargo publish`";
       if (manifestDir) {
         args.push("--manifest-path", path5.join(manifestDir, "Cargo.toml"));
       }
-      await exec3("cargo", args, { throwOnError: true });
+      await exec4("cargo", args, { throwOnError: true });
     } catch (error) {
       const stderr = error instanceof NonZeroExitError ? error.output?.stderr : void 0;
       const message = stderr ? `Failed to run \`cargo publish --dry-run\`:
@@ -5492,7 +5524,7 @@ var cratesPublishTasks = createCratesPublishTask();
 import { ListrEnquirerPromptAdapter } from "@listr2/prompt-adapter-enquirer";
 
 // src/registry/jsr.ts
-import { exec as exec4, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
+import { exec as exec5, NonZeroExitError as NonZeroExitError2 } from "tinyexec";
 
 // src/utils/package-name.ts
 import { builtinModules } from "node:module";
@@ -5559,7 +5591,7 @@ var JsrRegisry = class extends Registry {
     this.client = new JsrClient(getApiEndpoint(this.registry));
   }
   async jsr(args) {
-    const { stdout } = await exec4("jsr", args, { throwOnError: true });
+    const { stdout } = await exec5("jsr", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -5575,7 +5607,7 @@ var JsrRegisry = class extends Registry {
   }
   async ping() {
     try {
-      const { stdout } = await exec4(
+      const { stdout } = await exec5(
         "ping",
         [new URL(this.registry).hostname, "-c", "1"],
         { throwOnError: true }
@@ -5590,7 +5622,7 @@ var JsrRegisry = class extends Registry {
   }
   async publish() {
     try {
-      await exec4(
+      await exec5(
         "jsr",
         ["publish", "--allow-dirty", "--token", `${JsrClient.token}`],
         {
@@ -5621,7 +5653,7 @@ ${stderr}` : ""}`,
   }
   async dryRunPublish() {
     try {
-      await exec4(
+      await exec5(
         "jsr",
         [
           "publish",
@@ -5879,7 +5911,9 @@ async function jsrRegistry() {
 }
 
 // src/registry/npm.ts
-import { exec as exec5, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { exec as exec6, NonZeroExitError as NonZeroExitError3 } from "tinyexec";
 var NpmError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -5892,7 +5926,7 @@ var NpmRegistry = class extends Registry {
     __publicField(this, "registry", "https://registry.npmjs.org");
   }
   async npm(args) {
-    const { stdout } = await exec5("npm", args, { throwOnError: true });
+    const { stdout } = await exec6("npm", args, { throwOnError: true });
     return stdout;
   }
   async isInstalled() {
@@ -6003,7 +6037,7 @@ var NpmRegistry = class extends Registry {
   }
   async ping() {
     try {
-      await exec5("npm", ["ping"], { throwOnError: true });
+      await exec6("npm", ["ping"], { throwOnError: true });
       return true;
     } catch (error) {
       throw new NpmError("Failed to run `npm ping`", { cause: error });
@@ -6034,11 +6068,22 @@ var NpmRegistry = class extends Registry {
   }
   async dryRunPublish() {
     try {
-      await this.npm(["publish", "--dry-run"]);
-    } catch (error) {
-      throw new NpmError("Failed to run `npm publish --dry-run`", {
-        cause: error
+      await exec6("npm", ["publish", "--dry-run"], {
+        throwOnError: true,
+        nodeOptions: {
+          env: {
+            ...process.env,
+            npm_config_cache: join(tmpdir(), "pubm-npm-cache")
+          }
+        }
       });
+    } catch (error) {
+      const stderr = error instanceof NonZeroExitError3 ? error.output?.stderr : void 0;
+      throw new NpmError(
+        `Failed to run \`npm publish --dry-run\`${stderr ? `
+${stderr}` : ""}`,
+        { cause: error }
+      );
     }
   }
   async twoFactorAuthMode() {
@@ -6512,8 +6557,9 @@ var npmPublishTasks = {
 };
 
 // src/tasks/preflight.ts
+import { createHash as createHash2 } from "node:crypto";
 import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter4 } from "@listr2/prompt-adapter-enquirer";
-import { exec as exec6 } from "tinyexec";
+import { exec as exec7 } from "tinyexec";
 var PreflightError = class extends AbstractError {
   constructor() {
     super(...arguments);
@@ -6540,13 +6586,29 @@ async function syncGhSecrets(tokens) {
   for (const [registry, token] of Object.entries(tokens)) {
     const config = TOKEN_CONFIG[registry];
     if (!config) continue;
-    await exec6("gh", ["secret", "set", config.ghSecretName], {
-      throwOnError: true,
-      nodeOptions: { input: token }
+    const result = exec7("gh", ["secret", "set", config.ghSecretName], {
+      throwOnError: true
     });
+    const proc = result.process;
+    if (proc?.stdin) {
+      proc.stdin.end(token);
+    }
+    await result;
   }
 }
+function tokensSyncHash(tokens) {
+  const sorted = Object.entries(tokens).sort(([a2], [b]) => a2.localeCompare(b));
+  return createHash2("sha256").update(JSON.stringify(sorted)).digest("hex").slice(0, 16);
+}
+var SYNC_HASH_DB_KEY = "gh-secrets-sync-hash";
 async function promptGhSecretsSync(tokens, task) {
+  const db = new Db();
+  const currentHash = tokensSyncHash(tokens);
+  const storedHash = db.get(SYNC_HASH_DB_KEY);
+  if (storedHash === currentHash) {
+    task.output = "Tokens already synced to GitHub Secrets.";
+    return;
+  }
   const shouldSync = await task.prompt(ListrEnquirerPromptAdapter4).run({
     type: "toggle",
     message: "Sync tokens to GitHub Secrets?",
@@ -6557,6 +6619,7 @@ async function promptGhSecretsSync(tokens, task) {
     task.output = "Syncing tokens to GitHub Secrets...";
     try {
       await syncGhSecrets(tokens);
+      db.set(SYNC_HASH_DB_KEY, currentHash);
       task.output = "Tokens synced to GitHub Secrets.";
     } catch (error) {
       throw new PreflightError(
@@ -6717,10 +6780,10 @@ var prerequisitesCheckTask = (options) => {
 import { ListrEnquirerPromptAdapter as ListrEnquirerPromptAdapter6 } from "@listr2/prompt-adapter-enquirer";
 
 // src/registry/custom-registry.ts
-import { exec as exec7 } from "tinyexec";
+import { exec as exec8 } from "tinyexec";
 var CustomRegistry = class extends NpmRegistry {
   async npm(args) {
-    const { stdout } = await exec7(
+    const { stdout } = await exec8(
       "npm",
       args.concat("--registry", this.registry),
       { throwOnError: true }
@@ -7029,14 +7092,14 @@ async function run(options) {
         task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
           concurrent: true
         })
-      } : options.preflight ? [
+      } : [
         {
           skip: options.skipTests,
           title: "Running tests",
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
+              await exec9(packageManager, ["run", ctx2.testScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7053,48 +7116,7 @@ async function run(options) {
           task: async (ctx2) => {
             const packageManager = await getPackageManager();
             try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Build script '${ctx2.buildScript}' failed. Run \`${packageManager} run ${ctx2.buildScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          title: "Validating publish (dry-run)",
-          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
-            concurrent: true
-          })
-        }
-      ] : [
-        {
-          skip: options.skipTests,
-          title: "Running tests",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.testScript], {
-                throwOnError: true
-              });
-            } catch (error) {
-              throw new AbstractError(
-                `Test script '${ctx2.testScript}' failed. Run \`${packageManager} run ${ctx2.testScript}\` locally to see full output.`,
-                { cause: error }
-              );
-            }
-          }
-        },
-        {
-          skip: options.skipBuild,
-          title: "Building the project",
-          task: async (ctx2) => {
-            const packageManager = await getPackageManager();
-            try {
-              await exec8(packageManager, ["run", ctx2.buildScript], {
+              await exec9(packageManager, ["run", ctx2.buildScript], {
                 throwOnError: true
               });
             } catch (error) {
@@ -7154,12 +7176,19 @@ async function run(options) {
           }
         },
         {
-          skip: (ctx2) => options.skipPublish || !!ctx2.preview,
+          skip: (ctx2) => options.skipPublish || !!ctx2.preview || options.preflight,
           title: "Publishing",
           task: async (ctx2, parentTask) => parentTask.newListr(await collectPublishTasks(ctx2), {
             concurrent: true
           })
         },
+        {
+          skip: !options.preflight,
+          title: "Validating publish (dry-run)",
+          task: async (ctx2, parentTask) => parentTask.newListr(await collectDryRunPublishTasks(ctx2), {
+            concurrent: true
+          })
+        },
         {
           title: "Pushing tags to GitHub",
           skip: (ctx2) => !!ctx2.preview,
@@ -7614,18 +7643,18 @@ import micromatch from "micromatch";
 
 // src/monorepo/workspace.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { join } from "node:path";
+import { join as join2 } from "node:path";
 import { parse as parse2 } from "yaml";
 function detectWorkspace(cwd) {
   const root = cwd ?? process.cwd();
-  const pnpmWorkspacePath = join(root, "pnpm-workspace.yaml");
+  const pnpmWorkspacePath = join2(root, "pnpm-workspace.yaml");
   if (existsSync3(pnpmWorkspacePath)) {
     const content = readFileSync3(pnpmWorkspacePath, "utf-8");
     const parsed = parse2(content);
     const packages = parsed?.packages ?? [];
     return { type: "pnpm", patterns: packages };
   }
-  const packageJsonPath = join(root, "package.json");
+  const packageJsonPath = join2(root, "package.json");
   if (existsSync3(packageJsonPath)) {
     const content = readFileSync3(packageJsonPath, "utf-8");
     const pkg = JSON.parse(content);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pubm",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "engines": {
     "node": ">=18",
     "git": ">=2.11.0"
@@ -33,7 +33,7 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest --run",
     "coverage": "vitest --run --coverage",
-    "release": "pnpm build && node bin/cli.js --no-publish",
+    "release": "pnpm build && node bin/cli.js --preflight",
     "ci:release": "node bin/cli.js --publish-only"
   },
   "dependencies": {