@backstage/plugin-scaffolder-backend 0.15.13 → 0.15.17

package/dist/index.cjs.js

@@ -5,17 +5,17 @@ Object.defineProperty(exports, '__esModule', { value: true });
 var errors = require('@backstage/errors');
 var catalogModel = require('@backstage/catalog-model');
 var fs = require('fs-extra');
-var path = require('path');
 var yaml = require('yaml');
 var backendCommon = require('@backstage/backend-common');
+var path = require('path');
 var globby = require('globby');
-var nunjucks = require('nunjucks');
 var isbinaryfile = require('isbinaryfile');
+var vm2 = require('vm2');
 var pluginScaffolderBackendModuleCookiecutter = require('@backstage/plugin-scaffolder-backend-module-cookiecutter');
 var child_process = require('child_process');
 var stream = require('stream');
 var azureDevopsNodeApi = require('azure-devops-node-api');
-var fetch = require('cross-fetch');
+var fetch = require('node-fetch');
 var integration = require('@backstage/integration');
 var rest = require('@octokit/rest');
 var lodash = require('lodash');
@@ -27,6 +27,7 @@ var luxon = require('luxon');
 var Handlebars = require('handlebars');
 var winston = require('winston');
 var jsonschema = require('jsonschema');
+var nunjucks = require('nunjucks');
 var express = require('express');
 var Router = require('express-promise-router');
 var os = require('os');
@@ -44,26 +45,23 @@ function _interopNamespace(e) {
         var d = Object.getOwnPropertyDescriptor(e, k);
         Object.defineProperty(n, k, d.get ? d : {
           enumerable: true,
-          get: function () {
-            return e[k];
-          }
+          get: function () { return e[k]; }
         });
       }
     });
   }
-  n['default'] = e;
+  n["default"] = e;
   return Object.freeze(n);
 }
 
 var fs__default = /*#__PURE__*/_interopDefaultLegacy(fs);
-var path__namespace = /*#__PURE__*/_interopNamespace(path);
-var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
 var yaml__namespace = /*#__PURE__*/_interopNamespace(yaml);
+var path__default = /*#__PURE__*/_interopDefaultLegacy(path);
 var globby__default = /*#__PURE__*/_interopDefaultLegacy(globby);
-var nunjucks__default = /*#__PURE__*/_interopDefaultLegacy(nunjucks);
 var fetch__default = /*#__PURE__*/_interopDefaultLegacy(fetch);
 var Handlebars__namespace = /*#__PURE__*/_interopNamespace(Handlebars);
 var winston__namespace = /*#__PURE__*/_interopNamespace(winston);
+var nunjucks__default = /*#__PURE__*/_interopDefaultLegacy(nunjucks);
 var express__default = /*#__PURE__*/_interopDefaultLegacy(express);
 var Router__default = /*#__PURE__*/_interopDefaultLegacy(Router);
 var os__default = /*#__PURE__*/_interopDefaultLegacy(os);
@@ -73,7 +71,7 @@ const createTemplateAction = (templateAction) => {
 };
 
 function createCatalogRegisterAction(options) {
-  const {catalogClient, integrations} = options;
+  const { catalogClient, integrations } = options;
   return createTemplateAction({
     id: "catalog:register",
     description: "Registers entities from a catalog descriptor file in the workspace into the software catalog.",
@@ -122,12 +120,12 @@ function createCatalogRegisterAction(options) {
     },
     async handler(ctx) {
       var _a;
-      const {input} = ctx;
+      const { input } = ctx;
       let catalogInfoUrl;
       if ("catalogInfoUrl" in input) {
         catalogInfoUrl = input.catalogInfoUrl;
       } else {
-        const {repoContentsUrl, catalogInfoPath = "/catalog-info.yaml"} = input;
+        const { repoContentsUrl, catalogInfoPath = "/catalog-info.yaml" } = input;
         const integration = integrations.byUrl(repoContentsUrl);
         if (!integration) {
           throw new errors.InputError(`No integration found for host ${repoContentsUrl}`);
@@ -141,15 +139,15 @@ function createCatalogRegisterAction(options) {
       await catalogClient.addLocation({
         type: "url",
         target: catalogInfoUrl
-      }, ctx.token ? {token: ctx.token} : {});
+      }, ctx.token ? { token: ctx.token } : {});
       try {
         const result = await catalogClient.addLocation({
           dryRun: true,
           type: "url",
           target: catalogInfoUrl
-        }, ctx.token ? {token: ctx.token} : {});
+        }, ctx.token ? { token: ctx.token } : {});
         if (result.entities.length > 0) {
-          const {entities} = result;
+          const { entities } = result;
           const entity = (_a = entities.find((e) => !e.metadata.name.startsWith("generated-"))) != null ? _a : entities[0];
           ctx.output("entityRef", catalogModel.stringifyEntityRef(entity));
         }
@@ -181,8 +179,8 @@ function createCatalogWriteAction() {
     },
     async handler(ctx) {
       ctx.logStream.write(`Writing catalog-info.yaml`);
-      const {entity} = ctx.input;
-      await fs__default['default'].writeFile(path.resolve(ctx.workspacePath, "catalog-info.yaml"), yaml__namespace.stringify(entity));
+      const { entity } = ctx.input;
+      await fs__default["default"].writeFile(backendCommon.resolveSafeChildPath(ctx.workspacePath, "catalog-info.yaml"), yaml__namespace.stringify(entity));
     }
   });
 }
@@ -226,7 +224,7 @@ ${files.map((f) => `  - ${path.relative(ctx.workspacePath, f)}`).join("\n")}`);
 async function recursiveReadDir(dir) {
   const subdirs = await fs.readdir(dir);
   const files = await Promise.all(subdirs.map(async (subdir) => {
-    const res = path.resolve(dir, subdir);
+    const res = path.join(dir, subdir);
     return (await fs.stat(res)).isDirectory() ? recursiveReadDir(res) : [res];
   }));
   return files.reduce((a, f) => a.concat(f), []);
@@ -250,8 +248,8 @@ async function fetchContents({
   }
   if (!fetchUrlIsAbsolute && (baseUrl == null ? void 0 : baseUrl.startsWith("file://"))) {
     const basePath = baseUrl.slice("file://".length);
-    const srcDir = backendCommon.resolveSafeChildPath(path__namespace.dirname(basePath), fetchUrl);
-    await fs__default['default'].copy(srcDir, outputPath);
+    const srcDir = backendCommon.resolveSafeChildPath(path__default["default"].dirname(basePath), fetchUrl);
+    await fs__default["default"].copy(srcDir, outputPath);
   } else {
     let readUrl;
     if (fetchUrlIsAbsolute) {
@@ -269,13 +267,13 @@ async function fetchContents({
       throw new errors.InputError(`Failed to fetch, template location could not be determined and the fetch URL is relative, ${fetchUrl}`);
     }
     const res = await reader.readTree(readUrl);
-    await fs__default['default'].ensureDir(outputPath);
-    await res.dir({targetDir: outputPath});
+    await fs__default["default"].ensureDir(outputPath);
+    await res.dir({ targetDir: outputPath });
   }
 }
 
 function createFetchPlainAction(options) {
-  const {reader, integrations} = options;
+  const { reader, integrations } = options;
   return createTemplateAction({
     id: "fetch:plain",
     description: "Downloads content and places it in the workspace, or optionally in a subdirectory specified by the 'targetPath' input option.",
@@ -313,9 +311,102 @@ function createFetchPlainAction(options) {
   });
 }
 
-nunjucks__default['default'].installJinjaCompat();
+const mkScript = (nunjucksSource) => `
+const { render, renderCompat } = (() => {
+  const module = {};
+  const process = { env: {} };
+  const require = (pkg) => { if (pkg === 'events') { return function (){}; }};
+
+  ${nunjucksSource}
+
+  const env = module.exports.configure({
+    autoescape: false,
+    tags: {
+      variableStart: '\${{',
+      variableEnd: '}}',
+    },
+  });
+
+  const compatEnv = module.exports.configure({
+    autoescape: false,
+    tags: {
+      variableStart: '{{',
+      variableEnd: '}}',
+    },
+  });
+  compatEnv.addFilter('jsonify', compatEnv.getFilter('dump'));
+
+  if (typeof parseRepoUrl !== 'undefined') {
+    const safeHelperRef = parseRepoUrl;
+
+    env.addFilter('parseRepoUrl', repoUrl => {
+      return JSON.parse(safeHelperRef(repoUrl))
+    });
+    env.addFilter('projectSlug', repoUrl => {
+      const { owner, repo } = JSON.parse(safeHelperRef(repoUrl));
+      return owner + '/' + repo;
+    });
+  }
+
+  let uninstallCompat = undefined;
+
+  function render(str, values) {
+    try {
+      if (uninstallCompat) {
+        uninstallCompat();
+        uninstallCompat = undefined;
+      }
+      return env.renderString(str, JSON.parse(values));
+    } catch (error) {
+      // Make sure errors don't leak anything
+      throw new Error(String(error.message));
+    }
+  }
+
+  function renderCompat(str, values) {
+    try {
+      if (!uninstallCompat) {
+        uninstallCompat = module.exports.installJinjaCompat();
+      }
+      return compatEnv.renderString(str, JSON.parse(values));
+    } catch (error) {
+      // Make sure errors don't leak anything
+      throw new Error(String(error.message));
+    }
+  }
+
+  return { render, renderCompat };
+})();
+`;
+class SecureTemplater {
+  static async loadRenderer(options = {}) {
+    const { parseRepoUrl, cookiecutterCompat } = options;
+    let sandbox = void 0;
+    if (parseRepoUrl) {
+      sandbox = {
+        parseRepoUrl: (url) => JSON.stringify(parseRepoUrl(url))
+      };
+    }
+    const vm = new vm2.VM({ sandbox });
+    const nunjucksSource = await fs__default["default"].readFile(backendCommon.resolvePackagePath("@backstage/plugin-scaffolder-backend", "assets/nunjucks.js.txt"), "utf-8");
+    vm.run(mkScript(nunjucksSource));
+    const render = (template, values) => {
+      if (!vm) {
+        throw new Error("SecureTemplater has not been initialized");
+      }
+      vm.setGlobal("templateStr", template);
+      vm.setGlobal("templateValues", JSON.stringify(values));
+      if (cookiecutterCompat) {
+        return vm.run(`renderCompat(templateStr, templateValues)`);
+      }
+      return vm.run(`render(templateStr, templateValues)`);
+    };
+    return render;
+  }
+}
+
 function createFetchTemplateAction(options) {
-  const {reader, integrations} = options;
+  const { reader, integrations } = options;
   return createTemplateAction({
     id: "fetch:template",
     description: "Downloads a skeleton, templates variables into file and directory names and content, and places the result in the workspace, or optionally in a subdirectory specified by the 'targetPath' input option.",
@@ -364,7 +455,7 @@ function createFetchTemplateAction(options) {
       var _a;
       ctx.logger.info("Fetching template content from remote URL");
       const workDir = await ctx.createTemporaryDirectory();
-      const templateDir = path.resolve(workDir, "template");
+      const templateDir = backendCommon.resolveSafeChildPath(workDir, "template");
       const targetPath = (_a = ctx.input.targetPath) != null ? _a : "./";
       const outputDir = backendCommon.resolveSafeChildPath(ctx.workspacePath, targetPath);
       if (ctx.input.copyWithoutRender && !Array.isArray(ctx.input.copyWithoutRender)) {
@@ -388,35 +479,26 @@ function createFetchTemplateAction(options) {
         outputPath: templateDir
       });
       ctx.logger.info("Listing files and directories in template");
-      const allEntriesInTemplate = await globby__default['default'](`**/*`, {
+      const allEntriesInTemplate = await globby__default["default"](`**/*`, {
         cwd: templateDir,
         dot: true,
         onlyFiles: false,
         markDirectories: true
       });
-      const nonTemplatedEntries = new Set((await Promise.all((ctx.input.copyWithoutRender || []).map((pattern) => globby__default['default'](pattern, {
+      const nonTemplatedEntries = new Set((await Promise.all((ctx.input.copyWithoutRender || []).map((pattern) => globby__default["default"](pattern, {
         cwd: templateDir,
         dot: true,
         onlyFiles: false,
         markDirectories: true
       })))).flat());
-      const templater = nunjucks__default['default'].configure({
-        ...ctx.input.cookiecutterCompat ? {} : {
-          tags: {
-            variableStart: "${{",
-            variableEnd: "}}"
-          }
-        },
-        autoescape: false
-      });
-      if (ctx.input.cookiecutterCompat) {
-        templater.addFilter("jsonify", templater.getFilter("dump"));
-      }
-      const {cookiecutterCompat, values} = ctx.input;
+      const { cookiecutterCompat, values } = ctx.input;
       const context = {
         [cookiecutterCompat ? "cookiecutter" : "values"]: values
       };
       ctx.logger.info(`Processing ${allEntriesInTemplate.length} template files/directories with input values`, ctx.input.values);
+      const renderTemplate = await SecureTemplater.loadRenderer({
+        cookiecutterCompat: ctx.input.cookiecutterCompat
+      });
       for (const location of allEntriesInTemplate) {
         let renderFilename;
         let renderContents;
@@ -431,9 +513,9 @@ function createFetchTemplateAction(options) {
           renderFilename = renderContents = !nonTemplatedEntries.has(location);
         }
         if (renderFilename) {
-          localOutputPath = templater.renderString(localOutputPath, context);
+          localOutputPath = renderTemplate(localOutputPath, context);
         }
-        const outputPath = path.resolve(outputDir, localOutputPath);
+        const outputPath = backendCommon.resolveSafeChildPath(outputDir, localOutputPath);
         if (outputDir === outputPath) {
           continue;
         }
@@ -442,17 +524,17 @@ function createFetchTemplateAction(options) {
         }
         if (location.endsWith("/")) {
           ctx.logger.info(`Writing directory ${location} to template output path.`);
-          await fs__default['default'].ensureDir(outputPath);
+          await fs__default["default"].ensureDir(outputPath);
         } else {
-          const inputFilePath = path.resolve(templateDir, location);
+          const inputFilePath = backendCommon.resolveSafeChildPath(templateDir, location);
           if (await isbinaryfile.isBinaryFile(inputFilePath)) {
             ctx.logger.info(`Copying binary file ${location} to template output path.`);
-            await fs__default['default'].copy(inputFilePath, outputPath);
+            await fs__default["default"].copy(inputFilePath, outputPath);
           } else {
-            const statsObj = await fs__default['default'].stat(inputFilePath);
+            const statsObj = await fs__default["default"].stat(inputFilePath);
             ctx.logger.info(`Writing file ${location} to template output path with mode ${statsObj.mode}.`);
-            const inputFileContents = await fs__default['default'].readFile(inputFilePath, "utf-8");
-            await fs__default['default'].outputFile(outputPath, renderContents ? templater.renderString(inputFileContents, context) : inputFileContents, {mode: statsObj.mode});
+            const inputFileContents = await fs__default["default"].readFile(inputFilePath, "utf-8");
+            await fs__default["default"].outputFile(outputPath, renderContents ? renderTemplate(inputFileContents, context) : inputFileContents, { mode: statsObj.mode });
           }
         }
       }
@@ -489,7 +571,7 @@ const createFilesystemDeleteAction = () => {
       for (const file of ctx.input.files) {
         const filepath = backendCommon.resolveSafeChildPath(ctx.workspacePath, file);
         try {
-          await fs__default['default'].remove(filepath);
+          await fs__default["default"].remove(filepath);
           ctx.logger.info(`File ${filepath} deleted successfully`);
         } catch (err) {
           ctx.logger.error(`Failed to delete file ${filepath}:`, err);
@@ -547,7 +629,7 @@ const createFilesystemRenameAction = () => {
         const sourceFilepath = backendCommon.resolveSafeChildPath(ctx.workspacePath, file.from);
         const destFilepath = backendCommon.resolveSafeChildPath(ctx.workspacePath, file.to);
         try {
-          await fs__default['default'].move(sourceFilepath, destFilepath, {
+          await fs__default["default"].move(sourceFilepath, destFilepath, {
             overwrite: (_b = file.overwrite) != null ? _b : false
           });
           ctx.logger.info(`File ${sourceFilepath} renamed to ${destFilepath} successfully`);
@@ -563,10 +645,11 @@ const createFilesystemRenameAction = () => {
 const runCommand = async ({
   command,
   args,
-  logStream = new stream.PassThrough()
+  logStream = new stream.PassThrough(),
+  options
 }) => {
   await new Promise((resolve, reject) => {
-    const process = child_process.spawn(command, args);
+    const process = child_process.spawn(command, args, options);
     process.stdout.on("data", (stream) => {
       logStream.write(stream);
     });
@@ -603,7 +686,7 @@ async function initRepoAndPush({
     dir,
     defaultBranch
   });
-  await git.add({dir, filepath: "."});
+  await git.add({ dir, filepath: "." });
   const authorInfo = {
     name: (_a = gitAuthorInfo == null ? void 0 : gitAuthorInfo.name) != null ? _a : "Scaffolder",
     email: (_b = gitAuthorInfo == null ? void 0 : gitAuthorInfo.email) != null ? _b : "scaffolder@backstage.io"
@@ -641,7 +724,7 @@ const enableBranchProtectionOnDefaultRepoBranch = async ({
         owner,
         repo: repoName,
         branch: defaultBranch,
-        required_status_checks: {strict: true, contexts: []},
+        required_status_checks: { strict: true, contexts: [] },
         restrictions: null,
         enforce_admins: true,
         required_pull_request_reviews: {
@@ -715,7 +798,7 @@ const parseRepoUrl = (repoUrl, integrations) => {
   if (!repo) {
     throw new errors.InputError(`Invalid repo URL passed to publisher: ${repoUrl}, missing repo`);
   }
-  return {host, owner, repo, organization, workspace, project};
+  return { host, owner, repo, organization, workspace, project };
 };
 const isExecutable = (fileMode) => {
   const executeBitMask = 73;
@@ -724,7 +807,7 @@ const isExecutable = (fileMode) => {
 };
 
 function createPublishAzureAction(options) {
-  const {integrations, config} = options;
+  const { integrations, config } = options;
   return createTemplateAction({
     id: "publish:azure",
     description: "Initializes a git repository of the content in the workspace, and publishes it to Azure.",
@@ -767,8 +850,8 @@ function createPublishAzureAction(options) {
       }
     },
     async handler(ctx) {
-      const {repoUrl, defaultBranch = "master"} = ctx.input;
-      const {owner, repo, host, organization} = parseRepoUrl(repoUrl, integrations);
+      const { repoUrl, defaultBranch = "master" } = ctx.input;
+      const { owner, repo, host, organization } = parseRepoUrl(repoUrl, integrations);
       if (!organization) {
         throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing organization`);
       }
@@ -782,7 +865,7 @@ function createPublishAzureAction(options) {
       const authHandler = azureDevopsNodeApi.getPersonalAccessTokenHandler(integrationConfig.config.token);
       const webApi = new azureDevopsNodeApi.WebApi(`https://${host}/${organization}`, authHandler);
       const client = await webApi.getGitApi();
-      const createOptions = {name: repo};
+      const createOptions = { name: repo };
       const returnedRepo = await client.createRepository(createOptions, owner);
       if (!returnedRepo) {
         throw new errors.InputError(`Unable to create the repository with Organization ${organization}, Project ${owner} and Repo ${repo}.
@@ -830,7 +913,7 @@ const createBitbucketCloudRepository = async (opts) => {
       scm: "git",
       description,
       is_private: repoVisibility === "private",
-      project: {key: project}
+      project: { key: project }
     }),
     headers: {
       Authorization: authorization,
@@ -839,7 +922,7 @@ const createBitbucketCloudRepository = async (opts) => {
   };
   let response;
   try {
-    response = await fetch__default['default'](`https://api.bitbucket.org/2.0/repositories/${workspace}/${repo}`, options);
+    response = await fetch__default["default"](`https://api.bitbucket.org/2.0/repositories/${workspace}/${repo}`, options);
   } catch (e) {
     throw new Error(`Unable to create repository, ${e}`);
   }
@@ -854,7 +937,7 @@ const createBitbucketCloudRepository = async (opts) => {
     }
   }
   const repoContentsUrl = `${r.links.html.href}/src/master`;
-  return {remoteUrl, repoContentsUrl};
+  return { remoteUrl, repoContentsUrl };
 };
 const createBitbucketServerRepository = async (opts) => {
   const {
@@ -881,7 +964,7 @@ const createBitbucketServerRepository = async (opts) => {
   };
   try {
     const baseUrl = apiBaseUrl ? apiBaseUrl : `https://${host}/rest/api/1.0`;
-    response = await fetch__default['default'](`${baseUrl}/projects/${project}/repos`, options);
+    response = await fetch__default["default"](`${baseUrl}/projects/${project}/repos`, options);
   } catch (e) {
     throw new Error(`Unable to create repository, ${e}`);
   }
@@ -896,7 +979,7 @@ const createBitbucketServerRepository = async (opts) => {
     }
   }
   const repoContentsUrl = `${r.links.self[0].href}`;
-  return {remoteUrl, repoContentsUrl};
+  return { remoteUrl, repoContentsUrl };
 };
 const getAuthorizationHeader = (config) => {
   if (config.username && config.appPassword) {
@@ -909,19 +992,19 @@ const getAuthorizationHeader = (config) => {
   throw new Error(`Authorization has not been provided for Bitbucket. Please add either username + appPassword or token to the Integrations config`);
 };
 const performEnableLFS = async (opts) => {
-  const {authorization, host, project, repo} = opts;
+  const { authorization, host, project, repo } = opts;
   const options = {
     method: "PUT",
     headers: {
       Authorization: authorization
     }
   };
-  const {ok, status, statusText} = await fetch__default['default'](`https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`, options);
+  const { ok, status, statusText } = await fetch__default["default"](`https://${host}/rest/git-lfs/admin/projects/${project}/repos/${repo}/enabled`, options);
   if (!ok)
     throw new Error(`Failed to enable LFS in the repository, ${status}: ${statusText}`);
 };
 function createPublishBitbucketAction(options) {
-  const {integrations, config} = options;
+  const { integrations, config } = options;
   return createTemplateAction({
     id: "publish:bitbucket",
     description: "Initializes a git repository of the content in the workspace, and publishes it to Bitbucket.",
@@ -981,7 +1064,7 @@ function createPublishBitbucketAction(options) {
         repoVisibility = "private",
         enableLFS = false
       } = ctx.input;
-      const {workspace, project, repo, host} = parseRepoUrl(repoUrl, integrations);
+      const { workspace, project, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (host === "bitbucket.org") {
         if (!workspace) {
           throw new errors.InputError(`Invalid URL provider was included in the repo URL to create ${ctx.input.repoUrl}, missing workspace`);
@@ -997,7 +1080,7 @@ function createPublishBitbucketAction(options) {
       const authorization = getAuthorizationHeader(integrationConfig.config);
       const apiBaseUrl = integrationConfig.config.apiBaseUrl;
       const createMethod = host === "bitbucket.org" ? createBitbucketCloudRepository : createBitbucketServerRepository;
-      const {remoteUrl, repoContentsUrl} = await createMethod({
+      const { remoteUrl, repoContentsUrl } = await createMethod({
         authorization,
         host,
         workspace: workspace || "",
@@ -1024,7 +1107,7 @@ function createPublishBitbucketAction(options) {
         gitAuthorInfo
       });
       if (enableLFS && host !== "bitbucket.org") {
-        await performEnableLFS({authorization, host, project, repo});
+        await performEnableLFS({ authorization, host, project, repo });
       }
       ctx.output("remoteUrl", remoteUrl);
       ctx.output("repoContentsUrl", repoContentsUrl);
@@ -1049,13 +1132,13 @@ function createPublishFileAction() {
       }
     },
     async handler(ctx) {
-      const {path: path$1} = ctx.input;
-      const exists = await fs__default['default'].pathExists(path$1);
+      const { path: path$1 } = ctx.input;
+      const exists = await fs__default["default"].pathExists(path$1);
       if (exists) {
         throw new errors.InputError("Output path already exists");
       }
-      await fs__default['default'].ensureDir(path.dirname(path$1));
-      await fs__default['default'].copy(ctx.workspacePath, path$1);
+      await fs__default["default"].ensureDir(path.dirname(path$1));
+      await fs__default["default"].copy(ctx.workspacePath, path$1);
     }
   });
 }
@@ -1070,7 +1153,7 @@ class OctokitProvider {
   }
   async getOctokit(repoUrl) {
     var _a;
-    const {owner, repo, host} = parseRepoUrl(repoUrl, this.integrations);
+    const { owner, repo, host } = parseRepoUrl(repoUrl, this.integrations);
     if (!owner) {
       throw new errors.InputError(`No owner provided for repo ${repoUrl}`);
     }
@@ -1082,7 +1165,7 @@ class OctokitProvider {
     if (!credentialsProvider) {
       throw new errors.InputError(`No matching credentials for host ${host}, please check your integrations config`);
     }
-    const {token} = await credentialsProvider.getCredentials({
+    const { token } = await credentialsProvider.getCredentials({
       url: `https://${host}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`
     });
     if (!token) {
@@ -1093,12 +1176,12 @@ class OctokitProvider {
       baseUrl: integrationConfig.apiBaseUrl,
       previews: ["nebula-preview"]
     });
-    return {client, token, owner, repo};
+    return { client, token, owner, repo };
   }
 }
 
 function createPublishGithubAction(options) {
-  const {integrations, config} = options;
+  const { integrations, config } = options;
   const octokitProvider = new OctokitProvider(integrations);
   return createTemplateAction({
     id: "publish:github",
@@ -1194,7 +1277,7 @@ function createPublishGithubAction(options) {
         collaborators,
         topics
       } = ctx.input;
-      const {client, token, owner, repo} = await octokitProvider.getOctokit(repoUrl);
+      const { client, token, owner, repo } = await octokitProvider.getOctokit(repoUrl);
       const user = await client.users.getByUsername({
         username: owner
       });
@@ -1209,7 +1292,7 @@ function createPublishGithubAction(options) {
         private: repoVisibility === "private",
         description
       });
-      const {data: newRepo} = await repoCreationPromise;
+      const { data: newRepo } = await repoCreationPromise;
       if (access == null ? void 0 : access.startsWith(`${owner}/`)) {
         const [, team] = access.split("/");
         await client.teams.addOrUpdateRepoPermissionsInOrg({
@@ -1312,7 +1395,7 @@ const defaultClientFactory = async ({
   if (!credentialsProvider) {
     throw new errors.InputError(`No matching credentials for host ${host}, please check your integrations config`);
   }
-  const {token} = await credentialsProvider.getCredentials({
+  const { token } = await credentialsProvider.getCredentials({
     url: `https://${host}/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`
   });
   if (!token) {
@@ -1388,21 +1471,21 @@ const createPublishGithubPullRequestAction = ({
         targetPath,
         sourcePath
       } = ctx.input;
-      const {owner, repo, host} = parseRepoUrl(repoUrl, integrations);
+      const { owner, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (!owner) {
         throw new errors.InputError(`No owner provided for host: ${host}, and repo ${repo}`);
       }
-      const client = await clientFactory({integrations, host, owner, repo});
+      const client = await clientFactory({ integrations, host, owner, repo });
       const fileRoot = sourcePath ? backendCommon.resolveSafeChildPath(ctx.workspacePath, sourcePath) : ctx.workspacePath;
-      const localFilePaths = await globby__default['default'](["./**", "./**/.*", "!.git"], {
+      const localFilePaths = await globby__default["default"](["./**", "./**/.*", "!.git"], {
         cwd: fileRoot,
         gitignore: true,
         dot: true
       });
       const fileContents = await Promise.all(localFilePaths.map((filePath) => {
-        const absPath = path__default['default'].resolve(fileRoot, filePath);
-        const base64EncodedContent = fs__default['default'].readFileSync(absPath).toString("base64");
-        const fileStat = fs__default['default'].statSync(absPath);
+        const absPath = backendCommon.resolveSafeChildPath(fileRoot, filePath);
+        const base64EncodedContent = fs__default["default"].readFileSync(absPath).toString("base64");
+        const fileStat = fs__default["default"].statSync(absPath);
         const githubTreeItemMode = isExecutable(fileStat.mode) ? "100755" : "100644";
         const encoding = "base64";
         return {
@@ -1441,7 +1524,7 @@ const createPublishGithubPullRequestAction = ({
 };
 
 function createPublishGitlabAction(options) {
-  const {integrations, config} = options;
+  const { integrations, config } = options;
   return createTemplateAction({
     id: "publish:gitlab",
     description: "Initializes a git repository of the content in the workspace, and publishes it to GitLab.",
@@ -1490,7 +1573,7 @@ function createPublishGitlabAction(options) {
         repoVisibility = "private",
         defaultBranch = "master"
       } = ctx.input;
-      const {owner, repo, host} = parseRepoUrl(repoUrl, integrations);
+      const { owner, repo, host } = parseRepoUrl(repoUrl, integrations);
       if (!owner) {
         throw new errors.InputError(`No owner provided for host: ${host}, and repo ${repo}`);
       }
@@ -1505,12 +1588,12 @@ function createPublishGitlabAction(options) {
         host: integrationConfig.config.baseUrl,
         token: integrationConfig.config.token
       });
-      let {id: targetNamespace} = await client.Namespaces.show(owner);
+      let { id: targetNamespace } = await client.Namespaces.show(owner);
       if (!targetNamespace) {
-        const {id} = await client.Users.current();
+        const { id } = await client.Users.current();
         targetNamespace = id;
       }
-      const {http_url_to_repo} = await client.Projects.create({
+      const { http_url_to_repo } = await client.Projects.create({
         namespace_id: targetNamespace,
         name: repo,
         visibility: repoVisibility
@@ -1539,8 +1622,122 @@ function createPublishGitlabAction(options) {
   });
 }
 
+const createPublishGitlabMergeRequestAction = (options) => {
+  const { integrations } = options;
+  return createTemplateAction({
+    id: "publish:gitlab:merge-request",
+    schema: {
+      input: {
+        required: ["projectid", "repoUrl", "targetPath", "branchName"],
+        type: "object",
+        properties: {
+          repoUrl: {
+            type: "string",
+            title: "Repository Location",
+            description: `Accepts the format 'gitlab.com/group_name/project_name' where 'project_name' is the repository name and 'group_name' is a group or username`
+          },
+          projectid: {
+            type: "string",
+            title: "projectid",
+            description: "Project ID/Name(slug) of the Gitlab Project"
+          },
+          title: {
+            type: "string",
+            title: "Merge Request Name",
+            description: "The name for the merge request"
+          },
+          description: {
+            type: "string",
+            title: "Merge Request Description",
+            description: "The description of the merge request"
+          },
+          branchName: {
+            type: "string",
+            title: "Destination Branch name",
+            description: "The description of the merge request"
+          },
+          targetPath: {
+            type: "string",
+            title: "Repository Subdirectory",
+            description: "Subdirectory of repository to apply changes to"
+          }
+        }
+      },
+      output: {
+        type: "object",
+        properties: {
+          projectid: {
+            title: "Gitlab Project id/Name(slug)",
+            type: "string"
+          },
+          mergeRequestURL: {
+            title: "MergeRequest(MR) URL",
+            type: "string",
+            description: "Link to the merge request in GitLab"
+          }
+        }
+      }
+    },
+    async handler(ctx) {
+      const repoUrl = ctx.input.repoUrl;
+      const { host } = parseRepoUrl(repoUrl, integrations);
+      const integrationConfig = integrations.gitlab.byHost(host);
+      const actions = [];
+      const destinationBranch = ctx.input.branchName;
+      if (!integrationConfig) {
+        throw new errors.InputError(`No matching integration configuration for host ${host}, please check your integrations config`);
+      }
+      if (!integrationConfig.config.token) {
+        throw new errors.InputError(`No token available for host ${host}`);
+      }
+      const api = new node.Gitlab({
+        host: integrationConfig.config.baseUrl,
+        token: integrationConfig.config.token
+      });
+      const fileRoot = ctx.workspacePath;
+      const localFilePaths = await globby__default["default"]([`${ctx.input.targetPath}/**`], {
+        cwd: fileRoot,
+        gitignore: true,
+        dot: true
+      });
+      const fileContents = await Promise.all(localFilePaths.map((p) => fs.readFile(backendCommon.resolveSafeChildPath(fileRoot, p))));
+      const repoFilePaths = localFilePaths.map((repoFilePath) => {
+        return repoFilePath;
+      });
+      for (let i = 0; i < repoFilePaths.length; i++) {
+        actions.push({
+          action: "create",
+          filePath: repoFilePaths[i],
+          content: fileContents[i].toString()
+        });
+      }
+      const projects = await api.Projects.show(ctx.input.projectid);
+      const { default_branch: defaultBranch } = projects;
+      try {
+        await api.Branches.create(ctx.input.projectid, destinationBranch, String(defaultBranch));
+      } catch (e) {
+        throw new errors.InputError(`The branch creation failed ${e}`);
+      }
+      try {
+        await api.Commits.create(ctx.input.projectid, destinationBranch, ctx.input.title, actions);
+      } catch (e) {
+        throw new errors.InputError(`Committing the changes to ${destinationBranch} failed ${e}`);
+      }
+      try {
+        const mergeRequestUrl = await api.MergeRequests.create(ctx.input.projectid, destinationBranch, String(defaultBranch), ctx.input.title, { description: ctx.input.description }).then((mergeRequest) => {
+          return mergeRequest.web_url;
+        });
+        ctx.output("projectid", ctx.input.projectid);
+        ctx.output("mergeRequestUrl", mergeRequestUrl);
+      } catch (e) {
+        throw new errors.InputError(`Merge request creation failed${e}`);
+      }
+    }
+  });
+};
+
 function createGithubActionsDispatchAction(options) {
-  const {integrations} = options;
+  const { integrations } = options;
   const octokitProvider = new OctokitProvider(integrations);
   return createTemplateAction({
     id: "github:actions:dispatch",
@@ -1569,9 +1766,9 @@ function createGithubActionsDispatchAction(options) {
       }
     },
     async handler(ctx) {
-      const {repoUrl, workflowId, branchOrTagName} = ctx.input;
+      const { repoUrl, workflowId, branchOrTagName } = ctx.input;
       ctx.logger.info(`Dispatching workflow ${workflowId} for repo ${repoUrl} on ${branchOrTagName}`);
-      const {client, owner, repo} = await octokitProvider.getOctokit(repoUrl);
+      const { client, owner, repo } = await octokitProvider.getOctokit(repoUrl);
       await client.rest.actions.createWorkflowDispatch({
         owner,
         repo,
@@ -1584,7 +1781,7 @@ function createGithubActionsDispatchAction(options) {
 }
 
 function createGithubWebhookAction(options) {
-  const {integrations, defaultWebhookSecret} = options;
+  const { integrations, defaultWebhookSecret } = options;
   const octokitProvider = new OctokitProvider(integrations);
   const eventNames = webhooks.emitterEventNames.filter((event) => !event.includes("."));
   return createTemplateAction({
@@ -1659,7 +1856,7 @@ function createGithubWebhookAction(options) {
         insecureSsl = false
       } = ctx.input;
       ctx.logger.info(`Creating webhook ${webhookUrl} for repo ${repoUrl}`);
-      const {client, owner, repo} = await octokitProvider.getOctokit(repoUrl);
+      const { client, owner, repo } = await octokitProvider.getOctokit(repoUrl);
       try {
         const insecure_ssl = insecureSsl ? "1" : "0";
         await client.repos.createWebhook({
@@ -1684,17 +1881,12 @@ function createGithubWebhookAction(options) {
 }
 
 const createBuiltinActions = (options) => {
-  const {reader, integrations, containerRunner, catalogClient, config} = options;
-  return [
+  const { reader, integrations, containerRunner, catalogClient, config } = options;
+  const actions = [
     createFetchPlainAction({
       reader,
       integrations
     }),
-    pluginScaffolderBackendModuleCookiecutter.createFetchCookiecutterAction({
-      reader,
-      integrations,
-      containerRunner
-    }),
     createFetchTemplateAction({
       integrations,
       reader
@@ -1710,6 +1902,9 @@ const createBuiltinActions = (options) => {
       integrations,
       config
     }),
+    createPublishGitlabMergeRequestAction({
+      integrations
+    }),
     createPublishBitbucketAction({
       integrations,
       config
@@ -1719,7 +1914,7 @@ const createBuiltinActions = (options) => {
       config
     }),
     createDebugLogAction(),
-    createCatalogRegisterAction({catalogClient, integrations}),
+    createCatalogRegisterAction({ catalogClient, integrations }),
     createCatalogWriteAction(),
     createFilesystemDeleteAction(),
     createFilesystemRenameAction(),
@@ -1730,11 +1925,19 @@ const createBuiltinActions = (options) => {
       integrations
     })
   ];
+  if (containerRunner) {
+    actions.push(pluginScaffolderBackendModuleCookiecutter.createFetchCookiecutterAction({
+      reader,
+      integrations,
+      containerRunner
+    }));
+  }
+  return actions;
 };
 
 class TemplateActionRegistry {
   constructor() {
-    this.actions = new Map();
+    this.actions = /* @__PURE__ */ new Map();
   }
   register(action) {
     if (this.actions.has(action.id)) {
@@ -1766,7 +1969,7 @@ class DatabaseTaskStore {
     this.db = options.database;
   }
   async getTask(taskId) {
-    const [result] = await this.db("tasks").where({id: taskId}).select();
+    const [result] = await this.db("tasks").where({ id: taskId }).select();
     if (!result) {
       throw new errors.NotFoundError(`No task with id '${taskId}' found`);
     }
@@ -1793,7 +1996,7 @@ class DatabaseTaskStore {
       secrets: secrets ? JSON.stringify(secrets) : void 0,
       status: "open"
     });
-    return {taskId};
+    return { taskId };
   }
   async claimTask() {
     return this.db.transaction(async (tx) => {
@@ -1803,7 +2006,7 @@ class DatabaseTaskStore {
       if (!task) {
         return void 0;
       }
-      const updateCount = await tx("tasks").where({id: task.id, status: "open"}).update({
+      const updateCount = await tx("tasks").where({ id: task.id, status: "open" }).update({
         status: "processing",
         last_heartbeat_at: this.db.fn.now()
       });
@@ -1827,14 +2030,14 @@ class DatabaseTaskStore {
     });
   }
   async heartbeatTask(taskId) {
-    const updateCount = await this.db("tasks").where({id: taskId, status: "processing"}).update({
+    const updateCount = await this.db("tasks").where({ id: taskId, status: "processing" }).update({
       last_heartbeat_at: this.db.fn.now()
     });
     if (updateCount === 0) {
       throw new errors.ConflictError(`No running task with taskId ${taskId} found`);
     }
   }
-  async listStaleTasks({timeoutS}) {
+  async listStaleTasks({ timeoutS }) {
     const rawRows = await this.db("tasks").where("status", "processing").andWhere("last_heartbeat_at", "<=", this.db.client.config.client === "sqlite3" ? this.db.raw(`datetime('now', ?)`, [`-${timeoutS} seconds`]) : this.db.raw(`dateadd('second', ?, ?)`, [
       `-${timeoutS}`,
       this.db.fn.now()
@@ -1842,7 +2045,7 @@ class DatabaseTaskStore {
     const tasks = rawRows.map((row) => ({
       taskId: row.id
     }));
-    return {tasks};
+    return { tasks };
   }
   async completeTask({
     taskId,
@@ -1882,7 +2085,7 @@ class DatabaseTaskStore {
       });
     });
   }
-  async emitLogEvent({taskId, body}) {
+  async emitLogEvent({ taskId, body }) {
     const serliazedBody = JSON.stringify(body);
     await this.db("task_events").insert({
       task_id: taskId,
@@ -1909,13 +2112,13 @@ class DatabaseTaskStore {
           taskId,
           body,
           type: event.event_type,
-          createdAt: typeof event.created_at === "string" ? luxon.DateTime.fromSQL(event.created_at, {zone: "UTC"}).toISO() : event.created_at
+          createdAt: typeof event.created_at === "string" ? luxon.DateTime.fromSQL(event.created_at, { zone: "UTC" }).toISO() : event.created_at
         };
       } catch (error) {
         throw new Error(`Failed to parse event body from event taskId=${taskId} id=${event.id}, ${error}`);
       }
     });
-    return {events};
+    return { events };
   }
 }
 
@@ -1946,7 +2149,7 @@ class TaskManager {
   async emitLog(message, metadata) {
     await this.storage.emitLogEvent({
       taskId: this.state.taskId,
-      body: {message, ...metadata}
+      body: { message, ...metadata }
     });
   }
   async complete(result, metadata) {
@@ -1981,7 +2184,7 @@ function defer() {
   const promise = new Promise((_resolve) => {
     resolve = _resolve;
   });
-  return {promise, resolve};
+  return { promise, resolve };
 }
 class StorageTaskBroker {
   constructor(storage, logger) {
@@ -2013,7 +2216,7 @@ class StorageTaskBroker {
     return this.storage.getTask(taskId);
   }
   observe(options, callback) {
-    const {taskId} = options;
+    const { taskId } = options;
     let cancelled = false;
     const unsubscribe = () => {
       cancelled = true;
@@ -2021,24 +2224,24 @@ class StorageTaskBroker {
     (async () => {
       let after = options.after;
       while (!cancelled) {
-        const result = await this.storage.listEvents({taskId, after});
-        const {events} = result;
+        const result = await this.storage.listEvents({ taskId, after });
+        const { events } = result;
         if (events.length) {
           after = events[events.length - 1].id;
           try {
             callback(void 0, result);
           } catch (error) {
             errors.assertError(error);
-            callback(error, {events: []});
+            callback(error, { events: [] });
           }
         }
         await new Promise((resolve) => setTimeout(resolve, 1e3));
       }
     })();
-    return {unsubscribe};
+    return { unsubscribe };
   }
   async vacuumTasks(timeoutS) {
-    const {tasks} = await this.storage.listStaleTasks(timeoutS);
+    const { tasks } = await this.storage.listStaleTasks(timeoutS);
     await Promise.all(tasks.map(async (task) => {
       try {
         await this.storage.completeTask({
@@ -2075,7 +2278,7 @@ class HandlebarsWorkflowRunner {
       return JSON.stringify(parseRepoUrl(repoUrl, this.options.integrations));
     });
     this.handlebars.registerHelper("projectSlug", (repoUrl) => {
-      const {owner, repo} = parseRepoUrl(repoUrl, this.options.integrations);
+      const { owner, repo } = parseRepoUrl(repoUrl, this.options.integrations);
       return `${owner}/${repo}`;
     });
     this.handlebars.registerHelper("json", (obj) => JSON.stringify(obj));
@@ -2087,14 +2290,14 @@ class HandlebarsWorkflowRunner {
     if (!isValidTaskSpec$1(task.spec)) {
       throw new errors.InputError(`Task spec is not a valid v1beta2 task spec`);
     }
-    const {actionRegistry} = this.options;
-    const workspacePath = path__default['default'].join(this.options.workingDirectory, await task.getWorkspaceName());
+    const { actionRegistry } = this.options;
+    const workspacePath = path__default["default"].join(this.options.workingDirectory, await task.getWorkspaceName());
     try {
-      await fs__default['default'].ensureDir(workspacePath);
+      await fs__default["default"].ensureDir(workspacePath);
       await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);
-      const templateCtx = {parameters: task.spec.values, steps: {}};
+      const templateCtx = { parameters: task.spec.values, steps: {} };
       for (const step of task.spec.steps) {
-        const metadata = {stepId: step.id};
+        const metadata = { stepId: step.id };
         try {
           const taskLogger = winston__namespace.createLogger({
             level: process.env.LOG_LEVEL || "info",
@@ -2108,7 +2311,7 @@ class HandlebarsWorkflowRunner {
               await task.emitLog(message, metadata);
             }
           });
-          taskLogger.add(new winston__namespace.transports.Stream({stream: stream$1}));
+          taskLogger.add(new winston__namespace.transports.Stream({ stream: stream$1 }));
           if (step.if !== void 0) {
             let skip = !step.if;
             if (typeof step.if === "string") {
@@ -2189,7 +2392,7 @@ class HandlebarsWorkflowRunner {
             token: (_b = task.secrets) == null ? void 0 : _b.token,
             workspacePath,
             async createTemporaryDirectory() {
-              const tmpDir = await fs__default['default'].mkdtemp(`${workspacePath}_step-${step.id}-`);
+              const tmpDir = await fs__default["default"].mkdtemp(`${workspacePath}_step-${step.id}-`);
               tmpDirs.push(tmpDir);
               return tmpDir;
             },
@@ -2199,9 +2402,9 @@ class HandlebarsWorkflowRunner {
             metadata: task.spec.metadata
           });
           for (const tmpDir of tmpDirs) {
-            await fs__default['default'].remove(tmpDir);
+            await fs__default["default"].remove(tmpDir);
           }
-          templateCtx.steps[step.id] = {output: stepOutputs};
+          templateCtx.steps[step.id] = { output: stepOutputs };
           await task.emitLog(`Finished step ${step.name}`, {
             ...metadata,
             status: "completed"
@@ -2235,10 +2438,10 @@ class HandlebarsWorkflowRunner {
         }
         return value;
       });
-      return {output};
+      return { output };
     } finally {
       if (workspacePath) {
-        await fs__default['default'].remove(workspacePath);
+        await fs__default["default"].remove(workspacePath);
       }
     }
   }
@@ -2251,7 +2454,7 @@ const createStepLogger = ({
   task,
   step
 }) => {
-  const metadata = {stepId: step.id};
+  const metadata = { stepId: step.id };
   const taskLogger = winston__namespace.createLogger({
     level: process.env.LOG_LEVEL || "info",
     format: winston__namespace.format.combine(winston__namespace.format.colorize(), winston__namespace.format.timestamp(), winston__namespace.format.simple()),
@@ -2264,41 +2467,33 @@ const createStepLogger = ({
       await task.emitLog(message, metadata);
     }
   });
-  taskLogger.add(new winston__namespace.transports.Stream({stream: streamLogger}));
-  return {taskLogger, streamLogger};
+  taskLogger.add(new winston__namespace.transports.Stream({ stream: streamLogger }));
+  return { taskLogger, streamLogger };
 };
 class NunjucksWorkflowRunner {
   constructor(options) {
     this.options = options;
-    this.nunjucksOptions = {
+  }
+  isSingleTemplateString(input) {
+    var _a, _b;
+    const { parser, nodes } = nunjucks__default["default"];
+    const parsed = parser.parse(input, {}, {
       autoescape: false,
       tags: {
         variableStart: "${{",
         variableEnd: "}}"
       }
-    };
-    this.nunjucks = nunjucks__default['default'].configure(this.nunjucksOptions);
-    this.nunjucks.addFilter("parseRepoUrl", (repoUrl) => {
-      return parseRepoUrl(repoUrl, this.options.integrations);
-    });
-    this.nunjucks.addFilter("projectSlug", (repoUrl) => {
-      const {owner, repo} = parseRepoUrl(repoUrl, this.options.integrations);
-      return `${owner}/${repo}`;
     });
+    return parsed.children.length === 1 && !(((_b = (_a = parsed.children[0]) == null ? void 0 : _a.children) == null ? void 0 : _b[0]) instanceof nodes.TemplateData);
   }
-  isSingleTemplateString(input) {
-    const {parser, nodes} = require("nunjucks");
-    const parsed = parser.parse(input, {}, this.nunjucksOptions);
-    return parsed.children.length === 1 && !(parsed.children[0] instanceof nodes.TemplateData);
-  }
-  render(input, context) {
+  render(input, context, renderTemplate) {
     return JSON.parse(JSON.stringify(input), (_key, value) => {
       try {
         if (typeof value === "string") {
           try {
             if (this.isSingleTemplateString(value)) {
               const wrappedDumped = value.replace(/\${{(.+)}}/g, "${{ ( $1 ) | dump }}");
-              const templated2 = this.nunjucks.renderString(wrappedDumped, context);
+              const templated2 = renderTemplate(wrappedDumped, context);
               if (templated2 === "") {
                 return void 0;
               }
@@ -2307,7 +2502,7 @@ class NunjucksWorkflowRunner {
           } catch (ex) {
             this.options.logger.error(`Failed to parse template string: ${value} with error ${ex.message}`);
           }
-          const templated = this.nunjucks.renderString(value, context);
+          const templated = renderTemplate(value, context);
           if (templated === "") {
             return void 0;
           }
@@ -2324,9 +2519,15 @@ class NunjucksWorkflowRunner {
     if (!isValidTaskSpec(task.spec)) {
       throw new errors.InputError("Wrong template version executed with the workflow engine");
     }
-    const workspacePath = path__default['default'].join(this.options.workingDirectory, await task.getWorkspaceName());
+    const workspacePath = path__default["default"].join(this.options.workingDirectory, await task.getWorkspaceName());
+    const { integrations } = this.options;
+    const renderTemplate = await SecureTemplater.loadRenderer({
+      parseRepoUrl(url) {
+        return parseRepoUrl(url, integrations);
+      }
+    });
     try {
-      await fs__default['default'].ensureDir(workspacePath);
+      await fs__default["default"].ensureDir(workspacePath);
       await task.emitLog(`Starting up task with ${task.spec.steps.length} steps`);
       const context = {
         parameters: task.spec.parameters,
@@ -2335,9 +2536,9 @@ class NunjucksWorkflowRunner {
       for (const step of task.spec.steps) {
         try {
           if (step.if) {
-            const ifResult = await this.render(step.if, context);
+            const ifResult = await this.render(step.if, context, renderTemplate);
             if (!isTruthy(ifResult)) {
-              await task.emitLog(`Skipping step ${step.id} because it's if condition was false`, {stepId: step.id, status: "skipped"});
+              await task.emitLog(`Skipping step ${step.id} because it's if condition was false`, { stepId: step.id, status: "skipped" });
               continue;
             }
           }
@@ -2346,8 +2547,8 @@ class NunjucksWorkflowRunner {
             status: "processing"
           });
           const action = this.options.actionRegistry.get(step.action);
-          const {taskLogger, streamLogger} = createStepLogger({task, step});
-          const input = (_a = step.input && this.render(step.input, context)) != null ? _a : {};
+          const { taskLogger, streamLogger } = createStepLogger({ task, step });
+          const input = (_a = step.input && this.render(step.input, context, renderTemplate)) != null ? _a : {};
           if ((_b = action.schema) == null ? void 0 : _b.input) {
             const validateResult = jsonschema.validate(input, action.schema.input);
             if (!validateResult.valid) {
@@ -2367,7 +2568,7 @@ class NunjucksWorkflowRunner {
             logStream: streamLogger,
             workspacePath,
             createTemporaryDirectory: async () => {
-              const tmpDir = await fs__default['default'].mkdtemp(`${workspacePath}_step-${step.id}-`);
+              const tmpDir = await fs__default["default"].mkdtemp(`${workspacePath}_step-${step.id}-`);
               tmpDirs.push(tmpDir);
               return tmpDir;
             },
@@ -2377,9 +2578,9 @@ class NunjucksWorkflowRunner {
             metadata: task.spec.metadata
           });
           for (const tmpDir of tmpDirs) {
-            await fs__default['default'].remove(tmpDir);
+            await fs__default["default"].remove(tmpDir);
           }
-          context.steps[step.id] = {output: stepOutput};
+          context.steps[step.id] = { output: stepOutput };
           await task.emitLog(`Finished step ${step.name}`, {
             stepId: step.id,
             status: "completed"
@@ -2392,11 +2593,11 @@ class NunjucksWorkflowRunner {
           throw err;
         }
       }
-      const output = this.render(task.spec.output, context);
-      return {output};
+      const output = this.render(task.spec.output, context, renderTemplate);
+      return { output };
     } finally {
       if (workspacePath) {
-        await fs__default['default'].remove(workspacePath);
+        await fs__default["default"].remove(workspacePath);
       }
     }
   }
@@ -2428,7 +2629,7 @@ class TaskWorker {
     });
     return new TaskWorker({
       taskBroker,
-      runners: {legacyWorkflowRunner, workflowRunner}
+      runners: { legacyWorkflowRunner, workflowRunner }
     });
   }
   start() {
@@ -2441,12 +2642,12 @@ class TaskWorker {
   }
   async runOneTask(task) {
     try {
-      const {output} = task.spec.apiVersion === "scaffolder.backstage.io/v1beta3" ? await this.options.runners.workflowRunner.execute(task) : await this.options.runners.legacyWorkflowRunner.execute(task);
-      await task.complete("completed", {output});
+      const { output } = task.spec.apiVersion === "scaffolder.backstage.io/v1beta3" ? await this.options.runners.workflowRunner.execute(task) : await this.options.runners.legacyWorkflowRunner.execute(task);
+      await task.complete("completed", { output });
     } catch (error) {
       errors.assertError(error);
       await task.complete("failed", {
-        error: {name: error.name, message: error.message}
+        error: { name: error.name, message: error.message }
       });
     }
   }
@@ -2457,7 +2658,7 @@ class CatalogEntityClient {
     this.catalogClient = catalogClient;
   }
   async findTemplate(templateName, options) {
-    const {items: templates} = await this.catalogClient.getEntities({
+    const { items: templates } = await this.catalogClient.getEntities({
       filter: {
         kind: "template",
         "metadata.name": templateName
@@ -2476,11 +2677,11 @@ class CatalogEntityClient {
 
 async function getWorkingDirectory(config, logger) {
   if (!config.has("backend.workingDirectory")) {
-    return os__default['default'].tmpdir();
+    return os__default["default"].tmpdir();
   }
   const workingDirectory = config.getString("backend.workingDirectory");
   try {
-    await fs__default['default'].access(workingDirectory, fs__default['default'].constants.F_OK | fs__default['default'].constants.W_OK);
+    await fs__default["default"].access(workingDirectory, fs__default["default"].constants.F_OK | fs__default["default"].constants.W_OK);
     logger.info(`using working directory: ${workingDirectory}`);
   } catch (err) {
     errors.assertError(err);
@@ -2498,7 +2699,7 @@ function getEntityBaseUrl(entity) {
   if (!location) {
     return void 0;
   }
-  const {type, target} = catalogModel.parseLocationReference(location);
+  const { type, target } = catalogModel.parseLocationReference(location);
   if (type === "url") {
     return target;
   } else if (type === "file") {
@@ -2511,8 +2712,8 @@ function isSupportedTemplate(entity) {
   return entity.apiVersion === "backstage.io/v1beta2" || entity.apiVersion === "scaffolder.backstage.io/v1beta3";
 }
 async function createRouter(options) {
-  const router = Router__default['default']();
-  router.use(express__default['default'].json());
+  const router = Router__default["default"]();
+  router.use(express__default["default"].json());
   const {
     logger: parentLogger,
     config,
@@ -2523,7 +2724,7 @@ async function createRouter(options) {
     containerRunner,
     taskWorkers
   } = options;
-  const logger = parentLogger.child({plugin: "scaffolder"});
+  const logger = parentLogger.child({ plugin: "scaffolder" });
   const workingDirectory = await getWorkingDirectory(config, logger);
   const entityClient = new CatalogEntityClient(catalogClient);
   const integrations = integration.ScmIntegrations.fromConfig(config);
@@ -2559,7 +2760,7 @@ async function createRouter(options) {
   workers.forEach((worker) => worker.start());
   router.get("/v2/templates/:namespace/:kind/:name/parameter-schema", async (req, res) => {
     var _a, _b;
-    const {namespace, kind, name} = req.params;
+    const { namespace, kind, name } = req.params;
     if (namespace !== "default") {
       throw new errors.InputError(`Invalid namespace, only 'default' namespace is supported`);
     }
@@ -2606,7 +2807,7 @@ async function createRouter(options) {
       for (const parameters of [(_a = template.spec.parameters) != null ? _a : []].flat()) {
         const result2 = jsonschema.validate(values, parameters);
         if (!result2.valid) {
-          res.status(400).json({errors: result2.errors});
+          res.status(400).json({ errors: result2.errors });
           return;
         }
       }
@@ -2624,7 +2825,7 @@ async function createRouter(options) {
           };
         }),
         output: (_b = template.spec.output) != null ? _b : {},
-        metadata: {name: (_c = template.metadata) == null ? void 0 : _c.name}
+        metadata: { name: (_c = template.metadata) == null ? void 0 : _c.name }
       } : {
         apiVersion: template.apiVersion,
         baseUrl,
@@ -2638,7 +2839,7 @@ async function createRouter(options) {
           };
         }),
         output: (_d = template.spec.output) != null ? _d : {},
-        metadata: {name: (_e = template.metadata) == null ? void 0 : _e.name}
+        metadata: { name: (_e = template.metadata) == null ? void 0 : _e.name }
       };
     } else {
       throw new errors.InputError(`Unsupported apiVersion field in schema entity, ${template.apiVersion}`);
@@ -2646,9 +2847,9 @@ async function createRouter(options) {
     const result = await taskBroker.dispatch(taskSpec, {
       token
     });
-    res.status(201).json({id: result.taskId});
+    res.status(201).json({ id: result.taskId });
   }).get("/v2/tasks/:taskId", async (req, res) => {
-    const {taskId} = req.params;
+    const { taskId } = req.params;
     const task = await taskBroker.get(taskId);
     if (!task) {
       throw new errors.NotFoundError(`Task with id ${taskId} does not exist`);
@@ -2656,7 +2857,7 @@ async function createRouter(options) {
     delete task.secrets;
     res.status(200).json(task);
   }).get("/v2/tasks/:taskId/eventstream", async (req, res) => {
-    const {taskId} = req.params;
+    const { taskId } = req.params;
     const after = req.query.after !== void 0 ? Number(req.query.after) : void 0;
     logger.debug(`Event stream observing taskId '${taskId}' opened`);
     res.writeHead(200, {
@@ -2664,7 +2865,7 @@ async function createRouter(options) {
       "Cache-Control": "no-cache",
       "Content-Type": "text/event-stream"
     });
-    const {unsubscribe} = taskBroker.observe({taskId, after}, (error, {events}) => {
+    const { unsubscribe } = taskBroker.observe({ taskId, after }, (error, { events }) => {
       var _a;
       if (error) {
         logger.error(`Received error from event stream when observing taskId '${taskId}', ${error}`);
@@ -2688,7 +2889,7 @@ data: ${JSON.stringify(event)}
       logger.debug(`Event stream observing taskId '${taskId}' closed`);
     });
   }).get("/v2/tasks/:taskId/events", async (req, res) => {
-    const {taskId} = req.params;
+    const { taskId } = req.params;
     const after = Number(req.query.after) || void 0;
     let unsubscribe = () => {
     };
@@ -2696,7 +2897,7 @@ data: ${JSON.stringify(event)}
       unsubscribe();
       res.json([]);
     }, 3e4);
-    ({unsubscribe} = taskBroker.observe({taskId, after}, (error, {events}) => {
+    ({ unsubscribe } = taskBroker.observe({ taskId, after }, (error, { events }) => {
       clearTimeout(timeout);
       unsubscribe();
       if (error) {
@@ -2709,7 +2910,7 @@ data: ${JSON.stringify(event)}
       clearTimeout(timeout);
     });
   });
-  const app = express__default['default']();
+  const app = express__default["default"]();
   app.set("logger", logger);
   app.use("/", router);
   return app;
@@ -2769,9 +2970,7 @@ class ScaffolderEntitiesProcessor {
 
 Object.defineProperty(exports, 'createFetchCookiecutterAction', {
   enumerable: true,
-  get: function () {
-    return pluginScaffolderBackendModuleCookiecutter.createFetchCookiecutterAction;
-  }
+  get: function () { return pluginScaffolderBackendModuleCookiecutter.createFetchCookiecutterAction; }
 });
 exports.CatalogEntityClient = CatalogEntityClient;
 exports.DatabaseTaskStore = DatabaseTaskStore;
@@ -2796,6 +2995,7 @@ exports.createPublishFileAction = createPublishFileAction;
 exports.createPublishGithubAction = createPublishGithubAction;
 exports.createPublishGithubPullRequestAction = createPublishGithubPullRequestAction;
 exports.createPublishGitlabAction = createPublishGitlabAction;
+exports.createPublishGitlabMergeRequestAction = createPublishGitlabMergeRequestAction;
 exports.createRouter = createRouter;
 exports.createTemplateAction = createTemplateAction;
 exports.fetchContents = fetchContents;