@smoothbricks/cli 0.10.9 → 0.10.10

package/src/github-ci/index.test.ts

@@ -14,8 +14,8 @@ import {
   nxSmartArgs,
   publishGithubDeployment,
   readGitHeadSha,
-  resolveDeploymentEnvironment,
-  selectEnvironmentDeployProjects,
+  resolveDeploymentStage,
+  selectStageDeployProjects,
 } from './index.js';
 import {
   applyCollectedOutputs,
@@ -134,12 +134,13 @@ describe('GitHub CI Nx target expansion', () => {
     ).toEqual(['native:package-linux', 'native:compile-linux', 'native:build']);
   });
 
-  it('adds the generic target skip tag only to nx-smart', () => {
-    expect(nxSmartArgs('test', 'affected')).toEqual([
-      'affected',
+  it('adds optional stage before the generic target skip tag only to nx-smart', () => {
+    expect(nxSmartArgs('e2e-deployment', 'run-many', undefined, 'pr123')).toEqual([
+      'run-many',
       '-t',
-      'test',
-      '--exclude=tag:ci:skip:test',
+      'e2e-deployment',
+      '--stage=pr123',
+      '--exclude=tag:ci:skip:e2e-deployment',
       '--parallel=100%',
     ]);
     expect(nxRunManyArgs({ target: 'test', projects: projects.slice(0, 1) })).not.toContain(
@@ -540,10 +541,10 @@ async function withNxRunManyFixture(
   }
 }
 
-describe('event-aware environment deployment', () => {
-  it('resolves same-repository PR, private push, release, and explicit production environments', () => {
+describe('event-aware stage deployment', () => {
+  it('resolves same-repository PR, private push, release, and explicit production stages', () => {
     expect(
-      resolveDeploymentEnvironment(
+      resolveDeploymentStage(
         undefined,
         { GITHUB_EVENT_NAME: 'pull_request' },
         {
@@ -554,12 +555,12 @@ describe('event-aware environment deployment', () => {
       ),
     ).toBe('pr123');
     expect(
-      resolveDeploymentEnvironment(undefined, { GITHUB_EVENT_NAME: 'push', GITHUB_REF_NAME: 'private' }, undefined),
+      resolveDeploymentStage(undefined, { GITHUB_EVENT_NAME: 'push', GITHUB_REF_NAME: 'private' }, undefined),
     ).toBe('staging');
-    expect(resolveDeploymentEnvironment(undefined, { GITHUB_EVENT_NAME: 'release' }, undefined)).toBe('production');
-    expect(resolveDeploymentEnvironment('production', {}, undefined)).toBe('production');
+    expect(resolveDeploymentStage(undefined, { GITHUB_EVENT_NAME: 'release' }, undefined)).toBe('production');
+    expect(resolveDeploymentStage('production', {}, undefined)).toBe('production');
     expect(() =>
-      resolveDeploymentEnvironment(
+      resolveDeploymentStage(
         undefined,
         { GITHUB_EVENT_NAME: 'pull_request' },
         {
@@ -571,15 +572,15 @@ describe('event-aware environment deployment', () => {
     ).toThrow(/same-repository/);
   });
 
-  it('selects only deploy targets owned by the environment convention', async () => {
+  it('selects only deploy targets owned by the stage convention', async () => {
     const definitions: Record<string, unknown> = {
       'conloca-app': {
         targets: {
-          deploy: { options: { command: 'smoo wrangler deploy-environment --environment {args.environment}' } },
+          deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
         },
       },
       'conloca-app-backend': {
-        targets: { deploy: { command: 'smoo wrangler deploy-environment --environment {args.environment}' } },
+        targets: { deploy: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
       },
       'conloca-oauth-redirect': {
         targets: { deploy: { options: { command: 'wrangler deploy --config wrangler.toml' } } },
@@ -590,7 +591,7 @@ describe('event-aware environment deployment', () => {
     };
 
     await expect(
-      selectEnvironmentDeployProjects(Object.keys(definitions), async (project) => definitions[project]),
+      selectStageDeployProjects(Object.keys(definitions), async (project) => definitions[project]),
     ).resolves.toEqual(['conloca-app', 'conloca-app-backend']);
   });
 
@@ -654,19 +655,21 @@ describe('event-aware environment deployment', () => {
     ]);
   });
 
-  it('deploys app/backend, follows with e2e-deployed, and publishes PR metadata', async () => {
+  it('deploys app/backend, publishes PR metadata, and emits the resolved stage', async () => {
     const nxCalls: string[][] = [];
     const listCalls: Array<[string, string]> = [];
     const summaries: string[] = [];
     const deployments: Array<[string, string]> = [];
+    const outputs: string[] = [];
 
     await githubCiNxDeploy(
       '/repo',
-      { mode: 'run-many', name: 'Deploy Environment' },
+      { mode: 'run-many', name: 'Deploy Stage' },
       {
         processEnv: {
           GITHUB_EVENT_NAME: 'pull_request',
           GITHUB_STEP_SUMMARY: '/summary',
+          GITHUB_OUTPUT: '/output',
         },
         setStatus: async () => {},
         eventPayload: {
@@ -676,7 +679,7 @@ describe('event-aware environment deployment', () => {
         },
         listProjects: async (_root, target, mode) => {
           listCalls.push([target, mode]);
-          return target === 'deploy' ? ['conloca-app', 'conloca-app-backend'] : ['conloca-e2e'];
+          return ['conloca-app', 'conloca-app-backend'];
         },
         runNx: async (args) => {
           nxCalls.push(args);
@@ -685,24 +688,90 @@ describe('event-aware environment deployment', () => {
         appendSummary: async (_path, content) => {
           summaries.push(content);
         },
-        publishDeployment: async (environment, url) => {
-          deployments.push([environment, url]);
+        appendOutput: async (_path, content) => {
+          outputs.push(content);
+        },
+        publishDeployment: async (stage, url) => {
+          deployments.push([stage, url]);
         },
       },
     );
 
-    expect(listCalls).toEqual([
-      ['deploy', 'run-many'],
-      ['e2e-deployed', 'run-many'],
-    ]);
-    expect(nxCalls).toHaveLength(2);
+    expect(listCalls).toEqual([['deploy', 'run-many']]);
+    expect(nxCalls).toHaveLength(1);
     expect(nxCalls[0]).toContain('--projects=conloca-app,conloca-app-backend');
     expect(nxCalls[0]).toContain('--exclude=tag:permanent-deploy-target');
-    expect(nxCalls[0]).toContain('--environment=pr123');
-    expect(nxCalls[1]).toContain('-t');
-    expect(nxCalls[1]).toContain('e2e-deployed');
-    expect(nxCalls[1]).toContain('--environment=pr123');
+    expect(nxCalls[0]).toContain('--stage=pr123');
+    expect(nxCalls[0]).not.toContain('e2e-deployment');
     expect(summaries).toEqual(['## pr123 deployment\n\n[View deployment](https://app.pr123.conloca.com)\n']);
     expect(deployments).toEqual([['pr123', 'https://app.pr123.conloca.com']]);
+    expect(outputs).toEqual(['stage=pr123\n']);
+  });
+
+  it('emits no stage when no deploy project exists', async () => {
+    const outputs: string[] = [];
+    const statuses: string[] = [];
+
+    await githubCiNxDeploy(
+      '/repo',
+      { stage: 'staging' },
+      {
+        processEnv: { GITHUB_OUTPUT: '/output' },
+        listProjects: async () => [],
+        appendOutput: async (_path, content) => {
+          outputs.push(content);
+        },
+        setStatus: async (status) => {
+          statuses.push(status);
+        },
+      },
+    );
+
+    expect(outputs).toEqual([]);
+    expect(statuses).toEqual(['pending', 'success']);
+  });
+
+  it('emits no stage after deployment or output failure', async () => {
+    const deploymentOutputs: string[] = [];
+    const deploymentStatuses: string[] = [];
+    await expect(
+      githubCiNxDeploy(
+        '/repo',
+        { stage: 'staging' },
+        {
+          processEnv: { GITHUB_OUTPUT: '/output' },
+          listProjects: async () => ['app'],
+          runNx: async () => 1,
+          appendOutput: async (_path, content) => {
+            deploymentOutputs.push(content);
+          },
+          setStatus: async (status) => {
+            deploymentStatuses.push(status);
+          },
+        },
+      ),
+    ).rejects.toThrow(/failed with exit code 1/);
+    expect(deploymentOutputs).toEqual([]);
+    expect(deploymentStatuses).toEqual(['pending', 'failure']);
+
+    const outputStatuses: string[] = [];
+    await expect(
+      githubCiNxDeploy(
+        '/repo',
+        { stage: 'staging' },
+        {
+          processEnv: { GITHUB_OUTPUT: '/output' },
+          listProjects: async () => ['app'],
+          runNx: async () => 0,
+          appendOutput: async () => {
+            throw new Error('output unavailable');
+          },
+          setStatus: async (status) => {
+            outputStatuses.push(status);
+          },
+        },
+      ),
+    ).rejects.toThrow('output unavailable');
+    expect(outputStatuses).toEqual(['pending', 'failure']);
   });
 });

package/src/github-ci/index.ts

@@ -7,12 +7,7 @@ import typia from 'typia';
 import { parseStringArrayText } from '../lib/json.js';
 import { decode, run, runStatus } from '../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../nx/index.js';
-import {
-  type EnvironmentToken,
-  isPullRequestEnvironment,
-  parseEnvironmentToken,
-  pullRequestEnvironment,
-} from '../wrangler/environment.js';
+import { type DeploymentStage, isPullRequestStage, parseDeploymentStage, pullRequestStage } from '../wrangler/stage.js';
 import type { NxTargetRun } from './outputs.js';
 
 export interface GithubActionsEventPayload {
@@ -159,24 +154,32 @@ async function addReferencesFrom(roots: Set<string>, path: string, cwd: string):
   }
 }
 
-export function nxSmartArgs(target: string, mode: 'affected' | 'run-many', configuration?: string): string[] {
+export function nxSmartArgs(
+  target: string,
+  mode: 'affected' | 'run-many',
+  configuration?: string,
+  stage?: string,
+): string[] {
   const args = [mode, '-t', target];
   if (configuration) {
     args.push(`--configuration=${configuration}`);
   }
+  if (stage) {
+    args.push(`--stage=${stage}`);
+  }
   args.push(`--exclude=tag:ci:skip:${target}`, `--parallel=${NX_PARALLEL}`);
   return args;
 }
 
 export async function githubCiNxSmart(
   root: string,
-  options: { target: string; name?: string; step?: string; mode?: NxSmartMode; configuration?: string },
+  options: { target: string; name?: string; step?: string; mode?: NxSmartMode; configuration?: string; stage?: string },
 ): Promise<void> {
   const name = options.name ?? options.target;
   const step = options.step ?? '';
   await createGithubStatus(name, step);
   const mode = resolveNxSmartMode(options.mode ?? 'auto');
-  const nxArgs = nxSmartArgs(options.target, mode, options.configuration);
+  const nxArgs = nxSmartArgs(options.target, mode, options.configuration, options.stage);
   const status = await runStatus('nx', nxArgs, root);
   await updateGithubStatus(name, status === 0 ? 'success' : 'failure', step);
   if (status !== 0) {
@@ -381,7 +384,7 @@ function commaSeparatedValues(value: string): string[] {
 }
 
 export interface GithubCiNxDeployOptions {
-  environment?: string;
+  stage?: string;
   mode?: NxSmartMode;
   name?: string;
   step?: string;
@@ -392,7 +395,8 @@ export interface GithubCiNxDeployDependencies {
   listProjects?: (root: string, target: string, mode: 'affected' | 'run-many') => Promise<string[]>;
   runNx?: (args: string[], root: string) => Promise<number>;
   appendSummary?: (summaryPath: string, content: string) => Promise<void>;
-  publishDeployment?: (environment: `pr${number}`, url: string) => Promise<void>;
+  appendOutput?: (outputPath: string, content: string) => Promise<void>;
+  publishDeployment?: (stage: `pr${number}`, url: string) => Promise<void>;
   setStatus?: (state: 'pending' | 'success' | 'failure') => Promise<void>;
   processEnv?: NodeJS.ProcessEnv;
   eventPayload?: GithubActionsEventPayload;
@@ -405,8 +409,8 @@ export async function githubCiNxDeploy(
 ): Promise<void> {
   const processEnv = dependencies.processEnv ?? process.env;
   const eventPayload = dependencies.eventPayload ?? readGithubActionsEvent(processEnv);
-  const environment = resolveDeploymentEnvironment(options.environment, processEnv, eventPayload);
-  const name = options.name ?? 'Deploy Environment';
+  const stage = resolveDeploymentStage(options.stage, processEnv, eventPayload);
+  const name = options.name ?? 'Deploy Stage';
   const step = options.step ?? '';
   const setStatus =
     dependencies.setStatus ??
@@ -418,7 +422,7 @@ export async function githubCiNxDeploy(
   const runNx = dependencies.runNx ?? ((args: string[], commandRoot: string) => runStatus('nx', args, commandRoot));
   const projects = await listProjects(root, 'deploy', mode);
   if (projects.length === 0) {
-    console.log(`No ${mode} deploy projects; skipping ${environment}.`);
+    console.log(`No ${mode} deploy projects; skipping ${stage}.`);
     await setStatus('success');
     return;
   }
@@ -435,7 +439,7 @@ export async function githubCiNxDeploy(
       `--parallel=${NX_PARALLEL}`,
     ];
     if (target === 'deploy') {
-      nxArgs.push(`--environment=${environment}`);
+      nxArgs.push(`--stage=${stage}`);
     }
     const status = await runNx(nxArgs, root);
     if (status !== 0) {
@@ -444,37 +448,39 @@ export async function githubCiNxDeploy(
     }
   }
 
-  if (isPullRequestEnvironment(environment)) {
-    const url = `https://app.${environment}.conloca.com`;
+  if (isPullRequestStage(stage)) {
+    const url = `https://app.${stage}.conloca.com`;
     const summaryPath = processEnv.GITHUB_STEP_SUMMARY;
     if (summaryPath) {
       const appendSummary = dependencies.appendSummary ?? appendFile;
-      await appendSummary(summaryPath, `## ${environment} deployment\n\n[View deployment](${url})\n`);
+      await appendSummary(
+        summaryPath,
+        `## ${stage} deployment
+
+[View deployment](${url})
+`,
+      );
     }
     const publishDeployment =
       dependencies.publishDeployment ??
       ((token: `pr${number}`, deploymentUrl: string) => publishGithubDeployment(token, deploymentUrl, processEnv));
-    await publishDeployment(environment, url);
-  }
-  if (environment !== 'production') {
-    const e2eProjects = await listProjects(root, 'e2e-deployed', 'run-many');
-    if (e2eProjects.length > 0) {
-      const nxArgs = [
-        'run-many',
-        '-t',
-        'e2e-deployed',
-        `--projects=${e2eProjects.join(',')}`,
-        `--parallel=${NX_PARALLEL}`,
-        `--environment=${environment}`,
-      ];
-      const status = await runNx(nxArgs, root);
-      if (status !== 0) {
-        await setStatus('failure');
-        throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
-      }
+    await publishDeployment(stage, url);
+  }
+
+  const outputPath = processEnv.GITHUB_OUTPUT;
+  if (outputPath) {
+    try {
+      const appendOutput = dependencies.appendOutput ?? appendFile;
+      await appendOutput(
+        outputPath,
+        `stage=${stage}
+`,
+      );
+    } catch (error) {
+      await setStatus('failure');
+      throw error;
     }
   }
-
   await setStatus('success');
 }
 
@@ -509,12 +515,12 @@ function eventDefaultBranch(): string | undefined {
   }
 }
 
-export function resolveDeploymentEnvironment(
+export function resolveDeploymentStage(
   explicit: string | undefined,
   environment: NodeJS.ProcessEnv,
   event: GithubActionsEventPayload | undefined,
-): EnvironmentToken {
-  if (explicit !== undefined) return parseEnvironmentToken(explicit);
+): DeploymentStage {
+  if (explicit !== undefined) return parseDeploymentStage(explicit);
   if (environment.GITHUB_EVENT_NAME === 'pull_request') {
     if (!event?.action || !['opened', 'reopened', 'synchronize'].includes(event.action)) {
       throw new Error('Pull-request deployment runs only for opened, reopened, or synchronize events.');
@@ -526,7 +532,7 @@ export function resolveDeploymentEnvironment(
     }
     const number = event.pull_request?.number;
     if (number === undefined) throw new Error('GitHub pull_request event is missing its PR number.');
-    return pullRequestEnvironment(number);
+    return pullRequestStage(number);
   }
   if (environment.GITHUB_EVENT_NAME === 'push' && environment.GITHUB_REF_NAME === 'private') {
     return 'staging';
@@ -534,7 +540,7 @@ export function resolveDeploymentEnvironment(
   if (environment.GITHUB_EVENT_NAME === 'release') {
     return 'production';
   }
-  throw new Error('Cannot resolve a deployment environment from this GitHub event; pass --environment explicitly.');
+  throw new Error('Cannot resolve a deployment stage from this GitHub event; pass --stage explicitly.');
 }
 
 function readGithubActionsEvent(environment: NodeJS.ProcessEnv): GithubActionsEventPayload | undefined {
@@ -560,7 +566,7 @@ async function listNxProjectsWithTarget(
   const result = await $`nx ${listArgs}`.cwd(root).quiet();
   const candidates = nxProjectList(decode(result.stdout)).sort((left, right) => left.localeCompare(right));
   if (target !== 'deploy') return candidates;
-  return selectEnvironmentDeployProjects(candidates, async (project) => {
+  return selectStageDeployProjects(candidates, async (project) => {
     const projectResult = await $`nx show project ${project} --json`.cwd(root).quiet();
     const parsed = parseNxProjectDeployTarget(decode(projectResult.stdout));
     if (!parsed) throw new Error(`nx show project ${project} returned invalid JSON.`);
@@ -568,7 +574,7 @@ async function listNxProjectsWithTarget(
   });
 }
 
-export async function selectEnvironmentDeployProjects(
+export async function selectStageDeployProjects(
   candidates: string[],
   loadProject: (project: string) => Promise<unknown>,
 ): Promise<string[]> {
@@ -578,7 +584,7 @@ export async function selectEnvironmentDeployProjects(
     if (!isNxProjectDeployTarget(definition)) continue;
     const deploy = definition.targets?.deploy;
     const commandValue = deploy?.options?.command ?? deploy?.command;
-    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-environment')) {
+    if (typeof commandValue === 'string' && commandValue.includes('smoo wrangler deploy-stage')) {
       selected.push(project);
     }
   }

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -3,58 +3,109 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
+import {
+  type CiWorkflowDefinitionOptions,
+  CiWorkflowStepKind,
+  defineCiWorkflow,
+  renderCiWorkflowYaml,
+} from '../ci-workflow.js';
 
 const nixosRunsOn = ['nixos-latest-x64', 'self-hosted'] as const;
 
+function options(overrides: Partial<CiWorkflowDefinitionOptions> = {}): CiWorkflowDefinitionOptions {
+  return {
+    deploy: false,
+    browserTests: false,
+    e2eDeployment: false,
+    pushBranches: ['main'],
+    ...overrides,
+  };
+}
+
 describe('CI workflow definition', () => {
   it('renders the checked-in local CI workflow copy', async () => {
-    const rendered = renderCiWorkflowYaml({
-      deploy: false,
-      pushBranches: ['main'],
-      runsOn: [...nixosRunsOn],
-    });
+    const rendered = renderCiWorkflowYaml(options({ runsOn: [...nixosRunsOn] }));
     const packageRoot = join(import.meta.dir, '..', '..', '..');
 
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
   });
 
-  it('inserts deploy after tests and renumbers following deeplink steps', () => {
-    const steps = defineCiWorkflow({ deploy: true, pushBranches: ['main'] });
-    const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
+  it('deploys immediately after build and renumbers following steps', () => {
+    const definition = options({ deploy: true, browserTests: true });
+    const steps = defineCiWorkflow(definition);
+    const rendered = renderCiWorkflowYaml(definition);
 
-    expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 11]);
-    expect(rendered.match(/- name: 🚀 Deploy Environment/g)).toHaveLength(1);
-    expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
-    expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
-    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Environment" --step 11');
+    expect(steps.map((step) => [step.kind, step.number])).toEqual([
+      [CiWorkflowStepKind.Checkout, 2],
+      [CiWorkflowStepKind.SetupDevenv, 3],
+      [CiWorkflowStepKind.SetNxShas, 4],
+      [CiWorkflowStepKind.RestoreNxCache, 5],
+      [CiWorkflowStepKind.Build, 6],
+      [CiWorkflowStepKind.Deploy, 7],
+      [CiWorkflowStepKind.Lint, 8],
+      [CiWorkflowStepKind.UnitTests, 9],
+      [CiWorkflowStepKind.BrowserTests, 10],
+      [CiWorkflowStepKind.ManagedFilesCheck, 11],
+      [CiWorkflowStepKind.ManagedFilesDispatch, 12],
+      [CiWorkflowStepKind.SaveNxCache, 13],
+      [CiWorkflowStepKind.UploadTraceDbs, 14],
+      [CiWorkflowStepKind.SaveNixDevenv, 15],
+    ]);
+    expect(rendered.match(/- name: 🚀 Deploy Stage/g)).toHaveLength(1);
+    expect(rendered).toContain('id: deploy');
+    expect(rendered).toContain('smoo github-ci nx-deploy --mode run-many --name "Deploy Stage" --step 7');
+    expect(rendered).toContain('smoo github-ci nx-smart --target test-browser --name "Browser Tests" --step 10');
+    expect(rendered).toContain('group: ${{ github.workflow }}-${{ github.ref }}');
+    expect(rendered).toContain('cancel-in-progress: true');
     expect(rendered).toContain('github.event.pull_request.head.repo.full_name == github.repository');
     expect(rendered).toContain("github.ref == 'refs/heads/private'");
-    expect(rendered).toContain("# Step 12\n      # Nx's database cache needs artifact files");
-    expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
-    expect(rendered).toContain('id: setup');
-    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
-    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
-    expect(rendered).not.toContain('github-actions-bootstrap.sh');
-    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
-    expect(rendered).toContain('runs-on: ubuntu-latest');
+    expect(rendered).toContain("# Step 13\n      # Nx's database cache needs artifact files");
   });
 
-  it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
-    const rendered = renderCiWorkflowYaml({ deploy: true, deployProvider: 'cloudflare', pushBranches: ['main'] });
+  it('adds only generic Cloudflare credentials for Wrangler-backed deploys', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, deployProvider: 'cloudflare' }));
 
     expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
     expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
-    expect(rendered).toContain('GITHUB_CLIENT_SECRET: ${{ secrets.GITHUB_CLIENT_SECRET }}');
-    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}');
-    expect(rendered).toContain('GITHUB_APP_PRIVATE_KEY_PEM: ${{ secrets.GITHUB_APP_PRIVATE_KEY_PEM }}');
-    expect(rendered).toContain('OAUTH_STATE_SIGNING_KEY: ${{ secrets.OAUTH_STATE_SIGNING_KEY }}');
-    expect(rendered).toContain('MAIL_CAPTURE_CONTROL_TOKEN: ${{ secrets.MAIL_CAPTURE_CONTROL_TOKEN }}');
-    expect(rendered).toContain('TOKEN_ENCRYPTION_KEY: ${{ secrets.TOKEN_ENCRYPTION_KEY }}');
+    for (const appSecret of [
+      'GITHUB_CLIENT_SECRET',
+      'GITHUB_APP_PRIVATE_KEY',
+      'GITHUB_APP_PRIVATE_KEY_PEM',
+      'OAUTH_STATE_SIGNING_KEY',
+      'MAIL_CAPTURE_CONTROL_TOKEN',
+      'TOKEN_ENCRYPTION_KEY',
+      'E2E_CONTROL_TOKEN',
+    ]) {
+      expect(rendered).not.toContain(appSecret);
+    }
+  });
+
+  it('renders deployment E2E as a dependent job with an independent stage input', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, e2eDeployment: true, runsOn: [...nixosRunsOn] }));
+
+    expect(rendered).toContain('deployment-stage: ${{ steps.deploy.outputs.stage }}');
+    expect(rendered).toContain('  e2e-deployment:\n    name: Deployment E2E\n    needs: main');
+    expect(rendered).toContain(
+      "if: ${{ needs.main.result == 'success' && needs.main.outputs.deployment-stage != '' }}",
+    );
+    expect(rendered).toContain('timeout-minutes: 15');
+    expect(rendered).toContain(
+      'smoo github-ci nx-smart --target e2e-deployment --mode run-many --stage "${{ needs.main.outputs.deployment-stage }}" --name "Deployment E2E" --step 4',
+    );
+    expect(rendered.match(/name: Deployment E2E/g)).toHaveLength(2);
+    expect(rendered).not.toContain('E2E_CONTROL_TOKEN');
+  });
+
+  it('omits optional browser and deployment-E2E lanes when disabled', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true }));
+
+    expect(rendered).not.toContain('--target test-browser');
+    expect(rendered).not.toContain('  e2e-deployment:');
+    expect(rendered).not.toContain('deployment-stage:');
   });
 
   it('uses the same architecture-scoped key to restore and save the Nx cache', async () => {
-    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml(options());
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     const restoreAction = await readFile(join(packageRoot, '..', '..', '.github/actions/cache-nx/action.yml'), 'utf8');
     const restoreKey = restoreAction.match(/^\s*key: (.+)$/m)?.[1];
@@ -64,26 +115,13 @@ describe('CI workflow definition', () => {
     expect(saveKey).toBe(restoreKey);
   });
 
-  it('nixos config: fork PRs on ubuntu; one setup-devenv (composite owns host path)', () => {
-    const rendered = renderCiWorkflowYaml({
-      deploy: false,
-      pushBranches: ['main'],
-      runsOn: [...nixosRunsOn],
-    });
+  it('nixos config gates both jobs away from private runners for fork PRs', () => {
+    const rendered = renderCiWorkflowYaml(options({ deploy: true, e2eDeployment: true, runsOn: [...nixosRunsOn] }));
+    const runnerExpression =
+      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}";
 
-    expect(rendered).toContain(
-      "runs-on:\n      ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) &&\n      fromJSON('[\"nixos-latest-x64\",\"self-hosted\"]') || 'ubuntu-latest' }}",
-    );
+    expect(rendered.match(new RegExp(runnerExpression.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'g'))).toHaveLength(2);
     expect(rendered).toContain('uses: ./.github/actions/setup-devenv');
-    expect(rendered).toContain('id: setup');
-    expect(rendered).not.toContain('Setup Nix/devenv (fork)');
-    expect(rendered).not.toContain('Setup Nix/devenv (nixos)');
     expect(rendered).not.toContain('github-actions-bootstrap.sh');
-    expect(rendered).not.toContain('determinate-nix-action');
-    expect(rendered).toContain('if: always()');
-    expect(rendered).toContain('uses: ./.github/actions/save-nix-devenv');
-    // workflow yaml does not embed composite internals
-    expect(rendered).not.toContain('cache-node-modules');
-    expect(rendered).not.toContain('cache-ttsc-plugins');
   });
 });