@smoothbricks/cli 0.11.11 → 0.11.13

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -6,6 +6,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import type { PackageCargoGitOrigin } from '../../lib/json.js';
 import {
   type CiWorkflowDefinitionOptions,
   CiWorkflowStepKind,
@@ -317,6 +318,115 @@ describe('CI workflow definition', () => {
     }
   });
 
+  it('rewrites every declared SSH spelling of a mirrored forge onto the same mirror', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'cargo-ssh-'));
+    try {
+      const lines = cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        {
+          gitOrigins: [
+            {
+              origin: 'https://git.example.net',
+              tokenEnv: 'SOURCE_READ_TOKEN',
+              internalMirror: 'http://10.89.0.1:3000',
+              // Both spellings a lockfile can carry: git matches insteadOf
+              // prefixes textually and infers neither from the other.
+              sshOrigins: ['ssh://forgejo@forge.example.net:2223/', 'ssh://forge.example.net:2223'],
+            },
+          ],
+        },
+      );
+      const script = lines
+        .slice(lines.indexOf('        run: |') + 1)
+        .map((line) => line.slice(10))
+        .join('\n');
+      const githubEnv = join(directory, 'env');
+      writeFileSync(githubEnv, '');
+      const environment = {
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        RUNNER_TEMP: directory,
+        GITHUB_ENV: githubEnv,
+        SOURCE_READ_TOKEN: 'fixture-secret',
+      };
+      const prepared = spawnSync('sh', ['-eu', '-c', script], { env: environment, encoding: 'utf8' });
+      expect(prepared.status).toBe(0);
+      const written = readFileSync(githubEnv, 'utf8');
+      // One insteadOf pair per spelling, all pointing at the one mirror, and a
+      // missing trailing slash is normalized: `ssh://host:2223` would rewrite
+      // `ssh://host:2223-other/` too.
+      expect(written).toContain('GIT_CONFIG_KEY_2=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_2=https://git.example.net/');
+      expect(written).toContain('GIT_CONFIG_KEY_3=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_3=ssh://forgejo@forge.example.net:2223/');
+      expect(written).toContain('GIT_CONFIG_KEY_4=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_4=ssh://forge.example.net:2223/');
+      expect(written).toContain('GIT_CONFIG_COUNT=5');
+      const helper = join(directory, 'cargo-git-credential.sh');
+      const ask = (protocol: string, host: string): string => {
+        const result = spawnSync('sh', [helper, 'get'], {
+          env: environment,
+          encoding: 'utf8',
+          input: `protocol=${protocol}\nhost=${host}\n\n`,
+        });
+        expect(result.status).toBe(0);
+        return result.stdout;
+      };
+      // The rewrite happens before transport, so git only ever asks for the
+      // mirror. The SSH spelling stays credential-free: an SSH origin the
+      // runner cannot reach must fail loudly, not collect a token.
+      expect(ask('http', '10.89.0.1:3000')).toBe('username=x-access-token\npassword=fixture-secret\n');
+      expect(ask('ssh', 'forge.example.net:2223')).toBe('');
+      expect(ask('ssh', 'forgejo@forge.example.net:2223')).toBe('');
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  it('refuses SSH spellings no mirror rewrites, and spellings git cannot match as a prefix', () => {
+    const origin = { origin: 'https://git.example.net', tokenEnv: 'SOURCE_READ_TOKEN' };
+    const render = (entry: PackageCargoGitOrigin): string[] =>
+      cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        { gitOrigins: [entry] },
+      );
+
+    // An sshOrigins entry only means anything as a rewrite target.
+    expect(() => render({ ...origin, sshOrigins: ['ssh://forge.example.net:2223/'] })).toThrow('internalMirror');
+    const mirrored = { ...origin, internalMirror: 'http://10.89.0.1:3000' };
+    for (const sshOrigins of [
+      [],
+      // scp syntax is not a URL prefix git can rewrite from a Cargo pin.
+      ['forgejo@forge.example.net:axe/minigraf.git'],
+      // A path would rewrite one repository, not the forge.
+      ['ssh://forge.example.net:2223/axe/minigraf.git'],
+      // A password in a declared origin is a secret in package.json.
+      ['ssh://forgejo:hunter2@forge.example.net:2223/'],
+      ['https://git.example.net/'],
+      // Two identical spellings make the same key ambiguous.
+      ['ssh://forge.example.net:2223/', 'ssh://forge.example.net:2223'],
+    ]) {
+      expect(() => render({ ...mirrored, sshOrigins })).toThrow('sshOrigins');
+    }
+    // One spelling, two mirrors: git keeps whichever identical key it read
+    // last, so the declaration is refused instead of resolved.
+    expect(() =>
+      cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        {
+          gitOrigins: [
+            { ...mirrored, sshOrigins: ['ssh://forge.example.net:2223/'] },
+            {
+              origin: 'https://git.other.net',
+              tokenEnv: 'OTHER_READ_TOKEN',
+              internalMirror: 'http://10.89.0.2:3000',
+              sshOrigins: ['ssh://forge.example.net:2223/'],
+            },
+          ],
+        },
+      ),
+    ).toThrow('sshOrigins');
+  });
+
   it('refuses malformed internal mirrors at render time', () => {
     for (const internalMirror of [
       'http://git.example.net/private/repo.git',
@@ -333,6 +443,79 @@ describe('CI workflow definition', () => {
     }
   });
 
+  it('gives every Nx job the declared remote cache at the address its runners reach', () => {
+    const definition = options({
+      deploy: true,
+      e2eDeployment: true,
+      productionOnPush: true,
+      remoteCache: {
+        server: 'https://nx-cache.example.net',
+        internalServer: 'http://10.89.0.1:8765',
+        tokenSecret: 'NX_REMOTE_CACHE_TOKEN',
+      },
+    });
+    const rendered = renderCiWorkflowYaml(definition);
+    const cacheEnv = {
+      NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
+      NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: '${{ secrets.NX_REMOTE_CACHE_TOKEN }}',
+    };
+
+    expect(Bun.YAML.parse(rendered)).toMatchObject({
+      jobs: {
+        main: {
+          env: cacheEnv,
+          // A fork PR receives no secrets, and Nx fails every task a cache
+          // server refuses, so the job cannot run there at all.
+          if: "${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}",
+        },
+        'e2e-deployment': { env: cacheEnv },
+        'deploy-production': { env: cacheEnv },
+      },
+    });
+    // The public origin belongs to shells outside the runner network; a job
+    // that took it would leave the internal address unused.
+    expect(rendered).not.toContain('https://nx-cache.example.net');
+  });
+
+  it('takes the public server without an internal runner, and emits nothing without the declaration', () => {
+    const publicOnly = renderCiWorkflowYaml(
+      options({ remoteCache: { server: 'https://nx-cache.example.net', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } }),
+    );
+
+    expect(Bun.YAML.parse(publicOnly)).toMatchObject({
+      jobs: { main: { env: { NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'https://nx-cache.example.net' } } },
+    });
+    expect(renderCiWorkflowYaml(options())).not.toContain('NX_SELF_HOSTED');
+    // Without a cache token the job needs no secrets, so fork PRs still run.
+    expect(renderCiWorkflowYaml(options())).not.toContain('head.repo.full_name');
+  });
+
+  it('refuses a remote cache declaration Nx could not use, at render time', () => {
+    for (const server of [
+      'https://nx-cache.example.net/',
+      'https://nx-cache.example.net/cache',
+      'https://token@nx-cache.example.net',
+      'ftp://nx-cache.example.net',
+      'nx-cache.example.net:8765',
+    ]) {
+      expect(() =>
+        renderCiWorkflowYaml(options({ remoteCache: { server, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } })),
+      ).toThrow('smoo.remoteCache server');
+    }
+    const server = 'https://nx-cache.example.net';
+    expect(() =>
+      renderCiWorkflowYaml(
+        options({ remoteCache: { server, internalServer: 'http://10.89.0.1:8765/', tokenSecret: 'TOKEN' } }),
+      ),
+    ).toThrow('smoo.remoteCache internalServer');
+    expect(() =>
+      renderCiWorkflowYaml(options({ remoteCache: { server, internalServer: server, tokenSecret: 'TOKEN' } })),
+    ).toThrow('repeats server');
+    expect(() =>
+      renderCiWorkflowYaml(options({ remoteCache: { server, tokenSecret: 'nx_remote_cache_token' } })),
+    ).toThrow('tokenSecret');
+  });
+
   it('refuses missing registry secrets before setup and skips private Cargo jobs for fork PRs', () => {
     const definition = options({ cargoCredentials: { registryTokenEnvs: ['CARGO_REGISTRIES_EXAMPLE_TOKEN'] } });
     const steps = defineCiWorkflow(definition);

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -57,6 +57,35 @@ describe('publish workflow definition', () => {
     ).resolves.toBe(rendered);
   });
 
+  it('gives every publish job the declared remote cache, in bytes Prettier keeps', async () => {
+    const remoteCache = {
+      server: 'https://nx-cache.example.net',
+      internalServer: 'http://10.89.0.1:8765',
+      tokenSecret: 'NX_REMOTE_CACHE_TOKEN',
+    };
+    const cacheEnv = {
+      NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
+      NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: '${{ secrets.NX_REMOTE_CACHE_TOKEN }}',
+    };
+    const platform = renderPublishWorkflowYaml({ ...codebaseWorkflowOptions, remoteCache });
+    const single = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase', remoteCache });
+
+    expect(Bun.YAML.parse(platform)).toMatchObject({
+      jobs: {
+        'linux-release-candidate': { env: cacheEnv },
+        'macos-platform': { env: cacheEnv },
+        'publish-on-linux': { env: cacheEnv },
+      },
+    });
+    expect(Bun.YAML.parse(single)).toMatchObject({ jobs: { publish: { env: cacheEnv } } });
+    expect(renderPublishWorkflowYaml(codebaseWorkflowOptions)).not.toContain('NX_SELF_HOSTED');
+    // A workflow the repository Prettier config would rewrite drifts on the
+    // first commit hook, so the cache lines must already be its output.
+    await expect(
+      format(platform, { parser: 'yaml', printWidth: 120, proseWrap: 'always', singleQuote: true }),
+    ).resolves.toBe(platform);
+  });
+
   it('passes the projects selector to the version and platform-output steps', async () => {
     const rendered = renderPublishWorkflowYaml(codebaseWorkflowOptions);
 

package/src/monorepo/cargo-policy.test.ts

@@ -1,8 +1,9 @@
 import { describe, expect, it, spyOn } from 'bun:test';
+import { readFileSync } from 'node:fs';
 import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, type CargoHakariShell, validateCargoCachePolicy } from './cargo-policy.js';
 
 async function withFixture<T>(files: Record<string, string>, callback: (root: string) => T): Promise<T> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-cargo-policy-'));
@@ -18,17 +19,46 @@ async function withFixture<T>(files: Record<string, string>, callback: (root: st
   }
 }
 
-async function check(files: Record<string, string>): Promise<{ failures: number; messages: string[] }> {
+async function check(
+  files: Record<string, string>,
+  shell?: CargoHakariShell,
+): Promise<{ failures: number; messages: string[] }> {
   return withFixture(files, (root) => {
     const captured = captureErrors();
     try {
-      return { failures: validateCargoCachePolicy(root), messages: captured.messages };
+      return { failures: validateCargoCachePolicy(root, { shell }), messages: captured.messages };
     } finally {
       captured.restore();
     }
   });
 }
 
+/** Records what update would run, and answers `verify` however the test needs. */
+function recordingHakari(
+  verify: { code: number; output?: string; missing?: boolean } = { code: 0 },
+): CargoHakariShell & {
+  calls: string[][];
+} {
+  const calls: string[][] = [];
+  return {
+    calls,
+    run(_directory, args) {
+      calls.push([...args]);
+      return args[0] === 'verify'
+        ? { code: verify.code, output: verify.output ?? '', missing: verify.missing ?? false }
+        : { code: 0, output: '', missing: false };
+    },
+  };
+}
+
+const NIGHTLY_DEVENV = 'languages.rust = {\n  channel = "nightly";\n};\n';
+const UNIFIED_CONFIG = '[unstable]\nfeature-unification = true\n\n[resolver]\nfeature-unification = "workspace"\n';
+const TWO_CRATE_WORKSPACE = {
+  'Cargo.toml': '[workspace]\nmembers = ["crates/*"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+  'crates/alpha/Cargo.toml': '[package]\nname = "alpha"\n',
+  'crates/beta/Cargo.toml': '[package]\nname = "beta"\n',
+};
+
 function captureErrors(): { messages: string[]; restore: () => void } {
   const messages: string[] = [];
   const error = spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
@@ -186,3 +216,176 @@ describe('Cargo cache policy', () => {
     expect(result.messages).toEqual([]);
   });
 });
+
+describe('Cargo workspace feature unification', () => {
+  it('leaves a single-crate workspace alone', async () => {
+    // Nothing to unify: `feature-unification = "workspace"` and a workspace-hack
+    // both exist to stop ONE dependency being built twice with different
+    // features for two members, which needs two members.
+    const result = await check({
+      'Cargo.toml': '[workspace]\nmembers = ["crates/only"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+      'crates/only/Cargo.toml': '[package]\nname = "only"\n',
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+    });
+    expect(result.failures).toBe(0);
+  });
+
+  it('requires a mechanism once a workspace holds more than one crate', async () => {
+    const result = await check({ ...TWO_CRATE_WORKSPACE, 'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV });
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('feature-unification');
+    expect(result.messages[0]).toContain('smoo monorepo update');
+  });
+
+  it('accepts the nightly resolver configuration and rejects it without the unstable flag', async () => {
+    const configured = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(configured.failures).toBe(0);
+
+    // Cargo silently ignores [resolver] feature-unification without the
+    // unstable opt-in, so the half-configured repository believes it is unified
+    // while every crate still re-resolves features.
+    const inert = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      '.cargo/config.toml': '[resolver]\nfeature-unification = "workspace"\n',
+    });
+    expect(inert.failures).toBe(1);
+    expect(inert.messages[0]).toContain('[unstable] feature-unification = true');
+  });
+
+  it('reads the channel from the managed devenv module, not from a decorative rust-toolchain file', async () => {
+    // devenv resolves the toolchain through rust-overlay and ignores
+    // rust-toolchain.toml unless languages.rust.toolchainFile names it, so the
+    // module's channel is the compiler that actually runs these commands.
+    const result = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV,
+      'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(result.failures).toBe(0);
+  });
+
+  it('refuses the nightly-only resolver key on a stable toolchain', async () => {
+    const result = await check({
+      ...TWO_CRATE_WORKSPACE,
+      'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      '.cargo/config.toml': UNIFIED_CONFIG,
+    });
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('cargo-hakari');
+    expect(result.messages[0]).toContain('stable');
+  });
+
+  it('accepts a hakari-managed workspace-hack on a stable toolchain', async () => {
+    const hakari = recordingHakari();
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml':
+          '[package]\nname = "beta"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\nresolver = "2"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      hakari,
+    );
+    expect(result.failures).toBe(0);
+    expect(hakari.calls).toEqual([['verify']]);
+  });
+
+  it('flags a crate that does not depend on the workspace-hack', async () => {
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml': '[package]\nname = "beta"\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      recordingHakari(),
+    );
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('beta');
+    expect(result.messages[0]).toContain('smoo monorepo update');
+  });
+
+  it('surfaces a stale workspace-hack that cargo hakari verify rejects', async () => {
+    const result = await check(
+      {
+        'Cargo.toml':
+          '[workspace]\nmembers = ["crates/*", "workspace-hack"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+        'crates/alpha/Cargo.toml':
+          '[package]\nname = "alpha"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'crates/beta/Cargo.toml':
+          '[package]\nname = "beta"\n\n[dependencies]\nworkspace-hack = { path = "../../workspace-hack" }\n',
+        'workspace-hack/Cargo.toml': '[package]\nname = "workspace-hack"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+        'rust-toolchain.toml': '[toolchain]\nchannel = "stable"\n',
+      },
+      recordingHakari({ code: 1, output: 'workspace-hack is not up-to-date' }),
+    );
+    expect(result.failures).toBe(1);
+    expect(result.messages[0]).toContain('cargo hakari verify');
+    expect(result.messages[0]).toContain('workspace-hack is not up-to-date');
+  });
+});
+
+describe('Cargo feature unification update', () => {
+  it('writes the nightly resolver configuration once', async () => {
+    await withFixture({ ...TWO_CRATE_WORKSPACE, 'tooling/direnv/devenv.smoo.nix': NIGHTLY_DEVENV }, (root) => {
+      const configPath = join(root, '.cargo/config.toml');
+      const hakari = recordingHakari();
+      applyCargoFeatureUnification(root, { shell: hakari });
+      const written = readFileSync(configPath, 'utf8');
+      expect(written).toContain('[unstable]\nfeature-unification = true');
+      expect(written).toContain('[resolver]\nfeature-unification = "workspace"');
+      expect(hakari.calls).toEqual([]);
+
+      applyCargoFeatureUnification(root, { shell: hakari });
+      expect(readFileSync(configPath, 'utf8')).toBe(written);
+      const captured = captureErrors();
+      try {
+        expect(validateCargoCachePolicy(root, { shell: hakari })).toBe(0);
+      } finally {
+        captured.restore();
+      }
+    });
+  });
+
+  it('generates and wires a workspace-hack on a stable toolchain', async () => {
+    await withFixture(
+      { ...TWO_CRATE_WORKSPACE, 'rust-toolchain.toml': '[toolchain]\nchannel = "1.89.0"\n' },
+      (root) => {
+        const hakari = recordingHakari();
+        applyCargoFeatureUnification(root, { shell: hakari });
+        expect(hakari.calls).toEqual([['init', 'workspace-hack'], ['generate'], ['manage-deps', '--yes']]);
+      },
+    );
+  });
+
+  it('skips hakari init when the workspace already declares one', async () => {
+    await withFixture(
+      {
+        ...TWO_CRATE_WORKSPACE,
+        'rust-toolchain.toml': '[toolchain]\nchannel = "1.89.0"\n',
+        '.config/hakari.toml': 'hakari-package = "workspace-hack"\n',
+      },
+      (root) => {
+        const hakari = recordingHakari();
+        applyCargoFeatureUnification(root, { shell: hakari });
+        expect(hakari.calls).toEqual([['generate'], ['manage-deps', '--yes']]);
+      },
+    );
+  });
+});