@akash-chowdhury-24/deployhub 2.0.15 → 2.0.17

package/src/utils/github-actions.js

@@ -1,12 +1,20 @@
 import fs from 'fs-extra';
 import path from 'path';
+import yaml from 'js-yaml';
+import { fileURLToPath } from 'url';
 import { getWorkflowHeaderComment } from './author.js';
 import {
   generateDeploymentEnvSection,
   getDeploymentWorkflowSecretKeys,
   getDeploymentSecretChecklistItems,
+  getDeploymentWorkflowSecretKeysForEnv,
+  getDeploymentSecretChecklistItemsForEnv,
+  shouldPrefixEnvSecrets,
+  prefixSecretKey,
+  envUsesPrefixedSecrets,
   DEPLOYMENT_ENV_KEYS,
 } from '../deployment/deployment-env.js';
+import { getEnvMethod, getEnvTrigger, isEnvEnabled } from '../core/environments.js';
 
 /** @typedef {'aws'|'azure'|'gcp'|'gdrive'|'dropbox'|'local'|'ftp'|'ssh'} ProviderEnvKey */
 
@@ -128,6 +136,34 @@ export function getCliInstallSpec(cliSource) {
   return normalized;
 }
 
+/**
+ * Version/range suitable as a package.json dependency VALUE for this CLI
+ * (key is already NPM_PACKAGE — do not embed the package name again).
+ *
+ * @param {string} [cliSource]
+ * @returns {string}
+ */
+export function getCliPackageJsonDependencyVersion(cliSource) {
+  const normalized = normalizeCliSource(cliSource);
+  if (normalized === DEFAULT_NPM_CLI_SOURCE) {
+    try {
+      const pkgPath = path.join(
+        path.dirname(fileURLToPath(import.meta.url)),
+        '../../package.json'
+      );
+      const pkg = fs.readJsonSync(pkgPath);
+      if (typeof pkg.version === 'string' && pkg.version.trim()) {
+        return `^${pkg.version.trim()}`;
+      }
+    } catch {
+      // fall through
+    }
+    return 'latest';
+  }
+  // github: / file: specs are valid package.json dependency values as-is
+  return getCliInstallSpec(cliSource);
+}
+
 /**
  * Shell command to run deployhub build from the installed scoped package.
  * Uses node directly so it works reliably when installed from a private GitHub repo.
@@ -217,7 +253,9 @@ const KUBECTL_VERSION = 'v1.30.4';
  * @returns {boolean}
  */
 function hasKubernetesDeploy(deployEnvironments, environments) {
-  return deployEnvironments.some((envName) => environments[envName]?.type === 'kubernetes');
+  return deployEnvironments.some(
+    (envName) => getEnvMethod(environments[envName]) === 'kubernetes'
+  );
 }
 
 /**
@@ -262,13 +300,55 @@ function applyKubernetesWorkflowEnv(deployEnvironments, environments, envVars) {
 export const DEPLOY_WORKFLOW_FILENAME = 'deployhub.yml';
 export const ROLLBACK_WORKFLOW_FILENAME = 'deployhub-rollback.yml';
 
+/**
+ * Upsert a `KEY: value` line into the workflow env set (LHS must be unique for valid YAML).
+ * @param {Set<string>} envVars
+ * @param {string} lhs
+ * @param {string} valueExpr
+ */
+function upsertWorkflowEnvLine(envVars, lhs, valueExpr) {
+  const linePrefix = `${lhs}: `;
+  for (const entry of [...envVars]) {
+    if (entry.startsWith(linePrefix)) {
+      envVars.delete(entry);
+    }
+  }
+  envVars.add(`${linePrefix}${valueExpr}`);
+}
+
+/**
+ * Enabled environment names from the live `environments` map (preferred over
+ * a possibly-stale `deploy[]` argument passed into workflow generators).
+ * @param {Record<string, { type?: string, method?: string }>} environments
+ * @returns {string[]}
+ */
+function listEnabledEnvironmentNames(environments) {
+  return Object.keys(environments || {}).filter((n) => isEnvEnabled(environments[n]));
+}
+
+/**
+ * Push-triggered enabled envs — same set `pipelineDeployTargets` deploys in GHA.
+ * @param {Record<string, { type?: string, method?: string }>} environments
+ * @returns {string[]}
+ */
+function listPushEnvironmentNames(environments) {
+  return listEnabledEnvironmentNames(environments).filter(
+    (n) => getEnvTrigger(environments[n]) === 'push'
+  );
+}
+
 /**
  * Shared env entries for deploy and rollback workflows (same secret resolution).
- * Uses getDeploymentWorkflowSecretKeys(env.type) — no separate rollback list.
+ * Multi-env: each environment contributes its own CI secret names (grandfathered
+ * unprefixed SSH_HOST, or PRODUCTION_SSH_HOST, etc.). Prefixed envs are NOT
+ * last-wins-mapped onto unprefixed keys — that would overwrite the grandfathered
+ * binding and leave production looking fine in YAML while development silently
+ * inherits the wrong credentials. `applyEnvSecretOverlay` remaps PREFIX_* →
+ * unprefixed names at deploy time for non-grandfathered targets.
  *
  * @param {string[]} storageProviders
- * @param {string[]} deployEnvironments
- * @param {Record<string, { type: string }>} environments
+ * @param {string[]} deployEnvironments — environments whose secrets to inject
+ * @param {Record<string, { type?: string, method?: string }>} environments
  * @param {import('../core/config.js').DeployHubConfig} [config]
  * @returns {Set<string>}
  */
@@ -279,22 +359,32 @@ export function buildWorkflowEnvEntries(
   config = null
 ) {
   /** @type {Set<string>} */
-  const envVars = new Set(['DEPLOYHUB_ENV: production']);
+  const envVars = new Set([
+    `DEPLOYHUB_ENV: ${deployEnvironments[0] || 'production'}`,
+  ]);
 
   for (const provider of storageProviders) {
     const keys = PROVIDER_ENV_MAP[provider] || [];
     for (const key of keys) {
-      envVars.add(`${key}: \${{ secrets.${key} }}`);
+      upsertWorkflowEnvLine(envVars, key, `\${{ secrets.${key} }}`);
     }
   }
 
+  const cfg = { ...(config || {}), environments };
+
   for (const envName of deployEnvironments) {
     const env = environments[envName];
     if (!env) continue;
 
-    const keys = getDeploymentWorkflowSecretKeys(env.type, config);
-    for (const key of keys) {
-      envVars.add(`${key}: \${{ secrets.${key} }}`);
+    const method = getEnvMethod(env);
+    if (!method) continue;
+    const unprefixedKeys = getDeploymentWorkflowSecretKeys(method, config);
+    for (const key of unprefixedKeys) {
+      const secretName = envUsesPrefixedSecrets(envName, cfg)
+        ? prefixSecretKey(envName, key)
+        : key;
+      // Bind process.env[secretName] for this environment (prefixed or grandfathered).
+      upsertWorkflowEnvLine(envVars, secretName, `\${{ secrets.${secretName} }}`);
     }
   }
 
@@ -302,6 +392,21 @@ export function buildWorkflowEnvEntries(
   return envVars;
 }
 
+/**
+ * Choice options for workflow_dispatch — enabled environments only, plus `all`.
+ * Disabled envs are omitted so selecting them cannot waste a CI run.
+ *
+ * @param {Record<string, unknown>} environments
+ * @returns {string}
+ */
+function formatEnvironmentChoiceOptions(environments) {
+  const names = Object.keys(environments || {}).filter((n) =>
+    isEnvEnabled(environments[n])
+  );
+  const options = [...names, 'all'];
+  return options.map((n) => `          - ${n}`).join('\n');
+}
+
 /**
  * @param {Set<string>} envVars
  * @param {string} [indent]
@@ -339,7 +444,7 @@ export function extractWorkflowSecretKeys(yaml) {
 /**
  * @param {string[]} storageProviders
  * @param {string[]} deployEnvironments
- * @param {Record<string, { type: string }>} environments
+ * @param {Record<string, { type?: string, method?: string }>} environments
  * @param {string} [cliSource]
  * @param {import('../core/config.js').DeployHubConfig} [config]
  * @returns {string}
@@ -351,13 +456,41 @@ export function generateWorkflowYaml(
   cliSource = DEFAULT_NPM_CLI_SOURCE,
   config = null
 ) {
-  const envVars = buildWorkflowEnvEntries(
+  const envNames = Object.keys(environments || {});
+  // Secret injection must follow live environments (same as pipelineDeployTargets),
+  // not a possibly-stale deploy[] argument — otherwise push-deployed envs missing
+  // from deploy[] get no secrets in the job env block.
+  const enabledEnvs = listEnabledEnvironmentNames(environments);
+  const pushEnvs = listPushEnvironmentNames(environments);
+  const allDeployNames =
+    enabledEnvs.length > 0
+      ? enabledEnvs
+      : deployEnvironments.length > 0
+        ? deployEnvironments
+        : envNames;
+
+  // Build step: union of secrets for every push-triggered env (build deploys all of them).
+  const buildSecretEnvs =
+    pushEnvs.length > 0 ? pushEnvs : allDeployNames.slice(0, 1);
+
+  // workflow_dispatch step: union for ALL enabled envs (dropdown can pick any / all).
+  const dispatchSecretEnvs = allDeployNames;
+
+  const buildEnvVars = buildWorkflowEnvEntries(
     storageProviders,
-    deployEnvironments,
+    buildSecretEnvs,
     environments,
     config
   );
-  const envBlock = formatWorkflowEnvBlock(envVars);
+  const buildEnvBlock = formatWorkflowEnvBlock(buildEnvVars);
+
+  const dispatchEnvVars = buildWorkflowEnvEntries(
+    storageProviders,
+    dispatchSecretEnvs,
+    environments,
+    config
+  );
+  const dispatchEnvBlock = formatWorkflowEnvBlock(dispatchEnvVars);
 
   const installSpec = getCliInstallSpec(cliSource);
   const backendSteps = getBackendSetupSteps(config);
@@ -365,7 +498,7 @@ export function generateWorkflowYaml(
   const githubGitConfigStep = isGithubCliSource(cliSource)
     ? `${getGithubGitConfigStep()}\n`
     : '';
-  const kubernetesSteps = hasKubernetesDeploy(deployEnvironments, environments)
+  const kubernetesSteps = hasKubernetesDeploy(allDeployNames, environments)
     ? `${getKubernetesSetupSteps()}\n`
     : '';
 
@@ -375,11 +508,41 @@ export function generateWorkflowYaml(
       ? getInstallDepsCommand(config)
       : 'npm install';
 
+  const envChoiceOptions = formatEnvironmentChoiceOptions(environments);
+  const hasEnvs = envNames.length > 0;
+  const dispatchInputs = hasEnvs
+    ? `  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Environment to deploy (leave blank on push; use "all" for every enabled env)'
+        required: false
+        type: choice
+        options:
+${envChoiceOptions}
+`
+    : `  workflow_dispatch:
+`;
+
+  const manualDeployStep = hasEnvs
+    ? `      - name: Deploy (workflow_dispatch)
+        if: github.event_name == 'workflow_dispatch'
+        env:
+${dispatchEnvBlock}
+        run: |
+          ENV_INPUT="\${{ inputs.environment }}"
+          if [ -z "$ENV_INPUT" ] || [ "$ENV_INPUT" = "all" ]; then
+            ${getCliDeployCommand()} --env all
+          else
+            ${getCliDeployCommand()} --env "$ENV_INPUT"
+          fi
+`
+    : '';
+
   const workflow = `${getWorkflowHeaderComment()}name: DeployHub
 on:
   push:
     branches: [main]
-jobs:
+${dispatchInputs}jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
@@ -391,20 +554,29 @@ ${kubernetesSteps}${githubGitConfigStep}      - name: Install project dependenci
         run: ${installDepsCommand}
       - name: Install DeployHub CLI
         run: npm install ${installSpec} --no-save
-      - run: ${getCliBuildCommand()}
+      - name: Build (and auto-deploy push-triggered envs)
+        run: ${getCliBuildCommand()}
         env:
-${envBlock}
-`;
+${buildEnvBlock}
+${manualDeployStep}`;
 
   return workflow;
 }
 
+/**
+ * Shell command to run deployhub deploy from the installed scoped package.
+ * @returns {string}
+ */
+export function getCliDeployCommand() {
+  return `node ./node_modules/${NPM_PACKAGE}/src/cli/index.js deploy`;
+}
+
 /**
  * Manual rollback via Actions tab / gh workflow run (workflow_dispatch only).
  *
  * @param {string[]} storageProviders
  * @param {string[]} deployEnvironments
- * @param {Record<string, { type: string }>} environments
+ * @param {Record<string, { type?: string, method?: string }>} environments
  * @param {string} [cliSource]
  * @param {import('../core/config.js').DeployHubConfig} [config]
  * @returns {string}
@@ -416,9 +588,18 @@ export function generateRollbackWorkflowYaml(
   cliSource = DEFAULT_NPM_CLI_SOURCE,
   config = null
 ) {
+  const envNames = Object.keys(environments || {});
+  const enabledEnvs = listEnabledEnvironmentNames(environments);
+  const allDeployNames =
+    enabledEnvs.length > 0
+      ? enabledEnvs
+      : deployEnvironments.length > 0
+        ? deployEnvironments
+        : envNames.filter((n) => isEnvEnabled(environments[n]));
+
   const envVars = buildWorkflowEnvEntries(
     storageProviders,
-    deployEnvironments,
+    allDeployNames,
     environments,
     config
   );
@@ -428,11 +609,43 @@ export function generateRollbackWorkflowYaml(
   const githubGitConfigStep = isGithubCliSource(cliSource)
     ? `${getGithubGitConfigStep()}\n`
     : '';
-  const kubernetesSteps = hasKubernetesDeploy(deployEnvironments, environments)
+  const kubernetesSteps = hasKubernetesDeploy(allDeployNames, environments)
     ? `${getKubernetesSetupSteps()}\n`
     : '';
 
   const rollbackCmd = getCliRollbackCommand();
+  const envChoiceOptions = formatEnvironmentChoiceOptions(environments);
+  const hasEnvs = envNames.length > 0;
+
+  const environmentInput = hasEnvs
+    ? `      environment:
+        description: 'Environment to roll back (or "all")'
+        required: false
+        type: choice
+        options:
+${envChoiceOptions}
+`
+    : '';
+
+  const rollbackRun = hasEnvs
+    ? `          ENV_INPUT="\${{ inputs.environment }}"
+          BUILD_INPUT="\${{ inputs.buildId }}"
+          ENV_FLAG=""
+          if [ -z "$ENV_INPUT" ] || [ "$ENV_INPUT" = "all" ]; then
+            ENV_FLAG="--env all"
+          else
+            ENV_FLAG="--env $ENV_INPUT"
+          fi
+          if [ -n "$BUILD_INPUT" ]; then
+            ${rollbackCmd} "$BUILD_INPUT" $ENV_FLAG
+          else
+            ${rollbackCmd} $ENV_FLAG
+          fi`
+    : `          if [ -n "\${{ inputs.buildId }}" ]; then
+            ${rollbackCmd} "\${{ inputs.buildId }}"
+          else
+            ${rollbackCmd}
+          fi`;
 
   return `${getWorkflowHeaderComment()}name: DeployHub Rollback
 on:
@@ -442,7 +655,7 @@ on:
         description: 'Exact buildId to restore (leave blank = previous build)'
         required: false
         type: string
-jobs:
+${environmentInput}jobs:
   rollback:
     runs-on: ubuntu-latest
     steps:
@@ -456,11 +669,7 @@ ${kubernetesSteps}${githubGitConfigStep}      - name: Install DeployHub CLI
         env:
 ${envBlock}
         run: |
-          if [ -n "\${{ inputs.buildId }}" ]; then
-            ${rollbackCmd} "\${{ inputs.buildId }}"
-          else
-            ${rollbackCmd}
-          fi
+${rollbackRun}
 `;
 }
 
@@ -567,6 +776,169 @@ export async function getRollbackWorkflowDoctorCheck(cwd, config) {
   };
 }
 
+/**
+ * Expected CI secret names for the current config — same set a fresh
+ * `sync-workflows` would reference (via buildWorkflowEnvEntries).
+ *
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {'deploy'|'rollback'} [kind]
+ * @returns {Set<string>}
+ */
+export function expectedWorkflowSecretKeysFromConfig(config, kind = 'rollback') {
+  const environments = config.environments || {};
+  const allNames = Object.keys(environments);
+  /** @type {string[]} */
+  let targets;
+  if (kind === 'deploy') {
+    const pushEnvs = listPushEnvironmentNames(environments);
+    const enabled = listEnabledEnvironmentNames(environments);
+    // Deploy workflow Build step uses push envs; doctor also flags dispatch-needed
+    // secrets by using the broader enabled set via kind === 'rollback' / checklist.
+    targets = pushEnvs.length > 0 ? pushEnvs : enabled.slice(0, 1);
+  } else {
+    targets = allNames.length > 0 ? listEnabledEnvironmentNames(environments) : allNames;
+    if (targets.length === 0) targets = allNames;
+  }
+
+  const entries = buildWorkflowEnvEntries(
+    config.storage || [],
+    targets,
+    environments,
+    config
+  );
+
+  /** @type {Set<string>} */
+  const keys = new Set();
+  const re = /secrets\.([A-Z0-9_]+)/g;
+  for (const line of entries) {
+    let match;
+    re.lastIndex = 0;
+    while ((match = re.exec(line)) !== null) {
+      keys.add(match[1]);
+    }
+  }
+  return keys;
+}
+
+/**
+ * Lightweight drift check: checked-in workflow vs current config.
+ * Catches missing dispatch env options and missing required secret references.
+ *
+ * @param {string} yamlText
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string} [filename]
+ * @returns {{ drifted: boolean, missingEnvs: string[], missingSecrets: string[], summary: string }}
+ */
+export function detectWorkflowConfigDrift(yamlText, config, filename = DEPLOY_WORKFLOW_FILENAME) {
+  /** @type {string[]} */
+  const missingEnvs = [];
+  /** @type {string[]} */
+  const missingSecrets = [];
+
+  let parsed;
+  try {
+    parsed = yaml.load(yamlText);
+  } catch {
+    return {
+      drifted: false,
+      missingEnvs,
+      missingSecrets,
+      summary: '',
+    };
+  }
+
+  if (!parsed || typeof parsed !== 'object') {
+    return { drifted: false, missingEnvs, missingSecrets, summary: '' };
+  }
+
+  const envNames = listEnabledEnvironmentNames(config.environments || {});
+  const root = /** @type {Record<string, any>} */ (parsed);
+  const options = root?.on?.workflow_dispatch?.inputs?.environment?.options;
+
+  if (Array.isArray(options) && envNames.length > 0) {
+    const optionSet = new Set(options.map(String));
+    for (const name of envNames) {
+      if (!optionSet.has(name)) missingEnvs.push(name);
+    }
+  } else if (envNames.length > 1) {
+    // Multi-env config but no dispatch dropdown — stale single-env workflow.
+    missingEnvs.push(...envNames);
+  }
+
+  const kind = filename.includes('rollback') ? 'rollback' : 'deploy';
+  const fileSecrets = new Set(extractWorkflowSecretKeys(yamlText));
+  const expected = expectedWorkflowSecretKeysFromConfig(config, kind);
+  for (const key of expected) {
+    if (!fileSecrets.has(key)) missingSecrets.push(key);
+  }
+
+  const drifted = missingEnvs.length > 0 || missingSecrets.length > 0;
+  /** @type {string[]} */
+  const parts = [];
+  if (missingEnvs.length > 0) {
+    parts.push(
+      `missing: ${missingEnvs.map((n) => `"${n}"`).join(', ')} in the dispatch dropdown`
+    );
+  }
+  if (missingSecrets.length > 0) {
+    const shown = missingSecrets.slice(0, 4);
+    parts.push(
+      `missing secret(s): ${shown.join(', ')}${missingSecrets.length > 4 ? ', …' : ''}`
+    );
+  }
+
+  return {
+    drifted,
+    missingEnvs,
+    missingSecrets,
+    summary: parts.join('; '),
+  };
+}
+
+/**
+ * Doctor helper: informational checks when checked-in workflows drift from config.
+ * Skips missing/unparseable files (other checks cover "file missing").
+ * Returns an empty array when everything is in sync or not applicable.
+ *
+ * @param {string} cwd
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @returns {Promise<{ name: string, pass: boolean, message: string }[]>}
+ */
+export async function getWorkflowDriftDoctorChecks(cwd, config) {
+  const envCount = Object.keys(config.environments || {}).length;
+  if (envCount === 0) return [];
+
+  /** @type {{ name: string, pass: boolean, message: string }[]} */
+  const checks = [];
+  const files = [DEPLOY_WORKFLOW_FILENAME, ROLLBACK_WORKFLOW_FILENAME];
+
+  for (const filename of files) {
+    const filePath = path.join(cwd, '.github', 'workflows', filename);
+    if (!(await fs.pathExists(filePath))) continue;
+
+    let text;
+    try {
+      text = await fs.readFile(filePath, 'utf8');
+    } catch {
+      continue;
+    }
+
+    const drift = detectWorkflowConfigDrift(text, config, filename);
+    if (!drift.drifted) continue;
+
+    checks.push({
+      name: `Workflow sync (${filename})`,
+      // Informational nudge — same pattern as missing rollback workflow (pass: true).
+      pass: true,
+      message:
+        `.github/workflows/${filename} looks out of date with your current environments config ` +
+        `(${drift.summary}). Run: deployhub sync-workflows`,
+    });
+  }
+
+  return checks;
+}
+
 /**
  * @param {string} cliSource
  * @param {string} [cwd]
@@ -577,7 +949,9 @@ export async function addDeployhubToPackageJson(cliSource, cwd = process.cwd())
 
   const pkg = await fs.readJson(pkgPath);
   pkg.devDependencies = pkg.devDependencies || {};
-  pkg.devDependencies[NPM_PACKAGE] = getCliInstallSpec(cliSource);
+  // package.json value must be a semver range / "latest" / git URL — never "name@version"
+  // (that form is only for `npm install <spec>` via getCliInstallSpec).
+  pkg.devDependencies[NPM_PACKAGE] = getCliPackageJsonDependencyVersion(cliSource);
   delete pkg.devDependencies.deployhub;
   pkg.scripts = pkg.scripts || {};
   pkg.scripts['deployhub:build'] = 'deployhub build';
@@ -669,9 +1043,15 @@ export function getGithubSecretsChecklist(
 
   for (const envName of deployEnvironments) {
     const env = environments[envName];
-    if (!env?.type) continue;
-
-    for (const item of getDeploymentSecretChecklistItems(env.type, config)) {
+    const method = getEnvMethod(env);
+    if (!method) continue;
+
+    for (const item of getDeploymentSecretChecklistItemsForEnv(
+      envName,
+      method,
+      config,
+      environments
+    )) {
       const existing = byKey.get(item.key);
       if (existing) {
         if (item.required && !existing.required) {
@@ -741,9 +1121,10 @@ export function generateEnvExampleContent(
 
   for (const envName of deployEnvironments) {
     const env = environments[envName];
-    if (!env?.type) continue;
+    const method = getEnvMethod(env);
+    if (!method) continue;
 
-    const deploySection = generateDeploymentEnvSection(env.type, config, environments);
+    const deploySection = generateDeploymentEnvSection(method, config, environments);
     if (deploySection) {
       sections.push(`${deploySection}\n`);
     }