@biffo/cli 0.41.10 → 0.41.12

package/core.version

@@ -1 +1 @@
-0.41.10
+0.41.12

package/dist/index.js

@@ -835,6 +835,39 @@ var GitHubAdapter = class {
     log.info(`Committed ${files.map((f) => f.path).join(", ")} to ${branch}`);
     return commit.sha;
   }
+  /** The commit SHA at the head of `branch`. */
+  async getBranchSha(org, repo, branch) {
+    const ref = await this.waitForRef(org, repo, `heads/${branch}`, 12e4, 3e3);
+    return ref.object.sha;
+  }
+  /**
+   * Point `branch` at `sha` via a fast-forward-only ref update (issue #329).
+   *
+   * `sha` must be an ancestor-descendant of the branch's current head:
+   * GitHub's `updateRef` rejects a non-fast-forward move unless `force` is set,
+   * and it is deliberately left unset here. The only caller is `writeInstanceFiles`,
+   * moving a freshly-created branch onto the instance commit built on that
+   * branch's own shared base — always a fast-forward. If it ever isn't, failing
+   * loudly is the correct outcome, not clobbering history.
+   *
+   * Idempotent: a no-op (no API write) when `branch` is already at `sha`, so a
+   * resumed init neither errors nor rewrites anything.
+   */
+  async fastForwardBranch(org, repo, branch, sha) {
+    const current = await this.getBranchSha(org, repo, branch);
+    if (current === sha) {
+      log.info(`${branch} already at ${sha.slice(0, 7)} \u2014 skipping`);
+      return;
+    }
+    await this.octokit.git.updateRef({
+      owner: org,
+      repo,
+      ref: `heads/${branch}`,
+      sha,
+      force: false
+    });
+    log.info(`Fast-forwarded ${branch} to ${sha.slice(0, 7)}`);
+  }
   async setDefaultBranch(org, repo, branch) {
     await this.octokit.repos.update({ owner: org, repo, default_branch: branch });
     log.info(`Default branch set to ${branch}`);
@@ -1509,6 +1542,12 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
   return { dir, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 
+// src/lib/global-workflows.ts
+var GLOBAL_DISPATCH_REF = "main";
+var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
+  ".github/workflows/deploy-global.yml"
+];
+
 // src/commands/core-upgrade.ts
 var MISSING_TEMPLATE_ROOT_GUIDANCE2 = "Pass --template-repo <path> to a biffo-template git checkout, e.g. `biffo core upgrade --template-repo /path/to/biffo-template`.";
 var coreUpgradeCommand = new Command3("upgrade").description("Three-way-merge template-owned files for a core upgrade; preview it or open a PR").option("--cwd <path>", "Instance repo root to upgrade (defaults to the current directory)").option(
@@ -1685,7 +1724,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     head: branch,
     base,
     title: `Upgrade Biffo core ${fromVersion} \u2192 ${toVersion}`,
-    body: buildPrBody(fromVersion, toVersion, plan, migrations)
+    body: buildPrBody(fromVersion, toVersion, plan, migrations, base)
   });
   if (plan.conflicts.length > 0) {
     log.warn(`PR opened with ${plan.conflicts.length} conflict(s) to resolve: ${pr.url}`);
@@ -1693,7 +1732,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     log.success(`Opened PR #${pr.number}: ${pr.url}`);
   }
 }
-function buildPrBody(from, to, plan, migrations) {
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF) {
   const lines = [
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
@@ -1720,6 +1759,21 @@ function buildPrBody(from, to, plan, migrations) {
       "Review the DDL before merging: merging this PR runs these migrations against the database on the next deploy."
     );
   }
+  const globalWorkflowChanges = plan.changes.filter(
+    (c) => GLOBAL_DISPATCH_WORKFLOW_PATHS.includes(c.path)
+  );
+  if (base !== GLOBAL_DISPATCH_REF && globalWorkflowChanges.length > 0) {
+    lines.push(
+      "",
+      `## \u26A0 Promotion required \u2014 global workflow change (issue #328)`,
+      "",
+      `This upgrade changes ${globalWorkflowChanges.length} workflow(s) that \`biffo deploy\` dispatches from \`${GLOBAL_DISPATCH_REF}\`, but this PR targets \`${base}\`:`,
+      "",
+      ...globalWorkflowChanges.map((c) => `- \`${c.path}\``),
+      "",
+      `Merging here lands the fix on \`${base}\` \u2014 **but the deploy runs it from \`${GLOBAL_DISPATCH_REF}\`.** Until you promote \`${base}\` \u2192 \`${GLOBAL_DISPATCH_REF}\` (open a PR from \`${base}\` into \`${GLOBAL_DISPATCH_REF}\` and merge it), the old workflow keeps running and this fix will not take effect.`
+    );
+  }
   if (plan.conflicts.length > 0) {
     lines.push(
       "",
@@ -3124,6 +3178,61 @@ async function reportOidcHint(github, org, repo, runId) {
   log.error("  Re-run `biffo init` to rewrite the trust policy with both patterns.");
   log.error("");
 }
+async function readRemoteCoreVersion(github, org, repo, ref) {
+  const record = await github.getFileContent(org, repo, INSTANCE_CORE_FILE, ref);
+  if (record) {
+    try {
+      const parsed = JSON.parse(record);
+      if (typeof parsed.version === "string") {
+        parseCoreVersion(parsed.version);
+        return parsed.version;
+      }
+    } catch {
+    }
+  }
+  const inherited = await github.getFileContent(org, repo, CORE_VERSION_FILE, ref);
+  if (inherited) {
+    try {
+      const version = inherited.trim();
+      parseCoreVersion(version);
+      return version;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function warnIfDispatchRefStale(github, org, repo, workflowFile, dispatchRef, deployBranch) {
+  if (dispatchRef === deployBranch) return;
+  let refVersion;
+  let branchVersion;
+  try {
+    ;
+    [refVersion, branchVersion] = await Promise.all([
+      readRemoteCoreVersion(github, org, repo, dispatchRef),
+      readRemoteCoreVersion(github, org, repo, deployBranch)
+    ]);
+  } catch {
+    return;
+  }
+  if (!refVersion || !branchVersion) return;
+  if (compareCoreVersions(refVersion, branchVersion) >= 0) return;
+  log.warn("");
+  log.warn(
+    `  ${workflowFile} is dispatched from '${dispatchRef}', but '${dispatchRef}' is on core ${refVersion} while '${deployBranch}' (deploying now) is on core ${branchVersion}.`
+  );
+  log.warn(
+    `  A core upgrade landed on '${deployBranch}' that has not reached '${dispatchRef}'. This deploy`
+  );
+  log.warn(
+    `  will run the OLDER ${workflowFile} from '${dispatchRef}', so template fixes to it will NOT`
+  );
+  log.warn(
+    `  take effect. Promote '${deployBranch}' \u2192 '${dispatchRef}' (open a PR from '${deployBranch}'`
+  );
+  log.warn(`  into '${dispatchRef}' and merge it), then re-run this deploy. (issue #328)`);
+  log.warn("");
+}
 async function runDeploy(github, aws, config, environment, options = {}) {
   const { org, repo } = config.source_control.config;
   const awsConfig2 = config.cloud.config;
@@ -3165,8 +3274,16 @@ async function runDeploy(github, aws, config, environment, options = {}) {
   if (!skipInfra && hasGlobalInfra) {
     const globalLabel = dns.mode === "external" ? "Requesting SSL certificate for external DNS..." : "Deploying global infrastructure (DNS + SSL certificate)...";
     log.step(2, totalSteps, globalLabel);
+    await warnIfDispatchRefStale(
+      github,
+      org,
+      repo,
+      "deploy-global.yml",
+      GLOBAL_DISPATCH_REF,
+      branch
+    );
     const globalBaselineId = await github.getLatestWorkflowRunId(org, repo, "deploy-global.yml");
-    await github.triggerWorkflow(org, repo, "deploy-global.yml", {}, "main");
+    await github.triggerWorkflow(org, repo, "deploy-global.yml", {}, GLOBAL_DISPATCH_REF);
     if (dns.mode === "external") {
       log.info("  DNS will not be changed automatically.");
       log.info("  The workflow summary will list ACM validation CNAMEs to add manually.");
@@ -3181,7 +3298,7 @@ async function runDeploy(github, aws, config, environment, options = {}) {
       globalBaselineId,
       36e5,
       3e4,
-      "main"
+      GLOBAL_DISPATCH_REF
     );
     if (globalResult.conclusion !== "success") {
       log.error(`Global infrastructure deploy ${globalResult.conclusion ?? "failed"}.`);
@@ -4814,7 +4931,12 @@ function appSiblingRegistryFiles(config) {
   }));
 }
 var INSTANCE_CONFIG_FILE = "biffo.config.json";
-var INSTANCE_FILE_BRANCHES = ["main", "dev", "staging"];
+var INSTANCE_FILE_BASE_BRANCH = "main";
+var INSTANCE_FILE_FOLLOWER_BRANCHES = ["dev", "staging"];
+var INSTANCE_FILE_BRANCHES = [
+  INSTANCE_FILE_BASE_BRANCH,
+  ...INSTANCE_FILE_FOLLOWER_BRANCHES
+];
 async function writeInstanceFiles(github, org, repo, config) {
   const files = [
     { path: INSTANCE_CORE_FILE, content: serializeInstanceCoreVersion(getLatestCoreVersion()) },
@@ -4822,8 +4944,10 @@ async function writeInstanceFiles(github, org, repo, config) {
     ...config ? appSiblingRegistryFiles(config) : []
   ];
   const message = config ? `chore: record core version, register the ${ROOT_SIBLING_NAME} sibling, and drop the template ${INSTANCE_CONFIG_FILE}` : `chore: record core version and drop the template ${INSTANCE_CONFIG_FILE}`;
-  for (const branch of INSTANCE_FILE_BRANCHES) {
-    await github.commitFiles(org, repo, branch, files, message);
+  const committed = await github.commitFiles(org, repo, INSTANCE_FILE_BASE_BRANCH, files, message);
+  const sharedSha = committed ?? await github.getBranchSha(org, repo, INSTANCE_FILE_BASE_BRANCH);
+  for (const branch of INSTANCE_FILE_FOLLOWER_BRANCHES) {
+    await github.fastForwardBranch(org, repo, branch, sharedSha);
   }
 }
 function printPlan2(config) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.41.10",
+  "version": "0.41.12",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",