@smoothbricks/cli 0.11.17 → 0.11.19

package/managed/raw/tooling/git-hooks/pre-push.sh

@@ -1,25 +1,25 @@
 #!/usr/bin/env bash
-# macOS-only Linux compile gate. Everything in tooling depends only on
-# devenv.nix packages, so this hook must also work without devenv on PATH —
-# but it may not pretend a check ran that never did. Nx task hashes can
-# differ between the bare shell and the linux-cross profile, so a bare miss
-# proves nothing on its own. Policy, in order:
-# 1. Bare `nx run-many -t cargo-lint-cross`: a hit is a prior real
-#    `cargo clippy --target x86_64-unknown-linux-gnu`; pass with no toolchain.
-# 2. If a Nix-built devenv is on PATH, `bun run check:linux` enters the
-#    linux-cross profile properly and its result decides the push.
-# 3. Otherwise refuse with the recovery command instead of a toolchain error
-
-# A Nix-built devenv binary (under /nix/store), skipping the repo wrapper
-# scripts that also answer to this name but cannot enter a profile alone.
-has_nix_devenv() {
-  while IFS= read -r candidate; do
-    case "$(realpath "$candidate" 2>/dev/null)" in
-      /nix/store/*) return 0 ;;
-    esac
-  done < <(which -a devenv 2>/dev/null)
-  return 1
-}
+# macOS-only Linux cross-compile gate. This hook is a cache PROBE and nothing
+# else: it reads the nx cache and never compiles. A hit means a real
+# `cargo clippy --target x86_64-unknown-linux-gnu` already passed for exactly
+# this tree, so the push is safe with no toolchain present. Anything else
+# refuses the push and names the one command that fixes it.
+#
+# Why probe-only. The cross-clippy needs the linux-cross C toolchain, which
+# lives in a devenv profile. A hook that entered that profile spent minutes
+# compiling on a push the user expected to take a second, and it did so in an
+# environment they never asked for. Pushing is not the place to discover that
+# the tree has not been compiled for Linux; `bun run check:linux` is.
+#
+# CC_x86_64_unknown_linux_gnu is unset for the probe deliberately. The target's
+# own guard reads it to decide whether the toolchain is present, so leaving it
+# set would let a push made from inside an already-entered linux-cross shell
+# fall through into a real multi-minute compile. It is not a declared input of
+# the target, so unsetting it cannot change the task hash — a warm entry still
+# hits.
+#
+# Everything in tooling depends only on devenv.nix packages, so this hook also
+# works with no devenv on PATH. It must never pretend a check ran that did not.
 
 cd "$(git rev-parse --show-toplevel)"
 TOOLING="$PWD/tooling"
@@ -31,17 +31,18 @@ case "$(uname -s)" in
   *) exit 0 ;;
 esac
 
-if nx run-many -t cargo-lint-cross; then
+if env -u CC_x86_64_unknown_linux_gnu nx run-many -t cargo-lint-cross --output-style=static; then
   exit 0
 fi
 
-if has_nix_devenv; then
-  exec bun run check:linux
-fi
-
 cat >&2 <<'EOF'
-pre-push: cargo-lint-cross is not cached for this tree and no Nix-built
-devenv is on PATH to enter the linux-cross profile. Run `bun run check:linux`
-from a shell with nix on PATH, wait for it to pass, then push again.
+
+pre-push: the Linux cross-compile check is NOT cached for this tree, so this
+push would ship code that has never been compiled for Linux. This hook only
+reads the cache; it does not build. The "needs the linux-cross C toolchain"
+line above is the probe refusing to compile, not a broken toolchain.
+
+  Run:  bun run check:linux
+  Wait for it to pass, then push again.
 EOF
 exit 1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.17",
+  "version": "0.11.19",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.11",
+    "@smoothbricks/nx-plugin": "0.4.13",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/cli.ts

@@ -532,23 +532,46 @@ function buildProgram(): Command {
     .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
   secrets
     .command('status')
-    .description('Show every declared secret and refuse when a workflow passes one the repository lacks')
-    .option('--repo <owner/name>', 'repository to read secrets from; defaults to the current checkout')
-    .action(async (options: { repo?: string }) => {
+    .description(
+      'Show every declared secret with the scopes holding it, and refuse when a workflow passes one none has',
+    )
+    .option(
+      '-R, --repo <owner/name|remote>',
+      "repository or remote name; defaults to the current branch's upstream remote",
+    )
+    .option(
+      '--env <environment>',
+      "also read this GitHub Environment; its value takes precedence over the repository's for a job bound to it",
+    )
+    .action(async (options: { repo?: string; env?: string }) => {
       process.exitCode = secretsStatus(await findRepoRoot(), options);
     });
   secrets
-    .command('set <name>')
-    .description('Set one repository secret from a pasted value; the value is read without echo and never logged')
-    .option('--repo <owner/name>', 'repository to set the secret on')
-    .action(async (name: string, options: { repo?: string }) => {
-      process.exitCode = await secretsSet(name, options);
+    .command('set [name]')
+    .description('Set secrets from pasted values; with no name, prompts for every secret the target scope still lacks')
+    .option(
+      '-R, --repo <owner/name|remote>',
+      "repository or remote name; defaults to the current branch's upstream remote",
+    )
+    .option(
+      '--env <environment>',
+      "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it",
+    )
+    .action(async (name: string | undefined, options: { repo?: string; env?: string }) => {
+      process.exitCode = await secretsSet(await findRepoRoot(), name, options);
     });
   secrets
     .command('sync')
     .description('Push every secret smoo.secrets can fetch locally to the repository')
-    .option('--repo <owner/name>', 'repository to set the secrets on')
-    .action(async (options: { repo?: string }) => {
+    .option(
+      '-R, --repo <owner/name|remote>',
+      "repository or remote name; defaults to the current branch's upstream remote",
+    )
+    .option(
+      '--env <environment>',
+      "write into this GitHub Environment; its value takes precedence over the repository's for a job bound to it",
+    )
+    .action(async (options: { repo?: string; env?: string }) => {
       process.exitCode = await secretsSync(await findRepoRoot(), options);
     });
 

package/src/github-ci/index.test.ts

@@ -847,8 +847,11 @@ describe('event-aware stage deployment', () => {
     ).toThrow(/same-repository/);
   });
 
-  it('selects stage-derived deploy targets plus staging-only infrastructure on staging', async () => {
+  it('selects tagged stage projects plus staging-only infrastructure, and never an untagged one', async () => {
     const definitions: Record<string, unknown> = {
+      // A private wrangler project the plugin gave a deploy target and nobody tagged: deployable
+      // by hand, invisible to CI. Reading the command instead deployed whatever held a wrangler
+      // manifest, including a published library that ships one to document a binding.
       app: {
         targets: {
           deploy: { options: { command: 'smoo wrangler deploy-stage --stage {args.stage}' } },
@@ -875,18 +878,15 @@ describe('event-aware stage deployment', () => {
     const loadProject = async (project: string) => definitions[project];
 
     await expect(selectStageDeployProjects(candidates, 'staging', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'e2e-mail-capture',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'pr123', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
     await expect(selectStageDeployProjects(candidates, 'production', undefined, loadProject)).resolves.toEqual([
-      'app',
       'app-backend',
       'website',
     ]);
@@ -1303,15 +1303,14 @@ describe('selectStageDeployProjects with a required tag', () => {
   };
   const loadProject = async (project: string) => definitions[project];
 
-  it('keeps only projects carrying the tag, on top of the stage-derived rule', async () => {
+  it('keeps only projects carrying the tag, on top of the stage rules', async () => {
     await expect(
       selectStageDeployProjects(Object.keys(definitions), 'production', 'production-push-deploy-target', loadProject),
     ).resolves.toEqual(['website']);
   });
 
-  it('selects the website on every stage once it is stage-derived', async () => {
+  it('selects only the tagged project on every stage, required tag or not', async () => {
     await expect(selectStageDeployProjects(Object.keys(definitions), 'pr12', undefined, loadProject)).resolves.toEqual([
-      'app',
       'website',
     ]);
   });

package/src/github-ci/index.ts

@@ -4,7 +4,7 @@ import { appendFile } from 'node:fs/promises';
 import { PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
 import { $ } from 'bun';
 import typia from 'typia';
-import { isStageDerivedDeploy, PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PERMANENT_DEPLOY_TAG, STAGING_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import {
   ciPushBranches,
   isNonEmpty,
@@ -35,16 +35,14 @@ export interface GithubActionsEventPayload {
   };
 }
 
+/**
+ * What a deploy candidate is READ for: its tags. `nx show projects --withTarget
+ * deploy` already established the target, and the tags decide the rest, so a
+ * project whose `tags` is not a string array fails the parse instead of being
+ * silently untagged.
+ */
 interface NxProjectDeployTarget {
-  tags?: unknown;
-  targets?: {
-    deploy?: {
-      command?: unknown;
-      options?: {
-        command?: unknown;
-      };
-    };
-  };
+  tags?: string[];
 }
 
 const parseGithubActionsEvent = typia.json.createIsParse<GithubActionsEventPayload>();
@@ -570,16 +568,10 @@ export async function selectStageDeployProjects(
   for (const project of candidates) {
     const definition = await loadProject(project);
     if (!isNxProjectDeployTarget(definition)) continue;
-    const deploy = definition.targets?.deploy;
-    const commandValue = deploy?.options?.command ?? deploy?.command;
-    const tags = Array.isArray(definition.tags)
-      ? definition.tags.filter((tag): tag is string => typeof tag === 'string')
-      : [];
-    const isStageDerived = isStageDerivedDeploy(tags, typeof commandValue === 'string' ? commandValue : undefined);
-    const isStagingOnly = tags.includes(STAGING_DEPLOY_TAG);
+    const tags = definition.tags;
     // A required tag narrows the stage rules; it never selects a project they exclude.
-    if (requireTag && !tags.includes(requireTag)) continue;
-    if (isStageDerived || (stage === 'staging' && isStagingOnly)) {
+    if (requireTag && !tags?.includes(requireTag)) continue;
+    if (stageDeploysProject(tags, stage)) {
       selected.push(project);
     }
   }

package/src/lib/deploy-tags.ts

@@ -1,6 +1,8 @@
 // The Nx tags that drive stage deploys. CI selection (github-ci), workflow generation (monorepo)
 // and the graph readers must agree on these, so they live here rather than with any one of them.
 
+import type { DeploymentStage } from '../wrangler/stage.js';
+
 /** Deployed on every stage: one command that deploys whichever stage it is given. */
 const STAGE_DEPLOY_TAG = 'stage-deploy-target';
 
@@ -14,9 +16,25 @@ export const PERMANENT_DEPLOY_TAG = 'permanent-deploy-target';
 export const PRODUCTION_PUSH_DEPLOY_TAG = 'production-push-deploy-target';
 
 /**
- * Whether a deploy target is stage-derived (the tag, or the `smoo wrangler deploy-stage` command) rather than a set of
- * per-stage configurations; CI selection and workflow generation must agree on this.
+ * Whether the stage flow deploys a project, from its TAGS alone — the one rule
+ * CI selection and workflow generation both read, so a generated deploy job and
+ * the projects that job deploys cannot disagree.
+ *
+ * Having a `deploy` target is not that answer. A deploy target says a project
+ * CAN be deployed; only a tag says CI does it. A published library ships a
+ * wrangler manifest to document a Durable Object binding for its consumers, and
+ * that manifest is structurally identical to a deployable worker's — so the
+ * plugin infers `deploy` from one, and a repository that deploys nothing from CI
+ * would otherwise generate a deploy job, with cloud credentials, for it.
+ *
+ * The three tags compose as precedence, not as a set: `permanent` excludes a
+ * project from every stage, `staging` narrows it to one, `stage` generalizes it
+ * to all. `production-push` selects WITHIN this answer (see `--select-tag`) and
+ * never widens it.
  */
-export function isStageDerivedDeploy(tags: string[] | undefined, command: string | undefined): boolean {
-  return tags?.includes(STAGE_DEPLOY_TAG) === true || command?.includes('smoo wrangler deploy-stage') === true;
+export function stageDeploysProject(tags: string[] | undefined, stage: DeploymentStage): boolean {
+  if (tags === undefined) return false;
+  if (tags.includes(PERMANENT_DEPLOY_TAG)) return false;
+  if (tags.includes(STAGING_DEPLOY_TAG)) return stage === 'staging';
+  return tags.includes(STAGE_DEPLOY_TAG);
 }

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -7,6 +7,7 @@ import { readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { format } from 'prettier';
+import typia from 'typia';
 import type { PackageCargoGitOrigin } from '../../lib/json.js';
 import {
   type CiWorkflowDefinitionOptions,
@@ -898,3 +899,163 @@ describe('renderCiWorkflowYaml with deploy configuration', () => {
     expect(e2eJob).not.toContain('CARGO_REGISTRIES_EXAMPLE_TOKEN');
   });
 });
+
+describe('renderCiWorkflowYaml with cross-built test archives', () => {
+  const darwin = {
+    triple: 'aarch64-apple-darwin',
+    path: 'target/nextest/archive-aarch64-apple-darwin.tar.zst',
+  };
+  const declared = options({
+    runsOn: [...nixosRunsOn],
+    macosRunsOn: ['macos-arm64', 'self-hosted'],
+    crossTestArchives: [darwin],
+  });
+
+  it('renders nothing for a repository that declares no cross archives', () => {
+    const bare = renderCiWorkflowYaml(options({ runsOn: [...nixosRunsOn] }));
+
+    // An empty declaration is the same repository as an absent one: no step, no
+    // job, and above all no renumbering of the steps that were already there.
+    expect(renderCiWorkflowYaml(options({ runsOn: [...nixosRunsOn], crossTestArchives: [] }))).toBe(bare);
+    expect(bare).not.toContain('macos-cross-tests');
+    expect(bare).not.toContain('cross-target test archives');
+    expect(bare).not.toContain('cargo-cross-test');
+  });
+
+  it('builds and uploads each archive in Validate, then executes it in a job that needs Validate', () => {
+    const rendered = renderCiWorkflowYaml(declared);
+    const workflow = typia.assert<{
+      jobs: Record<string, { needs?: string; 'runs-on'?: unknown; 'timeout-minutes'?: number; steps: unknown[] }>;
+    }>(Bun.YAML.parse(rendered));
+    const validate = workflow.jobs.main;
+    const execute = workflow.jobs['macos-cross-tests'];
+
+    expect(execute?.needs).toBe('main');
+    expect(execute?.['runs-on']).toEqual(['macos-arm64', 'self-hosted']);
+    expect(execute?.['timeout-minutes']).toBe(30);
+    // The Linux job COMPILES the darwin binaries; that is what proves the cross
+    // build works at all.
+    expect(rendered).toContain(
+      'run: smoo github-ci nx-run-many --targets "cargo-cross-test-archive-aarch64-apple-darwin"',
+    );
+    expect(JSON.stringify(validate?.steps)).toContain('cross-test-archives-${{ github.run_id }}');
+    // ...and the macOS job only RUNS them: every step is checkout, the shell,
+    // the download, the archive run, or the cache save. Nothing invokes cargo,
+    // a toolchain install, or an SDK.
+    const executeSteps = execute?.steps ?? [];
+    expect(executeSteps).toContainEqual({
+      name: '🧪 Cross-Target Unit Tests',
+      run: 'smoo github-ci nx-run-many --targets "cargo-cross-test-aarch64-apple-darwin"',
+    });
+    const executeText = JSON.stringify(executeSteps);
+    expect(executeText).toContain('cross-test-archives-${{ github.run_id }}');
+    expect(executeText).toContain('actions/download-artifact');
+    expect(executeText).not.toContain('cargo ');
+    expect(executeText).not.toContain('rustup');
+    expect(executeText).not.toContain('cargo-cross-test-archive');
+    expect(executeText).not.toContain('--target build');
+    expect(executeText).not.toContain('SDK');
+  });
+
+  it('reuses the declared cross producer for the archive step, step-scoped', () => {
+    const rendered = renderCiWorkflowYaml(
+      options({
+        ...declared,
+        platformProducer: {
+          kind: 'linux-cross',
+          preflight: 'sh scripts/prepare-macos-sdk.sh',
+          env: { ACME_CROSS: '1', SDKROOT: '${{ runner.temp }}/apple-sdk/MacOSX.sdk' },
+        },
+      }),
+    );
+    const validate = rendered.slice(0, rendered.indexOf('  macos-cross-tests:'));
+
+    expect(validate).toContain('- name: Check cross-platform toolchain prerequisites');
+    expect(validate).toContain('        working-directory: .\n');
+    expect(validate).toContain('          set -euo pipefail\n          sh scripts/prepare-macos-sdk.sh');
+    // Step-scoped, so Validate's host builds stay host builds: the pair appears
+    // once per cross step and never in the job's own env block.
+    expect(validate.match(/ACME_CROSS: "1"/g)).toHaveLength(2);
+    const jobEnv = validate.slice(validate.indexOf('    env:'), validate.indexOf('    steps:'));
+    expect(jobEnv).not.toContain('ACME_CROSS');
+    expect(jobEnv).not.toContain('SDKROOT');
+    // A declared producer with no preflight is a mechanism error at render time.
+    expect(() =>
+      renderCiWorkflowYaml(options({ ...declared, platformProducer: { kind: 'linux-cross', preflight: '  ' } })),
+    ).toThrow('nonempty toolchain preflight');
+  });
+
+  it('numbers the execute job download before the run and keeps the cleanup anchor after both', () => {
+    const execute = crossTestJob(renderCiWorkflowYaml(declared));
+
+    // Checkout 2, setup-devenv 3, download 4, run 5, cleanup 6.
+    expect(execute).toContain('# Step 4\n      - name: 📥 Download cross-target test archives');
+    expect(execute).toContain('# Step 5\n      - name: 🧪 Cross-Target Unit Tests');
+    expect(execute).toContain('# Step 6');
+    expect(execute).toContain('uses: ./.github/actions/save-nix-devenv');
+  });
+
+  it('builds a non-darwin triple without an execution job it has no runner for', () => {
+    const rendered = renderCiWorkflowYaml(
+      options({
+        crossTestArchives: [
+          { triple: 'x86_64-unknown-linux-musl', path: 'target/nextest/archive-x86_64-unknown-linux-musl.tar.zst' },
+        ],
+      }),
+    );
+
+    expect(rendered).toContain(
+      'run: smoo github-ci nx-run-many --targets "cargo-cross-test-archive-x86_64-unknown-linux-musl"',
+    );
+    expect(rendered).not.toContain('macos-cross-tests');
+  });
+
+  it('downloads a nested cargo workspace archive back to the directory its target writes', () => {
+    const execute = crossTestJob(
+      renderCiWorkflowYaml(
+        options({
+          crossTestArchives: [{ ...darwin, path: `packages/ferris/${darwin.path}` }],
+        }),
+      ),
+    );
+
+    expect(execute).toContain('path: packages/ferris/target/nextest');
+  });
+
+  it('refuses declarations the Nx graph could not have produced, at render time', () => {
+    expect(() =>
+      renderCiWorkflowYaml(options({ crossTestArchives: [{ ...darwin, path: 'target/nextest/archive.tar.zst' }] })),
+    ).toThrow('must be a repository-relative target/nextest/archive-aarch64-apple-darwin.tar.zst');
+    expect(() =>
+      renderCiWorkflowYaml(options({ crossTestArchives: [{ ...darwin, path: `../${darwin.path}` }] })),
+    ).toThrow('must stay inside the repository');
+    expect(() =>
+      renderCiWorkflowYaml(
+        options({ crossTestArchives: [{ triple: 'Bad Triple; rm -rf /', path: 'target/nextest/x.tar.zst' }] }),
+      ),
+    ).toThrow('must be a target triple');
+    // Two cargo workspaces cannot share one artifact: upload-artifact roots it
+    // at the least common ancestor, so the restored paths would be wrong for
+    // both. Refuse here rather than on the runner.
+    expect(() =>
+      renderCiWorkflowYaml(
+        options({
+          crossTestArchives: [
+            darwin,
+            { triple: 'x86_64-apple-darwin', path: `packages/ferris/${cargoArchive('x86_64-apple-darwin')}` },
+          ],
+        }),
+      ),
+    ).toThrow('must share one directory');
+  });
+});
+
+function crossTestJob(rendered: string): string {
+  const start = rendered.indexOf('  macos-cross-tests:');
+  expect(start).toBeGreaterThan(-1);
+  return rendered.slice(start);
+}
+
+function cargoArchive(triple: string): string {
+  return `target/nextest/archive-${triple}.tar.zst`;
+}