@getvitops/create 0.6.0 → 0.7.0

package/templates/emdash/scripts/init-hosting.mjs

@@ -1,150 +0,0 @@
-// One-time hosting-platform setup for the target configured in
-// astro.config.mjs (vitopsHosting from @getvitops/emdash).
-//
-//   pnpm run init:hosting                 # cloudflare (the default target)
-//   pnpm run init:hosting -- --dry-run
-//   pnpm run init:hosting -- --target node
-//
-// cloudflare: creates the isolated DEV resources (D1 database + R2 bucket —
-// prod ones are auto-provisioned by wrangler on the first deploy) and, when a
-// GitHub repo is wired up (see init-github.mjs), sets the repo secrets the
-// deploy workflows need. The Cloudflare API token cannot be created via CLI,
-// so that one secret stays manual.
-//
-// Idempotent: safe to re-run — existing resources and secrets are just
-// updated/skipped. Requires wrangler auth (`npx wrangler login`).
-
-import { execSync, spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-
-const args = process.argv.slice(2);
-const dryRun = args.includes('--dry-run');
-const targetFlag = args[args.indexOf('--target') + 1];
-const target = (args.includes('--target') && targetFlag) || process.env.HOSTING || 'cloudflare';
-
-const name = JSON.parse(readFileSync('package.json', 'utf8')).name.replace(/^@[^/]+\//, '');
-
-function quiet(cmd) {
-  try {
-    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function run(cmd, { capture = false } = {}) {
-  if (dryRun) {
-    console.log(`[dry-run] ${cmd}`);
-    return '';
-  }
-  console.log(`$ ${cmd}`);
-  try {
-    if (capture) {
-      const out = execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'inherit'] });
-      process.stdout.write(out);
-      return out;
-    }
-    execSync(cmd, { stdio: 'inherit' });
-    return '';
-  } catch {
-    console.error(
-      `\nERROR: \`${cmd}\` failed (see output above). Fix and re-run — the script is idempotent.`,
-    );
-    process.exit(1);
-  }
-}
-
-if (target === 'node') {
-  console.log(`Hosting target 'node' has no cloud resources to provision. To switch this
-project to a Node host (VPS / docker-compose / k8s):
-
-  1. pnpm add @astrojs/node better-sqlite3
-  2. In astro.config.mjs: vitopsHosting({ target: 'node' })  (or set HOSTING=node)
-  3. Build and run:  pnpm build && node ./dist/server/entry.mjs
-     Data lives in ./data/ (SQLite db + uploads) — persist it as a volume.
-  4. CI deploy for VPS/docker/k8s is not scaffolded yet — the deploy-*.yml
-     workflows are Cloudflare-specific; replace or disable them.
-
-For production on Node, move storage to S3-compatible and/or the database to
-Postgres via vitopsHosting({ node: { database, storage } }) — see the
-@getvitops/emdash README.`);
-  process.exit(0);
-}
-
-if (target !== 'cloudflare') {
-  console.error(`ERROR: unknown hosting target '${target}'. Valid targets: cloudflare, node.`);
-  process.exit(1);
-}
-
-// --- Preflight: wrangler auth ------------------------------------------------
-const whoami = spawnSync('npx', ['wrangler', 'whoami'], { encoding: 'utf8' });
-if (whoami.status !== 0) {
-  console.error('ERROR: wrangler is not logged in. Run `npx wrangler login` first.');
-  process.exit(1);
-}
-// "Account Name | <32-hex account id>" table row in `wrangler whoami` output.
-const accountId = (whoami.stdout.match(/\b([0-9a-f]{32})\b/) ?? [])[1] ?? null;
-
-// --- Dev D1 database ---------------------------------------------------------
-const devDb = `${name}-dev`;
-let devDbId = null;
-const d1List = quiet('npx wrangler d1 list --json');
-if (d1List) {
-  devDbId = JSON.parse(d1List).find((d) => d.name === devDb)?.uuid ?? null;
-}
-if (devDbId) {
-  console.log(`D1 database ${devDb} already exists (${devDbId}).`);
-} else {
-  const out = run(`npx wrangler d1 create ${devDb}`, { capture: true });
-  devDbId = (out.match(/"database_id":\s*"([0-9a-f-]{36})"/) ?? [])[1] ?? null;
-  if (!dryRun && !devDbId) {
-    // Output format drifts across wrangler versions — the list is authoritative.
-    const relist = quiet('npx wrangler d1 list --json');
-    devDbId = relist ? (JSON.parse(relist).find((d) => d.name === devDb)?.uuid ?? null) : null;
-  }
-  if (!dryRun && !devDbId) {
-    console.error('ERROR: could not determine the database_id of the created dev database.');
-    process.exit(1);
-  }
-}
-
-// --- Dev R2 bucket -----------------------------------------------------------
-const devBucket = `${name}-media-dev`;
-const bucketList = quiet('npx wrangler r2 bucket list');
-if (bucketList && new RegExp(`name:\\s+${devBucket}\\s*$`, 'm').test(bucketList)) {
-  console.log(`R2 bucket ${devBucket} already exists.`);
-} else {
-  run(`npx wrangler r2 bucket create ${devBucket}`);
-}
-
-// --- GitHub repo secrets (when the repo is wired up) -------------------------
-const hasGh = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8' }).status === 0;
-const hasOrigin = quiet('git remote get-url origin') !== null;
-if (hasGh && hasOrigin) {
-  if (devDbId) run(`gh secret set DEV_D1_ID --body ${devDbId}`);
-  if (accountId) run(`gh secret set CLOUDFLARE_ACCOUNT_ID --body ${accountId}`);
-} else {
-  console.log(
-    '\nSkipping GitHub secrets (no gh auth or no origin remote — run init:github first).',
-  );
-}
-
-console.log(`
-Cloudflare dev environment ready:
-  D1:  ${devDb}${devDbId ? ` (${devDbId})` : ''}
-  R2:  ${devBucket}
-${
-  hasGh && hasOrigin
-    ? ''
-    : `  Set repo secrets once GitHub is wired up:
-    gh secret set DEV_D1_ID --body ${devDbId ?? '<id>'}
-    gh secret set CLOUDFLARE_ACCOUNT_ID --body ${accountId ?? '<account id>'}
-`
-}
-Still manual (CLI can't create API tokens):
-  1. Create a token with Workers + D1 + R2 edit permissions:
-     https://dash.cloudflare.com/profile/api-tokens
-  2. gh secret set CLOUDFLARE_API_TOKEN
-
-Prod D1/R2 are provisioned automatically by wrangler on the first \`pnpm deploy\`.
-Local \`pnpm deploy:dev\` runs need:  export DEV_D1_ID=${devDbId ?? '<id>'}`);

package/templates/static/scripts/init-github.mjs

@@ -1,186 +0,0 @@
-// One-time GitHub bootstrap: creates a GitHub repo named after this project
-// (package.json name), pushes `main` + `dev`, makes `dev` the default branch,
-// and provisions the branch-protection + environment policy the deploy
-// workflows assume (deploy-dev on push to dev, deploy-prod on push to main,
-// promote.yml between them):
-//
-//   - `main` requires a PR + the `ci` status check — it only advances via
-//     promote.yml, never a direct push.
-//   - the `production` GitHub Environment requires review from an admin
-//     collaborator before deploy-prod.yml is allowed to run — this is the
-//     "promoting to prod needs admin sign-off" gate.
-//   - `dev` is left UNPROTECTED on purpose — that's what lets an agent (or
-//     anyone with push access) commit and merge there directly for
-//     integration; only the promotion to `main` is gated.
-//
-//   pnpm run init:github             # private repo (default)
-//   pnpm run init:github -- --public
-//   pnpm run init:github -- --dry-run
-//
-// Idempotent: safe to re-run — existing git repo, commits, dev branch, origin
-// remote, branch protection and environments are all left alone or updated
-// in place. Requires the GitHub CLI (`gh`), logged in (`gh auth login`).
-//
-// NOTE: branch protection and environment required-reviewers are GitHub
-// Pro/Team features on a PRIVATE repo. Each `gh api` call below prints the
-// manual equivalent and continues rather than aborting when it 403s.
-
-import { execSync, spawnSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-
-const args = new Set(process.argv.slice(2));
-const dryRun = args.has('--dry-run');
-const visibility = args.has('--public') ? '--public' : '--private';
-
-const repoName = JSON.parse(readFileSync('package.json', 'utf8')).name.replace(/^@[^/]+\//, '');
-
-function check(cmd) {
-  return spawnSync(cmd[0], cmd.slice(1), { encoding: 'utf8' });
-}
-
-function quiet(cmd) {
-  try {
-    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function run(cmd) {
-  if (dryRun) {
-    console.log(`[dry-run] ${cmd}`);
-    return;
-  }
-  console.log(`$ ${cmd}`);
-  try {
-    execSync(cmd, { stdio: 'inherit' });
-  } catch {
-    console.error(
-      `\nERROR: \`${cmd}\` failed (see output above). Fix and re-run — the script is idempotent.`,
-    );
-    process.exit(1);
-  }
-}
-
-/**
- * Like `run`, but for `gh api` calls that provision an org/plan-gated
- * feature (branch protection, environment reviewers). A 403 there means the
- * repo's plan doesn't support it — not that the bootstrap failed — so this
- * prints the manual equivalent and keeps going instead of exiting.
- */
-function runPolicy(cmd, manualHint) {
-  if (dryRun) {
-    console.log(`[dry-run] ${cmd}`);
-    return;
-  }
-  console.log(`$ ${cmd}`);
-  const result = spawnSync(cmd, { shell: true, encoding: 'utf8' });
-  if (result.status === 0) return;
-  console.warn(
-    `\nWARNING: \`${cmd}\` failed (likely needs GitHub Pro/Team on a private repo).\n` +
-      `Set it up manually instead:\n  ${manualHint}\n`,
-  );
-}
-
-// --- Preflight: gh installed and authenticated -------------------------------
-if (check(['gh', '--version']).status !== 0) {
-  console.error('ERROR: the GitHub CLI (`gh`) is required. Install it from https://cli.github.com');
-  process.exit(1);
-}
-if (check(['gh', 'auth', 'status']).status !== 0) {
-  console.error('ERROR: `gh` is not logged in. Run `gh auth login` first.');
-  process.exit(1);
-}
-
-// --- Local git: repo, initial commit, main + dev branches --------------------
-if (quiet('git rev-parse --is-inside-work-tree') === null) {
-  run('git init -b main');
-}
-if (quiet('git rev-parse HEAD') === null) {
-  run('git add -A');
-  run('git commit -m "Initial commit (scaffolded from @getvitops/create)"');
-}
-
-// The workflows key off `main`; normalize whatever the initial branch is.
-const branch = quiet('git branch --show-current');
-if (branch && branch !== 'main' && branch !== 'dev') {
-  run(`git branch -m ${branch} main`);
-}
-if (quiet('git show-ref --verify refs/heads/dev') === null) {
-  run('git branch dev main');
-}
-
-// --- GitHub: create repo (same name), push, default to dev -------------------
-if (quiet('git remote get-url origin') === null) {
-  run(`gh repo create ${repoName} ${visibility} --source=. --remote=origin`);
-} else {
-  console.log('origin remote already set — skipping `gh repo create`.');
-}
-run('git push -u origin main dev');
-run('gh repo edit --default-branch dev');
-run('git checkout dev');
-
-// --- Policy: protect main, gate production behind admin review --------------
-const nwo = quiet('gh repo view --json nameWithOwner -q .nameWithOwner');
-if (nwo) {
-  runPolicy(
-    `gh api -X PUT repos/${nwo}/branches/main/protection --input - <<'JSON'
-{
-  "required_status_checks": { "strict": true, "contexts": ["ci"] },
-  "enforce_admins": false,
-  "required_pull_request_reviews": { "required_approving_review_count": 1 },
-  "restrictions": null,
-  "allow_force_pushes": false,
-  "allow_deletions": false
-}
-JSON`,
-    `Settings → Branches → protect 'main' (require a PR, 1 approval, the 'ci' ` +
-      `status check, no force-push/deletion).`,
-  );
-
-  const admins = quiet(
-    `gh api repos/${nwo}/collaborators?permission=admin -q '[.[].login]' 2>/dev/null`,
-  );
-  const reviewers = admins
-    ? JSON.parse(admins).map((login) => ({ type: 'User', id_or_login: login }))
-    : [];
-
-  runPolicy(
-    `gh api -X PUT repos/${nwo}/environments/production --input - <<'JSON'
-{
-  "reviewers": ${JSON.stringify(reviewers)},
-  "deployment_branch_policy": { "protected_branches": true, "custom_branch_policies": false }
-}
-JSON`,
-    `Settings → Environments → 'production' → require reviewers = your admins, ` +
-      `restrict deployment branches to 'main'. This is the prod-needs-admin-approval gate.`,
-  );
-
-  // `dev` gets an environment too (for the deploy-dev workflow's `environment:
-  // dev` reference), but deliberately no reviewers and no branch restriction —
-  // that's what keeps it open for direct pushes/merges.
-  runPolicy(
-    `gh api -X PUT repos/${nwo}/environments/dev --input - <<'JSON'
-{ "reviewers": [] }
-JSON`,
-    `Settings → Environments → create 'dev' with no required reviewers.`,
-  );
-} else {
-  console.warn('WARNING: could not resolve the repo name-with-owner; skipping policy setup.');
-}
-
-// --- What's left (manual, needs your Cloudflare account) ---------------------
-console.log(`
-Repo ready: main (protected, production) + dev (integration, default branch).
-NOTE: the first workflow runs will fail until the secrets below exist.
-
-Next steps:
-  1. Dev resources:  wrangler d1 create ${repoName}-dev   (note the printed id)
-                     wrangler r2 bucket create ${repoName}-media-dev
-  2. Secrets:        gh secret set CLOUDFLARE_API_TOKEN
-                     gh secret set CLOUDFLARE_ACCOUNT_ID
-                     gh secret set DEV_D1_ID
-  3. Verify policy:  Settings → Branches (main protected?) and
-                     Settings → Environments → production (reviewers set?) —
-                     printed above if this ran on a plan that supports them.
-`);

package/templates/static/scripts/init-hosting.mjs

@@ -1,62 +0,0 @@
-// One-time hosting-platform setup for this static site.
-//
-//   pnpm run init:hosting
-//   pnpm run init:hosting -- --dry-run
-//
-// There is no D1/R2 to provision here — a pure static build has no data
-// layer — so this reduces to reading the Cloudflare account id from
-// `wrangler whoami` and, when a GitHub repo is wired up (see
-// init-github.mjs), setting it as a repo secret. The API token itself still
-// has to be created by hand (the CLI can't mint one).
-//
-// Idempotent: safe to re-run. Requires wrangler auth (`npx wrangler login`).
-
-import { execSync, spawnSync } from 'node:child_process';
-
-const dryRun = process.argv.includes('--dry-run');
-
-function quiet(cmd) {
-  try {
-    return execSync(cmd, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
-  } catch {
-    return null;
-  }
-}
-
-function run(cmd) {
-  if (dryRun) {
-    console.log(`[dry-run] ${cmd}`);
-    return;
-  }
-  console.log(`$ ${cmd}`);
-  execSync(cmd, { stdio: 'inherit' });
-}
-
-const whoami = spawnSync('npx', ['wrangler', 'whoami'], { encoding: 'utf8' });
-if (whoami.status !== 0) {
-  console.error('ERROR: wrangler is not logged in. Run `npx wrangler login` first.');
-  process.exit(1);
-}
-// "Account Name | <32-hex account id>" table row in `wrangler whoami` output.
-const accountId = (whoami.stdout.match(/\b([0-9a-f]{32})\b/) ?? [])[1] ?? null;
-
-const hasGh = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8' }).status === 0;
-const hasOrigin = quiet('git remote get-url origin') !== null;
-if (hasGh && hasOrigin && accountId) {
-  run(`gh secret set CLOUDFLARE_ACCOUNT_ID --body ${accountId}`);
-} else {
-  console.log(
-    '\nSkipping GitHub secret (no gh auth, no origin remote, or no account id — run init:github first).',
-  );
-}
-
-console.log(`
-Cloudflare account: ${accountId ?? '(not found — check `wrangler whoami`)'}
-
-Still manual (CLI can't create API tokens):
-  1. Create a token with Workers edit permission:
-     https://dash.cloudflare.com/profile/api-tokens
-  2. gh secret set CLOUDFLARE_API_TOKEN
-
-Prod/dev D1/R2 don't apply here — this is a pure static site.
-`);