@pagopa/dx-cli 0.21.0 → 0.21.1

package/dist/adapters/azure/__tests__/cloud-account-service.test.js

@@ -241,7 +241,10 @@ describe("isInitialized", () => {
     });
 });
 describe("initialize", () => {
-    test("assigns bootstrap roles to the bootstrap identity", async ({ cloudAccountService, }) => {
+    test("assigns bootstrap roles and creates bootstrap environment secrets", async ({ cloudAccountService, }) => {
+        const createOrUpdateEnvironmentSecret = vi
+            .fn()
+            .mockResolvedValue(undefined);
         await cloudAccountService.initialize({
             csp: "azure",
             defaultLocation: "italynorth",
@@ -259,7 +262,7 @@ describe("initialize", () => {
             repo: "dx",
         }, {
             createBranch: vi.fn(),
-            createOrUpdateEnvironmentSecret: vi.fn().mockResolvedValue(undefined),
+            createOrUpdateEnvironmentSecret,
             createPullRequest: vi.fn(),
             getFileContent: vi.fn(),
             getRepository: vi.fn(),
@@ -286,5 +289,48 @@ describe("initialize", () => {
             issuer: "https://token.actions.githubusercontent.com",
             subject: "repo:pagopa/dx:environment:bootstrapper-dev-cd",
         });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledTimes(6);
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "ARM_CLIENT_ID",
+            secretValue: "client-1",
+        });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "ARM_TENANT_ID",
+            secretValue: "tenant-1",
+        });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "ARM_SUBSCRIPTION_ID",
+            secretValue: "sub-1",
+        });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "GH_APP_ID",
+            secretValue: "app-id",
+        });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "GH_APP_INSTALLATION_ID",
+            secretValue: "installation-id",
+        });
+        expect(createOrUpdateEnvironmentSecret).toHaveBeenCalledWith({
+            environmentName: "bootstrapper-dev-cd",
+            owner: "pagopa",
+            repo: "dx",
+            secretName: "GH_APP_KEY",
+            secretValue: "private-key",
+        });
     });
 });

package/dist/adapters/azure/cloud-account-service.js

@@ -169,6 +169,7 @@ export class AzureCloudAccountService {
         const parameters = {
             location: cloudAccount.defaultLocation,
             tags: {
+                CreatedBy: "DX CLI",
                 Environment: name,
                 ...tags,
             },
@@ -185,6 +186,10 @@ export class AzureCloudAccountService {
             const identityClientId = identity.clientId;
             logger.debug("Created identity {identityName} in subscription {subscriptionId}", { identityName, subscriptionId: cloudAccount.id });
             const authorizationManagementClient = new AuthorizationManagementClient(this.#credential, cloudAccount.id);
+            const subscriptionClient = new SubscriptionClient(this.#credential);
+            const subscription = await subscriptionClient.subscriptions.get(cloudAccount.id);
+            assert.ok(subscription.tenantId, "Subscription tenant ID is undefined");
+            const tenantId = subscription.tenantId;
             const subscriptionScope = `/subscriptions/${cloudAccount.id}`;
             // Grant the bootstrap identity the Azure permissions it needs to operate autonomously in the bootstrap workflow.
             await Promise.all(bootstrapIdentityRoleDefinitionIds.map((roleDefinitionId) => authorizationManagementClient.roleAssignments.create(subscriptionScope, this.#createRoleAssignmentName(subscriptionScope, identityPrincipalId, roleDefinitionId), {
@@ -205,25 +210,14 @@ export class AzureCloudAccountService {
                 identityName,
                 subscriptionId: cloudAccount.id,
             });
-            // These secrets let the GitHub workflow target the bootstrap identity and subscription without extra setup.
-            await Promise.all([
-                gitHubService.createOrUpdateEnvironmentSecret({
-                    environmentName: githubEnvironmentName,
-                    owner: github.owner,
-                    repo: github.repo,
-                    secretName: "ARM_CLIENT_ID",
-                    secretValue: identityClientId,
-                }),
-                gitHubService.createOrUpdateEnvironmentSecret({
-                    environmentName: githubEnvironmentName,
-                    owner: github.owner,
-                    repo: github.repo,
-                    secretName: "ARM_SUBSCRIPTION_ID",
-                    secretValue: cloudAccount.id,
-                }),
-            ]);
-            logger.debug("Set GitHub environment secrets for {environmentName}", {
-                environmentName: githubEnvironmentName,
+            await this.#storeBootstrapperEnvironmentSecrets({
+                cloudAccountId: cloudAccount.id,
+                github,
+                githubEnvironmentName,
+                gitHubService,
+                identityClientId,
+                runnerAppCredentials,
+                tenantId,
             });
             const keyVaultName = await this.#createCommonKeyVault({
                 cloudAccount,
@@ -233,6 +227,7 @@ export class AzureCloudAccountService {
                 shortEnv: short.env,
                 shortLocation: short.location,
                 tags,
+                tenantId,
             });
             await this.#storeRunnerAppSecrets({
                 cloudAccountId: cloudAccount.id,
@@ -348,11 +343,8 @@ export class AzureCloudAccountService {
         }));
         return results.every(Boolean);
     }
-    async #createCommonKeyVault({ cloudAccount, name, prefix, resourceGroupName, shortEnv, shortLocation, tags, }) {
+    async #createCommonKeyVault({ cloudAccount, name, prefix, resourceGroupName, shortEnv, shortLocation, tags, tenantId, }) {
         const logger = getLogger(["gen", "env"]);
-        const subscriptionClient = new SubscriptionClient(this.#credential);
-        const subscription = await subscriptionClient.subscriptions.get(cloudAccount.id);
-        assert.ok(subscription.tenantId, "Subscription tenant ID is undefined");
         const kvClient = new KeyVaultManagementClient(this.#credential, cloudAccount.id);
         const keyVaultName = `${prefix}-${shortEnv}-${shortLocation}-common-kv-01`;
         const secretsProtectionEnabled = shortEnv === "p";
@@ -372,7 +364,7 @@ export class AzureCloudAccountService {
                     name: "standard",
                 },
                 softDeleteRetentionInDays: secretsProtectionEnabled ? 14 : 7,
-                tenantId: subscription.tenantId,
+                tenantId,
             },
             tags: {
                 Environment: name,
@@ -437,6 +429,57 @@ export class AzureCloudAccountService {
         }));
         logger.info("All resource providers registered on subscription {subscriptionId}", { subscriptionId });
     }
+    async #storeBootstrapperEnvironmentSecrets({ cloudAccountId, github, githubEnvironmentName, gitHubService, identityClientId, runnerAppCredentials, tenantId, }) {
+        const logger = getLogger(["gen", "env"]);
+        await Promise.all([
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "ARM_CLIENT_ID",
+                secretValue: identityClientId,
+            }),
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "ARM_TENANT_ID",
+                secretValue: tenantId,
+            }),
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "ARM_SUBSCRIPTION_ID",
+                secretValue: cloudAccountId,
+            }),
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "GH_APP_ID",
+                secretValue: runnerAppCredentials.id,
+            }),
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "GH_APP_INSTALLATION_ID",
+                secretValue: runnerAppCredentials.installationId,
+            }),
+            gitHubService.createOrUpdateEnvironmentSecret({
+                environmentName: githubEnvironmentName,
+                owner: github.owner,
+                repo: github.repo,
+                secretName: "GH_APP_KEY",
+                secretValue: runnerAppCredentials.key.trimEnd(),
+            }),
+        ]);
+        logger.debug("Set GitHub environment secrets for {environmentName}", {
+            environmentName: githubEnvironmentName,
+            subscriptionId: cloudAccountId,
+        });
+    }
     async #storeRunnerAppSecrets({ cloudAccountId, keyVaultName, runnerAppCredentials, }) {
         const logger = getLogger(["gen", "env"]);
         const secretClient = new SecretClient(`https://${keyVaultName}.vault.azure.net/`, this.#credential);

package/dist/adapters/commander/commands/__tests__/preconditions.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/adapters/commander/commands/__tests__/preconditions.test.js

@@ -0,0 +1,32 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+const mocks = vi.hoisted(() => ({
+    oraPromise: vi.fn((promise) => promise),
+    tf$: vi.fn(async (...args) => {
+        void args;
+        return { stdout: '{"user":{"name":"test@example.com"}}' };
+    }),
+}));
+vi.mock("ora", () => ({ oraPromise: mocks.oraPromise }));
+vi.mock("../../../execa/terraform.js", () => ({ tf$: mocks.tf$ }));
+import { checkAddEnvironmentPreconditions, checkInitPreconditions, } from "../init.js";
+const calledCommands = () => mocks.tf$.mock.calls.map(([strings, ...values]) => strings.reduce((command, part, index) => command + part + String(values[index] ?? ""), ""));
+describe("init preconditions", () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    it("checkInitPreconditions does not require Azure login", async () => {
+        const result = await checkInitPreconditions();
+        expect(result.isOk()).toBe(true);
+        expect(calledCommands()).toEqual(["terraform -version", "corepack -v"]);
+    });
+    it("checkAddEnvironmentPreconditions requires Azure login", async () => {
+        const result = await checkAddEnvironmentPreconditions();
+        expect(result.isOk()).toBe(true);
+        expect(calledCommands()).toEqual([
+            "terraform -version",
+            "az account show",
+            "az group list",
+            "corepack -v",
+        ]);
+    });
+});

package/dist/adapters/commander/commands/add.js

@@ -16,7 +16,7 @@ import { environmentShort } from "../../../domain/environment.js";
 import { isAzureLocation, locationShort } from "../../azure/locations.js";
 import { getPlopInstance, runDeploymentEnvironmentGenerator, } from "../../plop/index.js";
 import { exitWithError } from "../index.js";
-import { checkPreconditions } from "./init.js";
+import { checkAddEnvironmentPreconditions } from "./init.js";
 /**
  * Authorize a Cloud Account (Azure Subscription, AWS Account, ...), creating a Pull Request for each account that requires authorization.
  */
@@ -70,7 +70,7 @@ const displaySummary = (result) => {
     }
     console.log(`${step}. Visit ${chalk.underline("https://dx.pagopa.it/getting-started")} to deploy your first project\n`);
 };
-const addEnvironmentAction = (authorizationService, gitHubService) => checkPreconditions()
+const addEnvironmentAction = (authorizationService, gitHubService) => checkAddEnvironmentPreconditions()
     .andThen(() => ResultAsync.fromPromise(getPlopInstance(), (cause) => new Error("Failed to initialize plop", { cause })))
     .andThen((plop) => ResultAsync.fromPromise(runDeploymentEnvironmentGenerator(plop, gitHubService), (cause) => new Error("Failed to run the deployment environment generator", {
     cause,

package/dist/adapters/commander/commands/init.d.ts

@@ -1,7 +1,15 @@
 import { Command } from "commander";
 import { ResultAsync } from "neverthrow";
 import { GitHubService } from "../../../domain/github.js";
-export declare const checkPreconditions: () => ResultAsync<import("execa").Result<{
+export declare const checkInitPreconditions: () => ResultAsync<import("execa").Result<{
+    environment: {
+        NO_COLOR: string;
+        TF_IN_AUTOMATION: string;
+        TF_INPUT: string;
+    };
+    shell: true;
+}>, Error>;
+export declare const checkAddEnvironmentPreconditions: () => ResultAsync<import("execa").Result<{
     environment: {
         NO_COLOR: string;
         TF_IN_AUTOMATION: string;

package/dist/adapters/commander/commands/init.js

@@ -54,7 +54,8 @@ const ensureAzLogin = async () => {
 };
 const checkAzLogin = () => withSpinner("Check Azure login status...", (userName) => `You are logged in to Azure (${userName})`, "Please log in to Azure CLI using `az login` before running this command.", ensureAzLogin());
 // TODO(CES-1810): Make these checks concurrent to speed up the preconditions check phase
-export const checkPreconditions = () => checkTerraformCliIsInstalled()
+export const checkInitPreconditions = () => checkTerraformCliIsInstalled().andThen(() => checkCorepackIsInstalled());
+export const checkAddEnvironmentPreconditions = () => checkTerraformCliIsInstalled()
     .andThen(() => checkAzLogin())
     .andThen(() => checkCorepackIsInstalled());
 const createRemoteRepository = ({ repoName, repoOwner, }) => {
@@ -121,7 +122,7 @@ export const makeInitCommand = ({ gitHubService, }) => new Command()
     .name("init")
     .description("Initialize a new DX workspace")
     .action(async function () {
-    await checkPreconditions()
+    await checkInitPreconditions()
         .andThen(() => ResultAsync.fromPromise(getPlopInstance(), (cause) => new Error("Failed to initialize plop", { cause })))
         .andThen((plop) => ResultAsync.fromPromise(runMonorepoGenerator(plop, gitHubService), handleGeneratorError))
         .andTee((payload) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pagopa/dx-cli",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "type": "module",
   "description": "A CLI useful to manage DX tools.",
   "repository": {
@@ -31,7 +31,7 @@
     "@azure/identity": "^4.13.1",
     "@azure/keyvault-secrets": "^4.11.1",
     "@azure/storage-blob": "^12.31.0",
-    "@logtape/logtape": "^1.3.7",
+    "@logtape/logtape": "^1.3.8",
     "@microsoft/microsoft-graph-client": "^3.0.7",
     "chalk": "^5.6.2",
     "commander": "^14.0.3",
@@ -39,16 +39,16 @@
     "execa": "^9.6.1",
     "glob": "^11.1.0",
     "inquirer": "^9.3.8",
-    "libsodium-wrappers": "^0.8.2",
+    "libsodium-wrappers": "^0.8.4",
     "neverthrow": "^8.2.0",
     "node-plop": "^0.32.3",
     "octokit": "^5.0.5",
-    "ora": "^9.3.0",
+    "ora": "^9.4.0",
     "replace-in-file": "^8.4.0",
     "semver": "^7.7.4",
-    "yaml": "^2.8.3",
-    "zod": "^4.3.6",
-    "@pagopa/dx-savemoney": "^0.2.4"
+    "yaml": "^2.8.4",
+    "zod": "^4.4.2",
+    "@pagopa/dx-savemoney": "^0.2.5"
   },
   "devDependencies": {
     "@tsconfig/node24": "24.0.4",
@@ -57,14 +57,14 @@
     "@types/node": "^22.19.17",
     "@types/semver": "^7.7.1",
     "@vitest/coverage-v8": "^3.2.4",
-    "eslint": "^10.2.1",
-    "memfs": "^4.57.1",
+    "eslint": "^10.3.0",
+    "memfs": "^4.57.2",
     "plop": "^4.0.5",
     "prettier": "3.8.3",
     "typescript": "~5.9.3",
     "vitest": "^3.2.4",
     "vitest-mock-extended": "^3.1.1",
-    "@pagopa/eslint-config": "^6.0.3"
+    "@pagopa/eslint-config": "^6.0.4"
   },
   "engines": {
     "node": ">=22.0.0"

package/templates/environment/workflow/_release-terraform-apply-bootstrapper-{{env.name}}.yaml.hbs

@@ -9,6 +9,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   release:

package/templates/monorepo/.prettierignore

@@ -2,4 +2,5 @@
 **/*.hbs
 
 # Ignore built files
-dist
+dist
+CHANGELOG.md