@smoothbricks/cli 0.10.8 → 0.10.10

package/src/github-ci/index.ts

@@ -7,12 +7,7 @@ import typia from 'typia';
 import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
-import {
-  type EnvironmentToken,
-  isPullRequestEnvironment,
-  parseEnvironmentToken,
-  pullRequestEnvironment,
-} from '../wrangler/environment.js';
+import { type DeploymentStage, isPullRequestStage, parseDeploymentStage, pullRequestStage } from '../wrangler/stage.js';
 import type { NxTargetRun } from './outputs.js';
 
 export interface GithubActionsEventPayload {
@@ -159,24 +154,32 @@ async function addReferencesFrom(roots: Set<string>, path: string, cwd: string):
   }
 }
 
-export function nxSmartArgs(target: string, mode: 'affected' | 'run-many', configuration?: string): string[] {
+export function nxSmartArgs(
+  target: string,
+  mode: 'affected' | 'run-many',
+  configuration?: string,
+  stage?: string,
+): string[] {
   const args = [mode, '-t', target];
   if (configuration) {
     args.push(`--configuration=${configuration}`);
   }
+  if (stage) {
+    args.push(`--stage=${stage}`);
+  }
   args.push(`--exclude=tag:ci:skip:${target}`, `--parallel=${NX_PARALLEL}`);
   return args;
 }
 
 export async function githubCiNxSmart(
   root: string,
-  options: { target: string; name?: string; step?: string; mode?: NxSmartMode; configuration?: string },
+  options: { target: string; name?: string; step?: string; mode?: NxSmartMode; configuration?: string; stage?: string },
 ): Promise<void> {
   const name = options.name ?? options.target;
   const step = options.step ?? '';
   await createGithubStatus(name, step);
   const mode = resolveNxSmartMode(options.mode ?? 'auto');
-  const nxArgs = nxSmartArgs(options.target, mode, options.configuration);
+  const nxArgs = nxSmartArgs(options.target, mode, options.configuration, options.stage);
   const status = await runStatus('nx', nxArgs, root);
   await updateGithubStatus(name, status === 0 ? 'success' : 'failure', step);
   if (status !== 0) {
@@ -315,7 +318,7 @@ export async function readGitHeadSha(root: string): Promise<string> {
   return decode((await $`git rev-parse HEAD`.cwd(root).quiet()).stdout).trim();
 }
 
-export async function githubCiNxRunMany(root: string, options: NxRunManyOptions): Promise<void> {
+export async function githubCiNxRunMany(root: string, options: NxRunManyOptions): Promise<ExpandedNxTargetRuns> {
   const expanded = expandNxTargetRuns(await readProjectTargets(root), options);
   if (expanded.unmatchedGlobs.length > 0) {
     console.log(`No Nx targets matched target glob(s): ${expanded.unmatchedGlobs.join(', ')}; skipping.`);
@@ -328,6 +331,7 @@ export async function githubCiNxRunMany(root: string, options: NxRunManyOptions)
     const sourceSha = await readGitHeadSha(root);
     await collectNxOutputs(root, options.collectOutputs, expandNxTargetDependencyRuns(expanded.runs), sourceSha);
   }
+  return expanded;
 }
 
 export async function githubCiApplyOutputs(
@@ -380,7 +384,7 @@ function commaSeparatedValues(value: string): string[] {
 }
 
 export interface GithubCiNxDeployOptions {
-  environment?: string;
+  stage?: string;
   mode?: NxSmartMode;
   name?: string;
   step?: string;
@@ -391,7 +395,8 @@ export interface GithubCiNxDeployDependencies {
   listProjects?: (root: string, target: string, mode: 'affected' | 'run-many') => Promise<string[]>;
   runNx?: (args: string[], root: string) => Promise<number>;
   appendSummary?: (summaryPath: string, content: string) => Promise<void>;
-  publishDeployment?: (environment: `pr${number}`, url: string) => Promise<void>;
+  appendOutput?: (outputPath: string, content: string) => Promise<void>;
+  publishDeployment?: (stage: `pr${number}`, url: string) => Promise<void>;
   setStatus?: (state: 'pending' | 'success' | 'failure') => Promise<void>;
   processEnv?: NodeJS.ProcessEnv;
   eventPayload?: GithubActionsEventPayload;
@@ -404,8 +409,8 @@ export async function githubCiNxDeploy(
 ): Promise<void> {
   const processEnv = dependencies.processEnv ?? process.env;
   const eventPayload = dependencies.eventPayload ?? readGithubActionsEvent(processEnv);
-  const environment = resolveDeploymentEnvironment(options.environment, processEnv, eventPayload);
-  const name = options.name ?? 'Deploy Environment';
+  const stage = resolveDeploymentStage(options.stage, processEnv, eventPayload);
+  const name = options.name ?? 'Deploy Stage';
   const step = options.step ?? '';
   const setStatus =
     dependencies.setStatus ??
@@ -417,7 +422,7 @@ export async function githubCiNxDeploy(
   const runNx = dependencies.runNx ?? ((args: string[], commandRoot: string) => runStatus('nx', args, commandRoot));
   const projects = await listProjects(root, 'deploy', mode);
   if (projects.length === 0) {
-    console.log(`No ${mode} deploy projects; skipping ${environment}.`);
+    console.log(`No ${mode} deploy projects; skipping ${stage}.`);
     await setStatus('success');
     return;
   }
@@ -434,7 +439,7 @@ export async function githubCiNxDeploy(
       `--parallel=${NX_PARALLEL}`,
     ];
     if (target === 'deploy') {
-      nxArgs.push(`--environment=${environment}`);
+      nxArgs.push(`--stage=${stage}`);
     }
     const status = await runNx(nxArgs, root);
     if (status !== 0) {
@@ -443,37 +448,39 @@ export async function githubCiNxDeploy(
     }
   }
 
-  if (isPullRequestEnvironment(environment)) {
-    const url = `https://app.${environment}.conloca.com`;
+  if (isPullRequestStage(stage)) {
+    const url = `https://app.${stage}.conloca.com`;
     const summaryPath = processEnv.GITHUB_STEP_SUMMARY;
     if (summaryPath) {
       const appendSummary = dependencies.appendSummary ?? appendFile;
-      await appendSummary(summaryPath, `## ${environment} deployment\n\n[View deployment](${url})\n`);
+      await appendSummary(
+        summaryPath,
+        `## ${stage} deployment
+
+[View deployment](${url})
+`,
+      );
     }
     const publishDeployment =
       dependencies.publishDeployment ??
       ((token: `pr${number}`, deploymentUrl: string) => publishGithubDeployment(token, deploymentUrl, processEnv));
-    await publishDeployment(environment, url);
-  }
-  if (environment !== 'production') {
-    const e2eProjects = await listProjects(root, 'e2e-deployed', 'run-many');
-    if (e2eProjects.length > 0) {
-      const nxArgs = [
-        'run-many',
-        '-t',
-        'e2e-deployed',
-        `--projects=${e2eProjects.join(',')}`,
-        `--parallel=${NX_PARALLEL}`,
-        `--environment=${environment}`,
-      ];
-      const status = await runNx(nxArgs, root);
-      if (status !== 0) {
-        await setStatus('failure');
-        throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
-      }
+    await publishDeployment(stage, url);
+  }
+
+  const outputPath = processEnv.GITHUB_OUTPUT;
+  if (outputPath) {
+    try {
+      const appendOutput = dependencies.appendOutput ?? appendFile;
+      await appendOutput(
+        outputPath,
+        `stage=${stage}
+`,
+      );
+    } catch (error) {
+      await setStatus('failure');
+      throw error;
     }
   }
-
   await setStatus('success');
 }
 
@@ -508,12 +515,12 @@ function eventDefaultBranch(): string | undefined {
   }
 }
 
-export function resolveDeploymentEnvironment(
+export function resolveDeploymentStage(
   explicit: string | undefined,
   environment: NodeJS.ProcessEnv,
   event: GithubActionsEventPayload | undefined,
-): EnvironmentToken {
-  if (explicit !== undefined) return parseEnvironmentToken(explicit);
+): DeploymentStage {
+  if (explicit !== undefined) return parseDeploymentStage(explicit);
   if (environment.GITHUB_EVENT_NAME === 'pull_request') {
     if (!event?.action || !['opened', 'reopened', 'synchronize'].includes(event.action)) {
       throw new Error('Pull-request deployment runs only for opened, reopened, or synchronize events.');
@@ -525,7 +532,7 @@ export function resolveDeploymentEnvironment(
     }
     const number = event.pull_request?.number;
     if (number === undefined) throw new Error('GitHub pull_request event is missing its PR number.');
-    return pullRequestEnvironment(number);
+    return pullRequestStage(number);
   }
   if (environment.GITHUB_EVENT_NAME === 'push' && environment.GITHUB_REF_NAME === 'private') {
     return 'staging';
@@ -533,7 +540,7 @@ export function resolveDeploymentEnvironment(
   if (environment.GITHUB_EVENT_NAME === 'release') {
     return 'production';
   }
-  throw new Error('Cannot resolve a deployment environment from this GitHub event; pass --environment explicitly.');
+  throw new Error('Cannot resolve a deployment stage from this GitHub event; pass --stage explicitly.');
 }
 
 function readGithubActionsEvent(environment: NodeJS.ProcessEnv): GithubActionsEventPayload | undefined {
@@ -559,7 +566,7 @@ async function listNxProjectsWithTarget(
   const result = await $`nx ${listArgs}`.cwd(root).quiet();
   const candidates = nxProjectList(decode(result.stdout)).sort((left, right) => left.localeCompare(right));
   if (target !== 'deploy') return candidates;
-  return selectEnvironmentDeployProjects(candidates, async (project) => {
+  return selectStageDeployProjects(candidates, async (project) => {
     const projectResult = await $`nx show project ${project} --json`.cwd(root).quiet();
     const parsed = parseNxProjectDeployTarget(decode(projectResult.stdout));
     if (!parsed) throw new Error(`nx show project ${project} returned invalid JSON.`);
@@ -567,7 +574,7 @@ async function listNxProjectsWithTarget(
   });
 }
 
-export async function selectEnvironmentDeployProjects(
+export async function selectStageDeployProjects(
   candidates: string[],
   loadProject: (project: string) => Promise<unknown>,
 ): Promise<string[]> {
@@ -577,7 +584,7 @@ export async function selectEnvironmentDeployProjects(
     if (!isNxProjectDeployTarget(definition)) continue;
     const deploy = definition.targets?.deploy;
     const commandValue = deploy?.options?.command ?? deploy?.command;
-    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-environment')) {
+    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-stage')) {
       selected.push(project);
     }
   }

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -3,58 +3,109 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
+import {
+  type CiWorkflowDefinitionOptions,
+  CiWorkflowStepKind,
+  defineCiWorkflow,
+  renderCiWorkflowYaml,
+} from '../ci-workflow.js';
 
 const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
 
+function options(overrides: Partial<CiWorkflowDefinitionOptions> = {}): CiWorkflowDefinitionOptions {
+  return {
+    deploy: false,
+    browserTests: false,
+    e2eDeployment: false,
+    pushBranches: ['main'],
+    ...overrides,
+  };
+}
+
 describe('CI workflow definition', () => {
   it('renders the checked-in local CI workflow copy', async () => {
-    const rendered = renderCiWorkflowYaml({
-      deploy: false,
-      pushBranches: ['main'],
-      runsOn: [...nixosRunsOn],
-    });
+    const rendered = renderCiWorkflowYaml(options({ runsOn: [...nixosRunsOn] }));
     const packageRoot = join(import.meta.dir, '..', '..', '..');
 
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
   });
 
-  it('inserts deploy after tests and renumbers following deeplink steps', () => {
-    const steps = defineCiWorkflow({ deploy: true, pushBranches: ['main'] });
-    const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
+  it('deploys immediately after build and renumbers following steps', () => {
+    const definition = options({ deploy: true, browserTests: true });
+    const steps = defineCiWorkflow(definition);
+    const rendered = renderCiWorkflowYaml(definition);
 
-    expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
-    expect(rendered.match(/- name: 🚀 Deploy Environment/g)).toHaveLength(1);
-    expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
-    expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
-    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step 11');
+    expect(steps.map((step) => [step.kind, step.number])).toEqual([
+      [CiWorkflowStepKind.Checkout, 2],
+      [CiWorkflowStepKind.SetupDevenv, 3],
+      [CiWorkflowStepKind.SetNxShas, 4],
+      [CiWorkflowStepKind.RestoreNxCache, 5],
+      [CiWorkflowStepKind.Build, 6],
+      [CiWorkflowStepKind.Deploy, 7],
+      [CiWorkflowStepKind.Lint, 8],
+      [CiWorkflowStepKind.UnitTests, 9],
+      [CiWorkflowStepKind.BrowserTests, 10],
+      [CiWorkflowStepKind.ManagedFilesCheck, 11],
+      [CiWorkflowStepKind.ManagedFilesDispatch, 12],
+      [CiWorkflowStepKind.SaveNxCache, 13],
+      [CiWorkflowStepKind.UploadTraceDbs, 14],
+      [CiWorkflowStepKind.SaveNixDevenv, 15],
+    ]);
+    expect(rendered.match(/- name: 🚀 Deploy Stage/g)).toHaveLength(1);
+    expect(rendered).toContain('id: deploy');
+    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Stage" --step 7');
+    expect(rendered).toContain('smoo github-ci nx-smart --target test-browser --name "Browser Tests" --step 10');
+    expect(rendered).toContain('group: ${{ github.workflow }}-${{ github.ref }}');
+    expect(rendered).toContain('cancel-in-progress: true');
     expect(rendered).toContain('github.event.pull_request.head.repo.full_name == github.repository');
     expect(rendered).toContain("github.ref == 'refs/heads/private'");
-    expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
-    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
-    expect(rendered).toContain('id: setup');
-    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
-    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
-    expect(rendered).not.toContain('github-actions-bootstrap.sh');
-    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
-    expect(rendered).toContain('runs-on: ubuntu-latest');
+    expect(rendered).toContain("# Step 13\n      # Nx's database cache needs artifact files");
   });
 
-  it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
-    const rendered = renderCiWorkflowYaml({ deploy: true, deployProvider: 'cloudflare', pushBranches: ['main'] });
+  it('adds only generic Cloudflare credentials for Wrangler-backed deploys', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, deployProvider: 'cloudflare' }));
 
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
-    expect(rendered).toContain('GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}');
-    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}');
-    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}');
-    expect(rendered).toContain('OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}');
-    expect(rendered).toContain('MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}');
-    expect(rendered).toContain('TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}');
+    for (const appSecret of [
+      'GITHUB_CLIENT_SECRET',
+      'GITHUB_APP_PRIVATE_KEY',
+      'GITHUB_APP_PRIVATE_KEY_PEM',
+      'OAUTH_STATE_SIGNING_KEY',
+      'MAIL_CAPTURE_CONTROL_TOKEN',
+      'TOKEN_ENCRYPTION_KEY',
+      'E2E_CONTROL_TOKEN',
+    ]) {
+      expect(rendered).not.toContain(appSecret);
+    }
+  });
+
+  it('renders deployment E2E as a dependent job with an independent stage input', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, e2eDeployment: true, runsOn: [...nixosRunsOn] }));
+
+    expect(rendered).toContain('deployment-stage: ${{ steps.deploy.outputs.stage }}');
+    expect(rendered).toContain('  e2e-deployment:\n    name: Deployment E2E\n    needs: main');
+    expect(rendered).toContain(
+      "if: ${{ needs.main.result == 'success' && needs.main.outputs.deployment-stage != '' }}",
+    );
+    expect(rendered).toContain('timeout-minutes: 15');
+    expect(rendered).toContain(
+      'smoo github-ci nx-smart --target e2e-deployment --mode run-many --stage "${{ needs.main.outputs.deployment-stage }}" --name "Deployment E2E" --step 4',
+    );
+    expect(rendered.match(/name: Deployment E2E/g)).toHaveLength(2);
+    expect(rendered).not.toContain('E2E_CONTROL_TOKEN');
+  });
+
+  it('omits optional browser and deployment-E2E lanes when disabled', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true }));
+
+    expect(rendered).not.toContain('--target test-browser');
+    expect(rendered).not.toContain('  e2e-deployment:');
+    expect(rendered).not.toContain('deployment-stage:');
   });
 
   it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {
-    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml(options());
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     const restoreAction = await readFile(join(packageRoot, '..', '..', '.github/actions/cache-nx/action.yml'), 'utf8');
     const restoreKey = restoreAction.match(/^\s*key: (.+)$/m)?.[1];
@@ -64,26 +115,13 @@ describe('CI workflow definition', () => {
     expect(saveKey).toBe(restoreKey);
   });
 
-  it('nixos config: fork PRs on ubuntu; one setup-devenv (composite owns host path)', () => {
-    const rendered = renderCiWorkflowYaml({
-      deploy: false,
-      pushBranches: ['main'],
-      runsOn: [...nixosRunsOn],
-    });
+  it('nixos config gates both jobs away from private runners for fork PRs', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, e2eDeployment: true, runsOn: [...nixosRunsOn] }));
+    const runnerExpression =
+      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}";
 
-    expect(rendered).toContain(
-      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}",
-    );
+    expect(rendered.match(new RegExp(runnerExpression.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'))).toHaveLength(2);
     expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
-    expect(rendered).toContain('id: setup');
-    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
-    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
     expect(rendered).not.toContain('github-actions-bootstrap.sh');
-    expect(rendered).not.toContain('determinate-nix-action');
-    expect(rendered).toContain('if: always()');
-    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
-    // workflow yaml does not embed composite internals
-    expect(rendered).not.toContain('cache-node-modules');
-    expect(rendered).not.toContain('cache-ttsc-plugins');
   });
 });

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -159,15 +159,17 @@ describe('publish workflow definition', () => {
     expect(foldedRunCommand(macosPlatform, '🍎 Build selected macOS and iOS release outputs')).toBe(
       `smoo release build-platform-outputs --bump "\${{ inputs.bump }}" --ref "\${{ github.sha }}" --targets "${MACOS_PLATFORM_TARGET_GLOBS.join(
         ',',
-      )}" --output "\${{ runner.temp }}/macos-platform-outputs"`,
+      )}" --output "\${{ runner.temp }}/macos-platform-outputs" --github-output "$GITHUB_OUTPUT"`,
     );
+    expect(macosPlatform).toContain('id: platform-outputs');
+    expect(macosPlatform).toContain("if: steps.platform-outputs.outputs.projects != ''");
     expect(macosPlatform).toContain(
-      `run: smoo github-ci nx-run-many --targets test --projects-with-targets "${MACOS_PLATFORM_TARGET_GLOBS.join(',')}"`,
+      'run: smoo github-ci nx-run-many --targets test --projects "${{ steps.platform-outputs.outputs.projects }}"',
     );
     expect(macosPlatform.indexOf('- name: 🍎 Build selected macOS and iOS release outputs')).toBeLessThan(
-      macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages'),
+      macosPlatform.indexOf('- name: 🧪 Unit test selected macOS and iOS packages'),
     );
-    expect(macosPlatform.indexOf('- name: 🧪 Unit test macOS and iOS packages')).toBeLessThan(
+    expect(macosPlatform.indexOf('- name: 🧪 Unit test selected macOS and iOS packages')).toBeLessThan(
       macosPlatform.indexOf('- name: 📤 Upload macOS platform outputs'),
     );
     expect(finalJob).not.toContain('smoo release version');
@@ -230,7 +232,7 @@ describe('publish workflow definition', () => {
     );
     expect(rendered).not.toContain('GITHUB_SHA:');
     expect(finalJob).toContain("needs.linux-release-candidate.outputs.mode != 'none'");
-    expect(finalJob).toContain("inputs.deploy_environment == 'production'");
+    expect(finalJob).toContain("inputs.deploy_stage == 'production'");
     expect(finalJob).toContain("inputs.dry_run != 'true'");
     expect(finalJob).toContain('smoo release publish --bump "${{ inputs.bump }}" --dry-run "${{ inputs.dry_run }}"');
     expect(finalJob).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
@@ -248,7 +250,7 @@ describe('publish workflow definition', () => {
   it('omits production deploy controls when no production deploy target exists', () => {
     const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
 
-    expect(rendered).not.toContain('deploy_environment');
+    expect(rendered).not.toContain('deploy_stage');
     expect(rendered).not.toContain('Deploy production');
     expect(rendered).not.toContain('nx-deploy');
   });
@@ -256,12 +258,12 @@ describe('publish workflow definition', () => {
   it('renders production deploy controls for repos with production deploy targets', () => {
     const rendered = renderPublishWorkflowYaml({ deploy: true, repoName: '@smoothbricks/codebase' });
 
-    expect(rendered).toContain('deploy_environment:');
+    expect(rendered).toContain('deploy_stage:');
     expect(rendered).toContain('- name: 🚀 Deploy production');
     expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
     expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
     expect(rendered).toContain(
-      'smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
+      'smoo github-ci nx-deploy --stage production --mode run-many --verify --name "Deploy Production"',
     );
   });
 
@@ -282,7 +284,7 @@ describe('publish workflow definition', () => {
       repairs: [],
       current: [],
       bump: 'auto',
-      deployEnvironment: 'production',
+      deployStage: 'production',
       dryRun: false,
       version: { mode: 'new', projects: ['app'] },
     }).run();
@@ -291,7 +293,7 @@ describe('publish workflow definition', () => {
       repairs: [],
       current: [],
       bump: 'auto',
-      deployEnvironment: 'production',
+      deployStage: 'production',
       dryRun: true,
       version: { mode: 'new', projects: ['app'] },
     }).run();
@@ -420,7 +422,7 @@ interface WorkflowScenarioConfig {
   repairs: ReleaseGap[];
   current: ReleaseGap[];
   bump: PublishWorkflowBump;
-  deployEnvironment?: 'none' | 'production';
+  deployStage?: 'none' | 'production';
   dryRun: boolean;
   version: PublishWorkflowVersionOutputs;
 }
@@ -446,7 +448,7 @@ function publishWorkflowScenario(config: WorkflowScenarioConfig): { run(): Promi
     async run() {
       const state = new WorkflowScenarioState(config);
       await runPublishWorkflow(definePublishWorkflow({ deploy: config.deploy, repoName: config.repoName }), {
-        inputs: { bump: config.bump, deployEnvironment: config.deployEnvironment ?? 'none', dryRun: config.dryRun },
+        inputs: { bump: config.bump, deployStage: config.deployStage ?? 'none', dryRun: config.dryRun },
         callbacks: state.callbacks(),
       });
       return state.outcome();

package/src/monorepo/ci-workflow.ts

@@ -8,6 +8,7 @@ export enum CiWorkflowStepKind {
   SetNxShas = 'set-nx-shas',
   RestoreNxCache = 'restore-nx-cache',
   Build = 'build',
+  BrowserTests = 'browser-tests',
   Lint = 'lint',
   UnitTests = 'unit-tests',
   ManagedFilesCheck = 'managed-files-check',
@@ -26,6 +27,8 @@ export interface CiWorkflowStep {
 
 export interface CiWorkflowDefinitionOptions {
   deploy: boolean;
+  browserTests: boolean;
+  e2eDeployment: boolean;
   deployProvider?: 'cloudflare';
   pushBranches: string[];
   /** Default ubuntu-latest when omitted. */
@@ -41,15 +44,20 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
     { kind: CiWorkflowStepKind.SetNxShas, name: '🧭 Set Nx SHAs' },
     { kind: CiWorkflowStepKind.RestoreNxCache, name: '🧠 Restore Nx cache' },
     { kind: CiWorkflowStepKind.Build, name: '🔨 Build' },
-    { kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' },
-    { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' },
-    { kind: CiWorkflowStepKind.ManagedFilesCheck, name: '🩺 Check managed-file drift' },
-    { kind: CiWorkflowStepKind.ManagedFilesDispatch, name: '🔁 Dispatch managed-file drift healing' },
   ];
   if (options.deploy) {
-    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Environment' });
+    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Stage' });
   }
   steps.push(
+    { kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' },
+    { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' },
+  );
+  if (options.browserTests) {
+    steps.push({ kind: CiWorkflowStepKind.BrowserTests, name: '🌐 Browser Tests' });
+  }
+  steps.push(
+    { kind: CiWorkflowStepKind.ManagedFilesCheck, name: '🩺 Check managed-file drift' },
+    { kind: CiWorkflowStepKind.ManagedFilesDispatch, name: '🔁 Dispatch managed-file drift healing' },
     { kind: CiWorkflowStepKind.SaveNxCache, name: '💾 Save Nx cache' },
     { kind: CiWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs' },
     { kind: CiWorkflowStepKind.SaveNixDevenv, name: '🧹 Cleanup and cache Nix/devenv' },
@@ -59,7 +67,7 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
 
 export function renderCiWorkflowYaml(options: CiWorkflowDefinitionOptions): string {
   const steps = defineCiWorkflow(options);
-  return `${renderCiWorkflowHeader(options)}${renderCiWorkflowSteps(steps, options)}`;
+  return `${renderCiWorkflowHeader(options)}${renderCiWorkflowSteps(steps, options)}${renderE2eDeploymentJob(options)}`;
 }
 
 function renderCiWorkflowHeader(options: CiWorkflowDefinitionOptions): string {
@@ -77,6 +85,10 @@ permissions:
   contents: read
 ${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
+concurrency:
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true
+
 defaults:
   run:
     working-directory: tooling/direnv
@@ -86,7 +98,13 @@ jobs:
     name: Validate
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 45
-    env:
+${
+  options.e2eDeployment
+    ? `    outputs:
+      deployment-stage: ${githubExpression('steps.deploy.outputs.stage')}
+`
+    : ''
+}    env:
       NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
       GH_TOKEN: ${githubExpression('github.token')}
     steps:
@@ -169,6 +187,8 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
       return [`      - name: ${step.name}`, '        id: nx-cache', '        uses: ./.github/actions/cache-nx'];
     case CiWorkflowStepKind.Build:
       return nxSmartStep(step, 'build', 'Build');
+    case CiWorkflowStepKind.BrowserTests:
+      return nxSmartStep(step, 'test-browser', 'Browser Tests');
     case CiWorkflowStepKind.Lint:
       return nxSmartStep(step, 'lint', 'Lint');
     case CiWorkflowStepKind.UnitTests:
@@ -197,6 +217,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
     case CiWorkflowStepKind.Deploy:
       return [
         `      - name: ${step.name}`,
+        '        id: deploy',
         '        if: >-',
         '          ${{',
         "            (github.event_name == 'pull_request' &&",
@@ -205,7 +226,7 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
         "            (github.event_name == 'push' && github.ref == 'refs/heads/private')",
         '          }}',
         ...deployEnvLines(options),
-        `        run: smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step ${step.number}`,
+        `        run: smoo github-ci nx-deploy --mode run-many --name "Deploy Stage" --step ${step.number}`,
       ];
     case CiWorkflowStepKind.SaveNxCache:
       return [
@@ -255,12 +276,6 @@ function deployEnvLines(options: CiWorkflowDefinitionOptions): string[] {
     '        env:',
     '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
     '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
-    '          GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}',
-    '          GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}',
-    '          GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}',
-    '          OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}',
-    '          MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}',
-    '          TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}',
   ];
 }
 
@@ -275,3 +290,41 @@ function renderYamlList(values: string[], spaces: number): string {
   const indent = ' '.repeat(spaces);
   return values.map((value) => `${indent}- ${value}`).join('\n');
 }
+
+function renderE2eDeploymentJob(options: CiWorkflowDefinitionOptions): string {
+  if (!options.e2eDeployment) return '';
+  return `
+
+  e2e-deployment:
+    name: Deployment E2E
+    needs: main
+${renderRunsOnLine(options.runsOn)}
+    timeout-minutes: 15
+    if: \${{ needs.main.result == 'success' && needs.main.outputs.deployment-stage != '' }}
+    steps:
+      # Step 1: GitHub adds "Set up job" automatically
+      # Step 2
+      - name: 📥 Checkout
+        uses: actions/checkout@v6.0.2
+        with:
+          filter: blob:none
+          fetch-depth: 0
+
+      # Step 3. Composite action internals do not affect top-level job step anchors.
+      - name: 🧱 Setup Nix/devenv
+        id: setup
+        uses: ./.github/actions/setup-devenv
+
+      # Step 4
+      - name: Deployment E2E
+        run: smoo github-ci nx-smart --target e2e-deployment --mode run-many --stage "\${{ needs.main.outputs.deployment-stage }}" --name "Deployment E2E" --step 4
+
+      # Step 5
+      - name: 🧹 Cleanup and cache Nix/devenv
+        if: always()
+        uses: ./.github/actions/save-nix-devenv
+        with:
+          nix-cache-hit: \${{ steps.setup.outputs.nix-cache-hit }}
+          devenv-cache-hit: \${{ steps.setup.outputs.devenv-cache-hit }}
+`;
+}