underpost 3.2.90 → 3.3.0

package/src/cli/release.js

@@ -56,6 +56,10 @@ const buildVersionBumpTargets = () => [
     file: 'src/index.js',
     patterns: /(static version = ['"]v)\d+\.\d+\.\d+(?=['"])/g,
   },
+  {
+    file: 'src/cli/run.js',
+    patterns: /(const version = ['"]v)\d+\.\d+\.\d+(?=['"])/g,
+  },
 
   // ── README + CLI-HELP fallbacks. CLI-HELP is regenerated by `deploy cli-docs`, but bump
   //    it too so the file is consistent if the regeneration step is skipped. ──
@@ -107,6 +111,14 @@ const buildVersionBumpTargets = () => [
     recursive: true,
   },
 
+  // ── Deployment runner scripts carry image defaults passed to deploy/sync commands. ──
+  {
+    dir: 'deploy',
+    match: /\.sh$/,
+    patterns: /(underpost\/[a-z0-9-]+:v)\d+\.\d+\.\d+/g,
+    recursive: true,
+  },
+
   // ── GitHub Actions workflows. Single sweep across docker-image.*.ci.yml, engine-*.cd.yml,
   //    and the root docker-image.ci.yml — replaces previous three separate loops. ──
   {
@@ -261,6 +273,19 @@ const bumpAuxiliaryFiles = (oldVersion, newVersion, { dryRun = false } = {}) =>
   return report;
 };
 
+/**
+ * Returns whether a manifest's canonical top-level version would change. Used by dry-runs
+ * because bumpp has no non-mutating API option.
+ */
+const wouldBumpManifestVersion = (filePath, newVersion) => {
+  try {
+    const manifest = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    return typeof manifest.version === 'string' && manifest.version !== newVersion;
+  } catch {
+    return false;
+  }
+};
+
 /**
  * Prints a per-file change summary table.
  */
@@ -379,8 +404,8 @@ class UnderpostRelease {
      * 1. Loads production env and pulls latest code; kills dev servers on ports 4001-4003.
      * 2. Builds and smoke-tests the pwa-microservices-template (aborts on error).
      * 3. Canonical version files: delegates to `bumpp` (driven by `bump.config.js`). Bumps
-     *    package.json, package-lock.json (root + packages['']), and every
-     *    engine-private/conf/**\/package.json.
+     *    package.json, package-lock.json (root + packages['']), Hardhat's package metadata,
+     *    and every engine-private/conf/**\/package.json.
      * 4. Auxiliary files: anchored-regex walker over VERSION_BUMP_TARGETS — covers
      *    src/index.js, README, cyberia-docs, nexodev docs, manifests (deployment + cronjobs),
      *    .github/workflows (image tags, type=raw, UNDERPOST_VERSION build-args), and
@@ -420,26 +445,36 @@ class UnderpostRelease {
         if (!templateOk) return;
       }
 
-      // ── Canonical version files: delegate to bumpp (package.json, package-lock.json,
-      //    engine-private/conf/**/package.json). bumpp owns lockfile semantics (root version
-      //    + packages[''].version) so we don't reimplement them. ──
-      const { versionBump } = await import('bumpp');
-      const bumppResult = await versionBump({
-        release: newVersion,
-        files: [
-          'package.json',
-          'package-lock.json',
-          ...(fs.existsSync('./engine-private/conf') ? ['engine-private/conf/**/package.json'] : []),
-        ],
-        commit: false,
-        tag: false,
-        push: false,
-        confirm: false,
-        recursive: false,
-        ignoreScripts: true,
-        dry: dryRun,
-      });
-      logger.info(`bumpp updated ${bumppResult?.files?.length ?? 0} canonical file(s).`);
+      // ── Canonical version files: bumpp owns lockfile semantics (root version +
+      //    packages[''].version). Its API has no non-mutating dry-run, so previews inspect
+      //    manifest versions directly rather than invoking it. ──
+      const canonicalVersionFiles = [
+        'package.json',
+        'package-lock.json',
+        'hardhat/package.json',
+        'hardhat/package-lock.json',
+        ...walkDir('engine-private/conf', /^package\.json$/, true),
+      ];
+      if (dryRun) {
+        const pendingCanonicalFiles = canonicalVersionFiles.filter((file) =>
+          wouldBumpManifestVersion(file, newVersion),
+        );
+        logger.info(`bumpp would update ${pendingCanonicalFiles.length} canonical file(s).`);
+        for (const file of pendingCanonicalFiles) console.log(`  ${file}`);
+      } else {
+        const { versionBump } = await import('bumpp');
+        const bumppResult = await versionBump({
+          release: newVersion,
+          files: canonicalVersionFiles,
+          commit: false,
+          tag: false,
+          push: false,
+          confirm: false,
+          recursive: false,
+          ignoreScripts: true,
+        });
+        logger.info(`bumpp updated ${bumppResult?.updatedFiles?.length ?? 0} canonical file(s).`);
+      }
 
       // ── Auxiliary files: anchored-regex walker over VERSION_BUMP_TARGETS. ──
       const report = bumpAuxiliaryFiles(version, newVersion, { dryRun });

package/src/cli/repository.js

@@ -11,7 +11,6 @@ import { actionInitLog, loggerFactory } from '../server/logger.js';
 import path from 'path';
 import fs from 'fs-extra';
 import {
-  getNpmRootPath,
   Config,
   loadConf,
   readConfJson,
@@ -20,9 +19,9 @@ import {
   loadConfServerJson,
   getDataDeploy,
   buildReplicaId,
-  writeEnv,
   readConfInstances,
 } from '../server/conf.js';
+import { getNpmRootPath, writeEnv } from '../server/environment.js';
 import { buildClient, unzipClientBuild, mergeClientBuildZip } from '../client-builder/client-build.js';
 import { DefaultConf } from '../../conf.js';
 import Underpost from '../index.js';
@@ -109,7 +108,7 @@ class UnderpostRepository {
      * @param {boolean} [options.changelogNoHash=false] - If true, omits commit hashes from the changelog entries.
      * @param {boolean} [options.remoteUrl=false] - If true, prints the current git remote URL (origin) in plain text and returns.
      * @param {string} [options.switchRepo=''] - If set, switches the remote `origin` to this URL and force-pulls the target branch, overwriting the current working tree.
-     * @param {string} [options.targetBranch=''] - Target branch for `switchRepo` (defaults to `master`).
+     * @param {string} [options.targetBranch=''] - Target branch for `switchRepo` (defaults to the remote's default branch).
      * @memberof UnderpostRepository
      */
     commit(
@@ -181,7 +180,7 @@ class UnderpostRepository {
         Underpost.repo.switchRemote({
           path: repoPath,
           url: options.switchRepo,
-          branch: options.targetBranch || 'master',
+          branch: options.targetBranch,
         });
         return;
       }
@@ -906,6 +905,7 @@ class UnderpostRepository {
               split: options.split || '',
               fullBuild: options.liteBuild ? false : true,
               iconsBuild: options.iconsBuild || false,
+              ssrOnly: options.ssr || false,
             });
             for (const replicaDeployId of deployIdSingleReplicas) {
               if (!fs.existsSync(`./engine-private/replica/${replicaDeployId}`)) {
@@ -917,6 +917,7 @@ class UnderpostRepository {
                 split: options.split || '',
                 liteBuild: options.liteBuild || false,
                 iconsBuild: options.iconsBuild || false,
+                ssr: options.ssr || false,
               });
             }
 
@@ -1428,14 +1429,15 @@ Prevent build private config repo.`,
      * @param {object} opts
      * @param {string} opts.url - New remote URL (full URL or "owner/repo" short form).
      * @param {string} [opts.path='.'] - Path to the git repository.
-     * @param {string} [opts.branch='master'] - Target branch to overwrite the current tree with.
+     * @param {string} [opts.branch] - Target branch to overwrite the current tree with. Defaults to the remote's default branch.
      * @param {string} [opts.remote='origin'] - Remote name to set and fetch from.
      * @returns {void}
      * @memberof UnderpostRepository
      */
-    switchRemote({ url, path: repoPath = '.', branch = 'master', remote = 'origin' }) {
+    switchRemote({ url, path: repoPath = '.', branch = '', remote = 'origin' }) {
       if (!url) throw new Error('switchRemote requires a target remote url');
       if (!fs.existsSync(`${repoPath}/.git`)) throw new Error(`switchRemote: not a git repository: ${repoPath}`);
+      const targetBranch = branch || Underpost.repo.getDefaultBranch(url);
       // Token-free URL for the stored remote; auth-injected URL only for the fetch.
       let normalized = url;
       if (!url.startsWith('http://') && !url.startsWith('https://') && !url.startsWith('git@')) {
@@ -1445,12 +1447,12 @@ Prevent build private config repo.`,
       const current = Underpost.repo.getRemoteUrl({ path: repoPath, remote });
       if (!current) shellExec(`cd "${repoPath}" && git remote add ${remote} "${normalized}"`);
       else shellExec(`cd "${repoPath}" && git remote set-url ${remote} "${normalized}"`);
-      logger.info('switchRemote', { path: repoPath, remote, branch, url: normalized });
-      shellExec(`cd "${repoPath}" && GIT_TERMINAL_PROMPT=0 git fetch --force "${authUrl}" ${branch}`);
+      logger.info('switchRemote', { path: repoPath, remote, branch: targetBranch, url: normalized });
+      shellExec(`cd "${repoPath}" && GIT_TERMINAL_PROMPT=0 git fetch --force "${authUrl}" ${targetBranch}`);
       // reset --hard first clears the worktree so the checkout cannot be blocked
       // by conflicting local changes; -B points the target branch at the fetched tip.
       shellExec(`cd "${repoPath}" && git reset --hard FETCH_HEAD`);
-      shellExec(`cd "${repoPath}" && git checkout -B ${branch} FETCH_HEAD`);
+      shellExec(`cd "${repoPath}" && git checkout -B ${targetBranch} FETCH_HEAD`);
     },
 
     /**

package/src/cli/run.js

@@ -4,13 +4,12 @@
  * @namespace UnderpostRun
  */
 
-import { daemonProcess, getTerminalPid, pbcopy, shellCd, shellExec } from '../server/process.js';
+import { daemonProcess, pbcopy, shellCd, shellExec } from '../server/process.js';
 import {
   awaitDeployMonitor,
   buildKindPorts,
   clusterContextFactory,
   clusterTypeFactory,
-  cronDeployIdResolve,
   dispatchBuildInstanceEnv,
   deployHostsFactory,
   etcHostFactory,
@@ -21,7 +20,6 @@ import {
   exposeTcpPortsFactory,
   gatewayApiEnabledFactory,
   generateSecurePassword,
-  getNpmRootPath,
   instanceHttpRouteRulesFactory,
   instanceInterceptStatusesFactory,
   instancePortFactory,
@@ -36,7 +34,6 @@ import {
   resolveEnvScoped,
   selectConfInstances,
   waitForPort,
-  writeEnv,
   clusterInstancesFactory,
   deployTrafficEntriesFactory,
   curlStatusChainFactory,
@@ -49,6 +46,8 @@ import {
   stopPlanFactory,
   trafficFromRoutingInfoFactory,
 } from '../server/conf.js';
+import { cronDeployIdResolve } from '../server/cron.js';
+import { getNpmRootPath, writeEnv } from '../server/environment.js';
 import { actionInitLog, loggerFactory } from '../server/logger.js';
 
 import fs from 'fs-extra';
@@ -127,7 +126,7 @@ const logger = loggerFactory(import.meta);
  * @property {string} confServerPath - The configuration server path.
  * @property {string} underpostRoot - The root path of the Underpost installation.
  * @property {string} cmdCronJobs - Pre-script commands to run before cron job execution.
- * @property {string} deployIdCronJobs - The deployment ID for cron jobs.
+ * @property {string} deployIdCronJobs - Cron deploy-id passed to `cron --setup-start`; unset resolves dd.cron, `none` skips cron setup.
  * @property {string} timezone - The timezone to set.
  * @property {boolean} kubeadm - Whether to run in kubeadm mode.
  * @property {boolean} kind - Whether to run in kind mode.
@@ -1172,8 +1171,16 @@ echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com
           if (!validVersion) throw new Error('Version mismatch');
         }
         if (options.timezone !== 'none') shellExec(`${baseCommand} run${baseClusterCommand} tz`);
-        if (options.deployIdCronJobs !== 'none')
-          shellExec(`node bin cron${baseClusterCommand}${clusterFlag} --setup-start --git --apply`);
+        if (options.deployIdCronJobs !== 'none') {
+          // --deploy-id-cron-jobs overrides the cron deploy-id; unset falls back to
+          // dd.cron, the same source `cron --setup-start` resolves against on its own.
+          const cronDeployId = options.deployIdCronJobs || cronDeployIdResolve() || '';
+          if (cronDeployId && !/^[a-zA-Z0-9._,-]+$/.test(cronDeployId))
+            throw new Error(`Invalid cron deploy-id: ${cronDeployId}`);
+          shellExec(
+            `node bin cron${cronDeployId ? ` ${cronDeployId}` : ''}${baseClusterCommand}${clusterFlag} --setup-start --git --apply`,
+          );
+        }
       }
 
       const currentTraffic = isDeployRunnerContext(path, options)
@@ -1220,7 +1227,7 @@ echo -e "[code]\nname=Visual Studio Code\nbaseurl=https://packages.microsoft.com
       // runner. Build the host-side SSR documents before generating routes unless
       // the caller explicitly selected a pre-built bundle workflow.
       if (isDeployRunnerContext(path, options) && !options.skipFullBuild)
-        shellExec(`${baseCommand} client ${deployId} ${env}`);
+        shellExec(`${baseCommand} client ${deployId} ${env} --ssr`);
 
       shellExec(
         `${baseCommand} deploy${clusterFlag} --build-manifest --sync --info-router --replicas ${replicas} --node ${node}${
@@ -3090,7 +3097,7 @@ EOF`);
         const hostListenResult = etcHostFactory(hosts);
         logger.info(hostListenResult.renderHosts);
       }
-      const version = 'v3.2.90';
+      const version = 'v3.3.0';
       const instanceOptionsFactory = (deployId, instanceId) => ({
         ...options,
         ...clusterContextFactory(clusterType),
@@ -4906,6 +4913,26 @@ EOF`;
       }
     },
 
+    /**
+     * @method kubeadm-wireguard
+     * @description
+     * Configures Calico to keep using the Kubernetes NodeInternalIP after WireGuard
+     * is added to the node. This prevents the WireGuard interface (for example
+     * 10.0.0.2) from being selected as the Calico/BGP node address.
+     *
+     * @param {string} path - Unused.
+     * @param {UnderpostRunDefaultOptions} options - The default underpost runner options.
+     * @memberof UnderpostRun
+     */
+    'kubeadm-wireguard': (path, options = DEFAULT_OPTION) => {
+      shellExec(`kubectl patch installation.operator.tigera.io default --type='json' \
+-p='[
+  {"op":"replace","path":"/spec/calicoNetwork/nodeAddressAutodetectionV4","value":{"kubernetes":"NodeInternalIP"}}
+]'`);
+
+      shellExec(`kubectl rollout restart daemonset/calico-node -n calico-system`);
+    },
+
     /**
      * @method build-cluster-deployment-manifests
      * @description Builds deployment manifests for both production and development environments using `node bin deploy --build-manifest`, syncing them, and setting replicas to 1 for the `dd` deployment.