@smoothbricks/cli 0.3.4 → 0.4.0

package/src/monorepo/publish-workflow.ts

@@ -1,8 +1,9 @@
 import { isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
 
 export type PublishWorkflowBump = 'auto' | 'patch' | 'minor' | 'major' | 'prerelease';
-export type PublishWorkflowCondition = 'version-mode-not-none' | 'failure' | 'always';
+export type PublishWorkflowCondition = 'version-mode-not-none' | 'deploy-production' | 'failure' | 'always';
 export type PublishWorkflowNxTarget = 'build' | 'lint' | 'test';
+export type PublishWorkflowDeployEnvironment = 'none' | 'production';
 
 export enum PublishWorkflowStepKind {
   Checkout = 'checkout',
@@ -18,6 +19,7 @@ export enum PublishWorkflowStepKind {
   UploadTraceDbs = 'upload-trace-dbs',
   ValidateMonorepoConfig = 'validate-monorepo-config',
   PublishRelease = 'publish-release',
+  DeployProduction = 'deploy-production',
   SaveNixDevenv = 'save-nix-devenv',
 }
 
@@ -35,11 +37,14 @@ export interface PublishWorkflowDefinition {
 }
 
 export interface PublishWorkflowDefinitionOptions {
+  deploy?: boolean;
+  deployProvider?: 'cloudflare';
   repoName?: string;
 }
 
 export interface PublishWorkflowInputs {
   bump: PublishWorkflowBump;
+  deployEnvironment: PublishWorkflowDeployEnvironment;
   dryRun: boolean;
 }
 
@@ -65,6 +70,7 @@ export interface PublishWorkflowCallbacks {
   uploadTraceDbs(): Promise<void>;
   validateMonorepoConfig(): Promise<void>;
   publishRelease(input: { bump: PublishWorkflowBump; dryRun: boolean }): Promise<void>;
+  deployProduction(): Promise<void>;
   saveNixDevenv(input: PublishWorkflowSetupOutputs): Promise<void>;
 }
 
@@ -90,6 +96,19 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
   if (isSmoothBricksCodebasePackageName(options.repoName)) {
     setupSteps.push({ kind: PublishWorkflowStepKind.BuildSelfHostedCli, name: '🏗️ Build self-hosted smoo' });
   }
+  const releaseSteps: PublishWorkflowStepInput[] = [
+    {
+      kind: PublishWorkflowStepKind.PublishRelease,
+      name: `📦 Publish release (${versionMode})`,
+    },
+  ];
+  if (options.deploy === true) {
+    releaseSteps.push({
+      kind: PublishWorkflowStepKind.DeployProduction,
+      name: '🚀 Deploy production',
+      condition: 'deploy-production',
+    });
+  }
   return {
     steps: numberWorkflowSteps([
       ...setupSteps,
@@ -127,10 +146,7 @@ export function definePublishWorkflow(options: PublishWorkflowDefinitionOptions
         name: `✅ Validate monorepo config (${versionMode})`,
         condition: 'version-mode-not-none',
       },
-      {
-        kind: PublishWorkflowStepKind.PublishRelease,
-        name: `📦 Publish release (${versionMode})`,
-      },
+      ...releaseSteps,
       {
         kind: PublishWorkflowStepKind.SaveNixDevenv,
         name: '🧹 Cleanup and cache Nix/devenv',
@@ -153,7 +169,7 @@ export async function runPublishWorkflow(
   let failed = false;
   let failure: unknown;
   for (const step of workflow.steps) {
-    if (!shouldRunStep(step, version, failed)) {
+    if (!shouldRunStep(step, version, failed, context.inputs)) {
       continue;
     }
     try {
@@ -201,6 +217,9 @@ export async function runPublishWorkflow(
             dryRun: context.inputs.dryRun,
           });
           break;
+        case PublishWorkflowStepKind.DeployProduction:
+          await context.callbacks.deployProduction();
+          break;
         case PublishWorkflowStepKind.SaveNixDevenv:
           await context.callbacks.saveNixDevenv(setupOutputs);
           break;
@@ -216,10 +235,18 @@ export async function runPublishWorkflow(
   return { version, failed };
 }
 
-function shouldRunStep(step: PublishWorkflowStep, version: PublishWorkflowVersionOutputs, failed: boolean): boolean {
+function shouldRunStep(
+  step: PublishWorkflowStep,
+  version: PublishWorkflowVersionOutputs,
+  failed: boolean,
+  inputs: PublishWorkflowInputs,
+): boolean {
   if (step.condition === 'version-mode-not-none') {
     return version.mode !== 'none';
   }
+  if (step.condition === 'deploy-production') {
+    return version.mode !== 'none' && inputs.deployEnvironment === 'production' && !inputs.dryRun;
+  }
   if (step.condition === 'failure') {
     return failed;
   }
@@ -228,10 +255,19 @@ function shouldRunStep(step: PublishWorkflowStep, version: PublishWorkflowVersio
 
 export function renderPublishWorkflowYaml(options: PublishWorkflowDefinitionOptions = {}): string {
   const steps = definePublishWorkflow(options).steps;
-  return `${renderPublishWorkflowHeader()}${renderPublishWorkflowSteps(steps)}`;
+  return `${renderPublishWorkflowHeader(options)}${renderPublishWorkflowSteps(steps, options)}`;
 }
 
-function renderPublishWorkflowHeader(): string {
+function renderPublishWorkflowHeader(options: PublishWorkflowDefinitionOptions): string {
+  const deployInput =
+    options.deploy === true
+      ? `
+      deploy_environment:
+        type: choice
+        description: Deploy live systems after a successful publish.
+        options: [none, production]
+        default: none`
+      : '';
   return `name: Publish
 
 on:
@@ -247,7 +283,7 @@ on:
       dry_run:
         type: boolean
         description: Run release commands without writing versions, tags, publishes, or GitHub Releases.
-        default: false
+        default: false${deployInput}
 
 permissions:
   contents: write
@@ -271,12 +307,12 @@ jobs:
 `;
 }
 
-function renderPublishWorkflowSteps(steps: PublishWorkflowStep[]): string {
+function renderPublishWorkflowSteps(steps: PublishWorkflowStep[], options: PublishWorkflowDefinitionOptions): string {
   const lines: string[] = [];
   for (const step of steps) {
     lines.push(...sectionLinesBefore(step));
     lines.push(...commentLinesForStep(step));
-    lines.push(...yamlLinesForStep(step));
+    lines.push(...yamlLinesForStep(step, options));
     lines.push('');
   }
   return `${lines.join('\n').trimEnd()}\n`;
@@ -319,7 +355,7 @@ function commentLinesForStep(step: PublishWorkflowStep): string[] {
   return [`      # Step ${step.number}`];
 }
 
-function yamlLinesForStep(step: PublishWorkflowStep): string[] {
+function yamlLinesForStep(step: PublishWorkflowStep, options: PublishWorkflowDefinitionOptions): string[] {
   switch (step.kind) {
     case PublishWorkflowStepKind.Checkout:
       return [
@@ -396,6 +432,8 @@ function yamlLinesForStep(step: PublishWorkflowStep): string[] {
         '        # Missing package names are bootstrapped locally before trust setup.',
         `        run: smoo release publish --bump "${githubExpression('inputs.bump')}" --dry-run "${githubExpression('inputs.dry_run')}"`,
       ];
+    case PublishWorkflowStepKind.DeployProduction:
+      return deployProductionStep(step, options);
     case PublishWorkflowStepKind.SaveNixDevenv:
       return [
         `      - name: ${step.name}`,
@@ -408,14 +446,33 @@ function yamlLinesForStep(step: PublishWorkflowStep): string[] {
   }
 }
 
-function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
+function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflowDefinitionOptions): string[] {
   return [
     `      - name: ${step.name}`,
-    `        if: ${githubExpression("steps.version.outputs.mode != 'none'")}`,
-    `        run: ${run}`,
+    '        if:',
+    "          ${{ steps.version.outputs.mode != 'none' && inputs.deploy_environment == 'production' && inputs.dry_run !=",
+    "          'true' }}",
+    ...deployEnvLines(options),
+    '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
   ];
 }
 
+function deployEnvLines(options: PublishWorkflowDefinitionOptions): string[] {
+  if (options.deployProvider !== 'cloudflare') {
+    return [];
+  }
+  return [
+    '        env:',
+    '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
+    '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+  ];
+}
+
+function conditionalRunStep(step: PublishWorkflowStep, run: string): string[] {
+  const condition = "steps.version.outputs.mode != 'none'";
+  return [`      - name: ${step.name}`, `        if: ${githubExpression(condition)}`, `        run: ${run}`];
+}
+
 function githubExpression(expression: string): string {
   return ['$', '{{ ', expression, ' }}'].join('');
 }

package/managed/templates/github/workflows/ci.yml

@@ -1,102 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches:
-      - '**'
-  pull_request:
-
-permissions:
-  actions: read
-  contents: read
-  statuses: write
-
-defaults:
-  run:
-    working-directory: tooling/direnv
-
-jobs:
-  main:
-    name: Validate
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    env:
-      NIX_STORE_NAR: ${{ github.workspace }}/nix-store.nar
-      GH_TOKEN: ${{ github.token }}
-    steps:
-      # Step 1: GitHub adds "Set up job" automatically
-      # Step 2
-      - name: 📥 Checkout
-        uses: actions/checkout@v6.0.2
-        with:
-          filter: blob:none
-          fetch-depth: 0
-
-      # Step 3. Composite action internals do not affect top-level job step
-      # anchors; update the nx-smart --step values below if top-level steps move.
-      - name: 🧱 Setup Nix/devenv
-        id: setup
-        uses: ./.github/actions/setup-devenv
-
-      # --- Nx -----------------------------------------------------------------
-
-      # Step 4
-      # Sets the base and head SHAs required for the nx affected commands
-      - name: 🧭 Set Nx SHAs
-        uses: nrwl/nx-set-shas@v5.0.1
-        with:
-          workflow-id: ci.yml
-
-      # Step 5
-      - name: 🧠 Restore Nx cache
-        id: nx-cache
-        uses: ./.github/actions/cache-nx
-
-      # Step 6
-      - name: 🔨 Build
-        run: smoo github-ci nx-smart --target build --name "Build" --step 6
-
-      # Step 7
-      - name: 🔍 Lint
-        run: smoo github-ci nx-smart --target lint --name "Lint" --step 7
-
-      # Step 8
-      - name: 🧪 Unit Tests
-        run: smoo github-ci nx-smart --target test --name "Unit Tests" --step 8
-
-      # Step 9
-      # Nx's database cache needs artifact files and .nx/workspace-data DB
-      # metadata restored together; GitHub Actions cache is only the archive
-      # transport. Save runs only after build/lint/test succeed on the default
-      # branch, so PRs may restore shared cache but cannot publish it.
-      - name: 💾 Save Nx cache
-        if:
-          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',
-          github.event.repository.default_branch) && steps.nx-cache.outputs.cache-hit != 'true' }}
-        uses: actions/cache/save@v5.0.5
-        with:
-          path: |
-            .nx/cache
-            .nx/workspace-data/*.db*
-          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}
-
-      # Step 10
-      - name: 📎 Upload trace DBs
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v7.0.1
-        with:
-          name: trace-results-${{ github.run_id }}
-          path: packages/*/.trace-results.db
-          if-no-files-found: ignore
-          retention-days: 14
-          include-hidden-files: true
-
-      # --- Cleanup ------------------------------------------------------------
-
-      # Step 11
-      - name: 🧹 Cleanup and cache Nix/devenv
-        if: ${{ always() }}
-        uses: ./.github/actions/save-nix-devenv
-        with:
-          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}
-          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}