@smoothbricks/cli 0.11.12 → 0.11.14

package/src/monorepo/packs/index.ts

@@ -36,6 +36,14 @@ export interface MonorepoContext {
   root: string;
   syncRuntime: boolean;
   verbose?: boolean;
+  /**
+   * Nx project names the validation is about, when a caller knows: the
+   * release's candidates. The build phase and the packed-package packs scope
+   * to them; manifest-level packs still see the whole repository, because a
+   * package's hygiene does not depend on which packages ship today. Absent,
+   * everything is validated and everything is built.
+   */
+  projects?: readonly string[];
 }
 
 export interface ValidatePackOptions {
@@ -174,19 +182,19 @@ const packs: MonorepoPack[] = [
   {
     name: 'packed-package-publint',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackagePublint(ctx.root);
+      return validatePackedPublishablePackagePublint(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-manifest',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageManifest(ctx.root);
+      return validatePackedPublishablePackageManifest(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-types',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageTypes(ctx.root);
+      return validatePackedPublishablePackageTypes(ctx.root, ctx.projects);
     },
   },
   {
@@ -369,9 +377,10 @@ async function runBuild(ctx: MonorepoContext, options: ValidatePackOptions = {})
   if (options.verbose) {
     printCheckHeading('build', true);
   }
+  const args = ['run-many', '-t', 'build', ...(ctx.projects?.length ? ['-p', ctx.projects.join(',')] : [])];
   const result = options.verbose
-    ? { exitCode: await runStatus('nx', ['run-many', '-t', 'build'], ctx.root, false), stdout: '', stderr: '' }
-    : await runResult('nx', ['run-many', '-t', 'build'], ctx.root);
+    ? { exitCode: await runStatus('nx', args, ctx.root, false), stdout: '', stderr: '' }
+    : await runResult('nx', args, ctx.root);
   const status = result.exitCode;
   if (status !== 0) {
     if (!options.verbose) {

package/src/monorepo/publish-workflow.ts

@@ -11,6 +11,7 @@ import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 import type {
   PackageCargoCredentialsConfig,
   PackagePrivateNpmConfig,
+  PackageRemoteCacheConfig,
   PackageSmooGithub,
   PackageSourceCheckoutConfig,
 } from '../lib/json.js';
@@ -21,6 +22,7 @@ import {
   cargoCredentialStepLines,
   type DeployStepSecretConfig,
   deployStepSecretEnvLines,
+  remoteCacheJobEnvLines,
   sourceCheckoutsStepLines,
 } from './ci-workflow.js';
 import { GITHUB_HOSTED_LINUX_RUNNER, renderRunsOnLine, type WorkflowRunsOn } from './github-runs-on.js';
@@ -125,6 +127,13 @@ export interface PublishWorkflowDefinitionOptions extends DeployStepSecretConfig
    * become job env because every later cargo fetch resolves them.
    */
   cargoCredentials?: PackageCargoCredentialsConfig;
+  /**
+   * Declared self-hosted Nx remote cache. Every job here runs Nx targets —
+   * the release-candidate build, the platform build, the publish gate — so
+   * each carries the server and access token and reuses what CI already
+   * built for the same hashes.
+   */
+  remoteCache?: PackageRemoteCacheConfig;
 }
 
 export interface PublishWorkflowInputs {
@@ -466,7 +475,7 @@ jobs:
   publish:
 ${options.release === false ? renderRunsOnLine(options.runsOn) : publishJobRunsOnLine(options)}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 `;
 }
@@ -605,7 +614,14 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         'failure()',
       );
     case PublishWorkflowStepKind.ValidateMonorepoConfig:
-      return conditionalRunStep(step, 'smoo monorepo validate');
+      // Scoped to the release's candidates: the build phase and the packed-package
+      // checks cover what ships. Unscoped, validate compiled every project - on a
+      // release touching no Rust that was 3m30 of the cowshed CLI on the critical
+      // path, for a binary the release did not contain.
+      return conditionalRunStep(
+        step,
+        `smoo monorepo validate --projects "${githubExpression('steps.version.outputs.projects')}"`,
+      );
     case PublishWorkflowStepKind.TagRelease:
       return tagReleaseStepLines(step.name);
     case PublishWorkflowStepKind.PublishRelease:
@@ -717,6 +733,17 @@ function cargoCredentialsJobEnv(options: PublishWorkflowDefinitionOptions): stri
   return rendered === '' ? '' : `\n${rendered}`;
 }
 
+/**
+ * The remote cache is job env for the same reason: every Nx target in the job
+ * reads it, and a release build that missed the cache would rebuild what CI
+ * already built for the identical hashes. Only `${{ secrets.NAME }}` is
+ * rendered for the token. Malformed declarations throw here, not in CI.
+ */
+function remoteCacheJobEnv(options: PublishWorkflowDefinitionOptions): string {
+  const rendered = remoteCacheJobEnvLines(options.remoteCache).trimEnd();
+  return rendered === '' ? '' : `\n${rendered}`;
+}
+
 function renderSingleJobPublishWorkflowSteps(
   steps: PublishWorkflowStep[],
   options: PublishWorkflowDefinitionOptions,
@@ -796,7 +823,7 @@ ${renderRunsOnLine(options.runsOn)}
       mode: ${githubExpression('steps.version.outputs.mode')}
       release-sha: ${githubExpression('steps.release-state.outputs.sha')}
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 ${renderLinuxReleaseCandidateSteps(steps, options)}
 
@@ -806,7 +833,7 @@ ${renderMacosJobHeaderLines(options)}
       contents: read
       id-token: none
     env:
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
 ${Object.entries(options.platformProducer?.env ?? {})
   .map(([name, value]) => `      ${name}: ${JSON.stringify(value)}`)
   .join('\n')}
@@ -821,7 +848,7 @@ ${publishJobRunsOnLine(options)}
       id-token: write
     env:
       TTSC_TSGO_BINARY: ${githubExpression('github.workspace')}/node_modules/@typescript/native/bin/tsc
-      GH_TOKEN: ${githubExpression('github.token')}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
+      GH_TOKEN: ${githubExpression('github.token')}${remoteCacheJobEnv(options)}${cargoCredentialsJobEnv(options)}${privateNpmInstallJobEnv(options)}
     steps:
 ${renderFinalLinuxPublishSteps(options)}
 `;

package/src/monorepo/secret-references.test.ts

@@ -136,14 +136,18 @@ async function resolveInBootstrap(options: {
 
 /** Builds a fixture repository whose package.json and .npmrc are the resolver's real inputs. */
 async function withFixture(
-  options: { secrets: Record<string, SecretSpec>; npmrc?: string },
+  options: { secrets: Record<string, SecretSpec>; npmrc?: string; remoteCache?: unknown },
   run: (root: string) => Promise<void>,
 ): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-secret-references-'));
   try {
     await writeFile(
       join(root, 'package.json'),
-      JSON.stringify({ name: 'fixture', version: '0.0.0', smoo: { secrets: options.secrets } }),
+      JSON.stringify({
+        name: 'fixture',
+        version: '0.0.0',
+        smoo: { secrets: options.secrets, remoteCache: options.remoteCache },
+      }),
     );
     if (options.npmrc !== undefined) {
       await writeFile(join(root, '.npmrc'), options.npmrc);
@@ -249,6 +253,28 @@ describe('resolveSecretEnvironment', () => {
     });
   });
 
+  it('an unreachable cache-token provider does not block the install, while other secrets still refuse', async () => {
+    await withFixture(
+      {
+        secrets: {
+          NX_REMOTE_CACHE_TOKEN: { command: ['definitely-not-a-real-smoo-binary-xyz'] },
+          SMOO_TOKEN: { command: emit('tok-from-provider') },
+        },
+        remoteCache: { server: 'https://nx-cache.example.net', tokenSecret: 'NX_REMOTE_CACHE_TOKEN' },
+      },
+      async (root) => {
+        // A cache is an optimization: its provider being down installs
+        // dependencies anyway. Every other declared secret keeps its refusal.
+        expect(await resolveInBootstrap({ root, env: {} })).toEqual({
+          resolved: { SMOO_TOKEN: 'tok-from-provider' },
+        });
+        const withoutCacheDeclaration = await resolveInBootstrap({ root, env: { CI: 'true' } });
+        expect(withoutCacheDeclaration.error).toContain('SMOO_TOKEN');
+        expect(withoutCacheDeclaration.error).not.toContain('NX_REMOTE_CACHE_TOKEN');
+      },
+    );
+  });
+
   it('a present variable is not reported while another refuses in CI', async () => {
     await withFixture(
       {