sng detect

Beta

Being rolled out. The interface described here is the one of the next release: it may still change, and may not be enabled on your tenant yet.

sng detect is being rolled out in the CLI.

sng detect [PATH] [-v] [--no-oidc]

Scans a folder (default .) and prints one row per program: language, framework, port. In a terminal, an assistant then offers to fix the result, to generate a Dockerfile and an App manifest per program, then to create an OIDC trust for your GitLab repository. A session is optional.

A program is a folder that holds a build file: go.mod (one program per main package: root and cmd/*), package.json, pyproject.toml, requirements.txt or Pipfile, composer.json. Recognized languages: Go, Node / TypeScript, Python, PHP. A tooling package.json (vite, lint) next to a composer.json or a requirements.txt is not a second program.

Flag	Effect
-v, --verbose	adds where the port was read from
--no-oidc	skips the last step (OIDC trust)
--json	structured list (name, path, language, framework, port, portSource, portFrom); nothing is asked or written

sng detect . -v

PATH     NAME  LANGUAGE    FRAMEWORK  PORT               FROM
cmd/api  api   go          chi        8080               internal/config/config.go HTTP_ADDR
ui       ui    typescript  next       3000 (dockerfile)  -
jobs     jobs  python      fastapi    8000 (default)     -

The port is read from the code (a Go binary is followed through its imports: a getenv("HTTP_ADDR", ":8080") counts; metrics, probe and internal ports rank after the main one), then from a Dockerfile EXPOSE, a compose file, a .env PORT, and finally the framework default. - means there is no server.

The assistant

In a terminal, the table is followed by four questions. Outside a terminal (redirection) or with --json, nothing is asked and nothing is written. ACCESSIBLE=1 gives plain-text questions (screen readers).

1. Is the result right? Answering no lets you tick the programs to fix, then edit only the wrong fields (name, language, framework, port); the table is shown again until you confirm. A corrected port is marked (user).
2. Generate? For each program: a Dockerfile in its folder and an App manifest in stackngo/<name>.yaml (one service, the port, and HTTPS access when the program listens). An existing file is only overwritten after confirmation.
3. Image: the proposed name is that of the Dockerfile's folder, tag latest; Enter accepts it, or type your own (registry/name:tag).
4. OIDC trust: see below.

Then build and push the images (sng registry build), and apply: sng apply stackngo/.

Non-root Dockerfiles

The generated Dockerfiles (Go, Node, Python, PHP) never run the program as root: they run under a numeric identifier, 65532:65532 (101:101 for a static site served by nginx). The generated App manifest declares the same user (user). For PHP, Apache listens on port 8080, without privileges.

OIDC trust for your GitLab repository

Last step, only if at least one App was generated and the folder is a GitLab repository: sng detect offers to create an OIDC trust limited to this repository and its current branch, so that the jobs of that branch can deploy without a secret. The rights granted are minimal: apply the generated Apps and push their images to the platform registry; never deletion, secrets or identity management. A 30-minute session.

Before anything is created, a summary lists the repository, the branch, every right and what remains forbidden. The default answer is no; Ctrl-C or Esc mean no, and nothing is created.

Situation	Behavior
No active branch (detached HEAD)	the branch is asked
Private GitLab project	the project number (Project ID) is asked; no GitLab token is ever read
Equivalent trust already present	it is reused; nothing is modified or deleted
No session, or insufficient rights (policy:admin, oidctrust:admin)	the sng tenant policy create, sng tenant oidc create and policy attach commands to run are printed
Non-GitLab repository	the step is skipped

--no-oidc skips the step. See also sng tenant oidc.

Typical errors

Symptom	Cause
no program listed	no recognized build file in the folder
PORT at -	no server detected: fix it in the assistant if the program listens

See also

• sng run: run a folder without a manifest
• sng registry build, sng apply