@gjsify/cli 0.38.1 → 0.40.0

package/lib/cli-app.js

@@ -15,12 +15,10 @@
 // This module MUST NOT execute anything at load time (no top-level
 // `parseAsync`) — `run.ts` imports it, and a top-level run would re-dispatch
 // the original argv on import.
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import yargs from 'yargs';
 import { classifyCliFailure } from './cli-fail.js';
-import { buildCommand as build, clearCommand as clear, copyCommand as copy, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, debugCommand as debug, browseCommand as browse, } from './commands/index.js';
+import { cliVersion } from './utils/publish-headers.js';
+import { buildCommand as build, clearCommand as clear, copyCommand as copy, testCommand as test, runCommand as run, infoCommand as info, systemCheckCommand as systemCheck, checkCommand as check, showcaseCommand as showcase, createCommand as create, gresourceCommand as gresource, gettextCommand as gettext, gsettingsCommand as gsettings, flatpakCommand as flatpak, shipCommand as ship, dlxCommand as dlx, installCommand as install, foreachCommand as foreach, workspaceCommand as workspace, packCommand as pack, publishCommand as publish, whoamiCommand as whoami, loginCommand as login, logoutCommand as logout, trustCommand as trust, onboardCommand as onboard, selfUpdateCommand as selfUpdate, generateInstallerCommand as generateInstaller, uninstallCommand as uninstall, formatCommand as format, lintCommand as lint, fixCommand as fix, upgradeCommand as upgrade, barrelsCommand as barrels, tscCommand as tsc, affectedCommand as affected, storybookCommand as storybook, debugCommand as debug, browseCommand as browse, } from './commands/index.js';
 import { APP_NAME } from './constants.js';
 import { isBun, isDeno, isNode, gjsSystemVersion } from '@gjsify/rolldown-plugin-gjsify/runtime';
 import { ensureGjsifyShimOnPath } from './utils/gjsify-shim.js';
@@ -49,22 +47,6 @@ function runtimeLabel() {
     }
     return 'unknown runtime';
 }
-// Read the version from package.json adjacent to the bundle. yargs's
-// auto-version-discovery (its `pkg-up`-driven default) doesn't reach
-// through the bundled `dist/cli.gjs.mjs` path on GJS — falls back to
-// "unknown". Both layouts are covered:
-//   - dev (tsx, `yarn workspace`):  src/index.ts → ../package.json
-//   - bundled (install -g):         dist/cli.gjs.mjs → ../package.json
-function readBundleVersion() {
-    try {
-        const here = dirname(fileURLToPath(import.meta.url));
-        const pkg = JSON.parse(readFileSync(join(here, '..', 'package.json'), 'utf8'));
-        return typeof pkg.version === 'string' ? pkg.version : 'unknown';
-    }
-    catch {
-        return 'unknown';
-    }
-}
 /**
  * Build + run the gjsify yargs command surface for the given argv (already
  * stripped of the `node`/`gjs` + script prefix — i.e. what `hideBin` returns).
@@ -75,15 +57,18 @@ function readBundleVersion() {
  * exit before any async work runs.
  */
 export async function runCli(argv) {
-    // Under GJS, make a GJS-runnable `gjsify` available on PATH for child
-    // processes (workspace/foreach orchestration + compound `gjsify run`
-    // scripts) so node-free builds don't fall back to the Node bin. No-op on
-    // Node.
+    // Make a runnable `gjsify` available on PATH for child processes
+    // (workspace/foreach orchestration + compound `gjsify run` scripts). TWO
+    // cases, not one — the "No-op on Node" this comment used to claim stopped
+    // being true when the bootstrap case landed: under GJS, so node-free builds
+    // don't fall back to the Node bin; and a BOOTSTRAP CLI under Node, where the
+    // tree's own `node_modules/.bin/gjsify` dangles until `build:infra` — which
+    // is what a cold macOS/Windows leg runs — has produced what it dispatches to.
     ensureGjsifyShimOnPath();
     const cli = yargs(argv);
     await cli
         .scriptName(APP_NAME)
-        .version(readBundleVersion())
+        .version(cliVersion())
         .strict()
         // Sits beside `.strict()` because that is what produces most of what it
         // classifies. See `cli-fail.ts` for the four yargs measurements this
@@ -122,6 +107,7 @@ export async function runCli(argv) {
         .command(gettext.command, gettext.description, gettext.builder, gettext.handler)
         .command(gsettings.command, gsettings.description, gsettings.builder, gsettings.handler)
         .command(flatpak.command, flatpak.description, flatpak.builder, flatpak.handler)
+        .command(ship.command, ship.description, ship.builder, ship.handler)
         .command(foreach.command, foreach.description, foreach.builder, foreach.handler)
         .command(workspace.command, workspace.description, workspace.builder, workspace.handler)
         .command(pack.command, pack.description, pack.builder, pack.handler)

package/lib/commands/affected-classify.d.ts

@@ -0,0 +1,16 @@
+import { type Workspace } from '@gjsify/workspace';
+export interface ClassifyResult {
+    /** Cannot decide precisely — caller should run full suite. */
+    global: boolean;
+    /** Reason string surfaced in logs / debugging. */
+    reason: string;
+    /** Sorted workspace names. Includes every test-targeted workspace. */
+    workspaces: string[];
+    /** Should `tests/e2e/**` run? */
+    runE2E: boolean;
+    /** Should `@gjsify/integration-*` workspaces run? */
+    runIntegration: boolean;
+    /** Diff was empty AND no triggers fired → CI can skip the whole job. */
+    skipAll: boolean;
+}
+export declare function classifyAndExpand(workspaces: readonly Workspace[], changedFiles: readonly string[]): ClassifyResult;

package/lib/commands/affected-classify.js

@@ -0,0 +1,304 @@
+// SPDX-License-Identifier: MIT
+// The `gjsify affected` CLASSIFIER — the pure decision, separated from the command.
+//
+// WHY THIS MODULE EXISTS (#1161). The spec used to reach `classifyAndExpand` by spawning
+// the built CLI for all 40 cases, deliberately: the spawns kept the helper unexported.
+// Measured, they cost 12.81 s against a 30 s per-`describe()` budget (11.68 s / 12.30 s on
+// two other hosts, so it is the suite's property, not a host's). A runner 2.6x slower per
+// spawn blows it, which CI macOS ordinarily is — so the failure was a BUDGET, never an
+// assertion, on the legs that run on `main` rather than on PRs: a red `main` naming no test.
+//
+// The privacy survives without them: this module is NOT in the package's `exports` map, so
+// the spec's relative import is the only way in. The seven cases that genuinely cross a
+// process boundary — both emit branches, a real `sh` word-split — still spawn.
+import { affectedClosure, buildDependencyGraph, buildReverseDependencyGraph, workspacesForChangedFiles, } from '@gjsify/workspace';
+/** Patterns that force a full run. First-match wins; order is intentional. */
+const GLOBAL_TRIGGERS = [
+    // The classifier itself + everything in its plumbing.
+    /^packages\/infra\/workspace\//,
+    /^packages\/infra\/cli\//,
+    /^packages\/infra\/rolldown-plugin-gjsify\//,
+    /^packages\/infra\/resolve-npm\//,
+    // The test framework every spec imports, as a *devDependency* — which the
+    // prod-deps-only closure below does not walk, so a change to it would yield a
+    // near-empty closure and silently skip every downstream test, while a bug in a
+    // matcher can break assertions anywhere.
+    /^packages\/gjs\/unit\//,
+    // The composite action every CI job sets itself up with: a change alters the
+    // environment of the whole matrix. Listed EXPLICITLY — it previously forced a
+    // full run only by falling through to the "unmatched files" path, which is luck
+    // rather than intent.
+    /^\.github\/actions\//,
+    // Cross-cutting dep + lockfile + root config.
+    /^gjsify-lock\.json$/,
+    /^package\.json$/,
+    /^tsconfig[^/]*\.json$/,
+    // The workflow file itself: a job-shape change is invisible until the workflow
+    // re-runs, so a path-filtered job cannot safely apply the new shape to an
+    // in-flight PR.
+    /^\.github\/workflows\/main\.yml$/,
+    /^scripts\/audit-runtimes\.mjs$/,
+];
+/**
+ * Inputs OWNED BY ANOTHER WORKFLOW — build-relevant, just not to `main.yml`.
+ *
+ * Adding a regex here is a claim with two halves and BOTH must hold: `main.yml`
+ * must not read the path, and some other workflow must have it in its own
+ * `paths:` filter so a break still reds a PR. The test is never "is this file
+ * unimportant" — none of these are.
+ */
+const OTHER_WORKFLOW_INPUTS = [
+    // Each sibling workflow's own definition. `main.yml` is deliberately absent: it
+    // is a GLOBAL_TRIGGER instead.
+    /^\.github\/workflows\/(deploy-docs|commitlint|release|release-cut|audit-runtimes|prebuilds|node-gi|napi|cli-cross-platform|build-ci-image|cancel-pr-runs)\.yml$/,
+    // `prebuilds.yml`'s toolchain (#838): the QEMU-emulated build script and the
+    // classifier deciding which native packages a prebuild run rebuilds. It is in
+    // both of that workflow's `paths:` filters; `main.yml` builds no prebuild and
+    // runs no emulated leg.
+    /^\.github\/prebuild-toolchain\//,
+    // The REPO-SCOPED manifest-conformance rules (#847), gated by
+    // `audit-runtimes.yml`, which runs on EVERY pull_request with no `paths:` filter;
+    // `prebuilds.yml` also treats it as a shared input (#843).
+    //
+    // The distinction is real, not a technicality: `main.yml` DOES run
+    // manifest-conformance code, but reaches it through
+    // `packages/infra/manifest-conformance/` — the PACKAGE, a normal workspace that
+    // maps and seeds like any other. Only the `scripts/`-side repo-scoped half is
+    // ignored, and that is precisely the half `main.yml` does not load.
+    /^scripts\/manifest-conformance\//,
+    // The authored status data (ADR 0016) + its generator. Same two halves:
+    // `main.yml` never runs `status:generate` and never opens `status/`, while
+    // `audit-runtimes.yml` runs the `status-data` rule over it on every PR.
+    //
+    // Naming the directory makes the `.md` case intentional rather than incidental:
+    // `status/*.md` already fell into IGNORE via the generic `/\.md$/i`, so the gap
+    // showed up only on `status/status.json`, which matched nothing, landed in
+    // `unmatched`, and paid for a FULL matrix run over a file `main.yml` cannot read.
+    /^status\//,
+    /^scripts\/generate-status\.mjs$/,
+];
+/** Patterns that contribute no seed and don't force a full run. */
+const IGNORE = [
+    /\.md$/i,
+    /^refs\//,
+    /^website\//,
+    /^docs\//,
+    ...OTHER_WORKFLOW_INPUTS,
+    // Neither `@gjsify/node-gi` (the Node-native GI engine) nor `@gjsify/napi` (the
+    // N-API host over SpiderMonkey) is a gjsify workspace member: the GJS-first
+    // install/foreach tooling cannot build their node-gyp addons or Vala+C++/meson
+    // shim, so `main.yml` neither builds nor tests them and their own workflows are
+    // the source of truth. Without the carve-outs their files map to no workspace,
+    // land in `unmatched`, and force a full run on every node-gi/napi PR.
+    /^packages\/node-gi\//,
+    /^packages\/napi\//,
+    // Flatpak build/distribution tooling (SDK-extension manifest + metainfo). No
+    // package-test consumers; its own `tests/e2e/flatpak-sdk-extension` runs on
+    // `tests/e2e/**` and global triggers. Worth revisiting: ignoring `.githooks/`
+    // for the same reason is what let a change walk past the suite guarding it (see
+    // SCRIPT_COUPLINGS), and IGNORE wins over every other rule.
+    /^flatpak\//,
+    /^LICENSE/,
+    /^\.gitignore$/,
+    /^\.gjsify-[^/]*\.md$/,
+    /^STATUS\.md$/,
+    /^CHANGELOG\.md$/,
+    /^AGENTS\.md$/,
+    /^CLAUDE\.md$/,
+    /^README\.md$/,
+];
+/** Patterns that suggest a test-only change. */
+const TEST_PATHS = [/\.spec\.[mc]?[tj]sx?$/, /^tests\/(e2e|integration)\//];
+const SCRIPT_COUPLINGS = [
+    {
+        // `.githooks/pre-commit` is guarded by an e2e suite and reachable from no
+        // workspace at all — not source, not a dependency, its consumer is git. So a
+        // change to it selected NOTHING and the e2e tier stayed off (that turns on
+        // for a `tests/e2e/**` touch): #1095 edited the hook's command line, merged
+        // green, and turned `main` red on the push run. Same shape #1028 noted —
+        // whoever changes the GUARDED thing walks past the guard, because the guard's
+        // trigger names the TEST's path instead of the thing under test.
+        //
+        // No extra seeds: there is no workspace to rebuild. The tier is the point.
+        match: /^\.githooks\//,
+        seeds: [],
+        runE2E: true,
+        why: 'tests/e2e/git-hooks-cli-bundle-staleness drives .githooks/pre-commit',
+    },
+    {
+        // `templates/*` ARE workspaces, so a template change already seeds its own
+        // `@gjsify/template-<name>` — not the consumer that matters. That consumer is
+        // `@gjsify/create-app`, unreachable twice over: it lives at
+        // `packages/infra/create-gjsify/`, so no directory-name search finds it, and
+        // it pulls the templates in through its own `scripts/process-template.mjs`
+        // build step (which resolves each `workspace:^` specifier and copies the
+        // result into `dist-templates/`), so there is no dependency edge either.
+        // `dist-templates/` is a build-output cache candidate, so once stale it
+        // stays stale.
+        match: /^templates\//,
+        seeds: ['@gjsify/create-app'],
+        // `tests/e2e/create-app` is the ONLY thing that would notice — it scaffolds a
+        // project out of `dist-templates/` and builds it. Without this a
+        // templates-only PR got neither the regenerated templates nor that suite;
+        // #853 passed only by also touching root `package.json`.
+        runE2E: true,
+        why: '@gjsify/create-app build → node scripts/process-template.mjs reads templates/',
+    },
+];
+export function classifyAndExpand(workspaces, changedFiles) {
+    const files = changedFiles.map((f) => f.replace(/\\/g, '/')).filter((f) => f.length > 0);
+    if (files.length === 0) {
+        return {
+            global: false,
+            reason: 'empty-diff',
+            workspaces: [],
+            runE2E: false,
+            runIntegration: false,
+            skipAll: true,
+        };
+    }
+    // Ignored files go FIRST, before the global-trigger check: ignore wins over
+    // global, so `packages/infra/cli/README.md` must not force a full run.
+    const remaining = [];
+    for (const f of files) {
+        if (IGNORE.some((re) => re.test(f)))
+            continue;
+        remaining.push(f);
+    }
+    if (remaining.length === 0) {
+        return {
+            global: false,
+            reason: 'ignored-only',
+            workspaces: [],
+            runE2E: false,
+            runIntegration: false,
+            skipAll: true,
+        };
+    }
+    // Global triggers short-circuit — checked on the non-ignored remainder.
+    for (const f of remaining) {
+        for (const re of GLOBAL_TRIGGERS) {
+            if (re.test(f)) {
+                return {
+                    global: true,
+                    reason: `global-trigger ${re.source} matched ${f}`,
+                    workspaces: workspaces.map((w) => w.name),
+                    runE2E: true,
+                    runIntegration: true,
+                    skipAll: false,
+                };
+            }
+        }
+    }
+    const { matched, unmatched } = workspacesForChangedFiles(workspaces, remaining);
+    // Seeds no graph edge can reach. BEFORE the `unmatched` bail-out, so the table
+    // also works for a coupled directory that is not itself a workspace — such a
+    // file would otherwise force a full run and never consult the declared seeds.
+    const knownNames = new Set(workspaces.map((w) => w.name));
+    const couplingSeeds = new Set();
+    const couplingAccounted = new Set();
+    let couplingRunE2E = false;
+    for (const c of SCRIPT_COUPLINGS) {
+        const hits = remaining.filter((f) => c.match.test(f));
+        if (hits.length === 0)
+            continue;
+        for (const h of hits)
+            couplingAccounted.add(h);
+        for (const s of c.seeds) {
+            // A declared seed that is not a workspace means the table drifted from the
+            // tree (renamed, moved, removed). Fail towards the full run and SAY SO: a
+            // missing rebuild here is invisible, so this must never degrade quietly
+            // back into the bug the table exists to prevent.
+            if (!knownNames.has(s)) {
+                return {
+                    global: true,
+                    reason: `script-coupling seed ${s} is not a workspace (${c.match.source} → ${c.why}); ` +
+                        `SCRIPT_COUPLINGS in commands/affected.ts is stale`,
+                    workspaces: workspaces.map((w) => w.name),
+                    runE2E: true,
+                    runIntegration: true,
+                    skipAll: false,
+                };
+            }
+            couplingSeeds.add(s);
+        }
+        if (c.runE2E)
+            couplingRunE2E = true;
+    }
+    // Unmatched-but-not-ignored (a new top-level dotfile, an uncarved `scripts/`
+    // file) falls back to the full run. A file a coupling claimed does not count.
+    const stillUnmatched = unmatched.filter((f) => !couplingAccounted.has(f));
+    if (stillUnmatched.length > 0) {
+        return {
+            global: true,
+            reason: `unmatched files (${stillUnmatched.length}): ${stillUnmatched.slice(0, 3).join(', ')}${stillUnmatched.length > 3 ? '…' : ''}`,
+            workspaces: workspaces.map((w) => w.name),
+            runE2E: true,
+            runIntegration: true,
+            skipAll: false,
+        };
+    }
+    for (const s of couplingSeeds)
+        matched.add(s);
+    // Every remaining file is a spec / e2e / integration path under ONE workspace, so
+    // skip the closure: test code has no downstream consumers. A coupling disables
+    // this — its extra seeds exist precisely because a consumer DOES care.
+    const testOnly = couplingSeeds.size === 0 && remaining.every((f) => TEST_PATHS.some((re) => re.test(f)));
+    if (testOnly && matched.size === 1) {
+        const only = [...matched][0];
+        // An e2e- or integration-only change still needs its own job.
+        const touchedE2E = remaining.some((f) => f.startsWith('tests/e2e/'));
+        const touchedIntegration = remaining.some((f) => f.startsWith('tests/integration/'));
+        return {
+            global: false,
+            reason: `test-only (${remaining.length} file(s) in ${only})`,
+            workspaces: [only],
+            runE2E: touchedE2E,
+            runIntegration: touchedIntegration || isIntegrationWorkspace(only),
+            skipAll: false,
+        };
+    }
+    // PRODUCTION dependencies only. The closure answers "whose tests must re-run
+    // because a package they depend on changed", which is a RUNTIME relationship;
+    // walking devDependency edges conflated it with the build/test toolchain, so ANY
+    // single-package change fanned out to ~210 of 221 workspaces and selective CI
+    // bought almost nothing. Prod-only collapses a typical seed to a handful (sqlite
+    // 210→4, fetch 210→34) while keeping every real runtime dependent.
+    //
+    // Safe against under-selection: no `*.spec.ts` imports a CROSS-PACKAGE sibling
+    // via a devDependency (the only such imports are self-imports, covered by the
+    // package being its own seed), `@gjsify/unit` is a GLOBAL_TRIGGER above, and
+    // every push-to-main plus the nightly cron still run the FULL suite.
+    const reverse = buildReverseDependencyGraph(workspaces, { includeDev: false });
+    const closure = affectedClosure(reverse, [...matched]);
+    // `includeDev: true`, deliberately broader than the reverse closure: integration
+    // packages declare the pillars they exercise as `dependencies`, but the wider
+    // walk tolerates a devDep-declared edge too. Over-running an integration suite is
+    // cheap; missing one is not.
+    const forward = buildDependencyGraph(workspaces, { includeDev: true });
+    let runIntegration = false;
+    for (const [from, deps] of forward.edges) {
+        if (!isIntegrationWorkspace(from))
+            continue;
+        for (const dep of deps) {
+            if (closure.has(dep)) {
+                closure.add(from);
+                runIntegration = true;
+                break;
+            }
+        }
+    }
+    const runE2E = remaining.some((f) => f.startsWith('tests/e2e/')) || couplingRunE2E;
+    return {
+        global: false,
+        reason: `closure (${closure.size} ws from ${matched.size} seed(s))` +
+            (couplingSeeds.size > 0 ? `, ${couplingSeeds.size} via script-coupling` : ''),
+        workspaces: [...closure].sort(),
+        runE2E,
+        runIntegration,
+        skipAll: false,
+    };
+}
+function isIntegrationWorkspace(name) {
+    return name.startsWith('@gjsify/integration-');
+}