@smoothbricks/cli 0.1.0

package/dist/release/index.js

@@ -0,0 +1,325 @@
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createInterface } from 'node:readline/promises';
+import { Writable } from 'node:stream';
+import { $ } from 'bun';
+import { decode, run, runStatus } from '../lib/run.js';
+import { listPublicPackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
+export async function releaseVersion(root, options) {
+    const bump = releaseBumpArg(options.bump);
+    const projects = listPublicPackages(root)
+        .map((pkg) => pkg.name)
+        .join(',');
+    const state = await getReleaseState(root);
+    if (state.allPublished) {
+        console.log('Current package versions are already published; skipping version bump.');
+        return;
+    }
+    const headBeforeVersioning = await gitHead(root);
+    // Nx owns local release mutation: package versions, bun.lock updates, the
+    // release commit, and annotated tags. smoo owns the remote push so retries do
+    // not push an older checkout when Nx skips the release commit.
+    const nxArgs = ['release', 'version'];
+    if (bump !== 'auto') {
+        nxArgs.push(bump);
+    }
+    nxArgs.push(`--projects=${projects}`, '--git-commit=true', '--git-tag=true', '--git-push=false');
+    if (options.dryRun) {
+        nxArgs.push('--dryRun');
+    }
+    await run('nx', nxArgs, root);
+    if (!options.dryRun) {
+        // Guard against future Nx/config regressions that leave release files, such
+        // as bun.lock, outside the release commit after tagging/pushing.
+        await assertCleanGitTree(root);
+        const headAfterVersioning = await gitHead(root);
+        if (headAfterVersioning === headBeforeVersioning) {
+            console.log('Nx did not create a release commit; skipping git push.');
+            return;
+        }
+        await pushReleaseCommit(root);
+    }
+}
+export async function releasePublish(root, options) {
+    const tag = releaseNpmTagArg(options);
+    const unpublishedPackages = await listUnpublishedPackages(root);
+    if (unpublishedPackages.length === 0) {
+        console.log('Current package versions are already published; skipping npm publish.');
+        return;
+    }
+    // npm package versions are immutable. Publishing only missing name@version
+    // pairs makes auth/network retries idempotent after a partial publish failure.
+    for (const pkg of unpublishedPackages) {
+        await publishPackedPackage(root, pkg, tag, options.dryRun === true);
+    }
+}
+export async function releaseGithubRelease(root, options) {
+    if (options.dryRun) {
+        console.log('Dry run; skipping GitHub Release creation.');
+        return;
+    }
+    const npmTag = releaseNpmTagArg(options);
+    const tags = options.tags ? options.tags.split(/\s+/).filter(Boolean) : await gitTagsAtHead(root);
+    if (tags.length === 0) {
+        throw new Error('No release tags found. Pass --tags or run from a tagged release commit.');
+    }
+    const latestFlag = npmTag === 'latest' ? 'true' : 'false';
+    for (const tag of tags) {
+        const exists = (await runStatus('gh', ['release', 'view', tag], root, true)) === 0;
+        if (exists) {
+            await run('gh', ['release', 'edit', tag, '--title', tag, `--latest=${latestFlag}`], root);
+        }
+        else {
+            await run('gh', ['release', 'create', tag, '--title', tag, '--generate-notes', `--latest=${latestFlag}`], root);
+        }
+    }
+}
+export async function releaseTrustPublisher(root, options) {
+    const repository = githubRepositoryFromRootPackage(root);
+    const workflow = 'publish.yml';
+    const packages = listPublicPackages(root);
+    if (packages.length === 0) {
+        throw new Error('No npm:public packages found.');
+    }
+    if (!options.dryRun) {
+        const packageStates = await Promise.all(packages.map(async (pkg) => ((await npmPackageExists(pkg.name)) ? null : pkg.name)));
+        const missingPackages = packageStates.filter((name) => name !== null);
+        if (missingPackages.length > 0) {
+            throw new Error('npm trusted publishing can only be configured after packages exist on the registry. ' +
+                'Bootstrap the first publish with a temporary NPM_TOKEN, then rerun trust-publisher. ' +
+                `Missing packages: ${missingPackages.join(', ')}`);
+        }
+    }
+    if (!options.dryRun && !options.skipLogin) {
+        await runLatestNpm(root, ['login', '--auth-type=web']);
+    }
+    for (const pkg of packages) {
+        console.log(`${pkg.name}: trusting GitHub Actions ${repository}/${workflow}`);
+        const args = ['trust', 'github', pkg.name, '--file', workflow, '--repo', repository, '--yes'];
+        if (options.dryRun) {
+            args.push('--dry-run');
+        }
+        const otp = options.dryRun ? undefined : (options.otp ?? (await promptForNpmOtp(pkg.name)));
+        await runLatestNpm(root, args, otp ? { NPM_CONFIG_OTP: otp } : undefined);
+    }
+}
+export async function printReleaseState(root) {
+    console.log(JSON.stringify(await getReleaseState(root), null, 2));
+}
+async function getReleaseState(root) {
+    const packages = listPublicPackages(root);
+    const states = await Promise.all(packages.map(async (pkg) => {
+        const published = await npmVersionExists(pkg.name, pkg.version);
+        return { name: pkg.name, version: pkg.version, published };
+    }));
+    return { packages: states, allPublished: states.every((state) => state.published) };
+}
+async function listUnpublishedPackages(root) {
+    const packages = listPublicPackages(root);
+    const states = await Promise.all(packages.map(async (pkg) => ({ pkg, published: await npmVersionExists(pkg.name, pkg.version) })));
+    return states.filter((state) => !state.published).map((state) => state.pkg);
+}
+async function publishPackedPackage(root, pkg, tag, dryRun) {
+    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-publish-'));
+    const tarball = join(tempDir, `${safeTarballPrefix(pkg.name)}-${pkg.version}.tgz`);
+    try {
+        console.log(`${pkg.name}@${pkg.version}: packing with bun pm pack`);
+        await run('bun', ['pm', 'pack', '--filename', tarball, '--ignore-scripts', '--quiet'], join(root, pkg.path));
+        await assertNoWorkspaceProtocolInTarball(root, tarball, pkg);
+        // npm CLI owns authentication here: trusted publishing OIDC when configured,
+        // or the temporary NODE_AUTH_TOKEN bootstrap path below before trust exists.
+        // Bun still produces the tarball so workspace:* dependencies are resolved the
+        // same way smoo validates packed packages before release.
+        const args = ['publish', tarball, '--access', 'public', '--tag', tag, '--provenance'];
+        if (dryRun) {
+            args.push('--dry-run');
+        }
+        await runLatestNpmPublish(root, args);
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+function safeTarballPrefix(name) {
+    return name.replace(/^@/, '').replace(/[^a-zA-Z0-9._-]+/g, '-');
+}
+async function assertNoWorkspaceProtocolInTarball(root, tarball, pkg) {
+    const result = await $ `tar -xOf ${tarball} package/package.json`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error(`${pkg.name}: unable to inspect packed package.json before publish.`);
+    }
+    const manifest = decode(result.stdout);
+    if (manifest.includes('workspace:')) {
+        throw new Error(`${pkg.name}: packed package.json still contains workspace: dependency references.`);
+    }
+}
+async function npmVersionExists(name, version) {
+    const result = await $ `bun pm view ${`${name}@${version}`} version`.cwd(process.cwd()).quiet().nothrow();
+    return result.exitCode === 0 && decode(result.stdout).trim() === version;
+}
+async function npmPackageExists(name) {
+    const result = await $ `bun pm view ${name} name`.cwd(process.cwd()).quiet().nothrow();
+    return result.exitCode === 0;
+}
+async function gitTagsAtHead(root) {
+    const result = await $ `git tag --points-at HEAD`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        return [];
+    }
+    return decode(result.stdout)
+        .split('\n')
+        .map((tag) => tag.trim())
+        .filter(Boolean);
+}
+async function assertCleanGitTree(root) {
+    const result = await $ `git status --porcelain --untracked-files=no`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error('Unable to inspect git status after release versioning.');
+    }
+    const status = decode(result.stdout).trim();
+    if (status) {
+        throw new Error(`nx release version left tracked changes after tagging:\n${status}`);
+    }
+}
+async function gitHead(root) {
+    const result = await $ `git rev-parse HEAD`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error('Unable to resolve git HEAD before release versioning.');
+    }
+    return decode(result.stdout).trim();
+}
+async function pushReleaseCommit(root) {
+    const branch = await releaseBranch(root);
+    const remote = await releaseRemote(root, branch);
+    await run('git', ['push', '--follow-tags', '--atomic', remote, `HEAD:refs/heads/${branch}`], root);
+}
+async function releaseBranch(root) {
+    const githubBranch = process.env.GITHUB_REF_NAME?.trim();
+    if (githubBranch) {
+        return githubBranch;
+    }
+    const result = await $ `git branch --show-current`.cwd(root).quiet().nothrow();
+    const branch = decode(result.stdout).trim();
+    if (result.exitCode === 0 && branch) {
+        return branch;
+    }
+    throw new Error('Unable to resolve current git branch for release push.');
+}
+async function releaseRemote(root, branch) {
+    const configured = await gitConfigValue(root, `branch.${branch}.remote`);
+    if (configured) {
+        return configured;
+    }
+    if (await gitRemoteExists(root, 'origin')) {
+        return 'origin';
+    }
+    const result = await $ `git remote`.cwd(root).quiet().nothrow();
+    if (result.exitCode !== 0) {
+        throw new Error('Unable to list git remotes for release push.');
+    }
+    const remotes = decode(result.stdout)
+        .split('\n')
+        .map((remote) => remote.trim())
+        .filter(Boolean);
+    if (remotes.length === 1 && remotes[0]) {
+        return remotes[0];
+    }
+    throw new Error('Unable to choose git remote for release push. Configure branch upstream or add origin.');
+}
+async function gitConfigValue(root, key) {
+    const result = await $ `git config --get ${key}`.cwd(root).quiet().nothrow();
+    const value = decode(result.stdout).trim();
+    return result.exitCode === 0 && value ? value : null;
+}
+async function gitRemoteExists(root, remote) {
+    const result = await $ `git remote get-url ${remote}`.cwd(root).quiet().nothrow();
+    return result.exitCode === 0;
+}
+function releaseBumpArg(bump = 'auto') {
+    if (!['auto', 'patch', 'minor', 'major', 'prerelease'].includes(bump)) {
+        throw new Error(`Invalid --bump "${bump}". Expected auto, patch, minor, major, or prerelease.`);
+    }
+    return bump;
+}
+function releaseNpmTagArg(options) {
+    const bump = releaseBumpArg(options.bump);
+    const derivedTag = bump === 'prerelease' ? 'next' : 'latest';
+    const explicitTag = options.tag ?? options.npmTag;
+    if (!explicitTag) {
+        return derivedTag;
+    }
+    if (explicitTag !== derivedTag) {
+        throw new Error(`--bump ${bump} publishes with npm dist-tag ${derivedTag}, not ${explicitTag}.`);
+    }
+    return explicitTag;
+}
+function githubRepositoryFromRootPackage(root) {
+    const pkg = readPackageJson(join(root, 'package.json'));
+    const repository = pkg ? repositoryInfo(pkg.json) : null;
+    if (!repository) {
+        throw new Error('Root package.json must define repository.url before configuring npm trusted publishing.');
+    }
+    return githubRepositoryFromUrl(repository.url);
+}
+function githubRepositoryFromUrl(url) {
+    const normalized = url
+        .replace(/^git\+/, '')
+        .replace(/#.*$/, '')
+        .replace(/\.git$/, '');
+    const https = /^https:\/\/github\.com\/([^/]+)\/([^/]+)$/.exec(normalized);
+    if (https?.[1] && https[2]) {
+        return `${https[1]}/${https[2]}`;
+    }
+    const ssh = /^git@github\.com:([^/]+)\/([^/]+)$/.exec(normalized);
+    if (ssh?.[1] && ssh[2]) {
+        return `${ssh[1]}/${ssh[2]}`;
+    }
+    const shorthand = /^github:([^/]+)\/([^/]+)$/.exec(normalized);
+    if (shorthand?.[1] && shorthand[2]) {
+        return `${shorthand[1]}/${shorthand[2]}`;
+    }
+    throw new Error(`Root package.json repository.url must be a GitHub repository URL, got ${url}`);
+}
+async function runLatestNpm(root, npmArgs, env) {
+    await run('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...npmArgs], root, env);
+}
+async function runLatestNpmPublish(root, npmArgs) {
+    const token = process.env.NODE_AUTH_TOKEN || process.env.NPM_TOKEN;
+    if (!token || process.env.NPM_CONFIG_USERCONFIG) {
+        await runLatestNpm(root, npmArgs);
+        return;
+    }
+    const tempDir = await mkdtemp(join(tmpdir(), 'smoo-npm-auth-'));
+    const npmrc = join(tempDir, '.npmrc');
+    try {
+        await writeFile(npmrc, `registry=https://registry.npmjs.org/\n//registry.npmjs.org/:_authToken=${token}\n`);
+        await runLatestNpm(root, npmArgs, { NPM_CONFIG_USERCONFIG: npmrc });
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+async function promptForNpmOtp(packageName) {
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new Error(`npm trust requires a one-time password for ${packageName}. Pass --otp <code> in non-interactive shells.`);
+    }
+    const mutedOutput = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback();
+        },
+    });
+    const rl = createInterface({ input: process.stdin, output: mutedOutput, terminal: true });
+    process.stdout.write(`Enter npm OTP for ${packageName}: `);
+    try {
+        const otp = (await rl.question('')).trim();
+        process.stdout.write('\n');
+        if (!otp) {
+            throw new Error(`npm OTP is required for ${packageName}.`);
+        }
+        return otp;
+    }
+    finally {
+        rl.close();
+    }
+}

package/managed/raw/.git-format-staged.yml

@@ -0,0 +1,47 @@
+# git-format-staged configuration for SmoothBricks-style monorepos
+
+formatters:
+  eslint:
+    command: eslint-stdout '{}'
+    patterns:
+      - '*.astro'
+      - '!.*'
+      - '!.*/**'
+
+  biome:
+    command: biome check --files-ignore-unknown=true --use-editorconfig=true '--stdin-file-path={}' --fix
+    patterns:
+      - '*.js'
+      - '*.ts'
+      - '*.jsx'
+      - '*.tsx'
+      - '*.json'
+      - '*.jsonc'
+      - '*.html'
+      - '*.css'
+      - '*.graphql'
+
+  prettier:
+    command: prettier --ignore-unknown --stdin-filepath '{}'
+    patterns:
+      - '*'
+      - '!.*'
+      - '!*.js'
+      - '!*.ts'
+      - '!*.jsx'
+      - '!*.tsx'
+      - '!*.json'
+      - '!*.jsonc'
+      - '!*.html'
+      - '!*.css'
+      - '!*.graphql'
+      - '!*.nix'
+
+  alejandra:
+    command: alejandra
+    patterns:
+      - '*.nix'
+
+settings:
+  update_working_tree: true
+  show_commands: true

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -0,0 +1,66 @@
+#!/bin/bash
+set -euo pipefail
+
+NIX_STORE_NAR="${NIX_STORE_NAR:-/tmp/nix-store.nar}"
+nix_store_cmd="/nix/var/nix/profiles/default/bin/nix-store"
+# Resolve from this script's location, not the caller's cwd. GitHub Actions
+# runs this from tooling/direnv today, but direct cwd-changing helpers are easy
+# to misuse and break on repeated calls.
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+repo_root="$(cd "$script_dir/../.." && pwd)"
+
+clear_devenv_cache_state() {
+  rm -rf "$repo_root/tooling/direnv/.devenv" "$repo_root/tooling/direnv/.direnv"
+}
+
+add_repo_paths() {
+  {
+    echo "$repo_root/tooling/direnv/.devenv/profile/bin"
+    echo "$repo_root/node_modules/.bin"
+    echo "$repo_root/tooling"
+  } >> "$GITHUB_PATH"
+}
+
+restore_nix_store() {
+  if [ -s "$NIX_STORE_NAR" ]; then
+    if ! sudo "$nix_store_cmd" --import --quiet < "$NIX_STORE_NAR"; then
+      # .devenv/.direnv contain absolute /nix/store references. If importing the
+      # matching store closure fails, clearing them prevents incoherent restores.
+      clear_devenv_cache_state
+      exit 1
+    fi
+    # The restored NAR is only the import source. Cleanup exports a fresh NAR for
+    # the next cache save, so remove this workspace scratch file before release
+    # steps run git cleanliness checks.
+    rm -f "$NIX_STORE_NAR"
+  else
+    echo "No NAR file found; clearing devenv cache state"
+    clear_devenv_cache_state
+  fi
+}
+
+install_devenv() {
+  sudo mkdir -p /nix/var/nix/gcroots/ci
+  if ! command -v devenv >/dev/null 2>&1; then
+    nix profile add --accept-flake-config nixpkgs#devenv
+  fi
+  echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
+  sudo ln -sf "$HOME/.nix-profile" /nix/var/nix/gcroots/ci/profile
+}
+
+build_devenv_shell() {
+  devenv shell --verbose -- date
+  # Add repo-local tools only after the shell exists; cleanup steps use an
+  # explicit PATH because failures before this point must still refresh caches.
+  add_repo_paths
+}
+
+case "${1:-}" in
+  restore-store) restore_nix_store ;;
+  install-devenv) install_devenv ;;
+  build-shell) build_devenv_shell ;;
+  *)
+    echo "Usage: $0 {restore-store|install-devenv|build-shell}" >&2
+    exit 1
+    ;;
+esac

package/managed/raw/tooling/git-hooks/commit-msg.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+cd "$(git rev-parse --show-toplevel)"
+TOOLING="$PWD/tooling"
+
+export PATH="$TOOLING/git-hooks:$TOOLING:$PWD/node_modules/.bin:$TOOLING/direnv/.devenv/profile/bin:$PATH"
+
+set -e -o pipefail
+
+smoo monorepo validate-commit-msg "$1"

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+cd "$(git rev-parse --show-toplevel)"
+TOOLING="$PWD/tooling"
+
+export PATH="$TOOLING/git-hooks:$TOOLING:$PWD/node_modules/.bin:$TOOLING/direnv/.devenv/profile/bin:$PATH"
+
+set -e -o pipefail
+
+# Format exactly what is staged so the commit includes the formatter output.
+git-format-staged
+
+# Adding a workspace package is rare and easy to leave half-wired. Run the
+# full monorepo validator only for newly staged package manifests; --fail-fast
+# keeps pre-commit output focused on the first blocking setup issue.
+if ! git diff --cached --quiet --diff-filter=A -- \
+  'packages/*/package.json' \
+  'targets/*/package.json'; then
+  smoo monorepo validate --fail-fast
+fi

package/managed/templates/github/actions/cache-nix-devenv/action.yml

@@ -0,0 +1,79 @@
+name: Cache Nix profiles, devenv and direnv
+description: Restore cached Nix/devenv state for SmoothBricks GitHub Actions jobs.
+
+inputs:
+  segment:
+    description: 'Cache segment to operate on: nix or devenv.'
+    required: false
+    default: nix
+  mode:
+    description: Restore or save the Nix/devenv cache.
+    required: false
+    default: restore
+
+outputs:
+  cache-hit:
+    description: Whether the restore step found an exact primary-key match.
+    value: ${{ steps.restore-nix.outputs.cache-hit == 'true' || steps.restore-devenv.outputs.cache-hit == 'true' }}
+
+runs:
+  using: composite
+  steps:
+    # The large cache is the Nix profile plus exported store NAR. Its key tracks
+    # the expensive shell closure inputs only; tiny direnv/setup script changes
+    # should not invalidate a 1GB+ store cache.
+    - name: Restore Nix profiles, devenv and direnv
+      id: restore-nix
+      if: ${{ inputs.segment == 'nix' && inputs.mode == 'restore' }}
+      uses: actions/cache/restore@v5.0.5
+      with:
+        path: |
+          ${{ env.NIX_STORE_NAR }}
+          ~/.nix-profile
+          ~/.local/state/nix/profiles
+          ~/.cache/nix
+        key:
+          ${{ runner.os }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
+          'tooling/direnv/devenv.lock') }}
+        restore-keys: |
+          ${{ runner.os }}-nix-v3-
+
+    - name: Save Nix profiles and store NAR
+      if: ${{ inputs.segment == 'nix' && inputs.mode == 'save' }}
+      uses: actions/cache/save@v5.0.5
+      with:
+        path: |
+          ${{ env.NIX_STORE_NAR }}
+          ~/.nix-profile
+          ~/.local/state/nix/profiles
+          ~/.cache/nix
+        key:
+          ${{ runner.os }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
+          'tooling/direnv/devenv.lock') }}
+
+    # .devenv/.direnv are small, but they contain absolute /nix/store pointers.
+    # Workflows restore this segment only after an exact Nix cache hit.
+    - name: Restore devenv and direnv state
+      id: restore-devenv
+      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'restore' }}
+      uses: actions/cache/restore@v5.0.5
+      with:
+        path: |
+          ${{ github.workspace }}/tooling/direnv/.devenv
+          ${{ github.workspace }}/tooling/direnv/.direnv
+        key:
+          ${{ runner.os }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
+          'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh', 'tooling/direnv/setup-environment.ts') }}
+        restore-keys: |
+          ${{ runner.os }}-devenv-v3-
+
+    - name: Save devenv and direnv state
+      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'save' }}
+      uses: actions/cache/save@v5.0.5
+      with:
+        path: |
+          ${{ github.workspace }}/tooling/direnv/.devenv
+          ${{ github.workspace }}/tooling/direnv/.direnv
+        key:
+          ${{ runner.os }}-devenv-v3-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix',
+          'tooling/direnv/devenv.lock', 'tooling/direnv/envrc.sh', 'tooling/direnv/setup-environment.ts') }}

package/managed/templates/github/actions/cache-node-modules/action.yml

@@ -0,0 +1,13 @@
+name: Cache node_modules
+description: Restore cached Bun workspace dependencies.
+
+runs:
+  using: composite
+  steps:
+    - name: Cache node_modules
+      uses: actions/cache@v5.0.5
+      with:
+        path: node_modules
+        key: ${{ runner.os }}-node-{{NODE_MODULES_CACHE_KEY}}
+        restore-keys: |
+          ${{ runner.os }}-node-

package/managed/templates/github/actions/cache-nx/action.yml

@@ -0,0 +1,21 @@
+name: Restore Nx cache
+description: Restore cached Nx task outputs without publishing new cache entries.
+
+outputs:
+  cache-hit:
+    description: Whether an exact Nx cache key was restored.
+    value: ${{ steps.restore.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    - name: Restore Nx cache
+      id: restore
+      uses: actions/cache/restore@v5.0.5
+      with:
+        path: |
+          .nx/cache
+          .nx/workspace-data/*.db*
+        key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}
+        restore-keys: |
+          ${{ runner.os }}-nx-db-v1-

package/managed/templates/github/actions/save-nix-devenv/action.yml

@@ -0,0 +1,39 @@
+name: Save Nix/devenv caches
+description: Cleanup the Nix store and explicitly save Nix/devenv cache segments.
+
+inputs:
+  nix-cache-hit:
+    description: Exact-hit output from setup-devenv's Nix cache restore.
+    required: false
+    default: 'false'
+  devenv-cache-hit:
+    description: Exact-hit output from setup-devenv's devenv cache restore.
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: 🧹 Cleanup and cache Nix store
+      id: cleanup-cache
+      shell: bash
+      working-directory: tooling/direnv
+      # build-shell normally adds repo paths to GITHUB_PATH, but this cleanup
+      # must still run when build-shell fails before that happens.
+      run:
+        PATH="$PWD/.devenv/profile/bin:$PWD/../../node_modules/.bin:$PWD/../../tooling:$PATH" ../../tooling/smoo
+        github-ci cleanup-cache
+
+    - name: 🧊 Save Nix profiles and store NAR
+      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.nix-cache-hit != 'true' }}
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: nix
+        mode: save
+
+    - name: 🧊 Save devenv and direnv
+      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.devenv-cache-hit != 'true' }}
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: devenv
+        mode: save