@theholocron/cli 3.17.2 → 3.18.1

package/dist/cli.mjs

@@ -970,7 +970,10 @@ function patchFiles(dir, variants, description, homepage, runtimeEnvironment, pr
 		if (isBinary(content)) continue;
 		const original = content;
 		for (const [search, replacement] of variants) content = content.split(search).join(replacement);
-		if (description !== void 0) content = content.split("<description>").join(description);
+		if (description !== void 0) {
+			content = content.split("<description>").join(description);
+			content = content.replace(/(<!-- holocron:description -->)[\s\S]*?(<!-- \/holocron:description -->)/g, `$1\n${description}\n$2`);
+		}
 		if (homepage !== void 0) content = content.split("<homepage>").join(homepage);
 		if (runtimeEnvironment !== void 0) content = content.split("<runtime_environment>").join(runtimeEnvironment);
 		content = content.replace(/\n?<!-- holocron:template-only -->[\s\S]*?<!-- \/holocron:template-only -->\n?/g, "");
@@ -989,9 +992,24 @@ function preflight$1() {
 function defaultExec$3(cmd, args, opts) {
 	execFileSync(cmd, args, {
 		cwd: opts.cwd,
-		stdio: opts.stdio
+		stdio: opts.stdio,
+		...opts.env && Object.keys(opts.env).length > 0 ? { env: {
+			...process.env,
+			...opts.env
+		} } : {}
 	});
 }
+function keychainLookup(key) {
+	const result = spawnSync("security", [
+		"find-generic-password",
+		"-s",
+		"com.theholocron.cli",
+		"-a",
+		key,
+		"-w"
+	], { encoding: "utf8" });
+	return result.status === 0 ? result.stdout?.trim() || void 0 : void 0;
+}
 function defaultReadFile(filepath) {
 	return readFileSync(filepath, "utf-8");
 }
@@ -1023,13 +1041,14 @@ async function runNew(input) {
 	}
 	if (existsSync(repoDir)) throw new NewError(`\`${repoDir}\` already exists — delete it or pick a different name.`);
 	print(`  Creating ${newRepo} from template ${templateRepo}…`);
+	const visibility = input.openSource ? "--public" : "--private";
 	try {
 		execFn("gh", [
 			"repo",
 			"create",
 			newRepo,
 			`--template=${templateRepo}`,
-			"--private",
+			visibility,
 			"--clone"
 		], {
 			cwd,
@@ -1038,6 +1057,28 @@ async function runNew(input) {
 	} catch (err) {
 		throw new NewError(`gh repo create failed: ${err instanceof Error ? err.message : String(err)}`);
 	}
+	if (input.isTemplate) try {
+		execFn("gh", [
+			"repo",
+			"edit",
+			newRepo,
+			"--template=true"
+		], {
+			cwd,
+			stdio: "inherit"
+		});
+	} catch {}
+	try {
+		execFn("gh", [
+			"repo",
+			"edit",
+			newRepo,
+			`--visibility=${input.openSource ? "public" : "private"}`
+		], {
+			cwd,
+			stdio: "inherit"
+		});
+	} catch {}
 	let templateSlug = `${input.type}-template`;
 	const pkgJsonPath = path.join(repoDir, "package.json");
 	if (existsSync(pkgJsonPath)) try {
@@ -1048,6 +1089,8 @@ async function runNew(input) {
 	print(`  Patching files…`);
 	const variants = deriveVariants(templateSlug, input.name);
 	variants.unshift([`theholocron/${templateSlug}`, `${org}/${input.name}`]);
+	const displayName = input.name.split("-").map(cap).join(" ");
+	variants.push(["<display_name>", displayName]);
 	const filesPatched = patchFiles(repoDir, variants, input.description, input.homepage, input.runtimeEnvironment, print, readFn, writeFn, walkFn);
 	print(`  ${filesPatched.length} file${filesPatched.length === 1 ? "" : "s"} patched`);
 	if (input.description !== void 0 || input.homepage !== void 0) try {
@@ -1110,9 +1153,22 @@ async function runNew(input) {
 		print("");
 		print("  Running holocron setup…");
 		try {
-			execFn("holocron", ["setup"], {
+			const setupArgs = ["setup"];
+			const setupEnv = {};
+			const adminToken = input.token ?? keychainLookup("github.admin");
+			if (adminToken) setupArgs.push("--token", adminToken);
+			if (!process.env["HOLOCRON_ORG_TOKEN"]) {
+				const orgToken = keychainLookup("github.org");
+				if (orgToken) setupEnv["HOLOCRON_ORG_TOKEN"] = orgToken;
+			}
+			if (!process.env["HOLOCRON_DEPLOY_TOKEN"]) {
+				const deployToken = keychainLookup("github.deploy");
+				if (deployToken) setupEnv["HOLOCRON_DEPLOY_TOKEN"] = deployToken;
+			}
+			execFn("holocron", setupArgs, {
 				cwd: repoDir,
-				stdio: "inherit"
+				stdio: "inherit",
+				env: setupEnv
 			});
 		} catch {
 			print("  ✗ holocron setup failed — run it manually after checking your config");
@@ -3144,6 +3200,10 @@ async function runSetup(input) {
 	if (loader.has("source")) {
 		const source = loader.get("source");
 		print(style.step("source"));
+		const SECURITY_SKIP_CODES = {
+			enableSecretScanning: [422],
+			enablePrivateVulnerabilityReporting: [404]
+		};
 		for (const method of [
 			"enableVulnerabilityAlerts",
 			"enableAutomatedSecurityFixes",
@@ -3153,7 +3213,7 @@ async function runSetup(input) {
 		]) {
 			steps.push(await runStep("source", method, dryRun, async () => {
 				await source[method]();
-			}));
+			}, { skipCodes: SECURITY_SKIP_CODES[method] }));
 			print(formatStep(steps[steps.length - 1]));
 		}
 		const usesAdvancedCodeQL = (config.workflows ?? []).map((e) => typeof e === "string" ? e : e.name).includes("codeql");
@@ -3287,7 +3347,7 @@ async function runSetup(input) {
 		}
 		const teams = repo?.teams ?? [];
 		if (teams.length > 0) if (source.syncTeams) {
-			steps.push(await runStep("source", "sync teams", dryRun, () => source.syncTeams(teams)));
+			steps.push(await runStep("source", "sync teams", dryRun, () => source.syncTeams(teams), { skipCodes: [422] }));
 			print(formatStep(steps[steps.length - 1]));
 			const repoCoord = input.context.repo ?? repo?.name ?? "";
 			const org = repoCoord.includes("/") ? repoCoord.split("/")[0] : "";
@@ -3654,7 +3714,7 @@ async function updateSkillsGitignore(gitignorePath, existingContent, skills, sym
 	} else content = (existingContent.trimEnd() ? existingContent.trimEnd() + "\n\n" : "") + block + "\n";
 	await writeFile(gitignorePath, content, "utf8");
 }
-async function runStep(capability, step, dryRun, body) {
+async function runStep(capability, step, dryRun, body, opts = {}) {
 	if (dryRun) return {
 		capability,
 		step,
@@ -3670,15 +3730,23 @@ async function runStep(capability, step, dryRun, body) {
 		if (typeof note === "string") result.message = note;
 		return result;
 	} catch (err) {
-		if (err instanceof ProviderApiError$1 && err.status === 403) {
-			const reason = classify403(err);
-			return {
+		if (err instanceof ProviderApiError$1) {
+			if (err.status !== void 0 && opts.skipCodes?.includes(err.status)) return {
 				capability,
 				step,
-				status: "fail",
-				message: err.message,
-				reason
+				status: "skip",
+				message: err.message
 			};
+			if (err.status === 403) {
+				const reason = classify403(err);
+				return {
+					capability,
+					step,
+					status: reason === "plan" ? "skip" : "fail",
+					message: err.message,
+					reason
+				};
+			}
 		}
 		return {
 			capability,
@@ -4105,7 +4173,7 @@ var codeql_default = "name: CodeQL\n\non: # yamllint disable-line rule:truthy\n
 var dependencies_default = "name: Dependencies\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    secrets:\n      merge-token:\n        description: >\n          Optional privileged token for auto-merge. Falls back to GITHUB_TOKEN.\n          Required when branch protection enforces required reviews — GITHUB_TOKEN\n          cannot approve its own PRs.\n        required: false\n\njobs:\n  dependabot:\n    name: Update the dependencies\n    permissions:\n      contents: write\n      pull-requests: write\n    runs-on: ubuntu-latest\n    timeout-minutes: 5\n    if: github.event.pull_request.user.login == 'dependabot[bot]'\n    steps:\n      - uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0\n        name: Fetch Dependabot metadata\n        id: metadata\n\n      - run: gh pr merge --auto --squash \"$PR_URL\"\n        # --squash is intentional: repo protection sets allow_merge_commit: false,\n        # so --merge would fail on any repo using the standard preset.\n        name: Enable auto-merge for Dependabot PRs\n        if: steps.metadata.outputs.update-type == 'version-update:semver-patch'\n        env:\n          PR_URL: ${{ github.event.pull_request.html_url }}\n          GH_TOKEN: ${{ secrets.merge-token || github.token }}\n";
 //#endregion
 //#region src/templates/workflows/deploy-docs.yml
-var deploy_docs_default = "name: Deploy Docs\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      name:\n        description: Repo name prefix used to derive package names (<name>-docs, <name>-site)\n        required: true\n        type: string\n      use-turbo:\n        description: Build content packages with pnpm turbo build (default true)\n        required: false\n        type: boolean\n        default: true\n\njobs:\n  build:\n    name: Build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build content packages\n        if: ${{ inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm turbo build --filter=@theholocron/\"$DOCS_NAME\"-docs\n\n      - name: Build content packages\n        if: ${{ !inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-docs build\n\n      - name: Build docs site\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-site build\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: docs/dist\n\n  deploy:\n    name: Deploy\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
+var deploy_docs_default = "name: Deploy Docs\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      name:\n        description: Repo name prefix used to derive package names (<name>-docs, <name>-site)\n        required: true\n        type: string\n      use-turbo:\n        description: Build content packages with pnpm turbo build (default true)\n        required: false\n        type: boolean\n        default: true\n      skip-content:\n        description: Skip the content package build step (for repos with no <name>-docs package)\n        required: false\n        type: boolean\n        default: false\n\njobs:\n  build:\n    name: Build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build content packages\n        if: ${{ !inputs.skip-content && inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm turbo build --filter=@theholocron/\"$DOCS_NAME\"-docs\n\n      - name: Build content packages\n        if: ${{ !inputs.skip-content && !inputs.use-turbo }}\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-docs build\n\n      - name: Build docs site\n        env:\n          DOCS_NAME: ${{ inputs.name }}\n        run: pnpm --filter @theholocron/\"$DOCS_NAME\"-site build\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: docs/dist\n\n  deploy:\n    name: Deploy\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
 //#endregion
 //#region src/templates/workflows/deploy-storybook.yml
 var deploy_storybook_default = "name: Deploy Storybook\n\non: # yamllint disable-line rule:truthy\n  workflow_call:\n    inputs:\n      build-script:\n        description: pnpm script that builds the Storybook static output\n        type: string\n        required: false\n        default: build:storybook\n      output-dir:\n        description: Directory where Storybook writes its static output\n        type: string\n        required: false\n        default: storybook-static\n\njobs:\n  build:\n    name: Build\n    runs-on: ubuntu-latest\n    permissions:\n      contents: read\n    steps:\n      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0\n        name: Checkout repository\n\n      - uses: theholocron/.github/.github/actions/setup@main\n        name: Setup\n\n      - name: Build Storybook\n        run: pnpm run \"$BUILD_SCRIPT\"\n        env:\n          BUILD_SCRIPT: ${{ inputs.build-script }}\n\n      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1\n        name: Upload pages artifact\n        with:\n          path: ${{ inputs.output-dir }}\n\n  deploy:\n    name: Deploy\n    needs: build\n    runs-on: ubuntu-latest\n    permissions:\n      pages: write\n      id-token: write\n    environment:\n      name: github-pages\n      url: ${{ steps.deployment.outputs.page_url }}\n    steps:\n      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5\n        id: deployment\n        name: Deploy to GitHub Pages\n";
@@ -5385,6 +5453,9 @@ try {
 	}).option("skills", {
 		type: "string",
 		describe: "Comma-separated agent skill names (e.g. git-safety,pr-workflow)"
+	}).option("is-template", {
+		type: "boolean",
+		describe: "Mark the new repo as a GitHub template repository"
 	}).option("org", {
 		type: "string",
 		default: "theholocron",
@@ -5395,6 +5466,9 @@ try {
 		describe: "Run pnpm install + holocron setup after bootstrapping (--no-verify skips)"
 	}), async (argv) => {
 		try {
+			const tokens = tokenContext(argv.token);
+			if (!tokens) return;
+			const adminToken = tokens.cliTokens?.["github"] ?? tokens.cliToken;
 			let type = argv.type;
 			let name = argv.name;
 			let description = argv.description;
@@ -5410,6 +5484,7 @@ try {
 			let openSource = argv.openSource;
 			let usesExternalPackages = argv.usesExternalPackages;
 			let skills = parseTopics(argv.skills);
+			const isTemplate = argv.isTemplate;
 			if (!type) type = await select({
 				message: "Template type:",
 				choices: [
@@ -5589,7 +5664,9 @@ try {
 				usesExternalPackages: usesExternalPackages ?? true,
 				topics,
 				skills,
+				isTemplate,
 				org: argv.org,
+				token: adminToken,
 				dryRun: argv.dryRun,
 				noVerify: !argv.verify,
 				cwd: argv.cwd