@smoothbricks/cli 0.3.4 → 0.4.1

package/src/monorepo/__tests__/publish-workflow.test.ts

@@ -28,6 +28,61 @@ describe('publish workflow definition', () => {
     expect(rendered).toContain('packages must already exist on npm and use trusted publishing/OIDC');
   });
 
+  it('omits production deploy controls when no production deploy target exists', () => {
+    const rendered = renderPublishWorkflowYaml({ repoName: '@smoothbricks/codebase' });
+
+    expect(rendered).not.toContain('deploy_environment');
+    expect(rendered).not.toContain('Deploy production');
+    expect(rendered).not.toContain('nx-deploy');
+  });
+
+  it('renders production deploy controls for repos with production deploy targets', () => {
+    const rendered = renderPublishWorkflowYaml({ deploy: true, repoName: '@smoothbricks/codebase' });
+
+    expect(rendered).toContain('deploy_environment:');
+    expect(rendered).toContain('- name: 🚀 Deploy production');
+    expect(rendered).not.toContain('CLOUDFLARE_API_TOKEN');
+    expect(rendered).not.toContain('CLOUDFLARE_ACCOUNT_ID');
+    expect(rendered).toContain(
+      'smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+    );
+  });
+
+  it('adds Cloudflare credentials for Wrangler-backed production deploys', () => {
+    const rendered = renderPublishWorkflowYaml({
+      deploy: true,
+      deployProvider: 'cloudflare',
+      repoName: '@smoothbricks/codebase',
+    });
+
+    expect(rendered).toContain('CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}');
+    expect(rendered).toContain('CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}');
+  });
+
+  it('deploys production only after a real publish when requested', async () => {
+    const deployed = await publishWorkflowScenario({
+      deploy: true,
+      repairs: [],
+      current: [],
+      bump: 'auto',
+      deployEnvironment: 'production',
+      dryRun: false,
+      version: { mode: 'new', projects: ['app'] },
+    }).run();
+    const dryRun = await publishWorkflowScenario({
+      deploy: true,
+      repairs: [],
+      current: [],
+      bump: 'auto',
+      deployEnvironment: 'production',
+      dryRun: true,
+      version: { mode: 'new', projects: ['app'] },
+    }).run();
+
+    expect(deployed.productionDeployed).toBe(true);
+    expect(dryRun.productionDeployed).toBe(false);
+  });
+
   it('bootstraps the self-hosted CLI before release commands only for the SmoothBricks repo', async () => {
     const smoothbricks = await publishWorkflowScenario({
       repoName: '@smoothbricks/codebase',
@@ -143,10 +198,12 @@ interface ReleaseGap {
 }
 
 interface WorkflowScenarioConfig {
+  deploy?: boolean;
   repoName?: string;
   repairs: ReleaseGap[];
   current: ReleaseGap[];
   bump: PublishWorkflowBump;
+  deployEnvironment?: 'none' | 'production';
   dryRun: boolean;
   version: PublishWorkflowVersionOutputs;
 }
@@ -161,6 +218,7 @@ interface WorkflowOutcome {
   repairBuildArtifacts: string[];
   validation: { checks: number; builds: string[]; lints: string[]; tests: string[]; validates: number };
   publishRan: boolean;
+  productionDeployed: boolean;
   publishSawValidatedRelease: boolean;
   publishCompletedTags: string[];
   remainingDurableGaps: string[];
@@ -170,8 +228,8 @@ function publishWorkflowScenario(config: WorkflowScenarioConfig): { run(): Promi
   return {
     async run() {
       const state = new WorkflowScenarioState(config);
-      await runPublishWorkflow(definePublishWorkflow({ repoName: config.repoName }), {
-        inputs: { bump: config.bump, dryRun: config.dryRun },
+      await runPublishWorkflow(definePublishWorkflow({ deploy: config.deploy, repoName: config.repoName }), {
+        inputs: { bump: config.bump, deployEnvironment: config.deployEnvironment ?? 'none', dryRun: config.dryRun },
         callbacks: state.callbacks(),
       });
       return state.outcome();
@@ -186,6 +244,7 @@ class WorkflowScenarioState {
   private repairObservedSelfHostedCli = false;
   private versionObservedSelfHostedCli = false;
   private publishReleaseRan = false;
+  private productionDeployRan = false;
   private publishSawValidation = false;
   private readonly repaired = new Set<string>();
   private readonly repairBuilds = new Set<string>();
@@ -275,6 +334,9 @@ class WorkflowScenarioState {
           }
         }
       },
+      deployProduction: async () => {
+        this.productionDeployRan = true;
+      },
       saveNixDevenv: async () => {},
     };
   }
@@ -296,6 +358,7 @@ class WorkflowScenarioState {
         validates: this.validationState.validates,
       },
       publishRan: this.publishReleaseRan,
+      productionDeployed: this.productionDeployRan,
       publishSawValidatedRelease: this.publishSawValidation,
       publishCompletedTags: [...this.publishedCurrent].sort(),
       remainingDurableGaps: [...this.durableGaps].sort(),

package/src/monorepo/ci-workflow.ts

@@ -0,0 +1,229 @@
+export enum CiWorkflowStepKind {
+  Checkout = 'checkout',
+  SetupDevenv = 'setup-devenv',
+  SetNxShas = 'set-nx-shas',
+  RestoreNxCache = 'restore-nx-cache',
+  Build = 'build',
+  Lint = 'lint',
+  UnitTests = 'unit-tests',
+  Deploy = 'deploy',
+  SaveNxCache = 'save-nx-cache',
+  UploadTraceDbs = 'upload-trace-dbs',
+  SaveNixDevenv = 'save-nix-devenv',
+}
+
+export interface CiWorkflowStep {
+  kind: CiWorkflowStepKind;
+  name: string;
+  number: number;
+}
+
+export interface CiWorkflowDefinitionOptions {
+  deploy: boolean;
+  deployProvider?: 'cloudflare';
+  pushBranches: string[];
+}
+
+type CiWorkflowStepInput = Omit<CiWorkflowStep, 'number'>;
+
+export function defineCiWorkflow(options: CiWorkflowDefinitionOptions): CiWorkflowStep[] {
+  const steps: CiWorkflowStepInput[] = [
+    { kind: CiWorkflowStepKind.Checkout, name: '📥 Checkout' },
+    { kind: CiWorkflowStepKind.SetupDevenv, name: '🧱 Setup Nix/devenv' },
+    { kind: CiWorkflowStepKind.SetNxShas, name: '🧭 Set Nx SHAs' },
+    { kind: CiWorkflowStepKind.RestoreNxCache, name: '🧠 Restore Nx cache' },
+    { kind: CiWorkflowStepKind.Build, name: '🔨 Build' },
+    { kind: CiWorkflowStepKind.Lint, name: '🔍 Lint' },
+    { kind: CiWorkflowStepKind.UnitTests, name: '🧪 Unit Tests' },
+  ];
+  if (options.deploy) {
+    steps.push({ kind: CiWorkflowStepKind.Deploy, name: '🚀 Deploy Staging' });
+  }
+  steps.push(
+    { kind: CiWorkflowStepKind.SaveNxCache, name: '💾 Save Nx cache' },
+    { kind: CiWorkflowStepKind.UploadTraceDbs, name: '📎 Upload trace DBs' },
+    { kind: CiWorkflowStepKind.SaveNixDevenv, name: '🧹 Cleanup and cache Nix/devenv' },
+  );
+  return steps.map((step, index) => ({ ...step, number: index + 2 }));
+}
+
+export function renderCiWorkflowYaml(options: CiWorkflowDefinitionOptions): string {
+  const steps = defineCiWorkflow(options);
+  return `${renderCiWorkflowHeader(options)}${renderCiWorkflowSteps(steps, options)}`;
+}
+
+function renderCiWorkflowHeader(options: CiWorkflowDefinitionOptions): string {
+  return `name: CI
+
+on:
+  push:
+    branches:
+${renderYamlList(options.pushBranches, 6)}
+  pull_request:
+
+permissions:
+  actions: read
+  contents: read
+  statuses: write
+
+defaults:
+  run:
+    working-directory: tooling/direnv
+
+jobs:
+  main:
+    name: Validate
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    env:
+      NIX_STORE_NAR: ${githubExpression('github.workspace')}/nix-store.nar
+      GH_TOKEN: ${githubExpression('github.token')}
+    steps:
+`;
+}
+
+function githubExpression(expression: string): string {
+  return `$${`{{ ${expression} }}`}`;
+}
+
+function renderCiWorkflowSteps(steps: CiWorkflowStep[], options: CiWorkflowDefinitionOptions): string {
+  const lines: string[] = [];
+  for (const step of steps) {
+    lines.push(...sectionLinesBefore(step));
+    lines.push(...commentLinesForStep(step));
+    lines.push(...yamlLinesForStep(step, options));
+    lines.push('');
+  }
+  return `${lines.join('\n').trimEnd()}\n`;
+}
+
+function sectionLinesBefore(step: CiWorkflowStep): string[] {
+  if (step.kind === CiWorkflowStepKind.SetNxShas) {
+    return ['      # --- Nx -----------------------------------------------------------------', ''];
+  }
+  if (step.kind === CiWorkflowStepKind.SaveNixDevenv) {
+    return ['      # --- Cleanup ------------------------------------------------------------', ''];
+  }
+  return [];
+}
+
+function commentLinesForStep(step: CiWorkflowStep): string[] {
+  if (step.kind === CiWorkflowStepKind.Checkout) {
+    return ['      # Step 1: GitHub adds "Set up job" automatically', '      # Step 2'];
+  }
+  if (step.kind === CiWorkflowStepKind.SetupDevenv) {
+    return [
+      '      # Step 3. Composite action internals do not affect top-level job step',
+      '      # anchors; update the nx-smart --step values below if top-level steps move.',
+    ];
+  }
+  if (step.kind === CiWorkflowStepKind.SetNxShas) {
+    return [`      # Step ${step.number}`, '      # Sets the base and head SHAs required for the nx affected commands'];
+  }
+  if (step.kind === CiWorkflowStepKind.SaveNxCache) {
+    return [
+      `      # Step ${step.number}`,
+      "      # Nx's database cache needs artifact files and .nx/workspace-data DB",
+      '      # metadata restored together; GitHub Actions cache is only the archive',
+      '      # transport. Save runs only after prior required steps succeed on the default',
+      '      # branch, so PRs may restore shared cache but cannot publish it.',
+    ];
+  }
+  return [`      # Step ${step.number}`];
+}
+
+function yamlLinesForStep(step: CiWorkflowStep, options: CiWorkflowDefinitionOptions): string[] {
+  switch (step.kind) {
+    case CiWorkflowStepKind.Checkout:
+      return [
+        `      - name: ${step.name}`,
+        '        uses: actions/checkout@v6.0.2',
+        '        with:',
+        '          filter: blob:none',
+        '          fetch-depth: 0',
+      ];
+    case CiWorkflowStepKind.SetupDevenv:
+      return [`      - name: ${step.name}`, '        id: setup', '        uses: ./.github/actions/setup-devenv'];
+    case CiWorkflowStepKind.SetNxShas:
+      return [
+        `      - name: ${step.name}`,
+        '        uses: nrwl/nx-set-shas@v5.0.1',
+        '        with:',
+        '          workflow-id: ci.yml',
+      ];
+    case CiWorkflowStepKind.RestoreNxCache:
+      return [`      - name: ${step.name}`, '        id: nx-cache', '        uses: ./.github/actions/cache-nx'];
+    case CiWorkflowStepKind.Build:
+      return nxSmartStep(step, 'build', 'Build');
+    case CiWorkflowStepKind.Lint:
+      return nxSmartStep(step, 'lint', 'Lint');
+    case CiWorkflowStepKind.UnitTests:
+      return nxSmartStep(step, 'test', 'Unit Tests');
+    case CiWorkflowStepKind.Deploy:
+      return [
+        `      - name: ${step.name}`,
+        '        if:',
+        "          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',",
+        '          github.event.repository.default_branch) }}',
+        ...deployEnvLines(options),
+        `        run: smoo github-ci nx-deploy --configuration staging --mode affected --name "Deploy Staging" --step ${step.number}`,
+      ];
+    case CiWorkflowStepKind.SaveNxCache:
+      return [
+        `      - name: ${step.name}`,
+        '        if:',
+        "          ${{ github.event_name == 'push' && github.ref == format('refs/heads/{0}',",
+        "          github.event.repository.default_branch) && steps.nx-cache.outputs.cache-hit != 'true' }}",
+        '        uses: actions/cache/save@v5.0.5',
+        '        with:',
+        '          path: |',
+        '            .nx/cache',
+        '            .nx/workspace-data/*.db*',
+        '          key: ${{ runner.os }}-nx-db-v1-${{ github.sha }}',
+      ];
+    case CiWorkflowStepKind.UploadTraceDbs:
+      return [
+        `      - name: ${step.name}`,
+        '        if: ${{ always() }}',
+        '        uses: actions/upload-artifact@v7.0.1',
+        '        with:',
+        '          name: trace-results-${{ github.run_id }}',
+        '          path: packages/*/.trace-results.db',
+        '          if-no-files-found: ignore',
+        '          retention-days: 14',
+        '          include-hidden-files: true',
+      ];
+    case CiWorkflowStepKind.SaveNixDevenv:
+      return [
+        `      - name: ${step.name}`,
+        '        if: ${{ always() }}',
+        '        uses: ./.github/actions/save-nix-devenv',
+        '        with:',
+        '          nix-cache-hit: ${{ steps.setup.outputs.nix-cache-hit }}',
+        '          devenv-cache-hit: ${{ steps.setup.outputs.devenv-cache-hit }}',
+      ];
+  }
+}
+
+function deployEnvLines(options: CiWorkflowDefinitionOptions): string[] {
+  if (options.deployProvider !== 'cloudflare') {
+    return [];
+  }
+  return [
+    '        env:',
+    '          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}',
+    '          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}',
+  ];
+}
+
+function nxSmartStep(step: CiWorkflowStep, target: string, name: string): string[] {
+  return [
+    `      - name: ${step.name}`,
+    `        run: smoo github-ci nx-smart --target ${target} --name "${name}" --step ${step.number}`,
+  ];
+}
+
+function renderYamlList(values: string[], spaces: number): string {
+  const indent = ' '.repeat(spaces);
+  return values.map((value) => `${indent}- ${value}`).join('\n');
+}

package/src/monorepo/managed-files.ts

@@ -1,7 +1,9 @@
+import { execFileSync } from 'node:child_process';
 import { existsSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
+import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 type ManagedKind = 'raw' | 'template' | 'generated';
@@ -21,10 +23,20 @@ export interface FileResult {
 
 interface ManagedFileContext {
   hasReleasePackages: boolean;
+  hasStagingDeployTargets: boolean;
+  hasProductionDeployTargets: boolean;
+  stagingDeployProvider?: 'cloudflare';
+  productionDeployProvider?: 'cloudflare';
+  ciPushBranches: string[];
   nodeModulesCacheKey: string;
   repoName: string;
 }
 
+interface DeployTargetInfo {
+  exists: boolean;
+  provider?: 'cloudflare';
+}
+
 const managedFiles: ManagedFile[] = [
   {
     kind: 'raw',
@@ -56,8 +68,8 @@ const managedFiles: ManagedFile[] = [
     target: '.git-format-staged.yml',
   },
   {
-    kind: 'template',
-    source: 'github/workflows/ci.yml',
+    kind: 'generated',
+    source: 'ci-workflow',
     target: '.github/workflows/ci.yml',
   },
   {
@@ -106,7 +118,7 @@ function applyManagedFile(
   mode: 'update' | 'check' | 'diff',
   context: ManagedFileContext,
 ): FileResult {
-  if (file.releasePackagesOnly === true && !context.hasReleasePackages) {
+  if (file.releasePackagesOnly === true && !context.hasReleasePackages && !context.hasProductionDeployTargets) {
     return { target: file.target, action: 'skipped' };
   }
   const target = resolve(root, file.target);
@@ -138,8 +150,19 @@ function applyManagedFile(
 
 function getManagedContent(file: ManagedFile, context: ManagedFileContext): string {
   if (file.kind === 'generated') {
+    if (file.source === 'ci-workflow') {
+      return renderCiWorkflowYaml({
+        deploy: context.hasStagingDeployTargets,
+        deployProvider: context.stagingDeployProvider,
+        pushBranches: context.ciPushBranches,
+      });
+    }
     if (file.source === 'publish-workflow') {
-      return renderPublishWorkflowYaml({ repoName: context.repoName });
+      return renderPublishWorkflowYaml({
+        deploy: context.hasProductionDeployTargets,
+        deployProvider: context.productionDeployProvider,
+        repoName: context.repoName,
+      });
     }
     throw new Error(`Unknown generated managed file source ${file.source}`);
   }
@@ -155,18 +178,105 @@ function getManagedContent(file: ManagedFile, context: ManagedFileContext): stri
 function getManagedFileContext(root: string): ManagedFileContext {
   const packageJson = readPackageJson(join(root, 'package.json'));
   const repoName = packageJson?.name ?? 'monorepo';
+  const ciPushBranches = getCiPushBranches(packageJson?.json);
+  const stagingDeploy = getDeployTargetInfo(root, 'staging');
+  const productionDeploy = getDeployTargetInfo(root, 'production');
   const nodeModulesCacheKey = existsSync(join(root, 'bun.lock'))
     ? `$${"{{ hashFiles('bun.lock', 'package.json', 'packages/*/package.json') }}"}`
     : `$${"{{ hashFiles('bun.lockb', 'package.json', 'packages/*/package.json') }}"}`;
-  return { hasReleasePackages: listReleasePackages(root, packageJson).length > 0, nodeModulesCacheKey, repoName };
+  return {
+    hasReleasePackages: listReleasePackages(root, packageJson).length > 0,
+    hasStagingDeployTargets: stagingDeploy.exists,
+    hasProductionDeployTargets: productionDeploy.exists,
+    stagingDeployProvider: stagingDeploy.provider,
+    productionDeployProvider: productionDeploy.provider,
+    ciPushBranches,
+    nodeModulesCacheKey,
+    repoName,
+  };
 }
 
 function renderTemplate(context: ManagedFileContext, template: string): string {
   return template
     .replaceAll('{{REPO_NAME}}', context.repoName)
+    .replaceAll('__SMOO_CI_PUSH_BRANCHES__', renderYamlFlowList(context.ciPushBranches))
     .replaceAll('{{NODE_MODULES_CACHE_KEY}}', context.nodeModulesCacheKey);
 }
 
+function getDeployTargetInfo(root: string, configuration: string): DeployTargetInfo {
+  const output = execFileSync('nx', ['show', 'projects', '--withTarget', 'deploy', '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const projects: unknown = JSON.parse(output);
+  if (!Array.isArray(projects) || !projects.every((project) => typeof project === 'string')) {
+    return { exists: false };
+  }
+  let exists = false;
+  let provider: DeployTargetInfo['provider'];
+  for (const project of projects) {
+    const target = nxDeployTarget(root, project, configuration);
+    if (!target.exists) {
+      continue;
+    }
+    exists = true;
+    provider ??= target.provider;
+  }
+  return { exists, provider };
+}
+
+function nxDeployTarget(root: string, project: string, configuration: string): DeployTargetInfo {
+  const output = execFileSync('nx', ['show', 'project', project, '--json'], {
+    cwd: root,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const parsed: unknown = JSON.parse(output);
+  const projectJson = recordValue(parsed);
+  const targets = recordValue(projectJson?.targets);
+  const deploy = recordValue(targets?.deploy);
+  const configurations = recordValue(deploy?.configurations);
+  const config = recordValue(configurations?.[configuration]);
+  if (!config) {
+    return { exists: false };
+  }
+  const command = deployCommand(deploy, config);
+  return { exists: true, provider: command.includes('wrangler ') ? 'cloudflare' : undefined };
+}
+
+function deployCommand(deploy: Record<string, unknown> | undefined, config: Record<string, unknown>): string {
+  const command = stringValue(config.command) ?? stringValue(recordValue(config.options)?.command);
+  return command ?? stringValue(recordValue(deploy?.options)?.command) ?? '';
+}
+
+function stringValue(value: unknown): string | undefined {
+  return typeof value === 'string' ? value : undefined;
+}
+
+function getCiPushBranches(packageJson: unknown): string[] {
+  const configured = readCiPushBranches(packageJson);
+  return configured.length > 0 ? configured : ['main'];
+}
+
+function readCiPushBranches(packageJson: unknown): string[] {
+  const rootPackage = recordValue(packageJson);
+  const smoo = recordValue(rootPackage?.smoo);
+  const github = recordValue(smoo?.github);
+  const branches = Array.isArray(github?.pushBranches) ? github.pushBranches : [];
+  return branches.filter((branch): branch is string => typeof branch === 'string' && branch.length > 0);
+}
+
+function recordValue(value: unknown): Record<string, unknown> | undefined {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : undefined;
+}
+
+function renderYamlFlowList(values: string[]): string {
+  return JSON.stringify(values);
+}
+
 function writeManagedFile(path: string, content: string, executable: boolean): void {
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, content, { mode: executable ? 0o755 : 0o644 });

package/src/monorepo/nx-sync.ts

@@ -1,13 +1,27 @@
-import { runStatus } from '../lib/run.js';
+import { printCommandOutput, runResult, runStatus } from '../lib/run.js';
 
 export async function fixNxSync(root: string, verbose = false): Promise<void> {
-  const status = await runStatus('nx', ['sync'], root, !verbose);
+  const result = verbose
+    ? { exitCode: await runStatus('nx', ['sync'], root, false), stdout: '', stderr: '' }
+    : await runResult('nx', ['sync'], root);
+  const status = result.exitCode;
   if (status !== 0) {
+    if (!verbose) {
+      printCommandOutput(result.stdout, result.stderr);
+    }
     throw new Error(`nx sync failed with exit code ${status}`);
   }
 }
 
 export async function validateNxSync(root: string, verbose = false): Promise<number> {
-  const status = await runStatus('nx', ['sync:check'], root, !verbose);
-  return status === 0 ? 0 : 1;
+  const result = verbose
+    ? { exitCode: await runStatus('nx', ['sync:check'], root, false), stdout: '', stderr: '' }
+    : await runResult('nx', ['sync:check'], root);
+  if (result.exitCode === 0) {
+    return 0;
+  }
+  if (!verbose) {
+    printCommandOutput(result.stdout, result.stderr);
+  }
+  return 1;
 }

package/src/monorepo/package-hygiene.test.ts

@@ -1,7 +1,12 @@
-import { describe, expect, it } from 'bun:test';
+import { afterEach, describe, expect, it, spyOn } from 'bun:test';
 import { fixPackageHygiene, type PackageHygieneShell, validatePackageHygiene } from './package-hygiene.js';
 
 describe('package hygiene', () => {
+  afterEach(() => {
+    console.log = originalConsoleLog;
+    console.error = originalConsoleError;
+  });
+
   it('runs sherif in autofix mode and selects highest dependency versions', async () => {
     const shell = new RecordingShell();
 
@@ -17,8 +22,39 @@ describe('package hygiene', () => {
 
     expect(shell.statuses).toEqual([{ command: 'sherif', args: ['--fail-on-warnings'], cwd: '/repo' }]);
   });
+
+  it('prints captured sherif output when quiet validation fails', async () => {
+    const shell = new FailingResultShell('sherif stdout', 'sherif stderr');
+    const logs = captureConsoleLogs();
+    const errors = captureConsoleErrors();
+
+    const failures = await validatePackageHygiene('/repo', shell);
+
+    expect(failures).toBe(1);
+    expect(logs).toEqual(['sherif stdout']);
+    expect(errors).toEqual(['sherif stderr', 'sherif package hygiene validation failed']);
+  });
 });
 
+const originalConsoleLog = console.log;
+const originalConsoleError = console.error;
+
+function captureConsoleLogs(): string[] {
+  const logs: string[] = [];
+  spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+    logs.push(args.join(' '));
+  });
+  return logs;
+}
+
+function captureConsoleErrors(): string[] {
+  const errors: string[] = [];
+  spyOn(console, 'error').mockImplementation((...args: unknown[]) => {
+    errors.push(args.join(' '));
+  });
+  return errors;
+}
+
 class RecordingShell implements PackageHygieneShell {
   readonly runs: { command: string; args: string[]; cwd: string }[] = [];
   readonly statuses: { command: string; args: string[]; cwd: string }[] = [];
@@ -32,3 +68,20 @@ class RecordingShell implements PackageHygieneShell {
     return 0;
   }
 }
+
+class FailingResultShell implements PackageHygieneShell {
+  constructor(
+    private readonly stdout: string,
+    private readonly stderr: string,
+  ) {}
+
+  async run(): Promise<void> {}
+
+  async runResult(): Promise<{ exitCode: number; stdout: string; stderr: string }> {
+    return { exitCode: 1, stdout: this.stdout, stderr: this.stderr };
+  }
+
+  async runStatus(): Promise<number> {
+    return 1;
+  }
+}