@gambi97/keel-cli 0.3.1 → 0.3.3

package/dist/bootstrap/github.js

@@ -16,12 +16,17 @@ export class GitHubError extends Error {
         this.field = field;
     }
 }
-export async function createContext(github) {
+/**
+ * Authenticate the token and confirm it carries the scopes keel needs. Split
+ * from createContext so the prompt can validate the token and list the user's
+ * repositories before a repository name even exists.
+ */
+export async function authenticate(token) {
     // Silence Octokit's own request logging: expected non-2xx responses (a 404
     // for a repo that does not exist yet, a 401 for a bad token) are handled
     // here and would otherwise scribble over the prompt spinner.
     const octokit = new Octokit({
-        auth: github.token,
+        auth: token,
         log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
     });
     let login;
@@ -48,13 +53,25 @@ export async function createContext(github) {
             }
         }
     }
-    return {
-        octokit,
-        owner: login,
-        ownerId,
-        repo: github.repoName,
-        repoPrivate: github.repoPrivate,
-    };
+    return { octokit, owner: login, ownerId };
+}
+export async function createContext(github) {
+    const identity = await authenticate(github.token);
+    return { ...identity, repo: github.repoName, repoPrivate: github.repoPrivate };
+}
+/**
+ * Repositories the user owns, newest first, flagged by emptiness. keel pushes a
+ * brand-new history, so only empty repos are reusable; `size === 0` is GitHub's
+ * cheap proxy for "no commits" (inspectRepo makes the authoritative call once a
+ * name is chosen). Paginated in full — the picker never silently truncates.
+ */
+export async function listOwnedRepos(octokit) {
+    const repos = await octokit.paginate(octokit.repos.listForAuthenticatedUser, {
+        affiliation: 'owner',
+        sort: 'updated',
+        per_page: 100,
+    });
+    return repos.map((r) => ({ name: r.name, private: r.private, empty: r.size === 0 }));
 }
 /** Read-only look at the target repository: existence, push access, emptiness. */
 export async function inspectRepo(ctx) {
@@ -103,15 +120,28 @@ export async function ensureRepo(ctx) {
     if (inspected.state !== 'not-found') {
         return { created: false, url: inspected.url };
     }
-    const { data } = await ctx.octokit.repos.createForAuthenticatedUser({
-        name: ctx.repo,
-        private: ctx.repoPrivate,
-        description: 'Serverless infrastructure on Scaleway, generated by keel',
-        has_wiki: false,
-        has_projects: false,
-        auto_init: false,
-    });
-    return { created: true, url: data.html_url };
+    try {
+        const { data } = await ctx.octokit.repos.createForAuthenticatedUser({
+            name: ctx.repo,
+            private: ctx.repoPrivate,
+            description: 'Serverless infrastructure on Scaleway, generated by keel',
+            has_wiki: false,
+            has_projects: false,
+            auto_init: false,
+        });
+        return { created: true, url: data.html_url };
+    }
+    catch (error) {
+        // inspectRepo said 404 but creation says the name is taken: a fine-grained
+        // token that cannot see the existing repo answers exactly this way. Map it
+        // to a re-askable error instead of dying on a raw Octokit failure.
+        if (error.status === 422) {
+            throw new GitHubError(`Repository ${ctx.owner}/${ctx.repo} already exists but the token cannot see it ` +
+                '(fine-grained tokens only see the repositories they were granted). Use a token ' +
+                'with access to it, or a different repository name.', 'repo');
+        }
+        throw error;
+    }
 }
 /**
  * Push the generated repo over HTTPS. The token is handed to git through a
@@ -154,7 +184,10 @@ export function pushRepo(ctx, token, targetDir) {
         rmSync(askpassDir, { recursive: true, force: true });
     }
 }
-/** Encrypt and upload every CI secret, then set the plain variables. */
+/**
+ * Encrypt and upload every CI secret, then set the plain variables. Returns a
+ * warning instead of failing when branch protection is unavailable.
+ */
 export async function configureRepo(ctx, answers, infisicalProjectId) {
     // The workflows map AWS_* (state backend) from the same SCW_* secrets, so
     // each credential is stored once and rotated in one place. The Record types
@@ -176,8 +209,11 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_HOST: answers.infisical.host,
     };
     await setVariables(ctx, variables);
-    await configureEnvironments(ctx, answers);
-    await protectMainBranch(ctx, answers);
+    const warnings = [
+        await configureEnvironments(ctx, answers),
+        await protectMainBranch(ctx, answers),
+    ].filter((w) => w !== undefined);
+    return warnings.length > 0 ? warnings.join('\n\n') : undefined;
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -218,33 +254,78 @@ async function setVariables(ctx, variables) {
         }
     }
 }
-/** Each environment gets a GitHub deployment environment; gated ones (prod) require approval. */
-async function configureEnvironments(ctx, answers) {
+/**
+ * Each environment gets a GitHub deployment environment; gated ones (prod)
+ * require a reviewer approval. Required reviewers need GitHub Enterprise Cloud
+ * on private repositories — GitHub answers 422 there. Rather than strand the
+ * bootstrap at its last step, fall back to an ungated environment and warn:
+ * the environment still exists (deployments target it) but production will
+ * auto-deploy on merge. Like the branch-protection miss, this degrades to a
+ * warning instead of killing the run.
+ */
+export async function configureEnvironments(ctx, answers) {
+    const ungated = [];
     for (const env of answers.environments) {
-        await ctx.octokit.repos.createOrUpdateEnvironment({
+        try {
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+                ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+            });
+        }
+        catch (error) {
+            // Only the reviewer rule can trip the plan limit; re-throw anything else
+            // (and any failure on a non-gated environment, which asked for no rule).
+            if (!env.gated || error.status !== 422)
+                throw error;
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+            });
+            ungated.push(env.githubEnvironment);
+        }
+    }
+    if (ungated.length === 0)
+        return undefined;
+    return (`Created the ${ungated.join(', ')} environment(s) without the manual-approval gate: ` +
+        'required reviewers need GitHub Enterprise Cloud on private repositories, so production ' +
+        'will auto-deploy on merge to main. Make the repository public (reviewers are free there) ' +
+        'or upgrade the plan, then re-run to add the gate.');
+}
+/**
+ * Require a green plan on PRs and forbid force-pushes/deletion of main.
+ * Branch protection needs GitHub Pro on private repositories: failing here
+ * would strand the bootstrap at its very last step with everything else
+ * already created, so — like the state bucket policy — the miss degrades to
+ * a warning instead of killing the run.
+ */
+async function protectMainBranch(ctx, answers) {
+    try {
+        await ctx.octokit.repos.updateBranchProtection({
             owner: ctx.owner,
             repo: ctx.repo,
-            environment_name: env.githubEnvironment,
-            ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+            branch: 'main',
+            required_status_checks: {
+                strict: false,
+                // Must match the job names produced by the plan workflow; the shared
+                // format lives in contracts.ts and is tested against the template.
+                contexts: answers.environments.map((env) => planStatusCheckContext(env.slug)),
+            },
+            enforce_admins: false,
+            required_pull_request_reviews: null,
+            restrictions: null,
+            allow_force_pushes: false,
+            allow_deletions: false,
         });
+        return undefined;
+    }
+    catch (error) {
+        if (error.status !== 403)
+            throw error;
+        return (`Could not protect the main branch of ${ctx.owner}/${ctx.repo}: GitHub requires a ` +
+            'paid plan for branch protection on private repositories. PRs stay mergeable without ' +
+            'a green plan — make the repository public or upgrade, then re-run to add protection.');
     }
-}
-/** Require a green plan on PRs and forbid force-pushes/deletion of main. */
-async function protectMainBranch(ctx, answers) {
-    await ctx.octokit.repos.updateBranchProtection({
-        owner: ctx.owner,
-        repo: ctx.repo,
-        branch: 'main',
-        required_status_checks: {
-            strict: false,
-            // Must match the job names produced by the plan workflow; the shared
-            // format lives in contracts.ts and is tested against the template.
-            contexts: answers.environments.map((env) => planStatusCheckContext(env.slug)),
-        },
-        enforce_admins: false,
-        required_pull_request_reviews: null,
-        restrictions: null,
-        allow_force_pushes: false,
-        allow_deletions: false,
-    });
 }

package/dist/bootstrap/infisical.js

@@ -60,10 +60,20 @@ async function ensureEnvironment(host, token, project, slug, name) {
     if (project.environments?.some((e) => e.slug === slug))
         return;
     const { status, data } = await api(host, `/api/v1/workspace/${project.id}/environments`, { method: 'POST', token, body: { name, slug } });
-    // 400 usually means the environment already exists: fine for idempotency.
-    if (status !== 200 && status !== 400) {
-        throw new InfisicalError(`Could not create Infisical environment "${slug}" (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
+    if (status === 200)
+        return;
+    // A 400 usually means the environment already exists (fine for idempotency),
+    // but it is also what plan limits and rejected slugs answer: trust the
+    // message when it says "exists", otherwise re-fetch and check for real —
+    // swallowing it blindly would surface later as a confusing seeding failure.
+    if (status === 400) {
+        if (/exist/i.test(data.message ?? ''))
+            return;
+        const fresh = await findProjectById(host, token, project.id);
+        if (fresh?.environments?.some((e) => e.slug === slug))
+            return;
     }
+    throw new InfisicalError(`Could not create Infisical environment "${slug}" (HTTP ${status}${data.message ? `: ${data.message}` : ''}).`);
 }
 async function seedSecret(host, token, projectId, environment, name, value) {
     const { status, data } = await api(host, `/api/v3/secrets/raw/${name}`, {

package/dist/bootstrap/scaleway.js

@@ -137,13 +137,30 @@ export async function ensureStateBucket(answers) {
         if (status !== 404 && status !== 301) {
             throw error;
         }
-        await client.send(new CreateBucketCommand({ Bucket: bucket }));
-        // Versioning protects the state history against accidental overwrites.
-        await client.send(new PutBucketVersioningCommand({
-            Bucket: bucket,
-            VersioningConfiguration: { Status: 'Enabled' },
-        }));
-        created = true;
+        // HeadBucket said "missing", but on Scaleway it can 404/301 a bucket we
+        // actually own (region/endpoint quirks, eventual consistency). CreateBucket
+        // is the authoritative check: treat AlreadyOwnedByYou as a resume, and
+        // AlreadyExists (owned by someone else) as the name clash Head would report.
+        try {
+            await client.send(new CreateBucketCommand({ Bucket: bucket }));
+            // Versioning protects the state history against accidental overwrites.
+            await client.send(new PutBucketVersioningCommand({
+                Bucket: bucket,
+                VersioningConfiguration: { Status: 'Enabled' },
+            }));
+            created = true;
+        }
+        catch (createError) {
+            const name = createError.name;
+            if (name === 'BucketAlreadyExists') {
+                throw new ScalewayError(`Bucket "${bucket}" already exists but is owned by another account. ` +
+                    'Choose a different project name.');
+            }
+            if (name !== 'BucketAlreadyOwnedByYou') {
+                throw createError;
+            }
+            // Already ours from an earlier run: fall through to (re)apply the policy.
+        }
     }
     const policyWarning = await lockDownStateBucket(client, bucket, answers);
     return policyWarning ? { created, policyWarning } : { created };

package/dist/index.js

@@ -283,7 +283,8 @@ const BOOTSTRAP_STEPS = [
         skipMessage: 'GitHub configuration: already done, skipping.',
         run: async (answers, ctx, state) => {
             // Recorded by the infisical step (this run or a resumed one).
-            await configureRepo(ctx, answers, stepData(state, 'infisical', 'projectId'));
+            const warning = await configureRepo(ctx, answers, stepData(state, 'infisical', 'projectId'));
+            return warning ? { warning } : undefined;
         },
     },
 ];

package/dist/prompts.js

@@ -1,5 +1,5 @@
 import * as p from '@clack/prompts';
-import { createContext, GitHubError, inspectRepo, assertRepoUsable } from './bootstrap/github.js';
+import { authenticate, createContext, GitHubError, inspectRepo, assertRepoUsable, listOwnedRepos, } from './bootstrap/github.js';
 import { InfisicalError, validateInfisical } from './bootstrap/infisical.js';
 import { ScalewayError, validateScalewayCredentials } from './bootstrap/scaleway.js';
 import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
@@ -123,21 +123,88 @@ async function askConfiguration(out, options) {
         }
     }
 }
-/** GitHub block: repo + token, then verify token, scopes and repo state. */
+/**
+ * Decide the target repository once the token is known: create a new one, or
+ * reuse an existing empty repo picked from a list. keel pushes a brand-new
+ * history, so only empty repos are offered — a name typed for a new repo is
+ * still validated. Sets repoName (and, for an existing pick, its real
+ * visibility) on `out`.
+ */
+async function chooseRepo(out, identity) {
+    const CREATE_NEW = ' create-new'; // sentinel: a leading space is never a valid repo name
+    const spin = p.spinner();
+    spin.start('Fetching your GitHub repositories');
+    let reusable = [];
+    try {
+        const repos = await listOwnedRepos(identity.octokit);
+        reusable = repos.filter((r) => r.empty);
+        spin.stop(reusable.length
+            ? `Found ${reusable.length} empty repositor${reusable.length === 1 ? 'y' : 'ies'} you can reuse`
+            : 'No empty repositories to reuse — keel will create a new one');
+    }
+    catch {
+        spin.stop('Could not list repositories; you can still name a new one');
+    }
+    const choice = reusable.length
+        ? await ask(p.select({
+            message: 'Repository',
+            initialValue: CREATE_NEW,
+            options: [
+                {
+                    value: CREATE_NEW,
+                    label: 'Create a new repository',
+                    hint: 'keel creates it for you',
+                },
+                ...reusable.map((r) => ({
+                    value: r.name,
+                    label: r.name,
+                    hint: `${r.private ? 'private' : 'public'}, empty — reuse it`,
+                })),
+            ],
+        }))
+        : CREATE_NEW;
+    if (choice !== CREATE_NEW) {
+        const picked = reusable.find((r) => r.name === choice);
+        out.github.repoName = picked.name;
+        out.github.repoPrivate = picked.private; // keep the repo's existing visibility
+        return;
+    }
+    out.github.repoName = await ask(p.text({
+        message: 'New repository name',
+        initialValue: out.projectName,
+        validate: validate(validateProjectName),
+    }));
+}
+/** GitHub block: token first (so we can list repos), then repo choice and state. */
 async function askGitHub(out) {
     // When resuming a run that already pushed, the repo legitimately has
     // commits: a non-empty repo must not block the resume.
     const targetDir = out.targetDir?.trim() || out.projectName;
     const alreadyPushed = isDone(loadState(targetDir, out.projectName), 'github-push');
-    p.intro('GitHub — repository, visibility and token');
+    p.intro('GitHub — token, repository and visibility');
     for (;;) {
+        // Token first: authenticating up front lets keel list your repositories so
+        // you can pick one instead of typing its name.
+        if (!out.github.token) {
+            out.github.token = await secret('GitHub token (scopes: repo, workflow)');
+        }
+        let identity;
+        try {
+            identity = await authenticate(out.github.token);
+        }
+        catch (error) {
+            if (!(error instanceof GitHubError))
+                throw error;
+            log.error(error.message);
+            out.github.token = undefined;
+            continue;
+        }
+        // New-or-existing selector. Skipped when a name is already fixed by flags,
+        // --config or a resumed run.
         if (!out.github.repoName) {
-            out.github.repoName = await ask(p.text({
-                message: 'GitHub repository name (a new empty repository works best)',
-                initialValue: out.projectName,
-                validate: validate(validateProjectName),
-            }));
+            await chooseRepo(out, identity);
         }
+        // Visibility. An existing pick carries its own; only a new repo asks.
         if (out.github.repoPrivate === undefined) {
             out.github.repoPrivate = await ask(p.select({
                 message: 'Repository visibility',
@@ -148,9 +215,6 @@ async function askGitHub(out) {
                 ],
             }));
         }
-        if (!out.github.token) {
-            out.github.token = await secret('GitHub token (scopes: repo, workflow)');
-        }
         try {
             const ctx = await createContext({
                 token: out.github.token,
@@ -174,7 +238,9 @@ async function askGitHub(out) {
                 throw error;
             log.error(error.message);
             if (error.field === 'repo') {
+                // Bad repo choice: re-run the selector and re-derive its visibility.
                 out.github.repoName = undefined;
+                out.github.repoPrivate = undefined;
             }
             else {
                 out.github.token = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -197,3 +197,9 @@ Avoid local applies: they race against CI on the same state.
 - **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
   permissions (IAMManager) to create the app's database (and Object Storage)
   credential.
+- **Apply fails with "expires_at ... organization security settings require an
+  expiration date for API keys"**: the app's database and Object Storage
+  credentials are long-lived service credentials — the container reads them at
+  runtime, so they intentionally never expire. If your Scaleway organization
+  enforces API-key expiration, exempt these service applications or turn the
+  policy off (Console → Organization → Security), then re-run the apply.