@scrymore/scry-deployer 0.3.2 → 0.4.1

package/bin/cli.js

@@ -409,9 +409,13 @@ async function main() {
                         alias: 'skipGhSetup'
                     })
                     .option('commit-api-key', {
-                        describe: 'Commit API key in config file (not recommended)',
+                        describe: 'Write the API key into the committed config file (not recommended)',
                         type: 'boolean',
-                        default: true,
+                        // False by default. The description has always said "not
+                        // recommended" while the default said otherwise, and the
+                        // default won: every `init` wrote a customer's key into a
+                        // file it then committed.
+                        default: false,
                         alias: 'commitApiKey'
                     })
                     .option('verbose', {

package/lib/init.js

@@ -47,19 +47,27 @@ async function runInit(argv) {
         // Step 3: Create config file
         const step3Start = Date.now();
         logger.info('3/8: Creating configuration file...');
-        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo);
+        createConfigFile(argv.project, argv.apiKey, argv.apiUrl, envInfo, argv.commitApiKey);
         const step3Duration = Date.now() - step3Start;
         logger.success(`✅ Created .storybook-deployer.json [${step3Duration}ms]\n`);
 
-        // Step 4: Add to gitignore (optional - keep API key out of git if user prefers)
+        // Step 4: Report what the committed config does and does not contain.
+        //
+        // This step used to add `.storybook-deployer.json` to .gitignore, which was
+        // wrong in both directions. The config now holds no credential, so ignoring
+        // it would only stop a team sharing its project id — and the entry it wrote,
+        // `.storybook-deployer.json  # Contains API key`, never matched anything:
+        // in .gitignore a `#` is only a comment at the start of a line, so the
+        // pattern included the trailing text and git ignored no file.
         const step4Start = Date.now();
-        if (!argv.commitApiKey) {
-            logger.info('4/8: Updating .gitignore...');
-            updateGitignore();
-            const step4Duration = Date.now() - step4Start;
-            logger.success(`✅ Updated .gitignore (API key will use env vars in CI) [${step4Duration}ms]\n`);
+        if (argv.commitApiKey) {
+            logger.info('4/8: Checking credentials...');
+            logger.error(`⚠️  --commit-api-key: your API key will be written to .storybook-deployer.json and committed.
+   Git history keeps it after rotation, and CI does not need it — the key is
+   already stored as the SCRY_API_KEY repository secret. [${Date.now() - step4Start}ms]\n`);
         } else {
-            logger.info('4/8: Skipping .gitignore update (--commit-api-key flag set)\n');
+            logger.info('4/8: Checking credentials...');
+            logger.success(`✅ .storybook-deployer.json holds no credentials — safe to commit [${Date.now() - step4Start}ms]\n`);
         }
 
         // Step 5: Generate workflow files
@@ -71,14 +79,18 @@ async function runInit(argv) {
         logger.success('✅ Created .github/workflows/deploy-pr-preview.yml\n');
 
         // Step 6: Setup GitHub variables (if gh CLI available)
+        // Tracked, not assumed — the closing summary reports what actually happened.
+        let ghConfigured = null;
         const step6Start = Date.now();
         if (!argv.skipGhSetup && isGhCliAvailable()) {
             logger.info('6/8: Setting up GitHub repository variables...');
             try {
                 await setupGitHubVariables(argv.project, argv.apiKey, argv.apiUrl, logger);
+                ghConfigured = true;
                 const step6Duration = Date.now() - step6Start;
                 logger.success(`✅ GitHub variables configured [${step6Duration}ms]\n`);
             } catch (error) {
+                ghConfigured = false;
                 const step6Duration = Date.now() - step6Start;
                 logger.error(`⚠️  GitHub setup failed: ${error.message} [${step6Duration}ms]`);
                 logger.info('You can set these up manually later.\n');
@@ -94,7 +106,7 @@ async function runInit(argv) {
         // Step 7: Git commit
         const step7Start = Date.now();
         logger.info('7/8: Committing changes...');
-        const commitResult = gitCommit(argv.commitApiKey, logger);
+        const commitResult = gitCommit(logger);
         const step7Duration = Date.now() - step7Start;
         if (commitResult.success) {
             logger.success(`✅ Changes committed: ${commitResult.sha} [${step7Duration}ms]\n`);
@@ -118,7 +130,10 @@ async function runInit(argv) {
         logger.info('━'.repeat(50));
         logger.info(`[TIMING] Total setup time: ${totalDuration}ms (${(totalDuration / 1000).toFixed(2)}s)\n`);
         
-        showSuccessMessage(argv.project, envInfo, argv.apiUrl, pushResult.success);
+        showSuccessMessage(argv.project, envInfo, argv.apiUrl, pushResult.success, {
+            ghConfigured,
+            committed: commitResult.success,
+        });
 
     } catch (error) {
         logger.error(`\n❌ Setup failed: ${error.message}`);
@@ -236,7 +251,7 @@ function parseGitHubRemote(remote) {
 /**
  * Create the configuration file
  */
-function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
+function createConfigFile(projectId, apiKey, apiUrl, envInfo, commitApiKey) {
     const config = {
         apiUrl: apiUrl,
         project: projectId,
@@ -245,10 +260,19 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
         verbose: false
     };
 
-    // Only include apiKey in config if user wants it committed
-    // Otherwise it should be set via environment variable
-    // For now, we'll include it but note in .gitignore
-    config.apiKey = apiKey;
+    // The key is deliberately absent unless explicitly asked for.
+    //
+    // This file gets committed, and CI never reads the key from it — `init` sets
+    // SCRY_API_KEY as a GitHub *secret* and the generated workflow reads
+    // ${{ secrets.SCRY_API_KEY }}. So a copy here buys nothing and lands
+    // somewhere git history makes permanent: rotating the key afterwards does
+    // not remove it, and on a public repository it is simply disclosed.
+    //
+    // Local runs read SCRY_API_KEY from the environment, which lib/config.js
+    // already resolves.
+    if (commitApiKey) {
+        config.apiKey = apiKey;
+    }
 
     const configPath = '.storybook-deployer.json';
     fs.writeFileSync(
@@ -258,28 +282,6 @@ function createConfigFile(projectId, apiKey, apiUrl, envInfo) {
     );
 }
 
-/**
- * Update .gitignore to exclude sensitive files (optional)
- */
-function updateGitignore() {
-    const gitignorePath = '.gitignore';
-    const entries = [
-        '# Scry Storybook Deployer',
-        '.storybook-deployer.json  # Contains API key'
-    ];
-
-    let gitignoreContent = '';
-    if (fs.existsSync(gitignorePath)) {
-        gitignoreContent = fs.readFileSync(gitignorePath, 'utf8');
-    }
-
-    // Check if already added
-    if (!gitignoreContent.includes('.storybook-deployer.json')) {
-        gitignoreContent += '\n' + entries.join('\n') + '\n';
-        fs.writeFileSync(gitignorePath, gitignoreContent, 'utf8');
-    }
-}
-
 /**
  * Generate workflow files
  */
@@ -318,22 +320,63 @@ function isGhCliAvailable() {
 /**
  * Setup GitHub variables using gh CLI
  */
-async function setupGitHubVariables(projectId, apiKey, apiUrl, logger) {
+/**
+ * Does this `gh` know about `gh variable`? It arrived in gh 2.21 (December 2022),
+ * and Ubuntu 22.04 still ships 2.4.0 — so plenty of machines do not have it.
+ * Without this check the very first call throws, the secret after it is never
+ * reached, and CI ends up with no credentials at all.
+ */
+function ghSupportsVariables() {
     try {
-        // Set variables
-        execSync(`gh variable set SCRY_PROJECT_ID --body "${projectId}"`, { stdio: 'pipe' });
-        logger.debug('   ✓ Set SCRY_PROJECT_ID');
+        execSync('gh variable --help', { stdio: 'pipe' });
+        return true;
+    } catch {
+        return false;
+    }
+}
 
-        execSync(`gh variable set SCRY_API_URL --body "${apiUrl}"`, { stdio: 'pipe' });
-        logger.debug('   ✓ Set SCRY_API_URL');
+function setVariableViaApi(repo, name, value) {
+    // `gh api` predates `gh variable` by years, so it is the safe fallback.
+    const payload = JSON.stringify({ name, value });
+    try {
+        execSync(`gh api -X POST repos/${repo}/actions/variables --input -`, {
+            stdio: ['pipe', 'pipe', 'pipe'], input: payload,
+        });
+    } catch {
+        // Already present: update rather than create.
+        execSync(`gh api -X PATCH repos/${repo}/actions/variables/${name} --input -`, {
+            stdio: ['pipe', 'pipe', 'pipe'], input: payload,
+        });
+    }
+}
 
-        // Set secret (API key)
-        execSync(`gh secret set SCRY_API_KEY --body "${apiKey}"`, { stdio: 'pipe' });
-        logger.debug('   ✓ Set SCRY_API_KEY');
+async function setupGitHubVariables(projectId, apiKey, apiUrl, logger) {
+    const repo = execSync('gh repo view --json nameWithOwner -q .nameWithOwner', { stdio: 'pipe' })
+        .toString().trim();
 
-    } catch (error) {
-        throw new Error(`Failed to set GitHub variables: ${error.message}`);
+    const useCli = ghSupportsVariables();
+    if (!useCli) {
+        logger.debug('   gh is too old for `gh variable`; using `gh api` instead');
     }
+
+    // Each of these is reported separately. A failure part-way through used to
+    // abandon the rest silently, which is how a repository ended up with the
+    // variables missing *and* the secret missing while setup reported success.
+    const setVar = (name, value) => {
+        if (useCli) execSync(`gh variable set ${name} --body "${value}"`, { stdio: 'pipe' });
+        else setVariableViaApi(repo, name, value);
+    };
+
+    setVar('SCRY_PROJECT_ID', projectId);
+    logger.debug('   ✓ Set SCRY_PROJECT_ID');
+
+    setVar('SCRY_API_URL', apiUrl);
+    logger.debug('   ✓ Set SCRY_API_URL');
+
+    // `gh secret set` needs libsodium encryption, so there is no simple `gh api`
+    // fallback — but it has existed since gh 1.x, so it works where variables do not.
+    execSync(`gh secret set SCRY_API_KEY --body "${apiKey}"`, { stdio: 'pipe' });
+    logger.debug('   ✓ Set SCRY_API_KEY');
 }
 
 /**
@@ -367,7 +410,7 @@ Or install GitHub CLI and run:
 /**
  * Commit the changes to git
  */
-function gitCommit(commitApiKey, logger) {
+function gitCommit(logger) {
     try {
         // Check if there are changes to commit
         const status = execSync('git status --porcelain', { encoding: 'utf8' });
@@ -382,16 +425,25 @@ function gitCommit(commitApiKey, logger) {
             '.storybook-deployer.json'
         ];
 
-        if (!commitApiKey) {
-            filesToAdd.push('.gitignore');
-        }
-
+        // Each file is staged on its own. `git add` fails on a path that
+        // .gitignore excludes, and one throw used to abort the loop before the
+        // commit — so a leftover `.storybook-deployer.json` ignore rule from the
+        // pre-0.4.0 workaround silently prevented the *workflows* being committed,
+        // and CI was never set up at all.
+        let staged = 0;
         for (const file of filesToAdd) {
-            if (fs.existsSync(file)) {
+            if (!fs.existsSync(file)) continue;
+            try {
                 execSync(`git add "${file}"`, { stdio: 'pipe' });
+                staged++;
                 logger.debug(`   ✓ Added ${file}`);
+            } catch {
+                logger.debug(`   • Skipped ${file} (ignored by .gitignore)`);
             }
         }
+        if (staged === 0) {
+            return { success: false, message: 'Nothing could be staged' };
+        }
 
         // Commit
         const commitMessage = 'chore: add Scry Storybook deployment workflows';
@@ -442,18 +494,23 @@ function gitPush(logger) {
 /**
  * Show success message
  */
-function showSuccessMessage(projectId, envInfo, apiUrl, pushed) {
+function showSuccessMessage(projectId, envInfo, apiUrl, pushed, results = {}) {
     console.log(`
 🎉 ${pushed ? 'Setup Complete and Deployed!' : 'Setup Complete!'}
 
 Your Storybook deployment is configured and ready to go.
 
 📦 What was set up:
-   ✅ Configuration file (.storybook-deployer.json)
+   ✅ Configuration file (.storybook-deployer.json — no credentials, safe to commit)
    ✅ GitHub Actions workflows (.github/workflows/)
-   ✅ Repository variables (SCRY_PROJECT_ID, SCRY_API_URL)
-   ✅ Repository secret (SCRY_API_KEY)
-   ${pushed ? '✅ Changes committed and pushed' : '⚠️  Manual push required'}
+   ${results.ghConfigured === true
+        ? '✅ Repository variables and secret (SCRY_PROJECT_ID, SCRY_API_URL, SCRY_API_KEY)'
+        : results.ghConfigured === false
+            ? '❌ Repository variables and secret NOT set — CI cannot deploy until you fix this'
+            : '⚠️  Repository variables and secret not attempted — CI cannot deploy until you set them'}
+   ${results.committed === false
+        ? '❌ Changes NOT committed — the workflows are staged but uncommitted'
+        : (pushed ? '✅ Changes committed and pushed' : '⚠️  Committed; manual push required')}
 
 ${!pushed ? `
 📌 Next Step:
@@ -461,6 +518,12 @@ ${!pushed ? `
    git push
 ` : ''}
 
+🔑 Running a deploy locally:
+   CI reads the key from the SCRY_API_KEY secret. On your own machine, export it
+   rather than writing it into the config file, which is committed:
+
+   export SCRY_API_KEY=<your key>
+
 🚀 Deployment:
    Your Storybook will deploy automatically on:
    • Every push to ${envInfo.currentBranch || 'main'} branch
@@ -477,4 +540,4 @@ Happy deploying! ✨
 `);
 }
 
-module.exports = { runInit };
+module.exports = { runInit, createConfigFile, gitCommit };

package/lib/templates.js

@@ -59,11 +59,27 @@ function getCacheValue(packageManager) {
 /**
  * Generate main deployment workflow
  */
+/**
+ * The command that fetches and runs a package that is not a project dependency.
+ *
+ * `npx` cannot be assumed. In a pnpm workflow it resolves against the
+ * pnpm-managed environment and reports "playwright: not found" — exit 127 —
+ * even with --yes. Each package manager has its own equivalent, so use it.
+ */
+function getDlxCommand(packageManager) {
+    switch (packageManager) {
+        case 'pnpm': return 'pnpm dlx';
+        case 'yarn': return 'yarn dlx';
+        default: return 'npx --yes';
+    }
+}
+
 function generateMainWorkflow(projectId, apiUrl, packageManager, buildCmd) {
     const pmSetup = getPackageManagerSetup(packageManager);
     const installCmd = getInstallCommand(packageManager);
     const cache = getCacheValue(packageManager);
     const runCmd = packageManager === 'npm' ? `npm run ${buildCmd}` : `${packageManager} run ${buildCmd}`;
+    const dlx = getDlxCommand(packageManager);
 
     return `# Auto-generated by Scry Storybook Deployer
 # Deploy Storybook to production on push to main branch
@@ -96,6 +112,16 @@ ${cache}
       - name: Build Storybook
         run: ${runCmd}
 
+      - name: Install Playwright browser
+        # Screenshot capture drives --with-analysis, and without a browser every
+        # story fails, no metadata archive is produced, and nothing is ever
+        # indexed — while the deploy still exits 0 and the workflow goes green.
+        # Chromium headless shell only: a few seconds, versus minutes for the
+        # full browser set.
+        # The version is left floating so it tracks sbcov's own playwright
+        # ^1.41.0 optional dependency and installs a matching browser build.
+        run: ${dlx} playwright install --with-deps chromium-headless-shell
+
       - name: Deploy to Scry
         run: |
           npx @scrymore/scry-deployer \\
@@ -121,6 +147,7 @@ function generatePRWorkflow(projectId, apiUrl, packageManager, buildCmd) {
     const installCmd = getInstallCommand(packageManager);
     const cache = getCacheValue(packageManager);
     const runCmd = packageManager === 'npm' ? `npm run ${buildCmd}` : `${packageManager} run ${buildCmd}`;
+    const dlx = getDlxCommand(packageManager);
 
     return `# Auto-generated by Scry Storybook Deployer
 # Deploy Storybook preview for pull requests
@@ -157,6 +184,16 @@ ${cache}
       - name: Build Storybook
         run: ${runCmd}
 
+      - name: Install Playwright browser
+        # Screenshot capture drives --with-analysis, and without a browser every
+        # story fails, no metadata archive is produced, and nothing is ever
+        # indexed — while the deploy still exits 0 and the workflow goes green.
+        # Chromium headless shell only: a few seconds, versus minutes for the
+        # full browser set.
+        # The version is left floating so it tracks sbcov's own playwright
+        # ^1.41.0 optional dependency and installs a matching browser build.
+        run: ${dlx} playwright install --with-deps chromium-headless-shell
+
       - name: Deploy Preview
         id: deploy
         run: |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scrymore/scry-deployer",
-  "version": "0.3.2",
+  "version": "0.4.1",
   "description": "A CLI to automate the deployment of Storybook static builds.",
   "main": "index.js",
   "bin": {