@gambi97/keel-cli 0.1.1 → 0.2.0

package/README.md

@@ -30,8 +30,9 @@ to `main`, and the infrastructure is live.
 
 - **Near-free to start.** Compute and database scale to zero; an idle project
   costs cents per month, with no expiring trial.
-- **Scales with your product.** Staging and prod from day one; growing is a
-  one-line tfvars change reviewed in a PR.
+- **Scales with your product.** Pick your environments (production only, or
+  add staging and dev) and, if you need it, an application file store; growing
+  is a one-line tfvars change reviewed in a PR.
 - **Nothing to install.** No Terraform, no cloud CLI. Node and git, done.
 - **No secrets in the repo, ever.** Encrypted CI secrets and a dedicated
   secret manager, wired for you.
@@ -151,21 +152,22 @@ local tooling or production credentials.
 
 **Phase A: bootstrap (the CLI, via APIs, after your confirmation)**
 
-| Where        | What                                                                                                                                                                                                     |
-| ------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                     |
-| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking)                                                                                                                     |
-| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; `staging` and `production` environments, the latter gated by manual approval; branch protection on `main` |
-| Infisical    | A project with `staging` and `prod` environments, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (staging, random password) and a `DATABASE_URL` placeholder per environment                      |
+| Where        | What                                                                                                                                                                                                                                                   |
+| ------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Your machine | The generated repo: Terraform, workflows, README, initial git commit                                                                                                                                                                                   |
+| Scaleway     | One Object Storage bucket for Terraform state (versioned, with native state locking)                                                                                                                                                                   |
+| GitHub       | Repository (public or private) pushed to `main`; encrypted Actions secrets; Actions variables; one deployment environment per selected environment (`production` gated by manual approval); branch protection on `main`                                |
+| Infisical    | A project with one environment per selected environment, seeded with `BASIC_AUTH_USER` / `BASIC_AUTH_PASSWORD` (non-production, random password), a `DATABASE_URL` placeholder per environment, and `S3_*` placeholders when Object Storage is enabled |
 
 **Phase B: first deploy (Terraform in GitHub Actions, on push to `main`)**
 
-| Scaleway resource                          | Notes                                                                                                                     |
-| ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------- |
-| Registry namespace                         | Private, one per environment                                                                                              |
-| Container namespace + Serverless Container | The container appears once you set `container_image` in the tfvars; registry and database are created right away          |
-| Serverless SQL Database                    | One per environment; after each apply the pipeline writes a ready-to-use connection string to Infisical as `DATABASE_URL` |
-| IAM application + API key                  | Dedicated credential that can only read/write the database (least privilege), embedded in `DATABASE_URL`                  |
+| Scaleway resource                           | Notes                                                                                                                                           |
+| ------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- |
+| Registry namespace                          | Private, one per environment                                                                                                                    |
+| Container namespace + Serverless Container  | The container appears once you set `container_image` in the tfvars; registry and database are created right away                                |
+| Serverless SQL Database                     | One per environment; after each apply the pipeline writes a ready-to-use connection string to Infisical as `DATABASE_URL`                       |
+| IAM application + API key                   | Dedicated credential that can only read/write the database (least privilege), embedded in `DATABASE_URL`                                        |
+| Object Storage bucket + credential (opt-in) | Only with `--object-storage`: one bucket per environment plus a dedicated least-privilege credential; coordinates synced to Infisical as `S3_*` |
 
 No custom domain is configured: the app gets an auto-generated Scaleway URL.
 Add one later with a single `scaleway_container_domain` resource.
@@ -176,28 +178,29 @@ Add one later with a single `scaleway_container_domain` resource.
 my-app/
 ├── README.md                    # operating manual for the repo
 ├── .github/workflows/
-│   ├── terraform-plan.yml       # PR: fmt + validate + plan (staging & prod)
-│   ├── terraform-apply.yml      # main: apply staging -> approval -> apply prod
+│   ├── terraform-plan.yml       # PR: fmt + validate + plan (every environment)
+│   ├── terraform-apply.yml      # main: apply each env in order; production gated
 │   └── terraform-drift.yml      # weekly: read-only plan, opens an issue on drift
 ├── versions.tf · providers.tf · backend.tf
 ├── backend.hcl.example          # state bucket coordinates (backend.hcl is git-ignored)
 ├── variables.tf · main.tf · outputs.tf
-├── staging.tfvars · prod.tfvars # non-sensitive config only, committed
-└── modules/app_stack/           # registry + container + database + db credential
+├── <env>.tfvars                 # one per environment, non-sensitive config, committed
+└── modules/app_stack/           # registry + container + database (+ object storage) + credentials
 ```
 
-Environments are separated with **Terraform workspaces**: same code, two
-independent states in one bucket, differences confined to the two `.tfvars`
-files.
+Environments are separated with **Terraform workspaces**: same code, one
+independent state per environment in one bucket, differences confined to the
+per-environment `<env>.tfvars` files.
 
-| Data                              | Lives in                 | Why                                                                  |
-| --------------------------------- | ------------------------ | -------------------------------------------------------------------- |
-| Scaleway API keys                 | GitHub encrypted secrets | CI needs them to run Terraform                                       |
-| Infisical machine identity        | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                        |
-| Basic Auth user/password          | Infisical (staging)      | App secret, injected into the container, rotatable                   |
-| Database connection string        | Infisical (both envs)    | Complete, ready-to-use value synced by the pipeline after each apply |
-| Bucket, region, Infisical project | GitHub variables         | Non-sensitive wiring, editable in one place                          |
-| Project name, scaling, image      | Committed tfvars         | Reviewable configuration, no secrets                                 |
+| Data                                | Lives in                 | Why                                                                  |
+| ----------------------------------- | ------------------------ | -------------------------------------------------------------------- |
+| Scaleway API keys                   | GitHub encrypted secrets | CI needs them to run Terraform                                       |
+| Infisical machine identity          | GitHub encrypted secrets | Lets Terraform read app secrets at plan/apply                        |
+| Basic Auth user/password            | Infisical (non-prod)     | App secret, injected into the container, rotatable                   |
+| Database connection string          | Infisical (each env)     | Complete, ready-to-use value synced by the pipeline after each apply |
+| Object Storage coordinates (opt-in) | Infisical (each env)     | `S3_*` values synced by the pipeline after each apply                |
+| Bucket, region, Infisical project   | GitHub variables         | Non-sensitive wiring, editable in one place                          |
+| Project name, scaling, image        | Committed tfvars         | Reviewable configuration, no secrets                                 |
 
 ## After the bootstrap
 
@@ -206,19 +209,21 @@ day-2 work (scaling, rotating secrets, custom domains, troubleshooting). The
 short version of the first deploy:
 
 1. **Push to `main`** (or merge a PR): the pipeline provisions registry and
-   databases. Approve the `production` gate when prompted.
+   databases (and an Object Storage bucket, if enabled). Approve the
+   `production` gate when prompted.
 2. **Build and push your app image** to the registry endpoint from the apply
-   output:
+   output (replace `<env>` with your target environment):
    ```sh
-   docker login rg.fr-par.scw.cloud/my-app-staging -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
-   docker build -t rg.fr-par.scw.cloud/my-app-staging/app:latest .
-   docker push rg.fr-par.scw.cloud/my-app-staging/app:latest
+   docker login rg.fr-par.scw.cloud/my-app-<env> -u nologin --password-stdin <<< "$SCW_SECRET_KEY"
+   docker build -t rg.fr-par.scw.cloud/my-app-<env>/app:latest .
+   docker push rg.fr-par.scw.cloud/my-app-<env>/app:latest
    ```
 3. **Set `container_image`** in the tfvars and open a PR: the next apply
    creates the containers.
 4. **Replace the placeholder secrets** in Infisical with real values. The app
-   reads `DATABASE_URL` and `BASIC_AUTH_*` from its environment; on staging
-   it also receives `BASIC_AUTH_ENABLED=true` and enforces it.
+   reads `DATABASE_URL`, `BASIC_AUTH_*` and (if enabled) `S3_*` from its
+   environment; non-production environments also receive `BASIC_AUTH_ENABLED=true`
+   and enforce it.
 
 ## Prerequisites
 
@@ -280,7 +285,8 @@ creating anything**.
   locking (`use_lockfile`), so concurrent applies cannot corrupt it.
 - The app connects to its database with a **dedicated least-privilege IAM
   credential** (read/write on that database, nothing else), not with your
-  main API key.
+  main API key. Object Storage, when enabled, gets its own separate dedicated
+  credential the same way.
 - A weekly drift-detection plan opens an issue when the real infrastructure
   no longer matches the code.
 
@@ -296,6 +302,7 @@ included (Scaleway `fr-par` list prices, excl. VAT):
 | Serverless SQL (both envs)        | idle most of the time      | ~€0.20 storage + a few cents of compute    |
 | Object Storage (Terraform state)  | a few MB                   | ~€0                                        |
 | Container Registry                | 1-2 image versions         | ~€0.05 (€0 if the registry is public)      |
+| Object Storage (optional)         | only if `--object-storage` | ~€0 idle (a few GB of storage when used)   |
 | **Total to start**                |                            | **under ~€1 / month**                      |
 
 Compute is billed per second, only while actually serving: an idle container
@@ -331,9 +338,20 @@ Scaleway Serverless Containers have no built-in auth in front of public
 endpoints. Credentials live in Infisical, the container gets
 `BASIC_AUTH_ENABLED=true`, and a few lines of middleware enforce it.
 
-**Can I add more environments?**
-Yes: add a workspace, a `<env>.tfvars`, an Infisical environment, and mirror
-one job in each workflow.
+**Which environments do I get, and can I change them?**
+You choose at creation: production only, staging + production (default), or
+dev + staging + production — interactively or with `--environments`
+(e.g. `--environments prod` or `--environments dev,staging,prod`). Production
+is always gated by a manual approval; non-production environments enable Basic
+Auth by default. To add one to an existing repo later: add a `<env>.tfvars`,
+an Infisical environment, a matrix entry in the plan/drift workflows, and a
+chained job in `terraform-apply.yml`.
+
+**Can I store files, not just rows?**
+Yes, opt in with `--object-storage` (or answer yes interactively). Each
+environment gets its own Object Storage bucket and a dedicated credential; the
+pipeline syncs the `S3_*` coordinates to Infisical for the app to read. It is
+off by default — many apps only need the database.
 
 ## CLI reference
 
@@ -352,7 +370,12 @@ one job in each workflow.
 --github-token <token>         or env GITHUB_TOKEN / GH_TOKEN (scopes: repo, workflow)
 --repo-name <name>             GitHub repository name (default: project name)
 --private / --public           Repository visibility (default: public)
---no-basic-auth                Disable Basic Auth on staging
+--environments <preset>        prod | staging+prod | dev+staging+prod
+                               (or a list like "dev,staging,prod"; default staging+prod)
+--object-storage               Provision a per-environment Object Storage bucket
+--no-object-storage            Do not provision Object Storage (default)
+--no-basic-auth                Disable Basic Auth on non-production environments
+--dev-min-scale <n>            Default 0        --dev-max-scale <n>       Default 1
 --staging-min-scale <n>        Default 0        --staging-max-scale <n>   Default 1
 --prod-min-scale <n>           Default 0        --prod-max-scale <n>      Default 2
 --config <file.json>           Load answers from a JSON file
@@ -368,8 +391,10 @@ is taken from the environment or asked interactively:
 {
   "projectName": "my-app",
   "region": "fr-par",
+  "environments": ["staging", "prod"],
+  "objectStorage": true,
   "github": { "repoPrivate": true },
-  "scaling": { "prodMaxScale": 4 }
+  "scaling": { "prod": { "maxScale": 4 } }
 }
 ```
 

package/dist/bootstrap/github.js

@@ -115,8 +115,8 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_PROJECT_ID: infisicalProjectId,
         INFISICAL_HOST: answers.infisical.host,
     });
-    await configureEnvironments(ctx);
-    await protectMainBranch(ctx);
+    await configureEnvironments(ctx, answers);
+    await protectMainBranch(ctx, answers);
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -157,29 +157,27 @@ async function setVariables(ctx, variables) {
         }
     }
 }
-/** staging deploys automatically; production requires a manual approval. */
-async function configureEnvironments(ctx) {
-    await ctx.octokit.repos.createOrUpdateEnvironment({
-        owner: ctx.owner,
-        repo: ctx.repo,
-        environment_name: 'staging',
-    });
-    await ctx.octokit.repos.createOrUpdateEnvironment({
-        owner: ctx.owner,
-        repo: ctx.repo,
-        environment_name: 'production',
-        reviewers: [{ type: 'User', id: ctx.ownerId }],
-    });
+/** Each environment gets a GitHub deployment environment; gated ones (prod) require approval. */
+async function configureEnvironments(ctx, answers) {
+    for (const env of answers.environments) {
+        await ctx.octokit.repos.createOrUpdateEnvironment({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            environment_name: env.githubEnvironment,
+            ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+        });
+    }
 }
 /** Require a green plan on PRs and forbid force-pushes/deletion of main. */
-async function protectMainBranch(ctx) {
+async function protectMainBranch(ctx, answers) {
     await ctx.octokit.repos.updateBranchProtection({
         owner: ctx.owner,
         repo: ctx.repo,
         branch: 'main',
         required_status_checks: {
             strict: false,
-            contexts: ['plan (staging)', 'plan (prod)'],
+            // Matches the job names produced by the plan workflow: "plan (<slug>)".
+            contexts: answers.environments.map((env) => `plan (${env.slug})`),
         },
         enforce_admins: false,
         required_pull_request_reviews: null,

package/dist/bootstrap/infisical.js

@@ -43,10 +43,9 @@ async function createProject(host, token, name) {
     }
     return data.project;
 }
-async function ensureEnvironment(host, token, project, slug) {
+async function ensureEnvironment(host, token, project, slug, name) {
     if (project.environments?.some((e) => e.slug === slug))
         return;
-    const name = slug === 'prod' ? 'Production' : 'Staging';
     const { status, data } = await api(host, `/api/v1/workspace/${project.id}/environments`, { method: 'POST', token, body: { name, slug } });
     // 400 usually means the environment already exists: fine for idempotency.
     if (status !== 200 && status !== 400) {
@@ -72,7 +71,14 @@ async function seedSecret(host, token, projectId, environment, name, value) {
         throw new InfisicalError(`Could not seed secret ${name} in ${environment} (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
     }
 }
-/** Create/reuse the project, ensure staging+prod, seed placeholder secrets. */
+const S3_PLACEHOLDER_KEYS = [
+    'S3_BUCKET',
+    'S3_ENDPOINT',
+    'S3_REGION',
+    'S3_ACCESS_KEY',
+    'S3_SECRET_KEY',
+];
+/** Create/reuse the project, ensure every environment, seed placeholder secrets. */
 export async function bootstrapInfisical(answers) {
     const { host, projectName } = answers.infisical;
     const token = await login(answers);
@@ -82,14 +88,23 @@ export async function bootstrapInfisical(answers) {
         project = await createProject(host, token, projectName);
         createdProject = true;
     }
-    await ensureEnvironment(host, token, project, 'staging');
-    await ensureEnvironment(host, token, project, 'prod');
-    if (answers.basicAuthStaging) {
-        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_USER', 'staging');
-        await seedSecret(host, token, project.id, 'staging', 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+    for (const env of answers.environments) {
+        await ensureEnvironment(host, token, project, env.slug, env.displayName);
     }
+    // Real values arrive from the pipeline after the first apply; seed placeholders
+    // now so the secret paths exist and the container has something to read.
     const placeholder = 'placeholder-updated-by-pipeline-after-first-apply';
-    await seedSecret(host, token, project.id, 'staging', 'DATABASE_URL', placeholder);
-    await seedSecret(host, token, project.id, 'prod', 'DATABASE_URL', placeholder);
+    for (const env of answers.environments) {
+        if (env.basicAuth) {
+            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_USER', env.slug);
+            await seedSecret(host, token, project.id, env.slug, 'BASIC_AUTH_PASSWORD', randomBytes(18).toString('base64url'));
+        }
+        await seedSecret(host, token, project.id, env.slug, 'DATABASE_URL', placeholder);
+        if (answers.objectStorage) {
+            for (const key of S3_PLACEHOLDER_KEYS) {
+                await seedSecret(host, token, project.id, env.slug, key, placeholder);
+            }
+        }
+    }
     return { projectId: project.id, createdProject };
 }

package/dist/config.js

@@ -1,12 +1,49 @@
 export const REGIONS = ['fr-par', 'nl-ams', 'pl-waw'];
 export const DEFAULT_INFISICAL_HOST = 'https://app.infisical.com';
 export const DEFAULT_REGION = 'fr-par';
-export const DEFAULT_SCALING = {
-    stagingMinScale: 0,
-    stagingMaxScale: 1,
-    prodMinScale: 0,
-    prodMaxScale: 2,
+/**
+ * The environments keel knows how to provision. The order here is also the
+ * deploy order (dev first, prod last) and drives the apply-workflow chain.
+ */
+export const KNOWN_ENV_SLUGS = ['dev', 'staging', 'prod'];
+const ENV_DEFAULTS = {
+    dev: {
+        displayName: 'Development',
+        githubEnvironment: 'dev',
+        production: false,
+        gated: false,
+        minScale: 0,
+        maxScale: 1,
+    },
+    staging: {
+        displayName: 'Staging',
+        githubEnvironment: 'staging',
+        production: false,
+        gated: false,
+        minScale: 0,
+        maxScale: 1,
+    },
+    prod: {
+        displayName: 'Production',
+        githubEnvironment: 'production',
+        production: true,
+        gated: true,
+        minScale: 0,
+        maxScale: 2,
+    },
 };
+/** Default min/max scale for an environment, for prompts and summaries. */
+export function envDefaultScale(slug) {
+    const def = ENV_DEFAULTS[slug];
+    return { minScale: def.minScale, maxScale: def.maxScale };
+}
+/** Named presets exposed on the CLI; the value is the list of env slugs. */
+export const ENV_PRESETS = {
+    prod: ['prod'],
+    'staging+prod': ['staging', 'prod'],
+    'dev+staging+prod': ['dev', 'staging', 'prod'],
+};
+export const DEFAULT_ENV_PRESET = 'staging+prod';
 export class ConfigError extends Error {
 }
 const PROJECT_NAME_RE = /^[a-z](?:[a-z0-9-]{0,48}[a-z0-9])?$/;
@@ -32,6 +69,35 @@ export function validateScale(value, label) {
     }
     return n;
 }
+/**
+ * Parse a `--environments` value into an ordered, de-duplicated slug list.
+ * Accepts preset names ("staging+prod") or free lists ("dev,staging,prod").
+ */
+export function parseEnvironments(raw) {
+    const trimmed = raw.trim();
+    if (ENV_PRESETS[trimmed])
+        return ENV_PRESETS[trimmed];
+    const slugs = trimmed
+        .split(/[\s,+]+/)
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    return normalizeEnvSlugs(slugs);
+}
+/** Validate slugs against the known set and return them in deploy order. */
+export function normalizeEnvSlugs(slugs) {
+    for (const slug of slugs) {
+        if (!KNOWN_ENV_SLUGS.includes(slug)) {
+            throw new ConfigError(`Unknown environment "${slug}". Supported environments: ${KNOWN_ENV_SLUGS.join(', ')} ` +
+                `(or a preset: ${Object.keys(ENV_PRESETS).join(', ')}).`);
+        }
+    }
+    const chosen = new Set(slugs);
+    const ordered = KNOWN_ENV_SLUGS.filter((s) => chosen.has(s));
+    if (ordered.length === 0) {
+        throw new ConfigError('At least one environment is required.');
+    }
+    return ordered;
+}
 export function validateUrl(value, label) {
     let parsed;
     try {
@@ -79,26 +145,68 @@ export function fromEnv(env) {
 export function mergeAnswers(...sources) {
     const out = { scaleway: {}, infisical: {}, github: {}, scaling: {} };
     for (const src of sources) {
-        for (const key of ['projectName', 'region', 'targetDir', 'basicAuthStaging']) {
+        for (const key of [
+            'projectName',
+            'region',
+            'targetDir',
+            'basicAuth',
+            'objectStorage',
+        ]) {
             const value = src[key];
             if (value !== undefined) {
                 out[key] = value;
             }
         }
-        for (const group of ['scaleway', 'infisical', 'github', 'scaling']) {
+        if (src.environments !== undefined) {
+            out.environments = src.environments;
+        }
+        for (const group of ['scaleway', 'infisical', 'github']) {
             for (const [k, v] of Object.entries(src[group] ?? {})) {
                 if (v !== undefined) {
                     out[group][k] = v;
                 }
             }
         }
+        // Scaling is a per-slug record: merge each slug's fields, deepest wins.
+        for (const [slug, override] of Object.entries(src.scaling ?? {})) {
+            if (!override)
+                continue;
+            const current = out.scaling[slug] ?? {};
+            if (override.minScale !== undefined)
+                current.minScale = override.minScale;
+            if (override.maxScale !== undefined)
+                current.maxScale = override.maxScale;
+            out.scaling[slug] = current;
+        }
     }
     return out;
 }
+/** Build the resolved environment list from selected slugs + overrides. */
+export function resolveEnvironments(slugs, basicAuth, overrides) {
+    return slugs.map((slug) => {
+        const def = ENV_DEFAULTS[slug];
+        const ov = overrides[slug] ?? {};
+        return {
+            slug,
+            displayName: def.displayName,
+            githubEnvironment: def.githubEnvironment,
+            production: def.production,
+            gated: def.gated,
+            // Basic Auth is a non-production safety net; production is never gated by it.
+            basicAuth: def.production ? false : basicAuth,
+            minScale: validateScale(ov.minScale ?? def.minScale, `${slug} min scale`),
+            maxScale: validateScale(ov.maxScale ?? def.maxScale, `${slug} max scale`),
+        };
+    });
+}
 /** Validate a fully-collected set of answers and freeze it into a Config. */
 export function finalizeAnswers(partial) {
     const projectName = validateProjectName(requireString(partial.projectName, 'project name'));
     const region = validateRegion(partial.region ?? DEFAULT_REGION);
+    const slugs = partial.environments && partial.environments.length > 0
+        ? normalizeEnvSlugs(partial.environments)
+        : ENV_PRESETS[DEFAULT_ENV_PRESET];
+    const basicAuth = partial.basicAuth ?? true;
     return {
         projectName,
         region,
@@ -121,13 +229,9 @@ export function finalizeAnswers(partial) {
             repoName: validateProjectName(partial.github.repoName?.trim() || projectName),
             repoPrivate: partial.github.repoPrivate ?? false,
         },
-        basicAuthStaging: partial.basicAuthStaging ?? true,
-        scaling: {
-            stagingMinScale: validateScale(partial.scaling.stagingMinScale ?? DEFAULT_SCALING.stagingMinScale, 'staging min scale'),
-            stagingMaxScale: validateScale(partial.scaling.stagingMaxScale ?? DEFAULT_SCALING.stagingMaxScale, 'staging max scale'),
-            prodMinScale: validateScale(partial.scaling.prodMinScale ?? DEFAULT_SCALING.prodMinScale, 'prod min scale'),
-            prodMaxScale: validateScale(partial.scaling.prodMaxScale ?? DEFAULT_SCALING.prodMaxScale, 'prod max scale'),
-        },
+        basicAuth,
+        objectStorage: partial.objectStorage ?? false,
+        environments: resolveEnvironments(slugs, basicAuth, partial.scaling),
     };
 }
 /** List which required values are still missing, for non-interactive runs. */

package/dist/generate.js

@@ -12,17 +12,53 @@ const RENAMES = {
 export function templatesDir() {
     return fileURLToPath(new URL('../templates', import.meta.url));
 }
+/** Global tokens shared by every non per-environment template. */
 export function tokenMap(answers) {
+    const slugs = answers.environments.map((e) => e.slug);
     return {
         __PROJECT_NAME__: answers.projectName,
         __REGION__: answers.region,
         __TF_STATE_BUCKET__: answers.stateBucket,
-        __STAGING_MIN_SCALE__: String(answers.scaling.stagingMinScale),
-        __STAGING_MAX_SCALE__: String(answers.scaling.stagingMaxScale),
-        __PROD_MIN_SCALE__: String(answers.scaling.prodMinScale),
-        __PROD_MAX_SCALE__: String(answers.scaling.prodMaxScale),
+        // YAML inline list for the plan/drift job matrix, e.g. [staging, prod].
+        __ENV_MATRIX__: `[${slugs.join(', ')}]`,
+        // HCL list for the `environment` variable validation in variables.tf.
+        __ENV_SLUGS_TF__: `[${slugs.map((s) => `"${s}"`).join(', ')}]`,
     };
 }
+/** Tokens for one rendered `<env>.tfvars` file. */
+function envTfvarsTokens(answers, env) {
+    return {
+        __PROJECT_NAME__: answers.projectName,
+        __REGION__: answers.region,
+        __ENVIRONMENT__: env.slug,
+        __ENABLE_BASIC_AUTH__: String(env.basicAuth),
+        __ENABLE_OBJECT_STORAGE__: String(answers.objectStorage),
+        __MIN_SCALE__: String(env.minScale),
+        __MAX_SCALE__: String(env.maxScale),
+    };
+}
+/** Templates rendered specially (per environment) instead of copied 1:1. */
+const SPECIAL_TEMPLATES = new Set(['env.tfvars', '.github/workflows/terraform-apply.yml']);
+function isSpecial(rel) {
+    return SPECIAL_TEMPLATES.has(rel) || rel.startsWith('_partials/');
+}
+/**
+ * Assemble the apply workflow: the shared header, then one job per environment
+ * in deploy order, each `needs:` the previous so applies run sequentially.
+ */
+function renderApplyWorkflow(source, answers, globalTokens) {
+    const header = renderContent(readFileSync(join(source, '_partials/apply-header.yml'), 'utf8'), globalTokens, '_partials/apply-header.yml');
+    const jobTemplate = readFileSync(join(source, '_partials/apply-job.yml'), 'utf8');
+    const jobs = answers.environments.map((env, i) => {
+        const previous = answers.environments[i - 1];
+        return renderContent(jobTemplate, {
+            __ENV_SLUG__: env.slug,
+            __GH_ENVIRONMENT__: env.githubEnvironment,
+            __NEEDS_LINE__: previous ? `    needs: apply-${previous.slug}\n` : '',
+        }, '_partials/apply-job.yml');
+    });
+    return header + jobs.join('\n');
+}
 function renderContent(content, tokens, file) {
     let out = content;
     for (const [token, value] of Object.entries(tokens)) {
@@ -59,6 +95,8 @@ export function generateProject(answers, options = {}) {
     mkdirSync(target, { recursive: true });
     const written = [];
     for (const rel of walk(source)) {
+        if (isSpecial(rel))
+            continue;
         const parts = rel.split('/');
         const fileName = parts[parts.length - 1] ?? rel;
         const destRel = [...parts.slice(0, -1), RENAMES[fileName] ?? fileName].join('/');
@@ -71,6 +109,18 @@ export function generateProject(answers, options = {}) {
         }
         written.push(destRel);
     }
+    // Per-environment tfvars: one <slug>.tfvars from the shared env.tfvars template.
+    const envTemplate = readFileSync(join(source, 'env.tfvars'), 'utf8');
+    for (const env of answers.environments) {
+        const destRel = `${env.slug}.tfvars`;
+        writeFileSync(join(target, destRel), renderContent(envTemplate, envTfvarsTokens(answers, env), 'env.tfvars'));
+        written.push(destRel);
+    }
+    // Apply workflow: a header plus one deploy job per environment, chained so
+    // each environment applies only after the previous one succeeded.
+    const applyDestRel = '.github/workflows/terraform-apply.yml';
+    writeFileSync(join(target, applyDestRel), renderApplyWorkflow(source, answers, tokens));
+    written.push(applyDestRel);
     // backend.hcl (git-ignored) so local terraform runs work out of the box.
     cpSync(join(target, 'backend.hcl.example'), join(target, 'backend.hcl'));
     if (options.git !== false) {