@smoothbricks/cli 0.10.7 → 0.10.9

package/src/github-ci/index.test.ts

@@ -8,10 +8,14 @@ import type { ProjectTargets } from '../nx/index.js';
 import {
   expandNxTargetDependencyRuns,
   expandNxTargetRuns,
+  githubCiNxDeploy,
   githubCiNxRunMany,
   nxRunManyArgs,
   nxSmartArgs,
+  publishGithubDeployment,
   readGitHeadSha,
+  resolveDeploymentEnvironment,
+  selectEnvironmentDeployProjects,
 } from './index.js';
 import {
   applyCollectedOutputs,
@@ -162,11 +166,12 @@ describe('collected Nx outputs', () => {
 
   it('collects an empty artifact when selected projects have no matching target', async () => {
     await withNxRunManyFixture(async ({ root, artifact }) => {
-      await githubCiNxRunMany(root, {
+      const expanded = await githubCiNxRunMany(root, {
         targets: '*-linux',
         projects: 'app',
         collectOutputs: artifact,
       });
+      expect(expanded.runs).toEqual([]);
 
       const sourceSha = await readGitHeadSha(root);
       expect(JSON.parse(await readFile(join(artifact, 'manifest.json'), 'utf8'))).toEqual({
@@ -182,10 +187,11 @@ describe('collected Nx outputs', () => {
       await writeFile(join(root, 'packages/app/test-target.ts'), "await Bun.write('test-ran.txt', 'tested');\n");
       await writeFile(join(root, 'packages/app/build-target.ts'), "throw new Error('build must not run here');\n");
 
-      await githubCiNxRunMany(root, {
+      const expanded = await githubCiNxRunMany(root, {
         targets: 'test',
         projectsWithTargets: '*-macos,*-ios',
       });
+      expect(expanded.runs.map((run) => run.projects.map((project) => project.project))).toEqual([['app']]);
 
       await expect(readFile(join(root, 'test-ran.txt'), 'utf8')).resolves.toBe('tested');
       await expect(readFile(join(root, 'build-ran.txt'), 'utf8')).rejects.toThrow();
@@ -533,3 +539,170 @@ async function withNxRunManyFixture(
     await rm(temp, { recursive: true, force: true });
   }
 }
+
+describe('event-aware environment deployment', () => {
+  it('resolves same-repository PR, private push, release, and explicit production environments', () => {
+    expect(
+      resolveDeploymentEnvironment(
+        undefined,
+        { GITHUB_EVENT_NAME: 'pull_request' },
+        {
+          action: 'synchronize',
+          repository: { full_name: 'owner/repo' },
+          pull_request: { number: 123, head: { repo: { full_name: 'owner/repo' } } },
+        },
+      ),
+    ).toBe('pr123');
+    expect(
+      resolveDeploymentEnvironment(undefined, { GITHUB_EVENT_NAME: 'push', GITHUB_REF_NAME: 'private' }, undefined),
+    ).toBe('staging');
+    expect(resolveDeploymentEnvironment(undefined, { GITHUB_EVENT_NAME: 'release' }, undefined)).toBe('production');
+    expect(resolveDeploymentEnvironment('production', {}, undefined)).toBe('production');
+    expect(() =>
+      resolveDeploymentEnvironment(
+        undefined,
+        { GITHUB_EVENT_NAME: 'pull_request' },
+        {
+          action: 'opened',
+          repository: { full_name: 'owner/repo' },
+          pull_request: { number: 123, head: { repo: { full_name: 'fork/repo' } } },
+        },
+      ),
+    ).toThrow(/same-repository/);
+  });
+
+  it('selects only deploy targets owned by the environment convention', async () => {
+    const definitions: Record<string, unknown> = {
+      'conloca-app': {
+        targets: {
+          deploy: { options: { command: 'smoo wrangler deploy-environment --environment {args.environment}' } },
+        },
+      },
+      'conloca-app-backend': {
+        targets: { deploy: { command: 'smoo wrangler deploy-environment --environment {args.environment}' } },
+      },
+      'conloca-oauth-redirect': {
+        targets: { deploy: { options: { command: 'wrangler deploy --config wrangler.toml' } } },
+      },
+      'conloca-website': {
+        targets: { deploy: { options: { command: 'bun scripts/deploy-website.ts' } } },
+      },
+    };
+
+    await expect(
+      selectEnvironmentDeployProjects(Object.keys(definitions), async (project) => definitions[project]),
+    ).resolves.toEqual(['conloca-app', 'conloca-app-backend']);
+  });
+
+  it('publishes GitHub deployment JSON through a real stdin process seam', async () => {
+    const calls: Array<{ args: string[]; input: unknown }> = [];
+    await publishGithubDeployment(
+      'pr123',
+      'https://app.pr123.conloca.com',
+      { GITHUB_REPOSITORY: 'owner/repo', GITHUB_SHA: 'abc123' },
+      {
+        run: async (args, input) => {
+          calls.push({ args, input: JSON.parse(input) });
+          return {
+            exitCode: 0,
+            stdout: calls.length === 1 ? JSON.stringify({ id: 42 }) : '',
+            stderr: '',
+          };
+        },
+      },
+    );
+
+    expect(calls).toEqual([
+      {
+        args: [
+          'api',
+          '--method',
+          'POST',
+          '-H',
+          'Accept: application/vnd.github+json',
+          '/repos/owner/repo/deployments',
+          '--input',
+          '-',
+        ],
+        input: {
+          ref: 'abc123',
+          environment: 'pr123',
+          auto_merge: false,
+          required_contexts: [],
+          transient_environment: true,
+          production_environment: false,
+        },
+      },
+      {
+        args: [
+          'api',
+          '--method',
+          'POST',
+          '-H',
+          'Accept: application/vnd.github+json',
+          '/repos/owner/repo/deployments/42/statuses',
+          '--input',
+          '-',
+        ],
+        input: {
+          state: 'success',
+          environment: 'pr123',
+          environment_url: 'https://app.pr123.conloca.com',
+          auto_inactive: false,
+        },
+      },
+    ]);
+  });
+
+  it('deploys app/backend, follows with e2e-deployed, and publishes PR metadata', async () => {
+    const nxCalls: string[][] = [];
+    const listCalls: Array<[string, string]> = [];
+    const summaries: string[] = [];
+    const deployments: Array<[string, string]> = [];
+
+    await githubCiNxDeploy(
+      '/repo',
+      { mode: 'run-many', name: 'Deploy Environment' },
+      {
+        processEnv: {
+          GITHUB_EVENT_NAME: 'pull_request',
+          GITHUB_STEP_SUMMARY: '/summary',
+        },
+        setStatus: async () => {},
+        eventPayload: {
+          action: 'opened',
+          repository: { full_name: 'owner/repo' },
+          pull_request: { number: 123, head: { repo: { full_name: 'owner/repo' } } },
+        },
+        listProjects: async (_root, target, mode) => {
+          listCalls.push([target, mode]);
+          return target === 'deploy' ? ['conloca-app', 'conloca-app-backend'] : ['conloca-e2e'];
+        },
+        runNx: async (args) => {
+          nxCalls.push(args);
+          return 0;
+        },
+        appendSummary: async (_path, content) => {
+          summaries.push(content);
+        },
+        publishDeployment: async (environment, url) => {
+          deployments.push([environment, url]);
+        },
+      },
+    );
+
+    expect(listCalls).toEqual([
+      ['deploy', 'run-many'],
+      ['e2e-deployed', 'run-many'],
+    ]);
+    expect(nxCalls).toHaveLength(2);
+    expect(nxCalls[0]).toContain('--projects=conloca-app,conloca-app-backend');
+    expect(nxCalls[0]).toContain('--exclude=tag:permanent-deploy-target');
+    expect(nxCalls[0]).toContain('--environment=pr123');
+    expect(nxCalls[1]).toContain('-t');
+    expect(nxCalls[1]).toContain('e2e-deployed');
+    expect(nxCalls[1]).toContain('--environment=pr123');
+    expect(summaries).toEqual(['## pr123 deployment\n\n[View deployment](https://app.pr123.conloca.com)\n']);
+    expect(deployments).toEqual([['pr123', 'https://app.pr123.conloca.com']]);
+  });
+});

package/src/github-ci/index.ts

@@ -1,3 +1,4 @@
+import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, realpath, rename, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
@@ -6,24 +7,45 @@ import typia from 'typia';
 import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
+import {
+  type EnvironmentToken,
+  isPullRequestEnvironment,
+  parseEnvironmentToken,
+  pullRequestEnvironment,
+} from '../wrangler/environment.js';
 import type { NxTargetRun } from './outputs.js';
 
-interface GithubActionsEventPayload {
+export interface GithubActionsEventPayload {
+  action?: string;
   repository?: {
     default_branch?: string;
+    full_name?: string;
+  };
+  pull_request?: {
+    number?: number;
+    head?: {
+      repo?: {
+        full_name?: string;
+      };
+    };
   };
 }
 
-interface NxProjectDeployConfigurations {
+interface NxProjectDeployTarget {
   targets?: {
     deploy?: {
-      configurations?: Record<string, unknown>;
+      command?: unknown;
+      options?: {
+        command?: unknown;
+      };
     };
   };
 }
 
 const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
-const parseNxProjectDeployConfigurations = typia.json.createIsParse<NxProjectDeployConfigurations>();
+const isGithubDeployment = typia.createIs<{ id: number }>();
+const isNxProjectDeployTarget = typia.createIs<NxProjectDeployTarget>();
+const parseNxProjectDeployTarget = typia.json.createIsParse<NxProjectDeployTarget>();
 
 type NxSmartMode = 'auto' | 'affected' | 'run-many';
 
@@ -293,7 +315,7 @@ export async function readGitHeadSha(root: string): Promise<string> {
   return decode((await $`git rev-parse HEAD`.cwd(root).quiet()).stdout).trim();
 }
 
-export async function githubCiNxRunMany(root: string, options: NxRunManyOptions): Promise<void> {
+export async function githubCiNxRunMany(root: string, options: NxRunManyOptions): Promise<ExpandedNxTargetRuns> {
   const expanded = expandNxTargetRuns(await readProjectTargets(root), options);
   if (expanded.unmatchedGlobs.length > 0) {
     console.log(`No Nx targets matched target glob(s): ${expanded.unmatchedGlobs.join(', ')}; skipping.`);
@@ -306,6 +328,7 @@ export async function githubCiNxRunMany(root: string, options: NxRunManyOptions)
     const sourceSha = await readGitHeadSha(root);
     await collectNxOutputs(root, options.collectOutputs, expandNxTargetDependencyRuns(expanded.runs), sourceSha);
   }
+  return expanded;
 }
 
 export async function githubCiApplyOutputs(
@@ -357,35 +380,102 @@ function commaSeparatedValues(value: string): string[] {
     .filter(Boolean);
 }
 
+export interface GithubCiNxDeployOptions {
+  environment?: string;
+  mode?: NxSmartMode;
+  name?: string;
+  step?: string;
+  verify?: boolean;
+}
+
+export interface GithubCiNxDeployDependencies {
+  listProjects?: (root: string, target: string, mode: 'affected' | 'run-many') => Promise<string[]>;
+  runNx?: (args: string[], root: string) => Promise<number>;
+  appendSummary?: (summaryPath: string, content: string) => Promise<void>;
+  publishDeployment?: (environment: `pr${number}`, url: string) => Promise<void>;
+  setStatus?: (state: 'pending' | 'success' | 'failure') => Promise<void>;
+  processEnv?: NodeJS.ProcessEnv;
+  eventPayload?: GithubActionsEventPayload;
+}
+
 export async function githubCiNxDeploy(
   root: string,
-  options: { configuration: string; mode?: NxSmartMode; name?: string; step?: string; verify?: boolean },
+  options: GithubCiNxDeployOptions,
+  dependencies: GithubCiNxDeployDependencies = {},
 ): Promise<void> {
-  const name = options.name ?? `Deploy ${options.configuration}`;
+  const processEnv = dependencies.processEnv ?? process.env;
+  const eventPayload = dependencies.eventPayload ?? readGithubActionsEvent(processEnv);
+  const environment = resolveDeploymentEnvironment(options.environment, processEnv, eventPayload);
+  const name = options.name ?? 'Deploy Environment';
   const step = options.step ?? '';
-  await createGithubStatus(name, step);
+  const setStatus =
+    dependencies.setStatus ??
+    ((state: 'pending' | 'success' | 'failure') =>
+      state === 'pending' ? createGithubStatus(name, step) : updateGithubStatus(name, state, step));
+  await setStatus('pending');
   const mode = resolveNxSmartMode(options.mode ?? 'run-many');
-  const projects = await deployProjectsWithConfiguration(root, options.configuration, mode);
+  const listProjects = dependencies.listProjects ?? listNxProjectsWithTarget;
+  const runNx = dependencies.runNx ?? ((args: string[], commandRoot: string) => runStatus('nx', args, commandRoot));
+  const projects = await listProjects(root, 'deploy', mode);
   if (projects.length === 0) {
-    console.log(`No ${mode} deploy projects with configuration ${options.configuration}; skipping.`);
-    await updateGithubStatus(name, 'success', step);
+    console.log(`No ${mode} deploy projects; skipping ${environment}.`);
+    await setStatus('success');
     return;
   }
 
   const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
   for (const target of targets) {
-    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, `--parallel=${NX_PARALLEL}`];
+    const nxArgs = [
+      'run-many',
+      '-t',
+      target,
+      `--projects=${projectList}`,
+      '--exclude=tag:permanent-deploy-target',
+      `--parallel=${NX_PARALLEL}`,
+    ];
     if (target === 'deploy') {
-      nxArgs.push(`--configuration=${options.configuration}`);
+      nxArgs.push(`--environment=${environment}`);
     }
-    const status = await runStatus('nx', nxArgs, root);
+    const status = await runNx(nxArgs, root);
     if (status !== 0) {
-      await updateGithubStatus(name, 'failure', step);
+      await setStatus('failure');
       throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
     }
   }
-  await updateGithubStatus(name, 'success', step);
+
+  if (isPullRequestEnvironment(environment)) {
+    const url = `https://app.${environment}.conloca.com`;
+    const summaryPath = processEnv.GITHUB_STEP_SUMMARY;
+    if (summaryPath) {
+      const appendSummary = dependencies.appendSummary ?? appendFile;
+      await appendSummary(summaryPath, `## ${environment} deployment\n\n[View deployment](${url})\n`);
+    }
+    const publishDeployment =
+      dependencies.publishDeployment ??
+      ((token: `pr${number}`, deploymentUrl: string) => publishGithubDeployment(token, deploymentUrl, processEnv));
+    await publishDeployment(environment, url);
+  }
+  if (environment !== 'production') {
+    const e2eProjects = await listProjects(root, 'e2e-deployed', 'run-many');
+    if (e2eProjects.length > 0) {
+      const nxArgs = [
+        'run-many',
+        '-t',
+        'e2e-deployed',
+        `--projects=${e2eProjects.join(',')}`,
+        `--parallel=${NX_PARALLEL}`,
+        `--environment=${environment}`,
+      ];
+      const status = await runNx(nxArgs, root);
+      if (status !== 0) {
+        await setStatus('failure');
+        throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
+      }
+    }
+  }
+
+  await setStatus('success');
 }
 
 function resolveNxSmartMode(mode: NxSmartMode): 'affected' | 'run-many' {
@@ -419,30 +509,183 @@ function eventDefaultBranch(): string | undefined {
   }
 }
 
-async function deployProjectsWithConfiguration(
+export function resolveDeploymentEnvironment(
+  explicit: string | undefined,
+  environment: NodeJS.ProcessEnv,
+  event: GithubActionsEventPayload | undefined,
+): EnvironmentToken {
+  if (explicit !== undefined) return parseEnvironmentToken(explicit);
+  if (environment.GITHUB_EVENT_NAME === 'pull_request') {
+    if (!event?.action || !['opened', 'reopened', 'synchronize'].includes(event.action)) {
+      throw new Error('Pull-request deployment runs only for opened, reopened, or synchronize events.');
+    }
+    const repository = event.repository?.full_name;
+    const headRepository = event.pull_request?.head?.repo?.full_name;
+    if (!repository || !headRepository || repository !== headRepository) {
+      throw new Error('Pull-request deployment is restricted to same-repository pull requests.');
+    }
+    const number = event.pull_request?.number;
+    if (number === undefined) throw new Error('GitHub pull_request event is missing its PR number.');
+    return pullRequestEnvironment(number);
+  }
+  if (environment.GITHUB_EVENT_NAME === 'push' && environment.GITHUB_REF_NAME === 'private') {
+    return 'staging';
+  }
+  if (environment.GITHUB_EVENT_NAME === 'release') {
+    return 'production';
+  }
+  throw new Error('Cannot resolve a deployment environment from this GitHub event; pass --environment explicitly.');
+}
+
+function readGithubActionsEvent(environment: NodeJS.ProcessEnv): GithubActionsEventPayload | undefined {
+  const eventPath = environment.GITHUB_EVENT_PATH;
+  if (!eventPath) return undefined;
+  try {
+    return parseGithubActionsEvent(readFileSync(eventPath, 'utf8')) || undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+async function listNxProjectsWithTarget(
   root: string,
-  configuration: string,
+  target: string,
   mode: 'affected' | 'run-many',
 ): Promise<string[]> {
-  const listArgs =
-    mode === 'affected'
-      ? ['show', 'projects', '--affected', '--withTarget', 'deploy', '--json']
-      : ['show', 'projects', '--withTarget', 'deploy', '--json'];
+  const listArgs = ['show', 'projects'];
+  if (mode === 'affected') listArgs.push('--affected');
+  listArgs.push('--withTarget', target);
+  if (target === 'deploy') listArgs.push('--exclude=tag:permanent-deploy-target');
+  listArgs.push('--json');
   const result = await $`nx ${listArgs}`.cwd(root).quiet();
-  const candidates = nxProjectList(decode(result.stdout));
-  const projects: string[] = [];
+  const candidates = nxProjectList(decode(result.stdout)).sort((left, right) => left.localeCompare(right));
+  if (target !== 'deploy') return candidates;
+  return selectEnvironmentDeployProjects(candidates, async (project) => {
+    const projectResult = await $`nx show project ${project} --json`.cwd(root).quiet();
+    const parsed = parseNxProjectDeployTarget(decode(projectResult.stdout));
+    if (!parsed) throw new Error(`nx show project ${project} returned invalid JSON.`);
+    return parsed;
+  });
+}
+
+export async function selectEnvironmentDeployProjects(
+  candidates: string[],
+  loadProject: (project: string) => Promise<unknown>,
+): Promise<string[]> {
+  const selected: string[] = [];
   for (const project of candidates) {
-    if (await deployTargetHasConfiguration(root, project, configuration)) {
-      projects.push(project);
+    const definition = await loadProject(project);
+    if (!isNxProjectDeployTarget(definition)) continue;
+    const deploy = definition.targets?.deploy;
+    const commandValue = deploy?.options?.command ?? deploy?.command;
+    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-environment')) {
+      selected.push(project);
     }
   }
-  return projects.sort((a, b) => a.localeCompare(b));
+  return selected;
+}
+
+export interface GithubApiProcessResult {
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+}
+
+export interface GithubApiProcessRunner {
+  run(args: string[], input: string, cwd: string): Promise<GithubApiProcessResult>;
+}
+
+export class NodeGithubApiProcessRunner implements GithubApiProcessRunner {
+  run(args: string[], input: string, cwd: string): Promise<GithubApiProcessResult> {
+    const { promise, resolve, reject } = Promise.withResolvers<GithubApiProcessResult>();
+    const child = spawn('gh', args, { cwd, stdio: ['pipe', 'pipe', 'pipe'] });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk: string) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk: string) => {
+      stderr += chunk;
+    });
+    child.once('error', reject);
+    child.once('close', (code) => {
+      resolve({ exitCode: code ?? -1, stdout, stderr });
+    });
+    child.stdin.end(input);
+    return promise;
+  }
 }
 
-async function deployTargetHasConfiguration(root: string, project: string, configuration: string): Promise<boolean> {
-  const result = await $`nx show project ${project} --json`.cwd(root).quiet();
-  const parsed = parseNxProjectDeployConfigurations(decode(result.stdout));
-  return parsed?.targets?.deploy?.configurations?.[configuration] !== undefined;
+export async function publishGithubDeployment(
+  environment: `pr${number}`,
+  url: string,
+  processEnvironment: NodeJS.ProcessEnv,
+  runner: GithubApiProcessRunner = new NodeGithubApiProcessRunner(),
+): Promise<void> {
+  const repository = processEnvironment.GITHUB_REPOSITORY;
+  const sha = processEnvironment.GITHUB_SHA;
+  if (!repository || !sha) throw new Error('GITHUB_REPOSITORY and GITHUB_SHA are required to publish a deployment.');
+  const createBody = JSON.stringify({
+    ref: sha,
+    environment,
+    auto_merge: false,
+    required_contexts: [],
+    transient_environment: true,
+    production_environment: false,
+  });
+  const createResult = await runner.run(
+    [
+      'api',
+      '--method',
+      'POST',
+      '-H',
+      'Accept: application/vnd.github+json',
+      `/repos/${repository}/deployments`,
+      '--input',
+      '-',
+    ],
+    createBody,
+    process.cwd(),
+  );
+  if (createResult.exitCode !== 0) {
+    throw new Error(
+      `GitHub deployment creation failed with exit code ${createResult.exitCode}: ${createResult.stderr.trim()}`,
+    );
+  }
+  let deployment: unknown;
+  try {
+    deployment = JSON.parse(createResult.stdout);
+  } catch {
+    throw new Error('GitHub returned invalid JSON while creating a deployment.');
+  }
+  if (!isGithubDeployment(deployment)) throw new Error('GitHub returned an invalid deployment response.');
+  const statusBody = JSON.stringify({
+    state: 'success',
+    environment,
+    environment_url: url,
+    auto_inactive: false,
+  });
+  const statusResult = await runner.run(
+    [
+      'api',
+      '--method',
+      'POST',
+      '-H',
+      'Accept: application/vnd.github+json',
+      `/repos/${repository}/deployments/${deployment.id}/statuses`,
+      '--input',
+      '-',
+    ],
+    statusBody,
+    process.cwd(),
+  );
+  if (statusResult.exitCode !== 0) {
+    throw new Error(
+      `GitHub deployment status failed with exit code ${statusResult.exitCode}: ${statusResult.stderr.trim()}`,
+    );
+  }
 }
 
 function nxProjectList(output: string): string[] {

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -24,12 +24,12 @@ describe('CI workflow definition', () => {
     const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
 
     expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
-    expect(rendered).toContain('- name: 🚀 Deploy Staging');
+    expect(rendered.match(/- name: 🚀 Deploy Environment/g)).toHaveLength(1);
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
-    expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 11',
-    );
+    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step 11');
+    expect(rendered).toContain('github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered).toContain("github.ref == 'refs/heads/private'");
     expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
     expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
     expect(rendered).toContain('id: setup');
@@ -45,6 +45,12 @@ describe('CI workflow definition', () => {
 
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+    expect(rendered).toContain('GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}');
+    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}');
+    expect(rendered).toContain('OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}');
+    expect(rendered).toContain('MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}');
+    expect(rendered).toContain('TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}');
   });
 
   it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {

package/src/monorepo/__tests__/pr-preview-cleanup-workflow.test.ts

@@ -0,0 +1,23 @@
+/* biome-ignore-all lint/suspicious/noTemplateCurlyInString: Assertions verify emitted GitHub Actions expressions literally. */
+import { describe, expect, it } from 'bun:test';
+import { managedFileTargetsForTest } from '../managed-files.js';
+import { renderPrPreviewCleanupWorkflowYaml } from '../pr-preview-cleanup-workflow.js';
+
+describe('PR preview cleanup workflow', () => {
+  it('renders one close-only same-repository cleanup job from the PR number', () => {
+    const rendered = renderPrPreviewCleanupWorkflowYaml({ runsOn: ['nixos-latest-x64', 'self-hosted'] });
+    expect(managedFileTargetsForTest).toContainEqual({
+      target: '.github/workflows/pr-preview-cleanup.yml',
+      executable: undefined,
+    });
+
+    expect(rendered).toContain('pull_request:\n    types: [closed]');
+    expect(rendered).not.toContain('opened');
+    expect(rendered).not.toContain('synchronize');
+    expect(rendered).toContain('if: github.event.pull_request.head.repo.full_name == github.repository');
+    expect(rendered.match(/smoo wrangler cleanup-pr --pr/g)).toHaveLength(1);
+    expect(rendered).toContain('smoo wrangler cleanup-pr --pr ${{ github.event.pull_request.number }}');
+    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+  });
+});

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -159,15 +159,17 @@ describe('publish workflow definition', () => {
     expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
       `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
         ',',
-      )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
+      )}" --output "\${{ runner.temp }}/macos-platform-outputs" --github-output "$GITHUB_OUTPUT"`,
     );
+    expect(macosPlatform).toContain('id: platform-outputs');
+    expect(macosPlatform).toContain("if: steps.platform-outputs.outputs.projects != ''");
     expect(macosPlatform).toContain(
-      `run: smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`,
+      'run: smoo github-ci nx-run-many --targets test --projects "${{ steps.platform-outputs.outputs.projects }}"',
     );
     expect(macosPlatform.indexOf('- name: 🍎 Build selected macOS and iOS release outputs')).toBeLessThan(
-      macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages'),
+      macosPlatform.indexOf('- name: 🧪 Unit test selected macOS and iOS packages'),
     );
-    expect(macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages')).toBeLessThan(
+    expect(macosPlatform.indexOf('- name: 🧪 Unit test selected macOS and iOS packages')).toBeLessThan(
       macosPlatform.indexOf('- name: 📤 Upload macOS platform outputs'),
     );
     expect(finalJob).not.toContain('smoo release version');
@@ -261,7 +263,7 @@ describe('publish workflow definition', () => {
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
     expect(rendered).toContain(
-      'smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+      'smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
     );
   });