@rtrentjones/greenlight 0.2.12 → 0.2.13

package/assets/skills/provider-vercel/SKILL.md

@@ -45,7 +45,7 @@ without carrying the wrapper's `greenlight.config.ts` into the tool repo.
 **Deployment Protection gotcha:** `deployment_status.target_url` is the `*.vercel.app` *deployment*
 URL, which Vercel **Deployment Protection** gates (→ **401**) even though the public custom domain
 is 200. To verify the real app, create a **Protection Bypass for Automation** secret (Vercel →
-project → Settings → Deployment Protection) and set it as `VERCEL_AUTOMATION_BYPASS_SECRET` on the
+project → Settings → Deployment Protection) and set it as `VERCEL_AUTOMATION_BYPASS_SECRET_<TOOL>` (per-tool — the bypass value is per Vercel project, so a second vercel tool never collides) on the
 tool repo — the api check sends it as `x-vercel-protection-bypass` and asserts 200. Without it the
 generated spec asserts **401** (the deployment is served + protected), so the gate stays green.
 

package/dist/bin.js

@@ -276,12 +276,11 @@ var PACKS = [
           });
           return { ok: okStatus(r), detail: `HTTP ${r.status}` };
         }
-      },
-      {
-        envVar: "TF_VAR_supabase_database_password",
-        label: "database password (ignored when importing an existing project)",
-        optional: true
       }
+      // NOTE: the database password is PER-PROJECT, so it's emitted as a per-tool variable
+      // (`<name>_supabase_database_password`) inline in each tool's <name>.tf — like the per-tool
+      // `<name>_vercel_project_id` — not a shared account credential gathered here. Set
+      // TF_VAR_<name>_supabase_database_password only when CREATING a project (ignored on import).
     ],
     mcp: {
       supabase: {
@@ -414,7 +413,7 @@ function tokensForTool(tool) {
 }
 
 // src/version.ts
-var MODULE_REF = "v0.2.12";
+var MODULE_REF = "v0.2.13";
 var MODULE_SOURCE_BASE = "git::https://github.com/RTrentJones/greenlight.git//infra/modules";
 function moduleSource(module, ref = MODULE_REF) {
   return `${MODULE_SOURCE_BASE}/${module}?ref=${ref}`;
@@ -433,7 +432,7 @@ function emitToolTf(opts) {
   const blocks = [];
   const assumes = ["var.cloudflare_zone_id"];
   if (useOci) assumes.push("var.cloudflare_account_id", "local.oci_compartment_id");
-  if (useSupabase) assumes.push("var.supabase_organization_id", "var.supabase_database_password");
+  if (useSupabase) assumes.push("var.supabase_organization_id");
   const ghcrOwner = (slug.split("/")[0] ?? "owner").toLowerCase();
   blocks.push(
     `# ${name} \u2014 ${lane}/${target}${useSupabase ? "/supabase" : ""}, emitted by \`greenlight add\`.
@@ -450,8 +449,17 @@ module "${name}_supabase" {
   name              = "${name}"
   project_name      = "${name}-db"
   organization_id   = var.supabase_organization_id
-  database_password = var.supabase_database_password
+  database_password = var.${name}_supabase_database_password
   region            = "us-east-1"
+}
+
+# Per-tool (the password is per Supabase PROJECT) \u2014 so a second data:supabase tool doesn't collide
+# on a shared variable. Set TF_VAR_${name}_supabase_database_password only when CREATING a project;
+# on import the module ignores it (the default placeholder is fine).
+variable "${name}_supabase_database_password" {
+  type      = string
+  sensitive = true
+  default   = "import-placeholder" # ignored when importing an existing project
 }`);
   }
   if (useVercel) {
@@ -603,9 +611,6 @@ function emitWrapperMainTf(opts) {
   vars.push('variable "cloudflare_account_id" {\n  type    = string\n  default = ""\n}');
   if (need.has("supabase")) {
     vars.push('variable "supabase_organization_id" { type = string }');
-    vars.push(
-      'variable "supabase_database_password" {\n  type      = string\n  sensitive = true\n  default   = "import-placeholder" # ignored when importing an existing project\n}'
-    );
   }
   if (need.has("oci")) {
     vars.push('variable "oci_tenancy_ocid" { type = string }');
@@ -1463,7 +1468,9 @@ jobs:
         env:
           # Bypass Vercel Deployment Protection on the deployment URL (Vercel \u2192 project \u2192 Deployment
           # Protection \u2192 Protection Bypass for Automation). Without it the gate asserts 401 (served).
-          VERCEL_AUTOMATION_BYPASS_SECRET: \${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET }}
+          # The SECRET is per-tool (the bypass value is per Vercel PROJECT) so two vercel tools never
+          # collide; the env var the spec reads stays generic.
+          VERCEL_AUTOMATION_BYPASS_SECRET: \${{ secrets.VERCEL_AUTOMATION_BYPASS_SECRET_${name.toUpperCase().replace(/-/g, "_")} }}
           ANTHROPIC_API_KEY: \${{ secrets.ANTHROPIC_API_KEY }}
         run: npx -y @rtrentjones/greenlight@latest verify --url "\${{ github.event.deployment_status.target_url }}" --spec verify/${name}.config.ts
 `;
@@ -1643,8 +1650,9 @@ Next:
                     greenlight secrets gather ${name} --repo ${slug}   # GREENLIGHT_DISPATCH_TOKEN
   The instance OCID is auto-resolved by the deploy workflow (by display name) \u2014 nothing to set.` : target === "vercel" ? `
   Deploy is Vercel's git integration (no wrapper deploy). The tool's greenlight-verify.yml verifies
-  each deployment (deployment_status). Optional: add ANTHROPIC_API_KEY to ${slug} to enable the
-  agent-web scenarios in verify/${name}.config.ts (absent \u2192 api + test gate alone).` : ""}`);
+  each deployment (deployment_status). Optional secrets on ${slug}:
+    \xB7 VERCEL_AUTOMATION_BYPASS_SECRET_${name.toUpperCase().replace(/-/g, "_")}  (Vercel \u2192 project \u2192 Deployment Protection \u2192 Bypass for Automation) \u2192 verify asserts 200, not 401
+    \xB7 ANTHROPIC_API_KEY \u2192 enables the agent-web scenarios in verify/${name}.config.ts (absent \u2192 api gate alone)` : ""}`);
 }
 async function adoptStandalone(ctx) {
   const { name, repoArg, lane, target, data, auth, envs, domain, reg, regPath } = ctx;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rtrentjones/greenlight",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Greenlight CLI — setup and lifecycle for the harness.",
   "license": "MIT",
   "repository": {
@@ -33,8 +33,8 @@
   "devDependencies": {
     "@rtrentjones/greenlight-adapters": "0.2.4",
     "@rtrentjones/greenlight-shared": "0.2.4",
-    "@rtrentjones/greenlight-loop": "0.2.4",
-    "@rtrentjones/greenlight-verify": "0.2.4"
+    "@rtrentjones/greenlight-verify": "0.2.4",
+    "@rtrentjones/greenlight-loop": "0.2.4"
   },
   "scripts": {
     "build": "node scripts/copy-assets.mjs && tsup",