cistack 5.2.0 → 5.4.0

package/README.md

@@ -89,6 +89,8 @@ By default, `cistack` now generates a single GitHub Actions workflow that combin
 
 Dependabot remains a separate file in `.github/dependabot.yml`, because it is not a GitHub Actions workflow.
 
+If you want preview deployments on Dependabot pull requests, add deployment credentials as Dependabot secrets too, not only Actions secrets. For Vercel, that means `VERCEL_TOKEN`, `VERCEL_ORG_ID`, and `VERCEL_PROJECT_ID`.
+
 ### Split mode
 
 If you prefer the old multi-file layout, set:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cistack",
-  "version": "5.2.0",
+  "version": "5.4.0",
   "description": "Automatically generate GitHub Actions CI/CD pipelines by analysing your codebase",
   "main": "src/index.js",
   "types": "index.d.ts",

package/src/generators/workflow.js

@@ -422,7 +422,7 @@ class WorkflowGenerator {
     if (previewSteps.length > 0) {
       jobs.preview = {
         name: `✨ Deploy → ${h.name} (Preview)`,
-        if: "github.event_name == 'pull_request'",
+        if: "github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository",
         'runs-on': 'ubuntu-latest',
         environment: 'preview',
         steps: [
@@ -430,7 +430,7 @@ class WorkflowGenerator {
           ...previewSteps,
           {
             name: 'Comment PR',
-            if: 'always()',
+            if: "always() && github.actor != 'dependabot[bot]'",
             uses: 'actions/github-script@v7',
             with: {
               script: `
@@ -883,20 +883,29 @@ class WorkflowGenerator {
         };
         steps.push(
           { name: 'Install Vercel CLI', run: 'npm install -g vercel' },
+          {
+            name: 'Validate Vercel credentials',
+            run: [
+              'test -n "$VERCEL_TOKEN" || (echo "Missing VERCEL_TOKEN secret. Add it in GitHub Actions secrets." && exit 1)',
+              'test -n "$VERCEL_ORG_ID" || (echo "Missing VERCEL_ORG_ID secret. Add it in GitHub Actions secrets." && exit 1)',
+              'test -n "$VERCEL_PROJECT_ID" || (echo "Missing VERCEL_PROJECT_ID secret. Add it in GitHub Actions secrets." && exit 1)',
+            ].join('\n'),
+            env: vercelEnv,
+          },
           {
             name: 'Pull Vercel environment',
-            run: `vercel pull --yes --environment=${isPreview ? 'preview' : 'production'} --token=\${{ secrets.VERCEL_TOKEN }}`,
+            run: `vercel pull --yes --environment=${isPreview ? 'preview' : 'production'} --token="$VERCEL_TOKEN"`,
             env: vercelEnv,
           },
           {
             name: 'Build project',
-            run: `vercel build${prodFlag ? ' ' + prodFlag : ''} --token=\${{ secrets.VERCEL_TOKEN }}`,
+            run: `vercel build${prodFlag ? ' ' + prodFlag : ''} --token="$VERCEL_TOKEN"`,
             env: vercelEnv,
           },
           {
             name: 'Deploy to Vercel',
             id: 'deploy',
-            run: `vercel deploy --prebuilt${prodFlag ? ' ' + prodFlag : ''} --token=\${{ secrets.VERCEL_TOKEN }} > deployment_url.txt && echo "DEPLOYMENT_URL=$(cat deployment_url.txt)" >> $GITHUB_ENV`,
+            run: `vercel deploy --prebuilt${prodFlag ? ' ' + prodFlag : ''} --token="$VERCEL_TOKEN" > deployment_url.txt && echo "DEPLOYMENT_URL=$(cat deployment_url.txt)" >> $GITHUB_ENV`,
             env: vercelEnv,
           },
         );

package/tests/run.js

@@ -414,6 +414,38 @@ test('combineWorkflows preserves workflow-specific trigger scoping in the unifie
   assert(!combined.jobs.deploy_deploy.if.includes("github.ref_name == 'develop'"));
 });
 
+test('Vercel deploy workflows validate secrets before running vercel pull', () => {
+  const projectDir = makeTempDir();
+  writeFiles(projectDir, {
+    'package.json': json({
+      name: 'vercel-secrets-app',
+      version: '1.0.0',
+      scripts: {
+        build: 'next build',
+      },
+    }),
+  });
+
+  const workflows = new WorkflowGenerator(
+    makeJsProject({
+      hosting: [{ name: 'Vercel', secrets: ['VERCEL_TOKEN', 'VERCEL_ORG_ID', 'VERCEL_PROJECT_ID'] }],
+      frameworks: [{ name: 'Next.js', confidence: 1, buildDir: '.next' }],
+    }),
+    projectDir
+  ).generate();
+
+  const deploy = parseWorkflow(workflows.find((workflow) => workflow.filename === 'deploy.yml').content);
+  const deploySteps = deploy.jobs.deploy.steps;
+  const validateStep = deploySteps.find((step) => step.name === 'Validate Vercel credentials');
+  const pullStep = deploySteps.find((step) => step.name === 'Pull Vercel environment');
+
+  assert(validateStep);
+  assert(validateStep.run.includes('Missing VERCEL_TOKEN secret'));
+  assert(validateStep.run.includes('Missing VERCEL_ORG_ID secret'));
+  assert(validateStep.run.includes('Missing VERCEL_PROJECT_ID secret'));
+  assert.equal(pullStep.run, 'vercel pull --yes --environment=production --token="$VERCEL_TOKEN"');
+});
+
 test('Single-layout monorepos still generate the root workspace matrix CI', () => {
   const projectDir = makeTempDir();
   const packages = [
@@ -528,6 +560,37 @@ test('Netlify preview configuration uses the detected production branch instead
   assert.equal(previewStep.with['production-branch'], 'release');
 });
 
+test('Preview deploy jobs run for same-repo pull requests, including Dependabot PRs', () => {
+  const projectDir = makeTempDir();
+  writeFiles(projectDir, {
+    'package.json': json({
+      name: 'preview-guard-app',
+      version: '1.0.0',
+      scripts: {
+        build: 'next build',
+      },
+    }),
+  });
+
+  const generator = new WorkflowGenerator(
+    makeJsProject({
+      hosting: [{ name: 'Vercel', secrets: ['VERCEL_TOKEN', 'VERCEL_ORG_ID', 'VERCEL_PROJECT_ID'] }],
+      frameworks: [{ name: 'Next.js', confidence: 1, buildDir: '.next' }],
+    }),
+    projectDir
+  );
+
+  const deploy = generator.generate().find((workflow) => workflow.filename === 'deploy.yml');
+  const parsed = parseWorkflow(deploy.content);
+  const commentStep = parsed.jobs.preview.steps.find((step) => step.name === 'Comment PR');
+
+  assert.equal(
+    parsed.jobs.preview.if,
+    "github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository"
+  );
+  assert.equal(commentStep.if, "always() && github.actor != 'dependabot[bot]'");
+});
+
 test('Generic JavaScript builds no longer upload a fake dist artifact when no build directory is known', () => {
   const projectDir = makeTempDir();
   writeFiles(projectDir, {