framework-m-studio 0.8.2__tar.gz → 0.8.4__tar.gz

{framework_m_studio-0.8.2 → framework_m_studio-0.8.4}/CHANGELOG.md

@@ -1,3 +1,38 @@
+## framework-m-studio v0.8.4
+
+### Bug Fixes
+
+- implement bulk dependency upgrades and fix typecheck stubs (bf01d94)
+- install pnpm and coreutils in release phase (ed335f8)
+- enforce tool availability and install pnpm in CI (b8f9465)
+- enforce lockfile sync, stage templates, and fix types (a41aad0)
+- enhance local dry-run and silence check-ignore spam (29f9ef6)
+- modernize gitops auth and api integration (7f15453)
+- secure staging logic and resolve test regressions (e31d701)
+- implement pnpm/uv lockfile sync and config cleanup (8302956)
+- lint cleanup for cli.py (40b3a78)
+- support GITLAB_TOKEN and harden auth check (c08b25c)
+- implement atomic direct push for CI/CD stability (2947270)
+- harden sync orchestration and align warning filters (714f9ba)
+- modularize release package and resolve test regressions (fe8c676)
+
+## framework-m-studio v0.8.3
+
+### Bug Fixes
+
+- install pnpm and coreutils in release phase (ed335f8)
+- enforce tool availability and install pnpm in CI (b8f9465)
+- enforce lockfile sync, stage templates, and fix types (a41aad0)
+- enhance local dry-run and silence check-ignore spam (29f9ef6)
+- modernize gitops auth and api integration (7f15453)
+- secure staging logic and resolve test regressions (e31d701)
+- implement pnpm/uv lockfile sync and config cleanup (8302956)
+- lint cleanup for cli.py (40b3a78)
+- support GITLAB_TOKEN and harden auth check (c08b25c)
+- implement atomic direct push for CI/CD stability (2947270)
+- harden sync orchestration and align warning filters (714f9ba)
+- modularize release package and resolve test regressions (fe8c676)
+
 # Changelog
 
 ## framework-m-studio v0.8.2

{framework_m_studio-0.8.2 → framework_m_studio-0.8.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: framework-m-studio
-Version: 0.8.2
+Version: 0.8.4
 Summary: Framework M Studio - Visual DocType Builder & Developer Tools
 Project-URL: Homepage, https://gitlab.com/castlecraft/framework-m
 Project-URL: Documentation, https://gitlab.com/castlecraft/framework-m#readme
@@ -20,8 +20,8 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.12
 Requires-Dist: bandit>=1.9.4
 Requires-Dist: build>=1.0.0
-Requires-Dist: framework-m-core>=0.11.2
-Requires-Dist: framework-m>=0.6.6
+Requires-Dist: framework-m-core>=0.11.4
+Requires-Dist: framework-m>=0.6.8
 Requires-Dist: honcho>=1.1.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: ipython>=9.11.0

{framework_m_studio-0.8.2 → framework_m_studio-0.8.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "framework-m-studio"
-version = "0.8.2"
+version = "0.8.4"
 description = "Framework M Studio - Visual DocType Builder & Developer Tools"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -21,8 +21,8 @@ classifiers = [
 ]
 
 dependencies = [
-    "framework-m-core>=0.11.2",
-    "framework-m>=0.6.6",
+    "framework-m-core>=0.11.4",
+    "framework-m>=0.6.8",
     # Code generation
     "libcst>=1.0.0",
     "jinja2>=3.1.0",
@@ -116,7 +116,10 @@ asyncio_mode = "auto"
 testpaths = ["tests"]
 addopts = "-v --tb=short"
 filterwarnings = [
-    "ignore:Core Pydantic V1 functionality isn't compatible with Python .* or greater.:UserWarning",
+    "ignore::DeprecationWarning",
+    "ignore::pytest.PytestRemovedIn9Warning",
+    "ignore:Core Pydantic V1 functionality isn't compatible.*:UserWarning:litestar.*",
+    "ignore:unclosed database in <sqlite3.Connection.*:ResourceWarning",
 ]
 
 [tool.coverage.run]
@@ -145,6 +148,10 @@ ignore_missing_imports = true
 module = "honcho.*"
 ignore_missing_imports = true
 
+[[tool.mypy.overrides]]
+module = "yaml"
+ignore_missing_imports = true
+
 [tool.ruff]
 line-length = 88
 target-version = "py312"

{framework_m_studio-0.8.2 → framework_m_studio-0.8.4}/src/framework_m_studio/cli/deps.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import os
 import sys
+from datetime import datetime
 from pathlib import Path
 from typing import Annotated
 
@@ -94,7 +95,10 @@ def deps_check_command(
 
 @deps_app.command(name="upgrade")
 async def deps_upgrade_command(
-    package: str,
+    package: Annotated[
+        str | None,
+        cyclopts.Parameter(name="package", help="Package to upgrade (omit for all)"),
+    ] = None,
     manager: Annotated[
         str, cyclopts.Parameter(name="--manager", help="uv or pnpm")
     ] = "uv",
@@ -113,6 +117,12 @@ async def deps_upgrade_command(
     root: Annotated[
         str | None, cyclopts.Parameter(name="--root", help="Project root directory")
     ] = None,
+    skip_branch: Annotated[
+        bool,
+        cyclopts.Parameter(
+            name="--skip-branch", help="Skip branch creation, keep changes unstaged"
+        ),
+    ] = False,
 ) -> None:
     """Upgrade a dependency and create a merge request."""
     root_path = Path(root) if root else Path.cwd()
@@ -124,30 +134,73 @@ async def deps_upgrade_command(
     )
     final_project_id = project_id or os.environ.get("CI_PROJECT_ID") or ""
 
-    if manager == "uv":
-        run_cmd(f"uv lock --upgrade-package {package}", cwd=root_path)
-    elif manager == "pnpm":
-        run_cmd(f"pnpm update -r {package}", cwd=root_path)
+    # Check for changes in lockfiles and git status
+    uv_lock = root_path / "uv.lock"
+    pnpm_lock = root_path / "pnpm-lock.yaml"
+
+    uv_mtime = uv_lock.stat().st_mtime if uv_lock.exists() else 0
+    pnpm_mtime = pnpm_lock.stat().st_mtime if pnpm_lock.exists() else 0
+
+    if not package:
+        print(f"Checking for all outdated packages using {manager}...")
+        if manager == "uv":
+            outdated = _check_uv_outdated(root_path)
+            packages_to_upgrade = [pkg["name"] for pkg in outdated]
+            if not packages_to_upgrade:
+                print("All uv dependencies are up to date.")
+                return
+
+            print(f"Upgrading {len(packages_to_upgrade)} packages...")
+            pkg_args = " ".join(
+                [f"--upgrade-package {pkg}" for pkg in packages_to_upgrade]
+            )
+            run_cmd(f"uv lock {pkg_args}", cwd=root_path)
+        elif manager == "pnpm":
+            run_cmd("pnpm update -r", cwd=root_path)
+            print("Running pnpm audit fix...")
+            run_cmd("pnpm audit fix", cwd=root_path, check=False)
+        else:
+            print(f"Unknown manager: {manager}", file=sys.stderr)
+            return
+        package = "all"
     else:
-        print(f"Unknown manager: {manager}", file=sys.stderr)
+        if manager == "uv":
+            run_cmd(f"uv lock --upgrade-package {package}", cwd=root_path)
+        elif manager == "pnpm":
+            run_cmd(f"pnpm update -r {package}", cwd=root_path)
+        else:
+            print(f"Unknown manager: {manager}", file=sys.stderr)
+            return
+
+    # Check if anything actually changed
+    new_uv_mtime = uv_lock.stat().st_mtime if uv_lock.exists() else 0
+    new_pnpm_mtime = pnpm_lock.stat().st_mtime if pnpm_lock.exists() else 0
+
+    lock_changed = (new_uv_mtime != uv_mtime) or (new_pnpm_mtime != pnpm_mtime)
+    git_status = run_cmd("git status --short", cwd=root_path)
+
+    if not (git_status or lock_changed):
+        print(f"No changes found after updating {package or 'all'}. Skipping MR.")
         return
 
-    if dry_run:
-        print(f"[DRY RUN] Would create MR for {package}")
+    if dry_run or skip_branch:
+        if dry_run:
+            print(f"[DRY RUN] Would create MR for {package or 'all'}")
         return
 
-    safe_name = package.replace("@", "").replace("/", "-")
-    branch_name = f"deps/{manager}-{safe_name}"
+    # Create and switch to new branch
+    timestamp = datetime.now().strftime("%Y%m%d%H%M%S")
+    branch_name = f"deps/{manager}-{package or 'all'}-{timestamp}"
 
-    run_cmd("git checkout main", cwd=root_path, check=False)
+    # Check for existing branch and delete it
     run_cmd(f"git branch -D {branch_name}", cwd=root_path, check=False)
     run_cmd(f"git checkout -b {branch_name}", cwd=root_path)
 
-    status = run_cmd("git status --short", cwd=root_path)
-    if not status:
-        print(f"No changes found after updating {package}. Skipping MR.")
-        run_cmd("git checkout main", cwd=root_path)
-        return
+    # Force add lockfiles if they are ignored
+    if manager == "uv":
+        run_cmd("git add -f uv.lock", cwd=root_path, check=False)
+    elif manager == "pnpm":
+        run_cmd("git add -f pnpm-lock.yaml", cwd=root_path, check=False)
 
     run_cmd("git add .", cwd=root_path)
 

framework_m_studio-0.8.4/src/framework_m_studio/cli/release/__init__.py

@@ -0,0 +1,76 @@
+"""Release orchestration package.
+This module provides a unified namespace for automated releases,
+re-exporting specialized submodules while ensuring compatibility
+with the existing test suite's mocks.
+"""
+
+from __future__ import annotations
+
+from framework_m_studio.core.shell import run_cmd
+
+from .cli import (
+    release_app,
+    release_auto_command,
+    release_mr_command,
+    release_plan_command,
+    release_prepare_command,
+    release_push_command,
+    release_schema_command,
+    release_tag_command,
+)
+from .gitops import (
+    GitLabProvider,
+    GitProviderProtocol,
+    _get_commits_since,
+    _get_last_tag,
+    push_release_branch,
+)
+from .models import Commit, ReleaseConfig, ReleasePackage, ReleaseSync, ReleaseUpdate
+from .orchestrator import (
+    _determine_version_bump,
+    _load_release_config,
+    compute_release_plan,
+    create_or_update_mr,
+    prepare_release,
+    run_release_orchestration,
+    tag_and_release,
+)
+from .versioning import (
+    _bump_version,
+    _pin_inter_package_dependencies,
+    _prepend_changelog,
+    _update_file_version,
+)
+
+__all__ = [
+    "Commit",
+    "GitLabProvider",
+    "GitProviderProtocol",
+    "ReleaseConfig",
+    "ReleasePackage",
+    "ReleaseSync",
+    "ReleaseUpdate",
+    "_bump_version",
+    "_determine_version_bump",
+    "_get_commits_since",
+    "_get_last_tag",
+    "_load_release_config",
+    "_pin_inter_package_dependencies",
+    "_prepend_changelog",
+    "_update_file_version",
+    "compute_release_plan",
+    "create_or_update_mr",
+    "prepare_release",
+    "push_release_branch",
+    "release_app",
+    "release_auto_command",
+    "release_mr_command",
+    "release_plan_command",
+    "release_prepare_command",
+    "release_push_command",
+    "release_schema_command",
+    "release_tag_command",
+    "run_cmd",
+    "run_release_orchestration",
+    "tag_and_release",
+]

framework_m_studio-0.8.4/src/framework_m_studio/cli/release/cli.py

@@ -0,0 +1,201 @@
+"""CLI commands for release orchestration."""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+from typing import Annotated
+
+import cyclopts
+
+from .gitops import GitLabProvider
+from .models import ReleaseConfig
+from .orchestrator import (
+    _load_release_config,
+    compute_release_plan,
+    create_or_update_mr,
+    prepare_release,
+    push_release_branch,
+    run_release_orchestration,
+    tag_and_release,
+)
+
+# Main CLI app instance
+release_app = cyclopts.App(name="release")
+
+
+@release_app.command(name="auto")
+async def release_auto_command(
+    provider: str = "gitlab",
+    token: Annotated[str | None, cyclopts.Parameter(help="Git provider token")] = None,
+    project_id: Annotated[str | None, cyclopts.Parameter(help="Git project ID")] = None,
+    dry_run: Annotated[bool, cyclopts.Parameter(help="Dry run")] = False,
+) -> None:
+    """Automated multi-package release workflow."""
+    await run_release_orchestration(
+        provider=provider,
+        token=token
+        or os.environ.get("CITADEL_CI_TOKEN")
+        or os.environ.get("GITLAB_TOKEN")
+        or "",
+        project_id=project_id or os.environ.get("CI_PROJECT_ID") or "",
+        dry_run=dry_run,
+    )
+
+
+@release_app.command(name="plan")
+def release_plan_command(
+    config: str = "release-config.json", root: str | None = None, json: bool = False
+) -> None:
+    """Preview which components will be released."""
+    root_path = Path(root) if root else Path.cwd()
+    release_config = _load_release_config(config, root=root_path)
+    updates = compute_release_plan(release_config, root_path)
+    if json:
+        import json as _json
+
+        print(_json.dumps([u.model_dump() for u in updates], indent=2))
+        return
+    if not updates:
+        print("✅ No releases needed.")
+        return
+    for u in updates:
+        print(f"🚀 {u.component}: {u.current_version} -> {u.new_version} ({u.bump})")
+
+
+@release_app.command(name="prepare")
+def release_prepare_command(
+    config: str = "release-config.json",
+    branch: str = "release/next",
+    root: str | None = None,
+    no_sbom: bool = False,
+    dry_run: bool = False,
+) -> None:
+    """Prepare a release branch with bumped versions."""
+    root_path = Path(root) if root else Path.cwd()
+    try:
+        release_config = _load_release_config(config, root=root_path)
+    except FileNotFoundError:
+        if dry_run:
+            release_config = ReleaseConfig(packages=[])
+        else:
+            raise
+
+    updates = compute_release_plan(release_config, root_path)
+    if not updates:
+        if dry_run:
+            pass
+        else:
+            print("✅ No releases needed.")
+            return
+
+    if dry_run:
+        print(f"[DRY RUN] Would prepare branch {branch} for {len(updates)} components")
+        return
+    prepare_release(updates, branch, root_path, release_config, sbom=not no_sbom)
+    print(f"✅ Prepared release files for {branch}")
+
+
+@release_app.command(name="push")
+def release_push_command(
+    branch: str = "release/next",
+    host: str | None = None,
+    project_path: str | None = None,
+    token: str | None = None,
+    dry_run: bool = False,
+) -> None:
+    """Push the release branch to the origin remote."""
+    final_host = host or os.environ.get("CI_SERVER_HOST", "gitlab.com")
+    final_path = project_path or os.environ.get("CI_PROJECT_PATH", "")
+    final_token = (
+        token or os.environ.get("CITADEL_CI_TOKEN") or os.environ.get("GITLAB_TOKEN")
+    )
+    if dry_run:
+        print(f"[DRY RUN] Would push branch {branch} to {final_host}/{final_path}")
+        return
+    if not final_token:
+        print("Error: token missing", file=sys.stderr)
+        raise SystemExit(1)
+    push_release_branch(branch, final_host, final_path, final_token)
+    print(f"✅ Pushed branch {branch}")
+
+
+@release_app.command(name="mr")
+async def release_mr_command(
+    branch: str = "release/next",
+    target_branch: str = "main",
+    provider: str = "gitlab",
+    token: str | None = None,
+    project_id: str | None = None,
+    dry_run: bool = False,
+) -> None:
+    """Create or update a merge request."""
+    final_token = (
+        token or os.environ.get("CITADEL_CI_TOKEN") or os.environ.get("GITLAB_TOKEN")
+    )
+    final_project_id = project_id or os.environ.get("CI_PROJECT_ID")
+
+    if provider != "gitlab":
+        print(f"Provider '{provider}' not yet supported.", file=sys.stderr)
+        raise SystemExit(1)
+
+    if dry_run:
+        print(f"[DRY RUN] Would create/update MR for {branch} into {target_branch}")
+        return
+    if not final_token or not final_project_id:
+        print("Error: token/project_id missing", file=sys.stderr)
+        raise SystemExit(1)
+    provider_cls = GitLabProvider(token=final_token, project_id=final_project_id)
+    title = "chore(release): automated multi-package release"
+    desc = "## Automated Release"
+    await create_or_update_mr(branch, target_branch, title, desc, provider_cls)
+
+
+@release_app.command(name="tag")
+async def release_tag_command(
+    config: str = "release-config.json",
+    provider: str = "gitlab",
+    token: str | None = None,
+    project_id: str | None = None,
+    dry_run: bool = False,
+) -> None:
+    """Create tags and releases for updated components."""
+    final_token = (
+        token or os.environ.get("CITADEL_CI_TOKEN") or os.environ.get("GITLAB_TOKEN")
+    )
+    final_project_id = project_id or os.environ.get("CI_PROJECT_ID")
+    root_path = Path.cwd()
+
+    try:
+        release_config = _load_release_config(config, root=root_path)
+    except Exception:
+        if provider != "gitlab":
+            print(f"Provider '{provider}' not yet supported.", file=sys.stderr)
+            raise SystemExit(1) from None
+        raise
+
+    git_provider: GitLabProvider | None = None
+    if final_token and final_project_id:
+        if provider == "gitlab":
+            git_provider = GitLabProvider(
+                token=final_token, project_id=final_project_id
+            )
+        else:
+            print(f"Provider '{provider}' not yet supported.", file=sys.stderr)
+            raise SystemExit(1)
+    await tag_and_release(release_config, root_path, git_provider, dry_run)
+
+
+def release_schema_command(output: str | None = None) -> None:
+    """Generate JSON schema for the release configuration."""
+    from .models import ReleaseConfig
+
+    schema = ReleaseConfig.model_json_schema()
+    import json as _json
+
+    content = _json.dumps(schema, indent=2)
+    if output:
+        Path(output).write_text(content)
+    else:
+        print(content)

framework_m_studio-0.8.4/src/framework_m_studio/cli/release/gitops.py

@@ -0,0 +1,194 @@
+import os
+import re
+import subprocess
+import sys
+from typing import Any, Protocol, runtime_checkable
+
+import httpx
+
+from framework_m_studio.core.shell import run_cmd
+
+from .models import Commit
+
+
+@runtime_checkable
+class GitProviderProtocol(Protocol):
+    """Protocol for Git platform providers (GitLab, GitHub, etc.)."""
+
+    async def find_mr(self, branch: str) -> dict[str, Any] | None: ...
+
+    async def create_mr(
+        self, title: str, desc: str, branch: str, target_branch: str
+    ) -> dict[str, Any]: ...
+
+    async def update_mr(self, iid: str, title: str, desc: str) -> dict[str, Any]: ...
+
+    async def create_release(self, tag: str, changelog: str) -> dict[str, Any]: ...
+
+
+class GitLabProvider:
+    """GitLab-specific implementation of the GitProviderProtocol."""
+
+    def __init__(self, token: str, project_id: str):
+        self.token = token
+        self.project_id = project_id
+        self.api_url = os.environ.get("CI_API_V4_URL", "https://gitlab.com/api/v4")
+
+    async def _request(
+        self, method: str, path: str, data: dict[str, Any] | None = None
+    ) -> dict[str, Any] | None:
+        """Make an authenticated request to the GitLab API using httpx."""
+        url = f"{self.api_url}/projects/{self.project_id}{path}"
+        headers = {
+            "PRIVATE-TOKEN": self.token,
+            "Content-Type": "application/json",
+        }
+
+        try:
+            async with httpx.AsyncClient(timeout=60.0) as client:
+                response = await client.request(
+                    method, url, headers=headers, json=data if data else None
+                )
+                response.raise_for_status()
+                return response.json() if response.content.strip() else {}
+        except httpx.HTTPStatusError as e:
+            print(
+                f"Error: GitLab API {method} {path} failed with {e.response.status_code}",
+                file=sys.stderr,
+            )
+            return None
+        except Exception as e:
+            print(f"Error: GitLab API request failed: {e}", file=sys.stderr)
+            return None
+
+    async def find_mr(self, branch: str) -> dict[str, Any] | None:
+        path = f"/merge_requests?source_branch={branch}&state=opened"
+        mrs = await self._request("GET", path)
+        return mrs[0] if isinstance(mrs, list) and mrs else None
+
+    async def create_mr(
+        self, title: str, desc: str, branch: str, target_branch: str
+    ) -> dict[str, Any]:
+        path = "/merge_requests"
+        data = {
+            "title": title,
+            "description": desc,
+            "source_branch": branch,
+            "target_branch": target_branch,
+            "remove_source_branch": True,
+        }
+        res = await self._request("POST", path, data)
+        return res if res is not None else {}
+
+    async def update_mr(self, iid: str, title: str, desc: str) -> dict[str, Any]:
+        path = f"/merge_requests/{iid}"
+        data = {"title": title, "description": desc}
+        res = await self._request("PUT", path, data)
+        return res if res is not None else {}
+
+    async def create_release(self, tag: str, changelog: str) -> dict[str, Any]:
+        path = "/releases"
+        data = {"tag_name": tag, "description": changelog}
+        res = await self._request("POST", path, data)
+        return res if res is not None else {}
+
+
+def _get_last_tag(component: str) -> str | None:
+    """Get the last git tag for a component (e.g., pkg-name@v1.2.3)."""
+    match_pattern = f"{component}@v*"
+    try:
+        # Use list-based command for security
+        tag = run_cmd(
+            ["git", "describe", "--tags", "--abbrev=0", f"--match={match_pattern}"],
+            check=False,
+        )
+        return tag.strip() if tag else None
+    except Exception:
+        return None
+
+
+def _get_commits_since(tag: str | None) -> list[Commit]:
+    """Get list of conventional commits since a tag (or all if tag is None)."""
+    range_spec = f"{tag}..HEAD" if tag else "HEAD"
+    sep = "||COMMIT_SEP||"
+    log_format = f"%H%n%s%n%b%n{sep}"
+    # Use list-based command for security
+    output = run_cmd(["git", "log", range_spec, f"--pretty=format:{log_format}"])
+
+    commits = []
+    if output:
+        raw_commits = output.split(sep)
+        for raw in raw_commits:
+            if not raw.strip():
+                continue
+            lines = raw.strip().split("\n")
+            if len(lines) < 2:
+                continue
+            parsed = _parse_commit_message("\n".join(lines[1:]), lines[0])
+            if parsed:
+                commits.append(parsed)
+    return commits
+
+
+def _parse_commit_message(full_message: str, hash_str: str = "") -> Commit | None:
+    """Parse a conventional commit message into a Commit model."""
+    lines = full_message.strip().split("\n")
+    subject = lines[0]
+    body = "\n".join(lines[1:]).strip() if len(lines) > 1 else ""
+    pattern = r"^(\w+)(?:\(([\w\-\.\*]+)\))?(!)?:\s*(.+)"
+    match = re.match(pattern, subject)
+
+    if not match:
+        return None
+
+    commit_type, scope, breaking_mark, description = match.groups()
+    is_breaking = bool(breaking_mark) or "BREAKING CHANGE:" in body
+
+    body_tags = []
+    for line in body.split("\n"):
+        tag_match = re.search(r"^(?:Releases|Packages):\s*(.+)", line, re.I)
+        if tag_match:
+            body_tags.extend(
+                [
+                    s.strip()
+                    for s in tag_match.group(1).replace(",", " ").split()
+                    if s.strip()
+                ]
+            )
+
+    return Commit(
+        hash=hash_str,
+        subject=subject,
+        body=body,
+        type=commit_type,
+        scope=scope,
+        breaking=is_breaking,
+        description=description,
+        body_tags=body_tags,
+    )
+
+
+def push_release_branch(branch: str, host: str, project_path: str, token: str) -> None:
+    """Push the local release branch directly to the remote (using token)."""
+    normalized_path = project_path.lstrip("/")
+    if not normalized_path:
+        raise ValueError("Git project path is empty. Cannot determine remote URL.")
+    # Inject token into the remote URL for direct push
+    remote_url = f"https://oauth2:{token}@{host}/{normalized_path}.git"
+    # Use list-based command for security (Bandit B605)
+    # Use --force to ensure we can update the transient release branch in CI/CD
+    cmd = ["git", "push", "--force", remote_url, f"{branch}:refs/heads/{branch}"]
+    try:
+        # We use subprocess.run directly for fine-grained masking of the token in logs
+        result = subprocess.run(cmd, capture_output=True, text=True, check=False)
+        if result.returncode != 0:
+            error_msg = result.stderr or result.stdout or "Unknown git error"
+            # Mask the token in any error output
+            cleaned_error = error_msg.replace(token, "[MASKED]")
+            print(f"Error pushing release branch: {cleaned_error}", file=sys.stderr)
+            raise SystemExit(1)
+    except Exception as e:
+        # Mask the token in any exception message
+        cleaned_error = str(e).replace(token, "[MASKED]")
+        print(f"Failed to execute git push: {cleaned_error}", file=sys.stderr)
+        raise SystemExit(1) from None