@smoothbricks/cli 0.10.4 → 0.10.6

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -1,44 +1,71 @@
 name: Setup Nix/devenv
-description: Restore caches and build the SmoothBricks devenv shell after checkout.
+description: >
+  Build the SmoothBricks devenv shell after checkout. Restores the small devenv/direnv actions/cache segment on every
+  runner (eval SQLite + shell scripts). On GARM/NixOS (NIX_REMOTE=daemon + /var/cache/ci) skips Nix install and the
+  large store NAR (host store). On ubuntu/macOS installs Nix and restores the NAR/profile cache.
 
 outputs:
   nix-cache-hit:
     description: Whether the Nix profile/store cache restored from the exact primary key.
-    value: ${{ steps.nix-cache.outputs.cache-hit }}
+    value: ${{ steps.nix-cache.outputs.cache-hit || 'false' }}
   devenv-cache-hit:
     description: Whether the devenv/direnv cache restored from the exact primary key.
-    value: ${{ steps.devenv-cache.outputs.cache-hit }}
+    value: ${{ steps.devenv-cache.outputs.cache-hit || 'false' }}
+  host-runner:
+    description: Whether this job is on a host-nix runner (GARM) with shared store/caches.
+    value: ${{ steps.runner-kind.outputs.host }}
 
 runs:
   using: composite
   steps:
     # This action is intentionally post-checkout only. Repo-local actions do not
     # exist before actions/checkout has populated the working tree.
+
+    # Runner image/profile owns paths (NIX_REMOTE, /var/cache/ci/*). Detect here
+    # so every workflow can `uses: setup-devenv` without forking step graphs.
+    - name: 🔎 Runner kind
+      id: runner-kind
+      shell: bash
+      run: |
+        if [ "${NIX_REMOTE:-}" = daemon ] && [ -d /var/cache/ci ]; then
+          echo "host=true" >> "$GITHUB_OUTPUT"
+          echo "host-nix runner (shared store + /var/cache/ci)"
+        else
+          echo "host=false" >> "$GITHUB_OUTPUT"
+          echo "ephemeral runner (install Nix + GH caches)"
+        fi
+
+    # Devenv segment (own key): tooling/direnv/.devenv + .direnv — includes
+    # nix-eval-cache.db. Independent of the nix NAR; restore on host and ephemeral
+    # whether or not the store cache hit. Missing store paths are fine: devenv
+    # verifies shell drv/out exist on eval-cache hit and invalidates + re-evals
+    # / realizes when GC removed them. Packages still come from host store, NAR,
+    # or Cachix — this blob only skips evaluation.
+    - name: 🧊 Cache devenv and direnv
+      id: devenv-cache
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: devenv
+
     - name: ❄️ Install Nix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: DeterminateSystems/determinate-nix-action@v3
 
     - name: 🧊 Cache Nix profiles and store NAR
       id: nix-cache
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: nix
 
     - name: ♻️ Restore Nix store from NAR
+      if: steps.runner-kind.outputs.host != 'true'
       shell: bash
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh restore-store
 
-    # Restore direnv state only when the Nix cache key is exact. Partial Nix
-    # restores can contain a NAR for a different shell closure, and .direnv
-    # points directly at derivations inside that closure.
-    - name: 🧊 Cache devenv and direnv
-      id: devenv-cache
-      if: ${{ steps.nix-cache.outputs.cache-hit == 'true' }}
-      uses: ./.github/actions/cache-nix-devenv
-      with:
-        segment: devenv
-
     - name: ⚡ Enable Cachix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: cachix/cachix-action@v17
       with:
         name: devenv
@@ -48,12 +75,14 @@ runs:
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh install-devenv
 
+    # node_modules + ttsc plugin binaries: GH Actions cache on ephemeral runners.
+    # Host runners keep those under the /var/cache/ci bind (bun / ttsc env).
     - name: 📦 Cache node_modules
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-node-modules
 
-    # Restores compiled ttsc native plugins into .cache/ttsc/plugins. TTSC_CACHE_DIR
-    # is set by devenv enterShell (+ bootstrap GITHUB_ENV for later steps).
     - name: 🧊 Cache ttsc plugins
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-ttsc-plugins
 
     - name: 🐚 Build devenv shell

package/managed/templates/github/workflows/managed-files.yml

@@ -9,10 +9,17 @@
 # change is upstream code that deserves a human look before it lands. Re-runs
 # refresh the same branch in place.
 #
-# NOTE: managed files include .github/workflows/*, and the default GITHUB_TOKEN
-# is server-side forbidden to push workflow-file changes. Configure a GitHub App
-# or PAT token with contents:write + workflows:write as MANAGED_FILES_TOKEN;
-# without it, runs that touch workflow files fail at push with a clear error.
+# REQUIRED SECRET: MANAGED_FILES_TOKEN
+# Managed files include .github/workflows/*. The default GITHUB_TOKEN is
+# server-side forbidden to create/update workflow files, even with
+# contents:write. Configure a GitHub App installation token or classic/fine-
+# grained PAT with:
+#   - contents: write
+#   - pull-requests: write
+#   - workflows: write
+# as repository secret MANAGED_FILES_TOKEN. Without it, any update that
+# touches workflow YAML fails at push (this is the usual "managed files
+# workflow isn't doing anything" failure mode).
 name: Managed files
 
 on:
@@ -41,6 +48,7 @@ jobs:
           filter: blob:none
           fetch-depth: 0
           persist-credentials: true
+          # Prefer MANAGED_FILES_TOKEN so push can update workflow files.
           token: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
 
       - name: 🧱 Setup Nix/devenv
@@ -53,27 +61,71 @@ jobs:
       - name: 📤 Push review branch and open PR
         env:
           GH_TOKEN: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
+          # secrets.* is empty when unset — used to fail before a useless push.
+          MANAGED_FILES_TOKEN_CONFIGURED: ${{ secrets.MANAGED_FILES_TOKEN != '' }}
         run: |
+          set -euo pipefail
           cd "$(git rev-parse --show-toplevel)"
+
           if [ -z "$(git status --porcelain)" ]; then
             echo "Managed files are in sync; nothing to do."
             exit 0
           fi
+
+          echo "Pending managed-file changes:"
+          git status --porcelain
+
+          workflow_changes="$(git status --porcelain -- .github/workflows || true)"
+          if [ -n "$workflow_changes" ] && [ "${MANAGED_FILES_TOKEN_CONFIGURED}" != "true" ]; then
+            {
+              echo "::error title=MANAGED_FILES_TOKEN required::Managed update touches .github/workflows/* but repository secret MANAGED_FILES_TOKEN is not set."
+              echo ""
+              echo "GitHub refuses pushes that create/update workflow files when the credentials are the default GITHUB_TOKEN / a GitHub App without the workflows permission:"
+              echo "  refusing to allow a GitHub App to create or update workflow ... without \`workflows\` permission"
+              echo ""
+              echo "Fix:"
+              echo "  1. Create a GitHub App (or PAT) with contents:write, pull-requests:write, workflows:write"
+              echo "  2. Install it on this repo"
+              echo "  3. Store an installation token or PAT as repository secret MANAGED_FILES_TOKEN"
+              echo "  4. Re-run this workflow"
+              echo ""
+              echo "Workflow files that would be updated:"
+              echo "$workflow_changes"
+            } >&2
+            exit 1
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git switch -C chore/managed-files
           git add -A
           git commit -m "chore: regenerate smoo-managed files"
-          git push --force origin chore/managed-files
-          gh pr create \
-            --head chore/managed-files \
-            --base "${GITHUB_REF_NAME}" \
-            --title "chore: regenerate smoo-managed files" \
-            --body "Automated refresh of smoo-managed files after drift (usually a @smoothbricks/cli pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes - do NOT enable auto-merge." \
-            2>/dev/null || echo "PR already open; branch refreshed in place."
+
+          if ! git push --force origin chore/managed-files 2> /tmp/managed-files-push.err; then
+            cat /tmp/managed-files-push.err >&2
+            if grep -q 'workflows' /tmp/managed-files-push.err; then
+              {
+                echo ""
+                echo "::error title=workflows permission missing::Push rejected because the token cannot update GitHub Actions workflow files."
+                echo "Set repository secret MANAGED_FILES_TOKEN to a GitHub App/PAT with contents:write + pull-requests:write + workflows:write, then re-run."
+              } >&2
+            fi
+            exit 1
+          fi
+
+          if ! gh pr view chore/managed-files --json number --jq .number >/dev/null 2>&1; then
+            gh pr create \
+              --head chore/managed-files \
+              --base "${GITHUB_REF_NAME}" \
+              --title "chore: regenerate smoo-managed files" \
+              --body "Automated refresh of smoo-managed files after drift (usually a \`@smoothbricks/cli\` pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes — do NOT enable auto-merge."
+          else
+            echo "PR already open for chore/managed-files; branch refreshed in place."
+          fi
 
       - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
+        # success() is default; always() still saves GH Nix cache after a red job.
+        if: always()
         uses: ./.github/actions/save-nix-devenv
         with:
           nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.4",
+  "version": "0.10.6",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
     "@prettier/sync": "^0.6.1",
-    "@smoothbricks/nx-plugin": "0.3.3",
+    "@smoothbricks/nx-plugin": "0.3.4",
     "@smoothbricks/validation": "0.1.4",
     "commander": "^14.0.3",
     "prettier": "^3.6.1",

package/src/cli.ts

@@ -59,18 +59,18 @@ function buildProgram(): Command {
     );
   monorepo.command('update').action(async () => {
     const { updateManagedFiles } = await import('./monorepo/index.js');
-    updateManagedFiles(await findRepoRoot());
+    await updateManagedFiles(await findRepoRoot());
   });
   monorepo
     .command('check')
     .option('--warn', 'report drift as warnings (GitHub annotations) instead of failing')
     .action(async (options: { warn?: boolean }) => {
       const { checkManagedFiles } = await import('./monorepo/index.js');
-      checkManagedFiles(await findRepoRoot(), { warn: options.warn });
+      await checkManagedFiles(await findRepoRoot(), { warn: options.warn });
     });
   monorepo.command('diff').action(async () => {
     const { diffManagedFiles } = await import('./monorepo/index.js');
-    diffManagedFiles(await findRepoRoot());
+    await diffManagedFiles(await findRepoRoot());
   });
   monorepo
     .command('validate-commit-msg <commitMsgFile>')
@@ -84,12 +84,12 @@ function buildProgram(): Command {
     .option('--stage', 'stage bun.lock when versions were resynced; quiet when clean')
     .option(
       '--mode <mode>',
-      'install: match package.json (CI); publish: map unpublished -next to last stable tag (pre-pack)',
-      'publish',
+      'install: match package.json (default, CI); publish: map unpublished -next to last stable tag (pre-pack only)',
+      'install',
     )
     .action(async (options: { stage?: boolean; mode?: 'install' | 'publish' }) => {
       const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-      const mode = options.mode === 'install' ? 'install' : 'publish';
+      const mode = options.mode === 'publish' ? 'publish' : 'install';
       syncBunLockfileVersions(await findRepoRoot(), {
         mode,
         ...(options.stage ? { log: false, stage: true } : {}),

package/src/github-ci/index.test.ts

@@ -38,7 +38,7 @@ describe('GitHub CI Nx target expansion', () => {
       ['test', ['api', 'desktop']],
     ]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=5'],
+      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=100%'],
     ]);
   });
 
@@ -65,7 +65,7 @@ describe('GitHub CI Nx target expansion', () => {
 
     expect(expanded.unmatchedGlobs).toEqual([]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'missing', '--projects=api', '--parallel=5'],
+      ['run-many', '-t', 'missing', '--projects=api', '--parallel=100%'],
     ]);
   });
 
@@ -114,7 +114,7 @@ describe('GitHub CI Nx target expansion', () => {
       '-t',
       'test',
       '--exclude=tag:ci:skip:test',
-      '--parallel=5',
+      '--parallel=100%',
     ]);
     expect(nxRunManyArgs({ target: 'test', projects: projects.slice(0, 1) })).not.toContain(
       '--exclude=tag:ci:skip:test',

package/src/github-ci/index.ts

@@ -27,6 +27,9 @@ const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDep
 
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
+/** Nx workers = host cores (CI runners sized for full machine use). */
+const NX_PARALLEL = '100%';
+
 export async function cleanupGithubCiCache(root: string): Promise<void> {
   const githubOutput = process.env.GITHUB_OUTPUT;
   const markCacheReady = async (ready: boolean): Promise<void> => {
@@ -139,7 +142,7 @@ export function nxSmartArgs(target: string, mode: 'affected' | 'run-many', confi
   if (configuration) {
     args.push(`--configuration=${configuration}`);
   }
-  args.push(`--exclude=tag:ci:skip:${target}`, '--parallel=5');
+  args.push(`--exclude=tag:ci:skip:${target}`, `--parallel=${NX_PARALLEL}`);
   return args;
 }
 
@@ -262,7 +265,7 @@ export function nxRunManyArgs(run: NxTargetRun, configuration?: string): string[
   if (configuration) {
     nxArgs.push(`--configuration=${configuration}`);
   }
-  nxArgs.push('--parallel=5');
+  nxArgs.push(`--parallel=${NX_PARALLEL}`);
   return nxArgs;
 }
 
@@ -343,7 +346,7 @@ export async function githubCiNxDeploy(
   const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
   for (const target of targets) {
-    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, '--parallel=5'];
+    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, `--parallel=${NX_PARALLEL}`];
     if (target === 'deploy') {
       nxArgs.push(`--configuration=${options.configuration}`);
     }

package/src/lib/json.ts

@@ -23,6 +23,8 @@ export interface PackagePublishConfig {
 
 export interface PackageSmooGithub {
   pushBranches?: string[];
+  /** GitHub Actions runs-on for managed CI (string or label list). Default: ubuntu-latest. */
+  runsOn?: string | string[];
 }
 
 export interface PackageSmooConfig {
@@ -52,6 +54,8 @@ export interface PackageJson {
   devDependencies?: StringMap;
   peerDependencies?: StringMap;
   optionalDependencies?: StringMap;
+  /** Bun patchedDependencies map (package@version → patch path). */
+  patchedDependencies?: StringMap;
   engines?: StringMap;
   scripts?: StringMap;
   publishConfig?: PackagePublishConfig;
@@ -165,7 +169,7 @@ export function ensureScripts(pkg: PackageJson): StringMap {
 /** Ensure package.json.dependencies (or other string-map dep field) exists. */
 export function ensureDependencyMap(
   pkg: PackageJson,
-  key: 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies',
+  key: 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies' | 'patchedDependencies',
 ): StringMap {
   const current = pkg[key];
   if (isStringMap(current)) {

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -5,9 +5,15 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('CI workflow definition', () => {
   it('renders the checked-in local CI workflow copy', async () => {
-    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
 
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
@@ -25,6 +31,13 @@ describe('CI workflow definition', () => {
       'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
     );
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    expect(rendered).toContain('runs-on: ubuntu-latest');
   });
 
   it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
@@ -44,4 +57,27 @@ describe('CI workflow definition', () => {
     expect(restoreKey).toBe('${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}');
     expect(saveKey).toBe(restoreKey);
   });
+
+  it('nixos config: fork PRs on ubuntu; one setup-devenv (composite owns host path)', () => {
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
+
+    expect(rendered).toContain(
+      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}",
+    );
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).not.toContain('determinate-nix-action');
+    expect(rendered).toContain('if: always()');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    // workflow yaml does not embed composite internals
+    expect(rendered).not.toContain('cache-node-modules');
+    expect(rendered).not.toContain('cache-ttsc-plugins');
+  });
 });

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -19,11 +19,14 @@ import {
   runPublishWorkflow,
 } from '../publish-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
@@ -35,6 +38,7 @@ describe('publish workflow definition', () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
 
     await expect(
@@ -125,6 +129,7 @@ describe('publish workflow definition', () => {
     const native = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const linuxCandidate = native.slice(
       native.indexOf('  linux-release-candidate:'),
@@ -137,8 +142,9 @@ describe('publish workflow definition', () => {
     expect(linuxOnly).toContain(
       `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
     );
-    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  linux-release-candidate:');
     expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:');
     expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
     expect(linuxCandidate).not.toContain('needs:');
     expect(macosPlatform).not.toContain('needs:');
@@ -612,3 +618,24 @@ function packageNameFromTag(tag: string): string {
   }
   return tag.slice(0, versionSeparator);
 }
+
+it('linux publish jobs use smoo.github.runsOn; macOS stays macos-latest', () => {
+  const rendered = renderPublishWorkflowYaml({
+    repoName: '@smoothbricks/codebase',
+    platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    runsOn: [...nixosRunsOn],
+  });
+  expect(rendered).toContain(
+    `runs-on:
+      \${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      fromJSON('["nixos-latest-x64","self-hosted"]') || 'ubuntu-latest' }}`,
+  );
+  expect(rendered).toContain('  macos-platform:\n    runs-on: macos-latest');
+  // Only the pre-publish linux job runs on self-hosted
+  expect(rendered.split('fromJSON(\'["nixos-latest-x64","self-hosted"]\')').length - 1).toBe(1);
+  expect(rendered).not.toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+  // NPM publishing happens from GitHub runner
+  expect(rendered).toContain(
+    '  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]\n    runs-on: ubuntu-latest',
+  );
+});

package/src/monorepo/ci-workflow.ts

@@ -1,5 +1,7 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
 
+import { renderRunsOnLine } from './github-runs-on.js';
+
 export enum CiWorkflowStepKind {
   Checkout = 'checkout',
   SetupDevenv = 'setup-devenv',
@@ -26,6 +28,8 @@ export interface CiWorkflowDefinitionOptions {
   deploy: boolean;
   deployProvider?: 'cloudflare';
   pushBranches: string[];
+  /** Default ubuntu-latest when omitted. */
+  runsOn?: string | string[];
 }
 
 type CiWorkflowStepInput = Omit<CiWorkflowStep, 'number'>;
@@ -80,7 +84,7 @@ defaults:
 jobs:
   main:
     name: Validate
-    runs-on: ubuntu-latest
+${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 45
     env:
       NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
@@ -150,7 +154,10 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         '          fetch-depth: 0',
       ];
     case CiWorkflowStepKind.SetupDevenv:
+      // One step everywhere. setup-devenv detects host-nix (GARM) vs ephemeral
+      // and skips GH install/cache steps internally — same for ci/publish/managed.
       return [`      - name: ${step.name}`, '        id: setup', '        uses: ./.github/actions/setup-devenv'];
+
     case CiWorkflowStepKind.SetNxShas:
       return [
         `      - name: ${step.name}`,
@@ -184,7 +191,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
       // recursion guard, so the default token suffices.
       return [
         `      - name: ${step.name}`,
-        "        if: ${{ steps.managed-drift.outputs.drifted != '' && steps.managed-drift.outputs.drifted != '0' }}",
+        "        if: steps.managed-drift.outputs.drifted != '' && steps.managed-drift.outputs.drifted != '0'",
         '        run: gh workflow run managed-files.yml --ref "$GITHUB_REF_NAME"',
       ];
     case CiWorkflowStepKind.Deploy:
@@ -212,7 +219,8 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.UploadTraceDbs:
       return [
         `      - name: ${step.name}`,
-        '        if: ${{ always() }}',
+        '        # success() is the default; always() keeps traces after a red build/test.',
+        '        if: always()',
         '        uses: actions/upload-artifact@v7.0.1',
         '        with:',
         '          name: trace-results-${{ github.run_id }}',
@@ -224,7 +232,9 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.SaveNixDevenv:
       return [
         `      - name: ${step.name}`,
-        '        if: ${{ always() }}',
+        '        # always() still saves after a red job. Nix NAR is ephemeral-only;',
+        '        # devenv eval-cache also saves on host-nix when setup missed.',
+        '        if: always()',
         '        uses: ./.github/actions/save-nix-devenv',
         '        with:',
         '          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}',

package/src/monorepo/github-runs-on.ts

@@ -0,0 +1,45 @@
+/** Shared `runs-on:` emission for generated GitHub workflow YAML. */
+
+export type WorkflowRunsOn = string | string[] | undefined;
+
+export function isNixosRunner(runsOn: WorkflowRunsOn): boolean {
+  const labels = runsOn === undefined ? [] : typeof runsOn === 'string' ? [runsOn] : runsOn;
+  return labels.some((label) => label === 'nixos' || label.startsWith('nixos-'));
+}
+
+/**
+ * Trusted jobs use configured nixos self-hosted labels; fork PRs stay on
+ * ubuntu-latest (no access to the private runner fleet).
+ */
+export function githubUsesNixosRunnerExpr(): string {
+  return "(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)";
+}
+
+/**
+ * Full `    runs-on: …` line(s), indented for a job under `jobs.<id>:`.
+ * Nixos labels emit the multiline prettier-stable fork-gate expression.
+ */
+export function renderRunsOnLine(runsOn: WorkflowRunsOn): string {
+  if (!isNixosRunner(runsOn)) {
+    let value: string;
+    if (runsOn === undefined) {
+      value = 'ubuntu-latest';
+    } else if (typeof runsOn === 'string') {
+      value = runsOn.length > 0 ? runsOn : 'ubuntu-latest';
+    } else if (runsOn.length === 0) {
+      value = 'ubuntu-latest';
+    } else if (runsOn.length === 1) {
+      value = runsOn[0] ?? 'ubuntu-latest';
+    } else {
+      value = `[${runsOn.map((label) => `'${label}'`).join(', ')}]`;
+    }
+    return `    runs-on: ${value}`;
+  }
+
+  const labels = typeof runsOn === 'string' ? [runsOn] : runsOn;
+  // Multiline matches prettier so checked-in workflows stay byte-identical.
+  const nixosJson = JSON.stringify(labels);
+  return `    runs-on:
+      \${{ ${githubUsesNixosRunnerExpr()} &&
+      fromJSON('${nixosJson}') || 'ubuntu-latest' }}`;
+}

package/src/monorepo/index.ts

@@ -9,6 +9,7 @@ import { applyManagedFiles, printResults, warnOnManagedFileDrift } from './manag
 import { listValidCommitScopes, validatePublicTags } from './package-policy.js';
 import { runInitPacks, runValidatePacks } from './packs/index.js';
 import { syncRootRuntimeVersions } from './runtime.js';
+import { applyToolConfigDefaults } from './tool-validation.js';
 
 export interface InitOptions {
   runtimeOnly?: boolean;
@@ -50,7 +51,7 @@ export async function initMonorepo(root: string, options: InitOptions): Promise<
     return;
   }
 
-  printResults(applyManagedFiles(root, 'update'));
+  printResults(await applyManagedFiles(root, 'update'));
   await runInitPacks({ root, syncRuntime: process.env.DEVENV_ROOT !== undefined || options.syncRuntime === true });
 }
 
@@ -74,24 +75,35 @@ export async function validateMonorepo(root: string, options: ValidateOptions =
   }
 }
 
-export function updateManagedFiles(root: string): void {
-  printResults(applyManagedFiles(root, 'update'));
+export async function updateManagedFiles(root: string): Promise<void> {
+  printResults(await applyManagedFiles(root, 'update'));
+  // Tool dependency policy (typescript API 6, @typescript/native for ttsc, nx, …)
+  // lives next to managed templates — update must install them, not only rewrite files.
+  await applyToolConfigDefaults(root);
+  syncBunLockfileVersions(root, { mode: 'install' });
+  console.log('installing     workspace dependencies (bun install)');
+  const install = await $`bun install --no-summary`.cwd(root).nothrow();
+  if (install.exitCode !== 0) {
+    const stderr = decode(install.stderr).trim();
+    const stdout = decode(install.stdout).trim();
+    throw new Error(`bun install failed after monorepo update${stderr || stdout ? `:\n${stderr || stdout}` : ''}`);
+  }
 }
 
-export function checkManagedFiles(root: string, options: { warn?: boolean } = {}): void {
+export async function checkManagedFiles(root: string, options: { warn?: boolean } = {}): Promise<void> {
   if (options.warn === true) {
-    warnOnManagedFileDrift(root);
+    await warnOnManagedFileDrift(root);
     return;
   }
-  const results = applyManagedFiles(root, 'check');
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   if (results.some((result) => result.action === 'drifted')) {
     throw new Error('Managed monorepo files are out of date. Run: smoo monorepo update');
   }
 }
 
-export function diffManagedFiles(root: string): void {
-  printResults(applyManagedFiles(root, 'diff'));
+export async function diffManagedFiles(root: string): Promise<void> {
+  printResults(await applyManagedFiles(root, 'diff'));
 }
 
 export function validateCommitMessageFile(