@crossdelta/platform-sdk 0.26.1 → 0.26.3

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to `@crossdelta/platform-sdk` will be documented in this fil
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.26.3] - 2026-10-21
+
+### Changed
+- **The workspace template's PR tests run only for affected packages.** `lint-and-tests.yml` runs
+  `turbo run test --affected` against the PR's base (the merge commit's first parent, checkout depth
+  2). A change to a root file every package reads (`package.json`, `bunfig.toml`, `tsconfig.json`,
+  `.npmrc`, `.bun-version`, `patches/`, the workflow itself or `setup-bun-install`) still tests every
+  package, because `--affected` does not count them. A PR that touches no package runs no task and passes.
+
 ## [0.26.1] - 2026-10-17
 
 ### Fixed

package/bin/templates/workspace/.github/actions/check-image-tag-exists/ghcr.js

@@ -0,0 +1,87 @@
+/**
+ * GHCR tag lookup shared by check-image-tag-exists and generate-scope-matrix.
+ *
+ * One API client for both, so the build job and the matrix ask GHCR the same question the same way.
+ * generate-scope-matrix/index.js requires this file by its relative path: moving it breaks that action.
+ */
+
+const PAGE_SIZE = 100
+
+/**
+ * Resolves the GHCR package prefix: the explicit input, else $GHCR_REPOSITORY_PREFIX, else the
+ * repository name, else 'platform'.
+ * @param {string} input - The action's repository-prefix input, possibly empty
+ * @param {Record<string, string | undefined>} env - Process environment
+ * @returns {string}
+ */
+const resolveRepositoryPrefix = (input, env) =>
+  input || env.GHCR_REPOSITORY_PREFIX || env.GITHUB_REPOSITORY?.split('/')[1] || 'platform'
+
+/**
+ * Checks if the target tag exists in a list of container versions.
+ * @param {Object[]} versions - Array of version objects from GitHub API
+ * @param {string} targetTag - The tag to search for
+ * @returns {boolean} True if tag is found
+ */
+const tagExistsInVersions = (versions, targetTag) =>
+  versions.some((version) => {
+    const tags = version?.metadata?.container?.tags
+    return Array.isArray(tags) && tags.includes(targetTag)
+  })
+
+/**
+ * Creates a GHCR client for one package owner and repository prefix.
+ * @param {Object} options
+ * @param {string} options.owner - GitHub organization that owns the container packages
+ * @param {string} options.prefix - Package prefix, e.g. 'platform' for 'platform/storefront'
+ * @param {string} options.token - Token with read:packages
+ * @param {number} [options.maxPages=5] - Pages of 100 versions to inspect before giving up
+ * @param {typeof fetch} [options.fetchImpl=fetch] - Injected for tests
+ * @returns {{tagExists: (shortName: string, tag: string) => Promise<boolean>}}
+ *   `tagExists` resolves false when the package does not exist yet (404) and rejects on any other
+ *   API error, so a caller decides itself whether an unknown answer means "build".
+ */
+const createGhcrClient = ({ owner, prefix, token, maxPages = 5, fetchImpl = fetch }) => {
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/vnd.github+json',
+    'X-GitHub-Api-Version': '2022-11-28',
+  }
+
+  const fetchVersions = async (shortName, page) => {
+    const encodedPackage = encodeURIComponent(`${prefix}/${shortName}`)
+    const url = `https://api.github.com/orgs/${owner}/packages/container/${encodedPackage}/versions?per_page=${PAGE_SIZE}&page=${page}`
+    const response = await fetchImpl(url, { headers })
+
+    // 404 means the package doesn't exist yet (first build)
+    if (response.status === 404) {
+      return { notFound: true, versions: [], hasMore: false }
+    }
+
+    if (!response.ok) {
+      const body = await response.text()
+      throw new Error(`GitHub API error (${response.status}): ${body}`)
+    }
+
+    const data = await response.json()
+    const versions = Array.isArray(data) ? data : []
+    return { notFound: false, versions, hasMore: versions.length === PAGE_SIZE }
+  }
+
+  const tagExists = async (shortName, tag) => {
+    const targetTag = tag.trim()
+
+    for (let page = 1; page <= maxPages; page += 1) {
+      const { versions, hasMore, notFound } = await fetchVersions(shortName, page)
+      if (notFound) return false
+      if (tagExistsInVersions(versions, targetTag)) return true
+      if (!hasMore) break
+    }
+
+    return false
+  }
+
+  return { tagExists }
+}
+
+module.exports = { createGhcrClient, resolveRepositoryPrefix, tagExistsInVersions }

package/bin/templates/workspace/.github/actions/check-image-tag-exists/index.js

@@ -16,6 +16,7 @@
 
 const { appendFileSync } = require('node:fs')
 const { exit } = require('node:process')
+const { createGhcrClient, resolveRepositoryPrefix } = require('./ghcr.js')
 
 /**
  * Builds environment variable keys for GitHub Actions inputs.
@@ -71,103 +72,17 @@ const githubToken = getInput('github-token', { required: true })
 
 // Optional inputs - defaults from environment for portability
 const repositoryOwner = getInput('repository-owner', { defaultValue: process.env.GITHUB_REPOSITORY_OWNER })
-const repositoryPrefixInput = getInput('repository-prefix')
-const repositoryPrefix =
-  repositoryPrefixInput || process.env.GHCR_REPOSITORY_PREFIX || process.env.GITHUB_REPOSITORY?.split('/')[1] || 'platform'
+const repositoryPrefix = resolveRepositoryPrefix(getInput('repository-prefix'), process.env)
 const maxPages = Number(getInput('max-pages', { defaultValue: '5' }))
 
-// GitHub API request headers
-const headers = {
-  Authorization: `Bearer ${githubToken}`,
-  Accept: 'application/vnd.github+json',
-  'X-GitHub-Api-Version': '2022-11-28',
-}
-
-// Construct the full package name (e.g., 'platform/storefront')
-const packageName = `${repositoryPrefix}/${scopeShortName}`
-const encodedPackage = encodeURIComponent(packageName)
-
-/**
- * Fetches a page of container versions from the GitHub Packages API.
- * @param {number} page - Page number (1-indexed)
- * @returns {Promise<Object>} Result with versions array, hasMore flag, and notFound flag
- */
-const fetchVersions = async (page) => {
-  const url = `https://api.github.com/orgs/${repositoryOwner}/packages/container/${encodedPackage}/versions?per_page=100&page=${page}`
-  const response = await fetch(url, { headers })
-
-  // 404 means the package doesn't exist yet (first build)
-  if (response.status === 404) {
-    return { notFound: true, versions: [], hasMore: false }
-  }
-
-  if (!response.ok) {
-    const body = await response.text()
-    throw new Error(`GitHub API error (${response.status}): ${body}`)
-  }
-
-  const data = await response.json()
-  const versions = Array.isArray(data) ? data : []
-  return {
-    versions,
-    hasMore: versions.length === 100, // Full page means there might be more
-    notFound: false,
-  }
-}
-
-/**
- * Checks if the target tag exists in a list of container versions.
- * @param {Object[]} versions - Array of version objects from GitHub API
- * @param {string} targetTag - The tag to search for
- * @returns {boolean} True if tag is found
- */
-const tagExistsInVersions = (versions, targetTag) => {
-  for (const version of versions) {
-    const tags = version?.metadata?.container?.tags
-    if (!Array.isArray(tags)) continue
-    if (tags.includes(targetTag)) {
-      return true
-    }
-  }
-  return false
-}
-
-/**
- * Checks if the image tag exists in GHCR by paginating through all versions.
- * @returns {Promise<boolean>} True if tag exists
- */
-const check = async () => {
-  const targetTag = imageTag.trim()
-
-  // Paginate through versions until we find the tag or run out of pages
-  for (let page = 1; page <= maxPages; page += 1) {
-    const { versions, hasMore, notFound } = await fetchVersions(page)
-
-    // Package doesn't exist yet - tag definitely doesn't exist
-    if (notFound) {
-      return false
-    }
-
-    // Check if target tag is in this page
-    if (tagExistsInVersions(versions, targetTag)) {
-      return true
-    }
-
-    // No more pages to check
-    if (!hasMore) {
-      break
-    }
-  }
-
-  return false
-}
+const ghcr = createGhcrClient({ owner: repositoryOwner, prefix: repositoryPrefix, token: githubToken, maxPages })
 
 /**
  * Main entry point - runs the check and outputs the result.
  */
 const run = async () => {
   try {
-    const exists = await check()
+    const exists = await ghcr.tagExists(scopeShortName, imageTag)
     setOutput('exists', String(exists))
   } catch (error) {
     console.error('Failed to check image tag existence:', error)

package/bin/templates/workspace/.github/actions/generate-scope-matrix/action.yml

@@ -11,11 +11,29 @@ inputs:
     description: When true, include ALL discovered scopes regardless of changes
     required: false
     default: 'false'
+  only-unbuilt:
+    description: >-
+      When true, include every scope whose checksum tag is not in GHCR yet, whatever changed.
+      Needs `bun install` before this step (the checksum prunes with the workspace's turbo) and
+      `github-token`. Ignored when force-all is true.
+    required: false
+    default: 'false'
+  github-token:
+    description: Token with read:packages, used by only-unbuilt to query GHCR
+    required: false
 outputs:
   scopes:
     description: JSON array describing scopes for the matrix strategy
   scopes_count:
     description: Number of scopes detected in the matrix
+  scope_tags:
+    description: >-
+      JSON object mapping every scope's short name to the checksum tag computed for this commit
+      (only-unbuilt); `{}` otherwise
+  tags_changed:
+    description: >-
+      'true' when a scope's checksum tag differs from the one at the diff base (GITHUB_EVENT_BEFORE),
+      even if its image exists, as after a revert (only-unbuilt); 'false' otherwise
 runs:
   using: node24
   main: index.js

package/bin/templates/workspace/.github/actions/generate-scope-matrix/index.js

@@ -13,14 +13,20 @@
  *   with:
  *     scope-roots: apps,services
  *
- * @outputs scopes - JSON array of scope objects [{name, shortName, dir, run}]
+ * With `only-unbuilt`, a scope is in the matrix when GHCR lacks its checksum tag instead of when
+ * its directory changed, and each entry carries that tag as `imageTag`.
+ *
+ * @outputs scopes - JSON array of scope objects [{name, shortName, dir, run, imageTag?}]
  * @outputs scopes_count - Number of scopes in the matrix
+ * @outputs tags_changed - 'true' when a scope's tag differs from the diff base's (only-unbuilt)
  */
 
 const { appendFileSync } = require('node:fs')
 const { spawnSync } = require('node:child_process')
-const { existsSync, readdirSync, readFileSync, statSync } = require('node:fs')
+const { existsSync, readdirSync, readFileSync, statSync, symlinkSync } = require('node:fs')
 const { basename, join, relative } = require('node:path')
+const { createGhcrClient, resolveRepositoryPrefix } = require('../check-image-tag-exists/ghcr.js')
+const { changedScopeTags, scopeTagMap, selectUnbuilt } = require('./select.js')
 
 /** Default directories to scan for scopes (Turborepo convention) */
 const defaultRoots = ['apps', 'services']
@@ -317,13 +323,144 @@ const hasGitDiffChanges = (dir, changedFilesFromEvent, beforeRef, headRef) => {
 const scopeHasChanges = (scopeDir, changedFilesFromEvent, beforeRef, headRef) =>
   hasGitDiffChanges(scopeDir, changedFilesFromEvent, beforeRef, headRef)
 
+/**
+ * Checks if a boolean input is enabled.
+ * @param {string} name - Input name as defined in action.yml
+ * @returns {boolean} True for 'true', '1' or 'yes'
+ */
+const isEnabled = (name) => {
+  const value = getInput(name)
+  return value === 'true' || value === '1' || value === 'yes'
+}
+
 /**
  * Checks if the force-all input is enabled.
  * @returns {boolean} True if all scopes should be force-included
  */
-const isForceAll = () => {
-  const value = getInput('force-all')
-  return value === 'true' || value === '1' || value === 'yes'
+const isForceAll = () => isEnabled('force-all')
+
+/**
+ * Prunes a scope and computes its checksum tag through the script the build job runs.
+ * @param {{name: string, shortName: string, dir: string}} scope - Scope to checksum
+ * @param {string} [cwd=process.cwd()] - Workspace root to prune from
+ * @returns {string} The scope's image tag
+ */
+const computeScopeChecksum = (scope, cwd = process.cwd()) => {
+  const script = join(__dirname, 'scope-checksum.sh')
+  // The GHCR token stays out of turbo's environment: the prune needs no credentials.
+  const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !/^INPUT_GITHUB[-_]TOKEN$/i.test(key)))
+  const result = spawnSync('bash', [script, scope.name, scope.shortName, scope.dir], {
+    cwd,
+    encoding: 'utf8',
+    env,
+    stdio: ['ignore', 'pipe', 'inherit'],
+  })
+
+  if (result.error || result.status !== 0) {
+    throw new Error(`Checksum for ${scope.name} failed (exit ${result.status}): ${result.error ?? ''}`)
+  }
+
+  return result.stdout.trim()
+}
+
+/**
+ * Looks up every scope's checksum tag in GHCR. An unanswered lookup counts as missing, so the
+ * scope is built: the build job checks the tag again before it pushes.
+ * @param {Map} scopeMap - Discovered scopes
+ * @returns {Promise<Array<{scope: Object, imageTag: string, exists: boolean}>>}
+ */
+const lookupScopeTags = async (scopeMap) => {
+  const ghcr = createGhcrClient({
+    owner: process.env.GITHUB_REPOSITORY_OWNER,
+    prefix: resolveRepositoryPrefix('', process.env),
+    token: getInput('github-token'),
+  })
+  const lookups = []
+
+  for (const scope of scopeMap.values()) {
+    const imageTag = computeScopeChecksum(scope)
+    const exists = await ghcr.tagExists(scope.shortName, imageTag).catch((error) => {
+      console.warn(`GHCR lookup for ${scope.shortName} failed, building it:`, error)
+      return false
+    })
+    console.log(`${scope.shortName} ${imageTag} ${exists ? 'exists' : 'missing'}`)
+    lookups.push({ scope, imageTag, exists })
+  }
+
+  return lookups
+}
+
+/**
+ * Runs git and throws with its stderr when it fails.
+ * @param {string[]} args - git arguments
+ */
+const runGit = (args) => {
+  const result = spawnSync('git', args, { encoding: 'utf8' })
+  if (result.error || result.status !== 0) {
+    throw new Error(`git ${args.join(' ')} failed: ${result.error ?? result.stderr}`)
+  }
+}
+
+/**
+ * Checks out the base commit into a temporary worktree that borrows this checkout's node_modules
+ * for turbo.
+ * @param {string} baseDir - Worktree directory
+ * @param {string} baseRef - Commit to check out
+ * @returns {boolean} False when the worktree could not be created (it is then removed again)
+ */
+const addBaseTree = (baseDir, baseRef) => {
+  try {
+    runGit(['worktree', 'add', '--detach', '--force', baseDir, baseRef])
+  } catch (error) {
+    console.warn(`No base tree at ${baseRef}, counting every scope as changed:`, error.message)
+    return false
+  }
+  try {
+    symlinkSync(join(process.cwd(), 'node_modules'), join(baseDir, 'node_modules'))
+    return true
+  } catch (error) {
+    console.warn('No node_modules in the base tree, counting every scope as changed:', error.message)
+    removeBaseTree(baseDir)
+    return false
+  }
+}
+
+/**
+ * Removes the temporary worktree; a failure only warns, the tags are computed by then.
+ * @param {string} baseDir - Worktree directory
+ */
+const removeBaseTree = (baseDir) => {
+  try {
+    runGit(['worktree', 'remove', '--force', baseDir])
+  } catch (error) {
+    console.warn('Could not remove the base tree:', error.message)
+  }
+}
+
+/**
+ * Computes every scope's checksum tag at the base commit, in a temporary worktree under out/. A
+ * scope the base cannot checksum (absent there, renamed) is left out and so counts as changed;
+ * without a base tree every scope does, so the deploy runs.
+ * @param {Map} scopeMap - Discovered scopes
+ * @param {string} baseRef - Diff base commit
+ * @returns {Record<string, string>} Short name → tag at the base
+ */
+const computeBaseScopeTags = (scopeMap, baseRef) => {
+  const baseDir = join(process.cwd(), 'out', '.base-tree')
+  if (!addBaseTree(baseDir, baseRef)) return {}
+  try {
+    const tags = {}
+    for (const scope of scopeMap.values()) {
+      try {
+        tags[scope.shortName] = computeScopeChecksum(scope, baseDir)
+      } catch (error) {
+        console.warn(`No base tag for ${scope.shortName}, counting it as changed:`, error.message)
+      }
+    }
+    return tags
+  } finally {
+    removeBaseTree(baseDir)
+  }
 }
 
 /**
@@ -358,13 +495,39 @@ const buildMatrix = (scopeMap, changedFilesFromEvent, beforeRef, headRef, forced
   return [...base, ...forced]
 }
 
-// Main execution
-const roots = loadRoots()
-const scopeMap = discoverScopes(roots)
-const changedFilesFromEvent = loadEventChangedFiles(process.env.GITHUB_EVENT_PATH)
-const { beforeRef, headRef } = getCommitRefs()
-const forcedShortNames = loadForcedShortNames()
-const matrix = buildMatrix(scopeMap, changedFilesFromEvent, beforeRef, headRef, forcedShortNames)
+/**
+ * Builds the matrix: with only-unbuilt, every scope whose checksum tag GHCR lacks, every scope's
+ * computed tag and the scopes whose tag differs from the base's; otherwise the changed scopes (or
+ * all with force-all), no tags and no tag changes.
+ * @returns {Promise<{matrix: Object[], scopeTags: Record<string, string>, changedTags: string[]}>}
+ */
+const resolveMatrix = async () => {
+  const scopeMap = discoverScopes(loadRoots())
+  const forcedShortNames = loadForcedShortNames()
+  const { beforeRef, headRef } = getCommitRefs()
+
+  if (isEnabled('only-unbuilt') && !isForceAll()) {
+    const lookups = await lookupScopeTags(scopeMap)
+    const scopeTags = scopeTagMap(lookups)
+    const baseScopeTags = beforeRef ? computeBaseScopeTags(scopeMap, beforeRef) : {}
+    const changedTags = changedScopeTags(scopeTags, baseScopeTags)
+    console.log(`Tags changed since ${beforeRef ?? 'no base'}: ${changedTags.join(' ') || 'none'}`)
+    return { matrix: selectUnbuilt(lookups, forcedShortNames), scopeTags, changedTags }
+  }
+
+  const changedFilesFromEvent = loadEventChangedFiles(process.env.GITHUB_EVENT_PATH)
+  const matrix = buildMatrix(scopeMap, changedFilesFromEvent, beforeRef, headRef, forcedShortNames)
+  return { matrix, scopeTags: {}, changedTags: [] }
+}
 
-setOutput('scopes', JSON.stringify(matrix))
-setOutput('scopes_count', String(matrix.length))
+resolveMatrix()
+  .then(({ matrix, scopeTags, changedTags }) => {
+    setOutput('scopes', JSON.stringify(matrix))
+    setOutput('scopes_count', String(matrix.length))
+    setOutput('scope_tags', JSON.stringify(scopeTags))
+    setOutput('tags_changed', String(changedTags.length > 0))
+  })
+  .catch((error) => {
+    console.error('Failed to generate the scope matrix:', error)
+    process.exit(1)
+  })

package/bin/templates/workspace/.github/actions/generate-scope-matrix/scope-checksum.js

@@ -0,0 +1,81 @@
+/**
+ * Usage: node scope-checksum.js <pruned-out-dir> <scope-dir>
+ *
+ * Prints the checksum of a pruned scope (out/<short-name>) over its git-tracked files, without the
+ * workspaces the scope does not reach: their directories under json/ and full/ and their blocks in
+ * bun.lock. Called by scope-checksum.sh from the workspace root after `turbo prune`.
+ */
+
+const { execFileSync } = require('node:child_process')
+const { createHash } = require('node:crypto')
+const { lstatSync, readdirSync, readFileSync } = require('node:fs')
+const { join, relative, sep } = require('node:path')
+const {
+  checksumOf,
+  foreignWorkspaces,
+  isForeignPath,
+  isSourcePath,
+  stripLockWorkspaces,
+  workspaceManifest,
+} = require('./scope-tree.js')
+
+/**
+ * Lists the regular files below a directory, like `find -type f`: symlinks are not followed or listed.
+ * @param {string} root - Directory to walk
+ * @returns {string[]} Paths relative to root, '/'-separated
+ */
+const listFiles = (root) => {
+  const files = []
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir)) {
+      const path = join(dir, entry)
+      const stats = lstatSync(path)
+      if (stats.isDirectory()) walk(path)
+      else if (stats.isFile()) files.push(relative(root, path).split(sep).join('/'))
+    }
+  }
+  walk(root)
+  return files
+}
+
+/**
+ * Reads every workspace manifest of the pruned tree's json/ half, the root manifest excluded.
+ * @param {string} outDir - out/<short-name>
+ * @param {string[]} files - Files of outDir
+ * @returns {Map<string, import('./scope-tree.js').WorkspaceManifest>}
+ */
+const readManifests = (outDir, files) =>
+  new Map(
+    files
+      .filter((path) => path.startsWith('json/') && path.endsWith('/package.json') && !path.includes('/node_modules/'))
+      .filter((path) => path !== 'json/package.json')
+      .map((path) => [
+        path.slice('json/'.length, -'/package.json'.length),
+        workspaceManifest(JSON.parse(readFileSync(join(outDir, path), 'utf8'))),
+      ]),
+  )
+
+const sha256 = (content) => createHash('sha256').update(content).digest('hex')
+
+/**
+ * Lists the files git tracks in the current directory, which must be the workspace root.
+ * @returns {Set<string>} '/'-separated paths
+ */
+const readTrackedPaths = () =>
+  new Set(execFileSync('git', ['ls-files', '-z'], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 }).split('\0').filter(Boolean))
+
+const [outDir, scopeDir] = process.argv.slice(2)
+const files = listFiles(outDir)
+const trackedPaths = readTrackedPaths()
+const foreignDirs = foreignWorkspaces(scopeDir, readManifests(outDir, files))
+const entries = files
+  .filter((path) => isSourcePath(path, trackedPaths))
+  .filter((path) => !isForeignPath(path, foreignDirs))
+  .map((path) => {
+    const content = readFileSync(join(outDir, path))
+    const isLock = path === 'bun.lock' || path.endsWith('/bun.lock')
+    return { path, digest: sha256(isLock ? stripLockWorkspaces(content.toString('utf8'), foreignDirs) : content) }
+  })
+
+console.error(`${scopeDir}: left out of the checksum: ${foreignDirs.join(', ') || 'nothing'}`)
+console.log(checksumOf(entries))

package/bin/templates/workspace/.github/actions/generate-scope-matrix/scope-checksum.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Usage: scope-checksum.sh <scope-name> <scope-short-name> <scope-dir>
+#
+# Prunes one scope into out/<short-name> and prints its checksum, which is the scope's image tag.
+# Workspaces the scope does not depend on (scope-checksum.js) stay in the build context but not in
+# the checksum.
+# The build job and generate-scope-matrix (only-unbuilt) both call this script, so the tag the
+# matrix looks up in GHCR is the tag the build job pushes. Run from the workspace root after
+# `bun install`: `bunx` must resolve the workspace's own turbo, another version prunes differently.
+set -euo pipefail
+
+SCOPE_NAME="$1"
+SHORT_NAME="$2"
+SCOPE_DIR="$3"
+OUT_DIR="out/${SHORT_NAME}"
+
+bunx turbo prune --scope="${SCOPE_NAME}" --docker --out-dir "${OUT_DIR}" >&2
+# turbo prune omits the bun patchedDependencies patch files. Copy them into the
+# pruned context so `bun install` can apply them (rxdb patch for studio/storefront).
+# Done before the scope checksum so a patch change busts the image tag.
+if [ -d patches ]; then
+  cp -rT patches "${OUT_DIR}/full/patches"
+fi
+
+node "$(dirname "$0")/scope-checksum.js" "${OUT_DIR}" "${SCOPE_DIR}"

package/bin/templates/workspace/.github/actions/generate-scope-matrix/scope-tree.js

@@ -0,0 +1,148 @@
+/**
+ * Pure functions behind a scope's checksum: which workspaces of a pruned tree the scope reaches,
+ * and how the remaining files hash into the image tag.
+ *
+ * `turbo prune` also copies every workspace the root package.json depends on (tool packages such
+ * as a CLI), so without this a release of such a package changed every scope's tag.
+ */
+
+const { createHash } = require('node:crypto')
+
+/**
+ * @typedef {{name: string, dependencies: string[]}} WorkspaceManifest
+ */
+
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
+const PRUNED_TREES = ['json', 'full']
+const WORKSPACE_BLOCK_INDENT = '    '
+
+/**
+ * Reduces a parsed package.json to its name and the names of everything it depends on. Every
+ * dependency field counts and the version spec does not matter, so a workspace linked by version
+ * instead of `workspace:` stays in the closure.
+ * @param {Object} packageJson - Parsed package.json
+ * @returns {WorkspaceManifest}
+ */
+const workspaceManifest = (packageJson) => ({
+  name: packageJson.name,
+  dependencies: DEPENDENCY_FIELDS.flatMap((field) => Object.keys(packageJson[field] ?? {})),
+})
+
+/**
+ * Collects the workspaces a scope reaches through its own dependencies, transitively, itself included.
+ * @param {string} scopeDir - The scope's workspace directory, e.g. 'apps/web'
+ * @param {Map<string, WorkspaceManifest>} manifestsByDir - Every workspace of the pruned tree by directory
+ * @returns {Set<string>} Workspace directories
+ */
+const dependencyClosure = (scopeDir, manifestsByDir) => {
+  if (!manifestsByDir.has(scopeDir)) {
+    throw new Error(`No manifest for ${scopeDir} in the pruned tree`)
+  }
+
+  const dirsByName = new Map([...manifestsByDir].map(([dir, manifest]) => [manifest.name, dir]))
+  const reached = new Set()
+  const pending = [scopeDir]
+
+  while (pending.length > 0) {
+    const dir = pending.pop()
+    if (reached.has(dir)) continue
+    reached.add(dir)
+    for (const name of manifestsByDir.get(dir).dependencies) {
+      const dependencyDir = dirsByName.get(name)
+      if (dependencyDir) pending.push(dependencyDir)
+    }
+  }
+
+  return reached
+}
+
+/**
+ * Lists the workspaces of a pruned tree the scope does not reach.
+ * @param {string} scopeDir - The scope's workspace directory
+ * @param {Map<string, WorkspaceManifest>} manifestsByDir - Every workspace of the pruned tree by directory
+ * @returns {string[]} Workspace directories, sorted
+ */
+const foreignWorkspaces = (scopeDir, manifestsByDir) => {
+  const closure = dependencyClosure(scopeDir, manifestsByDir)
+  return [...manifestsByDir.keys()].filter((dir) => !closure.has(dir)).sort()
+}
+
+/**
+ * Checks if a path of the pruned tree belongs to a foreign workspace.
+ * @param {string} path - Path relative to out/<scope>, without './'
+ * @param {string[]} foreignDirs - Foreign workspace directories
+ * @returns {boolean}
+ */
+const isForeignPath = (path, foreignDirs) =>
+  PRUNED_TREES.some((tree) => foreignDirs.some((dir) => path.startsWith(`${tree}/${dir}/`)))
+
+/**
+ * Checks if a file of the pruned tree is a copy of a git-tracked source file. `turbo prune` also
+ * copies ignored files such as `dist/` and `.turbo/` logs, which the CI's `bun install` builds anew
+ * on every run; hashing them changed every scope's tag on every run. Files outside json/ and full/
+ * (the pruned bun.lock) are turbo's own output and always count.
+ * @param {string} path - Path relative to out/<scope>, without './'
+ * @param {Set<string>} trackedPaths - `git ls-files` of the workspace root
+ * @returns {boolean}
+ */
+const isSourcePath = (path, trackedPaths) => {
+  const tree = PRUNED_TREES.find((name) => path.startsWith(`${name}/`))
+  return tree === undefined || trackedPaths.has(path.slice(tree.length + 1))
+}
+
+/**
+ * Removes the blocks of the given workspaces from the `workspaces` section of a bun.lock. The rest
+ * of the file is returned byte for byte.
+ * @param {string} lockText - bun.lock content
+ * @param {string[]} foreignDirs - Workspace directories whose blocks go
+ * @returns {string}
+ */
+const stripLockWorkspaces = (lockText, foreignDirs) => {
+  const blockStarts = new Set(foreignDirs.map((dir) => `${WORKSPACE_BLOCK_INDENT}"${dir}": {`))
+  const blockEnd = new RegExp(`^${WORKSPACE_BLOCK_INDENT}},?$`)
+  const kept = []
+  let inWorkspaces = false
+  let skipping = false
+
+  for (const line of lockText.split('\n')) {
+    if (line === '  "workspaces": {') inWorkspaces = true
+    else if (inWorkspaces && /^ {2}},?$/.test(line)) inWorkspaces = false
+
+    if (skipping) {
+      if (blockEnd.test(line)) skipping = false
+      continue
+    }
+    if (inWorkspaces && blockStarts.has(line)) {
+      skipping = true
+      continue
+    }
+    kept.push(line)
+  }
+
+  return kept.join('\n')
+}
+
+/**
+ * Hashes file digests the way `find . -type f | sort | xargs sha256sum | sha256sum` does, with the
+ * paths sorted by bytes so the order does not depend on the runner's locale.
+ * @param {Array<{path: string, digest: string}>} entries - Paths relative to out/<scope>, without './'
+ * @returns {string} Hex sha256
+ */
+const checksumOf = (entries) => {
+  const listing = entries
+    .map(({ path, digest }) => ({ path: `./${path}`, digest }))
+    .sort((a, b) => Buffer.compare(Buffer.from(a.path), Buffer.from(b.path)))
+    .map(({ path, digest }) => `${digest}  ${path}\n`)
+    .join('')
+  return createHash('sha256').update(listing).digest('hex')
+}
+
+module.exports = {
+  checksumOf,
+  dependencyClosure,
+  foreignWorkspaces,
+  isForeignPath,
+  isSourcePath,
+  stripLockWorkspaces,
+  workspaceManifest,
+}

package/bin/templates/workspace/.github/actions/generate-scope-matrix/select.js

@@ -0,0 +1,47 @@
+/**
+ * Pure selection for the only-unbuilt matrix: which scopes still need an image.
+ */
+
+/**
+ * @typedef {{name: string, dir: string, shortName: string}} Scope
+ * @typedef {{scope: Scope, imageTag: string, exists: boolean}} TagLookup
+ * @typedef {Scope & {run: true, imageTag: string}} MatrixEntry
+ */
+
+/**
+ * Keeps the scopes whose checksum tag GHCR does not hold yet, plus every forced scope.
+ * Each entry carries the `imageTag` it looked up, so the build job can warn when its own checksum differs.
+ * @param {TagLookup[]} lookups - One entry per discovered scope; `exists` is false when GHCR could not answer
+ * @param {string[]} [forcedShortNames=[]] - Short names included even when their image exists
+ * @returns {MatrixEntry[]} Matrix entries sorted by scope name
+ */
+const selectUnbuilt = (lookups, forcedShortNames = []) => {
+  const forced = new Set(forcedShortNames)
+  return lookups
+    .filter(({ scope, exists }) => !exists || forced.has(scope.shortName))
+    .map(({ scope, imageTag }) => ({ ...scope, run: true, imageTag }))
+    .sort((a, b) => a.name.localeCompare(b.name))
+}
+
+/**
+ * Maps every scope's short name to the tag computed for this commit, whether it was built or not.
+ * The deploy reads it for scopes without a build marker, so an image that already existed (after a
+ * revert, say) deploys by this commit's tag instead of by GHCR's newest checksum tag.
+ * @param {TagLookup[]} lookups - One entry per discovered scope
+ * @returns {Record<string, string>} Short name → image tag
+ */
+const scopeTagMap = (lookups) => Object.fromEntries(lookups.map(({ scope, imageTag }) => [scope.shortName, imageTag]))
+
+/**
+ * Lists the scopes whose tag differs from the one computed at the diff base. A revert lands on an
+ * image GHCR already holds, so the matrix stays empty; this list is what still makes it deploy.
+ * @param {Record<string, string>} scopeTags - Short name → tag at this commit
+ * @param {Record<string, string>} baseScopeTags - Short name → tag at the base; a scope missing here counts as changed
+ * @returns {string[]} Short names, sorted
+ */
+const changedScopeTags = (scopeTags, baseScopeTags) =>
+  Object.keys(scopeTags)
+    .filter((shortName) => scopeTags[shortName] !== baseScopeTags[shortName])
+    .sort()
+
+module.exports = { changedScopeTags, scopeTagMap, selectUnbuilt }

package/bin/templates/workspace/.github/workflows/build-and-deploy.yml.hbs

@@ -95,22 +95,71 @@ jobs:
     needs: gate
     if: needs.gate.outputs.proceed == 'true'
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      packages: read
     outputs:
       scopes: $\{{ steps.scope-generator.outputs.scopes }}
       scope_count: $\{{ steps.scope-generator.outputs.scopes_count }}
+      scope_tags: $\{{ steps.scope-generator.outputs.scope_tags }}
+      tags_changed: $\{{ steps.scope-generator.outputs.tags_changed }}
       infrastructure_changed: $\{{ steps.infra-eval.outputs.changed }}
+      force_deploy: $\{{ steps.commit-range.outputs.force_deploy }}
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           ref: $\{{ env.WORKFLOW_HEAD_SHA }}
 
+      # A workflow_run event carries no `before`. Its base is the head of the last successful run on
+      # main whose Prepare Scopes job ran, so a push of several commits or a commit whose publish run
+      # failed still shows its changes. A run the gate stopped does not count: it never looked at the
+      # diff. Manual dispatches do not count either: they may have targeted another environment.
+      #
+      # An image in GHCR is not an image on stage: a failed run since that base may have pushed images
+      # it never deployed, and the next run would find them built and skip the deploy. Any failed or
+      # cancelled run since the base, or no base at all (HEAD^ fallback), therefore forces a deploy.
       - name: Set commit range
+        id: commit-range
+        env:
+          GH_TOKEN: $\{{ github.token }}
+          EVENT_NAME: $\{{ github.event_name }}
+          WORKFLOW_FILE: build-and-deploy.yml
+          PREPARE_JOB_NAME: 🧪 Prepare Scopes
         run: |
           set -euo pipefail
           HEAD_SHA="${WORKFLOW_HEAD_SHA}"
           BASE_SHA="${WORKFLOW_BASE_SHA_INPUT}"
           NULL_SHA="0000000000000000000000000000000000000000"
+          FORCE_DEPLOY=false
+          if [ "$EVENT_NAME" = "workflow_run" ]; then
+            RUNS=$(gh run list -R "$GITHUB_REPOSITORY" --workflow "$WORKFLOW_FILE" --branch main --status completed --limit 30 \
+              --json databaseId,headSha,conclusion,event --jq '.[] | "\(.databaseId) \(.headSha) \(.conclusion) \(.event)"' \
+              || echo "::warning::Could not list earlier runs.")
+            while read -r RUN_ID RUN_SHA RUN_CONCLUSION RUN_EVENT; do
+              [ -n "$RUN_ID" ] || continue
+              [ "$RUN_EVENT" != "workflow_dispatch" ] || continue
+              git merge-base --is-ancestor "$RUN_SHA" "$HEAD_SHA" 2>/dev/null || continue
+              if [ "$RUN_CONCLUSION" != "success" ]; then
+                FORCE_DEPLOY=true
+                echo "Run $RUN_ID at $RUN_SHA ended $RUN_CONCLUSION: deploying regardless of the matrix"
+                continue
+              fi
+              PREPARED=$(gh run view "$RUN_ID" -R "$GITHUB_REPOSITORY" --json jobs \
+                --jq "[.jobs[] | select(.name == \"$PREPARE_JOB_NAME\" and .conclusion == \"success\")] | length" || echo 0)
+              if [ "$PREPARED" != "0" ]; then
+                BASE_SHA="$RUN_SHA"
+                echo "Base: last prepared run $RUN_ID at $RUN_SHA"
+                break
+              fi
+            done <<< "$RUNS"
+            if [ -z "$BASE_SHA" ]; then
+              FORCE_DEPLOY=true
+              echo "::warning::No earlier prepared run on main found; diffing against HEAD^ and deploying."
+            fi
+          fi
+          echo "force_deploy=$FORCE_DEPLOY" >> "$GITHUB_OUTPUT"
           if [ -z "$BASE_SHA" ] || [ "$BASE_SHA" = "$NULL_SHA" ]; then
             if git rev-parse "${HEAD_SHA}^" >/dev/null 2>&1; then
               BASE_SHA=$(git rev-parse "${HEAD_SHA}^")
@@ -121,10 +170,15 @@ jobs:
           echo "GITHUB_SHA=$HEAD_SHA" >> "$GITHUB_ENV"
           echo "GITHUB_EVENT_BEFORE=$BASE_SHA" >> "$GITHUB_ENV"
 
+      # The stack's own directory plus the workspace packages it imports. Those packages only ever
+      # change on the workflow_run path: a push touching packages/ is handed to the publish run.
       - name: Check for infrastructure changes
         id: infra-check
+        env:
+          INFRA_PATHS: infra/ packages/infrastructure/ packages/contracts/ packages/cloudevents/
         run: |
-          CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- infra/ | head -1)
+          # shellcheck disable=SC2086 # INFRA_PATHS is a space-separated pathspec list
+          CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- $INFRA_PATHS | head -1)
           if [ -n "$CHANGED" ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
@@ -134,18 +188,44 @@ jobs:
       - name: Evaluate infrastructure change
         id: infra-eval
         run: |
-          if [ "$\{{ github.event_name }}" = "workflow_run" ] || [ "$\{{ github.event_name }}" = "workflow_dispatch" ] || [ "$\{{ steps.infra-check.outputs.changed }}" = "true" ]; then
+          if [ "$\{{ github.event_name }}" = "workflow_dispatch" ] || [ "$\{{ steps.infra-check.outputs.changed }}" = "true" ]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
           else
             echo "changed=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # A private workspace package or a lockfile line reaches a scope without
+      # touching its directory. On those paths the matrix asks GHCR whether each scope's checksum
+      # tag exists instead of diffing directories; a tool-package bump that changes no scope's
+      # pruned tree then builds and deploys nothing. A manual dispatch keeps building every scope.
+      - name: Decide matrix mode
+        id: matrix-mode
+        run: |
+          EVENT="$\{{ github.event_name }}"
+          LOCK_CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- bun.lock | head -1)
+          if [ "$EVENT" != "workflow_dispatch" ] && { [ "$EVENT" = "workflow_run" ] || [ -n "$LOCK_CHANGED" ]; }; then
+            echo "only_unbuilt=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "only_unbuilt=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Setup Bun and install dependencies
+        if: steps.matrix-mode.outputs.only_unbuilt == 'true'
+        uses: ./.github/actions/setup-bun-install
+        with:
+          enable-cache: 'true'
+          cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
+          cache-restore-keys: bun-v4-$\{{ runner.os }}-
+          npm-token: $\{{ github.token }}
+
       - name: Generate scope matrix
         id: scope-generator
         uses: ./.github/actions/generate-scope-matrix
         with:
           scope-roots: $\{{ env.SCOPE_ROOTS }}
-          force-all: $\{{ github.event_name == 'workflow_dispatch' || github.event_name == 'workflow_run' }}
+          force-all: $\{{ github.event_name == 'workflow_dispatch' }}
+          only-unbuilt: $\{{ steps.matrix-mode.outputs.only_unbuilt }}
+          github-token: $\{{ secrets.GITHUB_TOKEN }}
 
   build:
     if: needs.prepare-scopes.outputs.scope_count && needs.prepare-scopes.outputs.scope_count != '0'
@@ -182,27 +262,30 @@ jobs:
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
           npm-token: $\{{ github.token }}
 
-      - name: Prune
-        run: |
-          bunx turbo prune --scope=$\{{ matrix.scope.name }} --docker --out-dir out/$\{{ matrix.scope.shortName }}
-          # turbo prune omits the bun patchedDependencies patch files. Copy them into the
-          # pruned context so `bun install` can apply them (rxdb patch for studio/storefront).
-          # Done before the scope checksum so a patch change busts the image tag.
-          if [ -d patches ]; then
-            cp -rT patches "out/$\{{ matrix.scope.shortName }}/full/patches"
-          fi
-
-      - name: Compute scope checksum
+      # The same script computes the tag prepare-scopes looked up (only-unbuilt), so both agree. It
+      # also leaves the pruned tree in out/<short-name>, which the Docker build below uses.
+      - name: Prune and compute scope checksum
         id: scope-checksum
+        env:
+          SCOPE_NAME: $\{{ matrix.scope.name }}
+          SCOPE_SHORT_NAME: $\{{ matrix.scope.shortName }}
+          SCOPE_DIR: $\{{ matrix.scope.dir }}
         run: |
           set -euo pipefail
-          cd "out/$\{{ matrix.scope.shortName }}"
-          HASH=$(find . -type f -print0 | sort -z | xargs -0 sha256sum | sha256sum)
-          HASH=${HASH%% *}
+          HASH=$(bash .github/actions/generate-scope-matrix/scope-checksum.sh "$SCOPE_NAME" "$SCOPE_SHORT_NAME" "$SCOPE_DIR")
           echo "scope_hash=$HASH" >> $GITHUB_OUTPUT
 
+      # The tag names what this job built. A matrix tag that differs means the pruned tree changed
+      # between the two jobs; the image then carries this job's tag, never the looked-up one.
       - name: Use scope checksum as image tag
-        run: echo "IMAGE_TAG=$\{{ steps.scope-checksum.outputs.scope_hash }}" >> $GITHUB_ENV
+        env:
+          MATRIX_TAG: $\{{ matrix.scope.imageTag }}
+          SCOPE_HASH: $\{{ steps.scope-checksum.outputs.scope_hash }}
+        run: |
+          if [ -n "$MATRIX_TAG" ] && [ "$MATRIX_TAG" != "$SCOPE_HASH" ]; then
+            echo "::warning::$\{{ matrix.scope.shortName }}: checksum $SCOPE_HASH differs from the matrix tag $MATRIX_TAG"
+          fi
+          echo "IMAGE_TAG=$SCOPE_HASH" >> $GITHUB_ENV
 
       - name: Check if image tag exists
         id: tag-check
@@ -275,12 +358,17 @@ jobs:
     # deploy the newest checksum image GHCR holds for them — an older commit, possibly a stage
     # build. That happened on 2026-09-17 (run 35254568199): four app builds cancelled, deploy
     # went ahead on the previous commit's images.
+    # `tags_changed` covers a revert: its tag is an older image GHCR still holds, so nothing is
+    # built, but stage runs the reverted one.
     if: |
       always() &&
       needs.gate.outputs.proceed == 'true' &&
       needs.prepare-scopes.result == 'success' &&
       (needs.build.result == 'success' || needs.build.result == 'skipped') &&
-      (needs.prepare-scopes.outputs.scope_count != '0' || needs.prepare-scopes.outputs.infrastructure_changed == 'true')
+      (needs.prepare-scopes.outputs.scope_count != '0' ||
+        needs.prepare-scopes.outputs.tags_changed == 'true' ||
+        needs.prepare-scopes.outputs.force_deploy == 'true' ||
+        needs.prepare-scopes.outputs.infrastructure_changed == 'true')
     name: 🌍 Deploy ($\{{ github.event.inputs.environment || 'stage' }})
     environment: $\{{ github.event.inputs.environment || 'stage' }}
     steps:
@@ -317,6 +405,7 @@ jobs:
           GH_TOKEN: $\{{ secrets.GITHUB_TOKEN }}
           REPO_OWNER: $\{{ github.repository_owner }}
           REPO_PREFIX: $\{{ github.event.repository.name }}
+          COMPUTED_TAGS: $\{{ needs.prepare-scopes.outputs.scope_tags || '{}' }}
         run: |
           set -euo pipefail
           RESULT="{}"
@@ -332,13 +421,22 @@ jobs:
             done
           fi
 
-          # 2. For scopes without markers, query GHCR for latest checksum tag
+          # 2. For scopes without markers: this commit's computed tag, else GHCR's latest checksum tag
           MISSING=""
           for scope_dir in apps/*/Dockerfile services/*/Dockerfile; do
             [ -f "$scope_dir" ] || continue
             SHORT=$(basename "$(dirname "$scope_dir")")
             echo "$RESULT" | jq -e --arg k "$SHORT" '.[$k]' >/dev/null 2>&1 && continue
 
+            # A scope prepare-scopes found already built carries this commit's tag: after a revert
+            # that is an older image, and GHCR's newest checksum tag would roll out the reverted one.
+            COMPUTED_TAG=$(jq -r --arg k "$SHORT" '.[$k] // empty' <<<"$COMPUTED_TAGS")
+            if [ -n "$COMPUTED_TAG" ]; then
+              RESULT=$(echo "$RESULT" | jq --arg k "$SHORT" --arg v "$REGISTRY/$SHORT:$COMPUTED_TAG" '. + {($k): $v}')
+              echo "  $SHORT → $COMPUTED_TAG (computed for this commit)"
+              continue
+            fi
+
             # Query GHCR for the latest version with a checksum tag (retry transient API errors)
             CHECKSUM_TAG=""
             for attempt in 1 2 3; do

package/bin/templates/workspace/.github/workflows/lint-and-tests.yml.hbs

@@ -12,6 +12,7 @@ concurrency:
 jobs:
   lint:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -36,10 +37,15 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     env:
     steps:
+      # A pull_request run checks out the PR merged into its base; depth 2 brings that merge
+      # commit's first parent, the base, which the test scope is diffed against.
       - name: Checkout code
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 2
 
       - name: Setup Bun and install dependencies
         uses: ./.github/actions/setup-bun-install
@@ -48,11 +54,39 @@ jobs:
           cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
 
+      # `turbo run test --affected` tests the changed packages and their dependents, all of them
+      # for a turbo.json or lockfile change. It ignores the root files every package reads, though:
+      # an override, the Bun version or the test script in the root package.json selects nothing.
+      # Those paths test every package. A PR that touches no package runs no task and passes.
+      - name: Decide test scope
+        id: test-scope
+        env:
+          GLOBAL_PATHS: package.json bunfig.toml tsconfig.json .npmrc .bun-version patches/ .github/workflows/lint-and-tests.yml .github/actions/setup-bun-install/
+        run: |
+          # shellcheck disable=SC2086 # GLOBAL_PATHS is a space-separated pathspec list
+          CHANGED=$(git diff --name-only HEAD^1 HEAD -- $GLOBAL_PATHS | head -1)
+          if [ -n "$CHANGED" ]; then
+            echo "::notice::${CHANGED} changed: testing every package."
+            echo "affected_only=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "affected_only=true" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Run Tests
-        run: bun run --if-present test
+        env:
+          AFFECTED_ONLY: $\{{ steps.test-scope.outputs.affected_only }}
+          TURBO_SCM_BASE: HEAD^1
+          TURBO_SCM_HEAD: HEAD
+        run: |
+          if [ "$AFFECTED_ONLY" = "true" ]; then
+            bun run --if-present test --affected
+          else
+            bun run --if-present test
+          fi
 
   e2e:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     needs: test
     if: false # disabled until E2E tests are stable
     env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/platform-sdk",
-  "version": "0.26.1",
+  "version": "0.26.3",
   "description": "Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.",
   "keywords": [
     "cli",