rastack 0.0.33 → 0.0.35

package/src/rastack-ci.ts

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+
+/**
+ * `rastack ci` — run the CI pipeline for a phase, so GitHub Actions stays a
+ * one-liner.
+ *
+ *   rastack ci <check|build|deploy> [--plan] [--skip-build]
+ *              [--function <name>] [--jwks-url <url>] [--bin <cmd>]
+ *
+ *   check    validate the resource graph + compile the manifest (a CI gate)
+ *   build    cross-build the Lambda bundle and bake the Cognito JWKS in
+ *   deploy   build (unless --skip-build) then `update-function-code`
+ *
+ * The steps are a pure function of `.rastack/deploy.json` (see
+ * tools/src/deploy/ci.ts); `--plan` prints them without running anything.
+ * Function name / JWKS URL come from the config's stack outputs when wired, else
+ * are resolved live from CloudFormation at run time.
+ */
+
+import { execSync } from "child_process";
+import { CiPhase, CiPlanOptions, CiStep, ciPlan } from "./deploy/ci";
+import { loadConfig } from "./deploy/io";
+
+const PHASES: CiPhase[] = ["check", "build", "deploy"];
+
+interface Flags {
+  phase: CiPhase;
+  plan: boolean;
+  opts: CiPlanOptions;
+}
+
+function parseFlags(argv: string[]): Flags {
+  let phase: CiPhase | "" = "";
+  let plan = false;
+  const opts: CiPlanOptions = {
+    bin: process.env.RASTACK_BIN || "rastack",
+    functionName: process.env.RASTACK_FUNCTION || undefined,
+    jwksUrl: process.env.RASTACK_JWKS_URL || undefined,
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i] ?? "";
+    switch (a) {
+      case "--plan":
+      case "--dry-run":
+        plan = true;
+        break;
+      case "--skip-build":
+        opts.skipBuild = true;
+        break;
+      case "--function":
+        opts.functionName = next();
+        break;
+      case "--jwks-url":
+        opts.jwksUrl = next();
+        break;
+      case "--bin":
+        opts.bin = next();
+        break;
+      default:
+        if (a.startsWith("-")) {
+          console.error(`Unknown flag: ${a}`);
+          process.exit(1);
+        } else if (!phase && PHASES.includes(a as CiPhase)) {
+          phase = a as CiPhase;
+        } else if (!phase) {
+          console.error(
+            `Unknown ci phase: "${a}" (expected ${PHASES.join(" | ")}).`,
+          );
+          process.exit(1);
+        }
+    }
+  }
+  if (!phase) {
+    console.error(
+      `Usage: rastack ci <${PHASES.join(" | ")}> [--plan] [--skip-build]\n`,
+    );
+    process.exit(1);
+  }
+  return { phase, plan, opts };
+}
+
+function printPlan(phase: CiPhase, steps: CiStep[]): void {
+  console.log(`\n  rastack ci ${phase} — ${steps.length} step(s):\n`);
+  steps.forEach((s, i) => {
+    const at = s.cwd ? ` (in ${s.cwd}/)` : "";
+    console.log(`  ${i + 1}. ${s.name}${at}`);
+    console.log(`     $ ${s.run}\n`);
+  });
+}
+
+function runSteps(phase: CiPhase, steps: CiStep[]): void {
+  for (const step of steps) {
+    console.log(`\n▸ ${step.name}${step.cwd ? ` (in ${step.cwd}/)` : ""}`);
+    console.log(`  $ ${step.run}`);
+    try {
+      // Runs a CI pipeline step derived from the developer's own deploy config
+      // — no untrusted input. A shell is required for the `$(aws …)` output
+      // substitutions the plan uses to resolve stack outputs at run time.
+      // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+      execSync(step.run, {
+        stdio: "inherit",
+        cwd: step.cwd,
+        env: process.env,
+      });
+    } catch {
+      console.error(`\n  ✗ step failed: ${step.name}`);
+      process.exit(1);
+    }
+  }
+  console.log(`\n  ✓ rastack ci ${phase} complete.`);
+}
+
+function main(argv: string[]): void {
+  const { phase, plan, opts } = parseFlags(argv);
+  const cfg = loadConfig();
+  if (!cfg) {
+    console.error(
+      "  ✗ no .rastack/deploy.json found. Run `rastack init` (or `rastack deploy`) first.",
+    );
+    process.exit(1);
+    return;
+  }
+  const steps = ciPlan(phase, cfg, opts);
+  if (plan) printPlan(phase, steps);
+  else runSteps(phase, steps);
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2));
+}

package/src/rastack-deploy.ts

@@ -0,0 +1,257 @@
+#!/usr/bin/env node
+
+/**
+ * `rastack deploy` — configure a repo's serverless deployment.
+ *
+ *   rastack deploy [--app <slug>] [--region <r>] [--owner <o>] [--repo <r>]
+ *                  [--branch <b>] [--namespace <n>] [--templates-bucket <b>]
+ *                  [--artifacts-bucket <b>] [--arch arm64|x86_64]
+ *                  [--print] [--run] [--yes]
+ *
+ * Writes/updates `.rastack/deploy.json` (creating it if `rastack init` has not
+ * run) and prints exactly how to stand the app up: the one-time
+ * `aws cloudformation deploy` that creates all infrastructure, the GitHub repo
+ * Variables CI reads, and the Lambda's runtime env. Infra is created once by a
+ * human — this command *configures* that step, it does not silently mutate the
+ * cloud. `--run` executes the launch command for you; `--print` is
+ * non-interactive (config as-is).
+ *
+ * The recurring code deploy is CI's job (`rastack ci deploy`), not this command.
+ */
+
+import { execFileSync } from "child_process";
+import {
+  DeployConfig,
+  PartialDeployConfig,
+  deployStackCommand,
+  lambdaEnv,
+  mergeConfig,
+  normalizeConfig,
+  repoVariables,
+  stackParameters,
+  templateUrl,
+  validateConfig,
+} from "./deploy/config";
+import {
+  ask,
+  canPrompt,
+  loadConfig,
+  saveConfig,
+  withPrompt,
+} from "./deploy/io";
+
+interface Flags {
+  patch: PartialDeployConfig;
+  print: boolean;
+  run: boolean;
+  nonInteractive: boolean;
+}
+
+function parseFlags(argv: string[]): Flags {
+  const patch: PartialDeployConfig = { github: {}, lambda: {} };
+  let print = false;
+  let run = false;
+  let nonInteractive = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i] ?? "";
+    switch (a) {
+      case "--app":
+        patch.app = next();
+        break;
+      case "--region":
+        patch.region = next();
+        break;
+      case "--owner":
+        patch.github!.owner = next();
+        break;
+      case "--repo":
+        patch.github!.repo = next();
+        break;
+      case "--branch":
+        patch.github!.branch = next();
+        break;
+      case "--prefix":
+        patch.namePrefix = next();
+        break;
+      case "--namespace":
+        patch.namespace = next();
+        break;
+      case "--stack-name":
+        patch.stackName = next();
+        break;
+      case "--templates-bucket":
+        patch.templatesBucket = next();
+        break;
+      case "--artifacts-bucket":
+        patch.artifactsBucket = next();
+        break;
+      case "--arch":
+        patch.lambda!.arch = next() as DeployConfig["lambda"]["arch"];
+        break;
+      case "--print":
+        print = true;
+        nonInteractive = true;
+        break;
+      case "--run":
+        run = true;
+        break;
+      case "--yes":
+      case "-y":
+      case "--non-interactive":
+        nonInteractive = true;
+        break;
+      default:
+        if (a.startsWith("-")) {
+          console.error(`Unknown flag: ${a}`);
+          process.exit(1);
+        }
+    }
+  }
+  return { patch, print, run, nonInteractive };
+}
+
+function seedConfig(patch: PartialDeployConfig): DeployConfig {
+  const existing = loadConfig();
+  return existing ? mergeConfig(existing, patch) : normalizeConfig(patch);
+}
+
+async function promptMissing(cfg: DeployConfig): Promise<DeployConfig> {
+  return withPrompt(async (rl) => {
+    const app = await ask(rl, "App slug", cfg.app);
+    const owner = await ask(rl, "GitHub owner", cfg.github.owner);
+    const repo = await ask(rl, "GitHub repo", cfg.github.repo);
+    const branch = await ask(rl, "Deploy branch", cfg.github.branch);
+    const region = await ask(rl, "AWS region", cfg.region);
+    const namespace = await ask(rl, "Iceberg namespace", cfg.namespace);
+    const artifactsBucket = await ask(
+      rl,
+      "Artifacts bucket (from bootstrap stack)",
+      cfg.artifactsBucket ?? "",
+    );
+    const templatesBucket = await ask(
+      rl,
+      "Templates bucket (from bootstrap stack, optional)",
+      cfg.templatesBucket ?? "",
+    );
+    return mergeConfig(cfg, {
+      app,
+      region,
+      namespace,
+      artifactsBucket,
+      templatesBucket,
+      github: { owner, repo, branch },
+    });
+  });
+}
+
+/** Pad a list of `Key=Value` rows into an aligned table. */
+function table(rows: { key: string; value: string }[]): string {
+  const width = Math.max(0, ...rows.map((r) => r.key.length));
+  return rows.map((r) => `    ${r.key.padEnd(width)}  ${r.value}`).join("\n");
+}
+
+function printSummary(cfg: DeployConfig): void {
+  const src = templateUrl(cfg);
+  console.log(`\n  Deployment config (${cfg.stackName} @ ${cfg.region})\n`);
+  console.log("  ── 1. Create the infrastructure (once, by a human) ──");
+  if (!cfg.artifactsBucket) {
+    console.log(
+      "    ⚠ artifactsBucket is unset — app.yaml requires it. Run the bootstrap\n" +
+        "      stack first, then set --artifacts-bucket (its ArtifactsBucketName output).",
+    );
+  }
+  if (!src) {
+    console.log(
+      "    (launching from the in-repo template; set --templates-bucket to launch\n" +
+        "     the hosted app.yaml by URL instead)",
+    );
+  }
+  console.log("\n" + deployStackCommand(cfg) + "\n");
+
+  console.log(
+    "  ── 2. Wire the GitHub repo Variables (from the stack Outputs) ──",
+  );
+  console.log(
+    table(
+      repoVariables(cfg).map((v) => ({
+        key: v.name,
+        value: v.value || `<${v.from}>`,
+      })),
+    ),
+  );
+
+  console.log("\n  ── 3. The Lambda runtime env (set by the stack) ──");
+  console.log(table(lambdaEnv(cfg)));
+
+  console.log(
+    `\n  ── 4. Then every push to ${cfg.github.branch} runs \`rastack ci deploy\`. ──\n`,
+  );
+}
+
+function runLaunch(cfg: DeployConfig): void {
+  const params = stackParameters(cfg).map((p) => `${p.key}=${p.value}`);
+  const src = templateUrl(cfg);
+  const args = [
+    "cloudformation",
+    "deploy",
+    ...(src
+      ? ["--template-url", src]
+      : ["--template-file", "deploy/cloudformation/app.yaml"]),
+    "--stack-name",
+    cfg.stackName,
+    "--capabilities",
+    "CAPABILITY_NAMED_IAM",
+    "--region",
+    cfg.region,
+    "--parameter-overrides",
+    ...params,
+  ];
+  console.log(`\n  ▸ aws ${args.join(" ")}\n`);
+  try {
+    // Runs the developer's own AWS CLI with args built from their config — no
+    // untrusted input, and `execFileSync` (no shell) avoids any injection.
+    execFileSync("aws", args, { stdio: "inherit" });
+  } catch (err) {
+    console.error(
+      `\n  ✗ aws cloudformation deploy failed. Is the AWS CLI installed and are` +
+        ` your credentials configured?\n    ${(err as Error).message}`,
+    );
+    process.exit(1);
+  }
+}
+
+async function main(argv: string[]): Promise<void> {
+  const flags = parseFlags(argv);
+  let cfg = seedConfig(flags.patch);
+
+  if (canPrompt(flags.nonInteractive)) {
+    console.log("\n  rastack deploy — configure the serverless deployment\n");
+    cfg = await promptMissing(cfg);
+  }
+
+  const errors = validateConfig(cfg);
+  if (errors.length) {
+    for (const e of errors) console.error(`  ✗ ${e}`);
+    console.error(
+      `\n  ${errors.length} problem(s) — fix the config and re-run.`,
+    );
+    process.exit(1);
+  }
+
+  if (!flags.print) {
+    const file = saveConfig(cfg);
+    console.log(`  ✓ saved ${file}`);
+  }
+
+  printSummary(cfg);
+
+  if (flags.run) runLaunch(cfg);
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).catch((err) => {
+    console.error(`  ✗ ${(err as Error).message}`);
+    process.exit(1);
+  });
+}

package/src/rastack-init.ts

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+
+/**
+ * `rastack init` — template the base GitHub Actions + deploy config into a repo.
+ *
+ *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
+ *                [--region <r>] [--force] [--no-workflows] [--yes]
+ *
+ * Scaffolds a new project (or reconfigures an existing one) so it is ready to
+ * deploy: `.rastack/deploy.json` plus `.github/workflows/{ci,deploy-backend}.yml`,
+ * both of which run `rastack ci`. GitHub coordinates default from the repo's
+ * `origin` remote; missing fields are prompted for on a TTY. Existing files are
+ * left untouched unless `--force`.
+ */
+
+import * as fs from "fs";
+import * as path from "path";
+import {
+  DeployConfig,
+  PartialDeployConfig,
+  mergeConfig,
+  normalizeConfig,
+  parseGitHubRemote,
+  validateConfig,
+} from "./deploy/config";
+import { scaffoldFiles } from "./deploy/workflows";
+import {
+  ask,
+  canPrompt,
+  gitRemoteUrl,
+  loadConfig,
+  withPrompt,
+} from "./deploy/io";
+
+interface Flags {
+  patch: PartialDeployConfig;
+  force: boolean;
+  noWorkflows: boolean;
+  nonInteractive: boolean;
+}
+
+function parseFlags(argv: string[]): Flags {
+  const patch: PartialDeployConfig = { github: {} };
+  let force = false;
+  let noWorkflows = false;
+  let nonInteractive = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i] ?? "";
+    switch (a) {
+      case "--app":
+        patch.app = next();
+        break;
+      case "--owner":
+        patch.github!.owner = next();
+        break;
+      case "--repo":
+        patch.github!.repo = next();
+        break;
+      case "--branch":
+        patch.github!.branch = next();
+        break;
+      case "--region":
+        patch.region = next();
+        break;
+      case "--prefix":
+        patch.namePrefix = next();
+        break;
+      case "--force":
+        force = true;
+        break;
+      case "--no-workflows":
+        noWorkflows = true;
+        break;
+      case "--yes":
+      case "-y":
+      case "--non-interactive":
+        nonInteractive = true;
+        break;
+      default:
+        if (a.startsWith("-")) {
+          console.error(`Unknown flag: ${a}`);
+          process.exit(1);
+        }
+    }
+  }
+  return { patch, force, noWorkflows, nonInteractive };
+}
+
+/** Seed a config: existing file → flags → git remote → defaults. */
+function seedConfig(flags: Flags): DeployConfig {
+  const existing = loadConfig();
+  let cfg = existing
+    ? mergeConfig(existing, flags.patch)
+    : normalizeConfig(flags.patch);
+  // Default the GitHub coordinates from `origin` when not already known.
+  if (!cfg.github.owner || !cfg.github.repo) {
+    const url = gitRemoteUrl();
+    const remote = url ? parseGitHubRemote(url) : null;
+    if (remote) {
+      cfg = mergeConfig(cfg, {
+        github: {
+          owner: cfg.github.owner || remote.owner,
+          repo: cfg.github.repo || remote.repo,
+        },
+      });
+    }
+  }
+  return cfg;
+}
+
+async function promptMissing(cfg: DeployConfig): Promise<DeployConfig> {
+  return withPrompt(async (rl) => {
+    const app = await ask(
+      rl,
+      "App slug",
+      cfg.app || path.basename(process.cwd()),
+    );
+    const owner = await ask(rl, "GitHub owner", cfg.github.owner);
+    const repo = await ask(rl, "GitHub repo", cfg.github.repo);
+    const branch = await ask(rl, "Deploy branch", cfg.github.branch);
+    const region = await ask(rl, "AWS region", cfg.region);
+    return mergeConfig(cfg, {
+      app,
+      region,
+      github: { owner, repo, branch },
+    });
+  });
+}
+
+async function main(argv: string[]): Promise<void> {
+  const flags = parseFlags(argv);
+  let cfg = seedConfig(flags);
+
+  if (canPrompt(flags.nonInteractive)) {
+    console.log(
+      "\n  rastack init — scaffold the deploy config + GitHub Actions\n",
+    );
+    cfg = await promptMissing(cfg);
+  }
+
+  const errors = validateConfig(cfg);
+  // In non-interactive mode a still-incomplete config is fatal; interactively we
+  // still write what we have so the user can finish it in the file, but warn.
+  if (errors.length) {
+    const label = flags.nonInteractive ? "✗" : "⚠";
+    for (const e of errors) console.error(`  ${label} ${e}`);
+    if (flags.nonInteractive) {
+      console.error(
+        `\n  ${errors.length} problem(s). Pass the missing values as flags.`,
+      );
+      process.exit(1);
+    }
+  }
+
+  const files = scaffoldFiles(cfg, { noWorkflows: flags.noWorkflows });
+  const written: string[] = [];
+  const skipped: string[] = [];
+  for (const f of files) {
+    const abs = path.join(process.cwd(), f.path);
+    if (fs.existsSync(abs) && !flags.force) {
+      skipped.push(f.path);
+      continue;
+    }
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, f.content);
+    written.push(f.path);
+  }
+
+  console.log("");
+  for (const w of written) console.log(`  ✓ wrote ${w}`);
+  for (const s of skipped)
+    console.log(`  • skipped ${s} (exists — pass --force to overwrite)`);
+  console.log(
+    `\n  Next:\n` +
+      `    1. rastack deploy   — review the config and print the stack launch command\n` +
+      `    2. create the CloudFormation stack (once), then wire the repo Variables it prints\n` +
+      `    3. push to ${cfg.github.branch} — CI runs \`rastack ci deploy\`\n`,
+  );
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).catch((err) => {
+    console.error(`  ✗ ${(err as Error).message}`);
+    process.exit(1);
+  });
+}

package/src/rastack.ts

@@ -16,22 +16,44 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack init   [--app slug] [--force]       Template the base GitHub Actions + deploy config
+ *   rastack deploy [--print] [--run]            Configure the serverless deployment
+ *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
  */
 
 import { execSync, spawnSync } from "child_process";
+import { readFileSync } from "fs";
 import path from "path";
 
 const [command, ...rest] = process.argv.slice(2);
 
+/** Print the installed package version (used by the installer to verify). */
+function printVersion(): void {
+  try {
+    const pkg = JSON.parse(
+      readFileSync(path.join(__dirname, "..", "package.json"), "utf-8"),
+    );
+    console.log(pkg.version);
+  } catch {
+    console.log("unknown");
+  }
+}
+
 function run(script: string, args: string[] = rest) {
-  // `rastack` is a local developer CLI: `script` is a fixed internal dist filename
-  // and `args` come from the developer's own shell (process.argv), not from an
-  // untrusted network request — there is no command-injection surface here.
-  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-  execSync(`node ${path.join(__dirname, script)} ${args.join(" ")}`, {
-    stdio: "inherit",
-    env: process.env,
-  });
+  try {
+    // `rastack` is a local developer CLI: `script` is a fixed internal dist filename
+    // and `args` come from the developer's own shell (process.argv), not from an
+    // untrusted network request — there is no command-injection surface here.
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    execSync(`node ${path.join(__dirname, script)} ${args.join(" ")}`, {
+      stdio: "inherit",
+      env: process.env,
+    });
+  } catch (err) {
+    // The subcommand already printed its own error over inherited stdio; just
+    // propagate its exit code without dumping node's child_process stack trace.
+    process.exit((err as { status?: number }).status ?? 1);
+  }
 }
 
 /** Invoke the compiled Rust server binary (built by `cargo build` in rust/). */
@@ -59,6 +81,11 @@ function runRust(subcommand: string) {
 }
 
 switch (command) {
+  case "--version":
+  case "-v":
+  case "version":
+    printVersion();
+    break;
   case "compile":
   case "check":
   case "list":
@@ -90,6 +117,18 @@ switch (command) {
   case "seed":
     run("seed.js");
     break;
+  case "init":
+    // Template the base GitHub Actions + deploy config into a repo.
+    run("rastack-init.js", rest);
+    break;
+  case "deploy":
+    // Configure the serverless deployment (writes .rastack/deploy.json).
+    run("rastack-deploy.js", rest);
+    break;
+  case "ci":
+    // Run a CI pipeline phase (check | build | deploy).
+    run("rastack-ci.js", rest);
+    break;
   case "generate":
   case "gen":
     // Proxy to existing rastack codegen pipeline
@@ -107,7 +146,10 @@ switch (command) {
         `  rastack serve | admin [--warehouse dir]\n` +
         `  rastack wasm                                Compile the API to WebAssembly (browser local dev)\n` +
         `  rastack scan   [files...] [--fail-on-pii]\n` +
-        `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n`,
+        `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+        `  rastack init   [--app slug] [--owner o] [--repo r] [--force]  Template GitHub Actions + deploy config\n` +
+        `  rastack deploy [--app slug] [--print] [--run]                 Configure the serverless deployment\n` +
+        `  rastack ci     <check|build|deploy> [--plan]                  Run the CI pipeline (cleaner Actions)\n`,
     );
     process.exit(1);
 }