@pagopa/dx-cli 0.20.1 → 0.21.0

package/dist/adapters/plop/index.js

@@ -26,19 +26,27 @@ const validatePayload = async (payload, github) => {
     }
 };
 export const getPlopInstance = async () => nodePlop();
-const runActions = async (generator, payload) => {
+export const runActions = async (generator, payload) => {
     const logger = getLogger(["dx-cli", "init"]);
     const result = await generator.runActions(payload);
     if (result.failures.length > 0) {
-        for (const failure of result.failures) {
-            if (failure.error === "Aborted due to previous action failure") {
-                continue;
-            }
-            logger.error(`Error on {type} step. ${failure.message}`, {
-                type: failure.type,
+        // Collect every failure to report rich context. node-plop's failure
+        // objects have shape `{ type, path, error }` (the `error` property holds
+        // the original error's message — see node-plop's generator-runner.js).
+        const relevant = result.failures.filter((failure) => failure.error !== "Aborted due to previous action failure");
+        if (relevant.length === 0) {
+            return;
+        }
+        const summary = relevant
+            .map((failure) => `${failure.type || "action"}: ${failure.error ?? "unknown error"}`)
+            .join("; ");
+        for (const failure of relevant) {
+            logger.error("Error on {type} step: {error}", {
+                error: failure.error ?? "unknown error",
+                type: failure.type || "action",
             });
-            throw new Error("One or more actions failed during generation.");
         }
+        throw new Error(`One or more actions failed during generation (${summary}).`);
     }
 };
 export const runMonorepoGenerator = async (plop, githubService) => {
@@ -62,8 +70,8 @@ export const runMonorepoGenerator = async (plop, githubService) => {
  *                 uses the explicitly passed repository. When omitted (by add command),
  *                 the generator infers it from the local git context.
  */
-export const runDeploymentEnvironmentGenerator = async (plop, github) => {
-    setDeploymentEnvironmentGenerator(plop, github);
+export const runDeploymentEnvironmentGenerator = async (plop, gitHubService, github) => {
+    setDeploymentEnvironmentGenerator(plop, gitHubService, github);
     const generator = plop.getGenerator(PLOP_ENVIRONMENT_GENERATOR_NAME);
     const answers = await generator.runPrompts();
     const payload = environmentPayloadSchema.parse(answers);
@@ -82,10 +90,10 @@ export const runDeploymentEnvironmentGenerator = async (plop, github) => {
  *                 uses the explicitly passed repository. When omitted (by add command),
  *                 the generator infers it from the local git context.
  */
-export const setDeploymentEnvironmentGenerator = (plop, github) => {
+export const setDeploymentEnvironmentGenerator = (plop, gitHubService, github) => {
     const credential = new AzureCliCredential();
     const cloudAccountRepository = new AzureSubscriptionRepository(credential);
     const cloudAccountService = new AzureCloudAccountService(credential);
     const templatesPath = path.join(import.meta.dirname, "../../../templates/environment");
-    createDeploymentEnvironmentGenerator(plop, templatesPath, cloudAccountRepository, cloudAccountService, github);
+    createDeploymentEnvironmentGenerator(plop, templatesPath, cloudAccountRepository, cloudAccountService, gitHubService, github);
 };

package/dist/domain/cloud-account.d.ts

@@ -1,6 +1,7 @@
 import { z } from "zod/v4";
 import { type EnvironmentId } from "./environment.js";
-import { type GitHubAppCredentials } from "./github.js";
+import { type GitHubRepo } from "./github-repo.js";
+import { type GitHubAppCredentials, type GitHubService } from "./github.js";
 import { TerraformBackend } from "./remote-backend.js";
 export declare const cloudAccountSchema: z.ZodObject<{
     csp: z.ZodDefault<z.ZodEnum<{
@@ -17,7 +18,7 @@ export type CloudAccountRepository = {
 export type CloudAccountService = {
     getTerraformBackend(cloudAccountId: CloudAccount["id"], environment: EnvironmentId): Promise<TerraformBackend | undefined>;
     hasUserPermissionToInitialize(cloudAccountId: CloudAccount["id"]): Promise<boolean>;
-    initialize(cloudAccount: CloudAccount, environment: EnvironmentId, runnerAppCredentials: GitHubAppCredentials, tags?: Record<string, string>): Promise<void>;
+    initialize(cloudAccount: CloudAccount, environment: EnvironmentId, runnerAppCredentials: GitHubAppCredentials, github: GitHubRepo, gitHubService: GitHubService, tags?: Record<string, string>): Promise<void>;
     isInitialized(cloudAccountId: CloudAccount["id"], environment: EnvironmentId): Promise<boolean>;
     provisionTerraformBackend(cloudAccount: CloudAccount, environment: EnvironmentId, tags?: Record<string, string>): Promise<TerraformBackend>;
 };

package/dist/domain/github.d.ts

@@ -5,6 +5,13 @@ export type CreateBranchParams = {
     owner: string;
     repo: string;
 };
+export type CreateOrUpdateEnvironmentSecretParams = {
+    environmentName: string;
+    owner: string;
+    repo: string;
+    secretName: string;
+    secretValue: string;
+};
 export type FileContent = {
     content: string;
     sha: string;
@@ -21,6 +28,12 @@ export interface GitHubService {
      * @throws Error if branch creation fails
      */
     createBranch(params: CreateBranchParams): Promise<void>;
+    /**
+     * Creates or updates a secret in a GitHub repository environment.
+     * The value is automatically encrypted using the environment's public key.
+     * @throws Error if secret creation fails
+     */
+    createOrUpdateEnvironmentSecret(params: CreateOrUpdateEnvironmentSecretParams): Promise<void>;
     /**
      * Creates a pull request in a GitHub repository.
      * @throws Error if pull request creation fails

package/dist/index.js

@@ -1,4 +1,5 @@
 import "core-js/actual/set/index.js";
+import { configure, getConsoleSink } from "@logtape/logtape";
 import * as assert from "node:assert/strict";
 import { Octokit } from "octokit";
 import codemodRegistry from "./adapters/codemods/index.js";
@@ -13,7 +14,42 @@ import { getInfo } from "./domain/info.js";
 import { applyCodemodById } from "./use-cases/apply-codemod.js";
 import { listCodemods } from "./use-cases/list-codemods.js";
 import { requestAuthorization } from "./use-cases/request-authorization.js";
+/**
+ * Returns `true` when `-v` or `--verbose` is present in argv.
+ *
+ * We inspect argv directly — instead of relying on Commander — because the
+ * logtape configuration must be in place before any command handler runs
+ * (including the ones that emit debug logs while parsing prompts).
+ */
+const detectVerboseFromArgv = (argv) => argv.includes("-v") || argv.includes("--verbose");
+const configureLogging = async (verbose) => {
+    const level = verbose ? "debug" : "info";
+    await configure({
+        loggers: [
+            { category: ["dx-cli"], lowestLevel: level, sinks: ["console"] },
+            // The environment generator (`gen.env`) emits debug messages about
+            // provisioned Azure resources; surfacing them is the main value of
+            // `--verbose` when running `dx init` / `dx add environment`.
+            { category: ["gen"], lowestLevel: level, sinks: ["console"] },
+            // `savemoney` already emits structured debug output by default.
+            { category: ["savemoney"], lowestLevel: "debug", sinks: ["console"] },
+            { category: ["json"], lowestLevel: "info", sinks: ["rawJson"] },
+            {
+                category: ["logtape", "meta"],
+                lowestLevel: "warning",
+                sinks: ["console"],
+            },
+        ],
+        sinks: {
+            console: getConsoleSink(),
+            rawJson(record) {
+                console.log(record.rawMessage);
+            },
+        },
+    });
+};
 export const runCli = async (version) => {
+    await configureLogging(detectVerboseFromArgv(process.argv));
     // Creating the adapters
     const repositoryReader = makeRepositoryReader();
     const packageJsonReader = makePackageJsonReader();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-cli",
-  "version": "0.20.1",
+  "version": "0.21.0",
   "type": "module",
   "description": "A CLI useful to manage DX tools.",
   "repository": {
@@ -39,6 +39,7 @@
     "execa": "^9.6.1",
     "glob": "^11.1.0",
     "inquirer": "^9.3.8",
+    "libsodium-wrappers": "^0.8.2",
     "neverthrow": "^8.2.0",
     "node-plop": "^0.32.3",
     "octokit": "^5.0.5",
@@ -52,10 +53,11 @@
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
     "@types/inquirer": "^9.0.9",
+    "@types/libsodium-wrappers": "^0.8.2",
     "@types/node": "^22.19.17",
     "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^10.2.0",
+    "eslint": "^10.2.1",
     "memfs": "^4.57.1",
     "plop": "^4.0.5",
     "prettier": "3.8.3",

package/templates/environment/workflow/_release-terraform-apply-bootstrapper-{{env.name}}.yaml.hbs

@@ -0,0 +1,19 @@
+name: Release Bootstrapper Infrastructure - {{@root.env.name}}
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - "infra/bootstrapper/**"
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    uses: pagopa/dx/.github/workflows/release-terraform-bootstrapper-v1.yaml@main
+    name: Release Bootstrapper ({{@root.env.name}})
+    secrets: inherit
+    with:
+      environment: '{{@root.env.name}}'