@smoothbricks/cli 0.11.16 → 0.11.17

package/README.md

@@ -428,6 +428,49 @@ that runs after Validate and the e2e job succeed on a push to the staging push b
 stage-derived — carry `stage-deploy-target` or deploy through `smoo wrangler deploy-stage` — otherwise `--select-tag`
 finds nothing and the job logs `No run-many deploy projects; skipping production.`
 
+#### Ordering one deploy after another
+
+When a project's deploy calls into what another project deploys — a site that signs in to its stage's backend — say so
+with an ordinary Nx edge on the deploying project:
+
+```json
+{ "nx": { "targets": { "deploy": { "dependsOn": ["...", "app-backend:deploy"] } } } }
+```
+
+Nx then orders it, at any depth: `site:deploy` after `app-backend:deploy` after `db:deploy` all resolve inside the one
+`nx run-many` that `smoo github-ci nx-deploy` already issues, and `nx deploy site --stage=…` run by hand gets the same
+order. Keep the leading `"..."`: it expands the `deploy-build` edge the plugin infers (below), which a bare list would
+drop.
+
+What makes the edge safe is that a deploy is never cached and always cheap when there is nothing to do:
+
+- `@smoothbricks/nx-plugin` gives every declared `deploy` target `cache: false`. An Nx cache hit on a deploy means "we
+  once uploaded this hash", which a rollback silently falsifies — the workspace is unchanged, so the hash is unchanged,
+  so a cached deploy would report success while the previous version keeps serving.
+- `smoo wrangler deploy-stage` reads live state first. If the version tagged with this task's hash is already the one
+  serving 100% of traffic, it returns `remote-cache-hit` after two API calls: no upload, no migration, no traffic shift.
+- The expensive, purely file-derived half belongs in a sibling `deploy-build` target (build the artifact, register it,
+  refresh what the build needs). The plugin gives that one `cache: true` and makes `deploy` depend on it, so a redundant
+  deploy costs two API calls rather than a rebuild.
+- A deploy does not finish when Cloudflare accepts the traffic shift; it finishes when the new version is the one being
+  served. `deploy-stage` polls `wrangler deployments status` until the tag it activated is live, and fails with what it
+  expected and what it saw if that never happens. Pass `--version-endpoint <url>` to also require an endpoint served by
+  the worker — whose trimmed response body is the running version tag — to answer with it. Without that wait, an edge
+  onto a deploy orders nothing: the step returns while the edge still serves the old code.
+
+**The policy caveat, plainly.** A cross-project edge is part of the graph, not of the selection: a run that selects only
+the dependent project will still evaluate the dependency's `deploy`. When the dependency is already at that hash, that
+evaluation is a no-op — two API calls. But it is not inert: if the dependency is intentionally behind (its production
+deploy is being held back, say), a run that selects only the dependent project **will advance the dependency to the hash
+the current workspace produces**. If you need a project to be deployable without touching what it depends on, do not add
+the edge; sequence those two deploys as separate CI jobs instead.
+
+`smoo wrangler deployed-version --stage <stage>` prints the tag serving all traffic for the project's worker on that
+stage, so an operator can check the same fact the deploy checks. It caches its answer briefly under Nx's workspace data
+directory; that cache is a convenience for repeated queries only. Nothing that decides whether to deploy reads it, and
+it refuses — rather than answering `unknown` — without credentials, on an API error, or while traffic is split between
+two versions.
+
 Pushes to the staging push branch queue behind a running workflow instead of canceling it, so a newer push never cancels
 a production deployment mid-flight. Pull requests and other branches keep canceling superseded runs. The e2e and
 production jobs repeat the Cargo credential and sibling-source preflight before SetupDevenv, so their `--step` anchors

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAWA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAaA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAcxE;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,IAAI,CAiBhD"}

package/dist/cli.js

@@ -6,7 +6,9 @@ import { cliPackageVersion } from './lib/cli-package.js';
 import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
+import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
 export async function runCli(argv = process.argv.slice(2)) {
     const program = buildProgram();
@@ -420,6 +422,30 @@ function buildProgram() {
         .action(async () => {
         await ensureChromium();
     });
+    const secrets = program
+        .command('secrets')
+        .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+    secrets
+        .command('status')
+        .description('Show every declared secret and refuse when a workflow passes one the repository lacks')
+        .option('--repo <owner/name>', 'repository to read secrets from; defaults to the current checkout')
+        .action(async (options) => {
+        process.exitCode = secretsStatus(await findRepoRoot(), options);
+    });
+    secrets
+        .command('set <name>')
+        .description('Set one repository secret from a pasted value; the value is read without echo and never logged')
+        .option('--repo <owner/name>', 'repository to set the secret on')
+        .action(async (name, options) => {
+        process.exitCode = await secretsSet(name, options);
+    });
+    secrets
+        .command('sync')
+        .description('Push every secret smoo.secrets can fetch locally to the repository')
+        .option('--repo <owner/name>', 'repository to set the secrets on')
+        .action(async (options) => {
+        process.exitCode = await secretsSync(await findRepoRoot(), options);
+    });
     const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
     wrangler
         .command('scaffold <project>')
@@ -432,11 +458,29 @@ function buildProgram() {
         .command('deploy-stage')
         .requiredOption('--stage <stage>', 'staging, production, or prN')
         .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
+        .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
         .action(async (options) => {
         await deployStage(process.cwd(), {
             stage: options.stage,
             ...(options.config ? { config: resolve(options.config) } : {}),
+            ...(options.versionEndpoint ? { versionEndpoint: options.versionEndpoint } : {}),
+        });
+    });
+    wrangler
+        .command('deployed-version')
+        .description('Print the version tag serving all traffic for this project\u2019s worker on a stage')
+        .requiredOption('--stage <stage>', 'staging, production, or prN')
+        .option('--config <path>', 'resolve the worker name from a build-generated flat wrangler.json')
+        .option('--refresh', 'ask Cloudflare even when a fresh cached answer exists')
+        .action(async (options) => {
+        const report = await deployedVersion(process.cwd(), {
+            stage: options.stage,
+            ...(options.config ? { config: resolve(options.config) } : {}),
+            ...(options.refresh ? { refresh: true } : {}),
         });
+        // The tag alone on stdout: this is read by humans and by `$(...)`, and a version deployed
+        // outside Nx genuinely has no tag, which `untagged` says without pretending to be one.
+        console.log(report.versionTag ?? 'untagged');
     });
     wrangler
         .command('cleanup-pr')

package/dist/github-ci/index.d.ts

@@ -68,7 +68,7 @@ export interface GithubCiNxDeployOptions {
     selectTag?: string;
 }
 export interface GithubCiNxDeployDependencies {
-    listProjects?: (root: string, target: string, mode: 'affected' | 'run-many', stage: DeploymentStage, selectTag?: string) => Promise<string[]>;
+    listProjects?: (root: string, mode: 'affected' | 'run-many', stage: DeploymentStage, selectTag?: string) => Promise<string[]>;
     runNx?: (args: string[], root: string) => Promise<number>;
     appendSummary?: (summaryPath: string, content: string) => Promise<void>;
     appendOutput?: (outputPath: string, content: string) => Promise<void>;

package/dist/github-ci/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAiFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA+BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/github-ci/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,iBAAiB,EAGvB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,KAAK,cAAc,EAAsB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,KAAK,eAAe,EAA8D,MAAM,sBAAsB,CAAC;AAExH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE;YACL,IAAI,CAAC,EAAE;gBACL,SAAS,CAAC,EAAE,MAAM,CAAC;aACpB,CAAC;SACH,CAAC;KACH,CAAC;CACH;AAmBD,KAAK,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAKpD,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,aAAa,CAAC,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,MAAM,EAAE,CAaV;AAED,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE;IACP,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GACA,OAAO,CAAC,IAAI,CAAC,CAWf;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB,CAmD9G;AAED;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CA0C/E;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,uFAAuF;AACvF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAiBxF;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAGlE;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkB9G;AAED,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAGf;AA8CD,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC3C,YAAY,CAAC,EAAE,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,UAAU,GAAG,UAAU,EAC7B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,KACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvB,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,YAAY,CAAC,EAAE,yBAAyB,CAAC;IACzC,6EAA6E;IAC7E,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,uBAAuB,EAChC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,IAAI,CAAC,CAmFf;AAsCD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,EAC5C,iBAAiB,EAAE,MAAM,GACxB,eAAe,CAsBjB;AAkBD,8GAA8G;AAC9G,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAShH;AA2BD,wBAAsB,yBAAyB,CAC7C,UAAU,EAAE,MAAM,EAAE,EACpB,KAAK,EAAE,eAAe,EACtB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,GACjD,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClF;AAED,qBAAa,0BAA2B,YAAW,sBAAsB;IACvE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB/E;CACF;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,KAAK,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,kBAAkB,EAAE,MAAM,CAAC,UAAU,EACrC,MAAM,GAAE,sBAAyD,GAChE,OAAO,CAAC,IAAI,CAAC,CAyEf;AAwDD,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,MAAM,CAAC,UAAU,EAC9B,KAAK,EAAE,yBAAyB,GAAG,SAAS,GAC3C,OAAO,CAUT"}

package/dist/github-ci/index.js

@@ -260,9 +260,9 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
     const setStatus = dependencies.setStatus ??
         ((state) => state === 'pending' ? createGithubStatus(name, step) : updateGithubStatus(name, state, step));
     const mode = resolveNxSmartMode(options.mode ?? 'run-many');
-    const listProjects = dependencies.listProjects ?? listNxProjectsWithTarget;
+    const listProjects = dependencies.listProjects ?? listNxDeployProjects;
     const runNx = dependencies.runNx ?? ((args, commandRoot) => runStatus('nx', args, commandRoot));
-    const projects = await listProjects(root, 'deploy', mode, stage, options.selectTag);
+    const projects = await listProjects(root, mode, stage, options.selectTag);
     if (projects.length === 0) {
         console.log(`No ${mode} deploy projects; skipping ${stage}.`);
         await setStatus('pending');
@@ -275,8 +275,8 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
         ? { stage, urls: previewUrlsForStage(github?.previewUrls, stage) }
         : undefined;
     await setStatus('pending');
-    const projectList = projects.join(',');
     const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
+    const projectList = projects.join(',');
     for (const target of targets) {
         const nxArgs = [
             'run-many',
@@ -286,6 +286,8 @@ export async function githubCiNxDeploy(root, options, dependencies = {}) {
             `--exclude=${deployExclusions(stage)}`,
             `--parallel=${NX_PARALLEL}`,
         ];
+        // Deploy ordering is a `dependsOn` edge in the project graph, not a second round here: one run-many
+        // already sequences any depth of `a:deploy -> b:deploy -> c:deploy`.
         if (target === 'deploy') {
             nxArgs.push(`--stage=${stage}`);
         }
@@ -413,17 +415,12 @@ function previewUrlFromTemplate(template, stage) {
         throw new Error(`preview URL template "${template}" must contain {stage}`);
     return template.replaceAll('{stage}', stage);
 }
-async function listNxProjectsWithTarget(root, target, mode, stage, selectTag) {
+async function listNxDeployProjects(root, mode, stage, selectTag) {
     const listArgs = ['show', 'projects'];
     if (mode === 'affected')
         listArgs.push('--affected');
-    listArgs.push('--withTarget', target);
-    if (target === 'deploy')
-        listArgs.push(`--exclude=${deployExclusions(stage)}`);
-    listArgs.push('--json');
+    listArgs.push('--withTarget', 'deploy', `--exclude=${deployExclusions(stage)}`, '--json');
     const candidates = nxProjectList(await runText('nx', listArgs, root)).sort((left, right) => left.localeCompare(right));
-    if (target !== 'deploy')
-        return candidates;
     return selectStageDeployProjects(candidates, stage, selectTag, async (project) => {
         const parsed = parseNxProjectDeployTarget(await runText('nx', ['show', 'project', project, '--json'], root));
         if (!parsed)

package/dist/lib/secret-names.d.ts

@@ -0,0 +1,35 @@
+/**
+ * One rule for naming the repository secret behind an environment variable, so
+ * the workflow renderer, the reconciler and an operator all derive the same
+ * name instead of maintaining a map.
+ *
+ * GitHub refuses to create a secret whose name starts with `GITHUB_` (hence
+ * `RepositorySecretName`'s pattern), which is why a Worker's
+ * `GITHUB_CLIENT_SECRET` cannot be stored under its own name. Prefixing with
+ * the repository owner is the workaround operators already reach for by hand
+ * (`ACME_GITHUB_CLIENT_SECRET` for `acme/app`); making it the convention means
+ * nothing has to declare it.
+ */
+/** Names GitHub reserves: it rejects `gh secret set GITHUB_*` outright. */
+export declare function isReservedRepositorySecretName(envName: string): boolean;
+/**
+ * The repository secret an env name lives in. Identity for every name GitHub
+ * accepts; owner-prefixed for the reserved ones. `owner` comes from the
+ * repository URL, so a fork or a rename derives its own names rather than
+ * inheriting a hardcoded prefix.
+ */
+export declare function conventionalRepositorySecretName(envName: string, owner: string): string;
+/**
+ * Resolve the whole env -> secret mapping for a set of declared env names.
+ * Explicit entries win: an exception stays expressible, but a repository that
+ * follows the convention declares nothing.
+ */
+export declare function repositorySecretMapping(envNames: readonly string[], owner: string, declared?: Readonly<Record<string, string>>): Record<string, string>;
+/**
+ * Repository owner from a repository URL — `acme` from
+ * `https://github.com/acme/app.git`, and the same for an ssh or forge
+ * URL. The owner is derived rather than configured so a fork or a rename
+ * carries its own prefix instead of inheriting one.
+ */
+export declare function repositoryOwnerFromUrl(url: string): string | null;
+//# sourceMappingURL=secret-names.d.ts.map

package/dist/lib/secret-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-names.d.ts","sourceRoot":"","sources":["../../src/lib/secret-names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,2EAA2E;AAC3E,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEvE;AAED;;;;;GAKG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAYvF;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAM,GAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKjE"}

package/dist/lib/secret-names.js

@@ -0,0 +1,61 @@
+/**
+ * One rule for naming the repository secret behind an environment variable, so
+ * the workflow renderer, the reconciler and an operator all derive the same
+ * name instead of maintaining a map.
+ *
+ * GitHub refuses to create a secret whose name starts with `GITHUB_` (hence
+ * `RepositorySecretName`'s pattern), which is why a Worker's
+ * `GITHUB_CLIENT_SECRET` cannot be stored under its own name. Prefixing with
+ * the repository owner is the workaround operators already reach for by hand
+ * (`ACME_GITHUB_CLIENT_SECRET` for `acme/app`); making it the convention means
+ * nothing has to declare it.
+ */
+/** Names GitHub reserves: it rejects `gh secret set GITHUB_*` outright. */
+export function isReservedRepositorySecretName(envName) {
+    return /^GITHUB_/i.test(envName);
+}
+/**
+ * The repository secret an env name lives in. Identity for every name GitHub
+ * accepts; owner-prefixed for the reserved ones. `owner` comes from the
+ * repository URL, so a fork or a rename derives its own names rather than
+ * inheriting a hardcoded prefix.
+ */
+export function conventionalRepositorySecretName(envName, owner) {
+    if (!isReservedRepositorySecretName(envName))
+        return envName;
+    const prefix = owner
+        .replace(/[^A-Za-z0-9]+/g, '_')
+        .replace(/^_+|_+$/g, '')
+        .toUpperCase();
+    if (prefix.length === 0) {
+        throw new Error(`Cannot derive a repository secret name for ${envName}: GitHub reserves the GITHUB_ prefix and the repository owner is empty.`);
+    }
+    return `${prefix}_${envName}`;
+}
+/**
+ * Resolve the whole env -> secret mapping for a set of declared env names.
+ * Explicit entries win: an exception stays expressible, but a repository that
+ * follows the convention declares nothing.
+ */
+export function repositorySecretMapping(envNames, owner, declared = {}) {
+    const mapping = {};
+    for (const envName of [...envNames].sort((left, right) => left.localeCompare(right))) {
+        mapping[envName] = declared[envName] ?? conventionalRepositorySecretName(envName, owner);
+    }
+    for (const [envName, secretName] of Object.entries(declared)) {
+        mapping[envName] = secretName;
+    }
+    return mapping;
+}
+/**
+ * Repository owner from a repository URL — `acme` from
+ * `https://github.com/acme/app.git`, and the same for an ssh or forge
+ * URL. The owner is derived rather than configured so a fork or a rename
+ * carries its own prefix instead of inheriting one.
+ */
+export function repositoryOwnerFromUrl(url) {
+    const withoutProtocol = url.replace(/^[a-z+]+:\/\//i, '').replace(/^git@/i, '');
+    const path = withoutProtocol.replace(/^[^/:]+[/:]/, '');
+    const owner = path.split('/')[0];
+    return owner && owner.length > 0 ? owner.replace(/\.git$/i, '') : null;
+}

package/dist/monorepo/ci-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAyDD,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AA8HD,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"ci-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/ci-workflow.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,aAAa,EACb,6BAA6B,EAE7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AAGxB,oBAAY,kBAAkB;IAC5B,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,WAAW,iBAAiB;IAC5B,gBAAgB,sBAAsB;IACtC,SAAS,gBAAgB;IACzB,cAAc,qBAAqB;IACnC,KAAK,UAAU;IACf,YAAY,kBAAkB;IAC9B,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,iBAAiB,wBAAwB;IACzC,oBAAoB,2BAA2B;IAC/C,MAAM,WAAW;IACjB,WAAW,kBAAkB;IAC7B,cAAc,qBAAqB;IACnC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,2BAA4B,SAAQ,sBAAsB;IACzE,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD,MAAM,EAAE,OAAO,CAAC;IAChB,YAAY,EAAE,OAAO,CAAC;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,2EAA2E;IAC3E,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC;;;;OAIG;IACH,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;OAIG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,yGAAyG;IACzG,YAAY,CAAC,EAAE,6BAA6B,CAAC;IAC7C,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,yFAAyF;IACzF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAID,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,2BAA2B,GAAG,cAAc,EAAE,CAgCvF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CAQjF;AAkED,mFAAmF;AACnF,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,YAAY,CAAC,GAAG,MAAM,CAM1G;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,cAAc,EACpB,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,MAAM,EAAE,CA+BV;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,2BAA2B,GAAG,2BAA2B,CA8BxG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,wBAAwB,GAAG,SAAS,GAAG,MAAM,CAS3F;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,wBAAwB,GAAG,wBAAwB,CAgB/F;AA+BD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,6BAA6B,GAAG,SAAS,GAAG,MAAM,CASpG;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,6BAA6B,GAAG,MAAM,EAAE,CAyG9G;AAqCD,6EAA6E;AAC7E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,6BAA6B,GAAG,6BAA6B,CAkC9G;AAqGD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,UAIjC,CAAC;AAiCF;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,MAAM,EAAE,CAMjF;AAgID,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,EAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,GAAG,UAAU,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,SAAS,SAAc,GACtB,MAAM,EAAE,CAmBV"}

package/dist/monorepo/ci-workflow.js

@@ -64,12 +64,19 @@ permissions:
 ${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 concurrency:
-  # One in-flight run per ref. Pushes to the staging push branch queue behind a
-  # running workflow instead of canceling it, so a newer push never cancels a
-  # production deployment mid-flight. Pull requests and other branches keep
-  # canceling superseded runs.
+${options.deploy
+        ? `  # One in-flight run per ref. Pushes to the staging push branch queue behind a
+  # running workflow instead of canceling it, so a newer push never cancels the
+  # deploy job mid-flight. Pull requests and other branches keep canceling
+  # superseded runs.
   group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}
+  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}`
+        : `  # This workflow validates and never deploys, so there is no in-flight
+  # deployment for a newer push to protect: every ref cancels its superseded
+  # runs. Queuing them instead serializes the staging branch, and a burst of
+  # pushes then reports the newest commit one full run per queued push late.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true`}
 
 defaults:
   run:
@@ -828,6 +835,7 @@ function renderProductionDeployJob(options) {
     needs: ${needs}
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 30
+    # prettier-ignore
     if: \${{ !cancelled() && github.event_name == 'push' && github.ref == ${stagingRefLiteral(options)} && needs.main.result == 'success'${e2eGate} }}
 ${environmentLine(options.environments?.production)}    env:
       GH_TOKEN: \${{ github.token }}
@@ -835,7 +843,8 @@ ${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(optio
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: 🚀 Deploy Production
-${renderOptionalLines(deployStepSecretEnvLines(options))}        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
+${renderOptionalLines(deployStepSecretEnvLines(options))}        # prettier-ignore
+        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
 
 ${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
 }

package/dist/monorepo/publish-workflow.d.ts

@@ -2,7 +2,7 @@ import type { PackageCargoCredentialsConfig, PackagePrivateNpmConfig, PackageRem
 import { type DeployStepSecretConfig } from './ci-workflow.js';
 import { type WorkflowRunsOn } from './github-runs-on.js';
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
-export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'deploy-production-standalone' | 'failure' | 'always';
+export type PublishWorkflowCondition = 'plan-mode-not-none' | 'version-mode-not-none' | 'deploy-production' | 'deploy-production-standalone' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
 export type PublishWorkflowDeployStage = 'none' | 'production';
 export declare enum PublishWorkflowStepKind {
@@ -13,6 +13,7 @@ export declare enum PublishWorkflowStepKind {
     ConfigureReleaseAuthor = "configure-release-author",
     BuildNxVersionActions = "build-nx-version-actions",
     RepairPendingReleases = "repair-pending-releases",
+    PlanRelease = "plan-release",
     VersionRelease = "version-release",
     CheckManagedMonorepoFiles = "check-managed-monorepo-files",
     Build = "build",
@@ -105,6 +106,14 @@ export interface PublishWorkflowCallbacks {
         bump: PublishWorkflowBump;
         dryRun: boolean;
     }): Promise<PublishWorkflowVersionOutputs>;
+    /**
+     * The selection the bump WILL make, computed without writing anything, so the
+     * gates that run before the version commit know what to run over. Defaults to
+     * a dry-run `versionRelease` when a caller supplies none.
+     */
+    planRelease?(input: {
+        bump: PublishWorkflowBump;
+    }): Promise<PublishWorkflowVersionOutputs>;
     checkManagedMonorepoFiles(): Promise<void>;
     nxRunMany(input: {
         target: PublishWorkflowNxTarget;

package/dist/monorepo/publish-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,sBAAsB,EAI5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAsBxG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAChC,uBAAuB,GACvB,mBAAmB,GACnB,8BAA8B,GAC9B,SAAS,GACT,QAAQ,CAAC;AACb,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/D,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,qBAAqB,6BAA6B;IAClD,qBAAqB,4BAA4B;IACjD,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAiC,SAAQ,sBAAsB;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,mGAAmG;IACnG,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,mEAAmE;IACnE,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,0BAA0B,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CAiF/G;AAkCD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CA6EnC;AAuBD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CA0BhG"}
+{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../src/monorepo/publish-workflow.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAKL,KAAK,sBAAsB,EAI5B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAgD,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAsBxG,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,YAAY,CAAC;AACtF,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,uBAAuB,GACvB,mBAAmB,GACnB,8BAA8B,GAC9B,SAAS,GACT,QAAQ,CAAC;AACb,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;AAChE,MAAM,MAAM,0BAA0B,GAAG,MAAM,GAAG,YAAY,CAAC;AAE/D,oBAAY,uBAAuB;IACjC,QAAQ,aAAa;IACrB,eAAe,qBAAqB;IACpC,gBAAgB,sBAAsB;IACtC,WAAW,iBAAiB;IAC5B,sBAAsB,6BAA6B;IACnD,qBAAqB,6BAA6B;IAClD,qBAAqB,4BAA4B;IACjD,WAAW,iBAAiB;IAC5B,cAAc,oBAAoB;IAClC,yBAAyB,iCAAiC;IAC1D,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,eAAe;IACxB,cAAc,qBAAqB;IACnC,sBAAsB,6BAA6B;IACnD,UAAU,gBAAgB;IAC1B,cAAc,oBAAoB;IAClC,gBAAgB,sBAAsB;IACtC,aAAa,oBAAoB;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,wBAAwB,CAAC;IACrC,QAAQ,CAAC,EAAE,uBAAuB,CAAC;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAiC,SAAQ,sBAAsB;IAC9E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC;;;OAGG;IACH,0BAA0B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,mGAAmG;IACnG,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,gBAAgB,CAAC,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,CAAC;IACzD,eAAe,CAAC,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACvD;;;;;OAKG;IACH,UAAU,CAAC,EAAE,uBAAuB,CAAC;IACrC,mEAAmE;IACnE,eAAe,CAAC,EAAE,2BAA2B,EAAE,CAAC;IAChD;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD;;;;;OAKG;IACH,WAAW,CAAC,EAAE,wBAAwB,CAAC;CACxC;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,0BAA0B,CAAC;IACxC,MAAM,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,WAAW,IAAI,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACpD,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,qBAAqB,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC9G;;;;OAIG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAA;KAAE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAC3F,yBAAyB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,SAAS,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,uBAAuB,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzF,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,mBAAmB,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,aAAa,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,qBAAqB,CAAC;IAC9B,SAAS,EAAE,wBAAwB,CAAC;CACrC;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,6BAA6B,CAAC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB;AAID,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,gCAAqC,GAAG,yBAAyB,CA2F/G;AAkCD,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,yBAAyB,EACnC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,wBAAwB,CAAC,CAwFnC;AA2BD,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,gCAAqC,GAAG,MAAM,CA0BhG"}

package/dist/monorepo/publish-workflow.js

@@ -31,6 +31,7 @@ export var PublishWorkflowStepKind;
     PublishWorkflowStepKind["ConfigureReleaseAuthor"] = "configure-release-author";
     PublishWorkflowStepKind["BuildNxVersionActions"] = "build-nx-version-actions";
     PublishWorkflowStepKind["RepairPendingReleases"] = "repair-pending-releases";
+    PublishWorkflowStepKind["PlanRelease"] = "plan-release";
     PublishWorkflowStepKind["VersionRelease"] = "version-release";
     PublishWorkflowStepKind["CheckManagedMonorepoFiles"] = "check-managed-monorepo-files";
     PublishWorkflowStepKind["Build"] = "build";
@@ -45,6 +46,9 @@ export var PublishWorkflowStepKind;
 })(PublishWorkflowStepKind || (PublishWorkflowStepKind = {}));
 export function definePublishWorkflow(options = {}) {
     const versionMode = githubExpression('steps.version.outputs.mode');
+    // Steps that run before the bump must label themselves from the plan: the
+    // version step's outputs do not exist yet, so the interpolation renders empty.
+    const planMode = githubExpression('steps.plan.outputs.mode');
     if (options.release === false) {
         return { steps: defineDeployOnlyWorkflowSteps(options) };
     }
@@ -86,30 +90,37 @@ export function definePublishWorkflow(options = {}) {
                 kind: PublishWorkflowStepKind.RepairPendingReleases,
                 name: '🧯 Repair pending releases',
             },
-            { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+            // Plan first, gate second, bump third. Lint and test hash the source, so
+            // running them BEFORE the version commit means their task hashes match
+            // the ones ci already computed for the same source — the publish reuses
+            // that cache instead of re-running 189 tasks. Build stays after the bump
+            // on purpose: an artifact built from pre-bump sources would ship the
+            // previous version string.
+            { kind: PublishWorkflowStepKind.PlanRelease, name: '🧭 Plan release', id: 'plan' },
             {
                 kind: PublishWorkflowStepKind.CheckManagedMonorepoFiles,
-                name: `✅ Check managed monorepo files (${versionMode})`,
-                condition: 'version-mode-not-none',
-            },
-            {
-                kind: PublishWorkflowStepKind.Build,
-                name: `🔨 Build (${versionMode})`,
-                condition: 'version-mode-not-none',
-                nxTarget: 'build',
+                name: `✅ Check managed monorepo files (${planMode})`,
+                condition: 'plan-mode-not-none',
             },
             {
                 kind: PublishWorkflowStepKind.Lint,
-                name: `🔍 Lint (${versionMode})`,
-                condition: 'version-mode-not-none',
+                name: `🔍 Lint (${planMode})`,
+                condition: 'plan-mode-not-none',
                 nxTarget: 'lint',
             },
             {
                 kind: PublishWorkflowStepKind.UnitTests,
-                name: `🧪 Unit Tests (${versionMode})`,
-                condition: 'version-mode-not-none',
+                name: `🧪 Unit Tests (${planMode})`,
+                condition: 'plan-mode-not-none',
                 nxTarget: 'test',
             },
+            { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+            {
+                kind: PublishWorkflowStepKind.Build,
+                name: `🔨 Build (${versionMode})`,
+                condition: 'version-mode-not-none',
+                nxTarget: 'build',
+            },
             { kind: PublishWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs', condition: 'failure' },
             {
                 kind: PublishWorkflowStepKind.ValidateMonorepoConfig,
@@ -158,10 +169,11 @@ function numberWorkflowSteps(steps) {
 export async function runPublishWorkflow(workflow, context) {
     let setupOutputs = { nixCacheHit: '', devenvCacheHit: '' };
     let version = { mode: 'none', projects: [] };
+    let plan = { mode: 'none', projects: [] };
     let failed = false;
     let failure;
     for (const step of workflow.steps) {
-        if (!shouldRunStep(step, version, failed, context.inputs)) {
+        if (!shouldRunStep(step, version, failed, context.inputs, plan)) {
             continue;
         }
         try {
@@ -187,6 +199,11 @@ export async function runPublishWorkflow(workflow, context) {
                         dryRun: context.inputs.dryRun,
                     });
                     break;
+                case PublishWorkflowStepKind.PlanRelease:
+                    plan = context.callbacks.planRelease
+                        ? await context.callbacks.planRelease({ bump: context.inputs.bump })
+                        : await context.callbacks.versionRelease({ bump: context.inputs.bump, dryRun: true });
+                    break;
                 case PublishWorkflowStepKind.VersionRelease:
                     version = await context.callbacks.versionRelease(context.inputs);
                     break;
@@ -199,7 +216,12 @@ export async function runPublishWorkflow(workflow, context) {
                     if (!step.nxTarget) {
                         throw new Error(`Workflow step ${step.kind} is missing an Nx target.`);
                     }
-                    await context.callbacks.nxRunMany({ target: step.nxTarget, projects: version.projects });
+                    // Lint and test run before the bump exists, so they select from the
+                    // plan; build runs after it and selects from the written version.
+                    await context.callbacks.nxRunMany({
+                        target: step.nxTarget,
+                        projects: step.kind === PublishWorkflowStepKind.Build ? version.projects : plan.projects,
+                    });
                     break;
                 case PublishWorkflowStepKind.UploadTraceDbs:
                     await context.callbacks.uploadTraceDbs();
@@ -234,7 +256,10 @@ export async function runPublishWorkflow(workflow, context) {
     }
     return { version, failed };
 }
-function shouldRunStep(step, version, failed, inputs) {
+function shouldRunStep(step, version, failed, inputs, plan = version) {
+    if (step.condition === 'plan-mode-not-none') {
+        return plan.mode !== 'none';
+    }
     if (step.condition === 'version-mode-not-none') {
         return version.mode !== 'none';
     }
@@ -421,6 +446,16 @@ function yamlLinesForStep(step, options) {
                 ...privateNpmPublisherStepEnv(options),
                 `        run: smoo release repair-pending --dry-run "${githubExpression('inputs.dry_run')}"`,
             ];
+        case PublishWorkflowStepKind.PlanRelease:
+            // The same selection the bump will make, computed without writing: the
+            // gates need `mode` and `projects` before any version commit exists.
+            return [
+                `      - name: ${step.name}`,
+                '        id: plan',
+                '        run:',
+                `          smoo release version --bump "${githubExpression('inputs.bump')}" --projects "${githubExpression('inputs.projects')}" --dry-run "true" --github-output`,
+                '          "$GITHUB_OUTPUT"',
+            ];
         case PublishWorkflowStepKind.VersionRelease:
             return [
                 `      - name: ${step.name}`,
@@ -436,9 +471,9 @@ function yamlLinesForStep(step, options) {
         case PublishWorkflowStepKind.Build:
             return conditionalRunStep(step, `smoo github-ci nx-run-many --targets build --projects "${githubExpression('steps.version.outputs.projects')}"`);
         case PublishWorkflowStepKind.Lint:
-            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.version.outputs.projects')}"`);
+            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.plan.outputs.projects')}"`);
         case PublishWorkflowStepKind.UnitTests:
-            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.version.outputs.projects')}"`);
+            return conditionalRunStep(step, `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.plan.outputs.projects')}"`);
         case PublishWorkflowStepKind.UploadTraceDbs:
             return artifactStepLines(options.actionsProvider, step.name, 'upload', [
                 `name: trace-results-${githubExpression('github.run_id')}`,
@@ -513,8 +548,11 @@ function deployProductionStep(step, options) {
     ];
 }
 function conditionalRunStep(step, run) {
-    const condition = "steps.version.outputs.mode != 'none'";
-    return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
+    // A step gated on the plan must read the PLAN's mode: it runs before the
+    // version step exists, and `steps.version.outputs.mode` is empty there, which
+    // silently skips the gate rather than running it.
+    const source = step.condition === 'plan-mode-not-none' ? 'plan' : 'version';
+    return [`      - name: ${step.name}`, `        if: steps.${source}.outputs.mode != 'none'`, `        run: ${run}`];
 }
 function siblingSourceCheckoutStepLines(options) {
     const checkouts = options.sourceCheckouts;

package/dist/secrets/commands.d.ts

@@ -0,0 +1,45 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ */
+/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
+export declare function readRepositorySecrets(repo: string | undefined): {
+    ok: true;
+    names: string[];
+} | {
+    ok: false;
+    reason: string;
+};
+/** Write one secret, value over stdin so it never reaches argv. */
+export declare function writeRepositorySecret(name: string, value: string, repo: string | undefined): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+}>;
+/**
+ * Print every known secret with its sources. Exit code 1 when a workflow
+ * promises a value the repository does not hold — that combination is the one
+ * that fails a deploy, and it fails talking about the value rather than the
+ * missing secret.
+ */
+export declare function secretsStatus(root: string, options: {
+    repo?: string;
+}): number;
+/** Set one secret from a pasted value. */
+export declare function secretsSet(name: string, options: {
+    repo?: string;
+}): Promise<number>;
+/**
+ * Push every locally fetchable secret to the repository. Only names
+ * `smoo.secrets` declares a command for: everything else has no source here
+ * and must be pasted with `smoo secrets set`.
+ */
+export declare function secretsSync(root: string, options: {
+    repo?: string;
+}): Promise<number>;
+//# sourceMappingURL=commands.d.ts.map