create-svc 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Andrew Ho
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,32 @@
+# create-svc
+
+`create-svc` is a Bun-authored scaffold CLI for generating a Go Cloud Run service with:
+
+- Chi HTTP routes
+- ConnectRPC handlers
+- a real Cloud Run service manifest
+- Bun-based deployment helpers
+- Vault-backed Cloudflare DNS CRUD as the default example
+
+## Usage
+
+```bash
+bun install
+bun run index.ts my-service
+```
+
+The generated service supports:
+
+```bash
+bun dev
+bun gen
+bun lint
+bun test
+bun deploy
+```
+
+## Development
+
+```bash
+bun test src
+```

package/index.ts

@@ -0,0 +1,5 @@
+#!/usr/bin/env bun
+
+import { run } from "./src/cli";
+
+await run(process.argv.slice(2));

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "create-svc",
+  "version": "0.1.0",
+  "description": "Bun-authored CLI to scaffold Go Cloud Run services with Chi, ConnectRPC, Vault, and Cloudflare examples.",
+  "module": "index.ts",
+  "type": "module",
+  "license": "MIT",
+  "bin": {
+    "create-svc": "./index.ts",
+    "create-service": "./index.ts"
+  },
+  "files": [
+    "index.ts",
+    "src",
+    "templates",
+    "README.md"
+  ],
+  "scripts": {
+    "dev": "bun run index.ts",
+    "test": "bun test src"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anmho/create-svc.git"
+  },
+  "homepage": "https://github.com/anmho/create-svc#readme",
+  "bugs": {
+    "url": "https://github.com/anmho/create-svc/issues"
+  },
+  "keywords": [
+    "bun",
+    "cloud-run",
+    "connectrpc",
+    "go",
+    "grpc",
+    "scaffold"
+  ],
+  "devDependencies": {
+    "@types/bun": "latest"
+  },
+  "peerDependencies": {
+    "typescript": "^5"
+  },
+  "dependencies": {
+    "@clack/prompts": "^1.2.0",
+    "picocolors": "^1.1.1"
+  }
+}

package/src/cli.ts

@@ -0,0 +1,300 @@
+import { cancel, confirm, intro, isCancel, log, note, outro, spinner, text } from "@clack/prompts";
+import pc from "picocolors";
+import { basename, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { scaffoldProject, type ScaffoldConfig } from "./scaffold";
+
+type ParsedArgs = {
+  directory?: string;
+  modulePath?: string;
+  projectId?: string;
+  region?: string;
+  githubRepo?: string;
+  vaultAddr?: string;
+  vaultSecretPath?: string;
+  vaultSecretKey?: string;
+  cloudflareZoneId?: string;
+  bufModule?: string;
+  yes: boolean;
+  help: boolean;
+};
+
+const DEFAULT_REGION = "us-west1";
+const DEFAULT_VAULT_ADDR = "https://vault.anmho.com";
+const DEFAULT_VAULT_SECRET_PATH = "provider/cloudflare-api-token";
+const DEFAULT_VAULT_SECRET_KEY = "value";
+const DEFAULT_CLOUDFLARE_ZONE_ID = "893c2371cc222826de6e00583f4902ea";
+
+export async function run(argv: string[]) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    printHelp();
+    return;
+  }
+
+  intro(`${pc.bold("create-service")} ${pc.dim("Cloud Run scaffold")}`);
+
+  const config = await resolveConfig(args);
+  const targetDir = resolve(process.cwd(), config.directory);
+
+  note(
+    [
+      `${pc.bold("Output")}: ${targetDir}`,
+      `${pc.bold("Module")}: ${config.modulePath}`,
+      `${pc.bold("Deploy")}: public Cloud Run service with Vault-backed Cloudflare DNS CRUD`,
+    ].join("\n"),
+    "Scaffold"
+  );
+
+  const buildSpinner = spinner();
+  buildSpinner.start("Generating project files");
+  await scaffoldProject(config);
+  buildSpinner.stop("Project files generated");
+
+  outro(
+    [
+      `Next: ${pc.cyan(`cd ${config.directory}`)}`,
+      `Local dev: ${pc.cyan("bun dev")}`,
+      `Generate stubs: ${pc.cyan("bun gen")}`,
+      `First deploy: set ${pc.cyan("BOOTSTRAP_VAULT_ROLE_ID")} and ${pc.cyan("BOOTSTRAP_VAULT_SECRET_ID")}, then run ${pc.cyan("bun deploy")}`,
+    ].join("\n")
+  );
+}
+
+function parseArgs(argv: string[]): ParsedArgs {
+  const parsed: ParsedArgs = {
+    yes: false,
+    help: false,
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token) {
+      continue;
+    }
+
+    if (!token.startsWith("-") && !parsed.directory) {
+      parsed.directory = token;
+      continue;
+    }
+
+    const next = argv[i + 1];
+    const readValue = () => {
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${token}`);
+      }
+      i += 1;
+      return next;
+    };
+
+    if (token === "--yes" || token === "-y") {
+      parsed.yes = true;
+      continue;
+    }
+
+    if (token === "--help" || token === "-h") {
+      parsed.help = true;
+      continue;
+    }
+
+    if (token === "--module") {
+      parsed.modulePath = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--module=")) {
+      parsed.modulePath = token.slice("--module=".length);
+      continue;
+    }
+
+    if (token === "--project-id") {
+      parsed.projectId = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--project-id=")) {
+      parsed.projectId = token.slice("--project-id=".length);
+      continue;
+    }
+
+    if (token === "--region") {
+      parsed.region = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--region=")) {
+      parsed.region = token.slice("--region=".length);
+      continue;
+    }
+
+    if (token === "--github-repo") {
+      parsed.githubRepo = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--github-repo=")) {
+      parsed.githubRepo = token.slice("--github-repo=".length);
+      continue;
+    }
+
+    if (token === "--vault-addr") {
+      parsed.vaultAddr = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--vault-addr=")) {
+      parsed.vaultAddr = token.slice("--vault-addr=".length);
+      continue;
+    }
+
+    if (token === "--vault-secret-path") {
+      parsed.vaultSecretPath = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--vault-secret-path=")) {
+      parsed.vaultSecretPath = token.slice("--vault-secret-path=".length);
+      continue;
+    }
+
+    if (token === "--vault-secret-key") {
+      parsed.vaultSecretKey = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--vault-secret-key=")) {
+      parsed.vaultSecretKey = token.slice("--vault-secret-key=".length);
+      continue;
+    }
+
+    if (token === "--cloudflare-zone-id") {
+      parsed.cloudflareZoneId = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--cloudflare-zone-id=")) {
+      parsed.cloudflareZoneId = token.slice("--cloudflare-zone-id=".length);
+      continue;
+    }
+
+    if (token === "--buf-module") {
+      parsed.bufModule = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--buf-module=")) {
+      parsed.bufModule = token.slice("--buf-module=".length);
+      continue;
+    }
+
+    throw new Error(`Unknown argument: ${token}`);
+  }
+
+  return parsed;
+}
+
+async function resolveConfig(args: ParsedArgs): Promise<ScaffoldConfig> {
+  const inferredName = slugify(basename(args.directory ?? "dns-api"));
+  const serviceName = args.yes
+    ? inferredName
+    : await promptText("Service name", inferredName, (value) => slugify(value).length > 0 || "Service name is required");
+
+  const directory = args.directory ?? serviceName;
+  const githubRepo = args.githubRepo ?? `anmho/${serviceName}`;
+  const modulePath = args.modulePath ?? `github.com/${githubRepo}`;
+  const projectId = args.projectId ?? (args.yes ? "my-gcp-project" : "");
+  const region = args.region ?? DEFAULT_REGION;
+  const vaultAddr = args.vaultAddr ?? DEFAULT_VAULT_ADDR;
+  const vaultSecretPath = args.vaultSecretPath ?? DEFAULT_VAULT_SECRET_PATH;
+  const vaultSecretKey = args.vaultSecretKey ?? DEFAULT_VAULT_SECRET_KEY;
+  const cloudflareZoneId = args.cloudflareZoneId ?? DEFAULT_CLOUDFLARE_ZONE_ID;
+  const bufModule = args.bufModule ?? `buf.build/${githubRepo}`;
+
+  const confirmedProjectId = projectId || (await promptText("GCP project ID", "my-gcp-project", (value) => value.trim().length > 0 || "Project ID is required"));
+  const confirmedModulePath = args.yes
+    ? modulePath
+    : await promptText("Go module path", modulePath, (value) => value.trim().length > 0 || "Module path is required");
+  const confirmedGithubRepo = args.yes
+    ? githubRepo
+    : await promptText("GitHub repo", githubRepo, (value) => value.includes("/") || "Use owner/repo format");
+  const confirmedRegion = args.yes
+    ? region
+    : await promptText("Cloud Run region", region, (value) => value.trim().length > 0 || "Region is required");
+  const confirmedBufModule = args.yes
+    ? bufModule
+    : await promptText("Buf module", bufModule, (value) => value.trim().length > 0 || "Buf module is required");
+
+  if (!args.yes) {
+    const okay = await confirm({
+      message: "Create the scaffold with these defaults?",
+      initialValue: true,
+    });
+    if (isCancel(okay) || !okay) {
+      cancel("Aborted");
+      process.exit(1);
+    }
+  }
+
+  return {
+    directory,
+    serviceName,
+    modulePath: confirmedModulePath,
+    projectId: confirmedProjectId,
+    region: confirmedRegion,
+    githubRepo: confirmedGithubRepo,
+    vaultAddr,
+    vaultSecretPath,
+    vaultSecretKey,
+    cloudflareZoneId,
+    bufModule: confirmedBufModule,
+    generatorRoot: resolve(dirname(fileURLToPath(import.meta.url)), ".."),
+  };
+}
+
+async function promptText(
+  message: string,
+  initialValue: string,
+  validate: (value: string) => true | string
+): Promise<string> {
+  const value = await text({
+    message,
+    initialValue,
+    validate: (input) => validate(input.trim()),
+  });
+
+  if (isCancel(value)) {
+    cancel("Aborted");
+    process.exit(1);
+  }
+
+  return value.trim();
+}
+
+function slugify(value: string): string {
+  return value
+    .trim()
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .slice(0, 63);
+}
+
+function printHelp() {
+  log.message(`
+Usage:
+  bun run index.ts [directory] [options]
+
+Options:
+  --module <path>               Go module path
+  --project-id <id>             GCP project ID
+  --region <region>             Cloud Run region
+  --github-repo <owner/repo>    GitHub repository
+  --vault-addr <url>            Vault address
+  --vault-secret-path <path>    Vault KV secret path
+  --vault-secret-key <key>      Vault KV secret key
+  --cloudflare-zone-id <id>     Cloudflare zone ID
+  --buf-module <module>         Buf module name
+  --yes, -y                     Accept defaults without prompts
+  --help, -h                    Show this message
+`);
+}

package/src/scaffold.test.ts

@@ -0,0 +1,46 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { scaffoldProject } from "./scaffold";
+
+test("scaffolds the default project shape", async () => {
+  const root = await mkdtemp(join(tmpdir(), "create-service-"));
+  const generatedRoot = join(root, "dns-api");
+
+  await scaffoldProject({
+    directory: generatedRoot,
+    serviceName: "dns-api",
+    modulePath: "github.com/anmho/dns-api",
+    projectId: "anmho-infra-prod",
+    region: "us-west1",
+    githubRepo: "anmho/dns-api",
+    vaultAddr: "https://vault.anmho.com",
+    vaultSecretPath: "provider/cloudflare-api-token",
+    vaultSecretKey: "value",
+    cloudflareZoneId: "893c2371cc222826de6e00583f4902ea",
+    bufModule: "buf.build/anmho/dns-api",
+    generatorRoot: join(import.meta.dir, ".."),
+  });
+
+  const entries = await readdir(generatedRoot);
+
+  expect(entries).toContain("cmd");
+  expect(entries).toContain("gen");
+  expect(entries).toContain("internal");
+  expect(entries).toContain("scripts");
+  expect(entries).toContain("service.yaml");
+
+  const manifest = await Bun.file(join(generatedRoot, "service.yaml")).text();
+  expect(manifest).toContain("serving.knative.dev/v1");
+  expect(manifest.includes("{{")).toBeFalse();
+
+  const deployScript = await Bun.file(join(generatedRoot, "scripts", "cloudrun", "deploy.ts")).text();
+  expect(deployScript).toContain('"run", "services", "replace"');
+
+  const configScript = await Bun.file(join(generatedRoot, "scripts", "cloudrun", "config.ts")).text();
+  expect(configScript).toContain('serviceName: "dns-api"');
+
+  const protoStub = await Bun.file(join(generatedRoot, "gen", "dns", "v1", "dns.pb.go")).text();
+  expect(protoStub).toContain("package dnsv1");
+});

package/src/scaffold.ts

@@ -0,0 +1,133 @@
+import { mkdir, readdir } from "node:fs/promises";
+import { dirname, join, resolve } from "node:path";
+
+export type ScaffoldConfig = {
+  directory: string;
+  serviceName: string;
+  modulePath: string;
+  projectId: string;
+  region: string;
+  githubRepo: string;
+  vaultAddr: string;
+  vaultSecretPath: string;
+  vaultSecretKey: string;
+  cloudflareZoneId: string;
+  bufModule: string;
+  generatorRoot: string;
+};
+
+export async function scaffoldProject(config: ScaffoldConfig) {
+  const targetDir = resolve(process.cwd(), config.directory);
+  await ensureTargetDirectory(targetDir);
+
+  const replacements = buildReplacements(config);
+  const templateRoot = resolve(config.generatorRoot, "templates", "root");
+  const files = await collectTemplateFiles(templateRoot);
+
+  for (const relativePath of files) {
+    const sourcePath = join(templateRoot, relativePath);
+    const destinationPath = join(targetDir, relativePath);
+    const raw = await Bun.file(sourcePath).text();
+    const rendered = renderTemplate(raw, replacements);
+
+    await mkdir(dirname(destinationPath), { recursive: true });
+    await Bun.write(destinationPath, rendered);
+  }
+}
+
+async function ensureTargetDirectory(targetDir: string) {
+  try {
+    const entries = await readdir(targetDir);
+    if (entries.length > 0) {
+      throw new Error(`Target directory already exists and is not empty: ${targetDir}`);
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      await mkdir(targetDir, { recursive: true });
+      return;
+    }
+    throw error;
+  }
+}
+
+async function collectTemplateFiles(root: string, relative = ""): Promise<string[]> {
+  const cwd = join(root, relative);
+  const entries = await readdir(cwd, { withFileTypes: true });
+  const files: string[] = [];
+
+  for (const entry of entries) {
+    const nextRelative = relative ? join(relative, entry.name) : entry.name;
+    if (entry.isDirectory()) {
+      files.push(...(await collectTemplateFiles(root, nextRelative)));
+      continue;
+    }
+    files.push(nextRelative);
+  }
+
+  return files.sort();
+}
+
+function buildReplacements(config: ScaffoldConfig) {
+  const [repoOwner = "anmho"] = config.githubRepo.split("/");
+  const serviceAccountBase = compactIdentifier(config.serviceName, 21);
+  const runtimeServiceAccount = `${serviceAccountBase}-runtime@${config.projectId}.iam.gserviceaccount.com`;
+  const deployerServiceAccount = `${serviceAccountBase}-deployer@${config.projectId}.iam.gserviceaccount.com`;
+  const vaultRoleIdSecret = `${config.serviceName}-vault-role-id`;
+  const vaultSecretIdSecret = `${config.serviceName}-vault-secret-id`;
+  const wifPoolId = "github";
+  const wifProviderId = compactIdentifier(config.serviceName, 32);
+
+  return {
+    SERVICE_NAME: config.serviceName,
+    MODULE_PATH: config.modulePath,
+    PROJECT_ID: config.projectId,
+    REGION: config.region,
+    GITHUB_REPO: config.githubRepo,
+    GITHUB_OWNER: repoOwner,
+    VAULT_ADDR: config.vaultAddr,
+    VAULT_SECRET_PATH: config.vaultSecretPath,
+    VAULT_SECRET_KEY: config.vaultSecretKey,
+    CLOUDFLARE_ZONE_ID: config.cloudflareZoneId,
+    BUF_MODULE: config.bufModule,
+    RUNTIME_SERVICE_ACCOUNT: runtimeServiceAccount,
+    DEPLOYER_SERVICE_ACCOUNT: deployerServiceAccount,
+    VAULT_ROLE_ID_SECRET: vaultRoleIdSecret,
+    VAULT_SECRET_ID_SECRET: vaultSecretIdSecret,
+    WIF_POOL_ID: wifPoolId,
+    WIF_PROVIDER_ID: wifProviderId,
+  };
+}
+
+function renderTemplate(input: string, replacements: Record<string, string>) {
+  return input.replace(/\{\{([A-Z0-9_]+)\}\}/g, (_, key: string) => {
+    const replacement = replacements[key];
+    if (replacement === undefined) {
+      throw new Error(`Missing template replacement for ${key}`);
+    }
+    return replacement;
+  });
+}
+
+function compactIdentifier(value: string, maxLength: number) {
+  const normalized = value
+    .toLowerCase()
+    .replace(/[^a-z0-9-]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+
+  if (normalized.length <= maxLength) {
+    return normalized || "service";
+  }
+
+  const hash = shortHash(normalized);
+  const head = normalized.slice(0, Math.max(1, maxLength - hash.length - 1)).replace(/-+$/g, "");
+  return `${head}-${hash}`;
+}
+
+function shortHash(value: string) {
+  let hash = 2166136261;
+  for (let i = 0; i < value.length; i += 1) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).slice(0, 8);
+}

package/templates/root/.github/workflows/buf-publish.yml

@@ -0,0 +1,19 @@
+name: buf-publish
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "protos/**"
+
+jobs:
+  publish:
+    if: ${{ vars.BUF_MODULE != '' }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: bufbuild/buf-setup-action@v1
+      - run: buf push
+        env:
+          BUF_TOKEN: ${{ secrets.BUF_TOKEN }}

package/templates/root/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: '1.25.4'
+      - uses: oven-sh/setup-bun@v2
+      - uses: bufbuild/buf-setup-action@v1
+      - name: Install proto plugins
+        run: |
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.10
+          go install connectrpc.com/connect/cmd/protoc-gen-connect-go@v1.19.1
+          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+      - run: bun gen
+      - run: bun lint
+      - run: bun test

package/templates/root/.github/workflows/deploy.yml

@@ -0,0 +1,22 @@
+name: deploy
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+      - uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOYER_SERVICE_ACCOUNT }}
+      - uses: google-github-actions/setup-gcloud@v2
+      - run: bun deploy -- --ci

package/templates/root/Dockerfile

@@ -0,0 +1,23 @@
+FROM golang:1.25.4 AS builder
+
+WORKDIR /app
+
+COPY go.mod ./
+COPY gen ./gen
+COPY internal ./internal
+COPY cmd ./cmd
+
+RUN go mod download
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o /out/server ./cmd/server
+
+FROM gcr.io/distroless/base-debian12
+
+WORKDIR /app
+
+COPY --from=builder /out/server /app/server
+
+ENV PORT=8080
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/server"]