@smoothbricks/cli 0.11.13 → 0.11.15

package/managed/raw/tooling/direnv/secret-references.ts

@@ -1,16 +1,14 @@
 /**
- * Provider-neutral local secret resolution for smoo-managed repositories, and
- * the developer-shell half of the declared Nx remote cache.
+ * Provider-neutral local secret resolution for smoo-managed repositories.
  *
  * Reads the root package.json `smoo.secrets` map and `smoo.remoteCache` block
  * — the bootstrap twins of `PackageSecretCommand`, `PackageSmooConfig.secrets`
  * and `PackageRemoteCacheConfig` in packages/cli/src/lib/json.ts. This file is
  * a managed raw script: it runs from `tooling/direnv/setup-environment.ts`
- * BEFORE `bun install`, and from the managed devenv `enterShell` before that,
- * when no workspace package and no Typia transform exist yet, so both shapes
- * are hand-validated here against exactly what json.ts declares. Keep them
- * aligned; smoo's Typia validation fails the manifest at generation time for
- * anything this file would reject at runtime.
+ * BEFORE `bun install`, when no workspace package and no Typia transform exist
+ * yet, so both shapes are hand-validated here against exactly what json.ts
+ * declares. Keep them aligned; smoo's Typia validation fails the manifest at
+ * generation time for anything this file would reject at runtime.
  *
  * Routing per declared variable, in first-match order:
  *
@@ -28,23 +26,18 @@
  * Failures aggregate so a single direnv reload surfaces every problem.
  * Error text names variables and exit codes only: secret values, provider
  * stdout/stderr, and command arguments are never echoed.
+ * A resolved value still reaches the environment of the install its caller
+ * runs next, so `maskSecretValues` redacts those values out of any captured
+ * child output that caller replays.
  *
- * One declared variable is exempt from blocking an install: the one
- * `smoo.remoteCache.tokenSecret` names. A remote cache is an optimization, so
- * an unreachable secret provider must not keep dependencies from installing or
- * a shell from opening; that variable is resolved by the cache export below,
- * where failure costs a stderr line.
- *
- * Run as a program (`bun secret-references.ts [root]`), the script prints the
- * remote cache's `export` lines for the shell to `eval` and nothing else: Nx
- * runs in the developer's shell, not in the setup child, and the export is
- * limited to those two variables so `smoo.secrets` stays process-local. It
- * prints nothing when the repository declares no cache, when the shell already
- * carries a server (a CI job env is never overwritten), or when the declared
- * token has no value — Nx accepts only 200 or 404 from a cache server, so a
- * server it cannot authenticate to fails every task instead of missing. Why
- * the cache is off is said on stderr; the exit status stays 0, because a
- * missing cache credential must never keep a shell from opening.
+ * The variable `smoo.remoteCache.tokenSecret` names is never resolved here,
+ * nor anywhere at shell entry. A remote cache is an optimization, and shell
+ * entry happens on every direnv reload and every `devenv shell -- <command>`:
+ * a provider command run there is a credential prompt on each of them. Nx
+ * reads NX_SELF_HOSTED_REMOTE_CACHE_SERVER and _ACCESS_TOKEN from the
+ * environment it runs in — CI injects them, a developer exports the token
+ * once in the terminal that wants the cache — and every nested shell inherits
+ * them. Absent, Nx keeps to its local cache.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -135,10 +128,6 @@ function parseSecretSpec(name: string, spec: unknown): SecretSpec {
   return { command: [first, ...rest] };
 }
 
-/** The two variables Nx reads for its self-hosted HTTP cache. */
-const REMOTE_CACHE_SERVER = 'NX_SELF_HOSTED_REMOTE_CACHE_SERVER';
-const REMOTE_CACHE_ACCESS_TOKEN = 'NX_SELF_HOSTED_REMOTE_CACHE_ACCESS_TOKEN';
-
 /**
  * The declared remote cache as a local shell needs it. `internalServer` is
  * deliberately absent: it is the address a managed runner reaches inside its
@@ -325,6 +314,69 @@ const runSecretCommand: SecretCommandRunner = async (argv) => {
   return stdout;
 };
 
+/** '*', the byte a redacted secret leaves behind. */
+const MASK_BYTE = 0x2a;
+
+/**
+ * A copy of captured child output with every resolved secret value replaced
+ * by the same number of `*` bytes.
+ *
+ * setup-environment.ts puts the values this file resolves into the
+ * environment of the install it then runs, and replays that child's captured
+ * stdout/stderr verbatim when it fails. Whatever the child echoes — a prepare
+ * script printing its environment, a registry URL carrying an inline
+ * credential — would otherwise walk straight past the suppression the rest of
+ * this file maintains. Redaction is byte-exact and same-length, so the
+ * failure being reported stays legible and every offset in it still lines up.
+ * Output with nothing to redact is returned as it came in, so the path that
+ * has no secrets to hide copies nothing.
+ */
+export function maskSecretValues(output: Uint8Array, values: Iterable<string>): Uint8Array {
+  const encoder = new TextEncoder();
+  let masked: Uint8Array | undefined;
+  for (const value of values) {
+    const needle = encoder.encode(value);
+    if (needle.length === 0 || needle.length > output.length) {
+      continue;
+    }
+    for (let from = 0; from + needle.length <= output.length; ) {
+      const at = indexOfBytes(masked ?? output, needle, from);
+      if (at < 0) {
+        break;
+      }
+      // `new Uint8Array`, not `.slice()`: a captured child's output arrives as
+      // a node Buffer, whose `slice` is `subarray` — a view. Masking through
+      // one would rewrite the caller's own captured bytes.
+      masked ??= new Uint8Array(output);
+      masked.fill(MASK_BYTE, at, at + needle.length);
+      from = at + needle.length;
+    }
+  }
+  return masked ?? output;
+}
+
+/** First occurrence of `needle` in `haystack` at or after `from`, or -1. */
+function indexOfBytes(haystack: Uint8Array, needle: Uint8Array, from: number): number {
+  const first = needle[0];
+  if (first === undefined) {
+    return -1;
+  }
+  const last = haystack.length - needle.length;
+  for (let at = haystack.indexOf(first, from); at >= 0 && at <= last; at = haystack.indexOf(first, at + 1)) {
+    let matches = true;
+    for (let offset = 1; offset < needle.length; offset += 1) {
+      if (haystack[at + offset] !== needle[offset]) {
+        matches = false;
+        break;
+      }
+    }
+    if (matches) {
+      return at;
+    }
+  }
+  return -1;
+}
+
 /**
  * The declared secrets an install needs, resolved before it runs. The cache
  * token is deliberately not among them: a remote cache is an optimization, so
@@ -353,85 +405,6 @@ export async function resolveSecretEnvironment(
   });
 }
 
-/**
- * What the shell should do about the declared remote cache. Each case is a
- * value, not an exception: three of the four are ordinary, and only one is
- * worth saying out loud.
- */
-export type RemoteCacheOutcome =
-  | { readonly kind: 'undeclared' }
-  | { readonly kind: 'inherited' }
-  | { readonly kind: 'unavailable'; readonly reason: string }
-  | { readonly kind: 'exported'; readonly env: Readonly<Record<string, string>> };
-
-/**
- * The remote cache variables this shell should export, or why it exports none.
- * An inherited server always wins, so a CI job env — which carries the address
- * its own runners reach — is never overwritten by the public one. The token is
- * taken from the environment when it is there, and otherwise from the one
- * `smoo.secrets` entry that declares it — resolving that single variable, so
- * no other declared secret ever reaches the shell. A repository that declares
- * the cache token as a provider secret therefore pays that one command twice
- * per shell entry, once here and once in the setup child's own aggregate
- * resolution; an ambient token pays nothing.
- */
-export async function resolveRemoteCacheOutcome(options: SecretResolutionOptions): Promise<RemoteCacheOutcome> {
-  const env = options.env ?? process.env;
-  const packageJson = readPackageJson(options.root);
-  const spec = parseSmooRemoteCache(packageJson);
-  if (spec === null) {
-    return { kind: 'undeclared' };
-  }
-  if (isNonemptyEnvValue(env[REMOTE_CACHE_SERVER])) {
-    return { kind: 'inherited' };
-  }
-  const ambient = env[spec.tokenSecret];
-  if (isNonemptyEnvValue(ambient)) {
-    return {
-      kind: 'exported',
-      env: { [REMOTE_CACHE_SERVER]: spec.server, [REMOTE_CACHE_ACCESS_TOKEN]: ambient },
-    };
-  }
-  const declared = parseSmooSecrets(packageJson)[spec.tokenSecret];
-  if (declared === undefined) {
-    return {
-      kind: 'unavailable',
-      reason: `${spec.tokenSecret} is unset and no smoo.secrets entry declares it, so ${spec.server} would be asked for cache entries with no credential`,
-    };
-  }
-  // A cache token is not registry routing, so the cowshed `.npmrc` exclusion
-  // cannot apply to it; every other rule in the header does.
-  const outcome = await routeSecret(spec.tokenSecret, declared, {
-    env,
-    registryIntentEnvs: new Set(),
-    run: options.runCommand ?? runSecretCommand,
-  });
-  switch (outcome.kind) {
-    case 'resolved':
-      return {
-        kind: 'exported',
-        env: { [REMOTE_CACHE_SERVER]: spec.server, [REMOTE_CACHE_ACCESS_TOKEN]: outcome.value },
-      };
-    case 'failed':
-      return { kind: 'unavailable', reason: `${spec.tokenSecret}: ${outcome.guidance}` };
-    case 'env-wins':
-      // Only reachable if an ambient value appeared between the check above
-      // and this call; the export happens on the next shell entry.
-      return { kind: 'unavailable', reason: `${spec.tokenSecret} was set after it was read` };
-  }
-}
-
-/**
- * POSIX `export` lines for a shell to `eval`. Single quotes are the only
- * quoting a value cannot escape from, so each value is single-quoted with its
- * own quotes spliced out — a token is opaque bytes, never assumed shell-safe.
- */
-export function shellExportLines(env: Readonly<Record<string, string>>): string {
-  return Object.entries(env)
-    .map(([name, value]) => `export ${name}='${value.replaceAll("'", "'\\''")}'\n`)
-    .join('');
-}
-
 function readPackageJson(root: string): unknown {
   const packageJsonPath = join(root, 'package.json');
   let text: string;
@@ -452,27 +425,8 @@ function readPackageJson(root: string): unknown {
   }
   return parsed;
 }
-
 function readNpmrcText(root: string): string | null {
   const npmrcPath = join(root, '.npmrc');
   if (!existsSync(npmrcPath)) return null;
   return readFileSync(npmrcPath, 'utf8');
 }
-
-// Program mode, run by the managed devenv shell as
-// `eval "$(bun "$DEVENV_ROOT/secret-references.ts" "$PWD")"`. stdout is
-// therefore shell text and carries nothing else; everything a human should
-// read goes to stderr, and the status stays 0 so a shell always opens.
-if (import.meta.main) {
-  const root = Bun.argv[2] ?? process.cwd();
-  try {
-    const outcome = await resolveRemoteCacheOutcome({ root });
-    if (outcome.kind === 'exported') {
-      process.stdout.write(shellExportLines(outcome.env));
-    } else if (outcome.kind === 'unavailable') {
-      console.error(`smoo: Nx remote cache off — ${outcome.reason}`);
-    }
-  } catch (error) {
-    console.error(`smoo: Nx remote cache off — ${error instanceof Error ? error.message : String(error)}`);
-  }
-}

package/managed/raw/tooling/direnv/setup-environment.ts

@@ -4,7 +4,7 @@ import { mkdir, rmdir, stat } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
 import { $ } from 'bun';
-import { resolveSecretEnvironment } from './secret-references.ts';
+import { maskSecretValues, resolveSecretEnvironment } from './secret-references.ts';
 
 // DEVENV_ROOT is set by the devenv shell, which is how this script normally
 // runs. CI jobs that install dependencies without building that shell (the
@@ -24,6 +24,14 @@ class CapturedCommandError extends Error {
   }
 }
 
+// Every value resolved out of smoo.secrets below. The install inherits them,
+// so whatever a failing child echoed is redacted before its captured output
+// is replayed. Declared above the first replay site (resolveProjectRoot's own
+// failure) because module consts are not hoisted: a reference from there to a
+// const declared further down would report a temporal-dead-zone error instead
+// of the failure it was called to report.
+const resolvedSecretValues: string[] = [];
+
 async function resolveProjectRoot(): Promise<string> {
   if (devenvRoot) {
     return path.resolve(`${devenvRoot}/../..`);
@@ -66,19 +74,11 @@ const TYPESCRIPT_API_VERSION = '6.0.3';
 process.chdir(projectRoot);
 
 try {
-  // Provider-declared secrets (smoo.secrets) resolve before any install. The
-  // values land in THIS process environment only — bun install, the prepare
-  // scripts it runs, and every later child of this script inherit them (for
-  // example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
-  // the point: this script must never act as a global shell export.
-  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
-    process.env[name] = value;
-  }
-
   // Bootstrap only: install deps + wire local git hooks/config.
   // Do not import workspace packages here — this script is what installs them,
   // and package resolution/Typia transforms are not available yet.
   if (process.env.CI) {
+    await resolveSecrets();
     // Concurrent devenv activations share one node_modules, so the CI
     // installs race exactly like local ones (EEXIST link failures under
     // parallel shells). Serialize them under the same setup lock. Nothing
@@ -118,24 +118,60 @@ try {
       process.exit(1);
     }
   } else {
-    await installLocalDependencies();
+    // A local secret-resolution or install failure (a provider that is not
+    // signed in, an unpublished private package, a missing registry
+    // credential, a lockfile that needs `devenv update`) must not take the
+    // shell down with it: direnv drops the whole environment on a non-zero
+    // exit, and then bun, nx, op and every other tool needed to repair the
+    // install are gone too. Report it, finish what does not depend on the
+    // install, and load the shell. CI above stays strict.
+    const installError = await installLocalDependencies();
+    if (installError === undefined) {
+      // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
+      ensureTypeScriptApiPackage(projectRoot);
+    }
+    await applyWorkspaceGitConfig(projectRoot);
+    if (installError !== undefined) {
+      reportDegradedSetup(installError);
+    }
   }
-
-  // Pin unscoped typescript → API 6 for root and Bun's shared .bun hoist (Nx).
-  ensureTypeScriptApiPackage(projectRoot);
-
-  await applyWorkspaceGitConfig(projectRoot);
 } catch (error) {
   reportSetupFailure(error);
 }
 
-async function installLocalDependencies(): Promise<void> {
+/**
+ * Provider-declared secrets (smoo.secrets) resolve before any install. The
+ * values land in THIS process environment only — bun install, the prepare
+ * scripts it runs, and every later child of this script inherit them (for
+ * example .npmrc `${VAR}` auth); the direnv shell itself does not, which is
+ * the point: this script must never act as a global shell export.
+ */
+async function resolveSecrets(): Promise<void> {
+  for (const [name, value] of Object.entries(await resolveSecretEnvironment({ root: projectRoot }))) {
+    process.env[name] = value;
+    resolvedSecretValues.push(value);
+  }
+}
+
+async function installLocalDependencies(): Promise<unknown> {
+  try {
+    await resolveSecrets();
+  } catch (error) {
+    return error;
+  }
   // bun install runs the root prepare script. Multiple concurrent direnv
   // activations can otherwise race while mutating the same files under
-  // node_modules.
+  // node_modules. Nothing that exits the process may run inside the callback
+  // (see the CI branch), so the failure is returned, not thrown.
+  let installError: unknown;
   await withSetupLock(async () => {
-    await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    try {
+      await runSetupCommand('bun install --no-summary', $`bun install --no-summary`);
+    } catch (error) {
+      installError = error;
+    }
   });
+  return installError;
 }
 
 function ensureTypeScriptApiPackage(root: string): void {
@@ -374,25 +410,44 @@ function isFileExistsError(error: unknown): boolean {
 }
 
 function reportSetupFailure(error: unknown): never {
+  describeFailure('ERROR', error);
+  process.exit(1);
+}
+
+function reportDegradedSetup(error: unknown): void {
+  describeFailure('WARNING', error);
+  console.error(
+    'The shell is loaded WITHOUT installed dependencies so the tools to repair this stay available.\n' +
+      'Fix the cause above (missing registry credential, unpublished package, stale lockfile → `devenv update`),\n' +
+      'then run `bun install` or `direnv reload`.',
+  );
+  console.error('---');
+}
+
+function describeFailure(level: 'ERROR' | 'WARNING', error: unknown): void {
   if (error instanceof CapturedCommandError) {
-    console.error(`--- ERROR: setup-environment.ts failed while running: ${error.command}`);
+    console.error(`--- ${level}: setup-environment.ts failed while running: ${error.command}`);
     console.error(`exit code: ${error.exitCode}`);
   } else {
-    console.error(`--- ERROR: setup-environment.ts failed: ${error}`);
+    console.error(`--- ${level}: setup-environment.ts failed: ${error}`);
   }
   replayCapturedOutput(error);
   console.error('\n---');
-  process.exit(1);
 }
 
 function replayCapturedOutput(error: unknown): void {
   if (!(error instanceof CapturedCommandError)) {
     return;
   }
-  if (error.stdout.length > 0) {
-    process.stdout.write(error.stdout);
+  // The install ran with every resolved secret in its environment, so its
+  // output is redacted before replay. Masking is same-length, which keeps the
+  // failure this replay exists to show intact.
+  const stdout = maskSecretValues(error.stdout, resolvedSecretValues);
+  const stderr = maskSecretValues(error.stderr, resolvedSecretValues);
+  if (stdout.length > 0) {
+    process.stdout.write(stdout);
   }
-  if (error.stderr.length > 0) {
-    process.stderr.write(error.stderr);
+  if (stderr.length > 0) {
+    process.stderr.write(stderr);
   }
 }

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -109,6 +109,11 @@ runs:
     # stable path (a symlink would not do: Nix canonicalises) and devenv is
     # evaluated from there; every later step still runs in the checkout, which
     # is the same tree. DEVENV_WORKDIR names the path the devenv steps use.
+    # The mount target is the instance's own /work, not the shared bind: only
+    # the path's spelling must be stable, and a bind onto the idmapped cache
+    # dataset failed inside the job (move_mount: ENOENT) where a container-fs
+    # target does not. If the mount is refused the job goes on from the
+    # checkout and pays the evaluation: this is an optimisation, never a gate.
     - name: 📂 Locate devenv state on the shared bind
       if: steps.runner-kind.outputs.host == 'true'
       shell: bash
@@ -119,13 +124,19 @@ runs:
       run: |
         lane=$(printf '%s' "$DEVENV_STATE_LANE" | tr '[:upper:]' '[:lower:]' | tr -cs 'a-z0-9._-' '-')
         root="/var/cache/ci/devenv/$DEVENV_STATE_REPO/${lane:-default}/$DEVENV_STATE_JOB"
-        mkdir -p "$root/.devenv" "$root/.direnv" "$root/workspace"
-        sudo mount --bind "$GITHUB_WORKSPACE" "$root/workspace"
+        mkdir -p "$root/.devenv" "$root/.direnv"
         rm -rf tooling/direnv/.devenv tooling/direnv/.direnv
         ln -s "$root/.devenv" tooling/direnv/.devenv
         ln -s "$root/.direnv" tooling/direnv/.direnv
-        echo "DEVENV_WORKDIR=$root/workspace" >> "$GITHUB_ENV"
-        echo "devenv state: $root (workspace bind-mounted at $root/workspace)"
+        stable="/work/$DEVENV_STATE_REPO/${lane:-default}/$DEVENV_STATE_JOB"
+        if mkdir -p "$stable" && sudo mount --bind "$GITHUB_WORKSPACE" "$stable"; then
+          echo "DEVENV_WORKDIR=$stable" >> "$GITHUB_ENV"
+          echo "devenv state: $root (workspace bind-mounted at $stable)"
+        else
+          echo "DEVENV_WORKDIR=$GITHUB_WORKSPACE" >> "$GITHUB_ENV"
+          echo "::warning::stable devenv path unavailable (bind mount refused); evaluating from the checkout"
+          echo "devenv state: $root (workspace at $GITHUB_WORKSPACE)"
+        fi
 
     - name: 📂 Devenv runs in the checkout
       if: steps.runner-kind.outputs.host != 'true'
@@ -189,8 +200,8 @@ runs:
           /nix
           ~/.cache/nix
         # prettier-ignore
-        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v5-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
-        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v5-
+        primary-key: ${{ runner.os }}-${{ runner.arch }}-nix-v6-${{ hashFiles('tooling/direnv/devenv.yaml', 'tooling/direnv/devenv.nix', 'tooling/direnv/devenv.lock') }}
+        restore-prefixes-first-match: ${{ runner.os }}-${{ runner.arch }}-nix-v6-
         gc-max-store-size: 1G
 
     - name: ⚡ Enable Cachix
@@ -225,4 +236,6 @@ runs:
     - name: 🐚 Build devenv shell
       shell: bash
       working-directory: ${{ env.DEVENV_WORKDIR }}/tooling/direnv
+      env:
+        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
       run: ./github-actions-bootstrap.sh build-shell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.13",
+  "version": "0.11.15",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.7",
+    "@smoothbricks/nx-plugin": "0.4.9",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/cli.ts

@@ -89,15 +89,24 @@ function buildProgram(): Command {
     .option('--fail-fast', 'stop after the first failing validation pack')
     .option('--only-if-new-workspace-package', 'skip validation unless a new workspace package manifest is staged')
     .option('--verbose', 'print validation progress and successful checks')
+    .option(
+      '--projects <names>',
+      'comma-separated Nx project names to build and pack-validate (a release selection); default: every project',
+    )
     .action(
       async (options: {
         fix?: boolean;
         failFast?: boolean;
         onlyIfNewWorkspacePackage?: boolean;
         verbose?: boolean;
+        projects?: string;
       }) => {
         const { validateMonorepo } = await import('./monorepo/index.js');
-        await validateMonorepo(await findRepoRoot(), options);
+        const projects = options.projects
+          ?.split(',')
+          .map((name) => name.trim())
+          .filter((name) => name.length > 0);
+        await validateMonorepo(await findRepoRoot(), { ...options, projects });
       },
     );
   monorepo.command('update').action(async () => {

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -38,6 +38,9 @@ const codebaseWorkflowOptions: PublishWorkflowDefinitionOptions = {
 describe('publish workflow definition', () => {
   it('renders the checked-in local publish workflow copy', async () => {
     const rendered = renderPublishWorkflowYaml(codebaseWorkflowOptions);
+    // validate builds and pack-checks the release's candidates, not every project:
+    // unscoped it compiled binaries the release did not contain.
+    expect(rendered).toContain('smoo monorepo validate --projects "${{ steps.version.outputs.projects }}"');
     const packageRoot = join(import.meta.dir, '..', '..', '..');
     await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/publish.yml'), 'utf8')).resolves.toBe(
       rendered,

package/src/monorepo/index.ts

@@ -47,6 +47,8 @@ export interface ValidateOptions {
   onlyIfNewWorkspacePackage?: boolean;
   fix?: boolean;
   verbose?: boolean;
+  /** Nx project names to build and pack-validate; see MonorepoContext.projects. */
+  projects?: readonly string[];
 }
 
 export interface ValidateCommitMessageOptions {
@@ -85,7 +87,10 @@ export async function validateMonorepo(root: string, options: ValidateOptions =
   if (options.onlyIfNewWorkspacePackage && !(await hasNewWorkspacePackage(root))) {
     return;
   }
-  const result = await runValidatePacks({ root, syncRuntime: false, verbose: options.verbose === true }, options);
+  const result = await runValidatePacks(
+    { root, syncRuntime: false, verbose: options.verbose === true, projects: options.projects },
+    options,
+  );
   if (result.failures > 0) {
     const checkNoun = result.failedChecks === 1 ? 'check' : 'checks';
     const problemNoun = result.failures === 1 ? 'problem' : 'problems';

package/src/monorepo/packed-package.ts

@@ -21,25 +21,40 @@ export async function validatePackedPublishablePackages(root: string): Promise<n
   );
 }
 
-export async function validatePackedPublishablePackagePublint(root: string): Promise<number> {
+/** The publishable packages, narrowed to `projects` (Nx names) when given. */
+function selectedPublishablePackages(root: string, projects?: readonly string[]): PackageInfo[] {
+  const all = listPublishablePackages(root);
+  return projects?.length ? all.filter((pkg) => projects.includes(pkg.projectName)) : all;
+}
+
+export async function validatePackedPublishablePackagePublint(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePublint);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageManifest(root: string): Promise<number> {
+export async function validatePackedPublishablePackageManifest(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validatePackedManifest);
   }
   return failures;
 }
 
-export async function validatePackedPublishablePackageTypes(root: string): Promise<number> {
+export async function validatePackedPublishablePackageTypes(
+  root: string,
+  projects?: readonly string[],
+): Promise<number> {
   let failures = 0;
-  for (const pkg of listPublishablePackages(root)) {
+  for (const pkg of selectedPublishablePackages(root, projects)) {
     failures += await validatePackedPublishablePackageTool(root, pkg, validateAttw);
   }
   return failures;

package/src/monorepo/packs/index.ts

@@ -36,6 +36,14 @@ export interface MonorepoContext {
   root: string;
   syncRuntime: boolean;
   verbose?: boolean;
+  /**
+   * Nx project names the validation is about, when a caller knows: the
+   * release's candidates. The build phase and the packed-package packs scope
+   * to them; manifest-level packs still see the whole repository, because a
+   * package's hygiene does not depend on which packages ship today. Absent,
+   * everything is validated and everything is built.
+   */
+  projects?: readonly string[];
 }
 
 export interface ValidatePackOptions {
@@ -174,19 +182,19 @@ const packs: MonorepoPack[] = [
   {
     name: 'packed-package-publint',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackagePublint(ctx.root);
+      return validatePackedPublishablePackagePublint(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-manifest',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageManifest(ctx.root);
+      return validatePackedPublishablePackageManifest(ctx.root, ctx.projects);
     },
   },
   {
     name: 'packed-package-types',
     validatePostBuild(ctx) {
-      return validatePackedPublishablePackageTypes(ctx.root);
+      return validatePackedPublishablePackageTypes(ctx.root, ctx.projects);
     },
   },
   {
@@ -369,9 +377,10 @@ async function runBuild(ctx: MonorepoContext, options: ValidatePackOptions = {})
   if (options.verbose) {
     printCheckHeading('build', true);
   }
+  const args = ['run-many', '-t', 'build', ...(ctx.projects?.length ? ['-p', ctx.projects.join(',')] : [])];
   const result = options.verbose
-    ? { exitCode: await runStatus('nx', ['run-many', '-t', 'build'], ctx.root, false), stdout: '', stderr: '' }
-    : await runResult('nx', ['run-many', '-t', 'build'], ctx.root);
+    ? { exitCode: await runStatus('nx', args, ctx.root, false), stdout: '', stderr: '' }
+    : await runResult('nx', args, ctx.root);
   const status = result.exitCode;
   if (status !== 0) {
     if (!options.verbose) {

package/src/monorepo/publish-workflow.ts

@@ -614,7 +614,14 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         'failure()',
       );
     case PublishWorkflowStepKind.ValidateMonorepoConfig:
-      return conditionalRunStep(step, 'smoo monorepo validate');
+      // Scoped to the release's candidates: the build phase and the packed-package
+      // checks cover what ships. Unscoped, validate compiled every project - on a
+      // release touching no Rust that was 3m30 of the cowshed CLI on the critical
+      // path, for a binary the release did not contain.
+      return conditionalRunStep(
+        step,
+        `smoo monorepo validate --projects "${githubExpression('steps.version.outputs.projects')}"`,
+      );
     case PublishWorkflowStepKind.TagRelease:
       return tagReleaseStepLines(step.name);
     case PublishWorkflowStepKind.PublishRelease: