@smoothbricks/cli 0.10.7 → 0.10.8

package/src/github-ci/index.ts

@@ -1,3 +1,4 @@
+import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, realpath, rename, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
@@ -6,24 +7,45 @@ import typia from 'typia';
 import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
+import {
+  type EnvironmentToken,
+  isPullRequestEnvironment,
+  parseEnvironmentToken,
+  pullRequestEnvironment,
+} from '../wrangler/environment.js';
 import type { NxTargetRun } from './outputs.js';
 
-interface GithubActionsEventPayload {
+export interface GithubActionsEventPayload {
+  action?: string;
   repository?: {
     default_branch?: string;
+    full_name?: string;
+  };
+  pull_request?: {
+    number?: number;
+    head?: {
+      repo?: {
+        full_name?: string;
+      };
+    };
   };
 }
 
-interface NxProjectDeployConfigurations {
+interface NxProjectDeployTarget {
   targets?: {
     deploy?: {
-      configurations?: Record<string, unknown>;
+      command?: unknown;
+      options?: {
+        command?: unknown;
+      };
     };
   };
 }
 
 const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
-const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDeployConfigurations>();
+const isGithubDeployment = typia.createIs<{ id: number }>();
+const isNxProjectDeployTarget = typia.createIs<NxProjectDeployTarget>();
+const parseNxProjectDeployTarget = typia.json.createIsParse<NxProjectDeployTarget>();
 
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
@@ -357,35 +379,102 @@ function commaSeparatedValues(value: string): string[] {
     .filter(Boolean);
 }
 
+export interface GithubCiNxDeployOptions {
+  environment?: string;
+  mode?: NxSmartMode;
+  name?: string;
+  step?: string;
+  verify?: boolean;
+}
+
+export interface GithubCiNxDeployDependencies {
+  listProjects?: (root: string, target: string, mode: 'affected' | 'run-many') => Promise<string[]>;
+  runNx?: (args: string[], root: string) => Promise<number>;
+  appendSummary?: (summaryPath: string, content: string) => Promise<void>;
+  publishDeployment?: (environment: `pr${number}`, url: string) => Promise<void>;
+  setStatus?: (state: 'pending' | 'success' | 'failure') => Promise<void>;
+  processEnv?: NodeJS.ProcessEnv;
+  eventPayload?: GithubActionsEventPayload;
+}
+
 export async function githubCiNxDeploy(
   root: string,
-  options: { configuration: string; mode?: NxSmartMode; name?: string; step?: string; verify?: boolean },
+  options: GithubCiNxDeployOptions,
+  dependencies: GithubCiNxDeployDependencies = {},
 ): Promise<void> {
-  const name = options.name ?? `Deploy ${options.configuration}`;
+  const processEnv = dependencies.processEnv ?? process.env;
+  const eventPayload = dependencies.eventPayload ?? readGithubActionsEvent(processEnv);
+  const environment = resolveDeploymentEnvironment(options.environment, processEnv, eventPayload);
+  const name = options.name ?? 'Deploy Environment';
   const step = options.step ?? '';
-  await createGithubStatus(name, step);
+  const setStatus =
+    dependencies.setStatus ??
+    ((state: 'pending' | 'success' | 'failure') =>
+      state === 'pending' ? createGithubStatus(name, step) : updateGithubStatus(name, state, step));
+  await setStatus('pending');
   const mode = resolveNxSmartMode(options.mode ?? 'run-many');
-  const projects = await deployProjectsWithConfiguration(root, options.configuration, mode);
+  const listProjects = dependencies.listProjects ?? listNxProjectsWithTarget;
+  const runNx = dependencies.runNx ?? ((args: string[], commandRoot: string) => runStatus('nx', args, commandRoot));
+  const projects = await listProjects(root, 'deploy', mode);
   if (projects.length === 0) {
-    console.log(`No ${mode} deploy projects with configuration ${options.configuration}; skipping.`);
-    await updateGithubStatus(name, 'success', step);
+    console.log(`No ${mode} deploy projects; skipping ${environment}.`);
+    await setStatus('success');
     return;
   }
 
   const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
   for (const target of targets) {
-    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, `--parallel=${NX_PARALLEL}`];
+    const nxArgs = [
+      'run-many',
+      '-t',
+      target,
+      `--projects=${projectList}`,
+      '--exclude=tag:permanent-deploy-target',
+      `--parallel=${NX_PARALLEL}`,
+    ];
     if (target === 'deploy') {
-      nxArgs.push(`--configuration=${options.configuration}`);
+      nxArgs.push(`--environment=${environment}`);
     }
-    const status = await runStatus('nx', nxArgs, root);
+    const status = await runNx(nxArgs, root);
     if (status !== 0) {
-      await updateGithubStatus(name, 'failure', step);
+      await setStatus('failure');
       throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
     }
   }
-  await updateGithubStatus(name, 'success', step);
+
+  if (isPullRequestEnvironment(environment)) {
+    const url = `https://app.${environment}.conloca.com`;
+    const summaryPath = processEnv.GITHUB_STEP_SUMMARY;
+    if (summaryPath) {
+      const appendSummary = dependencies.appendSummary ?? appendFile;
+      await appendSummary(summaryPath, `## ${environment} deployment\n\n[View deployment](${url})\n`);
+    }
+    const publishDeployment =
+      dependencies.publishDeployment ??
+      ((token: `pr${number}`, deploymentUrl: string) => publishGithubDeployment(token, deploymentUrl, processEnv));
+    await publishDeployment(environment, url);
+  }
+  if (environment !== 'production') {
+    const e2eProjects = await listProjects(root, 'e2e-deployed', 'run-many');
+    if (e2eProjects.length > 0) {
+      const nxArgs = [
+        'run-many',
+        '-t',
+        'e2e-deployed',
+        `--projects=${e2eProjects.join(',')}`,
+        `--parallel=${NX_PARALLEL}`,
+        `--environment=${environment}`,
+      ];
+      const status = await runNx(nxArgs, root);
+      if (status !== 0) {
+        await setStatus('failure');
+        throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
+      }
+    }
+  }
+
+  await setStatus('success');
 }
 
 function resolveNxSmartMode(mode: NxSmartMode): 'affected' | 'run-many' {
@@ -419,30 +508,183 @@ function eventDefaultBranch(): string | undefined {
   }
 }
 
-async function deployProjectsWithConfiguration(
+export function resolveDeploymentEnvironment(
+  explicit: string | undefined,
+  environment: NodeJS.ProcessEnv,
+  event: GithubActionsEventPayload | undefined,
+): EnvironmentToken {
+  if (explicit !== undefined) return parseEnvironmentToken(explicit);
+  if (environment.GITHUB_EVENT_NAME === 'pull_request') {
+    if (!event?.action || !['opened', 'reopened', 'synchronize'].includes(event.action)) {
+      throw new Error('Pull-request deployment runs only for opened, reopened, or synchronize events.');
+    }
+    const repository = event.repository?.full_name;
+    const headRepository = event.pull_request?.head?.repo?.full_name;
+    if (!repository || !headRepository || repository !== headRepository) {
+      throw new Error('Pull-request deployment is restricted to same-repository pull requests.');
+    }
+    const number = event.pull_request?.number;
+    if (number === undefined) throw new Error('GitHub pull_request event is missing its PR number.');
+    return pullRequestEnvironment(number);
+  }
+  if (environment.GITHUB_EVENT_NAME === 'push' && environment.GITHUB_REF_NAME === 'private') {
+    return 'staging';
+  }
+  if (environment.GITHUB_EVENT_NAME === 'release') {
+    return 'production';
+  }
+  throw new Error('Cannot resolve a deployment environment from this GitHub event; pass --environment explicitly.');
+}
+
+function readGithubActionsEvent(environment: NodeJS.ProcessEnv): GithubActionsEventPayload | undefined {
+  const eventPath = environment.GITHUB_EVENT_PATH;
+  if (!eventPath) return undefined;
+  try {
+    return parseGithubActionsEvent(readFileSync(eventPath, 'utf8')) || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function listNxProjectsWithTarget(
   root: string,
-  configuration: string,
+  target: string,
   mode: 'affected' | 'run-many',
 ): Promise<string[]> {
-  const listArgs =
-    mode === 'affected'
-      ? ['show', 'projects', '--affected', '--withTarget', 'deploy', '--json']
-      : ['show', 'projects', '--withTarget', 'deploy', '--json'];
+  const listArgs = ['show', 'projects'];
+  if (mode === 'affected') listArgs.push('--affected');
+  listArgs.push('--withTarget', target);
+  if (target === 'deploy') listArgs.push('--exclude=tag:permanent-deploy-target');
+  listArgs.push('--json');
   const result = await $`nx ${listArgs}`.cwd(root).quiet();
-  const candidates = nxProjectList(decode(result.stdout));
-  const projects: string[] = [];
+  const candidates = nxProjectList(decode(result.stdout)).sort((left, right) => left.localeCompare(right));
+  if (target !== 'deploy') return candidates;
+  return selectEnvironmentDeployProjects(candidates, async (project) => {
+    const projectResult = await $`nx show project ${project} --json`.cwd(root).quiet();
+    const parsed = parseNxProjectDeployTarget(decode(projectResult.stdout));
+    if (!parsed) throw new Error(`nx show project ${project} returned invalid JSON.`);
+    return parsed;
+  });
+}
+
+export async function selectEnvironmentDeployProjects(
+  candidates: string[],
+  loadProject: (project: string) => Promise<unknown>,
+): Promise<string[]> {
+  const selected: string[] = [];
   for (const project of candidates) {
-    if (await deployTargetHasConfiguration(root, project, configuration)) {
-      projects.push(project);
+    const definition = await loadProject(project);
+    if (!isNxProjectDeployTarget(definition)) continue;
+    const deploy = definition.targets?.deploy;
+    const commandValue = deploy?.options?.command ?? deploy?.command;
+    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-environment')) {
+      selected.push(project);
     }
   }
-  return projects.sort((a, b) => a.localeCompare(b));
+  return selected;
+}
+
+export interface GithubApiProcessResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export interface GithubApiProcessRunner {
+  run(args: string[], input: string, cwd: string): Promise<GithubApiProcessResult>;
+}
+
+export class NodeGithubApiProcessRunner implements GithubApiProcessRunner {
+  run(args: string[], input: string, cwd: string): Promise<GithubApiProcessResult> {
+    const { promise, resolve, reject } = Promise.withResolvers<GithubApiProcessResult>();
+    const child = spawn('gh', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    child.once('error', reject);
+    child.once('close', (code) => {
+      resolve({ exitCode: code ?? -1, stdout, stderr });
+    });
+    child.stdin.end(input);
+    return promise;
+  }
 }
 
-async function deployTargetHasConfiguration(root: string, project: string, configuration: string): Promise<boolean> {
-  const result = await $`nx show project ${project} --json`.cwd(root).quiet();
-  const parsed = parseNxProjectDeployConfigurations(decode(result.stdout));
-  return parsed?.targets?.deploy?.configurations?.[configuration] !== undefined;
+export async function publishGithubDeployment(
+  environment: `pr${number}`,
+  url: string,
+  processEnvironment: NodeJS.ProcessEnv,
+  runner: GithubApiProcessRunner = new NodeGithubApiProcessRunner(),
+): Promise<void> {
+  const repository = processEnvironment.GITHUB_REPOSITORY;
+  const sha = processEnvironment.GITHUB_SHA;
+  if (!repository || !sha) throw new Error('GITHUB_REPOSITORY and GITHUB_SHA are required to publish a deployment.');
+  const createBody = JSON.stringify({
+    ref: sha,
+    environment,
+    auto_merge: false,
+    required_contexts: [],
+    transient_environment: true,
+    production_environment: false,
+  });
+  const createResult = await runner.run(
+    [
+      'api',
+      '--method',
+      'POST',
+      '-H',
+      'Accept: application/vnd.github+json',
+      `/repos/${repository}/deployments`,
+      '--input',
+      '-',
+    ],
+    createBody,
+    process.cwd(),
+  );
+  if (createResult.exitCode !== 0) {
+    throw new Error(
+      `GitHub deployment creation failed with exit code ${createResult.exitCode}: ${createResult.stderr.trim()}`,
+    );
+  }
+  let deployment: unknown;
+  try {
+    deployment = JSON.parse(createResult.stdout);
+  } catch {
+    throw new Error('GitHub returned invalid JSON while creating a deployment.');
+  }
+  if (!isGithubDeployment(deployment)) throw new Error('GitHub returned an invalid deployment response.');
+  const statusBody = JSON.stringify({
+    state: 'success',
+    environment,
+    environment_url: url,
+    auto_inactive: false,
+  });
+  const statusResult = await runner.run(
+    [
+      'api',
+      '--method',
+      'POST',
+      '-H',
+      'Accept: application/vnd.github+json',
+      `/repos/${repository}/deployments/${deployment.id}/statuses`,
+      '--input',
+      '-',
+    ],
+    statusBody,
+    process.cwd(),
+  );
+  if (statusResult.exitCode !== 0) {
+    throw new Error(
+      `GitHub deployment status failed with exit code ${statusResult.exitCode}: ${statusResult.stderr.trim()}`,
+    );
+  }
 }
 
 function nxProjectList(output: string): string[] {

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -24,12 +24,12 @@ describe('CI workflow definition', () => {
     const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
 
     expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
-    expect(rendered).toContain('- name: 🚀 Deploy Staging');
+    expect(rendered.match(/- name: 🚀 Deploy Environment/g)).toHaveLength(1);
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
-    expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
-    );
+    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step 11');
+    expect(rendered).toContain('github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered).toContain("github.ref == 'refs/heads/private'");
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
     expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
     expect(rendered).toContain('id: setup');
@@ -45,6 +45,12 @@ describe('CI workflow definition', () => {
 
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+    expect(rendered).toContain('GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}');
+    expect(rendered).toContain('OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}');
+    expect(rendered).toContain('MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}');
+    expect(rendered).toContain('TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}');
   });
 
   it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {

package/src/monorepo/__tests__/pr-preview-cleanup-workflow.test.ts

@@ -0,0 +1,23 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: Assertions verify emitted GitHub Actions expressions literally. */
+import { describe, expect, it } from 'bun:test';
+import { managedFileTargetsForTest } from '../managed-files.js';
+import { renderPrPreviewCleanupWorkflowYaml } from '../pr-preview-cleanup-workflow.js';
+
+describe('PR preview cleanup workflow', () => {
+  it('renders one close-only same-repository cleanup job from the PR number', () => {
+    const rendered = renderPrPreviewCleanupWorkflowYaml({ runsOn: ['nixos-latest-x64', 'self-hosted'] });
+    expect(managedFileTargetsForTest).toContainEqual({
+      target: '.github/workflows/pr-preview-cleanup.yml',
+      executable: undefined,
+    });
+
+    expect(rendered).toContain('pull_request:\n    types: [closed]');
+    expect(rendered).not.toContain('opened');
+    expect(rendered).not.toContain('synchronize');
+    expect(rendered).toContain('if: github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered.match(/smoo wrangler cleanup-pr --pr/g)).toHaveLength(1);
+    expect(rendered).toContain('smoo wrangler cleanup-pr --pr ${{ github.event.pull_request.number }}');
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+  });
+});

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -261,7 +261,7 @@ describe('publish workflow definition', () => {
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
     expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+      'smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
     );
   });
 

package/src/monorepo/ci-workflow.ts

@@ -47,7 +47,7 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
     { kind: CiWorkflowStepKind.ManagedFilesDispatch, name: '🔁 Dispatch managed-file drift healing' },
   ];
   if (options.deploy) {
-    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Staging' });
+    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Environment' });
   }
   steps.push(
     { kind: CiWorkflowStepKind.SaveNxCache, name: '💾 Save Nx cache' },
@@ -75,7 +75,7 @@ permissions:
   # actions:write lets the drift step dispatch the managed-files workflow.
   actions: write
   contents: read
-  statuses: write
+${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 defaults:
   run:
@@ -197,11 +197,15 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.Deploy:
       return [
         `      - name: ${step.name}`,
-        '        if:',
-        "          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',",
-        '          github.event.repository.default_branch) }}',
+        '        if: >-',
+        '          ${{',
+        "            (github.event_name == 'pull_request' &&",
+        '              contains(fromJSON(\'["opened","reopened","synchronize"]\'), github.event.action) &&',
+        '              github.event.pull_request.head.repo.full_name == github.repository) ||',
+        "            (github.event_name == 'push' && github.ref == 'refs/heads/private')",
+        '          }}',
         ...deployEnvLines(options),
-        `        run: smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step ${step.number}`,
+        `        run: smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step ${step.number}`,
       ];
     case CiWorkflowStepKind.SaveNxCache:
       return [
@@ -251,6 +255,12 @@ function deployEnvLines(options: CiWorkflowDefinitionOptions): string[] {
     '        env:',
     '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
     '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+    '          GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}',
+    '          GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}',
+    '          GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}',
+    '          OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}',
+    '          MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}',
+    '          TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}',
   ];
 }
 

package/src/monorepo/managed-files.test.ts

@@ -1,6 +1,7 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are asserted literally. */
 import { describe, expect, it } from 'bun:test';
-import { readFile } from 'node:fs/promises';
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { LINUX_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import fc from 'fast-check';
@@ -215,6 +216,21 @@ describe('nx graph project helpers', () => {
     });
     expect(deployTargetInfoFromProjects(sampleProjects, 'preview')).toEqual({ exists: false });
   });
+
+  it('recognizes convention-driven deploy-environment targets without per-environment configurations', () => {
+    const projects: NxProjects = {
+      app: {
+        targets: {
+          deploy: {
+            options: { command: 'smoo wrangler deploy-environment --environment {args.environment}' },
+          },
+        },
+      },
+    };
+
+    expect(deployTargetInfoFromProjects(projects, 'staging')).toEqual({ exists: true, provider: 'cloudflare' });
+    expect(deployTargetInfoFromProjects(projects, 'production')).toEqual({ exists: true, provider: 'cloudflare' });
+  });
 });
 
 describe('managed raw files', () => {
@@ -228,6 +244,45 @@ describe('managed raw files', () => {
 
     expect(generated).toBe(source);
   });
+
+  it('exports the restored ttsc cache path while preserving host cache overrides', async () => {
+    const temp = await mkdtemp(join(tmpdir(), 'smoo-github-bootstrap-'));
+    const bin = join(temp, 'bin');
+    await mkdir(bin);
+    const devenv = join(bin, 'devenv');
+    await writeFile(devenv, '#!/bin/sh\nexit 0\n');
+    await chmod(devenv, 0o755);
+
+    try {
+      const cases = [
+        { input: '', expected: join(REPO_ROOT, '.cache', 'ttsc') },
+        { input: join(temp, 'host-ttsc'), expected: join(temp, 'host-ttsc') },
+      ];
+      for (const [index, cache] of cases.entries()) {
+        const githubEnv = join(temp, `github-env-${index}`);
+        const githubPath = join(temp, `github-path-${index}`);
+        const process = Bun.spawn(
+          [join(REPO_ROOT, 'tooling', 'direnv', 'github-actions-bootstrap.sh'), 'build-shell'],
+          {
+            cwd: join(REPO_ROOT, 'tooling', 'direnv'),
+            env: {
+              ...Bun.env,
+              GITHUB_ENV: githubEnv,
+              GITHUB_PATH: githubPath,
+              PATH: `${bin}:${Bun.env.PATH ?? ''}`,
+              TTSC_CACHE_DIR: cache.input,
+            },
+            stderr: 'pipe',
+            stdout: 'pipe',
+          },
+        );
+        expect(await process.exited).toBe(0);
+        expect(await readFile(githubEnv, 'utf8')).toContain(`TTSC_CACHE_DIR=${cache.expected}\n`);
+      }
+    } finally {
+      await rm(temp, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('managed cache actions', () => {

package/src/monorepo/managed-files.ts

@@ -6,6 +6,7 @@ import type { NxTargetConfig, PackageJson } from '../lib/json.js';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { loadNxProjects, type NxProjects, targetNamesFromProjects } from '../nx/index.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
+import { renderPrPreviewCleanupWorkflowYaml } from './pr-preview-cleanup-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 type ManagedKind = 'raw' | 'template' | 'generated';
@@ -24,6 +25,7 @@ interface ManagedFile {
   target: string;
   executable?: boolean;
   releasePackagesOnly?: boolean;
+  cloudflareDeployOnly?: boolean;
 }
 
 /** Split a managed target's content into the managed part and the repo-owned tail. */
@@ -211,6 +213,12 @@ const managedFiles: ManagedFile[] = [
     source: 'ci-workflow',
     target: '.github/workflows/ci.yml',
   },
+  {
+    kind: 'generated',
+    source: 'pr-preview-cleanup-workflow',
+    target: '.github/workflows/pr-preview-cleanup.yml',
+    cloudflareDeployOnly: true,
+  },
   {
     kind: 'generated',
     source: 'publish-workflow',
@@ -272,6 +280,9 @@ function applyManagedFile(
   if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
     return { target: file.target, action: 'skipped' };
   }
+  if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+    return { target: file.target, action: 'skipped' };
+  }
   const target = resolve(root, file.target);
   const content = getManagedContent(file, context);
   if (existsSync(target)) {
@@ -322,6 +333,9 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         runsOn: context.ciRunsOn,
       });
     }
+    if (file.source === 'pr-preview-cleanup-workflow') {
+      return renderPrPreviewCleanupWorkflowYaml({ runsOn: context.ciRunsOn });
+    }
     throw new Error(`Unknown generated managed file source ${file.source}`);
   }
   const sourceRoot = file.kind === 'raw' ? 'managed/raw' : 'managed/templates';
@@ -388,11 +402,16 @@ function deployTargetInfoFromTargets(targets: Record<string, NxTargetConfig>, co
   if (!deploy) {
     return { exists: false };
   }
+  const baseCommandValue = deploy.options?.command ?? deploy.command;
+  const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
+  if (baseCommand.includes('smoo wrangler deploy-environment')) {
+    return { exists: true, provider: 'cloudflare' };
+  }
   const config = deploy.configurations?.[configuration];
   if (!config) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? deploy.options?.command ?? deploy.command;
+  const commandValue = config.command ?? config.options?.command ?? baseCommand;
   const command = typeof commandValue === 'string' ? commandValue : '';
   return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
 }

package/src/monorepo/pr-preview-cleanup-workflow.ts

@@ -0,0 +1,44 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
+
+import { renderRunsOnLine } from './github-runs-on.js';
+
+export interface PrPreviewCleanupWorkflowOptions {
+  runsOn?: string | string[];
+}
+
+export function renderPrPreviewCleanupWorkflowYaml(options: PrPreviewCleanupWorkflowOptions = {}): string {
+  return `name: PR Preview Cleanup
+
+on:
+  pull_request:
+    types: [closed]
+
+permissions:
+  contents: read
+
+jobs:
+  cleanup:
+    name: Cleanup PR environment
+    if: github.event.pull_request.head.repo.full_name == github.repository
+${renderRunsOnLine(options.runsOn)}
+    timeout-minutes: 15
+    defaults:
+      run:
+        working-directory: tooling/direnv
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 1
+
+      - name: Setup Nix/devenv
+        uses: ./.github/actions/setup-devenv
+
+      - name: Cleanup PR environment
+        env:
+          CLOUDFLARE_API_TOKEN: \${{ secrets.CLOUDFLARE_API_TOKEN }}
+          CLOUDFLARE_ACCOUNT_ID: \${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
+        run: smoo wrangler cleanup-pr --pr \${{ github.event.pull_request.number }}
+`;
+}