splent-cli 1.28.2__tar.gz → 1.29.1__tar.gz

{splent_cli-1.28.2/src/splent_cli.egg-info → splent_cli-1.29.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: splent_cli
-Version: 1.28.2
+Version: 1.29.1
 Summary: SPLENT-CLI is a CLI to be able to work on your development more easily.
 Author-email: DiversoLab <diversolab@us.es>
 Project-URL: Homepage, https://github.com/diverso-lab/splent_cli

{splent_cli-1.28.2 → splent_cli-1.29.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "splent_cli"
-version = "1.28.2"
+version = "1.29.1"
 description = "SPLENT-CLI is a CLI to be able to work on your development more easily."
 readme = "README.md"
 requires-python = ">=3.13"

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/feature/feature_release.py

@@ -3,6 +3,7 @@ feature:release — Release a feature: bump version, tag, publish to the git for
 """
 
 import ast
+import json
 import os
 import re
 import shutil
@@ -363,6 +364,83 @@ def _extract_commands(commands_path: Path) -> list[str]:
     return sorted(set(re.findall(r"""@click\.command\s*\(\s*['"]([^'"]+)['"]""", text)))
 
 
+def _call_name(node) -> str:
+    """``click.command`` for the decorator call ``@click.command(...)``."""
+    func = node.func if isinstance(node, ast.Call) else node
+    parts = []
+    while isinstance(func, ast.Attribute):
+        parts.append(func.attr)
+        func = func.value
+    if isinstance(func, ast.Name):
+        parts.append(func.id)
+    return ".".join(reversed(parts))
+
+
+def _literal(node):
+    try:
+        return ast.literal_eval(node)
+    except (ValueError, SyntaxError, TypeError):
+        return None
+
+
+def _first_line(text) -> str:
+    for line in (text or "").strip().splitlines():
+        if line.strip():
+            return line.strip()
+    return ""
+
+
+def _extract_command_help(commands_path: Path) -> dict:
+    """What each command a feature adds is for, and how it is called.
+
+    ``{name: {"usage": "EMAIL ROLE [OPTIONS]", "help": "..."}}``, read from
+    the source without importing it: the arguments in the order they are
+    declared, in click's uppercase, ``[OPTIONS]`` when there are any, and the
+    first line of ``short_help``, ``help`` or the docstring. The marketplace
+    shows it next to each command, which used to be a bare name.
+    """
+    if not commands_path.exists():
+        return {}
+    try:
+        tree = ast.parse(commands_path.read_text())
+    except SyntaxError:
+        return {}
+    found = {}
+    for node in ast.walk(tree):
+        if not isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+            continue
+        name, help_text, usage, has_options = None, "", [], False
+        for deco in node.decorator_list:
+            if not isinstance(deco, ast.Call):
+                continue
+            kind = _call_name(deco)
+            if kind.endswith("command") and deco.args:
+                name = _literal(deco.args[0])
+                kwargs = {k.arg: _literal(k.value) for k in deco.keywords}
+                help_text = kwargs.get("short_help") or kwargs.get("help") or ""
+            elif kind.endswith("argument") and deco.args:
+                arg = _literal(deco.args[0])
+                if not isinstance(arg, str):
+                    continue
+                kwargs = {k.arg: _literal(k.value) for k in deco.keywords}
+                metavar = arg.upper().replace("-", "_")
+                if kwargs.get("nargs") == -1:
+                    metavar += "..."
+                optional = kwargs.get("required") is False or "default" in kwargs
+                usage.append(f"[{metavar}]" if optional else metavar)
+            elif kind.endswith("option"):
+                has_options = True
+        if not isinstance(name, str):
+            continue
+        if has_options:
+            usage.append("[OPTIONS]")
+        found[name] = {
+            "usage": " ".join(usage),
+            "help": _first_line(help_text) or _first_line(ast.get_docstring(node)),
+        }
+    return dict(sorted(found.items()))
+
+
 def _feature_sources(src_dir: Path):
     """The feature's own Python files, without its tests.
 
@@ -693,6 +771,7 @@ def infer_contract(
     templates = _extract_templates(src_dir)
     template_hook_slots = _extract_template_hook_slots(src_dir)
     commands = _extract_commands(src_dir / "commands.py")
+    commands_help = _extract_command_help(src_dir / "commands.py")
     docker = _extract_docker(feature_root)
     docker_contract = _extract_docker_contract(feature_root)
     req_features, env_vars = _scan_dependencies(src_dir, feature_name)
@@ -751,6 +830,7 @@ def infer_contract(
         "blueprints": blueprints,
         "models": models,
         "commands": commands,
+        "commands_help": commands_help,
         "hooks": hooks,
         "services": services,
         "signals": signals_provided,
@@ -945,7 +1025,8 @@ def write_contract(pyproject_path: str, contract: dict, feature_name: str) -> No
         f"signals    = {_toml_value(contract.get('signals', []))}\n"
         f"translations = {_toml_value(contract.get('translations', []))}\n"
         f"docker     = {_toml_value(contract['docker'])}\n"
-        "\n"
+        + _commands_help_block(contract.get("commands_help") or {})
+        + "\n"
         "[tool.splent.contract.requires]\n"
         f"features = {_toml_value(contract['requires_features'])}\n"
         + (
@@ -989,6 +1070,20 @@ def write_contract(pyproject_path: str, contract: dict, feature_name: str) -> No
     path.write_text(text + contract_block + refinement_block)
 
 
+def _commands_help_block(commands_help: dict) -> str:
+    """The ``[tool.splent.contract.provides.commands_help]`` table, or nothing."""
+    if not commands_help:
+        return ""
+    lines = ["\n[tool.splent.contract.provides.commands_help]\n"]
+    for name, entry in commands_help.items():
+        key = name if re.fullmatch(r"[A-Za-z0-9_-]+", name) else json.dumps(name)
+        lines.append(
+            f"{key} = {{ usage = {json.dumps(entry.get('usage', ''))}, "
+            f"help = {json.dumps(entry.get('help', ''))} }}\n"
+        )
+    return "".join(lines)
+
+
 # ── Compile assets ────────────────────────────────────────────────────
 
 

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_build.py

@@ -88,6 +88,16 @@ OPTIONAL_DEPLOY_SETTINGS: tuple[tuple[str, str, tuple[str, ...]], ...] = (
             "trusted proxy. true forces it on every cookie, false never sets it.",
         ),
     ),
+    (
+        "SPLENT_IMAGE",
+        "git.splent.io/<org>/<product>:stable",
+        (
+            "Image the web service runs. Unset means the image built on this",
+            "host. Set it to the image a release publishes, tagged stable, to",
+            "run releases without building here. Every deploy pulls it, and the",
+            "autodeploy feature follows it.",
+        ),
+    ),
     (
         "MAX_CONTENT_LENGTH",
         "64M",
@@ -551,9 +561,34 @@ def _apply_restart_policy(svc_def: dict) -> None:
     svc_def["restart"] = RESTART_POLICY
 
 
+def resolve_product_placeholders(value: str, product: str, *, prod: bool) -> str:
+    """Resolve ``__PRODUCT__`` in a feature's value for this product.
+
+    ``__PRODUCT___web`` is the product's web container, which is
+    ``<product>_web`` in development and ``<product>_web_deploy`` in
+    production (the prod compose template names it). Every other
+    ``__PRODUCT__`` is the product name. product:build and
+    product:env --merge --prod both write .env.deploy, so both go through
+    this: the merge used to replace the plain name only and point a feature
+    at the development container's name in production.
+    """
+    if "__PRODUCT__" not in value:
+        return value
+    if prod:
+        value = value.replace("__PRODUCT___web", f"{product}_web_deploy")
+    return value.replace("__PRODUCT__", product)
+
+
+def local_or_registry_image(product: str) -> str:
+    """The web image of a deploy: ``SPLENT_IMAGE`` when set, else the local build."""
+    return "${SPLENT_IMAGE:-" + product + ":latest}"
+
+
 def apply_production_policies(compose_data: dict, product: str) -> dict:
     """Give every deployed service a restart policy, and the web and database
-    services a healthcheck, unless the compose file already set one.
+    services a healthcheck, unless the compose file already set one. The web
+    image becomes ``${SPLENT_IMAGE:-<product>:latest}``, so a host can run the
+    image a release published instead of building its own.
 
     Applied by product:build to the merged deploy compose, so every product
     gets it on its next build, whatever its docker-compose.prod.yml says and
@@ -570,6 +605,11 @@ def apply_production_policies(compose_data: dict, product: str) -> dict:
     )
     if web_name and isinstance(services[web_name], dict):
         services[web_name].setdefault("healthcheck", dict(WEB_HEALTHCHECK))
+        # The local build, unless .env.deploy names a registry image. Only the
+        # plain local name is rewritten: an image the product chose on purpose
+        # is left alone.
+        if services[web_name].get("image") == f"{product}:latest":
+            services[web_name]["image"] = local_or_registry_image(product)
 
     db_name = next(
         (n for n in (f"{product}_db_deploy", f"{product}_db") if n in services),
@@ -1109,10 +1149,7 @@ def product_build(no_image, skip_preflight):
     # share the product network, so the prod service cannot simply take the
     # dev name as an alias. The CLI owns both names, so it owns the mapping.
     for k, v in env_result.items():
-        if "__PRODUCT__" in v:
-            env_result[k] = v.replace(
-                "__PRODUCT___web", f"{product}_web_deploy"
-            ).replace("__PRODUCT__", product)
+        env_result[k] = resolve_product_placeholders(v, product, prod=True)
 
     # Remove __FEATURE_HOST_DIR__ variables — not needed in prod
     # (templates are baked into Docker images, no bind mounts)

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_create.py

@@ -13,7 +13,12 @@ from jinja2 import Environment, FileSystemLoader, select_autoescape
 
 from splent_cli.utils.path_utils import PathUtils
 from splent_cli.services import context, spl_store
-from splent_cli.utils.template_drift import is_reserved_repo_name, not_a_product_reason
+from splent_cli.utils.template_drift import (
+    DEFAULT_UPGRADE_SCHEDULE,
+    is_reserved_repo_name,
+    not_a_product_reason,
+)
+from splent_cli.utils.template_drift import _forge_host as _template_forge_host
 
 try:
     from importlib.metadata import version as _pkg_version
@@ -218,6 +223,10 @@ def make_product(name, spl_name, spl_doi, features_file, force):
         # Dropping it here made every product created this way fall back to
         # "<name>.uvl" and 404, with nothing local left that knew the real name.
         "spl_file": pin.file or "",
+        # The forge workflows. The same values product:sync-template --ci
+        # renders, so a new product does not start out drifted.
+        "forge_host": _template_forge_host(),
+        "upgrade_schedule": DEFAULT_UPGRADE_SCHEDULE,
         # Production persistence. These switch on the named-volume mounts in
         # the prod compose template so uploads survive redeploys. Products
         # scaffolded before these variables existed render without them and
@@ -304,6 +313,8 @@ def _write_product(env, name, base_path, template_ctx):
         "scripts/05_0_start_app_dev.sh": "product/product_05_0_start_app_dev.sh.j2",
         "scripts/05_1_start_app_prod.sh": "product/product_05_1_start_app_prod.sh.j2",
         ".gitignore": "product/product_.gitignore.j2",
+        ".forgejo/workflows/splent-validate.yml": "product/product_ci_validate.yml.j2",
+        ".forgejo/workflows/splent-upgrade.yml": "product/product_ci_upgrade.yml.j2",
         "LICENSE": "product/product_LICENSE.j2",
         "package.json": "product/product_package.json.j2",
         "pyproject.toml": "product/product_pyproject.toml.j2",

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_deploy.py

@@ -441,9 +441,18 @@ def product_deploy(down, ci):
                 )
                 continue
             if ci:
-                env_value = os.getenv(key)
+                # The environment first. Without it, whatever the interactive
+                # deploy would offer as a default is taken (a random string
+                # for a secret, the conventional database names), so a feature
+                # that ships a <SET> secret does not stop an unattended deploy.
+                # What only the operator knows still has to come from them.
+                env_value = os.getenv(key) or suggest_value(key, product)
                 if env_value:
                     env_vars[key] = env_value
+                    if not os.getenv(key):
+                        click.echo(
+                            click.style("  secret   ", dim=True) + f"{key} generated"
+                        )
                 else:
                     missing_vars.append(key)
             else:
@@ -624,6 +633,41 @@ def product_deploy(down, ci):
     # container starts.
     compose.ensure_network(compose.network_name(product))
 
+    # A registry image (SPLENT_IMAGE) is pulled first: Compose only pulls an
+    # image it does not have, so a host that already ran an older build of
+    # the same tag would otherwise redeploy that one.
+    image = (env_vars.get("SPLENT_IMAGE") or "").strip()
+    if "/" in image:
+        click.echo(click.style("  image    ", dim=True) + f"pulling {image}")
+        pulled = subprocess.run(
+            [
+                "docker",
+                "compose",
+                "-p",
+                compose.deploy_project_name(product),
+                "-f",
+                compose_path,
+                "--env-file",
+                env_path,
+                "pull",
+                f"{product}_web_deploy",
+            ],
+            capture_output=True,
+            text=True,
+            cwd=docker_dir,
+            env={**os.environ, **host_docker_dir_env(workspace, product)},
+        )
+        if pulled.returncode != 0:
+            click.secho(f"  Could not pull {image}.", fg="red")
+            detail = (pulled.stderr or pulled.stdout or "").strip().splitlines()
+            for line in detail[-5:]:
+                click.echo(f"    {line}")
+            click.echo(
+                "  Check SPLENT_IMAGE in docker/.env.deploy, and docker login to "
+                "that registry when the image is private."
+            )
+            raise SystemExit(1)
+
     click.echo(click.style("  deploying ", dim=True) + f"{product} (prod)...")
 
     try:

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_env.py

@@ -368,11 +368,18 @@ def product_env(generate, merge, env_name, process_all):
         # second product of the same line came up.
         merged["SPLENT_NETWORK"] = compose.network_name(product)
 
-        # Replace __PRODUCT__ placeholder with the actual product name
+        # Replace __PRODUCT__ placeholder with the actual product name.
+        # product_build imports this module, so the helper is imported here.
+        from splent_cli.commands.product.product_build import (
+            resolve_product_placeholders,
+        )
+
         product_replaced = []
         for k, v in merged.items():
             if "__PRODUCT__" in v:
-                merged[k] = v.replace("__PRODUCT__", product)
+                merged[k] = resolve_product_placeholders(
+                    v, product, prod=env_name == "prod"
+                )
                 product_replaced.append(k)
 
         if env_name == "prod":

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_release.py

@@ -1,16 +1,19 @@
 """
-product:release — Release a product with version bump, tag, GitHub/PyPI/Docker Hub.
+product:release, a product release: version bump, tag, forge, PyPI and the image.
 """
 
+import contextlib
+import json
 import os
 import subprocess
+import tempfile
 
 import click
 from splent_cli.commands.product.product_build import (
     build_production_image,
     production_dockerfile,
 )
-from splent_cli.services import context, release, release_gate
+from splent_cli.services import context, image_registry, release, release_gate
 from splent_cli.utils.proc import run, require_docker
 
 
@@ -51,19 +54,73 @@ def _guard_all_features_pinned(product_path: str):
     raise SystemExit(1)
 
 
-def release_docker_image(product: str, version: str, docker_dir: str):
-    """Build the production image and push it to Docker Hub.
+def release_targets(product: str, version: str, product_path: str, org: str):
+    """The registries this release pushes the image to, from the product's pyproject."""
+    try:
+        registries, mirrors = image_registry.declared_registries(
+            os.path.join(product_path, "pyproject.toml")
+        )
+    except image_registry.RegistryDeclarationError as e:
+        click.secho(f"  error: {e}", fg="red")
+        raise SystemExit(1)
+    return image_registry.image_targets(product, version, org, registries, mirrors)
+
+
+#: Docker Hub answers to these names in a client's configuration.
+_DOCKER_HUB_HOSTS = ("index.docker.io", "registry-1.docker.io", "docker.io")
+
+
+@contextlib.contextmanager
+def registry_session(hosts=()):
+    """A docker client configuration of its own for one release's logins and pushes.
+
+    The host's configuration may hand credentials to a helper, the macOS
+    keychain under Docker Desktop, and that helper refuses to store a login
+    for a host the keychain already holds a git password for ("The specified
+    item already exists in the keychain"), which stopped the marketplace's
+    first release. A configuration of its own also keeps the release tokens
+    off the machine: it is deleted when the release is done.
+    """
+    # An empty credsStore is not enough: the docker client then detects the
+    # platform's helper again. An empty helper per host is what makes it keep
+    # the login in this file.
+    helpers = {host: "" for host in (*hosts, *_DOCKER_HUB_HOSTS) if host}
+    with tempfile.TemporaryDirectory(prefix="splent-docker-") as config_dir:
+        with open(os.path.join(config_dir, "config.json"), "w") as handle:
+            json.dump({"auths": {}, "credHelpers": helpers}, handle)
+        yield {**os.environ, "DOCKER_CONFIG": config_dir}
+
+
+def _login(target, env=None) -> bool:
+    user, secret = target.credentials()
+    if not user or not secret:
+        return False
+    command = ["docker", "login", "-u", user, "--password-stdin"]
+    if target.host:
+        command.insert(2, target.host)
+    try:
+        run(command, input=secret, capture=True, env=env)
+    except subprocess.CalledProcessError:
+        return False
+    return True
+
+
+def release_docker_image(product: str, version: str, docker_dir: str, targets):
+    """Build the production image once and push it to every registry.
 
     Public because release:resume has to be able to finish this channel too:
     the image is pushed last, after the forge and PyPI are already
     irreversible.
 
     The image is the one product:build makes, docker/Dockerfile.<product>.prod
-    built with the workspace as context, so what Docker Hub serves is what a
-    deploy runs. Building ``docker_dir`` with no Dockerfile named would look
-    for docker/Dockerfile, which products do not have. build_production_image
-    stages the SPL's UVL model first, so the pushed image ships the model the
-    product pins even from a clean clone where product:build never ran.
+    built with the workspace as context, so what a registry serves is what a
+    deploy runs. build_production_image stages the SPL's UVL model first, so
+    the pushed image ships the model the product pins even from a clean clone
+    where product:build never ran.
+
+    Each registry gets the version tag and the ``stable`` channel tag (Docker
+    Hub also ``latest``). A required registry that refuses the login or the
+    push stops the release here; a mirror that does is reported and skipped.
     """
     require_docker()
 
@@ -76,50 +133,52 @@ def release_docker_image(product: str, version: str, docker_dir: str):
         )
         raise SystemExit(1)
 
-    username = os.getenv("DOCKERHUB_USERNAME")
-    password = os.getenv("DOCKERHUB_PASSWORD")
-    missing = [
-        name
-        for name, value in (
-            ("DOCKERHUB_USERNAME", username),
-            ("DOCKERHUB_PASSWORD", password),
-        )
-        if not value
-    ]
-    if missing:
-        click.secho(
-            "  error: missing Docker Hub credentials: "
-            + ", ".join(missing)
-            + "\n  Set them in your environment (e.g. export DOCKERHUB_USERNAME=... "
-            "DOCKERHUB_PASSWORD=...) before releasing.",
-            fg="red",
-        )
-        raise SystemExit(1)
-
-    image_name = f"{username}/{product}"
-
-    click.echo("  docker   logging into Docker Hub...")
-    run(
-        ["docker", "login", "-u", username, "--password-stdin"],
-        input=password,
-        capture=True,
-    )
-
-    click.echo("  docker   building image...")
-    try:
-        build_production_image(
-            product,
-            str(context.workspace()),
-            docker_dir,
-            [f"{image_name}:{version}", f"{image_name}:latest"],
-        )
-    except subprocess.CalledProcessError:
-        click.secho("  error: Docker image build failed.", fg="red")
-        raise SystemExit(1)
-
-    click.echo("  docker   pushing images...")
-    run(["docker", "push", f"{image_name}:{version}"])
-    run(["docker", "push", f"{image_name}:latest"])
+    with registry_session([t.host for t in targets]) as docker_env:
+        usable = []
+        for target in targets:
+            click.echo(f"  docker   logging into {target.label}...")
+            if _login(target, docker_env):
+                usable.append(target)
+                continue
+            if target.mirror:
+                click.secho(
+                    f"  docker   the {target.label} mirror is left out, its login "
+                    f"failed or {' / '.join(target.credential_names())} are not set",
+                    fg="yellow",
+                )
+                continue
+            user_env, secret_env = target.credential_names()
+            click.secho(
+                f"  error: could not log into {target.label}. Check {user_env} and "
+                f"{secret_env}.",
+                fg="red",
+            )
+            raise SystemExit(1)
+
+        refs = [ref for target in usable for ref in target.refs]
+        click.echo("  docker   building image...")
+        try:
+            build_production_image(product, str(context.workspace()), docker_dir, refs)
+        except subprocess.CalledProcessError:
+            click.secho("  error: Docker image build failed.", fg="red")
+            raise SystemExit(1)
+
+        for target in usable:
+            click.echo(f"  docker   pushing to {target.label}...")
+            try:
+                for ref in target.refs:
+                    run(["docker", "push", ref], env=docker_env)
+            except subprocess.CalledProcessError:
+                if target.mirror:
+                    click.secho(
+                        f"  docker   the push to the {target.label} mirror failed "
+                        "and is left out",
+                        fg="yellow",
+                    )
+                    continue
+                click.secho(f"  error: the push to {target.label} failed.", fg="red")
+                raise SystemExit(1)
+            click.echo(f"  docker   {', '.join(target.refs)}")
 
     click.echo("  docker   push complete")
 
@@ -139,7 +198,7 @@ def _left_out_flags(channels) -> list[str]:
 
 @click.command(
     "product:release",
-    short_help="Release a product: version bump, tag, forge/PyPI/Docker Hub.",
+    short_help="Release a product: version bump, tag, forge, PyPI and image registries.",
 )
 @click.argument("version", required=False, default=None)
 @click.option("--product", default=None, help="Override SPLENT_APP.")
@@ -210,7 +269,7 @@ def product_release(
         raise SystemExit(1)
     org, repo_name = parts
 
-    # Docker Hub is a third channel, and it is the one that publishes LAST, so
+    # The image is a third channel, and it is the one that publishes LAST, so
     # it is the one most able to diverge. It goes through the gate with the
     # others instead of being discovered at the end.
     channels = release.resolve_channels(
@@ -250,7 +309,12 @@ def product_release(
 
     def _docker_hook(_path, ver):
         if release_gate.DOCKER in channels:
-            release_docker_image(product, ver, docker_dir)
+            release_docker_image(
+                product,
+                ver,
+                docker_dir,
+                release_targets(product, ver, product_path, org),
+            )
 
     release.run_release_pipeline(
         product,
@@ -262,8 +326,9 @@ def product_release(
         channels=channels,
         resume_target=resume_target,
         allow_unfinished=allow_unfinished,
-        docker_image=f"{os.getenv('DOCKERHUB_USERNAME', '')}/{product}".lstrip("/")
-        or None,
+        image_targets=release_targets(product, version, product_path, org)
+        if release_gate.DOCKER in channels
+        else None,
         post_pypi_hook=_docker_hook,
         wait=wait,
     )

{splent_cli-1.28.2 → splent_cli-1.29.1}/src/splent_cli/commands/product/product_sync_template.py

@@ -37,6 +37,12 @@ from splent_cli.utils.template_drift import (
     is_flag=True,
     help="Update only docker/ files.",
 )
+@click.option(
+    "--ci",
+    "only_ci",
+    is_flag=True,
+    help="Update only the forge workflows in .forgejo/workflows/.",
+)
 @click.option(
     "--dry-run",
     is_flag=True,
@@ -48,6 +54,7 @@ def product_sync_template(
     only_scripts,
     only_entrypoints,
     only_docker,
+    only_ci,
     dry_run,
     yes,
 ):
@@ -60,6 +67,7 @@ def product_sync_template(
         splent product:sync-template myapp
         splent product:sync-template myapp --scripts
         splent product:sync-template myapp --docker
+        splent product:sync-template myapp --ci
         splent product:sync-template myapp --dry-run
         splent product:sync-template myapp --yes
     """
@@ -72,7 +80,7 @@ def product_sync_template(
     product_path = resolve_product_dir(workspace, product_name)
 
     # Select which groups to process
-    filter_active = only_scripts or only_entrypoints or only_docker
+    filter_active = only_scripts or only_entrypoints or only_docker or only_ci
     groups_to_run: dict[str, dict] = {}
     if not filter_active or only_scripts:
         groups_to_run["scripts"] = PRODUCT_GROUPS["scripts"]
@@ -80,6 +88,8 @@ def product_sync_template(
         groups_to_run["entrypoints"] = PRODUCT_GROUPS["entrypoints"]
     if not filter_active or only_docker:
         groups_to_run["docker"] = PRODUCT_GROUPS["docker"]
+    if not filter_active or only_ci:
+        groups_to_run["ci"] = PRODUCT_GROUPS["ci"]
 
     ctx = product_ctx(product_name)