@crossdelta/platform-sdk 0.26.10 → 0.26.12

package/CHANGELOG.md

@@ -5,6 +5,41 @@ All notable changes to `@crossdelta/platform-sdk` will be documented in this fil
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.26.12] - 2026-10-28
+
+### Fixed
+- **`check-image-tag-exists` finds existing tags again.** The runner sets the `repository-owner`
+  input, declared without a default, to an empty string, which skipped the fallback to
+  `$GITHUB_REPOSITORY_OWNER`; the lookup asked `/orgs//packages/…`, got 404 and reported every tag
+  as missing, so a re-run build job rebuilt an image GHCR already held. An empty owner now falls back
+  like the prefix does.
+
+## [0.26.11] - 2026-10-28
+
+### Changed
+- **A manual dispatch of the generated `build-and-deploy.yml` builds only the images GHCR lacks.**
+  It used to rebuild every scope; it now asks GHCR like the publish path does, rolls out every
+  scope's tag for this commit and skips the base worktree through the new `compare-base` input of
+  `generate-scope-matrix`.
+- **CI installs skip the root `prepare` where no job reads a built package.** `setup-bun-install`
+  has a new `ignore-scripts` input (default `false`); the generated workflows set it in
+  `prepare-scopes`, the build job, the deploy and `lint`. The deploy builds the stack's packages
+  itself; `test` keeps `prepare`, since a package's tests may read its own build output, which
+  `^build` does not produce.
+- **Apps export the Docker layer cache with `mode=min`.** Exporting their builder layers took one to
+  two minutes per build and rarely paid off; services keep `mode=max`.
+- **A library's `devDependencies` no longer count towards a scope's checksum.** Only the scope's own
+  `devDependencies` do, so a test dependency of a library no longer rebuilds every scope that uses
+  the library. Every scope gets a new tag once.
+
+### Fixed
+- **The image tag lookup logs its answer.** `check-image-tag-exists` and `generate-scope-matrix`
+  print the scope, the tag, whether the package exists and the HTTP status of every page read; an
+  API error carries its status.
+- **`prepare-build-context` regenerates `bun.lock` without lifecycle scripts.** The install there
+  only rewrites the lockfile, and no dependency's script should run in a job that may later hold
+  deploy secrets.
+
 ## [0.26.10] - 2026-10-27
 
 ### Fixed

package/bin/templates/workspace/.github/actions/check-image-tag-exists/ghcr.js

@@ -5,6 +5,11 @@
  * generate-scope-matrix/index.js requires this file by its relative path: moving it breaks that action.
  */
 
+/**
+ * @typedef {{exists: boolean, packageFound: boolean, statuses: number[]}} GhcrLookup
+ *   `packageFound` is false after a 404; `statuses` holds the HTTP status of every page read.
+ */
+
 const PAGE_SIZE = 100
 
 /**
@@ -17,6 +22,16 @@ const PAGE_SIZE = 100
 const resolveRepositoryPrefix = (input, env) =>
   input || env.GHCR_REPOSITORY_PREFIX || env.GITHUB_REPOSITORY?.split('/')[1] || 'platform'
 
+/**
+ * Resolves the GHCR package owner: the explicit input, else $GITHUB_REPOSITORY_OWNER. The runner sets
+ * a declared input without a default to '', so an empty input has to fall back here; an empty owner
+ * asks `/orgs//packages/…`, which answers 404 and reads as "missing".
+ * @param {string} input - The action's repository-owner input, possibly empty
+ * @param {Record<string, string | undefined>} env - Process environment
+ * @returns {string}
+ */
+const resolveRepositoryOwner = (input, env) => input || env.GITHUB_REPOSITORY_OWNER || ''
+
 /**
  * Checks if the target tag exists in a list of container versions.
  * @param {Object[]} versions - Array of version objects from GitHub API
@@ -29,6 +44,16 @@ const tagExistsInVersions = (versions, targetTag) =>
     return Array.isArray(tags) && tags.includes(targetTag)
   })
 
+/**
+ * One log line for a lookup, so a run shows why the build job did or did not find a tag.
+ * @param {string} shortName - Scope short name
+ * @param {string} tag - The tag looked up
+ * @param {GhcrLookup} lookup
+ * @returns {string}
+ */
+const describeLookup = (shortName, tag, { exists, packageFound, statuses }) =>
+  `${shortName}:${tag} ${exists ? 'exists' : 'missing'}${packageFound ? '' : ' (package not found)'}, HTTP ${statuses.join(' ')}`
+
 /**
  * Creates a GHCR client for one package owner and repository prefix.
  * @param {Object} options
@@ -37,9 +62,10 @@ const tagExistsInVersions = (versions, targetTag) =>
  * @param {string} options.token - Token with read:packages
  * @param {number} [options.maxPages=5] - Pages of 100 versions to inspect before giving up
  * @param {typeof fetch} [options.fetchImpl=fetch] - Injected for tests
- * @returns {{tagExists: (shortName: string, tag: string) => Promise<boolean>}}
- *   `tagExists` resolves false when the package does not exist yet (404) and rejects on any other
- *   API error, so a caller decides itself whether an unknown answer means "build".
+ * @returns {{lookupTag: (shortName: string, tag: string) => Promise<GhcrLookup>}}
+ *   `lookupTag` resolves "missing" when the package does not exist yet (404) and rejects on any other API
+ *   error, with its HTTP status as `error.status`, so a caller decides itself whether an unknown
+ *   answer means "build".
  */
 const createGhcrClient = ({ owner, prefix, token, maxPages = 5, fetchImpl = fetch }) => {
   const headers = {
@@ -55,33 +81,41 @@ const createGhcrClient = ({ owner, prefix, token, maxPages = 5, fetchImpl = fetc
 
     // 404 means the package doesn't exist yet (first build)
     if (response.status === 404) {
-      return { notFound: true, versions: [], hasMore: false }
+      return { notFound: true, versions: [], hasMore: false, status: response.status }
     }
 
     if (!response.ok) {
       const body = await response.text()
-      throw new Error(`GitHub API error (${response.status}): ${body}`)
+      throw Object.assign(new Error(`GitHub API error (${response.status}): ${body}`), { status: response.status })
     }
 
     const data = await response.json()
     const versions = Array.isArray(data) ? data : []
-    return { notFound: false, versions, hasMore: versions.length === PAGE_SIZE }
+    return { notFound: false, versions, hasMore: versions.length === PAGE_SIZE, status: response.status }
   }
 
-  const tagExists = async (shortName, tag) => {
+  const lookupTag = async (shortName, tag) => {
     const targetTag = tag.trim()
+    const statuses = []
 
     for (let page = 1; page <= maxPages; page += 1) {
-      const { versions, hasMore, notFound } = await fetchVersions(shortName, page)
-      if (notFound) return false
-      if (tagExistsInVersions(versions, targetTag)) return true
+      const { versions, hasMore, notFound, status } = await fetchVersions(shortName, page)
+      statuses.push(status)
+      if (notFound) return { exists: false, packageFound: false, statuses }
+      if (tagExistsInVersions(versions, targetTag)) return { exists: true, packageFound: true, statuses }
       if (!hasMore) break
     }
 
-    return false
+    return { exists: false, packageFound: true, statuses }
   }
 
-  return { tagExists }
+  return { lookupTag }
 }
 
-module.exports = { createGhcrClient, resolveRepositoryPrefix, tagExistsInVersions }
+module.exports = {
+  createGhcrClient,
+  describeLookup,
+  resolveRepositoryOwner,
+  resolveRepositoryPrefix,
+  tagExistsInVersions,
+}

package/bin/templates/workspace/.github/actions/check-image-tag-exists/index.js

@@ -16,7 +16,7 @@
 
 const { appendFileSync } = require('node:fs')
 const { exit } = require('node:process')
-const { createGhcrClient, resolveRepositoryPrefix } = require('./ghcr.js')
+const { createGhcrClient, describeLookup, resolveRepositoryOwner, resolveRepositoryPrefix } = require('./ghcr.js')
 
 /**
  * Builds environment variable keys for GitHub Actions inputs.
@@ -71,7 +71,7 @@ const imageTag = getInput('image-tag', { required: true })
 const githubToken = getInput('github-token', { required: true })
 
 // Optional inputs - defaults from environment for portability
-const repositoryOwner = getInput('repository-owner', { defaultValue: process.env.GITHUB_REPOSITORY_OWNER })
+const repositoryOwner = resolveRepositoryOwner(getInput('repository-owner'), process.env)
 const repositoryPrefix = resolveRepositoryPrefix(getInput('repository-prefix'), process.env)
 const maxPages = Number(getInput('max-pages', { defaultValue: '5' }))
 
@@ -82,10 +82,11 @@ const ghcr = createGhcrClient({ owner: repositoryOwner, prefix: repositoryPrefix
  */
 const run = async () => {
   try {
-    const exists = await ghcr.tagExists(scopeShortName, imageTag)
-    setOutput('exists', String(exists))
+    const lookup = await ghcr.lookupTag(scopeShortName, imageTag)
+    console.log(`${describeLookup(scopeShortName, imageTag, lookup)} (${repositoryOwner}/${repositoryPrefix})`)
+    setOutput('exists', String(lookup.exists))
   } catch (error) {
-    console.error('Failed to check image tag existence:', error)
+    console.error(`Failed to check image tag existence (HTTP ${error.status ?? 'none'}):`, error)
     setOutput('exists', 'false')
     exit(1)
   }

package/bin/templates/workspace/.github/actions/generate-scope-matrix/action.yml

@@ -18,6 +18,13 @@ inputs:
       `github-token`. Ignored when force-all is true.
     required: false
     default: 'false'
+  compare-base:
+    description: >-
+      With only-unbuilt: when true, also compute every scope's tag at GITHUB_EVENT_BEFORE in a
+      temporary worktree and report `tags_changed`. False skips that worktree (a manual dispatch
+      deploys anyway); `tags_changed` is then 'false'.
+    required: false
+    default: 'true'
   github-token:
     description: Token with read:packages, used by only-unbuilt to query GHCR
     required: false

package/bin/templates/workspace/.github/actions/generate-scope-matrix/index.js

@@ -14,7 +14,8 @@
  *     scope-roots: apps,services
  *
  * With `only-unbuilt`, a scope is in the matrix when GHCR lacks its checksum tag instead of when
- * its directory changed, and each entry carries that tag as `imageTag`.
+ * its directory changed, and each entry carries that tag as `imageTag`. `compare-base: false`
+ * skips the tag comparison with the diff base.
  *
  * @outputs scopes - JSON array of scope objects [{name, shortName, dir, run, imageTag?}]
  * @outputs scopes_count - Number of scopes in the matrix
@@ -25,8 +26,8 @@ const { appendFileSync } = require('node:fs')
 const { spawnSync } = require('node:child_process')
 const { existsSync, readdirSync, readFileSync, statSync, symlinkSync } = require('node:fs')
 const { basename, join, relative } = require('node:path')
-const { createGhcrClient, resolveRepositoryPrefix } = require('../check-image-tag-exists/ghcr.js')
-const { changedScopeTags, scopeTagMap, selectUnbuilt } = require('./select.js')
+const { createGhcrClient, describeLookup, resolveRepositoryPrefix } = require('../check-image-tag-exists/ghcr.js')
+const { changedScopes, scopeTagMap, selectUnbuilt } = require('./select.js')
 
 /** Default directories to scan for scopes (Turborepo convention) */
 const defaultRoots = ['apps', 'services']
@@ -379,11 +380,16 @@ const lookupScopeTags = async (scopeMap) => {
 
   for (const scope of scopeMap.values()) {
     const imageTag = computeScopeChecksum(scope)
-    const exists = await ghcr.tagExists(scope.shortName, imageTag).catch((error) => {
-      console.warn(`GHCR lookup for ${scope.shortName} failed, building it:`, error)
-      return false
-    })
-    console.log(`${scope.shortName} ${imageTag} ${exists ? 'exists' : 'missing'}`)
+    const exists = await ghcr
+      .lookupTag(scope.shortName, imageTag)
+      .then((lookup) => {
+        console.log(describeLookup(scope.shortName, imageTag, lookup))
+        return lookup.exists
+      })
+      .catch((error) => {
+        console.warn(`GHCR lookup for ${scope.shortName} failed (HTTP ${error.status ?? 'none'}), building it:`, error)
+        return false
+      })
     lookups.push({ scope, imageTag, exists })
   }
 
@@ -496,8 +502,29 @@ const buildMatrix = (scopeMap, changedFilesFromEvent, beforeRef, headRef, forced
 }
 
 /**
- * Builds the matrix: with only-unbuilt, every scope whose checksum tag GHCR lacks, every scope's
- * computed tag and the scopes whose tag differs from the base's; otherwise the changed scopes (or
+ * The only-unbuilt matrix: every scope whose checksum tag GHCR lacks, every scope's computed tag,
+ * and, unless compare-base is off, the scopes whose tag differs from the base's.
+ * @param {Map} scopeMap - Discovered scopes
+ * @param {string[]} forcedShortNames - Short names included even when their image exists
+ * @param {string|undefined} beforeRef - Diff base commit
+ * @returns {Promise<{matrix: Object[], scopeTags: Record<string, string>, changedTags: string[]}>}
+ */
+const resolveUnbuiltMatrix = async (scopeMap, forcedShortNames, beforeRef) => {
+  const lookups = await lookupScopeTags(scopeMap)
+  const scopeTags = scopeTagMap(lookups)
+  const matrix = selectUnbuilt(lookups, forcedShortNames)
+  if (!isEnabled('compare-base')) {
+    console.log('Tags not compared with a base (compare-base is off)')
+    return { matrix, scopeTags, changedTags: [] }
+  }
+  const baseScopeTags = beforeRef ? computeBaseScopeTags(scopeMap, beforeRef) : {}
+  const changedTags = changedScopes(scopeTags, baseScopeTags)
+  console.log(`Tags changed since ${beforeRef ?? 'no base'}: ${changedTags.join(' ') || 'none'}`)
+  return { matrix, scopeTags, changedTags }
+}
+
+/**
+ * Builds the matrix: with only-unbuilt, see resolveUnbuiltMatrix; otherwise the changed scopes (or
  * all with force-all), no tags and no tag changes.
  * @returns {Promise<{matrix: Object[], scopeTags: Record<string, string>, changedTags: string[]}>}
  */
@@ -507,12 +534,7 @@ const resolveMatrix = async () => {
   const { beforeRef, headRef } = getCommitRefs()
 
   if (isEnabled('only-unbuilt') && !isForceAll()) {
-    const lookups = await lookupScopeTags(scopeMap)
-    const scopeTags = scopeTagMap(lookups)
-    const baseScopeTags = beforeRef ? computeBaseScopeTags(scopeMap, beforeRef) : {}
-    const changedTags = changedScopeTags(scopeTags, baseScopeTags)
-    console.log(`Tags changed since ${beforeRef ?? 'no base'}: ${changedTags.join(' ') || 'none'}`)
-    return { matrix: selectUnbuilt(lookups, forcedShortNames), scopeTags, changedTags }
+    return resolveUnbuiltMatrix(scopeMap, forcedShortNames, beforeRef)
   }
 
   const changedFilesFromEvent = loadEventChangedFiles(process.env.GITHUB_EVENT_PATH)

package/bin/templates/workspace/.github/actions/generate-scope-matrix/rollout-changes.js

@@ -0,0 +1,24 @@
+/**
+ * Usage: DEPLOY_IMAGES='<json>' RUNNING_IMAGES='<json>' node rollout-changes.js
+ *
+ * Prints, as a JSON array, the short names of the scopes the deploy rolls out to an image other than
+ * the one the stack runs. Both variables map short name → image; a scope the stack reports no image
+ * for counts as changed, so an empty RUNNING_IMAGES ('{}') lists every scope of DEPLOY_IMAGES.
+ */
+
+const { changedScopes } = require('./select.js')
+
+/**
+ * Parses an environment variable holding a JSON object of short name → image.
+ * @param {string} name - Variable name
+ * @returns {Record<string, string>}
+ */
+const readImages = (name) => {
+  const value = JSON.parse(process.env[name] || '{}')
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error(`${name} is not a JSON object`)
+  }
+  return value
+}
+
+console.log(JSON.stringify(changedScopes(readImages('DEPLOY_IMAGES'), readImages('RUNNING_IMAGES'))))

package/bin/templates/workspace/.github/actions/generate-scope-matrix/scope-tree.js

@@ -9,27 +9,32 @@
 const { createHash } = require('node:crypto')
 
 /**
- * @typedef {{name: string, dependencies: string[]}} WorkspaceManifest
+ * @typedef {{name: string, dependencies: string[], devDependencies: string[]}} WorkspaceManifest
  */
 
-const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'peerDependencies', 'optionalDependencies']
+const CONSUMER_DEPENDENCY_FIELDS = ['dependencies', 'peerDependencies', 'optionalDependencies']
 const PRUNED_TREES = ['json', 'full']
 const WORKSPACE_BLOCK_INDENT = '    '
 
 /**
- * Reduces a parsed package.json to its name and the names of everything it depends on. Every
- * dependency field counts and the version spec does not matter, so a workspace linked by version
- * instead of `workspace:` stays in the closure.
+ * Reduces a parsed package.json to its name and the names of what it depends on: `dependencies`
+ * holds every field a consumer installs, `devDependencies` the package's own tooling and tests. The
+ * version spec does not matter, so a workspace linked by version instead of `workspace:` stays in
+ * the closure.
  * @param {Object} packageJson - Parsed package.json
  * @returns {WorkspaceManifest}
  */
 const workspaceManifest = (packageJson) => ({
   name: packageJson.name,
-  dependencies: DEPENDENCY_FIELDS.flatMap((field) => Object.keys(packageJson[field] ?? {})),
+  dependencies: CONSUMER_DEPENDENCY_FIELDS.flatMap((field) => Object.keys(packageJson[field] ?? {})),
+  devDependencies: Object.keys(packageJson.devDependencies ?? {}),
 })
 
 /**
- * Collects the workspaces a scope reaches through its own dependencies, transitively, itself included.
+ * Collects the workspaces a scope reaches, transitively, itself included. The scope's own
+ * devDependencies count; a library's do not, since a consumer never installs them: a test
+ * dependency of a library on `ui` would otherwise rebuild every service using that library on
+ * each `ui` change.
  * @param {string} scopeDir - The scope's workspace directory, e.g. 'apps/web'
  * @param {Map<string, WorkspaceManifest>} manifestsByDir - Every workspace of the pruned tree by directory
  * @returns {Set<string>} Workspace directories
@@ -47,7 +52,8 @@ const dependencyClosure = (scopeDir, manifestsByDir) => {
     const dir = pending.pop()
     if (reached.has(dir)) continue
     reached.add(dir)
-    for (const name of manifestsByDir.get(dir).dependencies) {
+    const { dependencies, devDependencies } = manifestsByDir.get(dir)
+    for (const name of dir === scopeDir ? [...dependencies, ...devDependencies] : dependencies) {
       const dependencyDir = dirsByName.get(name)
       if (dependencyDir) pending.push(dependencyDir)
     }

package/bin/templates/workspace/.github/actions/generate-scope-matrix/select.js

@@ -33,15 +33,17 @@ const selectUnbuilt = (lookups, forcedShortNames = []) => {
 const scopeTagMap = (lookups) => Object.fromEntries(lookups.map(({ scope, imageTag }) => [scope.shortName, imageTag]))
 
 /**
- * Lists the scopes whose tag differs from the one computed at the diff base. A revert lands on an
- * image GHCR already holds, so the matrix stays empty; this list is what still makes it deploy.
- * @param {Record<string, string>} scopeTags - Short name → tag at this commit
- * @param {Record<string, string>} baseScopeTags - Short name → tag at the base; a scope missing here counts as changed
+ * Lists the scopes whose value in `current` differs from the one in `reference`. Two callers: the
+ * matrix compares this commit's tags with the diff base's (a revert lands on an image GHCR already
+ * holds, so the matrix stays empty, and this list still makes it deploy); the deploy compares the
+ * images it rolls out with the ones the stack runs, to decide which follow-up steps run.
+ * @param {Record<string, string>} current - Short name → tag or image now
+ * @param {Record<string, string>} reference - Short name → tag or image to compare with; a scope missing here counts as changed
  * @returns {string[]} Short names, sorted
  */
-const changedScopeTags = (scopeTags, baseScopeTags) =>
-  Object.keys(scopeTags)
-    .filter((shortName) => scopeTags[shortName] !== baseScopeTags[shortName])
+const changedScopes = (current, reference) =>
+  Object.keys(current)
+    .filter((shortName) => current[shortName] !== reference[shortName])
     .sort()
 
-module.exports = { changedScopeTags, scopeTagMap, selectUnbuilt }
+module.exports = { changedScopes, scopeTagMap, selectUnbuilt }

package/bin/templates/workspace/.github/actions/prepare-build-context/action.yml

@@ -151,7 +151,9 @@ runs:
           # Bounded: bun install has hung indefinitely after a 404 on a tarball (see above), and an
           # unbounded hang here holds the job until the runner's 6-hour limit. A timeout turns it
           # into the failure path below, which restores the original lockfile.
-          NPM_TOKEN="${{ inputs.npm-token }}" timeout 300 bun install --no-progress 2>&1 | tee /tmp/bun-install.log; INSTALL_EXIT=${PIPESTATUS[0]}
+          # Without lifecycle scripts: this install only regenerates bun.lock, and a later step of
+          # the build job may hold deploy secrets that a dependency's script must not reach.
+          NPM_TOKEN="${{ inputs.npm-token }}" timeout 300 bun install --no-progress --ignore-scripts 2>&1 | tee /tmp/bun-install.log; INSTALL_EXIT=${PIPESTATUS[0]}
           [ "$INSTALL_EXIT" -eq 124 ] && echo "::warning::bun install timed out after 300 s"
           set -e
           if [ ! -f bun.lock ] || [ ! -s bun.lock ]; then

package/bin/templates/workspace/.github/actions/setup-bun-install/action.yml.hbs

@@ -9,6 +9,12 @@ inputs:
   install-command:
     description: Command to install dependencies.
     default: bun install --frozen-lockfile
+  ignore-scripts:
+    description: >-
+      When 'true', runs the install command with --ignore-scripts: no root `prepare` (which builds
+      every package) and no dependency lifecycle scripts. For jobs that build what they need
+      themselves, or need no built package at all.
+    default: 'false'
   enable-cache:
     description: Whether to run the cache step.
     default: 'false'
@@ -42,13 +48,36 @@ runs:
       with:
         bun-version-file: $\{{ inputs.bun-version-file }}
 
+    # An install without scripts caches a node_modules whose dependencies never ran their lifecycle
+    # scripts, and Bun does not run them later for a package already in place. Such caches live under
+    # their own prefix, which a restore key of an install with scripts never matches.
+    - name: Resolve cache keys
+      id: cache-keys
+      if: $\{{ inputs.enable-cache == 'true' && inputs.cache-key != '' }}
+      shell: bash
+      env:
+        CACHE_KEY: $\{{ inputs.cache-key }}
+        RESTORE_KEYS: $\{{ inputs.cache-restore-keys }}
+        IGNORE_SCRIPTS: $\{{ inputs.ignore-scripts }}
+      run: |
+        PREFIX=""
+        [ "$IGNORE_SCRIPTS" = "true" ] && PREFIX="noscripts-"
+        echo "key=${PREFIX}${CACHE_KEY}" >> "$GITHUB_OUTPUT"
+        {
+          echo "restore-keys<<RESTORE_KEYS_END"
+          while IFS= read -r line; do
+            [ -n "$line" ] && echo "${PREFIX}${line}"
+          done <<<"$RESTORE_KEYS"
+          echo "RESTORE_KEYS_END"
+        } >> "$GITHUB_OUTPUT"
+
     - name: Cache dependencies
       if: $\{{ inputs.enable-cache == 'true' && inputs.cache-key != '' }}
       uses: actions/cache@v5
       with:
         path: $\{{ inputs.cache-paths }}
-        key: $\{{ inputs.cache-key }}
-        restore-keys: $\{{ inputs.cache-restore-keys }}
+        key: $\{{ steps.cache-keys.outputs.key }}
+        restore-keys: $\{{ steps.cache-keys.outputs.restore-keys }}
 
     # A Bun other than the pinned one writes a lockfile the pinned Bun in the Docker image refuses
     # as changed, so a drifted binary fails here instead of in the image build.
@@ -67,7 +96,12 @@ runs:
       shell: bash
       env:
         NPM_TOKEN: $\{{ inputs.npm-token }}
+        IGNORE_SCRIPTS: $\{{ inputs.ignore-scripts }}
       run: |
         set -euo pipefail
         cd "$\{{ inputs.working-directory }}"
-        $\{{ inputs.install-command }}
+        if [ "$IGNORE_SCRIPTS" = "true" ]; then
+          $\{{ inputs.install-command }} --ignore-scripts
+        else
+          $\{{ inputs.install-command }}
+        fi

package/bin/templates/workspace/.github/workflows/build-and-deploy.yml.hbs

@@ -197,18 +197,22 @@ jobs:
       # A private workspace package or a lockfile line reaches a scope without
       # touching its directory. On those paths the matrix asks GHCR whether each scope's checksum
       # tag exists instead of diffing directories; a tool-package bump that changes no scope's
-      # pruned tree then builds and deploys nothing. A manual dispatch keeps building every scope.
+      # pruned tree then builds and deploys nothing. A manual dispatch asks GHCR too: it rolls out
+      # this commit's tags and builds only the images GHCR lacks.
       - name: Decide matrix mode
         id: matrix-mode
         run: |
           EVENT="$\{{ github.event_name }}"
           LOCK_CHANGED=$(git diff --name-only "$GITHUB_EVENT_BEFORE" "$GITHUB_SHA" -- bun.lock | head -1)
-          if [ "$EVENT" != "workflow_dispatch" ] && { [ "$EVENT" = "workflow_run" ] || [ -n "$LOCK_CHANGED" ]; }; then
+          if [ "$EVENT" = "workflow_dispatch" ] || [ "$EVENT" = "workflow_run" ] || [ -n "$LOCK_CHANGED" ]; then
             echo "only_unbuilt=true" >> "$GITHUB_OUTPUT"
           else
             echo "only_unbuilt=false" >> "$GITHUB_OUTPUT"
           fi
 
+      # No job here reads a built workspace package: prepare-scopes and build only prune, the image
+      # installs and builds inside Docker, and the deploy builds the stack's packages itself. The root
+      # `prepare` (every package built, about 40 s) is therefore skipped in all three.
       - name: Setup Bun and install dependencies
         if: steps.matrix-mode.outputs.only_unbuilt == 'true'
         uses: ./.github/actions/setup-bun-install
@@ -217,14 +221,17 @@ jobs:
           cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
           npm-token: $\{{ github.token }}
+          ignore-scripts: 'true'
 
+      # A dispatch deploys in any case (infra-eval sets infrastructure_changed), so it needs no tag
+      # comparison with a base worktree.
       - name: Generate scope matrix
         id: scope-generator
         uses: ./.github/actions/generate-scope-matrix
         with:
           scope-roots: $\{{ env.SCOPE_ROOTS }}
-          force-all: $\{{ github.event_name == 'workflow_dispatch' }}
           only-unbuilt: $\{{ steps.matrix-mode.outputs.only_unbuilt }}
+          compare-base: $\{{ github.event_name != 'workflow_dispatch' }}
           github-token: $\{{ secrets.GITHUB_TOKEN }}
 
   build:
@@ -261,6 +268,7 @@ jobs:
           cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
           npm-token: $\{{ github.token }}
+          ignore-scripts: 'true'
 
       # The same script computes the tag prepare-scopes looked up (only-unbuilt), so both agree. It
       # also leaves the pruned tree in out/<short-name>, which the Docker build below uses.
@@ -329,7 +337,10 @@ jobs:
             $\{{ env.REGISTRY }}/$\{{ matrix.scope.shortName }}:$\{{ env.IMAGE_TAG }}
             $\{{ env.REGISTRY }}/$\{{ matrix.scope.shortName }}:latest
           cache-from: type=gha,scope=$\{{ matrix.scope.shortName }}
-          cache-to: type=gha,scope=$\{{ matrix.scope.shortName }},mode=max
+          # Apps export only the final stage: exporting their builder layers took one to two minutes
+          # per build and saved at most the half-minute install, since a client build rarely hits the
+          # cache. Services export in seconds and keep mode=max.
+          cache-to: type=gha,scope=$\{{ matrix.scope.shortName }},mode=$\{{ startsWith(matrix.scope.dir, 'apps/') && 'min' || 'max' }}
           build-args: |
             BUN_VERSION=$\{{ env.BUN_VERSION }}
           secrets: |
@@ -392,9 +403,7 @@ jobs:
           if [ -f .artifacts/metadata.json ]; then
             SHORT=$(jq -er '.shortName' .artifacts/metadata.json)
             mkdir -p ".artifacts/changed-${SHORT}"
-            for marker_file in metadata.json scope.txt; do
-              if [ -f ".artifacts/${marker_file}" ]; then mv ".artifacts/${marker_file}" ".artifacts/changed-${SHORT}/"; fi
-            done
+            find .artifacts -maxdepth 1 -type f -exec mv {} ".artifacts/changed-${SHORT}/" \;
           fi
 
       - name: Resolve scope image tags
@@ -458,7 +467,7 @@ jobs:
           done
 
           if [ -n "$MISSING" ]; then
-            echo "::error::No checksum-tagged image found in GHCR for:$MISSING. Refusing to deploy :latest — trigger a build for these scopes first (workflow_dispatch builds all)."
+            echo "::error::No checksum-tagged image found in GHCR for:$MISSING. Refusing to deploy :latest — trigger a build for these scopes first (workflow_dispatch builds every missing image)."
             exit 1
           fi
 
@@ -472,6 +481,31 @@ jobs:
           cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
           npm-token: $\{{ github.token }}
+          ignore-scripts: 'true'
+
+      # The scopes this deploy moves to another image than the stack runs, from the stack's
+      # `scopeImages` output of the last `up`. The steps that follow a new image (the Studio smoke
+      # check among them) hang off this list rather than off a build marker: a dispatch that builds
+      # nothing still runs them for the images it changes, and an image built anew but already
+      # running skips them. Each changed scope sets `changed_<short-name>=true`; a workspace without
+      # a scope never sets its output and skips its steps. A stack that cannot be read fails the step;
+      # before the first `up` that writes the output, every scope counts as changed.
+      - name: Compare with the running images
+        id: rollout
+        env:
+          PULUMI_ACCESS_TOKEN: $\{{ secrets.PULUMI_ACCESS_TOKEN }}
+          DEPLOY_IMAGES: $\{{ steps.resolve_scope_tags.outputs.scope_image_tags }}
+        run: |
+          set -euo pipefail
+          OUTPUTS=$(pulumi stack output --json --cwd infra --stack "$PULUMI_STACK" --non-interactive)
+          if ! jq -e 'has("scopeImages")' <<<"$OUTPUTS" >/dev/null; then
+            echo "::notice::The stack has no scopeImages output yet; every scope counts as changed."
+          fi
+          RUNNING_IMAGES=$(jq -c '.scopeImages // {}' <<<"$OUTPUTS")
+          export RUNNING_IMAGES
+          CHANGED=$(node .github/actions/generate-scope-matrix/rollout-changes.js)
+          echo "Rolled out to a new image: ${CHANGED}"
+          jq -r '.[] | "changed_\(.)=true"' <<<"$CHANGED" >> "$GITHUB_OUTPUT"
 
       - name: Build infrastructure dependencies
         run: |
@@ -498,18 +532,9 @@ jobs:
           DIGITALOCEAN_TOKEN: $\{{ secrets.DIGITALOCEAN_TOKEN }}
           SCOPE_IMAGE_TAGS: $\{{ steps.resolve_scope_tags.outputs.scope_image_tags }}
 
-      - name: Check if Studio was deployed
-        id: studio-deployed
-        run: |
-          if [ -f .artifacts/changed-studio/metadata.json ]; then
-            echo "deployed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "deployed=false" >> "$GITHUB_OUTPUT"
-          fi
-
       - name: Get Pulumi outputs
         id: pulumi-outputs
-        if: steps.studio-deployed.outputs.deployed == 'true'
+        if: steps.rollout.outputs.changed_studio == 'true'
         working-directory: infra
         run: |
           URL=$(pulumi stack output studioUrl --stack "$PULUMI_STACK" --non-interactive)
@@ -519,7 +544,7 @@ jobs:
 
       - name: Smoke-check new Studio deployment
         id: studio-smoke
-        if: steps.studio-deployed.outputs.deployed == 'true'
+        if: steps.rollout.outputs.changed_studio == 'true'
         env:
           STUDIO_URL: $\{{ steps.pulumi-outputs.outputs.studio_url }}
         run: |

package/bin/templates/workspace/.github/workflows/lint-and-tests.yml.hbs

@@ -39,6 +39,7 @@ jobs:
           patterns: docs/**/*.md
           github-token: $\{{ github.token }}
 
+      # Lint reads sources only, so the root `prepare` (every package built) is skipped.
       - name: Setup Bun and install dependencies
         if: steps.docs-only.outputs.docs_only != 'true'
         uses: ./.github/actions/setup-bun-install
@@ -46,6 +47,7 @@ jobs:
           enable-cache: 'true'
           cache-key: bun-v4-$\{{ runner.os }}-$\{{ hashFiles('bun.lock', 'bunfig.toml') }}
           cache-restore-keys: bun-v4-$\{{ runner.os }}-
+          ignore-scripts: 'true'
 
       - name: Run Linter
         if: steps.docs-only.outputs.docs_only != 'true'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crossdelta/platform-sdk",
-  "version": "0.26.10",
+  "version": "0.26.12",
   "description": "Platform toolkit for event-driven microservices — keeping code and infrastructure in lockstep.",
   "keywords": [
     "cli",