@gambi97/keel-cli 0.3.2 → 0.3.4

package/dist/bootstrap/github.js

@@ -209,8 +209,11 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_HOST: answers.infisical.host,
     };
     await setVariables(ctx, variables);
-    await configureEnvironments(ctx, answers);
-    return protectMainBranch(ctx, answers);
+    const warnings = [
+        await configureEnvironments(ctx, answers),
+        await protectMainBranch(ctx, answers),
+    ].filter((w) => w !== undefined);
+    return warnings.length > 0 ? warnings.join('\n\n') : undefined;
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -251,16 +254,45 @@ async function setVariables(ctx, variables) {
         }
     }
 }
-/** Each environment gets a GitHub deployment environment; gated ones (prod) require approval. */
-async function configureEnvironments(ctx, answers) {
+/**
+ * Each environment gets a GitHub deployment environment; gated ones (prod)
+ * require a reviewer approval. Required reviewers need GitHub Enterprise Cloud
+ * on private repositories — GitHub answers 422 there. Rather than strand the
+ * bootstrap at its last step, fall back to an ungated environment and warn:
+ * the environment still exists (deployments target it) but production will
+ * auto-deploy on merge. Like the branch-protection miss, this degrades to a
+ * warning instead of killing the run.
+ */
+export async function configureEnvironments(ctx, answers) {
+    const ungated = [];
     for (const env of answers.environments) {
-        await ctx.octokit.repos.createOrUpdateEnvironment({
-            owner: ctx.owner,
-            repo: ctx.repo,
-            environment_name: env.githubEnvironment,
-            ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
-        });
+        try {
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+                ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
+            });
+        }
+        catch (error) {
+            // Only the reviewer rule can trip the plan limit; re-throw anything else
+            // (and any failure on a non-gated environment, which asked for no rule).
+            if (!env.gated || error.status !== 422)
+                throw error;
+            await ctx.octokit.repos.createOrUpdateEnvironment({
+                owner: ctx.owner,
+                repo: ctx.repo,
+                environment_name: env.githubEnvironment,
+            });
+            ungated.push(env.githubEnvironment);
+        }
     }
+    if (ungated.length === 0)
+        return undefined;
+    return (`Created the ${ungated.join(', ')} environment(s) without the manual-approval gate: ` +
+        'required reviewers need GitHub Enterprise Cloud on private repositories, so production ' +
+        'will auto-deploy on merge to main. Make the repository public (reviewers are free there) ' +
+        'or upgrade the plan, then re-run to add the gate.');
 }
 /**
  * Require a green plan on PRs and forbid force-pushes/deletion of main.

package/dist/config.js

@@ -46,6 +46,17 @@ export const ENV_PRESETS = {
     'dev+staging+prod': ['dev', 'staging', 'prod'],
 };
 export const DEFAULT_ENV_PRESET = 'staging+prod';
+/**
+ * Lock a resume's configuration to what the repo was generated with. Scaling
+ * is intentionally not carried: it only shapes the tfvars, which are already
+ * generated on any run that has a manifest, so post-generate steps never read it.
+ */
+export function hydrateConfigFromManifest(partial, manifest) {
+    partial.region = manifest.region;
+    partial.environments = manifest.environments;
+    partial.objectStorage = manifest.options.objectStorage;
+    partial.basicAuth = manifest.options.basicAuth;
+}
 export class ConfigError extends Error {
 }
 const PROJECT_NAME_RE = /^[a-z](?:[a-z0-9-]{0,48}[a-z0-9])?$/;

package/dist/generate.js

@@ -29,6 +29,28 @@ function renderManifest(answers) {
     };
     return `${JSON.stringify(manifest, null, 2)}\n`;
 }
+/**
+ * Read the committed manifest from a target directory, or undefined when there
+ * is none (a fresh run). Used by the resume paths to lock configuration to
+ * what the repo was generated with instead of asking for it again.
+ */
+export function readManifest(targetDir) {
+    try {
+        const raw = readFileSync(join(targetDir, MANIFEST_FILE), 'utf8');
+        const m = JSON.parse(raw);
+        if (typeof m.projectName === 'string' &&
+            typeof m.region === 'string' &&
+            Array.isArray(m.environments) &&
+            typeof m.options?.objectStorage === 'boolean' &&
+            typeof m.options?.basicAuth === 'boolean') {
+            return m;
+        }
+    }
+    catch {
+        // No manifest or unreadable/invalid: treat as a fresh run.
+    }
+    return undefined;
+}
 /** Files whose real name would confuse npm packaging are stored renamed. */
 const RENAMES = {
     _gitignore: '.gitignore',

package/dist/index.js

@@ -2,9 +2,9 @@
 import { readFileSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { parseArgs } from 'node:util';
-import { ConfigError, finalizeAnswers, fromEnv, mergeAnswers, missingRequired, parseEnvironments, } from './config.js';
+import { ConfigError, finalizeAnswers, fromEnv, hydrateConfigFromManifest, mergeAnswers, missingRequired, parseEnvironments, } from './config.js';
 import { CI_SECRET_NAMES, CI_VARIABLE_NAMES, resourceName } from './contracts.js';
-import { generateProject, GenerateError } from './generate.js';
+import { generateProject, GenerateError, readManifest } from './generate.js';
 import { toolVersion } from './meta.js';
 import { confirmSummary, fillMissing } from './prompts.js';
 import { isDone, loadState, markDone, STATE_FILE, stepData, } from './state.js';
@@ -333,6 +333,16 @@ async function main() {
         collected = await fillMissing(partial, { advanced: flags.advanced, dryRun: flags.dryRun });
     }
     else if (!flags.dryRun) {
+        // Resuming non-interactively: lock configuration to the committed manifest
+        // so flags/defaults can't silently diverge from the generated repo (e.g. a
+        // resume without --object-storage must not flip it off). Same source of
+        // truth as the interactive path.
+        const resumeDir = partial.targetDir?.trim() || partial.projectName;
+        const manifest = resumeDir ? readManifest(resumeDir) : undefined;
+        if (manifest && manifest.projectName === partial.projectName) {
+            hydrateConfigFromManifest(partial, manifest);
+            log.info(`Resuming "${manifest.projectName}" — configuration locked to its .keel manifest.`);
+        }
         const missing = missingRequired(partial);
         if (missing.length > 0) {
             cancel(`Non-interactive run is missing required values:\n  - ${missing.join('\n  - ')}`);

package/dist/prompts.js

@@ -2,7 +2,8 @@ import * as p from '@clack/prompts';
 import { authenticate, createContext, GitHubError, inspectRepo, assertRepoUsable, listOwnedRepos, } from './bootstrap/github.js';
 import { InfisicalError, validateInfisical } from './bootstrap/infisical.js';
 import { ScalewayError, validateScalewayCredentials } from './bootstrap/scaleway.js';
-import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
+import { ConfigError, DEFAULT_ENV_PRESET, DEFAULT_INFISICAL_HOST, DEFAULT_REGION, ENV_PRESETS, envDefaultScale, hydrateConfigFromManifest, REGIONS, validateProjectName, validateScale, validateUrl, } from './config.js';
+import { readManifest } from './generate.js';
 import { isDone, loadState } from './state.js';
 import { log } from './ui.js';
 function bail() {
@@ -45,6 +46,17 @@ const text = (message, placeholder) => ask(p.text({
 export async function fillMissing(partial, options) {
     const out = structuredClone(partial);
     await askProjectName(out);
+    // Resuming an existing project: its configuration is frozen (the repo is
+    // already generated with it), so lock it from the committed manifest instead
+    // of asking again. Credentials are never persisted, so the provider blocks
+    // still run — set SCW_*/INFISICAL_*/GITHUB_TOKEN in the env to skip typing.
+    const resumeDir = out.targetDir?.trim() || out.projectName;
+    const manifest = readManifest(resumeDir);
+    const resuming = manifest !== undefined && manifest.projectName === out.projectName;
+    if (manifest && resuming) {
+        hydrateConfigFromManifest(out, manifest);
+        log.info(`Resuming "${out.projectName}" — region, environments and options are locked to its .keel manifest.`);
+    }
     // Each block opens with a "┌ <Provider>" section corner and closes with a
     // "└ <Provider> connected — …" line, so every question flows inside its own
     // section and the next one opens only when the previous is verified.
@@ -55,7 +67,10 @@ export async function fillMissing(partial, options) {
     }
     // Configuration comes last: with the accounts verified, these are the only
     // real choices left. In a dry run it is all that is asked after the name.
-    await askConfiguration(out, options);
+    // On resume it is skipped entirely — the manifest already fixed it.
+    if (!resuming) {
+        await askConfiguration(out, options);
+    }
     return out;
 }
 async function askProjectName(out) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -197,3 +197,9 @@ Avoid local applies: they race against CI on the same state.
 - **Apply fails creating IAM resources**: the CI Scaleway key needs IAM
   permissions (IAMManager) to create the app's database (and Object Storage)
   credential.
+- **Apply fails with "expires_at ... organization security settings require an
+  expiration date for API keys"**: the app's database and Object Storage
+  credentials are long-lived service credentials — the container reads them at
+  runtime, so they intentionally never expire. If your Scaleway organization
+  enforces API-key expiration, exempt these service applications or turn the
+  policy off (Console → Organization → Security), then re-run the apply.