create-meith 0.17.1 → 0.17.2

package/dist/bin.mjs

@@ -47,6 +47,16 @@ function scaffold(options) {
       null,
       2
     )}
+`
+  );
+  files.set(
+    ".npmrc",
+    `# Every @meith/* dependency here is an exact version, not a range \u2014 see
+# README.md, "Upgrading", for why a range breaks the build. This makes that
+# the default for any \`npm install\` run in this project from here on,
+# including a plugin installed by hand later, not only the three packages
+# the scaffold pinned itself.
+save-exact=true
 `
   );
   files.set(
@@ -366,6 +376,10 @@ jobs:
         run: |
           IMAGE=$(echo "ghcr.io/\${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
           MEITH_VERSION=$(node -p "require('./package.json').dependencies['@meith/web']")
+          if ! echo "$MEITH_VERSION" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+$'; then
+            echo "::error::@meith/web in package.json is '$MEITH_VERSION', not an exact X.Y.Z version \u2014 that is not a legal Docker image tag. Upgrade with \\\`npm install --save-exact\\\` (see README.md, Upgrading) so this dependency always resolves to one."
+            exit 1
+          fi
           docker build --build-arg MEITH_VERSION="$MEITH_VERSION" -t "$IMAGE:\${{ github.sha }}" -t "$IMAGE:latest" .
           docker push "$IMAGE:\${{ github.sha }}"
           docker push "$IMAGE:latest"
@@ -381,12 +395,15 @@ jobs:
             echo
             echo "Paste this into the MEITH_IMAGE variable on the Coolify resource:"
             echo
-            echo "    $IMAGE:latest"
-            echo
-            echo "Once you want a pin that only moves when you say so:"
-            echo
             echo "    $IMAGE:\${{ github.sha }}"
             echo
+            echo "This tag names this run's build and nothing else, ever. $IMAGE:latest"
+            echo "also pushed, as a convenience for a quick manual pull; it moves on"
+            echo "every push to main, so any later Coolify redeploy \u2014 for any reason,"
+            echo "not necessarily this one \u2014 pulls whatever main most recently built,"
+            echo "including a commit still mid-feature. Prefer the sha above for the"
+            echo "value you actually set on the resource."
+            echo
             echo "## One-time: make the package public"
             echo
             echo "This package starts private. Coolify's pull fails until you visit"
@@ -537,10 +554,13 @@ one value only you know:
    \`TICK_SECRET\` and the database password, generated on the first deploy
    and never typed in. The one thing Coolify cannot generate is the image
    step 1 just pushed: set \`MEITH_IMAGE\` in the resource's own environment
-   to the value that run's Summary printed \u2014 \`ghcr.io/<you>/${name}:latest\`
-   (or a commit sha, once you want a pin that only moves when you say so \u2014
-   \`docker-compose.yml\` refuses to start without this set, with a message saying
-   why).
+   to the value that run's Summary printed \u2014 \`ghcr.io/<you>/${name}:\${{ github.sha }}\`,
+   a pin that only ever names that one build (\`docker-compose.yml\` refuses
+   to start without this set, with a message saying why). The same run also
+   pushes \`ghcr.io/<you>/${name}:latest\` as a convenience for a quick manual
+   pull, but it moves on every push to \`main\` \u2014 set it on the resource and a
+   later, unrelated redeploy can pull whatever \`main\` most recently built,
+   commit still mid-feature included.
 
 3. **Deploy, then \`/install\` on your own domain.** Coolify issues the
    certificate; the installer from there is the one
@@ -590,8 +610,8 @@ With no \`DATABASE_URL\`, the board runs on deterministic in-memory sample data
 enough to click through every reading surface. Posting needs a database:
 
 \`\`\`sh
-npm run forum -- migrate
-npm run forum -- user:create --admin
+npm run community -- migrate
+echo "<password>" | npm run community -- user:create --username <name> --email <address> --group administrators
 \`\`\`
 
 ## Configuring
@@ -602,14 +622,14 @@ npm run forum -- user:create --admin
 - **\`/admin\`** \u2014 settings, forums, groups, members, themes, maintenance. An
   administrator re-enters their password to get in, and again for anything
   destructive.
-- **\`npm run forum -- --help\`** \u2014 the operator CLI. Everything the panel does
+- **\`npm run community -- --help\`** \u2014 the operator CLI. Everything the panel does
   and a few things it cannot, without a browser.
 
 ## Upgrading
 
 \`\`\`sh
-npm install @meith/web@latest @meith/cli@latest
-git commit -am "Upgrade @meith/web and @meith/cli"
+npm install --save-exact @meith/web@latest @meith/cli@latest @meith/theme-default@latest
+git commit -am "Upgrade @meith/web, @meith/cli and @meith/theme-default"
 git push
 \`\`\`
 
@@ -617,8 +637,15 @@ That one \`package.json\` change is the whole pin: \`Dockerfile\`'s own
 \`FROM\` line takes the version as a build argument, and
 \`.github/workflows/build.yml\` reads it straight out of \`package.json\`'s
 own \`@meith/web\` dependency when it rebuilds \u2014 nothing in \`Dockerfile\`
-itself to keep in sync by hand. Once the rebuilt image is deployed, run
-\`npm run forum -- upgrade\` against it for the plugin migrations \u2014 see
+itself to keep in sync by hand. \`--save-exact\` matters: npm's default
+\`save-prefix\` is \`^\`, and a caret range is not a legal Docker image tag \u2014
+without it, this exact command would write \`"^0.18.0"\` and the next build
+would fail with \`invalid reference format\` instead of building. This
+project's own \`.npmrc\` sets \`save-exact=true\` for the same reason, so an
+\`npm install\` of anything else here \u2014 a plugin, say \u2014 stays pinned too; the
+build workflow also refuses to build from anything but an exact version, as
+a second line of defense. Once the rebuilt image is deployed, run
+\`npm run community -- upgrade\` against it for the plugin migrations \u2014 see
 [the operator CLI](${repositoryUrl}/blob/main/docs/operating.md#the-operator-cli)
 for running it against this deployment.
 
@@ -652,7 +679,15 @@ async function initGit(target) {
   }
 }
 async function run(argv, version) {
-  const positional = argv.filter((arg) => !arg.startsWith("-"));
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--repo") {
+      i++;
+      continue;
+    }
+    if (!arg.startsWith("-")) positional.push(arg);
+  }
   const name = positional[0] ?? "";
   if (argv.includes("--help") || argv.includes("-h")) {
     return {
@@ -723,7 +758,7 @@ async function run(argv, version) {
 }
 
 // src/bin.ts
-var result = await run(process.argv.slice(2), "0.17.1");
+var result = await run(process.argv.slice(2), "0.17.2");
 for (const line of result.lines) {
   if (result.code === 0) console.log(line);
   else console.error(line);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-meith",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Scaffold a Meith board — npx create-meith <name> writes a workspace that depends on @meith/web and @meith/cli.",
   "license": "LGPL-3.0-or-later",
   "repository": {

package/src/bin.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { run } from './cli'
 
-const result = await run(process.argv.slice(2), '0.17.1')
+const result = await run(process.argv.slice(2), '0.17.2')
 for (const line of result.lines) {
   if (result.code === 0) console.log(line)
   else console.error(line)

package/src/cli.ts

@@ -31,7 +31,15 @@ async function initGit(target: string): Promise<boolean> {
 }
 
 export async function run(argv: readonly string[], version: string): Promise<CliResult> {
-  const positional = argv.filter((arg) => !arg.startsWith('-'))
+  const positional: string[] = []
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i] as string
+    if (arg === '--repo') {
+      i++
+      continue
+    }
+    if (!arg.startsWith('-')) positional.push(arg)
+  }
   const name = positional[0] ?? ''
 
   if (argv.includes('--help') || argv.includes('-h')) {

package/src/scaffold.ts

@@ -50,6 +50,17 @@ export function scaffold(options: ScaffoldOptions): ReadonlyMap<string, string>
     )}\n`,
   )
 
+  files.set(
+    '.npmrc',
+    `# Every @meith/* dependency here is an exact version, not a range — see
+# README.md, "Upgrading", for why a range breaks the build. This makes that
+# the default for any \`npm install\` run in this project from here on,
+# including a plugin installed by hand later, not only the three packages
+# the scaffold pinned itself.
+save-exact=true
+`,
+  )
+
   files.set(
     'community.config.ts',
     `/**
@@ -375,6 +386,10 @@ jobs:
         run: |
           IMAGE=$(echo "ghcr.io/\${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
           MEITH_VERSION=$(node -p "require('./package.json').dependencies['@meith/web']")
+          if ! echo "$MEITH_VERSION" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+$'; then
+            echo "::error::@meith/web in package.json is '$MEITH_VERSION', not an exact X.Y.Z version — that is not a legal Docker image tag. Upgrade with \\\`npm install --save-exact\\\` (see README.md, Upgrading) so this dependency always resolves to one."
+            exit 1
+          fi
           docker build --build-arg MEITH_VERSION="$MEITH_VERSION" -t "$IMAGE:\${{ github.sha }}" -t "$IMAGE:latest" .
           docker push "$IMAGE:\${{ github.sha }}"
           docker push "$IMAGE:latest"
@@ -390,12 +405,15 @@ jobs:
             echo
             echo "Paste this into the MEITH_IMAGE variable on the Coolify resource:"
             echo
-            echo "    $IMAGE:latest"
-            echo
-            echo "Once you want a pin that only moves when you say so:"
-            echo
             echo "    $IMAGE:\${{ github.sha }}"
             echo
+            echo "This tag names this run's build and nothing else, ever. $IMAGE:latest"
+            echo "also pushed, as a convenience for a quick manual pull; it moves on"
+            echo "every push to main, so any later Coolify redeploy — for any reason,"
+            echo "not necessarily this one — pulls whatever main most recently built,"
+            echo "including a commit still mid-feature. Prefer the sha above for the"
+            echo "value you actually set on the resource."
+            echo
             echo "## One-time: make the package public"
             echo
             echo "This package starts private. Coolify's pull fails until you visit"
@@ -548,10 +566,13 @@ one value only you know:
    \`TICK_SECRET\` and the database password, generated on the first deploy
    and never typed in. The one thing Coolify cannot generate is the image
    step 1 just pushed: set \`MEITH_IMAGE\` in the resource's own environment
-   to the value that run's Summary printed — \`ghcr.io/<you>/${name}:latest\`
-   (or a commit sha, once you want a pin that only moves when you say so —
-   \`docker-compose.yml\` refuses to start without this set, with a message saying
-   why).
+   to the value that run's Summary printed — \`ghcr.io/<you>/${name}:\${{ github.sha }}\`,
+   a pin that only ever names that one build (\`docker-compose.yml\` refuses
+   to start without this set, with a message saying why). The same run also
+   pushes \`ghcr.io/<you>/${name}:latest\` as a convenience for a quick manual
+   pull, but it moves on every push to \`main\` — set it on the resource and a
+   later, unrelated redeploy can pull whatever \`main\` most recently built,
+   commit still mid-feature included.
 
 3. **Deploy, then \`/install\` on your own domain.** Coolify issues the
    certificate; the installer from there is the one
@@ -601,8 +622,8 @@ With no \`DATABASE_URL\`, the board runs on deterministic in-memory sample data
 enough to click through every reading surface. Posting needs a database:
 
 \`\`\`sh
-npm run forum -- migrate
-npm run forum -- user:create --admin
+npm run community -- migrate
+echo "<password>" | npm run community -- user:create --username <name> --email <address> --group administrators
 \`\`\`
 
 ## Configuring
@@ -613,14 +634,14 @@ npm run forum -- user:create --admin
 - **\`/admin\`** — settings, forums, groups, members, themes, maintenance. An
   administrator re-enters their password to get in, and again for anything
   destructive.
-- **\`npm run forum -- --help\`** — the operator CLI. Everything the panel does
+- **\`npm run community -- --help\`** — the operator CLI. Everything the panel does
   and a few things it cannot, without a browser.
 
 ## Upgrading
 
 \`\`\`sh
-npm install @meith/web@latest @meith/cli@latest
-git commit -am "Upgrade @meith/web and @meith/cli"
+npm install --save-exact @meith/web@latest @meith/cli@latest @meith/theme-default@latest
+git commit -am "Upgrade @meith/web, @meith/cli and @meith/theme-default"
 git push
 \`\`\`
 
@@ -628,8 +649,15 @@ That one \`package.json\` change is the whole pin: \`Dockerfile\`'s own
 \`FROM\` line takes the version as a build argument, and
 \`.github/workflows/build.yml\` reads it straight out of \`package.json\`'s
 own \`@meith/web\` dependency when it rebuilds — nothing in \`Dockerfile\`
-itself to keep in sync by hand. Once the rebuilt image is deployed, run
-\`npm run forum -- upgrade\` against it for the plugin migrations — see
+itself to keep in sync by hand. \`--save-exact\` matters: npm's default
+\`save-prefix\` is \`^\`, and a caret range is not a legal Docker image tag —
+without it, this exact command would write \`"^0.18.0"\` and the next build
+would fail with \`invalid reference format\` instead of building. This
+project's own \`.npmrc\` sets \`save-exact=true\` for the same reason, so an
+\`npm install\` of anything else here — a plugin, say — stays pinned too; the
+build workflow also refuses to build from anything but an exact version, as
+a second line of defense. Once the rebuilt image is deployed, run
+\`npm run community -- upgrade\` against it for the plugin migrations — see
 [the operator CLI](${repositoryUrl}/blob/main/docs/operating.md#the-operator-cli)
 for running it against this deployment.