@fern-api/generator-cli 0.9.56 → 0.10.1

package/dist/cli.js

@@ -7166,7 +7166,7 @@ var require_require_directory = __commonJS({
   "../../node_modules/.pnpm/require-directory@2.1.1/node_modules/require-directory/index.js"(exports2, module2) {
     "use strict";
     var fs3 = require("fs");
-    var join18 = require("path").join;
+    var join19 = require("path").join;
     var resolve8 = require("path").resolve;
     var dirname6 = require("path").dirname;
     var defaultOptions2 = {
@@ -7203,7 +7203,7 @@ var require_require_directory = __commonJS({
       }
       path5 = !path5 ? dirname6(m.filename) : resolve8(dirname6(m.filename), path5);
       fs3.readdirSync(path5).forEach(function(filename) {
-        var joined = join18(path5, filename), files, key, obj;
+        var joined = join19(path5, filename), files, key, obj;
         if (fs3.statSync(joined).isDirectory() && options.recurse) {
           files = requireDirectory(m, joined, options);
           if (Object.keys(files).length) {
@@ -30483,9 +30483,9 @@ function resolve(...paths) {
 }
 
 // src/cli.ts
-var import_fs17 = __toESM(require("fs"));
+var import_fs18 = __toESM(require("fs"));
 var import_promises19 = require("fs/promises");
-var import_path26 = __toESM(require("path"));
+var import_path27 = __toESM(require("path"));
 
 // ../../node_modules/.pnpm/yargs@17.7.2/node_modules/yargs/build/lib/yerror.js
 var YError = class _YError extends Error {
@@ -40614,18 +40614,48 @@ var consolePipelineLogger = {
 };
 
 // src/pipeline/PostGenerationPipeline.ts
-var import_child_process7 = require("child_process");
+var import_child_process8 = require("child_process");
 
 // src/pipeline/github/constants.ts
 var FERN_BOT_NAME2 = "fern-api";
 var FERN_BOT_EMAIL2 = "115122769+fern-api[bot]@users.noreply.github.com";
 var FERN_BOT_LOGIN2 = "fern-api[bot]";
 
-// src/pipeline/steps/AutoVersionStep.ts
+// src/pipeline/github/stripGeneratedWorkflows.ts
 var import_child_process4 = require("child_process");
-var import_fs15 = require("fs");
+var import_fs14 = require("fs");
+var import_path22 = require("path");
+var GITHUB_WORKFLOWS_DIR = ".github/workflows";
+function stripGeneratedWorkflows(outputDir, logger) {
+  (0, import_fs14.rmSync)((0, import_path22.join)(outputDir, GITHUB_WORKFLOWS_DIR), { recursive: true, force: true });
+  (0, import_child_process4.execFileSync)("git", ["rm", "-r", "-q", "--cached", "--ignore-unmatch", "--", GITHUB_WORKFLOWS_DIR], {
+    cwd: outputDir,
+    stdio: "pipe"
+  });
+  if (!hasTrackedWorkflows(outputDir)) {
+    logger.debug(`Removed generated ${GITHUB_WORKFLOWS_DIR} (workflows disabled)`);
+    return;
+  }
+  (0, import_child_process4.execFileSync)("git", ["checkout", "HEAD", "--", GITHUB_WORKFLOWS_DIR], { cwd: outputDir, stdio: "pipe" });
+  logger.debug(`Restored ${GITHUB_WORKFLOWS_DIR} from HEAD (workflows disabled)`);
+}
+function hasTrackedWorkflows(outputDir) {
+  try {
+    const output = (0, import_child_process4.execFileSync)("git", ["ls-tree", "-r", "--name-only", "HEAD", "--", GITHUB_WORKFLOWS_DIR], {
+      cwd: outputDir,
+      stdio: "pipe"
+    });
+    return output.toString().trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+// src/pipeline/steps/AutoVersionStep.ts
+var import_child_process5 = require("child_process");
+var import_fs16 = require("fs");
 var import_promises16 = require("fs/promises");
-var import_path23 = require("path");
+var import_path24 = require("path");
 
 // ../commons/logging-execa/lib/loggingExeca.js
 var import_execa = __toESM(require_execa(), 1);
@@ -40683,9 +40713,9 @@ async function loggingExeca(logger, executable, args = [], { doNotPipeOutput = f
 }
 
 // src/autoversion/AutoVersioningService.ts
-var import_fs14 = require("fs");
+var import_fs15 = require("fs");
 var import_promises15 = require("fs/promises");
-var import_path22 = require("path");
+var import_path23 = require("path");
 var import_semver = __toESM(require_semver2());
 var AutoVersioningException = class extends Error {
   /**
@@ -41557,8 +41587,8 @@ var AutoVersioningService = class _AutoVersioningService {
       );
       return;
     }
-    const goModPath = (0, import_path22.join)(workingDirectory, "go.mod");
-    if (!(0, import_fs14.existsSync)(goModPath)) {
+    const goModPath = (0, import_path23.join)(workingDirectory, "go.mod");
+    if (!(0, import_fs15.existsSync)(goModPath)) {
       this.logger.debug(`No go.mod found in ${workingDirectory}, skipping Go module path update`);
       return;
     }
@@ -41628,7 +41658,7 @@ var AutoVersioningService = class _AutoVersioningService {
     const results = [];
     const entries2 = await (0, import_promises15.readdir)(dir);
     for (const entry of entries2) {
-      const fullPath = (0, import_path22.join)(dir, entry);
+      const fullPath = (0, import_path23.join)(dir, entry);
       const entryStat = await (0, import_promises15.lstat)(fullPath);
       if (entryStat.isSymbolicLink()) {
         continue;
@@ -41660,7 +41690,7 @@ var AutoVersioningService = class _AutoVersioningService {
    * literals (e.g. the X-Fern-SDK-Name header value) in all .go files.
    */
   async addSuffixToGoFiles(repoRoot, modulePath, suffix) {
-    const goFiles = await this.walkDirectory(repoRoot, (filePath) => (0, import_path22.extname)(filePath) === ".go");
+    const goFiles = await this.walkDirectory(repoRoot, (filePath) => (0, import_path23.extname)(filePath) === ".go");
     await this.processInParallel(goFiles, (filePath) => this.addSuffixToGoFile(filePath, modulePath, suffix));
   }
   /**
@@ -41706,7 +41736,7 @@ var AutoVersioningService = class _AutoVersioningService {
   async addSuffixToMarkdownFiles(repoRoot, modulePath, suffix) {
     const markdownFiles = await this.walkDirectory(
       repoRoot,
-      (filePath) => (0, import_path22.extname)(filePath).toLowerCase() === ".md"
+      (filePath) => (0, import_path23.extname)(filePath).toLowerCase() === ".md"
     );
     await this.processInParallel(
       markdownFiles,
@@ -42181,7 +42211,8 @@ var AutoVersionStep = class extends BaseStep {
     };
   }
   async finalizeWithBump(params) {
-    const { service, language, mappedMagicVersion, previousVersion, analysis } = params;
+    const { service, language, mappedMagicVersion, previousVersion } = params;
+    const analysis = this.withChangelogFallback(params.analysis);
     const newVersion = incrementVersion(previousVersion, analysis.versionBump);
     this.logger.info(`AutoVersionStep: ${analysis.versionBump} bump: ${previousVersion} \u2192 ${newVersion}`);
     await service.replaceMagicVersion(this.outputDir, mappedMagicVersion, newVersion);
@@ -42235,7 +42266,8 @@ var AutoVersionStep = class extends BaseStep {
    * the bumped version but does NOT commit — GithubStep handles the commit.
    */
   async finalizeWithBumpNonReplay(params) {
-    const { service, language, mappedMagicVersion, previousVersion, analysis } = params;
+    const { service, language, mappedMagicVersion, previousVersion } = params;
+    const analysis = this.withChangelogFallback(params.analysis);
     const newVersion = incrementVersion(previousVersion, analysis.versionBump);
     this.logger.info(
       `AutoVersionStep (non-replay): ${analysis.versionBump} bump: ${previousVersion} \u2192 ${newVersion}`
@@ -42345,7 +42377,7 @@ var AutoVersionStep = class extends BaseStep {
   }
   async readVersionFromMetadata() {
     try {
-      const output = (0, import_child_process4.execFileSync)("git", ["show", "HEAD~1:.fern/metadata.json"], {
+      const output = (0, import_child_process5.execFileSync)("git", ["show", "HEAD~1:.fern/metadata.json"], {
         cwd: this.outputDir,
         encoding: "utf-8",
         stdio: "pipe"
@@ -42388,7 +42420,7 @@ var AutoVersionStep = class extends BaseStep {
    */
   readVersionFromMetadataAtHead() {
     try {
-      const output = (0, import_child_process4.execFileSync)("git", ["show", "HEAD:.fern/metadata.json"], {
+      const output = (0, import_child_process5.execFileSync)("git", ["show", "HEAD:.fern/metadata.json"], {
         cwd: this.outputDir,
         encoding: "utf-8",
         stdio: "pipe"
@@ -42406,11 +42438,11 @@ var AutoVersionStep = class extends BaseStep {
    * the diff, matching LocalTaskHandler.generateDiffFile() behavior.
    */
   gitDiffHead() {
-    (0, import_child_process4.execFileSync)("git", ["add", "-N", "."], {
+    (0, import_child_process5.execFileSync)("git", ["add", "-N", "."], {
       cwd: this.outputDir,
       stdio: "pipe"
     });
-    return (0, import_child_process4.execFileSync)("git", ["diff", "HEAD", "--", ".", ":(exclude).fern/metadata.json"], {
+    return (0, import_child_process5.execFileSync)("git", ["diff", "HEAD", "--", ".", ":(exclude).fern/metadata.json"], {
       cwd: this.outputDir,
       encoding: "utf-8",
       stdio: "pipe",
@@ -42449,7 +42481,7 @@ var AutoVersionStep = class extends BaseStep {
       return false;
     }
     try {
-      (0, import_child_process4.execFileSync)("git", ["cat-file", "-e", `${sha}^{commit}`], {
+      (0, import_child_process5.execFileSync)("git", ["cat-file", "-e", `${sha}^{commit}`], {
         cwd: this.outputDir,
         stdio: "pipe"
       });
@@ -42467,7 +42499,7 @@ var AutoVersionStep = class extends BaseStep {
     const start = this.commitExists(currentGenerationSha) ? currentGenerationSha : "HEAD";
     let log;
     try {
-      log = (0, import_child_process4.execFileSync)("git", ["log", "--first-parent", "--format=%H%x00%s", start], {
+      log = (0, import_child_process5.execFileSync)("git", ["log", "--first-parent", "--format=%H%x00%s", start], {
         cwd: this.outputDir,
         encoding: "utf-8",
         stdio: "pipe",
@@ -42509,7 +42541,7 @@ var AutoVersionStep = class extends BaseStep {
     }
   }
   gitDiff(from, to) {
-    return (0, import_child_process4.execFileSync)("git", ["diff", from, to, "--", ".", ":(exclude).fern/metadata.json"], {
+    return (0, import_child_process5.execFileSync)("git", ["diff", from, to, "--", ".", ":(exclude).fern/metadata.json"], {
       cwd: this.outputDir,
       encoding: "utf-8",
       stdio: "pipe",
@@ -42522,12 +42554,12 @@ var AutoVersionStep = class extends BaseStep {
     const fullMessage = body.length > 0 ? `${COMMIT_MARKER} ${subject}
 
 ${body}` : `${COMMIT_MARKER} ${subject}`;
-    (0, import_child_process4.execFileSync)("git", ["add", "-A"], { cwd: this.outputDir, stdio: "pipe" });
-    (0, import_child_process4.execFileSync)("git", ["commit", "--allow-empty", "-m", fullMessage], {
+    (0, import_child_process5.execFileSync)("git", ["add", "-A"], { cwd: this.outputDir, stdio: "pipe" });
+    (0, import_child_process5.execFileSync)("git", ["commit", "--allow-empty", "-m", fullMessage], {
       cwd: this.outputDir,
       stdio: "pipe"
     });
-    return (0, import_child_process4.execFileSync)("git", ["rev-parse", "HEAD"], {
+    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "HEAD"], {
       cwd: this.outputDir,
       encoding: "utf-8",
       stdio: "pipe"
@@ -42535,13 +42567,33 @@ ${body}` : `${COMMIT_MARKER} ${subject}`;
   }
   async prependChangelogEntry(params) {
     const { version: version2, entry } = params;
-    const changelogPath = (0, import_path23.join)(this.outputDir, "changelog.md");
+    const changelogPath = (0, import_path24.join)(this.outputDir, "changelog.md");
     let existing = "";
-    if ((0, import_fs15.existsSync)(changelogPath)) {
+    if ((0, import_fs16.existsSync)(changelogPath)) {
       existing = await (0, import_promises16.readFile)(changelogPath, "utf-8");
     }
     await (0, import_promises16.writeFile)(changelogPath, prependChangelogBlock({ existingContent: existing, version: version2, entry }), "utf-8");
   }
+  /**
+   * MAJOR/MINOR bumps must ship a changelog entry. FAI occasionally returns a
+   * bump with a populated `pr_description` / `version_bump_reason` but an empty
+   * `changelog_entry`; reuse that text rather than writing a version-only block.
+   */
+  withChangelogFallback(analysis) {
+    const fallback = resolveChangelogEntryFallbackWithSource(analysis);
+    if (fallback == null) {
+      if (analysis.versionBump !== "PATCH" && !hasText(analysis.changelogEntry)) {
+        this.logger.warn(
+          `AutoVersionStep: FAI returned a ${analysis.versionBump} bump without a changelog entry and no fallback text.`
+        );
+      }
+      return analysis;
+    }
+    this.logger.warn(
+      `AutoVersionStep: FAI returned a ${analysis.versionBump} bump without a changelog entry; using the ${fallback.source} instead.`
+    );
+    return { ...analysis, changelogEntry: fallback.text };
+  }
   brandMessage(message) {
     if (this.config.isWhitelabel) {
       return message;
@@ -42572,10 +42624,7 @@ ${body}` : `${COMMIT_MARKER} ${subject}`;
   }
   async analyzeChunks(chunks, language, previousVersion) {
     const { client, VersionBump: VersionBump4 } = await this.loadBaml();
-    let bestBump = VersionBump4.NO_CHANGE;
-    let bestMessage = "";
-    let bestVersionBumpReason;
-    const changelogEntries = [];
+    const chunkAnalyses = [];
     for (let i2 = 0; i2 < chunks.length; i2++) {
       const chunk = chunks[i2];
       if (!chunk) {
@@ -42591,20 +42640,22 @@ ${body}` : `${COMMIT_MARKER} ${subject}`;
       if (analysis.version_bump === VersionBump4.NO_CHANGE) {
         continue;
       }
-      const prev = bestBump;
-      bestBump = maxVersionBump(bestBump, analysis.version_bump);
-      if (bestBump !== prev) {
-        bestMessage = analysis.message;
-        bestVersionBumpReason = analysis.version_bump_reason;
-      }
-      const entry = analysis.changelog_entry?.trim();
-      if (entry) {
-        changelogEntries.push(entry);
-      }
+      chunkAnalyses.push({
+        versionBump: analysis.version_bump,
+        message: analysis.message,
+        changelogEntry: analysis.changelog_entry,
+        versionBumpReason: analysis.version_bump_reason
+      });
     }
-    if (bestBump === VersionBump4.NO_CHANGE) {
+    if (chunkAnalyses.length === 0) {
       return null;
     }
+    const { bestBump, bestMessage, bestVersionBumpReason, changelogEntries, usedBumpReasonAsEntry } = aggregateChunkAnalyses(chunkAnalyses);
+    if (usedBumpReasonAsEntry) {
+      this.logger.warn(
+        `AutoVersionStep: no chunk produced a changelog entry for the ${bestBump} bump; using its version bump reason instead.`
+      );
+    }
     if (changelogEntries.length <= 1) {
       return {
         versionBump: bestBump,
@@ -42720,6 +42771,57 @@ ${body}` : `${COMMIT_MARKER} ${subject}`;
     return adapter;
   }
 };
+function aggregateChunkAnalyses(chunkAnalyses) {
+  let bestBump = "NO_CHANGE";
+  let bestMessage = "";
+  let bestVersionBumpReason;
+  const entries2 = [];
+  for (const analysis of chunkAnalyses) {
+    const prev = bestBump;
+    bestBump = maxVersionBump(bestBump, analysis.versionBump);
+    if (bestBump !== prev) {
+      bestMessage = analysis.message;
+      bestVersionBumpReason = analysis.versionBumpReason;
+    }
+    const text = analysis.changelogEntry?.trim();
+    if (text) {
+      entries2.push({ bump: analysis.versionBump, text });
+    }
+  }
+  const changelogEntries = entries2.map((entry) => entry.text);
+  const hasEntryAtBestBump = entries2.some((entry) => entry.bump === bestBump);
+  const usedBumpReasonAsEntry = bestBump !== "PATCH" && !hasEntryAtBestBump && hasText(bestVersionBumpReason);
+  if (usedBumpReasonAsEntry && bestVersionBumpReason != null) {
+    changelogEntries.unshift(bestVersionBumpReason.trim());
+  }
+  return { bestBump, bestMessage, bestVersionBumpReason, changelogEntries, usedBumpReasonAsEntry };
+}
+function hasText(value) {
+  return value != null && value.trim().length > 0;
+}
+function commitMessageBody(message) {
+  const trimmed2 = message.trimEnd();
+  const withoutTrailer = trimmed2.endsWith(FERN_TRAILER) ? trimmed2.slice(0, -FERN_TRAILER.length) : trimmed2;
+  const [, ...rest] = withoutTrailer.split("\n");
+  const body = rest.join("\n").trim();
+  return body.length > 0 ? body : void 0;
+}
+function resolveChangelogEntryFallbackWithSource(analysis) {
+  if (hasText(analysis.changelogEntry) || analysis.versionBump === "PATCH") {
+    return void 0;
+  }
+  const candidates = [
+    ["PR description", analysis.prDescription],
+    ["version bump reason", analysis.versionBumpReason],
+    ["commit message body", commitMessageBody(analysis.message)]
+  ];
+  for (const [source, text] of candidates) {
+    if (hasText(text)) {
+      return { source, text: text.trim() };
+    }
+  }
+  return void 0;
+}
 var FAI_VERSION_BUMPS = ["MAJOR", "MINOR", "PATCH", "NO_CHANGE"];
 function isFaiAnalyzeResponse(value) {
   if (typeof value !== "object" || value == null) {
@@ -42736,7 +42838,7 @@ function nonEmpty(value) {
 }
 
 // src/pipeline/steps/GenerationCommitStep.ts
-var import_child_process5 = require("child_process");
+var import_child_process6 = require("child_process");
 var GenerationCommitStep = class extends BaseStep {
   constructor(outputDir, logger, config, cliVersion, generatorVersions) {
     super(outputDir, logger);
@@ -42767,7 +42869,7 @@ var GenerationCommitStep = class extends BaseStep {
       const reason = error instanceof ReplayPrepareError ? error.reason : String(error);
       if (headBeforePrepare != null) {
         try {
-          (0, import_child_process5.execFileSync)("git", ["reset", "--hard", headBeforePrepare], {
+          (0, import_child_process6.execFileSync)("git", ["reset", "--hard", headBeforePrepare], {
             cwd: this.outputDir,
             stdio: "pipe"
           });
@@ -42803,7 +42905,7 @@ var GenerationCommitStep = class extends BaseStep {
 };
 function tryRevParse(cwd2, rev) {
   try {
-    return (0, import_child_process5.execFileSync)("git", ["rev-parse", "--verify", rev], {
+    return (0, import_child_process6.execFileSync)("git", ["rev-parse", "--verify", rev], {
       cwd: cwd2,
       encoding: "utf-8",
       stdio: "pipe"
@@ -42815,7 +42917,7 @@ function tryRevParse(cwd2, rev) {
 
 // src/pipeline/steps/GithubStep.ts
 var import_promises17 = require("fs/promises");
-var import_path24 = require("path");
+var import_path25 = require("path");
 
 // src/pipeline/github/createReplayBranch.ts
 async function createReplayBranch(repository, branchName, commitMessage, replayConflictInfo, logger) {
@@ -43587,7 +43689,7 @@ var GithubStep = class extends BaseStep {
   }
   async ensureFernignore() {
     this.logger.debug("Checking for .fernignore file...");
-    const fernignorePath = (0, import_path24.join)(this.outputDir, ".fernignore");
+    const fernignorePath = (0, import_path25.join)(this.outputDir, ".fernignore");
     try {
       await (0, import_promises17.access)(fernignorePath);
       this.logger.debug(".fernignore already exists");
@@ -43614,7 +43716,7 @@ var GithubStep = class extends BaseStep {
     if (entry.length === 0 && resolved.newVersion == null) {
       return false;
     }
-    const changelogPath = (0, import_path24.join)(this.outputDir, "changelog.md");
+    const changelogPath = (0, import_path25.join)(this.outputDir, "changelog.md");
     let existing;
     try {
       existing = await (0, import_promises17.readFile)(changelogPath, "utf-8");
@@ -43732,7 +43834,7 @@ function resolveChangelogUrl({
 }
 
 // src/pipeline/steps/ReplayStep.ts
-var import_child_process6 = require("child_process");
+var import_child_process7 = require("child_process");
 var ReplayStep = class extends BaseStep {
   constructor(outputDir, logger, config, cliVersion, generatorVersions) {
     super(outputDir, logger);
@@ -43859,7 +43961,7 @@ var ReplayStep = class extends BaseStep {
    */
   commitLockfileIfUncommitted() {
     try {
-      const status2 = (0, import_child_process6.execFileSync)("git", ["status", "--porcelain", "--", ".fern/replay.lock"], {
+      const status2 = (0, import_child_process7.execFileSync)("git", ["status", "--porcelain", "--", ".fern/replay.lock"], {
         cwd: this.outputDir,
         encoding: "utf-8",
         stdio: ["pipe", "pipe", "pipe"]
@@ -43867,11 +43969,11 @@ var ReplayStep = class extends BaseStep {
       if (status2.length === 0) {
         return;
       }
-      (0, import_child_process6.execFileSync)("git", ["add", "--", ".fern/replay.lock"], {
+      (0, import_child_process7.execFileSync)("git", ["add", "--", ".fern/replay.lock"], {
         cwd: this.outputDir,
         stdio: "pipe"
       });
-      (0, import_child_process6.execFileSync)(
+      (0, import_child_process7.execFileSync)(
         "git",
         [
           "-c",
@@ -43891,6 +43993,66 @@ var ReplayStep = class extends BaseStep {
   }
 };
 
+// ../cli/generation/local-generation/docker-utils/lib/dockerHubOatLogin.js
+var DOCKERHUB_OAT_ENV_VAR = "DOCKERHUB_OAT";
+var DOCKERHUB_OAT_USERNAME_ENV_VAR = "DOCKERHUB_OAT_USERNAME";
+var DEFAULT_DOCKERHUB_OAT_USERNAME = "fernenterprise";
+var DOCKER_HUB_HOSTS = /* @__PURE__ */ new Set([
+  "docker.io",
+  "index.docker.io",
+  "registry-1.docker.io",
+  "registry.hub.docker.com"
+]);
+function getDockerHubNamespace(imageName) {
+  const parts = imageName.split("/");
+  const [first2] = parts;
+  if (first2 == null || parts.length < 2) {
+    return void 0;
+  }
+  const host = first2.toLowerCase();
+  const isRegistryHost = host.includes(".") || host.includes(":") || host === "localhost";
+  if (!isRegistryHost) {
+    return first2;
+  }
+  if (!DOCKER_HUB_HOSTS.has(host)) {
+    return void 0;
+  }
+  return parts.length >= 3 ? parts[1] : void 0;
+}
+function resolveDockerHubOatLogin(imageName, env3 = process.env) {
+  const token = env3[DOCKERHUB_OAT_ENV_VAR]?.trim();
+  if (token == null || token === "") {
+    return void 0;
+  }
+  const username = env3[DOCKERHUB_OAT_USERNAME_ENV_VAR]?.trim() || DEFAULT_DOCKERHUB_OAT_USERNAME;
+  if (getDockerHubNamespace(imageName) !== username) {
+    return void 0;
+  }
+  return { username, token };
+}
+async function ensureDockerHubOatLogin({ imageName, runner, logger, signal, env: env3 = process.env }) {
+  const credentials = resolveDockerHubOatLogin(imageName, env3);
+  if (credentials == null) {
+    return;
+  }
+  logger?.debug(`Logging in to Docker Hub as ${credentials.username} with ${DOCKERHUB_OAT_ENV_VAR} to pull ${imageName}`);
+  const { exitCode, stdout, stderr } = await loggingExeca(logger, runner ?? "docker", ["login", "--username", credentials.username, "--password-stdin"], {
+    input: credentials.token,
+    reject: false,
+    doNotPipeOutput: true,
+    secrets: [credentials.token],
+    signal
+  });
+  if (exitCode !== 0) {
+    if (signal?.aborted === true) {
+      throw new Error(`Docker Hub login as ${credentials.username} was cancelled.`);
+    }
+    throw new Error(`Failed to log in to Docker Hub as ${credentials.username} using ${DOCKERHUB_OAT_ENV_VAR}. Check that the token is a valid organization access token for ${credentials.username} with pull access to ${imageName}.
+${stdout}
+${stderr}`);
+  }
+}
+
 // ../cli/generation/local-generation/docker-utils/lib/runDocker.js
 var import_promises18 = require("fs/promises");
 var import_tmp_promise3 = __toESM(require_tmp_promise(), 1);
@@ -43925,6 +44087,7 @@ async function pullImage(imageName, runner, signal) {
 }
 async function startContainer({ logger, imageName, runner }) {
   const containerRunner = runner ?? "docker";
+  await ensureDockerHubOatLogin({ imageName, runner, logger });
   const tryStart = async () => {
     const { stdout, exitCode, stderr } = await loggingExeca(logger, containerRunner, ["run", "--user", "root", "-dit", "--entrypoint", "/bin/sh", imageName], {
       reject: false,
@@ -44053,8 +44216,8 @@ function createLogger4(log) {
 }
 
 // src/pipeline/steps/VerificationStep.ts
-var import_fs16 = require("fs");
-var import_path25 = require("path");
+var import_fs17 = require("fs");
+var import_path26 = require("path");
 var CONTAINER_WORKSPACE_PATH = "/workspace";
 var VERIFY_SCRIPT_RELATIVE_PATH = ".fern/verify.sh";
 var VERIFY_SCRIPT_CONTAINER_PATH = `${CONTAINER_WORKSPACE_PATH}/${VERIFY_SCRIPT_RELATIVE_PATH}`;
@@ -44070,8 +44233,8 @@ var VerificationStep = class extends BaseStep {
   generatorVersions;
   name = "verify";
   async execute(_context) {
-    const verifyScriptHostPath = (0, import_path25.join)(this.outputDir, VERIFY_SCRIPT_RELATIVE_PATH);
-    if (!(0, import_fs16.existsSync)(verifyScriptHostPath)) {
+    const verifyScriptHostPath = (0, import_path26.join)(this.outputDir, VERIFY_SCRIPT_RELATIVE_PATH);
+    if (!(0, import_fs17.existsSync)(verifyScriptHostPath)) {
       return { executed: true, success: true, skipped: true };
     }
     const validatorImage = this.deriveValidatorImage();
@@ -44250,8 +44413,8 @@ var PostGenerationPipeline = class {
   async run() {
     if (this.config.github?.enabled) {
       try {
-        (0, import_child_process7.execFileSync)("git", ["config", "user.name", FERN_BOT_NAME2], { cwd: this.config.outputDir });
-        (0, import_child_process7.execFileSync)("git", ["config", "user.email", FERN_BOT_EMAIL2], { cwd: this.config.outputDir });
+        (0, import_child_process8.execFileSync)("git", ["config", "user.name", FERN_BOT_NAME2], { cwd: this.config.outputDir });
+        (0, import_child_process8.execFileSync)("git", ["config", "user.email", FERN_BOT_EMAIL2], { cwd: this.config.outputDir });
       } catch {
       }
     }
@@ -44259,6 +44422,15 @@ var PostGenerationPipeline = class {
       success: true,
       steps: {}
     };
+    if (this.config.github?.enabled && this.config.github.workflows === false) {
+      try {
+        stripGeneratedWorkflows(this.config.outputDir, this.logger);
+      } catch (error) {
+        result.success = false;
+        result.errors = [`failed to strip generated workflows: ${extractErrorMessage(error)}`];
+        return result;
+      }
+    }
     const pipelineContext = {
       previousStepResults: {}
     };
@@ -44761,9 +44933,9 @@ async function createWriteStream(outputPath) {
 }
 async function createWriteStreamFromFile(filepath) {
   if (!await doesPathExist(filepath)) {
-    await (0, import_promises19.mkdir)(import_path26.default.dirname(filepath), { recursive: true });
+    await (0, import_promises19.mkdir)(import_path27.default.dirname(filepath), { recursive: true });
   }
-  return import_fs17.default.createWriteStream(filepath);
+  return import_fs18.default.createWriteStream(filepath);
 }
 /*! Bundled license information:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fern-api/generator-cli",
-  "version": "0.9.56",
+  "version": "0.10.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/fern-api/fern.git",