@gambi97/keel-cli 0.3.5 → 0.3.6

package/dist/bootstrap/github.js

@@ -24,18 +24,21 @@ export class GitHubError extends Error {
 export async function authenticate(token) {
     // Silence Octokit's own request logging: expected non-2xx responses (a 404
     // for a repo that does not exist yet, a 401 for a bad token) are handled
-    // here and would otherwise scribble over the prompt spinner.
+    // here and would otherwise scribble over the prompt spinner. The same sink
+    // is passed at the request layer too: @octokit/request reads
+    // `request.log` (falling back to console) for deprecation notices carried
+    // in response headers, bypassing the instance logger.
+    const silentLog = { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } };
     const octokit = new Octokit({
         auth: token,
-        log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
+        log: silentLog,
+        request: { log: silentLog },
     });
     let login;
-    let ownerId;
     let scopes;
     try {
         const { data, headers } = await octokit.users.getAuthenticated();
         login = data.login;
-        ownerId = data.id;
         scopes = headers['x-oauth-scopes'];
     }
     catch {
@@ -53,7 +56,7 @@ export async function authenticate(token) {
             }
         }
     }
-    return { octokit, owner: login, ownerId };
+    return { octokit, owner: login };
 }
 export async function createContext(github) {
     const identity = await authenticate(github.token);
@@ -209,11 +212,8 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_HOST: answers.infisical.host,
     };
     await setVariables(ctx, variables);
-    const warnings = [
-        await configureEnvironments(ctx, answers),
-        await protectMainBranch(ctx, answers),
-    ].filter((w) => w !== undefined);
-    return warnings.length > 0 ? warnings.join('\n\n') : undefined;
+    await configureEnvironments(ctx, answers);
+    return protectMainBranch(ctx, answers);
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -255,44 +255,20 @@ async function setVariables(ctx, variables) {
     }
 }
 /**
- * Each environment gets a GitHub deployment environment; gated ones (prod)
- * require a reviewer approval. Required reviewers need GitHub Enterprise Cloud
- * on private repositories — GitHub answers 422 there. Rather than strand the
- * bootstrap at its last step, fall back to an ungated environment and warn:
- * the environment still exists (deployments target it) but production will
- * auto-deploy on merge. Like the branch-protection miss, this degrades to a
- * warning instead of killing the run.
+ * Each environment gets a GitHub deployment environment, used by the apply
+ * workflow for deployment tracking and history. No reviewer gate is requested:
+ * production is promoted by a version tag — the tag IS the gate, free on every
+ * plan, while required reviewers would need GitHub Enterprise Cloud on private
+ * repositories and would only duplicate what the tag already enforces.
  */
 export async function configureEnvironments(ctx, answers) {
-    const ungated = [];
     for (const env of answers.environments) {
-        try {
-            await ctx.octokit.repos.createOrUpdateEnvironment({
-                owner: ctx.owner,
-                repo: ctx.repo,
-                environment_name: env.githubEnvironment,
-                ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
-            });
-        }
-        catch (error) {
-            // Only the reviewer rule can trip the plan limit; re-throw anything else
-            // (and any failure on a non-gated environment, which asked for no rule).
-            if (!env.gated || error.status !== 422)
-                throw error;
-            await ctx.octokit.repos.createOrUpdateEnvironment({
-                owner: ctx.owner,
-                repo: ctx.repo,
-                environment_name: env.githubEnvironment,
-            });
-            ungated.push(env.githubEnvironment);
-        }
+        await ctx.octokit.repos.createOrUpdateEnvironment({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            environment_name: env.githubEnvironment,
+        });
     }
-    if (ungated.length === 0)
-        return undefined;
-    return (`Created the ${ungated.join(', ')} environment(s) without the manual-approval gate: ` +
-        'required reviewers need GitHub Enterprise Cloud on private repositories, so production ' +
-        'will auto-deploy on merge to main. Make the repository public (reviewers are free there) ' +
-        'or upgrade the plan, then re-run to add the gate.');
 }
 /**
  * Require a green plan on PRs and forbid force-pushes/deletion of main.

package/dist/bootstrap/scaleway.js

@@ -33,6 +33,26 @@ export async function validateScalewayCredentials(scaleway) {
             `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
 }
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Bucket-metadata calls made right after CreateBucket can race its propagation
+ * and answer NoSuchBucket for a bucket that provably exists (we created or
+ * Head-checked it moments before). Retry exactly that error with a short
+ * backoff; anything else is a real failure and is thrown immediately.
+ */
+export async function retryWhileBucketPropagates(fn, attempts = 5, baseDelayMs = 1000) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (error.name !== 'NoSuchBucket' || attempt >= attempts) {
+                throw error;
+            }
+            await sleep(attempt * baseDelayMs);
+        }
+    }
+}
 function s3Client(answers) {
     return new S3Client({
         region: answers.region,
@@ -107,13 +127,14 @@ async function lockDownStateBucket(client, bucket, answers) {
         ],
     };
     try {
-        await client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+        await retryWhileBucketPropagates(() => client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) })));
         return undefined;
     }
     catch (error) {
         return (`Could not apply a policy to bucket "${bucket}" ` +
             `(${error instanceof Error ? error.message : String(error)}); ` +
-            'the state bucket was NOT restricted to your identity.');
+            'the state bucket was NOT restricted to your identity. ' +
+            'Re-run keel to retry this step.');
     }
 }
 /**
@@ -144,10 +165,10 @@ export async function ensureStateBucket(answers) {
         try {
             await client.send(new CreateBucketCommand({ Bucket: bucket }));
             // Versioning protects the state history against accidental overwrites.
-            await client.send(new PutBucketVersioningCommand({
+            await retryWhileBucketPropagates(() => client.send(new PutBucketVersioningCommand({
                 Bucket: bucket,
                 VersioningConfiguration: { Status: 'Enabled' },
-            }));
+            })));
             created = true;
         }
         catch (createError) {

package/dist/config.js

@@ -11,7 +11,6 @@ const ENV_DEFAULTS = {
         displayName: 'Development',
         githubEnvironment: 'dev',
         production: false,
-        gated: false,
         minScale: 0,
         maxScale: 1,
     },
@@ -19,7 +18,6 @@ const ENV_DEFAULTS = {
         displayName: 'Staging',
         githubEnvironment: 'staging',
         production: false,
-        gated: false,
         minScale: 0,
         maxScale: 1,
     },
@@ -27,7 +25,6 @@ const ENV_DEFAULTS = {
         displayName: 'Production',
         githubEnvironment: 'production',
         production: true,
-        gated: true,
         minScale: 0,
         // Start small: one instance is enough to go live and costs the least;
         // raising the ceiling later is a one-line prod.tfvars change.
@@ -50,12 +47,25 @@ export const DEFAULT_ENV_PRESET = 'staging+prod';
  * Lock a resume's configuration to what the repo was generated with. Scaling
  * is intentionally not carried: it only shapes the tfvars, which are already
  * generated on any run that has a manifest, so post-generate steps never read it.
+ *
+ * The GitHub repo identity is locked too: on resume the target repository is
+ * already decided (keel created and pushed it), so the picker must not run and
+ * must never frame the project's own — now non-empty — repo as "create a new
+ * one". Older manifests without a github block fall back to the project name,
+ * which is the repo default and the only repository the project could own. An
+ * explicit --repo-name still wins (the established flag-precedence rule).
  */
 export function hydrateConfigFromManifest(partial, manifest) {
     partial.region = manifest.region;
     partial.environments = manifest.environments;
     partial.objectStorage = manifest.options.objectStorage;
     partial.basicAuth = manifest.options.basicAuth;
+    if (!partial.github.repoName) {
+        partial.github.repoName = manifest.github?.repoName ?? manifest.projectName;
+    }
+    if (partial.github.repoPrivate === undefined && manifest.github?.repoPrivate !== undefined) {
+        partial.github.repoPrivate = manifest.github.repoPrivate;
+    }
 }
 export class ConfigError extends Error {
 }
@@ -210,8 +220,7 @@ export function resolveEnvironments(slugs, basicAuth, overrides) {
             displayName: def.displayName,
             githubEnvironment: def.githubEnvironment,
             production: def.production,
-            gated: def.gated,
-            // Basic Auth is a non-production safety net; production is never gated by it.
+            // Basic Auth is a non-production safety net; production never has it.
             basicAuth: def.production ? false : basicAuth,
             minScale,
             maxScale,

package/dist/generate.js

@@ -26,6 +26,12 @@ function renderManifest(answers) {
             objectStorage: answers.objectStorage,
             basicAuth: answers.basicAuth,
         },
+        // Recorded so a resume locks the repository instead of re-running the
+        // picker; see hydrateConfigFromManifest.
+        github: {
+            repoName: answers.github.repoName,
+            repoPrivate: answers.github.repoPrivate,
+        },
     };
     return `${JSON.stringify(manifest, null, 2)}\n`;
 }

package/dist/index.js

@@ -7,7 +7,7 @@ import { CI_SECRET_NAMES, CI_VARIABLE_NAMES, resourceName } from './contracts.js
 import { generateProject, GenerateError, readManifest } from './generate.js';
 import { toolVersion } from './meta.js';
 import { confirmSummary, fillMissing } from './prompts.js';
-import { isDone, loadState, markDone, STATE_FILE, stepData, } from './state.js';
+import { isDone, loadState, markDone, STATE_FILE, stepData, stepWarning, } from './state.js';
 import { cancel, intro, log, outro, renderNextSteps, renderSummary, withSpinner } from './ui.js';
 import { ensureStateBucket, validateScalewayCredentials } from './bootstrap/scaleway.js';
 import { bootstrapInfisical, validateInfisical } from './bootstrap/infisical.js';
@@ -316,8 +316,13 @@ async function runBootstrap(answers, state, options) {
             log.info(step.skipMessage);
             continue;
         }
+        // A step that degraded with a warning last run is re-run (idempotent) so
+        // the degraded part can heal — e.g. a bucket policy that raced creation.
+        if (stepWarning(state, step.name)) {
+            log.info('Previous run finished this step with a warning — retrying it.');
+        }
         const result = await withSpinner(step.label(answers, ctx), () => step.run(answers, ctx, state));
-        markDone(answers.targetDir, state, step.name, result?.data);
+        markDone(answers.targetDir, state, step.name, result?.data, result?.warning);
         if (result?.warning)
             log.warn(result.warning);
     }

package/dist/prompts.js

@@ -55,7 +55,7 @@ export async function fillMissing(partial, options) {
     const resuming = manifest !== undefined && manifest.projectName === out.projectName;
     if (manifest && resuming) {
         hydrateConfigFromManifest(out, manifest);
-        log.info(`Resuming "${out.projectName}" — region, environments and options are locked to its .keel manifest.`);
+        log.info(`Resuming "${out.projectName}" — repository, region, environments and options are locked to its .keel manifest.`);
     }
     // Each block opens with a "┌ <Provider>" section corner and closes with a
     // "└ <Provider> connected — …" line, so every question flows inside its own

package/dist/state.js

@@ -18,10 +18,15 @@ export function saveState(targetDir, state) {
     writeFileSync(join(targetDir, STATE_FILE), `${JSON.stringify(state, null, 2)}\n`);
 }
 export function isDone(state, step) {
-    return state.steps[step] !== undefined;
+    const record = state.steps[step];
+    return record !== undefined && record.warning === undefined;
 }
-export function markDone(targetDir, state, step, data) {
-    state.steps[step] = data ? { data } : {};
+/** The warning a previous run recorded for this step, if it degraded. */
+export function stepWarning(state, step) {
+    return state.steps[step]?.warning;
+}
+export function markDone(targetDir, state, step, data, warning) {
+    state.steps[step] = { ...(data ? { data } : {}), ...(warning ? { warning } : {}) };
     saveState(targetDir, state);
 }
 export function stepData(state, step, key) {

package/dist/ui.js

@@ -59,7 +59,7 @@ export function renderSummary(answers, dryRun) {
     for (const env of answers.environments) {
         const flags = [
             `scale ${env.minScale}-${env.maxScale}`,
-            env.gated ? 'manual approval' : 'auto-deploy',
+            env.production ? 'deploys on version tag' : 'deploys on merge to main',
             env.basicAuth ? 'basic auth' : null,
         ]
             .filter(Boolean)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",