@crossdelta/platform-sdk 0.22.0 → 0.22.2

package/bin/templates/workspace/.github/actions/generate-scope-matrix/index.js

@@ -0,0 +1,370 @@
+/**
+ * Generate Scope Matrix Action
+ *
+ * Discovers Docker-enabled scopes in a monorepo and generates a GitHub Actions
+ * matrix for building only the scopes that have changed between commits.
+ *
+ * A "scope" is a directory containing a Dockerfile. Scopes are discovered by
+ * scanning configured root directories (default: apps, services).
+ *
+ * @example
+ * // In a workflow:
+ * - uses: ./.github/actions/generate-scope-matrix
+ *   with:
+ *     scope-roots: apps,services
+ *
+ * @outputs scopes - JSON array of scope objects [{name, shortName, dir, run}]
+ * @outputs scopes_count - Number of scopes in the matrix
+ */
+
+const { appendFileSync } = require('node:fs')
+const { spawnSync } = require('node:child_process')
+const { existsSync, readdirSync, readFileSync, statSync } = require('node:fs')
+const { basename, join, relative } = require('node:path')
+
+/** Default directories to scan for scopes (Turborepo convention) */
+const defaultRoots = ['apps', 'services']
+
+/** Keys in GitHub event payload that contain changed file paths */
+const changedKeys = ['added', 'modified', 'removed']
+
+/**
+ * Builds environment variable keys for GitHub Actions inputs.
+ * GitHub converts input names to uppercase and replaces special chars with underscores.
+ * @param {string} name - Input name (e.g., 'scope-roots')
+ * @returns {string[]} Possible environment variable keys
+ */
+const buildInputKeys = (name) => {
+  const trimmed = name.trim()
+  const upper = trimmed.toUpperCase()
+  const normalized = upper.replace(/[^A-Z0-9]+/g, '_')
+  return Array.from(new Set([`INPUT_${upper}`, `INPUT_${normalized}`]))
+}
+
+/**
+ * Retrieves a GitHub Actions input value from environment variables.
+ * @param {string} name - Input name as defined in action.yml
+ * @param {Object} options - Options
+ * @param {string} [options.defaultValue=''] - Default value if input is not set
+ * @returns {string} The input value
+ */
+const getInput = (name, { defaultValue = '' } = {}) => {
+  const keys = buildInputKeys(name)
+  const raw = keys.map((key) => process.env[key]).find((value) => typeof value === 'string')
+  const value = typeof raw === 'string' ? raw.trim() : defaultValue
+  return value
+}
+
+/**
+ * Sets a GitHub Actions output value.
+ * Writes to GITHUB_OUTPUT file or logs to console if not in Actions environment.
+ * @param {string} name - Output name
+ * @param {string|object} value - Output value (objects are JSON stringified)
+ */
+const setOutput = (name, value) => {
+  const outputFile = process.env.GITHUB_OUTPUT
+  const stringValue = typeof value === 'string' ? value : JSON.stringify(value)
+
+  if (outputFile) {
+    appendFileSync(outputFile, `${name}=${stringValue}\n`)
+  } else {
+    console.log(`${name}=${stringValue}`)
+  }
+}
+
+/**
+ * Loads root directories to scan for scopes.
+ * Parses the 'scope-roots' input or uses defaults (apps, services).
+ * @returns {string[]} Array of root directory paths
+ */
+const loadRoots = () => {
+  const envRoots = getInput('scope-roots')
+
+  if (!envRoots) return defaultRoots
+
+  const parsed = envRoots
+    .split(/[^a-zA-Z0-9._-]+/)
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+
+  return parsed.length > 0 ? parsed : defaultRoots
+}
+
+/**
+ * Loads short names that should be forced into the matrix regardless of changes.
+ * Useful for deploying specific services manually.
+ * @returns {string[]} Array of short names to force-include
+ */
+const loadForcedShortNames = () => {
+  const envValue = getInput('force-scope-short-names')
+
+  if (!envValue) return []
+
+  return Array.from(
+    new Set(
+      envValue
+        .split(/[^a-zA-Z0-9._-]+/)
+        .map((entry) => entry.trim())
+        .filter(Boolean),
+    ),
+  )
+}
+
+/**
+ * Resolves the scope name from package.json or falls back to directory name.
+ * @param {string} entryPath - Path to the scope directory
+ * @param {string} fallback - Fallback name if package.json is not found
+ * @returns {string} The scope name
+ */
+const resolveScopeName = (entryPath, fallback) => {
+  const pkgPath = join(entryPath, 'package.json')
+
+  if (!existsSync(pkgPath)) return fallback
+
+  try {
+    const raw = readFileSync(pkgPath, 'utf8')
+    const pkg = JSON.parse(raw)
+    if (typeof pkg.name === 'string' && pkg.name.trim().length > 0) {
+      return pkg.name
+    }
+  } catch (error) {
+    console.error(`Failed to read package.json for ${entryPath}:`, error)
+    process.exit(1)
+  }
+
+  return fallback
+}
+
+/**
+ * Processes a single directory entry and adds it to scopes if it contains a Dockerfile.
+ * @param {string} root - Root directory path
+ * @param {string} entry - Directory entry name
+ * @param {Map} scopes - Map to store discovered scopes
+ */
+const processScopeEntry = (root, entry, scopes) => {
+  const entryPath = join(root, entry)
+
+  const isDirectory = statSync(entryPath).isDirectory()
+  if (!isDirectory) return
+
+  const dockerfilePath = join(entryPath, 'Dockerfile')
+  const hasDockerfile = existsSync(dockerfilePath)
+  if (!hasDockerfile) return
+
+  const scopeName = resolveScopeName(entryPath, entry)
+  const isDuplicateScope = scopes.has(scopeName)
+  if (isDuplicateScope) return
+
+  const relativeDir = relative(process.cwd(), entryPath).replace(/\\/g, '/')
+  scopes.set(scopeName, {
+    name: scopeName,
+    dir: relativeDir,
+    shortName: basename(relativeDir),
+  })
+}
+
+/**
+ * Discovers all Docker-enabled scopes in the given root directories.
+ * @param {string[]} roots - Array of root directory paths to scan
+ * @returns {Map<string, {name: string, dir: string, shortName: string}>} Map of discovered scopes
+ */
+const discoverScopes = (roots) => {
+  const scopes = new Map()
+
+  for (const root of roots) {
+    let entries = []
+    try {
+      entries = readdirSync(root)
+    } catch (error) {
+      if (error.code === 'ENOENT') {
+        continue
+      }
+      throw error
+    }
+
+    for (const entry of entries) {
+      processScopeEntry(root, entry, scopes)
+    }
+  }
+
+  return scopes
+}
+
+/**
+ * Loads changed files from the GitHub event payload.
+ * @param {string} eventPath - Path to the GitHub event JSON file
+ * @returns {string[]} Array of changed file paths
+ */
+const loadEventChangedFiles = (eventPath) => {
+  if (!eventPath || !existsSync(eventPath)) {
+    return []
+  }
+
+  try {
+    const payloadRaw = readFileSync(eventPath, 'utf8')
+    const payload = JSON.parse(payloadRaw)
+    const commits = Array.isArray(payload.commits) ? payload.commits : []
+    const files = new Set()
+
+    commits.forEach((commit) => {
+      changedKeys.forEach((key) => {
+        if (!Array.isArray(commit[key])) {
+          return
+        }
+        commit[key].forEach((file) => {
+          files.add(file.replace(/\\/g, '/'))
+        })
+      })
+    })
+
+    return Array.from(files)
+  } catch (error) {
+    console.warn('Unable to read changed files from event payload:', error)
+    return []
+  }
+}
+
+/**
+ * Gets the before and head commit refs from GitHub environment variables.
+ * @returns {{beforeRef: string|undefined, headRef: string|undefined}} Commit references
+ */
+const getCommitRefs = () => {
+  const beforeRef = process.env.GITHUB_EVENT_BEFORE
+  const headRef = process.env.GITHUB_SHA
+
+  return { beforeRef, headRef }
+}
+
+/**
+ * Runs git diff to check if a directory has changes between two commits.
+ * @param {string} base - Base commit reference
+ * @param {string} target - Target commit reference
+ * @param {string} dir - Directory to check for changes
+ * @returns {{ok: boolean, changed?: boolean}} Result with ok status and changed flag
+ */
+const runGitDiff = (base, target, dir) => {
+  const result = spawnSync('git', ['diff', '--name-only', base, target, '--', dir], { encoding: 'utf8' })
+
+  if (result.error || result.status !== 0) {
+    return { ok: false }
+  }
+
+  return { ok: true, changed: result.stdout.trim().length > 0 }
+}
+
+/**
+ * Resolves the parent commit reference for a given commit.
+ * @param {string} ref - Commit reference
+ * @returns {string|undefined} Parent commit reference or undefined if not found
+ */
+const resolveParentRef = (ref) => {
+  if (!ref) {
+    return undefined
+  }
+
+  const result = spawnSync('git', ['rev-parse', '--verify', `${ref}^`], { encoding: 'utf8' })
+  if (result.error || result.status !== 0) {
+    return undefined
+  }
+
+  return result.stdout.trim()
+}
+
+/**
+ * Checks if a directory has changes using git diff or event payload.
+ * Uses event payload first, then falls back to git diff.
+ * @param {string} dir - Directory to check
+ * @param {string[]} changedFilesFromEvent - Changed files from event payload
+ * @param {string} beforeRef - Before commit reference
+ * @param {string} headRef - Head commit reference
+ * @returns {boolean} True if directory has changes
+ */
+const hasGitDiffChanges = (dir, changedFilesFromEvent, beforeRef, headRef) => {
+  const normalizedDir = dir.replace(/\\/g, '/')
+
+  if (changedFilesFromEvent.length > 0) {
+    return changedFilesFromEvent.some((file) => file === normalizedDir || file.startsWith(`${normalizedDir}/`))
+  }
+
+  const diffCandidates = []
+  if (beforeRef && headRef && !/^0+$/.test(beforeRef)) {
+    diffCandidates.push({ base: beforeRef, target: headRef })
+  }
+
+  const parentRef = resolveParentRef(headRef)
+  if (parentRef) {
+    diffCandidates.push({ base: parentRef, target: headRef })
+  }
+
+  for (const { base, target } of diffCandidates) {
+    const diffResult = runGitDiff(base, target, dir)
+    if (diffResult.ok) {
+      return diffResult.changed ?? true
+    }
+  }
+
+  return true
+}
+
+/**
+ * Wrapper to check if a scope directory has changes.
+ * @param {string} scopeDir - Scope directory path
+ * @param {string[]} changedFilesFromEvent - Changed files from event
+ * @param {string} beforeRef - Before commit ref
+ * @param {string} headRef - Head commit ref
+ * @returns {boolean} True if scope has changes
+ */
+const scopeHasChanges = (scopeDir, changedFilesFromEvent, beforeRef, headRef) =>
+  hasGitDiffChanges(scopeDir, changedFilesFromEvent, beforeRef, headRef)
+
+/**
+ * Checks if the force-all input is enabled.
+ * @returns {boolean} True if all scopes should be force-included
+ */
+const isForceAll = () => {
+  const value = getInput('force-all')
+  return value === 'true' || value === '1' || value === 'yes'
+}
+
+/**
+ * Builds the final matrix array with change detection and forced scopes.
+ * @param {Map} scopeMap - Discovered scopes
+ * @param {string[]} changedFilesFromEvent - Changed files from event
+ * @param {string} beforeRef - Before commit ref
+ * @param {string} headRef - Head commit ref
+ * @param {string[]} forcedShortNames - Short names to force into matrix
+ * @returns {Array<{name: string, shortName: string, dir: string, run: boolean}>} Matrix entries
+ */
+const buildMatrix = (scopeMap, changedFilesFromEvent, beforeRef, headRef, forcedShortNames) => {
+  if (isForceAll()) {
+    return Array.from(scopeMap.values())
+      .map((scope) => ({ ...scope, run: true }))
+      .sort((a, b) => a.name.localeCompare(b.name))
+  }
+
+  const enriched = Array.from(scopeMap.values())
+    .map((scope) => ({
+      ...scope,
+      run: scopeHasChanges(scope.dir, changedFilesFromEvent, beforeRef, headRef),
+    }))
+    .sort((a, b) => a.name.localeCompare(b.name))
+
+  const forcedSet = new Set(forcedShortNames || [])
+  const base = enriched.filter((scope) => scope.run)
+  const forced = enriched.filter(
+    (scope) => forcedSet.has(scope.shortName) && !base.some((entry) => entry.shortName === scope.shortName),
+  )
+
+  return [...base, ...forced]
+}
+
+// Main execution
+const roots = loadRoots()
+const scopeMap = discoverScopes(roots)
+const changedFilesFromEvent = loadEventChangedFiles(process.env.GITHUB_EVENT_PATH)
+const { beforeRef, headRef } = getCommitRefs()
+const forcedShortNames = loadForcedShortNames()
+const matrix = buildMatrix(scopeMap, changedFilesFromEvent, beforeRef, headRef, forcedShortNames)
+
+setOutput('scopes', JSON.stringify(matrix))
+setOutput('scopes_count', String(matrix.length))

package/bin/templates/workspace/.github/actions/prepare-build-context/action.yml

@@ -0,0 +1,167 @@
+name: Prepare Build Context
+description: Flatten turbo prune output for Docker build
+
+inputs:
+  scope-short-name:
+    description: Short name of the scope (e.g., orders, storefront)
+    required: true
+  scope-dir:
+    description: Original scope directory (e.g., services/orders, apps/storefront)
+    required: true
+  npm-token:
+    description: NPM token for @orderboss private registry — used to regenerate bun.lock
+    required: false
+    default: ''
+
+outputs:
+  context-dir:
+    description: Path to the prepared build context
+    value: ${{ steps.prepare.outputs.context-dir }}
+  dockerfile:
+    description: Path to the Dockerfile relative to context-dir
+    value: ${{ steps.prepare.outputs.dockerfile }}
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare build context
+      id: prepare
+      shell: bash
+      run: |
+        set -euo pipefail
+        
+        CONTEXT_DIR="out/${{ inputs.scope-short-name }}/full"
+        SCOPE_DIR="${{ inputs.scope-dir }}"
+        
+        # Only flatten services — apps keep monorepo structure so
+        # relative paths (../../packages/ui) resolve correctly
+        if [[ "$SCOPE_DIR" == services/* ]]; then
+          if [ -d "$CONTEXT_DIR/$SCOPE_DIR" ]; then
+            cp -r "$CONTEXT_DIR/$SCOPE_DIR"/. "$CONTEXT_DIR/"
+            rm -rf "$CONTEXT_DIR/$SCOPE_DIR"
+          fi
+          rm -rf "$CONTEXT_DIR/apps" "$CONTEXT_DIR/services"
+          DOCKERFILE="Dockerfile"
+        else
+          DOCKERFILE="$SCOPE_DIR/Dockerfile"
+        fi
+        
+        cd "$CONTEXT_DIR"
+
+        # Ensure bun.lock is present — turbo prune may omit it for certain workspace configs.
+        # Copy from workspace root as a baseline; bun install below will regenerate it anyway.
+        if [ ! -f "bun.lock" ]; then
+          echo "bun.lock not in prune output — copying from workspace root"
+          cp "$GITHUB_WORKSPACE/bun.lock" bun.lock
+        fi
+
+        # Replace workspace:* with npm versions for published packages
+        # so bun install fetches pre-built packages from registry (with dist/)
+        # Private packages stay as workspace deps (Bun resolves their .ts source)
+        if [ -d "packages" ]; then
+          for pkg_dir in packages/*/; do
+            [ -f "$pkg_dir/package.json" ] || continue
+            
+            pkg_name=$(jq -r '.name' "$pkg_dir/package.json")
+            is_private=$(jq -r '.private // false' "$pkg_dir/package.json")
+            pkg_version=$(jq -r '.version // empty' "$pkg_dir/package.json")
+            
+            if [ "$is_private" = "true" ] || [ -z "$pkg_version" ]; then
+              echo "  keeping workspace dep: $pkg_name (private)"
+              continue
+            fi
+            
+            # Use npm version if local version isn't published yet (race with publish workflow)
+            npm_version=$(npm view "$pkg_name" version 2>/dev/null || echo "")
+            if [ -n "$npm_version" ] && ! npm view "$pkg_name@$pkg_version" version >/dev/null 2>&1; then
+              echo "  $pkg_name@$pkg_version not on npm yet, using ^$npm_version"
+              pkg_version="$npm_version"
+            fi
+            
+            echo "  replacing workspace:* → ^$pkg_version for $pkg_name"
+            
+            # Replace in dependencies and devDependencies (root + scope package.json)
+            for pkg_file in package.json "$SCOPE_DIR/package.json"; do
+              [ -f "$pkg_file" ] || continue
+              for field in dependencies devDependencies; do
+                if jq -e ".${field}[\"${pkg_name}\"]" "$pkg_file" > /dev/null 2>&1; then
+                  jq ".${field}[\"${pkg_name}\"] = \"^${pkg_version}\"" "$pkg_file" > "$pkg_file.tmp"
+                  mv "$pkg_file.tmp" "$pkg_file"
+                fi
+              done
+            done
+            
+            # Also update private packages that depend on this published package
+            for other_pkg in packages/*/; do
+              [ -f "$other_pkg/package.json" ] || continue
+              for field in dependencies devDependencies; do
+                if jq -e ".${field}[\"${pkg_name}\"]" "$other_pkg/package.json" > /dev/null 2>&1; then
+                  jq ".${field}[\"${pkg_name}\"] = \"^${pkg_version}\"" "$other_pkg/package.json" > "$other_pkg/package.json.tmp"
+                  mv "$other_pkg/package.json.tmp" "$other_pkg/package.json"
+                fi
+              done
+            done
+            
+            # Remove published package dir (will be installed from npm)
+            rm -rf "$pkg_dir"
+          done
+        fi
+        
+        # Set workspace config for remaining private packages, or remove it
+        if [ -d "packages" ] && [ -n "$(ls -A packages/ 2>/dev/null)" ]; then
+          if [[ "$SCOPE_DIR" == services/* ]]; then
+            jq '.workspaces = ["packages/*"]' package.json > package.json.tmp
+          else
+            jq ".workspaces = [\"packages/*\", \"$SCOPE_DIR\"]" package.json > package.json.tmp
+          fi
+          mv package.json.tmp package.json
+        else
+          rm -rf packages
+          jq 'del(.workspaces)' package.json > package.json.tmp
+          mv package.json.tmp package.json
+        fi
+        
+        # Ensure packages/ dir exists (Dockerfiles COPY it even when empty)
+        mkdir -p packages
+        
+        # Strip prepare script — it runs husky + turbo (dev-only, not needed in Docker)
+        if jq -e '.scripts.prepare' package.json > /dev/null 2>&1; then
+          jq 'del(.scripts.prepare)' package.json > package.json.tmp
+          mv package.json.tmp package.json
+        fi
+        
+        # Regenerate bun.lock for the flattened workspace.
+        # package.json files were modified above (workspace:* → npm versions), so the
+        # original bun.lock is now inconsistent. We re-run bun install in the pruned
+        # context — bun's global cache is warm from the earlier setup-bun-install step,
+        # so this is fast and produces no new network traffic for already-cached packages.
+        #
+        # bun may delete bun.lock if it detects a workspace mismatch and then fails.
+        # Always back up first; restore if install leaves no valid lockfile behind.
+        # Service Dockerfiles install without --frozen-lockfile for this reason.
+        if [ -f "bun.lock" ]; then
+          echo "Regenerating bun.lock for modified workspace..."
+          cp bun.lock bun.lock.bak
+          set +e
+          NPM_TOKEN="${{ inputs.npm-token }}" bun install --no-progress 2>&1 | tee /tmp/bun-install.log; INSTALL_EXIT=${PIPESTATUS[0]}
+          set -e
+          if [ ! -f bun.lock ] || [ ! -s bun.lock ]; then
+            echo "::warning::bun install (exit $INSTALL_EXIT) produced no valid bun.lock — restoring original so Docker COPY does not fail"
+            mv bun.lock.bak bun.lock
+          elif [ "$INSTALL_EXIT" -ne 0 ]; then
+            echo "::warning::bun install exited with $INSTALL_EXIT but bun.lock exists — using regenerated lockfile"
+            rm -f bun.lock.bak
+          else
+            rm -f bun.lock.bak
+            echo "bun.lock regenerated"
+          fi
+          # Remove all node_modules created by the install; Docker installs fresh
+          find . -type d -name node_modules -prune -exec rm -rf {} + 2>/dev/null || true
+        fi
+
+        # Create .dockerignore in context root so COPY . . never re-introduces
+        # node_modules (bun symlinks) even when no root .dockerignore is in scope.
+        printf '%s\n' '**/node_modules' '**/.git' '**/.turbo' '.env' '.env.local' '*.log' > ".dockerignore"
+
+        echo "context-dir=$CONTEXT_DIR" >> "$GITHUB_OUTPUT"
+        echo "dockerfile=$DOCKERFILE" >> "$GITHUB_OUTPUT"

package/bin/templates/workspace/.github/actions/setup-bun-install/action.yml.hbs

@@ -0,0 +1,57 @@
+name: Setup Bun and install dependencies
+description: Installs Bun, optionally restores cache, and runs Bun install commands.
+author: {{githubOwner}}
+
+inputs:
+  working-directory:
+    description: Directory to run the install command in.
+    default: .
+  install-command:
+    description: Command to install dependencies.
+    default: bun install --frozen-lockfile
+  enable-cache:
+    description: Whether to run the cache step.
+    default: 'false'
+  cache-key:
+    description: Cache key to use when caching is enabled.
+    default: ''
+  cache-restore-keys:
+    description: Restore keys for the cache step.
+    default: ''
+  cache-paths:
+    description: Newline-delimited paths to include in the cache.
+    default: |
+      ~/.bun
+      node_modules
+  bun-version-file:
+    description: Path to a file containing the Bun version (passed to setup-bun).
+    default: 'package.json'
+  npm-token:
+    description: NPM token for private registry access.
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Install Bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version-file: $\{{ inputs.bun-version-file }}
+
+    - name: Cache dependencies
+      if: $\{{ inputs.enable-cache == 'true' && inputs.cache-key != '' }}
+      uses: actions/cache@v5
+      with:
+        path: $\{{ inputs.cache-paths }}
+        key: $\{{ inputs.cache-key }}
+        restore-keys: $\{{ inputs.cache-restore-keys }}
+
+    - name: Install dependencies
+      shell: bash
+      env:
+        NPM_TOKEN: $\{{ inputs.npm-token }}
+      run: |
+        set -euo pipefail
+        cd "$\{{ inputs.working-directory }}"
+        $\{{ inputs.install-command }}

package/bin/templates/workspace/.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+registries:
+  npm-github:
+    type: npm-registry
+    url: https://npm.pkg.github.com
+    token: ${{secrets.NPM_TOKEN}}
+    replaces-base: true
+    
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+    registries:
+      - npm-github