@smoothbricks/cli 0.11.17 → 0.11.18

package/src/secrets/index.ts

@@ -20,7 +20,7 @@
  */
 
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
 import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
@@ -39,6 +39,13 @@ export interface SecretRow {
   fetchableLocally: boolean;
   /** True when the repository holds a secret of this name. */
   onRepository: boolean;
+  /**
+   * GitHub Environments holding their own value for this name. A job bound to
+   * an environment reads that value in preference to the repository's, which
+   * is how one name carries test credentials on a preview stage and live ones
+   * in production.
+   */
+  heldByEnvironment: string[];
 }
 
 export interface SecretSources {
@@ -52,6 +59,8 @@ export interface SecretSources {
   localCommands: readonly string[];
   /** Repository secret names GitHub currently holds. */
   repositorySecrets: readonly string[];
+  /** Environment name -> secret names that environment holds. */
+  environmentSecrets?: Readonly<Record<string, readonly string[]>>;
 }
 
 /**
@@ -68,8 +77,14 @@ export function reconcileSecrets(sources: SecretSources): SecretRow[] {
   const carriesKnownEnvName = new Set(
     names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : [],
   );
-  for (const secret of sources.repositorySecrets) {
+  // A value only an environment holds is still a value: leaving it out of the
+  // rows is how an operator ends up hunting for a secret that is already set.
+  const addUndeclared = (secret: string): void => {
     if (!carriesKnownEnvName.has(secret)) names.add(secret);
+  };
+  for (const secret of sources.repositorySecrets) addUndeclared(secret);
+  for (const held of Object.values(sources.environmentSecrets ?? {})) {
+    for (const secret of held) addUndeclared(secret);
   }
   return [...names]
     .sort((left, right) => left.localeCompare(right))
@@ -83,6 +98,10 @@ export function reconcileSecrets(sources: SecretSources): SecretRow[] {
       suppliedByWorkflow: sources.workflowSecrets.includes(name),
       fetchableLocally: sources.localCommands.includes(name),
       onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+      heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
+        .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
+        .map(([environment]) => environment)
+        .sort((left, right) => left.localeCompare(right)),
     }));
 }
 
@@ -92,8 +111,22 @@ export function reconcileSecrets(sources: SecretSources): SecretRow[] {
  * separately from "declared but not wired into any workflow", because the
  * remedies differ — set a secret, versus declare it in `smoo.github`.
  */
-export function unsatisfiedSecrets(rows: readonly SecretRow[]): SecretRow[] {
-  return rows.filter((row) => row.suppliedByWorkflow && !row.onRepository);
+export function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments: readonly string[] = []): SecretRow[] {
+  return rows.filter((row) => {
+    if (!row.suppliedByWorkflow) return false;
+    if (row.onRepository) return false;
+    // With no environment bound, the repository is the only scope a job reads.
+    // With environments bound, each one can carry the value instead - so the
+    // name is satisfied only when every bound environment holds it.
+    if (boundEnvironments.length === 0) return true;
+    return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
+  });
+}
+
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[] {
+  if (row.onRepository) return [];
+  return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
 }
 
 /** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
@@ -122,6 +155,77 @@ export function workflowSecretNames(root: string): string[] {
   return [...names].sort((left, right) => left.localeCompare(right));
 }
 
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export function workflowEnvironments(root: string): string[] {
+  const directory = join(root, '.github', 'workflows');
+  if (!existsSync(directory)) return [];
+  const environments = new Set<string>();
+  for (const entry of readdirSync(directory)) {
+    if (!entry.endsWith('.yml') && !entry.endsWith('.yaml')) continue;
+    for (const bound of environmentBindings(readFileSync(join(directory, entry), 'utf8'))) {
+      environments.add(bound);
+    }
+  }
+  return [...environments].sort((left, right) => left.localeCompare(right));
+}
+
+/**
+ * The environments one workflow file binds, in both spellings GitHub accepts:
+ * `environment: staging`, and the block form whose `name:` sits under it when
+ * the job also records a deployment URL. Only a `name:` indented inside an
+ * `environment:` block is a binding - a workflow's, a job's and a step's are
+ * not, and reading those as environments would send an operator to set
+ * secrets in scopes that do not exist.
+ */
+function environmentBindings(text: string): string[] {
+  const lines = text.split('\n');
+  const bound: string[] = [];
+  for (let index = 0; index < lines.length; index += 1) {
+    const binding = /^(\s*)environment:(.*)$/.exec(lines[index] ?? '');
+    if (!binding) continue;
+    const indent = (binding[1] ?? '').length;
+    const value = binding[2] ?? '';
+    // Nothing but a comment after the colon is the block form; anything else
+    // is the value itself.
+    if (!/^\s*(?:#.*)?$/.test(value)) {
+      const name = literalEnvironmentName(value);
+      if (name !== null) bound.push(name);
+      continue;
+    }
+    for (let next = index + 1; next < lines.length; next += 1) {
+      const line = lines[next] ?? '';
+      const content = line.trimStart();
+      if (content.length === 0 || content.startsWith('#')) continue;
+      if (line.length - content.length <= indent) break;
+      const named = /^name:(.*)$/.exec(content);
+      if (!named) continue;
+      const name = literalEnvironmentName(named[1] ?? '');
+      if (name !== null) bound.push(name);
+      break;
+    }
+  }
+  return bound;
+}
+
+/**
+ * The fixed name a YAML value denotes, or null when it denotes no fixed scope:
+ * an expression is computed per run, and a flow mapping or a list is not a
+ * name. Names may contain spaces, which is why the renderer quotes them.
+ */
+function literalEnvironmentName(value: string): string | null {
+  const scalar = value.replace(/\s+#.*$/, '').trim();
+  if (scalar.length === 0 || scalar.includes('${{')) return null;
+  const unquoted = /^(['"])(.*)\1$/.exec(scalar)?.[2] ?? scalar;
+  return /^[A-Za-z0-9._-][A-Za-z0-9._ -]*$/.test(unquoted) ? unquoted : null;
+}
+
 /**
  * Env name -> repository secret for every name in play, following the naming
  * convention and honouring the declared exceptions a repository still needs.

package/src/secrets/repository.test.ts

@@ -0,0 +1,98 @@
+import { describe, expect, it } from 'bun:test';
+import { chooseRepository, repositorySlugFromUrl } from './repository.js';
+
+const mirror = new Map([
+  ['private-repo', 'https://github.com/acme/private.git'],
+  ['public-repo', 'https://github.com/acme/acme.git'],
+]);
+
+describe('secrets repository resolution', () => {
+  it("reads the repository from the current branch's upstream when several remotes exist", () => {
+    // `gh` refuses outright here ("multiple remotes detected"), which is the
+    // public/private mirror layout. The branch already records which side it
+    // pushes to, and that is the side holding its secrets.
+    const resolved = chooseRepository({ remotes: mirror, upstreamRemote: 'private-repo', requested: undefined });
+
+    expect(resolved).toEqual({
+      ok: true,
+      choice: { repo: 'acme/private', source: 'upstream of the current branch (private-repo)' },
+    });
+  });
+
+  it('accepts a remote name where an operator would type one', () => {
+    const resolved = chooseRepository({ remotes: mirror, upstreamRemote: null, requested: 'private-repo' });
+
+    expect(resolved).toEqual({ ok: true, choice: { repo: 'acme/private', source: 'remote private-repo' } });
+  });
+
+  it('uses the one remote that already carries this branch when nothing tracks it', () => {
+    // A branch pushed by explicit refspec has no upstream, which is how the
+    // mirror layout is driven; its remote-tracking ref still records where it
+    // went, and one carrier is an answer.
+    const resolved = chooseRepository({
+      remotes: mirror,
+      upstreamRemote: null,
+      remotesCarryingBranch: ['private-repo'],
+      branch: 'billing',
+      requested: undefined,
+    });
+
+    expect(resolved).toEqual({
+      ok: true,
+      choice: { repo: 'acme/private', source: 'the only remote carrying this branch (private-repo)' },
+    });
+  });
+
+  it('refuses when two remotes carry the branch, naming both', () => {
+    const resolved = chooseRepository({
+      remotes: mirror,
+      upstreamRemote: null,
+      remotesCarryingBranch: ['private-repo', 'public-repo'],
+      branch: 'main',
+      requested: undefined,
+    });
+
+    expect(resolved.ok).toBe(false);
+    if (resolved.ok) throw new Error('expected a refusal');
+    expect(resolved.reason).toContain('branch main has no upstream and no remote carries it');
+  });
+
+  it('names the candidates instead of guessing when nothing decides', () => {
+    const resolved = chooseRepository({ remotes: mirror, upstreamRemote: null, requested: undefined });
+
+    expect(resolved.ok).toBe(false);
+    if (resolved.ok) throw new Error('expected a refusal');
+    expect(resolved.reason).toContain('private-repo -> acme/private');
+    expect(resolved.reason).toContain('public-repo -> acme/acme');
+  });
+
+  it('refuses a name that is neither a remote nor a slug, listing the remotes', () => {
+    const resolved = chooseRepository({ remotes: mirror, upstreamRemote: null, requested: 'privaterepo' });
+
+    expect(resolved.ok).toBe(false);
+    if (resolved.ok) throw new Error('expected a refusal');
+    expect(resolved.reason).toContain('private-repo, public-repo');
+  });
+
+  it('falls back to origin, then to a sole remote', () => {
+    const withOrigin = new Map([...mirror, ['origin', 'git@github.com:acme/app.git']]);
+    expect(chooseRepository({ remotes: withOrigin, upstreamRemote: null, requested: undefined })).toEqual({
+      ok: true,
+      choice: { repo: 'acme/app', source: 'remote origin' },
+    });
+
+    const single = new Map([['forge', 'ssh://forge.example.net:2223/acme/widgets.git']]);
+    expect(chooseRepository({ remotes: single, upstreamRemote: null, requested: undefined })).toEqual({
+      ok: true,
+      choice: { repo: 'acme/widgets', source: 'the only remote (forge)' },
+    });
+  });
+
+  it('parses every remote URL form git writes', () => {
+    expect(repositorySlugFromUrl('https://github.com/acme/app.git')).toBe('acme/app');
+    expect(repositorySlugFromUrl('git@github.com:acme/app.git')).toBe('acme/app');
+    expect(repositorySlugFromUrl('ssh://git@forge.example.net:2223/acme/app')).toBe('acme/app');
+    expect(repositorySlugFromUrl('https://user:token@github.com/acme/app')).toBe('acme/app');
+    expect(repositorySlugFromUrl('/srv/git/bare.git')).toBeNull();
+  });
+});

package/src/secrets/repository.ts

@@ -0,0 +1,164 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+
+import { spawnSync } from 'node:child_process';
+
+export interface RepositoryChoice {
+  /** `owner/name`, the form `gh --repo` takes. */
+  readonly repo: string;
+  /** Why this repository, for the operator to read back. */
+  readonly source: string;
+}
+
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export function repositorySlugFromUrl(url: string): string | null {
+  const withoutProtocol = url
+    .trim()
+    .replace(/^[a-z+]+:\/\//i, '')
+    .replace(/^[^@/]+@/, '');
+  // A remainder starting with `/` or `.` carries no host, so it is a path on
+  // this machine - a valid git remote, never a GitHub repository.
+  if (withoutProtocol.startsWith('/') || withoutProtocol.startsWith('.')) return null;
+  const path = withoutProtocol.replace(/^[^/:]+(?::\d+)?[/:]/, '');
+  const segments = path
+    .replace(/\.git$/i, '')
+    .split('/')
+    .filter((segment) => segment.length > 0);
+  if (segments.length < 2) return null;
+  return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
+}
+
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export function chooseRepository(inputs: {
+  readonly remotes: ReadonlyMap<string, string>;
+  readonly upstreamRemote: string | null;
+  /** Remotes that already carry the current branch, from its remote-tracking refs. */
+  readonly remotesCarryingBranch?: readonly string[];
+  /** Current branch name, for the refusal to say which branch decided nothing. */
+  readonly branch?: string | null;
+  readonly requested: string | undefined;
+}): { ok: true; choice: RepositoryChoice } | { ok: false; reason: string } {
+  const { remotes, upstreamRemote, requested } = inputs;
+  const remotesCarryingBranch = inputs.remotesCarryingBranch ?? [];
+  if (requested !== undefined && requested.length > 0) {
+    const url = remotes.get(requested);
+    if (url !== undefined) {
+      const slug = repositorySlugFromUrl(url);
+      if (slug === null) return { ok: false, reason: `remote ${requested} (${url}) names no owner/name` };
+      return { ok: true, choice: { repo: slug, source: `remote ${requested}` } };
+    }
+    if (requested.includes('/')) return { ok: true, choice: { repo: requested, source: 'requested' } };
+    return {
+      ok: false,
+      reason:
+        `${requested} is neither a remote of this checkout nor an owner/name. ` +
+        `Remotes: ${[...remotes.keys()].join(', ') || 'none'}`,
+    };
+  }
+  if (upstreamRemote !== null) {
+    const url = remotes.get(upstreamRemote);
+    const slug = url === undefined ? null : repositorySlugFromUrl(url);
+    if (slug !== null) {
+      return { ok: true, choice: { repo: slug, source: `upstream of the current branch (${upstreamRemote})` } };
+    }
+  }
+  if (remotesCarryingBranch.length === 1) {
+    const name = remotesCarryingBranch[0] ?? '';
+    const url = remotes.get(name);
+    const slug = url === undefined ? null : repositorySlugFromUrl(url);
+    if (slug !== null) {
+      return { ok: true, choice: { repo: slug, source: `the only remote carrying this branch (${name})` } };
+    }
+  }
+  if (remotes.size === 1) {
+    const [name, url] = [...remotes][0];
+    const slug = repositorySlugFromUrl(url);
+    if (slug !== null) return { ok: true, choice: { repo: slug, source: `the only remote (${name})` } };
+  }
+  const origin = remotes.get('origin');
+  const originSlug = origin === undefined ? null : repositorySlugFromUrl(origin);
+  if (originSlug !== null) return { ok: true, choice: { repo: originSlug, source: 'remote origin' } };
+  const candidates = [...remotes].map(([name, url]) => `${name} -> ${repositorySlugFromUrl(url) ?? url}`).join(', ');
+  const branchClause =
+    inputs.branch === undefined || inputs.branch === null
+      ? 'this checkout has no current branch'
+      : `branch ${inputs.branch} has no upstream and no remote carries it`;
+  return {
+    ok: false,
+    reason:
+      `${branchClause}, and there is no origin, so the repository is ambiguous. ` +
+      `Pass -R with one of: ${candidates || 'no remotes at all'}`,
+  };
+}
+
+function git(root: string, args: readonly string[]): string | null {
+  const result = spawnSync('git', [...args], { cwd: root, encoding: 'utf8' });
+  return result.status === 0 ? result.stdout.trim() : null;
+}
+
+/** Remote name -> URL, in config order. */
+export function readRemotes(root: string): Map<string, string> {
+  const remotes = new Map<string, string>();
+  const config = git(root, ['config', '--get-regexp', '^remote\\..*\\.url']);
+  if (config === null) return remotes;
+  for (const line of config.split('\n')) {
+    const match = /^remote\.(.+)\.url\s+(.+)$/.exec(line.trim());
+    if (match !== null && match[1] !== undefined && match[2] !== undefined) remotes.set(match[1], match[2]);
+  }
+  return remotes;
+}
+
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export function readRemotesCarryingBranch(root: string, remotes: ReadonlyMap<string, string>): string[] {
+  const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+  if (branch === null || branch === 'HEAD') return [];
+  const carrying: string[] = [];
+  for (const name of remotes.keys()) {
+    if (git(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/${name}/${branch}`]) !== null) {
+      carrying.push(name);
+    }
+  }
+  return carrying;
+}
+
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export function readUpstreamRemote(root: string): string | null {
+  const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+  if (branch === null || branch === 'HEAD') return null;
+  return git(root, ['config', '--get', `branch.${branch}.remote`]);
+}
+
+/** The repository to operate on, resolved from the checkout. */
+export function resolveRepository(
+  root: string,
+  requested: string | undefined,
+): { ok: true; choice: RepositoryChoice } | { ok: false; reason: string } {
+  const remotes = readRemotes(root);
+  const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+  return chooseRepository({
+    remotes,
+    upstreamRemote: readUpstreamRemote(root),
+    remotesCarryingBranch: readRemotesCarryingBranch(root, remotes),
+    branch: branch === 'HEAD' ? null : branch,
+    requested,
+  });
+}

package/src/wrangler/cloudflare.ts

@@ -9,6 +9,11 @@ export interface WorkerScript {
   id: string;
 }
 
+/** One secret bound to a Worker. Cloudflare answers names and types only; a value is never readable. */
+export interface WorkerSecret {
+  name: string;
+}
+
 export interface WorkerRoute {
   id: string;
   pattern: string;
@@ -49,6 +54,8 @@ export interface CloudflareClient {
   deleteR2Object(bucket: string, key: string): Promise<void>;
   deleteR2Bucket(name: string): Promise<void>;
   listWorkerScripts(): Promise<WorkerScript[]>;
+  /** Names only; the Worker's stored values are write-only from outside. */
+  listWorkerSecrets(workerName: string): Promise<string[]>;
   deleteWorkerScript(name: string): Promise<void>;
   listWorkerDomains(): Promise<WorkerDomain[]>;
   createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;
@@ -97,6 +104,7 @@ const MAX_LIST_PAGES = 1000;
 const isKvNamespaces = typia.createIs<LiveKvNamespace[]>();
 const isR2Buckets = typia.createIs<R2Bucket[]>();
 const isWorkerScripts = typia.createIs<WorkerScript[]>();
+const isWorkerSecrets = typia.createIs<WorkerSecret[]>();
 const isWorkerDomains = typia.createIs<WorkerDomain[]>();
 const isCloudflareZones = typia.createIs<CloudflareZone[]>();
 const isWorkerRoutes = typia.createIs<WorkerRoute[]>();
@@ -222,6 +230,16 @@ export class CloudflareRestClient implements CloudflareClient {
     return this.listOnce(`${this.accountPath}/workers/scripts`, isWorkerScripts);
   }
 
+  async listWorkerSecrets(workerName: string): Promise<string[]> {
+    // Unpaginated, like the script listing itself. A Worker that does not exist answers 404 rather
+    // than an empty list, so the caller must establish that the Worker is there before asking.
+    const secrets = await this.listOnce(
+      `${this.accountPath}/workers/scripts/${encodeURIComponent(workerName)}/secrets`,
+      isWorkerSecrets,
+    );
+    return secrets.map((secret) => secret.name);
+  }
+
   deleteWorkerScript(name: string): Promise<void> {
     return this.mutate(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
   }