feat(global-cli): release support

README.md

@@ -23,6 +23,7 @@ Vite+ is the unified entry point for local web development. It combines [Vite](h
 - **`vp build`:** Build applications for production with Vite + Rolldown
 - **`vp run`:** Run `package.json` scripts and monorepo tasks with caching and dependency-aware scheduling
 - **`vp pack`:** Build libraries for npm publishing or standalone app binaries
+- **`vp release`:** Publish workspace releases
 - **`vp toolchain`:** Show the versions of Vite+, Vite, Rolldown, Oxc, and other tools
 - **`vp create` / `vp migrate`:** Scaffold new projects and migrate existing ones
 
@@ -126,6 +127,7 @@ Use `vp migrate` to migrate to Vite+. It merges tool-specific config files such
 
 - **build** - Build for production
 - **pack** - Build libraries
+- **release** - Publish workspace releases
 - **preview** - Preview production build
 
 #### Manage Dependencies

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/cli_helper_message/snapshots/cli_helper_message.md

@@ -36,6 +36,7 @@ Build:
   build    Build for production
   pack     Build library
   preview  Preview production build
+  release  Version and publish workspace packages with readiness checks, confirmation, and optional changelog generation
 
 Manage Dependencies:
   add                        Add packages to dependencies

crates/vp_global_cli/Cargo.toml

@@ -24,11 +24,14 @@ serde_json = { workspace = true }
 node-semver = { workspace = true }
 thiserror = { workspace = true }
 tar = { workspace = true }
+tempfile = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tracing = { workspace = true }
 owo-colors = { workspace = true }
 oxc_resolver = { workspace = true }
 crossterm = { workspace = true }
+glob = { workspace = true }
+petgraph = { workspace = true }
 indexmap = { workspace = true }
 indicatif = { workspace = true }
 vp_error = { workspace = true }
@@ -45,7 +48,6 @@ uuid = { workspace = true, features = ["v4"] }
 
 [dev-dependencies]
 serial_test = { workspace = true }
-tempfile = { workspace = true }
 
 [lints]
 workspace = true

crates/vp_global_cli/src/cli.rs

@@ -170,6 +170,115 @@ pub enum Commands {
         args: Vec<String>,
     },
 
+    /// Version workspace packages locally, then publish them from trusted-publishing CI with readiness checks and optional changelog generation
+    Release {
+        /// Preview the release plan without changing files or publishing
+        #[arg(long)]
+        dry_run: bool,
+
+        /// During dry-runs, omit publish simulation and show only versioning/changelog actions
+        #[arg(long)]
+        skip_publish: bool,
+
+        /// Treat this release as the first one and ignore existing release tags
+        #[arg(long)]
+        first_release: bool,
+
+        /// Generate root and per-package changelogs
+        #[arg(long, overrides_with = "no_changelog")]
+        changelog: bool,
+
+        /// Skip changelog generation
+        #[arg(long, overrides_with = "changelog")]
+        no_changelog: bool,
+
+        /// Override the computed release version. Useful when retrying a partial publish.
+        #[arg(long, value_name = "VERSION")]
+        version: Option<String>,
+
+        /// Publish a prerelease using the provided identifier (for example: alpha, beta, rc)
+        #[arg(long, value_name = "TAG")]
+        preid: Option<String>,
+
+        /// Legacy TOTP code for npm 2FA publish flows. Prefer trusted publishing or passkey/security-key auth when possible.
+        #[arg(long, value_name = "OTP")]
+        otp: Option<String>,
+
+        /// Configure npm Trusted Publishing for the selected workspace packages, then exit
+        #[arg(
+            long,
+            conflicts_with_all = [
+                "skip_publish",
+                "first_release",
+                "changelog",
+                "no_changelog",
+                "version",
+                "preid",
+                "otp",
+                "git_tag",
+                "no_git_tag",
+                "git_commit",
+                "no_git_commit",
+                "run_checks",
+                "no_run_checks"
+            ]
+        )]
+        setup_trusted_publishing: bool,
+
+        /// GitHub repository in owner/repository form (auto-detected from origin by default)
+        #[arg(long, value_name = "OWNER/REPOSITORY", requires = "setup_trusted_publishing")]
+        trusted_publisher_repository: Option<String>,
+
+        /// GitHub Actions workflow path or filename (auto-detected by default)
+        #[arg(long, value_name = "FILE", requires = "setup_trusted_publishing")]
+        trusted_publisher_workflow: Option<String>,
+
+        /// Restrict trusted publishing to a GitHub Actions environment
+        #[arg(long, value_name = "NAME", requires = "setup_trusted_publishing")]
+        trusted_publisher_environment: Option<String>,
+
+        /// Registry passed to npm trust (defaults to the configured npm registry)
+        #[arg(long, value_name = "URL", requires = "setup_trusted_publishing")]
+        trusted_publisher_registry: Option<String>,
+
+        /// Also permit npm's staged publishing flow for this trusted publisher
+        #[arg(long, requires = "setup_trusted_publishing")]
+        allow_stage_publish: bool,
+
+        /// Release only matching workspace packages. When multiple values are provided,
+        /// their order is used as a tie-breaker between independent packages.
+        #[arg(long, value_name = "PATTERN", value_delimiter = ',')]
+        projects: Option<Vec<String>>,
+
+        /// Create git tags for released packages
+        #[arg(long, overrides_with = "no_git_tag")]
+        git_tag: bool,
+
+        /// Skip git tag creation in preview mode
+        #[arg(long, overrides_with = "git_tag")]
+        no_git_tag: bool,
+
+        /// Create a git commit for release changes
+        #[arg(long, overrides_with = "no_git_commit")]
+        git_commit: bool,
+
+        /// Skip the release commit
+        #[arg(long, overrides_with = "git_commit")]
+        no_git_commit: bool,
+
+        /// Run detected release checks before publishing. Real releases do this by default.
+        #[arg(long, overrides_with = "no_run_checks")]
+        run_checks: bool,
+
+        /// Skip release checks before publishing
+        #[arg(long, overrides_with = "run_checks")]
+        no_run_checks: bool,
+
+        /// Skip the final confirmation prompt
+        #[arg(long, short = 'y', alias = "force")]
+        yes: bool,
+    },
+
     /// Run tasks
     #[command(disable_help_flag = true)]
     Run {
@@ -1066,6 +1175,67 @@ pub async fn run_command_with_options(
             commands::delegate::execute(cwd, "pack", &args, raw_subcommand).await
         }
 
+        Commands::Release {
+            dry_run,
+            skip_publish,
+            first_release,
+            changelog,
+            no_changelog,
+            version,
+            preid,
+            otp,
+            setup_trusted_publishing,
+            trusted_publisher_repository,
+            trusted_publisher_workflow,
+            trusted_publisher_environment,
+            trusted_publisher_registry,
+            allow_stage_publish,
+            projects,
+            git_tag: _,
+            no_git_tag,
+            git_commit: _,
+            no_git_commit,
+            run_checks,
+            no_run_checks,
+            yes,
+        } => {
+            let run_checks = if setup_trusted_publishing {
+                false
+            } else if dry_run {
+                run_checks
+            } else {
+                !no_run_checks || run_checks
+            };
+            let trusted_publishing_setup = setup_trusted_publishing.then_some({
+                commands::release::TrustedPublishingSetupOptions {
+                    repository: trusted_publisher_repository,
+                    workflow: trusted_publisher_workflow,
+                    environment: trusted_publisher_environment,
+                    registry: trusted_publisher_registry,
+                    allow_stage_publish,
+                }
+            });
+            commands::release::execute(
+                cwd,
+                commands::release::ReleaseOptions {
+                    dry_run,
+                    skip_publish,
+                    first_release,
+                    changelog: changelog && !no_changelog,
+                    version,
+                    preid,
+                    otp,
+                    projects,
+                    git_tag: !no_git_tag,
+                    git_commit: !no_git_commit,
+                    run_checks,
+                    yes,
+                },
+                trusted_publishing_setup,
+            )
+            .await
+        }
+
         Commands::Run { args } => {
             maybe_print_runtime_header("run", &args, render_options.show_header);
             commands::delegate::execute(cwd, "run", &args, raw_subcommand).await

crates/vp_global_cli/src/command_picker.rs

@@ -82,6 +82,12 @@ const COMMANDS: &[CommandEntry] = &[
         append_help: false,
     },
     CommandEntry { label: "pack", command: "pack", summary: "Build library.", append_help: false },
+    CommandEntry {
+        label: "release",
+        command: "release",
+        summary: "Version and publish workspace packages with readiness checks, confirmation, and optional changelog generation.",
+        append_help: false,
+    },
     CommandEntry {
         label: "preview",
         command: "preview",

crates/vp_global_cli/src/commands/env/exec.rs

@@ -201,10 +201,43 @@ fn classify_version(version: &str) -> VersionSelector<'_> {
 
 #[cfg(test)]
 mod tests {
+    use std::ffi::OsString;
+
     use serial_test::serial;
+    use tempfile::TempDir;
 
     use super::*;
 
+    struct VpHomeGuard {
+        original_vp_home: Option<OsString>,
+        _temp_dir: TempDir,
+    }
+
+    impl VpHomeGuard {
+        fn new() -> Self {
+            let temp_dir = TempDir::new().unwrap();
+            let original_vp_home = std::env::var_os(env_vars::VP_HOME);
+            // SAFETY: This test helper is only used from serial tests and restores the
+            // process-global environment before dropping.
+            unsafe {
+                std::env::set_var(env_vars::VP_HOME, temp_dir.path());
+            }
+            Self { original_vp_home, _temp_dir: temp_dir }
+        }
+    }
+
+    impl Drop for VpHomeGuard {
+        fn drop(&mut self) {
+            // SAFETY: We restore the original process-global environment captured in new().
+            unsafe {
+                match &self.original_vp_home {
+                    Some(value) => std::env::set_var(env_vars::VP_HOME, value),
+                    None => std::env::remove_var(env_vars::VP_HOME),
+                }
+            }
+        }
+    }
+
     #[tokio::test]
     async fn test_execute_missing_command() {
         let result = execute(Some("20.18.0"), None, &[]).await;
@@ -216,10 +249,11 @@ mod tests {
     #[tokio::test]
     #[serial]
     async fn test_execute_node_version() {
+        let _guard = VpHomeGuard::new();
         // Run 'node --version' with a specific Node.js version
         let command = vec!["node".to_string(), "--version".to_string()];
         let result = execute(Some("20.18.0"), None, &command).await;
-        assert!(result.is_ok());
+        assert!(result.is_ok(), "{result:?}");
         let status = result.unwrap();
         assert!(status.success());
     }

crates/vp_global_cli/src/commands/mod.rs

@@ -137,6 +137,9 @@ pub async fn prepend_js_runtime_to_path_env(project_path: &AbsolutePath) -> Resu
 // Global package management
 pub mod global;
 
+// Workspace release management
+pub mod release;
+
 // Category B: JS Script Commands
 pub mod config;
 pub mod create;