@biffo/cli 0.41.11 → 0.41.13

package/core.version

@@ -1 +1 @@
-0.41.11
+0.41.13

package/dist/index.js

@@ -1542,6 +1542,12 @@ function materializeTemplateAtTag(repo, version, git = defaultGit) {
   return { dir, cleanup: () => rmSync3(dir, { recursive: true, force: true }) };
 }
 
+// src/lib/global-workflows.ts
+var GLOBAL_DISPATCH_REF = "main";
+var GLOBAL_DISPATCH_WORKFLOW_PATHS = [
+  ".github/workflows/deploy-global.yml"
+];
+
 // src/commands/core-upgrade.ts
 var MISSING_TEMPLATE_ROOT_GUIDANCE2 = "Pass --template-repo <path> to a biffo-template git checkout, e.g. `biffo core upgrade --template-repo /path/to/biffo-template`.";
 var coreUpgradeCommand = new Command3("upgrade").description("Three-way-merge template-owned files for a core upgrade; preview it or open a PR").option("--cwd <path>", "Instance repo root to upgrade (defaults to the current directory)").option(
@@ -1718,7 +1724,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     head: branch,
     base,
     title: `Upgrade Biffo core ${fromVersion} \u2192 ${toVersion}`,
-    body: buildPrBody(fromVersion, toVersion, plan, migrations)
+    body: buildPrBody(fromVersion, toVersion, plan, migrations, base)
   });
   if (plan.conflicts.length > 0) {
     log.warn(`PR opened with ${plan.conflicts.length} conflict(s) to resolve: ${pr.url}`);
@@ -1726,7 +1732,7 @@ async function applyAndOpenPr(options, deps, plan, migrations, fromVersion, toVe
     log.success(`Opened PR #${pr.number}: ${pr.url}`);
   }
 }
-function buildPrBody(from, to, plan, migrations) {
+function buildPrBody(from, to, plan, migrations, base = GLOBAL_DISPATCH_REF) {
   const lines = [
     "Automated core upgrade generated by `biffo core upgrade` (ADR-0006).",
     "",
@@ -1753,6 +1759,21 @@ function buildPrBody(from, to, plan, migrations) {
       "Review the DDL before merging: merging this PR runs these migrations against the database on the next deploy."
     );
   }
+  const globalWorkflowChanges = plan.changes.filter(
+    (c) => GLOBAL_DISPATCH_WORKFLOW_PATHS.includes(c.path)
+  );
+  if (base !== GLOBAL_DISPATCH_REF && globalWorkflowChanges.length > 0) {
+    lines.push(
+      "",
+      `## \u26A0 Promotion required \u2014 global workflow change (issue #328)`,
+      "",
+      `This upgrade changes ${globalWorkflowChanges.length} workflow(s) that \`biffo deploy\` dispatches from \`${GLOBAL_DISPATCH_REF}\`, but this PR targets \`${base}\`:`,
+      "",
+      ...globalWorkflowChanges.map((c) => `- \`${c.path}\``),
+      "",
+      `Merging here lands the fix on \`${base}\` \u2014 **but the deploy runs it from \`${GLOBAL_DISPATCH_REF}\`.** Until you promote \`${base}\` \u2192 \`${GLOBAL_DISPATCH_REF}\` (open a PR from \`${base}\` into \`${GLOBAL_DISPATCH_REF}\` and merge it), the old workflow keeps running and this fix will not take effect.`
+    );
+  }
   if (plan.conflicts.length > 0) {
     lines.push(
       "",
@@ -3157,6 +3178,61 @@ async function reportOidcHint(github, org, repo, runId) {
   log.error("  Re-run `biffo init` to rewrite the trust policy with both patterns.");
   log.error("");
 }
+async function readRemoteCoreVersion(github, org, repo, ref) {
+  const record = await github.getFileContent(org, repo, INSTANCE_CORE_FILE, ref);
+  if (record) {
+    try {
+      const parsed = JSON.parse(record);
+      if (typeof parsed.version === "string") {
+        parseCoreVersion(parsed.version);
+        return parsed.version;
+      }
+    } catch {
+    }
+  }
+  const inherited = await github.getFileContent(org, repo, CORE_VERSION_FILE, ref);
+  if (inherited) {
+    try {
+      const version = inherited.trim();
+      parseCoreVersion(version);
+      return version;
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function warnIfDispatchRefStale(github, org, repo, workflowFile, dispatchRef, deployBranch) {
+  if (dispatchRef === deployBranch) return;
+  let refVersion;
+  let branchVersion;
+  try {
+    ;
+    [refVersion, branchVersion] = await Promise.all([
+      readRemoteCoreVersion(github, org, repo, dispatchRef),
+      readRemoteCoreVersion(github, org, repo, deployBranch)
+    ]);
+  } catch {
+    return;
+  }
+  if (!refVersion || !branchVersion) return;
+  if (compareCoreVersions(refVersion, branchVersion) >= 0) return;
+  log.warn("");
+  log.warn(
+    `  ${workflowFile} is dispatched from '${dispatchRef}', but '${dispatchRef}' is on core ${refVersion} while '${deployBranch}' (deploying now) is on core ${branchVersion}.`
+  );
+  log.warn(
+    `  A core upgrade landed on '${deployBranch}' that has not reached '${dispatchRef}'. This deploy`
+  );
+  log.warn(
+    `  will run the OLDER ${workflowFile} from '${dispatchRef}', so template fixes to it will NOT`
+  );
+  log.warn(
+    `  take effect. Promote '${deployBranch}' \u2192 '${dispatchRef}' (open a PR from '${deployBranch}'`
+  );
+  log.warn(`  into '${dispatchRef}' and merge it), then re-run this deploy. (issue #328)`);
+  log.warn("");
+}
 async function runDeploy(github, aws, config, environment, options = {}) {
   const { org, repo } = config.source_control.config;
   const awsConfig2 = config.cloud.config;
@@ -3198,8 +3274,16 @@ async function runDeploy(github, aws, config, environment, options = {}) {
   if (!skipInfra && hasGlobalInfra) {
     const globalLabel = dns.mode === "external" ? "Requesting SSL certificate for external DNS..." : "Deploying global infrastructure (DNS + SSL certificate)...";
     log.step(2, totalSteps, globalLabel);
+    await warnIfDispatchRefStale(
+      github,
+      org,
+      repo,
+      "deploy-global.yml",
+      GLOBAL_DISPATCH_REF,
+      branch
+    );
     const globalBaselineId = await github.getLatestWorkflowRunId(org, repo, "deploy-global.yml");
-    await github.triggerWorkflow(org, repo, "deploy-global.yml", {}, "main");
+    await github.triggerWorkflow(org, repo, "deploy-global.yml", {}, GLOBAL_DISPATCH_REF);
     if (dns.mode === "external") {
       log.info("  DNS will not be changed automatically.");
       log.info("  The workflow summary will list ACM validation CNAMEs to add manually.");
@@ -3214,7 +3298,7 @@ async function runDeploy(github, aws, config, environment, options = {}) {
       globalBaselineId,
       36e5,
       3e4,
-      "main"
+      GLOBAL_DISPATCH_REF
     );
     if (globalResult.conclusion !== "success") {
       log.error(`Global infrastructure deploy ${globalResult.conclusion ?? "failed"}.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.41.11",
+  "version": "0.41.13",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",