@smoothbricks/cli 0.11.16 → 0.11.18

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -103,13 +103,13 @@ describe('publish workflow definition', () => {
 
   it('a private forge release with cross-built Apple targets publishes from one job', () => {
     const rendered = renderPublishWorkflowYaml({
-      repoName: 'axe.sc/axe',
+      repoName: 'acme/app',
       actionsProvider: 'forgejo',
       runsOn: ['nixos-latest-x64', 'self-hosted'],
       platformTargetGlobs: ['*-macos', '*-linux'],
       macosPlatformArchitectures: ['arm64'],
       platformProducer: { kind: 'linux-cross', preflight: 'sh scripts/prepare-macos-sdk.sh', env: { AXE_CROSS: '1' } },
-      privateNpm: { scope: '@axe.sc', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
+      privateNpm: { scope: '@acme', readTokenEnv: 'READ_ENV', publishTokenEnv: 'PUBLISH_ENV' },
     });
 
     // One job: no producer job to hand outputs over from, so no transfer at all.
@@ -202,18 +202,18 @@ describe('publish workflow definition', () => {
     );
     const finalJob = platform.slice(platform.indexOf('  publish-on-linux:'));
 
-    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 16 }, (_, index) => index + 1));
-    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 19 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 17 }, (_, index) => index + 1));
+    expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 20 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 10 }, (_, index) => index + 1));
     expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 14 }, (_, index) => index + 1));
-    expect(singleJob).toContain('# Step 14\n      - name: 🏷️ Tag release');
-    expect(singleJob).toContain('# Step 15\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
-    expect(singleJob).toContain('# Step 16\n      - name: 🧹 Cleanup and cache Nix/devenv');
-    expect(linuxCandidate).toContain('# Step 7\n      - name: 🔒 Capture candidate release SHA');
+    expect(singleJob).toContain('# Step 15\n      - name: 🏷️ Tag release');
+    expect(singleJob).toContain('# Step 16\n      - name: 📦 Publish release (${{ steps.version.outputs.mode }})');
+    expect(singleJob).toContain('# Step 17\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 11\n      - name: 🔒 Capture candidate release SHA');
     expect(linuxCandidate).toContain(
-      '# Step 8\n      - name: ✅ Check managed monorepo files (${{ steps.version.outputs.mode }})',
+      '# Step 7\n      - name: ✅ Check managed monorepo files (${{ steps.plan.outputs.mode }})',
     );
-    expect(linuxCandidate).toContain('# Step 19\n      - name: 🧹 Cleanup and cache Nix/devenv');
+    expect(linuxCandidate).toContain('# Step 20\n      - name: 🧹 Cleanup and cache Nix/devenv');
     expect(macosPlatform).toContain('# Step 6\n      - name: 🔢 Version release');
     expect(macosPlatform).toContain('# Step 7\n      - name: 🍎 Build selected macOS and iOS release outputs');
     expect(macosPlatform).toContain('# Step 10\n      - name: 🧹 Cleanup and cache Nix/devenv');
@@ -311,14 +311,22 @@ describe('publish workflow definition', () => {
     expect(singleJob.match(/- name: 🏷️ Tag release/g)).toHaveLength(1);
     expect(singleJob).toContain('        run: smoo release tag --dry-run "${{ inputs.dry_run }}"');
     expect(singleJob.indexOf('- name: 🧯 Repair pending releases')).toBeLessThan(
-      singleJob.indexOf('- name: 🔢 Version release'),
+      singleJob.indexOf('- name: 🧭 Plan release'),
     );
+    // Lint and test hash the source, so they run BEFORE the version commit and
+    // reuse the task hashes ci already computed. Build stays after it: an
+    // artifact built from pre-bump sources would carry the previous version.
+    expect(singleJob.indexOf('- name: 🧭 Plan release')).toBeLessThan(singleJob.indexOf('- name: 🔍 Lint'));
+    expect(singleJob.indexOf('- name: 🧪 Unit Tests')).toBeLessThan(singleJob.indexOf('- name: 🔢 Version release'));
     expect(singleJob.indexOf('- name: 🔢 Version release')).toBeLessThan(singleJob.indexOf('- name: 🔨 Build'));
-    expect(singleJob.indexOf('- name: 🧪 Unit Tests')).toBeLessThan(singleJob.indexOf('- name: 🏷️ Tag release'));
+    expect(singleJob.indexOf('- name: 🔨 Build')).toBeLessThan(singleJob.indexOf('- name: 🏷️ Tag release'));
+    // The gates select from the plan, not from a version step that has not run.
+    expect(singleJob).toContain('--targets lint --projects "${{ steps.plan.outputs.projects }}"');
+    expect(singleJob).toContain("if: steps.plan.outputs.mode != 'none'");
     expect(singleJob.indexOf('- name: 🏷️ Tag release')).toBeLessThan(singleJob.indexOf('- name: 📦 Publish release'));
     // The Release section starts at tagging now, not at publishing.
     expect(singleJob).toContain(
-      '# --- Release ------------------------------------------------------------\n\n      # Step 14\n      - name: 🏷️ Tag release',
+      '# --- Release ------------------------------------------------------------\n\n      # Step 15\n      - name: 🏷️ Tag release',
     );
   });
 
@@ -919,6 +927,8 @@ class WorkflowScenarioState {
     tests: [],
     validates: 0,
   };
+  planned = false;
+  gatesBeforeVersion: { lints: string[]; tests: string[] } = { lints: [], tests: [] };
 
   constructor(private readonly config: WorkflowScenarioConfig) {
     for (const gap of [...config.repairs, ...config.current]) {
@@ -960,8 +970,16 @@ class WorkflowScenarioState {
           this.repaired.add(gap.tag);
         }
       },
+      planRelease: async ({ bump }) => {
+        // The plan runs before anything is written, and the gates that follow
+        // it must therefore have seen no version commit yet.
+        this.planned = true;
+        expect(bump).toBe(this.config.bump);
+        return this.config.version;
+      },
       versionRelease: async ({ bump, dryRun }) => {
         this.versionObservedNxVersionActions = this.nxVersionActions;
+        this.gatesBeforeVersion = { lints: [...this.validationState.lints], tests: [...this.validationState.tests] };
         expect(bump).toBe(this.config.bump);
         expect(dryRun).toBe(this.config.dryRun);
         return this.config.version;
@@ -1271,8 +1289,8 @@ it('keeps job-local step anchors contiguous once Cargo credentials add a setup s
 
   // Each job gains exactly one step over the credential-free counts, and the
   // hand-numbered platform renderers must renumber with it.
-  expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 17 }, (_, index) => index + 1));
-  expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 20 }, (_, index) => index + 1));
+  expect(stepAnchorNumbers(singleJob)).toEqual(Array.from({ length: 18 }, (_, index) => index + 1));
+  expect(stepAnchorNumbers(linuxCandidate)).toEqual(Array.from({ length: 21 }, (_, index) => index + 1));
   expect(stepAnchorNumbers(macosPlatform)).toEqual(Array.from({ length: 11 }, (_, index) => index + 1));
   expect(stepAnchorNumbers(finalJob)).toEqual(Array.from({ length: 15 }, (_, index) => index + 1));
 });

package/src/monorepo/ci-workflow.ts

@@ -1,5 +1,10 @@
 /* biome-ignore-all lint/suspicious/noTemplateCurlyInString: GitHub Actions expressions are emitted literally. */
 
+import {
+  cargoCrossTestArchiveFile,
+  cargoCrossTestArchiveTargetName,
+  cargoCrossTestTargetName,
+} from '@smoothbricks/nx-plugin/cross-check-policy';
 import { PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
 import type {
   NonEmptyArray,
@@ -24,6 +29,11 @@ export enum CiWorkflowStepKind {
   BrowserTests = 'browser-tests',
   Lint = 'lint',
   UnitTests = 'unit-tests',
+  CrossToolchainPreflight = 'cross-toolchain-preflight',
+  CrossTestArchives = 'cross-test-archives',
+  UploadCrossTestArchives = 'upload-cross-test-archives',
+  DownloadCrossTestArchives = 'download-cross-test-archives',
+  CrossTests = 'cross-tests',
   ManagedFilesCheck = 'managed-files-check',
   ManagedFilesDispatch = 'managed-files-dispatch',
   Deploy = 'deploy',
@@ -51,6 +61,23 @@ export interface DeployStepSecretConfig {
   deploySecrets?: Record<string, string>;
 }
 
+/**
+ * One foreign target triple's test archive: what the Linux job cross-builds and
+ * a native runner executes.
+ *
+ * Both fields are DERIVED, never hand-written: the triple comes from the cargo
+ * workspace's `[workspace.metadata.smoothbricks.test] cross-targets`, and the
+ * path is where the inferred `cargo-cross-test-archive-<triple>` target
+ * declares its output. That is why this is not a `smoo.github` key — a triple
+ * repeated in CI config could name an archive the graph cannot build, and the
+ * workflow would only find out on the runner.
+ */
+export interface CiCrossTestArchive {
+  triple: string;
+  /** Repository-relative path of the archive file, from the target's output. */
+  path: string;
+}
+
 export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
   actionsProvider?: PackageSmooGithub['actionsProvider'];
   deploy: boolean;
@@ -92,6 +119,41 @@ export interface CiWorkflowDefinitionOptions extends DeployStepSecretConfig {
   e2eSecrets?: Record<string, string>;
   /** Emit the production-on-push job (some project carries PRODUCTION_PUSH_DEPLOY_TAG). */
   productionOnPush?: boolean;
+  /**
+   * Cross-built test archives, one per foreign target triple the cargo
+   * workspace declares. The Linux job builds and uploads each one; a second job
+   * downloads the `*-apple-darwin` ones and EXECUTES them on `macosRunsOn`,
+   * which is how a cross compile gets proved by running rather than by linking.
+   *
+   * Empty or absent renders exactly what a repository without cross archives
+   * renders — no step, no job, no numbering shift.
+   */
+  crossTestArchives?: readonly CiCrossTestArchive[];
+  /**
+   * macOS runner labels for the darwin execution job
+   * (`smoo.github.macosRunsOn`, the same labels the publish workflow's macOS
+   * legs use). Default macos-latest.
+   *
+   * A self-hosted label here is one specific machine. That machine being asleep
+   * does not skip the job: it queues, and the run FAILS on the job's
+   * `timeout-minutes`. That is the trade this opt-in buys — a red run when the
+   * Mac is unreachable, in exchange for the darwin binaries being tested by
+   * execution at all. `continue-on-error` would buy the green back by making
+   * the job unable to report anything, which is worse than not having it.
+   */
+  macosRunsOn?: string | string[];
+  /**
+   * Declared Linux cross-platform producer (`smoo.github.platformProducer`):
+   * the toolchain preflight and the environment a foreign-target build needs on
+   * a Linux runner. The publish workflow already renders this declaration for
+   * its cross artifact job, so the cross test archive reuses it rather than
+   * carrying a second copy of one repository's SDK and linker setup.
+   *
+   * Rendered STEP-scoped here, never as job env: this environment turns the
+   * repository's native producers into cross producers, and Validate's other
+   * steps are host builds that must stay host builds.
+   */
+  platformProducer?: PackageSmooGithub['platformProducer'];
 }
 
 type CiWorkflowStepInput = Omit<CiWorkflowStep, 'number'>;
@@ -117,6 +179,18 @@ export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkfl
     { kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' },
     { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' },
   );
+  if (options.crossTestArchives?.length) {
+    if (options.platformProducer !== undefined) {
+      steps.push({
+        kind: CiWorkflowStepKind.CrossToolchainPreflight,
+        name: 'Check cross-platform toolchain prerequisites',
+      });
+    }
+    steps.push(
+      { kind: CiWorkflowStepKind.CrossTestArchives, name: '🎯 Build cross-target test archives' },
+      { kind: CiWorkflowStepKind.UploadCrossTestArchives, name: '📤 Upload cross-target test archives' },
+    );
+  }
   if (options.browserTests) {
     steps.push({ kind: CiWorkflowStepKind.BrowserTests, name: '🌐 Browser Tests' });
   }
@@ -135,6 +209,7 @@ export function renderCiWorkflowYaml(options: CiWorkflowDefinitionOptions): stri
   return [
     renderCiWorkflowHeader(options),
     renderCiWorkflowSteps(steps, options),
+    renderCrossTestExecutionJob(options),
     renderE2eDeploymentJob(options),
     renderProductionDeployJob(options),
   ].join('');
@@ -156,12 +231,21 @@ permissions:
 ${options.deploy ? '  deployments: write\n' : ''}  statuses: write
 
 concurrency:
-  # One in-flight run per ref. Pushes to the staging push branch queue behind a
-  # running workflow instead of canceling it, so a newer push never cancels a
-  # production deployment mid-flight. Pull requests and other branches keep
-  # canceling superseded runs.
+${
+  options.deploy
+    ? `  # One in-flight run per ref. Pushes to the staging push branch queue behind a
+  # running workflow instead of canceling it, so a newer push never cancels the
+  # deploy job mid-flight. Pull requests and other branches keep canceling
+  # superseded runs.
   group: \${{ github.workflow }}-\${{ github.ref }}
-  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}
+  cancel-in-progress: \${{ github.ref != ${stagingRefLiteral(options)} }}`
+    : `  # This workflow validates and never deploys, so there is no in-flight
+  # deployment for a newer push to protect: every ref cancels its superseded
+  # runs. Queuing them instead serializes the staging branch, and a burst of
+  # pushes then reports the newest commit one full run per queued push late.
+  group: \${{ github.workflow }}-\${{ github.ref }}
+  cancel-in-progress: true`
+}
 
 defaults:
   run:
@@ -312,6 +396,61 @@ function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOpt
       return nxSmartStep(step, 'lint', 'Lint');
     case CiWorkflowStepKind.UnitTests:
       return nxSmartStep(step, 'test', 'Unit Tests');
+    case CiWorkflowStepKind.CrossToolchainPreflight:
+      // The repository's own preflight, the same one the publish workflow's
+      // cross artifact job runs — an SDK to provision, a linker to check.
+      // `working-directory: .` because this workflow's steps default to the
+      // direnv shell directory while a preflight is repository-relative.
+      return [
+        `      - name: ${step.name}`,
+        '        working-directory: .',
+        ...platformProducerStepEnvLines(options),
+        '        run: |',
+        '          set -euo pipefail',
+        ...crossToolchainPreflight(options).map((line) => `          ${line}`),
+      ];
+    case CiWorkflowStepKind.CrossTestArchives:
+      // Cross-COMPILES the workspace's test binaries for each declared foreign
+      // triple and packs them; runs nothing. `nx-run-many` rather than
+      // `nx-smart`, because an affected-graph selection would skip the archive
+      // on a commit that changed nothing Rust — and the sibling job that
+      // executes it has no way to build one.
+      return [
+        `      - name: ${step.name}`,
+        ...platformProducerStepEnvLines(options),
+        `        run: smoo github-ci nx-run-many --targets "${crossArchiveTargetNames(options).join(',')}"`,
+      ];
+    case CiWorkflowStepKind.UploadCrossTestArchives:
+      // retention-days: 1 — the only consumer is the sibling job in this same
+      // run, and these archives are the whole workspace's test binaries.
+      return artifactStepLines(options.actionsProvider, step.name, 'upload', [
+        `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+        'path: |',
+        ...crossTestArchives(options).map((archive) => `  ${archive.path}`),
+        // error, not ignore: a missing archive means the cross build silently
+        // produced nothing, and the execute job would then have nothing to run
+        // and no reason to say so.
+        'if-no-files-found: error',
+        'retention-days: 1',
+      ]);
+    case CiWorkflowStepKind.DownloadCrossTestArchives:
+      // Restores each archive at the path its own Nx target declares as output,
+      // which is where the runner target reads it from. upload-artifact roots
+      // the artifact at the least common ancestor of what it uploaded, so the
+      // download path is that shared directory.
+      return artifactStepLines(options.actionsProvider, step.name, 'download', [
+        `name: ${CROSS_TEST_ARCHIVE_ARTIFACT}`,
+        `path: ${crossTestArchiveDirectory(options)}`,
+      ]);
+    case CiWorkflowStepKind.CrossTests:
+      // EXECUTES, and that is all it can do: every one of these targets is
+      // `nextest run --archive-file`, which extracts prebuilt binaries into its
+      // own temporary directory. nextest never invokes cargo on this path
+      // (measured), so nothing here can compile even if a toolchain is present.
+      return [
+        `      - name: ${step.name}`,
+        `        run: smoo github-ci nx-run-many --targets "${darwinCrossTestTargetNames(options).join(',')}"`,
+      ];
     case CiWorkflowStepKind.ManagedFilesCheck:
       // The authoritative drift check is nearly free here (devenv is already
       // up). --warn never fails the job and publishes the step output
@@ -944,6 +1083,10 @@ function renderYamlList(values: string[], spaces: number): string {
  * is GitHub's automatic "Set up job"); every preflight the main job runs also
  * runs here before SetupDevenv, so the middle and cleanup anchors shift with
  * the configuration instead of baking a fixed step number.
+ *
+ * `middle` is the FIRST of the job's own steps. A job with more than one — the
+ * cross-test job downloads before it runs — passes how many it has, so the
+ * cleanup anchor stays the number of the step GitHub will actually report.
  */
 interface FollowUpStepNumbers {
   cargo: number | undefined;
@@ -953,12 +1096,13 @@ interface FollowUpStepNumbers {
   cleanup: number;
 }
 
-function followUpStepNumbers(options: CiWorkflowDefinitionOptions): FollowUpStepNumbers {
+function followUpStepNumbers(options: CiWorkflowDefinitionOptions, middleSteps = 1): FollowUpStepNumbers {
   let number = 3;
   const cargo = options.cargoCredentials !== undefined ? number++ : undefined;
   const sources = options.sourceCheckouts?.length ? number++ : undefined;
   const setup = number++;
-  const middle = number++;
+  const middle = number;
+  number += middleSteps;
   const cleanup = number++;
   return { cargo, sources, setup, middle, cleanup };
 }
@@ -985,6 +1129,146 @@ function followUpCleanupStep(numbers: FollowUpStepNumbers): CiWorkflowStep[] {
   return [{ kind: CiWorkflowStepKind.SaveNixDevenv, name: '🧹 Cleanup and cache Nix/devenv', number: numbers.cleanup }];
 }
 
+/**
+ * How long the darwin execution job may take, download included. Generous
+ * because the archive is the whole workspace's test binaries, and bounded
+ * because the runner behind `macosRunsOn` may be one person's laptop: an
+ * unreachable runner queues, and this number is when the run says so.
+ */
+const CROSS_TEST_JOB_TIMEOUT_MINUTES = 30;
+
+/** Rust names every Apple-desktop triple this way; iOS and simulator do not. */
+const DARWIN_TRIPLE_SUFFIX = '-apple-darwin';
+
+/** One artifact carrying every triple's archive, scoped to the run that built it. */
+const CROSS_TEST_ARCHIVE_ARTIFACT = `cross-test-archives-${githubExpression('github.run_id')}`;
+
+/**
+ * Executes the cross-built test binaries on a machine where they are native.
+ *
+ * This job COMPILES NOTHING, and cannot: its only Rust input is the archive the
+ * Validate job uploaded, and `nextest run --archive-file` extracts prebuilt
+ * binaries rather than invoking cargo (measured: zero cargo invocations). It
+ * needs the checkout for the workspace `--workspace-remap .` points at and for
+ * Nx to resolve the target, and setup-devenv for `nx` and `cargo-nextest`
+ * themselves — the repository's ordinary shell, not a cross toolchain, no SDK,
+ * no `rustup target add`.
+ *
+ * `needs: main` and a success gate rather than `!cancelled()`: an archive that
+ * was never uploaded cannot be executed, and a job that starts anyway would
+ * fail on a missing artifact and report it as a test failure.
+ *
+ * Only `*-apple-darwin` archives run here, because macOS runner labels are the
+ * only native runner this declaration names. A repository declaring some other
+ * foreign triple still gets its archive BUILT — which proves that triple
+ * compiles — and no execution job, which is the honest rendering of having
+ * nowhere to run it.
+ */
+function renderCrossTestExecutionJob(options: CiWorkflowDefinitionOptions): string {
+  const archives = darwinCrossTestArchives(options);
+  if (archives.length === 0) return '';
+  const numbers = followUpStepNumbers(options, 2);
+  const middleSteps: CiWorkflowStep[] = [
+    {
+      kind: CiWorkflowStepKind.DownloadCrossTestArchives,
+      name: '📥 Download cross-target test archives',
+      number: numbers.middle,
+    },
+    { kind: CiWorkflowStepKind.CrossTests, name: '🧪 Cross-Target Unit Tests', number: numbers.middle + 1 },
+  ];
+  return `
+  macos-cross-tests:
+    name: Unit Tests (${archives.map((archive) => archive.triple).join(', ')})
+    needs: main
+${options.macosRunsOn === undefined ? '    runs-on: macos-latest' : renderRunsOnLine(options.macosRunsOn)}
+    timeout-minutes: ${CROSS_TEST_JOB_TIMEOUT_MINUTES}
+    if: \${{ needs.main.result == 'success' }}
+    env:
+      GH_TOKEN: \${{ github.token }}
+${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(options.cargoCredentials)}${privateNpmReadTokenJobEnv(options)}    steps:
+${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
+${renderCiWorkflowSteps(middleSteps, options)}
+${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
+}
+
+/**
+ * The declared archives, checked against the naming the Nx graph would have
+ * produced. A path that is not `cargoCrossTestArchiveFile(triple)` under some
+ * project root cannot have come from that target, so it is refused here rather
+ * than uploaded as an artifact nothing on the other side can find.
+ */
+function crossTestArchives(options: CiWorkflowDefinitionOptions): CiCrossTestArchive[] {
+  return (options.crossTestArchives ?? []).map((archive) => {
+    const suffix = cargoCrossTestArchiveFile(archive.triple);
+    const path = archive.path.split('\\').join('/');
+    if (!/^[a-z0-9][a-z0-9._-]*$/.test(archive.triple)) {
+      throw new Error(`smoo cross test archive triple must be a target triple, got ${JSON.stringify(archive.triple)}`);
+    }
+    if (path !== suffix && !path.endsWith(`/${suffix}`)) {
+      throw new Error(
+        `smoo cross test archive for ${archive.triple} must be a repository-relative ${suffix}, got ${archive.path}`,
+      );
+    }
+    if (path.startsWith('/') || path.split('/').includes('..')) {
+      throw new Error(`smoo cross test archive path must stay inside the repository, got ${archive.path}`);
+    }
+    return { triple: archive.triple, path };
+  });
+}
+
+function crossArchiveTargetNames(options: CiWorkflowDefinitionOptions): string[] {
+  return crossTestArchives(options).map((archive) => cargoCrossTestArchiveTargetName(archive.triple));
+}
+
+/**
+ * The declared preflight, as lines. A declaration with nothing in it is a
+ * mechanism error, and it surfaces here at render time rather than as a step
+ * whose `run:` block is empty.
+ */
+function crossToolchainPreflight(options: CiWorkflowDefinitionOptions): string[] {
+  const preflight = options.platformProducer?.preflight ?? '';
+  if (preflight.trim().length === 0) {
+    throw new Error('smoo.github.platformProducer requires a nonempty toolchain preflight command.');
+  }
+  return preflight.split('\n');
+}
+
+/** The producer environment, step-scoped, quoted exactly as the publish workflow quotes it. */
+function platformProducerStepEnvLines(options: CiWorkflowDefinitionOptions): string[] {
+  const entries = Object.entries(options.platformProducer?.env ?? {});
+  if (entries.length === 0) return [];
+  return ['        env:', ...entries.map(([name, value]) => `          ${name}: ${JSON.stringify(value)}`)];
+}
+
+function darwinCrossTestArchives(options: CiWorkflowDefinitionOptions): CiCrossTestArchive[] {
+  return crossTestArchives(options).filter((archive) => archive.triple.endsWith(DARWIN_TRIPLE_SUFFIX));
+}
+
+function darwinCrossTestTargetNames(options: CiWorkflowDefinitionOptions): string[] {
+  return darwinCrossTestArchives(options).map((archive) => cargoCrossTestTargetName(archive.triple));
+}
+
+/**
+ * Where the download lands. upload-artifact roots an artifact at the least
+ * common ancestor of the files it uploaded, so every archive in one artifact
+ * has to share a parent directory for the restored layout to be the one the
+ * runner targets read — true for one cargo workspace, false the moment a
+ * second one also declares cross targets, which is refused here instead of
+ * silently restoring the archives one directory too high.
+ */
+function crossTestArchiveDirectory(options: CiWorkflowDefinitionOptions): string {
+  const directories = new Set(
+    darwinCrossTestArchives(options).map((archive) => archive.path.slice(0, archive.path.lastIndexOf('/') + 1) || './'),
+  );
+  if (directories.size > 1) {
+    throw new Error(
+      `smoo cross test archives must share one directory to travel as one artifact, got ${[...directories].join(', ')}`,
+    );
+  }
+  const [directory] = [...directories];
+  return (directory ?? './').replace(/\/$/, '');
+}
+
 function renderE2eDeploymentJob(options: CiWorkflowDefinitionOptions): string {
   if (!options.e2eDeployment) return '';
   const numbers = followUpStepNumbers(options);
@@ -1025,6 +1309,7 @@ function renderProductionDeployJob(options: CiWorkflowDefinitionOptions): string
     needs: ${needs}
 ${renderRunsOnLine(options.runsOn)}
     timeout-minutes: 30
+    # prettier-ignore
     if: \${{ !cancelled() && github.event_name == 'push' && github.ref == ${stagingRefLiteral(options)} && needs.main.result == 'success'${e2eGate} }}
 ${environmentLine(options.environments?.production)}    env:
       GH_TOKEN: \${{ github.token }}
@@ -1032,7 +1317,8 @@ ${remoteCacheJobEnvLines(options.remoteCache)}${cargoCredentialJobEnvLines(optio
 ${renderCiWorkflowSteps(followUpSetupSteps(options, numbers), options)}
       # Step ${numbers.middle}
       - name: 🚀 Deploy Production
-${renderOptionalLines(deployStepSecretEnvLines(options))}        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
+${renderOptionalLines(deployStepSecretEnvLines(options))}        # prettier-ignore
+        run: smoo github-ci nx-deploy --stage production --mode run-many --select-tag ${PRODUCTION_PUSH_DEPLOY_TAG} --name "Deploy Production" --step ${numbers.middle}
 
 ${renderCiWorkflowSteps(followUpCleanupStep(numbers), options)}`;
 }

package/src/monorepo/managed-files.test.ts

@@ -8,6 +8,7 @@ import fc from 'fast-check';
 import { type NxProjects, targetNamesFromProjects } from '../nx/index.js';
 import {
   anyProjectHasTagForTest,
+  crossTestArchivesForTest,
   DEVENV_MODULE_IMPORT,
   deployTargetInfoFromProjects,
   extractInlineLocalBlocksForTest,
@@ -205,6 +206,31 @@ describe('managed publish platform discovery', () => {
     expect(macosPlatformArchitecturesForTest(['simulator-arm64-ios', 'cli-arm64-macos'])).toEqual(['arm64']);
     expect(macosPlatformArchitecturesForTest(['build', 'cli-x64-linux', 'test'])).toEqual([]);
   });
+
+  it('reads cross-built archives out of the graph, at each project root', () => {
+    expect(
+      crossTestArchivesForTest({
+        '@acme/codebase': {
+          root: '.',
+          targets: { 'cargo-cross-test-archive-aarch64-apple-darwin': {}, 'cargo-test-archive': {}, test: {} },
+        },
+        'acme-embedded': {
+          root: 'packages/embedded',
+          targets: { 'cargo-cross-test-archive-thumbv7em-none-eabihf': {} },
+        },
+        'acme-web': { root: 'packages/web', targets: { build: {}, 'cargo-cross-test-aarch64-apple-darwin': {} } },
+      }),
+    ).toEqual([
+      { triple: 'aarch64-apple-darwin', path: 'target/nextest/archive-aarch64-apple-darwin.tar.zst' },
+      {
+        triple: 'thumbv7em-none-eabihf',
+        path: 'packages/embedded/target/nextest/archive-thumbv7em-none-eabihf.tar.zst',
+      },
+    ]);
+    // A repository with no cross declaration has no such target, so the CI
+    // renderer gets an empty list and renders the workflow it renders today.
+    expect(crossTestArchivesForTest({ '@acme/codebase': { root: '.', targets: { test: {} } } })).toEqual([]);
+  });
 });
 
 describe('managed devenv module import', () => {
@@ -461,6 +487,7 @@ const context = (overrides: Partial<ManagedFileContext>): ManagedFileContext =>
   platformTargetGlobs: [],
   releasePlatformTargetGlobs: [],
   macosPlatformArchitectures: [],
+  crossTestArchives: [],
   ...overrides,
 });
 
@@ -578,7 +605,7 @@ describe('release platform families', () => {
   it('excluding every Apple family renders the single-job Linux publish shape', () => {
     const globs = releasePlatformTargetGlobsFor(['*-macos', '*-linux'], ['*-macos']);
     const rendered = renderPublishWorkflowYaml({
-      repoName: 'axe.sc/axe',
+      repoName: 'acme/app',
       platformTargetGlobs: globs,
       macosPlatformArchitectures: [],
       runsOn: ['nixos-latest-x64', 'self-hosted'],

package/src/monorepo/managed-files.ts

@@ -1,6 +1,10 @@
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import {
+  cargoCrossTestArchiveFile,
+  cargoCrossTestTripleFromArchiveTarget,
+} from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
 import {
@@ -17,9 +21,15 @@ import {
   readValidatedPackageJson,
 } from '../lib/json.js';
 import { listReleasePackages, packageInfo } from '../lib/workspace.js';
-import { loadNxProjects, type NxProjects, targetNamesFromProjects } from '../nx/index.js';
+import {
+  loadNxProjects,
+  type NxProjects,
+  projectRootFromNxProjectJson,
+  targetNamesFromNxProjectJson,
+  targetNamesFromProjects,
+} from '../nx/index.js';
 import { resolvePrivateNpmWorkflowConfig } from '../release/private-npm.js';
-import { privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
+import { type CiCrossTestArchive, privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderRunsOnLine } from './github-runs-on.js';
 import { renderPrPreviewCleanupWorkflowYaml } from './pr-preview-cleanup-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -181,6 +191,12 @@ export interface ManagedFileContext {
   cargoCredentials?: PackageCargoCredentialsConfig;
   /** Declared self-hosted Nx remote cache from the root smoo config; absent means local caching only. */
   remoteCache?: PackageRemoteCacheConfig;
+  /**
+   * Cross-built test archives the graph can produce, one per foreign target
+   * triple the cargo workspace declares. Empty for a repository that declares
+   * none, which renders a CI workflow with no cross steps and no macOS job.
+   */
+  crossTestArchives: CiCrossTestArchive[];
 }
 
 interface DeployTargetInfo {
@@ -407,6 +423,9 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploySecrets: context.ciDeploySecrets,
         e2eSecrets: context.ciE2eSecrets,
         productionOnPush: context.hasProductionPushDeployTargets,
+        crossTestArchives: context.crossTestArchives,
+        macosRunsOn: context.macosRunsOn,
+        platformProducer: context.platformProducer,
       });
     }
     if (file.source === 'publish-workflow') {
@@ -503,6 +522,7 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
       ? macosPlatformArchitecturesForTest(targetNames)
       : [],
     privateNpm,
+    crossTestArchives: crossTestArchivesForTest(nxProjects),
   };
 }
 
@@ -510,6 +530,40 @@ export function hasExactTargetForTest(targetNames: Iterable<string>, target: str
   return [...targetNames].includes(target);
 }
 
+/**
+ * Test seam: the cross-built test archives this graph can produce, read back
+ * out of the inferred `cargo-cross-test-archive-<triple>` targets.
+ *
+ * Derived, not configured. The triple is declared exactly once — in the cargo
+ * workspace's own `[workspace.metadata.smoothbricks.test] cross-targets`, where
+ * a Rust target triple belongs — and both halves of the workflow are rendered
+ * from the targets that declaration produced. A second copy in `smoo.github`
+ * could name a triple the graph cannot build, and CI would discover that only
+ * on the runner.
+ *
+ * The path is the target's own output location, so the artifact the Linux job
+ * uploads and the file the macOS job's runner opens are the same string
+ * computed once.
+ */
+export function crossTestArchivesForTest(projects: NxProjects): CiCrossTestArchive[] {
+  const archives: CiCrossTestArchive[] = [];
+  for (const project of Object.values(projects)) {
+    const projectRoot = projectRootFromNxProjectJson(project);
+    for (const targetName of targetNamesFromNxProjectJson(project)) {
+      const triple = cargoCrossTestTripleFromArchiveTarget(targetName);
+      if (triple === null) {
+        continue;
+      }
+      const file = cargoCrossTestArchiveFile(triple);
+      archives.push({
+        triple,
+        path: projectRoot === undefined || projectRoot === '.' ? file : `${projectRoot}/${file}`,
+      });
+    }
+  }
+  return archives.sort((left, right) => left.triple.localeCompare(right.triple));
+}
+
 /**
  * The platform families the release workflow produces: the graph's families
  * minus the ones the repository excludes. Excluding a family the graph does not

package/src/monorepo/package-policy.test.ts

@@ -63,7 +63,7 @@ describe('root smoo monorepo policy', () => {
       const rootPackage = await readJson(join(root, 'package.json'));
       const nxJson = await readJson(join(root, 'nx.json'));
       expect(rootPackage.scripts).toEqual({
-        'check:linux': 'tooling/devenv --quiet -P linux-cross shell -- nx run-many -t cargo-lint-cross',
+        'check:linux': 'tooling/devenv -P linux-cross shell -- nx run-many -t cargo-lint-cross',
         clean: 'nx run-many -t clean; nx reset',
         'clean:node_modules':
           'rm -rf node_modules && find e* t* p* -type d -name node_modules -print0 | xargs -0 rm -rvf',