@smoothbricks/cli 0.11.11 → 0.11.13

package/src/monorepo/index.ts

@@ -2,7 +2,7 @@ import { appendFileSync, readFileSync, writeFileSync } from 'node:fs';
 import { printCommandOutput, run, runResult } from '../lib/run.js';
 import { escapeRegex, getWorkspacePackages, getWorkspacePatterns, listReleasePackages } from '../lib/workspace.js';
 import { readProjectTargets } from '../nx/index.js';
-import { validateCargoCachePolicy } from './cargo-policy.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy } from './cargo-policy.js';
 import {
   formatCommitMessage,
   stagedDeletedPublicPackages,
@@ -112,6 +112,10 @@ export async function updateManagedFiles(root: string): Promise<void> {
   // Tool dependency policy (typescript API 6, @typescript/native for ttsc, nx, …)
   // lives next to managed templates — update must install them, not only rewrite files.
   await applyToolConfigDefaults(root);
+  // Rust's half of the same job: a multi-crate Cargo workspace must resolve
+  // features once for every member, or each per-crate cargo invocation
+  // recompiles the shared graph for its own selection.
+  applyCargoFeatureUnification(root);
   syncBunLockfileVersions(root, { mode: 'install' });
   console.log('installing     workspace dependencies (bun install)');
   await run('bun', ['install', '--no-summary'], root);

package/src/monorepo/managed-files.ts

@@ -10,6 +10,7 @@ import {
   type PackageCargoCredentialsConfig,
   type PackageJson,
   type PackagePrivateNpmConfig,
+  type PackageRemoteCacheConfig,
   type PackageSmooGithub,
   type PackageSmooGithubEnvironments,
   type PackageSourceCheckoutConfig,
@@ -176,6 +177,8 @@ export interface ManagedFileContext {
   sourceCheckouts?: PackageSourceCheckoutConfig[];
   /** Declared Cargo private-dependency credentials from the root smoo config; absent means none. */
   cargoCredentials?: PackageCargoCredentialsConfig;
+  /** Declared self-hosted Nx remote cache from the root smoo config; absent means local caching only. */
+  remoteCache?: PackageRemoteCacheConfig;
 }
 
 interface DeployTargetInfo {
@@ -391,6 +394,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         privateNpm: context.privateNpm,
         sourceCheckouts: context.sourceCheckouts,
         cargoCredentials: context.cargoCredentials,
+        remoteCache: context.remoteCache,
         environments: context.ciEnvironments,
         deploySecrets: context.ciDeploySecrets,
         e2eSecrets: context.ciE2eSecrets,
@@ -414,6 +418,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         privateNpm: context.privateNpm,
         sourceCheckouts: context.sourceCheckouts,
         cargoCredentials: context.cargoCredentials,
+        remoteCache: context.remoteCache,
         deploySecrets: context.ciDeploySecrets,
       });
     }
@@ -476,6 +481,7 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
     platformTargetGlobs,
     sourceCheckouts,
     cargoCredentials,
+    remoteCache: manifest?.smoo?.remoteCache,
     macosPlatformArchitectures: macosPlatformArchitecturesForTest(targetNames),
     privateNpm,
   };

package/src/monorepo/packs/index.test.ts

@@ -221,6 +221,38 @@ describe('monorepo validation pack phases', () => {
     }
   });
 
+  it('validates and fixes cargo workspace feature unification through its own pack', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-validate-cargo-'));
+    try {
+      await mkdir(join(root, 'crates/alpha'), { recursive: true });
+      await mkdir(join(root, 'crates/beta'), { recursive: true });
+      await mkdir(join(root, 'tooling/direnv'), { recursive: true });
+      await writeFile(
+        join(root, 'Cargo.toml'),
+        '[workspace]\nmembers = ["crates/*"]\n\n[profile.test]\nincremental = false\ndebug = 0\n',
+      );
+      await writeFile(join(root, 'crates/alpha/Cargo.toml'), '[package]\nname = "alpha"\n');
+      await writeFile(join(root, 'crates/beta/Cargo.toml'), '[package]\nname = "beta"\n');
+      await writeFile(join(root, 'tooling/direnv/devenv.smoo.nix'), 'languages.rust = {\n  channel = "nightly";\n};\n');
+      const cargoPack = packsForTest.find((pack) => pack.name === 'cargo');
+      if (!cargoPack) {
+        throw new Error('cargo validation pack not found');
+      }
+      const runBuild = () => 0;
+
+      // A policy nothing calls is not a policy: validate must reach it.
+      expect(
+        await runValidatePacks({ root, syncRuntime: false }, { failFast: true }, { packs: [cargoPack], runBuild }),
+      ).toEqual({ failures: 1, failedChecks: 1 });
+
+      expect(
+        await runValidatePacks({ root, syncRuntime: false }, { fix: true }, { packs: [cargoPack], runBuild }),
+      ).toEqual({ failures: 0, failedChecks: 0 });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
   it('propagates parsed target dependencies through the production adapter', () => {
     const targetDependencies = new Map([
       ['build', ['compile-linux']],

package/src/monorepo/packs/index.ts

@@ -2,6 +2,7 @@ import { chmodSync, existsSync, statSync } from 'node:fs';
 import { join } from 'node:path';
 import { printCommandOutput, runResult, runStatus } from '../../lib/run.js';
 import { type ProjectTargets, readProjectTargets } from '../../nx/index.js';
+import { applyCargoFeatureUnification, validateCargoCachePolicy } from '../cargo-policy.js';
 import { validateGoToolchainAgreement } from '../go-toolchain.js';
 import { syncBunLockfileVersions, validateBunLockfileVersions } from '../lockfile.js';
 import { validateDevenvModuleImport, warnOnManagedFileDrift } from '../managed-files.js';
@@ -120,6 +121,18 @@ const packs: MonorepoPack[] = [
       return validateDevenvModuleImport(ctx.root);
     },
   },
+  {
+    // Cargo's build-cache and feature-unification conventions. `--fix` writes
+    // the workspace feature unification a multi-crate workspace needs; the rest
+    // of the policy is a verdict a human has to act on.
+    name: 'cargo',
+    fixPreBuild(ctx) {
+      applyCargoFeatureUnification(ctx.root);
+    },
+    validatePreBuild(ctx) {
+      return validateCargoCachePolicy(ctx.root);
+    },
+  },
   {
     name: 'publishing',
     init(ctx) {

package/src/monorepo/publish-workflow.ts

@@ -11,6 +11,7 @@ import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 import type {
   PackageCargoCredentialsConfig,
   PackagePrivateNpmConfig,
+  PackageRemoteCacheConfig,
   PackageSmooGithub,
   PackageSourceCheckoutConfig,
 } from '../lib/json.js';
@@ -21,6 +22,7 @@ import {
   cargoCredentialStepLines,
   type DeployStepSecretConfig,
   deployStepSecretEnvLines,
+  remoteCacheJobEnvLines,
   sourceCheckoutsStepLines,
 } from './ci-workflow.js';
 import { GITHUB_HOSTED_LINUX_RUNNER, renderRunsOnLine, type WorkflowRunsOn } from './github-runs-on.js';
@@ -125,6 +127,13 @@ export interface PublishWorkflowDefinitionOptions extends DeployStepSecretConfig
    * become job env because every later cargo fetch resolves them.
    */
   cargoCredentials?: PackageCargoCredentialsConfig;
+  /**
+   * Declared self-hosted Nx remote cache. Every job here runs Nx targets —
+   * the release-candidate build, the platform build, the publish gate — so
+   * each carries the server and access token and reuses what CI already
+   * built for the same hashes.
+   */
+  remoteCache?: PackageRemoteCacheConfig;
 }
 
 export interface PublishWorkflowInputs {
@@ -466,7 +475,7 @@ jobs:
   publish:
 ${options.release === false ? renderRunsOnLine(options.runsOn) : publishJobRunsOnLine(options)}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 `;
 }
@@ -717,6 +726,17 @@ function cargoCredentialsJobEnv(options: PublishWorkflowDefinitionOptions): stri
   return rendered === '' ? '' : `\n${rendered}`;
 }
 
+/**
+ * The remote cache is job env for the same reason: every Nx target in the job
+ * reads it, and a release build that missed the cache would rebuild what CI
+ * already built for the identical hashes. Only `${{ secrets.NAME }}` is
+ * rendered for the token. Malformed declarations throw here, not in CI.
+ */
+function remoteCacheJobEnv(options: PublishWorkflowDefinitionOptions): string {
+  const rendered = remoteCacheJobEnvLines(options.remoteCache).trimEnd();
+  return rendered === '' ? '' : `\n${rendered}`;
+}
+
 function renderSingleJobPublishWorkflowSteps(
   steps: PublishWorkflowStep[],
   options: PublishWorkflowDefinitionOptions,
@@ -796,7 +816,7 @@ ${renderRunsOnLine(options.runsOn)}
       mode: ${githubExpression('steps.version.outputs.mode')}
       release-sha: ${githubExpression('steps.release-state.outputs.sha')}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 ${renderLinuxReleaseCandidateSteps(steps, options)}
 
@@ -806,7 +826,7 @@ ${renderMacosJobHeaderLines(options)}
       contents: read
       id-token: none
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
 ${Object.entries(options.platformProducer?.env ?? {})
   .map(([name, value]) => `      ${name}: ${JSON.stringify(value)}`)
   .join('\n')}
@@ -821,7 +841,7 @@ ${publishJobRunsOnLine(options)}
       id-token: write
     env:
       TTSC_TSGO_BINARY: ${githubExpression('github.workspace')}/node_modules/@typescript/native/bin/tsc
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 ${renderFinalLinuxPublishSteps(options)}
 `;

package/src/monorepo/secret-references.test.ts

@@ -136,14 +136,18 @@ async function resolveInBootstrap(options: {
 
 /** Builds a fixture repository whose package.json and .npmrc are the resolver's real inputs. */
 async function withFixture(
-  options: { secrets: Record<string, SecretSpec>; npmrc?: string },
+  options: { secrets: Record<string, SecretSpec>; npmrc?: string; remoteCache?: unknown },
   run: (root: string) => Promise<void>,
 ): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-secret-references-'));
   try {
     await writeFile(
       join(root, 'package.json'),
-      JSON.stringify({ name: 'fixture', version: '0.0.0', smoo: { secrets: options.secrets } }),
+      JSON.stringify({
+        name: 'fixture',
+        version: '0.0.0',
+        smoo: { secrets: options.secrets, remoteCache: options.remoteCache },
+      }),
     );
     if (options.npmrc !== undefined) {
       await writeFile(join(root, '.npmrc'), options.npmrc);
@@ -249,6 +253,28 @@ describe('resolveSecretEnvironment', () => {
     });
   });
 
+  it('an unreachable cache-token provider does not block the install, while other secrets still refuse', async () => {
+    await withFixture(
+      {
+        secrets: {
+          NX_REMOTE_CACHE_TOKEN: { command: ['definitely-not-a-real-smoo-binary-xyz'] },
+          SMOO_TOKEN: { command: emit('tok-from-provider') },
+        },
+        remoteCache: { server: 'https://nx-cache.example.net', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      },
+      async (root) => {
+        // A cache is an optimization: its provider being down installs
+        // dependencies anyway. Every other declared secret keeps its refusal.
+        expect(await resolveInBootstrap({ root, env: {} })).toEqual({
+          resolved: { SMOO_TOKEN: 'tok-from-provider' },
+        });
+        const withoutCacheDeclaration = await resolveInBootstrap({ root, env: { CI: 'true' } });
+        expect(withoutCacheDeclaration.error).toContain('SMOO_TOKEN');
+        expect(withoutCacheDeclaration.error).not.toContain('NX_REMOTE_CACHE_TOKEN');
+      },
+    );
+  });
+
   it('a present variable is not reported while another refuses in CI', async () => {
     await withFixture(
       {
@@ -361,3 +387,150 @@ describe('resolveSecretEnvironment', () => {
     }
   });
 });
+
+/**
+ * The remote cache half is exercised the way the managed shell runs it — the
+ * raw script as a program, its stdout `eval`-ed — because that round trip is
+ * the contract: shell text on stdout, guidance on stderr, and a status that
+ * never keeps a shell from opening.
+ */
+describe('remote cache shell export', () => {
+  const SERVER = 'https://nx-cache.example.net';
+
+  async function exportFor(root: string, env: Record<string, string>): Promise<{ stdout: string; stderr: string }> {
+    const proc = Bun.spawn({
+      cmd: ['bun', RAW_RESOLVER, root],
+      env: { PATH: process.env['PATH'], HOME: process.env['HOME'], ...env },
+      stdin: 'ignore',
+      stdout: 'pipe',
+      stderr: 'pipe',
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+      new Response(proc.stdout).text(),
+      new Response(proc.stderr).text(),
+      proc.exited,
+    ]);
+    // A cache is an optimization: nothing it does may fail shell entry.
+    expect(exitCode).toBe(0);
+    return { stdout, stderr };
+  }
+
+  /** The value a shell ends up with after eval-ing the script's output. */
+  async function evaluated(root: string, env: Record<string, string>, name: string): Promise<string> {
+    const { stdout } = await exportFor(root, env);
+    const shell = Bun.spawnSync({
+      cmd: ['sh', '-c', `${stdout}printf %s "\${${name}:-}"`],
+      env: { PATH: process.env['PATH'] ?? '/usr/bin:/bin' },
+    });
+    expect(shell.exitCode).toBe(0);
+    return shell.stdout.toString();
+  }
+
+  it('exports the pair from an ambient token and nothing from an absent declaration', async () => {
+    await withFixture(
+      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
+      async (root) => {
+        expect((await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).stdout).toBe(
+          `export NX_SELF_HOSTED_REMOTE_CACHE_SERVER='${SERVER}'\nexport NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='ambient-token'\n`,
+        );
+      },
+    );
+    await withFixture({ secrets: {} }, async (root) => {
+      expect(await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' })).toEqual({ stdout: '', stderr: '' });
+    });
+  });
+
+  it('exports nothing and names the variable when the token has no value', async () => {
+    await withFixture(
+      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
+      async (root) => {
+        const { stdout, stderr } = await exportFor(root, {});
+        // Half a pair is worse than none: Nx enables its cache on the server
+        // alone and then fails every task on 401.
+        expect(stdout).toBe('');
+        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
+        expect(stderr).toContain(SERVER);
+      },
+    );
+  });
+
+  it('reports a broken provider as a lost cache, never as a failed install', async () => {
+    await withFixture(
+      {
+        secrets: { NX_REMOTE_CACHE_TOKEN: { command: ['definitely-not-a-real-smoo-binary-xyz'] } },
+        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      },
+      async (root) => {
+        const { stdout, stderr } = await exportFor(root, {});
+        expect(stdout).toBe('');
+        expect(stderr).toContain('NX_REMOTE_CACHE_TOKEN');
+        expect(stderr).toContain('remote cache off');
+        // Nothing here stopped an install, and the message may not say it did.
+        expect(stderr).not.toContain('dependencies were not installed');
+      },
+    );
+  });
+
+  it('leaves a server the environment already carries alone', async () => {
+    await withFixture(
+      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
+      async (root) => {
+        // A CI job env names the address its own runners reach; the public
+        // origin must not replace it.
+        expect(
+          await exportFor(root, {
+            NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
+            NX_REMOTE_CACHE_TOKEN: 'ambient-token',
+          }),
+        ).toEqual({ stdout: '', stderr: '' });
+      },
+    );
+  });
+
+  it('resolves a provider-declared token, and only that one secret', async () => {
+    await withFixture(
+      {
+        secrets: {
+          NX_REMOTE_CACHE_TOKEN: { command: emit('provider-token') },
+          SMOO_OTHER: { command: ['definitely-not-a-real-smoo-binary-xyz'] },
+        },
+        remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      },
+      async (root) => {
+        // The unrunnable sibling proves no other declared secret is resolved
+        // here, and that none of them reaches the shell.
+        const { stdout } = await exportFor(root, {});
+        expect(stdout).toContain("export NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN='provider-token'");
+        expect(stdout).not.toContain('SMOO_OTHER');
+      },
+    );
+  });
+
+  it('survives eval with a token full of shell metacharacters', async () => {
+    const hostile = `it's $(touch /tmp/smoo-cache-pwned) \`x\` "q" \\`;
+    await withFixture(
+      { secrets: {}, remoteCache: { server: SERVER, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } },
+      async (root) => {
+        expect(
+          await evaluated(root, { NX_REMOTE_CACHE_TOKEN: hostile }, 'NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN'),
+        ).toBe(hostile);
+      },
+    );
+  });
+
+  it('refuses a declaration Nx could not use, naming the field', async () => {
+    for (const remoteCache of [
+      { server: `${SERVER}/`, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      { server: '', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      { server: SERVER, tokenSecret: 'has-dash' },
+      { server: SERVER },
+      'https://nx-cache.example.net',
+    ]) {
+      await withFixture({ secrets: {}, remoteCache }, async (root) => {
+        const { stdout, stderr } = await exportFor(root, { NX_REMOTE_CACHE_TOKEN: 'ambient-token' });
+        expect(stdout).toBe('');
+        expect(stderr).toContain('smoo.remoteCache');
+      });
+    }
+  });
+});