fix: stream custom build/publish command output and surface real failures

[theoephraim]

Problem

During a release, @varlock/bumpy ran user-defined buildCommand/publishCommand through runAsync, which buffered all child output (nothing reached CI logs live) and, on failure, threw an error containing only stderr — discarding stdout. When a custom publish like vsce publish wrote its real error (an expired marketplace VSCE_PAT) to stdout and exited non-zero, the actual cause was invisible — CI showed only a generic Command failed wrapper plus bun's exit notice.

This degraded every non-npm / custom publish path (vsce, ovsx, anything bespoke), making failures un-debuggable. npm publishing has its own path and was unaffected.

Fix

• New runStreaming(cmd, opts) in shell.ts — runs via spawn (shell: true), tees child stdout/stderr to the parent process live so output appears in CI as it happens, while also capturing both streams. On non-zero exit it rejects with Command failed (exit code N): <cmd> plus the captured output.
• buildCommand / publishCommand in the publish pipeline now use runStreaming. Internal git/npm/pack helpers (which parse captured stdout) stay on the capturing runners, including checkPublished.
• Belt-and-suspenders: runAsync / runArgsAsync now include stdout (not just stderr) in their thrown errors.

Tests

New test/utils/shell.test.ts asserts a command writing its error to stdout then exiting non-zero surfaces that text in the rejected error (for runStreaming, runAsync, and runArgsAsync), plus stderr and exit-code coverage.

• bun run test → 303 pass, 0 fail
• tsc --noEmit, oxlint, oxfmt --check all clean

Acceptance criteria

• A failing publishCommand surfaces the child's actual stdout and stderr
• buildCommand/publishCommand output streams live, not just on failure
• Internal git/npm capture-and-parse operations unchanged (full suite passes)
• Unit test for the stdout-only failure case
• Changeset / bump file added (patch → 1.14.1)

Incident reference

https://github.com/dmno-dev/varlock/actions/runs/27600876636/job/81602352962

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/bumpy 1.14.0 → 1.14.1

Bump files in this PR

• stream-custom-command-output.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.