@smoothbricks/cli 0.10.5 → 0.10.6

package/dist/monorepo/publish-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5G,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,YAAY,CAAC;AAErE,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,kBAAkB,0BAA0B;IAC5C,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAoE/G;AAMD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAsEnC;AAoBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CAchG"}
+{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AASA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ5E,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAAG,uBAAuB,GAAG,mBAAmB,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC5G,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,gCAAgC,GAAG,MAAM,GAAG,YAAY,CAAC;AAErE,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,kBAAkB,0BAA0B;IAC5C,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,iBAAiB,EAAE,gCAAgC,CAAC;IACpD,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAoE/G;AAMD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAsEnC;AAoBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CAchG"}

package/dist/monorepo/publish-workflow.js

@@ -2,6 +2,7 @@
 import synchronizedPrettier from '@prettier/sync';
 import { LINUX_PLATFORM_TARGET_GLOBS, MACOS_PLATFORM_TARGET_GLOBS, } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
+import { renderRunsOnLine } from './github-runs-on.js';
 const PUBLISH_WORKFLOW_FORMAT_OPTIONS = Object.freeze({
     parser: 'yaml',
     printWidth: 120,
@@ -338,7 +339,8 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.UploadTraceDbs:
             return [
                 `      - name: ${step.name}`,
-                `        if: ${githubExpression('failure()')}`,
+                '        # Default is success(); failure() uploads traces only when the job already failed.',
+                '        if: failure()',
                 '        uses: actions/upload-artifact@v7.0.1',
                 '        with:',
                 `          name: trace-results-${githubExpression('github.run_id')}`,
@@ -362,7 +364,8 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.SaveNixDevenv:
             return [
                 `      - name: ${step.name}`,
-                `        if: ${githubExpression('always()')}`,
+                '        # success() is default; always() still saves GH Nix cache after a red job.',
+                '        if: always()',
                 '        uses: ./.github/actions/save-nix-devenv',
                 '        with:',
                 `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`,
@@ -392,7 +395,7 @@ function deployEnvLines(options) {
 }
 function conditionalRunStep(step, run) {
     const condition = "steps.version.outputs.mode != 'none'";
-    return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+    return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
 }
 function renderSingleJobPublishWorkflowSteps(steps, options) {
     const lines = [];
@@ -402,7 +405,7 @@ function renderSingleJobPublishWorkflowSteps(steps, options) {
         lines.push(...yamlLinesForStep(step, options));
         lines.push('');
         if (step.kind === PublishWorkflowStepKind.Build) {
-            lines.push('      - name: 🐧 Build supplemental Linux targets', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}"`, '');
+            lines.push('      - name: 🐧 Build supplemental Linux targets', "        if: steps.version.outputs.mode != 'none'", `        run: smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}"`, '');
         }
     }
     return `${lines.join('\n').trimEnd()}\n`;
@@ -447,7 +450,7 @@ defaults:
 
 jobs:
   linux-release-candidate:
-    runs-on: ubuntu-latest
+${renderRunsOnLine(options.runsOn)}
     permissions:
       contents: write
       id-token: none
@@ -508,7 +511,7 @@ function renderLinuxReleaseCandidateSteps(steps, options) {
             lines.push(`      - name: ${step.name}`, '        uses: actions/checkout@v6.0.2', '        with:', `          ref: ${githubExpression('github.sha')}`, '          filter: blob:none', '          fetch-depth: 0');
         }
         else if (step.kind === PublishWorkflowStepKind.Build) {
-            lines.push(`      - name: ${step.name}`, `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        run:', `          smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/release-build-outputs"`);
+            lines.push(`      - name: ${step.name}`, "        if: steps.version.outputs.mode != 'none'", '        run:', `          smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/release-build-outputs"`);
         }
         else {
             lines.push(...yamlLinesForStep(step, options));
@@ -519,16 +522,16 @@ function renderLinuxReleaseCandidateSteps(steps, options) {
             stepNumber += 1;
         }
         if (step.kind === PublishWorkflowStepKind.Build && hasLinuxPlatformTargets(options)) {
-            lines.push('', `      # Step ${stepNumber}`, '      - name: 🐧 Build supplemental Linux targets', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        run:', `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/linux-platform-outputs"`);
+            lines.push('', `      # Step ${stepNumber}`, '      - name: 🐧 Build supplemental Linux targets', "        if: steps.version.outputs.mode != 'none'", '        run:', `          smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects "${githubExpression('steps.version.outputs.projects')}" --collect-outputs "${githubExpression('runner.temp')}/linux-platform-outputs"`);
             stepNumber += 1;
         }
         lines.push('');
     }
-    lines.push('      # --- Candidate transfer --------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Bundle validated release state', '        run:', `          mkdir -p "${githubExpression('runner.temp')}/publish-release-state" && git bundle create`, `          "${githubExpression('runner.temp')}/publish-release-state/release-state.bundle" HEAD --tags && git rev-parse HEAD >`, `          "${githubExpression('runner.temp')}/publish-release-state/release-head"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated release state', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-state-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/publish-release-state`, '          if-no-files-found: error', '          retention-days: 1', '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated build outputs', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/release-build-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
+    lines.push('      # --- Candidate transfer --------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Bundle validated release state', '        run:', `          mkdir -p "${githubExpression('runner.temp')}/publish-release-state" && git bundle create`, `          "${githubExpression('runner.temp')}/publish-release-state/release-state.bundle" HEAD --tags && git rev-parse HEAD >`, `          "${githubExpression('runner.temp')}/publish-release-state/release-head"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated release state', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-state-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/publish-release-state`, '          if-no-files-found: error', '          retention-days: 1', '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload validated build outputs', "        if: steps.version.outputs.mode != 'none'", '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-release-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/release-build-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
     if (hasLinuxPlatformTargets(options)) {
-        lines.push('', `      # Step ${stepNumber++}`, '      - name: 📤 Upload supplemental Linux outputs', `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`, '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-linux-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/linux-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
+        lines.push('', `      # Step ${stepNumber++}`, '      - name: 📤 Upload supplemental Linux outputs', "        if: steps.version.outputs.mode != 'none'", '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-linux-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/linux-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true');
     }
-    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function renderMacosPlatformSteps(options) {
@@ -554,7 +557,7 @@ function renderMacosPlatformSteps(options) {
     if (isSmoothBricksCodebasePackageName(options.repoName)) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🏗️ Build self-hosted smoo', '        # SmoothBricks self-hosts smoo from source for release commands.', '        run: nx build cli');
     }
-    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Build selected macOS and iOS release outputs', '        run:', `          smoo release build-platform-outputs --bump "${githubExpression('inputs.bump')}" --ref "${githubExpression('github.sha')}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}" --output`, `          "${githubExpression('runner.temp')}/macos-platform-outputs"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload macOS platform outputs', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-macos-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/macos-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true', '', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Build selected macOS and iOS release outputs', '        run:', `          smoo release build-platform-outputs --bump "${githubExpression('inputs.bump')}" --ref "${githubExpression('github.sha')}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}" --output`, `          "${githubExpression('runner.temp')}/macos-platform-outputs"`, '', `      # Step ${stepNumber++}`, '      - name: 📤 Upload macOS platform outputs', '        uses: actions/upload-artifact@v7.0.1', '        with:', `          name: publish-macos-outputs-${githubExpression('github.run_id')}`, `          path: ${githubExpression('runner.temp')}/macos-platform-outputs`, '          if-no-files-found: error', '          retention-days: 1', '          include-hidden-files: true', '', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function renderFinalLinuxPublishSteps(options) {
@@ -597,15 +600,15 @@ function renderFinalLinuxPublishSteps(options) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🏗️ Build self-hosted smoo', '        # SmoothBricks self-hosts smoo from source for release commands.', '        run: nx build cli');
     }
     lines.push('', '      # --- Repair -------------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 🧯 Repair pending releases', '        run:', `          smoo release repair-pending --ref "${githubExpression('github.sha')}" --platform-outputs "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/repairs" --dry-run`, `          "${githubExpression('inputs.dry_run')}"`, '', `      # Step ${stepNumber++}`, '      - name: ♻️ Restore validated release state', '        run:', `          git fetch "${githubExpression('runner.temp')}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-state.bundle" HEAD --tags && git reset`, `          --hard "$(cat "${githubExpression('runner.temp')}/publish-artifacts/publish-release-state-${githubExpression('github.run_id')}/release-head")"`);
-    lines.push('', '      # --- Validation ---------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Apply verified Linux outputs', `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('needs.linux-release-candidate.outputs.release-sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-release-outputs-${githubExpression('github.run_id')}"`);
+    lines.push('', '      # --- Validation ---------------------------------------------------------', '', `      # Step ${stepNumber++}`, '      - name: 📦 Apply verified Linux outputs', `        if: ${mode} != 'none'`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('needs.linux-release-candidate.outputs.release-sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-release-outputs-${githubExpression('github.run_id')}"`);
     if (hasLinuxPlatformTargets(options)) {
         lines.push(`          "${githubExpression('runner.temp')}/publish-artifacts/publish-linux-outputs-${githubExpression('github.run_id')}"`);
     }
-    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Apply verified macOS outputs', `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/current"`, '', `      # Step ${stepNumber++}`, `      - name: ✅ Validate restored release (${githubExpression(mode)})`, `        if: ${githubExpression(`${mode} != 'none'`)}`, '        run: smoo monorepo validate', '', '      # --- Release ------------------------------------------------------------', '', `      # Step ${stepNumber++}`, `      - name: 📦 Publish release (${githubExpression(mode)})`, '        # smoo packs with Bun, then publishes tarballs with npm. Existing', '        # packages must already exist on npm and use trusted publishing/OIDC.', '        # Missing package names are bootstrapped locally before trust setup.', `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`);
+    lines.push('', `      # Step ${stepNumber++}`, '      - name: 🍎 Apply verified macOS outputs', `        if: ${mode} != 'none'`, '        run:', `          smoo github-ci apply-outputs --source-sha "${githubExpression('github.sha')}"`, `          "${githubExpression('runner.temp')}/publish-artifacts/publish-macos-outputs-${githubExpression('github.run_id')}/current"`, '', `      # Step ${stepNumber++}`, `      - name: ✅ Validate restored release (${githubExpression(mode)})`, `        if: ${mode} != 'none'`, '        run: smoo monorepo validate', '', '      # --- Release ------------------------------------------------------------', '', `      # Step ${stepNumber++}`, `      - name: 📦 Publish release (${githubExpression(mode)})`, '        # smoo packs with Bun, then publishes tarballs with npm. Existing', '        # packages must already exist on npm and use trusted publishing/OIDC.', '        # Missing package names are bootstrapped locally before trust setup.', `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`);
     if (options.deploy === true) {
         lines.push('', `      # Step ${stepNumber++}`, '      - name: 🚀 Deploy production', '        if:', "          ${{ needs.linux-release-candidate.outputs.mode != 'none' && inputs.deploy_environment == 'production' &&", "          inputs.dry_run != 'true' }}", ...deployEnvLines(options), '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"');
     }
-    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', `        if: ${githubExpression('always()')}`, '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
+    lines.push('', '      # --- Cleanup ------------------------------------------------------------', '', `      # Step ${stepNumber}`, '      - name: 🧹 Cleanup and cache Nix/devenv', '        # success() is default; always() still saves GH Nix cache after a red job.', '        if: always()', '        uses: ./.github/actions/save-nix-devenv', '        with:', `          nix-cache-hit: ${githubExpression('steps.setup.outputs.nix-cache-hit')}`, `          devenv-cache-hit: ${githubExpression('steps.setup.outputs.devenv-cache-hit')}`);
     return lines.join('\n').trimEnd();
 }
 function hasMacosPlatformTargets(options) {

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -1,8 +1,13 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 NIX_STORE_NAR="${NIX_STORE_NAR:-/tmp/nix-store.nar}"
 nix_store_cmd="/nix/var/nix/profiles/default/bin/nix-store"
+DEVENV_FLAKE="${DEVENV_FLAKE:-github:cachix/devenv}"
+# Host CI cache (GARM bind-mount). Prefer env from runner profile.
+# Path comes from the runner (GARM profile). Ephemeral runners leave unset;
+# devenv enterShell defaults to $PWD/.cache/ttsc.
+TTSC_CACHE_DIR="${TTSC_CACHE_DIR:-}"
 # Resolve from this script's location, not the caller's cwd. GitHub Actions
 # runs this from tooling/direnv today, but direct cwd-changing helpers are easy
 # to misuse and break on repeated calls.
@@ -36,12 +41,21 @@ restore_nix_store() {
 }
 
 install_devenv() {
-  sudo mkdir -p /nix/var/nix/gcroots/ci
-  if ! command -v devenv >/dev/null 2>&1; then
-    nix profile add --accept-flake-config nixpkgs#devenv
+  # Shared host /nix/store is the package cache. Image may already provide
+  # devenv from github:cachix/devenv; otherwise profile-add the same flake
+  # (links store paths; re-fetch only when missing).
+  if command -v devenv >/dev/null 2>&1; then
+    echo "using existing devenv: $(command -v devenv) ($(devenv version 2>/dev/null || true))"
+  else
+    echo "nix profile add ${DEVENV_FLAKE}"
+    nix profile add --accept-flake-config "$DEVENV_FLAKE"
+  fi
+  if [ -d "$HOME/.nix-profile/bin" ]; then
+    echo "$HOME/.nix-profile/bin" >> "${GITHUB_PATH:-/dev/null}"
+  fi
+  if [ -n "$TTSC_CACHE_DIR" ]; then
+    mkdir -p "$TTSC_CACHE_DIR"
   fi
-  echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
-  sudo ln -sf "$HOME/.nix-profile" /nix/var/nix/gcroots/ci/profile
 }
 
 build_devenv_shell() {
@@ -50,7 +64,10 @@ build_devenv_shell() {
   # independent workflow step shells that run after this composite action.
   if [ -n "${GITHUB_ENV:-}" ]; then
     echo "TTSC_TSGO_BINARY=$repo_root/node_modules/@typescript/native/bin/tsc" >> "$GITHUB_ENV"
-    echo "TTSC_CACHE_DIR=$repo_root/.cache/ttsc" >> "$GITHUB_ENV"
+    # Only re-export when the runner (or a prior step) already set the path.
+    if [ -n "$TTSC_CACHE_DIR" ]; then
+      echo "TTSC_CACHE_DIR=$TTSC_CACHE_DIR" >> "$GITHUB_ENV"
+    fi
   fi
   # Add repo-local tools only after the shell exists; cleanup steps use an
   # explicit PATH because failures before this point must still refresh caches.

package/managed/templates/github/actions/cache-nix-devenv/action.yml

@@ -1,5 +1,7 @@
 name: Cache Nix profiles, devenv and direnv
-description: Restore cached Nix/devenv state for SmoothBricks GitHub Actions jobs.
+description: >
+  Two independent segments: large nix (NAR/profiles, ephemeral runners only) and small devenv (.devenv/.direnv — eval
+  SQLite, shell scripts, profile; all runners).
 
 inputs:
   segment:
@@ -19,12 +21,11 @@ outputs:
 runs:
   using: composite
   steps:
-    # The large cache is the Nix profile plus exported store NAR. Its key tracks
-    # the expensive shell closure inputs only; tiny direnv/setup script changes
-    # should not invalidate a 1GB+ store cache.
-    - name: Restore Nix profiles, devenv and direnv
+    # Large segment: Nix profile + exported store NAR. Ephemeral runners only.
+    # Key = shell closure inputs; direnv/setup script edits must not bust a multi-GB NAR.
+    - name: Restore Nix profiles and store NAR
       id: restore-nix
-      if: ${{ inputs.segment == 'nix' && inputs.mode == 'restore' }}
+      if: inputs.segment == 'nix' && inputs.mode == 'restore'
       uses: actions/cache/restore@v5.0.5
       with:
         path: |
@@ -39,7 +40,7 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-nix-v3-
 
     - name: Save Nix profiles and store NAR
-      if: ${{ inputs.segment == 'nix' && inputs.mode == 'save' }}
+      if: inputs.segment == 'nix' && inputs.mode == 'save'
       uses: actions/cache/save@v5.0.5
       with:
         path: |
@@ -51,11 +52,12 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-nix-v3-${{ hashFiles('tooling/direnv/devenv.yaml',
           'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
 
-    # .devenv/.direnv are small, but they contain absolute /nix/store pointers.
-    # Workflows restore this segment only after an exact Nix cache hit.
+    # Small segment: devenv eval cache (nix-eval-cache.db), shell-*.sh, profile, .direnv.
+    # Own key. Setup restores on every runner; not gated on nix NAR hit. Devenv drops a
+    # shell cache row when drv/out are missing (GC) and re-evals/realizes.
     - name: Restore devenv and direnv state
       id: restore-devenv
-      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'restore' }}
+      if: inputs.segment == 'devenv' && inputs.mode == 'restore'
       uses: actions/cache/restore@v5.0.5
       with:
         path: |
@@ -69,7 +71,7 @@ runs:
           ${{ runner.os }}-${{ runner.arch }}-devenv-v3-
 
     - name: Save devenv and direnv state
-      if: ${{ inputs.segment == 'devenv' && inputs.mode == 'save' }}
+      if: inputs.segment == 'devenv' && inputs.mode == 'save'
       uses: actions/cache/save@v5.0.5
       with:
         path: |

package/managed/templates/github/actions/save-nix-devenv/action.yml

@@ -1,5 +1,7 @@
 name: Save Nix/devenv caches
-description: Cleanup the Nix store and explicitly save Nix/devenv cache segments.
+description: >
+  Save cache segments after the job. Nix store NAR stays ephemeral-only (host uses shared /nix/store). Devenv/direnv
+  eval-cache segment saves on every runner when setup missed and build-shell produced nix-eval-cache.db.
 
 inputs:
   nix-cache-hit:
@@ -14,8 +16,19 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: 🔎 Runner kind
+      id: runner-kind
+      shell: bash
+      run: |
+        if [ "${NIX_REMOTE:-}" = daemon ] && [ -d /var/cache/ci ]; then
+          echo "host=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "host=false" >> "$GITHUB_OUTPUT"
+        fi
+
     - name: 🧹 Prepare Nix/devenv cache save
       id: cleanup-cache
+      if: steps.runner-kind.outputs.host != 'true'
       shell: bash
       working-directory: tooling/direnv
       env:
@@ -33,14 +46,32 @@ runs:
         smoo github-ci cleanup-cache
 
     - name: 🧊 Save Nix profiles and store NAR
-      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.nix-cache-hit != 'true' }}
+      if:
+        ${{ steps.runner-kind.outputs.host != 'true' && steps.cleanup-cache.outputs.cache-ready == 'true' &&
+        inputs.nix-cache-hit != 'true' }}
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: nix
         mode: save
 
+    # Devenv segment is independent of nix NAR readiness and host vs ephemeral.
+    # Skip when setup never finished (no eval DB) so if: always() cannot poison
+    # the next restore with an empty/partial key.
+    - name: 🔎 Devenv save ready
+      id: devenv-save
+      if: inputs.devenv-cache-hit != 'true'
+      shell: bash
+      run: |
+        db="${GITHUB_WORKSPACE}/tooling/direnv/.devenv/nix-eval-cache.db"
+        if [[ -f "$db" ]]; then
+          echo "ready=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "ready=false" >> "$GITHUB_OUTPUT"
+          echo "skip devenv save: no nix-eval-cache.db"
+        fi
+
     - name: 🧊 Save devenv and direnv
-      if: ${{ steps.cleanup-cache.outputs.cache-ready == 'true' && inputs.devenv-cache-hit != 'true' }}
+      if: ${{ inputs.devenv-cache-hit != 'true' && steps.devenv-save.outputs.ready == 'true' }}
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: devenv

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -1,44 +1,71 @@
 name: Setup Nix/devenv
-description: Restore caches and build the SmoothBricks devenv shell after checkout.
+description: >
+  Build the SmoothBricks devenv shell after checkout. Restores the small devenv/direnv actions/cache segment on every
+  runner (eval SQLite + shell scripts). On GARM/NixOS (NIX_REMOTE=daemon + /var/cache/ci) skips Nix install and the
+  large store NAR (host store). On ubuntu/macOS installs Nix and restores the NAR/profile cache.
 
 outputs:
   nix-cache-hit:
     description: Whether the Nix profile/store cache restored from the exact primary key.
-    value: ${{ steps.nix-cache.outputs.cache-hit }}
+    value: ${{ steps.nix-cache.outputs.cache-hit || 'false' }}
   devenv-cache-hit:
     description: Whether the devenv/direnv cache restored from the exact primary key.
-    value: ${{ steps.devenv-cache.outputs.cache-hit }}
+    value: ${{ steps.devenv-cache.outputs.cache-hit || 'false' }}
+  host-runner:
+    description: Whether this job is on a host-nix runner (GARM) with shared store/caches.
+    value: ${{ steps.runner-kind.outputs.host }}
 
 runs:
   using: composite
   steps:
     # This action is intentionally post-checkout only. Repo-local actions do not
     # exist before actions/checkout has populated the working tree.
+
+    # Runner image/profile owns paths (NIX_REMOTE, /var/cache/ci/*). Detect here
+    # so every workflow can `uses: setup-devenv` without forking step graphs.
+    - name: 🔎 Runner kind
+      id: runner-kind
+      shell: bash
+      run: |
+        if [ "${NIX_REMOTE:-}" = daemon ] && [ -d /var/cache/ci ]; then
+          echo "host=true" >> "$GITHUB_OUTPUT"
+          echo "host-nix runner (shared store + /var/cache/ci)"
+        else
+          echo "host=false" >> "$GITHUB_OUTPUT"
+          echo "ephemeral runner (install Nix + GH caches)"
+        fi
+
+    # Devenv segment (own key): tooling/direnv/.devenv + .direnv — includes
+    # nix-eval-cache.db. Independent of the nix NAR; restore on host and ephemeral
+    # whether or not the store cache hit. Missing store paths are fine: devenv
+    # verifies shell drv/out exist on eval-cache hit and invalidates + re-evals
+    # / realizes when GC removed them. Packages still come from host store, NAR,
+    # or Cachix — this blob only skips evaluation.
+    - name: 🧊 Cache devenv and direnv
+      id: devenv-cache
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: devenv
+
     - name: ❄️ Install Nix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: DeterminateSystems/determinate-nix-action@v3
 
     - name: 🧊 Cache Nix profiles and store NAR
       id: nix-cache
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: nix
 
     - name: ♻️ Restore Nix store from NAR
+      if: steps.runner-kind.outputs.host != 'true'
       shell: bash
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh restore-store
 
-    # Restore direnv state only when the Nix cache key is exact. Partial Nix
-    # restores can contain a NAR for a different shell closure, and .direnv
-    # points directly at derivations inside that closure.
-    - name: 🧊 Cache devenv and direnv
-      id: devenv-cache
-      if: ${{ steps.nix-cache.outputs.cache-hit == 'true' }}
-      uses: ./.github/actions/cache-nix-devenv
-      with:
-        segment: devenv
-
     - name: ⚡ Enable Cachix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: cachix/cachix-action@v17
       with:
         name: devenv
@@ -48,12 +75,14 @@ runs:
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh install-devenv
 
+    # node_modules + ttsc plugin binaries: GH Actions cache on ephemeral runners.
+    # Host runners keep those under the /var/cache/ci bind (bun / ttsc env).
     - name: 📦 Cache node_modules
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-node-modules
 
-    # Restores compiled ttsc native plugins into .cache/ttsc/plugins. TTSC_CACHE_DIR
-    # is set by devenv enterShell (+ bootstrap GITHUB_ENV for later steps).
     - name: 🧊 Cache ttsc plugins
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-ttsc-plugins
 
     - name: 🐚 Build devenv shell

package/managed/templates/github/workflows/managed-files.yml

@@ -9,10 +9,17 @@
 # change is upstream code that deserves a human look before it lands. Re-runs
 # refresh the same branch in place.
 #
-# NOTE: managed files include .github/workflows/*, and the default GITHUB_TOKEN
-# is server-side forbidden to push workflow-file changes. Configure a GitHub App
-# or PAT token with contents:write + workflows:write as MANAGED_FILES_TOKEN;
-# without it, runs that touch workflow files fail at push with a clear error.
+# REQUIRED SECRET: MANAGED_FILES_TOKEN
+# Managed files include .github/workflows/*. The default GITHUB_TOKEN is
+# server-side forbidden to create/update workflow files, even with
+# contents:write. Configure a GitHub App installation token or classic/fine-
+# grained PAT with:
+#   - contents: write
+#   - pull-requests: write
+#   - workflows: write
+# as repository secret MANAGED_FILES_TOKEN. Without it, any update that
+# touches workflow YAML fails at push (this is the usual "managed files
+# workflow isn't doing anything" failure mode).
 name: Managed files
 
 on:
@@ -41,6 +48,7 @@ jobs:
           filter: blob:none
           fetch-depth: 0
           persist-credentials: true
+          # Prefer MANAGED_FILES_TOKEN so push can update workflow files.
           token: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
 
       - name: 🧱 Setup Nix/devenv
@@ -53,27 +61,71 @@ jobs:
       - name: 📤 Push review branch and open PR
         env:
           GH_TOKEN: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
+          # secrets.* is empty when unset — used to fail before a useless push.
+          MANAGED_FILES_TOKEN_CONFIGURED: ${{ secrets.MANAGED_FILES_TOKEN != '' }}
         run: |
+          set -euo pipefail
           cd "$(git rev-parse --show-toplevel)"
+
           if [ -z "$(git status --porcelain)" ]; then
             echo "Managed files are in sync; nothing to do."
             exit 0
           fi
+
+          echo "Pending managed-file changes:"
+          git status --porcelain
+
+          workflow_changes="$(git status --porcelain -- .github/workflows || true)"
+          if [ -n "$workflow_changes" ] && [ "${MANAGED_FILES_TOKEN_CONFIGURED}" != "true" ]; then
+            {
+              echo "::error title=MANAGED_FILES_TOKEN required::Managed update touches .github/workflows/* but repository secret MANAGED_FILES_TOKEN is not set."
+              echo ""
+              echo "GitHub refuses pushes that create/update workflow files when the credentials are the default GITHUB_TOKEN / a GitHub App without the workflows permission:"
+              echo "  refusing to allow a GitHub App to create or update workflow ... without \`workflows\` permission"
+              echo ""
+              echo "Fix:"
+              echo "  1. Create a GitHub App (or PAT) with contents:write, pull-requests:write, workflows:write"
+              echo "  2. Install it on this repo"
+              echo "  3. Store an installation token or PAT as repository secret MANAGED_FILES_TOKEN"
+              echo "  4. Re-run this workflow"
+              echo ""
+              echo "Workflow files that would be updated:"
+              echo "$workflow_changes"
+            } >&2
+            exit 1
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git switch -C chore/managed-files
           git add -A
           git commit -m "chore: regenerate smoo-managed files"
-          git push --force origin chore/managed-files
-          gh pr create \
-            --head chore/managed-files \
-            --base "${GITHUB_REF_NAME}" \
-            --title "chore: regenerate smoo-managed files" \
-            --body "Automated refresh of smoo-managed files after drift (usually a @smoothbricks/cli pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes - do NOT enable auto-merge." \
-            2>/dev/null || echo "PR already open; branch refreshed in place."
+
+          if ! git push --force origin chore/managed-files 2> /tmp/managed-files-push.err; then
+            cat /tmp/managed-files-push.err >&2
+            if grep -q 'workflows' /tmp/managed-files-push.err; then
+              {
+                echo ""
+                echo "::error title=workflows permission missing::Push rejected because the token cannot update GitHub Actions workflow files."
+                echo "Set repository secret MANAGED_FILES_TOKEN to a GitHub App/PAT with contents:write + pull-requests:write + workflows:write, then re-run."
+              } >&2
+            fi
+            exit 1
+          fi
+
+          if ! gh pr view chore/managed-files --json number --jq .number >/dev/null 2>&1; then
+            gh pr create \
+              --head chore/managed-files \
+              --base "${GITHUB_REF_NAME}" \
+              --title "chore: regenerate smoo-managed files" \
+              --body "Automated refresh of smoo-managed files after drift (usually a \`@smoothbricks/cli\` pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes — do NOT enable auto-merge."
+          else
+            echo "PR already open for chore/managed-files; branch refreshed in place."
+          fi
 
       - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
+        # success() is default; always() still saves GH Nix cache after a red job.
+        if: always()
         uses: ./.github/actions/save-nix-devenv
         with:
           nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.5",
+  "version": "0.10.6",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {

package/src/cli.ts

@@ -66,11 +66,11 @@ function buildProgram(): Command {
     .option('--warn', 'report drift as warnings (GitHub annotations) instead of failing')
     .action(async (options: { warn?: boolean }) => {
       const { checkManagedFiles } = await import('./monorepo/index.js');
-      checkManagedFiles(await findRepoRoot(), { warn: options.warn });
+      await checkManagedFiles(await findRepoRoot(), { warn: options.warn });
     });
   monorepo.command('diff').action(async () => {
     const { diffManagedFiles } = await import('./monorepo/index.js');
-    diffManagedFiles(await findRepoRoot());
+    await diffManagedFiles(await findRepoRoot());
   });
   monorepo
     .command('validate-commit-msg <commitMsgFile>')

package/src/github-ci/index.test.ts

@@ -38,7 +38,7 @@ describe('GitHub CI Nx target expansion', () => {
       ['test', ['api', 'desktop']],
     ]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=5'],
+      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=100%'],
     ]);
   });
 
@@ -65,7 +65,7 @@ describe('GitHub CI Nx target expansion', () => {
 
     expect(expanded.unmatchedGlobs).toEqual([]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'missing', '--projects=api', '--parallel=5'],
+      ['run-many', '-t', 'missing', '--projects=api', '--parallel=100%'],
     ]);
   });
 
@@ -114,7 +114,7 @@ describe('GitHub CI Nx target expansion', () => {
       '-t',
       'test',
       '--exclude=tag:ci:skip:test',
-      '--parallel=5',
+      '--parallel=100%',
     ]);
     expect(nxRunManyArgs({ target: 'test', projects: projects.slice(0, 1) })).not.toContain(
       '--exclude=tag:ci:skip:test',

package/src/github-ci/index.ts

@@ -27,6 +27,9 @@ const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDep
 
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
+/** Nx workers = host cores (CI runners sized for full machine use). */
+const NX_PARALLEL = '100%';
+
 export async function cleanupGithubCiCache(root: string): Promise<void> {
   const githubOutput = process.env.GITHUB_OUTPUT;
   const markCacheReady = async (ready: boolean): Promise<void> => {
@@ -139,7 +142,7 @@ export function nxSmartArgs(target: string, mode: 'affected' | 'run-many', confi
   if (configuration) {
     args.push(`--configuration=${configuration}`);
   }
-  args.push(`--exclude=tag:ci:skip:${target}`, '--parallel=5');
+  args.push(`--exclude=tag:ci:skip:${target}`, `--parallel=${NX_PARALLEL}`);
   return args;
 }
 
@@ -262,7 +265,7 @@ export function nxRunManyArgs(run: NxTargetRun, configuration?: string): string[
   if (configuration) {
     nxArgs.push(`--configuration=${configuration}`);
   }
-  nxArgs.push('--parallel=5');
+  nxArgs.push(`--parallel=${NX_PARALLEL}`);
   return nxArgs;
 }
 
@@ -343,7 +346,7 @@ export async function githubCiNxDeploy(
   const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
   for (const target of targets) {
-    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, '--parallel=5'];
+    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, `--parallel=${NX_PARALLEL}`];
     if (target === 'deploy') {
       nxArgs.push(`--configuration=${options.configuration}`);
     }