@biffo/cli 0.272.7 → 0.273.0

package/dist/index.js

@@ -8530,6 +8530,16 @@ ${lines.join("\n")}
   writeFileSync10(pluginPyprojectPath, updated);
   return toAdd;
 }
+function applyWorkspaceSources(targetDir, cwd, relTargetDir) {
+  const pluginPyproject = join28(targetDir, "pyproject.toml");
+  if (!existsSync27(pluginPyproject)) return;
+  const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(cwd));
+  if (sourced.length > 0) {
+    log.info(
+      `Sourced ${sourced.join(", ")} from the workspace in ${relTargetDir}/pyproject.toml (the instance provides it as a workspace member).`
+    );
+  }
+}
 
 // src/commands/plugin-install.ts
 var TARGET_PATTERN = /^([a-z][a-z0-9-]*)@(\d+\.\d+)$/;
@@ -8699,15 +8709,7 @@ async function runPluginInstall(target, options, deps) {
       });
       log.success(`Installed plugin source at ${relTargetDir}/`);
     }
-    const pluginPyproject = join29(targetDir, "pyproject.toml");
-    if (existsSync28(pluginPyproject)) {
-      const sourced = ensureWorkspaceSources(pluginPyproject, workspaceMemberNames(options.cwd));
-      if (sourced.length > 0) {
-        log.info(
-          `Sourced ${sourced.join(", ")} from the workspace in ${relTargetDir}/pyproject.toml (the instance provides it as a workspace member).`
-        );
-      }
-    }
+    applyWorkspaceSources(targetDir, options.cwd, relTargetDir);
     const stagePaths = [relTargetDir];
     const tfSourceDir = join29(targetDir, "terraform");
     if (existsSync28(tfSourceDir)) {
@@ -9074,37 +9076,63 @@ function printDryRun5(name, version, stagePaths, keepData) {
 
 // src/commands/plugin-upgrade.ts
 import { cpSync as cpSync4, existsSync as existsSync32, mkdirSync as mkdirSync10, readFileSync as readFileSync24, rmSync as rmSync9 } from "fs";
-import { join as join33, relative as relative5, resolve as resolve16 } from "path";
+import { basename as basename2, join as join33, relative as relative5, resolve as resolve16 } from "path";
 import chalk19 from "chalk";
 import { Command as Command19 } from "commander";
 import inquirer7 from "inquirer";
 var pluginUpgradeCommand = new Command19("upgrade").description(
-  "Upgrade an installed plugin to a new minor version: biffo plugin upgrade <name>@<new-minor>"
-).argument("<target>", "Plugin name and new minor version, e.g. rbac@1.1").option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(async (target, options) => {
-  const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
-  try {
-    await runPluginUpgrade(
-      target,
-      { dryRun: options.dryRun ?? false, force: options.force ?? false, cwd },
-      {
-        registry: new RegistryAdapter(),
-        git: new GitAdapter(),
-        migrations: new PluginMigrationsAdapter()
-      }
-    );
-  } catch (err) {
-    log.error(err.message);
-    process.exit(1);
+  "Upgrade an installed plugin to a new minor version (biffo plugin upgrade <name>@<new-minor>) or refresh it in place from a local, unpublished checkout (biffo plugin upgrade --local <path>)"
+).argument(
+  "[target]",
+  "Plugin name and new minor version, e.g. rbac@1.1 (omit when using --local)"
+).option(
+  "--local <path>",
+  "Refresh the installed plugin from a local, unpublished checkout instead of the registry"
+).option("--dry-run", "Resolve the new version and print planned changes without applying them").option("--force", "Skip the confirmation prompt").option("--cwd <path>", "Project root to upgrade in (defaults to the current directory)").action(
+  async (target, options) => {
+    const cwd = options.cwd ? resolve16(options.cwd) : process.cwd();
+    try {
+      await runPluginUpgrade(
+        target,
+        {
+          ...options.local ? { local: resolve16(options.local) } : {},
+          dryRun: options.dryRun ?? false,
+          force: options.force ?? false,
+          cwd
+        },
+        {
+          registry: new RegistryAdapter(),
+          git: new GitAdapter(),
+          migrations: new PluginMigrationsAdapter()
+        }
+      );
+    } catch (err) {
+      log.error(err.message);
+      process.exit(1);
+    }
   }
-});
+);
 async function runPluginUpgrade(target, options, deps) {
-  const { name, minor } = parsePluginTarget(target);
+  if (options.local && target) {
+    throw new Error(
+      `Pass either a registry target (<name>@<new-minor>) or --local <path>, not both. --local refreshes an installed plugin from an unpublished checkout on disk and has no registry entry to resolve.`
+    );
+  }
+  if (!options.local && !target) {
+    throw new Error(
+      `Nothing to upgrade. Pass a registry target (e.g. \`biffo plugin upgrade acme-crm@1.1\`) or a local checkout to refresh from (\`biffo plugin upgrade --local ../acme-crm\`).`
+    );
+  }
   const servicesDir = join33(options.cwd, "services");
   if (!existsSync32(servicesDir)) {
     throw new Error(
       `${servicesDir} does not exist \u2014 is ${options.cwd} the root of a Biffo project checkout?`
     );
   }
+  if (options.local) {
+    return runLocalPluginRefresh(options.local, options, deps);
+  }
+  const { name, minor } = parsePluginTarget(target);
   const targetDir = join33(servicesDir, name);
   if (!existsSync32(targetDir)) {
     throw new Error(
@@ -9152,6 +9180,7 @@ async function runPluginUpgrade(target, options, deps) {
     mkdirSync10(targetDir, { recursive: true });
     cpSync4(tmpDir, targetDir, { recursive: true });
     log.success(`Upgraded plugin source at services/${entry.name}/`);
+    applyWorkspaceSources(targetDir, options.cwd, `services/${entry.name}`);
     const stagePaths = [`services/${entry.name}`];
     if (existsSync32(modulesDir)) {
       rmSync9(modulesDir, { recursive: true, force: true });
@@ -9190,6 +9219,100 @@ async function runPluginUpgrade(target, options, deps) {
     deps.git.cleanup(tmpDir);
   }
 }
+async function runLocalPluginRefresh(localPath, options, deps) {
+  const source = resolveLocalPlugin(localPath);
+  log.success(`Resolved ${source.name}@${source.version} from ${source.origin}`);
+  const servicesDir = join33(options.cwd, "services");
+  const targetDir = join33(servicesDir, source.name);
+  if (!existsSync32(targetDir)) {
+    throw new Error(
+      `Plugin '${source.name}' is not installed at services/${source.name}/. Use 'biffo plugin install --local ${localPath}' instead.`
+    );
+  }
+  const inTreeSource = resolve16(source.sourceDir) === resolve16(targetDir);
+  const currentVersion = readInstalledVersion2(targetDir);
+  const modulesDir = join33(options.cwd, "modules", "plugins", source.name);
+  if (options.dryRun) {
+    printLocalDryRun(source, currentVersion, inTreeSource);
+    return;
+  }
+  if (!options.force) {
+    const proceed = await confirmRefresh(source.name, source.origin);
+    if (!proceed) {
+      log.warn("Refresh cancelled");
+      return;
+    }
+  }
+  const isRepo = await deps.git.isGitRepo(options.cwd);
+  if (!isRepo) {
+    throw new Error(
+      `${options.cwd} is not a git repository \u2014 biffo plugin upgrade must be run from a Biffo project checkout.`
+    );
+  }
+  const { manifest } = source;
+  try {
+    log.success(
+      `Manifest valid \u2014 ${manifest.tables.length} table(s), ${manifest.api_routes.length} route(s)`
+    );
+    if (inTreeSource) {
+      log.info(
+        `services/${source.name}/ is already the local checkout \u2014 nothing to copy; re-syncing its Terraform module and checking for a migration.`
+      );
+    } else {
+      rmSync9(targetDir, { recursive: true, force: true });
+      mkdirSync10(targetDir, { recursive: true });
+      cpSync4(source.sourceDir, targetDir, {
+        recursive: true,
+        filter: (src) => !LOCAL_COPY_EXCLUDES.has(basename2(src))
+      });
+      log.success(`Refreshed plugin source at services/${source.name}/ from ${source.origin}`);
+    }
+    applyWorkspaceSources(targetDir, options.cwd, `services/${source.name}`);
+    const stagePaths = [`services/${source.name}`];
+    if (existsSync32(modulesDir)) {
+      rmSync9(modulesDir, { recursive: true, force: true });
+    }
+    const tfSourceDir = join33(targetDir, "terraform");
+    if (existsSync32(tfSourceDir)) {
+      mkdirSync10(modulesDir, { recursive: true });
+      cpSync4(tfSourceDir, modulesDir, { recursive: true });
+      stagePaths.push(`modules/plugins/${source.name}`);
+      log.success(`Refreshed Terraform module at modules/plugins/${source.name}/`);
+    }
+    if (manifest.tables.length > 0) {
+      log.info(
+        `Checking for a migration for services/${source.name}/'s ${manifest.tables.length} table(s)...`
+      );
+      const generatedPaths = await deps.migrations.generate(options.cwd, [source.name]);
+      for (const absPath of generatedPaths) {
+        stagePaths.push(relative5(options.cwd, absPath));
+      }
+      if (generatedPaths.length > 0) {
+        log.success(`Generated migration: ${relative5(options.cwd, generatedPaths[0])}`);
+      } else {
+        log.info(`${source.name}'s table set is unchanged \u2014 no migration needed.`);
+      }
+    } else {
+      log.info(`${source.name} declares no tables \u2014 nothing to migrate.`);
+    }
+    await deps.git.add(options.cwd, stagePaths);
+    if (!await deps.git.hasUncommittedChanges(options.cwd)) {
+      log.warn(`services/${source.name}/ already matches ${source.origin} \u2014 nothing to commit.`);
+      return;
+    }
+    const commitMessage = `chore(plugins): refresh ${source.name} from local checkout`;
+    await deps.git.commit(options.cwd, commitMessage);
+    log.success(`Committed: ${commitMessage}`);
+    console.log(chalk19.bold("\n  Plugin refreshed!\n"));
+    console.log(`  services/${source.name}/ now matches ${source.origin}`);
+    console.log("  Push and redeploy to apply any updated tables and routes:");
+    console.log(chalk19.dim(`    git push`));
+    console.log(chalk19.dim(`    biffo deploy <environment> --app-only
+`));
+  } finally {
+    source.cleanup();
+  }
+}
 function readInstalledVersion2(targetDir) {
   const manifestPath = join33(targetDir, "biffo.plugin.json");
   if (!existsSync32(manifestPath)) return void 0;
@@ -9206,6 +9329,17 @@ async function confirmUpgrade(name, currentVersion, newVersion) {
   ]);
   return confirmed;
 }
+async function confirmRefresh(name, origin) {
+  const { confirmed } = await inquirer7.prompt([
+    {
+      type: "confirm",
+      name: "confirmed",
+      message: `Refresh ${chalk19.bold(name)} from ${origin}, replacing services/${name}/?`,
+      default: false
+    }
+  ]);
+  return confirmed;
+}
 function printDryRun6(entry, currentVersion) {
   console.log(chalk19.bold("\n  Dry run \u2014 no changes will be made\n"));
   console.log(`  Plugin:        ${entry.name}`);
@@ -9221,6 +9355,25 @@ function printDryRun6(entry, currentVersion) {
   console.log(`  Would commit:  feat(plugins): upgrade ${entry.name} to ${entry.version}
 `);
 }
+function printLocalDryRun(source, currentVersion, inTreeSource) {
+  console.log(chalk19.bold("\n  Dry run \u2014 no changes will be made\n"));
+  console.log(`  Plugin:        ${source.name}`);
+  console.log(`  Installed:     ${currentVersion ?? "(unknown \u2014 manifest unreadable)"}`);
+  console.log(`  Local source:  ${source.origin} (manifest version ${source.version})`);
+  console.log(
+    inTreeSource ? `  Already in tree at services/${source.name}/ \u2014 nothing to copy, only Terraform/migration re-sync` : `  Would replace: services/${source.name}/`
+  );
+  console.log(
+    `  Would replace Terraform module at: modules/plugins/${source.name}/ (if the checkout has one)`
+  );
+  if (source.manifest.tables.length > 0) {
+    console.log(
+      `  Would check for a migration for ${source.manifest.tables.length} table(s) (only generated if the table set changed)`
+    );
+  }
+  console.log(`  Would commit:  chore(plugins): refresh ${source.name} from local checkout
+`);
+}
 
 // src/commands/plugin.ts
 var pluginCommand = new Command20("plugin").description("Manage Biffo plugins");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.272.7",
+  "version": "0.273.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",

package/scripts/branch-health.sh

@@ -145,12 +145,12 @@ label=${REPO:-$(basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)")}
 # an older run because an API changed its sort is the same class of defect as the
 # truncated list this replaces. Ask for the newest explicitly.
 summary=$(gh_run list --branch "$BRANCH" --limit 200 \
-  --json workflowName,status,conclusion,headSha,createdAt,url \
+  --json workflowName,status,conclusion,headSha,createdAt,url,event \
   --jq 'group_by(.workflowName)
         | map(max_by(.createdAt))
         | .[]
         | [ (if .status == "completed" then (.conclusion // "unknown") else .status end),
-            .workflowName, .headSha[0:8], .createdAt[0:16], .url ]
+            .workflowName, .headSha[0:8], .createdAt[0:16], .url, .event ]
         | @tsv' 2>/dev/null)
 
 if [ -z "$summary" ]; then
@@ -165,12 +165,12 @@ cancelled=""
 skipped=""
 ok=""
 
-while IFS="$TAB" read -r state name sha when url; do
+while IFS="$TAB" read -r state name sha when url event; do
   [ -n "$name" ] || continue
   case "$state" in
     success) ok="${ok}${name}\n" ;;
     failure | timed_out | startup_failure)
-      failed="${failed}${state}\t${name}\t${sha}\t${when}\t${url}\n"
+      failed="${failed}${state}\t${name}\t${sha}\t${when}\t${url}\t${event}\n"
       ;;
     cancelled) cancelled="${cancelled}${name}\n" ;;
     skipped) skipped="${skipped}${name}\n" ;;
@@ -210,7 +210,14 @@ if [ -z "$failed" ]; then
 fi
 
 echo
-printf '%b' "$failed" | awk -F'\t' -v r="$RED" -v o="$OFF" 'NF{printf "  %s%s%s  %s  at %s  %s\n", r, $1, o, $2, $3, $5}'
+printf '%b' "$failed" | awk -F'\t' -v r="$RED" -v o="$OFF" -v y="$YELLOW" \
+  'NF{
+     line = sprintf("  %s%s%s  %s  at %s  %s", r, $1, o, $2, $3, $5)
+     if ($6 == "workflow_run") {
+       line = line sprintf("  %s(workflow_run trigger: this sha is not reliably the commit evaluated)%s", y, o)
+     }
+     print line
+   }'
 
 # --- Who actually broke it ----------------------------------------------------
 #
@@ -218,11 +225,42 @@ printf '%b' "$failed" | awk -F'\t' -v r="$RED" -v o="$OFF" 'NF{printf "  %s%s%s
 # branch backwards from the newest failure through consecutive failures, and
 # report the OLDEST one in that unbroken streak. That run's commit is where the
 # breakage started, which is very often not the person now reading this.
+#
+# `workflow_run`-triggered workflows are excluded from that confident
+# attribution (#1463). A `workflow_run` run's own `headSha` (what `gh run
+# list --json headSha` reports, and what every query in this file uses) is
+# this run's ambient checkout ref — for this template's own
+# error-branch-coverage-gate.yml that happens to be the default branch's HEAD
+# at trigger time, not necessarily the commit the run's logic actually
+# evaluated. The commit actually under test only exists in the ORIGINAL
+# webhook payload (`github.event.workflow_run.head_sha`, which a workflow can
+# read live and post as a commit status), and the Runs API does not expose
+# that payload after the fact for an arbitrary workflow — confirmed against
+# this repo's own history: `gh api .../actions/runs/<id>` for a
+# `workflow_run`-triggered run carries no such field, only the ambient
+# `head_sha`, which repeatedly disagreed with the SHA the run's job logs
+# showed it actually reported a status against (e.g. run 31411324650 here:
+# reported headSha f0d697e1 — commit "fix(deploy): package plugins that
+# declare only admin_ingress (#1466)" — while its own job log named the
+# evaluated commit as 0c077cf0, an unrelated `feat(cli)` commit by a
+# different author). Naming the wrong commit with the same confidence as a
+# push-triggered failure is worse than naming none, per the tool's own
+# "cannot tell is never a pass" posture (see file header) — so this reports
+# "cannot attribute" instead of guessing.
 
 echo
-printf '%b' "$failed" | while IFS="$TAB" read -r state name sha when url; do
+printf '%b' "$failed" | while IFS="$TAB" read -r state name sha when url event; do
   [ -n "$name" ] || continue
 
+  if [ "$event" = "workflow_run" ]; then
+    echo "  ${RED}$name${OFF} is failing (latest observed sha ${YELLOW}$sha${OFF}, $when)"
+    echo "    ${DIM}This workflow is workflow_run-triggered — its headSha is this run's own"
+    echo "    ambient checkout ref, not necessarily the commit it evaluated. Cannot"
+    echo "    attribute which commit broke it from run metadata alone; read the commit"
+    echo "    status this workflow posts (or its job log) against the real commit.${OFF}"
+    continue
+  fi
+
   # Sort newest-first ourselves, cut the list at the most recent SUCCESS, and
   # take the oldest failure still inside that streak. Anything before a green run
   # is a different, already-fixed breakage and must not be blamed for this one.