@geekmidas/cli 10.0.0-alpha.112 → 10.0.0-alpha.114

package/dist/index.mjs

@@ -51,7 +51,7 @@ import crypto from "crypto";
 import { Function } from "@geekmidas/constructs/functions";
 import { Topic } from "@geekmidas/constructs/topic";
 //#region package.json
-var version = "10.0.0-alpha.112";
+var version = "10.0.0-alpha.114";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -5943,25 +5943,25 @@ function loadPackageJson() {
 * Run: pnpm --filter @geekmidas/cli sync-versions
 */
 const GEEKMIDAS_VERSIONS = {
-	"@geekmidas/audit": "~10.0.0-alpha.112",
-	"@geekmidas/auth": "~10.0.0-alpha.112",
-	"@geekmidas/cache": "~10.0.0-alpha.112",
-	"@geekmidas/client": "~10.0.0-alpha.112",
-	"@geekmidas/cloud": "~10.0.0-alpha.112",
-	"@geekmidas/constructs": "~10.0.0-alpha.112",
-	"@geekmidas/db": "~10.0.0-alpha.112",
-	"@geekmidas/emailkit": "~10.0.0-alpha.112",
-	"@geekmidas/envkit": "~10.0.0-alpha.112",
-	"@geekmidas/errors": "~10.0.0-alpha.112",
-	"@geekmidas/events": "~10.0.0-alpha.112",
-	"@geekmidas/logger": "~10.0.0-alpha.112",
-	"@geekmidas/manifest": "~10.0.0-alpha.112",
-	"@geekmidas/rate-limit": "~10.0.0-alpha.112",
-	"@geekmidas/schema": "~10.0.0-alpha.112",
-	"@geekmidas/services": "~10.0.0-alpha.112",
-	"@geekmidas/storage": "~10.0.0-alpha.112",
-	"@geekmidas/telescope": "~10.0.0-alpha.112",
-	"@geekmidas/testkit": "~10.0.0-alpha.112",
+	"@geekmidas/audit": "~10.0.0-alpha.114",
+	"@geekmidas/auth": "~10.0.0-alpha.114",
+	"@geekmidas/cache": "~10.0.0-alpha.114",
+	"@geekmidas/client": "~10.0.0-alpha.114",
+	"@geekmidas/cloud": "~10.0.0-alpha.114",
+	"@geekmidas/constructs": "~10.0.0-alpha.114",
+	"@geekmidas/db": "~10.0.0-alpha.114",
+	"@geekmidas/emailkit": "~10.0.0-alpha.114",
+	"@geekmidas/envkit": "~10.0.0-alpha.114",
+	"@geekmidas/errors": "~10.0.0-alpha.114",
+	"@geekmidas/events": "~10.0.0-alpha.114",
+	"@geekmidas/logger": "~10.0.0-alpha.114",
+	"@geekmidas/manifest": "~10.0.0-alpha.114",
+	"@geekmidas/rate-limit": "~10.0.0-alpha.114",
+	"@geekmidas/schema": "~10.0.0-alpha.114",
+	"@geekmidas/services": "~10.0.0-alpha.114",
+	"@geekmidas/storage": "~10.0.0-alpha.114",
+	"@geekmidas/telescope": "~10.0.0-alpha.114",
+	"@geekmidas/testkit": "~10.0.0-alpha.114",
 	"@geekmidas/cli": `~${loadPackageJson().version}`
 };
 //#endregion
@@ -7154,7 +7154,7 @@ const COMMIT = /^[0-9a-f]{40}$/;
 * The `uses:` value for the stages action, with a comment saying which CLI
 * release the pinned commit is.
 */
-function stagesActionUses(commit = "4f82632d8355cb858b895c3caf36228e040d39b0", version = cliVersion()) {
+function stagesActionUses(commit = "82e87263a7c554204b12819f4eff2c4f7e9c8a96", version = cliVersion()) {
 	return commit && COMMIT.test(commit) ? `${STAGES_ACTION}@${commit} # @geekmidas/cli ${version}` : `${STAGES_ACTION}@main # pin to a commit SHA: see the action's README`;
 }
 //#endregion
@@ -7406,6 +7406,7 @@ function stagesJob(options) {
       has-build: \${{ steps.stages.outputs.has-build }}
       has-deploy: \${{ steps.stages.outputs.has-deploy }}
       aws-region: \${{ steps.stages.outputs.aws-region }}
+      registry: \${{ steps.stages.outputs.registry }}
     steps:
       - uses: actions/checkout@v4
 
@@ -7424,17 +7425,25 @@ ${pm.setup}
 `;
 }
 /**
-* The registry login a compose build pushes with: GitHub's own token on
-* ghcr.io, otherwise a username variable and a password secret.
+* The registry login a compose build pushes with, and a deploy pulls with.
+* The host is `deploy.registry`'s, read from gkm.config.ts by the stages
+* job at run time — never written here, so the workflow follows the config:
+* GitHub's own token on ghcr.io, otherwise the stage environment's
+* `REGISTRY_USERNAME` variable and `REGISTRY_PASSWORD` secret.
 */
-function registryLogin(registry) {
-	const host = registry.split("/")[0];
-	const ghcr = host === "ghcr.io";
-	return `      - uses: docker/login-action@v3
+function registryLogin() {
+	const ghcr = "needs.stages.outputs.registry == 'ghcr.io'";
+	return `      # deploy.registry in gkm.config.ts: GitHub's registry with this
+      # workflow's own token (the job's \`packages\` permission decides push
+      # or pull), any other with the stage's REGISTRY_USERNAME variable and
+      # REGISTRY_PASSWORD secret.
+      - name: Log in to the registry
+        if: needs.stages.outputs.registry != ''
+        uses: docker/login-action@v3
         with:
-          registry: ${host}
-          username: ${ghcr ? "${{ github.actor }}" : "${{ vars.REGISTRY_USERNAME }}"}
-          password: ${ghcr ? "${{ secrets.GITHUB_TOKEN }}" : "${{ secrets.REGISTRY_PASSWORD }}"}
+          registry: \${{ needs.stages.outputs.registry }}
+          username: \${{ ${ghcr} && github.actor || vars.REGISTRY_USERNAME }}
+          password: \${{ ${ghcr} && secrets.GITHUB_TOKEN || secrets.REGISTRY_PASSWORD }}
 `;
 }
 /**
@@ -7453,8 +7462,14 @@ function registryLogin(registry) {
 */
 function composeDeploy(options) {
 	const pm = tooling(options);
-	const registry = options.registry ?? "";
 	return `${deployHeader(true)}
+# A push to main builds main's newest commit: a later push cancels an earlier
+# push's run, so several merges in a row build once. A release or a manual
+# run shares no group (its run id is in the name), and is never cancelled.
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.event_name == 'push' && github.ref || github.run_id }}
+  cancel-in-progress: \${{ github.event_name == 'push' }}
+
 jobs:
 ${stagesJob(options)}
   build:
@@ -7473,13 +7488,22 @@ ${stagesJob(options)}
       packages: write
       id-token: write
     steps:
+      # The runner's preinstalled toolchains, none of them used here: with
+      # them, building every image of a workspace runs out of disk.
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/local/lib/android /usr/share/dotnet /opt/ghc \\
+            /usr/local/.ghcup /opt/hostedtoolcache/CodeQL
+          sudo docker image prune --all --force
+          df -h /
+
       - uses: actions/checkout@v4
 
 ${pm.setup}
       - name: Install
         run: ${pm.install}
 
-${registryLogin(registry)}
+${registryLogin()}
       # A site's public URLs are built into it, so the build reads the stage's
       # secrets store. With secrets.store on S3, SSM or Secrets Manager the job
       # assumes the stage's role (AWS_ROLE_ARN, set by gkm deploy:github);
@@ -7505,6 +7529,7 @@ ${registryLogin(registry)}
         with:
           name: digests-\${{ matrix.stage }}
           path: digests.json
+          if-no-files-found: error
           retention-days: 90
 
   deploy:
@@ -7538,8 +7563,14 @@ ${registryLogin(registry)}
             workflow_dispatch) ref="\${REF:-$SHA}" ;;
             *) ref="$SHA" ;;
           esac
-          sha=$(gh api "repos/$REPO/commits/$ref" --jq .sha)
-          echo "Deploying $sha"
+          case "$ref" in
+            ''|-*) echo "::error::Not a tag or commit: '$ref'"; exit 1 ;;
+          esac
+          if ! sha=$(gh api "repos/$REPO/commits/$ref" --jq .sha); then
+            echo "::error::'$ref' is not a tag, branch or commit in this repository"
+            exit 1
+          fi
+          echo "Deploying $ref = $sha"
           echo "sha=$sha" >> "$GITHUB_OUTPUT"
         env:
           GH_TOKEN: \${{ github.token }}
@@ -7560,7 +7591,7 @@ ${pm.setup}
 
       # The server's engine pulls with the login docker sends from here: it
       # holds none of its own.
-${registryLogin(registry)}
+${registryLogin()}
       # The stage's secrets and deploy state are read and written here, with
       # the stage's role (AWS_ROLE_ARN, set by gkm deploy:github). With the
       # default 'file' secrets store there is no role, and no secrets file in
@@ -7621,6 +7652,7 @@ ${registryLogin(registry)}
       # pinned host key (DEPLOY_KNOWN_HOSTS, a variable) on each environment:
       # never accepted on first sight. The server — user and host — is
       # deploy.compose.server in gkm.config.ts and the stage's GKM_SERVER_IPV4.
+      # \`gkm compose:server --stage <stage>\` sets the server up and gives both.
       - name: SSH to the server
         run: |
           mkdir -p ~/.ssh && chmod 700 ~/.ssh
@@ -13039,6 +13071,7 @@ export default function RootLayout({
 `;
 	const pages = app.key === "admin" ? adminPages() : webPages(options);
 	const gitignore = `.next/
+next-env.d.ts
 node_modules/
 .env.local
 *.log
@@ -16714,6 +16747,16 @@ program.command("deploy:rollback").description("Put a stage's app back on its pr
 		exitWithError(error);
 	}
 });
+program.command("compose:server").description("Set up a stage's server for compose deploys: harden it (SSH keys only, no root login, firewall, security updates, fail2ban), install Docker, create the deploy user, and give its key to GitHub").requiredOption("--stage <stage>", "A deployed stage from gkm.config.ts").option("--admin <user>", "The sudo user you log in to the server as — never root (asked when absent)").option("--key-file <path>", "The deploy key pair (default: ~/.ssh/gkm-<project>-<stage>)").option("--repo <owner/name>", "GitHub repository (default: this one)").option("--no-github", "Leave the GitHub environment's key and host alone").option("--yes", "Set the server up without asking first").option("--dry-run", "Print the plan and the script; connect to nothing").action(async (options) => {
+	try {
+		const globalOptions = program.opts();
+		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
+		const { composeServerCommand } = await import("./serverSetup--O61SRvg.mjs");
+		await composeServerCommand(options);
+	} catch (error) {
+		exitWithError(error);
+	}
+});
 program.command("deploy:init").description("Initialize Dokploy deployment (create project and application)").option("--endpoint <url>", "Dokploy server URL (uses stored credentials if logged in)").requiredOption("--project <name>", "Project name (creates if not exists)").requiredOption("--app <name>", "Application name").option("--project-id <id>", "Use existing project ID instead of creating").option("--registry-id <id>", "Configure registry for the application").action(async (options) => {
 	try {
 		const globalOptions = program.opts();
@@ -16733,7 +16776,7 @@ program.command("deploy:github").description("Let GitHub Actions deploy a stage:
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { deployGithubCommand } = await import("./github-D2eABlxM.mjs");
+		const { deployGithubCommand } = await import("./github-BMakI-k3.mjs");
 		await deployGithubCommand(options);
 	} catch (error) {
 		exitWithError(error);
@@ -16743,7 +16786,7 @@ program.command("stages").description("The workspace's stages from gkm.config.ts
 	try {
 		const globalOptions = program.opts();
 		if (globalOptions.cwd) process.chdir(globalOptions.cwd);
-		const { stagesCommand } = await import("./stages-DJrOYLZ-.mjs");
+		const { stagesCommand } = await import("./stages-Cb9rqRbN.mjs");
 		await stagesCommand(options);
 	} catch (error) {
 		exitWithError(error);