@smoothbricks/cli 0.10.4 → 0.10.6

package/src/monorepo/lockfile.ts

@@ -8,9 +8,10 @@ export interface SyncBunLockfileVersionsOptions {
   /** `git add` bun.lock when versions were resynced. */
   stage?: boolean;
   /**
-   * `install` (default for validation): lockfile must match package.json.
+   * `install` (default): lockfile must match package.json (including -next).
    * `publish`: rewrite unpublished prerelease package.json versions to the last
    * stable git tag so `bun pm pack` embeds installable dependency versions.
+   * Only use publish mode around pack; never leave the tree in publish mode.
    */
   mode?: 'install' | 'publish';
 }
@@ -34,7 +35,7 @@ export interface SyncBunLockfileVersionsOptions {
 // rewrites lockfile back to package.json and frozen CI then fails.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
-  const mode = options.mode ?? 'publish';
+  const mode = options.mode ?? 'install';
   const lockfilePath = join(root, 'bun.lock');
   if (!existsSync(lockfilePath)) {
     throw new Error('bun.lock not found');

package/src/monorepo/managed-files.test.ts

@@ -5,13 +5,16 @@ import { join } from 'node:path';
 import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
 import {
+  deployTargetInfoFromProjects,
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
+  type NxGraphProjectNode,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
+  targetNamesFromProjects,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
@@ -172,6 +175,52 @@ describe('managed publish platform discovery', () => {
   });
 });
 
+describe('nx graph project helpers', () => {
+  const sampleNodes: Record<string, NxGraphProjectNode> = {
+    lib: {
+      data: {
+        targets: {
+          build: {},
+          'bundle-linux': {},
+          lint: {},
+        },
+      },
+    },
+    app: {
+      data: {
+        targets: {
+          deploy: {
+            options: { command: 'echo no' },
+            configurations: {
+              staging: { command: 'wrangler deploy --env staging' },
+              production: { options: { command: 'wrangler deploy --env production' } },
+            },
+          },
+          'package-macos': {},
+        },
+      },
+    },
+  };
+
+  it('collects target names from graph nodes without project names', () => {
+    expect(targetNamesFromProjects(sampleNodes).sort()).toEqual(
+      ['build', 'bundle-linux', 'deploy', 'lint', 'package-macos'].sort(),
+    );
+  });
+
+  it('detects deploy configurations and cloudflare provider from graph nodes', () => {
+    expect(deployTargetInfoFromProjects(sampleNodes, 'staging')).toEqual({
+      exists: true,
+      provider: 'cloudflare',
+    });
+    expect(deployTargetInfoFromProjects(sampleNodes, 'production')).toEqual({
+      exists: true,
+      provider: 'cloudflare',
+    });
+    expect(deployTargetInfoFromProjects(sampleNodes, 'preview')).toEqual({ exists: false });
+  });
+});
+
 describe('managed cache actions', () => {
   it('renders the checked-in action copies from their managed templates', async () => {
     for (const action of CACHE_ACTIONS) {

package/src/monorepo/managed-files.ts

@@ -1,9 +1,10 @@
-import { execFileSync } from 'node:child_process';
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { type PackageJson, parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
+// Nx package exports are CLI-oriented; this is the module the CLI uses for graph + daemon IPC.
+import { createProjectGraphAsync } from 'nx/src/project-graph/project-graph.js';
+import type { PackageJson } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -137,6 +138,7 @@ interface ManagedFileContext {
   stagingDeployProvider?: 'cloudflare';
   productionDeployProvider?: 'cloudflare';
   ciPushBranches: string[];
+  ciRunsOn: string | string[];
   nodeModulesCacheKey: string;
   repoName: string;
   platformTargetGlobs: string[];
@@ -199,6 +201,11 @@ const managedFiles: ManagedFile[] = [
     target: 'tooling/direnv/merge-newer-pins.sh',
     executable: true,
   },
+  {
+    kind: 'raw',
+    source: 'patches/ttsc@0.19.3.patch',
+    target: 'patches/ttsc@0.19.3.patch',
+  },
   {
     kind: 'generated',
     source: 'ci-workflow',
@@ -249,8 +256,8 @@ const managedFiles: ManagedFile[] = [
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
-export function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): FileResult[] {
-  const context = getManagedFileContext(root);
+export async function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]> {
+  const context = await getManagedFileContext(root);
   return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
 }
 
@@ -301,6 +308,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploy: context.hasStagingDeployTargets,
         deployProvider: context.stagingDeployProvider,
         pushBranches: context.ciPushBranches,
+        runsOn: context.ciRunsOn,
       });
     }
     if (file.source === 'publish-workflow') {
@@ -309,6 +317,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
         platformTargetGlobs: context.platformTargetGlobs,
+        runsOn: context.ciRunsOn,
       });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -322,13 +331,16 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
   return renderTemplate(context, content);
 }
 
-function getManagedFileContext(root: string): ManagedFileContext {
+async function getManagedFileContext(root: string): Promise<ManagedFileContext> {
   const packageJson = readPackageJson(join(root, 'package.json'));
   const repoName = packageJson?.name ?? 'monorepo';
   const ciPushBranches = getCiPushBranches(packageJson?.json);
-  const stagingDeploy = getDeployTargetInfo(root, 'staging');
-  const productionDeploy = getDeployTargetInfo(root, 'production');
-  const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
+  const ciRunsOn = getCiRunsOn(packageJson?.json);
+  // In-process Nx API → daemon socket (no second Node/`nx` CLI process).
+  const nxProjects = await loadNxGraphProjects(root);
+  const stagingDeploy = deployTargetInfoFromProjects(nxProjects, 'staging');
+  const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
+  const platformTargetGlobs = platformTargetGlobsForTest(targetNamesFromProjects(nxProjects));
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -339,6 +351,7 @@ function getManagedFileContext(root: string): ManagedFileContext {
     stagingDeployProvider: stagingDeploy.provider,
     productionDeployProvider: productionDeploy.provider,
     ciPushBranches,
+    ciRunsOn,
     nodeModulesCacheKey,
     repoName,
     platformTargetGlobs,
@@ -353,81 +366,109 @@ export function platformTargetGlobsForTest(targetNames: Iterable<string>): strin
   });
 }
 
-function readResolvedNxTargetNames(root: string): string[] {
-  const output = execFileSync('nx', ['show', 'projects', '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projects = parseStringArrayText(output);
-  if (!projects) {
-    return [];
-  }
-  const targetNames = new Set<string>();
-  for (const project of projects) {
-    const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
-      cwd: root,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'inherit'],
-    });
-    const projectJson = parseNxProjectJsonText(projectOutput);
-    const targets = projectJson?.targets;
-    if (targets) {
-      for (const targetName of Object.keys(targets)) {
-        targetNames.add(targetName);
-      }
+/** Resolved Nx project node as returned under `graph.nodes` / project-graph.json. */
+export type NxGraphProjectNode = {
+  data?: { targets?: Record<string, NxGraphTarget> };
+  targets?: Record<string, NxGraphTarget>;
+};
+
+type NxGraphTarget = {
+  command?: string;
+  options?: { command?: string };
+  configurations?: Record<string, { command?: string; options?: { command?: string } }>;
+};
+
+/**
+ * Load resolved project nodes via Nx's programmatic API.
+ *
+ * `createProjectGraphAsync` is what the CLI uses: with the daemon up it speaks the
+ * daemon unix socket instead of rebuilding the graph in a fresh Node process.
+ * Spawning `nx graph` / `nx show` only added CLI boot + plugin-worker overhead on
+ * top of that. smoo runs under Bun; Bun can import this CJS module directly.
+ */
+async function loadNxGraphProjects(root: string): Promise<Record<string, NxGraphProjectNode>> {
+  const prevCwd = process.cwd();
+  process.chdir(root);
+  try {
+    const graph = (await createProjectGraphAsync()) as {
+      nodes: Record<string, { data?: { targets?: Record<string, NxGraphTarget> } }>;
+    };
+    const out: Record<string, NxGraphProjectNode> = {};
+    for (const [name, node] of Object.entries(graph.nodes)) {
+      out[name] = { data: { targets: node.data?.targets ?? {} } };
     }
+    return out;
+  } finally {
+    process.chdir(prevCwd);
   }
-  return [...targetNames];
 }
 
-function renderTemplate(context: ManagedFileContext, template: string): string {
-  return template
-    .replaceAll('{{REPO_NAME}}', context.repoName)
-    .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
-    .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
+function targetsOfProject(node: NxGraphProjectNode): Record<string, NxGraphTarget> {
+  return node.data?.targets ?? node.targets ?? {};
 }
 
-function getDeployTargetInfo(root: string, configuration: string): DeployTargetInfo {
-  const output = execFileSync('nx', ['show', 'projects', '--withTarget', 'deploy', '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projects = parseStringArrayText(output);
-  if (!projects) {
-    return { exists: false };
+/** Test seam: collect target names from a graph.nodes map. */
+export function targetNamesFromProjects(nodes: Record<string, NxGraphProjectNode>): string[] {
+  const targetNames = new Set<string>();
+  for (const node of Object.values(nodes)) {
+    for (const name of Object.keys(targetsOfProject(node))) {
+      targetNames.add(name);
+    }
   }
+  return [...targetNames];
+}
+
+/** Test seam: deploy configuration presence/provider from graph nodes. */
+export function deployTargetInfoFromProjects(
+  nodes: Record<string, NxGraphProjectNode>,
+  configuration: string,
+): DeployTargetInfo {
   let exists = false;
   let provider: DeployTargetInfo['provider'];
-  for (const project of projects) {
-    const target = nxDeployTarget(root, project, configuration);
-    if (!target.exists) {
+  for (const node of Object.values(nodes)) {
+    const info = deployTargetInfoFromTargets(targetsOfProject(node), configuration);
+    if (!info.exists) {
       continue;
     }
     exists = true;
-    provider ??= target.provider;
+    provider ??= info.provider;
   }
   return { exists, provider };
 }
 
-function nxDeployTarget(root: string, project: string, configuration: string): DeployTargetInfo {
-  const output = execFileSync('nx', ['show', 'project', project, '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projectJson = parseNxProjectJsonText(output);
-  const deploy = projectJson?.targets?.deploy;
-  const config = deploy?.configurations?.[configuration];
+function deployTargetInfoFromTargets(targets: Record<string, NxGraphTarget>, configuration: string): DeployTargetInfo {
+  const deploy = targets.deploy;
+  if (!deploy) {
+    return { exists: false };
+  }
+  const config = deploy.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+  const commandValue = config.command ?? config.options?.command ?? deploy.options?.command ?? deploy.command;
   const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
 
+function renderTemplate(context: ManagedFileContext, template: string): string {
+  return template
+    .replaceAll('{{REPO_NAME}}', context.repoName)
+    .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
+    .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
+}
+
+function getCiRunsOn(packageJson: PackageJson | null | undefined): string | string[] {
+  const configured = packageJson?.smoo?.github?.runsOn;
+  if (configured === undefined) {
+    return 'ubuntu-latest';
+  }
+  if (typeof configured === 'string') {
+    return configured.length > 0 ? configured : 'ubuntu-latest';
+  }
+  const labels = configured.filter((label) => label.length > 0);
+  return labels.length > 0 ? labels : 'ubuntu-latest';
+}
+
 function getCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
   const configured = readCiPushBranches(packageJson);
   return configured.length > 0 ? configured : ['main'];
@@ -453,8 +494,8 @@ export function printResults(results: FileResult[]): void {
   }
 }
 
-export function validateManagedFiles(root: string): number {
-  const results = applyManagedFiles(root, 'check');
+export async function validateManagedFiles(root: string): Promise<number> {
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   const failures = results.filter((result) => result.action === 'drifted').length;
   if (failures > 0) {
@@ -473,8 +514,8 @@ export function validateManagedFiles(root: string): number {
  * Under GitHub Actions the drifted-file count is published as the step output
  * `drifted`, so downstream steps gate declaratively instead of parsing logs.
  */
-export function warnOnManagedFileDrift(root: string): void {
-  const results = applyManagedFiles(root, 'check');
+export async function warnOnManagedFileDrift(root: string): Promise<void> {
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   const drifted = results.filter((result) => result.action === 'drifted');
   if (process.env.GITHUB_OUTPUT) {

package/src/monorepo/packs/index.ts

@@ -92,11 +92,11 @@ const packs: MonorepoPack[] = [
       // Managed-file drift is derived state (CLI template x pinned version) with
       // its own remediation flow; it warns instead of failing so validation only
       // blocks on actual package issues. See warnOnManagedFileDrift.
-      warnOnManagedFileDrift(ctx.root);
+      await warnOnManagedFileDrift(ctx.root);
       return (
         runtimeFailures +
         validateRootPackagePolicy(ctx.root) +
-        validateToolConfig(ctx.root) +
+        (await validateToolConfig(ctx.root)) +
         validateNxProjectNames(ctx.root) +
         validateNxReleaseConfig(ctx.root) +
         validateBunLockfileVersions(ctx.root) +

package/src/monorepo/publish-workflow.ts

@@ -7,6 +7,7 @@ import {
 } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import type { Options as PrettierOptions } from 'prettier';
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
+import { renderRunsOnLine, type WorkflowRunsOn } from './github-runs-on.js';
 
 const PUBLISH_WORKFLOW_FORMAT_OPTIONS = Object.freeze({
   parser: 'yaml',
@@ -55,6 +56,8 @@ export interface PublishWorkflowDefinitionOptions {
   deployProvider?: 'cloudflare';
   repoName?: string;
   platformTargetGlobs?: readonly string[];
+  /** Linux jobs only. Default ubuntu-latest. Same smoo.github.runsOn as CI. */
+  runsOn?: WorkflowRunsOn;
 }
 
 export interface PublishWorkflowInputs {
@@ -441,7 +444,8 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
     case PublishWorkflowStepKind.UploadTraceDbs:
       return [
         `      - name: ${step.name}`,
-        `        if: ${githubExpression('failure()')}`,
+        '        # Default is success(); failure() uploads traces only when the job already failed.',
+        '        if: failure()',
         '        uses: actions/upload-artifact@v7.0.1',
         '        with:',
         `          name: trace-results-${githubExpression('github.run_id')}`,
@@ -465,7 +469,8 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
     case PublishWorkflowStepKind.SaveNixDevenv:
       return [
         `      - name: ${step.name}`,
-        `        if: ${githubExpression('always()')}`,
+        '        # success() is default; always() still saves GH Nix cache after a red job.',
+        '        if: always()',
         '        uses: ./.github/actions/save-nix-devenv',
         '        with:',
         `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
@@ -498,7 +503,7 @@ function deployEnvLines(options: PublishWorkflowDefinitionOptions): string[] {
 
 function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
   const condition = "steps.version.outputs.mode != 'none'";
-  return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+  return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
 }
 
 function renderSingleJobPublishWorkflowSteps(
@@ -514,7 +519,7 @@ function renderSingleJobPublishWorkflowSteps(
     if (step.kind === PublishWorkflowStepKind.Build) {
       lines.push(
         '      - name: 🐧 Build supplemental Linux targets',
-        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        "        if: steps.version.outputs.mode != 'none'",
         `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression(
           'steps.version.outputs.projects',
         )}"`,
@@ -566,7 +571,7 @@ defaults:
 
 jobs:
   linux-release-candidate:
-    runs-on: ubuntu-latest
+${renderRunsOnLine(options.runsOn)}
     permissions:
       contents: write
       id-token: none
@@ -642,7 +647,7 @@ function renderLinuxReleaseCandidateSteps(
     } else if (step.kind === PublishWorkflowStepKind.Build) {
       lines.push(
         `      - name: ${step.name}`,
-        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        "        if: steps.version.outputs.mode != 'none'",
         '        run:',
         `          smoo github-ci nx-run-many --targets build --projects "${githubExpression(
           'steps.version.outputs.projects',
@@ -667,7 +672,7 @@ function renderLinuxReleaseCandidateSteps(
         '',
         `      # Step ${stepNumber}`,
         '      - name: 🐧 Build supplemental Linux targets',
-        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+        "        if: steps.version.outputs.mode != 'none'",
         '        run:',
         `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(
           ',',
@@ -700,7 +705,7 @@ function renderLinuxReleaseCandidateSteps(
     '',
     `      # Step ${stepNumber++}`,
     '      - name: 📤 Upload validated build outputs',
-    `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+    "        if: steps.version.outputs.mode != 'none'",
     '        uses: actions/upload-artifact@v7.0.1',
     '        with:',
     `          name: publish-release-outputs-${githubExpression('github.run_id')}`,
@@ -714,7 +719,7 @@ function renderLinuxReleaseCandidateSteps(
       '',
       `      # Step ${stepNumber++}`,
       '      - name: 📤 Upload supplemental Linux outputs',
-      `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
+      "        if: steps.version.outputs.mode != 'none'",
       '        uses: actions/upload-artifact@v7.0.1',
       '        with:',
       `          name: publish-linux-outputs-${githubExpression('github.run_id')}`,
@@ -730,7 +735,8 @@ function renderLinuxReleaseCandidateSteps(
     '',
     `      # Step ${stepNumber}`,
     '      - name: 🧹 Cleanup and cache Nix/devenv',
-    `        if: ${githubExpression('always()')}`,
+    '        # success() is default; always() still saves GH Nix cache after a red job.',
+    '        if: always()',
     '        uses: ./.github/actions/save-nix-devenv',
     '        with:',
     `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
@@ -792,7 +798,8 @@ function renderMacosPlatformSteps(options: PublishWorkflowDefinitionOptions): st
     '',
     `      # Step ${stepNumber}`,
     '      - name: 🧹 Cleanup and cache Nix/devenv',
-    `        if: ${githubExpression('always()')}`,
+    '        # success() is default; always() still saves GH Nix cache after a red job.',
+    '        if: always()',
     '        uses: ./.github/actions/save-nix-devenv',
     '        with:',
     `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
@@ -876,7 +883,7 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
     '',
     `      # Step ${stepNumber++}`,
     '      - name: 📦 Apply verified Linux outputs',
-    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    `        if: ${mode} != 'none'`,
     '        run:',
     `          smoo github-ci apply-outputs --source-sha "${githubExpression(
       'needs.linux-release-candidate.outputs.release-sha',
@@ -896,7 +903,7 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
     '',
     `      # Step ${stepNumber++}`,
     '      - name: 🍎 Apply verified macOS outputs',
-    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    `        if: ${mode} != 'none'`,
     '        run:',
     `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`,
     `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression(
@@ -905,7 +912,7 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
     '',
     `      # Step ${stepNumber++}`,
     `      - name: ✅ Validate restored release (${githubExpression(mode)})`,
-    `        if: ${githubExpression(`${mode} != 'none'`)}`,
+    `        if: ${mode} != 'none'`,
     '        run: smoo monorepo validate',
     '',
     '      # --- Release ------------------------------------------------------------',
@@ -937,7 +944,8 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
     '',
     `      # Step ${stepNumber}`,
     '      - name: 🧹 Cleanup and cache Nix/devenv',
-    `        if: ${githubExpression('always()')}`,
+    '        # success() is default; always() still saves GH Nix cache after a red job.',
+    '        if: always()',
     '        uses: ./.github/actions/save-nix-devenv',
     '        with:',
     `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,