@databricks-solutions/lakebase-scm-utils 0.3.4 → 0.3.5

package/scripts/lakebase/create-project.ts

@@ -20,6 +20,8 @@ import {
 import {
   checkDatabricksAuth,
   databricksAuthPrereqMessage,
+  checkGitHubWorkflowScope,
+  githubWorkflowScopePrereqMessage,
   withLakebaseRollback,
   validateCreateInputs,
   dirIsEmpty,
@@ -289,6 +291,19 @@ export async function createProject(
     throw new Error(databricksAuthPrereqMessage(host, auth.reason));
   }
 
+  // ── GitHub token `workflow` scope precondition ────────────────
+  // The scaffold's final push commits .github/workflows/*, which GitHub rejects
+  // unless the token carries the `workflow` OAuth scope. Check it HERE, before any
+  // GitHub repo or Lakebase project exists, so a missing scope fails in seconds with
+  // a fix instead of at the final push after all provisioning (which then rolls back).
+  if (useGithub) {
+    report("Checking GitHub token scopes...");
+    const scope = await checkGitHubWorkflowScope();
+    if (!scope.ok) {
+      throw new Error(githubWorkflowScopePrereqMessage(scope.reason));
+    }
+  }
+
   // ── Step 1+2: GitHub repo + clone, OR local-only setup ────────
   if (useGithub) {
     report("Creating GitHub repository...", fullRepoName);

package/scripts/lakebase/doctor.ts

@@ -14,6 +14,7 @@ import { listBranches } from "./branch-utils.js";
 import { verifyHooks } from "./project-verify.js";
 import { detectLanguage } from "./schema-migrate.js";
 import { detectWorkflowDrift } from "./workflow-drift.js";
+import { checkGitHubScopes } from "../github/repo.js";
 
 export type CheckStatus = "ok" | "warn" | "fail" | "skip";
 
@@ -593,6 +594,53 @@ async function checkGitRemote(projectDir: string): Promise<CheckResult> {
   }
 }
 
+/**
+ * Probe whether the GitHub token carries the `workflow` scope needed to push
+ * `.github/workflows/*`. A missing scope is exactly why a scaffold push (or any
+ * later workflow edit) gets rejected at the very end and rolls back. Best-effort:
+ * no token, OR a fine-grained / GitHub App token (no visible OAuth scopes), OR
+ * an API error → `skip`, never a false `fail`. `probe` is injectable for tests.
+ */
+export async function checkGitHubTokenScope(
+  probe: () => Promise<{ granted: string[] | null; missing: string[] }> = () =>
+    checkGitHubScopes(["workflow"])
+): Promise<CheckResult> {
+  try {
+    const { granted, missing } = await probe();
+    if (granted === null) {
+      return {
+        name: "github-token-scope",
+        status: "skip",
+        message:
+          "GitHub token scopes not visible (fine-grained PAT / App token) - `workflow` scope unverified",
+      };
+    }
+    if (missing.includes("workflow")) {
+      return {
+        name: "github-token-scope",
+        status: "fail",
+        message:
+          "GitHub token lacks the `workflow` scope - pushes touching .github/workflows/* will be rejected",
+        detail: { granted },
+        hint: "Grant it with `gh auth refresh -h github.com -s workflow`, re-sign in to GitHub in VS Code and approve the workflow scope, or set GITHUB_TOKEN to a PAT that includes `workflow`.",
+      };
+    }
+    return {
+      name: "github-token-scope",
+      status: "ok",
+      message: "GitHub token has the `workflow` scope",
+      detail: { granted },
+    };
+  } catch (err) {
+    return {
+      name: "github-token-scope",
+      status: "skip",
+      message: "GitHub token scope check skipped (no token resolved, or GitHub unreachable)",
+      detail: { error: (err as Error).message },
+    };
+  }
+}
+
 function checkLanguage(projectDir: string): CheckResult {
   try {
     const lang = detectLanguage(projectDir);
@@ -732,6 +780,7 @@ export async function runDoctor(args: DoctorArgs = {}): Promise<DoctorReport> {
     host
   );
   const gitRemote = await checkGitRemote(projectDir);
+  const githubTokenScope = await checkGitHubTokenScope();
   const language = checkLanguage(projectDir);
   const hooks = checkHooks(projectDir);
   const workflowDrift = checkWorkflowDrift(projectDir);
@@ -763,6 +812,7 @@ export async function runDoctor(args: DoctorArgs = {}): Promise<DoctorReport> {
     configProfile,
     lakebaseProject,
     gitRemote,
+    githubTokenScope,
     language,
     hooks,
     workflowDrift,

package/templates/project/common/.github/workflows/pr.yml

@@ -148,11 +148,6 @@ jobs:
       # the CI branch is provisioned and fail fast. `--if-present` no-ops a
       # client with no `test` script. The client's Playwright E2E runs later
       # (its own step, gated on client/playwright.config.ts).
-      - name: Run client unit tests
-        if: hashFiles('client/package.json') != ''
-        working-directory: client
-        run: npm run test --if-present
-
       # The official action installs to a user-writable path (no sudo). It's
       # a no-op if a compatible databricks CLI is already on PATH.
       - name: Install Databricks CLI
@@ -384,6 +379,20 @@ jobs:
             --pretty
           echo "Migrations completed."
 
+      - name: Run client unit tests
+        # The kit's client/vitest.globalSetup.ts boots a REAL backend over the /api
+        # boundary (never mock when a real counterpart exists), so the component suite
+        # NEEDS the CI Lakebase branch + DATABASE_URL. Run it AFTER datasource config +
+        # migrations, not before. No-op when there are no component tests (globalSetup
+        # returns early); skipped when there is no CI Lakebase branch (url empty).
+        if: hashFiles('client/package.json') != '' && steps.lakebase-db.outputs.url != ''
+        working-directory: client
+        env:
+          DATABASE_URL: ${{ env.DATABASE_URL }}
+          DB_USERNAME: ${{ env.DB_USERNAME }}
+          DB_PASSWORD: ${{ env.DB_PASSWORD }}
+        run: npm run test --if-present
+
       - name: Run tests
         env:
           DATABASE_URL: ${{ env.DATABASE_URL }}