rastack 0.0.39 → 0.0.40

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.40](https://github.com/theserverkid/reactapistack/compare/v0.0.39...v0.0.40) (2026-07-12)
+
+
+### Bug Fixes
+
+* `rastack init` now wires the GitHub→Lambda deploy variables ([fa35b97](https://github.com/theserverkid/reactapistack/commit/fa35b9744c2149ff7a9c663ffecdd2d6ad1edec6))
+
 ### [0.0.39](https://github.com/theserverkid/reactapistack/compare/v0.0.38...v0.0.39) (2026-07-11)
 
 ### [0.0.38](https://github.com/theserverkid/reactapistack/compare/v0.0.37...v0.0.38) (2026-07-11)

package/dist/deploy/config.d.ts

@@ -185,6 +185,16 @@ export interface RepoVariable {
  * Console.
  */
 export declare function repoVariables(cfg: DeployConfig): RepoVariable[];
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+export declare function ghVariableSetArgs(cfg: DeployConfig, name: string, value: string): string[];
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/config.js

@@ -33,6 +33,7 @@ exports.bootstrapStackParameters = bootstrapStackParameters;
 exports.bootstrapStackArgs = bootstrapStackArgs;
 exports.bootstrapStackCommand = bootstrapStackCommand;
 exports.repoVariables = repoVariables;
+exports.ghVariableSetArgs = ghVariableSetArgs;
 exports.lambdaEnv = lambdaEnv;
 exports.DEFAULT_LAMBDA = {
     bin: "bootstrap",
@@ -345,6 +346,26 @@ function repoVariables(cfg) {
         { name: "AWS_REGION", value: cfg.region, from: "Region stack output" },
     ];
 }
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+function ghVariableSetArgs(cfg, name, value) {
+    return [
+        "variable",
+        "set",
+        name,
+        "--repo",
+        `${cfg.github.owner}/${cfg.github.repo}`,
+        "--body",
+        value,
+    ];
+}
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/io.d.ts

@@ -17,7 +17,7 @@ export declare function saveConfig(cfg: DeployConfig, cwd?: string): string;
  */
 export declare function gitRemoteUrl(cwd?: string): string | null;
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-export declare function canPrompt(nonInteractive: boolean): boolean;
+export declare function canPrompt(nonInteractive?: boolean): boolean;
 /** Capture `aws <args>` stdout, or null when the CLI is absent / the call fails. */
 export declare function awsCapture(args: string[], cwd?: string): string | null;
 /** Run `aws <args>` streaming output; throws on a non-zero exit. */
@@ -37,6 +37,29 @@ export declare function stackOutput(stackName: string, key: string, region: stri
  * on every `init`. Returns false when the placeholder file is missing.
  */
 export declare function uploadPlaceholder(artifactsBucket: string, region: string, cwd?: string): boolean;
+/** True when the GitHub CLI is on PATH. */
+export declare function ghAvailable(): boolean;
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+export declare function ghAuthenticated(cwd?: string): boolean;
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+export declare function ghAuthLogin(cwd?: string): boolean;
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+export declare function setRepoVariable(args: string[], cwd?: string): boolean;
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/deploy/io.js

@@ -48,6 +48,10 @@ exports.awsRun = awsRun;
 exports.awsAvailable = awsAvailable;
 exports.stackOutput = stackOutput;
 exports.uploadPlaceholder = uploadPlaceholder;
+exports.ghAvailable = ghAvailable;
+exports.ghAuthenticated = ghAuthenticated;
+exports.ghAuthLogin = ghAuthLogin;
+exports.setRepoVariable = setRepoVariable;
 exports.ask = ask;
 exports.withPrompt = withPrompt;
 const child_process_1 = require("child_process");
@@ -98,7 +102,7 @@ function gitRemoteUrl(cwd = process.cwd()) {
     }
 }
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-function canPrompt(nonInteractive) {
+function canPrompt(nonInteractive = false) {
     return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 // ── AWS CLI boundary ─────────────────────────────────────────────────────────
@@ -175,6 +179,75 @@ function uploadPlaceholder(artifactsBucket, region, cwd = process.cwd()) {
     ]);
     return true;
 }
+// ── GitHub CLI boundary ──────────────────────────────────────────────────────
+// After the stack is up `init` wires the two repo Variables CI reads
+// (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already
+// authenticated to their GitHub — so the pipeline fires on the first push
+// instead of leaving the wiring as a manual Console step. Best-effort: absent or
+// unauthenticated `gh` degrades to the printed instructions.
+/** True when the GitHub CLI is on PATH. */
+function ghAvailable() {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+function ghAuthenticated(cwd = process.cwd()) {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["auth", "status", "--hostname", "github.com"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+function ghAuthLogin(cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", ["auth", "login", "--hostname", "github.com"], {
+            cwd,
+            stdio: "inherit",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+function setRepoVariable(args, cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/rastack-init.d.ts

@@ -5,7 +5,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`

package/dist/rastack-init.js

@@ -6,7 +6,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
@@ -68,7 +68,6 @@ function parseFlags(argv) {
     let noWorkflows = false;
     let noDeploy = false;
     let print = false;
-    let nonInteractive = false;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         const next = () => argv[++i] ?? "";
@@ -107,11 +106,6 @@ function parseFlags(argv) {
             case "--dry-run":
                 print = true;
                 break;
-            case "--yes":
-            case "-y":
-            case "--non-interactive":
-                nonInteractive = true;
-                break;
             default:
                 if (a.startsWith("-")) {
                     console.error(`Unknown flag: ${a}`);
@@ -119,7 +113,7 @@ function parseFlags(argv) {
                 }
         }
     }
-    return { patch, force, noWorkflows, noDeploy, print, nonInteractive };
+    return { patch, force, noWorkflows, noDeploy, print };
 }
 /** Seed a config: existing file → flags → git remote → defaults. */
 function seedConfig(flags) {
@@ -209,7 +203,7 @@ function printPlan(cfg) {
  * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
  * the config. Returns the config enriched with the resolved buckets + outputs.
  */
-async function standUp(cfg) {
+async function standUp(cfg, interactive) {
     if (!(0, io_1.awsAvailable)()) {
         console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
@@ -252,8 +246,57 @@ async function standUp(cfg) {
     const outputs = readAppOutputs(cfg);
     cfg = (0, config_1.mergeConfig)(cfg, { outputs });
     (0, io_1.saveConfig)(cfg);
+    // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
+    //    push actually ships. Without this the deploy-backend workflow's `if:
+    //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+    wireRepoVariables(cfg, interactive);
     return cfg;
 }
+/**
+ * Set the `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` repo Variables via `gh` so the
+ * GitHub → Lambda pipeline is live the moment `init` finishes. Connects `gh` to
+ * GitHub first — running `gh auth login` when it is installed but not yet
+ * authenticated (on a TTY) — so a fresh machine goes from nothing to a working
+ * pipeline in one command. Best-effort throughout: no `gh`, a declined login, or
+ * a value the stack Outputs did not yield falls back to the printed instructions
+ * in `printSummary`. Records the names it wired so the summary reports what is
+ * (and isn't) done.
+ */
+const wiredVariables = new Set();
+function wireRepoVariables(cfg, interactive) {
+    const vars = (0, config_1.repoVariables)(cfg).filter((v) => v.value);
+    if (!vars.length)
+        return;
+    if (!(0, io_1.ghAvailable)()) {
+        console.log("\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+            "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
+            "  Variables below by hand so pushes deploy.");
+        return;
+    }
+    // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+    if (!(0, io_1.ghAuthenticated)()) {
+        if (interactive) {
+            console.log("\n▸ Connecting the GitHub CLI to your account (`gh auth login`)");
+            (0, io_1.ghAuthLogin)();
+        }
+        if (!(0, io_1.ghAuthenticated)()) {
+            console.log("\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+                "  Run `gh auth login`, then wire the Variables below by hand.");
+            return;
+        }
+    }
+    console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
+    for (const v of vars) {
+        const ok = (0, io_1.setRepoVariable)((0, config_1.ghVariableSetArgs)(cfg, v.name, v.value));
+        if (ok) {
+            wiredVariables.add(v.name);
+            console.log(`  ✓ set ${v.name}`);
+        }
+        else {
+            console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+        }
+    }
+}
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg) {
     try {
@@ -277,26 +320,33 @@ function printSummary(cfg) {
     console.log(`\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`);
     if (cfg.outputs?.apiUrl)
         console.log(`    API:  ${cfg.outputs.apiUrl}`);
-    console.log("\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):");
-    console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-    }))));
-    console.log(`\n  Then every push to ${cfg.github.branch} ships code via \`rastack ci deploy\`` +
+    // Only the Variables `init` could NOT wire itself remain a manual step.
+    const pending = (0, config_1.repoVariables)(cfg).filter((v) => !wiredVariables.has(v.name));
+    if (pending.length) {
+        console.log("\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):");
+        console.log(table(pending.map((v) => ({
+            key: v.name,
+            value: v.value || `<${v.from}>`,
+        }))));
+    }
+    else {
+        console.log("\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).");
+    }
+    console.log(`\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
         ` (also runnable locally as \`rastack deploy\`).\n`);
 }
 async function main(argv) {
     const flags = parseFlags(argv);
     let cfg = seedConfig(flags);
-    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+    if ((0, io_1.canPrompt)()) {
         console.log("\n  rastack init — scaffold the deploy config + stand the backend up\n");
         cfg = await promptMissing(cfg);
     }
     const errors = (0, config_1.validateConfig)(cfg);
     // Any deploy needs a complete config; a still-incomplete one is fatal unless we
-    // are only scaffolding files.
+    // are only scaffolding files, and always fatal off a TTY (no prompt to fix it).
     if (errors.length) {
-        const fatal = !flags.noDeploy || flags.nonInteractive;
+        const fatal = !flags.noDeploy || !(0, io_1.canPrompt)();
         const label = fatal ? "✗" : "⚠";
         for (const e of errors)
             console.error(`  ${label} ${e}`);
@@ -334,14 +384,14 @@ async function main(argv) {
             `  or \`rastack init --print\` to see the exact commands.\n`);
         return;
     }
-    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+    if ((0, io_1.canPrompt)()) {
         const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;
         }
     }
-    cfg = await standUp(cfg);
+    cfg = await standUp(cfg, (0, io_1.canPrompt)());
     printSummary(cfg);
 }
 if (require.main === module) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/deploy/config.ts

@@ -471,6 +471,31 @@ export function repoVariables(cfg: DeployConfig): RepoVariable[] {
   ];
 }
 
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+export function ghVariableSetArgs(
+  cfg: DeployConfig,
+  name: string,
+  value: string,
+): string[] {
+  return [
+    "variable",
+    "set",
+    name,
+    "--repo",
+    `${cfg.github.owner}/${cfg.github.repo}`,
+    "--body",
+    value,
+  ];
+}
+
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/src/deploy/io.ts

@@ -55,7 +55,7 @@ export function gitRemoteUrl(cwd = process.cwd()): string | null {
 }
 
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-export function canPrompt(nonInteractive: boolean): boolean {
+export function canPrompt(nonInteractive = false): boolean {
   return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 
@@ -144,6 +144,79 @@ export function uploadPlaceholder(
   return true;
 }
 
+// ── GitHub CLI boundary ──────────────────────────────────────────────────────
+// After the stack is up `init` wires the two repo Variables CI reads
+// (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already
+// authenticated to their GitHub — so the pipeline fires on the first push
+// instead of leaving the wiring as a manual Console step. Best-effort: absent or
+// unauthenticated `gh` degrades to the printed instructions.
+
+/** True when the GitHub CLI is on PATH. */
+export function ghAvailable(): boolean {
+  try {
+    execFileSync("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+export function ghAuthenticated(cwd = process.cwd()): boolean {
+  try {
+    execFileSync("gh", ["auth", "status", "--hostname", "github.com"], {
+      cwd,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+export function ghAuthLogin(cwd = process.cwd()): boolean {
+  try {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    execFileSync("gh", ["auth", "login", "--hostname", "github.com"], {
+      cwd,
+      stdio: "inherit",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+export function setRepoVariable(
+  args: string[],
+  cwd = process.cwd(),
+): boolean {
+  try {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    execFileSync("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/src/rastack-init.ts

@@ -6,7 +6,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
@@ -38,6 +38,7 @@ import {
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
+  ghVariableSetArgs,
   mergeConfig,
   normalizeConfig,
   parseGitHubRemote,
@@ -50,9 +51,13 @@ import {
   awsAvailable,
   awsRun,
   canPrompt,
+  ghAuthLogin,
+  ghAuthenticated,
+  ghAvailable,
   gitRemoteUrl,
   loadConfig,
   saveConfig,
+  setRepoVariable,
   stackOutput,
   uploadPlaceholder,
   withPrompt,
@@ -64,7 +69,6 @@ interface Flags {
   noWorkflows: boolean;
   noDeploy: boolean;
   print: boolean;
-  nonInteractive: boolean;
 }
 
 function parseFlags(argv: string[]): Flags {
@@ -73,7 +77,6 @@ function parseFlags(argv: string[]): Flags {
   let noWorkflows = false;
   let noDeploy = false;
   let print = false;
-  let nonInteractive = false;
   for (let i = 0; i < argv.length; i++) {
     const a = argv[i];
     const next = () => argv[++i] ?? "";
@@ -112,11 +115,6 @@ function parseFlags(argv: string[]): Flags {
       case "--dry-run":
         print = true;
         break;
-      case "--yes":
-      case "-y":
-      case "--non-interactive":
-        nonInteractive = true;
-        break;
       default:
         if (a.startsWith("-")) {
           console.error(`Unknown flag: ${a}`);
@@ -124,7 +122,7 @@ function parseFlags(argv: string[]): Flags {
         }
     }
   }
-  return { patch, force, noWorkflows, noDeploy, print, nonInteractive };
+  return { patch, force, noWorkflows, noDeploy, print };
 }
 
 /** Seed a config: existing file → flags → git remote → defaults. */
@@ -236,7 +234,10 @@ function printPlan(cfg: DeployConfig): void {
  * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
  * the config. Returns the config enriched with the resolved buckets + outputs.
  */
-async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
+async function standUp(
+  cfg: DeployConfig,
+  interactive: boolean,
+): Promise<DeployConfig> {
   if (!awsAvailable()) {
     console.error(
       "  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
@@ -308,9 +309,67 @@ async function standUp(cfg: DeployConfig): Promise<DeployConfig> {
   const outputs = readAppOutputs(cfg);
   cfg = mergeConfig(cfg, { outputs });
   saveConfig(cfg);
+
+  // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
+  //    push actually ships. Without this the deploy-backend workflow's `if:
+  //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+  wireRepoVariables(cfg, interactive);
   return cfg;
 }
 
+/**
+ * Set the `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` repo Variables via `gh` so the
+ * GitHub → Lambda pipeline is live the moment `init` finishes. Connects `gh` to
+ * GitHub first — running `gh auth login` when it is installed but not yet
+ * authenticated (on a TTY) — so a fresh machine goes from nothing to a working
+ * pipeline in one command. Best-effort throughout: no `gh`, a declined login, or
+ * a value the stack Outputs did not yield falls back to the printed instructions
+ * in `printSummary`. Records the names it wired so the summary reports what is
+ * (and isn't) done.
+ */
+const wiredVariables = new Set<string>();
+function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
+  const vars = repoVariables(cfg).filter((v) => v.value);
+  if (!vars.length) return;
+
+  if (!ghAvailable()) {
+    console.log(
+      "\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+        "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
+        "  Variables below by hand so pushes deploy.",
+    );
+    return;
+  }
+
+  // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+  if (!ghAuthenticated()) {
+    if (interactive) {
+      console.log(
+        "\n▸ Connecting the GitHub CLI to your account (`gh auth login`)",
+      );
+      ghAuthLogin();
+    }
+    if (!ghAuthenticated()) {
+      console.log(
+        "\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+          "  Run `gh auth login`, then wire the Variables below by hand.",
+      );
+      return;
+    }
+  }
+
+  console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
+  for (const v of vars) {
+    const ok = setRepoVariable(ghVariableSetArgs(cfg, v.name, v.value));
+    if (ok) {
+      wiredVariables.add(v.name);
+      console.log(`  ✓ set ${v.name}`);
+    } else {
+      console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+    }
+  }
+}
+
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg: DeployConfig): void {
   try {
@@ -338,19 +397,28 @@ function printSummary(cfg: DeployConfig): void {
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
   );
   if (cfg.outputs?.apiUrl) console.log(`    API:  ${cfg.outputs.apiUrl}`);
+
+  // Only the Variables `init` could NOT wire itself remain a manual step.
+  const pending = repoVariables(cfg).filter((v) => !wiredVariables.has(v.name));
+  if (pending.length) {
+    console.log(
+      "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
+    );
+    console.log(
+      table(
+        pending.map((v) => ({
+          key: v.name,
+          value: v.value || `<${v.from}>`,
+        })),
+      ),
+    );
+  } else {
+    console.log(
+      "\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).",
+    );
+  }
   console.log(
-    "\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):",
-  );
-  console.log(
-    table(
-      repoVariables(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-      })),
-    ),
-  );
-  console.log(
-    `\n  Then every push to ${cfg.github.branch} ships code via \`rastack ci deploy\`` +
+    `\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
       ` (also runnable locally as \`rastack deploy\`).\n`,
   );
 }
@@ -359,7 +427,7 @@ async function main(argv: string[]): Promise<void> {
   const flags = parseFlags(argv);
   let cfg = seedConfig(flags);
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     console.log(
       "\n  rastack init — scaffold the deploy config + stand the backend up\n",
     );
@@ -368,9 +436,9 @@ async function main(argv: string[]): Promise<void> {
 
   const errors = validateConfig(cfg);
   // Any deploy needs a complete config; a still-incomplete one is fatal unless we
-  // are only scaffolding files.
+  // are only scaffolding files, and always fatal off a TTY (no prompt to fix it).
   if (errors.length) {
-    const fatal = !flags.noDeploy || flags.nonInteractive;
+    const fatal = !flags.noDeploy || !canPrompt();
     const label = fatal ? "✗" : "⚠";
     for (const e of errors) console.error(`  ${label} ${e}`);
     if (fatal) {
@@ -413,7 +481,7 @@ async function main(argv: string[]): Promise<void> {
     return;
   }
 
-  if (canPrompt(flags.nonInteractive)) {
+  if (canPrompt()) {
     const ok = await confirm(
       `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
     );
@@ -425,7 +493,7 @@ async function main(argv: string[]): Promise<void> {
     }
   }
 
-  cfg = await standUp(cfg);
+  cfg = await standUp(cfg, canPrompt());
   printSummary(cfg);
 }
 

package/test/deploy.spec.ts

@@ -13,6 +13,7 @@ import {
   bootstrapStackParameters,
   cognitoAdvancedSecuritySupported,
   APP_STACK_OUTPUTS,
+  ghVariableSetArgs,
   lambdaEnv,
   mergeConfig,
   normalizeConfig,
@@ -345,6 +346,32 @@ describe("repo variables + lambda env", () => {
     expect(vars.find((v) => v.name === "AWS_REGION")!.value).toBe("af-south-1");
   });
 
+  it("builds the `gh variable set` argv init wires the pipeline with", () => {
+    const cfg = base({ outputs: { deployRoleArn: "arn:aws:iam::1:role/x" } });
+    const roleVar = repoVariables(cfg).find(
+      (v) => v.name === "AWS_DEPLOY_ROLE_ARN",
+    )!;
+    expect(ghVariableSetArgs(cfg, roleVar.name, roleVar.value)).toEqual([
+      "variable",
+      "set",
+      "AWS_DEPLOY_ROLE_ARN",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "arn:aws:iam::1:role/x",
+    ]);
+    // Region variable targets the same repo with the region value.
+    expect(ghVariableSetArgs(cfg, "AWS_REGION", cfg.region)).toEqual([
+      "variable",
+      "set",
+      "AWS_REGION",
+      "--repo",
+      "theserverkid/reactapistack-demo",
+      "--body",
+      "af-south-1",
+    ]);
+  });
+
   it("fills the RASTACK_* env, using outputs where available", () => {
     const cfg = base({
       outputs: {