deploy-stack 0.18.0 → 0.18.2

package/src/utils/aws.js

@@ -2,7 +2,20 @@ import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
 import { S3Client, CreateBucketCommand, PutBucketVersioningCommand, PutBucketTaggingCommand } from '@aws-sdk/client-s3';
 import { DeleteBucketCommand, ListObjectVersionsCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
+export async function checkAwsCredentials(region) {
+    const resolvedRegion = region || process.env.AWS_REGION || 'us-east-1';
+    if (process.env.CI_MOCK_AWS === 'true') {
+        return { accountId: '123456789012', awsAccountId: '123456789012', region: resolvedRegion };
+    }
+    const stsClient = new STSClient({ region: resolvedRegion });
+    const { Account } = await stsClient.send(new GetCallerIdentityCommand({}));
+    return { accountId: Account, awsAccountId: Account, region: resolvedRegion };
+}
+
 export async function provisionStateBucket(region, projectName) {
+    if (process.env.CI_MOCK_AWS === 'true') {
+        return { awsAccountId: '123456789012', stateBucketName: 'mock-tf-state-bucket' };
+    }
     const stsClient = new STSClient({ region });
     let awsAccountId;
 
@@ -48,6 +61,9 @@ export async function provisionStateBucket(region, projectName) {
 }
 
 export async function teardownStateBucket(region, bucketName) {
+    if (process.env.CI_MOCK_AWS === 'true') {
+        return true;
+    }
     const client = new S3Client({ region });
 
     try {

package/src/utils/generator.js

@@ -138,14 +138,15 @@ export async function generateTemplates(targetDir, config) {
     if (config.finalFramework === 'rails') {
         secretsArray.push(`{ "name": "RAILS_MASTER_KEY", "valueFrom": "\${local.secret_arn}:RAILS_MASTER_KEY::" }`);
 
-        initialSecretMap += `,\n    RAILS_MASTER_KEY = var.rails_master_key`;
-
+        let initialMasterKey = "1234567890abcdef1234567890abcdef"; // Dummy fallback for CI/CD
         const masterKeyPath = path.join(targetDir, 'config', 'master.key');
+
         if (fsSync.existsSync(masterKeyPath)) {
-            const realKey = fsSync.readFileSync(masterKeyPath, 'utf-8').trim();
-            const tfvarsPath = path.join(targetDir, 'terraform', 'secrets.auto.tfvars');
-            fsSync.writeFileSync(tfvarsPath, `rails_master_key = "${realKey}"\n`);
+            initialMasterKey = fsSync.readFileSync(masterKeyPath, 'utf-8').trim();
         }
+
+        // Inject the string literal directly, avoiding Terraform variables entirely
+        initialSecretMap += `,\n    RAILS_MASTER_KEY = "${initialMasterKey}"`;
     }
 
     initialSecretMap += `\n  }`;

package/src/utils/prompts.js

@@ -106,7 +106,7 @@ export async function getProjectConfig(isHeadless, headlessOptions, targetDir, d
     let aiAssistants = [];
     if (setupType === 'advanced') {
         const prChoice = await confirm({
-            message: `Enable Ephemeral PR Previews? (Spins up isolated, temporary AWS environments for PRs)\n  ${color.gray('📖 Learn more: https://github.com/anton-codes-iac/deploy-stack/blob/main/docs/guides/ephemeral-pr-previews.md')}`,
+            message: `Enable Ephemeral PR Previews? (Spins up isolated, temporary AWS environments for PRs)\n  ${color.gray('📖 Learn more: https://github.com/anton-codes-iac/deploy-stack/blob/main/apps/docs/src/content/docs/guides/ephemeral-pr-previews.md')}`,
             initialValue: false,
         });
         if (typeof prChoice === 'symbol') process.exit(0);

package/templates/docker/nestjs.Dockerfile

@@ -8,13 +8,25 @@ RUN npm run build
 
 # --- Stage 2: Production ---
 FROM node:22-alpine
-# DevSecOps: Patch Alpine OS and update npm
-RUN apk update && apk upgrade --no-cache && npm install -g npm@latest
+
+# 1. DevSecOps: Patch Alpine OS
+RUN apk update && apk upgrade --no-cache
+
 ENV NODE_ENV=production
 WORKDIR /app
+
+# 2. Install ONLY production dependencies
 COPY --chown=node:node package*.json ./
-RUN npm ci --omit=dev
+RUN npm ci --omit=dev && npm cache clean --force
+
+# 3. DevSecOps: Nuke all package managers to eliminate base-image CVEs
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \
+    /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+    /usr/local/lib/node_modules/corepack /usr/local/bin/corepack
+
+# 4. Copy the compiled application
 COPY --chown=node:node --from=builder /app/dist ./dist
+
 USER node
 # Expose the port defined by Terraform
 EXPOSE {{PORT}}

package/templates/docker/svelte.Dockerfile

@@ -40,8 +40,10 @@ RUN npm ci --omit=dev && npm cache clean --force
 # 4. Copy the compiled SvelteKit server from the builder stage
 COPY --from=builder --chown=node:node /app/build/ ./build/
 
-# 5. DevSecOps: Nuke NPM completely to eliminate Trivy vulnerabilities
-RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# 5. DevSecOps: Nuke all package managers to eliminate base-image CVEs
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \
+    /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \
+    /usr/local/lib/node_modules/corepack /usr/local/bin/corepack
 
 USER node
 EXPOSE {{PORT}}

package/templates/terraform/backend.tf

@@ -1,4 +1,17 @@
 terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+    tls = {
+      source  = "hashicorp/tls"
+      version = "~> 4.0"
+    }
+  }
+
   backend "s3" {
     bucket       = "{{STATE_BUCKET}}"
     key          = "state/terraform.tfstate"
@@ -6,4 +19,4 @@ terraform {
     encrypt      = true
     use_lockfile = true
   }
-}
+}

package/templates/terraform/secrets.tf

@@ -19,12 +19,6 @@ locals {
   secret_arn = terraform.workspace == "default" ? aws_secretsmanager_secret.app_secrets[0].arn : data.aws_secretsmanager_secret.existing_secrets[0].arn
 }
 
-# Fallback dummy key for CI/CD environments where the real key isn't present
-variable "rails_master_key" {
-  type    = string
-  default = "1234567890abcdef1234567890abcdef"
-}
-
 # Initial placeholder secret so the ECS task doesn't fail on first boot
 resource "aws_secretsmanager_secret_version" "app_secrets_initial" {
   count         = terraform.workspace == "default" ? 1 : 0

package/tests/__snapshots__/generator.test.js.snap

@@ -5356,8 +5356,10 @@ RUN npm ci --omit=dev && npm cache clean --force
 # 4. Copy the compiled SvelteKit server from the builder stage
 COPY --from=builder --chown=node:node /app/build/ ./build/
 
-# 5. DevSecOps: Nuke NPM completely to eliminate Trivy vulnerabilities
-RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
+# 5. DevSecOps: Nuke all package managers to eliminate base-image CVEs
+RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx \\
+    /opt/yarn-* /usr/local/bin/yarn /usr/local/bin/yarnpkg \\
+    /usr/local/lib/node_modules/corepack /usr/local/bin/corepack
 
 USER node
 EXPOSE 8000

package/tests/diagnose.test.js

@@ -104,7 +104,7 @@ describe('Command: diagnose', () => {
         try {
             const result = await runDiagnose({
                 cluster: 'test-cluster',
-                region: 'us-east-1',
+                region: 'us-east-2',
                 logGroup: '/ecs/test'
             });
 
@@ -132,7 +132,7 @@ describe('Command: diagnose', () => {
         });
 
         try {
-            const result = await runDiagnose({ cluster: 'test-cluster', region: 'us-east-1' });
+            const result = await runDiagnose({ cluster: 'test-cluster', region: 'us-east-2' });
             expect(result.healthy).toBe(true);
             expect(mockLogsSend).not.toHaveBeenCalled();
             expect(output.join('\n')).toMatch(/healthy|No stopped tasks/i);

package/tests/secrets.test.js

@@ -90,4 +90,33 @@ describe('Secrets Push Command', () => {
         exitSpy.mockRestore();
         consoleSpy.mockRestore();
     });
+
+    it('gracefully falls back to .env when envFilePath is undefined or omitted', async () => {
+        // Create default .env file
+        await fs.writeFile('.env', 'DATABASE_URL=postgres://localhost:5432/db');
+        await fs.writeFile(path.join('terraform', 'main.tf'), 'region = "us-east-1"');
+
+        // Call pushSecrets with undefined/omitted argument
+        await pushSecrets(undefined, 'my-project');
+
+        // Verify it resolved .env properly and sent secrets
+        expect(MockUpdateSecretCommand).toHaveBeenCalledWith({
+            SecretId: 'my-project-secrets',
+            SecretString: JSON.stringify({ DATABASE_URL: 'postgres://localhost:5432/db' })
+        });
+    });
+
+    it('gracefully falls back to .env when envFilePath is passed as an object or invalid type', async () => {
+        // Simulates Commander passing an options object as the first parameter
+        await fs.writeFile('.env', 'STRIPE_KEY=sk_test_12345');
+        await fs.writeFile(path.join('terraform', 'main.tf'), 'region = "us-east-1"');
+
+        // Call pushSecrets with an object
+        await pushSecrets({}, 'my-project');
+
+        expect(MockUpdateSecretCommand).toHaveBeenCalledWith({
+            SecretId: 'my-project-secrets',
+            SecretString: JSON.stringify({ STRIPE_KEY: 'sk_test_12345' })
+        });
+    });
 });

package/docs/frameworks.md

@@ -1,34 +0,0 @@
-# 🧩 Framework Support & Quirks
-
-`deploy-stack` is designed to be as "zero-config" as possible. However, because different frameworks have unique internal architectures (especially around network binding and build outputs), a few frameworks require minor application-level tweaks to run securely in a Dockerized AWS Fargate environment.
-
-## The 3-Tier Support Philosophy
-
-We handle framework requirements using a 3-tier strategy so you are never left guessing why a deployment failed:
-
-1. **Zero-Touch Plugins (Tier 1):** If you use one of our ecosystem plugins (e.g., `nest add nest-deploy-stack` or `cookiecutter-django-deploy-stack`), your code is automatically patched and configured. Zero manual intervention required.
-2. **Intelligent CLI Pre-flight (Tier 2):** If you run the standalone `deploy-stack` CLI against a raw repository, the CLI statically analyzes your code. If it detects a missing production requirement (like a localhost binding), it will flag it inline in your terminal with the exact copy-paste fix.
-3. **In-Repo Docs (Tier 3):** The generated `DEPLOYMENT.md` file always contains a framework-specific checklist before you push to CI/CD.
-
----
-
-## 🛠️ Framework Requirements Cheat Sheet
-
-| Framework | What `deploy-stack` Automates | Application Code Requirement | Zero-Click Starter / Plugin |
-|---|---|---|---|
-| **Next.js** | Multi-stage Dockerfile, CloudFront edge routing, `vercel.json` parsing | `output: 'standalone'` must be set in `next.config.js` | Built-in CLI detection |
-| **NestJS** | Multi-stage TypeScript build (`dist/`), unprivileged Node runtime | `await app.listen(port, '0.0.0.0')` in `src/main.ts` | `nest-deploy-stack` (`nest add`) |
-| **FastAPI** | Alpine Python container, Uvicorn CLI args, unprivileged port mapping | None (0.0.0.0 set via Docker CMD) | `cookiecutter-fastapi-deploy-stack` |
-| **Django** | Gunicorn WSGI adapter, Celery worker topologies, RDS bindings | None (0.0.0.0 set via Docker CMD) | `cookiecutter-django-deploy-stack` |
-| **Ruby on Rails** | Puma adapter, `.auto.tfvars` Master Key injection, Kamal Dockerfile replaced with 0-CVE Alpine build | None (0.0.0.0 set via Docker CMD) | `rails-template-deploy-stack` |
-| **Nuxt 3** | Nitro-optimized Node output | None (`NITRO_HOST=0.0.0.0` injected automatically) | `nuxt-deploy-stack` |
-| **SvelteKit** | Node adapter conversion | None (`HOST=0.0.0.0` injected automatically) | `svelte-adapter-deploy-stack` |
-| **Static Sites** *(Vite, Astro, React)* | Output folder detection (`dist/`, `build/`), Nginx routing | None | `vite-plugin-deploy-stack` |
-
-## ⚠️ The Golden Rule: 0.0.0.0 vs Localhost
-
-The most common reason a newly deployed container fails its ALB health check is network binding. 
-
-In local development, frameworks bind to `localhost` (or `127.0.0.1`) for security. However, inside a Docker container on AWS ECS, binding to `localhost` means the web server only listens to internal container traffic. The AWS Application Load Balancer (ALB) trying to route traffic from the outside world will hit a closed port, resulting in a `502 Bad Gateway` or `503 Service Temporarily Unavailable`.
-
-**Always ensure your application explicitly binds to `0.0.0.0`.**