@xemahq/repo-build-tooling 0.15.0 → 0.15.1

package/README.md

@@ -33,7 +33,7 @@ pnpm exec xema-scrub-swagger-paths dist
 | `xema-check-no-vendored-deps` | Fails on a `workspace:` range for a package the repository does not own |
 | `xema-check-workspace-ranges` | Fails on a `workspace:` range the local package does not satisfy |
 
-`xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--copy`, `--cache-id` and `--build-source`; it pins the version of this tool itself, and there is no flag for it (`--tooling-version` is refused as an unknown option). `dockerfile --prebuilt` renders the Dockerfile and `Dockerfile.dockerignore` of an image assembled from `stage <dir> [--output <rel>]… [--also <pkg>]…` output (requires `--cache-id`, `--build-source`; `--copy` and `--stage-dir` optional); `load --each` loads every member in its own process. `stage` and `filters` accept `--also <workspace package name>` (repeatable): the package's closure is built and staged (built outputs only, no Prisma checks) alongside the members; an unknown name is refused. `pnpm-context <dir> (--subject <svc>… | --image-dir <composed>)` runs on the CI runner after `pnpm install --frozen-lockfile` and builds the offline `xema-pnpm` build context (`staged.json`, `corepack/pnpm.tgz`, `cache/`); it prints `XEMA_PNPM_CONTEXT=<dir>` and `XEMA_PNPM_STORE=<store root>` on stdout (everything else on stderr) and refuses a non-empty `<dir>`. Run `xema-composed-image` with no arguments for the full usage.
+`xema-composed-image members --write|--check` accepts `--manifests <glob>` (repeatable, default `**/xema-biome.json`), `--canonical-dockerfile <path>` and `--cross-repo-manifest <path>`. `xema-composed-image dockerfile` requires `--copy`, `--cache-id` and `--build-source`; it pins the version of this tool itself, and there is no flag for it (`--tooling-version` is refused as an unknown option). `dockerfile --prebuilt` renders the Dockerfile and `Dockerfile.dockerignore` of an image assembled from `stage <dir> [--output <rel>]… [--also <pkg>]…` output (requires `--cache-id`, `--build-source`; `--copy` and `--stage-dir` optional); `load --each` loads every member in its own process. `stage` and `filters` accept `--also <workspace package name>` (repeatable): the package's closure is built and staged (built outputs only, no Prisma checks) alongside the members; an unknown name is refused. `pnpm-context <dir> (--subject <svc>… | --image-dir <composed>)` runs on the CI runner after `pnpm install --frozen-lockfile` and builds the offline `xema-pnpm` build context (`staged.json`, `corepack/pnpm.tgz`, and, with `--image-dir` only, a warmed `cache/` of registry metadata; `--subject` writes no `cache/` and `staged.json` says `cache: false`); it prints `XEMA_PNPM_CONTEXT=<dir>` and `XEMA_PNPM_STORE=<store root>` on stdout (everything else on stderr) and refuses a non-empty `<dir>`. Run `xema-composed-image` with no arguments for the full usage.
 
 Every step refuses rather than skips. The package has no dependencies.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -44,6 +44,6 @@
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-migrate.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:d3f54741da7e081ed21ee59ca2b27600880be97f359fde67028b756528c66153"
+    "sourceDigest": "sha256:fa45efe38d666b11ffa8841595cec6f19d065d77f286bf2b7c1e6eb3c93aed0e"
   }
 }

package/src/composed-image-pnpm-context.mjs

@@ -3,9 +3,10 @@
 // offline prebuilt image build consumes as the named BuildKit context `xema-pnpm`. The runner's
 // own pnpm store is the second context (`xema-pnpm-store`); it is never copied.
 //
-//   <dir>/staged.json         { tool, pnpm, storeDir, subjects[], imageDir? } — the sentinel the image checks
+//   <dir>/staged.json         { tool, pnpm, storeDir, subjects[], cache, imageDir? } — the sentinel the image checks
 //   <dir>/corepack/pnpm.tgz   `corepack pack pnpm@<root packageManager>`
-//   <dir>/cache/              pnpm `cache-dir` (registry metadata), seeded from the runner's and warmed
+//   <dir>/cache/              --image-dir only: pnpm `cache-dir` (registry metadata), seeded from the runner's and warmed
+//                             (--subject writes no cache/: the member deploy is lockfile-driven and offline)
 //
 // stdout is exactly two lines for `$GITHUB_ENV`: `XEMA_PNPM_CONTEXT=<dir>` and
 // `XEMA_PNPM_STORE=<store root>`. Everything else goes to stderr. pnpm's own request-level
@@ -83,37 +84,27 @@ export function buildPnpmContext({
   if (storePath === '' || !existsSync(storePath)) {
     throw new Error(`the runner's pnpm store ${storePath || '(unknown)'} does not exist — run pnpm install --frozen-lockfile before pnpm-context`);
   }
-  const cacheSource = exec('pnpm', ['config', 'get', 'cache-dir'], { cwd: root }).trim();
-
   mkdirSync(join(target, 'corepack'), { recursive: true });
   exec('corepack', ['pack', `pnpm@${pnpm}`, '-o', join(target, 'corepack', 'pnpm.tgz')], { cwd: root });
-  const cache = join(target, 'cache');
-  log(`pnpm-context: cache ${seedCache(exec, cacheSource, cache, log)} from ${cacheSource}`);
 
-  // Warm: the exact metadata requests the offline image build will make, answered from the registry once, here.
-  const base = [`--config.cache-dir=${cache}`];
-  if (subjects.length > 0) {
-    const tmp = mkdtempSync(join(tmpdir(), 'xema-pnpm-deploy-'));
-    try {
-      for (const subject of subjects) {
-        exec('pnpm', ['deploy', '--prod', '--ignore-scripts', '--prefer-offline', ...base, '--filter', subject, join(tmp, subject.replace(/[^A-Za-z0-9._-]/g, '_'))], { cwd: root });
-        log(`pnpm-context: warmed ${subject}`);
-      }
-    } finally {
-      rmSync(tmp, { recursive: true, force: true });
-    }
-  } else {
+  // --subject: the member image runs the lockfile-driven `pnpm deploy --offline` from the store alone, so no
+  // metadata cache is seeded or warmed. --image-dir: its `--lockfile-only` resolve needs registry metadata, warmed here.
+  const withCache = subjects.length === 0;
+  if (withCache) {
+    const cacheSource = exec('pnpm', ['config', 'get', 'cache-dir'], { cwd: root }).trim();
+    const cache = join(target, 'cache');
+    log(`pnpm-context: cache ${seedCache(exec, cacheSource, cache, log)} from ${cacheSource}`);
     const scratch = scratchLockfileInputs({ root, imageDir, exec, copy });
     try {
       const [file, ...args] = lockfileOnlyCommand(memberFilters({ root, imageDir }).flatMap((f) => f.split(' ')));
-      exec(file, [...args, ...base], { cwd: scratch });
+      exec(file, [...args, `--config.cache-dir=${cache}`], { cwd: scratch });
       log(`pnpm-context: warmed the ${imageDir} lockfile-only resolve`);
     } finally {
       rmSync(scratch, { recursive: true, force: true });
     }
   }
 
-  const sentinel = { tool: toolVersion(), pnpm, storeDir: storeRoot, subjects: [...subjects], ...(imageDir === undefined ? {} : { imageDir }) };
+  const sentinel = { tool: toolVersion(), pnpm, storeDir: storeRoot, subjects: [...subjects], cache: withCache, ...(imageDir === undefined ? {} : { imageDir }) };
   writeFileSync(join(target, 'staged.json'), `${JSON.stringify(sentinel, null, 2)}\n`);
   return { context: target, store: storeRoot };
 }

package/src/composed-image-pnpm-context.test.mjs

@@ -38,23 +38,20 @@ function setup({ store = true, cache = true } = {}) {
   return { root, out, exec, calls, storePath, home };
 }
 
-test('--subject: writes corepack tgz, a seeded and warmed cache dir, and the sentinel; returns the two env values', () => {
+test('--subject: writes the corepack tgz and the sentinel, no cache dir and no deploy warm-up; returns the two env values', () => {
   const { root, out, exec, calls, home } = setup();
   const result = buildPnpmContext({ root, dir: out, subjects: ['svc-a', 'svc-b'], exec });
   assert.deepEqual(result, { context: out, store: path.join(home, '.pnpm-store') });
   assert.equal(fs.readFileSync(path.join(out, 'corepack/pnpm.tgz'), 'utf8'), 'tgz');
-  assert.ok(fs.existsSync(path.join(out, 'cache/metadata-v1.3/registry.npmjs.org/x.json')));
+  assert.equal(fs.existsSync(path.join(out, 'cache')), false);
   const staged = JSON.parse(fs.readFileSync(path.join(out, 'staged.json'), 'utf8'));
-  assert.deepEqual(Object.keys(staged), ['tool', 'pnpm', 'storeDir', 'subjects']);
+  assert.deepEqual(Object.keys(staged), ['tool', 'pnpm', 'storeDir', 'subjects', 'cache']);
   assert.equal(staged.pnpm, '10.33.0');
+  assert.equal(staged.cache, false);
   assert.deepEqual(staged.subjects, ['svc-a', 'svc-b']);
   assert.deepEqual(calls.find((c) => c.file === 'corepack').args.slice(0, 2), ['pack', 'pnpm@10.33.0']);
-  const deploys = calls.filter((c) => c.args[0] === 'deploy');
-  assert.equal(deploys.length, 2);
-  for (const d of deploys) {
-    for (const flag of ['--prod', '--ignore-scripts', '--prefer-offline', `--config.cache-dir=${path.join(out, 'cache')}`]) assert.ok(d.args.includes(flag), flag);
-    assert.ok(!fs.existsSync(d.args.at(-1)), 'the deploy target is deleted');
-  }
+  assert.equal(calls.filter((c) => c.args[0] === 'deploy' || c.args.includes('--lockfile-only')).length, 0, 'no warm-up');
+  assert.ok(!calls.some((c) => c.args[0] === 'config'));
 });
 
 test('refuses a non-empty directory, a missing store, and a bad invocation, writing nothing', () => {
@@ -77,7 +74,9 @@ test('--image-dir: runs the generator\'s lockfile-only command on a scratch copy
   assert.ok(resolve.args.includes(`--config.cache-dir=${path.join(out, 'cache')}`));
   assert.equal(fs.existsSync(resolve.cwd), false, 'the scratch tree is deleted');
   assert.equal(fs.readFileSync(path.join(root, 'pnpm-lock.yaml'), 'utf8'), 'lockfileVersion: 9\n');
-  assert.equal(JSON.parse(fs.readFileSync(path.join(out, 'staged.json'), 'utf8')).imageDir, 'infra/composed-process');
+  const staged = JSON.parse(fs.readFileSync(path.join(out, 'staged.json'), 'utf8'));
+  assert.equal(staged.imageDir, 'infra/composed-process');
+  assert.equal(staged.cache, true);
 });
 
 test('the lockfile-only command is the one the generated Dockerfile runs (no drift)', () => {
@@ -97,7 +96,7 @@ test('a failed cp -al falls back to a copy and logs why', () => {
     if (file === 'cp') throw new Error('cross-device link');
     return exec(file, args, options);
   };
-  buildPnpmContext({ root, dir: out, subjects: ['s'], exec: failing, log: (m) => logs.push(m) });
+  buildPnpmContext({ root, dir: out, imageDir: 'infra/composed-process', exec: failing, log: (m) => logs.push(m) });
   assert.ok(logs.some((m) => /cp -al failed \(cross-device link\)/.test(m)));
   assert.ok(fs.existsSync(path.join(out, 'cache/metadata-v1.3/registry.npmjs.org/x.json')));
   assert.ok(home);