@gambi97/keel-cli 0.3.5 → 0.3.7

package/README.md

@@ -263,6 +263,12 @@ creating anything**.
    `ContainersFullAccess`, `ServerlessSQLDatabaseFullAccess`,
    `ContainerRegistryFullAccess`, plus `IAMManager` so Terraform can create
    the app's dedicated least-privilege database credential).
+5. **Organization security settings — API-key expiration must be unlimited**
+   (Console → Organization → Security → API keys). The app's database and
+   Object Storage credentials are non-expiring service credentials by design
+   (the container reads them at runtime); if your organization forces API
+   keys to expire, the first CI apply fails creating them. keel checks this
+   setting during validation and warns before anything is created.
 
 </details>
 
@@ -273,7 +279,9 @@ creating anything**.
 1. Create an account at [app.infisical.com](https://app.infisical.com) (or
    use a self-hosted instance).
 2. Create a **Machine Identity** with **Universal Auth**: you need its
-   **client ID** and **client secret**.
+   **client ID** and **client secret**. Create the client secret with
+   **unlimited uses** (Max Number of Uses = 0): CI logs in with it on every
+   plan/apply, so any finite usage limit eventually runs out mid-pipeline.
 3. Give the identity permission to create and manage projects.
 
 </details>

package/dist/bootstrap/github.js

@@ -24,18 +24,21 @@ export class GitHubError extends Error {
 export async function authenticate(token) {
     // Silence Octokit's own request logging: expected non-2xx responses (a 404
     // for a repo that does not exist yet, a 401 for a bad token) are handled
-    // here and would otherwise scribble over the prompt spinner.
+    // here and would otherwise scribble over the prompt spinner. The same sink
+    // is passed at the request layer too: @octokit/request reads
+    // `request.log` (falling back to console) for deprecation notices carried
+    // in response headers, bypassing the instance logger.
+    const silentLog = { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } };
     const octokit = new Octokit({
         auth: token,
-        log: { debug: () => { }, info: () => { }, warn: () => { }, error: () => { } },
+        log: silentLog,
+        request: { log: silentLog },
     });
     let login;
-    let ownerId;
     let scopes;
     try {
         const { data, headers } = await octokit.users.getAuthenticated();
         login = data.login;
-        ownerId = data.id;
         scopes = headers['x-oauth-scopes'];
     }
     catch {
@@ -53,7 +56,7 @@ export async function authenticate(token) {
             }
         }
     }
-    return { octokit, owner: login, ownerId };
+    return { octokit, owner: login };
 }
 export async function createContext(github) {
     const identity = await authenticate(github.token);
@@ -209,11 +212,8 @@ export async function configureRepo(ctx, answers, infisicalProjectId) {
         INFISICAL_HOST: answers.infisical.host,
     };
     await setVariables(ctx, variables);
-    const warnings = [
-        await configureEnvironments(ctx, answers),
-        await protectMainBranch(ctx, answers),
-    ].filter((w) => w !== undefined);
-    return warnings.length > 0 ? warnings.join('\n\n') : undefined;
+    await configureEnvironments(ctx, answers);
+    return protectMainBranch(ctx, answers);
 }
 async function setSecrets(ctx, secrets) {
     await sodium.ready;
@@ -255,44 +255,20 @@ async function setVariables(ctx, variables) {
     }
 }
 /**
- * Each environment gets a GitHub deployment environment; gated ones (prod)
- * require a reviewer approval. Required reviewers need GitHub Enterprise Cloud
- * on private repositories — GitHub answers 422 there. Rather than strand the
- * bootstrap at its last step, fall back to an ungated environment and warn:
- * the environment still exists (deployments target it) but production will
- * auto-deploy on merge. Like the branch-protection miss, this degrades to a
- * warning instead of killing the run.
+ * Each environment gets a GitHub deployment environment, used by the apply
+ * workflow for deployment tracking and history. No reviewer gate is requested:
+ * production is promoted by a version tag — the tag IS the gate, free on every
+ * plan, while required reviewers would need GitHub Enterprise Cloud on private
+ * repositories and would only duplicate what the tag already enforces.
  */
 export async function configureEnvironments(ctx, answers) {
-    const ungated = [];
     for (const env of answers.environments) {
-        try {
-            await ctx.octokit.repos.createOrUpdateEnvironment({
-                owner: ctx.owner,
-                repo: ctx.repo,
-                environment_name: env.githubEnvironment,
-                ...(env.gated ? { reviewers: [{ type: 'User', id: ctx.ownerId }] } : {}),
-            });
-        }
-        catch (error) {
-            // Only the reviewer rule can trip the plan limit; re-throw anything else
-            // (and any failure on a non-gated environment, which asked for no rule).
-            if (!env.gated || error.status !== 422)
-                throw error;
-            await ctx.octokit.repos.createOrUpdateEnvironment({
-                owner: ctx.owner,
-                repo: ctx.repo,
-                environment_name: env.githubEnvironment,
-            });
-            ungated.push(env.githubEnvironment);
-        }
+        await ctx.octokit.repos.createOrUpdateEnvironment({
+            owner: ctx.owner,
+            repo: ctx.repo,
+            environment_name: env.githubEnvironment,
+        });
     }
-    if (ungated.length === 0)
-        return undefined;
-    return (`Created the ${ungated.join(', ')} environment(s) without the manual-approval gate: ` +
-        'required reviewers need GitHub Enterprise Cloud on private repositories, so production ' +
-        'will auto-deploy on merge to main. Make the repository public (reviewers are free there) ' +
-        'or upgrade the plan, then re-run to add the gate.');
 }
 /**
  * Require a green plan on PRs and forbid force-pushes/deletion of main.

package/dist/bootstrap/infisical.js

@@ -30,8 +30,15 @@ export async function login(infisical) {
     const { host, clientId, clientSecret } = infisical;
     const { status, data } = await api(host, '/api/v1/auth/universal-auth/login', { method: 'POST', body: { clientId, clientSecret } });
     if (status !== 200 || !data.accessToken) {
-        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ` +
-            'Check the machine identity client ID/secret and that Universal Auth is enabled.');
+        // A usage-limited client secret is a trap for this setup: besides the
+        // bootstrap, CI logs in with it on every plan/apply, so any finite limit
+        // eventually runs out. Name the fix instead of a generic "check secret".
+        const remediation = /usage limit/i.test(data.message ?? '')
+            ? 'This client secret was created with a usage limit and it is spent. Create a new one ' +
+                'with unlimited uses (Max Number of Uses = 0): CI logs in with it on every plan/apply, ' +
+                'so a limited secret will always run out.'
+            : 'Check the machine identity client ID/secret and that Universal Auth is enabled.';
+        throw new InfisicalError(`Infisical Universal Auth login failed (HTTP ${status}${data.message ? `: ${data.message}` : ''}). ${remediation}`);
     }
     return data.accessToken;
 }

package/dist/bootstrap/scaleway.js

@@ -7,10 +7,38 @@ export class ScalewayError extends Error {
     }
 }
 const API_BASE = 'https://api.scaleway.com';
+/**
+ * The generated stack creates non-expiring service credentials (the app's
+ * database and Object Storage API keys are read by the container at runtime).
+ * An organization security setting that forces API-key expiration makes the
+ * very first CI apply fail — hours after the bootstrap looked green. Read the
+ * setting here (read-only) so the run can warn upfront, while it is still a
+ * 30-second console fix. Returns undefined when the key cannot read it.
+ */
+async function apiKeyExpirationPolicyWarning(secretKey, organizationId) {
+    try {
+        const response = await fetch(`${API_BASE}/iam/v1alpha1/organizations/${organizationId}/security-settings`, { headers: { 'X-Auth-Token': secretKey } });
+        if (!response.ok)
+            return undefined;
+        const settings = (await response.json());
+        const seconds = Number.parseInt(settings.max_api_key_expiration_duration ?? '0', 10);
+        if (!Number.isFinite(seconds) || seconds <= 0)
+            return undefined; // "0s" = unlimited
+        return ('Your Scaleway organization requires API keys to expire ' +
+            `(max ${Math.round(seconds / 86400)} days). The database/storage credentials the ` +
+            'generated stack creates are non-expiring service credentials, so the first CI apply ' +
+            'WILL fail on them. Disable the requirement first (Console → Organization → Security → ' +
+            'API keys), then merge or re-run the apply.');
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Validate credentials with a harmless read call before creating anything.
  * Also confirms the project belongs to the given organization. Read-only: it
- * proves the key can see the project, not that it can create resources.
+ * proves the key can see the project, not that it can create resources. The
+ * returned warning flags an org policy that would break the first CI apply.
  */
 export async function validateScalewayCredentials(scaleway) {
     const { secretKey, projectId, organizationId } = scaleway;
@@ -32,6 +60,28 @@ export async function validateScalewayCredentials(scaleway) {
         throw new ScalewayError(`Scaleway project ${projectId} belongs to organization ${project.organization_id}, ` +
             `not ${organizationId}. Check --scw-organization-id.`, 'organization');
     }
+    const warning = await apiKeyExpirationPolicyWarning(secretKey, organizationId);
+    return warning ? { warning } : {};
+}
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Bucket-metadata calls made right after CreateBucket can race its propagation
+ * and answer NoSuchBucket for a bucket that provably exists (we created or
+ * Head-checked it moments before). Retry exactly that error with a short
+ * backoff; anything else is a real failure and is thrown immediately.
+ */
+export async function retryWhileBucketPropagates(fn, attempts = 5, baseDelayMs = 1000) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (error) {
+            if (error.name !== 'NoSuchBucket' || attempt >= attempts) {
+                throw error;
+            }
+            await sleep(attempt * baseDelayMs);
+        }
+    }
 }
 function s3Client(answers) {
     return new S3Client({
@@ -107,13 +157,14 @@ async function lockDownStateBucket(client, bucket, answers) {
         ],
     };
     try {
-        await client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) }));
+        await retryWhileBucketPropagates(() => client.send(new PutBucketPolicyCommand({ Bucket: bucket, Policy: JSON.stringify(policy) })));
         return undefined;
     }
     catch (error) {
         return (`Could not apply a policy to bucket "${bucket}" ` +
             `(${error instanceof Error ? error.message : String(error)}); ` +
-            'the state bucket was NOT restricted to your identity.');
+            'the state bucket was NOT restricted to your identity. ' +
+            'Re-run keel to retry this step.');
     }
 }
 /**
@@ -144,10 +195,10 @@ export async function ensureStateBucket(answers) {
         try {
             await client.send(new CreateBucketCommand({ Bucket: bucket }));
             // Versioning protects the state history against accidental overwrites.
-            await client.send(new PutBucketVersioningCommand({
+            await retryWhileBucketPropagates(() => client.send(new PutBucketVersioningCommand({
                 Bucket: bucket,
                 VersioningConfiguration: { Status: 'Enabled' },
-            }));
+            })));
             created = true;
         }
         catch (createError) {

package/dist/config.js

@@ -11,7 +11,6 @@ const ENV_DEFAULTS = {
         displayName: 'Development',
         githubEnvironment: 'dev',
         production: false,
-        gated: false,
         minScale: 0,
         maxScale: 1,
     },
@@ -19,7 +18,6 @@ const ENV_DEFAULTS = {
         displayName: 'Staging',
         githubEnvironment: 'staging',
         production: false,
-        gated: false,
         minScale: 0,
         maxScale: 1,
     },
@@ -27,7 +25,6 @@ const ENV_DEFAULTS = {
         displayName: 'Production',
         githubEnvironment: 'production',
         production: true,
-        gated: true,
         minScale: 0,
         // Start small: one instance is enough to go live and costs the least;
         // raising the ceiling later is a one-line prod.tfvars change.
@@ -50,12 +47,25 @@ export const DEFAULT_ENV_PRESET = 'staging+prod';
  * Lock a resume's configuration to what the repo was generated with. Scaling
  * is intentionally not carried: it only shapes the tfvars, which are already
  * generated on any run that has a manifest, so post-generate steps never read it.
+ *
+ * The GitHub repo identity is locked too: on resume the target repository is
+ * already decided (keel created and pushed it), so the picker must not run and
+ * must never frame the project's own — now non-empty — repo as "create a new
+ * one". Older manifests without a github block fall back to the project name,
+ * which is the repo default and the only repository the project could own. An
+ * explicit --repo-name still wins (the established flag-precedence rule).
  */
 export function hydrateConfigFromManifest(partial, manifest) {
     partial.region = manifest.region;
     partial.environments = manifest.environments;
     partial.objectStorage = manifest.options.objectStorage;
     partial.basicAuth = manifest.options.basicAuth;
+    if (!partial.github.repoName) {
+        partial.github.repoName = manifest.github?.repoName ?? manifest.projectName;
+    }
+    if (partial.github.repoPrivate === undefined && manifest.github?.repoPrivate !== undefined) {
+        partial.github.repoPrivate = manifest.github.repoPrivate;
+    }
 }
 export class ConfigError extends Error {
 }
@@ -210,8 +220,7 @@ export function resolveEnvironments(slugs, basicAuth, overrides) {
             displayName: def.displayName,
             githubEnvironment: def.githubEnvironment,
             production: def.production,
-            gated: def.gated,
-            // Basic Auth is a non-production safety net; production is never gated by it.
+            // Basic Auth is a non-production safety net; production never has it.
             basicAuth: def.production ? false : basicAuth,
             minScale,
             maxScale,

package/dist/generate.js

@@ -26,6 +26,12 @@ function renderManifest(answers) {
             objectStorage: answers.objectStorage,
             basicAuth: answers.basicAuth,
         },
+        // Recorded so a resume locks the repository instead of re-running the
+        // picker; see hydrateConfigFromManifest.
+        github: {
+            repoName: answers.github.repoName,
+            repoPrivate: answers.github.repoPrivate,
+        },
     };
     return `${JSON.stringify(manifest, null, 2)}\n`;
 }

package/dist/index.js

@@ -7,7 +7,7 @@ import { CI_SECRET_NAMES, CI_VARIABLE_NAMES, resourceName } from './contracts.js
 import { generateProject, GenerateError, readManifest } from './generate.js';
 import { toolVersion } from './meta.js';
 import { confirmSummary, fillMissing } from './prompts.js';
-import { isDone, loadState, markDone, STATE_FILE, stepData, } from './state.js';
+import { isDone, loadState, markDone, STATE_FILE, stepData, stepWarning, } from './state.js';
 import { cancel, intro, log, outro, renderNextSteps, renderSummary, withSpinner } from './ui.js';
 import { ensureStateBucket, validateScalewayCredentials } from './bootstrap/scaleway.js';
 import { bootstrapInfisical, validateInfisical } from './bootstrap/infisical.js';
@@ -298,8 +298,9 @@ async function runBootstrap(answers, state, options) {
     else {
         // All three credentials are checked before anything is created anywhere,
         // so a bad token cannot leave a half-bootstrapped account behind.
+        let scalewayWarning;
         await withSpinner('Validating Scaleway, Infisical and GitHub credentials', async () => {
-            await validateScalewayCredentials(answers.scaleway);
+            scalewayWarning = (await validateScalewayCredentials(answers.scaleway)).warning;
             await validateInfisical(answers.infisical);
             ctx = await createContext(answers.github);
             // A repo with commits would make the push fail after the bucket and the
@@ -310,14 +311,21 @@ async function runBootstrap(answers, state, options) {
                 assertRepoUsable(ctx, repoState);
             }
         });
+        if (scalewayWarning)
+            log.warn(scalewayWarning);
     }
     for (const step of BOOTSTRAP_STEPS) {
         if (isDone(state, step.name)) {
             log.info(step.skipMessage);
             continue;
         }
+        // A step that degraded with a warning last run is re-run (idempotent) so
+        // the degraded part can heal — e.g. a bucket policy that raced creation.
+        if (stepWarning(state, step.name)) {
+            log.info('Previous run finished this step with a warning — retrying it.');
+        }
         const result = await withSpinner(step.label(answers, ctx), () => step.run(answers, ctx, state));
-        markDone(answers.targetDir, state, step.name, result?.data);
+        markDone(answers.targetDir, state, step.name, result?.data, result?.warning);
         if (result?.warning)
             log.warn(result.warning);
     }

package/dist/prompts.js

@@ -55,7 +55,7 @@ export async function fillMissing(partial, options) {
     const resuming = manifest !== undefined && manifest.projectName === out.projectName;
     if (manifest && resuming) {
         hydrateConfigFromManifest(out, manifest);
-        log.info(`Resuming "${out.projectName}" — region, environments and options are locked to its .keel manifest.`);
+        log.info(`Resuming "${out.projectName}" — repository, region, environments and options are locked to its .keel manifest.`);
     }
     // Each block opens with a "┌ <Provider>" section corner and closes with a
     // "└ <Provider> connected — …" line, so every question flows inside its own
@@ -358,11 +358,16 @@ async function askScaleway(out) {
             out.scaleway.organizationId = await text('Scaleway organization ID');
         }
         try {
-            await validateScalewayCredentials({
+            const { warning } = await validateScalewayCredentials({
                 secretKey: out.scaleway.secretKey,
                 projectId: out.scaleway.projectId,
                 organizationId: out.scaleway.organizationId,
             });
+            // e.g. an org policy that would make the first CI apply fail: better a
+            // loud heads-up now, while it is a 30-second console fix, than a red
+            // pipeline hours after everything here looked green.
+            if (warning)
+                log.warn(warning);
             p.outro('Scaleway connected — credentials valid and project reachable.');
             return;
         }

package/dist/state.js

@@ -18,10 +18,15 @@ export function saveState(targetDir, state) {
     writeFileSync(join(targetDir, STATE_FILE), `${JSON.stringify(state, null, 2)}\n`);
 }
 export function isDone(state, step) {
-    return state.steps[step] !== undefined;
+    const record = state.steps[step];
+    return record !== undefined && record.warning === undefined;
 }
-export function markDone(targetDir, state, step, data) {
-    state.steps[step] = data ? { data } : {};
+/** The warning a previous run recorded for this step, if it degraded. */
+export function stepWarning(state, step) {
+    return state.steps[step]?.warning;
+}
+export function markDone(targetDir, state, step, data, warning) {
+    state.steps[step] = { ...(data ? { data } : {}), ...(warning ? { warning } : {}) };
     saveState(targetDir, state);
 }
 export function stepData(state, step, key) {

package/dist/ui.js

@@ -59,7 +59,7 @@ export function renderSummary(answers, dryRun) {
     for (const env of answers.environments) {
         const flags = [
             `scale ${env.minScale}-${env.maxScale}`,
-            env.gated ? 'manual approval' : 'auto-deploy',
+            env.production ? 'deploys on version tag' : 'deploys on merge to main',
             env.basicAuth ? 'basic auth' : null,
         ]
             .filter(Boolean)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gambi97/keel-cli",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "One command from zero to a production-shaped serverless infrastructure on Scaleway (Terraform + GitHub Actions + Infisical). Only Node required.",
   "keywords": [
     "keel",

package/templates/README.md

@@ -209,6 +209,10 @@ Avoid local applies: they race against CI on the same state.
   match a Scaleway key with Object Storage access.
 - **Plan fails reading Infisical secrets**: check `INFISICAL_PROJECT_ID` and
   that the machine identity has access to the project and every environment.
+  If the error mentions a **usage limit**, the machine identity's client
+  secret was created with a maximum number of uses and it is spent: create a
+  new client secret with unlimited uses (the pipeline logs in on every
+  plan/apply) and update the `INFISICAL_CLIENT_SECRET` Actions secret.
 - **Apply green but no container**: expected until `container_image` is set.
 - **App can't reach the database**: `DATABASE_URL` is only synced after an
   apply; check the value in Infisical for that environment. It must contain