@gambi97/keel-cli 0.2.0 → 0.3.0

package/dist/config.js

@@ -29,7 +29,9 @@ const ENV_DEFAULTS = {
         production: true,
         gated: true,
         minScale: 0,
-        maxScale: 2,
+        // Start small: one instance is enough to go live and costs the least;
+        // raising the ceiling later is a one-line prod.tfvars change.
+        maxScale: 1,
     },
 };
 /** Default min/max scale for an environment, for prompts and summaries. */
@@ -134,6 +136,7 @@ export function fromEnv(env) {
             host: env.INFISICAL_HOST,
             clientId: env.INFISICAL_CLIENT_ID,
             clientSecret: env.INFISICAL_CLIENT_SECRET,
+            projectId: env.INFISICAL_PROJECT_ID,
         },
         github: {
             token: env.GITHUB_TOKEN ?? env.GH_TOKEN,
@@ -186,6 +189,11 @@ export function resolveEnvironments(slugs, basicAuth, overrides) {
     return slugs.map((slug) => {
         const def = ENV_DEFAULTS[slug];
         const ov = overrides[slug] ?? {};
+        const minScale = validateScale(ov.minScale ?? def.minScale, `${slug} min scale`);
+        const maxScale = validateScale(ov.maxScale ?? def.maxScale, `${slug} max scale`);
+        if (minScale > maxScale) {
+            throw new ConfigError(`Invalid ${slug} scaling: min scale (${minScale}) cannot exceed max scale (${maxScale}).`);
+        }
         return {
             slug,
             displayName: def.displayName,
@@ -194,8 +202,8 @@ export function resolveEnvironments(slugs, basicAuth, overrides) {
             gated: def.gated,
             // Basic Auth is a non-production safety net; production is never gated by it.
             basicAuth: def.production ? false : basicAuth,
-            minScale: validateScale(ov.minScale ?? def.minScale, `${slug} min scale`),
-            maxScale: validateScale(ov.maxScale ?? def.maxScale, `${slug} max scale`),
+            minScale,
+            maxScale,
         };
     });
 }
@@ -223,6 +231,9 @@ export function finalizeAnswers(partial) {
             clientId: requireString(partial.infisical.clientId, 'Infisical client ID'),
             clientSecret: requireString(partial.infisical.clientSecret, 'Infisical client secret'),
             projectName: partial.infisical.projectName?.trim() || projectName,
+            ...(partial.infisical.projectId?.trim()
+                ? { projectId: partial.infisical.projectId.trim() }
+                : {}),
         },
         github: {
             token: requireString(partial.github.token, 'GitHub token'),

package/dist/contracts.js

@@ -0,0 +1,80 @@
+/**
+ * Names shared between the bootstrap code and the generated repository.
+ *
+ * The CLI configures the user's account by name (required status checks,
+ * Actions secrets/variables, seeded Infisical secrets) and the generated
+ * workflows and Terraform reference the same names. A rename on one side
+ * without the other passes CI here and breaks at runtime in the user's
+ * account — so both sides import these constants, and contracts.test.ts
+ * renders the templates and asserts they still agree.
+ */
+/**
+ * Job name of the plan workflow for one environment; branch protection
+ * requires exactly these contexts before a PR can merge.
+ */
+export function planStatusCheckContext(environment) {
+    return `plan (${environment})`;
+}
+/**
+ * Version of the docking contract between keel and the generated repository
+ * (output naming, manifest schema, tfvars conventions). Recorded in the
+ * committed .keel/manifest.json; future tooling that extends a generated
+ * repo checks it before touching anything.
+ */
+export const CONTRACT_VERSION = 1;
+/** Base Terraform output consumed by .github/scripts/sync-secrets.sh. */
+export const INFISICAL_SECRETS_OUTPUT = 'infisical_secrets';
+/**
+ * Regex (verbatim in sync-secrets.sh) matching the base output plus any
+ * module-contributed "infisical_secrets_<name>" output. A module added to a
+ * generated repo exposes its own map under that name and the pipeline syncs
+ * it — no edit to outputs.tf needed (file-additive extension).
+ */
+export const INFISICAL_SECRETS_OUTPUT_PATTERN = '^infisical_secrets(_[a-z0-9_]+)?$';
+/**
+ * Keys always present in the synced map: seeded as placeholders by the CLI,
+ * produced by the root outputs, overwritten by the pipeline after each apply.
+ */
+export const BASE_SYNCED_KEYS = ['DATABASE_URL', 'APP_URL'];
+/**
+ * Basic Auth crosses the boundary in three places: the CLI seeds these two
+ * secrets in Infisical (non-production), the generated app_stack injects the
+ * flag below, and the user's app enforces it. [user, password] in this order.
+ */
+export const BASIC_AUTH_SECRET_KEYS = ['BASIC_AUTH_USER', 'BASIC_AUTH_PASSWORD'];
+export const BASIC_AUTH_FLAG = 'BASIC_AUTH_ENABLED';
+/**
+ * Naming convention for per-environment resources (registry, namespaces,
+ * database, buckets…): mirrored by `local.name` in the app_stack template,
+ * which contracts.test.ts pins against this function.
+ */
+export function resourceName(projectName, envSlug) {
+    return `${projectName}-${envSlug}`;
+}
+/**
+ * Object Storage coordinates: seeded as placeholders by the CLI, produced by
+ * the infisical_secrets output, synced to Infisical by the pipeline.
+ */
+export const S3_SECRET_KEYS = [
+    'S3_BUCKET',
+    'S3_ENDPOINT',
+    'S3_REGION',
+    'S3_ACCESS_KEY',
+    'S3_SECRET_KEY',
+];
+/** Encrypted Actions secrets set by configureRepo, read by the workflows. */
+export const CI_SECRET_NAMES = [
+    'SCW_ACCESS_KEY',
+    'SCW_SECRET_KEY',
+    'SCW_DEFAULT_PROJECT_ID',
+    'SCW_DEFAULT_ORGANIZATION_ID',
+    'INFISICAL_CLIENT_ID',
+    'INFISICAL_CLIENT_SECRET',
+];
+/** Plain Actions variables set by configureRepo, read by the workflows. */
+export const CI_VARIABLE_NAMES = [
+    'TF_STATE_BUCKET',
+    'SCW_REGION',
+    'INFISICAL_PROJECT_ID',
+    'INFISICAL_HOST',
+];

package/dist/generate.js

@@ -2,9 +2,33 @@ import { spawnSync } from 'node:child_process';
 import { chmodSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync, } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { CONTRACT_VERSION } from './contracts.js';
+import { toolVersion } from './meta.js';
 import { STATE_FILE } from './state.js';
 export class GenerateError extends Error {
 }
+/**
+ * Machine-readable record of how the repository was generated. Unlike the
+ * git-ignored .keel.json resume file, the manifest is committed: future
+ * tooling that extends a generated repo (e.g. `keel add`) reads it from a
+ * fresh clone to know which contract it is docking onto.
+ */
+export const MANIFEST_FILE = '.keel/manifest.json';
+function renderManifest(answers) {
+    const manifest = {
+        keelVersion: toolVersion(),
+        contractVersion: CONTRACT_VERSION,
+        generatedAt: new Date().toISOString(),
+        projectName: answers.projectName,
+        region: answers.region,
+        environments: answers.environments.map((e) => e.slug),
+        options: {
+            objectStorage: answers.objectStorage,
+            basicAuth: answers.basicAuth,
+        },
+    };
+    return `${JSON.stringify(manifest, null, 2)}\n`;
+}
 /** Files whose real name would confuse npm packaging are stored renamed. */
 const RENAMES = {
     _gitignore: '.gitignore',
@@ -19,8 +43,6 @@ export function tokenMap(answers) {
         __PROJECT_NAME__: answers.projectName,
         __REGION__: answers.region,
         __TF_STATE_BUCKET__: answers.stateBucket,
-        // YAML inline list for the plan/drift job matrix, e.g. [staging, prod].
-        __ENV_MATRIX__: `[${slugs.join(', ')}]`,
         // HCL list for the `environment` variable validation in variables.tf.
         __ENV_SLUGS_TF__: `[${slugs.map((s) => `"${s}"`).join(', ')}]`,
     };
@@ -37,7 +59,15 @@ function envTfvarsTokens(answers, env) {
         __MAX_SCALE__: String(env.maxScale),
     };
 }
-/** Templates rendered specially (per environment) instead of copied 1:1. */
+/**
+ * Templates rendered specially (per environment) instead of copied 1:1.
+ *
+ * Keep this set small: the templating here is plain token replacement by
+ * design. A conditional feature must become a Terraform variable rendered
+ * into tfvars (as enable_object_storage does), never a conditionally emitted
+ * file — the day a feature cannot be expressed that way is the day to adopt
+ * a real template engine, not to add another special case here.
+ */
 const SPECIAL_TEMPLATES = new Set(['env.tfvars', '.github/workflows/terraform-apply.yml']);
 function isSpecial(rel) {
     return SPECIAL_TEMPLATES.has(rel) || rel.startsWith('_partials/');
@@ -121,6 +151,10 @@ export function generateProject(answers, options = {}) {
     const applyDestRel = '.github/workflows/terraform-apply.yml';
     writeFileSync(join(target, applyDestRel), renderApplyWorkflow(source, answers, tokens));
     written.push(applyDestRel);
+    // Committed manifest recording generator version, contract and options.
+    mkdirSync(join(target, '.keel'), { recursive: true });
+    writeFileSync(join(target, MANIFEST_FILE), renderManifest(answers));
+    written.push(MANIFEST_FILE);
     // backend.hcl (git-ignored) so local terraform runs work out of the box.
     cpSync(join(target, 'backend.hcl.example'), join(target, 'backend.hcl'));
     if (options.git !== false) {

package/dist/index.js

@@ -2,92 +2,138 @@
 import { readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { parseArgs } from 'node:util';
-import { fileURLToPath } from 'node:url';
 import { ConfigError, finalizeAnswers, fromEnv, mergeAnswers, missingRequired, parseEnvironments, } from './config.js';
+import { CI_SECRET_NAMES, CI_VARIABLE_NAMES, resourceName } from './contracts.js';
 import { generateProject, GenerateError } from './generate.js';
+import { toolVersion } from './meta.js';
 import { confirmSummary, fillMissing } from './prompts.js';
-import { isDone, loadState, markDone, STATE_FILE, stepData } from './state.js';
+import { isDone, loadState, markDone, STATE_FILE, stepData, } from './state.js';
 import { cancel, intro, log, outro, renderNextSteps, renderSummary, withSpinner } from './ui.js';
 import { ensureStateBucket, validateScalewayCredentials } from './bootstrap/scaleway.js';
-import { bootstrapInfisical, login as infisicalLogin } from './bootstrap/infisical.js';
-import { configureRepo, createContext, ensureRepo, pushRepo, } from './bootstrap/github.js';
-const HELP = `keel: generate and bootstrap serverless infra on Scaleway
-
-Usage:
-  npx @gambi97/keel-cli [options]
-
-Options:
-  --name <name>                  Project name (dns-safe)
-  --dir <path>                   Target directory (default: ./<name>)
-  --region <region>              fr-par | nl-ams | pl-waw (default: fr-par)
-  --scw-access-key <key>         Scaleway access key        (env SCW_ACCESS_KEY)
-  --scw-secret-key <key>         Scaleway secret key        (env SCW_SECRET_KEY)
-  --scw-project-id <id>          Scaleway project ID        (env SCW_DEFAULT_PROJECT_ID)
-  --scw-organization-id <id>     Scaleway organization ID   (env SCW_DEFAULT_ORGANIZATION_ID)
-  --infisical-host <url>         Infisical host             (env INFISICAL_HOST)
-  --infisical-client-id <id>     Machine identity client ID (env INFISICAL_CLIENT_ID)
-  --infisical-client-secret <s>  Machine identity secret    (env INFISICAL_CLIENT_SECRET)
-  --infisical-project-name <n>   Infisical project (default: project name)
-  --github-token <token>         GitHub token, repo+workflow (env GITHUB_TOKEN)
-  --repo-name <name>             GitHub repository name (default: project name)
-  --private / --public           GitHub repository visibility (default: public)
-  --environments <preset>        prod | staging+prod | dev+staging+prod
-                                 (or a list like "dev,staging,prod"; default staging+prod)
-  --no-basic-auth                Disable Basic Auth on non-production environments
-  --object-storage               Provision a per-environment Object Storage bucket
-  --no-object-storage            Do not provision Object Storage (default)
-  --dev-min-scale <n>            Dev min instances (default 0)
-  --dev-max-scale <n>            Dev max instances (default 1)
-  --staging-min-scale <n>        Staging min instances (default 0)
-  --staging-max-scale <n>        Staging max instances (default 1)
-  --prod-min-scale <n>           Prod min instances (default 0)
-  --prod-max-scale <n>           Prod max instances (default 2)
-  --config <file.json>           Read answers from a JSON config file
-  --advanced                     Also ask scaling questions interactively
-  --yes                          Accept defaults, no confirmation prompt
-  --dry-run                      Generate files locally, touch no account
-  --help, --version
-`;
+import { bootstrapInfisical, validateInfisical } from './bootstrap/infisical.js';
+import { assertRepoUsable, configureRepo, createContext, ensureRepo, inspectRepo, pushRepo, } from './bootstrap/github.js';
+/**
+ * Single source of truth for the CLI surface: parseArgs consumes these specs
+ * and --help is generated from CLI_HELP, whose keys the compiler checks
+ * against this table — a flag cannot be added without help text, or vice
+ * versa. (The README's CLI reference is the one remaining manual copy.)
+ */
+const CLI_OPTIONS = {
+    name: { type: 'string' },
+    dir: { type: 'string' },
+    region: { type: 'string' },
+    'scw-access-key': { type: 'string' },
+    'scw-secret-key': { type: 'string' },
+    'scw-project-id': { type: 'string' },
+    'scw-organization-id': { type: 'string' },
+    'infisical-host': { type: 'string' },
+    'infisical-client-id': { type: 'string' },
+    'infisical-client-secret': { type: 'string' },
+    'infisical-project-id': { type: 'string' },
+    'infisical-project-name': { type: 'string' },
+    'github-token': { type: 'string' },
+    'repo-name': { type: 'string' },
+    private: { type: 'boolean' },
+    public: { type: 'boolean' },
+    environments: { type: 'string' },
+    'basic-auth': { type: 'boolean' },
+    'no-basic-auth': { type: 'boolean' },
+    'object-storage': { type: 'boolean' },
+    'no-object-storage': { type: 'boolean' },
+    'dev-min-scale': { type: 'string' },
+    'dev-max-scale': { type: 'string' },
+    'staging-min-scale': { type: 'string' },
+    'staging-max-scale': { type: 'string' },
+    'prod-min-scale': { type: 'string' },
+    'prod-max-scale': { type: 'string' },
+    config: { type: 'string' },
+    advanced: { type: 'boolean' },
+    yes: { type: 'boolean' },
+    'dry-run': { type: 'boolean' },
+    help: { type: 'boolean' },
+    version: { type: 'boolean' },
+};
+/** Help text per flag; null hides it (help/version share a closing line). */
+const CLI_HELP = {
+    name: { hint: '<name>', text: 'Project name (dns-safe)' },
+    dir: { hint: '<path>', text: 'Target directory (default: ./<name>)' },
+    region: { hint: '<region>', text: 'fr-par | nl-ams | pl-waw (default: fr-par)' },
+    'scw-access-key': { hint: '<key>', text: 'Scaleway access key        (env SCW_ACCESS_KEY)' },
+    'scw-secret-key': { hint: '<key>', text: 'Scaleway secret key        (env SCW_SECRET_KEY)' },
+    'scw-project-id': {
+        hint: '<id>',
+        text: 'Scaleway project ID        (env SCW_DEFAULT_PROJECT_ID)',
+    },
+    'scw-organization-id': {
+        hint: '<id>',
+        text: 'Scaleway organization ID   (env SCW_DEFAULT_ORGANIZATION_ID)',
+    },
+    'infisical-host': { hint: '<url>', text: 'Infisical host             (env INFISICAL_HOST)' },
+    'infisical-client-id': {
+        hint: '<id>',
+        text: 'Machine identity client ID (env INFISICAL_CLIENT_ID)',
+    },
+    'infisical-client-secret': {
+        hint: '<s>',
+        text: 'Machine identity secret    (env INFISICAL_CLIENT_SECRET)',
+    },
+    'infisical-project-id': {
+        hint: '<id>',
+        text: 'Existing Infisical project ID to reuse\n(env INFISICAL_PROJECT_ID; default: create by name)',
+    },
+    'infisical-project-name': { hint: '<n>', text: 'Infisical project name (default: project name)' },
+    'github-token': { hint: '<token>', text: 'GitHub token, repo+workflow (env GITHUB_TOKEN)' },
+    'repo-name': { hint: '<name>', text: 'GitHub repository name (default: project name)' },
+    private: { text: 'Create the GitHub repository as private' },
+    public: { text: 'Create the GitHub repository as public (default)' },
+    environments: {
+        hint: '<preset>',
+        text: 'prod | staging+prod | dev+staging+prod\n(or a list like "dev,staging,prod"; default staging+prod)',
+    },
+    'basic-auth': { text: 'Enable Basic Auth on non-production environments (default)' },
+    'no-basic-auth': { text: 'Disable Basic Auth on non-production environments' },
+    'object-storage': { text: 'Provision a per-environment Object Storage bucket' },
+    'no-object-storage': { text: 'Do not provision Object Storage (default)' },
+    'dev-min-scale': { hint: '<n>', text: 'Dev min instances (default 0)' },
+    'dev-max-scale': { hint: '<n>', text: 'Dev max instances (default 1)' },
+    'staging-min-scale': { hint: '<n>', text: 'Staging min instances (default 0)' },
+    'staging-max-scale': { hint: '<n>', text: 'Staging max instances (default 1)' },
+    'prod-min-scale': { hint: '<n>', text: 'Prod min instances (default 0)' },
+    'prod-max-scale': { hint: '<n>', text: 'Prod max instances (default 1)' },
+    config: { hint: '<file.json>', text: 'Read answers from a JSON config file' },
+    advanced: { text: 'Also ask scaling questions interactively' },
+    yes: { text: 'Accept defaults, no confirmation prompt' },
+    'dry-run': { text: 'Generate files locally, touch no account' },
+    help: null,
+    version: null,
+};
+const HELP_COLUMN = 33;
+function buildHelp() {
+    const lines = [
+        'keel: generate and bootstrap serverless infra on Scaleway',
+        '',
+        'Usage:',
+        '  npx @gambi97/keel-cli [options]',
+        '',
+        'Options:',
+    ];
+    for (const [flag, entry] of Object.entries(CLI_HELP)) {
+        if (!entry)
+            continue;
+        const head = `  --${flag}${entry.hint ? ` ${entry.hint}` : ''}`;
+        const [first, ...rest] = entry.text.split('\n');
+        lines.push(head.padEnd(HELP_COLUMN) + first);
+        for (const continuation of rest) {
+            lines.push(' '.repeat(HELP_COLUMN) + continuation);
+        }
+    }
+    lines.push('  --help, --version');
+    return `${lines.join('\n')}\n`;
+}
 function parseCli(argv) {
-    const { values } = parseArgs({
-        args: argv,
-        options: {
-            name: { type: 'string' },
-            dir: { type: 'string' },
-            region: { type: 'string' },
-            'scw-access-key': { type: 'string' },
-            'scw-secret-key': { type: 'string' },
-            'scw-project-id': { type: 'string' },
-            'scw-organization-id': { type: 'string' },
-            'infisical-host': { type: 'string' },
-            'infisical-client-id': { type: 'string' },
-            'infisical-client-secret': { type: 'string' },
-            'infisical-project-name': { type: 'string' },
-            'github-token': { type: 'string' },
-            'repo-name': { type: 'string' },
-            private: { type: 'boolean' },
-            public: { type: 'boolean' },
-            environments: { type: 'string' },
-            'basic-auth': { type: 'boolean' },
-            'no-basic-auth': { type: 'boolean' },
-            'object-storage': { type: 'boolean' },
-            'no-object-storage': { type: 'boolean' },
-            'dev-min-scale': { type: 'string' },
-            'dev-max-scale': { type: 'string' },
-            'staging-min-scale': { type: 'string' },
-            'staging-max-scale': { type: 'string' },
-            'prod-min-scale': { type: 'string' },
-            'prod-max-scale': { type: 'string' },
-            config: { type: 'string' },
-            advanced: { type: 'boolean' },
-            yes: { type: 'boolean' },
-            'dry-run': { type: 'boolean' },
-            help: { type: 'boolean' },
-            version: { type: 'boolean' },
-        },
-    });
+    const { values } = parseArgs({ args: argv, options: CLI_OPTIONS });
     if (values.help) {
-        process.stdout.write(HELP);
+        process.stdout.write(buildHelp());
         process.exit(0);
     }
     if (values.version) {
@@ -112,6 +158,7 @@ function parseCli(argv) {
             host: values['infisical-host'],
             clientId: values['infisical-client-id'],
             clientSecret: values['infisical-client-secret'],
+            projectId: values['infisical-project-id'],
             projectName: values['infisical-project-name'],
         },
         github: {
@@ -164,15 +211,6 @@ function normalizeConfigFile(raw) {
         scaling: (obj.scaling ?? {}),
     });
 }
-function toolVersion() {
-    try {
-        const pkg = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
-        return pkg.version;
-    }
-    catch {
-        return '0.0.0';
-    }
-}
 function checkEnvironment() {
     const [major] = process.versions.node.split('.');
     if (Number(major) < 18) {
@@ -187,66 +225,102 @@ function printDryRunPlan(answers) {
     const ghEnvs = answers.environments.map((e) => e.githubEnvironment).join('/');
     log.info([
         'Dry run: generated the repository locally. A real run would additionally:',
-        `  - Scaleway: create the Terraform state bucket "${answers.stateBucket}" (${answers.region})`,
-        `  - Infisical: create/reuse project "${answers.infisical.projectName}", environments ${envList},`,
-        '    seed BASIC_AUTH_USER/BASIC_AUTH_PASSWORD (non-prod) and DATABASE_URL placeholders' +
+        `  - Scaleway: create the Terraform state bucket "${answers.stateBucket}" (${answers.region}),`,
+        '    restricted by a bucket policy to the identity behind your API key',
+        `  - Infisical: ${answers.infisical.projectId
+            ? `reuse project ${answers.infisical.projectId}`
+            : `create/reuse project "${answers.infisical.projectName}"`}, environments ${envList},`,
+        '    seed BASIC_AUTH_USER/BASIC_AUTH_PASSWORD (non-prod) and DATABASE_URL/APP_URL placeholders' +
             (answers.objectStorage ? ' and S3_* placeholders' : ''),
-        `  - GitHub: create ${answers.github.repoPrivate ? 'private' : 'public'} repo "${answers.github.repoName}", push, set 6 encrypted secrets,`,
-        `    4 variables, ${ghEnvs} environments and main branch protection`,
+        `  - GitHub: create ${answers.github.repoPrivate ? 'private' : 'public'} repo "${answers.github.repoName}", push, set ${CI_SECRET_NAMES.length} encrypted secrets,`,
+        `    ${CI_VARIABLE_NAMES.length} variables, ${ghEnvs} environments and main branch protection`,
     ].join('\n'));
 }
-async function runBootstrap(answers, state) {
-    const dir = answers.targetDir;
-    // All three credentials are checked before anything is created anywhere,
-    // so a bad token cannot leave a half-bootstrapped account behind.
+/**
+ * The bootstrap pipeline, in order. Each step is idempotent on the provider
+ * side and recorded in the state file, so a re-run after a failure skips what
+ * is done and resumes exactly where it stopped.
+ */
+const BOOTSTRAP_STEPS = [
+    {
+        name: 'scaleway-bucket',
+        label: () => 'Creating Terraform state bucket',
+        skipMessage: 'Scaleway state bucket: already done, skipping.',
+        run: async (answers) => {
+            const { policyWarning } = await ensureStateBucket(answers);
+            return policyWarning ? { warning: policyWarning } : undefined;
+        },
+    },
+    {
+        name: 'infisical',
+        label: () => 'Bootstrapping Infisical project and secrets',
+        skipMessage: 'Infisical project: already done, skipping.',
+        run: async (answers) => {
+            const { projectId } = await bootstrapInfisical(answers);
+            return { data: { projectId } };
+        },
+    },
+    {
+        name: 'github-repo',
+        label: (_answers, ctx) => `Creating GitHub repository ${ctx.owner}/${ctx.repo}`,
+        skipMessage: 'GitHub repository: already done, skipping.',
+        run: async (_answers, ctx) => {
+            const { url } = await ensureRepo(ctx);
+            return { data: { url } };
+        },
+    },
+    {
+        name: 'github-push',
+        label: () => 'Pushing generated code to GitHub',
+        skipMessage: 'GitHub push: already done, skipping.',
+        run: async (answers, ctx) => {
+            pushRepo(ctx, answers.github.token, answers.targetDir);
+        },
+    },
+    {
+        name: 'github-config',
+        label: () => 'Setting GitHub secrets, variables and branch protection',
+        skipMessage: 'GitHub configuration: already done, skipping.',
+        run: async (answers, ctx, state) => {
+            // Recorded by the infisical step (this run or a resumed one).
+            await configureRepo(ctx, answers, stepData(state, 'infisical', 'projectId'));
+        },
+    },
+];
+async function runBootstrap(answers, state, options) {
     let ctx;
-    await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
-        await validateScalewayCredentials(answers);
-        await infisicalLogin(answers);
-        ctx = await createContext(answers);
-    });
-    if (!isDone(state, 'scaleway-bucket')) {
-        await withSpinner('Creating Terraform state bucket', () => ensureStateBucket(answers));
-        markDone(dir, state, 'scaleway-bucket');
-    }
-    else {
-        log.info('Scaleway state bucket: already done, skipping.');
-    }
-    let infisicalProjectId = stepData(state, 'infisical', 'projectId');
-    if (!infisicalProjectId) {
-        const result = await withSpinner('Bootstrapping Infisical project and secrets', () => bootstrapInfisical(answers));
-        infisicalProjectId = result.projectId;
-        markDone(dir, state, 'infisical', { projectId: infisicalProjectId });
-    }
-    else {
-        log.info('Infisical project: already done, skipping.');
-    }
-    let repoUrl = stepData(state, 'github-repo', 'url');
-    if (!repoUrl) {
-        const repo = await withSpinner(`Creating GitHub repository ${ctx.owner}/${ctx.repo}`, () => ensureRepo(ctx));
-        repoUrl = repo.url;
-        markDone(dir, state, 'github-repo', { url: repoUrl });
+    if (options.preValidated) {
+        // Interactive runs validated each provider inline while prompting; only
+        // the GitHub context (octokit + owner) needs to be rebuilt here.
+        ctx = await createContext(answers.github);
     }
     else {
-        log.info('GitHub repository: already done, skipping.');
-    }
-    if (!isDone(state, 'github-push')) {
-        await withSpinner('Pushing generated code to GitHub', async () => {
-            pushRepo(ctx, answers.github.token, dir);
+        // All three credentials are checked before anything is created anywhere,
+        // so a bad token cannot leave a half-bootstrapped account behind.
+        await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
+            await validateScalewayCredentials(answers.scaleway);
+            await validateInfisical(answers.infisical);
+            ctx = await createContext(answers.github);
+            // A repo with commits would make the push fail after the bucket and the
+            // Infisical project were already created: fail here instead. Skipped on
+            // resume, where the previous run's push is the reason it is non-empty.
+            if (!isDone(state, 'github-push')) {
+                const { state: repoState } = await inspectRepo(ctx);
+                assertRepoUsable(ctx, repoState);
+            }
         });
-        markDone(dir, state, 'github-push');
-    }
-    else {
-        log.info('GitHub push: already done, skipping.');
     }
-    if (!isDone(state, 'github-config')) {
-        await withSpinner('Setting GitHub secrets, variables and branch protection', () => configureRepo(ctx, answers, infisicalProjectId));
-        markDone(dir, state, 'github-config');
-    }
-    else {
-        log.info('GitHub configuration: already done, skipping.');
+    for (const step of BOOTSTRAP_STEPS) {
+        if (isDone(state, step.name)) {
+            log.info(step.skipMessage);
+            continue;
+        }
+        const result = await withSpinner(step.label(answers, ctx), () => step.run(answers, ctx, state));
+        markDone(answers.targetDir, state, step.name, result?.data);
+        if (result?.warning)
+            log.warn(result.warning);
     }
-    return repoUrl;
+    return stepData(state, 'github-repo', 'url');
 }
 async function main() {
     const { partial, flags } = parseCli(process.argv.slice(2));
@@ -255,7 +329,7 @@ async function main() {
     const interactive = process.stdin.isTTY && !flags.yes;
     let collected = partial;
     if (interactive) {
-        collected = await fillMissing(partial, { advanced: flags.advanced });
+        collected = await fillMissing(partial, { advanced: flags.advanced, dryRun: flags.dryRun });
     }
     else if (!flags.dryRun) {
         const missing = missingRequired(partial);
@@ -305,8 +379,8 @@ async function main() {
         outro('Dry run complete. No account was touched.');
         return;
     }
-    const repoUrl = await runBootstrap(answers, state);
-    outro(renderNextSteps(answers, repoUrl, `rg.${answers.region}.scw.cloud/${answers.projectName}-${answers.environments[0].slug}`));
+    const repoUrl = await runBootstrap(answers, state, { preValidated: interactive });
+    outro(renderNextSteps(answers, repoUrl, `rg.${answers.region}.scw.cloud/${resourceName(answers.projectName, answers.environments[0].slug)}`));
 }
 main().catch((error) => {
     if (error instanceof ConfigError || error instanceof GenerateError) {

package/dist/meta.js

@@ -0,0 +1,12 @@
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** Version of the running keel package (dist/ sits next to package.json). */
+export function toolVersion() {
+    try {
+        const pkg = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+        return pkg.version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}