@mediamonks/canopy-cli 0.7.44 → 0.7.46

package/dist/templates/worker/.github/workflows/canopy-deploy.yml

@@ -1,34 +1,40 @@
 # Deploy to Canopy on every push to main. GitHub's runners are the build
 # farm — the platform owns no build infrastructure.
 #
-# Needs a CANOPY_DEPLOY_TOKEN repo secret: create a deploy token in the
-# dashboard (project → Settings → Deploy tokens) or with `canopy token
-# create`, then add it via `gh secret set CANOPY_DEPLOY_TOKEN` or the repo's
-# Settings → Secrets. Until the secret is set, this workflow skips itself
-# instead of failing the build.
+# No secret needed: the run proves which repository and branch it comes from
+# with GitHub's own identity token (the id-token permission below), and
+# Canopy deploys it once the project owner has linked this repository:
+#
+#   canopy repo link            (in this folder: links the origin remote)
+#
+# Until then, every run skips the deploy with a warning instead of failing.
+# The owner can pause CI deploys without editing this file:
+#
+#   canopy repo deploys off     (and `on` to resume)
+#
+# A staging branch (`canopy repo branches --staging-ref develop`) deploys to
+# the project's staging channel only. Add it to `branches` below, e.g.
+# [main, develop], so pushes to it run this workflow.
 name: Deploy to Canopy
 
 on:
   push:
     branches: [main]
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    env:
-      CANOPY_DEPLOY_TOKEN: ${{ secrets.CANOPY_DEPLOY_TOKEN }}
     steps:
       - uses: actions/checkout@v7
       - uses: actions/setup-node@v7
         with:
           node-version: 24
       - name: Install dependencies
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: |
           if [ -f package-lock.json ]; then npm ci; else npm install; fi
       - name: Deploy
-        if: env.CANOPY_DEPLOY_TOKEN != ''
         run: npm exec --yes @mediamonks/canopy-cli deploy
-      - name: Skipped (no deploy token)
-        if: env.CANOPY_DEPLOY_TOKEN == ''
-        run: echo "CANOPY_DEPLOY_TOKEN secret not set — skipping deploy."

package/dist/templates/worker/README.md

@@ -14,4 +14,4 @@ https://{{slug}}.thanarie.dev after the first `canopy deploy`.
 - `AGENTS.md` — project guardrails and skill setup for coding agents
 
 Push-to-main deploys are prepared in `.github/workflows/canopy-deploy.yml`
-(needs a `CANOPY_DEPLOY_TOKEN` repo secret — see the workflow file).
+(no secret: link the repository once with `canopy repo link` — see the workflow file).

package/dist/{token-7vSNuz-X.mjs → token-DMCj88A-.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, o as projectDirArgs, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors, t as formatDateTime } from "./ui-CLnICOne.mjs";
+import { c as projectDirArgs, d as resolveProject, l as projectFlagArgs } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors, t as formatDateTime } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 const tokenCommand = defineCommand({
 	meta: {
@@ -23,12 +23,12 @@ const tokenCommand = defineCommand({
 			run: reportErrors("token create", async ({ args }) => {
 				const { slug } = resolveProject(args);
 				const { token, idle_days } = await apiRequest("POST", `/projects/${slug}/deploy-tokens`, { name: args.name });
+				console.log("You do not need this for GitHub Actions — link the repository instead (`canopy repo link <owner/name>`) and pushes deploy with no secret.\n");
 				console.log(`Deploy token for ${slug} (shown once — store it now):\n`);
 				console.log(`  ${token}\n`);
 				console.log(`It belongs to the project and stops working after ${idle_days} days without a deploy.`);
-				console.log("Add it to the GitHub repo as secret CANOPY_DEPLOY_TOKEN");
-				console.log("(gh secret set CANOPY_DEPLOY_TOKEN, or repo Settings → Secrets).");
-				console.log("Pushes to main then deploy via .github/workflows/canopy-deploy.yml.");
+				console.log("For other CI, set it as the CANOPY_DEPLOY_TOKEN environment variable;");
+				console.log("`canopy deploy` then deploys as this project with no `canopy login`.");
 			})
 		}),
 		list: defineCommand({

package/dist/{ui-CLnICOne.mjs → ui-26ETk1n8.mjs}

@@ -1,4 +1,4 @@
-import { t as ApiError } from "./api-Bl6SG8Oq.mjs";
+import { t as ApiError } from "./api-DmJrIsE7.mjs";
 import { spawn } from "node:child_process";
 import { cancel, isCancel } from "@clack/prompts";
 //#region src/ui.ts

package/dist/{upgrade-D_yrD7zp.mjs → upgrade-8_pFNTo5.mjs}

@@ -1,5 +1,5 @@
 import { t as PACKAGE_NAME } from "./version-check-CcsA1QjI.mjs";
-import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 import { spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -112,7 +112,7 @@ const upgradeCommand = defineCommand({
 		const spec = `${PACKAGE_NAME}@${args.version ?? "latest"}`;
 		const command = pmCommand(pm);
 		const cmd = installArgs(pm, spec);
-		const { skillInstalled } = await import("./skill-DRLniv-I.mjs");
+		const { skillInstalled } = await import("./skill-vzcCD1b4.mjs");
 		const { homedir } = await import("node:os");
 		const refreshGlobal = skillInstalled(homedir());
 		const refreshRepo = process.cwd() !== homedir() && skillInstalled(process.cwd());

package/dist/{usage-DGGmTwjJ.mjs → usage-Bpz5B1N1.mjs}

@@ -1,6 +1,6 @@
-import { l as resolveProject, s as projectFlagArgs } from "./site-0i7wAJqg.mjs";
-import { a as apiRequest, f as withContext } from "./api-Bl6SG8Oq.mjs";
-import { r as reportErrors } from "./ui-CLnICOne.mjs";
+import { d as resolveProject, l as projectFlagArgs } from "./site-BL5Ik-yj.mjs";
+import { a as apiRequest, m as withContext } from "./api-DmJrIsE7.mjs";
+import { r as reportErrors } from "./ui-26ETk1n8.mjs";
 import { defineCommand } from "citty";
 //#region src/usage.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mediamonks/canopy-cli",
-  "version": "0.7.44",
+  "version": "0.7.46",
   "description": "Canopy CLI — create, develop and deploy Canopy projects.",
   "bin": {
     "canopy": "./dist/index.mjs"

package/dist/dev-CUJKgaqJ.mjs

@@ -1,2 +0,0 @@
-import { n as devCommand } from "./dev-Cq98yblV.mjs";
-export { devCommand };

package/dist/project-template-715H_lnu.mjs

@@ -1,2 +0,0 @@
-import { a as templateCommand } from "./project-template-Cdr1uwwE.mjs";
-export { templateCommand };

package/dist/repo-DmFs6H9m.mjs

@@ -1,2 +0,0 @@
-import { a as repoCommand } from "./repo-CwT2RDoW.mjs";
-export { repoCommand };