@smoothbricks/cli 0.11.16 → 0.11.17

package/src/monorepo/publish-workflow.ts

@@ -49,6 +49,7 @@ const synchronizedPrettier = makeModuleSynchronized<typeof PrettierModule>(impor
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
 export type PublishWorkflowCondition =
+  | 'plan-mode-not-none'
   | 'version-mode-not-none'
   | 'deploy-production'
   | 'deploy-production-standalone'
@@ -65,6 +66,7 @@ export enum PublishWorkflowStepKind {
   ConfigureReleaseAuthor = 'configure-release-author',
   BuildNxVersionActions = 'build-nx-version-actions',
   RepairPendingReleases = 'repair-pending-releases',
+  PlanRelease = 'plan-release',
   VersionRelease = 'version-release',
   CheckManagedMonorepoFiles = 'check-managed-monorepo-files',
   Build = 'build',
@@ -159,6 +161,12 @@ export interface PublishWorkflowCallbacks {
   buildNxVersionActions(): Promise<void>;
   repairPendingReleases(input: { dryRun: boolean }): Promise<void>;
   versionRelease(input: { bump: PublishWorkflowBump; dryRun: boolean }): Promise<PublishWorkflowVersionOutputs>;
+  /**
+   * The selection the bump WILL make, computed without writing anything, so the
+   * gates that run before the version commit know what to run over. Defaults to
+   * a dry-run `versionRelease` when a caller supplies none.
+   */
+  planRelease?(input: { bump: PublishWorkflowBump }): Promise<PublishWorkflowVersionOutputs>;
   checkManagedMonorepoFiles(): Promise<void>;
   nxRunMany(input: { target: PublishWorkflowNxTarget; projects: string[] }): Promise<void>;
   uploadTraceDbs(): Promise<void>;
@@ -183,6 +191,9 @@ type PublishWorkflowStepInput = Omit<PublishWorkflowStep, 'number'>;
 
 export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions = {}): PublishWorkflowDefinition {
   const versionMode = githubExpression('steps.version.outputs.mode');
+  // Steps that run before the bump must label themselves from the plan: the
+  // version step's outputs do not exist yet, so the interpolation renders empty.
+  const planMode = githubExpression('steps.plan.outputs.mode');
   if (options.release === false) {
     return { steps: defineDeployOnlyWorkflowSteps(options) };
   }
@@ -224,30 +235,37 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
         kind: PublishWorkflowStepKind.RepairPendingReleases,
         name: '🧯 Repair pending releases',
       },
-      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      // Plan first, gate second, bump third. Lint and test hash the source, so
+      // running them BEFORE the version commit means their task hashes match
+      // the ones ci already computed for the same source — the publish reuses
+      // that cache instead of re-running 189 tasks. Build stays after the bump
+      // on purpose: an artifact built from pre-bump sources would ship the
+      // previous version string.
+      { kind: PublishWorkflowStepKind.PlanRelease, name: '🧭 Plan release', id: 'plan' },
       {
         kind: PublishWorkflowStepKind.CheckManagedMonorepoFiles,
-        name: `✅ Check managed monorepo files (${versionMode})`,
-        condition: 'version-mode-not-none',
-      },
-      {
-        kind: PublishWorkflowStepKind.Build,
-        name: `🔨 Build (${versionMode})`,
-        condition: 'version-mode-not-none',
-        nxTarget: 'build',
+        name: `✅ Check managed monorepo files (${planMode})`,
+        condition: 'plan-mode-not-none',
       },
       {
         kind: PublishWorkflowStepKind.Lint,
-        name: `🔍 Lint (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🔍 Lint (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'lint',
       },
       {
         kind: PublishWorkflowStepKind.UnitTests,
-        name: `🧪 Unit Tests (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🧪 Unit Tests (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'test',
       },
+      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      {
+        kind: PublishWorkflowStepKind.Build,
+        name: `🔨 Build (${versionMode})`,
+        condition: 'version-mode-not-none',
+        nxTarget: 'build',
+      },
       { kind: PublishWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs', condition: 'failure' },
       {
         kind: PublishWorkflowStepKind.ValidateMonorepoConfig,
@@ -302,10 +320,11 @@ export async function runPublishWorkflow(
 ): Promise<PublishWorkflowRunResult> {
   let setupOutputs: PublishWorkflowSetupOutputs = { nixCacheHit: '', devenvCacheHit: '' };
   let version: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
+  let plan: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
   let failed = false;
   let failure: unknown;
   for (const step of workflow.steps) {
-    if (!shouldRunStep(step, version, failed, context.inputs)) {
+    if (!shouldRunStep(step, version, failed, context.inputs, plan)) {
       continue;
     }
     try {
@@ -331,6 +350,11 @@ export async function runPublishWorkflow(
             dryRun: context.inputs.dryRun,
           });
           break;
+        case PublishWorkflowStepKind.PlanRelease:
+          plan = context.callbacks.planRelease
+            ? await context.callbacks.planRelease({ bump: context.inputs.bump })
+            : await context.callbacks.versionRelease({ bump: context.inputs.bump, dryRun: true });
+          break;
         case PublishWorkflowStepKind.VersionRelease:
           version = await context.callbacks.versionRelease(context.inputs);
           break;
@@ -343,7 +367,12 @@ export async function runPublishWorkflow(
           if (!step.nxTarget) {
             throw new Error(`Workflow step ${step.kind} is missing an Nx target.`);
           }
-          await context.callbacks.nxRunMany({ target: step.nxTarget, projects: version.projects });
+          // Lint and test run before the bump exists, so they select from the
+          // plan; build runs after it and selects from the written version.
+          await context.callbacks.nxRunMany({
+            target: step.nxTarget,
+            projects: step.kind === PublishWorkflowStepKind.Build ? version.projects : plan.projects,
+          });
           break;
         case PublishWorkflowStepKind.UploadTraceDbs:
           await context.callbacks.uploadTraceDbs();
@@ -383,7 +412,11 @@ function shouldRunStep(
   version: PublishWorkflowVersionOutputs,
   failed: boolean,
   inputs: PublishWorkflowInputs,
+  plan: PublishWorkflowVersionOutputs = version,
 ): boolean {
+  if (step.condition === 'plan-mode-not-none') {
+    return plan.mode !== 'none';
+  }
   if (step.condition === 'version-mode-not-none') {
     return version.mode !== 'none';
   }
@@ -581,6 +614,16 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         ...privateNpmPublisherStepEnv(options),
         `        run: smoo release repair-pending --dry-run "${githubExpression('inputs.dry_run')}"`,
       ];
+    case PublishWorkflowStepKind.PlanRelease:
+      // The same selection the bump will make, computed without writing: the
+      // gates need `mode` and `projects` before any version commit exists.
+      return [
+        `      - name: ${step.name}`,
+        '        id: plan',
+        '        run:',
+        `          smoo release version --bump "${githubExpression('inputs.bump')}" --projects "${githubExpression('inputs.projects')}" --dry-run "true" --github-output`,
+        '          "$GITHUB_OUTPUT"',
+      ];
     case PublishWorkflowStepKind.VersionRelease:
       return [
         `      - name: ${step.name}`,
@@ -601,12 +644,12 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
     case PublishWorkflowStepKind.Lint:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UnitTests:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UploadTraceDbs:
       return artifactStepLines(
@@ -695,8 +738,11 @@ function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflo
 }
 
 function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
-  const condition = "steps.version.outputs.mode != 'none'";
-  return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
+  // A step gated on the plan must read the PLAN's mode: it runs before the
+  // version step exists, and `steps.version.outputs.mode` is empty there, which
+  // silently skips the gate rather than running it.
+  const source = step.condition === 'plan-mode-not-none' ? 'plan' : 'version';
+  return [`      - name: ${step.name}`, `        if: steps.${source}.outputs.mode != 'none'`, `        run: ${run}`];
 }
 
 function siblingSourceCheckoutStepLines(options: PublishWorkflowDefinitionOptions): string[] {

package/src/monorepo/secret-references.test.ts

@@ -206,7 +206,7 @@ describe('registryAuthEnvNames', () => {
 
   it('collects ${VAR} references from .npmrc text', async () => {
     expect(
-      await names('@axe.sc:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
+      await names('@acme:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
     ).toEqual(['SMOO_READ_TOKEN']);
   });
 

package/src/release/__tests__/private-npm-status.test.ts

@@ -434,8 +434,8 @@ describe('private npm published-version status', () => {
   });
 
   it('reads through a repository .npmrc whose own auth line names an unset env', async () => {
-    // The shape that cost a day: AxE commits
-    // `//host/path:_authToken=${AXE_NPM_PUBLISH_TOKEN}` at the workspace root.
+    // The shape that cost a day: a repository commits
+    // `//host/path:_authToken=${NPM_PUBLISH_TOKEN}` at the workspace root.
     // npm ranks that project file ABOVE the userconfig this CLI writes, so with
     // the publish env unset it sent the unexpanded value and the registry
     // answered 401 — with a perfectly good read credential in hand.

package/src/secrets/commands.ts

@@ -0,0 +1,210 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ */
+
+import { spawn, spawnSync } from 'node:child_process';
+import { getWorkspacePackages } from '../lib/workspace.js';
+import {
+  fetchLocalSecret,
+  localSecretCommandNames,
+  reconcileSecrets,
+  type SecretRow,
+  secretNameMapping,
+  unsatisfiedSecrets,
+  unwiredSecrets,
+  workerSecretNames,
+  workflowSecretNames,
+} from './index.js';
+
+/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
+export function readRepositorySecrets(
+  repo: string | undefined,
+): { ok: true; names: string[] } | { ok: false; reason: string } {
+  const args = ['secret', 'list', '--json', 'name'];
+  if (repo) args.push('--repo', repo);
+  const result = spawnSync('gh', args, { encoding: 'utf8' });
+  if (result.status !== 0) {
+    return {
+      ok: false,
+      reason: `gh ${args.join(' ')} exited ${result.status ?? 'without status'}: ${result.stderr.trim()}`,
+    };
+  }
+  const parsed: unknown = JSON.parse(result.stdout);
+  if (!Array.isArray(parsed)) {
+    return { ok: false, reason: 'gh secret list did not return a list' };
+  }
+  const names: string[] = [];
+  for (const row of parsed) {
+    if (typeof row !== 'object' || row === null || !('name' in row)) continue;
+    // `in` narrows the property to unknown, so the typeof check below is the
+    // only thing that admits it — no assertion about gh's output shape.
+    const name: unknown = row.name;
+    if (typeof name === 'string') names.push(name);
+  }
+  return { ok: true, names: names.sort((left, right) => left.localeCompare(right)) };
+}
+
+/** Write one secret, value over stdin so it never reaches argv. */
+export async function writeRepositorySecret(
+  name: string,
+  value: string,
+  repo: string | undefined,
+): Promise<{ ok: true } | { ok: false; reason: string }> {
+  const args = ['secret', 'set', name];
+  if (repo) args.push('--repo', repo);
+  const child = spawn('gh', args, { stdio: ['pipe', 'inherit', 'inherit'] });
+  child.stdin.end(value);
+  const status = await new Promise<number | null>((resolvePromise) => {
+    child.on('close', (code) => resolvePromise(code));
+  });
+  return status === 0
+    ? { ok: true }
+    : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
+}
+
+function collectSources(root: string, repositorySecrets: readonly string[]) {
+  const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+  const workerSecrets = workerSecretNames(root, workspaceDirs);
+  const workflowSecrets = workflowSecretNames(root);
+  const localCommands = localSecretCommandNames(root);
+  const envNames = [
+    ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+  ];
+  return {
+    workerSecrets,
+    workflowSecrets,
+    secretNames: secretNameMapping(root, envNames),
+    localCommands,
+    repositorySecrets,
+  };
+}
+
+function describe(row: SecretRow): string {
+  const where = row.declaredByWorkers.length > 0 ? row.declaredByWorkers.join(', ') : '—';
+  return [
+    row.onRepository ? 'set ' : 'ABSENT',
+    row.name.padEnd(32),
+    row.suppliedByWorkflow ? 'workflow' : '        ',
+    row.fetchableLocally ? 'local' : '     ',
+    where,
+  ].join('  ');
+}
+
+/**
+ * Print every known secret with its sources. Exit code 1 when a workflow
+ * promises a value the repository does not hold — that combination is the one
+ * that fails a deploy, and it fails talking about the value rather than the
+ * missing secret.
+ */
+export function secretsStatus(root: string, options: { repo?: string }): number {
+  const repositorySecrets = readRepositorySecrets(options.repo);
+  if (!repositorySecrets.ok) {
+    console.error(repositorySecrets.reason);
+    return 1;
+  }
+  const rows = reconcileSecrets(collectSources(root, repositorySecrets.names));
+  console.log('state   name                              workflow  local  declared by');
+  for (const row of rows) console.log(describe(row));
+
+  const unsatisfied = unsatisfiedSecrets(rows);
+  const unwired = unwiredSecrets(rows);
+  if (unwired.length > 0) {
+    console.log('');
+    for (const row of unwired) {
+      console.log(
+        `note: ${row.name} is declared by ${row.declaredByWorkers.join(', ')} but no managed workflow passes it; ` +
+          'declare it in smoo.github.deploySecrets to have CI supply it.',
+      );
+    }
+  }
+  if (unsatisfied.length > 0) {
+    console.log('');
+    for (const row of unsatisfied) {
+      console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and the repository has no value.`);
+      console.error(
+        `         set it with: smoo secrets set ${row.name}${options.repo ? ` --repo ${options.repo}` : ''}`,
+      );
+    }
+    return 1;
+  }
+  return 0;
+}
+
+/** Read a value with echo disabled when stdin is a terminal; otherwise read piped input. */
+async function readSecretValue(prompt: string): Promise<string> {
+  if (!process.stdin.isTTY) {
+    const chunks: Buffer[] = [];
+    for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8').replace(/\n$/, '');
+  }
+  process.stderr.write(prompt);
+  process.stdin.setRawMode(true);
+  let value = '';
+  try {
+    for await (const chunk of process.stdin) {
+      const text = Buffer.from(chunk).toString('utf8');
+      if (text === '\r' || text === '\n' || text === '\u0004') break;
+      if (text === '\u0003') throw new Error('cancelled');
+      if (text === '\u007f') {
+        value = value.slice(0, -1);
+        continue;
+      }
+      value += text;
+    }
+  } finally {
+    process.stdin.setRawMode(false);
+    process.stderr.write('\n');
+  }
+  return value;
+}
+
+/** Set one secret from a pasted value. */
+export async function secretsSet(name: string, options: { repo?: string }): Promise<number> {
+  const value = await readSecretValue(`Value for ${name} (not echoed): `);
+  if (value.length === 0) {
+    console.error(`${name}: refusing to set an empty value.`);
+    return 1;
+  }
+  const written = await writeRepositorySecret(name, value, options.repo);
+  if (!written.ok) {
+    console.error(written.reason);
+    return 1;
+  }
+  console.log(`set     ${name}`);
+  return 0;
+}
+
+/**
+ * Push every locally fetchable secret to the repository. Only names
+ * `smoo.secrets` declares a command for: everything else has no source here
+ * and must be pasted with `smoo secrets set`.
+ */
+export async function secretsSync(root: string, options: { repo?: string }): Promise<number> {
+  const names = localSecretCommandNames(root);
+  if (names.length === 0) {
+    console.error('smoo.secrets declares no fetch commands; nothing to sync.');
+    return 1;
+  }
+  let failed = 0;
+  for (const name of names) {
+    const fetched = fetchLocalSecret(root, name);
+    if (!fetched.ok) {
+      console.error(`skip    ${name}: ${fetched.reason}`);
+      failed += 1;
+      continue;
+    }
+    const written = await writeRepositorySecret(name, fetched.value, options.repo);
+    if (!written.ok) {
+      console.error(`fail    ${name}: ${written.reason}`);
+      failed += 1;
+      continue;
+    }
+    console.log(`set     ${name}`);
+  }
+  return failed === 0 ? 0 : 1;
+}

package/src/secrets/index.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it } from 'bun:test';
+import { repositorySecretMapping } from '../lib/secret-names.js';
+import { reconcileSecrets, unsatisfiedSecrets, unwiredSecrets } from './index.js';
+
+const sources = {
+  workerSecrets: {
+    'targets/billing': ['STRIPE_PUBLISHABLE_KEY', 'STRIPE_SECRET_KEY'],
+    'targets/mail': ['MAIL_CAPTURE_CONTROL_TOKEN'],
+  },
+  workflowSecrets: ['MAIL_CAPTURE_CONTROL_TOKEN', 'STRIPE_PUBLISHABLE_KEY', 'STRIPE_SECRET_KEY'],
+  localCommands: ['NPM_READ_TOKEN'],
+  secretNames: {
+    STRIPE_PUBLISHABLE_KEY: 'STRIPE_PUBLISHABLE_KEY',
+    STRIPE_SECRET_KEY: 'STRIPE_SECRET_KEY',
+    MAIL_CAPTURE_CONTROL_TOKEN: 'MAIL_CAPTURE_CONTROL_TOKEN',
+    NPM_READ_TOKEN: 'NPM_READ_TOKEN',
+  },
+  repositorySecrets: ['MAIL_CAPTURE_CONTROL_TOKEN', 'NPM_READ_TOKEN'],
+};
+
+describe('secret reconciliation', () => {
+  it('names the secret a workflow passes and the repository does not hold', () => {
+    // A preview stage refuses with `publishable_key_mismatch` when `ci.yml`
+    // passes `secrets.STRIPE_PUBLISHABLE_KEY` and the repository holds no such
+    // secret: the empty value reaches the payment library's validator, which
+    // talks about the key instead of the missing declaration.
+    const unsatisfied = unsatisfiedSecrets(reconcileSecrets(sources)).map((row) => row.name);
+
+    expect(unsatisfied).toEqual(['STRIPE_PUBLISHABLE_KEY', 'STRIPE_SECRET_KEY']);
+  });
+
+  it('keeps "declared but no workflow passes it" separate from "no value"', () => {
+    // The remedies differ: one is `smoo secrets set`, the other is a
+    // smoo.github.deploySecrets entry. Reporting them as one list sends an
+    // operator to the wrong fix.
+    const rows = reconcileSecrets({
+      ...sources,
+      workflowSecrets: ['MAIL_CAPTURE_CONTROL_TOKEN'],
+    });
+
+    expect(unwiredSecrets(rows).map((row) => row.name)).toEqual(['STRIPE_PUBLISHABLE_KEY', 'STRIPE_SECRET_KEY']);
+    expect(unsatisfiedSecrets(rows)).toEqual([]);
+  });
+
+  it('reports a repository secret no source declares, so a stale one is visible', () => {
+    const rows = reconcileSecrets({ ...sources, repositorySecrets: [...sources.repositorySecrets, 'RETIRED_TOKEN'] });
+    const retired = rows.find((row) => row.name === 'RETIRED_TOKEN');
+
+    expect(retired).toEqual({
+      name: 'RETIRED_TOKEN',
+      repositorySecret: 'RETIRED_TOKEN',
+      declaredByWorkers: [],
+      suppliedByWorkflow: false,
+      fetchableLocally: false,
+      onRepository: true,
+    });
+  });
+
+  it('attributes a shared secret to every worker that declares it', () => {
+    const rows = reconcileSecrets({
+      ...sources,
+      workerSecrets: { 'targets/a': ['SHARED'], 'targets/b': ['SHARED'] },
+    });
+
+    expect(rows.find((row) => row.name === 'SHARED')?.declaredByWorkers).toEqual(['targets/a', 'targets/b']);
+  });
+
+  it('reads a reserved env name from its owner-prefixed secret, with no declaration', () => {
+    // GitHub rejects `gh secret set GITHUB_*`, so the value cannot live under
+    // its own name. Operators write the owner-prefixed name by hand in the
+    // workflow; the convention derives exactly that from the repository owner.
+    const rows = reconcileSecrets({
+      workerSecrets: { 'targets/backend': ['GITHUB_CLIENT_SECRET'] },
+      workflowSecrets: ['GITHUB_CLIENT_SECRET'],
+      secretNames: repositorySecretMapping(['GITHUB_CLIENT_SECRET'], 'acme'),
+      localCommands: [],
+      repositorySecrets: ['ACME_GITHUB_CLIENT_SECRET'],
+    });
+
+    expect(rows).toEqual([
+      {
+        name: 'GITHUB_CLIENT_SECRET',
+        repositorySecret: 'ACME_GITHUB_CLIENT_SECRET',
+        declaredByWorkers: ['targets/backend'],
+        suppliedByWorkflow: true,
+        fetchableLocally: false,
+        onRepository: true,
+      },
+    ]);
+    expect(unsatisfiedSecrets(rows)).toEqual([]);
+  });
+});