@akash-chowdhury-24/deployhub 2.0.14 → 2.0.16

package/src/core/environments.js

@@ -0,0 +1,300 @@
+/**
+ * Multi-environment helpers — kept separate from config I/O to avoid ESM cycles
+ * (e.g. github-actions ↔ config via doctor/sync-workflows).
+ */
+
+/** DNS label / Kubernetes namespace max length — tightest downstream constraint. */
+export const ENV_NAME_MAX_LENGTH = 63;
+
+/**
+ * Reserved CLI sentinel names. `"all"` collides with `--env all`.
+ * `"default"` is intentionally NOT reserved — it is a normal env key used by
+ * single-env init and legacy migration, with no special CLI meaning.
+ */
+export const RESERVED_ENVIRONMENT_NAMES = new Set(['all']);
+
+/**
+ * Lowercase kebab-case: safe for storage paths, CI secret prefixes (uppercased),
+ * and Nginx site filename segments.
+ */
+export const ENV_NAME_PATTERN = /^[a-z][a-z0-9-]*$/;
+
+/**
+ * Validate a candidate environment name before writing config.
+ * Shared by `deployhub env add` and interactive init / env-name prompts.
+ *
+ * @param {string} name
+ * @param {Iterable<string>} [existingNames]
+ * @returns {{ ok: true, name: string } | { ok: false, error: string }}
+ */
+export function validateEnvironmentName(name, existingNames = []) {
+  const trimmed = typeof name === 'string' ? name.trim() : '';
+  if (!trimmed) {
+    return { ok: false, error: 'Environment name cannot be empty.' };
+  }
+  if (trimmed.length > ENV_NAME_MAX_LENGTH) {
+    return {
+      ok: false,
+      error: `Environment name must be at most ${ENV_NAME_MAX_LENGTH} characters.`,
+    };
+  }
+  if (RESERVED_ENVIRONMENT_NAMES.has(trimmed.toLowerCase())) {
+    return {
+      ok: false,
+      error: `"${trimmed}" is a reserved name and cannot be used as an environment name.`,
+    };
+  }
+  if (!ENV_NAME_PATTERN.test(trimmed)) {
+    return {
+      ok: false,
+      error: `Invalid environment name "${trimmed}". Use lowercase letters, numbers, and hyphens only (must start with a letter), e.g. production, staging, my-app.`,
+    };
+  }
+  const existing = [...existingNames];
+  const collision = existing.find((n) => String(n).toLowerCase() === trimmed.toLowerCase());
+  if (collision) {
+    return {
+      ok: false,
+      error: `Environment "${collision}" already exists (names are case-insensitive). Use a different name or remove it first.`,
+    };
+  }
+  return { ok: true, name: trimmed };
+}
+
+/**
+ * Inquirer `validate` callback for environment name prompts.
+ *
+ * @param {Iterable<string>} [existingNames]
+ * @returns {(input: string) => true|string}
+ */
+export function createEnvNamePromptValidate(existingNames = []) {
+  return (input) => {
+    const result = validateEnvironmentName(input, existingNames);
+    return result.ok ? true : result.error;
+  };
+}
+
+/**
+ * @param {unknown} entry
+ * @returns {boolean}
+ */
+export function isNewEnvironmentShape(entry) {
+  return Boolean(
+    entry &&
+      typeof entry === 'object' &&
+      typeof /** @type {Record<string, unknown>} */ (entry).method === 'string' &&
+      /** @type {Record<string, unknown>} */ (entry).config &&
+      typeof /** @type {Record<string, unknown>} */ (entry).config === 'object' &&
+      !Array.isArray(/** @type {Record<string, unknown>} */ (entry).config)
+  );
+}
+
+/**
+ * @param {unknown} envEntry
+ * @returns {string|undefined}
+ */
+export function getEnvMethod(envEntry) {
+  if (!envEntry || typeof envEntry !== 'object') return undefined;
+  const e = /** @type {Record<string, unknown>} */ (envEntry);
+  if (typeof e.method === 'string') return e.method;
+  if (typeof e.type === 'string') return e.type;
+  return undefined;
+}
+
+/**
+ * Method-specific settings object (mutable reference for new-shape `config`).
+ * Supports legacy flat env entries used in tests.
+ *
+ * @param {unknown} envEntry
+ * @returns {Record<string, unknown>}
+ */
+export function getEnvSettings(envEntry) {
+  if (!envEntry || typeof envEntry !== 'object') return {};
+  if (isNewEnvironmentShape(envEntry)) {
+    return /** @type {Record<string, unknown>} */ (
+      /** @type {Record<string, unknown>} */ (envEntry).config
+    );
+  }
+  return /** @type {Record<string, unknown>} */ (envEntry);
+}
+
+/**
+ * @param {unknown} envEntry
+ * @returns {boolean}
+ */
+export function isEnvEnabled(envEntry) {
+  if (!envEntry || typeof envEntry !== 'object') return false;
+  const e = /** @type {Record<string, unknown>} */ (envEntry);
+  if (typeof e.enabled === 'boolean') return e.enabled;
+  return true;
+}
+
+/**
+ * @param {unknown} envEntry
+ * @returns {'push'|'manual'}
+ */
+export function getEnvTrigger(envEntry) {
+  if (!envEntry || typeof envEntry !== 'object') return 'manual';
+  const e = /** @type {Record<string, unknown>} */ (envEntry);
+  return e.trigger === 'push' ? 'push' : 'manual';
+}
+
+/**
+ * @param {Record<string, unknown>} config
+ * @returns {string|null}
+ */
+export function resolveDefaultEnvironmentName(config) {
+  const envs = /** @type {Record<string, unknown>} */ (config.environments || {});
+  const named = config.defaultEnvironment;
+  if (typeof named === 'string' && envs[named]) return named;
+
+  const deploy = /** @type {string[]|undefined} */ (config.deploy);
+  if (Array.isArray(deploy) && deploy[0] && envs[deploy[0]]) return deploy[0];
+
+  const enabled = Object.entries(envs)
+    .filter(([, e]) => isEnvEnabled(e))
+    .map(([n]) => n);
+  if (enabled.length === 1) return enabled[0];
+  if (envs.default) return 'default';
+  if (envs.production) return 'production';
+  return enabled[0] || Object.keys(envs)[0] || null;
+}
+
+/**
+ * Enabled environment names (for `--env all` and pipeline defaults).
+ * Falls back to legacy `deploy[]` when present and environments lack `enabled`.
+ *
+ * @param {Record<string, unknown>} config
+ * @returns {string[]}
+ */
+export function getEnabledEnvironmentNames(config) {
+  const envs = /** @type {Record<string, unknown>} */ (config.environments || {});
+  const names = Object.keys(envs);
+  if (names.length === 0) return [];
+
+  const hasEnabledFlag = names.some(
+    (n) => typeof /** @type {Record<string, unknown>} */ (envs[n])?.enabled === 'boolean'
+  );
+  if (hasEnabledFlag || names.some((n) => isNewEnvironmentShape(envs[n]))) {
+    return names.filter((n) => isEnvEnabled(envs[n]));
+  }
+
+  const deploy = /** @type {string[]|undefined} */ (config.deploy);
+  if (Array.isArray(deploy) && deploy.length > 0) {
+    return deploy.filter((n) => Boolean(envs[n]));
+  }
+  return names;
+}
+
+/**
+ * Build a new-shape environment entry from method + settings.
+ *
+ * @param {string} method
+ * @param {Record<string, unknown>} [settings]
+ * @param {{ enabled?: boolean, trigger?: 'push'|'manual' }} [meta]
+ */
+export function buildEnvironmentEntry(method, settings = {}, meta = {}) {
+  const cleaned = { ...settings };
+  delete cleaned.type;
+  delete cleaned.method;
+  delete cleaned.enabled;
+  delete cleaned.trigger;
+  delete cleaned.config;
+  return {
+    enabled: meta.enabled !== false,
+    method,
+    trigger: meta.trigger === 'push' ? 'push' : 'manual',
+    config: cleaned,
+  };
+}
+
+/**
+ * Resolve which environments a deploy/rollback should target.
+ *
+ * @param {Record<string, unknown>} config
+ * @param {string|undefined} envFlag — omitted = default only; `"all"` = every enabled; else one name
+ * @returns {{ targets: string[], skippedDisabled: string[] }}
+ */
+export function resolveEnvTargets(config, envFlag) {
+  const envs = /** @type {Record<string, unknown>} */ (config.environments || {});
+
+  if (!envFlag) {
+    const def = resolveDefaultEnvironmentName(config);
+    if (!def) {
+      throw new Error(
+        'No environments configured. Run "deployhub init" or "deployhub env add <name>".'
+      );
+    }
+    if (!isEnvEnabled(envs[def])) {
+      throw new Error(
+        `Environment "${def}" is disabled. Enable it with: deployhub env enable ${def}`
+      );
+    }
+    return { targets: [def], skippedDisabled: [] };
+  }
+
+  if (envFlag === 'all') {
+    /** @type {string[]} */
+    const skippedDisabled = [];
+    /** @type {string[]} */
+    const targets = [];
+    for (const name of Object.keys(envs)) {
+      if (isEnvEnabled(envs[name])) {
+        targets.push(name);
+      } else {
+        skippedDisabled.push(name);
+      }
+    }
+    return { targets, skippedDisabled };
+  }
+
+  if (!envs[envFlag]) {
+    throw new Error(
+      `Environment "${envFlag}" not found in config. Use: deployhub env list`
+    );
+  }
+  if (!isEnvEnabled(envs[envFlag])) {
+    throw new Error(
+      `Environment "${envFlag}" is disabled. Enable it with: deployhub env enable ${envFlag}`
+    );
+  }
+  return { targets: [envFlag], skippedDisabled: [] };
+}
+
+/**
+ * Overlay method-specific config onto process env for Docker/K8s providers.
+ * Secrets still come from real env vars; non-secret names/paths come from config.
+ *
+ * @param {Record<string, string|undefined>} env
+ * @param {Record<string, unknown>} settings
+ * @returns {Record<string, string|undefined>}
+ */
+export function mergeMethodSettingsIntoEnv(env, settings) {
+  /** @type {Record<string, string|undefined>} */
+  const out = { ...env };
+  if (settings.dockerImageName) out.DOCKER_IMAGE_NAME = String(settings.dockerImageName);
+  if (settings.dockerRegistryUrl) out.DOCKER_REGISTRY_URL = String(settings.dockerRegistryUrl);
+  if (settings.dockerHost) out.DOCKER_HOST = String(settings.dockerHost);
+  if (settings.kubeNamespace) out.KUBE_NAMESPACE = String(settings.kubeNamespace);
+  if (settings.kubeconfig) out.KUBECONFIG = String(settings.kubeconfig);
+  if (settings.kubeContext) out.KUBE_CONTEXT = String(settings.kubeContext);
+  return out;
+}
+
+export default {
+  ENV_NAME_MAX_LENGTH,
+  RESERVED_ENVIRONMENT_NAMES,
+  ENV_NAME_PATTERN,
+  validateEnvironmentName,
+  createEnvNamePromptValidate,
+  isNewEnvironmentShape,
+  getEnvMethod,
+  getEnvSettings,
+  isEnvEnabled,
+  getEnvTrigger,
+  resolveDefaultEnvironmentName,
+  getEnabledEnvironmentNames,
+  buildEnvironmentEntry,
+  resolveEnvTargets,
+  mergeMethodSettingsIntoEnv,
+};

package/src/core/stages.js

@@ -4,10 +4,45 @@ import { createArtifact, repackArtifactZip } from '../artifact/engine.js';
 import { uploadToAll } from '../storage/index.js';
 import { deployToAll } from '../deployment/index.js';
 import { sendNotifications } from '../notifications/index.js';
-import axios from 'axios';
+import {
+  anyEnvHasResolvableHealthCheckUrl,
+  runHealthChecksForEnvs,
+} from '../utils/health-check.js';
 import { getProjectVersion } from '../utils/version.js';
 import { resolveBuildId } from '../utils/build-id.js';
 import { ensureDeployScaffold } from '../utils/scaffold.js';
+import {
+  getEnabledEnvironmentNames,
+  resolveDefaultEnvironmentName,
+  isEnvEnabled,
+  getEnvTrigger,
+} from './environments.js';
+
+/**
+ * Environments to deploy during `deployhub build` (pipeline.deploy).
+ * - Local: default environment only (promote elsewhere via `deploy --env`).
+ * - GitHub Actions push: every enabled env with trigger "push".
+ * - workflow_dispatch: none here (explicit deploy step handles --env).
+ *
+ * @param {import('./config.js').DeployHubConfig} config
+ * @param {Record<string, string|undefined>} [env]
+ * @returns {string[]}
+ */
+function pipelineDeployTargets(config, env = process.env) {
+  if (env.GITHUB_EVENT_NAME === 'workflow_dispatch') {
+    return [];
+  }
+  if (env.GITHUB_ACTIONS === 'true' || env.GITHUB_ACTIONS === '1') {
+    return Object.entries(config.environments || {})
+      .filter(([, entry]) => isEnvEnabled(entry) && getEnvTrigger(entry) === 'push')
+      .map(([name]) => name);
+  }
+  const def = resolveDefaultEnvironmentName(config);
+  if (def && getEnabledEnvironmentNames(config).includes(def)) {
+    return [def];
+  }
+  return getEnabledEnvironmentNames(config).slice(0, 1);
+}
 
 /**
  * @param {import('../core/config.js').DeployHubConfig} config
@@ -143,7 +178,8 @@ export function buildPipelineStages(config, cwd, state) {
       name: 'storage',
       enabled: (ctx) => {
         const willDeploy =
-          ctx.config.pipeline.deploy === true && (ctx.config.deploy?.length || 0) > 0;
+          ctx.config.pipeline.deploy === true &&
+          getEnabledEnvironmentNames(ctx.config).length > 0;
         if (willDeploy && (!ctx.config.storage || ctx.config.storage.length === 0)) {
           ctx.config.storage = ['local'];
         }
@@ -159,7 +195,8 @@ export function buildPipelineStages(config, cwd, state) {
     {
       name: 'deploy',
       enabled: (ctx) =>
-        ctx.config.pipeline.deploy === true && (ctx.config.deploy?.length || 0) > 0,
+        ctx.config.pipeline.deploy === true &&
+        getEnabledEnvironmentNames(ctx.config).length > 0,
       async run(ctx) {
         if (!ctx.state.storageCompleted) {
           throw new Error(
@@ -168,7 +205,8 @@ export function buildPipelineStages(config, cwd, state) {
         }
         const artifactDir = /** @type {string} */ (ctx.state.artifactDir);
         if (!artifactDir) throw new Error('No artifact to deploy');
-        const deployed = await deployToAll(ctx.config, artifactDir);
+        const targets = pipelineDeployTargets(ctx.config);
+        const deployed = await deployToAll(ctx.config, artifactDir, targets);
         ctx.state.deployedTargets = deployed;
 
         await repackArtifactZip(artifactDir);
@@ -180,23 +218,21 @@ export function buildPipelineStages(config, cwd, state) {
     },
     {
       name: 'verify',
-      enabled: (ctx) =>
-        ctx.config.pipeline.verify === true && !!ctx.config.healthCheck?.url,
+      enabled: (ctx) => {
+        if (ctx.config.pipeline.verify !== true) return false;
+        const deployed = /** @type {string[]} */ (ctx.state.deployedTargets || []);
+        return anyEnvHasResolvableHealthCheckUrl(ctx.config, deployed);
+      },
       async run(ctx) {
-        const url = ctx.config.healthCheck.url;
-        const timeout = (ctx.config.healthCheck.timeout || 30) * 1000;
-        const start = Date.now();
-        const response = await axios.get(url, {
-          timeout,
-          validateStatus: () => true,
-        });
-        const elapsed = Date.now() - start;
-        if (response.status < 200 || response.status >= 400) {
-          throw new Error(
-            `Health check failed: HTTP ${response.status} (${elapsed}ms)`
-          );
+        const deployed = /** @type {string[]} */ (ctx.state.deployedTargets || []);
+        const { results, failures } = await runHealthChecksForEnvs(ctx.config, deployed);
+        if (failures.length > 0) {
+          throw new Error(failures[0].error);
+        }
+        const last = results[results.length - 1];
+        if (last) {
+          ctx.state.healthCheck = { status: last.status, elapsed: last.elapsed };
         }
-        ctx.state.healthCheck = { status: response.status, elapsed };
       },
     },
     {

package/src/deployment/deployment-env.js

@@ -504,6 +504,216 @@ export function getDeploymentSecretChecklistItems(deployType, config = null) {
   return Array.from(byKey.values());
 }
 
+/**
+ * Uppercase env name for secret prefixes (e.g. production → PRODUCTION).
+ * @param {string} envName
+ * @returns {string}
+ */
+export function envSecretPrefix(envName) {
+  return (
+    String(envName || 'default')
+      .toUpperCase()
+      .replace(/[^A-Z0-9]+/g, '_')
+      .replace(/^_+|_+$/g, '') || 'DEFAULT'
+  );
+}
+
+/**
+ * Trade-off (superseded for per-env grandfathering): true when 2+ environments exist.
+ * Prefer envUsesPrefixedSecrets(envName, config) so the original env stays unprefixed.
+ *
+ * @param {Record<string, unknown>} [environments]
+ * @returns {boolean}
+ */
+export function shouldPrefixEnvSecrets(environments) {
+  return Object.keys(environments || {}).length > 1;
+}
+
+/**
+ * Which environment keeps reading unprefixed secrets (SSH_HOST, not ENV_SSH_HOST).
+ * Once established, this must not silently change when more environments are added.
+ *
+ * @param {Record<string, unknown>} config
+ * @returns {string|null}
+ */
+export function resolveUnprefixedSecretEnvironment(config) {
+  const envs = /** @type {Record<string, unknown>} */ (config.environments || {});
+  const named = config.unprefixedSecretEnvironment;
+  if (typeof named === 'string' && envs[named]) return named;
+
+  const names = Object.keys(envs);
+  if (names.length === 1) return names[0];
+  if (typeof config.defaultEnvironment === 'string' && envs[config.defaultEnvironment]) {
+    return config.defaultEnvironment;
+  }
+  return names[0] || null;
+}
+
+/**
+ * Whether this environment's CI secrets use ENVNAME_KEY prefixes.
+ * - 0–1 environments: never prefixed (BC).
+ * - 2+ environments: every env EXCEPT the grandfathered unprefixedSecretEnvironment is prefixed.
+ *
+ * @param {string} envName
+ * @param {Record<string, unknown>} config
+ * @returns {boolean}
+ */
+export function envUsesPrefixedSecrets(envName, config) {
+  const envs = config.environments || {};
+  if (Object.keys(envs).length <= 1) return false;
+  const unprefixed = resolveUnprefixedSecretEnvironment(config);
+  return envName !== unprefixed;
+}
+
+/**
+ * @param {string} envName
+ * @param {string} key
+ * @returns {string}
+ */
+export function prefixSecretKey(envName, key) {
+  return `${envSecretPrefix(envName)}_${key}`;
+}
+
+/**
+ * Overlay prefixed CI secrets (e.g. STAGING_SSH_HOST) onto the unprefixed names
+ * providers already read (SSH_HOST). Used when a workflow job carries secrets for
+ * multiple environments — static YAML can only map one value per unprefixed key.
+ *
+ * For prefixed environments, ambient unprefixed leftovers (e.g. a developer's
+ * shell SSH_HOST from another project) are cleared unless a matching prefixed
+ * secret is present — config settings (host, dockerImageName, …) still win via
+ * provider resolution / mergeMethodSettingsIntoEnv.
+ *
+ * @param {string} envName
+ * @param {Record<string, unknown>} config
+ * @param {Record<string, string|undefined>} [env]
+ * @returns {Record<string, string|undefined>}
+ */
+export function applyEnvSecretOverlay(envName, config, env = process.env) {
+  /** @type {Record<string, string|undefined>} */
+  const out = { ...env };
+  if (!envUsesPrefixedSecrets(envName, config)) {
+    return out;
+  }
+
+  const entry = /** @type {Record<string, unknown>|undefined} */ (
+    (config.environments || {})[envName]
+  );
+  const method =
+    (entry && typeof entry.method === 'string' && entry.method) ||
+    (entry && typeof entry.type === 'string' && entry.type) ||
+    null;
+  if (!method) return out;
+
+  const keys = getDeploymentWorkflowSecretKeys(method, /** @type {any} */ (config));
+  for (const key of keys) {
+    const prefixed = prefixSecretKey(envName, key);
+    if (out[prefixed]) {
+      out[key] = out[prefixed];
+    } else {
+      // Prefixed envs must NOT silently inherit ambient unprefixed leftovers
+      // (e.g. shell SSH_HOST from another project). Config settings still win
+      // via settings.host || env.SSH_HOST in providers.
+      delete out[key];
+    }
+  }
+  return out;
+}
+
+/**
+ * Workflow secret names for one environment (prefixed only when that env requires it).
+ * @param {string} envName
+ * @param {string} deployType
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @param {Record<string, unknown>} [environments]
+ * @returns {string[]}
+ */
+export function getDeploymentWorkflowSecretKeysForEnv(
+  envName,
+  deployType,
+  config = null,
+  environments = null
+) {
+  const keys = getDeploymentWorkflowSecretKeys(deployType, config);
+  const cfg = {
+    ...(config || {}),
+    environments: environments || config?.environments || {},
+  };
+  if (!envUsesPrefixedSecrets(envName, cfg)) {
+    return keys;
+  }
+  return keys.map((k) => prefixSecretKey(envName, k));
+}
+
+/**
+ * Checklist items for one environment (prefixed keys when that env requires it).
+ * @param {string} envName
+ * @param {string} deployType
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @param {Record<string, unknown>} [environments]
+ * @returns {SecretChecklistItem[]}
+ */
+export function getDeploymentSecretChecklistItemsForEnv(
+  envName,
+  deployType,
+  config = null,
+  environments = null
+) {
+  const items = getDeploymentSecretChecklistItems(deployType, config);
+  const cfg = {
+    ...(config || {}),
+    environments: environments || config?.environments || {},
+  };
+  if (!envUsesPrefixedSecrets(envName, cfg)) {
+    return items;
+  }
+  return items.map((item) => ({
+    ...item,
+    key: prefixSecretKey(envName, item.key),
+    note: item.note
+      ? `${item.note} (env: ${envName})`
+      : `Secret for environment "${envName}"`,
+  }));
+}
+
+/**
+ * Required doctor/CI secret keys for one environment.
+ * @param {string} envName
+ * @param {string} deployType
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @param {Record<string, unknown>} [environments]
+ * @returns {string[]}
+ */
+export function getDeploymentSecretKeysForEnv(
+  envName,
+  deployType,
+  config = null,
+  environments = null
+) {
+  const keys = getDeploymentSecretKeys(deployType, config);
+  const cfg = {
+    ...(config || {}),
+    environments: environments || config?.environments || {},
+  };
+  if (!envUsesPrefixedSecrets(envName, cfg)) {
+    return keys;
+  }
+  return keys.map((k) => prefixSecretKey(envName, k));
+}
+
+/**
+ * Unprefixed process-env key ↔ GitHub secret name for one env.
+ * @param {string} envName
+ * @param {string} unprefixedKey
+ * @param {Record<string, unknown>} config
+ * @returns {string} secret name to look up in GitHub / doctor
+ */
+export function resolveSecretNameForEnv(envName, unprefixedKey, config) {
+  return envUsesPrefixedSecrets(envName, config)
+    ? prefixSecretKey(envName, unprefixedKey)
+    : unprefixedKey;
+}
+
 /**
  * Format a checklist item for console output.
  * @param {SecretChecklistItem} item