@gambi97/keel-cli 0.3.2 → 0.3.3

package/dist/bootstrap/github.js

@@ -209,8 +209,11 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_HOST: answers.infisical.host,
     };
     await setVariables(ctx, variables);
-    await configureEnvironments(ctx, answers);
-    return protectMainBranch(ctx, answers);
+    const warnings = [
+        await configureEnvironments(ctx, answers),
+        await protectMainBranch(ctx, answers),
+    ].filter((w) => w !== undefined);
+    return warnings.length > 0 ? warnings.join('\n\n') : undefined;
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -251,16 +254,45 @@ async function setVariables(ctx, variables) {
         }
     }
 }
-/** Each environment gets a GitHub deployment environment; gated ones (prod) require approval. */
-async function configureEnvironments(ctx, answers) {
+/**
+ * Each environment gets a GitHub deployment environment; gated ones (prod)
+ * require a reviewer approval. Required reviewers need GitHub Enterprise Cloud
+ * on private repositories — GitHub answers 422 there. Rather than strand the
+ * bootstrap at its last step, fall back to an ungated environment and warn:
+ * the environment still exists (deployments target it) but production will
+ * auto-deploy on merge. Like the branch-protection miss, this degrades to a
+ * warning instead of killing the run.
+ */
+export async function configureEnvironments(ctx, answers) {
+    const ungated = [];
     for (const env of answers.environments) {
-        await ctx.octokit.repos.createOrUpdateEnvironment({
-            owner: ctx.owner,
-            repo: ctx.repo,
-            environment_name: env.githubEnvironment,
-            ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
-        });
+        try {
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+                ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+            });
+        }
+        catch (error) {
+            // Only the reviewer rule can trip the plan limit; re-throw anything else
+            // (and any failure on a non-gated environment, which asked for no rule).
+            if (!env.gated || error.status !== 422)
+                throw error;
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+            });
+            ungated.push(env.githubEnvironment);
+        }
     }
+    if (ungated.length === 0)
+        return undefined;
+    return (`Created the ${ungated.join(', ')} environment(s) without the manual-approval gate: ` +
+        'required reviewers need GitHub Enterprise Cloud on private repositories, so production ' +
+        'will auto-deploy on merge to main. Make the repository public (reviewers are free there) ' +
+        'or upgrade the plan, then re-run to add the gate.');
 }
 /**
  * Require a green plan on PRs and forbid force-pushes/deletion of main.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -197,3 +197,9 @@ Avoid local applies: they race against CI on the same state.
 - **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
   permissions (IAMManager) to create the app's database (and Object Storage)
   credential.
+- **Apply fails with "expires_at ... organization security settings require an
+  expiration date for API keys"**: the app's database and Object Storage
+  credentials are long-lived service credentials — the container reads them at
+  runtime, so they intentionally never expire. If your Scaleway organization
+  enforces API-key expiration, exempt these service applications or turn the
+  policy off (Console → Organization → Security), then re-run the apply.