alepha 0.18.2 → 0.18.3

package/src/cli/platform/commands/SecretsCommand.spec.ts

@@ -0,0 +1,298 @@
+import { Alepha } from "alepha";
+import { CliProvider } from "alepha/command";
+import { FileSystemProvider, MemoryFileSystemProvider } from "alepha/system";
+import { describe, test } from "vitest";
+import { platformOptions } from "../atoms/platformOptions.ts";
+import { MemorySecretStore } from "../providers/MemorySecretStore.ts";
+import type { SecretStoreProvider } from "../providers/SecretStoreProvider.ts";
+import { SecretsCommand } from "./SecretsCommand.ts";
+
+class TestSecretsCommand extends SecretsCommand {
+  public readonly testList = this.list;
+  public readonly testDiff = this.diff;
+  public readonly testApply = this.apply;
+  public testStore: MemorySecretStore | null = null;
+
+  public override resolveStore(): SecretStoreProvider {
+    if (this.testStore) return this.testStore;
+    return super.resolveStore();
+  }
+}
+
+describe("SecretsCommand", () => {
+  const createTestEnv = (
+    config: Record<string, any> = {},
+    storeSecrets: Record<string, Record<string, string>> = {},
+  ) => {
+    const alepha = Alepha.create().with({
+      provide: FileSystemProvider,
+      use: MemoryFileSystemProvider,
+    });
+
+    const fs = alepha.inject(MemoryFileSystemProvider);
+    const store = new MemorySecretStore();
+    const cli = alepha.inject(CliProvider);
+    const cmd = alepha.inject(TestSecretsCommand);
+    cmd.testStore = store;
+
+    alepha.set(platformOptions, {
+      name: "my-app",
+      environments: { production: { adapter: "cloudflare" } },
+      ...config,
+    } as any);
+
+    // Seed package.json
+    fs.writeFile("/project/package.json", JSON.stringify({ name: "my-app" }));
+
+    // Seed store with pre-existing secrets
+    for (const [env, secrets] of Object.entries(storeSecrets)) {
+      const envMap = new Map<string, string>();
+      for (const [k, v] of Object.entries(secrets)) {
+        envMap.set(k, v);
+      }
+      store.secrets.set(env, envMap);
+    }
+
+    return { alepha, fs, store, cli, cmd };
+  };
+
+  // -----------------------------------------------------------------------
+  // apply
+  // -----------------------------------------------------------------------
+
+  describe("apply", () => {
+    test("filters and pushes secrets to store", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv();
+
+      await fs.writeFile(
+        "/project/.env.production",
+        "DATABASE_URL=postgres://localhost/db\nAPI_KEY=abc123\nNODE_ENV=production\nVITE_APP=hello\nEMPTY=",
+      );
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production",
+      });
+
+      expect(store.wasSet("my-app-production", "DATABASE_URL")).toBe(true);
+      expect(store.wasSet("my-app-production", "API_KEY")).toBe(true);
+      expect(store.wasSet("my-app-production", "NODE_ENV")).toBe(false);
+      expect(store.wasSet("my-app-production", "VITE_APP")).toBe(false);
+      expect(store.wasSet("my-app-production", "EMPTY")).toBe(false);
+    });
+
+    test("renames GITHUB_ keys with APP_ prefix", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv();
+
+      await fs.writeFile(
+        "/project/.env.production",
+        "GITHUB_CLIENT_ID=id123\nGITHUB_CLIENT_SECRET=secret456",
+      );
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production",
+      });
+
+      expect(store.wasSet("my-app-production", "APP_GITHUB_CLIENT_ID")).toBe(
+        true,
+      );
+      expect(
+        store.wasSet("my-app-production", "APP_GITHUB_CLIENT_SECRET"),
+      ).toBe(true);
+      expect(store.wasSet("my-app-production", "GITHUB_CLIENT_ID")).toBe(false);
+    });
+
+    test("dry run does not call store", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv();
+
+      await fs.writeFile(
+        "/project/.env.production",
+        "API_KEY=abc123\nSECRET=xyz",
+      );
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production --dry-run",
+      });
+
+      expect(store.calls.filter((c) => c.method === "set")).toHaveLength(0);
+    });
+
+    test("uses custom environment pattern", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv({
+        secrets: {
+          store: "github",
+          environmentPattern: "{env}",
+        },
+      });
+
+      await fs.writeFile("/project/.env.production", "API_KEY=abc123");
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production",
+      });
+
+      expect(store.wasSet("production", "API_KEY")).toBe(true);
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // diff
+  // -----------------------------------------------------------------------
+
+  describe("diff", () => {
+    test("detects only-local, only-remote, and in-both keys", async ({
+      expect,
+    }) => {
+      const { fs, cli, cmd } = createTestEnv(
+        {},
+        {
+          "my-app-production": {
+            API_KEY: "remote-value",
+            OLD_SECRET: "stale",
+          },
+        },
+      );
+
+      await fs.writeFile(
+        "/project/.env.production",
+        "API_KEY=local-value\nNEW_SECRET=fresh",
+      );
+
+      // Capture stdout
+      const writes: string[] = [];
+      const originalWrite = process.stdout.write;
+      process.stdout.write = ((chunk: string) => {
+        writes.push(chunk);
+        return true;
+      }) as any;
+
+      try {
+        await cli.run(cmd.testDiff, {
+          root: "/project",
+          argv: "--env production",
+        });
+      } finally {
+        process.stdout.write = originalWrite;
+      }
+
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: stripping ANSI codes
+      const output = writes.join("").replace(/\x1B\[[0-9;]*m/g, "");
+      expect(output).toContain("+ NEW_SECRET");
+      expect(output).toContain("- OLD_SECRET");
+      expect(output).toContain("= API_KEY");
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // list
+  // -----------------------------------------------------------------------
+
+  describe("list", () => {
+    test("shows table format by default", async ({ expect }) => {
+      const { cli, cmd } = createTestEnv(
+        {},
+        {
+          "my-app-production": {
+            API_KEY: "value1",
+            DATABASE_URL: "value2",
+          },
+        },
+      );
+
+      const writes: string[] = [];
+      const originalWrite = process.stdout.write;
+      process.stdout.write = ((chunk: string) => {
+        writes.push(chunk);
+        return true;
+      }) as any;
+
+      try {
+        await cli.run(cmd.testList, {
+          root: "/project",
+          argv: "--env production",
+        });
+      } finally {
+        process.stdout.write = originalWrite;
+      }
+
+      const output = writes.join("");
+      expect(output).toContain("API_KEY");
+      expect(output).toContain("DATABASE_URL");
+    });
+
+    test("shows GHA format", async ({ expect }) => {
+      const { cli, cmd } = createTestEnv(
+        {},
+        {
+          "my-app-production": {
+            API_KEY: "value1",
+            APP_GITHUB_CLIENT_ID: "value2",
+          },
+        },
+      );
+
+      const writes: string[] = [];
+      const originalWrite = process.stdout.write;
+      process.stdout.write = ((chunk: string) => {
+        writes.push(chunk);
+        return true;
+      }) as any;
+
+      try {
+        await cli.run(cmd.testList, {
+          root: "/project",
+          argv: "--env production --format gha",
+        });
+      } finally {
+        process.stdout.write = originalWrite;
+      }
+
+      const output = writes.join("");
+      expect(output).toContain("env:");
+      expect(output).toContain("API_KEY: ${{ secrets.API_KEY }}");
+      expect(output).toContain(
+        "GITHUB_CLIENT_ID: ${{ secrets.APP_GITHUB_CLIENT_ID }}",
+      );
+    });
+  });
+
+  // -----------------------------------------------------------------------
+  // environment name resolution
+  // -----------------------------------------------------------------------
+
+  describe("environment name resolution", () => {
+    test("uses default pattern {project}-{env}", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv();
+
+      await fs.writeFile("/project/.env.production", "KEY=val");
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production",
+      });
+
+      expect(store.wasSet("my-app-production", "KEY")).toBe(true);
+    });
+
+    test("uses custom pattern", async ({ expect }) => {
+      const { fs, store, cli, cmd } = createTestEnv({
+        secrets: {
+          store: "github",
+          environmentPattern: "deploy-{project}-{env}",
+        },
+      });
+
+      await fs.writeFile("/project/.env.production", "KEY=val");
+
+      await cli.run(cmd.testApply, {
+        root: "/project",
+        argv: "--env production",
+      });
+
+      expect(store.wasSet("deploy-my-app-production", "KEY")).toBe(true);
+    });
+  });
+});

package/src/cli/platform/commands/SecretsCommand.ts

@@ -0,0 +1,283 @@
+import { $inject, $use, AlephaError, t } from "alepha";
+import { $command, EnvUtils } from "alepha/command";
+import { $logger, ConsoleColorProvider } from "alepha/logger";
+import { platformOptions } from "../atoms/platformOptions.ts";
+import { GitHubSecretStore } from "../providers/GitHubSecretStore.ts";
+import type { SecretStoreProvider } from "../providers/SecretStoreProvider.ts";
+import { NamingService } from "../services/NamingService.ts";
+import { PlatformInspector } from "../services/PlatformInspector.ts";
+import { SecretFilterService } from "../services/SecretFilterService.ts";
+
+export class SecretsCommand {
+  protected readonly log = $logger();
+  protected readonly options = $use(platformOptions);
+  protected readonly inspector = $inject(PlatformInspector);
+  protected readonly naming = $inject(NamingService);
+  protected readonly envUtils = $inject(EnvUtils);
+  protected readonly githubStore = $inject(GitHubSecretStore);
+  protected readonly filter = $inject(SecretFilterService);
+  protected readonly color = $inject(ConsoleColorProvider);
+
+  protected readonly envFlags = t.object({
+    env: t.optional(
+      t.text({
+        aliases: ["e"],
+        description: "Target environment",
+      }),
+    ),
+  });
+
+  // -----------------------------------------------------------------------
+  // alepha p secrets list
+  // -----------------------------------------------------------------------
+
+  protected readonly list = $command({
+    name: "list",
+    aliases: ["ls"],
+    description: "List secrets in the remote store",
+    flags: t.object({
+      env: t.optional(
+        t.text({
+          aliases: ["e"],
+          description: "Target environment",
+        }),
+      ),
+      format: t.optional(
+        t.text({
+          aliases: ["f"],
+          description: "Output format: table (default), gha",
+        }),
+      ),
+    }),
+    handler: async ({ flags, root, run }) => {
+      const config = await this.inspector.resolveConfig(root);
+      const env = flags.env ?? config.defaultEnv;
+      const envName = this.resolveEnvironmentName(config.project, env);
+      const format = flags.format ?? "table";
+
+      const store = this.resolveStore();
+      await store.ensureAvailable();
+      const remoteSecrets = await store.list(envName);
+
+      run.end();
+
+      if (format === "gha") {
+        process.stdout.write(
+          `# Generated by alepha — environment: ${envName}\n`,
+        );
+        process.stdout.write("env:\n");
+        for (const secret of remoteSecrets) {
+          const localName = this.filter.toLocalName(secret.name);
+          process.stdout.write(
+            `  ${localName}: \${{ secrets.${secret.name} }}\n`,
+          );
+        }
+        return;
+      }
+
+      // table format
+      const c = this.color;
+
+      if (remoteSecrets.length === 0) {
+        process.stdout.write(
+          `\nNo secrets in environment ${c.set("CYAN", envName)}.\n\n`,
+        );
+        return;
+      }
+
+      process.stdout.write(
+        `\n${c.set("GREY_LIGHT", "Environment:")} ${c.set("CYAN", envName)}\n\n`,
+      );
+
+      const maxNameLen = Math.max(
+        ...remoteSecrets.map((s) => s.name.length),
+        4,
+      );
+
+      process.stdout.write(
+        `   ${c.set("GREY_LIGHT", "NAME".padEnd(maxNameLen + 2))}${c.set("GREY_LIGHT", "UPDATED")}\n`,
+      );
+
+      for (const secret of remoteSecrets) {
+        const updated = secret.updatedAt
+          ? new Date(secret.updatedAt).toLocaleString()
+          : "-";
+        process.stdout.write(
+          `   ${c.set("CYAN", secret.name.padEnd(maxNameLen + 2))}${c.set("GREY_DARK", updated)}\n`,
+        );
+      }
+
+      process.stdout.write("\n");
+    },
+  });
+
+  // -----------------------------------------------------------------------
+  // alepha p secrets diff
+  // -----------------------------------------------------------------------
+
+  protected readonly diff = $command({
+    name: "diff",
+    description: "Compare local .env keys with remote store",
+    flags: this.envFlags,
+    handler: async ({ flags, root, run }) => {
+      const config = await this.inspector.resolveConfig(root);
+      const env = flags.env ?? config.defaultEnv;
+      const envName = this.resolveEnvironmentName(config.project, env);
+
+      const envVars = await this.envUtils.parseEnv(root, [`.env.${env}`]);
+      const filtered = this.filter.filter(envVars);
+      const localKeys = new Set(
+        Object.keys(filtered).map((k) => this.filter.toRemoteName(k)),
+      );
+
+      const store = this.resolveStore();
+      await store.ensureAvailable();
+      const remoteSecrets = await store.list(envName);
+      const remoteKeys = new Set(remoteSecrets.map((s) => s.name));
+
+      run.end();
+
+      const c = this.color;
+      const allKeys = [...new Set([...localKeys, ...remoteKeys])].sort();
+
+      process.stdout.write(
+        `\n${c.set("GREY_LIGHT", "Environment:")} ${c.set("CYAN", envName)}\n\n`,
+      );
+
+      let hasChanges = false;
+      for (const key of allKeys) {
+        const inLocal = localKeys.has(key);
+        const inRemote = remoteKeys.has(key);
+
+        if (inLocal && !inRemote) {
+          process.stdout.write(`   ${c.set("GREEN", "+")} ${key}\n`);
+          hasChanges = true;
+        } else if (!inLocal && inRemote) {
+          process.stdout.write(`   ${c.set("RED", "-")} ${key}\n`);
+          hasChanges = true;
+        } else {
+          process.stdout.write(`   ${c.set("GREY_DARK", "=")} ${key}\n`);
+        }
+      }
+
+      if (!hasChanges) {
+        process.stdout.write(
+          `   ${c.set("GREEN", "Local and remote are in sync.")}\n`,
+        );
+      }
+
+      process.stdout.write("\n");
+    },
+  });
+
+  // -----------------------------------------------------------------------
+  // alepha p secrets apply
+  // -----------------------------------------------------------------------
+
+  protected readonly apply = $command({
+    name: "apply",
+    description: "Push local .env secrets to the remote store",
+    flags: t.object({
+      env: t.optional(
+        t.text({
+          aliases: ["e"],
+          description: "Target environment",
+        }),
+      ),
+      "dry-run": t.optional(
+        t.boolean({
+          description: "Preview changes without pushing",
+        }),
+      ),
+    }),
+    handler: async ({ flags, root, run }) => {
+      const config = await this.inspector.resolveConfig(root);
+      const env = flags.env ?? config.defaultEnv;
+      const envName = this.resolveEnvironmentName(config.project, env);
+      const dryRun = flags["dry-run"] ?? false;
+
+      const envVars = await this.envUtils.parseEnv(root, [`.env.${env}`]);
+      const filtered = this.filter.filter(envVars);
+      const keys = Object.keys(filtered);
+
+      if (keys.length === 0) {
+        run.end();
+        process.stdout.write("\nNo secrets to push.\n\n");
+        return;
+      }
+
+      if (dryRun) {
+        run.end();
+        const c = this.color;
+        process.stdout.write(
+          `\n${c.set("GREY_LIGHT", "Dry run — environment:")} ${c.set("CYAN", envName)}\n\n`,
+        );
+        for (const key of keys) {
+          process.stdout.write(`   ${c.set("GREEN", "+")} ${key}\n`);
+        }
+        process.stdout.write(
+          `\n   ${keys.length} secret(s) would be pushed.\n\n`,
+        );
+        return;
+      }
+
+      const store = this.resolveStore();
+      await store.ensureAvailable();
+      await store.ensureEnvironment(envName);
+
+      for (const key of keys) {
+        const remoteName = this.filter.toRemoteName(key);
+        await run({
+          name: `push ${remoteName}`,
+          handler: async () => {
+            await store.set(envName, remoteName, filtered[key]);
+          },
+        });
+      }
+
+      run.end();
+      process.stdout.write(
+        `\n${keys.length} secret(s) pushed to ${envName}.\n`,
+      );
+    },
+  });
+
+  // -----------------------------------------------------------------------
+  // Parent command
+  // -----------------------------------------------------------------------
+
+  public readonly secrets = $command({
+    name: "secrets",
+    aliases: ["sec"],
+    description: "Manage secrets in external stores",
+    children: [this.list, this.diff, this.apply],
+    handler: async ({ help }) => {
+      help();
+    },
+  });
+
+  // -----------------------------------------------------------------------
+  // Helpers
+  // -----------------------------------------------------------------------
+
+  public resolveStore(): SecretStoreProvider {
+    const storeName = this.options?.secrets?.store ?? "github";
+    switch (storeName) {
+      case "github":
+        return this.githubStore;
+      default:
+        throw new AlephaError(
+          `Unknown secret store "${storeName}". Available: github`,
+        );
+    }
+  }
+
+  protected resolveEnvironmentName(project: string, env: string): string {
+    const pattern =
+      this.options?.secrets?.environmentPattern ?? "{project}-{env}";
+
+    return pattern
+      .replace("{project}", this.naming.slugify(project))
+      .replace("{env}", this.naming.slugify(env));
+  }
+}

package/src/cli/platform/commands/platform.ts

@@ -19,6 +19,7 @@ import {
   type ResolvedPlatformConfig,
 } from "../services/PlatformInspector.ts";
 import { PlatformOrchestrator } from "../services/PlatformOrchestrator.ts";
+import { SecretsCommand } from "./SecretsCommand.ts";
 
 export class PlatformCommand {
   protected readonly log = $logger();
@@ -30,6 +31,7 @@ export class PlatformCommand {
   protected readonly viteBuild = $inject(ViteBuildProvider);
   protected readonly color = $inject(ConsoleColorProvider);
   protected readonly envUtils = $inject(EnvUtils);
+  protected readonly secretsCommand = $inject(SecretsCommand);
 
   /**
    * Common flags for env/app targeting.
@@ -134,6 +136,15 @@ export class PlatformCommand {
         }
       }
 
+      if (adapterName === "docker" || adapterName === "docker-compose") {
+        if (hasDB && !envVars.DATABASE_URL) {
+          resources.push({ label: "Postgres", value: "postgres:17-alpine" });
+        }
+        if (hasBucket && !envVars.S3_ENDPOINT) {
+          resources.push({ label: "RustFS", value: "rustfs/rustfs:latest" });
+        }
+      }
+
       const excludedKeys =
         adapterName === "vercel"
           ? VercelAdapter.EXCLUDED_SECRET_KEYS
@@ -609,6 +620,7 @@ export class PlatformCommand {
       this.build,
       this.deploy,
       this.migrate,
+      this.secretsCommand.secrets,
     ],
     handler: async ({ help, root }) => {
       await this.inspector.resolveConfig(root);