@smoothbricks/cli 0.10.5 → 0.10.7

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -1,44 +1,71 @@
 name: Setup Nix/devenv
-description: Restore caches and build the SmoothBricks devenv shell after checkout.
+description: >
+  Build the SmoothBricks devenv shell after checkout. Restores the small devenv/direnv actions/cache segment on every
+  runner (eval SQLite + shell scripts). On GARM/NixOS (NIX_REMOTE=daemon + /var/cache/ci) skips Nix install and the
+  large store NAR (host store). On ubuntu/macOS installs Nix and restores the NAR/profile cache.
 
 outputs:
   nix-cache-hit:
     description: Whether the Nix profile/store cache restored from the exact primary key.
-    value: ${{ steps.nix-cache.outputs.cache-hit }}
+    value: ${{ steps.nix-cache.outputs.cache-hit || 'false' }}
   devenv-cache-hit:
     description: Whether the devenv/direnv cache restored from the exact primary key.
-    value: ${{ steps.devenv-cache.outputs.cache-hit }}
+    value: ${{ steps.devenv-cache.outputs.cache-hit || 'false' }}
+  host-runner:
+    description: Whether this job is on a host-nix runner (GARM) with shared store/caches.
+    value: ${{ steps.runner-kind.outputs.host }}
 
 runs:
   using: composite
   steps:
     # This action is intentionally post-checkout only. Repo-local actions do not
     # exist before actions/checkout has populated the working tree.
+
+    # Runner image/profile owns paths (NIX_REMOTE, /var/cache/ci/*). Detect here
+    # so every workflow can `uses: setup-devenv` without forking step graphs.
+    - name: 🔎 Runner kind
+      id: runner-kind
+      shell: bash
+      run: |
+        if [ "${NIX_REMOTE:-}" = daemon ] && [ -d /var/cache/ci ]; then
+          echo "host=true" >> "$GITHUB_OUTPUT"
+          echo "host-nix runner (shared store + /var/cache/ci)"
+        else
+          echo "host=false" >> "$GITHUB_OUTPUT"
+          echo "ephemeral runner (install Nix + GH caches)"
+        fi
+
+    # Devenv segment (own key): tooling/direnv/.devenv + .direnv — includes
+    # nix-eval-cache.db. Independent of the nix NAR; restore on host and ephemeral
+    # whether or not the store cache hit. Missing store paths are fine: devenv
+    # verifies shell drv/out exist on eval-cache hit and invalidates + re-evals
+    # / realizes when GC removed them. Packages still come from host store, NAR,
+    # or Cachix — this blob only skips evaluation.
+    - name: 🧊 Cache devenv and direnv
+      id: devenv-cache
+      uses: ./.github/actions/cache-nix-devenv
+      with:
+        segment: devenv
+
     - name: ❄️ Install Nix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: DeterminateSystems/determinate-nix-action@v3
 
     - name: 🧊 Cache Nix profiles and store NAR
       id: nix-cache
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-nix-devenv
       with:
         segment: nix
 
     - name: ♻️ Restore Nix store from NAR
+      if: steps.runner-kind.outputs.host != 'true'
       shell: bash
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh restore-store
 
-    # Restore direnv state only when the Nix cache key is exact. Partial Nix
-    # restores can contain a NAR for a different shell closure, and .direnv
-    # points directly at derivations inside that closure.
-    - name: 🧊 Cache devenv and direnv
-      id: devenv-cache
-      if: ${{ steps.nix-cache.outputs.cache-hit == 'true' }}
-      uses: ./.github/actions/cache-nix-devenv
-      with:
-        segment: devenv
-
     - name: ⚡ Enable Cachix
+      if: steps.runner-kind.outputs.host != 'true'
       uses: cachix/cachix-action@v17
       with:
         name: devenv
@@ -48,12 +75,14 @@ runs:
       working-directory: tooling/direnv
       run: ./github-actions-bootstrap.sh install-devenv
 
+    # node_modules + ttsc plugin binaries: GH Actions cache on ephemeral runners.
+    # Host runners keep those under the /var/cache/ci bind (bun / ttsc env).
     - name: 📦 Cache node_modules
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-node-modules
 
-    # Restores compiled ttsc native plugins into .cache/ttsc/plugins. TTSC_CACHE_DIR
-    # is set by devenv enterShell (+ bootstrap GITHUB_ENV for later steps).
     - name: 🧊 Cache ttsc plugins
+      if: steps.runner-kind.outputs.host != 'true'
       uses: ./.github/actions/cache-ttsc-plugins
 
     - name: 🐚 Build devenv shell

package/managed/templates/github/workflows/managed-files.yml

@@ -9,10 +9,17 @@
 # change is upstream code that deserves a human look before it lands. Re-runs
 # refresh the same branch in place.
 #
-# NOTE: managed files include .github/workflows/*, and the default GITHUB_TOKEN
-# is server-side forbidden to push workflow-file changes. Configure a GitHub App
-# or PAT token with contents:write + workflows:write as MANAGED_FILES_TOKEN;
-# without it, runs that touch workflow files fail at push with a clear error.
+# REQUIRED SECRET: MANAGED_FILES_TOKEN
+# Managed files include .github/workflows/*. The default GITHUB_TOKEN is
+# server-side forbidden to create/update workflow files, even with
+# contents:write. Configure a GitHub App installation token or classic/fine-
+# grained PAT with:
+#   - contents: write
+#   - pull-requests: write
+#   - workflows: write
+# as repository secret MANAGED_FILES_TOKEN. Without it, any update that
+# touches workflow YAML fails at push (this is the usual "managed files
+# workflow isn't doing anything" failure mode).
 name: Managed files
 
 on:
@@ -41,6 +48,7 @@ jobs:
           filter: blob:none
           fetch-depth: 0
           persist-credentials: true
+          # Prefer MANAGED_FILES_TOKEN so push can update workflow files.
           token: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
 
       - name: 🧱 Setup Nix/devenv
@@ -53,27 +61,71 @@ jobs:
       - name: 📤 Push review branch and open PR
         env:
           GH_TOKEN: ${{ secrets.MANAGED_FILES_TOKEN || github.token }}
+          # secrets.* is empty when unset — used to fail before a useless push.
+          MANAGED_FILES_TOKEN_CONFIGURED: ${{ secrets.MANAGED_FILES_TOKEN != '' }}
         run: |
+          set -euo pipefail
           cd "$(git rev-parse --show-toplevel)"
+
           if [ -z "$(git status --porcelain)" ]; then
             echo "Managed files are in sync; nothing to do."
             exit 0
           fi
+
+          echo "Pending managed-file changes:"
+          git status --porcelain
+
+          workflow_changes="$(git status --porcelain -- .github/workflows || true)"
+          if [ -n "$workflow_changes" ] && [ "${MANAGED_FILES_TOKEN_CONFIGURED}" != "true" ]; then
+            {
+              echo "::error title=MANAGED_FILES_TOKEN required::Managed update touches .github/workflows/* but repository secret MANAGED_FILES_TOKEN is not set."
+              echo ""
+              echo "GitHub refuses pushes that create/update workflow files when the credentials are the default GITHUB_TOKEN / a GitHub App without the workflows permission:"
+              echo "  refusing to allow a GitHub App to create or update workflow ... without \`workflows\` permission"
+              echo ""
+              echo "Fix:"
+              echo "  1. Create a GitHub App (or PAT) with contents:write, pull-requests:write, workflows:write"
+              echo "  2. Install it on this repo"
+              echo "  3. Store an installation token or PAT as repository secret MANAGED_FILES_TOKEN"
+              echo "  4. Re-run this workflow"
+              echo ""
+              echo "Workflow files that would be updated:"
+              echo "$workflow_changes"
+            } >&2
+            exit 1
+          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git switch -C chore/managed-files
           git add -A
           git commit -m "chore: regenerate smoo-managed files"
-          git push --force origin chore/managed-files
-          gh pr create \
-            --head chore/managed-files \
-            --base "${GITHUB_REF_NAME}" \
-            --title "chore: regenerate smoo-managed files" \
-            --body "Automated refresh of smoo-managed files after drift (usually a @smoothbricks/cli pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes - do NOT enable auto-merge." \
-            2>/dev/null || echo "PR already open; branch refreshed in place."
+
+          if ! git push --force origin chore/managed-files 2> /tmp/managed-files-push.err; then
+            cat /tmp/managed-files-push.err >&2
+            if grep -q 'workflows' /tmp/managed-files-push.err; then
+              {
+                echo ""
+                echo "::error title=workflows permission missing::Push rejected because the token cannot update GitHub Actions workflow files."
+                echo "Set repository secret MANAGED_FILES_TOKEN to a GitHub App/PAT with contents:write + pull-requests:write + workflows:write, then re-run."
+              } >&2
+            fi
+            exit 1
+          fi
+
+          if ! gh pr view chore/managed-files --json number --jq .number >/dev/null 2>&1; then
+            gh pr create \
+              --head chore/managed-files \
+              --base "${GITHUB_REF_NAME}" \
+              --title "chore: regenerate smoo-managed files" \
+              --body "Automated refresh of smoo-managed files after drift (usually a \`@smoothbricks/cli\` pin bump). One persistent PR; re-runs force-push this branch in place. Review the template changes — do NOT enable auto-merge."
+          else
+            echo "PR already open for chore/managed-files; branch refreshed in place."
+          fi
 
       - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
+        # success() is default; always() still saves GH Nix cache after a red job.
+        if: always()
         uses: ./.github/actions/save-nix-devenv
         with:
           nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.5",
+  "version": "0.10.7",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,8 +64,8 @@
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
     "@prettier/sync": "^0.6.1",
-    "@smoothbricks/nx-plugin": "0.3.4",
-    "@smoothbricks/validation": "0.1.4",
+    "@smoothbricks/nx-plugin": "0.3.5",
+    "@smoothbricks/validation": "0.1.5",
     "commander": "^14.0.3",
     "prettier": "^3.6.1",
     "publint": "^0.3.18",
@@ -73,7 +73,7 @@
     "sherif": "^1.11.1",
     "toml-eslint-parser": "^1.0.3",
     "tslib": "^2.8.1",
-    "typia": "13.1.19"
+    "typia": "13.2.0"
   },
   "devDependencies": {
     "fast-check": "^4.4.0"

package/src/cli.ts

@@ -66,11 +66,11 @@ function buildProgram(): Command {
     .option('--warn', 'report drift as warnings (GitHub annotations) instead of failing')
     .action(async (options: { warn?: boolean }) => {
       const { checkManagedFiles } = await import('./monorepo/index.js');
-      checkManagedFiles(await findRepoRoot(), { warn: options.warn });
+      await checkManagedFiles(await findRepoRoot(), { warn: options.warn });
     });
   monorepo.command('diff').action(async () => {
     const { diffManagedFiles } = await import('./monorepo/index.js');
-    diffManagedFiles(await findRepoRoot());
+    await diffManagedFiles(await findRepoRoot());
   });
   monorepo
     .command('validate-commit-msg <commitMsgFile>')
@@ -348,10 +348,17 @@ function buildProgram(): Command {
     .command('nx-run-many')
     .requiredOption('--targets <targets>')
     .option('--projects <projects>')
+    .option('--projects-with-targets <targets>', 'select projects owning any comma-separated target or target glob')
     .option('--configuration <configuration>')
     .option('--collect-outputs <directory>')
     .action(
-      async (options: { targets: string; projects?: string; configuration?: string; collectOutputs?: string }) => {
+      async (options: {
+        targets: string;
+        projects?: string;
+        projectsWithTargets?: string;
+        configuration?: string;
+        collectOutputs?: string;
+      }) => {
         const { githubCiNxRunMany } = await import('./github-ci/index.js');
         await githubCiNxRunMany(await findRepoRoot(), options);
       },

package/src/github-ci/index.test.ts

@@ -38,7 +38,7 @@ describe('GitHub CI Nx target expansion', () => {
       ['test', ['api', 'desktop']],
     ]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=5'],
+      ['run-many', '-t', 'test', '--projects=api,desktop', '--parallel=100%'],
     ]);
   });
 
@@ -53,6 +53,28 @@ describe('GitHub CI Nx target expansion', () => {
     ]);
   });
 
+  it('selects test owners from target globs and fails if any selected project lacks test', () => {
+    const platformProjects = projects.map((project) =>
+      project.project === 'mobile' ? { ...project, targets: [...project.targets, 'test'] } : project,
+    );
+    const expanded = expandNxTargetRuns(platformProjects, {
+      targets: 'test',
+      projectsWithTargets: '*-macos,*-ios',
+    });
+
+    expect(expanded.runs.map((run) => [run.target, run.projects.map((project) => project.project)])).toEqual([
+      ['test', ['desktop', 'mobile']],
+    ]);
+    const [testRun] = expanded.runs;
+    if (!testRun) {
+      throw new Error('Expected a test target run.');
+    }
+    expect(nxRunManyArgs(testRun)).toEqual(['run-many', '-t', 'test', '--projects=desktop,mobile', '--parallel=100%']);
+    expect(() => expandNxTargetRuns(projects, { targets: 'test', projectsWithTargets: '*-macos,*-ios' })).toThrow(
+      'Nx target test is missing for project(s) selected by --projects-with-targets *-macos,*-ios: mobile.',
+    );
+  });
+
   it('reports a zero-match glob as an empty run set', () => {
     expect(expandNxTargetRuns(projects, { targets: '*-windows' })).toEqual({
       runs: [],
@@ -65,7 +87,7 @@ describe('GitHub CI Nx target expansion', () => {
 
     expect(expanded.unmatchedGlobs).toEqual([]);
     expect(expanded.runs.map((run) => nxRunManyArgs(run))).toEqual([
-      ['run-many', '-t', 'missing', '--projects=api', '--parallel=5'],
+      ['run-many', '-t', 'missing', '--projects=api', '--parallel=100%'],
     ]);
   });
 
@@ -114,7 +136,7 @@ describe('GitHub CI Nx target expansion', () => {
       '-t',
       'test',
       '--exclude=tag:ci:skip:test',
-      '--parallel=5',
+      '--parallel=100%',
     ]);
     expect(nxRunManyArgs({ target: 'test', projects: projects.slice(0, 1) })).not.toContain(
       '--exclude=tag:ci:skip:test',
@@ -155,6 +177,21 @@ describe('collected Nx outputs', () => {
     });
   });
 
+  it('runs test for projects selected by platform target ownership', async () => {
+    await withNxRunManyFixture(async ({ root }) => {
+      await writeFile(join(root, 'packages/app/test-target.ts'), "await Bun.write('test-ran.txt', 'tested');\n");
+      await writeFile(join(root, 'packages/app/build-target.ts'), "throw new Error('build must not run here');\n");
+
+      await githubCiNxRunMany(root, {
+        targets: 'test',
+        projectsWithTargets: '*-macos,*-ios',
+      });
+
+      await expect(readFile(join(root, 'test-ran.txt'), 'utf8')).resolves.toBe('tested');
+      await expect(readFile(join(root, 'build-ran.txt'), 'utf8')).rejects.toThrow();
+    });
+  });
+
   it('applies an empty manifest after artifact transport omits its empty workspace directory', async () => {
     await withOutputFixture(async ({ root, artifact }) => {
       const manifest = await collectNxOutputs(root, artifact, [], SOURCE_SHA);
@@ -472,7 +509,19 @@ async function withNxRunManyFixture(
       join(root, 'packages/app/package.json'),
       JSON.stringify({
         name: '@fixture/app',
-        nx: { name: 'app', targets: { build: { executor: 'nx:noop' } } },
+        nx: {
+          name: 'app',
+          targets: {
+            'build-macos': {
+              executor: 'nx:run-commands',
+              options: { command: 'bun packages/app/build-target.ts', cwd: '.' },
+            },
+            test: {
+              executor: 'nx:run-commands',
+              options: { command: 'bun packages/app/test-target.ts', cwd: '.' },
+            },
+          },
+        },
       }),
     );
     await $`git init --quiet`.cwd(root);

package/src/github-ci/index.ts

@@ -27,6 +27,9 @@ const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDep
 
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
+/** Nx workers = host cores (CI runners sized for full machine use). */
+const NX_PARALLEL = '100%';
+
 export async function cleanupGithubCiCache(root: string): Promise<void> {
   const githubOutput = process.env.GITHUB_OUTPUT;
   const markCacheReady = async (ready: boolean): Promise<void> => {
@@ -139,7 +142,7 @@ export function nxSmartArgs(target: string, mode: 'affected' | 'run-many', confi
   if (configuration) {
     args.push(`--configuration=${configuration}`);
   }
-  args.push(`--exclude=tag:ci:skip:${target}`, '--parallel=5');
+  args.push(`--exclude=tag:ci:skip:${target}`, `--parallel=${NX_PARALLEL}`);
   return args;
 }
 
@@ -165,6 +168,7 @@ export interface NxRunManyOptions {
   configuration?: string;
   collectOutputs?: string;
   allowEmptyProjects?: boolean;
+  projectsWithTargets?: string;
 }
 
 export interface ExpandedNxTargetRuns {
@@ -173,10 +177,18 @@ export interface ExpandedNxTargetRuns {
 }
 
 export function expandNxTargetRuns(projects: ProjectTargets[], options: NxRunManyOptions): ExpandedNxTargetRuns {
-  const selectedProjects = selectProjects(projects, options.projects);
-  if (options.projects !== undefined && selectedProjects.length === 0 && options.allowEmptyProjects !== true) {
+  const namedProjects = selectProjects(projects, options.projects);
+  if (options.projects !== undefined && namedProjects.length === 0 && options.allowEmptyProjects !== true) {
     throw new Error(`No Nx projects matched --projects ${options.projects}.`);
   }
+  const selectedProjects = selectProjectsWithTargets(namedProjects, options.projectsWithTargets);
+  if (
+    options.projectsWithTargets !== undefined &&
+    selectedProjects.length === 0 &&
+    options.allowEmptyProjects !== true
+  ) {
+    throw new Error(`No Nx projects own targets matching --projects-with-targets ${options.projectsWithTargets}.`);
+  }
   const selectedTargetNames = [...new Set(selectedProjects.flatMap((project) => project.targets))].sort((a, b) =>
     a.localeCompare(b),
   );
@@ -192,6 +204,16 @@ export function expandNxTargetRuns(projects: ProjectTargets[], options: NxRunMan
       unmatchedGlobs.push(targetPattern);
     }
     for (const target of targets) {
+      if (!isGlob && options.projectsWithTargets !== undefined) {
+        const missingProjects = selectedProjects
+          .filter((project) => !project.targets.includes(target))
+          .map((project) => project.project);
+        if (missingProjects.length > 0) {
+          throw new Error(
+            `Nx target ${target} is missing for project(s) selected by --projects-with-targets ${options.projectsWithTargets}: ${missingProjects.join(', ')}.`,
+          );
+        }
+      }
       if (addedTargets.has(target)) {
         continue;
       }
@@ -262,7 +284,7 @@ export function nxRunManyArgs(run: NxTargetRun, configuration?: string): string[
   if (configuration) {
     nxArgs.push(`--configuration=${configuration}`);
   }
-  nxArgs.push('--parallel=5');
+  nxArgs.push(`--parallel=${NX_PARALLEL}`);
   return nxArgs;
 }
 
@@ -318,6 +340,16 @@ function selectProjects(projects: ProjectTargets[], selectors: string | undefine
     .sort((left, right) => left.project.localeCompare(right.project));
 }
 
+function selectProjectsWithTargets(projects: ProjectTargets[], selectors: string | undefined): ProjectTargets[] {
+  if (selectors === undefined) {
+    return projects;
+  }
+  const patterns = commaSeparatedValues(selectors);
+  return projects.filter((project) =>
+    project.targets.some((target) => patterns.some((pattern) => new Bun.Glob(pattern).match(target))),
+  );
+}
+
 function commaSeparatedValues(value: string): string[] {
   return value
     .split(',')
@@ -343,7 +375,7 @@ export async function githubCiNxDeploy(
   const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
   for (const target of targets) {
-    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, '--parallel=5'];
+    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, `--parallel=${NX_PARALLEL}`];
     if (target === 'deploy') {
       nxArgs.push(`--configuration=${options.configuration}`);
     }

package/src/lib/json.ts

@@ -23,6 +23,8 @@ export interface PackagePublishConfig {
 
 export interface PackageSmooGithub {
   pushBranches?: string[];
+  /** GitHub Actions runs-on for managed CI (string or label list). Default: ubuntu-latest. */
+  runsOn?: string | string[];
 }
 
 export interface PackageSmooConfig {
@@ -78,7 +80,7 @@ export type NxDependsOn = string | NxDependsOnObject;
 /** Nx target options are executor-specific open bags. */
 export type NxTargetOptions = Record<string, unknown>;
 
-export type NxInput = string | Record<string, unknown>;
+export type NxInput = string | object;
 
 export interface NxTargetConfig {
   executor?: string;

package/src/lib/workspace.ts

@@ -129,6 +129,7 @@ function listWorkspacePackageJsonPaths(root: string, workspacePatterns: string[]
   const paths: string[] = [];
   for (const pattern of workspacePatterns) {
     if (!pattern.endsWith('/*')) {
+      paths.push(join(root, pattern, 'package.json'));
       continue;
     }
     const parent = join(root, pattern.slice(0, -2));

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -5,9 +5,15 @@ import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('CI workflow definition', () => {
   it('renders the checked-in local CI workflow copy', async () => {
-    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
 
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
@@ -25,6 +31,13 @@ describe('CI workflow definition', () => {
       'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
     );
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    expect(rendered).toContain('runs-on: ubuntu-latest');
   });
 
   it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
@@ -44,4 +57,27 @@ describe('CI workflow definition', () => {
     expect(restoreKey).toBe('${{ runner.os }}-${{ runner.arch }}-nx-db-v1-${{ github.sha }}');
     expect(saveKey).toBe(restoreKey);
   });
+
+  it('nixos config: fork PRs on ubuntu; one setup-devenv (composite owns host path)', () => {
+    const rendered = renderCiWorkflowYaml({
+      deploy: false,
+      pushBranches: ['main'],
+      runsOn: [...nixosRunsOn],
+    });
+
+    expect(rendered).toContain(
+      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}",
+    );
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('id: setup');
+    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
+    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
+    expect(rendered).not.toContain('github-actions-bootstrap.sh');
+    expect(rendered).not.toContain('determinate-nix-action');
+    expect(rendered).toContain('if: always()');
+    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
+    // workflow yaml does not embed composite internals
+    expect(rendered).not.toContain('cache-node-modules');
+    expect(rendered).not.toContain('cache-ttsc-plugins');
+  });
 });

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -19,11 +19,14 @@ import {
   runPublishWorkflow,
 } from '../publish-workflow.js';
 
+const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
+
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
@@ -35,6 +38,7 @@ describe('publish workflow definition', () => {
     const rendered = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
 
     await expect(
@@ -95,7 +99,7 @@ describe('publish workflow definition', () => {
 
     expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
-    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 7 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 8 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
     expect(singleJob).toContain('# Step 14\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
     expect(singleJob).toContain('# Step 15\n      - name: 🧹 Cleanup and cache Nix/devenv');
@@ -105,7 +109,7 @@ describe('publish workflow definition', () => {
     );
     expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(macosPlatform).toContain('# Step 5\n      - name: 🍎 Build selected macOS and iOS release outputs');
-    expect(macosPlatform).toContain('# Step 7\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(macosPlatform).toContain('# Step 8\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(finalJob).toContain('# Step 7\n      - name: 🧯 Repair pending releases');
     expect(finalJob).toContain('# Step 8\n      - name: ♻️ Restore validated release state');
     expect(finalJob).toContain('# Step 9\n      - name: 📦 Apply verified Linux outputs');
@@ -125,6 +129,7 @@ describe('publish workflow definition', () => {
     const native = renderPublishWorkflowYaml({
       repoName: '@smoothbricks/codebase',
       platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+      runsOn: [...nixosRunsOn],
     });
     const linuxCandidate = native.slice(
       native.indexOf('  linux-release-candidate:'),
@@ -137,8 +142,9 @@ describe('publish workflow definition', () => {
     expect(linuxOnly).toContain(
       `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
     );
-    expect(native).toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+    expect(native).toContain('  linux-release-candidate:');
     expect(native).toContain('  macos-platform:\n    runs-on: macos-latest');
+    expect(native).toContain('  publish-on-linux:');
     expect(native).toContain('  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]');
     expect(linuxCandidate).not.toContain('needs:');
     expect(macosPlatform).not.toContain('needs:');
@@ -150,12 +156,20 @@ describe('publish workflow definition', () => {
     expect(linuxCandidate).toContain(
       `smoo github-ci nx-run-many --targets "${LINUX_PLATFORM_TARGET_GLOBS.join(',')}" --projects`,
     );
-    expect(macosPlatform).not.toContain('smoo github-ci nx-run-many');
     expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
       `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
         ',',
       )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
     );
+    expect(macosPlatform).toContain(
+      `run: smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`,
+    );
+    expect(macosPlatform.indexOf('- name: 🍎 Build selected macOS and iOS release outputs')).toBeLessThan(
+      macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages'),
+    );
+    expect(macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages')).toBeLessThan(
+      macosPlatform.indexOf('- name: 📤 Upload macOS platform outputs'),
+    );
     expect(finalJob).not.toContain('smoo release version');
     expect(finalJob).not.toContain('nx-run-many');
     expect(foldedRunCommand(finalJob, '🧯 Repair pending releases')).toBe(
@@ -612,3 +626,24 @@ function packageNameFromTag(tag: string): string {
   }
   return tag.slice(0, versionSeparator);
 }
+
+it('linux publish jobs use smoo.github.runsOn; macOS stays macos-latest', () => {
+  const rendered = renderPublishWorkflowYaml({
+    repoName: '@smoothbricks/codebase',
+    platformTargetGlobs: PLATFORM_TARGET_GLOBS,
+    runsOn: [...nixosRunsOn],
+  });
+  expect(rendered).toContain(
+    `runs-on:
+      \${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&
+      fromJSON('["nixos-latest-x64","self-hosted"]') || 'ubuntu-latest' }}`,
+  );
+  expect(rendered).toContain('  macos-platform:\n    runs-on: macos-latest');
+  // Only the pre-publish linux job runs on self-hosted
+  expect(rendered.split('fromJSON(\'["nixos-latest-x64","self-hosted"]\')').length - 1).toBe(1);
+  expect(rendered).not.toContain('  linux-release-candidate:\n    runs-on: ubuntu-latest');
+  // NPM publishing happens from GitHub runner
+  expect(rendered).toContain(
+    '  publish-on-linux:\n    needs: [linux-release-candidate, macos-platform]\n    runs-on: ubuntu-latest',
+  );
+});