@mnci/cli 1.15.0 → 1.15.1

package/README.md

@@ -365,8 +365,12 @@ default `azure`): `azure` writes `azure-pipelines.yml`, `github` writes
 GitHub-hosted repo, or `both` while migrating between the two. Whichever
 provider(s), the pipeline does the **exact same thing**: both files are built
 from the same shared guard scripts (`overlay.ts`'s `PYTHON_INSTALL_GUARD`,
-`PACK_APPS_GUARD`, `releaseGuard`), so they can never drift on what CI
-actually runs — only the provider's own syntax differs.
+`PACK_APPS_GUARD`, `releaseGuard`, `AFFECTED_OR_ALL_GUARD`), so they can never
+drift on what CI actually runs — only the provider's own syntax differs. That
+matters most for the last of those: the two providers detect a pull request
+through different environment variables, so the guard reads both, and a
+provider-specific copy would change _what CI verifies_ rather than merely how it
+is spelled.
 
 The pipeline contains **no bash and no PowerShell**: every step is a built-in
 task/action or a single-line `git`/`npm`/`npx`/`node` command that `cmd.exe`
@@ -394,8 +398,29 @@ vulnerable transitive package) is exactly what this monorepo's own
 attempts automatically.
 
 Then `nx sync:check` (fails fast and clearly if the workspace wasn't
-synced+committed locally — see above), then one `nx run-many -t
-lint,test,build`. Pushes to `main` then:
+synced+committed locally — see above), then `npm run format:check`, then **one
+verify step** running `lint,typecheck,test,build`. `typecheck` is in that list
+because a bundler-built project strips types without reading them, so `build`
+passing proves nothing about type correctness.
+
+That step verifies the **affected** projects on a pull request and **every**
+project on anything else — including a push to `main`, so a release is always
+verified in full. There is deliberately no separate `npm run lint` step: that is
+`nx run-many -t lint`, a strict subset of the list above, and on an
+affected-scoped PR it would re-lint every project and throw the benefit away.
+`format:check` does stay workspace-wide, because `prettier --check .` is one
+invocation over the whole tree rather than a per-project target, so there is
+nothing to narrow.
+
+Every fallback in that step verifies **everything**: no PR target branch, an
+unresolvable merge-base (shallow clone, absent remote branch), any non-PR run.
+That direction is deliberate — resolving the base too wide costs a few minutes,
+while resolving it too narrow means CI runs almost nothing, reports green and has
+verified nothing. The base is a `git merge-base`, not either provider's "base SHA"
+field and not the GitHub-only `nrwl/nx-set-shas`, so one mechanism serves both
+providers and is correct in each by construction.
+
+Pushes to `main` then:
 
 - **Pack all apps** — each app's `package` target zips its build output into
   `dist/drop/<type>-<name>.zip` (e.g. `node-function-app-api.zip`,

package/dist/cli.js

@@ -1506,6 +1506,8 @@ var FLUTTER_TOOL_PATH_AZURE = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}console.log(
 var FLUTTER_TOOL_PATH_GITHUB = `node -e "${FLUTTER_TOOL_PATH_PRELUDE}if(!process.env.GITHUB_PATH){console.log('Not running in GitHub Actions - skipping.');process.exit(0)}fs.appendFileSync(process.env.GITHUB_PATH,bin+${String.raw`'\n'`})"`;
 var FLUTTER_PUB_GET_GUARD = `node -e "const fs=require('node:fs');if(!fs.existsSync('pubspec.yaml')){console.log('No Flutter projects - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('flutter',['pub','get'],{stdio:'inherit',shell:process.platform==='win32'}).status ?? 1)"`;
 var NPM_AUDIT_STEP = "npm audit --audit-level=high || echo npm audit found vulnerabilities, see log above - non-blocking, run npm audit locally to inspect";
+var VERIFY_TARGETS = "lint,typecheck,test,build";
+var AFFECTED_OR_ALL_GUARD = `node -e "const cp=require('node:child_process');const T='${VERIFY_TARGETS}';const all=()=>process.exit(cp.spawnSync('npx nx run-many -t '+T,{stdio:'inherit',shell:true}).status ?? 1);const ref=process.env.GITHUB_BASE_REF||process.env.SYSTEM_PULLREQUEST_TARGETBRANCH||'';if(!ref){console.log('Not a pull request - verifying EVERY project.');all()}const target=ref.replace('refs/heads/','');const mergeBase=r=>{const o=cp.spawnSync('git',['merge-base',r,'HEAD'],{encoding:'utf8'});return o.status===0?o.stdout.trim():''};let base=mergeBase('origin/'+target);if(!base){console.log('No origin/'+target+' ref - fetching it to resolve a merge-base.');cp.spawnSync('git',['fetch','--no-tags','origin',target],{stdio:'inherit'});base=mergeBase('FETCH_HEAD')}if(!base){console.log('Could not resolve a merge-base with '+target+' - verifying EVERY project.');all()}console.log('Pull request against '+target+' - verifying projects affected since '+base);process.exit(cp.spawnSync('npx nx affected -t '+T+' --base='+base,{stdio:'inherit',shell:true}).status ?? 1)"`;
 var PACK_APPS_GUARD = `node -e "const fs=require('node:fs');fs.mkdirSync('dist/drop',{recursive:true});if(fs.globSync('apps/*/project.json').length===0){console.log('No apps to pack - skipping.');process.exit(0)}process.exit(require('node:child_process').spawnSync('npx nx run-many -t package',{stdio:'inherit',shell:true}).status ?? 1)"`;
 function releaseGuard(pythonPublishEnv) {
   return `node -e "const fs=require('node:fs'),cp=require('node:child_process');const hasNpm=fs.globSync('packages/*/package.json').length>0;const hasPython=fs.globSync('python-packages/*/pyproject.toml').length>0;if(!hasNpm&&!hasPython){console.log('Nothing to release - skipping.');process.exit(0)}const env={...process.env};${pythonPublishEnv}process.exit(cp.spawnSync('npx nx release --yes',{stdio:'inherit',shell:true,env}).status ?? 1)"`;
@@ -1674,27 +1676,28 @@ steps:
   - script: npx nx sync:check
     displayName: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
 
-  # One verify for every run (PR and main). Nx cache makes unchanged test/build
-  # projects instant.
-  - script: npm run lint
-    displayName: Lint
-
   # Prettier owns ALL formatting in this workspace, so it needs a gate of its
   # own: ESLint is configured for correctness only and deliberately reports
   # nothing about formatting. Without this step the entire formatting opinion is
   # advisory, and a workspace drifts out of compliance with no signal anywhere.
+  #
+  # Stays workspace-wide even on a PR, unlike the verify step below: it is one
+  # Prettier invocation over the whole tree, not a per-project Nx target, so
+  # there is nothing to scope down and formatting is never partially checked.
   - script: npm run format:check
     displayName: Check formatting (run 'npm run format' locally to fix)
-  # \`lint\` here also runs any Nx lint targets \`npm run lint\` does not cover \u2014
-  # notably Python's ruff (every Python project owns a hand-authored \`lint\`
-  # target). The JS lint runs twice, but Nx caches the repeat instantly.
+
+  # The one verify step, and deliberately the only one: affected projects on a
+  # pull request, EVERY project on anything else (a push to main included, so a
+  # release is always verified in full). Every fallback \u2014 no target branch, an
+  # unresolvable merge-base \u2014 takes the full path, because a run that verifies
+  # too little still reports green.
   #
-  # \`typecheck\` is load-bearing and not covered by \`build\`: a bundler-built
-  # project (esbuild, swc) strips types without reading them, so a workspace can
-  # build, test and lint green while carrying real type errors. --preset=ts
-  # infers a typecheck target for every project, so this costs one target name.
-  - script: npx nx run-many -t lint,typecheck,test,build
-    displayName: Lint, typecheck, test and build everything
+  # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
+  # below, so adding it back as its own step would only duplicate work \u2014 and on
+  # a pull request it would re-lint every project, discarding the point of this.
+  - script: ${AFFECTED_OR_ALL_GUARD}
+    displayName: Verify (affected on a PR, every project on main)
 
   # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
   # target. Portable guard: skip cleanly when the workspace has no apps yet.
@@ -1873,29 +1876,31 @@ jobs:
       - run: npx nx sync:check
         name: Verify the workspace is synced (run 'npx nx sync' locally and commit if this fails)
 
-      # One verify for every run (PR and main). Nx cache makes unchanged
-      # test/build projects instant.
-      - run: npm run lint
-        name: Lint
-
       # Prettier owns ALL formatting in this workspace, so it needs a gate of
       # its own: ESLint is configured for correctness only and deliberately
       # reports nothing about formatting. Without this step the entire
       # formatting opinion is advisory, and a workspace drifts out of
       # compliance with no signal anywhere.
+      #
+      # Stays workspace-wide even on a PR, unlike the verify step below: it is
+      # one Prettier invocation over the whole tree, not a per-project Nx
+      # target, so there is nothing to scope down and formatting is never
+      # partially checked.
       - run: npm run format:check
         name: Check formatting (run 'npm run format' locally to fix)
-      # \`lint\` here also runs any Nx lint targets \`npm run lint\` does not cover \u2014
-      # notably Python's ruff (every Python project owns a hand-authored \`lint\`
-      # target). The JS lint runs twice, but Nx caches the repeat instantly.
+
+      # The one verify step, and deliberately the only one: affected projects on
+      # a pull request, EVERY project on anything else (a push to main included,
+      # so a release is always verified in full). Every fallback \u2014 no target
+      # branch, an unresolvable merge-base \u2014 takes the full path, because a run
+      # that verifies too little still reports green.
       #
-      # \`typecheck\` is load-bearing and not covered by \`build\`: a bundler-built
-      # project (esbuild, swc) strips types without reading them, so a workspace
-      # can build, test and lint green while carrying real type errors.
-      # --preset=ts infers a typecheck target for every project, so this costs
-      # one target name.
-      - run: npx nx run-many -t lint,typecheck,test,build
-        name: Lint, typecheck, test and build everything
+      # 'npm run lint' is 'nx run-many -t lint', a strict subset of the targets
+      # below, so adding it back as its own step would only duplicate work \u2014 and
+      # on a pull request it would re-lint every project, discarding the point
+      # of this.
+      - run: ${AFFECTED_OR_ALL_GUARD}
+        name: Verify (affected on a PR, every project on main)
 
       # Pack every app into dist/drop/<type>-<name>.zip via each app's 'package'
       # target. Portable guard: skip cleanly when the workspace has no apps yet.
@@ -2543,7 +2548,7 @@ async function main() {
   }
 }
 if (require.main === module) {
-  main();
+  void main();
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {