@databricks-solutions/lakebase-scm-utils 0.2.48 → 0.2.49

package/dist/scripts/util/index.d.cts

@@ -1,4 +1,5 @@
 export { C as CwdOnly, E as ExecOptions, e as exec, s as shq } from '../../exec-CwxSWhlz.cjs';
+export { C as CI_TOKEN_LIFETIME_SECONDS, a as CI_TOKEN_REMINT_MARGIN_SECONDS, b as CiFreshnessResult, c as CiTokenExpiryArgs, E as EnsureCiSecretsFreshArgs, R as REQUIRED_CI_SECRETS, S as SyncCiSecretsArgs, d as ciTokenComment, e as ciTokenExpiry, f as ensureCiSecretsFresh, g as ensureCiSecretsFreshFromEnv, m as missingCiSecrets, s as syncCiSecrets } from '../../ci-secrets-CnGrdQV-.cjs';
 
 /** Promise-based sleep – replaces shell `sleep` in poll loops. */
 declare function delay(ms: number): Promise<void>;
@@ -33,32 +34,6 @@ declare function copyDirSubstituted(srcDir: string, destDir: string, args?: Copy
 declare const LAKEBASE_BRANCH_NAME_MAX = 63;
 declare function sanitizeBranchName(gitBranch: string): string;
 
-/** The repo Actions secrets CI needs to provision a per-PR Lakebase branch. Missing ANY of
- *  these leaves CI unable to produce a DATABASE_URL, so the test step aborts — the failure
- *  that otherwise only surfaces at promotion, an entire feature after creation. */
-declare const REQUIRED_CI_SECRETS: readonly ["DATABRICKS_HOST", "LAKEBASE_PROJECT_ID", "DATABRICKS_TOKEN"];
-/** Which required CI secrets are NOT present on the repo (empty = fully provisioned). Used to
- *  VERIFY a sync landed — a `databricks tokens create` or `gh secret set` that fails must be
- *  caught here, not swallowed, so CI-auth is never silently absent. */
-declare function missingCiSecrets(ownerRepo: string): Promise<string[]>;
-interface SyncCiSecretsArgs {
-    /** Project root (used to resolve ownerRepo from `git remote` when not given,
-     *  and as the cwd for the `databricks tokens create` call). */
-    projectDir: string;
-    /** Workspace host (DATABRICKS_HOST secret). Required. */
-    databricksHost: string;
-    /** Lakebase project id (LAKEBASE_PROJECT_ID secret). Required. */
-    lakebaseProjectId: string;
-    /** Token comment for `databricks tokens create`. */
-    comment?: string;
-    /** Token lifetime in seconds (default: 24h). */
-    lifetimeSeconds?: number;
-    /** Override the auto-detected ownerRepo (defaults to origin remote). */
-    ownerRepo?: string;
-}
-/** Synchronize Databricks + Lakebase CI secrets to the repo's Actions secrets. */
-declare function syncCiSecrets(args: SyncCiSecretsArgs): Promise<void>;
-
 /**
  * Return true iff the current module is being executed as a Node.js
  * entry point (vs. imported as a library). Pass `import.meta.url`
@@ -169,4 +144,4 @@ declare function pollUntilDefined<T>(probe: (ctx: {
     elapsedMs: number;
 }) => Promise<T | undefined>, opts: Omit<PollUntilArgs<T>, "probe">): Promise<PollUntilResult<T>>;
 
-export { type CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, type OwnerRepo, PROXY_ENV_KEYS, type PollProbeDone, type PollProbePending, type PollProbeResult, type PollUntilArgs, type PollUntilDoneResult, type PollUntilResult, type PollUntilTimeoutResult, REQUIRED_CI_SECRETS, type SyncCiSecretsArgs, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, missingCiSecrets, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, syncCiSecrets, withProxyEnv };
+export { type CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, type OwnerRepo, PROXY_ENV_KEYS, type PollProbeDone, type PollProbePending, type PollProbeResult, type PollUntilArgs, type PollUntilDoneResult, type PollUntilResult, type PollUntilTimeoutResult, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, withProxyEnv };

package/dist/scripts/util/index.d.ts

@@ -1,4 +1,5 @@
 export { C as CwdOnly, E as ExecOptions, e as exec, s as shq } from '../../exec-CwxSWhlz.js';
+export { C as CI_TOKEN_LIFETIME_SECONDS, a as CI_TOKEN_REMINT_MARGIN_SECONDS, b as CiFreshnessResult, c as CiTokenExpiryArgs, E as EnsureCiSecretsFreshArgs, R as REQUIRED_CI_SECRETS, S as SyncCiSecretsArgs, d as ciTokenComment, e as ciTokenExpiry, f as ensureCiSecretsFresh, g as ensureCiSecretsFreshFromEnv, m as missingCiSecrets, s as syncCiSecrets } from '../../ci-secrets-CnGrdQV-.js';
 
 /** Promise-based sleep – replaces shell `sleep` in poll loops. */
 declare function delay(ms: number): Promise<void>;
@@ -33,32 +34,6 @@ declare function copyDirSubstituted(srcDir: string, destDir: string, args?: Copy
 declare const LAKEBASE_BRANCH_NAME_MAX = 63;
 declare function sanitizeBranchName(gitBranch: string): string;
 
-/** The repo Actions secrets CI needs to provision a per-PR Lakebase branch. Missing ANY of
- *  these leaves CI unable to produce a DATABASE_URL, so the test step aborts — the failure
- *  that otherwise only surfaces at promotion, an entire feature after creation. */
-declare const REQUIRED_CI_SECRETS: readonly ["DATABRICKS_HOST", "LAKEBASE_PROJECT_ID", "DATABRICKS_TOKEN"];
-/** Which required CI secrets are NOT present on the repo (empty = fully provisioned). Used to
- *  VERIFY a sync landed — a `databricks tokens create` or `gh secret set` that fails must be
- *  caught here, not swallowed, so CI-auth is never silently absent. */
-declare function missingCiSecrets(ownerRepo: string): Promise<string[]>;
-interface SyncCiSecretsArgs {
-    /** Project root (used to resolve ownerRepo from `git remote` when not given,
-     *  and as the cwd for the `databricks tokens create` call). */
-    projectDir: string;
-    /** Workspace host (DATABRICKS_HOST secret). Required. */
-    databricksHost: string;
-    /** Lakebase project id (LAKEBASE_PROJECT_ID secret). Required. */
-    lakebaseProjectId: string;
-    /** Token comment for `databricks tokens create`. */
-    comment?: string;
-    /** Token lifetime in seconds (default: 24h). */
-    lifetimeSeconds?: number;
-    /** Override the auto-detected ownerRepo (defaults to origin remote). */
-    ownerRepo?: string;
-}
-/** Synchronize Databricks + Lakebase CI secrets to the repo's Actions secrets. */
-declare function syncCiSecrets(args: SyncCiSecretsArgs): Promise<void>;
-
 /**
  * Return true iff the current module is being executed as a Node.js
  * entry point (vs. imported as a library). Pass `import.meta.url`
@@ -169,4 +144,4 @@ declare function pollUntilDefined<T>(probe: (ctx: {
     elapsedMs: number;
 }) => Promise<T | undefined>, opts: Omit<PollUntilArgs<T>, "probe">): Promise<PollUntilResult<T>>;
 
-export { type CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, type OwnerRepo, PROXY_ENV_KEYS, type PollProbeDone, type PollProbePending, type PollProbeResult, type PollUntilArgs, type PollUntilDoneResult, type PollUntilResult, type PollUntilTimeoutResult, REQUIRED_CI_SECRETS, type SyncCiSecretsArgs, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, missingCiSecrets, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, syncCiSecrets, withProxyEnv };
+export { type CopyDirSubstitutedArgs, LAKEBASE_BRANCH_NAME_MAX, type OwnerRepo, PROXY_ENV_KEYS, type PollProbeDone, type PollProbePending, type PollProbeResult, type PollUntilArgs, type PollUntilDoneResult, type PollUntilResult, type PollUntilTimeoutResult, copyDirSubstituted, delay, extractZipToDir, formatOwnerRepo, isCliEntry, parseOwnerRepo, patchPomForLakebase, pollUntil, pollUntilDefined, proxyEnvSubset, sanitizeArtifactId, sanitizeBranchName, withProxyEnv };

package/dist/scripts/util/index.js

@@ -1630,8 +1630,8 @@ var PKG_NAME = "@databricks-solutions/lakebase-scm-utils";
 var cached;
 function substrateSelfVersion() {
   if (cached !== void 0) return cached;
-  if ("0.2.48".length > 0) {
-    cached = "0.2.48";
+  if ("0.2.49".length > 0) {
+    cached = "0.2.49";
     return cached;
   }
   cached = "unknown";
@@ -1691,6 +1691,7 @@ function sanitizeBranchName(gitBranch) {
 
 // scripts/util/ci-secrets.ts
 init_esm_shims();
+import * as path6 from "path";
 
 // scripts/lakebase/databricks-cli.ts
 init_esm_shims();
@@ -2992,7 +2993,7 @@ paginateRest.VERSION = VERSION5;
 
 // node_modules/@octokit/plugin-paginate-graphql/dist-bundle/index.js
 init_esm_shims();
-var generateMessage = (path6, cursorValue) => `The cursor at "${path6.join(
+var generateMessage = (path7, cursorValue) => `The cursor at "${path7.join(
   ","
 )}" did not change its value "${cursorValue}" after a page transition. Please make sure your that your query is set up correctly.`;
 var MissingCursorChange = class extends Error {
@@ -3033,9 +3034,9 @@ function findPaginatedResourcePath(responseData) {
   }
   return paginatedResourcePath;
 }
-var deepFindPathToProperty = (object, searchProp, path6 = []) => {
+var deepFindPathToProperty = (object, searchProp, path7 = []) => {
   for (const key of Object.keys(object)) {
-    const currentPath = [...path6, key];
+    const currentPath = [...path7, key];
     const currentValue = object[key];
     if (isObject(currentValue)) {
       if (currentValue.hasOwnProperty(searchProp)) {
@@ -3053,12 +3054,12 @@ var deepFindPathToProperty = (object, searchProp, path6 = []) => {
   }
   return [];
 };
-var get = (object, path6) => {
-  return path6.reduce((current, nextProperty) => current[nextProperty], object);
+var get = (object, path7) => {
+  return path7.reduce((current, nextProperty) => current[nextProperty], object);
 };
-var set = (object, path6, mutator) => {
-  const lastProperty = path6[path6.length - 1];
-  const parentPath = [...path6].slice(0, -1);
+var set = (object, path7, mutator) => {
+  const lastProperty = path7[path7.length - 1];
+  const parentPath = [...path7].slice(0, -1);
   const parent = get(object, parentPath);
   if (typeof mutator === "function") {
     parent[lastProperty] = mutator(parent[lastProperty]);
@@ -3110,22 +3111,22 @@ var mergeResponses = (response1, response2) => {
   if (Object.keys(response1).length === 0) {
     return Object.assign(response1, response2);
   }
-  const path6 = findPaginatedResourcePath(response1);
-  const nodesPath = [...path6, "nodes"];
+  const path7 = findPaginatedResourcePath(response1);
+  const nodesPath = [...path7, "nodes"];
   const newNodes = get(response2, nodesPath);
   if (newNodes) {
     set(response1, nodesPath, (values) => {
       return [...values, ...newNodes];
     });
   }
-  const edgesPath = [...path6, "edges"];
+  const edgesPath = [...path7, "edges"];
   const newEdges = get(response2, edgesPath);
   if (newEdges) {
     set(response1, edgesPath, (values) => {
       return [...values, ...newEdges];
     });
   }
-  const pageInfoPath = [...path6, "pageInfo"];
+  const pageInfoPath = [...path7, "pageInfo"];
   set(response1, pageInfoPath, get(response2, pageInfoPath));
   return response1;
 };
@@ -5546,7 +5547,7 @@ var triggers_notification_paths_default = [
 ];
 function routeMatcher(paths) {
   const regexes = paths.map(
-    (path6) => path6.split("/").map((c) => c.startsWith("{") ? "(?:.+?)" : c).join("/")
+    (path7) => path7.split("/").map((c) => c.startsWith("{") ? "(?:.+?)" : c).join("/")
   );
   const regex2 = `^(?:${regexes.map((r) => `(?:${r})`).join("|")})[^/]*$`;
   return new RegExp(regex2, "i");
@@ -8601,13 +8602,40 @@ async function getOwnerRepo(cwd) {
 
 // scripts/util/ci-secrets.ts
 var REQUIRED_CI_SECRETS = ["DATABRICKS_HOST", "LAKEBASE_PROJECT_ID", "DATABRICKS_TOKEN"];
+var CI_TOKEN_LIFETIME_SECONDS = 7776e3;
+var CI_TOKEN_REMINT_MARGIN_SECONDS = 86400;
+function ciTokenComment(ownerRepo) {
+  const repoName = ownerRepo.includes("/") ? ownerRepo.slice(ownerRepo.lastIndexOf("/") + 1) : ownerRepo;
+  return `GitHub Actions (${repoName})`;
+}
 async function missingCiSecrets(ownerRepo) {
   const present = new Set(await listSecretNames(ownerRepo));
   return REQUIRED_CI_SECRETS.filter((n) => !present.has(n));
 }
+async function mintCiToken(args) {
+  try {
+    const raw = await runDatabricks(
+      ["tokens", "create", "--comment", args.comment, "--lifetime-seconds", String(args.lifetimeSeconds), "-o", "json"],
+      { host: args.databricksHost, cwd: args.projectDir, timeout: 3e4 }
+    );
+    const parsed = JSON.parse(raw.slice(Math.max(0, raw.indexOf("{"))));
+    const token = parsed.token_value || parsed.token || "";
+    if (token) return token;
+  } catch {
+  }
+  try {
+    const raw = await runDatabricks(["auth", "token", "-o", "json"], {
+      host: args.databricksHost,
+      cwd: args.projectDir,
+      timeout: 3e4
+    });
+    const parsed = JSON.parse(raw.slice(Math.max(0, raw.indexOf("{"))));
+    return parsed.access_token || "";
+  } catch {
+    return "";
+  }
+}
 async function syncCiSecrets(args) {
-  const lifetime = args.lifetimeSeconds ?? 86400;
-  const comment = args.comment ?? "GitHub Actions CI";
   const ownerRepo = args.ownerRepo ?? await getOwnerRepo(args.projectDir);
   if (!ownerRepo) {
     throw new Error("Could not resolve GitHub repository from git remote");
@@ -8618,21 +8646,98 @@ async function syncCiSecrets(args) {
   if (!args.lakebaseProjectId) {
     throw new Error("syncCiSecrets: lakebaseProjectId is required");
   }
+  const lifetime = args.lifetimeSeconds ?? CI_TOKEN_LIFETIME_SECONDS;
+  const comment = args.comment ?? ciTokenComment(ownerRepo);
   const secrets = {
     DATABRICKS_HOST: args.databricksHost,
     LAKEBASE_PROJECT_ID: args.lakebaseProjectId
   };
+  const token = await mintCiToken({
+    databricksHost: args.databricksHost,
+    projectDir: args.projectDir,
+    comment,
+    lifetimeSeconds: lifetime
+  });
+  if (token) secrets.DATABRICKS_TOKEN = token;
+  await setRepoSecrets(ownerRepo, secrets);
+}
+async function ciTokenExpiry(args) {
+  const comment = ciTokenComment(args.ownerRepo);
+  let raw;
   try {
-    const tokenRaw = await runDatabricks(
-      ["tokens", "create", "--comment", comment, "--lifetime-seconds", String(lifetime), "-o", "json"],
-      { host: args.databricksHost, cwd: args.projectDir, timeout: 3e4 }
-    );
-    const parsed = JSON.parse(tokenRaw);
-    const token = parsed.token_value || parsed.token || "";
-    if (token) secrets.DATABRICKS_TOKEN = token;
+    raw = await runDatabricks(["tokens", "list", "-o", "json"], {
+      host: args.databricksHost,
+      cwd: args.projectDir,
+      timeout: 3e4
+    });
   } catch {
+    return null;
+  }
+  let infos;
+  try {
+    const parsed = JSON.parse(raw.slice(Math.max(0, raw.indexOf("["))));
+    infos = Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return null;
+  }
+  const expiries = infos.filter((t) => t.comment === comment).map((t) => t.expiry_time === -1 ? Number.POSITIVE_INFINITY : Number(t.expiry_time)).filter((n) => Number.isFinite(n) || n === Number.POSITIVE_INFINITY);
+  if (expiries.length === 0) return null;
+  return Math.max(...expiries);
+}
+async function ensureCiSecretsFresh(args) {
+  const now = args.now ?? Date.now;
+  const marginMs = (args.marginSeconds ?? CI_TOKEN_REMINT_MARGIN_SECONDS) * 1e3;
+  const ownerRepo = args.ownerRepo ?? await getOwnerRepo(args.projectDir);
+  if (!ownerRepo) {
+    throw new Error("Could not resolve GitHub repository from git remote");
+  }
+  const sync = () => syncCiSecrets({
+    projectDir: args.projectDir,
+    databricksHost: args.databricksHost,
+    lakebaseProjectId: args.lakebaseProjectId,
+    ownerRepo
+  });
+  const missing = await missingCiSecrets(ownerRepo);
+  if (missing.length > 0) {
+    await sync();
+    return { action: "provisioned", reason: `CI secret(s) were missing (${missing.join(", ")}); provisioned.` };
+  }
+  const expiry = await ciTokenExpiry({ projectDir: args.projectDir, databricksHost: args.databricksHost, ownerRepo });
+  if (expiry === null) {
+    await sync();
+    return { action: "reminted", reason: "no live CI token found (expired or minted under a different identity); re-minted." };
+  }
+  if (expiry !== Number.POSITIVE_INFINITY && expiry < now() + marginMs) {
+    await sync();
+    const hrs = Math.max(0, Math.round((expiry - now()) / 36e5));
+    return { action: "reminted", reason: `CI token expires in ~${hrs}h (within the re-mint margin); re-minted.` };
+  }
+  return { action: "ok", reason: "CI token is current." };
+}
+async function ensureCiSecretsFreshFromEnv(projectDir, opts) {
+  const envPath = path6.join(projectDir, ".env");
+  const databricksHost = readEnvVar(envPath, "DATABRICKS_HOST");
+  const lakebaseProjectId = readEnvVar(envPath, "LAKEBASE_PROJECT_ID");
+  if (!databricksHost || !lakebaseProjectId) {
+    return {
+      action: "skipped",
+      reason: "CI-auth preflight skipped: .env is missing DATABRICKS_HOST / LAKEBASE_PROJECT_ID."
+    };
+  }
+  try {
+    return await ensureCiSecretsFresh({
+      projectDir,
+      databricksHost,
+      lakebaseProjectId,
+      ownerRepo: opts?.ownerRepo,
+      marginSeconds: opts?.marginSeconds
+    });
+  } catch (err) {
+    return {
+      action: "failed",
+      reason: `CI-auth preflight could not re-mint (${err instanceof Error ? err.message : String(err)}); if CI fails on auth, run lakebase-sync-ci-secrets.`
+    };
   }
-  await setRepoSecrets(ownerRepo, secrets);
 }
 
 // scripts/util/cli-entry.ts
@@ -8740,11 +8845,17 @@ async function pollUntilDefined(probe, opts) {
   });
 }
 export {
+  CI_TOKEN_LIFETIME_SECONDS,
+  CI_TOKEN_REMINT_MARGIN_SECONDS,
   LAKEBASE_BRANCH_NAME_MAX,
   PROXY_ENV_KEYS,
   REQUIRED_CI_SECRETS,
+  ciTokenComment,
+  ciTokenExpiry,
   copyDirSubstituted,
   delay,
+  ensureCiSecretsFresh,
+  ensureCiSecretsFreshFromEnv,
   exec2 as exec,
   extractZipToDir,
   formatOwnerRepo,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@databricks-solutions/lakebase-scm-utils",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Lakebase SCM + substrate engine: database branching, paired-branch SCM workflows, connection/credential minting, schema migration, project scaffold + deploy primitives, and the git/github utility layer. Extracted from consort for portable, standalone consumption by lakebase-scm-extension and the SFTDD orchestration.",
   "type": "module",
   "private": false,

package/scripts/lakebase/create-project.ts

@@ -429,12 +429,12 @@ export async function createProject(
   if (useGithub) {
     report("Setting up CI auth (service principal)...");
     try {
+      // Canonical CI-token identity (durable 90-day PAT, project-scoped comment) — defaults
+      // live in ci-secrets.ts so every mint path (create, repair, pre-push, preflight) matches.
       await syncCiSecrets({
         projectDir,
         databricksHost: host,
         lakebaseProjectId,
-        comment: "GitHub Actions CI",
-        lifetimeSeconds: 86_400,
         ownerRepo: fullRepoName,
       });
       // VERIFY the secrets actually landed — syncCiSecrets fail-softs a dropped PAT, and a

package/scripts/lakebase/scm-merge.ts

@@ -18,6 +18,7 @@ import {
   type WorkflowRunSummary,
 } from "../github/pr.js";
 import { getOwnerRepo } from "../git/remote.js";
+import { ensureCiSecretsFreshFromEnv, type CiFreshnessResult } from "../util/ci-secrets.js";
 import { pollUntil } from "../util/poll-until.js";
 import { exec } from "../util/exec.js";
 import { getCurrentBranch } from "../git/inspect.js";
@@ -175,6 +176,11 @@ export interface MergeArgs {
   /** Fetch the PR's mergeability (to gate the reconcile). Defaults to the real getPullRequest;
    *  injected in tests so the gate is exercised without the network. */
   fetchPrState?: (ownerRepo: string, headBranch: string) => Promise<{ mergeableState?: string } | undefined>;
+  /** Expiry-aware CI-auth preflight run before the merge: the promote triggers merge.yml, which
+   *  needs a live DATABRICKS_TOKEN secret, and a merge is not a push so the pre-push hook does not
+   *  fire. Re-mints the canonical token when missing / near expiry. BEST-EFFORT: never blocks the
+   *  merge. Defaults to {@link ensureCiSecretsFreshFromEnv}; injected in tests. */
+  ensureCiFresh?: (ownerRepo: string) => Promise<CiFreshnessResult>;
 }
 
 export interface MergeResult {
@@ -450,6 +456,21 @@ export async function mergeFeature(args: MergeArgs): Promise<MergeResult> {
     }
   }
 
+  // ─── Pre-merge CI-auth freshness preflight ───
+  // The promote merges to the tier branch, which triggers merge.yml (migrate-target) — that needs
+  // a live DATABRICKS_TOKEN repo secret. A merge is not a push, so the pre-push hook does NOT
+  // refresh it here; if the token has expired (or was never provisioned) the promote CI fails on
+  // empty auth. Re-mint the canonical token when missing / near expiry. BEST-EFFORT: never blocks.
+  {
+    const ensure = args.ensureCiFresh ?? ((repo: string) => ensureCiSecretsFreshFromEnv(args.projectDir, { ownerRepo: repo }));
+    try {
+      const r = await ensure(ownerRepo);
+      if (r.action !== "ok" && r.action !== "skipped") preflightNotes.push(`CI-auth preflight: ${r.reason}`);
+    } catch (err) {
+      preflightNotes.push(`CI-auth preflight skipped (${err instanceof Error ? err.message : String(err)}); if the promote CI fails on auth, run lakebase-sync-ci-secrets.`);
+    }
+  }
+
   // ─── Pre-merge pipeline.json-ledger reconcile ───
   // The per-feature pipeline.json ledger is TRACKED (durable run-state) and can diverge between the
   // feature branch and its tier, so the promotion PR lands CONFLICTING — GitHub won't dispatch CI or

package/scripts/lakebase/scm-prepare-pr.ts

@@ -9,6 +9,7 @@ import { exec } from "../util/exec.js";
 import { getCurrentBranch } from "../git/inspect.js";
 import { getAheadBehind, isDirty } from "../git/status.js";
 import { getOwnerRepo } from "../git/remote.js";
+import { ensureCiSecretsFreshFromEnv, type CiFreshnessResult } from "../util/ci-secrets.js";
 import { resolveGitBase } from "./scm-git-base.js";
 import { createPullRequest, getPullRequest } from "../github/pr.js";
 import { RUNTIME_ARTIFACT_IGNORE } from "./constants.js";
@@ -63,6 +64,8 @@ export interface PreparePrResult {
   prUrl: string;
   /** True iff createPullRequest was invoked (vs. reusing an existing open PR). */
   prCreated: boolean;
+  /** Outcome of the expiry-aware CI-auth preflight run before the push (fail-soft). */
+  ciFreshness: CiFreshnessResult;
 }
 
 export async function preparePr(
@@ -138,6 +141,12 @@ export async function preparePr(
     );
   }
 
+  // Expiry-aware CI-auth preflight BEFORE the push: opening/updating the PR triggers
+  // build-and-test, which needs a live DATABRICKS_TOKEN secret. Re-mint the canonical token
+  // when it is missing or near expiry so the run isn't DOA. Fail-soft — never blocks the PR
+  // (the push's pre-push hook also refreshes; this is the belt-and-suspenders guarantee).
+  const ciFreshness = await ensureCiSecretsFreshFromEnv(args.projectDir, { ownerRepo });
+
   const now = (args.now ?? (() => new Date()))();
   let prUrl = args.prUrlOverride ?? "";
   let prCreated = false;
@@ -191,7 +200,7 @@ export async function preparePr(
   };
   writeWorkflowState(args.projectDir, next);
 
-  return { state: next, prUrl, prCreated };
+  return { state: next, prUrl, prCreated, ciFreshness };
 }
 
 async function ensureAheadOfParent(

package/scripts/lakebase/sync-ci-secrets.cli.ts

@@ -57,8 +57,8 @@ Flags:
   --host <url>          DATABRICKS_HOST (default: .env DATABRICKS_HOST)
   --project-id <id>     LAKEBASE_PROJECT_ID (default: .env LAKEBASE_PROJECT_ID)
   --repo <owner/name>   Target repo (default: origin remote)
-  --lifetime-sec <n>    CI PAT lifetime (default: 86400 = 24h)
-  --comment <text>      Token comment (default: "GitHub Actions CI")
+  --lifetime-sec <n>    CI PAT lifetime (default: 7776000 = 90d, the canonical durable lifetime)
+  --comment <text>      Token comment (default: canonical "GitHub Actions (<repo>)")
   -h, --help            Show this help
 
 Exit codes: