@gambi97/keel-cli 0.2.0 → 0.2.1

package/dist/prompts.js

@@ -1,5 +1,10 @@
 import * as p from '@clack/prompts';
-import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, } from './config.js';
+import { createContext, GitHubError, inspectRepo, assertRepoUsable } from './bootstrap/github.js';
+import { InfisicalError, validateInfisical } from './bootstrap/infisical.js';
+import { ScalewayError, validateScalewayCredentials } from './bootstrap/scaleway.js';
+import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
+import { isDone, loadState } from './state.js';
+import { log } from './ui.js';
 function bail() {
     p.cancel('Cancelled. Nothing was created.');
     process.exit(1);
@@ -21,80 +26,58 @@ function validate(fn) {
         }
     };
 }
-/** Interactively fill everything still missing from flags/env/config file. */
+const secret = (message) => ask(p.password({ message }));
+const text = (message, placeholder) => ask(p.text({
+    message,
+    ...(placeholder ? { placeholder } : {}),
+    validate: (v) => (v.trim() ? undefined : 'Required.'),
+}));
+/**
+ * Interactively fill everything still missing from flags/env/config file.
+ *
+ * The project name comes first (it seeds the repo/bucket/project defaults),
+ * then the three provider blocks (GitHub, Infisical, Scaleway) — each closed
+ * by a read-only validation call that reports bad input immediately and
+ * re-asks only the offending value — and finally the configuration you want
+ * (region, environments, storage, scaling). Nothing is created here; creation
+ * starts only after the final confirmation.
+ */
 export async function fillMissing(partial, options) {
     const out = structuredClone(partial);
-    if (!out.projectName) {
-        out.projectName = await ask(p.text({
-            message: 'Project name (dns-safe, used for repo, bucket and resources)',
-            placeholder: 'my-app',
-            validate: validate(validateProjectName),
-        }));
-    }
-    if (!out.region) {
-        out.region = await ask(p.select({
-            message: 'Scaleway region',
-            initialValue: DEFAULT_REGION,
-            options: REGIONS.map((r) => ({ value: r, label: r })),
-        }));
+    await askProjectName(out);
+    // Each block opens with a "┌ <Provider>" section corner and closes with a
+    // "└ <Provider> connected — …" line, so every question flows inside its own
+    // section and the next one opens only when the previous is verified.
+    if (!options.dryRun) {
+        await askGitHub(out);
+        await askInfisical(out);
+        await askScaleway(out);
     }
-    const secret = (message) => ask(p.password({ message }));
-    const text = (message, placeholder) => ask(p.text({
-        message,
-        ...(placeholder ? { placeholder } : {}),
-        validate: (v) => (v.trim() ? undefined : 'Required.'),
+    // Configuration comes last: with the accounts verified, these are the only
+    // real choices left. In a dry run it is all that is asked after the name.
+    await askConfiguration(out, options);
+    return out;
+}
+async function askProjectName(out) {
+    if (out.projectName)
+        return;
+    out.projectName = await ask(p.text({
+        message: 'Project name (dns-safe, used for repo, bucket and resources)',
+        placeholder: 'my-app',
+        validate: validate(validateProjectName),
     }));
-    if (!out.scaleway.accessKey)
-        out.scaleway.accessKey = await text('Scaleway access key');
-    if (!out.scaleway.secretKey)
-        out.scaleway.secretKey = await secret('Scaleway secret key');
-    if (!out.scaleway.projectId)
-        out.scaleway.projectId = await text('Scaleway project ID');
-    if (!out.scaleway.organizationId)
-        out.scaleway.organizationId = await text('Scaleway organization ID');
-    if (!out.infisical.host) {
-        out.infisical.host = await ask(p.text({ message: 'Infisical host', initialValue: DEFAULT_INFISICAL_HOST }));
-    }
-    if (!out.infisical.clientId)
-        out.infisical.clientId = await text('Infisical machine identity client ID');
-    if (!out.infisical.clientSecret)
-        out.infisical.clientSecret = await secret('Infisical machine identity client secret');
-    if (!out.infisical.projectName) {
-        out.infisical.projectName = await ask(p.text({
-            message: 'Infisical project name (existing project is reused, otherwise created)',
-            initialValue: out.projectName,
-        }));
-    }
-    if (!out.github.token)
-        out.github.token = await secret('GitHub token (scopes: repo, workflow)');
-    if (!out.github.repoName) {
-        out.github.repoName = await ask(p.text({
-            message: 'GitHub repository name',
-            initialValue: out.projectName,
-            validate: validate(validateProjectName),
-        }));
-    }
-    if (out.github.repoPrivate === undefined) {
-        out.github.repoPrivate = await ask(p.select({
-            message: 'Repository visibility',
-            initialValue: false,
-            options: [
-                { value: false, label: 'Public', hint: 'the infra contains no secrets' },
-                { value: true, label: 'Private' },
-            ],
-        }));
-    }
+}
+/** Everything that shapes the infrastructure: region, environments, options. */
+async function askConfiguration(out, options) {
+    p.intro('Configuration — region, environments and options');
+    await askRegion(out);
     if (!out.environments || out.environments.length === 0) {
         const preset = await ask(p.select({
             message: 'Which environments do you want?',
             initialValue: DEFAULT_ENV_PRESET,
             options: [
                 { value: 'prod', label: 'Production only', hint: 'single environment' },
-                {
-                    value: 'staging+prod',
-                    label: 'Staging + Production',
-                    hint: 'recommended',
-                },
+                { value: 'staging+prod', label: 'Staging + Production', hint: 'recommended' },
                 { value: 'dev+staging+prod', label: 'Dev + Staging + Production' },
             ],
         }));
@@ -114,6 +97,17 @@ export async function fillMissing(partial, options) {
             initialValue: true,
         }));
     }
+    // Production is the one scaling knob worth surfacing at setup: everything
+    // scales to zero when idle, and this is the ceiling. Staging/dev stay 0-1;
+    // full per-environment control lives behind --advanced.
+    if (!options.advanced && slugs.includes('prod') && out.scaling.prod?.maxScale === undefined) {
+        const max = await ask(p.text({
+            message: 'Maximum production instances (idle scales to zero; raise later in prod.tfvars)',
+            initialValue: String(envDefaultScale('prod').maxScale),
+            validate: validate((v) => validateScale(v, 'prod max scale')),
+        }));
+        out.scaling.prod = { ...(out.scaling.prod ?? {}), maxScale: Number(max) };
+    }
     if (options.advanced) {
         const scale = async (message, initial) => Number(await ask(p.text({
             message,
@@ -128,7 +122,193 @@ export async function fillMissing(partial, options) {
             out.scaling[slug] = current;
         }
     }
-    return out;
+}
+/** GitHub block: repo + token, then verify token, scopes and repo state. */
+async function askGitHub(out) {
+    // When resuming a run that already pushed, the repo legitimately has
+    // commits: a non-empty repo must not block the resume.
+    const targetDir = out.targetDir?.trim() || out.projectName;
+    const alreadyPushed = isDone(loadState(targetDir, out.projectName), 'github-push');
+    p.intro('GitHub — repository, visibility and token');
+    for (;;) {
+        if (!out.github.repoName) {
+            out.github.repoName = await ask(p.text({
+                message: 'GitHub repository name (a new empty repository works best)',
+                initialValue: out.projectName,
+                validate: validate(validateProjectName),
+            }));
+        }
+        if (out.github.repoPrivate === undefined) {
+            out.github.repoPrivate = await ask(p.select({
+                message: 'Repository visibility',
+                initialValue: false,
+                options: [
+                    { value: false, label: 'Public', hint: 'the infra contains no secrets' },
+                    { value: true, label: 'Private' },
+                ],
+            }));
+        }
+        if (!out.github.token) {
+            out.github.token = await secret('GitHub token (scopes: repo, workflow)');
+        }
+        try {
+            const ctx = await createContext({
+                token: out.github.token,
+                repoName: out.github.repoName,
+                repoPrivate: out.github.repoPrivate ?? false,
+            });
+            const { state } = await inspectRepo(ctx);
+            if (!(state === 'non-empty' && alreadyPushed)) {
+                assertRepoUsable(ctx, state);
+            }
+            const repo = `${ctx.owner}/${out.github.repoName}`;
+            p.outro(state === 'not-found'
+                ? `GitHub connected — ${repo} will be created after confirmation.`
+                : state === 'non-empty'
+                    ? `GitHub connected — resuming, ${repo} was already pushed.`
+                    : `GitHub connected — existing empty repository ${repo} will be reused.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof GitHubError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'repo') {
+                out.github.repoName = undefined;
+            }
+            else {
+                out.github.token = undefined;
+            }
+        }
+    }
+}
+/** Infisical block: host + machine identity, then verify login and project. */
+async function askInfisical(out) {
+    p.intro('Infisical — secret-manager project and machine identity');
+    if (!out.infisical.host) {
+        const choice = await ask(p.select({
+            message: 'Infisical host',
+            initialValue: 'us',
+            options: [
+                { value: 'us', label: 'US — app.infisical.com', hint: 'default' },
+                { value: 'eu', label: 'EU — eu.infisical.com' },
+                { value: 'other', label: 'Other (self-hosted)' },
+            ],
+        }));
+        if (choice === 'us')
+            out.infisical.host = DEFAULT_INFISICAL_HOST;
+        else if (choice === 'eu')
+            out.infisical.host = 'https://eu.infisical.com';
+        else {
+            out.infisical.host = await ask(p.text({
+                message: 'Infisical host URL',
+                placeholder: 'https://infisical.example.com',
+                validate: validate((v) => validateUrl(v, 'Infisical host')),
+            }));
+        }
+    }
+    for (;;) {
+        if (!out.infisical.clientId) {
+            out.infisical.clientId = await text('Infisical machine identity client ID');
+        }
+        if (!out.infisical.clientSecret) {
+            out.infisical.clientSecret = await secret('Infisical machine identity client secret');
+        }
+        if (!out.infisical.projectId && !out.infisical.projectName) {
+            const id = await ask(p.text({
+                message: `Infisical project ID to reuse (leave empty to create "${out.projectName}")`,
+                placeholder: 'empty: create a new project',
+                defaultValue: '',
+            }));
+            if (id.trim())
+                out.infisical.projectId = id.trim();
+            else
+                out.infisical.projectName = out.projectName;
+        }
+        try {
+            const { projectName } = await validateInfisical({
+                host: out.infisical.host,
+                clientId: out.infisical.clientId,
+                clientSecret: out.infisical.clientSecret,
+                projectId: out.infisical.projectId,
+            });
+            if (projectName)
+                out.infisical.projectName = projectName;
+            p.outro(out.infisical.projectId
+                ? `Infisical connected — existing project "${projectName}" (${out.infisical.projectId}) will be reused.`
+                : `Infisical connected — project "${out.infisical.projectName}" will be created after confirmation.`);
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof InfisicalError))
+                throw error;
+            log.error(error.message);
+            if (error.field === 'project') {
+                out.infisical.projectId = undefined;
+                out.infisical.projectName = undefined;
+            }
+            else {
+                out.infisical.clientId = undefined;
+                out.infisical.clientSecret = undefined;
+            }
+        }
+    }
+}
+async function askRegion(out) {
+    if (out.region)
+        return;
+    out.region = await ask(p.select({
+        message: 'Scaleway region',
+        initialValue: DEFAULT_REGION,
+        options: REGIONS.map((r) => ({ value: r, label: r })),
+    }));
+}
+/** Scaleway block: keys + IDs, then verify with a read-only API call. */
+async function askScaleway(out) {
+    p.intro('Scaleway — account keys and project');
+    for (;;) {
+        if (!out.scaleway.accessKey)
+            out.scaleway.accessKey = await text('Scaleway access key');
+        if (!out.scaleway.secretKey)
+            out.scaleway.secretKey = await secret('Scaleway secret key');
+        if (!out.scaleway.projectId)
+            out.scaleway.projectId = await text('Scaleway project ID');
+        if (!out.scaleway.organizationId) {
+            out.scaleway.organizationId = await text('Scaleway organization ID');
+        }
+        try {
+            await validateScalewayCredentials({
+                secretKey: out.scaleway.secretKey,
+                projectId: out.scaleway.projectId,
+                organizationId: out.scaleway.organizationId,
+            });
+            p.outro('Scaleway connected — credentials valid and project reachable.');
+            return;
+        }
+        catch (error) {
+            if (!(error instanceof ScalewayError))
+                throw error;
+            log.error(error.message);
+            switch (error.code) {
+                case 'auth':
+                    out.scaleway.accessKey = undefined;
+                    out.scaleway.secretKey = undefined;
+                    break;
+                case 'project':
+                    out.scaleway.projectId = undefined;
+                    break;
+                case 'organization':
+                    out.scaleway.organizationId = undefined;
+                    break;
+                default: {
+                    // Transient API error: nothing to correct, offer a plain retry.
+                    const retry = await ask(p.confirm({ message: 'Scaleway API error. Retry?' }));
+                    if (!retry)
+                        bail();
+                }
+            }
+        }
+    }
 }
 export async function confirmSummary(summary) {
     p.note(summary, 'About to create');

package/dist/ui.js

@@ -48,7 +48,9 @@ export function renderSummary(answers, dryRun) {
         '',
         'Infisical',
         `  host           ${answers.infisical.host}`,
-        `  project        ${answers.infisical.projectName} (created or reused)`,
+        `  project        ${answers.infisical.projectId
+            ? `${answers.infisical.projectName} (existing, ${answers.infisical.projectId})`
+            : `${answers.infisical.projectName} (will be created)`}`,
         `  environments   ${envSlugs} (+ placeholder secrets)`,
         '',
         `Object Storage   ${answers.objectStorage ? 'enabled (per-environment bucket + S3_* secrets)' : 'disabled'}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/.github/workflows/terraform-drift.yml

@@ -29,13 +29,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the drift matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   drift:
     name: drift (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: __ENV_MATRIX__
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4
 

package/templates/.github/workflows/terraform-plan.yml

@@ -23,13 +23,31 @@ env:
   TF_IN_AUTOMATION: "true"
 
 jobs:
+  discover:
+    name: discover environments
+    runs-on: ubuntu-latest
+    outputs:
+      environments: ${{ steps.list.outputs.environments }}
+    steps:
+      - uses: actions/checkout@v4
+
+      # Every <env>.tfvars at the repo root is an environment: adding one to
+      # the plan matrix is just adding its tfvars file, no workflow edit.
+      - name: List environments from tfvars files
+        id: list
+        run: |
+          environments=$(ls *.tfvars | sed 's/\.tfvars$//' \
+            | jq --raw-input --slurp --compact-output 'split("\n") | map(select(length > 0))')
+          echo "environments=$environments" >> "$GITHUB_OUTPUT"
+
   plan:
     name: plan (${{ matrix.environment }})
+    needs: discover
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
-        environment: __ENV_MATRIX__
+        environment: ${{ fromJSON(needs.discover.outputs.environments) }}
     steps:
       - uses: actions/checkout@v4
 

package/templates/README.md

@@ -114,10 +114,13 @@ environment enables it is the `enable_basic_auth` flag in its `<env>.tfvars`.
   secrets (repo Settings > Secrets and variables > Actions).
 - **Add a custom domain**: add a `scaleway_container_domain` resource in
   `modules/app_stack` pointing at the container, plus your DNS record.
-- **Add an environment**: add a `<env>.tfvars`, an Infisical environment with
-  the same slug, an entry in the plan/drift matrix and a job in
+- **Add an environment**: add a `<env>.tfvars` at the repo root (the plan and
+  drift workflows discover environments from the tfvars files automatically),
+  create an Infisical environment with the same slug, and add a job in
   `.github/workflows/terraform-apply.yml` (mirror an existing one and set its
-  `needs:` to chain after the previous environment).
+  `needs:` to chain after the previous environment). Note: the new `plan
+  (<env>)` check becomes required on `main` only after you add it in the
+  branch-protection settings.
 - **Pin provider versions**: after any local `terraform init`, commit the
   generated `.terraform.lock.hcl` so CI resolves the exact same provider
   builds on every run.

package/templates/main.tf

@@ -3,6 +3,16 @@ data "infisical_secrets" "app" {
   env_slug     = var.environment
   workspace_id = var.infisical_project_id
   folder_path  = "/"
+
+  lifecycle {
+    # Guards against applying one environment's tfvars into another
+    # environment's state (e.g. prod.tfvars while the staging workspace is
+    # selected), which would create prod-named resources in staging state.
+    precondition {
+      condition     = terraform.workspace == var.environment
+      error_message = "The selected Terraform workspace must match var.environment: run `terraform workspace select <env>` before plan/apply with <env>.tfvars."
+    }
+  }
 }
 
 module "app_stack" {