@smoothbricks/cli 0.10.2 → 0.10.3

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -3,6 +3,12 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import {
+  LINUX_PLATFORM_TARGET_GLOBS,
+  MACOS_PLATFORM_TARGET_GLOBS,
+  PLATFORM_TARGET_GLOBS,
+} from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { format } from 'prettier';
 import {
   definePublishWorkflow,
   type PublishWorkflowBump,
@@ -15,13 +21,208 @@ import {
 
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
-    const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,
     );
   });
 
+  it('renders workflow bytes that are stable under the repository Prettier config', async () => {
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+
+    await expect(
+      format(rendered, {
+        parser: 'yaml',
+        printWidth: 120,
+        proseWrap: 'always',
+      }),
+    ).resolves.toBe(rendered);
+  });
+
+  it('preserves the single Ubuntu job and renders no artifact transfer when no Apple targets exist', () => {
+    const current = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const explicitlyEmpty = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: [],
+    });
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+
+    expect(explicitlyEmpty).toBe(current);
+    for (const rendered of [current, linuxOnly]) {
+      const jobsYaml = rendered.slice(rendered.indexOf('jobs:\n') + 'jobs:\n'.length);
+      expect(jobsYaml).toContain('  publish:\n    runs-on: ubuntu-latest');
+      expect(jobsYaml.match(/^ {2}[a-z][a-z-]+:\n/gm)).toHaveLength(1);
+      expect(rendered).not.toContain('linux-release-candidate:');
+      expect(rendered).not.toContain('macos-platform:');
+      expect(rendered).not.toContain('publish-on-linux:');
+      expect(rendered).not.toContain('--collect-outputs');
+      expect(rendered).not.toContain('Upload validated release state');
+      expect(rendered).not.toContain('Upload validated build outputs');
+      expect(rendered).not.toContain('Upload supplemental Linux outputs');
+      expect(rendered).not.toContain('Upload macOS platform outputs');
+      expect(rendered).not.toContain('actions/download-artifact');
+      expect(rendered).not.toContain('apply-outputs');
+      expect(rendered).not.toContain('git bundle');
+    }
+  });
+
+  it('keeps job-local deeplink step anchors exact for single-job and parallel platform workflows', () => {
+    const singleJob = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const platform = renderPublishWorkflowYaml({
+      deploy: true,
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = platform.slice(
+      platform.indexOf('  linux-release-candidate:'),
+      platform.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = platform.slice(
+      platform.indexOf('  macos-platform:'),
+      platform.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = platform.slice(platform.indexOf('  publish-on-linux:'));
+
+    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 7 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
+    expect(singleJob).toContain('# Step 14\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
+    expect(singleJob).toContain('# Step 15\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 7\n      - name: 🔒 Capture candidate release SHA');
+    expect(linuxCandidate).toContain(
+      '# Step 8\n      - name: ✅ Check managed monorepo files (${{ steps.version.outputs.mode }})',
+    );
+    expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(macosPlatform).toContain('# Step 5\n      - name: 🍎 Build selected macOS and iOS release outputs');
+    expect(macosPlatform).toContain('# Step 7\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(finalJob).toContain('# Step 7\n      - name: 🧯 Repair pending releases');
+    expect(finalJob).toContain('# Step 8\n      - name: ♻️ Restore validated release state');
+    expect(finalJob).toContain('# Step 9\n      - name: 📦 Apply verified Linux outputs');
+    expect(finalJob).toContain('# Step 10\n      - name: 🍎 Apply verified macOS outputs');
+    expect(finalJob).toContain(
+      '# Step 12\n      - name: 📦 Publish release (${{ needs.linux-release-candidate.outputs.mode }})',
+    );
+    expect(finalJob).toContain('# Step 13\n      - name: 🚀 Deploy production');
+    expect(finalJob).toContain('# Step 14\n      - name: 🧹 Cleanup and cache Nix/devenv');
+  });
+
+  it('renders parallel native producers and a dependent publish-only final job', () => {
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+    const native = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = native.slice(
+      native.indexOf('  linux-release-candidate:'),
+      native.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = native.slice(native.indexOf('  macos-platform:'), native.indexOf('  publish-on-linux:'));
+    const finalJob = native.slice(native.indexOf('  publish-on-linux:'));
+
+    expect(linuxOnly).not.toContain('macos-platform:');
+    expect(linuxOnly).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
+    expect(linuxCandidate).not.toContain('needs:');
+    expect(macosPlatform).not.toContain('needs:');
+    expect(linuxCandidate).not.toContain('smoo release repair-pending');
+    expect(linuxCandidate).toContain('smoo release version');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets build --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets lint --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets test --projects');
+    expect(linuxCandidate).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(macosPlatform).not.toContain('smoo github-ci nx-run-many');
+    expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
+      `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
+        ',',
+      )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
+    );
+    expect(finalJob).not.toContain('smoo release version');
+    expect(finalJob).not.toContain('nx-run-many');
+    expect(foldedRunCommand(finalJob, '🧯 Repair pending releases')).toBe(
+      'smoo release repair-pending --ref "${{ github.sha }}" --platform-outputs ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/repairs" ' +
+        '--dry-run "${{ inputs.dry_run }}"',
+    );
+    expect(native).toContain('uses: actions/upload-artifact@v7.0.1');
+    expect(native).toContain('uses: actions/download-artifact@v8.0.1');
+    expect(native).toContain('name: publish-release-state-${{ github.run_id }}');
+    expect(native).toContain('name: publish-release-outputs-${{ github.run_id }}');
+    expect(native).toContain('name: publish-linux-outputs-${{ github.run_id }}');
+    expect(native.match(/include-hidden-files: true/g)).toHaveLength(4);
+    expect(native).toContain('name: publish-macos-outputs-${{ github.run_id }}');
+    expect(native).toContain('git bundle create');
+    expect(native).toContain('git fetch "${{ runner.temp }}/publish-artifacts/publish-release-state-');
+    expect(finalJob).toContain(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}"',
+    );
+    expect(finalJob).toContain('smoo github-ci apply-outputs --source-sha "${{ github.sha }}"');
+    expect(foldedRunCommand(finalJob, '📦 Apply verified Linux outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-release-outputs-${{ github.run_id }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-linux-outputs-${{ github.run_id }}"',
+    );
+    expect(foldedRunCommand(finalJob, '🍎 Apply verified macOS outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ github.sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/current"',
+    );
+  });
+
+  it('limits trusted publishing permission to final publish and preserves mode, deploy, and dry-run gates', () => {
+    const rendered = renderPublishWorkflowYaml({
+      deploy: true,
+      deployProvider: 'cloudflare',
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = rendered.slice(
+      rendered.indexOf('  linux-release-candidate:'),
+      rendered.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = rendered.slice(
+      rendered.indexOf('  macos-platform:'),
+      rendered.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = rendered.slice(rendered.indexOf('  publish-on-linux:'));
+
+    expect(linuxCandidate).toContain('id-token: none');
+    expect(macosPlatform).toContain('id-token: none');
+    expect(finalJob).toContain('id-token: write');
+    expect(rendered.match(/id-token: write/g)).toHaveLength(1);
+    expect(finalJob.indexOf('🧯 Repair pending releases')).toBeLessThan(
+      finalJob.indexOf('♻️ Restore validated release state'),
+    );
+    expect(finalJob.indexOf('♻️ Restore validated release state')).toBeGreaterThan(
+      finalJob.indexOf('🧱 Setup Nix/devenv'),
+    );
+    expect(rendered).not.toContain('GITHUB_SHA:');
+    expect(finalJob).toContain("needs.linux-release-candidate.outputs.mode != 'none'");
+    expect(finalJob).toContain("inputs.deploy_environment == 'production'");
+    expect(finalJob).toContain("inputs.dry_run != 'true'");
+    expect(finalJob).toContain('smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"');
+    expect(finalJob).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(finalJob).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+
   it('does not wire npm token secrets into repair or publish steps', () => {
     const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
 
@@ -384,6 +585,26 @@ class WorkflowScenarioState {
   }
 }
 
+function stepAnchorNumbers(yaml: string): number[] {
+  return [...yaml.matchAll(/^\s*# Step (\d+)/gm)].map((match) => Number(match[1]));
+}
+
+function foldedRunCommand(yaml: string, stepName: string): string {
+  const stepStart = yaml.indexOf(`- name: ${stepName}`);
+  expect(stepStart).toBeGreaterThanOrEqual(0);
+  const runMarker = '        run:\n';
+  const runStart = yaml.indexOf(runMarker, stepStart);
+  expect(runStart).toBeGreaterThan(stepStart);
+  const commandLines: string[] = [];
+  for (const line of yaml.slice(runStart + runMarker.length).split('\n')) {
+    if (!line.startsWith('          ')) {
+      break;
+    }
+    commandLines.push(line.trim());
+  }
+  return commandLines.join(' ');
+}
+
 function packageNameFromTag(tag: string): string {
   const versionSeparator = tag.lastIndexOf('@');
   if (versionSeparator <= 0) {

package/src/monorepo/ci-workflow.ts

@@ -181,7 +181,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         '          path: |',
         '            .nx/cache',
         '            .nx/workspace-data/*.db*',
-        '          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}',
+        '          key: ${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}',
       ];
     case CiWorkflowStepKind.UploadTraceDbs:
       return [

package/src/monorepo/managed-files.test.ts

@@ -1,16 +1,30 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are asserted literally. */
 import { describe, expect, it } from 'bun:test';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
 import {
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
+  platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
 
+const REPO_ROOT = join(import.meta.dir, '..', '..', '..', '..');
+const ARCHITECTURE_SCOPED_PREFIX = '${{ runner.os }}-${{ runner.arch }}-';
+const NODE_MODULES_CACHE_KEY = "${{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}";
+const CACHE_ACTIONS = [
+  { name: 'cache-nix-devenv', osKeyLines: 6 },
+  { name: 'cache-node-modules', osKeyLines: 2 },
+  { name: 'cache-nx', osKeyLines: 2 },
+] as const;
+
 describe('managed-file local sections', () => {
   it('content without a marker is entirely managed', () => {
     const { managed, localTail } = splitLocalSectionForTest(MANAGED);
@@ -139,3 +153,51 @@ describe('managed-file inline local blocks', () => {
     );
   });
 });
+
+describe('managed publish platform discovery', () => {
+  it('returns canonical target families from resolved target names without leaking project names', () => {
+    const discovered = platformTargetGlobsForTest(['build', 'bundle-linux', 'package-macos', 'simulator-ios', 'test']);
+
+    expect(discovered).toEqual([...PLATFORM_TARGET_GLOBS]);
+    expect(discovered).not.toContain('native-app');
+  });
+
+  it('selects only supplemental Linux when resolved metadata has no Apple targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'bundle-linux', 'test'])).toEqual([...LINUX_PLATFORM_TARGET_GLOBS]);
+  });
+
+  it('returns no platform families for ordinary Nx targets', () => {
+    expect(platformTargetGlobsForTest(['build', 'lint', 'test', 'typecheck'])).toEqual([]);
+  });
+});
+
+describe('managed cache actions', () => {
+  it('renders the checked-in action copies from their managed templates', async () => {
+    for (const action of CACHE_ACTIONS) {
+      const [template, generated] = await Promise.all([
+        readFile(
+          join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions', action.name, 'action.yml'),
+          'utf8',
+        ),
+        readFile(join(REPO_ROOT, '.github', 'actions', action.name, 'action.yml'), 'utf8'),
+      ]);
+
+      expect(generated).toBe(template.replace('{{NODE_MODULES_CACHE_KEY}}', NODE_MODULES_CACHE_KEY));
+    }
+  });
+
+  it('scopes every primary, restore, and save key to the runner OS and architecture', async () => {
+    for (const action of CACHE_ACTIONS) {
+      for (const actionRoot of [
+        join(REPO_ROOT, 'packages', 'cli', 'managed', 'templates', 'github', 'actions'),
+        join(REPO_ROOT, '.github', 'actions'),
+      ]) {
+        const content = await readFile(join(actionRoot, action.name, 'action.yml'), 'utf8');
+        const osKeyLines = content.split('\n').filter((line) => line.includes('${{ runner.os }}'));
+
+        expect(osKeyLines).toHaveLength(action.osKeyLines);
+        expect(osKeyLines.every((line) => line.includes(ARCHITECTURE_SCOPED_PREFIX))).toBe(true);
+      }
+    }
+  });
+});

package/src/monorepo/managed-files.ts

@@ -2,6 +2,7 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -137,6 +138,7 @@ interface ManagedFileContext {
   ciPushBranches: string[];
   nodeModulesCacheKey: string;
   repoName: string;
+  platformTargetGlobs: string[];
 }
 
 interface DeployTargetInfo {
@@ -295,6 +297,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploy: context.hasProductionDeployTargets,
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
+        platformTargetGlobs: context.platformTargetGlobs,
       });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -314,6 +317,7 @@ function getManagedFileContext(root: string): ManagedFileContext {
   const ciPushBranches = getCiPushBranches(packageJson?.json);
   const stagingDeploy = getDeployTargetInfo(root, 'staging');
   const productionDeploy = getDeployTargetInfo(root, 'production');
+  const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -326,9 +330,46 @@ function getManagedFileContext(root: string): ManagedFileContext {
     ciPushBranches,
     nodeModulesCacheKey,
     repoName,
+    platformTargetGlobs,
   };
 }
 
+export function platformTargetGlobsForTest(targetNames: Iterable<string>): string[] {
+  const names = [...targetNames];
+  return PLATFORM_TARGET_GLOBS.filter((glob) => {
+    const suffix = glob.startsWith('*') ? glob.slice(1) : glob;
+    return names.some((name) => name.endsWith(suffix));
+  });
+}
+
+function readResolvedNxTargetNames(root: string): string[] {
+  const output = execFileSync('nx', ['show', 'projects', '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const projects: unknown = JSON.parse(output);
+  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+    return [];
+  }
+  const targetNames = new Set<string>();
+  for (const project of projects) {
+    const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
+      cwd: root,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'inherit'],
+    });
+    const projectJson: unknown = JSON.parse(projectOutput);
+    const targets = recordValue(recordValue(projectJson)?.targets);
+    if (targets) {
+      for (const targetName of Object.keys(targets)) {
+        targetNames.add(targetName);
+      }
+    }
+  }
+  return [...targetNames];
+}
+
 function renderTemplate(context: ManagedFileContext, template: string): string {
   return template
     .replaceAll('{{REPO_NAME}}', context.repoName)

package/src/monorepo/package-policy.test.ts

@@ -29,7 +29,6 @@ const buildOutputDependencies = [
   '*-web',
   '*-html',
   '*-css',
-  '*-ios',
   '*-android',
   '*-native',
   '*-napi',
@@ -974,6 +973,56 @@ describe('workspace package script policy', () => {
       await rm(root, { recursive: true, force: true });
     }
   });
+  it('validates generic CI skip tags against resolved project targets', async () => {
+    const root = await createWorkspace({
+      rootName: '@fixture/root',
+      packages: [
+        {
+          dir: 'worker',
+          name: '@fixture/worker',
+          nx: { name: 'worker', tags: ['ci:skip:test', 'ci:skip:test.integration'], targets: {} },
+        },
+      ],
+    });
+    try {
+      const resolvedTargetsByProject = new Map([['worker', new Set(['build', 'test', 'test.integration'])]]);
+      expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(0);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('rejects malformed and missing-target CI skip tags', async () => {
+    const root = await createWorkspace({
+      rootName: '@fixture/root',
+      packages: [
+        {
+          dir: 'malformed',
+          name: '@fixture/malformed',
+          nx: { name: 'malformed', tags: ['ci:skip:'], targets: {} },
+        },
+        {
+          dir: 'missing',
+          name: '@fixture/missing',
+          nx: { name: 'missing', tags: ['ci:skip:test'], targets: {} },
+        },
+      ],
+    });
+    const errors = captureConsoleErrors();
+    try {
+      const resolvedTargetsByProject = new Map([
+        ['malformed', new Set(['test'])],
+        ['missing', new Set(['build'])],
+      ]);
+      expect(validateWorkspaceDependencies(root, { resolvedTargetsByProject })).toBe(2);
+      expect(errors).toContain(
+        'packages/malformed: nx tag ci:skip: must use ci:skip:<target> with one exact Nx target name',
+      );
+      expect(errors).toContain('packages/missing: nx tag ci:skip:test names missing Nx target test');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
 });
 
 async function createWorkspace(input: {

package/src/monorepo/package-policy.ts

@@ -371,6 +371,7 @@ export function validatePublicPackageMetadata(root: string): number {
 
 export function validateWorkspaceDependencies(root: string, options: PackageTargetPolicyOptions = {}): number {
   let failures = 0;
+  failures += validateCiSkipTags(root, options);
   const workspaceNames = new Set(getWorkspacePackages(root).map((pkg) => pkg.name));
   for (const pkg of listPackageJsonRecords(root)) {
     for (const field of workspaceDependencyFields) {
@@ -404,6 +405,33 @@ export function validateWorkspaceDependencies(root: string, options: PackageTarg
   return failures;
 }
 
+const ciSkipTagPrefix = 'ci:skip:';
+const invalidCiSkipTargetSyntax = /[,*?[\]{}]/;
+
+function validateCiSkipTags(root: string, options: PackageTargetPolicyOptions): number {
+  let failures = 0;
+  for (const pkg of getWorkspacePackages(root)) {
+    const resolved = options.resolvedTargetsByProject?.get(pkg.projectName);
+    const resolvedTargets = resolved && 'targets' in resolved ? resolved.targets : resolved;
+    for (const tag of pkg.tags) {
+      if (tag !== 'ci:skip' && !tag.startsWith(ciSkipTagPrefix)) {
+        continue;
+      }
+      const target = tag.startsWith(ciSkipTagPrefix) ? tag.slice(ciSkipTagPrefix.length) : '';
+      if (!target || invalidCiSkipTargetSyntax.test(target)) {
+        console.error(`${pkg.path}: nx tag ${tag} must use ci:skip:<target> with one exact Nx target name`);
+        failures++;
+        continue;
+      }
+      if (resolvedTargets && !resolvedTargets.has(target)) {
+        console.error(`${pkg.path}: nx tag ${tag} names missing Nx target ${target}`);
+        failures++;
+      }
+    }
+  }
+  return failures;
+}
+
 // ---------------------------------------------------------------------------
 // Helpers kept in CLI (not Nx-specific)
 // ---------------------------------------------------------------------------

package/src/monorepo/packs/index.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'bun:test';
 import type { MonorepoPack } from './index.js';
-import { runValidatePacks } from './index.js';
+import { resolvedTargetsByProject, runValidatePacks } from './index.js';
 
 const ctx = { root: '/workspace', syncRuntime: false };
 
@@ -186,4 +186,21 @@ describe('monorepo validation pack phases', () => {
     expect(result).toEqual({ failures: 1, failedChecks: 1 });
     expect(events).toEqual(['pre-fix', 'build']);
   });
+
+  it('propagates parsed target dependencies through the production adapter', () => {
+    const targetDependencies = new Map([
+      ['build', ['compile-linux']],
+      ['compile-linux', ['package-linux']],
+    ]);
+
+    const resolved = resolvedTargetsByProject([
+      {
+        project: 'native',
+        targets: ['build', 'compile-linux', 'package-linux'],
+        targetDependencies,
+      },
+    ]);
+
+    expect(resolved.get('native')?.targetDependencies).toBe(targetDependencies);
+  });
 });

package/src/monorepo/packs/index.ts

@@ -1,7 +1,7 @@
 import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
-import { readProjectTargets } from '../../nx/index.js';
+import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateManagedFiles } from '../managed-files.js';
 import { fixNxSync, validateNxSync } from '../nx-sync.js';
@@ -400,14 +400,14 @@ function printCapturedOutput(output: CapturedOutput): void {
   }
 }
 
-async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<string, ResolvedProjectTargets>> {
-  const projects = await readProjectTargets(ctx.root);
+export function resolvedTargetsByProject(projects: ProjectTargets[]): Map<string, ResolvedProjectTargets> {
   return new Map(
     projects.map((project) => [
       project.project,
       {
         targets: new Set(project.targets),
         ...(project.buildDependsOn ? { buildDependsOn: project.buildDependsOn } : {}),
+        ...(project.targetDependencies ? { targetDependencies: project.targetDependencies } : {}),
         ...(project.targetExecutors ? { targetExecutors: project.targetExecutors } : {}),
         ...(project.targetScripts ? { targetScripts: project.targetScripts } : {}),
       },
@@ -415,6 +415,10 @@ async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<s
   );
 }
 
+async function readResolvedTargetsByProject(ctx: MonorepoContext): Promise<Map<string, ResolvedProjectTargets>> {
+  return resolvedTargetsByProject(await readProjectTargets(ctx.root));
+}
+
 function ensureLocalSmooShim(root: string): void {
   const shim = join(root, 'tooling', 'smoo');
   if (!existsSync(shim)) {