@smoothbricks/cli 0.3.3 → 0.4.0

package/src/monorepo/publish-workflow.ts

@@ -1,8 +1,9 @@
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
-export type PublishWorkflowCondition = 'version-mode-not-none' | 'failure' | 'always';
+export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
+export type PublishWorkflowDeployEnvironment = 'none' | 'production';
 
 export enum PublishWorkflowStepKind {
   Checkout = 'checkout',
@@ -18,6 +19,7 @@ export enum PublishWorkflowStepKind {
   UploadTraceDbs = 'upload-trace-dbs',
   ValidateMonorepoConfig = 'validate-monorepo-config',
   PublishRelease = 'publish-release',
+  DeployProduction = 'deploy-production',
   SaveNixDevenv = 'save-nix-devenv',
 }
 
@@ -35,11 +37,14 @@ export interface PublishWorkflowDefinition {
 }
 
 export interface PublishWorkflowDefinitionOptions {
+  deploy?: boolean;
+  deployProvider?: 'cloudflare';
   repoName?: string;
 }
 
 export interface PublishWorkflowInputs {
   bump: PublishWorkflowBump;
+  deployEnvironment: PublishWorkflowDeployEnvironment;
   dryRun: boolean;
 }
 
@@ -65,6 +70,7 @@ export interface PublishWorkflowCallbacks {
   uploadTraceDbs(): Promise<void>;
   validateMonorepoConfig(): Promise<void>;
   publishRelease(input: { bump: PublishWorkflowBump; dryRun: boolean }): Promise<void>;
+  deployProduction(): Promise<void>;
   saveNixDevenv(input: PublishWorkflowSetupOutputs): Promise<void>;
 }
 
@@ -90,6 +96,19 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
   if (isSmoothBricksCodebasePackageName(options.repoName)) {
     setupSteps.push({ kind: PublishWorkflowStepKind.BuildSelfHostedCli, name: '🏗️ Build self-hosted smoo' });
   }
+  const releaseSteps: PublishWorkflowStepInput[] = [
+    {
+      kind: PublishWorkflowStepKind.PublishRelease,
+      name: `📦 Publish release (${versionMode})`,
+    },
+  ];
+  if (options.deploy === true) {
+    releaseSteps.push({
+      kind: PublishWorkflowStepKind.DeployProduction,
+      name: '🚀 Deploy production',
+      condition: 'deploy-production',
+    });
+  }
   return {
     steps: numberWorkflowSteps([
       ...setupSteps,
@@ -127,10 +146,7 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
         name: `✅ Validate monorepo config (${versionMode})`,
         condition: 'version-mode-not-none',
       },
-      {
-        kind: PublishWorkflowStepKind.PublishRelease,
-        name: `📦 Publish release (${versionMode})`,
-      },
+      ...releaseSteps,
       {
         kind: PublishWorkflowStepKind.SaveNixDevenv,
         name: '🧹 Cleanup and cache Nix/devenv',
@@ -153,7 +169,7 @@ export async function runPublishWorkflow(
   let failed = false;
   let failure: unknown;
   for (const step of workflow.steps) {
-    if (!shouldRunStep(step, version, failed)) {
+    if (!shouldRunStep(step, version, failed, context.inputs)) {
       continue;
     }
     try {
@@ -201,6 +217,9 @@ export async function runPublishWorkflow(
             dryRun: context.inputs.dryRun,
           });
           break;
+        case PublishWorkflowStepKind.DeployProduction:
+          await context.callbacks.deployProduction();
+          break;
         case PublishWorkflowStepKind.SaveNixDevenv:
           await context.callbacks.saveNixDevenv(setupOutputs);
           break;
@@ -216,10 +235,18 @@ export async function runPublishWorkflow(
   return { version, failed };
 }
 
-function shouldRunStep(step: PublishWorkflowStep, version: PublishWorkflowVersionOutputs, failed: boolean): boolean {
+function shouldRunStep(
+  step: PublishWorkflowStep,
+  version: PublishWorkflowVersionOutputs,
+  failed: boolean,
+  inputs: PublishWorkflowInputs,
+): boolean {
   if (step.condition === 'version-mode-not-none') {
     return version.mode !== 'none';
   }
+  if (step.condition === 'deploy-production') {
+    return version.mode !== 'none' && inputs.deployEnvironment === 'production' && !inputs.dryRun;
+  }
   if (step.condition === 'failure') {
     return failed;
   }
@@ -228,10 +255,19 @@ function shouldRunStep(step: PublishWorkflowStep, version: PublishWorkflowVersio
 
 export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOptions = {}): string {
   const steps = definePublishWorkflow(options).steps;
-  return `${renderPublishWorkflowHeader()}${renderPublishWorkflowSteps(steps)}`;
+  return `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
 }
 
-function renderPublishWorkflowHeader(): string {
+function renderPublishWorkflowHeader(options: PublishWorkflowDefinitionOptions): string {
+  const deployInput =
+    options.deploy === true
+      ? `
+      deploy_environment:
+        type: choice
+        description: Deploy live systems after a successful publish.
+        options: [none, production]
+        default: none`
+      : '';
   return `name: Publish
 
 on:
@@ -247,7 +283,7 @@ on:
       dry_run:
         type: boolean
         description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
-        default: false
+        default: false${deployInput}
 
 permissions:
   contents: write
@@ -271,12 +307,12 @@ jobs:
 `;
 }
 
-function renderPublishWorkflowSteps(steps: PublishWorkflowStep[]): string {
+function renderPublishWorkflowSteps(steps: PublishWorkflowStep[], options: PublishWorkflowDefinitionOptions): string {
   const lines: string[] = [];
   for (const step of steps) {
     lines.push(...sectionLinesBefore(step));
     lines.push(...commentLinesForStep(step));
-    lines.push(...yamlLinesForStep(step));
+    lines.push(...yamlLinesForStep(step, options));
     lines.push('');
   }
   return `${lines.join('\n').trimEnd()}\n`;
@@ -319,7 +355,7 @@ function commentLinesForStep(step: PublishWorkflowStep): string[] {
   return [`      # Step ${step.number}`];
 }
 
-function yamlLinesForStep(step: PublishWorkflowStep): string[] {
+function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDefinitionOptions): string[] {
   switch (step.kind) {
     case PublishWorkflowStepKind.Checkout:
       return [
@@ -396,6 +432,8 @@ function yamlLinesForStep(step: PublishWorkflowStep): string[] {
         '        # Missing package names are bootstrapped locally before trust setup.',
         `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`,
       ];
+    case PublishWorkflowStepKind.DeployProduction:
+      return deployProductionStep(step, options);
     case PublishWorkflowStepKind.SaveNixDevenv:
       return [
         `      - name: ${step.name}`,
@@ -408,14 +446,33 @@ function yamlLinesForStep(step: PublishWorkflowStep): string[] {
   }
 }
 
-function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
+function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflowDefinitionOptions): string[] {
   return [
     `      - name: ${step.name}`,
-    `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
-    `        run: ${run}`,
+    '        if:',
+    "          ${{ steps.version.outputs.mode != 'none' && inputs.deploy_environment == 'production' && inputs.dry_run !=",
+    "          'true' }}",
+    ...deployEnvLines(options),
+    '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
   ];
 }
 
+function deployEnvLines(options: PublishWorkflowDefinitionOptions): string[] {
+  if (options.deployProvider !== 'cloudflare') {
+    return [];
+  }
+  return [
+    '        env:',
+    '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
+    '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+  ];
+}
+
+function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
+  const condition = "steps.version.outputs.mode != 'none'";
+  return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+}
+
 function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }

package/src/monorepo/runtime.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from 'bun:test';
+import { runtimeTypesRangeForPublishedVersions } from './runtime.js';
+
+describe('runtimeTypesRangeForPublishedVersions', () => {
+  test('uses the installed Node major when @types/node has published it', () => {
+    expect(
+      runtimeTypesRangeForPublishedVersions('@types/node', '24.12.0', 'major', ['24.0.0', '24.12.4', '25.9.1']),
+    ).toBe('~24.0.0');
+  });
+
+  test('falls back to latest published @types/node when the Node major is unpublished', () => {
+    expect(
+      runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['24.12.4', '25.9.0', '25.9.1']),
+    ).toBe('~25.9.1');
+  });
+
+  test('uses the installed Bun version when @types/bun has published it', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/bun', '1.3.14', 'exact', ['1.3.13', '1.3.14'])).toBe('1.3.14');
+  });
+
+  test('falls back to latest published @types/bun when the Bun version is unpublished', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/bun', '1.3.15', 'exact', ['1.3.13', '1.3.14'])).toBe('1.3.14');
+  });
+
+  test('ignores non-stable version strings when choosing the fallback', () => {
+    expect(runtimeTypesRangeForPublishedVersions('@types/node', '26.0.0', 'major', ['25.9.1', '26.0.0-beta.1'])).toBe(
+      '~25.9.1',
+    );
+  });
+});

package/src/monorepo/runtime.ts

@@ -23,8 +23,18 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   changed = setStringProperty(engines, 'node', `>=${nodeMajor}.0.0`) || changed;
   changed = setStringProperty(packageJson, 'packageManager', `bun@${bunVersion}`) || changed;
   const devDependencies = getOrCreateRecord(packageJson, 'devDependencies');
-  changed = setStringProperty(devDependencies, '@types/node', `~${nodeMajor}.0.0`) || changed;
-  changed = setStringProperty(devDependencies, '@types/bun', bunVersion) || changed;
+  changed =
+    setStringProperty(
+      devDependencies,
+      '@types/node',
+      await runtimeTypesRange(root, '@types/node', nodeVersion, 'major'),
+    ) || changed;
+  changed =
+    setStringProperty(
+      devDependencies,
+      '@types/bun',
+      await runtimeTypesRange(root, '@types/bun', bunVersion, 'exact'),
+    ) || changed;
 
   if (changed) {
     writeJsonObject(packageJsonPath, packageJson);
@@ -32,6 +42,88 @@ export async function syncRootRuntimeVersions(root: string): Promise<void> {
   }
 }
 
+type RuntimeTypesPinMode = 'major' | 'exact';
+
+async function runtimeTypesRange(
+  root: string,
+  packageName: string,
+  runtimeVersion: string,
+  pinMode: RuntimeTypesPinMode,
+): Promise<string> {
+  const versionsText = await $`bun pm view ${packageName} versions --json`.cwd(root).text();
+  const versions = JSON.parse(versionsText) as unknown;
+  if (!Array.isArray(versions) || !versions.every((version) => typeof version === 'string')) {
+    throw new Error(`Unable to read published ${packageName} versions`);
+  }
+  return runtimeTypesRangeForPublishedVersions(packageName, runtimeVersion, pinMode, versions);
+}
+
+export function runtimeTypesRangeForPublishedVersions(
+  packageName: string,
+  runtimeVersion: string,
+  pinMode: RuntimeTypesPinMode,
+  versions: readonly string[],
+): string {
+  const parsedRuntimeVersion = parseVersion(runtimeVersion);
+  if (!parsedRuntimeVersion) {
+    throw new Error(`Unable to parse runtime version ${runtimeVersion}`);
+  }
+
+  if (pinMode === 'major') {
+    const runtimeMajor = parsedRuntimeVersion[0].toString();
+    if (latestVersion(versions.filter((version) => versionMajor(version) === runtimeMajor))) {
+      return `~${runtimeMajor}.0.0`;
+    }
+  } else if (versions.includes(runtimeVersion)) {
+    return runtimeVersion;
+  }
+
+  const latest = latestVersion(versions);
+  if (!latest) {
+    throw new Error(`Unable to find any published ${packageName} versions`);
+  }
+
+  console.warn(`${packageName} has no published types for runtime ${runtimeVersion}; using ${latest}`);
+  return pinMode === 'major' ? `~${latest}` : latest;
+}
+
+function latestVersion(versions: readonly string[]): string | null {
+  let latest: string | null = null;
+  for (const version of versions) {
+    if (!parseVersion(version)) {
+      continue;
+    }
+    if (!latest || compareVersions(version, latest) > 0) {
+      latest = version;
+    }
+  }
+  return latest;
+}
+
+function compareVersions(left: string, right: string): number {
+  const leftParts = parseVersion(left);
+  const rightParts = parseVersion(right);
+  if (!leftParts || !rightParts) {
+    return 0;
+  }
+  for (let index = 0; index < leftParts.length; index++) {
+    const diff = leftParts[index] - rightParts[index];
+    if (diff !== 0) {
+      return diff;
+    }
+  }
+  return 0;
+}
+
+function versionMajor(version: string): string | null {
+  return parseVersion(version)?.[0].toString() ?? null;
+}
+
+function parseVersion(version: string): [number, number, number] | null {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version);
+  return match ? [Number(match[1]), Number(match[2]), Number(match[3])] : null;
+}
+
 function runtimeCommand(root: string, name: 'bun' | 'node'): string {
   const candidates = [
     join(root, 'tooling', 'direnv', '.devenv', 'profile', 'bin', name),

package/src/release/__tests__/fixture-repo.test.ts

@@ -1,7 +1,6 @@
 import { describe, expect, it } from 'bun:test';
 import { readFile, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { $ } from 'bun';
 import { collectOwnedReleaseTagRecords, pendingReleaseTargets, type ReleasePackageInfo, releaseTag } from '../core.js';
 import { completeReleaseAtHead, type ReleaseRepairShell, repairPendingTargets } from '../orchestration.js';
 import {
@@ -9,7 +8,9 @@ import {
   gitIsAncestor,
   gitOutput,
   gitReleaseTagsByCreatorDate,
+  gitSucceeds,
   packageVersionAtRef,
+  runFixtureNx,
   tag,
   withFixtureRepo,
   writeBuildablePackage,
@@ -78,7 +79,7 @@ describe('release planning with fixture git repositories', () => {
       await git(root, ['init', '--bare', 'remote.git']);
       await git(root, ['remote', 'add', 'origin', join(root, 'remote.git')]);
       await git(root, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(root, 'remote.git')} checkout`.cwd(root).quiet();
+      await git(root, ['clone', '--branch', 'main', join(root, 'remote.git'), 'checkout']);
       const checkout = join(root, 'checkout');
       await git(checkout, ['fetch', '--tags', 'origin', 'main']);
       const head = await gitOutput(checkout, ['rev-parse', 'HEAD']);
@@ -105,7 +106,7 @@ describe('release planning with fixture git repositories', () => {
       await writeBuildablePackage(root, '@scope/a', 'packages/a');
       await writeBuildablePackage(root, '@scope/b', 'packages/b');
 
-      await $`nx run-many -t build --projects=${'a,b'}`.cwd(root).quiet();
+      await runFixtureNx(root, ['run-many', '-t', 'build', '--projects=a,b']);
 
       await expect(readFile(join(root, 'packages/a/dist/index.js'), 'utf8')).resolves.toBe('{}\n');
       await expect(readFile(join(root, 'packages/b/dist/index.js'), 'utf8')).resolves.toBe('{}\n');
@@ -143,7 +144,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -197,7 +198,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -213,7 +214,7 @@ describe('release planning with fixture git repositories', () => {
 
       expect(summary.pushed).toBe(true);
       expect(shell.pushes).toEqual([['pushed@1.0.0']]);
-      await $`git clone --branch main ${join(author, 'remote.git')} auditor`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'auditor']);
       const auditor = join(author, 'auditor');
       await git(auditor, ['fetch', '--tags', 'origin', 'main']);
       await expect(gitOutput(auditor, ['rev-parse', 'refs/tags/pushed@1.0.0^{}'])).resolves.toBe(
@@ -237,7 +238,7 @@ describe('release planning with fixture git repositories', () => {
       await git(author, ['init', '--bare', 'remote.git']);
       await git(author, ['remote', 'add', 'origin', join(author, 'remote.git')]);
       await git(author, ['push', 'origin', 'main', '--tags']);
-      await $`git clone --branch main ${join(author, 'remote.git')} runner`.cwd(author).quiet();
+      await git(author, ['clone', '--branch', 'main', join(author, 'remote.git'), 'runner']);
       const runner = join(author, 'runner');
       await git(runner, ['config', 'user.name', 'Test User']);
       await git(runner, ['config', 'user.email', 'test@example.com']);
@@ -323,7 +324,12 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
 
   async buildReleaseCandidate(packages: ReleasePackageInfo[]): Promise<void> {
     this.builds.push(packages.map((pkg) => pkg.name));
-    await $`nx run-many -t build --projects=${packages.map((pkg) => pkg.projectName).join(',')}`.cwd(this.root).quiet();
+    await runFixtureNx(this.root, [
+      'run-many',
+      '-t',
+      'build',
+      `--projects=${packages.map((pkg) => pkg.projectName).join(',')}`,
+    ]);
   }
 
   async publishPackage(pkg: ReleasePackageInfo, distTag: string, dryRun: boolean): Promise<void> {
@@ -357,8 +363,3 @@ class LocalGitRepairShell implements ReleaseRepairShell<ReleasePackageInfo> {
     await git(this.root, ['tag', '-a', tagName, '-m', tagName, 'HEAD']);
   }
 }
-
-async function gitSucceeds(root: string, args: string[]): Promise<boolean> {
-  const result = await $`git ${args}`.cwd(root).quiet().nothrow();
-  return result.exitCode === 0;
-}

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -4,6 +4,8 @@ import { join } from 'node:path';
 import { $ } from 'bun';
 import type { GitReleaseTagInfo } from '../../core.js';
 
+const GIT_TIMEOUT_MS = 10_000;
+
 export async function withFixtureRepo(fn: (root: string) => Promise<void>): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-release-test-'));
   try {
@@ -63,26 +65,98 @@ export async function writeBuildablePackage(
 }
 
 export async function git(root: string, args: string[], env?: Record<string, string>): Promise<void> {
-  await $`git ${args}`
-    .cwd(root)
-    .env(env ?? {})
-    .quiet();
+  const result = await gitResult(root, args, env);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, args, result));
+  }
 }
 
 export async function gitOutput(root: string, args: string[]): Promise<string> {
-  const result = await $`git ${args}`.cwd(root).quiet();
+  const result = await gitResult(root, args);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, args, result));
+  }
   return new TextDecoder().decode(result.stdout).trim();
 }
 
+export async function gitSucceeds(root: string, args: string[]): Promise<boolean> {
+  return (await gitResult(root, args)).exitCode === 0;
+}
+
+async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
+  const proc = Bun.spawn(['git', ...args], {
+    cwd: root,
+    env: { ...process.env, ...env },
+    stdout: 'pipe',
+    stderr: 'pipe',
+  });
+  let timedOut = false;
+  const timeout = setTimeout(() => {
+    timedOut = true;
+    proc.kill();
+  }, GIT_TIMEOUT_MS);
+  try {
+    const [exitCode, stdout, stderr] = await Promise.all([
+      proc.exited,
+      streamBytes(proc.stdout),
+      streamBytes(proc.stderr),
+    ]);
+    return { exitCode, stdout, stderr, timedOut };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function streamBytes(stream: ReadableStream<Uint8Array>): Promise<Uint8Array> {
+  return new Uint8Array(await new Response(stream).arrayBuffer());
+}
+
+export async function runFixtureNx(root: string, args: string[]): Promise<void> {
+  await $`nx ${args}`
+    .cwd(root)
+    .env({ ...definedProcessEnv(), NX_DAEMON: 'false' })
+    .quiet();
+}
+
+function definedProcessEnv(): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value !== undefined) {
+      env[key] = value;
+    }
+  }
+  return env;
+}
+
+interface GitResult {
+  exitCode: number;
+  stdout: Uint8Array;
+  stderr: Uint8Array;
+  timedOut: boolean;
+}
+
+function gitErrorMessage(root: string, args: string[], result: GitResult): string {
+  const stderr = new TextDecoder().decode(result.stderr).trim();
+  const timeoutText = result.timedOut
+    ? ` timed out after ${GIT_TIMEOUT_MS}ms`
+    : ` failed with exit code ${result.exitCode}`;
+  return [`git ${args.join(' ')}${timeoutText}`, `cwd: ${root}`, stderr].filter(Boolean).join('\n');
+}
+
 export async function tag(root: string, tagName: string, date: string): Promise<void> {
   await git(root, ['tag', '-a', tagName, '-m', tagName], { GIT_COMMITTER_DATE: date });
 }
 
 export async function gitReleaseTagsByCreatorDate(root: string): Promise<GitReleaseTagInfo[]> {
-  const result =
-    await $`git for-each-ref --sort=-creatordate --format=${'%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)'} refs/tags`
-      .cwd(root)
-      .quiet();
+  const result = await gitResult(root, [
+    'for-each-ref',
+    '--sort=-creatordate',
+    '--format=%(refname:short)%09%(creatordate:unix)%09%(*objectname)%09%(objectname)',
+    'refs/tags',
+  ]);
+  if (result.exitCode !== 0) {
+    throw new Error(gitErrorMessage(root, ['for-each-ref', 'refs/tags'], result));
+  }
   return new TextDecoder()
     .decode(result.stdout)
     .split('\n')
@@ -100,12 +174,11 @@ export async function gitReleaseTagsByCreatorDate(root: string): Promise<GitRele
 }
 
 export async function gitIsAncestor(root: string, ancestor: string, descendant: string): Promise<boolean> {
-  const result = await $`git merge-base --is-ancestor ${ancestor} ${descendant}`.cwd(root).quiet().nothrow();
-  return result.exitCode === 0;
+  return gitSucceeds(root, ['merge-base', '--is-ancestor', ancestor, descendant]);
 }
 
 export async function packageVersionAtRef(root: string, packagePath: string, ref: string): Promise<string | null> {
-  const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
+  const result = await gitResult(root, ['show', `${ref}:${packagePath}/package.json`]);
   if (result.exitCode !== 0) {
     return null;
   }

package/managed/templates/github/workflows/ci.yml

@@ -1,102 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-
-permissions:
-  actions: read
-  contents: read
-  statuses: write
-
-defaults:
-  run:
-    working-directory: tooling/direnv
-
-jobs:
-  main:
-    name: Validate
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      # Step 1: GitHub adds "Set up job" automatically
-      # Step 2
-      - name: 📥 Checkout
-        uses: actions/checkout@v6.0.2
-        with:
-          filter: blob:none
-          fetch-depth: 0
-
-      # Step 3. Composite action internals do not affect top-level job step
-      # anchors; update the nx-smart --step values below if top-level steps move.
-      - name: 🧱 Setup Nix/devenv
-        id: setup
-        uses: ./.github/actions/setup-devenv
-
-      # --- Nx -----------------------------------------------------------------
-
-      # Step 4
-      # Sets the base and head SHAs required for the nx affected commands
-      - name: 🧭 Set Nx SHAs
-        uses: nrwl/nx-set-shas@v5.0.1
-        with:
-          workflow-id: ci.yml
-
-      # Step 5
-      - name: 🧠 Restore Nx cache
-        id: nx-cache
-        uses: ./.github/actions/cache-nx
-
-      # Step 6
-      - name: 🔨 Build
-        run: smoo github-ci nx-smart --target build --name "Build" --step 6
-
-      # Step 7
-      - name: 🔍 Lint
-        run: smoo github-ci nx-smart --target lint --name "Lint" --step 7
-
-      # Step 8
-      - name: 🧪 Unit Tests
-        run: smoo github-ci nx-smart --target test --name "Unit Tests" --step 8
-
-      # Step 9
-      # Nx's database cache needs artifact files and .nx/workspace-data DB
-      # metadata restored together; GitHub Actions cache is only the archive
-      # transport. Save runs only after build/lint/test succeed on the default
-      # branch, so PRs may restore shared cache but cannot publish it.
-      - name: 💾 Save Nx cache
-        if:
-          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',
-          github.event.repository.default_branch) && steps.nx-cache.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v5.0.5
-        with:
-          path: |
-            .nx/cache
-            .nx/workspace-data/*.db*
-          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}
-
-      # Step 10
-      - name: 📎 Upload trace DBs
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v7.0.1
-        with:
-          name: trace-results-${{ github.run_id }}
-          path: packages/*/.trace-results.db
-          if-no-files-found: ignore
-          retention-days: 14
-          include-hidden-files: true
-
-      # --- Cleanup ------------------------------------------------------------
-
-      # Step 11
-      - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
-        uses: ./.github/actions/save-nix-devenv
-        with:
-          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
-          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}