@scrymore/scry-deployer 0.3.2 → 0.4.0

package/bin/cli.js

@@ -409,9 +409,13 @@ async function main() {
                         alias: 'skipGhSetup'
                     })
                     .option('commit-api-key', {
-                        describe: 'Commit API key in config file (not recommended)',
+                        describe: 'Write the API key into the committed config file (not recommended)',
                         type: 'boolean',
-                        default: true,
+                        // False by default. The description has always said "not
+                        // recommended" while the default said otherwise, and the
+                        // default won: every `init` wrote a customer's key into a
+                        // file it then committed.
+                        default: false,
                         alias: 'commitApiKey'
                     })
                     .option('verbose', {

package/lib/init.js

@@ -47,19 +47,27 @@ async function runInit(argv) {
         // Step 3: Create config file
         const step3Start = Date.now();
         logger.info('3/8: Creating configuration file...');
-        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo);
+        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo, argv.commitApiKey);
         const step3Duration = Date.now() - step3Start;
         logger.success(`✅ Created .storybook-deployer.json [${step3Duration}ms]\n`);
 
-        // Step 4: Add to gitignore (optional - keep API key out of git if user prefers)
+        // Step 4: Report what the committed config does and does not contain.
+        //
+        // This step used to add `.storybook-deployer.json` to .gitignore, which was
+        // wrong in both directions. The config now holds no credential, so ignoring
+        // it would only stop a team sharing its project id — and the entry it wrote,
+        // `.storybook-deployer.json  # Contains API key`, never matched anything:
+        // in .gitignore a `#` is only a comment at the start of a line, so the
+        // pattern included the trailing text and git ignored no file.
         const step4Start = Date.now();
-        if (!argv.commitApiKey) {
-            logger.info('4/8: Updating .gitignore...');
-            updateGitignore();
-            const step4Duration = Date.now() - step4Start;
-            logger.success(`✅ Updated .gitignore (API key will use env vars in CI) [${step4Duration}ms]\n`);
+        if (argv.commitApiKey) {
+            logger.info('4/8: Checking credentials...');
+            logger.error(`⚠️  --commit-api-key: your API key will be written to .storybook-deployer.json and committed.
+   Git history keeps it after rotation, and CI does not need it — the key is
+   already stored as the SCRY_API_KEY repository secret. [${Date.now() - step4Start}ms]\n`);
         } else {
-            logger.info('4/8: Skipping .gitignore update (--commit-api-key flag set)\n');
+            logger.info('4/8: Checking credentials...');
+            logger.success(`✅ .storybook-deployer.json holds no credentials — safe to commit [${Date.now() - step4Start}ms]\n`);
         }
 
         // Step 5: Generate workflow files
@@ -94,7 +102,7 @@ async function runInit(argv) {
         // Step 7: Git commit
         const step7Start = Date.now();
         logger.info('7/8: Committing changes...');
-        const commitResult = gitCommit(argv.commitApiKey, logger);
+        const commitResult = gitCommit(logger);
         const step7Duration = Date.now() - step7Start;
         if (commitResult.success) {
             logger.success(`✅ Changes committed: ${commitResult.sha} [${step7Duration}ms]\n`);
@@ -236,7 +244,7 @@ function parseGitHubRemote(remote) {
 /**
  * Create the configuration file
  */
-function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
+function createConfigFile(projectId, apiKey, apiUrl, envInfo, commitApiKey) {
     const config = {
         apiUrl: apiUrl,
         project: projectId,
@@ -245,10 +253,19 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
         verbose: false
     };
 
-    // Only include apiKey in config if user wants it committed
-    // Otherwise it should be set via environment variable
-    // For now, we'll include it but note in .gitignore
-    config.apiKey = apiKey;
+    // The key is deliberately absent unless explicitly asked for.
+    //
+    // This file gets committed, and CI never reads the key from it — `init` sets
+    // SCRY_API_KEY as a GitHub *secret* and the generated workflow reads
+    // ${{ secrets.SCRY_API_KEY }}. So a copy here buys nothing and lands
+    // somewhere git history makes permanent: rotating the key afterwards does
+    // not remove it, and on a public repository it is simply disclosed.
+    //
+    // Local runs read SCRY_API_KEY from the environment, which lib/config.js
+    // already resolves.
+    if (commitApiKey) {
+        config.apiKey = apiKey;
+    }
 
     const configPath = '.storybook-deployer.json';
     fs.writeFileSync(
@@ -258,28 +275,6 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
     );
 }
 
-/**
- * Update .gitignore to exclude sensitive files (optional)
- */
-function updateGitignore() {
-    const gitignorePath = '.gitignore';
-    const entries = [
-        '# Scry Storybook Deployer',
-        '.storybook-deployer.json  # Contains API key'
-    ];
-
-    let gitignoreContent = '';
-    if (fs.existsSync(gitignorePath)) {
-        gitignoreContent = fs.readFileSync(gitignorePath, 'utf8');
-    }
-
-    // Check if already added
-    if (!gitignoreContent.includes('.storybook-deployer.json')) {
-        gitignoreContent += '\n' + entries.join('\n') + '\n';
-        fs.writeFileSync(gitignorePath, gitignoreContent, 'utf8');
-    }
-}
-
 /**
  * Generate workflow files
  */
@@ -367,7 +362,7 @@ Or install GitHub CLI and run:
 /**
  * Commit the changes to git
  */
-function gitCommit(commitApiKey, logger) {
+function gitCommit(logger) {
     try {
         // Check if there are changes to commit
         const status = execSync('git status --porcelain', { encoding: 'utf8' });
@@ -382,10 +377,6 @@ function gitCommit(commitApiKey, logger) {
             '.storybook-deployer.json'
         ];
 
-        if (!commitApiKey) {
-            filesToAdd.push('.gitignore');
-        }
-
         for (const file of filesToAdd) {
             if (fs.existsSync(file)) {
                 execSync(`git add "${file}"`, { stdio: 'pipe' });
@@ -449,7 +440,7 @@ function showSuccessMessage(projectId, envInfo, apiUrl, pushed) {
 Your Storybook deployment is configured and ready to go.
 
 📦 What was set up:
-   ✅ Configuration file (.storybook-deployer.json)
+   ✅ Configuration file (.storybook-deployer.json — no credentials, safe to commit)
    ✅ GitHub Actions workflows (.github/workflows/)
    ✅ Repository variables (SCRY_PROJECT_ID, SCRY_API_URL)
    ✅ Repository secret (SCRY_API_KEY)
@@ -461,6 +452,12 @@ ${!pushed ? `
    git push
 ` : ''}
 
+🔑 Running a deploy locally:
+   CI reads the key from the SCRY_API_KEY secret. On your own machine, export it
+   rather than writing it into the config file, which is committed:
+
+   export SCRY_API_KEY=<your key>
+
 🚀 Deployment:
    Your Storybook will deploy automatically on:
    • Every push to ${envInfo.currentBranch || 'main'} branch
@@ -477,4 +474,4 @@ Happy deploying! ✨
 `);
 }
 
-module.exports = { runInit };
+module.exports = { runInit, createConfigFile };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {