@bensandee/tooling 0.52.3 → 0.53.1

package/README.md

@@ -153,6 +153,26 @@ To override defaults, add a `docker` entry to `.tooling.json`:
 
 The `context` field defaults to `"."` (project root) when omitted. Versions for tagging are read from each package's own `package.json`.
 
+#### Per-package build args
+
+Each `docker` entry may declare `buildArgs` — a map of `ARG_NAME` to value that is passed to that package's `docker build` as `--build-arg ARG_NAME=<value>`. Args flow to the configured package only, so they don't trigger "unused build arg" warnings on sibling images. They apply to both `docker:build` and `docker:publish`, so CI-published images match local builds.
+
+```json
+{
+  "docker": {
+    "frontend": {
+      "dockerfile": "packages/frontend/docker/Dockerfile",
+      "context": ".",
+      "buildArgs": {
+        "VITE_BASE_PATH": "${BASE_PATH:-/}"
+      }
+    }
+  }
+}
+```
+
+Values support `${VAR}` and `${VAR:-default}` expansion against `process.env`. Empty strings are treated as unset (POSIX `:-` semantics). Unset variables with no default expand to `""` and log a warning. When the CLI also receives `--build-arg` via `--` pass-through, the CLI value comes after the configured value and wins on duplicate `ARG_NAME`.
+
 #### `docker:build`
 
 Builds all discovered packages, or a single package with `--package`:

package/dist/bin.mjs

@@ -624,7 +624,8 @@ const ToolingConfigSchema = z.strictObject({
 	detectPackageTypes: z.boolean().optional().meta({ description: "Auto-detect project types for monorepo packages" }),
 	docker: z.record(z.string(), z.object({
 		dockerfile: z.string().meta({ description: "Path to Dockerfile relative to package" }),
-		context: z.string().default(".").meta({ description: "Docker build context relative to package" })
+		context: z.string().default(".").meta({ description: "Docker build context relative to package" }),
+		buildArgs: z.record(z.string(), z.string()).optional().meta({ description: "Build args passed to `docker build` for this package. Values support ${VAR} and ${VAR:-default} expansion against process.env." })
 	})).optional().meta({ description: "Docker package overrides (package name → config)" }),
 	dockerCheck: z.union([z.literal(false), DockerCheckConfigSchema]).optional().meta({ description: "Docker health check configuration or false to disable" }),
 	registryHost: z.string().optional().meta({ description: "Docker registry hostname (e.g. ghcr.io, code.example.com)" }),
@@ -715,7 +716,8 @@ function mergeWithSavedConfig(detected, saved) {
 //#region src/release/docker.ts
 const ToolingDockerMapSchema = z.record(z.string(), z.object({
 	dockerfile: z.string(),
-	context: z.string().default(".")
+	context: z.string().default("."),
+	buildArgs: z.record(z.string(), z.string()).optional()
 }));
 const ToolingConfigDockerSchema = z.object({ docker: ToolingDockerMapSchema.optional() });
 const PackageInfoSchema = z.object({
@@ -877,16 +879,53 @@ function readRepoName(executor, cwd) {
 	if (!repoName) throw new FatalError("Root package.json must have a name field");
 	return repoName;
 }
+const INTERPOLATE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+/**
+* Expand `${VAR}` and `${VAR:-default}` in `value` against `env`. Unset (or empty)
+* variables with no default produce `""` and invoke `onMissing(name)` once per occurrence.
+* Literal `$` not followed by `{…}` passes through unchanged. POSIX `:-` semantics:
+* empty string is treated the same as unset.
+*/
+function interpolate(value, env, onMissing) {
+	return value.replace(INTERPOLATE_RE, (_, name, defaultValue) => {
+		const v = env[name];
+		if (v !== void 0 && v !== "") return v;
+		if (defaultValue !== void 0) return defaultValue;
+		onMissing?.(name);
+		return "";
+	});
+}
+/**
+* Translate a package's configured buildArgs map into `--build-arg K=V` flags,
+* expanding env-var references in values. Warns once per unset variable per build.
+*/
+function resolveBuildArgs(pkg, env) {
+	const entries = Object.entries(pkg.docker.buildArgs ?? {});
+	if (entries.length === 0) return [];
+	const warned = /* @__PURE__ */ new Set();
+	const flags = [];
+	for (const [k, rawValue] of entries) {
+		const resolved = interpolate(rawValue, env, (missing) => {
+			if (warned.has(missing)) return;
+			warned.add(missing);
+			log.warn(`docker build arg "${k}" for ${pkg.dir}: env var ${missing} is not set; using empty string`);
+		});
+		flags.push("--build-arg", `${k}=${resolved}`);
+	}
+	return flags;
+}
 /** Build a single docker image from its config. Paths are resolved relative to cwd. */
 function buildImage(executor, pkg, cwd, extraArgs) {
 	const dockerfilePath = path.resolve(cwd, pkg.docker.dockerfile);
 	const contextPath = path.resolve(cwd, pkg.docker.context);
+	const configuredArgs = resolveBuildArgs(pkg, process.env);
 	executor.execInherit("docker", [
 		"build",
 		"-f",
 		dockerfilePath,
 		"-t",
 		`${pkg.imageName}:latest`,
+		...configuredArgs,
 		...extraArgs,
 		contextPath
 	]);
@@ -1149,6 +1188,45 @@ function preserveDevBinaryPath(generated, existing) {
 	if (!match) return generated;
 	return generated.replaceAll("pnpm exec bst", match[0]).replaceAll("pnpm dlx @bensandee/tooling", match[0]);
 }
+function escapeRegex(value) {
+	return value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/** Match a `uses: <name>@<ref>` line, capturing indentation, action name, ref, and trailing comment. */
+const USES_LINE_PATTERN = /^(?<indent>\s*(?:-\s+)?uses:\s*)(?<name>[^\s@#]+)@(?<ref>\S+)(?<comment>[ \t]+#[^\n]*)?$/gm;
+/**
+* Extract a map of action-name → full verbatim tail (`<ref>` + optional inline comment)
+* from an existing workflow's `uses:` lines. Local actions (starting with `./` or
+* `docker://`) are skipped. First occurrence wins.
+*/
+function extractPinnedActions(existing) {
+	const map = /* @__PURE__ */ new Map();
+	for (const match of existing.matchAll(USES_LINE_PATTERN)) {
+		const { name, ref, comment } = match.groups ?? {};
+		if (!name || !ref) continue;
+		if (name.startsWith("./") || name.startsWith("docker://")) continue;
+		if (!map.has(name)) map.set(name, `${ref}${comment ?? ""}`);
+	}
+	return map;
+}
+/**
+* Preserve existing Renovate-managed action pins when rewriting a workflow.
+*
+* For each `uses: <name>@<ref>` in the existing file, if the generated file references the
+* same action name, substitute the existing ref (including any inline comment like `# v6`)
+* into the generated output. This keeps SHA pins and their version annotations stable when
+* unrelated workflow changes force a rewrite.
+*/
+function preservePinnedActions(generated, existing) {
+	if (!existing) return generated;
+	const pins = extractPinnedActions(existing);
+	if (pins.size === 0) return generated;
+	let result = generated;
+	for (const [name, tail] of pins) {
+		const pattern = new RegExp(String.raw`^(\s*(?:-\s+)?uses:\s*)${escapeRegex(name)}@\S+(?:[ \t]+#[^\n]*)?$`, "gm");
+		result = result.replace(pattern, `$1${name}@${tail}`);
+	}
+	return result;
+}
 /** Build a complete workflow YAML string from structured options. Single source of truth for workflow files. */
 function buildWorkflowYaml(options) {
 	const doc = { name: options.name };
@@ -1311,8 +1389,8 @@ async function generateDeployCi(ctx) {
 			description: "Publish workflow already up to date"
 		};
 	}
-	const withDevPath = preserveDevBinaryPath(content, existing);
-	const final = existing ? insertCustomBlocks(withDevPath, extractCustomBlocks(existing)) : withDevPath;
+	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
+	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
 	ctx.write(workflowPath, final);
 	return {
 		filePath: workflowPath,
@@ -1596,7 +1674,7 @@ async function generatePackageJson(ctx) {
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
 	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.10.2";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.52.3";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.53.1";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.12.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.30.0",
@@ -2388,8 +2466,8 @@ async function generateReleaseCi(ctx) {
 			description: "Release workflow already up to date"
 		};
 	}
-	const withDevPath = preserveDevBinaryPath(content, existing);
-	const final = existing ? insertCustomBlocks(withDevPath, extractCustomBlocks(existing)) : withDevPath;
+	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
+	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
 	ctx.write(workflowPath, final);
 	return {
 		filePath: workflowPath,
@@ -2518,8 +2596,8 @@ async function generateCi(ctx) {
 			description: "CI workflow already up to date"
 		};
 	}
-	const withDevPath = preserveDevBinaryPath(content, existing);
-	const final = existing ? insertCustomBlocks(withDevPath, extractCustomBlocks(existing)) : withDevPath;
+	const withPinnedActions = preservePinnedActions(preserveDevBinaryPath(content, existing), existing);
+	const final = existing ? insertCustomBlocks(withPinnedActions, extractCustomBlocks(existing)) : withPinnedActions;
 	ctx.write(filePath, final);
 	return {
 		filePath,
@@ -3372,7 +3450,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.52.3 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.53.1 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -6675,7 +6753,7 @@ async function sendWebhookWithLogging(url, secret, payload) {
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.52.3",
+		version: "0.53.1",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -6743,7 +6821,7 @@ const main = defineCommand({
 		})
 	}
 });
-console.log(`@bensandee/tooling v0.52.3`);
+console.log(`@bensandee/tooling v0.53.1`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.52.3",
+  "version": "0.53.1",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {

package/tooling.schema.json

@@ -74,6 +74,16 @@
             "default": ".",
             "description": "Docker build context relative to package",
             "type": "string"
+          },
+          "buildArgs": {
+            "description": "Build args passed to `docker build` for this package. Values support ${VAR} and ${VAR:-default} expansion against process.env.",
+            "type": "object",
+            "propertyNames": {
+              "type": "string"
+            },
+            "additionalProperties": {
+              "type": "string"
+            }
           }
         },
         "required": ["dockerfile", "context"],