@gambi97/keel-cli 0.1.1 → 0.2.1

package/dist/bootstrap/scaleway.js

@@ -1,30 +1,36 @@
-import { CreateBucketCommand, HeadBucketCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
+import { CreateBucketCommand, GetBucketPolicyCommand, HeadBucketCommand, PutBucketPolicyCommand, PutBucketVersioningCommand, S3Client, } from '@aws-sdk/client-s3';
 export class ScalewayError extends Error {
+    code;
+    constructor(message, code = 'api') {
+        super(message);
+        this.code = code;
+    }
 }
 const API_BASE = 'https://api.scaleway.com';
 /**
  * Validate credentials with a harmless read call before creating anything.
- * Also confirms the project belongs to the given organization.
+ * Also confirms the project belongs to the given organization. Read-only: it
+ * proves the key can see the project, not that it can create resources.
  */
-export async function validateScalewayCredentials(answers) {
-    const { secretKey, projectId, organizationId } = answers.scaleway;
+export async function validateScalewayCredentials(scaleway) {
+    const { secretKey, projectId, organizationId } = scaleway;
     const response = await fetch(`${API_BASE}/account/v3/projects/${projectId}`, {
         headers: { 'X-Auth-Token': secretKey },
     });
     if (response.status === 401 || response.status === 403) {
         throw new ScalewayError('Scaleway rejected the API key (401/403). Check SCW_ACCESS_KEY / SCW_SECRET_KEY and ' +
-            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.');
+            'make sure the key can read the project and manage Object Storage, Containers and Serverless SQL.', 'auth');
     }
     if (response.status === 404) {
-        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`);
+        throw new ScalewayError(`Scaleway project ${projectId} not found with this API key.`, 'project');
     }
     if (!response.ok) {
-        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`);
+        throw new ScalewayError(`Scaleway API error while validating credentials: HTTP ${response.status}.`, 'api');
     }
     const project = (await response.json());
     if (project.organization_id && project.organization_id !== organizationId) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
-            `not ${organizationId}. Check --scw-organization-id.`);
+            `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
 }
 function s3Client(answers) {
@@ -37,13 +43,90 @@ function s3Client(answers) {
         },
     });
 }
-/** Create the Terraform state bucket if it does not exist yet (idempotent). */
+/**
+ * Resolve the IAM identity (user or application) that owns the API key, in
+ * the `<kind>:<uuid>` principal form bucket policies expect. Returns
+ * undefined when the key cannot read IAM; the caller degrades to a warning.
+ */
+async function apiKeyPrincipal(scaleway) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/api-keys/${scaleway.accessKey}`, {
+            headers: { 'X-Auth-Token': scaleway.secretKey },
+        });
+        if (!response.ok)
+            return undefined;
+        const key = (await response.json());
+        if (key.application_id)
+            return `application_id:${key.application_id}`;
+        if (key.user_id)
+            return `user_id:${key.user_id}`;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Restrict the state bucket to the identity that owns the bootstrap API key —
+ * the same identity CI authenticates with, so the pipeline keeps working.
+ * Terraform state contains the generated credentials (DATABASE_URL, S3 keys),
+ * and the per-app IAM policies are project-wide for Object Storage: without
+ * this policy the app's own storage credential could read the state. An
+ * existing policy is never overwritten. Failures degrade to a warning: a
+ * missed lockdown must not strand a half-finished bootstrap.
+ */
+async function lockDownStateBucket(client, bucket, answers) {
+    try {
+        await client.send(new GetBucketPolicyCommand({ Bucket: bucket }));
+        return undefined; // A policy is already in place: leave it alone.
+    }
+    catch (error) {
+        const status = error.$metadata?.httpStatusCode;
+        if (status !== 404) {
+            return (`Could not read the policy of bucket "${bucket}" (HTTP ${status ?? 'error'}); ` +
+                'the state bucket was NOT restricted to your identity.');
+        }
+    }
+    const principal = await apiKeyPrincipal(answers.scaleway);
+    if (!principal) {
+        return ('Could not resolve the IAM identity behind the API key, so the state bucket was NOT ' +
+            'restricted: any Object Storage credential in the project can read the Terraform state. ' +
+            'Grant the key IAM read access and re-run, or add a bucket policy manually.');
+    }
+    const policy = {
+        Version: '2023-04-17',
+        Id: 'keel-state-bucket-bootstrap-identity-only',
+        Statement: [
+            {
+                Sid: 'OnlyBootstrapIdentity',
+                Effect: 'Allow',
+                Principal: { SCW: principal },
+                Action: ['*'],
+                Resource: [bucket, `${bucket}/*`],
+            },
+        ],
+    };
+    try {
+        await client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+        return undefined;
+    }
+    catch (error) {
+        return (`Could not apply a policy to bucket "${bucket}" ` +
+            `(${error instanceof Error ? error.message : String(error)}); ` +
+            'the state bucket was NOT restricted to your identity.');
+    }
+}
+/**
+ * Create the Terraform state bucket if it does not exist yet (idempotent) and
+ * restrict it to the bootstrap identity via a bucket policy.
+ */
 export async function ensureStateBucket(answers) {
     const client = s3Client(answers);
     const bucket = answers.stateBucket;
+    let created = false;
     try {
         await client.send(new HeadBucketCommand({ Bucket: bucket }));
-        return { created: false }; // Already exists and we own it.
+        // Already exists and we own it (resume): still ensure the policy below.
     }
     catch (error) {
         const status = error.$metadata?.httpStatusCode;
@@ -54,12 +137,14 @@ export async function ensureStateBucket(answers) {
         if (status !== 404 && status !== 301) {
             throw error;
         }
+        await client.send(new CreateBucketCommand({ Bucket: bucket }));
+        // Versioning protects the state history against accidental overwrites.
+        await client.send(new PutBucketVersioningCommand({
+            Bucket: bucket,
+            VersioningConfiguration: { Status: 'Enabled' },
+        }));
+        created = true;
     }
-    await client.send(new CreateBucketCommand({ Bucket: bucket }));
-    // Versioning protects the state history against accidental overwrites.
-    await client.send(new PutBucketVersioningCommand({
-        Bucket: bucket,
-        VersioningConfiguration: { Status: 'Enabled' },
-    }));
-    return { created: true };
+    const policyWarning = await lockDownStateBucket(client, bucket, answers);
+    return policyWarning ? { created, policyWarning } : { created };
 }

package/dist/config.js

@@ -1,12 +1,51 @@
 export const REGIONS = ['fr-par', 'nl-ams', 'pl-waw'];
 export const DEFAULT_INFISICAL_HOST = 'https://app.infisical.com';
 export const DEFAULT_REGION = 'fr-par';
-export const DEFAULT_SCALING = {
-    stagingMinScale: 0,
-    stagingMaxScale: 1,
-    prodMinScale: 0,
-    prodMaxScale: 2,
+/**
+ * The environments keel knows how to provision. The order here is also the
+ * deploy order (dev first, prod last) and drives the apply-workflow chain.
+ */
+export const KNOWN_ENV_SLUGS = ['dev', 'staging', 'prod'];
+const ENV_DEFAULTS = {
+    dev: {
+        displayName: 'Development',
+        githubEnvironment: 'dev',
+        production: false,
+        gated: false,
+        minScale: 0,
+        maxScale: 1,
+    },
+    staging: {
+        displayName: 'Staging',
+        githubEnvironment: 'staging',
+        production: false,
+        gated: false,
+        minScale: 0,
+        maxScale: 1,
+    },
+    prod: {
+        displayName: 'Production',
+        githubEnvironment: 'production',
+        production: true,
+        gated: true,
+        minScale: 0,
+        // Start small: one instance is enough to go live and costs the least;
+        // raising the ceiling later is a one-line prod.tfvars change.
+        maxScale: 1,
+    },
 };
+/** Default min/max scale for an environment, for prompts and summaries. */
+export function envDefaultScale(slug) {
+    const def = ENV_DEFAULTS[slug];
+    return { minScale: def.minScale, maxScale: def.maxScale };
+}
+/** Named presets exposed on the CLI; the value is the list of env slugs. */
+export const ENV_PRESETS = {
+    prod: ['prod'],
+    'staging+prod': ['staging', 'prod'],
+    'dev+staging+prod': ['dev', 'staging', 'prod'],
+};
+export const DEFAULT_ENV_PRESET = 'staging+prod';
 export class ConfigError extends Error {
 }
 const PROJECT_NAME_RE = /^[a-z](?:[a-z0-9-]{0,48}[a-z0-9])?$/;
@@ -32,6 +71,35 @@ export function validateScale(value, label) {
     }
     return n;
 }
+/**
+ * Parse a `--environments` value into an ordered, de-duplicated slug list.
+ * Accepts preset names ("staging+prod") or free lists ("dev,staging,prod").
+ */
+export function parseEnvironments(raw) {
+    const trimmed = raw.trim();
+    if (ENV_PRESETS[trimmed])
+        return ENV_PRESETS[trimmed];
+    const slugs = trimmed
+        .split(/[\s,+]+/)
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+    return normalizeEnvSlugs(slugs);
+}
+/** Validate slugs against the known set and return them in deploy order. */
+export function normalizeEnvSlugs(slugs) {
+    for (const slug of slugs) {
+        if (!KNOWN_ENV_SLUGS.includes(slug)) {
+            throw new ConfigError(`Unknown environment "${slug}". Supported environments: ${KNOWN_ENV_SLUGS.join(', ')} ` +
+                `(or a preset: ${Object.keys(ENV_PRESETS).join(', ')}).`);
+        }
+    }
+    const chosen = new Set(slugs);
+    const ordered = KNOWN_ENV_SLUGS.filter((s) => chosen.has(s));
+    if (ordered.length === 0) {
+        throw new ConfigError('At least one environment is required.');
+    }
+    return ordered;
+}
 export function validateUrl(value, label) {
     let parsed;
     try {
@@ -68,6 +136,7 @@ export function fromEnv(env) {
             host: env.INFISICAL_HOST,
             clientId: env.INFISICAL_CLIENT_ID,
             clientSecret: env.INFISICAL_CLIENT_SECRET,
+            projectId: env.INFISICAL_PROJECT_ID,
         },
         github: {
             token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
@@ -79,26 +148,68 @@ export function fromEnv(env) {
 export function mergeAnswers(...sources) {
     const out = { scaleway: {}, infisical: {}, github: {}, scaling: {} };
     for (const src of sources) {
-        for (const key of ['projectName', 'region', 'targetDir', 'basicAuthStaging']) {
+        for (const key of [
+            'projectName',
+            'region',
+            'targetDir',
+            'basicAuth',
+            'objectStorage',
+        ]) {
             const value = src[key];
             if (value !== undefined) {
                 out[key] = value;
             }
         }
-        for (const group of ['scaleway', 'infisical', 'github', 'scaling']) {
+        if (src.environments !== undefined) {
+            out.environments = src.environments;
+        }
+        for (const group of ['scaleway', 'infisical', 'github']) {
             for (const [k, v] of Object.entries(src[group] ?? {})) {
                 if (v !== undefined) {
                     out[group][k] = v;
                 }
             }
         }
+        // Scaling is a per-slug record: merge each slug's fields, deepest wins.
+        for (const [slug, override] of Object.entries(src.scaling ?? {})) {
+            if (!override)
+                continue;
+            const current = out.scaling[slug] ?? {};
+            if (override.minScale !== undefined)
+                current.minScale = override.minScale;
+            if (override.maxScale !== undefined)
+                current.maxScale = override.maxScale;
+            out.scaling[slug] = current;
+        }
     }
     return out;
 }
+/** Build the resolved environment list from selected slugs + overrides. */
+export function resolveEnvironments(slugs, basicAuth, overrides) {
+    return slugs.map((slug) => {
+        const def = ENV_DEFAULTS[slug];
+        const ov = overrides[slug] ?? {};
+        return {
+            slug,
+            displayName: def.displayName,
+            githubEnvironment: def.githubEnvironment,
+            production: def.production,
+            gated: def.gated,
+            // Basic Auth is a non-production safety net; production is never gated by it.
+            basicAuth: def.production ? false : basicAuth,
+            minScale: validateScale(ov.minScale ?? def.minScale, `${slug} min scale`),
+            maxScale: validateScale(ov.maxScale ?? def.maxScale, `${slug} max scale`),
+        };
+    });
+}
 /** Validate a fully-collected set of answers and freeze it into a Config. */
 export function finalizeAnswers(partial) {
     const projectName = validateProjectName(requireString(partial.projectName, 'project name'));
     const region = validateRegion(partial.region ?? DEFAULT_REGION);
+    const slugs = partial.environments && partial.environments.length > 0
+        ? normalizeEnvSlugs(partial.environments)
+        : ENV_PRESETS[DEFAULT_ENV_PRESET];
+    const basicAuth = partial.basicAuth ?? true;
     return {
         projectName,
         region,
@@ -115,19 +226,18 @@ export function finalizeAnswers(partial) {
             clientId: requireString(partial.infisical.clientId, 'Infisical client ID'),
             clientSecret: requireString(partial.infisical.clientSecret, 'Infisical client secret'),
             projectName: partial.infisical.projectName?.trim() || projectName,
+            ...(partial.infisical.projectId?.trim()
+                ? { projectId: partial.infisical.projectId.trim() }
+                : {}),
         },
         github: {
             token: requireString(partial.github.token, 'GitHub token'),
             repoName: validateProjectName(partial.github.repoName?.trim() || projectName),
             repoPrivate: partial.github.repoPrivate ?? false,
         },
-        basicAuthStaging: partial.basicAuthStaging ?? true,
-        scaling: {
-            stagingMinScale: validateScale(partial.scaling.stagingMinScale ?? DEFAULT_SCALING.stagingMinScale, 'staging min scale'),
-            stagingMaxScale: validateScale(partial.scaling.stagingMaxScale ?? DEFAULT_SCALING.stagingMaxScale, 'staging max scale'),
-            prodMinScale: validateScale(partial.scaling.prodMinScale ?? DEFAULT_SCALING.prodMinScale, 'prod min scale'),
-            prodMaxScale: validateScale(partial.scaling.prodMaxScale ?? DEFAULT_SCALING.prodMaxScale, 'prod max scale'),
-        },
+        basicAuth,
+        objectStorage: partial.objectStorage ?? false,
+        environments: resolveEnvironments(slugs, basicAuth, partial.scaling),
     };
 }
 /** List which required values are still missing, for non-interactive runs. */

package/dist/contracts.js

@@ -0,0 +1,46 @@
+/**
+ * Names shared between the bootstrap code and the generated repository.
+ *
+ * The CLI configures the user's account by name (required status checks,
+ * Actions secrets/variables, seeded Infisical secrets) and the generated
+ * workflows and Terraform reference the same names. A rename on one side
+ * without the other passes CI here and breaks at runtime in the user's
+ * account — so both sides import these constants, and contracts.test.ts
+ * renders the templates and asserts they still agree.
+ */
+/**
+ * Job name of the plan workflow for one environment; branch protection
+ * requires exactly these contexts before a PR can merge.
+ */
+export function planStatusCheckContext(environment) {
+    return `plan (${environment})`;
+}
+/** Root Terraform output consumed by .github/scripts/sync-secrets.sh. */
+export const INFISICAL_SECRETS_OUTPUT = 'infisical_secrets';
+/**
+ * Object Storage coordinates: seeded as placeholders by the CLI, produced by
+ * the infisical_secrets output, synced to Infisical by the pipeline.
+ */
+export const S3_SECRET_KEYS = [
+    'S3_BUCKET',
+    'S3_ENDPOINT',
+    'S3_REGION',
+    'S3_ACCESS_KEY',
+    'S3_SECRET_KEY',
+];
+/** Encrypted Actions secrets set by configureRepo, read by the workflows. */
+export const CI_SECRET_NAMES = [
+    'SCW_ACCESS_KEY',
+    'SCW_SECRET_KEY',
+    'SCW_DEFAULT_PROJECT_ID',
+    'SCW_DEFAULT_ORGANIZATION_ID',
+    'INFISICAL_CLIENT_ID',
+    'INFISICAL_CLIENT_SECRET',
+];
+/** Plain Actions variables set by configureRepo, read by the workflows. */
+export const CI_VARIABLE_NAMES = [
+    'TF_STATE_BUCKET',
+    'SCW_REGION',
+    'INFISICAL_PROJECT_ID',
+    'INFISICAL_HOST',
+];

package/dist/generate.js

@@ -12,17 +12,59 @@ const RENAMES = {
 export function templatesDir() {
     return fileURLToPath(new URL('../templates', import.meta.url));
 }
+/** Global tokens shared by every non per-environment template. */
 export function tokenMap(answers) {
+    const slugs = answers.environments.map((e) => e.slug);
     return {
         __PROJECT_NAME__: answers.projectName,
         __REGION__: answers.region,
         __TF_STATE_BUCKET__: answers.stateBucket,
-        __STAGING_MIN_SCALE__: String(answers.scaling.stagingMinScale),
-        __STAGING_MAX_SCALE__: String(answers.scaling.stagingMaxScale),
-        __PROD_MIN_SCALE__: String(answers.scaling.prodMinScale),
-        __PROD_MAX_SCALE__: String(answers.scaling.prodMaxScale),
+        // HCL list for the `environment` variable validation in variables.tf.
+        __ENV_SLUGS_TF__: `[${slugs.map((s) => `"${s}"`).join(', ')}]`,
     };
 }
+/** Tokens for one rendered `<env>.tfvars` file. */
+function envTfvarsTokens(answers, env) {
+    return {
+        __PROJECT_NAME__: answers.projectName,
+        __REGION__: answers.region,
+        __ENVIRONMENT__: env.slug,
+        __ENABLE_BASIC_AUTH__: String(env.basicAuth),
+        __ENABLE_OBJECT_STORAGE__: String(answers.objectStorage),
+        __MIN_SCALE__: String(env.minScale),
+        __MAX_SCALE__: String(env.maxScale),
+    };
+}
+/**
+ * Templates rendered specially (per environment) instead of copied 1:1.
+ *
+ * Keep this set small: the templating here is plain token replacement by
+ * design. A conditional feature must become a Terraform variable rendered
+ * into tfvars (as enable_object_storage does), never a conditionally emitted
+ * file — the day a feature cannot be expressed that way is the day to adopt
+ * a real template engine, not to add another special case here.
+ */
+const SPECIAL_TEMPLATES = new Set(['env.tfvars', '.github/workflows/terraform-apply.yml']);
+function isSpecial(rel) {
+    return SPECIAL_TEMPLATES.has(rel) || rel.startsWith('_partials/');
+}
+/**
+ * Assemble the apply workflow: the shared header, then one job per environment
+ * in deploy order, each `needs:` the previous so applies run sequentially.
+ */
+function renderApplyWorkflow(source, answers, globalTokens) {
+    const header = renderContent(readFileSync(join(source, '_partials/apply-header.yml'), 'utf8'), globalTokens, '_partials/apply-header.yml');
+    const jobTemplate = readFileSync(join(source, '_partials/apply-job.yml'), 'utf8');
+    const jobs = answers.environments.map((env, i) => {
+        const previous = answers.environments[i - 1];
+        return renderContent(jobTemplate, {
+            __ENV_SLUG__: env.slug,
+            __GH_ENVIRONMENT__: env.githubEnvironment,
+            __NEEDS_LINE__: previous ? `    needs: apply-${previous.slug}\n` : '',
+        }, '_partials/apply-job.yml');
+    });
+    return header + jobs.join('\n');
+}
 function renderContent(content, tokens, file) {
     let out = content;
     for (const [token, value] of Object.entries(tokens)) {
@@ -59,6 +101,8 @@ export function generateProject(answers, options = {}) {
     mkdirSync(target, { recursive: true });
     const written = [];
     for (const rel of walk(source)) {
+        if (isSpecial(rel))
+            continue;
         const parts = rel.split('/');
         const fileName = parts[parts.length - 1] ?? rel;
         const destRel = [...parts.slice(0, -1), RENAMES[fileName] ?? fileName].join('/');
@@ -71,6 +115,18 @@ export function generateProject(answers, options = {}) {
         }
         written.push(destRel);
     }
+    // Per-environment tfvars: one <slug>.tfvars from the shared env.tfvars template.
+    const envTemplate = readFileSync(join(source, 'env.tfvars'), 'utf8');
+    for (const env of answers.environments) {
+        const destRel = `${env.slug}.tfvars`;
+        writeFileSync(join(target, destRel), renderContent(envTemplate, envTfvarsTokens(answers, env), 'env.tfvars'));
+        written.push(destRel);
+    }
+    // Apply workflow: a header plus one deploy job per environment, chained so
+    // each environment applies only after the previous one succeeded.
+    const applyDestRel = '.github/workflows/terraform-apply.yml';
+    writeFileSync(join(target, applyDestRel), renderApplyWorkflow(source, answers, tokens));
+    written.push(applyDestRel);
     // backend.hcl (git-ignored) so local terraform runs work out of the box.
     cpSync(join(target, 'backend.hcl.example'), join(target, 'backend.hcl'));
     if (options.git !== false) {