feat(nx-cloudflare): add D1 migrations and secrets executors#190
Merged
Conversation
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
gonx-docs | 4182a64 | Commit Preview URL Branch Preview URL |
Jun 28 2026, 06:17 PM |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nx-cloudflare | 4182a64 | Commit Preview URL Branch Preview URL |
Jun 28 2026, 06:18 PM |
|
View your CI Pipeline Execution ↗ for commit 4182a64
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx affected -t e2e --parallel=1 |
✅ Succeeded | 1m 55s | View ↗ |
nx affected -t build --yes |
✅ Succeeded | 15s | View ↗ |
nx affected -t lint test |
✅ Succeeded | 33s | View ↗ |
nx-cloud record -- nx format:check |
✅ Succeeded | 1s | View ↗ |
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗
☁️ Nx Cloud last updated this comment at 2026-06-25 12:42:24 UTC
…inference tests and JSDoc
…er; tighten docs, comments, and tests Addresses PR review: parse the wrangler config once (readValidConfig returns the parsed object), warn instead of silently dropping malformed d1_databases entries, surface a hint when wrangler is not on PATH (ENOENT), correct the d1-list docs and the executor-target passthrough note, fix stale comments and a stale test name, and add the missing arg-builder test cases.
…ommands pages Cloudflare split the single wrangler commands page into per-product subpages. Point the lifecycle/secret links at .../commands/workers/ and the D1 links at .../commands/d1/, and update the versions anchor to #versions-upload. All targets' anchors verified against the live pages.
Distinguishes the auto-generated API reference from the hand-written reference pages (e.g. Inferred targets) that share the Reference section.
Adds task-oriented guides under Guides > Targets (mirroring the gonx docs' Generators/Executors split): a full D1 migration workflow (create -> write SQL -> apply local -> apply remote, plus list, multi-DB, environments, and CI chaining) and secrets management (.dev.vars for local dev; put/bulk/list/delete for the deployed Worker, with environments). The Inferred targets reference stays the catalog; the guides link to it.
NachoVazquez
force-pushed
the
feat/nx-cloudflare-d1-secrets
branch
from
c0925d0 to
ea74ebe
Compare
…mmands Standardize all inferred-target invocations in the README, docs site, and e2e specs on the `nx run <project>:<target>` form. Generator (`nx g`), `nx add`, `nx show project`, `nx reset`, and `nx migrate` commands are left as-is since they are not target runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Adding a D1- or secrets-bearing Worker via the
bindinggenerator left a "Day 2" gap: applying D1 migrations and managing Worker secrets meant dropping to rawwranglercommands. This PR adds two inference-driven executors, sonx d1-apply <worker>,nx secret-put <worker> --name=API_KEY, and five more targets work out of the box — with typed, validated options.Files to review (16, +670 / -7):
src/plugin.ts(start here)d1_databasesand emits the new targets pointing at the executors.src/executors/d1/executor.tswrangler d1 migrations apply/create/list— purebuildD1Args+ thin executor.src/executors/secret/executor.tswrangler secret put/bulk/list/delete—buildSecretArgs+ executor (inherits stdio for interactiveput).src/utils/run-wrangler.tsexecutors.json·package.json·project.jsonsrc/plugin.spec.ts(tests)README.md·docs/nx-cloudflare-docs/.../inferred-targets.mdWhy
The
bindinggenerator (#185) wires a D1/KV/R2/Queue binding intowrangler.jsonc, but the plugin had no way to operate those resources afterward. A D1 binding with no migration workflow is half a feature, and secrets were entirely manual. This closes that gap for D1 migrations and secrets.How
Two executors, each a
command-discriminated wrapper that inference points targets at::d1runswrangler d1 migrations <command> <database>. Inference emitsd1-apply/d1-create/d1-listperd1_databasesentry — bare names with one binding, suffixed (d1-apply-DB) when a Worker has several — baking thedatabase_nameinto the target's options.:secretrunswrangler secret <command>. Inference always emitssecret-put/secret-bulk/secret-list/secret-delete, since secrets aren't declared in the config and so have no signal to gate on.Each executor splits a pure arg-builder (unit-tested) from
run-wrangler.ts(the side effects), mirroring the existingrun-wrangler-types.tspattern. All seven target names are overridable viaCloudflarePluginOptions.Reviewer notes
nx migrateentry needed.applydefaults to local.d1-applypasses--local; production opts in with--remote. D1 commands always pass one explicitly because wrangler requires it.secret-putprompts interactively (the executor inherits stdio);bulkreads a JSON file. The executor never accepts or logs a value.plugin.ts(consistent with the jsonc-onlybindinggenerator).readD1Databasesnever throws — malformed or partial entries are dropped.Tests
Unit (
bun test): D1 (5) and secret (6) arg-builder cases asserting exact argv per command/option, plus inference tests covering D1 gating, single/multi-db naming, always-on secret targets, and name overrides.e2e (
nx-cloudflare-e2e/src/executors.spec.ts, against the published tarball): one test asserts the plugin infers thed1-*/secret-*targets with the right executor refs and baked options; a second runsnx d1-list <app> --remoteandnx secret-list <app>withwranglerstubbed innode_modules/.bin, asserting the executor invokeswrangler d1 migrations list my-db --remoteandwrangler secret list. This covers therun-wrangler/ExecutorContextpath end-to-end.nx test,nx lint,nx buildfornx-cloudflareand the new e2e all pass.Links