@smoothbricks/cli 0.11.16 → 0.11.17

package/src/cli.ts

@@ -6,7 +6,9 @@ import { cliPackageVersion } from './lib/cli-package.js';
 import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
+import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
 
 export async function runCli(argv = process.argv.slice(2)): Promise<void> {
@@ -525,6 +527,31 @@ function buildProgram(): Command {
       await ensureChromium();
     });
 
+  const secrets = program
+    .command('secrets')
+    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+  secrets
+    .command('status')
+    .description('Show every declared secret and refuse when a workflow passes one the repository lacks')
+    .option('--repo <owner/name>', 'repository to read secrets from; defaults to the current checkout')
+    .action(async (options: { repo?: string }) => {
+      process.exitCode = secretsStatus(await findRepoRoot(), options);
+    });
+  secrets
+    .command('set <name>')
+    .description('Set one repository secret from a pasted value; the value is read without echo and never logged')
+    .option('--repo <owner/name>', 'repository to set the secret on')
+    .action(async (name: string, options: { repo?: string }) => {
+      process.exitCode = await secretsSet(name, options);
+    });
+  secrets
+    .command('sync')
+    .description('Push every secret smoo.secrets can fetch locally to the repository')
+    .option('--repo <owner/name>', 'repository to set the secrets on')
+    .action(async (options: { repo?: string }) => {
+      process.exitCode = await secretsSync(await findRepoRoot(), options);
+    });
+
   const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
   wrangler
     .command('scaffold <project>')
@@ -537,11 +564,29 @@ function buildProgram(): Command {
     .command('deploy-stage')
     .requiredOption('--stage <stage>', 'staging, production, or prN')
     .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
-    .action(async (options: { stage: string; config?: string }) => {
+    .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
+    .action(async (options: { stage: string; config?: string; versionEndpoint?: string }) => {
       await deployStage(process.cwd(), {
         stage: options.stage,
         ...(options.config ? { config: resolve(options.config) } : {}),
+        ...(options.versionEndpoint ? { versionEndpoint: options.versionEndpoint } : {}),
+      });
+    });
+  wrangler
+    .command('deployed-version')
+    .description('Print the version tag serving all traffic for this project\u2019s worker on a stage')
+    .requiredOption('--stage <stage>', 'staging, production, or prN')
+    .option('--config <path>', 'resolve the worker name from a build-generated flat wrangler.json')
+    .option('--refresh', 'ask Cloudflare even when a fresh cached answer exists')
+    .action(async (options: { stage: string; config?: string; refresh?: boolean }) => {
+      const report = await deployedVersion(process.cwd(), {
+        stage: options.stage,
+        ...(options.config ? { config: resolve(options.config) } : {}),
+        ...(options.refresh ? { refresh: true } : {}),
       });
+      // The tag alone on stdout: this is read by humans and by `$(...)`, and a version deployed
+      // outside Nx genuinely has no tag, which `untagged` says without pretending to be one.
+      console.log(report.versionTag ?? 'untagged');
     });
   wrangler
     .command('cleanup-pr')

package/src/github-ci/index.test.ts

@@ -954,7 +954,7 @@ describe('event-aware stage deployment', () => {
 
   it('deploys app/backend, publishes PR metadata, and emits the resolved stage', async () => {
     const nxCalls: string[][] = [];
-    const listCalls: Array<[string, string, string, string | undefined]> = [];
+    const listCalls: Array<[string, string, string | undefined]> = [];
     const summaries: string[] = [];
     const deployments: Array<[string, string]> = [];
     const outputs: string[] = [];
@@ -975,8 +975,8 @@ describe('event-aware stage deployment', () => {
           repository: { full_name: 'owner/repo' },
           pull_request: { number: 123, head: { repo: { full_name: 'owner/repo' } } },
         },
-        listProjects: async (_root, target, mode, stage, selectTag) => {
-          listCalls.push([target, mode, stage, selectTag]);
+        listProjects: async (_root, mode, stage, selectTag) => {
+          listCalls.push([mode, stage, selectTag]);
           return ['app', 'app-backend'];
         },
         runNx: async (args) => {
@@ -995,7 +995,7 @@ describe('event-aware stage deployment', () => {
       },
     );
 
-    expect(listCalls).toEqual([['deploy', 'run-many', 'pr123', undefined]]);
+    expect(listCalls).toEqual([['run-many', 'pr123', undefined]]);
     expect(nxCalls).toHaveLength(1);
     expect(nxCalls[0]).toContain('--projects=app,app-backend');
     expect(nxCalls[0]).toContain('--exclude=tag:permanent-deploy-target,tag:staging-deploy-target');
@@ -1077,7 +1077,7 @@ describe('event-aware stage deployment', () => {
   });
 
   it('passes --select-tag through to the project selection of the production deploy', async () => {
-    const listCalls: Array<[string, string, string, string | undefined]> = [];
+    const listCalls: Array<[string, string, string | undefined]> = [];
     const nxCalls: string[][] = [];
 
     await githubCiNxDeploy(
@@ -1086,8 +1086,8 @@ describe('event-aware stage deployment', () => {
       {
         processEnv: {},
         setStatus: async () => {},
-        listProjects: async (_root, target, mode, stage, selectTag) => {
-          listCalls.push([target, mode, stage, selectTag]);
+        listProjects: async (_root, mode, stage, selectTag) => {
+          listCalls.push([mode, stage, selectTag]);
           return ['website'];
         },
         runNx: async (args) => {
@@ -1097,7 +1097,7 @@ describe('event-aware stage deployment', () => {
       },
     );
 
-    expect(listCalls).toEqual([['deploy', 'run-many', 'production', 'production-push-deploy-target']]);
+    expect(listCalls).toEqual([['run-many', 'production', 'production-push-deploy-target']]);
     expect(nxCalls).toHaveLength(1);
     expect(nxCalls[0]).toContain('--projects=website');
     expect(nxCalls[0]).toContain('--stage=production');
@@ -1193,6 +1193,90 @@ describe('event-aware stage deployment', () => {
 
     expect(statuses).toEqual(['pending', 'success']);
   });
+
+  it('deploys the whole selection in one run-many, leaving the order to the graph', async () => {
+    const nxCalls: string[][] = [];
+    await githubCiNxDeploy(
+      '/repo',
+      { stage: 'staging' },
+      {
+        processEnv: {},
+        setStatus: async () => {},
+        listProjects: async () => ['app-backend', 'website'],
+        runNx: async (args) => {
+          nxCalls.push(args);
+          return 0;
+        },
+      },
+    );
+    expect(nxCalls.map((args) => args.find((arg) => arg.startsWith('--projects=')))).toEqual([
+      '--projects=app-backend,website',
+    ]);
+    expect(nxCalls[0]).toContain('--stage=staging');
+  });
+
+  it('publishes nothing when the deploy fails', async () => {
+    const statuses: string[] = [];
+    const summaries: string[] = [];
+    const deployments: Array<[string, string]> = [];
+    const outputs: string[] = [];
+    await expect(
+      githubCiNxDeploy(
+        '/repo',
+        { mode: 'run-many' },
+        {
+          processEnv: { GITHUB_EVENT_NAME: 'pull_request', GITHUB_OUTPUT: '/output', GITHUB_STEP_SUMMARY: '/summary' },
+          github: { previewUrls: ['https://app.{stage}.example.com'] },
+          eventPayload: {
+            action: 'opened',
+            repository: { full_name: 'owner/repo' },
+            pull_request: { number: 12, head: { repo: { full_name: 'owner/repo' } } },
+          },
+          setStatus: async (status) => {
+            statuses.push(status);
+          },
+          listProjects: async () => ['app-backend', 'website'],
+          runNx: async () => 1,
+          appendSummary: async (_path, content) => {
+            summaries.push(content);
+          },
+          appendOutput: async (_path, content) => {
+            outputs.push(content);
+          },
+          publishDeployment: async (stage, url) => {
+            deployments.push([stage, url]);
+          },
+        },
+      ),
+    ).rejects.toThrow(/--projects=app-backend,website .*failed with exit code 1/);
+    expect(statuses).toEqual(['pending', 'failure']);
+    expect(outputs).toEqual([]);
+    expect(summaries).toEqual([]);
+    expect(deployments).toEqual([]);
+  });
+
+  it('verifies and deploys the whole selection with one run-many each', async () => {
+    const nxCalls: string[][] = [];
+    await githubCiNxDeploy(
+      '/repo',
+      { stage: 'production', verify: true },
+      {
+        processEnv: {},
+        setStatus: async () => {},
+        listProjects: async () => ['app-backend', 'website'],
+        runNx: async (args) => {
+          nxCalls.push(args);
+          return 0;
+        },
+      },
+    );
+    expect(nxCalls.map((args) => `${args[2]} ${args[3]}`)).toEqual([
+      'build --projects=app-backend,website',
+      'lint --projects=app-backend,website',
+      'test --projects=app-backend,website',
+      'deploy --projects=app-backend,website',
+    ]);
+  });
 });
 
 describe('resolveDeploymentStage with a configured push branch', () => {

package/src/github-ci/index.ts

@@ -338,7 +338,6 @@ export interface GithubCiNxDeployOptions {
 export interface GithubCiNxDeployDependencies {
   listProjects?: (
     root: string,
-    target: string,
     mode: 'affected' | 'run-many',
     stage: DeploymentStage,
     selectTag?: string,
@@ -371,9 +370,9 @@ export async function githubCiNxDeploy(
     ((state: 'pending' | 'success' | 'failure') =>
       state === 'pending' ? createGithubStatus(name, step) : updateGithubStatus(name, state, step));
   const mode = resolveNxSmartMode(options.mode ?? 'run-many');
-  const listProjects = dependencies.listProjects ?? listNxProjectsWithTarget;
+  const listProjects = dependencies.listProjects ?? listNxDeployProjects;
   const runNx = dependencies.runNx ?? ((args: string[], commandRoot: string) => runStatus('nx', args, commandRoot));
-  const projects = await listProjects(root, 'deploy', mode, stage, options.selectTag);
+  const projects = await listProjects(root, mode, stage, options.selectTag);
   if (projects.length === 0) {
     console.log(`No ${mode} deploy projects; skipping ${stage}.`);
     await setStatus('pending');
@@ -387,8 +386,8 @@ export async function githubCiNxDeploy(
     : undefined;
   await setStatus('pending');
 
-  const projectList = projects.join(',');
   const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
+  const projectList = projects.join(',');
   for (const target of targets) {
     const nxArgs = [
       'run-many',
@@ -398,6 +397,8 @@ export async function githubCiNxDeploy(
       `--exclude=${deployExclusions(stage)}`,
       `--parallel=${NX_PARALLEL}`,
     ];
+    // Deploy ordering is a `dependsOn` edge in the project graph, not a second round here: one run-many
+    // already sequences any depth of `a:deploy -> b:deploy -> c:deploy`.
     if (target === 'deploy') {
       nxArgs.push(`--stage=${stage}`);
     }
@@ -540,22 +541,18 @@ function previewUrlFromTemplate(template: string, stage: string): string {
   return template.replaceAll('{stage}', stage);
 }
 
-async function listNxProjectsWithTarget(
+async function listNxDeployProjects(
   root: string,
-  target: string,
   mode: 'affected' | 'run-many',
   stage: DeploymentStage,
   selectTag?: string,
 ): Promise<string[]> {
   const listArgs = ['show', 'projects'];
   if (mode === 'affected') listArgs.push('--affected');
-  listArgs.push('--withTarget', target);
-  if (target === 'deploy') listArgs.push(`--exclude=${deployExclusions(stage)}`);
-  listArgs.push('--json');
+  listArgs.push('--withTarget', 'deploy', `--exclude=${deployExclusions(stage)}`, '--json');
   const candidates = nxProjectList(await runText('nx', listArgs, root)).sort((left, right) =>
     left.localeCompare(right),
   );
-  if (target !== 'deploy') return candidates;
   return selectStageDeployProjects(candidates, stage, selectTag, async (project) => {
     const parsed = parseNxProjectDeployTarget(await runText('nx', ['show', 'project', project, '--json'], root));
     if (!parsed) throw new Error(`nx show project ${project} returned invalid JSON.`);

package/src/lib/secret-names.ts

@@ -0,0 +1,70 @@
+/**
+ * One rule for naming the repository secret behind an environment variable, so
+ * the workflow renderer, the reconciler and an operator all derive the same
+ * name instead of maintaining a map.
+ *
+ * GitHub refuses to create a secret whose name starts with `GITHUB_` (hence
+ * `RepositorySecretName`'s pattern), which is why a Worker's
+ * `GITHUB_CLIENT_SECRET` cannot be stored under its own name. Prefixing with
+ * the repository owner is the workaround operators already reach for by hand
+ * (`ACME_GITHUB_CLIENT_SECRET` for `acme/app`); making it the convention means
+ * nothing has to declare it.
+ */
+
+/** Names GitHub reserves: it rejects `gh secret set GITHUB_*` outright. */
+export function isReservedRepositorySecretName(envName: string): boolean {
+  return /^GITHUB_/i.test(envName);
+}
+
+/**
+ * The repository secret an env name lives in. Identity for every name GitHub
+ * accepts; owner-prefixed for the reserved ones. `owner` comes from the
+ * repository URL, so a fork or a rename derives its own names rather than
+ * inheriting a hardcoded prefix.
+ */
+export function conventionalRepositorySecretName(envName: string, owner: string): string {
+  if (!isReservedRepositorySecretName(envName)) return envName;
+  const prefix = owner
+    .replace(/[^A-Za-z0-9]+/g, '_')
+    .replace(/^_+|_+$/g, '')
+    .toUpperCase();
+  if (prefix.length === 0) {
+    throw new Error(
+      `Cannot derive a repository secret name for ${envName}: GitHub reserves the GITHUB_ prefix and the repository owner is empty.`,
+    );
+  }
+  return `${prefix}_${envName}`;
+}
+
+/**
+ * Resolve the whole env -> secret mapping for a set of declared env names.
+ * Explicit entries win: an exception stays expressible, but a repository that
+ * follows the convention declares nothing.
+ */
+export function repositorySecretMapping(
+  envNames: readonly string[],
+  owner: string,
+  declared: Readonly<Record<string, string>> = {},
+): Record<string, string> {
+  const mapping: Record<string, string> = {};
+  for (const envName of [...envNames].sort((left, right) => left.localeCompare(right))) {
+    mapping[envName] = declared[envName] ?? conventionalRepositorySecretName(envName, owner);
+  }
+  for (const [envName, secretName] of Object.entries(declared)) {
+    mapping[envName] = secretName;
+  }
+  return mapping;
+}
+
+/**
+ * Repository owner from a repository URL — `acme` from
+ * `https://github.com/acme/app.git`, and the same for an ssh or forge
+ * URL. The owner is derived rather than configured so a fork or a rename
+ * carries its own prefix instead of inheriting one.
+ */
+export function repositoryOwnerFromUrl(url: string): string | null {
+  const withoutProtocol = url.replace(/^[a-z+]+:\/\//i, '').replace(/^git@/i, '');
+  const path = withoutProtocol.replace(/^[^/:]+[/:]/, '');
+  const owner = path.split('/')[0];
+  return owner && owner.length > 0 ? owner.replace(/\.git$/i, '') : null;
+}

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -6,6 +6,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { format } from 'prettier';
 import type { PackageCargoGitOrigin } from '../../lib/json.js';
 import {
   type CiWorkflowDefinitionOptions,
@@ -396,9 +397,9 @@ describe('CI workflow definition', () => {
     for (const sshOrigins of [
       [],
       // scp syntax is not a URL prefix git can rewrite from a Cargo pin.
-      ['forgejo@forge.example.net:axe/minigraf.git'],
+      ['forgejo@forge.example.net:acme/widgets.git'],
       // A path would rewrite one repository, not the forge.
-      ['ssh://forge.example.net:2223/axe/minigraf.git'],
+      ['ssh://forge.example.net:2223/acme/widgets.git'],
       // A password in a declared origin is a secret in package.json.
       ['ssh://forgejo:hunter2@forge.example.net:2223/'],
       ['https://git.example.net/'],
@@ -769,6 +770,30 @@ describe('renderCiWorkflowYaml with deploy configuration', () => {
     expect(productionJob).not.toContain('needs.e2e-deployment');
   });
 
+  it('renders a production job the repository Prettier config keeps byte for byte', async () => {
+    const withoutE2e = renderCiWorkflowYaml(
+      options({ deploy: true, deployProvider: 'cloudflare', pushBranches: ['trunk'], productionOnPush: true }),
+    );
+    for (const workflow of [rendered, withoutE2e]) {
+      const productionJob = workflow.slice(workflow.indexOf('  deploy-production:'));
+      expect(productionJob).toContain('    # prettier-ignore\n    if: ${{ !cancelled() ');
+      expect(productionJob).toContain(
+        '        # prettier-ignore\n        run: smoo github-ci nx-deploy --stage production ',
+      );
+      // A consuming repo's commit hook formats staged YAML with Prettier; a rewrapped line reads as drift forever.
+      await expect(
+        format(workflow, { parser: 'yaml', printWidth: 120, proseWrap: 'always', singleQuote: true }),
+      ).resolves.toBe(workflow);
+    }
+  });
+
+  it('cancels superseded pushes when the workflow has no deploy job to protect', () => {
+    const validateOnly = renderCiWorkflowYaml(options());
+
+    expect(validateOnly).toContain('cancel-in-progress: true');
+    expect(validateOnly).not.toContain("cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}");
+  });
+
   it('keeps a protected staging environment off CI runs that do not deploy', () => {
     const validateOnly = renderCiWorkflowYaml(options({ environments: { staging: 'staging' } }));
 

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -103,13 +103,13 @@ describe('publish workflow definition', () => {
 
   it('a private forge release with cross-built Apple targets publishes from one job', () => {
     const rendered = renderPublishWorkflowYaml({
-      repoName: 'axe.sc/axe',
+      repoName: 'acme/app',
       actionsProvider: 'forgejo',
       runsOn: ['nixos-latest-x64', 'self-hosted'],
       platformTargetGlobs: ['*-macos', '*-linux'],
       macosPlatformArchitectures: ['arm64'],
       platformProducer: { kind: 'linux-cross', preflight: 'sh scripts/prepare-macos-sdk.sh', env: { AXE_CROSS: '1' } },
-      privateNpm: { scope: '@axe.sc', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
+      privateNpm: { scope: '@acme', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
     });
 
     // One job: no producer job to hand outputs over from, so no transfer at all.
@@ -202,18 +202,18 @@ describe('publish workflow definition', () => {
     );
     const finalJob = platform.slice(platform.indexOf('  publish-on-linux:'));
 
-    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 16 }, (_, index) => index + 1));
-    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 17 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 20 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 10 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
-    expect(singleJob).toContain('# Step 14\n      - name: 🏷️ Tag release');
-    expect(singleJob).toContain('# Step 15\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
-    expect(singleJob).toContain('# Step 16\n      - name: 🧹 Cleanup and cache Nix/devenv');
-    expect(linuxCandidate).toContain('# Step 7\n      - name: 🔒 Capture candidate release SHA');
+    expect(singleJob).toContain('# Step 15\n      - name: 🏷️ Tag release');
+    expect(singleJob).toContain('# Step 16\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
+    expect(singleJob).toContain('# Step 17\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 11\n      - name: 🔒 Capture candidate release SHA');
     expect(linuxCandidate).toContain(
-      '# Step 8\n      - name: ✅ Check managed monorepo files (${{ steps.version.outputs.mode }})',
+      '# Step 7\n      - name: ✅ Check managed monorepo files (${{ steps.plan.outputs.mode }})',
     );
-    expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 20\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(macosPlatform).toContain('# Step 6\n      - name: 🔢 Version release');
     expect(macosPlatform).toContain('# Step 7\n      - name: 🍎 Build selected macOS and iOS release outputs');
     expect(macosPlatform).toContain('# Step 10\n      - name: 🧹 Cleanup and cache Nix/devenv');
@@ -311,14 +311,22 @@ describe('publish workflow definition', () => {
     expect(singleJob.match(/- name: 🏷️ Tag release/g)).toHaveLength(1);
     expect(singleJob).toContain('        run: smoo release tag --dry-run "${{ inputs.dry_run }}"');
     expect(singleJob.indexOf('- name: 🧯 Repair pending releases')).toBeLessThan(
-      singleJob.indexOf('- name: 🔢 Version release'),
+      singleJob.indexOf('- name: 🧭 Plan release'),
     );
+    // Lint and test hash the source, so they run BEFORE the version commit and
+    // reuse the task hashes ci already computed. Build stays after it: an
+    // artifact built from pre-bump sources would carry the previous version.
+    expect(singleJob.indexOf('- name: 🧭 Plan release')).toBeLessThan(singleJob.indexOf('- name: 🔍 Lint'));
+    expect(singleJob.indexOf('- name: 🧪 Unit Tests')).toBeLessThan(singleJob.indexOf('- name: 🔢 Version release'));
     expect(singleJob.indexOf('- name: 🔢 Version release')).toBeLessThan(singleJob.indexOf('- name: 🔨 Build'));
-    expect(singleJob.indexOf('- name: 🧪 Unit Tests')).toBeLessThan(singleJob.indexOf('- name: 🏷️ Tag release'));
+    expect(singleJob.indexOf('- name: 🔨 Build')).toBeLessThan(singleJob.indexOf('- name: 🏷️ Tag release'));
+    // The gates select from the plan, not from a version step that has not run.
+    expect(singleJob).toContain('--targets lint --projects "${{ steps.plan.outputs.projects }}"');
+    expect(singleJob).toContain("if: steps.plan.outputs.mode != 'none'");
     expect(singleJob.indexOf('- name: 🏷️ Tag release')).toBeLessThan(singleJob.indexOf('- name: 📦 Publish release'));
     // The Release section starts at tagging now, not at publishing.
     expect(singleJob).toContain(
-      '# --- Release ------------------------------------------------------------\n\n      # Step 14\n      - name: 🏷️ Tag release',
+      '# --- Release ------------------------------------------------------------\n\n      # Step 15\n      - name: 🏷️ Tag release',
     );
   });
 
@@ -919,6 +927,8 @@ class WorkflowScenarioState {
     tests: [],
     validates: 0,
   };
+  planned = false;
+  gatesBeforeVersion: { lints: string[]; tests: string[] } = { lints: [], tests: [] };
 
   constructor(private readonly config: WorkflowScenarioConfig) {
     for (const gap of [...config.repairs, ...config.current]) {
@@ -960,8 +970,16 @@ class WorkflowScenarioState {
           this.repaired.add(gap.tag);
         }
       },
+      planRelease: async ({ bump }) => {
+        // The plan runs before anything is written, and the gates that follow
+        // it must therefore have seen no version commit yet.
+        this.planned = true;
+        expect(bump).toBe(this.config.bump);
+        return this.config.version;
+      },
       versionRelease: async ({ bump, dryRun }) => {
         this.versionObservedNxVersionActions = this.nxVersionActions;
+        this.gatesBeforeVersion = { lints: [...this.validationState.lints], tests: [...this.validationState.tests] };
         expect(bump).toBe(this.config.bump);
         expect(dryRun).toBe(this.config.dryRun);
         return this.config.version;
@@ -1271,8 +1289,8 @@ it('keeps job-local step anchors contiguous once Cargo credentials add a setup s
 
   // Each job gains exactly one step over the credential-free counts, and the
   // hand-numbered platform renderers must renumber with it.
-  expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 17 }, (_, index) => index + 1));
-  expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 20 }, (_, index) => index + 1));
+  expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 18 }, (_, index) => index + 1));
+  expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
   expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 11 }, (_, index) => index + 1));
   expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
 });

package/src/monorepo/ci-workflow.ts

@@ -156,12 +156,21 @@ permissions:
 ${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 concurrency:
-  # One in-flight run per ref. Pushes to the staging push branch queue behind a
-  # running workflow instead of canceling it, so a newer push never cancels a
-  # production deployment mid-flight. Pull requests and other branches keep
-  # canceling superseded runs.
+${
+  options.deploy
+    ? `  # One in-flight run per ref. Pushes to the staging push branch queue behind a
+  # running workflow instead of canceling it, so a newer push never cancels the
+  # deploy job mid-flight. Pull requests and other branches keep canceling
+  # superseded runs.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}`
+    : `  # This workflow validates and never deploys, so there is no in-flight
+  # deployment for a newer push to protect: every ref cancels its superseded
+  # runs. Queuing them instead serializes the staging branch, and a burst of
+  # pushes then reports the newest commit one full run per queued push late.
   group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}
+  cancel-in-progress: true`
+}
 
 defaults:
   run:
@@ -1025,6 +1034,7 @@ function renderProductionDeployJob(options: CiWorkflowDefinitionOptions): string
     needs: ${needs}
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 30
+    # prettier-ignore
     if: \${{ !cancelled() && github.event_name == 'push' && github.ref == ${stagingRefLiteral(options)} && needs.main.result == 'success'${e2eGate} }}
 ${environmentLine(options.environments?.production)}    env:
       GH_TOKEN: \${{ github.token }}
@@ -1032,7 +1042,8 @@ ${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(optio
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: 🚀 Deploy Production
-${renderOptionalLines(deployStepSecretEnvLines(options))}        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
+${renderOptionalLines(deployStepSecretEnvLines(options))}        # prettier-ignore
+        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
 
 ${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
 }

package/src/monorepo/managed-files.test.ts

@@ -578,7 +578,7 @@ describe('release platform families', () => {
   it('excluding every Apple family renders the single-job Linux publish shape', () => {
     const globs = releasePlatformTargetGlobsFor(['*-macos', '*-linux'], ['*-macos']);
     const rendered = renderPublishWorkflowYaml({
-      repoName: 'axe.sc/axe',
+      repoName: 'acme/app',
       platformTargetGlobs: globs,
       macosPlatformArchitectures: [],
       runsOn: ['nixos-latest-x64', 'self-hosted'],