rastack 0.0.38 → 0.0.40

package/src/rastack-init.ts

@@ -6,7 +6,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
@@ -38,6 +38,7 @@ import {
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
+  ghVariableSetArgs,
   mergeConfig,
   normalizeConfig,
   parseGitHubRemote,
@@ -50,9 +51,13 @@ import {
   awsAvailable,
   awsRun,
   canPrompt,
+  ghAuthLogin,
+  ghAuthenticated,
+  ghAvailable,
   gitRemoteUrl,
   loadConfig,
   saveConfig,
+  setRepoVariable,
   stackOutput,
   uploadPlaceholder,
   withPrompt,
@@ -64,7 +69,6 @@ interface Flags {
   noWorkflows: boolean;
   noDeploy: boolean;
   print: boolean;
-  nonInteractive: boolean;
 }
 
 function parseFlags(argv: string[]): Flags {
@@ -73,7 +77,6 @@ function parseFlags(argv: string[]): Flags {
   let noWorkflows = false;
   let noDeploy = false;
   let print = false;
-  let nonInteractive = false;
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     const next = () => argv[++i] ?? "";
@@ -112,11 +115,6 @@ function parseFlags(argv: string[]): Flags {
       case "--dry-run":
         print = true;
         break;
-      case "--yes":
-      case "-y":
-      case "--non-interactive":
-        nonInteractive = true;
-        break;
       default:
         if (a.startsWith("-")) {
           console.error(`Unknown flag: ${a}`);
@@ -124,7 +122,7 @@ function parseFlags(argv: string[]): Flags {
         }
     }
   }
-  return { patch, force, noWorkflows, noDeploy, print, nonInteractive };
+  return { patch, force, noWorkflows, noDeploy, print };
 }
 
 /** Seed a config: existing file → flags → git remote → defaults. */
@@ -236,7 +234,10 @@ function printPlan(cfg: DeployConfig): void {
  * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
  * the config. Returns the config enriched with the resolved buckets + outputs.
  */
-async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
+async function standUp(
+  cfg: DeployConfig,
+  interactive: boolean,
+): Promise<DeployConfig> {
   if (!awsAvailable()) {
     console.error(
       "  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
@@ -308,9 +309,67 @@ async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
   const outputs = readAppOutputs(cfg);
   cfg = mergeConfig(cfg, { outputs });
   saveConfig(cfg);
+
+  // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
+  //    push actually ships. Without this the deploy-backend workflow's `if:
+  //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+  wireRepoVariables(cfg, interactive);
   return cfg;
 }
 
+/**
+ * Set the `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` repo Variables via `gh` so the
+ * GitHub → Lambda pipeline is live the moment `init` finishes. Connects `gh` to
+ * GitHub first — running `gh auth login` when it is installed but not yet
+ * authenticated (on a TTY) — so a fresh machine goes from nothing to a working
+ * pipeline in one command. Best-effort throughout: no `gh`, a declined login, or
+ * a value the stack Outputs did not yield falls back to the printed instructions
+ * in `printSummary`. Records the names it wired so the summary reports what is
+ * (and isn't) done.
+ */
+const wiredVariables = new Set<string>();
+function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
+  const vars = repoVariables(cfg).filter((v) => v.value);
+  if (!vars.length) return;
+
+  if (!ghAvailable()) {
+    console.log(
+      "\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+        "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
+        "  Variables below by hand so pushes deploy.",
+    );
+    return;
+  }
+
+  // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+  if (!ghAuthenticated()) {
+    if (interactive) {
+      console.log(
+        "\n▸ Connecting the GitHub CLI to your account (`gh auth login`)",
+      );
+      ghAuthLogin();
+    }
+    if (!ghAuthenticated()) {
+      console.log(
+        "\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+          "  Run `gh auth login`, then wire the Variables below by hand.",
+      );
+      return;
+    }
+  }
+
+  console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
+  for (const v of vars) {
+    const ok = setRepoVariable(ghVariableSetArgs(cfg, v.name, v.value));
+    if (ok) {
+      wiredVariables.add(v.name);
+      console.log(`  ✓ set ${v.name}`);
+    } else {
+      console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+    }
+  }
+}
+
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg: DeployConfig): void {
   try {
@@ -338,19 +397,28 @@ function printSummary(cfg: DeployConfig): void {
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
   );
   if (cfg.outputs?.apiUrl) console.log(`    API:  ${cfg.outputs.apiUrl}`);
+
+  // Only the Variables `init` could NOT wire itself remain a manual step.
+  const pending = repoVariables(cfg).filter((v) => !wiredVariables.has(v.name));
+  if (pending.length) {
+    console.log(
+      "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
+    );
+    console.log(
+      table(
+        pending.map((v) => ({
+          key: v.name,
+          value: v.value || `<${v.from}>`,
+        })),
+      ),
+    );
+  } else {
+    console.log(
+      "\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).",
+    );
+  }
   console.log(
-    "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
-  );
-  console.log(
-    table(
-      repoVariables(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-      })),
-    ),
-  );
-  console.log(
-    `\n  Then every push to ${cfg.github.branch} ships code via \`rastack ci deploy\`` +
+    `\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
       ` (also runnable locally as \`rastack deploy\`).\n`,
   );
 }
@@ -359,7 +427,7 @@ async function main(argv: string[]): Promise<void> {
   const flags = parseFlags(argv);
   let cfg = seedConfig(flags);
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     console.log(
       "\n  rastack init — scaffold the deploy config + stand the backend up\n",
     );
@@ -368,9 +436,9 @@ async function main(argv: string[]): Promise<void> {
 
   const errors = validateConfig(cfg);
   // Any deploy needs a complete config; a still-incomplete one is fatal unless we
-  // are only scaffolding files.
+  // are only scaffolding files, and always fatal off a TTY (no prompt to fix it).
   if (errors.length) {
-    const fatal = !flags.noDeploy || flags.nonInteractive;
+    const fatal = !flags.noDeploy || !canPrompt();
     const label = fatal ? "✗" : "⚠";
     for (const e of errors) console.error(`  ${label} ${e}`);
     if (fatal) {
@@ -413,7 +481,7 @@ async function main(argv: string[]): Promise<void> {
     return;
   }
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     const ok = await confirm(
       `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
     );
@@ -425,7 +493,7 @@ async function main(argv: string[]): Promise<void> {
     }
   }
 
-  cfg = await standUp(cfg);
+  cfg = await standUp(cfg, canPrompt());
   printSummary(cfg);
 }
 

package/src/rastack.ts

@@ -16,6 +16,7 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
  *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
@@ -118,6 +119,11 @@ switch (command) {
   case "seed":
     run("seed.js");
     break;
+  case "bootstrap":
+    // Stand the tier-0 bootstrap stack up (buckets + GitHub OIDC) for an AWS
+    // account — the once-per-account+region step, decoupled from any app.
+    run("rastack-bootstrap.js", rest);
+    break;
   case "init":
     // Scaffold config + GitHub Actions and stand the serverless backend up.
     run("rastack-init.js", rest);
@@ -154,6 +160,7 @@ switch (command) {
         `  rastack wasm                                Compile the API to WebAssembly (browser local dev)\n` +
         `  rastack scan   [files...] [--fail-on-pii]\n` +
         `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+        `  rastack bootstrap [--owner o] [--repo r] [--region r] [--prefix p] [--reuse-oidc] [--print]  Stand the AWS account stack up\n` +
         `  rastack init   [--app slug] [--owner o] [--repo r] [--print] [--no-deploy]  Scaffold + stand the backend up\n` +
         `  rastack deploy [--plan]                                       Ship code to the Lambda (alias for ci deploy)\n` +
         `  rastack ci     <check|build|deploy> [--plan]                  Run the CI pipeline (cleaner Actions)\n` +

package/test/deploy.spec.ts

@@ -13,6 +13,7 @@ import {
   bootstrapStackParameters,
   cognitoAdvancedSecuritySupported,
   APP_STACK_OUTPUTS,
+  ghVariableSetArgs,
   lambdaEnv,
   mergeConfig,
   normalizeConfig,
@@ -21,6 +22,7 @@ import {
   scaffoldFiles,
   stackParameters,
   validateConfig,
+  validateBootstrapConfig,
   zipStore,
   renderCiWorkflow,
   renderDeployWorkflow,
@@ -278,6 +280,31 @@ describe("bootstrap stack", () => {
     expect(cmd).toContain("--stack-name rastack-bootstrap");
     expect(`aws ${bootstrapStackArgs(base()).join(" ")}`).toBe(cmd);
   });
+
+  it("validates only the account-level fields, not the per-app ones", () => {
+    // A config with no `app` is fine for bootstrap — it never touches app.yaml.
+    const cfg = normalizeConfig({
+      github: { owner: "theserverkid", repo: "reactapistack-demo" },
+    });
+    expect(validateConfig(cfg)).toContain(
+      "app is required (a short slug, e.g. `airline`).",
+    );
+    expect(validateBootstrapConfig(cfg)).toEqual([]);
+  });
+
+  it("still flags a bad prefix, region, or GitHub coordinates", () => {
+    expect(
+      validateBootstrapConfig(base({ namePrefix: "Bad_Prefix" })),
+    ).toContainEqual(expect.stringContaining("namePrefix"));
+    expect(
+      validateBootstrapConfig(base({ region: "not-a-region" })),
+    ).toContainEqual(expect.stringContaining("region"));
+    expect(
+      validateBootstrapConfig(
+        normalizeConfig({ app: "airline", github: { repo: "demo" } }),
+      ),
+    ).toContain("github.owner is required.");
+  });
 });
 
 describe("app stack outputs map", () => {
@@ -319,6 +346,32 @@ describe("repo variables + lambda env", () => {
     expect(vars.find((v) => v.name === "AWS_REGION")!.value).toBe("af-south-1");
   });
 
+  it("builds the `gh variable set` argv init wires the pipeline with", () => {
+    const cfg = base({ outputs: { deployRoleArn: "arn:aws:iam::1:role/x" } });
+    const roleVar = repoVariables(cfg).find(
+      (v) => v.name === "AWS_DEPLOY_ROLE_ARN",
+    )!;
+    expect(ghVariableSetArgs(cfg, roleVar.name, roleVar.value)).toEqual([
+      "variable",
+      "set",
+      "AWS_DEPLOY_ROLE_ARN",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "arn:aws:iam::1:role/x",
+    ]);
+    // Region variable targets the same repo with the region value.
+    expect(ghVariableSetArgs(cfg, "AWS_REGION", cfg.region)).toEqual([
+      "variable",
+      "set",
+      "AWS_REGION",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "af-south-1",
+    ]);
+  });
+
   it("fills the RASTACK_* env, using outputs where available", () => {
     const cfg = base({
       outputs: {