@smoothbricks/cli 0.11.17 → 0.11.19

package/src/monorepo/managed-files.ts

@@ -1,8 +1,12 @@
 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import {
+  cargoCrossTestArchiveFile,
+  cargoCrossTestTripleFromArchiveTarget,
+} from '@smoothbricks/nx-plugin/cross-check-policy';
 import { MACOS_PLATFORM_TARGET_GLOBS, PLATFORM_TARGET_GLOBS } from '@smoothbricks/nx-plugin/workspace-config-policy';
-import { isStageDerivedDeploy, PRODUCTION_PUSH_DEPLOY_TAG } from '../lib/deploy-tags.js';
+import { PRODUCTION_PUSH_DEPLOY_TAG, stageDeploysProject } from '../lib/deploy-tags.js';
 import {
   ciPushBranches,
   type NonEmptyArray,
@@ -17,9 +21,16 @@ import {
   readValidatedPackageJson,
 } from '../lib/json.js';
 import { listReleasePackages, packageInfo } from '../lib/workspace.js';
-import { loadNxProjects, type NxProjects, targetNamesFromProjects } from '../nx/index.js';
+import {
+  loadNxProjects,
+  type NxProjects,
+  projectRootFromNxProjectJson,
+  targetNamesFromNxProjectJson,
+  targetNamesFromProjects,
+} from '../nx/index.js';
 import { resolvePrivateNpmWorkflowConfig } from '../release/private-npm.js';
-import { privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
+import type { DeploymentStage } from '../wrangler/stage.js';
+import { type CiCrossTestArchive, privateNpmReadTokenJobEnv, renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderRunsOnLine } from './github-runs-on.js';
 import { renderPrPreviewCleanupWorkflowYaml } from './pr-preview-cleanup-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
@@ -181,6 +192,12 @@ export interface ManagedFileContext {
   cargoCredentials?: PackageCargoCredentialsConfig;
   /** Declared self-hosted Nx remote cache from the root smoo config; absent means local caching only. */
   remoteCache?: PackageRemoteCacheConfig;
+  /**
+   * Cross-built test archives the graph can produce, one per foreign target
+   * triple the cargo workspace declares. Empty for a repository that declares
+   * none, which renders a CI workflow with no cross steps and no macOS job.
+   */
+  crossTestArchives: CiCrossTestArchive[];
 }
 
 interface DeployTargetInfo {
@@ -326,6 +343,23 @@ export const managedFileTargetsForTest = managedFiles.map(({ target, executable
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..', '..');
 
+/**
+ * Whether a repository of this shape has the file at all. A repository that owns
+ * no packages has nothing to publish, and one the stage flow does not deploy to
+ * Cloudflare has no preview stage to clean up.
+ */
+function managedFileApplies(file: ManagedFile, context: ManagedFileContext): boolean {
+  if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
+    return false;
+  }
+  return file.cloudflareDeployOnly !== true || context.stagingDeployProvider === 'cloudflare';
+}
+
+/** Test seam: the managed targets a repository of this shape gets, in file order. */
+export function managedFileTargetsForContext(context: ManagedFileContext): string[] {
+  return managedFiles.filter((file) => managedFileApplies(file, context)).map((file) => file.target);
+}
+
 export async function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): Promise<FileResult[]> {
   const context = await getManagedFileContext(root);
   return managedFiles.map((file) => applyManagedFile(root, file, mode, context));
@@ -337,10 +371,7 @@ function applyManagedFile(
   mode: 'update' | 'check' | 'diff',
   context: ManagedFileContext,
 ): FileResult {
-  if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
-    return { target: file.target, action: 'skipped' };
-  }
-  if (file.cloudflareDeployOnly === true && context.stagingDeployProvider !== 'cloudflare') {
+  if (!managedFileApplies(file, context)) {
     return { target: file.target, action: 'skipped' };
   }
   const target = resolve(root, file.target);
@@ -407,6 +438,9 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
         deploySecrets: context.ciDeploySecrets,
         e2eSecrets: context.ciE2eSecrets,
         productionOnPush: context.hasProductionPushDeployTargets,
+        crossTestArchives: context.crossTestArchives,
+        macosRunsOn: context.macosRunsOn,
+        platformProducer: context.platformProducer,
       });
     }
     if (file.source === 'publish-workflow') {
@@ -503,6 +537,7 @@ async function getManagedFileContext(root: string): Promise<ManagedFileContext>
       ? macosPlatformArchitecturesForTest(targetNames)
       : [],
     privateNpm,
+    crossTestArchives: crossTestArchivesForTest(nxProjects),
   };
 }
 
@@ -510,6 +545,40 @@ export function hasExactTargetForTest(targetNames: Iterable<string>, target: str
   return [...targetNames].includes(target);
 }
 
+/**
+ * Test seam: the cross-built test archives this graph can produce, read back
+ * out of the inferred `cargo-cross-test-archive-<triple>` targets.
+ *
+ * Derived, not configured. The triple is declared exactly once — in the cargo
+ * workspace's own `[workspace.metadata.smoothbricks.test] cross-targets`, where
+ * a Rust target triple belongs — and both halves of the workflow are rendered
+ * from the targets that declaration produced. A second copy in `smoo.github`
+ * could name a triple the graph cannot build, and CI would discover that only
+ * on the runner.
+ *
+ * The path is the target's own output location, so the artifact the Linux job
+ * uploads and the file the macOS job's runner opens are the same string
+ * computed once.
+ */
+export function crossTestArchivesForTest(projects: NxProjects): CiCrossTestArchive[] {
+  const archives: CiCrossTestArchive[] = [];
+  for (const project of Object.values(projects)) {
+    const projectRoot = projectRootFromNxProjectJson(project);
+    for (const targetName of targetNamesFromNxProjectJson(project)) {
+      const triple = cargoCrossTestTripleFromArchiveTarget(targetName);
+      if (triple === null) {
+        continue;
+      }
+      const file = cargoCrossTestArchiveFile(triple);
+      archives.push({
+        triple,
+        path: projectRoot === undefined || projectRoot === '.' ? file : `${projectRoot}/${file}`,
+      });
+    }
+  }
+  return archives.sort((left, right) => left.triple.localeCompare(right.triple));
+}
+
 /**
  * The platform families the release workflow produces: the graph's families
  * minus the ones the repository excludes. Excluding a family the graph does not
@@ -558,12 +627,12 @@ export function macosPlatformArchitecturesForTest(targetNames: Iterable<string>)
   return [...architectures].sort((left, right) => left.localeCompare(right));
 }
 
-/** Test seam: deploy configuration presence/provider from graph nodes. */
-export function deployTargetInfoFromProjects(projects: NxProjects, configuration: string): DeployTargetInfo {
+/** Test seam: what the stage flow deploys, and with which provider, from graph nodes. */
+export function deployTargetInfoFromProjects(projects: NxProjects, stage: DeploymentStage): DeployTargetInfo {
   let exists = false;
   let provider: DeployTargetInfo['provider'];
   for (const project of Object.values(projects)) {
-    const info = deployTargetInfoFromProject(project, configuration);
+    const info = deployTargetInfoFromProject(project, stage);
     if (!info.exists) {
       continue;
     }
@@ -578,22 +647,24 @@ export function anyProjectHasTagForTest(projects: NxProjects, tag: string): bool
   return Object.values(projects).some((project) => project.tags?.includes(tag));
 }
 
-function deployTargetInfoFromProject(project: NxProjectJson, configuration: string): DeployTargetInfo {
+/**
+ * A generated deploy job exists for the projects CI would actually deploy, which
+ * is `stageDeploysProject` and nothing else — the same rule `smoo github-ci
+ * nx-deploy` selects by, so the job and its selection cannot disagree. Reading
+ * the target's presence instead would render a deploy job, with cloud
+ * credentials, into a repository whose only wrangler manifests document a
+ * Durable Object binding for a published library's consumers.
+ *
+ * The command is read for the PROVIDER only: which cloud CLI runs says which
+ * credentials the job needs, and says nothing about whether CI runs it.
+ */
+function deployTargetInfoFromProject(project: NxProjectJson, stage: DeploymentStage): DeployTargetInfo {
   const deploy = project.targets?.deploy;
-  if (!deploy) {
-    return { exists: false };
-  }
-  const baseCommandValue = deploy.options?.command ?? deploy.command;
-  const baseCommand = typeof baseCommandValue === 'string' ? baseCommandValue : '';
-  if (isStageDerivedDeploy(project.tags, baseCommand)) {
-    return { exists: true, provider: deployProvider(baseCommand) };
-  }
-  const config = deploy.configurations?.[configuration];
-  if (!config) {
+  if (!deploy || !stageDeploysProject(project.tags, stage)) {
     return { exists: false };
   }
-  const commandValue = config.command ?? config.options?.command ?? baseCommand;
-  return { exists: true, provider: deployProvider(typeof commandValue === 'string' ? commandValue : '') };
+  const command = deploy.options?.command ?? deploy.command;
+  return { exists: true, provider: deployProvider(typeof command === 'string' ? command : '') };
 }
 
 function deployProvider(command: string): DeployTargetInfo['provider'] {

package/src/monorepo/package-policy.test.ts

@@ -63,7 +63,7 @@ describe('root smoo monorepo policy', () => {
       const rootPackage = await readJson(join(root, 'package.json'));
       const nxJson = await readJson(join(root, 'nx.json'));
       expect(rootPackage.scripts).toEqual({
-        'check:linux': 'tooling/devenv --quiet -P linux-cross shell -- nx run-many -t cargo-lint-cross',
+        'check:linux': 'tooling/devenv -P linux-cross shell -- nx run-many -t cargo-lint-cross',
         clean: 'nx run-many -t clean; nx reset',
         'clean:node_modules':
           'rm -rf node_modules && find e* t* p* -type d -name node_modules -print0 | xargs -0 rm -rvf',

package/src/release/__tests__/github-release.test.ts

@@ -3,6 +3,7 @@ import { readFile } from 'node:fs/promises';
 import type { ReleasePackageInfo } from '../core.js';
 import {
   createOrUpdateGithubRelease,
+  DEPENDENCY_ONLY_RELEASE_NOTES,
   type GithubReleaseWriteShell,
   githubReleaseLookupExists,
   nxProjectChangelogArgs,
@@ -63,10 +64,13 @@ describe('GitHub release helpers', () => {
     ).toBe('generated release notes');
   });
 
-  it('fails when Nx omits the requested project changelog', () => {
-    expect(() => projectChangelogContents({ projectChangelogs: {} }, 'pkg')).toThrow(
-      'Nx did not generate a project changelog for pkg.',
-    );
+  it('renders a dependency-only body when Nx generates no project changelog', () => {
+    // Nx bumps a project "because a dependency was bumped", and such a version
+    // carries no commits of its own — so no changelog is the correct output
+    // rather than a failure. Refusing here aborted a publish AFTER the new
+    // versions had been written to every manifest, leaving the release half
+    // done: one dependency-only package took down the whole run.
+    expect(projectChangelogContents({ projectChangelogs: {} }, 'pkg')).toBe(DEPENDENCY_ONLY_RELEASE_NOTES);
   });
 
   it('distinguishes missing releases from transient GitHub lookup failures', () => {

package/src/release/github-release.ts

@@ -80,12 +80,20 @@ export function nxProjectChangelogArgs(pkg: ReleasePackageInfo, previousTag: str
   return previousTag ? { ...base, from: previousTag } : { ...base, firstRelease: true };
 }
 
+/**
+ * The release body for a version that carries no commits of its own.
+ *
+ * Nx bumps a project when a dependency it depends on was bumped, and reports
+ * that reason itself ("because a dependency was bumped"). Such a version has no
+ * commits touching the project, so Nx generates no changelog for it — which is
+ * correct, not a failure. Treating the absence as fatal made one dependency-only
+ * package abort a whole publish after the versions had already been written.
+ */
+export const DEPENDENCY_ONLY_RELEASE_NOTES =
+  '_No changelog entries for this package: this version was released because one of its dependencies was bumped._';
+
 export function projectChangelogContents(result: ProjectChangelogLookupResult, projectName: string): string {
-  const changelog = result.projectChangelogs?.[projectName];
-  if (!changelog) {
-    throw new Error(`Nx did not generate a project changelog for ${projectName}.`);
-  }
-  return changelog.contents;
+  return result.projectChangelogs?.[projectName]?.contents ?? DEPENDENCY_ONLY_RELEASE_NOTES;
 }
 
 export function githubReleaseLookupExists(tag: string, exitCode: number, stdout: string, stderr: string): boolean {

package/src/release/index.ts

@@ -89,6 +89,7 @@ import {
 } from './core.js';
 import {
   createOrUpdateGithubRelease,
+  DEPENDENCY_ONLY_RELEASE_NOTES,
   githubReleaseLookupExists,
   importWorkspaceNx,
   renderNxProjectChangelogContents,
@@ -1596,10 +1597,9 @@ async function writeReleasePreviewSummary(
       lines.push(`  - \`${pkg.name}\`: \`${currentByName.get(pkg.name)?.version ?? 'unknown'}\` -> \`${pkg.version}\``);
     }
     for (const pkg of previewPackages) {
-      const contents = releasePreviewChangelogs.get(pkg.projectName);
-      if (!contents) {
-        throw new Error(`Nx did not generate a project changelog for ${pkg.projectName}.`);
-      }
+      // A dependency-only bump has no commits of its own, so Nx generates no
+      // changelog for it. The preview says so rather than refusing to render.
+      const contents = releasePreviewChangelogs.get(pkg.projectName) ?? DEPENDENCY_ONLY_RELEASE_NOTES;
       lines.push('', `### ${pkg.name} ${pkg.version}`, '', contents.trim());
     }
   }

package/src/secrets/commands.test.ts

@@ -0,0 +1,28 @@
+import { describe, expect, it } from 'bun:test';
+import { secretsMissingInEnvironment } from './commands.js';
+import { reconcileSecrets } from './index.js';
+
+const sources = {
+  workerSecrets: { 'targets/billing': ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'] },
+  workflowSecrets: ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY'],
+  localCommands: [],
+  secretNames: {
+    PAYMENTS_PUBLISHABLE_KEY: 'PAYMENTS_PUBLISHABLE_KEY',
+    PAYMENTS_SECRET_KEY: 'PAYMENTS_SECRET_KEY',
+  },
+  repositorySecrets: ['PAYMENTS_PUBLISHABLE_KEY', 'PAYMENTS_SECRET_KEY', 'RETIRED_TOKEN'],
+  environmentSecrets: { production: ['PAYMENTS_PUBLISHABLE_KEY'] },
+};
+
+describe('what `smoo secrets set --env` walks', () => {
+  it('offers a name the repository holds and the environment does not, and no undeclared one', () => {
+    // Overriding one stage's credentials is the reason to write at environment
+    // scope: skipping names the repository already holds would leave a live
+    // value unsettable. RETIRED_TOKEN is absent from the environment too, but
+    // nothing declares it - prompting for it would ask an operator to copy a
+    // stale value forward.
+    const walked = secretsMissingInEnvironment(reconcileSecrets(sources), 'production');
+
+    expect(walked.map((row) => row.name)).toEqual(['PAYMENTS_SECRET_KEY']);
+  });
+});