@smoothbricks/cli 0.11.12 → 0.11.14

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -6,6 +6,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import type { PackageCargoGitOrigin } from '../../lib/json.js';
 import {
   type CiWorkflowDefinitionOptions,
   CiWorkflowStepKind,
@@ -317,6 +318,115 @@ describe('CI workflow definition', () => {
     }
   });
 
+  it('rewrites every declared SSH spelling of a mirrored forge onto the same mirror', () => {
+    const directory = mkdtempSync(join(tmpdir(), 'cargo-ssh-'));
+    try {
+      const lines = cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        {
+          gitOrigins: [
+            {
+              origin: 'https://git.example.net',
+              tokenEnv: 'SOURCE_READ_TOKEN',
+              internalMirror: 'http://10.89.0.1:3000',
+              // Both spellings a lockfile can carry: git matches insteadOf
+              // prefixes textually and infers neither from the other.
+              sshOrigins: ['ssh://forgejo@forge.example.net:2223/', 'ssh://forge.example.net:2223'],
+            },
+          ],
+        },
+      );
+      const script = lines
+        .slice(lines.indexOf('        run: |') + 1)
+        .map((line) => line.slice(10))
+        .join('\n');
+      const githubEnv = join(directory, 'env');
+      writeFileSync(githubEnv, '');
+      const environment = {
+        PATH: process.env.PATH ?? '/usr/bin:/bin',
+        RUNNER_TEMP: directory,
+        GITHUB_ENV: githubEnv,
+        SOURCE_READ_TOKEN: 'fixture-secret',
+      };
+      const prepared = spawnSync('sh', ['-eu', '-c', script], { env: environment, encoding: 'utf8' });
+      expect(prepared.status).toBe(0);
+      const written = readFileSync(githubEnv, 'utf8');
+      // One insteadOf pair per spelling, all pointing at the one mirror, and a
+      // missing trailing slash is normalized: `ssh://host:2223` would rewrite
+      // `ssh://host:2223-other/` too.
+      expect(written).toContain('GIT_CONFIG_KEY_2=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_2=https://git.example.net/');
+      expect(written).toContain('GIT_CONFIG_KEY_3=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_3=ssh://forgejo@forge.example.net:2223/');
+      expect(written).toContain('GIT_CONFIG_KEY_4=url.http://10.89.0.1:3000/.insteadOf');
+      expect(written).toContain('GIT_CONFIG_VALUE_4=ssh://forge.example.net:2223/');
+      expect(written).toContain('GIT_CONFIG_COUNT=5');
+      const helper = join(directory, 'cargo-git-credential.sh');
+      const ask = (protocol: string, host: string): string => {
+        const result = spawnSync('sh', [helper, 'get'], {
+          env: environment,
+          encoding: 'utf8',
+          input: `protocol=${protocol}\nhost=${host}\n\n`,
+        });
+        expect(result.status).toBe(0);
+        return result.stdout;
+      };
+      // The rewrite happens before transport, so git only ever asks for the
+      // mirror. The SSH spelling stays credential-free: an SSH origin the
+      // runner cannot reach must fail loudly, not collect a token.
+      expect(ask('http', '10.89.0.1:3000')).toBe('username=x-access-token\npassword=fixture-secret\n');
+      expect(ask('ssh', 'forge.example.net:2223')).toBe('');
+      expect(ask('ssh', 'forgejo@forge.example.net:2223')).toBe('');
+    } finally {
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  it('refuses SSH spellings no mirror rewrites, and spellings git cannot match as a prefix', () => {
+    const origin = { origin: 'https://git.example.net', tokenEnv: 'SOURCE_READ_TOKEN' };
+    const render = (entry: PackageCargoGitOrigin): string[] =>
+      cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        { gitOrigins: [entry] },
+      );
+
+    // An sshOrigins entry only means anything as a rewrite target.
+    expect(() => render({ ...origin, sshOrigins: ['ssh://forge.example.net:2223/'] })).toThrow('internalMirror');
+    const mirrored = { ...origin, internalMirror: 'http://10.89.0.1:3000' };
+    for (const sshOrigins of [
+      [],
+      // scp syntax is not a URL prefix git can rewrite from a Cargo pin.
+      ['forgejo@forge.example.net:axe/minigraf.git'],
+      // A path would rewrite one repository, not the forge.
+      ['ssh://forge.example.net:2223/axe/minigraf.git'],
+      // A password in a declared origin is a secret in package.json.
+      ['ssh://forgejo:hunter2@forge.example.net:2223/'],
+      ['https://git.example.net/'],
+      // Two identical spellings make the same key ambiguous.
+      ['ssh://forge.example.net:2223/', 'ssh://forge.example.net:2223'],
+    ]) {
+      expect(() => render({ ...mirrored, sshOrigins })).toThrow('sshOrigins');
+    }
+    // One spelling, two mirrors: git keeps whichever identical key it read
+    // last, so the declaration is refused instead of resolved.
+    expect(() =>
+      cargoCredentialStepLines(
+        { kind: CiWorkflowStepKind.CargoCredentials, name: 'Credentials', number: 3 },
+        {
+          gitOrigins: [
+            { ...mirrored, sshOrigins: ['ssh://forge.example.net:2223/'] },
+            {
+              origin: 'https://git.other.net',
+              tokenEnv: 'OTHER_READ_TOKEN',
+              internalMirror: 'http://10.89.0.2:3000',
+              sshOrigins: ['ssh://forge.example.net:2223/'],
+            },
+          ],
+        },
+      ),
+    ).toThrow('sshOrigins');
+  });
+
   it('refuses malformed internal mirrors at render time', () => {
     for (const internalMirror of [
       'http://git.example.net/private/repo.git',
@@ -333,6 +443,79 @@ describe('CI workflow definition', () => {
     }
   });
 
+  it('gives every Nx job the declared remote cache at the address its runners reach', () => {
+    const definition = options({
+      deploy: true,
+      e2eDeployment: true,
+      productionOnPush: true,
+      remoteCache: {
+        server: 'https://nx-cache.example.net',
+        internalServer: 'http://10.89.0.1:8765',
+        tokenSecret: 'NX_REMOTE_CACHE_TOKEN',
+      },
+    });
+    const rendered = renderCiWorkflowYaml(definition);
+    const cacheEnv = {
+      NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
+      NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: '${{ secrets.NX_REMOTE_CACHE_TOKEN }}',
+    };
+
+    expect(Bun.YAML.parse(rendered)).toMatchObject({
+      jobs: {
+        main: {
+          env: cacheEnv,
+          // A fork PR receives no secrets, and Nx fails every task a cache
+          // server refuses, so the job cannot run there at all.
+          if: "${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}",
+        },
+        'e2e-deployment': { env: cacheEnv },
+        'deploy-production': { env: cacheEnv },
+      },
+    });
+    // The public origin belongs to shells outside the runner network; a job
+    // that took it would leave the internal address unused.
+    expect(rendered).not.toContain('https://nx-cache.example.net');
+  });
+
+  it('takes the public server without an internal runner, and emits nothing without the declaration', () => {
+    const publicOnly = renderCiWorkflowYaml(
+      options({ remoteCache: { server: 'https://nx-cache.example.net', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } }),
+    );
+
+    expect(Bun.YAML.parse(publicOnly)).toMatchObject({
+      jobs: { main: { env: { NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'https://nx-cache.example.net' } } },
+    });
+    expect(renderCiWorkflowYaml(options())).not.toContain('NX_SELF_HOSTED');
+    // Without a cache token the job needs no secrets, so fork PRs still run.
+    expect(renderCiWorkflowYaml(options())).not.toContain('head.repo.full_name');
+  });
+
+  it('refuses a remote cache declaration Nx could not use, at render time', () => {
+    for (const server of [
+      'https://nx-cache.example.net/',
+      'https://nx-cache.example.net/cache',
+      'https://token@nx-cache.example.net',
+      'ftp://nx-cache.example.net',
+      'nx-cache.example.net:8765',
+    ]) {
+      expect(() =>
+        renderCiWorkflowYaml(options({ remoteCache: { server, tokenSecret: 'NX_REMOTE_CACHE_TOKEN' } })),
+      ).toThrow('smoo.remoteCache server');
+    }
+    const server = 'https://nx-cache.example.net';
+    expect(() =>
+      renderCiWorkflowYaml(
+        options({ remoteCache: { server, internalServer: 'http://10.89.0.1:8765/', tokenSecret: 'TOKEN' } }),
+      ),
+    ).toThrow('smoo.remoteCache internalServer');
+    expect(() =>
+      renderCiWorkflowYaml(options({ remoteCache: { server, internalServer: server, tokenSecret: 'TOKEN' } })),
+    ).toThrow('repeats server');
+    expect(() =>
+      renderCiWorkflowYaml(options({ remoteCache: { server, tokenSecret: 'nx_remote_cache_token' } })),
+    ).toThrow('tokenSecret');
+  });
+
   it('refuses missing registry secrets before setup and skips private Cargo jobs for fork PRs', () => {
     const definition = options({ cargoCredentials: { registryTokenEnvs: ['CARGO_REGISTRIES_EXAMPLE_TOKEN'] } });
     const steps = defineCiWorkflow(definition);

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -38,6 +38,9 @@ const codebaseWorkflowOptions: PublishWorkflowDefinitionOptions = {
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml(codebaseWorkflowOptions);
+    // validate builds and pack-checks the release's candidates, not every project:
+    // unscoped it compiled binaries the release did not contain.
+    expect(rendered).toContain('smoo monorepo validate --projects "${{ steps.version.outputs.projects }}"');
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,
@@ -57,6 +60,35 @@ describe('publish workflow definition', () => {
     ).resolves.toBe(rendered);
   });
 
+  it('gives every publish job the declared remote cache, in bytes Prettier keeps', async () => {
+    const remoteCache = {
+      server: 'https://nx-cache.example.net',
+      internalServer: 'http://10.89.0.1:8765',
+      tokenSecret: 'NX_REMOTE_CACHE_TOKEN',
+    };
+    const cacheEnv = {
+      NX_SELF_HOSTED_REMOTE_CACHE_SERVER: 'http://10.89.0.1:8765',
+      NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: '${{ secrets.NX_REMOTE_CACHE_TOKEN }}',
+    };
+    const platform = renderPublishWorkflowYaml({ ...codebaseWorkflowOptions, remoteCache });
+    const single = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase', remoteCache });
+
+    expect(Bun.YAML.parse(platform)).toMatchObject({
+      jobs: {
+        'linux-release-candidate': { env: cacheEnv },
+        'macos-platform': { env: cacheEnv },
+        'publish-on-linux': { env: cacheEnv },
+      },
+    });
+    expect(Bun.YAML.parse(single)).toMatchObject({ jobs: { publish: { env: cacheEnv } } });
+    expect(renderPublishWorkflowYaml(codebaseWorkflowOptions)).not.toContain('NX_SELF_HOSTED');
+    // A workflow the repository Prettier config would rewrite drifts on the
+    // first commit hook, so the cache lines must already be its output.
+    await expect(
+      format(platform, { parser: 'yaml', printWidth: 120, proseWrap: 'always', singleQuote: true }),
+    ).resolves.toBe(platform);
+  });
+
   it('passes the projects selector to the version and platform-output steps', async () => {
     const rendered = renderPublishWorkflowYaml(codebaseWorkflowOptions);
 

package/src/monorepo/ci-workflow.ts

@@ -6,6 +6,7 @@ import type {
   PackageCargoCredentialsConfig,
   PackageCargoGitOrigin,
   PackagePrivateNpmConfig,
+  PackageRemoteCacheConfig,
   PackageSmooGithub,
   PackageSmooGithubEnvironments,
   PackageSourceCheckoutConfig,
@@ -79,6 +80,12 @@ export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
    * before SetupDevenv. Absent means no private Cargo fetch.
    */
   cargoCredentials?: PackageCargoCredentialsConfig;
+  /**
+   * Declared self-hosted Nx remote cache (package.json `smoo.remoteCache`).
+   * Every job that runs Nx carries the server and the access token, so one
+   * cache serves the whole fleet. Absent means each runner caches locally.
+   */
+  remoteCache?: PackageRemoteCacheConfig;
   /** GitHub Environments: staging for the validate/e2e jobs, production for the production-on-push job. */
   environments?: PackageSmooGithubEnvironments;
   /** Secrets for the e2e-deployment step, env var name → repository secret name. */
@@ -166,8 +173,9 @@ jobs:
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 45
 ${
-  options.privateNpm?.readTokenEnv || options.cargoCredentials !== undefined
-    ? `    # Fork PRs receive no secrets; private dependency installs cannot run there.
+  options.privateNpm?.readTokenEnv || options.cargoCredentials !== undefined || options.remoteCache !== undefined
+    ? `    # Fork PRs receive no secrets, so neither a private dependency install nor an
+    # authenticated remote cache read can run there.
     if: \${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
 `
     : ''
@@ -179,7 +187,7 @@ ${
     : ''
 }    env:
       GH_TOKEN: ${githubExpression('github.token')}
-${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
 `;
 }
 
@@ -459,6 +467,78 @@ export function normalizeSourceCheckout(config: PackageSourceCheckoutConfig): Pa
   return config;
 }
 
+/**
+ * Job env lines carrying the declared Nx remote cache. The pair rides the job
+ * env rather than a step because every Nx invocation in the job — build, lint,
+ * tests, deploy — reads it, and Nx enables the cache on a nonempty server
+ * alone: an empty or absent token would make it authenticate with nothing and
+ * fail every task on 401, which is why the job carries the same fork-PR gate
+ * as a private dependency install (see `renderCiWorkflowHeader`).
+ *
+ * A declared `internalServer` is the address managed runners use, exactly as a
+ * git origin's `internalMirror` is: both say this repository's runners sit
+ * inside that network, and shells outside it keep the public origin.
+ * Mechanism errors surface at managed-file render time, never inside CI.
+ */
+export function remoteCacheJobEnvLines(config: PackageRemoteCacheConfig | undefined): string {
+  if (config === undefined) {
+    return '';
+  }
+  const normalized = normalizeRemoteCache(config);
+  return [
+    `      NX_SELF_HOSTED_REMOTE_CACHE_SERVER: ${normalized.internalServer ?? normalized.server}\n`,
+    `      NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN: ${githubExpression(`secrets.${normalized.tokenSecret}`)}\n`,
+  ].join('');
+}
+
+/** Mechanism errors surface at managed-file render time, never inside CI. */
+export function normalizeRemoteCache(config: PackageRemoteCacheConfig): PackageRemoteCacheConfig {
+  assertCacheOrigin('server', config.server);
+  if (config.internalServer !== undefined) {
+    assertCacheOrigin('internalServer', config.internalServer);
+    if (config.internalServer === config.server) {
+      throw new Error(
+        `smoo.remoteCache internalServer repeats server ${config.server}; drop internalServer or point it at the address internal runners reach`,
+      );
+    }
+  }
+  if (!/^[A-Z_][A-Z0-9_]*$/.test(config.tokenSecret)) {
+    throw new Error(
+      `smoo.remoteCache needs an upper-case secret name for tokenSecret, got ${JSON.stringify(config.tokenSecret)}`,
+    );
+  }
+  return config;
+}
+
+/**
+ * A cache origin is exactly `scheme://host[:port]`. Nx appends
+ * `/v1/cache/<hash>` to it, so a trailing slash silently requests a doubled
+ * slash the server routes nowhere, and a path or credential would be dropped
+ * or leaked rather than honored.
+ */
+function assertCacheOrigin(field: 'server' | 'internalServer', value: string): void {
+  let url: URL | null = null;
+  try {
+    url = new URL(value);
+  } catch {
+    url = null;
+  }
+  if (
+    url === null ||
+    (url.protocol !== 'https:' && url.protocol !== 'http:') ||
+    url.pathname !== '/' ||
+    value.endsWith('/') ||
+    url.username !== '' ||
+    url.password !== '' ||
+    url.search !== '' ||
+    url.hash !== ''
+  ) {
+    throw new Error(
+      `smoo.remoteCache ${field} needs a credential-free http(s) origin with no path and no trailing slash, got ${JSON.stringify(value)}`,
+    );
+  }
+}
+
 /**
  * Job env lines carrying the declared Cargo credential secrets. Both registry
  * tokens and git-origin tokens ride the job env so the credential helper is
@@ -488,7 +568,10 @@ export function cargoCredentialJobEnvLines(config: PackageCargoCredentialsConfig
  * `internalMirror` are rewritten to the mirror with `url.<mirror>.insteadOf`
  * and the helper answers the same credential for the mirror's host, since git
  * passes helpers the rewritten URL. The helper reads the environment at call
- * time and answers only for declared origins.
+ * time and answers only for declared origins. Declared `sshOrigins` rewrite
+ * onto the same mirror and stay credential-free: the rewrite happens before
+ * transport, so git only ever asks for the mirror, and an SSH pin the runner
+ * has no key for fails loudly instead of collecting a token.
  * Mechanism errors surface at managed-file render time, never inside CI.
  */
 export function cargoCredentialStepLines(step: CiWorkflowStep, config: PackageCargoCredentialsConfig): string[] {
@@ -576,23 +659,52 @@ export function cargoCredentialStepLines(step: CiWorkflowStep, config: PackageCa
   lines.push('            fi');
   lines.push('            # Internal mirrors rewrite the declared origin prefix so runners');
   lines.push('            # that cannot reach the public URL fetch over guest networking.');
+  if (origins.some((origin) => origin.sshOrigins !== undefined)) {
+    lines.push('            # The same forge over SSH, as Cargo and uv pin it: git matches');
+    lines.push('            # insteadOf values as literal URL prefixes, so every declared');
+    lines.push('            # spelling rewrites onto the mirror on its own line.');
+  }
   for (const origin of origins) {
     if (origin.internalMirror === undefined) {
       continue;
     }
-    const originUrl = new URL(origin.origin);
     const mirrorUrl = new URL(origin.internalMirror);
-    const originBase = `${originUrl.protocol}//${originUrl.host}/`.replaceAll("'", "'\\''");
     const mirrorBase = `${mirrorUrl.protocol}//${mirrorUrl.host}/`.replaceAll("'", "'\\''");
-    lines.push('            echo "GIT_CONFIG_KEY_${idx}=url.' + mirrorBase + '.insteadOf"');
-    lines.push('            echo "GIT_CONFIG_VALUE_${idx}=' + originBase + '"');
-    lines.push('            idx=$((idx + 1))');
+    for (const prefix of mirrorRewritePrefixes(origin)) {
+      lines.push('            echo "GIT_CONFIG_KEY_${idx}=url.' + mirrorBase + '.insteadOf"');
+      lines.push('            echo "GIT_CONFIG_VALUE_${idx}=' + prefix.replaceAll("'", "'\\''") + '"');
+      lines.push('            idx=$((idx + 1))');
+    }
   }
   lines.push('            echo "GIT_CONFIG_COUNT=${idx}"');
   lines.push('          } >> "$GITHUB_ENV"');
   return lines;
 }
 
+/**
+ * Every URL prefix a mirrored origin rewrites from: the declared https origin
+ * first, then each declared SSH spelling of the same forge. One `insteadOf`
+ * value per prefix, because git matches them as literal prefixes and derives
+ * no spelling from another. Rendering runs after `normalizeCargoCredentials`,
+ * which parsed and refused every malformed entry.
+ */
+function mirrorRewritePrefixes(origin: PackageCargoGitOrigin): string[] {
+  const originUrl = new URL(origin.origin);
+  return [
+    `${originUrl.protocol}//${originUrl.host}/`,
+    ...(origin.sshOrigins ?? []).map((spelling) => sshRewritePrefix(new URL(spelling))),
+  ];
+}
+
+/**
+ * The SSH spelling as a rewritable prefix: userinfo is part of the spelling
+ * git matches, and the trailing slash keeps `ssh://host:2223` from also
+ * rewriting `ssh://host:22230/`.
+ */
+function sshRewritePrefix(spelling: URL): string {
+  return `ssh://${spelling.username === '' ? '' : `${spelling.username}@`}${spelling.host}/`;
+}
+
 function distinctCargoTokenEnvs(config: PackageCargoCredentialsConfig): string[] {
   const seen = new Set<string>();
   for (const env of config.registryTokenEnvs ?? []) {
@@ -614,12 +726,24 @@ export function normalizeCargoCredentials(config: PackageCargoCredentialsConfig)
     }
   }
   const hosts = new Set<string>();
+  const sshPrefixes = new Set<string>();
   for (const origin of config.gitOrigins ?? []) {
     const host = new URL(normalizeCargoGitOrigin(origin).origin).host;
     if (hosts.has(host)) {
       throw new Error(`smoo.github.cargoCredentials repeats git origin host ${host}; declare one token per origin`);
     }
     hosts.add(host);
+    for (const spelling of origin.sshOrigins ?? []) {
+      // One spelling, one rewrite, whole config: a repeat renders two
+      // identical insteadOf keys and git silently keeps the last one read.
+      const prefix = sshRewritePrefix(assertSshOrigin(spelling));
+      if (sshPrefixes.has(prefix)) {
+        throw new Error(
+          `smoo.github.cargoCredentials repeats the sshOrigins spelling ${prefix}; declare each spelling once, on the origin whose mirror rewrites it`,
+        );
+      }
+      sshPrefixes.add(prefix);
+    }
   }
   if ((config.registryTokenEnvs?.length ?? 0) === 0 && (config.gitOrigins?.length ?? 0) === 0) {
     throw new Error(
@@ -680,9 +804,54 @@ function normalizeCargoGitOrigin(origin: PackageCargoGitOrigin): PackageCargoGit
       );
     }
   }
+  if (origin.sshOrigins !== undefined) {
+    if (origin.internalMirror === undefined) {
+      throw new Error(
+        `smoo.github.cargoCredentials gitOrigins entry declares sshOrigins for ${origin.origin} without an internalMirror to rewrite them onto; an SSH spelling is a rewrite source and nothing else`,
+      );
+    }
+    if (origin.sshOrigins.length === 0) {
+      throw new Error(
+        `smoo.github.cargoCredentials gitOrigins entry for ${origin.origin} declares an empty sshOrigins list; name every SSH spelling a lockfile can carry, or omit the field`,
+      );
+    }
+    for (const spelling of origin.sshOrigins) {
+      assertSshOrigin(spelling);
+    }
+  }
   return origin;
 }
 
+/**
+ * One declared SSH spelling, parsed. Credential-free and path-free: a
+ * password here would be a secret committed in package.json, and a path
+ * would rewrite a single repository instead of the forge. scp syntax
+ * (`git@host:org/repo.git`) is no URL, so git cannot rewrite it from a Cargo
+ * or uv pin at all; the `ssh://` spelling is the one to declare.
+ */
+function assertSshOrigin(spelling: string): URL {
+  let ssh: URL | null = null;
+  try {
+    ssh = new URL(spelling);
+  } catch {
+    ssh = null;
+  }
+  if (
+    ssh === null ||
+    ssh.protocol !== 'ssh:' ||
+    ssh.host === '' ||
+    (ssh.pathname !== '' && ssh.pathname !== '/') ||
+    ssh.password !== '' ||
+    ssh.search !== '' ||
+    ssh.hash !== ''
+  ) {
+    throw new Error(
+      `smoo.github.cargoCredentials gitOrigins entry needs credential-free ssh:// sshOrigins without a path, got ${JSON.stringify(spelling)}`,
+    );
+  }
+  return ssh;
+}
+
 /**
  * The same-repo gate as prettier folds it: the raw single line exceeds the
  * print width, so the generator emits the folded form itself to keep the
@@ -828,7 +997,7 @@ ${renderRunsOnLine(options.runsOn)}
 ${environmentLine(options.environments?.staging)}    if: \${{ needs.main.result == 'success' && needs.main.outputs.deployment-stage != '' }}
     env:
       GH_TOKEN: \${{ github.token }}
-${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: E2E Tests (Deployed Stage)
@@ -859,7 +1028,7 @@ ${renderRunsOnLine(options.runsOn)}
     if: \${{ !cancelled() && github.event_name == 'push' && github.ref == ${stagingRefLiteral(options)} && needs.main.result == 'success'${e2eGate} }}
 ${environmentLine(options.environments?.production)}    env:
       GH_TOKEN: \${{ github.token }}
-${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: 🚀 Deploy Production

package/src/monorepo/index.ts

@@ -47,6 +47,8 @@ export interface ValidateOptions {
   onlyIfNewWorkspacePackage?: boolean;
   fix?: boolean;
   verbose?: boolean;
+  /** Nx project names to build and pack-validate; see MonorepoContext.projects. */
+  projects?: readonly string[];
 }
 
 export interface ValidateCommitMessageOptions {
@@ -85,7 +87,10 @@ export async function validateMonorepo(root: string, options: ValidateOptions =
   if (options.onlyIfNewWorkspacePackage && !(await hasNewWorkspacePackage(root))) {
     return;
   }
-  const result = await runValidatePacks({ root, syncRuntime: false, verbose: options.verbose === true }, options);
+  const result = await runValidatePacks(
+    { root, syncRuntime: false, verbose: options.verbose === true, projects: options.projects },
+    options,
+  );
   if (result.failures > 0) {
     const checkNoun = result.failedChecks === 1 ? 'check' : 'checks';
     const problemNoun = result.failures === 1 ? 'problem' : 'problems';

package/src/monorepo/managed-files.ts

@@ -10,6 +10,7 @@ import {
   type PackageCargoCredentialsConfig,
   type PackageJson,
   type PackagePrivateNpmConfig,
+  type PackageRemoteCacheConfig,
   type PackageSmooGithub,
   type PackageSmooGithubEnvironments,
   type PackageSourceCheckoutConfig,
@@ -176,6 +177,8 @@ export interface ManagedFileContext {
   sourceCheckouts?: PackageSourceCheckoutConfig[];
   /** Declared Cargo private-dependency credentials from the root smoo config; absent means none. */
   cargoCredentials?: PackageCargoCredentialsConfig;
+  /** Declared self-hosted Nx remote cache from the root smoo config; absent means local caching only. */
+  remoteCache?: PackageRemoteCacheConfig;
 }
 
 interface DeployTargetInfo {
@@ -391,6 +394,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         privateNpm: context.privateNpm,
         sourceCheckouts: context.sourceCheckouts,
         cargoCredentials: context.cargoCredentials,
+        remoteCache: context.remoteCache,
         environments: context.ciEnvironments,
         deploySecrets: context.ciDeploySecrets,
         e2eSecrets: context.ciE2eSecrets,
@@ -414,6 +418,7 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         privateNpm: context.privateNpm,
         sourceCheckouts: context.sourceCheckouts,
         cargoCredentials: context.cargoCredentials,
+        remoteCache: context.remoteCache,
         deploySecrets: context.ciDeploySecrets,
       });
     }
@@ -476,6 +481,7 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
     platformTargetGlobs,
     sourceCheckouts,
     cargoCredentials,
+    remoteCache: manifest?.smoo?.remoteCache,
     macosPlatformArchitectures: macosPlatformArchitecturesForTest(targetNames),
     privateNpm,
   };

package/src/monorepo/packed-package.ts

@@ -21,25 +21,40 @@ export async function validatePackedPublishablePackages(root: string): Promise<n
   );
 }
 
-export async function validatePackedPublishablePackagePublint(root: string): Promise<number> {
+/** The publishable packages, narrowed to `projects` (Nx names) when given. */
+function selectedPublishablePackages(root: string, projects?: readonly string[]): PackageInfo[] {
+  const all = listPublishablePackages(root);
+  return projects?.length ? all.filter((pkg) => projects.includes(pkg.projectName)) : all;
+}
+
+export async function validatePackedPublishablePackagePublint(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePublint);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageManifest(root: string): Promise<number> {
+export async function validatePackedPublishablePackageManifest(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePackedManifest);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageTypes(root: string): Promise<number> {
+export async function validatePackedPublishablePackageTypes(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validateAttw);
   }
   return failures;