feat(global-cli): release support

README.md

@@ -19,11 +19,16 @@ Vite+ is the unified entry point for local web development. It combines [Vite](h
 - **`vp build`:** Build applications for production with Vite + Rolldown
 - **`vp run`:** Execute monorepo tasks with caching and dependency-aware scheduling
 - **`vp pack`:** Build libraries for npm publishing or standalone app binaries
+- **`vp release`:** Version and publish workspace packages with native publish preflight during `--dry-run`, release checks before real publishes by default, retry-friendly exact version overrides via `--version`, optional changelog generation via `--changelog`, prerelease channels like `--preid alpha` / `beta` / `rc`, and `--projects` order respected between independent packages
 - **`vp create` / `vp migrate`:** Scaffold new projects and migrate existing ones
 
 All of this is configured from your project root and works across Vite's framework ecosystem.
 Vite+ is fully open-source under the MIT license.
 
+`vp release` detects likely checks from `build`, `pack`, `prepack`, `prepublishOnly`, `prepare`, and `vitePlus.release.checkScripts`. Real releases run those checks before publishing unless you pass `--no-run-checks`; dry-runs stay lightweight by default and can opt in with `--run-checks`. `--dry-run` also runs the native publisher in dry-run mode from a temporary release manifest state when the git worktree is clean. Use `--yes` for CI or other non-interactive runs, and `--version <x.y.z>` when retrying a partial publish at an exact version.
+
+Real releases always create git tags after a successful publish. When every released package shares the same target version, `vp release` also creates a repository-level `v<version>` tag so GitHub Releases and repo-wide release notes can follow the same watermark. Preview-only flags such as `--skip-publish` and `--no-git-tag` are therefore limited to `--dry-run`.
+
 ## Getting Started
 
 Install Vite+ globally as `vp`:
@@ -120,6 +125,7 @@ Use `vp migrate` to migrate to Vite+. It merges tool-specific config files such
 
 - **build** - Build for production
 - **pack** - Build libraries
+- **release** - Version and publish workspace packages, with optional changelog generation
 - **preview** - Preview production build
 
 #### Manage Dependencies

crates/vite_global_cli/Cargo.toml

@@ -29,6 +29,8 @@ tracing = { workspace = true }
 owo-colors = { workspace = true }
 oxc_resolver = { workspace = true }
 crossterm = { workspace = true }
+glob = { workspace = true }
+petgraph = { workspace = true }
 vite_error = { workspace = true }
 vite_install = { workspace = true }
 vite_js_runtime = { workspace = true }

crates/vite_global_cli/src/cli.rs

@@ -613,6 +613,74 @@ pub enum Commands {
         args: Vec<String>,
     },
 
+    /// Version workspace packages locally, then publish them from trusted-publishing CI with readiness checks and optional changelog generation
+    Release {
+        /// Preview the release plan without changing files or publishing
+        #[arg(long)]
+        dry_run: bool,
+
+        /// During dry-runs, omit publish simulation and show only versioning/changelog actions
+        #[arg(long)]
+        skip_publish: bool,
+
+        /// Treat this release as the first one and ignore existing release tags
+        #[arg(long)]
+        first_release: bool,
+
+        /// Generate root and per-package changelogs
+        #[arg(long, overrides_with = "no_changelog")]
+        changelog: bool,
+
+        /// Skip changelog generation
+        #[arg(long, overrides_with = "changelog")]
+        no_changelog: bool,
+
+        /// Override the computed release version. Useful when retrying a partial publish.
+        #[arg(long, value_name = "VERSION")]
+        version: Option<String>,
+
+        /// Publish a prerelease using the provided identifier (for example: alpha, beta, rc)
+        #[arg(long, value_name = "TAG")]
+        preid: Option<String>,
+
+        /// Legacy TOTP code for npm 2FA publish flows. Prefer trusted publishing or passkey/security-key auth when possible.
+        #[arg(long, value_name = "OTP")]
+        otp: Option<String>,
+
+        /// Release only matching workspace packages. When multiple values are provided,
+        /// their order is used as a tie-breaker between independent packages.
+        #[arg(long, value_name = "PATTERN", value_delimiter = ',')]
+        projects: Option<Vec<String>>,
+
+        /// Create git tags for released packages
+        #[arg(long, overrides_with = "no_git_tag")]
+        git_tag: bool,
+
+        /// Skip git tag creation in preview mode
+        #[arg(long, overrides_with = "git_tag")]
+        no_git_tag: bool,
+
+        /// Create a git commit for release changes
+        #[arg(long, overrides_with = "no_git_commit")]
+        git_commit: bool,
+
+        /// Skip the release commit
+        #[arg(long, overrides_with = "git_commit")]
+        no_git_commit: bool,
+
+        /// Run detected release checks before publishing. Real releases do this by default.
+        #[arg(long, overrides_with = "no_run_checks")]
+        run_checks: bool,
+
+        /// Skip release checks before publishing
+        #[arg(long, overrides_with = "run_checks")]
+        no_run_checks: bool,
+
+        /// Skip the final confirmation prompt
+        #[arg(long, short = 'y', alias = "force")]
+        yes: bool,
+    },
+
     /// Run tasks
     #[command(disable_help_flag = true)]
     Run {
@@ -2032,6 +2100,45 @@ pub async fn run_command_with_options(
             commands::delegate::execute(cwd, "pack", &args).await
         }
 
+        Commands::Release {
+            dry_run,
+            skip_publish,
+            first_release,
+            changelog,
+            no_changelog,
+            version,
+            preid,
+            otp,
+            projects,
+            git_tag: _,
+            no_git_tag,
+            git_commit: _,
+            no_git_commit,
+            run_checks,
+            no_run_checks,
+            yes,
+        } => {
+            let run_checks = if dry_run { run_checks } else { !no_run_checks || run_checks };
+            commands::release::execute(
+                cwd,
+                commands::release::ReleaseOptions {
+                    dry_run,
+                    skip_publish,
+                    first_release,
+                    changelog: changelog && !no_changelog,
+                    version,
+                    preid,
+                    otp,
+                    projects,
+                    git_tag: !no_git_tag,
+                    git_commit: !no_git_commit,
+                    run_checks,
+                    yes,
+                },
+            )
+            .await
+        }
+
         Commands::Run { args } => {
             if help::maybe_print_unified_delegate_help("run", &args, render_options.show_header) {
                 return Ok(ExitStatus::default());

crates/vite_global_cli/src/command_picker.rs

@@ -82,6 +82,12 @@ const COMMANDS: &[CommandEntry] = &[
         append_help: false,
     },
     CommandEntry { label: "pack", command: "pack", summary: "Build library.", append_help: false },
+    CommandEntry {
+        label: "release",
+        command: "release",
+        summary: "Version and publish workspace packages with readiness checks, confirmation, and optional changelog generation.",
+        append_help: false,
+    },
     CommandEntry {
         label: "preview",
         command: "preview",

crates/vite_global_cli/src/commands/env/exec.rs

@@ -193,10 +193,43 @@ fn exit_status(code: i32) -> ExitStatus {
 
 #[cfg(test)]
 mod tests {
+    use std::ffi::OsString;
+
     use serial_test::serial;
+    use tempfile::TempDir;
 
     use super::*;
 
+    struct VpHomeGuard {
+        original_vp_home: Option<OsString>,
+        _temp_dir: TempDir,
+    }
+
+    impl VpHomeGuard {
+        fn new() -> Self {
+            let temp_dir = TempDir::new().unwrap();
+            let original_vp_home = std::env::var_os(env_vars::VP_HOME);
+            // SAFETY: This test helper is only used from serial tests and restores the
+            // process-global environment before dropping.
+            unsafe {
+                std::env::set_var(env_vars::VP_HOME, temp_dir.path());
+            }
+            Self { original_vp_home, _temp_dir: temp_dir }
+        }
+    }
+
+    impl Drop for VpHomeGuard {
+        fn drop(&mut self) {
+            // SAFETY: We restore the original process-global environment captured in new().
+            unsafe {
+                match &self.original_vp_home {
+                    Some(value) => std::env::set_var(env_vars::VP_HOME, value),
+                    None => std::env::remove_var(env_vars::VP_HOME),
+                }
+            }
+        }
+    }
+
     #[tokio::test]
     async fn test_execute_missing_command() {
         let result = execute(Some("20.18.0"), None, &[]).await;
@@ -208,10 +241,11 @@ mod tests {
     #[tokio::test]
     #[serial]
     async fn test_execute_node_version() {
+        let _guard = VpHomeGuard::new();
         // Run 'node --version' with a specific Node.js version
         let command = vec!["node".to_string(), "--version".to_string()];
         let result = execute(Some("20.18.0"), None, &command).await;
-        assert!(result.is_ok());
+        assert!(result.is_ok(), "{result:?}");
         let status = result.unwrap();
         assert!(status.success());
     }

crates/vite_global_cli/src/commands/mod.rs

@@ -157,6 +157,7 @@ pub mod install;
 pub mod link;
 pub mod outdated;
 pub mod pm;
+pub mod release;
 pub mod remove;
 pub mod unlink;
 pub mod update;

crates/vite_global_cli/src/commands/pm.rs

@@ -183,6 +183,7 @@ pub async fn execute_pm_subcommand(
                 tag: tag.as_deref(),
                 access: access.as_deref(),
                 otp: otp.as_deref(),
+                provenance: None,
                 no_git_checks,
                 publish_branch: publish_branch.as_deref(),
                 report_summary,