@smoothbricks/cli 0.1.0

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -0,0 +1,63 @@
+name: Setup Nix/devenv
+description: Restore caches and build the SmoothBricks devenv shell after checkout.
+
+outputs:
+  nix-cache-hit:
+    description: Whether the Nix profile/store cache restored from the exact primary key.
+    value: ${{ steps.nix-cache.outputs.cache-hit }}
+  devenv-cache-hit:
+    description: Whether the devenv/direnv cache restored from the exact primary key.
+    value: ${{ steps.devenv-cache.outputs.cache-hit }}
+
+runs:
+  using: composite
+  steps:
+    # This action is intentionally post-checkout only. Repo-local actions do not
+    # exist before actions/checkout has populated the working tree.
+    - name: ❄️ Install Nix
+      uses: DeterminateSystems/nix-installer-action@v22
+      with:
+        extra-conf: |
+          keep-outputs = true
+          keep-derivations = true
+          gc-keep-derivations = true
+          gc-keep-outputs = true
+
+    - name: 🧊 Cache Nix profiles and store NAR
+      id: nix-cache
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: nix
+
+    - name: ♻️ Restore Nix store from NAR
+      shell: bash
+      working-directory: tooling/direnv
+      run: ./github-actions-bootstrap.sh restore-store
+
+    # Restore direnv state only when the Nix cache key is exact. Partial Nix
+    # restores can contain a NAR for a different shell closure, and .direnv
+    # points directly at derivations inside that closure.
+    - name: 🧊 Cache devenv and direnv
+      id: devenv-cache
+      if: ${{ steps.nix-cache.outputs.cache-hit == 'true' }}
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: devenv
+
+    - name: ⚡ Enable Cachix
+      uses: cachix/cachix-action@v17
+      with:
+        name: devenv
+
+    - name: 🧰 Install devenv
+      shell: bash
+      working-directory: tooling/direnv
+      run: ./github-actions-bootstrap.sh install-devenv
+
+    - name: 📦 Cache node_modules
+      uses: ./.github/actions/cache-node-modules
+
+    - name: 🐚 Build devenv shell
+      shell: bash
+      working-directory: tooling/direnv
+      run: ./github-actions-bootstrap.sh build-shell

package/managed/templates/github/workflows/ci.yml

@@ -0,0 +1,98 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+  statuses: write
+
+defaults:
+  run:
+    working-directory: tooling/direnv
+
+jobs:
+  main:
+    runs-on: ubuntu-latest
+    env:
+      NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      # Step 1: GitHub adds "Set up job" automatically
+      # Step 2
+      - name: 📥 Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 0
+
+      # Step 3. Composite action internals do not affect top-level job step
+      # anchors; update the nx-smart --step values below if top-level steps move.
+      - name: 🧱 Setup Nix/devenv
+        id: setup
+        uses: ./.github/actions/setup-devenv
+
+      # --- Nx -----------------------------------------------------------------
+
+      # Step 4
+      # Sets the base and head SHAs required for the nx affected commands
+      - name: 🧭 Set Nx SHAs
+        uses: nrwl/nx-set-shas@v5.0.1
+        with:
+          workflow-id: ci.yml
+
+      # Step 5
+      - name: 🧠 Restore Nx cache
+        id: nx-cache
+        uses: ./.github/actions/cache-nx
+
+      # Step 6
+      - name: 🔨 Build
+        run: smoo github-ci nx-smart --target build --name "Build" --step 6
+
+      # Step 7
+      - name: 🔍 Lint
+        run: smoo github-ci nx-smart --target lint --name "Lint" --step 7
+
+      # Step 8
+      - name: 🧪 Unit Tests
+        run: smoo github-ci nx-smart --target test --name "Unit Tests" --step 8
+
+      # Step 9
+      # Nx's database cache needs artifact files and .nx/workspace-data DB
+      # metadata restored together; GitHub Actions cache is only the archive
+      # transport. Save runs only after build/lint/test succeed on the default
+      # branch, so PRs may restore shared cache but cannot publish it.
+      - name: 💾 Save Nx cache
+        if:
+          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',
+          github.event.repository.default_branch) && steps.nx-cache.outputs.cache-hit != 'true' }}
+        uses: actions/cache/save@v5.0.5
+        with:
+          path: |
+            .nx/cache
+            .nx/workspace-data/*.db*
+          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}
+
+      # Step 10
+      - name: 📎 Upload trace DBs
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: trace-results-${{ github.run_id }}
+          path: packages/*/.trace-results.db
+          if-no-files-found: ignore
+          retention-days: 14
+          include-hidden-files: true
+
+      # --- Cleanup ------------------------------------------------------------
+
+      # Step 11
+      - name: 🧹 Cleanup and cache Nix/devenv
+        if: ${{ always() }}
+        uses: ./.github/actions/save-nix-devenv
+        with:
+          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
+          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}

package/managed/templates/github/workflows/publish.yml

@@ -0,0 +1,136 @@
+name: Publish
+
+on:
+  workflow_dispatch:
+    inputs:
+      bump:
+        type: choice
+        description:
+          Use auto for conventional commits, or force a semver bump. Prerelease publishes to next; all others publish to
+          latest.
+        options: [auto, patch, minor, major, prerelease]
+        default: auto
+      dry_run:
+        type: boolean
+        description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
+        default: false
+
+permissions:
+  contents: write
+  id-token: write
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    working-directory: tooling/direnv
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    env:
+      NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      # --- Setup --------------------------------------------------------------
+
+      # Step 1: GitHub adds "Set up job" automatically
+      # Step 2
+      - name: 📥 Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 0
+
+      # Step 3. Composite action internals do not affect top-level job step
+      # anchors; update these comments if top-level steps move.
+      - name: 🧱 Setup Nix/devenv
+        id: setup
+        uses: ./.github/actions/setup-devenv
+
+      # --- Validation ---------------------------------------------------------
+
+      # Release validation intentionally does not restore persisted Nx task
+      # cache. Nx may reuse tasks produced earlier in this same job, but publish
+      # never relies on task outputs restored from CI cache.
+
+      # Step 4
+      - name: ✅ Check managed monorepo files
+        run: smoo monorepo check
+
+      # Step 5
+      - name: 📦 Resolve release projects
+        id: projects
+        run: echo "projects=$(smoo monorepo list-public-projects)" >> "$GITHUB_OUTPUT"
+
+      # Step 6
+      - name: 🔨 Build
+        run: smoo github-ci nx-run-many --targets build --projects "${{ steps.projects.outputs.projects }}"
+
+      # Step 7
+      - name: 🔍 Lint
+        run: smoo github-ci nx-run-many --targets lint --projects "${{ steps.projects.outputs.projects }}"
+
+      # Step 8
+      - name: 🧪 Unit Tests
+        run: smoo github-ci nx-run-many --targets test --projects "${{ steps.projects.outputs.projects }}"
+
+      # Step 9
+      - name: 📎 Upload trace DBs
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: trace-results-${{ github.run_id }}
+          path: packages/*/.trace-results.db
+          if-no-files-found: ignore
+          retention-days: 14
+          include-hidden-files: true
+
+      # Step 10
+      - name: ✅ Validate monorepo config
+        run: smoo monorepo validate
+
+      # --- Release ------------------------------------------------------------
+
+      # Step 11
+      - name: 🤖 Configure release author
+        run:
+          git config user.name "github-actions[bot]" && git config user.email
+          "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # Step 12
+      - name: 🏷️ Version, tag, and push packages
+        run: smoo release version --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"
+
+      # Step 13
+      - name: 🔖 Collect release tags
+        id: tags
+        run: echo "tags=$(git tag --points-at HEAD | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
+
+      # Step 14
+      - name: 📦 Publish packages
+        # smoo packs with Bun, then publishes tarballs with npm. npm uses OIDC
+        # trusted publishing when configured; NODE_AUTH_TOKEN is only a temporary
+        # bootstrap fallback before packages have trusted publishers.
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        run: smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"
+
+      # Step 15
+      - name: 🚀 Create or update GitHub Releases
+        if: ${{ inputs.dry_run != true }}
+        run:
+          smoo release github-release --tags "${{ steps.tags.outputs.tags }}" --bump "${{ inputs.bump }}" --dry-run "${{
+          inputs.dry_run }}"
+
+      # --- Cleanup ------------------------------------------------------------
+
+      # Step 16
+      - name: 🧹 Cleanup and cache Nix/devenv
+        if: ${{ always() }}
+        uses: ./.github/actions/save-nix-devenv
+        with:
+          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
+          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@smoothbricks/cli",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "SmoothBricks monorepo automation CLI",
+  "bin": {
+    "smoo": "./bin/smoo"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    "./package.json": "./package.json",
+    ".": {
+      "types": "./dist/index.d.ts",
+      "development": "./src/index.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./monorepo/runtime": {
+      "types": "./dist/monorepo/runtime.d.ts",
+      "bun": "./src/monorepo/runtime.ts",
+      "development": "./src/monorepo/runtime.ts",
+      "import": "./dist/monorepo/runtime.js",
+      "default": "./dist/monorepo/runtime.js"
+    },
+    "./monorepo/git-config": {
+      "types": "./dist/monorepo/git-config.d.ts",
+      "bun": "./src/monorepo/git-config.ts",
+      "development": "./src/monorepo/git-config.ts",
+      "import": "./dist/monorepo/git-config.js",
+      "default": "./dist/monorepo/git-config.js"
+    }
+  },
+  "files": [
+    "README.md",
+    "bin",
+    "dist",
+    "managed",
+    "src",
+    "!**/*.tsbuildinfo"
+  ],
+  "dependencies": {
+    "@arethetypeswrong/cli": "^0.18.2",
+    "@smoothbricks/validation": "0.0.1",
+    "commander": "^14.0.3",
+    "publint": "^0.3.18",
+    "sherif": "^1.11.1",
+    "tslib": "^2.8.1"
+  },
+  "nx": {
+    "targets": {
+      "lint": {}
+    },
+    "tags": [
+      "npm:public"
+    ]
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/smoothbricks/codebase.git",
+    "directory": "packages/cli"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,149 @@
+import { Command, CommanderError } from 'commander';
+import { findRepoRoot } from './lib/run.js';
+
+export async function runCli(argv = process.argv.slice(2)): Promise<void> {
+  const program = buildProgram();
+  try {
+    await program.parseAsync(argv, { from: 'user' });
+  } catch (error) {
+    if (error instanceof CommanderError) {
+      if (error.code !== 'commander.helpDisplayed') {
+        process.exitCode = error.exitCode;
+      }
+      return;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(message);
+    process.exitCode = 1;
+  }
+}
+
+function buildProgram(): Command {
+  const program = new Command();
+  program.name('smoo').description('SmoothBricks monorepo tooling').exitOverride().showHelpAfterError();
+
+  const monorepo = program.command('monorepo').description('Manage SmoothBricks-style monorepos');
+  monorepo
+    .command('init')
+    .option('--runtime-only', 'only sync root Bun/Node runtime metadata')
+    .option('--sync-runtime', 'sync root Bun/Node runtime metadata outside devenv')
+    .action(async (options: { runtimeOnly?: boolean; syncRuntime?: boolean }) => {
+      const { initMonorepo } = await import('./monorepo/index.js');
+      await initMonorepo(await findRepoRoot(), options);
+    });
+  monorepo
+    .command('validate')
+    .option('--fail-fast', 'stop after the first failing validation pack')
+    .action(async (options: { failFast?: boolean }) => {
+      const { validateMonorepo } = await import('./monorepo/index.js');
+      await validateMonorepo(await findRepoRoot(), options);
+    });
+  monorepo.command('update').action(async () => {
+    const { updateManagedFiles } = await import('./monorepo/index.js');
+    updateManagedFiles(await findRepoRoot());
+  });
+  monorepo.command('check').action(async () => {
+    const { checkManagedFiles } = await import('./monorepo/index.js');
+    checkManagedFiles(await findRepoRoot());
+  });
+  monorepo.command('diff').action(async () => {
+    const { diffManagedFiles } = await import('./monorepo/index.js');
+    diffManagedFiles(await findRepoRoot());
+  });
+  monorepo.command('validate-commit-msg <commitMsgFile>').action(async (commitMsgFile: string) => {
+    const { validateCommitMessageFile } = await import('./monorepo/index.js');
+    validateCommitMessageFile(commitMsgFile);
+  });
+  monorepo.command('sync-bun-lockfile-versions').action(async () => {
+    const { syncBunLockfileVersions } = await import('./monorepo/index.js');
+    syncBunLockfileVersions(await findRepoRoot());
+  });
+  monorepo.command('list-public-projects').action(async () => {
+    const { listPublicProjects } = await import('./monorepo/index.js');
+    console.log(listPublicProjects(await findRepoRoot()));
+  });
+  monorepo.command('validate-public-tags').action(async () => {
+    const { validatePublicPackageTags } = await import('./monorepo/index.js');
+    validatePublicPackageTags(await findRepoRoot());
+  });
+  monorepo.command('release-state').action(async () => {
+    const { printReleaseState } = await import('./release/index.js');
+    await printReleaseState(await findRepoRoot());
+  });
+
+  const release = program.command('release').description('Version, publish, and create GitHub Releases');
+  release
+    .command('version')
+    .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+    .option('--dry-run [dryRun]', 'run without writing versions, tags, or pushes')
+    .action(async (options: { bump: string; dryRun?: string | boolean }) => {
+      const { releaseVersion } = await import('./release/index.js');
+      await releaseVersion(await findRepoRoot(), { bump: options.bump, dryRun: booleanOption(options.dryRun) });
+    });
+  release
+    .command('publish')
+    .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+    .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
+    .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
+    .option('--dry-run [dryRun]', 'run without publishing')
+    .action(async (options: { bump: string; tag?: string; npmTag?: string; dryRun?: string | boolean }) => {
+      const { releasePublish } = await import('./release/index.js');
+      await releasePublish(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+    });
+  release
+    .command('github-release')
+    .option('--tags <tags>', 'space-separated release tags')
+    .option('--bump <bump>', 'auto, patch, minor, major, or prerelease', 'auto')
+    .option('--tag <tag>', 'explicit npm dist-tag; must match bump-derived tag')
+    .option('--npm-tag <npmTag>', 'explicit npm dist-tag; must match bump-derived tag')
+    .option('--dry-run [dryRun]', 'skip GitHub Release writes')
+    .action(
+      async (options: { tags?: string; bump: string; tag?: string; npmTag?: string; dryRun?: string | boolean }) => {
+        const { releaseGithubRelease } = await import('./release/index.js');
+        await releaseGithubRelease(await findRepoRoot(), { ...options, dryRun: booleanOption(options.dryRun) });
+      },
+    );
+  release
+    .command('trust-publisher')
+    .description('Configure npm trusted publishing for public packages')
+    .option('--dry-run [dryRun]', 'show npm trust changes without saving them')
+    .option('--otp <otp>', 'npm one-time password for trust operations')
+    .option('--skip-login', 'skip npm browser login before configuring trust')
+    .action(async (options: { dryRun?: string | boolean; otp?: string; skipLogin?: boolean }) => {
+      const { releaseTrustPublisher } = await import('./release/index.js');
+      await releaseTrustPublisher(await findRepoRoot(), {
+        dryRun: booleanOption(options.dryRun),
+        otp: options.otp,
+        skipLogin: options.skipLogin === true,
+      });
+    });
+
+  const githubCi = program.command('github-ci').description('GitHub Actions helpers');
+  githubCi.command('cleanup-cache').action(async () => {
+    const { cleanupGithubCiCache } = await import('./github-ci/index.js');
+    await cleanupGithubCiCache(await findRepoRoot());
+  });
+  githubCi
+    .command('nx-smart')
+    .requiredOption('--target <target>')
+    .option('--name <name>')
+    .option('--step <step>')
+    .action(async (options: { target: string; name?: string; step?: string }) => {
+      const { githubCiNxSmart } = await import('./github-ci/index.js');
+      await githubCiNxSmart(await findRepoRoot(), options);
+    });
+  githubCi
+    .command('nx-run-many')
+    .requiredOption('--targets <targets>')
+    .option('--projects <projects>')
+    .action(async (options: { targets: string; projects?: string }) => {
+      const { githubCiNxRunMany } = await import('./github-ci/index.js');
+      await githubCiNxRunMany(await findRepoRoot(), options);
+    });
+
+  return program;
+}
+
+function booleanOption(value: string | boolean | undefined): boolean {
+  return value === true || value === 'true';
+}