@smoothbricks/cli 0.10.2 → 0.10.4

package/src/lib/workspace.ts

@@ -1,7 +1,16 @@
 import { readdirSync, statSync } from 'node:fs';
 import { dirname, join, relative } from 'node:path';
 import { isSmoothBricksCodebasePackageName } from './cli-package.js';
-import { hasOwn, hasOwnString, isRecord, readJson, readJsonObject, stringProperty } from './json.js';
+import {
+  isPackageJson,
+  type PackageJson,
+  type PackageNxConfig,
+  type PackageRepository,
+  readJson,
+  readJsonObject,
+} from './json.js';
+
+export type { PackageJson, PackageNxConfig, PackageRepository };
 
 export interface PackageInfo {
   name: string;
@@ -11,7 +20,7 @@ export interface PackageInfo {
   tags: string[];
   path: string;
   packageJsonPath: string;
-  json: Record<string, unknown>;
+  json: PackageJson;
 }
 
 export interface WorkspacePackageManifest {
@@ -20,18 +29,7 @@ export interface WorkspacePackageManifest {
   private: boolean;
   path: string;
   packageJsonPath: string;
-  json: Record<string, unknown>;
-}
-
-export interface PackageJson extends Record<string, unknown> {
-  name?: string;
-  version?: string;
-  private?: boolean;
-  workspaces?: unknown;
-  devDependencies?: unknown;
-  dependencies?: unknown;
-  nx?: unknown;
-  repository?: unknown;
+  json: PackageJson;
 }
 
 export interface RepositoryInfo {
@@ -46,6 +44,8 @@ export const workspaceDependencyFields = [
   'optionalDependencies',
 ] as const;
 
+export type WorkspaceDependencyField = (typeof workspaceDependencyFields)[number];
+
 export function listPublicPackages(root: string): PackageInfo[] {
   return getWorkspacePackages(root).filter((pkg) => !pkg.private && pkg.tags.includes('npm:public'));
 }
@@ -54,26 +54,21 @@ export function listReleasePackages(
   root: string,
   rootPackage = readPackageJson(join(root, 'package.json')),
 ): PackageInfo[] {
-  if (!rootPackage) {
-    return [];
-  }
-  const rootRepository = repositoryInfo(rootPackage.json);
+  const rootRepository = rootPackage ? repositoryInfo(rootPackage.json) : null;
   if (!rootRepository) {
     return [];
   }
-  return getWorkspacePackagesForPatterns(root, getWorkspacePatternsFromPackageJson(rootPackage.json)).filter(
-    (pkg) => !pkg.private && pkg.tags.includes('npm:public') && isOwnedPackage(rootRepository, pkg),
-  );
+  return listPublicPackages(root).filter((pkg) => isOwnedPackage(rootRepository, pkg));
 }
 
 export function rootRepositoryInfo(root: string): RepositoryInfo | null {
-  const rootPackage = readJsonObject(join(root, 'package.json'));
-  return rootPackage ? repositoryInfo(rootPackage) : null;
+  const rootPackage = readPackageJson(join(root, 'package.json'));
+  return rootPackage ? repositoryInfo(rootPackage.json) : null;
 }
 
 export function rootPackageName(root: string): string | null {
   const rootPackage = readPackageJsonObject(join(root, 'package.json'));
-  return rootPackage ? stringProperty(rootPackage, 'name') : null;
+  return rootPackage?.name ?? null;
 }
 
 export function isSmoothBricksCodebase(root: string): boolean {
@@ -90,37 +85,23 @@ export function isOwnedPackage(rootRepository: RepositoryInfo, pkg: PackageInfo)
 }
 
 export function getWorkspacePackages(root: string): PackageInfo[] {
-  const rootPackage = readPackageJson(join(root, 'package.json'));
-  if (!rootPackage) {
-    throw new Error('package.json not found or invalid');
-  }
-  return getWorkspacePackagesForPatterns(root, getWorkspacePatternsFromPackageJson(rootPackage.json));
+  return getWorkspacePackagesForPatterns(root, getWorkspacePatterns(root));
 }
 
 export function getWorkspacePackageManifests(root: string): WorkspacePackageManifest[] {
-  const rootPackage = readPackageJsonObject(join(root, 'package.json'));
-  if (!rootPackage) {
-    throw new Error('package.json not found or invalid');
-  }
-  return getWorkspacePackageManifestsForPatterns(root, getWorkspacePatternsFromPackageJson(rootPackage));
+  return getWorkspacePackageManifestsForPatterns(root, getWorkspacePatterns(root));
 }
 
 function getWorkspacePackagesForPatterns(root: string, workspacePatterns: string[]): PackageInfo[] {
   const packages: PackageInfo[] = [];
-  for (const pkgPath of listWorkspacePackageJsonPaths(root, workspacePatterns)) {
-    const pkg = readPackageJson(pkgPath);
-    if (!pkg?.name || !pkg.version) {
+  for (const path of listWorkspacePackageJsonPaths(root, workspacePatterns)) {
+    const pkg = readPackageJson(path);
+    if (!pkg) {
       continue;
     }
     packages.push({
-      name: pkg.name,
-      projectName: pkg.projectName,
-      version: pkg.version,
-      private: pkg.private,
-      tags: pkg.tags,
-      path: relative(root, dirname(pkgPath)),
-      packageJsonPath: pkg.packageJsonPath,
-      json: pkg.json,
+      ...pkg,
+      path: relative(root, dirname(path)),
     });
   }
   return packages.sort((a, b) => a.name.localeCompare(b.name));
@@ -130,30 +111,42 @@ function getWorkspacePackageManifestsForPatterns(
   root: string,
   workspacePatterns: string[],
 ): WorkspacePackageManifest[] {
-  const manifests: WorkspacePackageManifest[] = [];
-  for (const pkgPath of listWorkspacePackageJsonPaths(root, workspacePatterns)) {
-    const pkg = readWorkspacePackageManifest(pkgPath);
-    if (pkg) {
-      manifests.push(pkg);
+  const packages: WorkspacePackageManifest[] = [];
+  for (const path of listWorkspacePackageJsonPaths(root, workspacePatterns)) {
+    const pkg = readWorkspacePackageManifest(path);
+    if (!pkg) {
+      continue;
     }
+    packages.push({
+      ...pkg,
+      path: relative(root, dirname(path)),
+    });
   }
-  return manifests.sort((a, b) => a.name.localeCompare(b.name));
+  return packages.sort((a, b) => a.name.localeCompare(b.name));
 }
 
 function listWorkspacePackageJsonPaths(root: string, workspacePatterns: string[]): string[] {
   const paths: string[] = [];
   for (const pattern of workspacePatterns) {
     if (!pattern.endsWith('/*')) {
-      paths.push(join(root, pattern, 'package.json'));
       continue;
     }
-
     const parent = join(root, pattern.slice(0, -2));
-    if (!statSync(parent, { throwIfNoEntry: false })?.isDirectory()) {
+    let entries: string[];
+    try {
+      entries = readdirSync(parent);
+    } catch {
       continue;
     }
-    for (const entry of readdirSync(parent)) {
-      paths.push(join(parent, entry, 'package.json'));
+    for (const entry of entries) {
+      const packageJsonPath = join(parent, entry, 'package.json');
+      try {
+        if (statSync(packageJsonPath).isFile()) {
+          paths.push(packageJsonPath);
+        }
+      } catch {
+        // skip missing package.json
+      }
     }
   }
   return paths;
@@ -162,7 +155,7 @@ function listWorkspacePackageJsonPaths(root: string, workspacePatterns: string[]
 export function listPackageJsonRecords(root: string): PackageInfo[] {
   const rootPackage = readPackageJson(join(root, 'package.json'));
   if (!rootPackage) {
-    throw new Error('package.json not found or invalid');
+    return getWorkspacePackages(root);
   }
   return [
     { ...rootPackage, path: '.' },
@@ -172,18 +165,16 @@ export function listPackageJsonRecords(root: string): PackageInfo[] {
 
 export function getWorkspacePatterns(root: string): string[] {
   const raw = readJson(join(root, 'package.json'));
-  return isRecord(raw) ? getWorkspacePatternsFromPackageJson(raw) : ['packages/*'];
+  const pkg = isPackageJson(raw) ? raw : null;
+  return pkg ? getWorkspacePatternsFromPackageJson(pkg) : ['packages/*'];
 }
 
-function getWorkspacePatternsFromPackageJson(pkg: Record<string, unknown>): string[] {
-  if (!hasOwn(pkg, 'workspaces')) {
-    return ['packages/*'];
-  }
+function getWorkspacePatternsFromPackageJson(pkg: PackageJson): string[] {
   const workspaces = pkg.workspaces;
   if (Array.isArray(workspaces)) {
     return workspaces.filter((entry): entry is string => typeof entry === 'string');
   }
-  if (isRecord(workspaces) && hasOwn(workspaces, 'packages') && Array.isArray(workspaces.packages)) {
+  if (workspaces && typeof workspaces === 'object' && Array.isArray(workspaces.packages)) {
     return workspaces.packages.filter((entry): entry is string => typeof entry === 'string');
   }
   return ['packages/*'];
@@ -191,17 +182,15 @@ function getWorkspacePatternsFromPackageJson(pkg: Record<string, unknown>): stri
 
 export function readPackageJson(path: string): PackageInfo | null {
   const parsed = readPackageJsonObject(path);
-  if (!isRecord(parsed) || !hasOwnString(parsed, 'name') || !hasOwnString(parsed, 'version')) {
+  if (!parsed?.name || !parsed.version) {
     return null;
   }
-  const privateValue = hasOwn(parsed, 'private') && typeof parsed.private === 'boolean' ? parsed.private : false;
-  const tags = getNxTags(parsed);
   return {
     name: parsed.name,
     projectName: packageNxProjectName(parsed),
     version: parsed.version,
-    private: privateValue,
-    tags,
+    private: parsed.private === true,
+    tags: getNxTags(parsed),
     path: dirname(path),
     packageJsonPath: path,
     json: parsed,
@@ -210,50 +199,48 @@ export function readPackageJson(path: string): PackageInfo | null {
 
 export function readWorkspacePackageManifest(path: string): WorkspacePackageManifest | null {
   const parsed = readPackageJsonObject(path);
-  if (!isRecord(parsed) || !hasOwnString(parsed, 'name')) {
+  if (!parsed?.name) {
     return null;
   }
-  const privateValue = hasOwn(parsed, 'private') && typeof parsed.private === 'boolean' ? parsed.private : false;
   return {
     name: parsed.name,
     projectName: packageNxProjectName(parsed),
-    private: privateValue,
+    private: parsed.private === true,
     path: dirname(path),
     packageJsonPath: path,
     json: parsed,
   };
 }
 
-function packageNxProjectName(pkg: Record<string, unknown>): string {
-  const nx = isRecord(pkg.nx) ? pkg.nx : null;
-  return (nx ? stringProperty(nx, 'name') : null) ?? stringProperty(pkg, 'name') ?? '';
+function packageNxProjectName(pkg: PackageJson): string {
+  return pkg.nx?.name ?? pkg.name ?? '';
 }
 
 export function readPackageJsonObject(path: string): PackageJson | null {
-  const parsed = readJsonObject(path);
-  return parsed;
+  return readJsonObject(path);
 }
 
-export function getNxTags(pkg: Record<string, unknown>): string[] {
-  if (!hasOwn(pkg, 'nx') || !isRecord(pkg.nx) || !hasOwn(pkg.nx, 'tags') || !Array.isArray(pkg.nx.tags)) {
+export function getNxTags(pkg: PackageJson): string[] {
+  const tags = pkg.nx?.tags;
+  if (!Array.isArray(tags)) {
     return [];
   }
-  return pkg.nx.tags.filter((tag): tag is string => typeof tag === 'string');
+  return tags.filter((tag): tag is string => typeof tag === 'string');
 }
 
-export function repositoryInfo(pkg: Record<string, unknown>): RepositoryInfo | null {
+export function repositoryInfo(pkg: PackageJson): RepositoryInfo | null {
   const repository = pkg.repository;
   if (typeof repository === 'string') {
     return { type: 'git', url: repository };
   }
-  if (!isRecord(repository)) {
+  if (!repository || typeof repository !== 'object') {
     return null;
   }
-  const url = stringProperty(repository, 'url');
+  const url = repository.url;
   if (!url) {
     return null;
   }
-  return { type: stringProperty(repository, 'type') ?? 'git', url };
+  return { type: repository.type ?? 'git', url };
 }
 
 export function sameRepositoryAfterNormalization(left: string, right: string): boolean {
@@ -261,25 +248,26 @@ export function sameRepositoryAfterNormalization(left: string, right: string): b
 }
 
 function normalizedRepositoryUrl(url: string): string {
-  const trimmed = url
-    .trim()
-    .replace(/^git\+/, '')
-    .replace(/#.*$/, '')
-    .replace(/\/$/, '')
-    .replace(/\.git$/, '');
-  const https = /^https:\/\/github\.com\/([^/]+)\/([^/]+)$/i.exec(trimmed);
-  if (https?.[1] && https[2]) {
-    return githubRepositoryKey(https[1], https[2]);
-  }
-  const ssh = /^git@github\.com:([^/]+)\/([^/]+)$/i.exec(trimmed);
-  if (ssh?.[1] && ssh[2]) {
-    return githubRepositoryKey(ssh[1], ssh[2]);
+  const trimmed = url.trim().replace(/\.git$/i, '');
+  const ssh = /^git@github\.com:(.+)$/i.exec(trimmed);
+  if (ssh?.[1]) {
+    const [owner, repo] = ssh[1].split('/');
+    if (owner && repo) {
+      return githubRepositoryKey(owner, repo);
+    }
   }
-  const shorthand = /^github:([^/]+)\/([^/]+)$/i.exec(trimmed);
-  if (shorthand?.[1] && shorthand[2]) {
-    return githubRepositoryKey(shorthand[1], shorthand[2]);
+  try {
+    const parsed = new URL(trimmed.includes('://') ? trimmed : `https://${trimmed}`);
+    if (parsed.hostname.replace(/^www\./i, '').toLowerCase() === 'github.com') {
+      const [owner, repo] = parsed.pathname.replace(/^\//, '').split('/');
+      if (owner && repo) {
+        return githubRepositoryKey(owner, repo);
+      }
+    }
+  } catch {
+    // fall through
   }
-  return trimmed;
+  return trimmed.toLowerCase();
 }
 
 function githubRepositoryKey(owner: string, repo: string): string {

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -17,14 +17,14 @@ describe('CI workflow definition', () => {
     const steps = defineCiWorkflow({ deploy: true, pushBranches: ['main'] });
     const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
 
-    expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 9]);
+    expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
     expect(rendered).toContain('- name: 🚀 Deploy Staging');
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
     expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 9',
+      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
     );
-    expect(rendered).toContain("# Step 10\n      # Nx's database cache needs artifact files");
+    expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
   });
 
   it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
@@ -33,4 +33,15 @@ describe('CI workflow definition', () => {
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
   });
+
+  it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {
+    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const packageRoot = join(import.meta.dir, '..', '..', '..');
+    const restoreAction = await readFile(join(packageRoot, '..', '..', '.github/actions/cache-nx/action.yml'), 'utf8');
+    const restoreKey = restoreAction.match(/^\s*key: (.+)$/m)?.[1];
+    const saveKey = rendered.match(/^\s*key: (.+)$/m)?.[1];
+
+    expect(restoreKey).toBe('${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}');
+    expect(saveKey).toBe(restoreKey);
+  });
 });

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -3,6 +3,12 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
+import {
+  LINUX_PLATFORM_TARGET_GLOBS,
+  MACOS_PLATFORM_TARGET_GLOBS,
+  PLATFORM_TARGET_GLOBS,
+} from '@smoothbricks/nx-plugin/workspace-config-policy';
+import { format } from 'prettier';
 import {
   definePublishWorkflow,
   type PublishWorkflowBump,
@@ -15,13 +21,208 @@ import {
 
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
-    const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,
     );
   });
 
+  it('renders workflow bytes that are stable under the repository Prettier config', async () => {
+    const rendered = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+
+    await expect(
+      format(rendered, {
+        parser: 'yaml',
+        printWidth: 120,
+        proseWrap: 'always',
+      }),
+    ).resolves.toBe(rendered);
+  });
+
+  it('preserves the single Ubuntu job and renders no artifact transfer when no Apple targets exist', () => {
+    const current = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const explicitlyEmpty = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: [],
+    });
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+
+    expect(explicitlyEmpty).toBe(current);
+    for (const rendered of [current, linuxOnly]) {
+      const jobsYaml = rendered.slice(rendered.indexOf('jobs:\n') + 'jobs:\n'.length);
+      expect(jobsYaml).toContain('  publish:\n    runs-on: ubuntu-latest');
+      expect(jobsYaml.match(/^ {2}[a-z][a-z-]+:\n/gm)).toHaveLength(1);
+      expect(rendered).not.toContain('linux-release-candidate:');
+      expect(rendered).not.toContain('macos-platform:');
+      expect(rendered).not.toContain('publish-on-linux:');
+      expect(rendered).not.toContain('--collect-outputs');
+      expect(rendered).not.toContain('Upload validated release state');
+      expect(rendered).not.toContain('Upload validated build outputs');
+      expect(rendered).not.toContain('Upload supplemental Linux outputs');
+      expect(rendered).not.toContain('Upload macOS platform outputs');
+      expect(rendered).not.toContain('actions/download-artifact');
+      expect(rendered).not.toContain('apply-outputs');
+      expect(rendered).not.toContain('git bundle');
+    }
+  });
+
+  it('keeps job-local deeplink step anchors exact for single-job and parallel platform workflows', () => {
+    const singleJob = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+    const platform = renderPublishWorkflowYaml({
+      deploy: true,
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = platform.slice(
+      platform.indexOf('  linux-release-candidate:'),
+      platform.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = platform.slice(
+      platform.indexOf('  macos-platform:'),
+      platform.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = platform.slice(platform.indexOf('  publish-on-linux:'));
+
+    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 7 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
+    expect(singleJob).toContain('# Step 14\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
+    expect(singleJob).toContain('# Step 15\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 7\n      - name: 🔒 Capture candidate release SHA');
+    expect(linuxCandidate).toContain(
+      '# Step 8\n      - name: ✅ Check managed monorepo files (${{ steps.version.outputs.mode }})',
+    );
+    expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(macosPlatform).toContain('# Step 5\n      - name: 🍎 Build selected macOS and iOS release outputs');
+    expect(macosPlatform).toContain('# Step 7\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(finalJob).toContain('# Step 7\n      - name: 🧯 Repair pending releases');
+    expect(finalJob).toContain('# Step 8\n      - name: ♻️ Restore validated release state');
+    expect(finalJob).toContain('# Step 9\n      - name: 📦 Apply verified Linux outputs');
+    expect(finalJob).toContain('# Step 10\n      - name: 🍎 Apply verified macOS outputs');
+    expect(finalJob).toContain(
+      '# Step 12\n      - name: 📦 Publish release (${{ needs.linux-release-candidate.outputs.mode }})',
+    );
+    expect(finalJob).toContain('# Step 13\n      - name: 🚀 Deploy production');
+    expect(finalJob).toContain('# Step 14\n      - name: 🧹 Cleanup and cache Nix/devenv');
+  });
+
+  it('renders parallel native producers and a dependent publish-only final job', () => {
+    const linuxOnly = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: LINUX_PLATFORM_TARGET_GLOBS,
+    });
+    const native = renderPublishWorkflowYaml({
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = native.slice(
+      native.indexOf('  linux-release-candidate:'),
+      native.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = native.slice(native.indexOf('  macos-platform:'), native.indexOf('  publish-on-linux:'));
+    const finalJob = native.slice(native.indexOf('  publish-on-linux:'));
+
+    expect(linuxOnly).not.toContain('macos-platform:');
+    expect(linuxOnly).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
+    expect(linuxCandidate).not.toContain('needs:');
+    expect(macosPlatform).not.toContain('needs:');
+    expect(linuxCandidate).not.toContain('smoo release repair-pending');
+    expect(linuxCandidate).toContain('smoo release version');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets build --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets lint --projects');
+    expect(linuxCandidate).toContain('smoo github-ci nx-run-many --targets test --projects');
+    expect(linuxCandidate).toContain(
+      `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
+    );
+    expect(macosPlatform).not.toContain('smoo github-ci nx-run-many');
+    expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
+      `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
+        ',',
+      )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
+    );
+    expect(finalJob).not.toContain('smoo release version');
+    expect(finalJob).not.toContain('nx-run-many');
+    expect(foldedRunCommand(finalJob, '🧯 Repair pending releases')).toBe(
+      'smoo release repair-pending --ref "${{ github.sha }}" --platform-outputs ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/repairs" ' +
+        '--dry-run "${{ inputs.dry_run }}"',
+    );
+    expect(native).toContain('uses: actions/upload-artifact@v7.0.1');
+    expect(native).toContain('uses: actions/download-artifact@v8.0.1');
+    expect(native).toContain('name: publish-release-state-${{ github.run_id }}');
+    expect(native).toContain('name: publish-release-outputs-${{ github.run_id }}');
+    expect(native).toContain('name: publish-linux-outputs-${{ github.run_id }}');
+    expect(native.match(/include-hidden-files: true/g)).toHaveLength(4);
+    expect(native).toContain('name: publish-macos-outputs-${{ github.run_id }}');
+    expect(native).toContain('git bundle create');
+    expect(native).toContain('git fetch "${{ runner.temp }}/publish-artifacts/publish-release-state-');
+    expect(finalJob).toContain(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}"',
+    );
+    expect(finalJob).toContain('smoo github-ci apply-outputs --source-sha "${{ github.sha }}"');
+    expect(foldedRunCommand(finalJob, '📦 Apply verified Linux outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ needs.linux-release-candidate.outputs.release-sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-release-outputs-${{ github.run_id }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-linux-outputs-${{ github.run_id }}"',
+    );
+    expect(foldedRunCommand(finalJob, '🍎 Apply verified macOS outputs')).toBe(
+      'smoo github-ci apply-outputs --source-sha "${{ github.sha }}" ' +
+        '"${{ runner.temp }}/publish-artifacts/publish-macos-outputs-${{ github.run_id }}/current"',
+    );
+  });
+
+  it('limits trusted publishing permission to final publish and preserves mode, deploy, and dry-run gates', () => {
+    const rendered = renderPublishWorkflowYaml({
+      deploy: true,
+      deployProvider: 'cloudflare',
+      repoName: '@smoothbricks/codebase',
+      platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    });
+    const linuxCandidate = rendered.slice(
+      rendered.indexOf('  linux-release-candidate:'),
+      rendered.indexOf('  macos-platform:'),
+    );
+    const macosPlatform = rendered.slice(
+      rendered.indexOf('  macos-platform:'),
+      rendered.indexOf('  publish-on-linux:'),
+    );
+    const finalJob = rendered.slice(rendered.indexOf('  publish-on-linux:'));
+
+    expect(linuxCandidate).toContain('id-token: none');
+    expect(macosPlatform).toContain('id-token: none');
+    expect(finalJob).toContain('id-token: write');
+    expect(rendered.match(/id-token: write/g)).toHaveLength(1);
+    expect(finalJob.indexOf('🧯 Repair pending releases')).toBeLessThan(
+      finalJob.indexOf('♻️ Restore validated release state'),
+    );
+    expect(finalJob.indexOf('♻️ Restore validated release state')).toBeGreaterThan(
+      finalJob.indexOf('🧱 Setup Nix/devenv'),
+    );
+    expect(rendered).not.toContain('GITHUB_SHA:');
+    expect(finalJob).toContain("needs.linux-release-candidate.outputs.mode != 'none'");
+    expect(finalJob).toContain("inputs.deploy_environment == 'production'");
+    expect(finalJob).toContain("inputs.dry_run != 'true'");
+    expect(finalJob).toContain('smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"');
+    expect(finalJob).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(finalJob).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+
   it('does not wire npm token secrets into repair or publish steps', () => {
     const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
 
@@ -384,6 +585,26 @@ class WorkflowScenarioState {
   }
 }
 
+function stepAnchorNumbers(yaml: string): number[] {
+  return [...yaml.matchAll(/^\s*# Step (\d+)/gm)].map((match) => Number(match[1]));
+}
+
+function foldedRunCommand(yaml: string, stepName: string): string {
+  const stepStart = yaml.indexOf(`- name: ${stepName}`);
+  expect(stepStart).toBeGreaterThanOrEqual(0);
+  const runMarker = '        run:\n';
+  const runStart = yaml.indexOf(runMarker, stepStart);
+  expect(runStart).toBeGreaterThan(stepStart);
+  const commandLines: string[] = [];
+  for (const line of yaml.slice(runStart + runMarker.length).split('\n')) {
+    if (!line.startsWith('          ')) {
+      break;
+    }
+    commandLines.push(line.trim());
+  }
+  return commandLines.join(' ');
+}
+
 function packageNameFromTag(tag: string): string {
   const versionSeparator = tag.lastIndexOf('@');
   if (versionSeparator <= 0) {