@smoothbricks/cli 0.3.3 → 0.4.0

package/dist/monorepo/publish-workflow.js

@@ -14,6 +14,7 @@ export var PublishWorkflowStepKind;
     PublishWorkflowStepKind["UploadTraceDbs"] = "upload-trace-dbs";
     PublishWorkflowStepKind["ValidateMonorepoConfig"] = "validate-monorepo-config";
     PublishWorkflowStepKind["PublishRelease"] = "publish-release";
+    PublishWorkflowStepKind["DeployProduction"] = "deploy-production";
     PublishWorkflowStepKind["SaveNixDevenv"] = "save-nix-devenv";
 })(PublishWorkflowStepKind || (PublishWorkflowStepKind = {}));
 export function definePublishWorkflow(options = {}) {
@@ -26,6 +27,19 @@ export function definePublishWorkflow(options = {}) {
     if (isSmoothBricksCodebasePackageName(options.repoName)) {
         setupSteps.push({ kind: PublishWorkflowStepKind.BuildSelfHostedCli, name: '🏗️ Build self-hosted smoo' });
     }
+    const releaseSteps = [
+        {
+            kind: PublishWorkflowStepKind.PublishRelease,
+            name: `📦 Publish release (${versionMode})`,
+        },
+    ];
+    if (options.deploy === true) {
+        releaseSteps.push({
+            kind: PublishWorkflowStepKind.DeployProduction,
+            name: '🚀 Deploy production',
+            condition: 'deploy-production',
+        });
+    }
     return {
         steps: numberWorkflowSteps([
             ...setupSteps,
@@ -63,10 +77,7 @@ export function definePublishWorkflow(options = {}) {
                 name: `✅ Validate monorepo config (${versionMode})`,
                 condition: 'version-mode-not-none',
             },
-            {
-                kind: PublishWorkflowStepKind.PublishRelease,
-                name: `📦 Publish release (${versionMode})`,
-            },
+            ...releaseSteps,
             {
                 kind: PublishWorkflowStepKind.SaveNixDevenv,
                 name: '🧹 Cleanup and cache Nix/devenv',
@@ -84,7 +95,7 @@ export async function runPublishWorkflow(workflow, context) {
     let failed = false;
     let failure;
     for (const step of workflow.steps) {
-        if (!shouldRunStep(step, version, failed)) {
+        if (!shouldRunStep(step, version, failed, context.inputs)) {
             continue;
         }
         try {
@@ -132,6 +143,9 @@ export async function runPublishWorkflow(workflow, context) {
                         dryRun: context.inputs.dryRun,
                     });
                     break;
+                case PublishWorkflowStepKind.DeployProduction:
+                    await context.callbacks.deployProduction();
+                    break;
                 case PublishWorkflowStepKind.SaveNixDevenv:
                     await context.callbacks.saveNixDevenv(setupOutputs);
                     break;
@@ -147,10 +161,13 @@ export async function runPublishWorkflow(workflow, context) {
     }
     return { version, failed };
 }
-function shouldRunStep(step, version, failed) {
+function shouldRunStep(step, version, failed, inputs) {
     if (step.condition === 'version-mode-not-none') {
         return version.mode !== 'none';
     }
+    if (step.condition === 'deploy-production') {
+        return version.mode !== 'none' && inputs.deployEnvironment === 'production' && !inputs.dryRun;
+    }
     if (step.condition === 'failure') {
         return failed;
     }
@@ -158,9 +175,17 @@ function shouldRunStep(step, version, failed) {
 }
 export function renderPublishWorkflowYaml(options = {}) {
     const steps = definePublishWorkflow(options).steps;
-    return `${renderPublishWorkflowHeader()}${renderPublishWorkflowSteps(steps)}`;
+    return `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
 }
-function renderPublishWorkflowHeader() {
+function renderPublishWorkflowHeader(options) {
+    const deployInput = options.deploy === true
+        ? `
+      deploy_environment:
+        type: choice
+        description: Deploy live systems after a successful publish.
+        options: [none, production]
+        default: none`
+        : '';
     return `name: Publish
 
 on:
@@ -176,7 +201,7 @@ on:
       dry_run:
         type: boolean
         description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
-        default: false
+        default: false${deployInput}
 
 permissions:
   contents: write
@@ -199,12 +224,12 @@ jobs:
     steps:
 `;
 }
-function renderPublishWorkflowSteps(steps) {
+function renderPublishWorkflowSteps(steps, options) {
     const lines = [];
     for (const step of steps) {
         lines.push(...sectionLinesBefore(step));
         lines.push(...commentLinesForStep(step));
-        lines.push(...yamlLinesForStep(step));
+        lines.push(...yamlLinesForStep(step, options));
         lines.push('');
     }
     return `${lines.join('\n').trimEnd()}\n`;
@@ -244,7 +269,7 @@ function commentLinesForStep(step) {
     }
     return [`      # Step ${step.number}`];
 }
-function yamlLinesForStep(step) {
+function yamlLinesForStep(step, options) {
     switch (step.kind) {
         case PublishWorkflowStepKind.Checkout:
             return [
@@ -312,6 +337,8 @@ function yamlLinesForStep(step) {
                 '        # Missing package names are bootstrapped locally before trust setup.',
                 `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`,
             ];
+        case PublishWorkflowStepKind.DeployProduction:
+            return deployProductionStep(step, options);
         case PublishWorkflowStepKind.SaveNixDevenv:
             return [
                 `      - name: ${step.name}`,
@@ -323,13 +350,30 @@ function yamlLinesForStep(step) {
             ];
     }
 }
-function conditionalRunStep(step, run) {
+function deployProductionStep(step, options) {
     return [
         `      - name: ${step.name}`,
-        `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
-        `        run: ${run}`,
+        '        if:',
+        "          ${{ steps.version.outputs.mode != 'none' && inputs.deploy_environment == 'production' && inputs.dry_run !=",
+        "          'true' }}",
+        ...deployEnvLines(options),
+        '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
     ];
 }
+function deployEnvLines(options) {
+    if (options.deployProvider !== 'cloudflare') {
+        return [];
+    }
+    return [
+        '        env:',
+        '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
+        '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+    ];
+}
+function conditionalRunStep(step, run) {
+    const condition = "steps.version.outputs.mode != 'none'";
+    return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+}
 function githubExpression(expression) {
     return ['$', '{{ ', expression, ' }}'].join('');
 }

package/dist/monorepo/runtime.d.ts

@@ -1,2 +1,5 @@
 export declare function syncRootRuntimeVersions(root: string): Promise<void>;
+type RuntimeTypesPinMode = 'major' | 'exact';
+export declare function runtimeTypesRangeForPublishedVersions(packageName: string, runtimeVersion: string, pinMode: RuntimeTypesPinMode, versions: readonly string[]): string;
+export {};
 //# sourceMappingURL=runtime.d.ts.map

package/dist/monorepo/runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAKA,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BzE"}
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/monorepo/runtime.ts"],"names":[],"mappings":"AAKA,wBAAsB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqCzE;AAED,KAAK,mBAAmB,GAAG,OAAO,GAAG,OAAO,CAAC;AAgB7C,wBAAgB,qCAAqC,CACnD,WAAW,EAAE,MAAM,EACnB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,SAAS,MAAM,EAAE,GAC1B,MAAM,CAsBR"}

package/dist/monorepo/runtime.js

@@ -21,13 +21,77 @@ export async function syncRootRuntimeVersions(root) {
     changed = setStringProperty(engines, 'node', `>=${nodeMajor}.0.0`) || changed;
     changed = setStringProperty(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
     const devDependencies = getOrCreateRecord(packageJson, 'devDependencies');
-    changed = setStringProperty(devDependencies, '@types/node', `~${nodeMajor}.0.0`) || changed;
-    changed = setStringProperty(devDependencies, '@types/bun', bunVersion) || changed;
+    changed =
+        setStringProperty(devDependencies, '@types/node', await runtimeTypesRange(root, '@types/node', nodeVersion, 'major')) || changed;
+    changed =
+        setStringProperty(devDependencies, '@types/bun', await runtimeTypesRange(root, '@types/bun', bunVersion, 'exact')) || changed;
     if (changed) {
         writeJsonObject(packageJsonPath, packageJson);
         console.log('updated        package.json runtime versions');
     }
 }
+async function runtimeTypesRange(root, packageName, runtimeVersion, pinMode) {
+    const versionsText = await $ `bun pm view ${packageName} versions --json`.cwd(root).text();
+    const versions = JSON.parse(versionsText);
+    if (!Array.isArray(versions) || !versions.every((version) => typeof version === 'string')) {
+        throw new Error(`Unable to read published ${packageName} versions`);
+    }
+    return runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions);
+}
+export function runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions) {
+    const parsedRuntimeVersion = parseVersion(runtimeVersion);
+    if (!parsedRuntimeVersion) {
+        throw new Error(`Unable to parse runtime version ${runtimeVersion}`);
+    }
+    if (pinMode === 'major') {
+        const runtimeMajor = parsedRuntimeVersion[0].toString();
+        if (latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor))) {
+            return `~${runtimeMajor}.0.0`;
+        }
+    }
+    else if (versions.includes(runtimeVersion)) {
+        return runtimeVersion;
+    }
+    const latest = latestVersion(versions);
+    if (!latest) {
+        throw new Error(`Unable to find any published ${packageName} versions`);
+    }
+    console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
+    return pinMode === 'major' ? `~${latest}` : latest;
+}
+function latestVersion(versions) {
+    let latest = null;
+    for (const version of versions) {
+        if (!parseVersion(version)) {
+            continue;
+        }
+        if (!latest || compareVersions(version, latest) > 0) {
+            latest = version;
+        }
+    }
+    return latest;
+}
+function compareVersions(left, right) {
+    const leftParts = parseVersion(left);
+    const rightParts = parseVersion(right);
+    if (!leftParts || !rightParts) {
+        return 0;
+    }
+    for (let index = 0; index < leftParts.length; index++) {
+        const diff = leftParts[index] - rightParts[index];
+        if (diff !== 0) {
+            return diff;
+        }
+    }
+    return 0;
+}
+function versionMajor(version) {
+    return parseVersion(version)?.[0].toString() ?? null;
+}
+function parseVersion(version) {
+    const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+    return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
 function runtimeCommand(root, name) {
     const candidates = [
         join(root, 'tooling', 'direnv', '.devenv', 'profile', 'bin', name),

package/managed/raw/git-format-staged.yml

@@ -42,6 +42,10 @@ formatters:
       - '!*.nix'
       # Bun lockfiles are generated and should not be rewritten by Prettier
       - '!bun.lock'
+      # Binary artifacts: Prettier reads them as UTF-8 and can corrupt them
+      # by replacing invalid byte sequences.
+      - '!*.wasm'
+      - '!*.wasm.sha256'
 
   # Alejandra for Nix files
   alejandra:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -45,7 +45,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/cli": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.2.2",
+    "@smoothbricks/nx-plugin": "0.2.4",
     "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",
@@ -72,7 +72,7 @@
       "test": {
         "executor": "@smoothbricks/nx-plugin:bounded-exec",
         "options": {
-          "command": "bun test",
+          "command": "bun test --timeout=30000",
           "cwd": "{projectRoot}",
           "timeoutMs": 120000,
           "killAfterMs": 1e4

package/src/cli.ts

@@ -298,18 +298,48 @@ function buildProgram(): Command {
     .requiredOption('--target <target>')
     .option('--name <name>')
     .option('--step <step>')
-    .action(async (options: { target: string; name?: string; step?: string }) => {
-      const { githubCiNxSmart } = await import('./github-ci/index.js');
-      await githubCiNxSmart(await findRepoRoot(), options);
-    });
+    .option('--mode <mode>', 'auto, affected, or run-many', 'auto')
+    .option('--configuration <configuration>')
+    .action(
+      async (options: {
+        target: string;
+        name?: string;
+        step?: string;
+        mode?: 'auto' | 'affected' | 'run-many';
+        configuration?: string;
+      }) => {
+        const { githubCiNxSmart } = await import('./github-ci/index.js');
+        await githubCiNxSmart(await findRepoRoot(), options);
+      },
+    );
   githubCi
     .command('nx-run-many')
     .requiredOption('--targets <targets>')
     .option('--projects <projects>')
-    .action(async (options: { targets: string; projects?: string }) => {
+    .option('--configuration <configuration>')
+    .action(async (options: { targets: string; projects?: string; configuration?: string }) => {
       const { githubCiNxRunMany } = await import('./github-ci/index.js');
       await githubCiNxRunMany(await findRepoRoot(), options);
     });
+  githubCi
+    .command('nx-deploy')
+    .requiredOption('--configuration <configuration>')
+    .option('--mode <mode>', 'auto, affected, or run-many', 'run-many')
+    .option('--name <name>')
+    .option('--step <step>')
+    .option('--verify', 'run build, lint, and test before deploy')
+    .action(
+      async (options: {
+        configuration: string;
+        mode?: 'auto' | 'affected' | 'run-many';
+        name?: string;
+        step?: string;
+        verify?: boolean;
+      }) => {
+        const { githubCiNxDeploy } = await import('./github-ci/index.js');
+        await githubCiNxDeploy(await findRepoRoot(), options);
+      },
+    );
 
   return program;
 }

package/src/github-ci/index.ts

@@ -4,6 +4,8 @@ import { dirname, join } from 'node:path';
 import { $ } from 'bun';
 import { decode, run, runStatus } from '../lib/run.js';
 
+type NxSmartMode = 'auto' | 'affected' | 'run-many';
+
 export async function cleanupGithubCiCache(root: string): Promise<void> {
   const githubOutput = process.env.GITHUB_OUTPUT;
   const markCacheReady = async (ready: boolean): Promise<void> => {
@@ -113,17 +115,17 @@ async function addReferencesFrom(roots: Set<string>, path: string, cwd: string):
 
 export async function githubCiNxSmart(
   root: string,
-  options: { target: string; name?: string; step?: string },
+  options: { target: string; name?: string; step?: string; mode?: NxSmartMode; configuration?: string },
 ): Promise<void> {
   const name = options.name ?? options.target;
   const step = options.step ?? '';
   await createGithubStatus(name, step);
-  const mode =
-    process.env.GITHUB_EVENT_NAME === 'push' && process.env.GITHUB_REF_NAME === 'main' ? 'run-many' : 'affected';
-  const nxArgs =
-    mode === 'run-many'
-      ? ['run-many', '-t', options.target, '--parallel=5']
-      : ['affected', '-t', options.target, '--parallel=5'];
+  const mode = resolveNxSmartMode(options.mode ?? 'auto');
+  const nxArgs = mode === 'run-many' ? ['run-many', '-t', options.target] : ['affected', '-t', options.target];
+  if (options.configuration) {
+    nxArgs.push(`--configuration=${options.configuration}`);
+  }
+  nxArgs.push('--parallel=5');
   const status = await runStatus('nx', nxArgs, root);
   await updateGithubStatus(name, status === 0 ? 'success' : 'failure', step);
   if (status !== 0) {
@@ -131,14 +133,98 @@ export async function githubCiNxSmart(
   }
 }
 
-export async function githubCiNxRunMany(root: string, options: { targets: string; projects?: string }): Promise<void> {
+export async function githubCiNxRunMany(
+  root: string,
+  options: { targets: string; projects?: string; configuration?: string },
+): Promise<void> {
   const nxArgs = ['run-many', '-t', options.targets, '--parallel=5'];
   if (options.projects) {
     nxArgs.push(`--projects=${options.projects}`);
   }
+  if (options.configuration) {
+    nxArgs.push(`--configuration=${options.configuration}`);
+  }
   await run('nx', nxArgs, root);
 }
 
+export async function githubCiNxDeploy(
+  root: string,
+  options: { configuration: string; mode?: NxSmartMode; name?: string; step?: string; verify?: boolean },
+): Promise<void> {
+  const name = options.name ?? `Deploy ${options.configuration}`;
+  const step = options.step ?? '';
+  await createGithubStatus(name, step);
+  const mode = resolveNxSmartMode(options.mode ?? 'run-many');
+  const projects = await deployProjectsWithConfiguration(root, options.configuration, mode);
+  if (projects.length === 0) {
+    console.log(`No ${mode} deploy projects with configuration ${options.configuration}; skipping.`);
+    await updateGithubStatus(name, 'success', step);
+    return;
+  }
+
+  const projectList = projects.join(',');
+  const targets = options.verify === true ? ['build', 'lint', 'test', 'deploy'] : ['deploy'];
+  for (const target of targets) {
+    const nxArgs = ['run-many', '-t', target, `--projects=${projectList}`, '--parallel=5'];
+    if (target === 'deploy') {
+      nxArgs.push(`--configuration=${options.configuration}`);
+    }
+    const status = await runStatus('nx', nxArgs, root);
+    if (status !== 0) {
+      await updateGithubStatus(name, 'failure', step);
+      throw new Error(`nx ${nxArgs.join(' ')} failed with exit code ${status}`);
+    }
+  }
+  await updateGithubStatus(name, 'success', step);
+}
+
+function resolveNxSmartMode(mode: NxSmartMode): 'affected' | 'run-many' {
+  if (mode === 'affected' || mode === 'run-many') {
+    return mode;
+  }
+  return process.env.GITHUB_EVENT_NAME === 'push' && process.env.GITHUB_REF_NAME === 'main' ? 'run-many' : 'affected';
+}
+
+async function deployProjectsWithConfiguration(
+  root: string,
+  configuration: string,
+  mode: 'affected' | 'run-many',
+): Promise<string[]> {
+  const listArgs =
+    mode === 'affected'
+      ? ['show', 'projects', '--affected', '--withTarget', 'deploy', '--json']
+      : ['show', 'projects', '--withTarget', 'deploy', '--json'];
+  const result = await $`nx ${listArgs}`.cwd(root).quiet();
+  const candidates = nxProjectList(decode(result.stdout));
+  const projects: string[] = [];
+  for (const project of candidates) {
+    if (await deployTargetHasConfiguration(root, project, configuration)) {
+      projects.push(project);
+    }
+  }
+  return projects.sort((a, b) => a.localeCompare(b));
+}
+
+async function deployTargetHasConfiguration(root: string, project: string, configuration: string): Promise<boolean> {
+  const result = await $`nx show project ${project} --json`.cwd(root).quiet();
+  const parsed: unknown = JSON.parse(decode(result.stdout));
+  const targets = recordValue(parsed)?.targets;
+  const deploy = recordValue(targets)?.deploy;
+  const configurations = recordValue(deploy)?.configurations;
+  return recordValue(configurations)?.[configuration] !== undefined;
+}
+
+function nxProjectList(output: string): string[] {
+  const parsed: unknown = JSON.parse(output);
+  return Array.isArray(parsed) ? parsed.filter((project): project is string => typeof project === 'string') : [];
+}
+
+function recordValue(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
 async function createGithubStatus(name: string, step: string): Promise<void> {
   await postGithubStatus(name, 'pending', `Running ${name}...`, step);
 }

package/src/monorepo/__tests__/ci-workflow.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, it } from 'bun:test';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CiWorkflowStepKind, defineCiWorkflow, renderCiWorkflowYaml } from '../ci-workflow.js';
+
+describe('CI workflow definition', () => {
+  it('renders the checked-in local CI workflow copy', async () => {
+    const rendered = renderCiWorkflowYaml({ deploy: false, pushBranches: ['main'] });
+    const packageRoot = join(import.meta.dir, '..', '..', '..');
+
+    await expect(readFile(join(packageRoot, '..', '..', '.github/workflows/ci.yml'), 'utf8')).resolves.toBe(rendered);
+  });
+
+  it('inserts deploy after tests and renumbers following deeplink steps', () => {
+    const steps = defineCiWorkflow({ deploy: true, pushBranches: ['main'] });
+    const rendered = renderCiWorkflowYaml({ deploy: true, pushBranches: ['main'] });
+
+    expect(steps.map((step) => [step.kind, step.number])).toContainEqual([CiWorkflowStepKind.Deploy, 9]);
+    expect(rendered).toContain('- name: 🚀 Deploy Staging');
+    expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
+    expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
+    expect(rendered).toContain(
+      'smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step 9',
+    );
+    expect(rendered).toContain("# Step 10\n      # Nx's database cache needs artifact files");
+  });
+
+  it('adds Cloudflare credentials for Wrangler-backed deploys', () => {
+    const rendered = renderCiWorkflowYaml({ deploy: true, deployProvider: 'cloudflare', pushBranches: ['main'] });
+
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+});

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -28,6 +28,61 @@ describe('publish workflow definition', () => {
     expect(rendered).toContain('packages must already exist on npm and use trusted publishing/OIDC');
   });
 
+  it('omits production deploy controls when no production deploy target exists', () => {
+    const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+
+    expect(rendered).not.toContain('deploy_environment');
+    expect(rendered).not.toContain('Deploy production');
+    expect(rendered).not.toContain('nx-deploy');
+  });
+
+  it('renders production deploy controls for repos with production deploy targets', () => {
+    const rendered = renderPublishWorkflowYaml({ deploy: true, repoName: '@smoothbricks/codebase' });
+
+    expect(rendered).toContain('deploy_environment:');
+    expect(rendered).toContain('- name: 🚀 Deploy production');
+    expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
+    expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
+    expect(rendered).toContain(
+      'smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+    );
+  });
+
+  it('adds Cloudflare credentials for Wrangler-backed production deploys', () => {
+    const rendered = renderPublishWorkflowYaml({
+      deploy: true,
+      deployProvider: 'cloudflare',
+      repoName: '@smoothbricks/codebase',
+    });
+
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+
+  it('deploys production only after a real publish when requested', async () => {
+    const deployed = await publishWorkflowScenario({
+      deploy: true,
+      repairs: [],
+      current: [],
+      bump: 'auto',
+      deployEnvironment: 'production',
+      dryRun: false,
+      version: { mode: 'new', projects: ['app'] },
+    }).run();
+    const dryRun = await publishWorkflowScenario({
+      deploy: true,
+      repairs: [],
+      current: [],
+      bump: 'auto',
+      deployEnvironment: 'production',
+      dryRun: true,
+      version: { mode: 'new', projects: ['app'] },
+    }).run();
+
+    expect(deployed.productionDeployed).toBe(true);
+    expect(dryRun.productionDeployed).toBe(false);
+  });
+
   it('bootstraps the self-hosted CLI before release commands only for the SmoothBricks repo', async () => {
     const smoothbricks = await publishWorkflowScenario({
       repoName: '@smoothbricks/codebase',
@@ -143,10 +198,12 @@ interface ReleaseGap {
 }
 
 interface WorkflowScenarioConfig {
+  deploy?: boolean;
   repoName?: string;
   repairs: ReleaseGap[];
   current: ReleaseGap[];
   bump: PublishWorkflowBump;
+  deployEnvironment?: 'none' | 'production';
   dryRun: boolean;
   version: PublishWorkflowVersionOutputs;
 }
@@ -161,6 +218,7 @@ interface WorkflowOutcome {
   repairBuildArtifacts: string[];
   validation: { checks: number; builds: string[]; lints: string[]; tests: string[]; validates: number };
   publishRan: boolean;
+  productionDeployed: boolean;
   publishSawValidatedRelease: boolean;
   publishCompletedTags: string[];
   remainingDurableGaps: string[];
@@ -170,8 +228,8 @@ function publishWorkflowScenario(config: WorkflowScenarioConfig): { run(): Promi
   return {
     async run() {
       const state = new WorkflowScenarioState(config);
-      await runPublishWorkflow(definePublishWorkflow({ repoName: config.repoName }), {
-        inputs: { bump: config.bump, dryRun: config.dryRun },
+      await runPublishWorkflow(definePublishWorkflow({ deploy: config.deploy, repoName: config.repoName }), {
+        inputs: { bump: config.bump, deployEnvironment: config.deployEnvironment ?? 'none', dryRun: config.dryRun },
         callbacks: state.callbacks(),
       });
       return state.outcome();
@@ -186,6 +244,7 @@ class WorkflowScenarioState {
   private repairObservedSelfHostedCli = false;
   private versionObservedSelfHostedCli = false;
   private publishReleaseRan = false;
+  private productionDeployRan = false;
   private publishSawValidation = false;
   private readonly repaired = new Set<string>();
   private readonly repairBuilds = new Set<string>();
@@ -275,6 +334,9 @@ class WorkflowScenarioState {
           }
         }
       },
+      deployProduction: async () => {
+        this.productionDeployRan = true;
+      },
       saveNixDevenv: async () => {},
     };
   }
@@ -296,6 +358,7 @@ class WorkflowScenarioState {
         validates: this.validationState.validates,
       },
       publishRan: this.publishReleaseRan,
+      productionDeployed: this.productionDeployRan,
       publishSawValidatedRelease: this.publishSawValidation,
       publishCompletedTags: [...this.publishedCurrent].sort(),
       remainingDurableGaps: [...this.durableGaps].sort(),