@biffo/cli 0.210.0 → 0.211.1

package/_skeletons/sibling-template/.github/workflows/deploy.yml

@@ -285,3 +285,68 @@ jobs:
             echo "::error::Health check failed after deploy — the Lambda uploaded but isn't serving requests. Check CloudWatch logs for ${{ vars.LAMBDA_FUNCTION_NAME }}."
             exit 1
           fi
+
+  # A Deploy run that deploys NOTHING must not report success (#1065).
+  #
+  # `deploy-infra` and `deploy-app` are both gated on
+  # `vars.SIBLING_DEPLOY_ENABLED == 'true'`. GitHub evaluates an unset variable
+  # to the empty string, so before that variable exists both jobs are simply
+  # SKIPPED — and a workflow whose every job skipped concludes **success**.
+  # Every sibling was therefore born with a green Deploy run that had created
+  # no bucket, no Lambda, no route, and nothing distinguished it from a real
+  # deploy: it was found only by opening the run and reading the job list.
+  #
+  # `biffo sibling create` no longer triggers that premature run at all, but
+  # ordering alone only fixes the instance of the bug we saw. This job fixes
+  # the CLASS: any future run in which the deploy jobs do not actually run is
+  # red, whatever the reason.
+  #
+  # The three states are deliberately distinguished, because "deliberately off"
+  # and "never configured" are different facts and only one of them is a defect:
+  deploy-status:
+    name: Deploy status
+    needs: [resolve-environment, deploy-infra, deploy-app]
+    if: always()
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    steps:
+      - name: Fail a run that deployed nothing
+        env:
+          ENABLED: ${{ vars.SIBLING_DEPLOY_ENABLED }}
+          INFRA: ${{ needs.deploy-infra.result }}
+          APP: ${{ needs.deploy-app.result }}
+        run: |
+          echo "SIBLING_DEPLOY_ENABLED='${ENABLED}'  deploy-infra=${INFRA}  deploy-app=${APP}"
+
+          if [ "${ENABLED}" = "false" ]; then
+            echo "::notice::Deploys are deliberately disabled for this repo (SIBLING_DEPLOY_ENABLED=false). Nothing was deployed, by choice."
+            exit 0
+          fi
+
+          if [ -z "${ENABLED}" ]; then
+            echo "::error::SIBLING_DEPLOY_ENABLED is not set, so every deploy job skipped and this run created nothing. A repo variable named SIBLING_DEPLOY_ENABLED must be set to 'true'; \`biffo sibling create\` sets it in step 7."
+            exit 1
+          fi
+
+          # A real failure already makes the run red for the right reason, and
+          # `deploy-app` needs `deploy-infra` — so a failed infra job SKIPS the
+          # app job. Reporting that skip as "deployed nothing" would bury the
+          # actual cause under a second, wrong error. Defer to the real one.
+          case "${INFRA}:${APP}" in
+            *failure*|*cancelled*)
+              echo "A deploy job failed or was cancelled; that failure is the run's result. Not adding a second error."
+              exit 0
+              ;;
+          esac
+
+          # Enabled — the jobs were meant to run. 'skipped' here means a gate
+          # upstream of them suppressed the work while the run still went green.
+          for pair in "deploy-infra:${INFRA}" "deploy-app:${APP}"; do
+            job="${pair%%:*}"
+            result="${pair#*:}"
+            if [ "${result}" = "skipped" ]; then
+              echo "::error::${job} was skipped although deploys are enabled — this run reported success while deploying nothing."
+              exit 1
+            fi
+          done
+
+          echo "Deploy jobs ran (infra=${INFRA}, app=${APP})."

package/dist/index.js

@@ -6134,12 +6134,14 @@ async function runSiblingCreateCommand(name, options) {
      this sibling automatically: the SIBLING_GITHUB_TOKEN secret, the CORE_* identity variables,
      and \u2014 once the registration PR has merged and the core has redeployed \u2014
      PARENT_CLOUDFRONT_DISTRIBUTION_ARN. No manual variable/secret setup is needed (issue #337).
-  3. Push to \`dev\` (or run the Deploy workflow manually) to provision this sibling's own AWS resources.
+  3. This sibling's first Deploy has already been dispatched (step 9) \u2014 watch it rather than
+     pushing to trigger one. If it was reported as not dispatched above, run it by hand:
+     \`gh workflow run deploy.yml --ref dev -f environment=dev\`
 `
   );
 }
 async function runSiblingCreate(github, aws, coreAws, git, config, session, options) {
-  const totalSteps = 8;
+  const totalSteps = 9;
   const { org, repo } = githubRepo(config);
   const pathPrefix = resolvePathPrefix(config);
   assertGitIdentity(await git.configuredIdentity());
@@ -6248,6 +6250,30 @@ async function runSiblingCreate(github, aws, coreAws, git, config, session, opti
   } else {
     log.step(8, totalSteps, "Already registered with the core project \u2014 skipping");
   }
+  if (!session.completedSteps.includes("trigger_first_deploy")) {
+    const firstEnvironment = config.environments[0] ?? "dev";
+    log.step(9, totalSteps, `Dispatching the first deploy (${firstEnvironment})...`);
+    try {
+      await github.triggerWorkflow(
+        org,
+        repo,
+        "deploy.yml",
+        { environment: firstEnvironment },
+        "dev"
+      );
+      log.info(`  Watch it: https://github.com/${org}/${repo}/actions/workflows/deploy.yml`);
+      markSiblingStepComplete(session, "trigger_first_deploy");
+    } catch (err) {
+      log.warn(
+        `  Could not dispatch the first deploy: ${err instanceof Error ? err.message : String(err)}`
+      );
+      log.warn(
+        `  Run it by hand: gh workflow run deploy.yml --repo ${org}/${repo} --ref dev -f environment=dev`
+      );
+    }
+  } else {
+    log.step(9, totalSteps, "First deploy already dispatched \u2014 skipping");
+  }
   reportBranchProtectionSummary();
   deleteSiblingSession(config.project.name);
 }
@@ -6350,7 +6376,12 @@ async function pushSkeleton(git, skeletonRoot, cloneUrl, config, coreConfig, git
     await git.init(workDir, "dev");
     await git.addRemote(workDir, "origin", cloneUrl);
     await git.add(workDir, ["."]);
-    await git.commit(workDir, `feat: scaffold ${config.project.name} sibling app (ADR-0007)`);
+    await git.commit(
+      workDir,
+      `feat: scaffold ${config.project.name} sibling app (ADR-0007)
+
+[skip ci]`
+    );
     await git.push(workDir, "dev", { token: githubToken });
   } finally {
     git.cleanup(workDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.210.0",
+  "version": "0.211.1",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",