@crossdelta/platform-sdk 0.22.0 → 0.22.2

package/bin/templates/workspace/.github/workflows/build-and-deploy.yml.hbs

@@ -0,0 +1,409 @@
+name: 🚀 Build and Deploy
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'apps/*/**'
+      - 'services/*/**'
+      - 'infra/**'
+      - 'bun.lock'
+      - 'bunfig.toml'
+      - '.github/workflows/**'
+  workflow_run:
+    workflows: ['📦 Publish Packages']
+    types: [completed]
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: 'Target environment'
+        required: true
+        default: 'stage'
+        type: choice
+        options:
+          - stage
+          - production
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  SCOPE_ROOTS: apps,services
+  REGISTRY: ghcr.io/$\{{ github.repository_owner }}/$\{{ github.event.repository.name }}
+  PULUMI_STACK: $\{{ vars.PULUMI_STACK_BASE }}/$\{{ github.event.inputs.environment || 'stage' }}
+  WORKFLOW_HEAD_SHA: $\{{ github.event.workflow_run.head_sha || github.sha }}
+  WORKFLOW_BASE_SHA_INPUT: $\{{ github.event.before || '' }}
+
+jobs:
+  gate:
+    name: 🚦 Publish Gate
+    runs-on: ubuntu-latest
+    outputs:
+      proceed: $\{{ steps.decide.outputs.proceed }}
+    steps:
+      - uses: actions/checkout@v6
+        if: github.event_name == 'push'
+        with:
+          fetch-depth: 0
+
+      - name: Check for package changes
+        if: github.event_name == 'push'
+        id: pkg-check
+        run: |
+          BASE="$\{{ github.event.before }}"
+          NULL_SHA="0000000000000000000000000000000000000000"
+          if [ -z "$BASE" ] || [ "$BASE" = "$NULL_SHA" ]; then
+            BASE=$(git rev-parse HEAD^ 2>/dev/null || git rev-parse HEAD)
+          fi
+          CHANGED=$(git diff --name-only "$BASE" "$\{{ github.sha }}" -- packages/ | head -1)
+          if [ -n "$CHANGED" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Decide whether to proceed
+        id: decide
+        run: |
+          EVENT="$\{{ github.event_name }}"
+          if [ "$EVENT" = "workflow_run" ]; then
+            CONCLUSION="$\{{ github.event.workflow_run.conclusion }}"
+            if [ "$CONCLUSION" = "success" ]; then
+              echo "✅ Publish completed — proceeding with build & deploy"
+              echo "proceed=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "❌ Publish workflow $CONCLUSION — skipping"
+              echo "proceed=false" >> "$GITHUB_OUTPUT"
+            fi
+          elif [ "$EVENT" = "push" ]; then
+            if [ "$\{{ steps.pkg-check.outputs.changed }}" = "true" ]; then
+              echo "📦 Package changes detected — deferring to publish workflow"
+              echo "proceed=false" >> "$GITHUB_OUTPUT"
+            else
+              echo "✅ No package changes — proceeding"
+              echo "proceed=true" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "✅ Manual dispatch — proceeding"
+            echo "proceed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  prepare-scopes:
+    name: 🧪 Prepare Scopes
+    needs: gate
+    if: needs.gate.outputs.proceed == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      scopes: $\{{ steps.scope-generator.outputs.scopes }}
+      scope_count: $\{{ steps.scope-generator.outputs.scopes_count }}
+      infrastructure_changed: $\{{ steps.infra-eval.outputs.changed }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: $\{{ env.WORKFLOW_HEAD_SHA }}
+
+      - name: Set commit range
+        run: |
+          set -euo pipefail
+          HEAD_SHA="${WORKFLOW_HEAD_SHA}"
+          BASE_SHA="${WORKFLOW_BASE_SHA_INPUT}"
+          NULL_SHA="0000000000000000000000000000000000000000"
+          if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "$NULL_SHA" ]; then
+            if git rev-parse "${HEAD_SHA}^" >/dev/null 2>&1; then
+              BASE_SHA=$(git rev-parse "${HEAD_SHA}^")
+            else
+              BASE_SHA="$HEAD_SHA"
+            fi
+          fi
+          echo "GITHUB_SHA=$HEAD_SHA" >> "$GITHUB_ENV"
+          echo "GITHUB_EVENT_BEFORE=$BASE_SHA" >> "$GITHUB_ENV"
+
+      - name: Check for infrastructure changes
+        id: infra-check
+        run: |
+          CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- infra/ | head -1)
+          if [ -n "$CHANGED" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Evaluate infrastructure change
+        id: infra-eval
+        run: |
+          if [ "$\{{ github.event_name }}" = "workflow_run" ] || [ "$\{{ github.event_name }}" = "workflow_dispatch" ] || [ "$\{{ steps.infra-check.outputs.changed }}" = "true" ]; then
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Generate scope matrix
+        id: scope-generator
+        uses: ./.github/actions/generate-scope-matrix
+        with:
+          scope-roots: $\{{ env.SCOPE_ROOTS }}
+          force-all: $\{{ github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' }}
+
+  build:
+    if: needs.prepare-scopes.outputs.scope_count && needs.prepare-scopes.outputs.scope_count != '0'
+    needs: prepare-scopes
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        scope: $\{{ fromJson(needs.prepare-scopes.outputs.scopes) }}
+    name: 🐳 Build $\{{ matrix.scope.shortName }}
+    environment: $\{{ github.event.inputs.environment || 'stage' }}
+    env:
+      DOCKER_BUILDKIT: 1
+      IMAGE_TAG: $\{{ github.sha }}
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
+          ref: $\{{ env.WORKFLOW_HEAD_SHA }}
+
+      - name: Extract Bun version from package.json
+        run: echo "BUN_VERSION=$(jq -r '.packageManager // empty' package.json | sed 's/bun@//')" >> $GITHUB_ENV
+
+      - name: Set scope metadata
+        run: |
+          echo "SCOPE_DIR=$\{{ matrix.scope.dir }}" >> $GITHUB_ENV
+          echo "scope_name=$\{{ matrix.scope.shortName }}" >> $GITHUB_OUTPUT
+
+      - name: Setup Bun and install dependencies
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+          npm-token: $\{{ github.token }}
+
+      - name: Prune
+        run: |
+          bunx turbo prune --scope=$\{{ matrix.scope.name }} --docker --out-dir out/$\{{ matrix.scope.shortName }}
+          # turbo prune omits the bun patchedDependencies patch files. Copy them into the
+          # pruned context so `bun install` can apply them (rxdb patch for studio/storefront).
+          # Done before the scope checksum so a patch change busts the image tag.
+          if [ -d patches ]; then
+            cp -rT patches "out/$\{{ matrix.scope.shortName }}/full/patches"
+          fi
+
+      - name: Compute scope checksum
+        id: scope-checksum
+        run: |
+          set -euo pipefail
+          cd "out/$\{{ matrix.scope.shortName }}"
+          HASH=$(find . -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum)
+          HASH=${HASH%% *}
+          echo "scope_hash=$HASH" >> $GITHUB_OUTPUT
+
+      - name: Use scope checksum as image tag
+        run: echo "IMAGE_TAG=$\{{ steps.scope-checksum.outputs.scope_hash }}" >> $GITHUB_ENV
+
+      - name: Check if image tag exists
+        id: tag-check
+        uses: ./.github/actions/check-image-tag-exists
+        with:
+          scope-short-name: $\{{ matrix.scope.shortName }}
+          image-tag: $\{{ env.IMAGE_TAG }}
+          github-token: $\{{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Docker Buildx
+        if: steps.tag-check.outputs.exists != 'true'
+        uses: docker/setup-buildx-action@v4
+
+      - name: Login to GitHub Packages (GHCR)
+        if: steps.tag-check.outputs.exists != 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: $\{{ github.actor }}
+          password: $\{{ secrets.GITHUB_TOKEN }}
+
+      - name: Prepare build context
+        if: steps.tag-check.outputs.exists != 'true'
+        id: prepare-context
+        uses: ./.github/actions/prepare-build-context
+        with:
+          scope-short-name: $\{{ matrix.scope.shortName }}
+          scope-dir: $\{{ matrix.scope.dir }}
+          npm-token: $\{{ github.token }}
+
+      - name: Build and push image
+        if: steps.tag-check.outputs.exists != 'true'
+        uses: docker/build-push-action@v7
+        env:
+          NPM_TOKEN: $\{{ github.token }}
+        with:
+          context: out/$\{{ matrix.scope.shortName }}/full
+          file: out/$\{{ matrix.scope.shortName }}/full/$\{{ steps.prepare-context.outputs.dockerfile }}
+          push: true
+          tags: |
+            $\{{ env.REGISTRY }}/$\{{ matrix.scope.shortName }}:$\{{ env.IMAGE_TAG }}
+            $\{{ env.REGISTRY }}/$\{{ matrix.scope.shortName }}:latest
+          cache-from: type=gha,scope=$\{{ matrix.scope.shortName }}
+          cache-to: type=gha,scope=$\{{ matrix.scope.shortName }},mode=max
+          build-args: |
+            BUN_VERSION=$\{{ env.BUN_VERSION }}
+          secrets: |
+            NPM_TOKEN=$\{{ env.NPM_TOKEN }}
+
+      - name: Mark this scope as changed
+        run: |
+          mkdir -p .changed/$\{{ matrix.scope.shortName }}
+          echo "$\{{ matrix.scope.shortName }}" > .changed/$\{{ matrix.scope.shortName }}/scope.txt
+          printf '{"shortName":"%s","imageTag":"%s"}\n' "$\{{ matrix.scope.shortName }}" "$\{{ env.IMAGE_TAG }}" > .changed/$\{{ matrix.scope.shortName }}/metadata.json
+
+      - name: Upload change marker
+        uses: actions/upload-artifact@v6
+        with:
+          name: changed-$\{{ matrix.scope.shortName }}
+          path: .changed/$\{{ matrix.scope.shortName }}
+
+  deploy:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: deploy-job-$\{{ github.ref }}
+      cancel-in-progress: false
+    needs: [gate, build, prepare-scopes]
+    if: |
+      always() &&
+      needs.gate.outputs.proceed == 'true' &&
+      needs.prepare-scopes.result == 'success' &&
+      needs.build.result != 'failure' &&
+      (needs.prepare-scopes.outputs.scope_count != '0' || needs.prepare-scopes.outputs.infrastructure_changed == 'true')
+    name: 🌍 Deploy ($\{{ github.event.inputs.environment || 'stage' }})
+    environment: $\{{ github.event.inputs.environment || 'stage' }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: $\{{ env.WORKFLOW_HEAD_SHA }}
+          fetch-depth: 2
+
+      - name: Download all change markers
+        uses: actions/download-artifact@v7
+        with:
+          pattern: changed-*
+          path: .artifacts
+
+      - name: Resolve scope image tags
+        id: resolve_scope_tags
+        shell: bash
+        env:
+          REGISTRY: $\{{ env.REGISTRY }}
+          GH_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
+          REPO_OWNER: $\{{ github.repository_owner }}
+          REPO_PREFIX: $\{{ github.event.repository.name }}
+        run: |
+          set -euo pipefail
+          RESULT="{}"
+
+          # 1. Read markers from build job
+          if [ -d .artifacts ]; then
+            for marker_dir in .artifacts/changed-*/; do
+              [ -f "$marker_dir/metadata.json" ] || continue
+              SHORT=$(jq -r '.shortName' "$marker_dir/metadata.json")
+              TAG=$(jq -r '.imageTag' "$marker_dir/metadata.json")
+              [ -n "$SHORT" ] && [ -n "$TAG" ] && \
+                RESULT=$(echo "$RESULT" | jq --arg k "$SHORT" --arg v "$REGISTRY/$SHORT:$TAG" '. + {($k): $v}')
+            done
+          fi
+
+          # 2. For scopes without markers, query GHCR for latest checksum tag
+          MISSING=""
+          for scope_dir in apps/*/Dockerfile services/*/Dockerfile; do
+            [ -f "$scope_dir" ] || continue
+            SHORT=$(basename "$(dirname "$scope_dir")")
+            echo "$RESULT" | jq -e --arg k "$SHORT" '.[$k]' >/dev/null 2>&1 && continue
+
+            # Query GHCR for the latest version with a checksum tag (retry transient API errors)
+            CHECKSUM_TAG=""
+            for attempt in 1 2 3; do
+              CHECKSUM_TAG=$(curl -sf \
+                -H "Authorization: Bearer $GH_TOKEN" \
+                -H "Accept: application/vnd.github+json" \
+                "https://api.github.com/orgs/$REPO_OWNER/packages/container/${REPO_PREFIX}%2F${SHORT}/versions?per_page=50" \
+                | jq -r '[.[].metadata.container.tags[]? | select(test("^[0-9a-f]{64}$"))][0] // empty' 2>/dev/null || true)
+              [ -n "$CHECKSUM_TAG" ] && break
+              sleep 2
+            done
+
+            if [ -n "$CHECKSUM_TAG" ]; then
+              RESULT=$(echo "$RESULT" | jq --arg k "$SHORT" --arg v "$REGISTRY/$SHORT:$CHECKSUM_TAG" '. + {($k): $v}')
+              echo "  $SHORT → $CHECKSUM_TAG (from GHCR)"
+            else
+              MISSING="$MISSING $SHORT"
+            fi
+          done
+
+          if [ -n "$MISSING" ]; then
+            echo "::error::No checksum-tagged image found in GHCR for:$MISSING. Refusing to deploy :latest — trigger a build for these scopes first (workflow_dispatch builds all)."
+            exit 1
+          fi
+
+          echo "scope_image_tags=$(echo "$RESULT" | jq -c .)" >> "$GITHUB_OUTPUT"
+          echo "Resolved image tags: $RESULT"
+
+      - name: Setup Bun and install dependencies
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+          npm-token: $\{{ github.token }}
+
+      - name: Build infrastructure dependencies
+        run: |
+          bunx turbo run build --filter=@crossdelta/infrastructure --filter={{scope}}/contracts
+
+      - name: Pulumi up
+        uses: pulumi/actions@v7
+        timeout-minutes: 5
+        with:
+          command: up
+          suppress-progress: true
+          suppress-outputs: true
+          comment-on-summary: true
+          stack-name: $\{{ env.PULUMI_STACK }}
+          work-dir: infra
+        env:
+          PULUMI_ACCESS_TOKEN: $\{{ secrets.PULUMI_ACCESS_TOKEN }}
+          DIGITALOCEAN_TOKEN: $\{{ secrets.DIGITALOCEAN_TOKEN }}
+          SCOPE_IMAGE_TAGS: $\{{ steps.resolve_scope_tags.outputs.scope_image_tags }}
+
+      - name: Check if Studio was deployed
+        id: studio-deployed
+        run: |
+          if [ -f .artifacts/changed-studio/metadata.json ]; then
+            echo "deployed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "deployed=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Get Pulumi outputs
+        id: pulumi-outputs
+        if: steps.studio-deployed.outputs.deployed == 'true'
+        working-directory: infra
+        run: |
+          URL=$(pulumi stack output studioUrl --stack "$PULUMI_STACK" --non-interactive)
+          echo "studio_url=${URL}" >> "$GITHUB_OUTPUT"
+        env:
+          PULUMI_ACCESS_TOKEN: $\{{ secrets.PULUMI_ACCESS_TOKEN }}
+
+      - name: Smoke-check new Studio deployment
+        id: studio-smoke
+        if: steps.studio-deployed.outputs.deployed == 'true'
+        env:
+          STUDIO_URL: $\{{ steps.pulumi-outputs.outputs.studio_url }}
+        run: |
+          curl_opts=(-sf)
+          for i in $(seq 1 30); do
+            if curl "${curl_opts[@]}" "${STUDIO_URL}/health"; then break; fi
+            sleep 2
+          done
+          curl "${curl_opts[@]}" "${STUDIO_URL}/health" || exit 1
+

package/bin/templates/workspace/.github/workflows/lint-and-tests.yml.hbs

@@ -0,0 +1,83 @@
+name: Pull Request Checks
+
+on:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: $\{{ github.workflow }}-$\{{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Bun and install dependencies
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+
+      - name: Run Linter
+        run: bun run --if-present lint
+
+  test:
+    runs-on: ubuntu-latest
+    env:
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Bun and install dependencies
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+
+      - name: Run Tests
+        run: bun run --if-present test
+
+  e2e:
+    runs-on: ubuntu-latest
+    needs: test
+    if: false # disabled until E2E tests are stable
+    env:
+      E2E_STUDIO_EMAIL: $\{{ secrets.E2E_STUDIO_EMAIL }}
+      E2E_STUDIO_PASSWORD: $\{{ secrets.E2E_STUDIO_PASSWORD }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Setup Bun and install dependencies
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+
+      - name: Cache Playwright browsers
+        id: playwright-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-$\{{ runner.os }}-$\{{ hashFiles('apps/studio/package.json', 'apps/storefront/package.json') }}
+
+      - name: Install Playwright Browsers
+        if: env.E2E_STUDIO_EMAIL != '' && steps.playwright-cache.outputs.cache-hit != 'true'
+        run: bunx playwright install --with-deps chromium
+
+      - name: Install Playwright deps (cached)
+        if: env.E2E_STUDIO_EMAIL != '' && steps.playwright-cache.outputs.cache-hit == 'true'
+        run: bunx playwright install-deps chromium
+
+      - name: Run E2E Tests
+        if: env.E2E_STUDIO_EMAIL != ''
+        run: bunx turbo run test.e2e --concurrency=1
+        env:
+          CI: true