@decocms/blocks-cli 7.50.0 → 7.50.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks-cli",
-  "version": "7.50.0",
+  "version": "7.50.1",
   "type": "module",
   "description": "Deco codegen (generate-blocks, generate-schema, generate-invoke) and Fresh-to-TanStack migration tooling",
   "repository": {
@@ -17,7 +17,7 @@
     "deco-audit-observability": "./scripts/audit-observability-config.ts",
     "deco-migrate-blocks-to-kv": "./scripts/migrate-blocks-to-kv.ts",
     "deco-sync-blocks-to-kv": "./scripts/sync-blocks-to-kv.ts",
-    "deco-pull-decofile": "./scripts/pull-decofile.ts",
+    "deco-sync-blocks-bot": "./scripts/sync-blocks-bot.ts",
     "deco-upgrade-6-to-7": "./scripts/upgrade-6-to-7.ts",
     "deco-reconcile": "./scripts/reconcile.ts"
   },
@@ -33,7 +33,7 @@
     "lint:unused": "knip"
   },
   "dependencies": {
-    "@decocms/blocks": "7.50.0",
+    "@decocms/blocks": "7.50.1",
     "ts-morph": "^27.0.0",
     "tsx": "^4.22.5"
   },

package/scripts/migrate/phase-scaffold.ts

@@ -9,7 +9,7 @@ import { generateCacheConfig } from "./templates/cache-config";
 import { generateCiFiles } from "./templates/ci-yml";
 import { generateCommerceInit } from "./templates/commerce-init";
 import { generateCommerceLoaders } from "./templates/commerce-loaders";
-import { generateContentSyncYml } from "./templates/content-sync-yml";
+import { generateSyncBlocksBotYml } from "./templates/sync-blocks-bot-yml";
 import { generateMigrationPolicyPointerRule } from "./templates/cursor-rules";
 import { generateHooks } from "./templates/hooks";
 import { generateKnipConfig } from "./templates/knip-config";
@@ -133,11 +133,11 @@ export function scaffold(ctx: MigrationContext): void {
 
   // Daily content pull from the still-live storefront (`<origin>/.decofile` ->
   // `.deco/blocks` -> PR). Replaces the legacy cross-repo-PAT push sync; inert
-  // until the operator sets the repo variable CONTENT_SYNC_ORIGIN.
+  // until the operator sets the repo variable SYNC_BLOCKS_ORIGIN.
   writeFile(
     ctx,
-    ".github/workflows/content-sync.yml",
-    generateContentSyncYml(CANONICAL_BUN_VERSION),
+    ".github/workflows/sync-blocks-bot.yml",
+    generateSyncBlocksBotYml(CANONICAL_BUN_VERSION),
   );
 
   // Server entry files (server.ts, worker-entry.ts, router.tsx, runtime.ts, context.ts)

package/scripts/migrate/phase-verify.ts

@@ -26,7 +26,7 @@ const REQUIRED_FILES = [
   ".github/workflows/playwright.yml",
   ".github/workflows/react-doctor.yml",
   ".github/workflows/parity.yml",
-  ".github/workflows/content-sync.yml",
+  ".github/workflows/sync-blocks-bot.yml",
   "tools/gates/no-suppressions.sh",
   "playwright.config.ts",
   "knip.config.ts",

package/scripts/migrate/templates/ci-workflows.test.ts

@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vitest";
 import { generateCiFiles } from "./ci-yml";
-import { generateContentSyncYml } from "./content-sync-yml";
 import { generateMainPushGuardYml } from "./main-push-guard-yml";
 import { generateParityYml } from "./parity-yml";
 import { generatePlaywrightFiles } from "./playwright-yml";
 import { generateReactDoctorYml } from "./react-doctor-yml";
+import { generateSyncBlocksBotYml } from "./sync-blocks-bot-yml";
 
 describe("generateCiFiles", () => {
   const files = generateCiFiles("22.15.0", "1.3.5");
@@ -125,15 +125,15 @@ describe("generateParityYml", () => {
   });
 });
 
-describe("generateContentSyncYml", () => {
-  const yml = generateContentSyncYml("bun@1.3.5");
+describe("generateSyncBlocksBotYml", () => {
+  const yml = generateSyncBlocksBotYml("bun@1.3.5");
 
-  it("pulls on a daily cron, gated on CONTENT_SYNC_ORIGIN", () => {
-    expect(yml).toContain("name: content-sync");
+  it("pulls on a daily cron, gated on SYNC_BLOCKS_ORIGIN", () => {
+    expect(yml).toContain("name: sync-blocks-bot");
     expect(yml).toContain('BUN_VERSION: "1.3.5"'); // bun@ prefix stripped
     expect(yml).toContain('- cron: "0 6 * * *"');
-    expect(yml).toContain("vars.CONTENT_SYNC_ORIGIN");
-    expect(yml).toContain("scripts/pull-decofile.ts");
+    expect(yml).toContain("vars.SYNC_BLOCKS_ORIGIN");
+    expect(yml).toContain("scripts/sync-blocks-bot.ts");
     expect(yml).toContain("--fail-on-plaintext-secret");
   });
 
@@ -160,9 +160,20 @@ describe("generateContentSyncYml", () => {
   });
 
   it("runs the site's own installed CLI, or a pinned one when given", () => {
-    expect(yml).toContain("bunx tsx node_modules/@decocms/blocks-cli/scripts/pull-decofile.ts");
-    const pinned = generateContentSyncYml("1.3.5", "7.50.0");
-    expect(pinned).toContain("bunx -y @decocms/blocks-cli@7.50.0 deco-pull-decofile");
+    expect(yml).toContain("bunx tsx node_modules/@decocms/blocks-cli/scripts/sync-blocks-bot.ts");
+    const pinned = generateSyncBlocksBotYml("1.3.5", "7.51.0");
+    // `npx --package=<pkg> <bin>`, never `bunx <pkg> <bin>` — the latter treats
+    // the bin name as an argument and silently runs deco-migrate instead.
+    expect(pinned).toContain("npx --yes --package=@decocms/blocks-cli@7.51.0 deco-sync-blocks-bot");
+    expect(pinned).not.toMatch(/bunx\s+(-y\s+)?@decocms\/blocks-cli/);
     expect(pinned).not.toContain("node_modules/@decocms/blocks-cli");
   });
+
+  it("cannot pass green having run the wrong tool", () => {
+    // pipefail so `| tee` doesn't swallow the plaintext-secret exit 1, plus a
+    // grep on the report that only this script emits.
+    expect(yml).toContain("set -o pipefail");
+    expect(yml).toContain("--json --github");
+    expect(yml).toContain(`grep -q '"remoteBlocks"'`);
+  });
 });

package/scripts/migrate/templates/{content-sync-yml.ts → sync-blocks-bot-yml.ts}

@@ -1,5 +1,5 @@
 /**
- * Scaffolds `.github/workflows/content-sync.yml` — the secure content channel
+ * Scaffolds `.github/workflows/sync-blocks-bot.yml` — the secure content channel
  * from the still-live Fresh/Deno storefront into the migrated repo.
  *
  * Replaces the legacy push-based sync (a workflow in the *legacy* repo holding a
@@ -9,7 +9,7 @@
  *
  * Direction is inverted — this repo pulls, on its own schedule, with its own
  * `GITHUB_TOKEN`, and gates the result:
- *   - `pull-decofile.ts` fetches `<origin>/.decofile` (public, unauthenticated)
+ *   - `sync-blocks-bot.ts` fetches `<origin>/.decofile` (public, unauthenticated)
  *     and writes `.deco/blocks/`, denying the `Site` block and anything holding
  *     encrypted credentials, and aborting on a plaintext credential;
  *   - a path guard fails the run if anything outside `.deco/blocks/` changed;
@@ -18,37 +18,44 @@
  *     `pull_request` workflows, so gating on the PR's own CI would need a PAT
  *     and would never fire on its own.
  *
- * Inert until the operator sets the repo variable `CONTENT_SYNC_ORIGIN` (same
+ * Inert until the operator sets the repo variable `SYNC_BLOCKS_ORIGIN` (same
  * one-knob pattern as parity.yml's `PARITY_PROD_URL`) — the job skips cleanly.
  *
- * Docs: docs/content-sync.md
+ * Docs: docs/sync-blocks-bot.md
  *
  * @param bunVersion  Pinned bun version, in lockstep with package.json.
  * @param cliVersion  Optional `@decocms/blocks-cli` version to run the pull
- *   with, via `bunx`. Omit for a freshly scaffolded site: the site's own
- *   installed copy is by definition in-version, so the local file path is used.
- *   Pass a version for a site still on an older `@decocms/*` — pinning only the
- *   sync step gets the script without bumping the runtime the site builds
- *   against (blocks-cli pins `@decocms/blocks` exactly, so bumping the devDep
- *   drags a second runtime version into the tree). Drop it when the site bumps.
+ *   with. Omit for a freshly scaffolded site: the site's own installed copy is
+ *   by definition in-version, so the local file path is used. Pass a version
+ *   for a site still on an older `@decocms/*` — pinning only the sync step gets
+ *   the script without bumping the runtime the site builds against (blocks-cli
+ *   pins `@decocms/blocks` exactly, so bumping the devDep drags a second
+ *   runtime version into the tree). Drop it when the site bumps.
+ *
+ *   GOTCHA: the pinned form uses `npx --package=<pkg> <bin>`, NOT
+ *   `bunx <pkg> <bin>`. `bunx pkg@ver some-bin` treats `some-bin` as an
+ *   *argument* and runs the package's first bin instead — in this package that
+ *   is `deco-migrate`, which rewrites the whole site and exits 0 in dry-run, so
+ *   the job goes green having run the wrong tool. Observed on a real run. The
+ *   `--json`-report assertion below is the second line of defence.
  */
-export function generateContentSyncYml(bunVersion: string, cliVersion?: string): string {
+export function generateSyncBlocksBotYml(bunVersion: string, cliVersion?: string): string {
   const bun = bunVersion.replace(/^bun@/, "");
   const pullCmd = cliVersion
-    ? `bunx -y @decocms/blocks-cli@${cliVersion} deco-pull-decofile`
-    : "bunx tsx node_modules/@decocms/blocks-cli/scripts/pull-decofile.ts";
-  return `name: content-sync
+    ? `npx --yes --package=@decocms/blocks-cli@${cliVersion} deco-sync-blocks-bot`
+    : "bunx tsx node_modules/@decocms/blocks-cli/scripts/sync-blocks-bot.ts";
+  return `name: sync-blocks-bot
 
 # Puxa o conteúdo publicado na loja de produção (Fresh/Deno) para \`.deco/blocks\`
 # e abre um PR. Sem token cross-repo: o repo legado não tem permissão nenhuma
 # aqui — este repo busca sozinho, valida e só então mergeia.
 #
-# Configuração (uma vez): variável de repo \`CONTENT_SYNC_ORIGIN\` = origin da
+# Configuração (uma vez): variável de repo \`SYNC_BLOCKS_ORIGIN\` = origin da
 # loja de produção (ex.: https://www.minhaloja.com.br). Sem ela o job pula limpo.
 # Para revisão humana em vez de merge automático, mude \`AUTO_MERGE\` para "false".
 #
 # Depois de ligar isto, APAGUE o workflow de push no repo legado e REVOGUE o
-# token cross-repo — o pull não fecha aquela porta sozinho. Ver docs/content-sync.md.
+# token cross-repo — o pull não fecha aquela porta sozinho. Ver docs/sync-blocks-bot.md.
 
 on:
   schedule:
@@ -57,7 +64,7 @@ on:
   workflow_dispatch:
     inputs:
       origin:
-        description: "Origin da loja de produção (sobrepõe CONTENT_SYNC_ORIGIN)"
+        description: "Origin da loja de produção (sobrepõe SYNC_BLOCKS_ORIGIN)"
         required: false
       prune:
         description: "Apagar blocos que não existem mais em produção"
@@ -75,7 +82,7 @@ permissions:
 # Publicações do CMS acontecem em rajada; uma sync por vez, sem cancelar a que
 # já está no gate de build.
 concurrency:
-  group: content-sync
+  group: sync-blocks-bot
   cancel-in-progress: false
 
 env:
@@ -94,11 +101,11 @@ jobs:
         id: cfg
         env:
           INPUT_ORIGIN: \${{ github.event.inputs.origin }}
-          VAR_ORIGIN: \${{ vars.CONTENT_SYNC_ORIGIN }}
+          VAR_ORIGIN: \${{ vars.SYNC_BLOCKS_ORIGIN }}
         run: |
           origin="\${INPUT_ORIGIN:-$VAR_ORIGIN}"
           if [ -z "$origin" ]; then
-            echo "::notice::variável de repo CONTENT_SYNC_ORIGIN não configurada — content-sync inerte."
+            echo "::notice::variável de repo SYNC_BLOCKS_ORIGIN não configurada — sync-blocks-bot inerte."
             echo "skip=true" >> "$GITHUB_OUTPUT"
           else
             echo "origin=$origin" >> "$GITHUB_OUTPUT"
@@ -123,12 +130,22 @@ jobs:
           PRUNE: \${{ github.event.inputs.prune == 'false' && ' ' || '--prune' }}
           DRY_RUN: \${{ github.event.inputs.dry_run == 'true' && '--dry-run' || ' ' }}
         run: |
+          # pipefail é obrigatório: sem ele o \`| tee\` mascara o exit 1 do gate
+          # de plaintext secret e o job passa mesmo tendo abortado o pull.
+          set -o pipefail
           ${pullCmd} \\
             --origin "$ORIGIN" \\
             --out .deco/blocks \\
             --deny "$DENY_KEYS" \\
             --fail-on-plaintext-secret \\
-            --github $PRUNE $DRY_RUN
+            --json --github $PRUNE $DRY_RUN | tee /tmp/sync-blocks-report.json
+          # Prova de que foi ESTE script que rodou, e que ele viu conteúdo. Sem
+          # isso, uma invocação errada que resolva para outro bin do pacote
+          # termina 0 e o job fica verde tendo rodado a ferramenta errada.
+          grep -q '"remoteBlocks"' /tmp/sync-blocks-report.json || {
+            echo "::error::o passo de pull não produziu o relatório esperado — comando errado?"
+            exit 1
+          }
 
       - name: Guard — só .deco/blocks pode mudar
         id: guard
@@ -137,19 +154,19 @@ jobs:
           {
             git -c core.quotepath=false diff --name-only HEAD
             git -c core.quotepath=false ls-files --others --exclude-standard
-          } | sort -u > /tmp/content-sync-changed.txt
-          offending="$(grep -v '^\\.deco/blocks/' /tmp/content-sync-changed.txt || true)"
+          } | sort -u > /tmp/sync-blocks-changed.txt
+          offending="$(grep -v '^\\.deco/blocks/' /tmp/sync-blocks-changed.txt || true)"
           if [ -n "$offending" ]; then
             echo "::error::a sync mexeu fora de .deco/blocks — abortando:"
             echo "$offending"
             exit 1
           fi
-          if [ ! -s /tmp/content-sync-changed.txt ]; then
+          if [ ! -s /tmp/sync-blocks-changed.txt ]; then
             echo "::notice::conteúdo já está em dia, nada a sincronizar."
             echo "changed=false" >> "$GITHUB_OUTPUT"
           else
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            echo "$(wc -l < /tmp/content-sync-changed.txt) arquivo(s) de bloco alterado(s)"
+            echo "$(wc -l < /tmp/sync-blocks-changed.txt) arquivo(s) de bloco alterado(s)"
           fi
 
       # Gate de verdade. Roda AQUI porque PR aberto com GITHUB_TOKEN não dispara
@@ -164,7 +181,7 @@ jobs:
           GH_TOKEN: \${{ secrets.GITHUB_TOKEN }}
           ORIGIN: \${{ steps.cfg.outputs.origin }}
         run: |
-          branch="content-sync/$(date -u +%Y-%m-%dT%H%M%SZ)"
+          branch="sync-blocks/$(date -u +%Y-%m-%dT%H%M%SZ)"
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git checkout -b "$branch"
@@ -173,7 +190,7 @@ jobs:
           git push origin "$branch"
           url="$(gh pr create \\
             --title "chore(content): sync .deco/blocks de produção" \\
-            --body "Conteúdo puxado de \\\`$ORIGIN/.decofile\\\` pelo workflow \\\`content-sync\\\`. Só \\\`.deco/blocks/**\\\` mudou (guard) e \\\`generate + build\\\` passou antes deste PR existir." \\
+            --body "Conteúdo puxado de \\\`$ORIGIN/.decofile\\\` pelo workflow \\\`sync-blocks-bot\\\`. Só \\\`.deco/blocks/**\\\` mudou (guard) e \\\`generate + build\\\` passou antes deste PR existir." \\
             --head "$branch")"
           echo "PR: $url"
           if [ "$AUTO_MERGE" = "true" ]; then

package/scripts/{pull-decofile.test.ts → sync-blocks-bot.test.ts}

@@ -1,3 +1,4 @@
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -9,10 +10,10 @@ import {
   hasEncryptedSecretRef,
   matchesGlob,
   writeDecofileToDir,
-} from "./pull-decofile";
+} from "./sync-blocks-bot";
 
 function tmpBlocksDir(files: Record<string, unknown> = {}): string {
-  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pull-decofile-"));
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bot-"));
   const out = path.join(dir, ".deco", "blocks");
   fs.mkdirSync(out, { recursive: true });
   for (const [file, content] of Object.entries(files)) {
@@ -97,7 +98,7 @@ describe("writeDecofileToDir", () => {
   });
 
   it("compares content, not bytes — minified or reordered locals are not churn", () => {
-    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pull-decofile-"));
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bot-"));
     const out = path.join(dir, "blocks");
     fs.mkdirSync(out, { recursive: true });
     // how the Studio daemon / old sync bot write it: one minified line, no newline
@@ -256,3 +257,20 @@ describe("fetchDecofile", () => {
     );
   });
 });
+
+describe("CLI entrypoint", () => {
+  // Regression: invoked through the package `bin`, argv[1] is the
+  // node_modules/.bin symlink while import.meta.url is the real file. A string
+  // compare of the two fails, main() never runs, and the CLI exits 0 having
+  // printed nothing — a silently green CI job. Exercise the symlink path.
+  it("runs when invoked through a bin symlink", () => {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), "sync-blocks-bin-"));
+    const link = path.join(dir, "deco-sync-blocks-bot");
+    fs.symlinkSync(path.join(__dirname, "sync-blocks-bot.ts"), link);
+
+    const out = execFileSync(process.execPath, [require.resolve("tsx/cli"), link, "--help"], {
+      encoding: "utf-8",
+    });
+    expect(out).toContain("--fail-on-plaintext-secret");
+  });
+});

package/scripts/{pull-decofile.ts → sync-blocks-bot.ts}

@@ -11,7 +11,7 @@
  * live site (`GET <origin>/.decofile`, public and unauthenticated) on a daily
  * cron, materialises one file per block, and opens a PR. No cross-repo token,
  * no write permission handed to anyone, and the content passes a build gate
- * before reaching `main`. See `docs/content-sync.md`.
+ * before reaching `main`. See `docs/sync-blocks-bot.md`.
  *
  * Three filters decide what may be overwritten:
  *   1. `--deny <globs>`      — deny by block key (default: the `Site` block).
@@ -25,8 +25,8 @@
  *      committed into git.
  *
  * Usage (from a site root):
- *   tsx pull-decofile.ts --origin https://www.minhaloja.com.br --prune
- *   tsx pull-decofile.ts --url https://www.minhaloja.com.br/.decofile --dry-run --json
+ *   tsx sync-blocks-bot.ts --origin https://www.minhaloja.com.br --prune
+ *   tsx sync-blocks-bot.ts --url https://www.minhaloja.com.br/.decofile --dry-run --json
  *
  * Exit codes:
  *   0 — done (with or without changes)
@@ -36,6 +36,7 @@
 
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { fileURLToPath } from "node:url";
 import { decodeBlockNameWithPasses } from "./lib/blocks-dedupe";
 
 /** Block keys never overwritten by a sync unless `--deny` is overridden. */
@@ -447,7 +448,7 @@ function showHelp(): void {
   @decocms/blocks-cli — pull the production decofile into .deco/blocks/
 
   Usage:
-    tsx pull-decofile.ts --origin https://www.minhaloja.com.br [options]
+    tsx sync-blocks-bot.ts --origin https://www.minhaloja.com.br [options]
 
   Options:
     --origin <url>               Site origin; fetches <origin>/.decofile
@@ -494,7 +495,7 @@ async function main(): Promise<void> {
     process.exit(0);
   }
   if (!opts.url) {
-    console.error("pull-decofile: --origin or --url is required (see --help)");
+    console.error("sync-blocks-bot: --origin or --url is required (see --help)");
     process.exit(2);
   }
 
@@ -502,7 +503,7 @@ async function main(): Promise<void> {
   try {
     fetched = await fetchDecofile(opts.url, { maxBytes: opts.maxBytes, timeoutMs: opts.timeoutMs });
   } catch (e) {
-    console.error(`pull-decofile: ${(e as Error).message}`);
+    console.error(`sync-blocks-bot: ${(e as Error).message}`);
     process.exit(2);
   }
 
@@ -510,7 +511,7 @@ async function main(): Promise<void> {
   try {
     report = writeDecofileToDir(fetched.blocks, opts);
   } catch (e) {
-    console.error(`pull-decofile: ${(e as Error).message}`);
+    console.error(`sync-blocks-bot: ${(e as Error).message}`);
     process.exit(2);
   }
   report.revision = fetched.revision;
@@ -533,25 +534,34 @@ async function main(): Promise<void> {
 
   if (report.plaintextSecrets.length > 0 && opts.failOnPlaintextSecret) {
     console.error(
-      `pull-decofile: ${report.plaintextSecrets.length} plaintext credential(s) in the pulled content — refusing to commit it. Move them to encrypted secrets upstream, or deny the block with --deny.`,
+      `sync-blocks-bot: ${report.plaintextSecrets.length} plaintext credential(s) in the pulled content — refusing to commit it. Move them to encrypted secrets upstream, or deny the block with --deny.`,
     );
     process.exit(1);
   }
   process.exit(0);
 }
 
-const isCjsEntry =
-  typeof require !== "undefined" && typeof module !== "undefined" && require.main === module;
-let isEsmEntry = false;
-try {
-  isEsmEntry =
-    typeof process !== "undefined" &&
-    Array.isArray(process.argv) &&
-    process.argv[1] !== undefined &&
-    import.meta.url === `file://${process.argv[1]}`;
-} catch {
-  // ignore in CJS
+/**
+ * Entry detection must resolve symlinks. Invoked through the package `bin`
+ * (`npx --package=@decocms/blocks-cli deco-sync-blocks-bot`), `process.argv[1]`
+ * is the `node_modules/.bin/...` symlink while `import.meta.url` is the real
+ * file — a plain string compare fails, `main()` never runs, and the CLI exits 0
+ * having printed nothing. Observed on a real CI run; the workflow's report
+ * assertion is what surfaced it.
+ */
+function isMainModule(): boolean {
+  if (typeof require !== "undefined" && typeof module !== "undefined" && require.main === module) {
+    return true;
+  }
+  try {
+    const arg = process.argv?.[1];
+    if (!arg) return false;
+    return fs.realpathSync(arg) === fs.realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
 }
-if (isCjsEntry || isEsmEntry) {
+
+if (isMainModule()) {
   void main();
 }