deploy-stack 0.3.3 → 0.5.0

package/README.md

@@ -4,7 +4,7 @@
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 
-![deploy-stack CLI demonstration](./docs/demo.gif)
+<!-- ![deploy-stack CLI demonstration](./docs/demo.gif) -->
 
 ---
 
@@ -25,13 +25,16 @@ You retain complete ownership of your infrastructure code without relying on bla
 ## ✨ Features
 
 * **Zero Vendor Lock-In:** Generates standard, clean `.tf` files. Modify, expand, or decouple them at any time.
-* **Framework Agnostic:** Tailored container presets for Next.js (standalone), Express.js, FastAPI, and custom Docker setups.
+* **Framework Agnostic:** Tailored container presets for Next.js, Express.js, FastAPI, and **Zero-Config Static Sites** (React, Vue, SvelteKit, Astro, Vite).
+* **Smart Git Integration:** Automatically detects your working branch (`main`, `master`, `develop`) and binds it directly to the generated GitHub Actions pipeline.
 * **Production-Grade Defaults:** Automatically provisions an Amazon ECS Fargate cluster fronted by an Application Load Balancer across multiple availability zones.
 * **Global Edge Acceleration:** Includes an integrated AWS CloudFront CDN distribution with SSL termination and optimized caching.
 * **Keyless, Zero-Secret CI/CD:** Uses AWS IAM OpenID Connect (OIDC) for automated GitHub Actions deployments—no long-lived AWS keys stored in GitHub Secrets.
 * **Remote State with Native S3 Locking:** Automatically creates an encrypted S3 state bucket utilizing modern native S3 concurrency locking.
 * **Built-in Secrets Sync:** Provides a dedicated CLI workflow to securely push local `.env` variables into AWS Secrets Manager and map them directly into containers at runtime.
 * **Non-Destructive:** Safely analyzes existing directories and prompts for confirmation before updating any files.
+* **Zero-Config Detection:** Automatically resolves output directories for Vite, Astro, SvelteKit, CRA, and more.
+* **Safe Teardown:** Completely remove all generated AWS resources and empty S3 state buckets with a single `destroy` command.
 
 ---
 
@@ -46,7 +49,7 @@ npx deploy-stack
 The interactive CLI will guide you through the setup:
 1. **Target Directory / Name:** (Type `.` to bootstrap your current directory)
 2. **Setup Mode:** (Choose **Quickstart** for sensible defaults, or **Advanced** for custom scaling and branch names)
-3. **Zero-Config Detection:** The CLI automatically scans your `package.json` or `requirements.txt` to detect your framework (Next.js, Express, FastAPI, etc.) and dynamically configures your container port.
+3. **Zero-Config Detection:** The CLI automatically scans your project to detect your framework. For static sites, it intelligently discovers your build output directory (`dist`, `build`, `.output`, etc.) and dynamically configures the hardened Nginx container.
 4. **AWS Region & Compute Tier:** (Select your target region and Fargate size with live cost estimates)
 
 ---
@@ -80,6 +83,12 @@ npx deploy-stack secrets push .env.production
 
 ---
 
+## 🗑️ Infrastructure Teardown
+To safely completely remove your ECS cluster, load balancers, and empty the remote S3 state bucket, run:
+`npx deploy-stack destroy`
+
+---
+
 ## 📁 Generated File Structure
 
 Running the CLI generates a modular architecture tailored to your service:
@@ -104,8 +113,13 @@ your-project/
 
 ## 📦 Reference Implementations
 
-* **[Next.js Fullstack Reference App](https://github.com/anton-codes-iac/deploy-stack-nextjs-example):** A complete Next.js deployment showcasing the generated Terraform, CloudFront setup, and automated OIDC workflow.
-
+* **[Next.js Fullstack App](https://github.com/anton-codes-iac/deploy-stack-nextjs-example):** A complete Next.js deployment showcasing the generated Terraform, CloudFront setup, and automated OIDC workflow.
+* **[Express.js API](https://github.com/anton-codes-iac/deploy-stack-express-example):** A standard Node.js backend setup.
+* **[Python FastAPI](https://github.com/anton-codes-iac/deploy-stack-fastapi-example):** A Python API demonstrating unprivileged port mapping.
+* **[Vite / React SPA](https://github.com/anton-codes-iac/deploy-stack-vite-example):** Demonstrates SPA routing and `dist/` auto-detection.
+* **[Create React App](https://github.com/anton-codes-iac/deploy-stack-cra-example):** Validates backward compatibility with legacy Webpack pipelines and `build/` auto-detection.
+* **[Astro Static Site](https://github.com/anton-codes-iac/deploy-stack-astro-example):** Demonstrates modern static site generation (SSG).
+* **[SvelteKit Application](https://github.com/anton-codes-iac/deploy-stack-svelte-example):** Demonstrates static adapter integration and custom output folder detection.
 ---
 
 ## 🛡️ Telemetry & Privacy

package/bin/cli.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 import path from 'path';
+import { mainStack } from '../src/commands/init.js';
+import { destroyStack } from '../src/commands/destroy.js';
 import { runDoctor } from '../src/commands/doctor.js';
 import { pushSecrets } from '../src/commands/secrets.js';
-import { mainStack } from '../src/commands/init.js';
 
 // 1. Extract the telemetry flag and set the environment variable
 const rawArgs = process.argv.slice(2);
@@ -22,6 +23,8 @@ if (args[0] === 'secrets' && args[1] === 'push') {
     pushSecrets(envFile, projectName).catch(console.error);
 } else if (args[0] === 'doctor') {
     runDoctor().catch(console.error);
+} else if (args[0] === 'destroy') {
+    destroyStack().catch(console.error);
 } else {
     mainStack().catch(console.error);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "deploy-stack",
-  "version": "0.3.3",
+  "version": "0.5.0",
   "description": "Provision production-ready AWS infrastructure and CI/CD pipelines in seconds.",
   "type": "module",
   "bin": {

package/src/commands/destroy.js

@@ -0,0 +1,77 @@
+import fsSync from 'fs';
+import path from 'path';
+import { intro, outro, confirm, spinner, cancel } from '@clack/prompts';
+import color from 'picocolors';
+import { execSync } from 'child_process';
+import { teardownStateBucket } from '../utils/aws.js';
+import { checkDependency } from '../utils/system.js';
+import { trackEvent, flushTelemetry } from '../core/telemetry.js';
+
+export async function destroyStack() {
+    intro(color.bgRed(color.white(' deploy-stack destroy 🗑️  ')));
+
+    const tfDirPath = path.join(process.cwd(), 'terraform');
+    const backendFilePath = path.join(tfDirPath, 'backend.tf');
+
+    if (!fsSync.existsSync(backendFilePath)) {
+        console.error(color.red('✖ No terraform/backend.tf found in the current directory.'));
+        console.log(color.yellow('Are you in the root of a deploy-stack project?'));
+        process.exit(1);
+    }
+
+    const hasTerraform = await checkDependency('terraform');
+    if (!hasTerraform) {
+        console.error(color.red('✖ Terraform is not installed.'));
+        process.exit(1);
+    }
+
+    const proceed = await confirm({
+        message: color.red('⚠️  WARNING: This will permanently destroy all AWS resources associated with this project. Are you absolutely sure?'),
+        initialValue: false,
+    });
+
+    if (!proceed) {
+        cancel('Destruction cancelled. Your infrastructure is safe.');
+        process.exit(0);
+    }
+
+    const s = spinner();
+
+    // 1. Extract Bucket and Region from backend.tf
+    const backendContent = fsSync.readFileSync(backendFilePath, 'utf-8');
+    const bucketMatch = backendContent.match(/bucket\s*=\s*"([^"]+)"/);
+    const regionMatch = backendContent.match(/region\s*=\s*"([^"]+)"/);
+
+    const bucketName = bucketMatch ? bucketMatch[1] : null;
+    const region = regionMatch ? regionMatch[1] : 'us-east-1';
+
+    // 2. Execute Terraform Destroy
+    console.log(color.cyan('\nInitiating Terraform destroy (this may take a few minutes)...\n'));
+    try {
+        execSync('terraform destroy -auto-approve', { cwd: tfDirPath, stdio: 'inherit' });
+    } catch (error) {
+        console.error(color.red('\n✖ Terraform destroy failed. Please check the output above.'));
+        process.exit(1);
+    }
+
+    // 3. Clean up the S3 State Bucket
+    if (bucketName) {
+        s.start(`Emptying and deleting S3 state bucket: ${bucketName}...`);
+        try {
+            await teardownStateBucket(region, bucketName);
+            s.stop(`S3 bucket ${bucketName} successfully deleted.`);
+        } catch (error) {
+            s.stop(`❌ Failed to delete S3 bucket. You may need to delete it manually in the AWS Console.`);
+            console.error(color.red(`AWS Error: ${error.message}`));
+        }
+    }
+
+    trackEvent('project_destroyed', {
+        region,
+        bucket: bucketName,
+        success: true
+    });
+    await flushTelemetry();
+
+    outro(color.green('✅ Infrastructure successfully destroyed. Your AWS bill is safe.'));
+}

package/src/commands/init.js

@@ -3,6 +3,7 @@ import fs from 'fs/promises';
 import path from 'path';
 import { intro, outro, group, text, select, spinner, cancel, confirm, log } from '@clack/prompts';
 import color from 'picocolors';
+import { execSync } from 'child_process';
 
 import { checkDependency } from '../utils/system.js';
 import { detectFramework } from '../utils/detector.js';
@@ -88,6 +89,14 @@ export async function mainStack() {
     if (finalFramework === 'static') defaultPort = '8080';
     if (finalFramework === 'python') defaultPort = '8000';
 
+    // 2.8 Check current Git branch
+    let currentGitBranch = 'main';
+    try {
+        currentGitBranch = execSync('git symbolic-ref --short HEAD', { cwd: targetDir, stdio: 'pipe' }).toString().trim();
+    } catch (e) {
+        // Not a git repo yet, fallback to 'main'
+    }
+
     // 3. Prompt Configuration Group
     const project = await group(
         {
@@ -140,8 +149,8 @@ export async function mainStack() {
                 if (setupType === 'quick') return undefined;
                 return text({
                     message: 'Primary Git deployment branch for CI/CD:',
-                    placeholder: 'main',
-                    defaultValue: 'main',
+                    placeholder: currentGitBranch,
+                    defaultValue: currentGitBranch,
                 });
             },
         },
@@ -162,7 +171,9 @@ export async function mainStack() {
 
     const healthCheckPath = project.healthCheckPath || '/';
     const desiredCount = project.desiredCount || '1';
-    const deployBranch = project.branch || 'main';
+    const deployBranch = project.branch || currentGitBranch;
+
+    const buildDir = detectedFramework?.buildDir || 'dist';
 
     // 5. Check for existing files that might be overwritten
     const dockerfilePath = path.join(targetDir, 'Dockerfile');
@@ -213,6 +224,7 @@ export async function mainStack() {
         HEALTH_CHECK_PATH: healthCheckPath,
         DESIRED_COUNT: desiredCount,
         DEPLOY_BRANCH: deployBranch,
+        BUILD_DIR: buildDir,
         finalFramework: finalFramework
     });
 
@@ -220,6 +232,7 @@ export async function mainStack() {
     trackEvent('project_provisioned', {
         projectName: actualProjectName,
         framework: finalFramework,
+        specific_framework: detectedFramework?.name || finalFramework,
         region: project.region,
         size: project.size,
         setup_mode: setupType,
@@ -230,7 +243,10 @@ export async function mainStack() {
     s.stop('Infrastructure provisioned successfully!');
 
     // 9. Provide the Outro, Framework Warnings and Next Steps
-    const frameworkWarnings = getFrameworkWarning(finalFramework);
+    let frameworkWarnings = '';
+    if (!(finalFramework === 'static' && detectedFramework?.buildDir)) {
+        frameworkWarnings = getFrameworkWarning(finalFramework);
+    }
 
     const isGitInitialized = fsSync.existsSync(path.join(targetDir, '.git'));
 
@@ -240,7 +256,7 @@ export async function mainStack() {
 
     const gitInstructions = isGitInitialized
         ? `git add .\n       git commit -m "chore: add AWS infrastructure and CI/CD"\n       git push`
-        : `git init\n       git add .\n       git commit -m "chore: add AWS infrastructure and CI/CD"\n       git branch -M main\n       git remote add origin https://github.com/your-username/your-repo.git\n       git push -u origin main`;
+        : `git init\n       git add .\n       git commit -m "chore: add AWS infrastructure and CI/CD"\n       git branch -M ${deployBranch}\n       git remote add origin https://github.com/your-username/your-repo.git\n       git push -u origin ${deployBranch}`;
 
     outro(`
     ${color.green('✅ Project provisioned successfully!')}

package/src/utils/aws.js

@@ -1,5 +1,6 @@
 import { STSClient, GetCallerIdentityCommand } from '@aws-sdk/client-sts';
-import { S3Client, CreateBucketCommand, PutBucketVersioningCommand } from '@aws-sdk/client-s3';
+import { S3Client, CreateBucketCommand, PutBucketVersioningCommand, PutBucketTaggingCommand } from '@aws-sdk/client-s3';
+import { DeleteBucketCommand, ListObjectVersionsCommand, DeleteObjectsCommand } from "@aws-sdk/client-s3";
 
 export async function provisionStateBucket(region, projectName) {
     const stsClient = new STSClient({ region });
@@ -23,6 +24,15 @@ export async function provisionStateBucket(region, projectName) {
             CreateBucketConfiguration: region === 'us-east-1' ? undefined : { LocationConstraint: region }
         }));
 
+        await s3Client.send(new PutBucketTaggingCommand({
+            Bucket: stateBucketName,
+            Tagging: {
+                TagSet: [
+                    { Key: "ManagedBy", Value: "deploy-stack" }
+                ]
+            }
+        }));
+
         await s3Client.send(new PutBucketVersioningCommand({
             Bucket: stateBucketName,
             VersioningConfiguration: { Status: 'Enabled' }
@@ -35,4 +45,36 @@ export async function provisionStateBucket(region, projectName) {
     }
 
     return { awsAccountId, stateBucketName };
+}
+
+export async function teardownStateBucket(region, bucketName) {
+    const client = new S3Client({ region });
+
+    try {
+        // 1. Fetch all object versions and delete markers
+        const listCommand = new ListObjectVersionsCommand({ Bucket: bucketName });
+        const { Versions, DeleteMarkers } = await client.send(listCommand);
+
+        const objectsToDelete = [];
+        if (Versions) objectsToDelete.push(...Versions.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+        if (DeleteMarkers) objectsToDelete.push(...DeleteMarkers.map(v => ({ Key: v.Key, VersionId: v.VersionId })));
+
+        // 2. Delete all contents if any exist
+        if (objectsToDelete.length > 0) {
+            const deleteCommand = new DeleteObjectsCommand({
+                Bucket: bucketName,
+                Delete: { Objects: objectsToDelete }
+            });
+            await client.send(deleteCommand);
+        }
+
+        // 3. Delete the now-empty bucket
+        const deleteBucketCommand = new DeleteBucketCommand({ Bucket: bucketName });
+        await client.send(deleteBucketCommand);
+
+        return true;
+    } catch (error) {
+        if (error.name === 'NoSuchBucket') return true; // Already deleted
+        throw error;
+    }
 }

package/src/utils/detector.js

@@ -12,9 +12,19 @@ export function detectFramework(targetDir) {
             // Merge dependencies and devDependencies to check both
             const deps = { ...(pkg.dependencies || {}), ...(pkg.devDependencies || {}) };
 
+            // Next.js & Express
             if (deps['next']) return { id: 'nextjs', name: 'Next.js' };
-            if (deps['vite'] || deps['astro'] || deps['@sveltejs/kit'] || deps['gatsby'] || deps['react-scripts'] || deps['@vue/cli-service']) return { id: 'static', name: 'Static Site (Vite, Astro, React)' };
             if (deps['express']) return { id: 'node', name: 'Node.js / Express' };
+
+            // Static Site Generators & SPAs (with precise build directories)
+            if (deps['@sveltejs/kit']) return { id: 'static', name: 'SvelteKit', buildDir: 'build' };
+            if (deps['react-scripts']) return { id: 'static', name: 'Create React App', buildDir: 'build' };
+            if (deps['gatsby']) return { id: 'static', name: 'Gatsby', buildDir: 'public' };
+            if (deps['nuxt']) return { id: 'static', name: 'Nuxt', buildDir: '.output/public' };
+            if (deps['astro']) return { id: 'static', name: 'Astro', buildDir: 'dist' };
+            if (deps['vite']) return { id: 'static', name: 'Vite', buildDir: 'dist' };
+            if (deps['@vue/cli-service']) return { id: 'static', name: 'Vue.js', buildDir: 'dist' };
+            if (deps['@angular/cli']) return { id: 'static', name: 'Angular', buildDir: 'dist' };
         } catch (e) {
             // Silently fail if package.json is malformed
         }

package/src/utils/generator.js

@@ -103,6 +103,8 @@ env/
 node_modules/
 dist/
 build/
+out/
+.output/
 .cache/
 public/
 `;

package/src/utils/warnings.js

@@ -25,10 +25,9 @@ export function getFrameworkWarning(frameworkId) {
             return (
                 color.bgYellow(color.black(' ⚠️  IMPORTANT: STATIC SITE SETUP REQUIRED ')) +
                 color.yellow('\n    1. Open your generated Dockerfile.') +
-                color.yellow('\n    2. Ensure the "COPY --from=builder" command matches your framework:') +
-                color.yellow('\n       Vite / Astro:   COPY --from=builder /app/dist /usr/share/nginx/html') +
-                color.yellow('\n       Create React App: COPY --from=builder /app/build /usr/share/nginx/html') +
-                color.yellow('\n    3. Ensure your package.json has a "build" script (e.g., "vite build").\n\n')
+                color.yellow('\n    2. We defaulted your output folder to /app/dist.') +
+                color.yellow('\n    3. If your framework uses a different folder (like build/ or out/), change it in the COPY command.') +
+                color.yellow('\n    4. Ensure your package.json has a "build" script (e.g., "vite build").\n\n')
             );
         default:
             return '';

package/templates/README.md

@@ -29,7 +29,7 @@ This infrastructure provisions a highly available Application Load Balancer (ALB
    ```
 
 3. **Automated CI/CD (Keyless via OIDC):**
-   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `main` will automatically build, package, and deploy your application.
+   Push this repository to GitHub. Your deployment pipeline uses AWS IAM OpenID Connect (OIDC) to authenticate securely with temporary credentials—**no long-lived AWS secret keys are required in GitHub Secrets**. Every push to `{{DEPLOY_BRANCH}}` will automatically build, package, and deploy your application.
 
 ### ⚠️ Troubleshooting: OIDC Provider Already Exists
 AWS only permits one GitHub Actions OIDC provider per AWS account. If `terraform apply` fails with an `EntityAlreadyExists` error regarding the OIDC provider, it indicates GitHub Actions was previously configured in this account.
@@ -48,13 +48,11 @@ Re-run `terraform apply` to link directly to your existing provider.
 
 If you are done testing and want to stop all AWS billing, you must destroy the infrastructure. 
 
-Because our Terraform configuration is set to force-delete the ECR image repository (even if images are present), teardown is a single, clean command:
-
+Run the automated teardown command from the root of your project:
 ```bash
-cd terraform
-terraform destroy
+npx deploy-stack destroy
 ```
-*Type `yes` when prompted. This will permanently delete the Load Balancer, ECS cluster, log groups, and associated networking components.*
+*Type `yes` when prompted. This will execute a safe Terraform teardown of your Load Balancer, ECS cluster, and networking components, followed by automatically emptying and deleting your remote S3 state bucket.*
 
 ## ⚠️ Critical Application Prerequisites
 
@@ -94,8 +92,8 @@ Make sure your app is configured correctly:
 * **Express.js:** `app.listen(port, '0.0.0.0', () => ...)`
 * **FastAPI:** `uvicorn.run(app, host="0.0.0.0", port=8000)`
 
-### 4. Static Sites (Vite, Astro, React, Vue)
+### 4. Static Sites (Vite, Astro, React, Vue, SvelteKit)
 
 If you are deploying a static site, your application is served via a highly optimized, unprivileged Nginx container. 
-1. **Build Folder:** Different frameworks output compiled assets to different folders. Open your `Dockerfile` and ensure the `COPY --from=builder` command points to the correct folder (`dist`, `build`, or `out`).
-2. **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.
+* **Zero-Config Build:** The CLI automatically detected your framework's output folder (`dist`, `build`, etc.) and pre-configured your Dockerfile. 
+* **Health Checks:** You do not need to configure a custom `/health` route. Nginx will automatically return a `200 OK` when AWS pings the root `/` index page.

package/templates/docker/static.Dockerfile

@@ -13,9 +13,8 @@ RUN npm run build
 # STAGE 2: Serve with Hardened Nginx
 FROM nginx:alpine
 
-# ⚠️ CRITICAL: Adjust 'dist' to match your framework's output folder!
-# Vite/Astro = dist | Create React App/Gatsby = build | Next.js Static = out
-COPY --from=builder /app/dist /usr/share/nginx/html
+# Adjusts BUILD_DIR to match your framework's output folder
+COPY --from=builder /app/{{BUILD_DIR}} /usr/share/nginx/html
 
 # Inject custom Nginx configuration for unprivileged ports and SPA routing
 RUN echo "server {" > /etc/nginx/conf.d/default.conf && \