@harly/cli 0.2.1 → 0.2.3

package/README.md

@@ -26,7 +26,7 @@ cd harly
 npx @harly/cli update
 ```
 
-Use `--to edge` for preview builds or `--to 0.1.0-beta.2` for a fixed release.
+Use `--to edge` for preview builds or `--to <release-version>` for a fixed release.
 The command creates a private local rollback point first, pulls the target,
 pins its immutable digest, runs migrations once, recreates the services, and
 waits for readiness. This works without extra system dependencies. Use

package/dist/index.js

@@ -11,6 +11,16 @@ import process from "node:process";
 import { spawnSync } from "node:child_process";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
+
+// src/release.ts
+var embeddedRelease = {
+  version: "0.1.0-beta.2",
+  image: "ghcr.io/vytral/harly",
+  digest: "sha256:f0b999a76fa170887f625d12835379ef57772903c792fb0b66faea9270776a16"
+};
+var releaseImage = (release) => `${release.image}@${release.digest}`;
+
+// src/index.ts
 var resourceProfiles = {
   compact: {
     app: "1024m",
@@ -63,7 +73,26 @@ var force = flags.has("--force");
 var yes = flags.has("--yes");
 var json = flags.has("--json");
 var interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY && !process.env.CI);
-var cliVersion = "0.1.4";
+var cliVersion = "0.2.3";
+var releaseManifestUrl = process.env.HARLY_RELEASE_MANIFEST_URL ?? "https://raw.githubusercontent.com/Vytral/harly/main/release-manifest.json";
+var currentOfficialRelease;
+var releaseManifestChecked = false;
+function validRelease(value) {
+  if (!value || typeof value !== "object") return false;
+  const release = value;
+  return typeof release.version === "string" && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(release.version) && release.image === "ghcr.io/vytral/harly" && typeof release.digest === "string" && /^sha256:[a-f0-9]{64}$/.test(release.digest);
+}
+async function officialRelease() {
+  if (releaseManifestChecked) return currentOfficialRelease ?? embeddedRelease;
+  releaseManifestChecked = true;
+  try {
+    const response = await fetch(releaseManifestUrl, { signal: AbortSignal.timeout(2e3) });
+    const candidate = response.ok ? await response.json() : null;
+    if (validRelease(candidate)) currentOfficialRelease = candidate;
+  } catch {
+  }
+  return currentOfficialRelease ?? embeddedRelease;
+}
 var logo = `
 \u2588\u2588\u2557  \u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2557     \u2588\u2588\u2557   \u2588\u2588\u2557
 \u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2551     \u255A\u2588\u2588\u2557 \u2588\u2588\u2554\u255D
@@ -246,7 +275,7 @@ async function collectNonInteractiveAnswers(directory) {
     endpoint: process.env.S3_ENDPOINT?.trim() || "",
     publicUrl: process.env.S3_PUBLIC_URL?.trim() || ""
   } : null;
-  const image = process.env.HARLY_IMAGE_REF ?? "ghcr.io/vytral/harly:0.1.0-beta.2";
+  const image = process.env.HARLY_IMAGE_REF ?? releaseImage(await officialRelease());
   if (image.endsWith(":latest")) throw new CliError("Installations must pin a version or digest, never latest.", 2);
   return { mode, url, email, organization, storage, s3, resourceProfile, image };
 }
@@ -320,7 +349,7 @@ async function collectInteractiveAnswers(directory) {
       { value: "performance", label: "Performance", hint: "8 GB RAM or more" }
     ]
   }));
-  const image = process.env.HARLY_IMAGE_REF ?? "ghcr.io/vytral/harly:0.1.0-beta.2";
+  const image = process.env.HARLY_IMAGE_REF ?? releaseImage(await officialRelease());
   if (image.endsWith(":latest")) throw new CliError("Installations must pin a version or digest, never latest.", 2);
   const services = `PostgreSQL, migrator, app, scheduler${mode === "caddy" ? ", Caddy" : ""}`;
   const localPort = process.env.HARLY_PORT ?? (mode === "local" && url.port ? url.port : "3000");
@@ -411,7 +440,7 @@ services:
     cpus: \${HARLY_APP_CPUS:-2.0}
     logging: *logging
     read_only: true
-    tmpfs: [/tmp]
+    tmpfs: [/tmp:size=256m,mode=1777]
     environment: { <<: *env, NODE_OPTIONS: "\${HARLY_APP_NODE_OPTIONS:---max-old-space-size=1024}" }
     depends_on: { migrate: { condition: service_completed_successfully } }
     ports: ["127.0.0.1:\${HARLY_PORT:-3000}:3000"]
@@ -426,7 +455,7 @@ services:
     cpus: \${HARLY_SCHEDULER_CPUS:-0.5}
     logging: *logging
     read_only: true
-    tmpfs: [/tmp]
+    tmpfs: [/tmp:size=64m,mode=1777]
     environment: { <<: *env, HARLY_INTERNAL_URL: http://app:3000, NODE_OPTIONS: "\${HARLY_SCHEDULER_NODE_OPTIONS:---max-old-space-size=160}" }
     depends_on: { app: { condition: service_healthy } }
     healthcheck: { test: [CMD, node, /app/runtime.mjs, doctor], interval: 30s, timeout: 10s, start_period: 45s, retries: 3 }
@@ -906,7 +935,8 @@ async function cloudGuide(provider) {
     ...databaseUrl ? [`DATABASE_URL=${envLine(databaseUrl)}`] : []
   ].join("\n") + "\n";
   await atomicWrite(path.join(directory, ".env"), env, 384);
-  const image = "ghcr.io/vytral/harly:0.1.0-beta.2";
+  const deploymentRelease = await officialRelease();
+  const image = releaseImage(deploymentRelease);
   if (provider === "fly") {
     await atomicWrite(path.join(directory, "fly.toml"), `app = "replace-with-your-harly-app-name"
 primary_region = "iad"
@@ -960,9 +990,9 @@ primary_region = "iad"
       secretEnv("STORAGE_UPLOAD_SECRET", runtimeSecrets.storageUpload),
       secretEnv("CRON_SECRET", runtimeSecrets.cron),
       secretEnv("HARLY_SETUP_SECRET", runtimeSecrets.setup),
-      "services:",
+      `services:`,
       "  - name: web",
-      "    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: 0.1.0-beta.1 }",
+      `    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: ${deploymentRelease.version} }`,
       "    run_command: node /app/runtime.mjs serve",
       "    http_port: 3000",
       "    instance_count: 1",
@@ -970,14 +1000,14 @@ primary_region = "iad"
       "    health_check: { http_path: /api/health/ready, port: 3000, initial_delay_seconds: 20, period_seconds: 30, timeout_seconds: 5, failure_threshold: 5 }",
       "workers:",
       "  - name: scheduler",
-      "    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: 0.1.0-beta.1 }",
+      `    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: ${deploymentRelease.version} }`,
       "    run_command: node /app/runtime.mjs scheduler",
       "    instance_count: 1",
       "    instance_size_slug: apps-s-1vcpu-0.5gb",
       "jobs:",
       "  - name: migrate",
       "    kind: PRE_DEPLOY",
-      "    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: 0.1.0-beta.1 }",
+      `    image: { registry_type: GHCR, registry: vytral, repository: harly, tag: ${deploymentRelease.version} }`,
       "    run_command: node /app/runtime.mjs migrate",
       "    instance_size_slug: apps-s-1vcpu-0.5gb",
       ""
@@ -1059,6 +1089,11 @@ async function main() {
     case "-h":
       usage();
       return;
+    case "--version":
+    case "-v":
+      process.stdout.write(`${cliVersion}
+`);
+      return;
     default:
       usage();
       throw new CliError(`Unknown command: ${command}`, 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@harly/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "private": false,
   "type": "module",
   "description": "Official operations CLI for self-hosted Harly.",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "esbuild src/index.ts --bundle --packages=external --platform=node --format=esm --target=node20 --outfile=dist/index.js",
     "typecheck": "tsc --noEmit --module NodeNext --moduleResolution NodeNext --target ES2022 --types node src/index.ts",
-    "test": "pnpm build && node --test test/*.test.mjs",
+    "test": "pnpm build && node scripts/sync-release-assets.mjs --check && node --test test/*.test.mjs",
     "test:backup-restore": "pnpm build && ./test/backup-restore.destructive.sh",
     "pack:check": "pnpm build && npm pack --dry-run"
   },