@smoothbricks/cli 0.10.5 → 0.10.6

package/src/lib/json.ts

@@ -23,6 +23,8 @@ export interface PackagePublishConfig {
 
 export interface PackageSmooGithub {
   pushBranches?: string[];
+  /** GitHub Actions runs-on for managed CI (string or label list). Default: ubuntu-latest. */
+  runsOn?: string | string[];
 }
 
 export interface PackageSmooConfig {

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -5,9 +5,15 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('CI workflow definition', () => {
   it('renders the checked-in local CI workflow copy', async () => {
-    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
 
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
@@ -25,6 +31,13 @@ describe('CI workflow definition', () => {
       'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
     );
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    expect(rendered).toContain('runs-on: ubuntu-latest');
   });
 
   it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
@@ -44,4 +57,27 @@ describe('CI workflow definition', () => {
     expect(restoreKey).toBe('${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}');
     expect(saveKey).toBe(restoreKey);
   });
+
+  it('nixos config: fork PRs on ubuntu; one setup-devenv (composite owns host path)', () => {
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
+
+    expect(rendered).toContain(
+      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}",
+    );
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).not.toContain('determinate-nix-action');
+    expect(rendered).toContain('if: always()');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    // workflow yaml does not embed composite internals
+    expect(rendered).not.toContain('cache-node-modules');
+    expect(rendered).not.toContain('cache-ttsc-plugins');
+  });
 });

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -19,11 +19,14 @@ import {
   runPublishWorkflow,
 } from '../publish-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
@@ -35,6 +38,7 @@ describe('publish workflow definition', () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
 
     await expect(
@@ -125,6 +129,7 @@ describe('publish workflow definition', () => {
     const native = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const linuxCandidate = native.slice(
       native.indexOf('  linux-release-candidate:'),
@@ -137,8 +142,9 @@ describe('publish workflow definition', () => {
     expect(linuxOnly).toContain(
       `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
     );
-    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  linux-release-candidate:');
     expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:');
     expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
     expect(linuxCandidate).not.toContain('needs:');
     expect(macosPlatform).not.toContain('needs:');
@@ -612,3 +618,24 @@ function packageNameFromTag(tag: string): string {
   }
   return tag.slice(0, versionSeparator);
 }
+
+it('linux publish jobs use smoo.github.runsOn; macOS stays macos-latest', () => {
+  const rendered = renderPublishWorkflowYaml({
+    repoName: '@smoothbricks/codebase',
+    platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    runsOn: [...nixosRunsOn],
+  });
+  expect(rendered).toContain(
+    `runs-on:
+      \${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      fromJSON('["nixos-latest-x64","self-hosted"]') || 'ubuntu-latest' }}`,
+  );
+  expect(rendered).toContain('  macos-platform:\n    runs-on: macos-latest');
+  // Only the pre-publish linux job runs on self-hosted
+  expect(rendered.split('fromJSON(\'["nixos-latest-x64","self-hosted"]\')').length - 1).toBe(1);
+  expect(rendered).not.toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+  // NPM publishing happens from GitHub runner
+  expect(rendered).toContain(
+    '  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]\n    runs-on: ubuntu-latest',
+  );
+});

package/src/monorepo/ci-workflow.ts

@@ -1,5 +1,7 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
 
+import { renderRunsOnLine } from './github-runs-on.js';
+
 export enum CiWorkflowStepKind {
   Checkout = 'checkout',
   SetupDevenv = 'setup-devenv',
@@ -26,6 +28,8 @@ export interface CiWorkflowDefinitionOptions {
   deploy: boolean;
   deployProvider?: 'cloudflare';
   pushBranches: string[];
+  /** Default ubuntu-latest when omitted. */
+  runsOn?: string | string[];
 }
 
 type CiWorkflowStepInput = Omit<CiWorkflowStep, 'number'>;
@@ -80,7 +84,7 @@ defaults:
 jobs:
   main:
     name: Validate
-    runs-on: ubuntu-latest
+${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 45
     env:
       NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
@@ -150,7 +154,10 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         '          fetch-depth: 0',
       ];
     case CiWorkflowStepKind.SetupDevenv:
+      // One step everywhere. setup-devenv detects host-nix (GARM) vs ephemeral
+      // and skips GH install/cache steps internally — same for ci/publish/managed.
       return [`      - name: ${step.name}`, '        id: setup', '        uses: ./.github/actions/setup-devenv'];
+
     case CiWorkflowStepKind.SetNxShas:
       return [
         `      - name: ${step.name}`,
@@ -184,7 +191,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
       // recursion guard, so the default token suffices.
       return [
         `      - name: ${step.name}`,
-        "        if: ${{ steps.managed-drift.outputs.drifted != '' && steps.managed-drift.outputs.drifted != '0' }}",
+        "        if: steps.managed-drift.outputs.drifted != '' && steps.managed-drift.outputs.drifted != '0'",
         '        run: gh workflow run managed-files.yml --ref "$GITHUB_REF_NAME"',
       ];
     case CiWorkflowStepKind.Deploy:
@@ -212,7 +219,8 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.UploadTraceDbs:
       return [
         `      - name: ${step.name}`,
-        '        if: ${{ always() }}',
+        '        # success() is the default; always() keeps traces after a red build/test.',
+        '        if: always()',
         '        uses: actions/upload-artifact@v7.0.1',
         '        with:',
         '          name: trace-results-${{ github.run_id }}',
@@ -224,7 +232,9 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.SaveNixDevenv:
       return [
         `      - name: ${step.name}`,
-        '        if: ${{ always() }}',
+        '        # always() still saves after a red job. Nix NAR is ephemeral-only;',
+        '        # devenv eval-cache also saves on host-nix when setup missed.',
+        '        if: always()',
         '        uses: ./.github/actions/save-nix-devenv',
         '        with:',
         '          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}',

package/src/monorepo/github-runs-on.ts

@@ -0,0 +1,45 @@
+/** Shared `runs-on:` emission for generated GitHub workflow YAML. */
+
+export type WorkflowRunsOn = string | string[] | undefined;
+
+export function isNixosRunner(runsOn: WorkflowRunsOn): boolean {
+  const labels = runsOn === undefined ? [] : typeof runsOn === 'string' ? [runsOn] : runsOn;
+  return labels.some((label) => label === 'nixos' || label.startsWith('nixos-'));
+}
+
+/**
+ * Trusted jobs use configured nixos self-hosted labels; fork PRs stay on
+ * ubuntu-latest (no access to the private runner fleet).
+ */
+export function githubUsesNixosRunnerExpr(): string {
+  return "(github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)";
+}
+
+/**
+ * Full `    runs-on: …` line(s), indented for a job under `jobs.<id>:`.
+ * Nixos labels emit the multiline prettier-stable fork-gate expression.
+ */
+export function renderRunsOnLine(runsOn: WorkflowRunsOn): string {
+  if (!isNixosRunner(runsOn)) {
+    let value: string;
+    if (runsOn === undefined) {
+      value = 'ubuntu-latest';
+    } else if (typeof runsOn === 'string') {
+      value = runsOn.length > 0 ? runsOn : 'ubuntu-latest';
+    } else if (runsOn.length === 0) {
+      value = 'ubuntu-latest';
+    } else if (runsOn.length === 1) {
+      value = runsOn[0] ?? 'ubuntu-latest';
+    } else {
+      value = `[${runsOn.map((label) => `'${label}'`).join(', ')}]`;
+    }
+    return `    runs-on: ${value}`;
+  }
+
+  const labels = typeof runsOn === 'string' ? [runsOn] : runsOn;
+  // Multiline matches prettier so checked-in workflows stay byte-identical.
+  const nixosJson = JSON.stringify(labels);
+  return `    runs-on:
+      \${{ ${githubUsesNixosRunnerExpr()} &&
+      fromJSON('${nixosJson}') || 'ubuntu-latest' }}`;
+}

package/src/monorepo/index.ts

@@ -51,7 +51,7 @@ export async function initMonorepo(root: string, options: InitOptions): Promise<
     return;
   }
 
-  printResults(applyManagedFiles(root, 'update'));
+  printResults(await applyManagedFiles(root, 'update'));
   await runInitPacks({ root, syncRuntime: process.env.DEVENV_ROOT !== undefined || options.syncRuntime === true });
 }
 
@@ -76,7 +76,7 @@ export async function validateMonorepo(root: string, options: ValidateOptions =
 }
 
 export async function updateManagedFiles(root: string): Promise<void> {
-  printResults(applyManagedFiles(root, 'update'));
+  printResults(await applyManagedFiles(root, 'update'));
   // Tool dependency policy (typescript API 6, @typescript/native for ttsc, nx, …)
   // lives next to managed templates — update must install them, not only rewrite files.
   await applyToolConfigDefaults(root);
@@ -90,20 +90,20 @@ export async function updateManagedFiles(root: string): Promise<void> {
   }
 }
 
-export function checkManagedFiles(root: string, options: { warn?: boolean } = {}): void {
+export async function checkManagedFiles(root: string, options: { warn?: boolean } = {}): Promise<void> {
   if (options.warn === true) {
-    warnOnManagedFileDrift(root);
+    await warnOnManagedFileDrift(root);
     return;
   }
-  const results = applyManagedFiles(root, 'check');
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   if (results.some((result) => result.action === 'drifted')) {
     throw new Error('Managed monorepo files are out of date. Run: smoo monorepo update');
   }
 }
 
-export function diffManagedFiles(root: string): void {
-  printResults(applyManagedFiles(root, 'diff'));
+export async function diffManagedFiles(root: string): Promise<void> {
+  printResults(await applyManagedFiles(root, 'diff'));
 }
 
 export function validateCommitMessageFile(

package/src/monorepo/managed-files.test.ts

@@ -5,13 +5,16 @@ import { join } from 'node:path';
 import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
 import {
+  deployTargetInfoFromProjects,
   extractInlineLocalBlocksForTest,
   INLINE_LOCAL_BEGIN,
   INLINE_LOCAL_END,
   LOCAL_SECTION_MARKER,
+  type NxGraphProjectNode,
   platformTargetGlobsForTest,
   reinsertInlineLocalBlocksForTest,
   splitLocalSectionForTest,
+  targetNamesFromProjects,
 } from './managed-files.js';
 
 const MANAGED = '# managed content\npath merge=driver\n';
@@ -172,6 +175,52 @@ describe('managed publish platform discovery', () => {
   });
 });
 
+describe('nx graph project helpers', () => {
+  const sampleNodes: Record<string, NxGraphProjectNode> = {
+    lib: {
+      data: {
+        targets: {
+          build: {},
+          'bundle-linux': {},
+          lint: {},
+        },
+      },
+    },
+    app: {
+      data: {
+        targets: {
+          deploy: {
+            options: { command: 'echo no' },
+            configurations: {
+              staging: { command: 'wrangler deploy --env staging' },
+              production: { options: { command: 'wrangler deploy --env production' } },
+            },
+          },
+          'package-macos': {},
+        },
+      },
+    },
+  };
+
+  it('collects target names from graph nodes without project names', () => {
+    expect(targetNamesFromProjects(sampleNodes).sort()).toEqual(
+      ['build', 'bundle-linux', 'deploy', 'lint', 'package-macos'].sort(),
+    );
+  });
+
+  it('detects deploy configurations and cloudflare provider from graph nodes', () => {
+    expect(deployTargetInfoFromProjects(sampleNodes, 'staging')).toEqual({
+      exists: true,
+      provider: 'cloudflare',
+    });
+    expect(deployTargetInfoFromProjects(sampleNodes, 'production')).toEqual({
+      exists: true,
+      provider: 'cloudflare',
+    });
+    expect(deployTargetInfoFromProjects(sampleNodes, 'preview')).toEqual({ exists: false });
+  });
+});
+
 describe('managed cache actions', () => {
   it('renders the checked-in action copies from their managed templates', async () => {
     for (const action of CACHE_ACTIONS) {

package/src/monorepo/managed-files.ts

@@ -1,9 +1,10 @@
-import { execFileSync } from 'node:child_process';
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { type PackageJson, parseNxProjectJsonText, parseStringArrayText } from '../lib/json.js';
+// Nx package exports are CLI-oriented; this is the module the CLI uses for graph + daemon IPC.
+import { createProjectGraphAsync } from 'nx/src/project-graph/project-graph.js';
+import type { PackageJson } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -137,6 +138,7 @@ interface ManagedFileContext {
   stagingDeployProvider?: 'cloudflare';
   productionDeployProvider?: 'cloudflare';
   ciPushBranches: string[];
+  ciRunsOn: string | string[];
   nodeModulesCacheKey: string;
   repoName: string;
   platformTargetGlobs: string[];
@@ -254,8 +256,8 @@ const managedFiles: ManagedFile[] = [
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
-export function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): FileResult[] {
-  const context = getManagedFileContext(root);
+export async function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]> {
+  const context = await getManagedFileContext(root);
   return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
 }
 
@@ -306,6 +308,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploy: context.hasStagingDeployTargets,
         deployProvider: context.stagingDeployProvider,
         pushBranches: context.ciPushBranches,
+        runsOn: context.ciRunsOn,
       });
     }
     if (file.source === 'publish-workflow') {
@@ -314,6 +317,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deployProvider: context.productionDeployProvider,
         repoName: context.repoName,
         platformTargetGlobs: context.platformTargetGlobs,
+        runsOn: context.ciRunsOn,
       });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
@@ -327,13 +331,16 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
   return renderTemplate(context, content);
 }
 
-function getManagedFileContext(root: string): ManagedFileContext {
+async function getManagedFileContext(root: string): Promise<ManagedFileContext> {
   const packageJson = readPackageJson(join(root, 'package.json'));
   const repoName = packageJson?.name ?? 'monorepo';
   const ciPushBranches = getCiPushBranches(packageJson?.json);
-  const stagingDeploy = getDeployTargetInfo(root, 'staging');
-  const productionDeploy = getDeployTargetInfo(root, 'production');
-  const platformTargetGlobs = platformTargetGlobsForTest(readResolvedNxTargetNames(root));
+  const ciRunsOn = getCiRunsOn(packageJson?.json);
+  // In-process Nx API → daemon socket (no second Node/`nx` CLI process).
+  const nxProjects = await loadNxGraphProjects(root);
+  const stagingDeploy = deployTargetInfoFromProjects(nxProjects, 'staging');
+  const productionDeploy = deployTargetInfoFromProjects(nxProjects, 'production');
+  const platformTargetGlobs = platformTargetGlobsForTest(targetNamesFromProjects(nxProjects));
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
@@ -344,6 +351,7 @@ function getManagedFileContext(root: string): ManagedFileContext {
     stagingDeployProvider: stagingDeploy.provider,
     productionDeployProvider: productionDeploy.provider,
     ciPushBranches,
+    ciRunsOn,
     nodeModulesCacheKey,
     repoName,
     platformTargetGlobs,
@@ -358,81 +366,109 @@ export function platformTargetGlobsForTest(targetNames: Iterable<string>): strin
   });
 }
 
-function readResolvedNxTargetNames(root: string): string[] {
-  const output = execFileSync('nx', ['show', 'projects', '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projects = parseStringArrayText(output);
-  if (!projects) {
-    return [];
-  }
-  const targetNames = new Set<string>();
-  for (const project of projects) {
-    const projectOutput = execFileSync('nx', ['show', 'project', project, '--json'], {
-      cwd: root,
-      encoding: 'utf8',
-      stdio: ['ignore', 'pipe', 'inherit'],
-    });
-    const projectJson = parseNxProjectJsonText(projectOutput);
-    const targets = projectJson?.targets;
-    if (targets) {
-      for (const targetName of Object.keys(targets)) {
-        targetNames.add(targetName);
-      }
+/** Resolved Nx project node as returned under `graph.nodes` / project-graph.json. */
+export type NxGraphProjectNode = {
+  data?: { targets?: Record<string, NxGraphTarget> };
+  targets?: Record<string, NxGraphTarget>;
+};
+
+type NxGraphTarget = {
+  command?: string;
+  options?: { command?: string };
+  configurations?: Record<string, { command?: string; options?: { command?: string } }>;
+};
+
+/**
+ * Load resolved project nodes via Nx's programmatic API.
+ *
+ * `createProjectGraphAsync` is what the CLI uses: with the daemon up it speaks the
+ * daemon unix socket instead of rebuilding the graph in a fresh Node process.
+ * Spawning `nx graph` / `nx show` only added CLI boot + plugin-worker overhead on
+ * top of that. smoo runs under Bun; Bun can import this CJS module directly.
+ */
+async function loadNxGraphProjects(root: string): Promise<Record<string, NxGraphProjectNode>> {
+  const prevCwd = process.cwd();
+  process.chdir(root);
+  try {
+    const graph = (await createProjectGraphAsync()) as {
+      nodes: Record<string, { data?: { targets?: Record<string, NxGraphTarget> } }>;
+    };
+    const out: Record<string, NxGraphProjectNode> = {};
+    for (const [name, node] of Object.entries(graph.nodes)) {
+      out[name] = { data: { targets: node.data?.targets ?? {} } };
     }
+    return out;
+  } finally {
+    process.chdir(prevCwd);
   }
-  return [...targetNames];
 }
 
-function renderTemplate(context: ManagedFileContext, template: string): string {
-  return template
-    .replaceAll('{{REPO_NAME}}', context.repoName)
-    .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
-    .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
+function targetsOfProject(node: NxGraphProjectNode): Record<string, NxGraphTarget> {
+  return node.data?.targets ?? node.targets ?? {};
 }
 
-function getDeployTargetInfo(root: string, configuration: string): DeployTargetInfo {
-  const output = execFileSync('nx', ['show', 'projects', '--withTarget', 'deploy', '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projects = parseStringArrayText(output);
-  if (!projects) {
-    return { exists: false };
+/** Test seam: collect target names from a graph.nodes map. */
+export function targetNamesFromProjects(nodes: Record<string, NxGraphProjectNode>): string[] {
+  const targetNames = new Set<string>();
+  for (const node of Object.values(nodes)) {
+    for (const name of Object.keys(targetsOfProject(node))) {
+      targetNames.add(name);
+    }
   }
+  return [...targetNames];
+}
+
+/** Test seam: deploy configuration presence/provider from graph nodes. */
+export function deployTargetInfoFromProjects(
+  nodes: Record<string, NxGraphProjectNode>,
+  configuration: string,
+): DeployTargetInfo {
   let exists = false;
   let provider: DeployTargetInfo['provider'];
-  for (const project of projects) {
-    const target = nxDeployTarget(root, project, configuration);
-    if (!target.exists) {
+  for (const node of Object.values(nodes)) {
+    const info = deployTargetInfoFromTargets(targetsOfProject(node), configuration);
+    if (!info.exists) {
       continue;
     }
     exists = true;
-    provider ??= target.provider;
+    provider ??= info.provider;
   }
   return { exists, provider };
 }
 
-function nxDeployTarget(root: string, project: string, configuration: string): DeployTargetInfo {
-  const output = execFileSync('nx', ['show', 'project', project, '--json'], {
-    cwd: root,
-    encoding: 'utf8',
-    stdio: ['ignore', 'pipe', 'inherit'],
-  });
-  const projectJson = parseNxProjectJsonText(output);
-  const deploy = projectJson?.targets?.deploy;
-  const config = deploy?.configurations?.[configuration];
+function deployTargetInfoFromTargets(targets: Record<string, NxGraphTarget>, configuration: string): DeployTargetInfo {
+  const deploy = targets.deploy;
+  if (!deploy) {
+    return { exists: false };
+  }
+  const config = deploy.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? deploy?.options?.command;
+  const commandValue = config.command ?? config.options?.command ?? deploy.options?.command ?? deploy.command;
   const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }
 
+function renderTemplate(context: ManagedFileContext, template: string): string {
+  return template
+    .replaceAll('{{REPO_NAME}}', context.repoName)
+    .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
+    .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
+}
+
+function getCiRunsOn(packageJson: PackageJson | null | undefined): string | string[] {
+  const configured = packageJson?.smoo?.github?.runsOn;
+  if (configured === undefined) {
+    return 'ubuntu-latest';
+  }
+  if (typeof configured === 'string') {
+    return configured.length > 0 ? configured : 'ubuntu-latest';
+  }
+  const labels = configured.filter((label) => label.length > 0);
+  return labels.length > 0 ? labels : 'ubuntu-latest';
+}
+
 function getCiPushBranches(packageJson: PackageJson | null | undefined): string[] {
   const configured = readCiPushBranches(packageJson);
   return configured.length > 0 ? configured : ['main'];
@@ -458,8 +494,8 @@ export function printResults(results: FileResult[]): void {
   }
 }
 
-export function validateManagedFiles(root: string): number {
-  const results = applyManagedFiles(root, 'check');
+export async function validateManagedFiles(root: string): Promise<number> {
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   const failures = results.filter((result) => result.action === 'drifted').length;
   if (failures > 0) {
@@ -478,8 +514,8 @@ export function validateManagedFiles(root: string): number {
  * Under GitHub Actions the drifted-file count is published as the step output
  * `drifted`, so downstream steps gate declaratively instead of parsing logs.
  */
-export function warnOnManagedFileDrift(root: string): void {
-  const results = applyManagedFiles(root, 'check');
+export async function warnOnManagedFileDrift(root: string): Promise<void> {
+  const results = await applyManagedFiles(root, 'check');
   printResults(results);
   const drifted = results.filter((result) => result.action === 'drifted');
   if (process.env.GITHUB_OUTPUT) {

package/src/monorepo/packs/index.ts

@@ -92,7 +92,7 @@ const packs: MonorepoPack[] = [
       // Managed-file drift is derived state (CLI template x pinned version) with
       // its own remediation flow; it warns instead of failing so validation only
       // blocks on actual package issues. See warnOnManagedFileDrift.
-      warnOnManagedFileDrift(ctx.root);
+      await warnOnManagedFileDrift(ctx.root);
       return (
         runtimeFailures +
         validateRootPackagePolicy(ctx.root) +