@stacksjs/defaults 0.72.92 → 0.72.94

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.72.92",
+  "version": "0.72.94",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.72.92",
+  "version": "0.72.94",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -51,7 +51,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.72.92",
+    "@stacksjs/mobile": "^0.72.94",
     "@stacksjs/sanitizer": "^0.2.113"
   },
   "scripts": {

package/vcs/github/workflows/ci.yml

@@ -122,87 +122,3 @@ jobs:
 
       - name: Test Suite
         run: bun run test
-
-  # Push to deploy: `buddy deploy` on every green push to main.
-  #
-  # A fresh app has nothing to deploy to, and red CI on day one is worse than
-  # no deploy, so this checks for its secrets first and finishes green with a
-  # notice when they are missing. Add them under
-  # Settings > Secrets and variables > Actions to turn it on:
-  #
-  #   DOTENV_PRIVATE_KEY_PRODUCTION   decrypts .env.production for the deploy
-  #   DEPLOY_SSH_KEY                  private key for the target server
-  #
-  # Cloud tokens are optional. Without them the release still ships and DNS is
-  # still published; only the provider-specific parts are skipped.
-  deploy:
-    if: >-
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
-    needs: [lint, typecheck, test]
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      deployments: write
-
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v4
-
-      - name: Is deployment configured?
-        id: check
-        env:
-          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          if [ -n "$DOTENV_PRIVATE_KEY_PRODUCTION" ] && [ -n "$DEPLOY_SSH_KEY" ]; then
-            echo 'configured=true' >> "$GITHUB_OUTPUT"
-          else
-            echo 'configured=false' >> "$GITHUB_OUTPUT"
-            echo '::notice::Deployment is not configured, so this step did nothing. Add DOTENV_PRIVATE_KEY_PRODUCTION and DEPLOY_SSH_KEY to deploy on every push to main.'
-          fi
-
-      - name: Setup Pantry
-        if: steps.check.outputs.configured == 'true'
-        uses: pantry-pm/pantry/packages/action@c1417d98f5613290bc3b1f96d35086b834684659 # v0.10.47 + the socket-hang-up retry fix
-        with:
-          install: 'false'
-
-      - name: Use cached node_modules
-        if: steps.check.outputs.configured == 'true'
-        uses: actions/cache@v4
-        with:
-          path: node_modules
-          key: node-modules-${{ hashFiles('**/bun.lock') }}
-          restore-keys: |
-            node-modules-
-
-      - name: Install Dependencies
-        if: steps.check.outputs.configured == 'true'
-        run: bun install
-
-      - name: Prepare Deploy SSH Key
-        if: steps.check.outputs.configured == 'true'
-        env:
-          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
-        run: |
-          mkdir -p ~/.ssh
-          chmod 700 ~/.ssh
-          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub
-          chmod 644 ~/.ssh/id_ed25519.pub
-
-      - name: Deploy production
-        if: steps.check.outputs.configured == 'true'
-        run: bun buddy deploy --yes
-        env:
-          APP_ENV: production
-          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
-          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          # macOS resource forks in a tarball built on a developer machine make
-          # the extraction on the server noisy and occasionally fatal.
-          COPYFILE_DISABLE: '1'

package/vcs/github/workflows/deploy.yml

@@ -38,30 +38,74 @@ jobs:
     environment: ${{ github.event.inputs.environment || 'production' }}
 
     steps:
+      # A fresh app has nowhere to deploy to, and a red X on day one is worse
+      # than no deploy, so every step below is gated on the two secrets that
+      # cannot be defaulted. Without them this finishes green with a notice
+      # saying exactly what to add.
+      #
+      # Checked here rather than in `if:` on the job, because a job-level
+      # condition cannot read `secrets`.
+      - name: Is deployment configured?
+        id: check
+        env:
+          DOTENV_PRIVATE_KEY_PRODUCTION: ${{ secrets.DOTENV_PRIVATE_KEY_PRODUCTION }}
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          if [ -n "$DOTENV_PRIVATE_KEY_PRODUCTION" ] && [ -n "$DEPLOY_SSH_KEY" ]; then
+            echo 'configured=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'configured=false' >> "$GITHUB_OUTPUT"
+            echo '::notice::Deployment is not configured, so this run did nothing. Add DEPLOY_SSH_KEY (a private key the target server trusts) and DOTENV_PRIVATE_KEY_PRODUCTION (from .env.keys) to deploy on every green push to main.'
+          fi
+
       - name: Checkout
+        if: steps.check.outputs.configured == 'true'
         uses: actions/checkout@v6
         with:
           # The exact commit CI approved, not whatever main points at now.
           ref: ${{ github.event.workflow_run.head_sha || github.ref }}
 
       - name: Setup Bun
+        if: steps.check.outputs.configured == 'true'
         uses: oven-sh/setup-bun@v2
 
       - name: Setup Pantry
+        if: steps.check.outputs.configured == 'true'
         uses: home-lang/pantry/packages/action@main
 
       - name: Install dependencies
+        if: steps.check.outputs.configured == 'true'
         run: bun install --frozen-lockfile
 
       # The deploy talks to the server as root over SSH with BatchMode on, so
       # the key has to be in an agent before it runs — there is no prompt to
       # fall back to.
       - name: Load the deploy key
+        if: steps.check.outputs.configured == 'true'
         uses: webfactory/ssh-agent@v0.9.0
         with:
           ssh-private-key: ${{ secrets.DEPLOY_SSH_KEY }}
 
+      # An agent is not enough on its own. ts-cloud reads the PUBLIC key off
+      # disk to register it on the server, and an agent holds keys in memory
+      # and exposes no path, so the deploy died on "SSH public key not found
+      # at ~/.ssh/id_ed25519.pub" with the agent perfectly loaded. The public
+      # half is derived from the private one rather than carried as a second
+      # secret, so the two can never disagree.
+      - name: Write the deploy key to disk
+        if: steps.check.outputs.configured == 'true'
+        env:
+          DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          chmod 700 ~/.ssh
+          printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/id_ed25519
+          chmod 600 ~/.ssh/id_ed25519
+          ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub
+          chmod 644 ~/.ssh/id_ed25519.pub
+
       - name: Deploy
+        if: steps.check.outputs.configured == 'true'
         run: ./buddy deploy --${{ github.event.inputs.environment == 'staging' && 'staging' || github.event.inputs.environment == 'development' && 'dev' || 'prod' }} --yes
         env:
           # Decrypts .env.production. Without it the encrypted values silently
@@ -75,3 +119,6 @@ jobs:
           PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
           PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          # macOS resource forks in a tarball built on a developer machine make
+          # the extraction on the server noisy and occasionally fatal.
+          COPYFILE_DISABLE: '1'