feat: publish-target plugin system (npm / jsr / pypi / vscode-marketplace / open-vsx)

[theoephraim]

What

Packages can now publish to multiple targets at once. Each target is an instance of a plugin implementing one interface (src/core/targets/); built-ins: npm, custom (the existing shell-command escape hatch), jsr, pypi, vscode-marketplace, open-vsx.

// .bumpy/_config.json
{
  "targets": {
    "npm": { "provenance": true },                                  // type-level defaults
    "ghp": { "type": "npm", "registry": "https://npm.pkg.github.com" } // named reusable instance
  },
  "packages": {
    "my-lib": { "publishTargets": ["npm", "ghp", "jsr"] },
    "my-extension": { "publishTargets": [{ "type": "vscode-marketplace", "azureCredential": true }, "open-vsx"] },
    "my-py-tool": { "publishTargets": ["pypi"] } // stub package.json + pyproject.toml
  }
}

Design highlights

• Per-target resume: publish state is tracked per target instance in the GitHub release metadata (the metadata layer already supported this — the instance name is the key). npm succeeded + Open VSX failed → the retry re-runs only Open VSX. A registry-level guard (checkPublished before every publish) also prevents republish errors when metadata is lost.
• Shared artifacts: targets declaring the same artifact kind share one build — a single .vsix (packaged once via vsce package --no-dependencies) uploads to both the Marketplace and Open VSX, byte-identical. npm's pack-then-publish flow is the same mechanism (npm-tarball).
• Publish-time version sync (prepare() hook): jsr.json and pyproject.toml versions sync from package.json in the working tree at publish time — commit them as 0.0.0 and forget them. No version-phase changes needed.
• Capabilities: targets declare what they support; Marketplace/Open VSX (no prereleases), JSR/PyPI (no dist-tags → no snapshots) record skipped instead of failing mid-release.
• Trust model unchanged: name references in package.json are plain data; inline shell commands stay gated by allowCustomCommands. Broken target config degrades read-only commands to a warning; publish flows refuse loudly.
• Back-compat: publishCommand/skipNpmPublish map onto targets with the same metadata keys — in-flight releases resume cleanly, and all 411 pre-existing tests pass unmodified.

Validated against real setups

• varlock: the vscode extension's skipNpmPublish + vsce/ovsx script chain collapses to two targets (incl. azureCredential: true for its Azure-OIDC Marketplace auth) — and gains per-registry retry its cmd1 && cmd2 setup can't do.
• mirrordown: all four hand-rolled publish scripts (npm idempotency, jsr version sync, catalog resolution, jsr idempotency) are covered by built-ins; config collapses to ["npm", "jsr"].

Review

Multi-angle review (8 finders → 12 verified candidates) ran on the branch; all confirmed findings are fixed in the hardening commit (lenient discovery, unified registry fallback chain, structured skip kinds, capability-driven private-package drop, parallel published-checks). Not yet done: a live end-to-end publish — first real validation will be a varlock release after migrating its config.

Credits

JSR publishing behavior (publish-time jsr.json sync, claim-first bootstrap, catalog-resolution requirement) is modeled on Drake Costa's setup in mirrordown — thanks Drake! 🙏

Test plan

• 464 tests (53 new: resolver/back-compat/trust-gate, multi-target pipeline incl. per-target retry + shared artifacts + registry guard, jsr/pypi/vscode arg-building, pyproject.toml helpers, lenient discovery)
• Real-config smoke tests: workspace discovery + target resolution against varlock and mirrordown checkouts

[github-actions]

The changes in this PR will be included in the next version bump.

Minor releases

• @varlock/bumpy 1.18.1 → 1.19.0

Bump files in this PR

• publish-targets.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.