@biffo/cli 0.198.3 → 0.198.5

package/_skeletons/sibling-template/apps/frontend/src/app/layout.tsx

@@ -1,9 +1,16 @@
 import type { Metadata } from 'next'
 import type { ReactNode } from 'react'
+import { SIBLING_TITLE } from '@/lib/branding'
 import './globals.css'
 
 export const metadata: Metadata = {
-  title: 'Sibling App',
+  // Derived from this sibling's own name at build time — see lib/branding.ts.
+  // `title.template` composes per-page titles for free: a page exporting
+  // `metadata = { title: 'Weekly' }` then renders "<Sibling> - Weekly".
+  title: {
+    default: SIBLING_TITLE,
+    template: `${SIBLING_TITLE} - %s`,
+  },
 }
 
 export default function RootLayout({ children }: { children: ReactNode }) {

package/_skeletons/sibling-template/apps/frontend/src/lib/branding.test.ts

@@ -0,0 +1,35 @@
+import { describe, expect, it } from 'vitest'
+
+import { formatSiblingTitle } from './branding'
+
+// Regression coverage for biffo-template#963: the skeleton's root layout used
+// to hard-code `metadata.title = 'Sibling App'`, so every sibling scaffolded
+// from it shipped that literal in its deployed <title>. The title is now
+// derived from NEXT_PUBLIC_SIBLING_NAME (the same build-time variable
+// `page.tsx` reads), and this is that derivation.
+describe('formatSiblingTitle', () => {
+  it('capitalises a single-word sibling name', () => {
+    expect(formatSiblingTitle('reports')).toBe('Reports')
+  })
+
+  it('splits hyphenated and underscored names into words', () => {
+    expect(formatSiblingTitle('field-ops')).toBe('Field Ops')
+    expect(formatSiblingTitle('tabsii_crm')).toBe('Tabsii Crm')
+    expect(formatSiblingTitle('a-b-c')).toBe('A B C')
+  })
+
+  it('leaves an already-capitalised name alone', () => {
+    expect(formatSiblingTitle('Reports')).toBe('Reports')
+  })
+
+  it('tolerates stray separators without emitting empty words', () => {
+    expect(formatSiblingTitle('--field--ops--')).toBe('Field Ops')
+  })
+
+  it('never returns the old hard-coded placeholder, even with no name set', () => {
+    for (const missing of [undefined, '', '   ', '---']) {
+      expect(formatSiblingTitle(missing)).toBe('Sibling')
+      expect(formatSiblingTitle(missing)).not.toBe('Sibling App')
+    }
+  })
+})

package/_skeletons/sibling-template/apps/frontend/src/lib/branding.ts

@@ -0,0 +1,51 @@
+/**
+ * Sibling branding (issue #963).
+ *
+ * The skeleton's root layout used to hard-code `metadata.title = 'Sibling App'`,
+ * and nothing at `biffo sibling create` time ever touched it — so every sibling
+ * ever scaffolded was born mislabeled in every browser tab, visibly in the
+ * deployed `out/index.html`, until a human noticed and fixed it by hand.
+ *
+ * Instead, derive it from the sibling's own name the same way `page.tsx`
+ * already does: the build-time `NEXT_PUBLIC_SIBLING_NAME`. That variable is
+ * already wired end to end — `biffo sibling create` writes the repo variable
+ * `PROJECT_NAME`, `.github/workflows/deploy.yml` passes it to the frontend
+ * build as `NEXT_PUBLIC_SIBLING_NAME`, and `apps/frontend/.env.example` is
+ * templated with the sibling's name at create time for local runs. The
+ * frontend builds with `output: 'export'`, so the value is baked into the
+ * static bundle; there is nothing to read at runtime.
+ *
+ * This mirrors `apps/portal/src/lib/branding.ts` upstream (issue #389), which
+ * solved the identical problem for the portal with a build-time env var rather
+ * than a scaffold-time source patch. Reading an env var beats regex-patching a
+ * `.tsx` file at create time: one mechanism, no fragile source rewrite, and it
+ * keeps working when the sibling is later renamed.
+ *
+ * The title is the sibling's OWN name only, never `<core project> - <sibling>`.
+ * The template is deliberately brand-agnostic and has no reliable way to know
+ * an instance's brand (as opposed to its `project.name`) at sibling-create
+ * time. A sibling that wants a brand prefix owns its own `layout.tsx` and can
+ * add one.
+ */
+
+/**
+ * Turn a project slug into something presentable in a browser tab:
+ * `reports` → `Reports`, `field-ops` → `Field Ops`, `tabsii_crm` → `Tabsii Crm`.
+ *
+ * Deliberately dumb and deterministic — it does not try to guess acronyms
+ * (`crm` → `CRM`), because guessing wrong is worse than being plain and a
+ * sibling that cares can override the title outright.
+ */
+export function formatSiblingTitle(rawName: string | undefined): string {
+  const words = (rawName ?? '')
+    .split(/[-_\s]+/)
+    .filter((word) => word.length > 0)
+    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
+
+  // Fallback for a frontend run with no env at all (a bare `pnpm dev` before
+  // `.env.example` is copied). Matches page.tsx's own fallback for the same
+  // variable, and is deliberately NOT the old 'Sibling App' literal.
+  return words.length > 0 ? words.join(' ') : 'Sibling'
+}
+
+export const SIBLING_TITLE = formatSiblingTitle(process.env['NEXT_PUBLIC_SIBLING_NAME'])

package/dist/index.js

@@ -1167,6 +1167,53 @@ function injectToken(repoUrl, token) {
 // src/adapters/source-control/github/index.ts
 import { execSync } from "child_process";
 import { Octokit } from "@octokit/rest";
+
+// src/lib/branch-protection-outcome.ts
+var pending = [];
+function recordBranchProtectionOutcome(outcome) {
+  pending.push(outcome);
+  return outcome;
+}
+function isUnprotected(outcome) {
+  return outcome.status !== "applied" || outcome.unprotectedBranches.length > 0;
+}
+function formatBranchProtectionSummary(outcomes) {
+  if (outcomes.length === 0) return [];
+  const unprotected = outcomes.filter(isUnprotected);
+  if (unprotected.length === 0) {
+    return [
+      `Branch protection applied to ${outcomes.map((o) => `${o.org}/${o.repo}`).sort().join(", ")}`
+    ];
+  }
+  const lines = [
+    `Branch protection was NOT fully applied \u2014 ${unprotected.length} of ${outcomes.length} repositor${outcomes.length === 1 ? "y" : "ies"} created by this run ${unprotected.length === 1 ? "is" : "are"} unprotected:`
+  ];
+  for (const outcome of unprotected) {
+    const left = outcome.unprotectedBranches.join(", ") || "unknown";
+    const why = outcome.status === "skipped-403" ? "GitHub returned 403 \u2014 the org's plan does not allow branch protection on this repo" : outcome.status === "failed" ? "branch protection failed" : "branch protection incomplete";
+    lines.push(`  ${outcome.org}/${outcome.repo} \u2014 unprotected: ${left} (${why})`);
+    if (outcome.reason) lines.push(`      ${outcome.reason}`);
+  }
+  lines.push(
+    "  Direct pushes, force-pushes and merges with red or missing checks are all allowed on those branches right now.",
+    "  Fix it with:  biffo check branch-protection --fix   (after upgrading the plan, or making the repo public)"
+  );
+  return lines;
+}
+function reportBranchProtectionSummary() {
+  const outcomes = pending.splice(0, pending.length);
+  const lines = formatBranchProtectionSummary(outcomes);
+  if (lines.length === 0) return outcomes;
+  if (outcomes.some(isUnprotected)) {
+    log.error(lines[0]);
+    for (const line of lines.slice(1)) log.error(line);
+  } else {
+    log.success(lines[0]);
+  }
+  return outcomes;
+}
+
+// src/adapters/source-control/github/index.ts
 var DEFAULT_STATUS_CHECKS = [
   "JS (lint, types, test, audit)",
   "Python (lint, types, test, security)",
@@ -1566,49 +1613,96 @@ var GitHubAdapter = class {
     await this.octokit.repos.update({ owner: org, repo, default_branch: branch });
     log.info(`Default branch set to ${branch}`);
   }
+  /**
+   * Protect `dev`, `staging` and `main`, and **say what actually happened**.
+   *
+   * This used to return `Promise<void>`, which made the 403 path (GitHub
+   * refusing branch protection on a private org repo whose plan does not
+   * include it) indistinguishable from success at every call site: the method
+   * logged two warnings and returned, and the scaffold went on to report a
+   * repo created. Nothing durable recorded that protection had been skipped,
+   * so the only trace was a log line in the middle of a long provisioning
+   * transcript. Three repos — including a live core platform — ran completely
+   * unprotected for three weeks on the strength of that (#715, #737 item 2).
+   *
+   * The returned outcome is also pushed onto the run-scoped collector in
+   * `lib/branch-protection-outcome.ts`, so callers that do nothing with the
+   * return value still get named in the end-of-run summary.
+   */
   async configureBranchProtection(config, protectionIntervalMs = 3e3, statusChecks = DEFAULT_STATUS_CHECKS) {
     const { org, repo } = config.source_control.config;
     const branches = ["dev", "staging", "main"];
-    for (const branch of branches) {
-      log.info(`Waiting for ${branch} branch to be ready...`);
-      await this.waitForBranch(org, repo, branch);
-      log.info(`Configuring branch protection on ${branch}...`);
-      const params = {
-        owner: org,
-        repo,
-        branch,
-        required_status_checks: { strict: true, contexts: statusChecks },
-        enforce_admins: false,
-        required_pull_request_reviews: {
-          required_approving_review_count: 0,
-          dismiss_stale_reviews: false
-        },
-        restrictions: null,
-        required_linear_history: true,
-        allow_force_pushes: false,
-        allow_deletions: false
-      };
-      const deadline = Date.now() + 3e4;
-      while (true) {
-        try {
-          await this.octokit.repos.updateBranchProtection(params);
-          break;
-        } catch (err) {
-          const status = err.status;
-          if (status === 403) {
-            log.warn(`Branch protection unavailable for ${org}/${repo}: ${err.message}`);
-            log.warn(
-              "  This usually means the organization is on a plan that only supports branch protection on public repos (GitHub Team/Enterprise is required for private org repos). Skipping branch protection \u2014 add it later via GitHub once the plan allows it, or make the repo public."
-            );
-            return;
+    const applied = [];
+    const remaining = () => branches.filter((b) => !applied.includes(b));
+    try {
+      for (const branch of branches) {
+        log.info(`Waiting for ${branch} branch to be ready...`);
+        await this.waitForBranch(org, repo, branch);
+        log.info(`Configuring branch protection on ${branch}...`);
+        const params = {
+          owner: org,
+          repo,
+          branch,
+          required_status_checks: { strict: true, contexts: statusChecks },
+          enforce_admins: false,
+          required_pull_request_reviews: {
+            required_approving_review_count: 0,
+            dismiss_stale_reviews: false
+          },
+          restrictions: null,
+          required_linear_history: true,
+          allow_force_pushes: false,
+          allow_deletions: false
+        };
+        const deadline = Date.now() + 3e4;
+        while (true) {
+          try {
+            await this.octokit.repos.updateBranchProtection(params);
+            applied.push(branch);
+            break;
+          } catch (err) {
+            const status = err.status;
+            if (status === 403) {
+              log.warn(
+                `Branch protection unavailable for ${org}/${repo}: ${err.message}`
+              );
+              log.warn(
+                "  This usually means the organization is on a plan that only supports branch protection on public repos (GitHub Team/Enterprise is required for private org repos). Skipping branch protection \u2014 add it later via GitHub once the plan allows it, or make the repo public."
+              );
+              return recordBranchProtectionOutcome({
+                status: "skipped-403",
+                org,
+                repo,
+                protectedBranches: applied,
+                unprotectedBranches: remaining(),
+                reason: err.message
+              });
+            }
+            if (status !== 404 || Date.now() >= deadline) throw err;
+            log.info("Branch protection endpoint not yet ready, retrying...");
+            await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
           }
-          if (status !== 404 || Date.now() >= deadline) throw err;
-          log.info("Branch protection endpoint not yet ready, retrying...");
-          await new Promise((resolve19) => setTimeout(resolve19, protectionIntervalMs));
         }
       }
+    } catch (err) {
+      recordBranchProtectionOutcome({
+        status: "failed",
+        org,
+        repo,
+        protectedBranches: applied,
+        unprotectedBranches: remaining(),
+        reason: err.message
+      });
+      throw err;
     }
     log.success("Branch protection configured on dev, staging, and main");
+    return recordBranchProtectionOutcome({
+      status: "applied",
+      org,
+      repo,
+      protectedBranches: applied,
+      unprotectedBranches: []
+    });
   }
   /**
    * Protect a single branch with caller-supplied required checks (#803).
@@ -5688,11 +5782,15 @@ async function runSiblingCreateCommand(name, options) {
   const aws = new AwsAdapter(config);
   const coreAws = new AwsAdapter(coreConfig);
   const git = new GitAdapter();
-  await runSiblingCreate(github, aws, coreAws, git, config, session, {
-    coreConfig,
-    skeletonRoot: options.templateRoot,
-    githubToken: token
-  });
+  try {
+    await runSiblingCreate(github, aws, coreAws, git, config, session, {
+      coreConfig,
+      skeletonRoot: options.templateRoot,
+      githubToken: token
+    });
+  } finally {
+    reportBranchProtectionSummary();
+  }
   const { org, repo } = githubRepo(config);
   const pathPrefix = resolvePathPrefix(config);
   log.success("\nSibling repo created successfully!");
@@ -5826,6 +5924,7 @@ async function runSiblingCreate(github, aws, coreAws, git, config, session, opti
   } else {
     log.step(8, totalSteps, "Already registered with the core project \u2014 skipping");
   }
+  reportBranchProtectionSummary();
   deleteSiblingSession(config.project.name);
 }
 function resolvePathPrefix(config) {
@@ -6242,12 +6341,16 @@ var initCommand = new Command12("init").description("Scaffold a new project from
     githubToken ??= await resolveGithubToken3(options.yes === true || Boolean(options.config));
     const github = new GitHubAdapter(githubToken);
     const aws = new AwsAdapter(config);
-    await runInit(github, aws, config, session, {
-      git: new GitAdapter(),
-      awsFor: (siblingConfig) => new AwsAdapter(siblingConfig),
-      skeletonRoot: defaultSiblingTemplateRoot(),
-      githubToken
-    });
+    try {
+      await runInit(github, aws, config, session, {
+        git: new GitAdapter(),
+        awsFor: (siblingConfig) => new AwsAdapter(siblingConfig),
+        skeletonRoot: defaultSiblingTemplateRoot(),
+        githubToken
+      });
+    } finally {
+      reportBranchProtectionSummary();
+    }
     const { org, repo } = config.source_control.config;
     const appRepo = rootSiblingProjectName(config.project.name);
     log.success("\nProject initialised successfully!");
@@ -6385,6 +6488,7 @@ async function runInit(github, aws, config, session, appSibling) {
       log.step(6, totalSteps, "Application sibling already created \u2014 skipping");
     }
   }
+  reportBranchProtectionSummary();
   deleteSession(config.project.name);
   saveProjectConfig(config);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.198.3",
+  "version": "0.198.5",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",