@smoothbricks/cli 0.11.16 → 0.11.18

package/src/monorepo/publish-workflow.ts

@@ -49,6 +49,7 @@ const synchronizedPrettier = makeModuleSynchronized<typeof PrettierModule>(impor
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
 export type PublishWorkflowCondition =
+  | 'plan-mode-not-none'
   | 'version-mode-not-none'
   | 'deploy-production'
   | 'deploy-production-standalone'
@@ -65,6 +66,7 @@ export enum PublishWorkflowStepKind {
   ConfigureReleaseAuthor = 'configure-release-author',
   BuildNxVersionActions = 'build-nx-version-actions',
   RepairPendingReleases = 'repair-pending-releases',
+  PlanRelease = 'plan-release',
   VersionRelease = 'version-release',
   CheckManagedMonorepoFiles = 'check-managed-monorepo-files',
   Build = 'build',
@@ -159,6 +161,12 @@ export interface PublishWorkflowCallbacks {
   buildNxVersionActions(): Promise<void>;
   repairPendingReleases(input: { dryRun: boolean }): Promise<void>;
   versionRelease(input: { bump: PublishWorkflowBump; dryRun: boolean }): Promise<PublishWorkflowVersionOutputs>;
+  /**
+   * The selection the bump WILL make, computed without writing anything, so the
+   * gates that run before the version commit know what to run over. Defaults to
+   * a dry-run `versionRelease` when a caller supplies none.
+   */
+  planRelease?(input: { bump: PublishWorkflowBump }): Promise<PublishWorkflowVersionOutputs>;
   checkManagedMonorepoFiles(): Promise<void>;
   nxRunMany(input: { target: PublishWorkflowNxTarget; projects: string[] }): Promise<void>;
   uploadTraceDbs(): Promise<void>;
@@ -183,6 +191,9 @@ type PublishWorkflowStepInput = Omit<PublishWorkflowStep, 'number'>;
 
 export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions = {}): PublishWorkflowDefinition {
   const versionMode = githubExpression('steps.version.outputs.mode');
+  // Steps that run before the bump must label themselves from the plan: the
+  // version step's outputs do not exist yet, so the interpolation renders empty.
+  const planMode = githubExpression('steps.plan.outputs.mode');
   if (options.release === false) {
     return { steps: defineDeployOnlyWorkflowSteps(options) };
   }
@@ -224,30 +235,37 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
         kind: PublishWorkflowStepKind.RepairPendingReleases,
         name: '🧯 Repair pending releases',
       },
-      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      // Plan first, gate second, bump third. Lint and test hash the source, so
+      // running them BEFORE the version commit means their task hashes match
+      // the ones ci already computed for the same source — the publish reuses
+      // that cache instead of re-running 189 tasks. Build stays after the bump
+      // on purpose: an artifact built from pre-bump sources would ship the
+      // previous version string.
+      { kind: PublishWorkflowStepKind.PlanRelease, name: '🧭 Plan release', id: 'plan' },
       {
         kind: PublishWorkflowStepKind.CheckManagedMonorepoFiles,
-        name: `✅ Check managed monorepo files (${versionMode})`,
-        condition: 'version-mode-not-none',
-      },
-      {
-        kind: PublishWorkflowStepKind.Build,
-        name: `🔨 Build (${versionMode})`,
-        condition: 'version-mode-not-none',
-        nxTarget: 'build',
+        name: `✅ Check managed monorepo files (${planMode})`,
+        condition: 'plan-mode-not-none',
       },
       {
         kind: PublishWorkflowStepKind.Lint,
-        name: `🔍 Lint (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🔍 Lint (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'lint',
       },
       {
         kind: PublishWorkflowStepKind.UnitTests,
-        name: `🧪 Unit Tests (${versionMode})`,
-        condition: 'version-mode-not-none',
+        name: `🧪 Unit Tests (${planMode})`,
+        condition: 'plan-mode-not-none',
         nxTarget: 'test',
       },
+      { kind: PublishWorkflowStepKind.VersionRelease, name: '🔢 Version release', id: 'version' },
+      {
+        kind: PublishWorkflowStepKind.Build,
+        name: `🔨 Build (${versionMode})`,
+        condition: 'version-mode-not-none',
+        nxTarget: 'build',
+      },
       { kind: PublishWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs', condition: 'failure' },
       {
         kind: PublishWorkflowStepKind.ValidateMonorepoConfig,
@@ -302,10 +320,11 @@ export async function runPublishWorkflow(
 ): Promise<PublishWorkflowRunResult> {
   let setupOutputs: PublishWorkflowSetupOutputs = { nixCacheHit: '', devenvCacheHit: '' };
   let version: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
+  let plan: PublishWorkflowVersionOutputs = { mode: 'none', projects: [] };
   let failed = false;
   let failure: unknown;
   for (const step of workflow.steps) {
-    if (!shouldRunStep(step, version, failed, context.inputs)) {
+    if (!shouldRunStep(step, version, failed, context.inputs, plan)) {
       continue;
     }
     try {
@@ -331,6 +350,11 @@ export async function runPublishWorkflow(
             dryRun: context.inputs.dryRun,
           });
           break;
+        case PublishWorkflowStepKind.PlanRelease:
+          plan = context.callbacks.planRelease
+            ? await context.callbacks.planRelease({ bump: context.inputs.bump })
+            : await context.callbacks.versionRelease({ bump: context.inputs.bump, dryRun: true });
+          break;
         case PublishWorkflowStepKind.VersionRelease:
           version = await context.callbacks.versionRelease(context.inputs);
           break;
@@ -343,7 +367,12 @@ export async function runPublishWorkflow(
           if (!step.nxTarget) {
             throw new Error(`Workflow step ${step.kind} is missing an Nx target.`);
           }
-          await context.callbacks.nxRunMany({ target: step.nxTarget, projects: version.projects });
+          // Lint and test run before the bump exists, so they select from the
+          // plan; build runs after it and selects from the written version.
+          await context.callbacks.nxRunMany({
+            target: step.nxTarget,
+            projects: step.kind === PublishWorkflowStepKind.Build ? version.projects : plan.projects,
+          });
           break;
         case PublishWorkflowStepKind.UploadTraceDbs:
           await context.callbacks.uploadTraceDbs();
@@ -383,7 +412,11 @@ function shouldRunStep(
   version: PublishWorkflowVersionOutputs,
   failed: boolean,
   inputs: PublishWorkflowInputs,
+  plan: PublishWorkflowVersionOutputs = version,
 ): boolean {
+  if (step.condition === 'plan-mode-not-none') {
+    return plan.mode !== 'none';
+  }
   if (step.condition === 'version-mode-not-none') {
     return version.mode !== 'none';
   }
@@ -581,6 +614,16 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
         ...privateNpmPublisherStepEnv(options),
         `        run: smoo release repair-pending --dry-run "${githubExpression('inputs.dry_run')}"`,
       ];
+    case PublishWorkflowStepKind.PlanRelease:
+      // The same selection the bump will make, computed without writing: the
+      // gates need `mode` and `projects` before any version commit exists.
+      return [
+        `      - name: ${step.name}`,
+        '        id: plan',
+        '        run:',
+        `          smoo release version --bump "${githubExpression('inputs.bump')}" --projects "${githubExpression('inputs.projects')}" --dry-run "true" --github-output`,
+        '          "$GITHUB_OUTPUT"',
+      ];
     case PublishWorkflowStepKind.VersionRelease:
       return [
         `      - name: ${step.name}`,
@@ -601,12 +644,12 @@ function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDef
     case PublishWorkflowStepKind.Lint:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets lint --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UnitTests:
       return conditionalRunStep(
         step,
-        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.version.outputs.projects')}"`,
+        `smoo github-ci nx-run-many --targets test --projects "${githubExpression('steps.plan.outputs.projects')}"`,
       );
     case PublishWorkflowStepKind.UploadTraceDbs:
       return artifactStepLines(
@@ -695,8 +738,11 @@ function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflo
 }
 
 function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
-  const condition = "steps.version.outputs.mode != 'none'";
-  return [`      - name: ${step.name}`, `        if: ${condition}`, `        run: ${run}`];
+  // A step gated on the plan must read the PLAN's mode: it runs before the
+  // version step exists, and `steps.version.outputs.mode` is empty there, which
+  // silently skips the gate rather than running it.
+  const source = step.condition === 'plan-mode-not-none' ? 'plan' : 'version';
+  return [`      - name: ${step.name}`, `        if: steps.${source}.outputs.mode != 'none'`, `        run: ${run}`];
 }
 
 function siblingSourceCheckoutStepLines(options: PublishWorkflowDefinitionOptions): string[] {

package/src/monorepo/secret-references.test.ts

@@ -206,7 +206,7 @@ describe('registryAuthEnvNames', () => {
 
   it('collects ${VAR} references from .npmrc text', async () => {
     expect(
-      await names('@axe.sc:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
+      await names('@acme:registry=https://npm.example.net\n//npm.example.net/:_authToken=${SMOO_READ_TOKEN}\n'),
     ).toEqual(['SMOO_READ_TOKEN']);
   });
 

package/src/release/__tests__/github-release.test.ts

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import type { ReleasePackageInfo } from '../core.js';
 import {
   createOrUpdateGithubRelease,
+  DEPENDENCY_ONLY_RELEASE_NOTES,
   type GithubReleaseWriteShell,
   githubReleaseLookupExists,
   nxProjectChangelogArgs,
@@ -63,10 +64,13 @@ describe('GitHub release helpers', () => {
     ).toBe('generated release notes');
   });
 
-  it('fails when Nx omits the requested project changelog', () => {
-    expect(() => projectChangelogContents({ projectChangelogs: {} }, 'pkg')).toThrow(
-      'Nx did not generate a project changelog for pkg.',
-    );
+  it('renders a dependency-only body when Nx generates no project changelog', () => {
+    // Nx bumps a project "because a dependency was bumped", and such a version
+    // carries no commits of its own — so no changelog is the correct output
+    // rather than a failure. Refusing here aborted a publish AFTER the new
+    // versions had been written to every manifest, leaving the release half
+    // done: one dependency-only package took down the whole run.
+    expect(projectChangelogContents({ projectChangelogs: {} }, 'pkg')).toBe(DEPENDENCY_ONLY_RELEASE_NOTES);
   });
 
   it('distinguishes missing releases from transient GitHub lookup failures', () => {

package/src/release/__tests__/private-npm-status.test.ts

@@ -434,8 +434,8 @@ describe('private npm published-version status', () => {
   });
 
   it('reads through a repository .npmrc whose own auth line names an unset env', async () => {
-    // The shape that cost a day: AxE commits
-    // `//host/path:_authToken=${AXE_NPM_PUBLISH_TOKEN}` at the workspace root.
+    // The shape that cost a day: a repository commits
+    // `//host/path:_authToken=${NPM_PUBLISH_TOKEN}` at the workspace root.
     // npm ranks that project file ABOVE the userconfig this CLI writes, so with
     // the publish env unset it sent the unexpanded value and the registry
     // answered 401 — with a perfectly good read credential in hand.

package/src/release/github-release.ts

@@ -80,12 +80,20 @@ export function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previousTag: str
   return previousTag ? { ...base, from: previousTag } : { ...base, firstRelease: true };
 }
 
+/**
+ * The release body for a version that carries no commits of its own.
+ *
+ * Nx bumps a project when a dependency it depends on was bumped, and reports
+ * that reason itself ("because a dependency was bumped"). Such a version has no
+ * commits touching the project, so Nx generates no changelog for it — which is
+ * correct, not a failure. Treating the absence as fatal made one dependency-only
+ * package abort a whole publish after the versions had already been written.
+ */
+export const DEPENDENCY_ONLY_RELEASE_NOTES =
+  '_No changelog entries for this package: this version was released because one of its dependencies was bumped._';
+
 export function projectChangelogContents(result: ProjectChangelogLookupResult, projectName: string): string {
-  const changelog = result.projectChangelogs?.[projectName];
-  if (!changelog) {
-    throw new Error(`Nx did not generate a project changelog for ${projectName}.`);
-  }
-  return changelog.contents;
+  return result.projectChangelogs?.[projectName]?.contents ?? DEPENDENCY_ONLY_RELEASE_NOTES;
 }
 
 export function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean {

package/src/release/index.ts

@@ -89,6 +89,7 @@ import {
 } from './core.js';
 import {
   createOrUpdateGithubRelease,
+  DEPENDENCY_ONLY_RELEASE_NOTES,
   githubReleaseLookupExists,
   importWorkspaceNx,
   renderNxProjectChangelogContents,
@@ -1596,10 +1597,9 @@ async function writeReleasePreviewSummary(
       lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
     }
     for (const pkg of previewPackages) {
-      const contents = releasePreviewChangelogs.get(pkg.projectName);
-      if (!contents) {
-        throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
-      }
+      // A dependency-only bump has no commits of its own, so Nx generates no
+      // changelog for it. The preview says so rather than refusing to render.
+      const contents = releasePreviewChangelogs.get(pkg.projectName) ?? DEPENDENCY_ONLY_RELEASE_NOTES;
       lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
     }
   }

package/src/secrets/commands.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'bun:test';
+import { secretsMissingInEnvironment } from './commands.js';
+import { reconcileSecrets } from './index.js';
+
+const sources = {
+  workerSecrets: { 'targets/billing': ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'] },
+  workflowSecrets: ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'],
+  localCommands: [],
+  secretNames: {
+    PAYMENTS_PUBLISHABLE_KEY: 'PAYMENTS_PUBLISHABLE_KEY',
+    PAYMENTS_SECRET_KEY: 'PAYMENTS_SECRET_KEY',
+  },
+  repositorySecrets: ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY', 'RETIRED_TOKEN'],
+  environmentSecrets: { production: ['PAYMENTS_PUBLISHABLE_KEY'] },
+};
+
+describe('what `smoo secrets set --env` walks', () => {
+  it('offers a name the repository holds and the environment does not, and no undeclared one', () => {
+    // Overriding one stage's credentials is the reason to write at environment
+    // scope: skipping names the repository already holds would leave a live
+    // value unsettable. RETIRED_TOKEN is absent from the environment too, but
+    // nothing declares it - prompting for it would ask an operator to copy a
+    // stale value forward.
+    const walked = secretsMissingInEnvironment(reconcileSecrets(sources), 'production');
+
+    expect(walked.map((row) => row.name)).toEqual(['PAYMENTS_SECRET_KEY']);
+  });
+});