@abgov/nx-oc 13.0.0-beta.2 → 13.0.0-beta.4

package/executors.json

@@ -5,6 +5,11 @@
       "implementation": "./src/executors/apply/apply",
       "schema": "./src/executors/apply/schema.json",
       "description": "Executor that applies deployment template to OpenShift."
+    },
+    "sandbox": {
+      "implementation": "./src/executors/sandbox/sandbox",
+      "schema": "./src/executors/sandbox/schema.json",
+      "description": "Build locally with podman, push to the registry, import into the sandbox namespace, and roll out."
     }
   }
 }

package/migrations.json

@@ -0,0 +1,10 @@
+{
+  "$schema": "http://json-schema.org/schema",
+  "generators": {
+    "convert-sandbox-target-to-executor": {
+      "version": "13.0.0-beta.3",
+      "description": "Convert generated sandbox `nx:run-commands` targets to the @abgov/nx-oc:sandbox executor.",
+      "implementation": "./src/migrations/convert-sandbox-target/convert-sandbox-target"
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abgov/nx-oc",
-  "version": "13.0.0-beta.2",
+  "version": "13.0.0-beta.4",
   "license": "Apache-2.0",
   "main": "src/index.js",
   "description": "Government of Alberta - Nx plugin for OpenShift.",
@@ -23,6 +23,9 @@
   },
   "generators": "./generators.json",
   "executors": "./executors.json",
+  "nx-migrations": {
+    "migrations": "./migrations.json"
+  },
   "scripts": {},
   "types": "./src/index.d.ts",
   "type": "commonjs"

package/src/executors/sandbox/sandbox.d.ts

@@ -0,0 +1,5 @@
+import { ExecutorContext } from '@nx/devkit';
+import { SandboxExecutorSchema } from './schema';
+export default function runExecutor(options: SandboxExecutorSchema, context: ExecutorContext): Promise<{
+    success: boolean;
+}>;

package/src/executors/sandbox/sandbox.js

@@ -0,0 +1,217 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = runExecutor;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+const child_process_1 = require("child_process");
+const app_type_1 = require("../../utils/app-type");
+const oc_utils_1 = require("../../utils/oc-utils");
+const PROXY_TAG_PREFIX = 'adsp:proxy-service:';
+// Fail fast, with an actionable message, before the (slow) production build —
+// rather than a raw "command not found" partway through.
+function requireTool(tool, hint) {
+    try {
+        (0, child_process_1.execSync)(`command -v ${tool}`, { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error(`'${tool}' is required but was not found on PATH. ${hint}`);
+    }
+}
+// The pull secret + registry login read the gh session token, so gh must be
+// installed AND authenticated. Checked up front so a missing/expired login
+// fails before the slow build rather than at the push/import step.
+function requireGhAuth() {
+    requireTool('gh', 'Install the GitHub CLI (https://cli.github.com).');
+    try {
+        (0, child_process_1.execSync)('gh auth status', { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error('gh is installed but not authenticated. Run `gh auth login` as an account with write:packages on the registry org (check/switch with `gh auth status` / `gh auth switch`).');
+    }
+}
+// podman must be installed and its machine reachable. `podman info` fails when
+// the machine is stopped, so it catches that before the build.
+function requirePodman() {
+    requireTool('podman', "Install it (macOS: 'brew install podman').");
+    try {
+        (0, child_process_1.execSync)('podman info', { stdio: 'ignore', shell: '/bin/bash' });
+    }
+    catch (_a) {
+        throw new Error("podman is installed but not responding — start the machine (macOS: 'podman machine start').");
+    }
+}
+function run(label, cmd, cwd) {
+    devkit_1.logger.info(`\n▸ ${label}`);
+    // Safe to echo: secrets are shell substitutions ($(gh auth token), $(grep …
+    // .env)), so the literal command never contains a resolved secret.
+    devkit_1.logger.info(`  $ ${cmd}`);
+    (0, child_process_1.execSync)(cmd, { stdio: 'inherit', cwd, shell: '/bin/bash' });
+}
+// Run a command and capture stdout; returns '' on any failure.
+function capture(cmd, cwd) {
+    try {
+        return (0, child_process_1.execSync)(cmd, { cwd, shell: '/bin/bash', stdio: ['ignore', 'pipe', 'ignore'] })
+            .toString()
+            .trim();
+    }
+    catch (_a) {
+        return '';
+    }
+}
+// oc tag triggers an async imagestream reconcile, so a back-to-back
+// import-image can 409 ("object has been modified"). Retry until it settles.
+function importWithRetry(imageStreamTag, namespace, cwd, retries) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            run(`Import image (attempt ${attempt}/${retries})`, `oc import-image ${imageStreamTag} --confirm -n ${namespace}`, cwd);
+            return;
+        }
+        catch (err) {
+            if (attempt >= retries) {
+                throw new Error(`oc import-image failed after ${retries} attempts: ${err.message}`);
+            }
+            devkit_1.logger.warn(`  import-image failed (likely the oc tag reconcile race); retrying in 3s`);
+            (0, child_process_1.execSync)('sleep 3', { stdio: 'ignore' });
+        }
+    }
+}
+function runExecutor(options, context) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        const projectName = context.projectName;
+        const project = projectName && ((_a = context.projectsConfigurations) === null || _a === void 0 ? void 0 : _a.projects[projectName]);
+        if (!projectName || !project) {
+            devkit_1.logger.error('[nx-oc:sandbox] Could not resolve the target project.');
+            return { success: false };
+        }
+        const { sandboxProject, registry, imageTag = 'sandbox', skipBuild = false, skipPush = false, deployBackend = false, importRetries = 5, } = options;
+        if (!sandboxProject) {
+            devkit_1.logger.error('[nx-oc:sandbox] "sandboxProject" is required.');
+            return { success: false };
+        }
+        if (!registry) {
+            devkit_1.logger.error('[nx-oc:sandbox] "registry" is required.');
+            return { success: false };
+        }
+        const appType = (_b = options.appType) !== null && _b !== void 0 ? _b : (0, app_type_1.detectApplicationType)(project);
+        if (!appType) {
+            devkit_1.logger.error(`[nx-oc:sandbox] Could not determine the application type for ${projectName}.`);
+            return { success: false };
+        }
+        const database = (_c = options.database) !== null && _c !== void 0 ? _c : 'none';
+        // Container registries (GHCR) require lowercase paths. Prefix the image with
+        // the (per-user) namespace so images from different experimenters never
+        // collide on GHCR's org-global package names.
+        const reg = registry.toLowerCase();
+        const registryHost = reg.split('/')[0];
+        const imageName = `${sandboxProject}-${projectName}`.toLowerCase();
+        const imageRef = `${reg}/${imageName}:${imageTag}`;
+        const projectRoot = project.root;
+        const cwd = context.root;
+        try {
+            // ---- preflight: check prerequisites before the expensive build ----
+            (0, oc_utils_1.ensureOcLogin)();
+            // The pull secret + import always need gh (session token to reach GHCR).
+            requireGhAuth();
+            if (!skipBuild || !skipPush) {
+                requirePodman();
+            }
+            // ---- service client secret (node services authenticate to ADSP) ----
+            // Upserted from the current .env so re-runs pick up a rotated secret.
+            if (appType === 'node') {
+                run('Upsert CLIENT_SECRET', `oc create secret generic ${projectName}-secrets ` +
+                    `--from-literal=CLIENT_SECRET="$(grep -E '^CLIENT_SECRET=' ${projectRoot}/.env 2>/dev/null | cut -d= -f2-)" ` +
+                    `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`, cwd);
+            }
+            // ---- shared database provisioning ----
+            if (database === 'postgres') {
+                run('Ensure Postgres credentials', `oc get secret sandbox-postgres-creds -n ${sandboxProject} 2>/dev/null || ` +
+                    `oc create secret generic sandbox-postgres-creds ` +
+                    `--from-literal=POSTGRESQL_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+                    `-n ${sandboxProject}`, cwd);
+                run('Deploy shared Postgres', `oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${sandboxProject}`, cwd);
+                // The shared Postgres only creates the admin database; each app needs its
+                // own <app>_sandbox database created before its migrate init container
+                // runs. Wait for Postgres, then create the database idempotently.
+                const dbName = `${projectName}_sandbox`;
+                run('Create app database', `oc rollout status deployment/sandbox-postgres -n ${sandboxProject} --timeout=180s && ` +
+                    `oc exec -n ${sandboxProject} deployment/sandbox-postgres -- ` +
+                    `bash -lc "psql -U postgres -tc \\"SELECT 1 FROM pg_database WHERE datname='${dbName}'\\" ` +
+                    `| grep -q 1 || createdb -U postgres ${dbName}"`, cwd);
+            }
+            else if (database === 'mongo') {
+                run('Ensure MongoDB credentials', `oc get secret sandbox-mongodb-creds -n ${sandboxProject} 2>/dev/null || ` +
+                    `oc create secret generic sandbox-mongodb-creds ` +
+                    `--from-literal=MONGODB_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
+                    `-n ${sandboxProject}`, cwd);
+                run('Deploy shared MongoDB', `oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${sandboxProject}`, cwd);
+            }
+            // ---- paired backend Services (so a frontend's nginx resolves proxy_pass
+            // upstreams at startup). Only the Service is needed for DNS. Idempotent. ----
+            const proxyServices = ((_d = project.tags) !== null && _d !== void 0 ? _d : [])
+                .filter((tag) => tag.startsWith(PROXY_TAG_PREFIX))
+                .map((tag) => {
+                const value = tag.slice(PROXY_TAG_PREFIX.length);
+                const lastColon = value.lastIndexOf(':');
+                return { name: value.slice(0, lastColon), port: value.slice(lastColon + 1) };
+            });
+            for (const { name, port } of proxyServices) {
+                run(`Ensure paired Service ${name}`, `oc get service ${name} -n ${sandboxProject} >/dev/null 2>&1 || ` +
+                    `oc create service clusterip ${name} --tcp=${port}:${port} -n ${sandboxProject}`, cwd);
+            }
+            // The Service stub above only stops nginx crashlooping; the backend needs
+            // its own pods for /api proxying to work. Deploy it (opt-in) or warn that
+            // proxied calls will 502 until it is deployed separately.
+            for (const { name } of proxyServices) {
+                if (deployBackend) {
+                    try {
+                        run(`Deploy paired backend ${name}`, `npx nx run ${name}:sandbox`, cwd);
+                    }
+                    catch (_e) {
+                        throw new Error(`--deployBackend: could not deploy paired backend "${name}". Ensure it has a sandbox target ` +
+                            `(nx g @abgov/nx-oc:sandbox ${name} --sandboxProject ${sandboxProject}).`);
+                    }
+                }
+                else {
+                    const endpoints = capture(`oc get endpoints ${name} -n ${sandboxProject} -o jsonpath='{.subsets[*].addresses[*].ip}'`, cwd);
+                    if (!endpoints) {
+                        devkit_1.logger.warn(`\n⚠ Paired backend "${name}" has no running pods in ${sandboxProject}. ` +
+                            `The frontend will deploy, but requests proxied to ${name} will 502 until it is deployed:\n` +
+                            `    nx run ${name}:sandbox\n` +
+                            `  (or re-run this target with --deployBackend to deploy it first).`);
+                    }
+                }
+            }
+            // ---- build locally + push to the registry ----
+            if (!skipBuild) {
+                run('Build', `npx nx build ${projectName} --configuration production`, cwd);
+                run('Podman build', `podman build --platform=linux/amd64 -f .openshift/${projectName}/Dockerfile -t ${imageRef} .`, cwd);
+            }
+            if (!skipPush) {
+                // gh supplies the token so no PAT is stored; the same session token backs
+                // the pull secret below.
+                run('Registry login', `gh auth token | podman login ${registryHost} -u "$(gh api user -q .login)" --password-stdin`, cwd);
+                run('Push image', `podman push ${imageRef}`, cwd);
+            }
+            // ---- import into the namespace imagestream + roll out ----
+            // Per-deploy pull secret from the gh session (no long-lived PAT needed).
+            run('Upsert pull secret', `oc create secret docker-registry ghcr-pull ` +
+                `--docker-server=${registryHost} --docker-username="$(gh api user -q .login)" --docker-password="$(gh auth token)" ` +
+                `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`, cwd);
+            // oc tag sets/repoints the imagestream tag with reference-policy=local so
+            // pods pull in-cluster; import --confirm then pulls the current manifest.
+            run('Tag imagestream', `oc tag ${imageRef} ${projectName}:${imageTag} --reference-policy=local -n ${sandboxProject}`, cwd);
+            importWithRetry(`${projectName}:${imageTag}`, sandboxProject, cwd, importRetries);
+            run('Apply manifest', `oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`, cwd);
+            run('Restart rollout', `oc rollout restart deployment/${projectName} -n ${sandboxProject}`, cwd);
+            run('Wait for rollout', `oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=180s`, cwd);
+            devkit_1.logger.info(`\n✓ Sandbox deploy complete for ${projectName}.`);
+            return { success: true };
+        }
+        catch (err) {
+            devkit_1.logger.error(`\n[nx-oc:sandbox] ${err.message}`);
+            return { success: false };
+        }
+    });
+}
+//# sourceMappingURL=sandbox.js.map

package/src/executors/sandbox/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/executors/sandbox/sandbox.ts"],"names":[],"mappings":";;AAqGA,8BAsOC;;AA3UD,uCAAqD;AACrD,iDAAyC;AACzC,mDAA6D;AAC7D,mDAAqD;AAGrD,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AAE/C,8EAA8E;AAC9E,yDAAyD;AACzD,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,cAAc,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,4CAA4C,IAAI,EAAE,CAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,2EAA2E;AAC3E,mEAAmE;AACnE,SAAS,aAAa;IACpB,WAAW,CAAC,IAAI,EAAE,kDAAkD,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2KAA2K,CAC5K,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,+DAA+D;AAC/D,SAAS,aAAa;IACpB,WAAW,CACT,QAAQ,EACR,4CAA4C,CAC7C,CAAC;IACF,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,aAAa,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,WAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,GAAW;IAClD,eAAM,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC5B,4EAA4E;IAC5E,mEAAmE;IACnE,eAAM,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IAC1B,IAAA,wBAAQ,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,+DAA+D;AAC/D,SAAS,OAAO,CAAC,GAAW,EAAE,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,IAAA,wBAAQ,EAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;aACnF,QAAQ,EAAE;aACV,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,6EAA6E;AAC7E,SAAS,eAAe,CACtB,cAAsB,EACtB,SAAiB,EACjB,GAAW,EACX,OAAe;IAEf,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,GAAG,CACD,yBAAyB,OAAO,IAAI,OAAO,GAAG,EAC9C,mBAAmB,cAAc,iBAAiB,SAAS,EAAE,EAC7D,GAAG,CACJ,CAAC;YACF,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,gCAAgC,OAAO,cACpC,GAAa,CAAC,OACjB,EAAE,CACH,CAAC;YACJ,CAAC;YACD,eAAM,CAAC,IAAI,CACT,0EAA0E,CAC3E,CAAC;YACF,IAAA,wBAAQ,EAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAA8B,WAAW,CACvC,OAA8B,EAC9B,OAAwB;;;QAExB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACxC,MAAM,OAAO,GACX,WAAW,KAAI,MAAA,OAAO,CAAC,sBAAsB,0CAAE,QAAQ,CAAC,WAAW,CAAC,CAAA,CAAC;QACvE,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,eAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,EACJ,cAAc,EACd,QAAQ,EACR,QAAQ,GAAG,SAAS,EACpB,SAAS,GAAG,KAAK,EACjB,QAAQ,GAAG,KAAK,EAChB,aAAa,GAAG,KAAK,EACrB,aAAa,GAAG,CAAC,GAClB,GAAG,OAAO,CAAC;QAEZ,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,eAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,eAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QAED,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,OAAO,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CACV,gEAAgE,WAAW,GAAG,CAC/E,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,CAAC;QAE5C,6EAA6E;QAC7E,wEAAwE;QACxE,8CAA8C;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,GAAG,cAAc,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,GAAG,GAAG,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;QAEzB,IAAI,CAAC;YACH,sEAAsE;YACtE,IAAA,wBAAa,GAAE,CAAC;YAChB,yEAAyE;YACzE,aAAa,EAAE,CAAC;YAChB,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,aAAa,EAAE,CAAC;YAClB,CAAC;YAED,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;gBACvB,GAAG,CACD,sBAAsB,EACtB,4BAA4B,WAAW,WAAW;oBAChD,6DAA6D,WAAW,qCAAqC;oBAC7G,MAAM,cAAc,2CAA2C,EACjE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,yCAAyC;YACzC,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5B,GAAG,CACD,6BAA6B,EAC7B,2CAA2C,cAAc,kBAAkB;oBACzE,kDAAkD;oBAClD,oFAAoF;oBACpF,MAAM,cAAc,EAAE,EACxB,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,wBAAwB,EACxB,0DAA0D,cAAc,EAAE,EAC1E,GAAG,CACJ,CAAC;gBACF,0EAA0E;gBAC1E,uEAAuE;gBACvE,kEAAkE;gBAClE,MAAM,MAAM,GAAG,GAAG,WAAW,UAAU,CAAC;gBACxC,GAAG,CACD,qBAAqB,EACrB,oDAAoD,cAAc,qBAAqB;oBACrF,cAAc,cAAc,kCAAkC;oBAC9D,8EAA8E,MAAM,OAAO;oBAC3F,uCAAuC,MAAM,GAAG,EAClD,GAAG,CACJ,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAChC,GAAG,CACD,4BAA4B,EAC5B,0CAA0C,cAAc,kBAAkB;oBACxE,iDAAiD;oBACjD,iFAAiF;oBACjF,MAAM,cAAc,EAAE,EACxB,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,uBAAuB,EACvB,yDAAyD,cAAc,EAAE,EACzE,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,8EAA8E;YAC9E,MAAM,aAAa,GAAG,CAAC,MAAA,OAAO,CAAC,IAAI,mCAAI,EAAE,CAAC;iBACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;iBACjD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/E,CAAC,CAAC,CAAC;YACL,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC3C,GAAG,CACD,yBAAyB,IAAI,EAAE,EAC/B,kBAAkB,IAAI,OAAO,cAAc,sBAAsB;oBAC/D,+BAA+B,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,cAAc,EAAE,EAClF,GAAG,CACJ,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,0EAA0E;YAC1E,0DAA0D;YAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;gBACrC,IAAI,aAAa,EAAE,CAAC;oBAClB,IAAI,CAAC;wBACH,GAAG,CAAC,yBAAyB,IAAI,EAAE,EAAE,cAAc,IAAI,UAAU,EAAE,GAAG,CAAC,CAAC;oBAC1E,CAAC;oBAAC,WAAM,CAAC;wBACP,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,oCAAoC;4BAC3F,8BAA8B,IAAI,qBAAqB,cAAc,IAAI,CAC5E,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,MAAM,SAAS,GAAG,OAAO,CACvB,oBAAoB,IAAI,OAAO,cAAc,8CAA8C,EAC3F,GAAG,CACJ,CAAC;oBACF,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,eAAM,CAAC,IAAI,CACT,uBAAuB,IAAI,4BAA4B,cAAc,IAAI;4BACvE,qDAAqD,IAAI,mCAAmC;4BAC5F,cAAc,IAAI,YAAY;4BAC9B,oEAAoE,CACvE,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,iDAAiD;YACjD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CACD,OAAO,EACP,gBAAgB,WAAW,6BAA6B,EACxD,GAAG,CACJ,CAAC;gBACF,GAAG,CACD,cAAc,EACd,qDAAqD,WAAW,kBAAkB,QAAQ,IAAI,EAC9F,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,0EAA0E;gBAC1E,yBAAyB;gBACzB,GAAG,CACD,gBAAgB,EAChB,gCAAgC,YAAY,iDAAiD,EAC7F,GAAG,CACJ,CAAC;gBACF,GAAG,CAAC,YAAY,EAAE,eAAe,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;YACpD,CAAC;YAED,6DAA6D;YAC7D,yEAAyE;YACzE,GAAG,CACD,oBAAoB,EACpB,6CAA6C;gBAC3C,mBAAmB,YAAY,qFAAqF;gBACpH,MAAM,cAAc,2CAA2C,EACjE,GAAG,CACJ,CAAC;YACF,0EAA0E;YAC1E,0EAA0E;YAC1E,GAAG,CACD,iBAAiB,EACjB,UAAU,QAAQ,IAAI,WAAW,IAAI,QAAQ,gCAAgC,cAAc,EAAE,EAC7F,GAAG,CACJ,CAAC;YACF,eAAe,CACb,GAAG,WAAW,IAAI,QAAQ,EAAE,EAC5B,cAAc,EACd,GAAG,EACH,aAAa,CACd,CAAC;YAEF,GAAG,CACD,gBAAgB,EAChB,4BAA4B,WAAW,IAAI,WAAW,mBAAmB,cAAc,kBAAkB,EACzG,GAAG,CACJ,CAAC;YACF,GAAG,CACD,iBAAiB,EACjB,iCAAiC,WAAW,OAAO,cAAc,EAAE,EACnE,GAAG,CACJ,CAAC;YACF,GAAG,CACD,kBAAkB,EAClB,gCAAgC,WAAW,OAAO,cAAc,iBAAiB,EACjF,GAAG,CACJ,CAAC;YAEF,eAAM,CAAC,IAAI,CAAC,mCAAmC,WAAW,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,eAAM,CAAC,KAAK,CAAC,qBAAsB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;CAAA"}

package/src/executors/sandbox/sandbox.spec.ts

@@ -0,0 +1,223 @@
+import { ExecutorContext, logger } from '@nx/devkit';
+import runExecutor from './sandbox';
+import { SandboxExecutorSchema } from './schema';
+
+jest.mock('child_process', () => ({
+  ...jest.requireActual('child_process'),
+  execSync: jest.fn(),
+}));
+jest.mock('../../utils/oc-utils', () => ({ ensureOcLogin: jest.fn() }));
+
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+const { execSync } = require('child_process') as { execSync: jest.Mock };
+
+const IMAGE_REF = 'ghcr.io/test-org/test-sandbox-test:sandbox';
+
+function context(tags: string[] = []): ExecutorContext {
+  return {
+    root: '/ws',
+    cwd: '/ws',
+    isVerbose: false,
+    projectName: 'test',
+    projectsConfigurations: {
+      version: 2,
+      projects: {
+        test: { root: 'apps/test', tags },
+      },
+    },
+  } as unknown as ExecutorContext;
+}
+
+const baseOptions: SandboxExecutorSchema = {
+  sandboxProject: 'test-sandbox',
+  registry: 'ghcr.io/test-org',
+  appType: 'node',
+};
+
+// The commands passed to execSync, in call order.
+function commands(): string[] {
+  return execSync.mock.calls.map((c) => c[0] as string);
+}
+
+beforeEach(() => {
+  execSync.mockReset();
+  execSync.mockImplementation(() => Buffer.from(''));
+});
+
+describe('sandbox executor', () => {
+  it('builds, pushes, tags, imports, and rolls out in order', async () => {
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(true);
+
+    const cmds = commands();
+    const has = (s: string) => cmds.some((c) => c.includes(s));
+    expect(has('nx build test --configuration production')).toBe(true);
+    expect(
+      has(
+        `podman build --platform=linux/amd64 -f .openshift/test/Dockerfile -t ${IMAGE_REF} .`
+      )
+    ).toBe(true);
+    expect(has(`podman push ${IMAGE_REF}`)).toBe(true);
+    expect(
+      has(`oc tag ${IMAGE_REF} test:sandbox --reference-policy=local -n test-sandbox`)
+    ).toBe(true);
+    expect(has('oc import-image test:sandbox --confirm -n test-sandbox')).toBe(true);
+    expect(has('oc create secret docker-registry ghcr-pull')).toBe(true);
+    expect(has('oc rollout restart deployment/test -n test-sandbox')).toBe(true);
+    expect(has('oc rollout status deployment/test -n test-sandbox')).toBe(true);
+
+    // ordering: build precedes push precedes tag precedes import precedes rollout
+    const idx = (s: string) => cmds.findIndex((c) => c.includes(s));
+    expect(idx('podman build')).toBeLessThan(idx('podman push'));
+    expect(idx('podman push')).toBeLessThan(idx('oc tag'));
+    expect(idx('oc tag')).toBeLessThan(idx('oc import-image'));
+    expect(idx('oc import-image')).toBeLessThan(idx('oc rollout restart'));
+  });
+
+  it('mirrors CLIENT_SECRET for a node service only', async () => {
+    await runExecutor(baseOptions, context());
+    expect(
+      commands().some(
+        (c) => c.includes('oc create secret generic test-secrets') && c.includes('CLIENT_SECRET')
+      )
+    ).toBe(true);
+
+    execSync.mockClear();
+    await runExecutor({ ...baseOptions, appType: 'frontend' }, context());
+    expect(commands().some((c) => c.includes('test-secrets'))).toBe(false);
+  });
+
+  it('fails fast with an actionable message when podman is missing', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.startsWith('command -v podman')) throw new Error('not found');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    // did not proceed to the build
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('fails fast when the podman machine is not running', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd === 'podman info') throw new Error('cannot connect');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('fails fast when gh is installed but not authenticated (before the build)', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd === 'gh auth status') throw new Error('not logged in');
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(false);
+    // gh checked up front — no build/push happened
+    expect(commands().some((c) => c.includes('nx build test'))).toBe(false);
+    expect(commands().some((c) => c.includes('podman build'))).toBe(false);
+  });
+
+  it('retries oc import-image on the tag-reconcile race', async () => {
+    let importAttempts = 0;
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.includes('oc import-image')) {
+        importAttempts++;
+        if (importAttempts < 3) throw new Error('409 the object has been modified');
+      }
+      return Buffer.from('');
+    });
+    const result = await runExecutor(baseOptions, context());
+    expect(result.success).toBe(true);
+    expect(importAttempts).toBe(3);
+  });
+
+  it('gives up after importRetries and fails', async () => {
+    execSync.mockImplementation((cmd: string) => {
+      if (cmd.includes('oc import-image')) throw new Error('409');
+      return Buffer.from('');
+    });
+    const result = await runExecutor({ ...baseOptions, importRetries: 2 }, context());
+    expect(result.success).toBe(false);
+    const importCalls = commands().filter((c) => c.includes('oc import-image'));
+    expect(importCalls.length).toBe(2);
+  });
+
+  it('skipBuild/skipPush reuse the existing image', async () => {
+    await runExecutor({ ...baseOptions, skipBuild: true, skipPush: true }, context());
+    const cmds = commands();
+    expect(cmds.some((c) => c.includes('podman build'))).toBe(false);
+    expect(cmds.some((c) => c.includes('nx build test'))).toBe(false);
+    expect(cmds.some((c) => c.includes('podman push'))).toBe(false);
+    // still imports + rolls out
+    expect(cmds.some((c) => c.includes('oc import-image'))).toBe(true);
+    expect(cmds.some((c) => c.includes('oc rollout restart'))).toBe(true);
+  });
+
+  it('provisions Postgres and the per-app database before rollout', async () => {
+    await runExecutor({ ...baseOptions, database: 'postgres' }, context());
+    const cmds = commands();
+    expect(cmds.some((c) => c.includes('sandbox-postgres-creds'))).toBe(true);
+    expect(cmds.some((c) => c.includes('sandbox-postgres.yml'))).toBe(true);
+    expect(cmds.some((c) => c.includes('createdb -U postgres test_sandbox'))).toBe(true);
+    const createDbIdx = cmds.findIndex((c) => c.includes('createdb'));
+    const rolloutIdx = cmds.findIndex((c) => c.includes('rollout status deployment/test'));
+    expect(createDbIdx).toBeGreaterThanOrEqual(0);
+    expect(createDbIdx).toBeLessThan(rolloutIdx);
+  });
+
+  it('ensures paired backend Services from proxy-service tags (idempotent)', async () => {
+    await runExecutor(
+      { ...baseOptions, appType: 'frontend' },
+      context(['adsp:proxy-service:test-service:3333'])
+    );
+    const guard = commands().find((c) => c.includes('oc get service test-service'));
+    expect(guard).toBeTruthy();
+    expect(guard).toContain('||');
+    expect(guard).toContain('oc create service clusterip test-service --tcp=3333:3333');
+  });
+
+  it('adds no paired-service guard without proxy-service tags', async () => {
+    await runExecutor(baseOptions, context());
+    expect(commands().some((c) => c.includes('oc get service'))).toBe(false);
+  });
+
+  it('warns when a paired backend has no running pods', async () => {
+    const warn = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    // default mock returns '' for `oc get endpoints` → no endpoints
+    await runExecutor(
+      { ...baseOptions, appType: 'frontend' },
+      context(['adsp:proxy-service:test-service:3333'])
+    );
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining('test-service'));
+    // warn only — does not deploy the backend
+    expect(commands().some((c) => c.includes('nx run test-service:sandbox'))).toBe(false);
+    warn.mockRestore();
+  });
+
+  it('does not warn when the paired backend has endpoints', async () => {
+    const warn = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    execSync.mockImplementation((cmd: string) =>
+      Buffer.from(cmd.includes('oc get endpoints test-service') ? '10.1.2.3' : '')
+    );
+    await runExecutor(
+      { ...baseOptions, appType: 'frontend' },
+      context(['adsp:proxy-service:test-service:3333'])
+    );
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
+  it('deployBackend deploys each paired backend first (no warning)', async () => {
+    const warn = jest.spyOn(logger, 'warn').mockImplementation(() => undefined);
+    await runExecutor(
+      { ...baseOptions, appType: 'frontend', deployBackend: true },
+      context(['adsp:proxy-service:test-service:3333'])
+    );
+    expect(commands().some((c) => c.includes('npx nx run test-service:sandbox'))).toBe(true);
+    expect(warn).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+});

package/src/executors/sandbox/schema.d.ts

@@ -0,0 +1,13 @@
+import { ApplicationType, DatabaseType } from '../../generators/deployment/schema';
+
+export interface SandboxExecutorSchema {
+  sandboxProject: string;
+  registry: string;
+  database?: DatabaseType;
+  appType?: ApplicationType;
+  imageTag?: string;
+  skipBuild?: boolean;
+  skipPush?: boolean;
+  deployBackend?: boolean;
+  importRetries?: number;
+}

package/src/executors/sandbox/schema.json

@@ -0,0 +1,55 @@
+{
+  "version": 2,
+  "outputCapture": "direct-nodejs",
+  "$schema": "http://json-schema.org/schema",
+  "title": "Sandbox deploy executor",
+  "description": "Builds the project image locally with podman, pushes it to the container registry, imports it into the sandbox namespace, and rolls out the deployment.",
+  "type": "object",
+  "properties": {
+    "sandboxProject": {
+      "type": "string",
+      "description": "The OpenShift namespace to deploy the sandbox into."
+    },
+    "registry": {
+      "type": "string",
+      "description": "Container registry the sandbox image is published to (e.g. ghcr.io/my-org)."
+    },
+    "database": {
+      "type": "string",
+      "enum": ["none", "postgres", "mongo"],
+      "default": "none",
+      "description": "Provision a shared sandbox database of this type before deploying."
+    },
+    "appType": {
+      "type": "string",
+      "enum": ["node", "frontend", "dotnet"],
+      "description": "Application type. Detected from the project configuration when omitted."
+    },
+    "imageTag": {
+      "type": "string",
+      "default": "sandbox",
+      "description": "Image tag pushed and imported into the namespace imagestream."
+    },
+    "skipBuild": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip the nx build + podman build steps and reuse the already-built image (resume a partial deploy)."
+    },
+    "skipPush": {
+      "type": "boolean",
+      "default": false,
+      "description": "Skip the registry login + push and reuse the already-pushed image (resume from the import step)."
+    },
+    "deployBackend": {
+      "type": "boolean",
+      "default": false,
+      "description": "For a frontend: deploy each paired backend (its own sandbox target) first, so proxied /api calls work. Off by default; without it, a missing backend is warned about, not deployed."
+    },
+    "importRetries": {
+      "type": "number",
+      "default": 5,
+      "description": "How many times to retry oc import-image (absorbs the 409 from oc tag's async reconcile)."
+    }
+  },
+  "required": ["sandboxProject", "registry"]
+}

package/src/generators/sandbox/files/SANDBOX.md__tmpl__

@@ -0,0 +1,99 @@
+# Sandbox deploy — <%= projectName %>
+
+Deploy runbook for coding agents. `nx run <%= projectName %>:sandbox` builds the
+image **locally with podman**, pushes it to GHCR, imports it into the
+`<%= sandboxProject %>` namespace, and rolls out — no git push or CI wait. The
+orchestration lives in the `@abgov/nx-oc:sandbox` executor (versioned in the
+plugin), so the steps below are what it runs for you.
+
+## What the target does, in order
+
+1. **Preflight** — `oc` login, `gh` auth, and `podman` machine are checked up
+   front; a failure here stops before the build with an actionable message.
+2. Upsert the pull secret + <% if (appType === 'node') { %>the `CLIENT_SECRET` secret + <% } %>any paired Services<% if (database && database !== 'none') { %> + the shared `<%= database %>` database<% } %>.
+3. `nx build <%= projectName %> --configuration production`
+4. `podman build` → `podman login` (gh token) → `podman push` to
+   `<%= registry %>/<%= imageName %>:sandbox`.
+5. `oc tag … --reference-policy=local` then `oc import-image` (retried to absorb
+   the tag-reconcile 409).
+6. `oc process | oc apply` the manifest, then `oc rollout restart` + `status`.
+
+## Options (resume a partial deploy without rebuilding)
+
+```bash
+nx run <%= projectName %>:sandbox --skipBuild            # reuse the built image; re-push + import + roll out
+nx run <%= projectName %>:sandbox --skipBuild --skipPush # reuse the pushed image; re-import + roll out only
+nx run <%= projectName %>:sandbox --imageTag=<tag>       # push/import under a different tag
+nx run <%= projectName %>:sandbox --importRetries=8      # more import retries on a slow cluster
+<% if (appType === 'frontend') { %>nx run <%= projectName %>:sandbox --deployBackend         # deploy each paired backend (its own sandbox) first
+<% } %>```
+<% if (appType === 'frontend') { %>
+This frontend proxies `/api` to its paired backend Service. The target always
+ensures that Service exists (so nginx doesn't crashloop), but by default it does
+**not** deploy the backend — if the backend has no running pods it **warns** that
+proxied calls will 502, and names the target to run. Pass `--deployBackend` to
+deploy each paired backend as part of this run instead.
+<% } %>
+
+## Preflight failures — cause → fix
+
+- **`'podman' is required …`** — podman not installed. `brew install podman` (macOS).
+- **`podman is installed but not responding`** — machine stopped. `podman machine start`.
+- **`'gh' is required …`** — GitHub CLI not installed. See https://cli.github.com.
+- **`gh is installed but not authenticated`** — run `gh auth login`.
+- **oc login prompts / fails** — `oc login` to your cluster, targeting the
+  `<%= sandboxProject %>` namespace (`oc project <%= sandboxProject %>`).
+
+## If the deploy fails mid-way (work around by hand)
+
+The executor stops at the first failing step. After fixing the cause, the
+fastest path is usually `--skipBuild` (or `--skipBuild --skipPush`) to resume.
+If you need to drive it manually, these are the remaining steps — the image ref
+is `<%= registry %>/<%= imageName %>:sandbox`:
+
+```bash
+NS=<%= sandboxProject %>
+REF=<%= registry %>/<%= imageName %>:sandbox
+# (1) push, if not already pushed
+gh auth token | podman login <%= registryHost %> -u "$(gh api user -q .login)" --password-stdin
+podman push "$REF"
+# (2) point the imagestream at it and import (retry absorbs the tag race)
+oc tag "$REF" <%= projectName %>:sandbox --reference-policy=local -n "$NS"
+until oc import-image <%= projectName %>:sandbox --confirm -n "$NS"; do sleep 3; done
+# (3) apply the manifest and roll out
+oc process -f .openshift/<%= projectName %>/<%= projectName %>.yml -p PROJECT="$NS" | oc apply -f -
+oc rollout restart deployment/<%= projectName %> -n "$NS"
+oc rollout status  deployment/<%= projectName %> -n "$NS" --timeout=180s
+```
+
+## Verify
+
+```bash
+oc get pods -n <%= sandboxProject %> -l name=<%= projectName %>
+<% if (appType === 'node') { %>curl "https://$(oc get route <%= projectName %> -n <%= sandboxProject %> -o jsonpath='{.spec.host}')/health"<% } else { %>curl -I "https://$(oc get route <%= projectName %> -n <%= sandboxProject %> -o jsonpath='{.spec.host}')/"<% } %>
+```
+
+## Known issues & workarounds
+
+- **`podman push` / import fails with an auth error** — the *active* `gh`
+  account lacks `write:packages` (or access to the org). Preflight only confirms
+  *an* account is logged in, not its scope. Check `gh auth status`; switch with
+  `gh auth switch -u <account>`, then re-run with `--skipBuild`.
+- **Pod `FailedCreate` "exceeded quota"** — the namespace CPU quota is full.
+  Free room: `oc get deploy -n <%= sandboxProject %>` then delete stale apps
+  (`oc delete all,configmap,is -l app=<old-app> -n <%= sandboxProject %>`), and re-run.
+- **Pod `CrashLoopBackOff`** — `oc logs -n <%= sandboxProject %> <pod> -c <%= projectName %>`.<% if (appType === 'node' && database && database !== 'none') { %>
+  For the DB migration, also check the init container:
+  `oc logs -n <%= sandboxProject %> <pod> -c <%= projectName %>-migrate`.<% } %>
+<% if (appType === 'frontend') { %>- **Sign-in returns `Invalid redirect_uri`** — the sandbox Route wasn't
+  registered on the Keycloak public client (the generator does this when it can
+  resolve the cluster ingress domain). Add `https://<%= projectName %>-<%= sandboxProject %>.<ingress-domain>/*`
+  to the client's valid redirect URIs.
+<% } %>- **Import 409 "object has been modified"** — the `oc tag` reconcile race; the
+  executor already retries. If you hit it manually, just re-run the import.
+
+## Teardown
+
+```bash
+nx run <%= projectName %>:sandbox-teardown   # remove sandbox resources + delete the GHCR image
+```

package/src/generators/sandbox/sandbox.js

@@ -70,103 +70,39 @@ function addManifestFiles(host, options) {
         sourceRepositoryUrl: (_a = options.sourceRepositoryUrl) !== null && _a !== void 0 ? _a : '', database: (_b = options.database) !== null && _b !== void 0 ? _b : 'none', sandbox: true, ocInfraProject: options.sandboxProject, tmpl: '' });
     (0, devkit_1.generateFiles)(host, path.join(__dirname, `../deployment/${options.appType}-files`), `./.openshift/${options.projectName}`, templateOptions);
 }
+// Emit the per-app deploy + troubleshooting runbook next to the manifests, so a
+// coding agent has one canonical, app-aware source (rather than the guidance
+// being duplicated across every app's AGENTS.md).
+function addSandboxDoc(host, options) {
+    var _a;
+    (0, devkit_1.generateFiles)(host, path.join(__dirname, 'files'), `./.openshift/${options.projectName}`, {
+        projectName: options.projectName,
+        appType: options.appType,
+        database: (_a = options.database) !== null && _a !== void 0 ? _a : 'none',
+        sandboxProject: options.sandboxProject,
+        registry: options.registry,
+        registryHost: options.registryHost,
+        imageName: options.imageName,
+        tmpl: '',
+    });
+}
 function addDatabaseFiles(host, options) {
     if (!options.database || options.database === 'none')
         return;
     (0, devkit_1.generateFiles)(host, path.join(__dirname, 'database-files'), './.openshift/sandbox', { database: options.database, tmpl: '' });
 }
 function addSandboxTarget(host, options) {
-    var _a;
     const config = (0, devkit_1.readProjectConfiguration)(host, options.project);
-    const { projectName, sandboxProject, database, appType, imageRef, registryHost, registryOrg, imageName, } = options;
-    const commands = [];
-    // ADSP services authenticate with the access service using a confidential
-    // Keycloak client secret. The express-service generator writes it to the
-    // service's .env (CLIENT_SECRET=...) at generate time; mirror it into an
-    // OpenShift Secret the deployment reads. Upserted from the current .env so
-    // re-runs pick up a rotated secret. Non-node app types have no client secret.
-    if (appType === 'node') {
-        commands.push(`oc create secret generic ${projectName}-secrets ` +
-            `--from-literal=CLIENT_SECRET="$(grep -E '^CLIENT_SECRET=' ${config.root}/.env 2>/dev/null | cut -d= -f2-)" ` +
-            `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`);
-    }
-    if (database === 'postgres') {
-        commands.push(`oc get secret sandbox-postgres-creds -n ${sandboxProject} 2>/dev/null || ` +
-            `oc create secret generic sandbox-postgres-creds ` +
-            `--from-literal=POSTGRESQL_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
-            `-n ${sandboxProject}`);
-        commands.push(`oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${sandboxProject}`);
-        // The shared Postgres instance only creates the admin database; each app
-        // needs its own <app>_sandbox database created before its migrate init
-        // container runs (neither the image nor the ORM creates it). Wait for
-        // Postgres to be ready, then create the database idempotently.
-        const dbName = `${projectName}_sandbox`;
-        commands.push(`oc rollout status deployment/sandbox-postgres -n ${sandboxProject} --timeout=180s && ` +
-            `oc exec -n ${sandboxProject} deployment/sandbox-postgres -- ` +
-            `bash -lc "psql -U postgres -tc \\"SELECT 1 FROM pg_database WHERE datname='${dbName}'\\" ` +
-            `| grep -q 1 || createdb -U postgres ${dbName}"`);
-    }
-    else if (database === 'mongo') {
-        commands.push(`oc get secret sandbox-mongodb-creds -n ${sandboxProject} 2>/dev/null || ` +
-            `oc create secret generic sandbox-mongodb-creds ` +
-            `--from-literal=MONGODB_ADMIN_PASSWORD=$(openssl rand -base64 24 | tr -d '/+=') ` +
-            `-n ${sandboxProject}`);
-        commands.push(`oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${sandboxProject}`);
-    }
-    // Ensure any paired backend Services exist first, so this app's nginx can
-    // resolve its proxy_pass upstreams at startup (otherwise the pod crashloops
-    // until the Service appears). Create only the Service (all nginx needs for
-    // DNS) — not the backend's deployment, which has no image until its own
-    // sandbox runs. Idempotent: skipped once the Service exists, so it doesn't
-    // slow down repeated frontend iteration. Recorded by the composite generators
-    // (pevn/mevn/…) as `adsp:proxy-service:<name>:<port>` project tags.
-    const PREFIX = 'adsp:proxy-service:';
-    const proxyServices = ((_a = config.tags) !== null && _a !== void 0 ? _a : [])
-        .filter((tag) => tag.startsWith(PREFIX))
-        .map((tag) => {
-        const value = tag.slice(PREFIX.length);
-        const lastColon = value.lastIndexOf(':');
-        return {
-            name: value.slice(0, lastColon),
-            port: value.slice(lastColon + 1),
-        };
-    });
-    for (const { name, port } of proxyServices) {
-        commands.push(`oc get service ${name} -n ${sandboxProject} >/dev/null 2>&1 || ` +
-            `oc create service clusterip ${name} --tcp=${port}:${port} -n ${sandboxProject}`);
-    }
-    // Build the image locally and push to the container registry, then import it
-    // into the namespace's imagestream. reference-policy=local mirrors it into the
-    // internal registry so pods pull in-cluster (no per-pod pull secret, no node
-    // egress to the registry). This replaces the in-cluster BuildConfig: no
-    // full-workspace upload, and local layer caching makes iteration fast.
-    commands.push(`npx nx build ${projectName} --configuration production`);
-    commands.push(`podman build --platform=linux/amd64 -f .openshift/${projectName}/Dockerfile -t ${imageRef} .`);
-    // Prereq: the publishing account is logged in with write:packages. gh supplies
-    // the token so no PAT is stored; the same session token backs the pull secret.
-    commands.push(`gh auth token | podman login ${registryHost} -u "$(gh api user -q .login)" --password-stdin`);
-    commands.push(`podman push ${imageRef}`);
-    // Per-deploy pull secret from the gh session (sandbox images are re-imported
-    // every run, so a session token is sufficient — no long-lived PAT needed).
-    commands.push(`oc create secret docker-registry ghcr-pull ` +
-        `--docker-server=${registryHost} --docker-username="$(gh api user -q .login)" --docker-password="$(gh auth token)" ` +
-        `-n ${sandboxProject} --dry-run=client -o yaml | oc apply -f -`);
-    // oc tag sets/repoints the imagestream tag (import-image refuses to change an
-    // existing tag's source); import --confirm then pulls the manifest.
-    commands.push(`oc tag ${imageRef} ${projectName}:sandbox --reference-policy=local -n ${sandboxProject}`);
-    // oc tag triggers an async imagestream reconcile, so a back-to-back
-    // import-image can 409 ("object has been modified"). Retry until it settles.
-    commands.push(`n=0; until oc import-image ${projectName}:sandbox --confirm -n ${sandboxProject}; do ` +
-        `n=$((n+1)); [ $n -ge 5 ] && exit 1; sleep 3; done`);
-    commands.push(`oc process -f .openshift/${projectName}/${projectName}.yml -p PROJECT=${sandboxProject} | oc apply -f -`);
-    commands.push(`oc rollout restart deployment/${projectName} -n ${sandboxProject}`);
-    commands.push(`oc rollout status deployment/${projectName} -n ${sandboxProject} --timeout=180s`);
+    const { projectName, sandboxProject, database, appType, registry, registryOrg, imageName, } = options;
+    // The deploy orchestration (preflight, build → podman → push → import with
+    // retry → rollout, database/paired-service provisioning) lives in the
+    // @abgov/nx-oc:sandbox executor, versioned in the plugin — so bug fixes reach
+    // every project on `npm update` instead of being baked into project.json.
     config.targets = Object.assign(Object.assign({}, config.targets), { sandbox: {
-            executor: 'nx:run-commands',
-            options: {
-                commands,
-                parallel: false,
-            },
+            executor: '@abgov/nx-oc:sandbox',
+            options: Object.assign({ sandboxProject,
+                registry,
+                appType }, (database && database !== 'none' ? { database } : {})),
         }, 'sandbox-teardown': {
             executor: 'nx:run-commands',
             options: {
@@ -214,6 +150,7 @@ function default_1(host, options) {
         }
         addManifestFiles(host, normalizedOptions);
         addDatabaseFiles(host, normalizedOptions);
+        addSandboxDoc(host, normalizedOptions);
         addSandboxTarget(host, normalizedOptions);
         yield registerSandboxRedirectUri(normalizedOptions);
         yield (0, devkit_1.formatFiles)(host);

package/src/generators/sandbox/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/sandbox/sandbox.ts"],"names":[],"mappings":";;AAsUA,4BAYC;;AAlVD,uCASoB;AACpB,6BAA6B;AAC7B,qCAAyE;AACzE,qDAI+B;AAC/B,mDAA+D;AAC/D,mDAAiF;AAGjF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,gFAAgF;AAChF,2EAA2E;AAC3E,kFAAkF;AAClF,SAAe,eAAe,CAC5B,IAAU,EACV,QAA4B,EAC5B,SAA6B;;;QAE7B,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAA,MACb,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,0CAAE,UAGnB,0CAAG,iBAAiB,CAAC,0CAAE,QAAQ,CAAC;QACjC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAA,oCAAwB,EAAC,SAAS,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YAC1F,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAuB;YAChE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CAAA;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,IAAU,EAAE,QAAgB;;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,mCAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,MAAA,MAAM,CAAC,UAAU,mCAAI,EAAE,CAG1C,CAAC;IACF,UAAU,CAAC,iBAAiB,CAAC,mCACxB,CAAC,MAAA,UAAU,CAAC,iBAAiB,CAAC,mCAAI,EAAE,CAAC,KACxC,QAAQ,EAAE,KAAK,GAChB,CAAC;IACF,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,IAAA,qBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,kCACvC,OAAO,KACV,GAAG,EAAE,MAAC,OAAO,CAAC,GAA+B,mCAAI,KAAK,IACtD,CAAC;QAEH,MAAM,SAAS,GAAG,IAAA,2BAAe,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1F,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;QAE1C,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW,EACX,eAAe,EAAE,IAAA,6BAAkB,EAAC,MAAM,CAAC,EAC3C,QAAQ,EACR,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACpC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EACnD,SAAS,EACT,QAAQ,EAAE,GAAG,QAAQ,IAAI,SAAS,UAAU,EAC5C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAC5E;IACJ,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI;QACf,0EAA0E;QAC1E,mBAAmB,EAAE,MAAA,OAAO,CAAC,mBAAmB,mCAAI,EAAE,EACtD,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,IAAI,EACb,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,OAAO,QAAQ,CAAC,EAC9D,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO;IAC7D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,sBAAsB,EACtB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EACJ,WAAW,EACX,cAAc,EACd,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,SAAS,GACV,GAAG,OAAO,CAAC;IAEZ,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,2EAA2E;IAC3E,8EAA8E;IAC9E,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,4BAA4B,WAAW,WAAW;YAChD,6DAA6D,MAAM,CAAC,IAAI,qCAAqC;YAC7G,MAAM,cAAc,2CAA2C,CAClE,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CACX,2CAA2C,cAAc,kBAAkB;YACzE,kDAAkD;YAClD,oFAAoF;YACpF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,0DAA0D,cAAc,EAAE,CAC3E,CAAC;QACF,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,MAAM,GAAG,GAAG,WAAW,UAAU,CAAC;QACxC,QAAQ,CAAC,IAAI,CACX,oDAAoD,cAAc,qBAAqB;YACrF,cAAc,cAAc,kCAAkC;YAC9D,8EAA8E,MAAM,OAAO;YAC3F,uCAAuC,MAAM,GAAG,CACnD,CAAC;IACJ,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,0CAA0C,cAAc,kBAAkB;YACxE,iDAAiD;YACjD,iFAAiF;YACjF,MAAM,cAAc,EAAE,CACzB,CAAC;QACF,QAAQ,CAAC,IAAI,CACX,yDAAyD,cAAc,EAAE,CAC1E,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,MAAM,GAAG,qBAAqB,CAAC;IACrC,MAAM,aAAa,GAAG,CAAC,MAAA,MAAM,CAAC,IAAI,mCAAI,EAAE,CAAC;SACtC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;YAC/B,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;SACjC,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;QAC3C,QAAQ,CAAC,IAAI,CACX,kBAAkB,IAAI,OAAO,cAAc,sBAAsB;YAC/D,+BAA+B,IAAI,UAAU,IAAI,IAAI,IAAI,OAAO,cAAc,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,QAAQ,CAAC,IAAI,CAAC,gBAAgB,WAAW,6BAA6B,CAAC,CAAC;IACxE,QAAQ,CAAC,IAAI,CACX,qDAAqD,WAAW,kBAAkB,QAAQ,IAAI,CAC/F,CAAC;IACF,+EAA+E;IAC/E,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,CACX,gCAAgC,YAAY,iDAAiD,CAC9F,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;IACzC,6EAA6E;IAC7E,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CACX,6CAA6C;QAC3C,mBAAmB,YAAY,qFAAqF;QACpH,MAAM,cAAc,2CAA2C,CAClE,CAAC;IACF,8EAA8E;IAC9E,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CACX,UAAU,QAAQ,IAAI,WAAW,wCAAwC,cAAc,EAAE,CAC1F,CAAC;IACF,oEAAoE;IACpE,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,CACX,8BAA8B,WAAW,yBAAyB,cAAc,OAAO;QACrF,mDAAmD,CACtD,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX,4BAA4B,WAAW,IAAI,WAAW,mBAAmB,cAAc,kBAAkB,CAC1G,CAAC;IAEF,QAAQ,CAAC,IAAI,CACX,iCAAiC,WAAW,OAAO,cAAc,EAAE,CACpE,CAAC;IACF,QAAQ,CAAC,IAAI,CACX,gCAAgC,WAAW,OAAO,cAAc,iBAAiB,CAClF,CAAC;IAEF,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,OAAO,EAAE;YACP,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ;gBACR,QAAQ,EAAE,KAAK;aAChB;SACF,EACD,kBAAkB,EAAE;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,qCAAqC,WAAW,OAAO,cAAc,qBAAqB;oBAC1F,yBAAyB,WAAW,OAAO,cAAc,qBAAqB;oBAC9E,mEAAmE;oBACnE,yEAAyE;oBACzE,qCAAqC;oBACrC,gCAAgC,WAAW,uBAAuB,SAAS,sBAAsB;iBAClG;aACF;SACF,GACF,CAAC;IAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,6EAA6E;AAC7E,qCAAqC;AACrC,SAAe,0BAA0B,CAAC,OAAyB;;QACjE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QAC3C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QACtD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAA;YAAE,OAAO;QAE/B,MAAM,aAAa,GAAG,IAAA,kCAAuB,GAAE,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,8FAA8F;gBAC5F,2EAA2E,CAC9E,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,WAAW,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACzD,MAAM,IAAA,4BAAqB,EACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,QAAQ,EACR,CAAC,GAAG,QAAQ,IAAI,CAAC,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;CAAA;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/generators/sandbox/sandbox.ts"],"names":[],"mappings":";;AA0OA,4BAaC;;AAvPD,uCASoB;AACpB,6BAA6B;AAC7B,qCAAyE;AACzE,qDAI+B;AAC/B,mDAA+D;AAC/D,mDAAiF;AAGjF,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,gFAAgF;AAChF,2EAA2E;AAC3E,kFAAkF;AAClF,SAAe,eAAe,CAC5B,IAAU,EACV,QAA4B,EAC5B,SAA6B;;;QAE7B,IAAI,QAAQ;YAAE,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAErD,MAAM,MAAM,GAAG,MAAA,MACb,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,0CAAE,UAGnB,0CAAG,iBAAiB,CAAC,0CAAE,QAAQ,CAAC;QACjC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,OAAO,GAAG,IAAA,oCAAwB,EAAC,SAAS,CAAC,CAAC;QACpD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,yBAAyB,OAAO,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;YAC1F,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,2CAAa,UAAU,EAAC,CAAC;QAC5C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAuB;YAChE,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,UAAU;YAChB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;QACH,OAAO,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;CAAA;AAED,8EAA8E;AAC9E,SAAS,eAAe,CAAC,IAAU,EAAE,QAAgB;;IACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,MAAA,IAAA,mBAAU,EAAC,IAAI,CAAC,mCAAI,EAAE,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,MAAA,MAAM,CAAC,UAAU,mCAAI,EAAE,CAG1C,CAAC;IACF,UAAU,CAAC,iBAAiB,CAAC,mCACxB,CAAC,MAAA,UAAU,CAAC,iBAAiB,CAAC,mCAAI,EAAE,CAAC,KACxC,QAAQ,EAAE,KAAK,GAChB,CAAC;IACF,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,IAAA,qBAAY,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAe,gBAAgB,CAC7B,IAAU,EACV,OAAe;;;QAEf,MAAM,WAAW,GAAG,IAAA,cAAK,EAAC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,OAAO,mCAAI,IAAA,gCAAqB,EAAC,MAAM,CAAC,CAAC;QAEjE,MAAM,IAAI,GAAG,MAAM,IAAA,2BAAoB,EAAC,IAAI,kCACvC,OAAO,KACV,GAAG,EAAE,MAAC,OAAO,CAAC,GAA+B,mCAAI,KAAK,IACtD,CAAC;QAEH,MAAM,SAAS,GAAG,IAAA,2BAAe,GAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1F,wEAAwE;QACxE,4EAA4E;QAC5E,MAAM,SAAS,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAG,IAAA,yBAAa,EAAC,SAAS,CAAC,CAAC;QAE1C,uCACK,OAAO,KACV,OAAO;YACP,IAAI;YACJ,WAAW,EACX,eAAe,EAAE,IAAA,6BAAkB,EAAC,MAAM,CAAC,EAC3C,QAAQ,EACR,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACpC,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EACnD,SAAS,EACT,QAAQ,EAAE,GAAG,QAAQ,IAAI,SAAS,UAAU,EAC5C,mBAAmB,EAAE,QAAQ,CAAC,CAAC,CAAC,sBAAsB,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,IAC5E;IACJ,CAAC;CAAA;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;;IAC7D,MAAM,eAAe,iDAChB,OAAO,GACP,OAAO,CAAC,IAAI;QACf,0EAA0E;QAC1E,mBAAmB,EAAE,MAAA,OAAO,CAAC,mBAAmB,mCAAI,EAAE,EACtD,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM,EACpC,OAAO,EAAE,IAAI,EACb,cAAc,EAAE,OAAO,CAAC,cAAc,EACtC,IAAI,EAAE,EAAE,GACT,CAAC;IACF,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,OAAO,CAAC,OAAO,QAAQ,CAAC,EAC9D,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,6EAA6E;AAC7E,kDAAkD;AAClD,SAAS,aAAa,CAAC,IAAU,EAAE,OAAyB;;IAC1D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAC7B,gBAAgB,OAAO,CAAC,WAAW,EAAE,EACrC;QACE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,MAAA,OAAO,CAAC,QAAQ,mCAAI,MAAM;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,EAAE;KACT,CACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM;QAAE,OAAO;IAC7D,IAAA,sBAAa,EACX,IAAI,EACJ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,EACtC,sBAAsB,EACtB,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAU,EAAE,OAAyB;IAC7D,MAAM,MAAM,GAAG,IAAA,iCAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,EACJ,WAAW,EACX,cAAc,EACd,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,WAAW,EACX,SAAS,GACV,GAAG,OAAO,CAAC;IAEZ,2EAA2E;IAC3E,sEAAsE;IACtE,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,CAAC,OAAO,mCACT,MAAM,CAAC,OAAO,KACjB,OAAO,EAAE;YACP,QAAQ,EAAE,sBAAsB;YAChC,OAAO,kBACL,cAAc;gBACd,QAAQ;gBACR,OAAO,IACJ,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;SACF,EACD,kBAAkB,EAAE;YAClB,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE;gBACP,QAAQ,EAAE;oBACR,qCAAqC,WAAW,OAAO,cAAc,qBAAqB;oBAC1F,yBAAyB,WAAW,OAAO,cAAc,qBAAqB;oBAC9E,mEAAmE;oBACnE,yEAAyE;oBACzE,qCAAqC;oBACrC,gCAAgC,WAAW,uBAAuB,SAAS,sBAAsB;iBAClG;aACF;SACF,GACF,CAAC;IAEF,IAAA,mCAA0B,EAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5D,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,iFAAiF;AACjF,6EAA6E;AAC7E,qCAAqC;AACrC,SAAe,0BAA0B,CAAC,OAAyB;;QACjE,IAAI,OAAO,CAAC,OAAO,KAAK,UAAU;YAAE,OAAO;QAC3C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;QACtD,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,WAAW,CAAA;YAAE,OAAO;QAE/B,MAAM,aAAa,GAAG,IAAA,kCAAuB,GAAE,CAAC;QAChD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CACT,8FAA8F;gBAC5F,2EAA2E,CAC9E,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,WAAW,WAAW,IAAI,cAAc,IAAI,aAAa,EAAE,CAAC;QAC7E,MAAM,QAAQ,GAAG,WAAW,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QACzD,MAAM,IAAA,4BAAqB,EACzB,IAAI,CAAC,gBAAgB,EACrB,IAAI,CAAC,WAAW,EAChB,QAAQ,EACR,CAAC,GAAG,QAAQ,IAAI,CAAC,EACjB,IAAI,CAAC,WAAW,CACjB,CAAC;IACJ,CAAC;CAAA;AAED,mBAA+B,IAAU,EAAE,OAAe;;QACxD,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC5E,OAAO;QACT,CAAC;QAED,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,aAAa,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QACvC,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAC1C,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,CAAC;QACpD,MAAM,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CAAA"}

package/src/generators/sandbox/sandbox.spec.ts

@@ -83,64 +83,61 @@ describe('Sandbox Generator', () => {
     expect(manifest).not.toContain('ImageStream');
   });
 
-  it('adds sandbox nx target', async () => {
+  it('adds a sandbox target wired to the @abgov/nx-oc:sandbox executor', async () => {
     const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
     addNodeProject(host);
 
     await generator(host, options);
 
     const config = readProjectConfiguration(host, 'test');
-    expect(config.targets['sandbox']).toBeTruthy();
-    expect(config.targets['sandbox'].executor).toBe('nx:run-commands');
-    // Commands run in order (nx:run-commands has no `sequential` option).
-    expect(config.targets['sandbox'].options.parallel).toBe(false);
-    const cmds: string[] = config.targets['sandbox'].options.commands;
-    expect(cmds.some((c) => c.includes('oc rollout restart'))).toBeTruthy();
-    expect(cmds.some((c) => c.includes('oc rollout status'))).toBeTruthy();
-    expect(cmds.some((c) => c.includes('nx build test'))).toBeTruthy();
-
-    // Local podman build + push to the prescribed registry, with the image name
-    // prefixed by the (per-user) sandbox namespace to avoid GHCR's org-global
-    // name collisions.
-    const imageRef = 'ghcr.io/test-org/test-sandbox-test:sandbox';
-    expect(
-      cmds.some((c) => c.includes('podman build') && c.includes(imageRef))
-    ).toBeTruthy();
-    expect(cmds.some((c) => c.includes(`podman push ${imageRef}`))).toBeTruthy();
-    expect(cmds.some((c) => c.includes('podman login ghcr.io'))).toBeTruthy();
-
-    // Import into the namespace imagestream; pods pull from the internal registry.
-    expect(
-      cmds.some((c) =>
-        c.includes(`oc tag ${imageRef} test:sandbox --reference-policy=local`)
-      )
-    ).toBeTruthy();
-    // import-image is retried to absorb the 409 from oc tag's async reconcile.
-    expect(
-      cmds.some(
-        (c) =>
-          c.includes('oc import-image test:sandbox --confirm') &&
-          c.includes('until')
-      )
-    ).toBeTruthy();
-    // Per-deploy pull secret from the gh session (no stored PAT).
-    expect(
-      cmds.some((c) => c.includes('oc create secret docker-registry ghcr-pull'))
-    ).toBeTruthy();
+    const target = config.targets['sandbox'];
+    expect(target).toBeTruthy();
+    // Deploy orchestration lives in the executor (versioned in the plugin), so
+    // the target is thin config — no baked-in command list.
+    expect(target.executor).toBe('@abgov/nx-oc:sandbox');
+    expect(target.options).toMatchObject({
+      sandboxProject: 'test-sandbox',
+      registry: 'ghcr.io/test-org',
+      appType: 'node',
+    });
+    // No database key when the app has no database.
+    expect(target.options.database).toBeUndefined();
 
     // The in-cluster BuildConfig flow is gone.
-    expect(cmds.some((c) => c.includes('oc start-build'))).toBeFalsy();
     expect(host.exists('.openshift/test/sandbox-build.yml')).toBeFalsy();
+  });
 
-    // A node service's ADSP client secret is mirrored from .env into an
-    // OpenShift Secret the deployment reads.
-    expect(
-      cmds.some(
-        (c) =>
-          c.includes('oc create secret generic test-secrets') &&
-          c.includes('CLIENT_SECRET')
-      )
-    ).toBeTruthy();
+  it('writes a SANDBOX.md deploy/troubleshooting runbook next to the manifests', async () => {
+    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(host);
+
+    await generator(host, options);
+
+    expect(host.exists('.openshift/test/SANDBOX.md')).toBeTruthy();
+    const doc = host.read('.openshift/test/SANDBOX.md').toString();
+    expect(doc).toContain('nx run test:sandbox');
+    // resume flags + the copy-paste manual-completion sequence
+    expect(doc).toContain('--skipBuild');
+    expect(doc).toContain('oc import-image test:sandbox');
+    expect(doc).toContain('ghcr.io/test-org/test-sandbox-test:sandbox');
+    // no unrendered EJS tags leaked through
+    expect(doc).not.toContain('<%');
+  });
+
+  it('SANDBOX.md is app-type aware (frontend redirect URI; node+db migrate logs)', async () => {
+    const fe = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addFrontendProject(fe);
+    await generator(fe, options);
+    const feDoc = fe.read('.openshift/test/SANDBOX.md').toString();
+    expect(feDoc).toContain('Invalid redirect_uri');
+    expect(feDoc).not.toContain('-migrate');
+
+    const node = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+    addNodeProject(node);
+    await generator(node, { ...options, database: 'postgres' });
+    const nodeDoc = node.read('.openshift/test/SANDBOX.md').toString();
+    expect(nodeDoc).toContain('test-migrate');
+    expect(nodeDoc).not.toContain('Invalid redirect_uri');
   });
 
   it('persists the resolved registry to nx.json for reuse', async () => {
@@ -194,16 +191,10 @@ describe('Sandbox Generator', () => {
     expect(appManifest).toContain('sandbox-postgres-creds');
     expect(appManifest).toContain('$(POSTGRES_PASSWORD)');
 
+    // The database type is passed to the executor, which provisions the shared
+    // instance + per-app database at deploy time.
     const config = readProjectConfiguration(host, 'test');
-    const cmds: string[] = config.targets['sandbox'].options.commands;
-    expect(cmds.some((c) => c.includes('sandbox-postgres-creds'))).toBeTruthy();
-    expect(cmds.some((c) => c.includes('sandbox-postgres.yml'))).toBeTruthy();
-    // The per-app database is created idempotently before the app deploys.
-    expect(cmds.some((c) => c.includes('createdb -U postgres test_sandbox'))).toBeTruthy();
-    const createDbIdx = cmds.findIndex((c) => c.includes('createdb'));
-    const rolloutIdx = cmds.findIndex((c) => c.includes('rollout status deployment/test'));
-    expect(createDbIdx).toBeGreaterThanOrEqual(0);
-    expect(createDbIdx).toBeLessThan(rolloutIdx);
+    expect(config.targets['sandbox'].options.database).toBe('postgres');
   });
 
   it('generates shared mongodb manifest with secret-backed MONGODB_URI', async () => {
@@ -222,38 +213,7 @@ describe('Sandbox Generator', () => {
     expect(appManifest).toContain('$(MONGO_PASSWORD)');
 
     const config = readProjectConfiguration(host, 'test');
-    const cmds: string[] = config.targets['sandbox'].options.commands;
-    expect(cmds.some((c) => c.includes('sandbox-mongodb-creds'))).toBeTruthy();
-  });
-
-  it('ensures paired backend Services from proxy-service tags', async () => {
-    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
-    addFrontendProject(host, ['adsp:proxy-service:test-service:3333']);
-
-    await generator(host, options);
-
-    const config = readProjectConfiguration(host, 'test');
-    const cmds: string[] = config.targets['sandbox'].options.commands;
-    const guard = cmds.find((c) => c.includes('oc get service test-service'));
-    expect(guard).toBeTruthy();
-    // idempotent: only creates the Service (for DNS) when it's missing — no
-    // backend deployment, which would have no image until its own sandbox runs.
-    expect(guard).toContain('||');
-    expect(guard).toContain(
-      'oc create service clusterip test-service --tcp=3333:3333'
-    );
-    expect(guard).not.toContain('test-service.yml');
-  });
-
-  it('adds no paired-service guard when there are no proxy-service tags', async () => {
-    const host = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
-    addNodeProject(host);
-
-    await generator(host, options);
-
-    const config = readProjectConfiguration(host, 'test');
-    const cmds: string[] = config.targets['sandbox'].options.commands;
-    expect(cmds.some((c) => c.includes('oc get service'))).toBeFalsy();
+    expect(config.targets['sandbox'].options.database).toBe('mongo');
   });
 
   it('registers the deployment Route redirect URI for a frontend client', async () => {

package/src/migrations/convert-sandbox-target/convert-sandbox-target.d.ts

@@ -0,0 +1,2 @@
+import { Tree } from '@nx/devkit';
+export default function convertSandboxTarget(tree: Tree): Promise<void>;

package/src/migrations/convert-sandbox-target/convert-sandbox-target.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = convertSandboxTarget;
+const tslib_1 = require("tslib");
+const devkit_1 = require("@nx/devkit");
+// Converts sandbox targets generated as raw `nx:run-commands` command lists into
+// the `@abgov/nx-oc:sandbox` executor, so the versioned deploy logic (import
+// retry, preflight, resume flags) applies without re-running the generator.
+//
+// sandboxProject and registry are recovered from the old command strings; the
+// app type is left to the executor to detect at run time.
+function convertSandboxTarget(tree) {
+    return tslib_1.__awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c, _d;
+        let converted = 0;
+        for (const [name, project] of (0, devkit_1.getProjects)(tree)) {
+            const target = (_a = project.targets) === null || _a === void 0 ? void 0 : _a['sandbox'];
+            if (!target || target.executor !== 'nx:run-commands')
+                continue;
+            const commands = Array.isArray((_b = target.options) === null || _b === void 0 ? void 0 : _b.commands)
+                ? target.options.commands
+                : [];
+            const joined = commands.join('\n');
+            // Only touch the sandbox target this plugin generated (podman build + import).
+            if (!/podman build/.test(joined) || !/oc import-image/.test(joined))
+                continue;
+            const namespace = (_c = joined.match(/-n\s+(\S+)/)) === null || _c === void 0 ? void 0 : _c[1];
+            const imageRef = (_d = joined.match(/podman build[^\n]*?-t\s+(\S+)/)) === null || _d === void 0 ? void 0 : _d[1];
+            if (!namespace || !imageRef) {
+                devkit_1.logger.warn(`[nx-oc] Could not parse the sandbox target for "${name}"; leaving it as run-commands. Re-run the sandbox generator to migrate it.`);
+                continue;
+            }
+            // imageRef is <registry>/<namespace>-<project>:<tag>; the registry is
+            // everything before the final path segment (it contains its own slash,
+            // e.g. ghcr.io/org).
+            const registry = imageRef.slice(0, imageRef.lastIndexOf('/'));
+            const database = /sandbox-postgres/.test(joined)
+                ? 'postgres'
+                : /sandbox-mongodb/.test(joined)
+                    ? 'mongo'
+                    : undefined;
+            project.targets['sandbox'] = {
+                executor: '@abgov/nx-oc:sandbox',
+                options: Object.assign({ sandboxProject: namespace, registry }, (database ? { database } : {})),
+            };
+            (0, devkit_1.updateProjectConfiguration)(tree, name, project);
+            converted++;
+        }
+        if (converted > 0) {
+            devkit_1.logger.info(`[nx-oc] Converted ${converted} sandbox target(s) to the @abgov/nx-oc:sandbox executor.`);
+        }
+    });
+}
+//# sourceMappingURL=convert-sandbox-target.js.map

package/src/migrations/convert-sandbox-target/convert-sandbox-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"convert-sandbox-target.js","sourceRoot":"","sources":["../../../../../../packages/nx-oc/src/migrations/convert-sandbox-target/convert-sandbox-target.ts"],"names":[],"mappings":";;AAaA,uCAiDC;;AA9DD,uCAKoB;AAEpB,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,8EAA8E;AAC9E,0DAA0D;AAC1D,SAA8B,oBAAoB,CAAC,IAAU;;;QAC3D,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAA,oBAAW,EAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,0CAAG,SAAS,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBAAE,SAAS;YAE/D,MAAM,QAAQ,GAAa,KAAK,CAAC,OAAO,CAAC,MAAA,MAAM,CAAC,OAAO,0CAAE,QAAQ,CAAC;gBAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ;gBACzB,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnC,+EAA+E;YAC/E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAE9E,MAAM,SAAS,GAAG,MAAA,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,0CAAG,CAAC,CAAC,CAAC;YAClD,MAAM,QAAQ,GAAG,MAAA,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,0CAAG,CAAC,CAAC,CAAC;YACpE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC5B,eAAM,CAAC,IAAI,CACT,mDAAmD,IAAI,4EAA4E,CACpI,CAAC;gBACF,SAAS;YACX,CAAC;YACD,sEAAsE;YACtE,uEAAuE;YACvE,qBAAqB;YACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC9C,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;oBAChC,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,SAAS,CAAC;YAEd,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;gBAC3B,QAAQ,EAAE,sBAAsB;gBAChC,OAAO,kBACL,cAAc,EAAE,SAAS,EACzB,QAAQ,IACL,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAClC;aACF,CAAC;YACF,IAAA,mCAA0B,EAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;YAChD,SAAS,EAAE,CAAC;QACd,CAAC;QAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAClB,eAAM,CAAC,IAAI,CACT,qBAAqB,SAAS,0DAA0D,CACzF,CAAC;QACJ,CAAC;IACH,CAAC;CAAA"}

package/src/migrations/convert-sandbox-target/convert-sandbox-target.spec.ts

@@ -0,0 +1,111 @@
+import {
+  addProjectConfiguration,
+  readProjectConfiguration,
+  Tree,
+} from '@nx/devkit';
+import { createTreeWithEmptyWorkspace } from '@nx/devkit/testing';
+import migration from './convert-sandbox-target';
+
+// A representative slice of the old generated run-commands sandbox target.
+function oldSandboxCommands(ns: string, database?: 'postgres' | 'mongo') {
+  const ref = `ghcr.io/test-org/${ns}-app:sandbox`;
+  return [
+    ...(database === 'postgres'
+      ? [`oc apply -f .openshift/sandbox/sandbox-postgres.yml -n ${ns}`]
+      : []),
+    ...(database === 'mongo'
+      ? [`oc apply -f .openshift/sandbox/sandbox-mongodb.yml -n ${ns}`]
+      : []),
+    `npx nx build app --configuration production`,
+    `podman build --platform=linux/amd64 -f .openshift/app/Dockerfile -t ${ref} .`,
+    `podman push ${ref}`,
+    `oc tag ${ref} app:sandbox --reference-policy=local -n ${ns}`,
+    `n=0; until oc import-image app:sandbox --confirm -n ${ns}; do n=$((n+1)); [ $n -ge 5 ] && exit 1; sleep 3; done`,
+  ];
+}
+
+describe('convert-sandbox-target migration', () => {
+  let tree: Tree;
+  beforeEach(() => {
+    tree = createTreeWithEmptyWorkspace({ layout: 'apps-libs' });
+  });
+
+  it('converts a run-commands sandbox target to the executor', async () => {
+    addProjectConfiguration(tree, 'app', {
+      root: 'apps/app',
+      projectType: 'application',
+      targets: {
+        sandbox: {
+          executor: 'nx:run-commands',
+          options: { commands: oldSandboxCommands('my-ns'), parallel: false },
+        },
+      },
+    });
+
+    await migration(tree);
+
+    const target = readProjectConfiguration(tree, 'app').targets.sandbox;
+    expect(target.executor).toBe('@abgov/nx-oc:sandbox');
+    expect(target.options).toEqual({
+      sandboxProject: 'my-ns',
+      registry: 'ghcr.io/test-org',
+    });
+  });
+
+  it('recovers the database type from the old commands', async () => {
+    addProjectConfiguration(tree, 'app', {
+      root: 'apps/app',
+      projectType: 'application',
+      targets: {
+        sandbox: {
+          executor: 'nx:run-commands',
+          options: { commands: oldSandboxCommands('my-ns', 'postgres') },
+        },
+      },
+    });
+
+    await migration(tree);
+
+    expect(readProjectConfiguration(tree, 'app').targets.sandbox.options).toEqual({
+      sandboxProject: 'my-ns',
+      registry: 'ghcr.io/test-org',
+      database: 'postgres',
+    });
+  });
+
+  it('leaves an already-migrated executor target untouched', async () => {
+    const executorTarget = {
+      executor: '@abgov/nx-oc:sandbox',
+      options: { sandboxProject: 'my-ns', registry: 'ghcr.io/test-org' },
+    };
+    addProjectConfiguration(tree, 'app', {
+      root: 'apps/app',
+      projectType: 'application',
+      targets: { sandbox: executorTarget },
+    });
+
+    await migration(tree);
+
+    expect(readProjectConfiguration(tree, 'app').targets.sandbox).toEqual(
+      executorTarget
+    );
+  });
+
+  it('ignores unrelated run-commands targets', async () => {
+    const unrelated = {
+      executor: 'nx:run-commands',
+      options: { commands: ['echo hi'] },
+    };
+    addProjectConfiguration(tree, 'app', {
+      root: 'apps/app',
+      projectType: 'application',
+      targets: { sandbox: unrelated },
+    });
+
+    await migration(tree);
+
+    expect(readProjectConfiguration(tree, 'app').targets.sandbox).toEqual(
+      unrelated
+    );
+  });
+});