@catladder/cli 0.0.0-fix-materialize-binary-image-files-37469f1f → 0.0.0-fix-github-artifact-symlinks-3a2c1c28

package/dist/bundles/catenv/index.js

@@ -3102,6 +3102,97 @@ exports.makeAggregateCheckJob = makeAggregateCheckJob;
 
 /***/ }),
 
+/***/ 75125:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.createArtifactDownloadSteps = exports.createArtifactUploadSteps = exports.artifactArchiveFile = void 0;
+/**
+ * Artifacts are handed between github jobs as ONE tar archive instead
+ * of letting upload-artifact walk the paths itself.
+ *
+ * upload-artifact does not preserve symlinks (it uploads the target's
+ * content) nor file modes, and it strips the paths' common ancestor.
+ * Gitlab artifacts keep all of that, and builds rely on it: next.js
+ * with turbopack writes `.next/node_modules/<pkg>-<hash>` as relative
+ * symlinks into the pnpm virtual store. Copied as plain directories,
+ * node resolves the package's own dependencies from the wrong place
+ * and the app crashes with ERR_MODULE_NOT_FOUND at runtime. tar keeps
+ * symlinks, modes and the paths relative to the repo root (github's
+ * own docs recommend it for exactly this).
+ *
+ * The archive is not hidden (upload-artifact skips hidden files) and
+ * lives in the workspace, the one path run steps and actions agree on
+ * inside job containers too.
+ */
+const artifactArchiveFile = (jobId) => `catladder-artifacts-${jobId}.tar`;
+exports.artifactArchiveFile = artifactArchiveFile;
+const createArtifactUploadSteps = (jobId, paths, condition) => {
+    const archive = (0, exports.artifactArchiveFile)(jobId);
+    const ifCondition = condition ? { if: condition } : {};
+    return [
+        {
+            name: "Archive artifacts",
+            ...ifCondition,
+            run: [
+                "shopt -s nullglob globstar",
+                "paths=()",
+                // unquoted on purpose: artifact paths may be globs. Non-matching
+                // globs vanish (nullglob), missing literal paths are skipped —
+                // gitlab only warns about both, so do we
+                `for path in ${paths.join(" ")}; do`,
+                '  if [ -e "$path" ] || [ -L "$path" ]; then paths+=("$path"); else echo "::warning::artifact path not found: $path"; fi',
+                "done",
+                "if [ ${#paths[@]} -eq 0 ]; then",
+                // an empty archive keeps downstream downloads from failing.
+                // Written by hand: busybox tar (alpine job images) refuses to
+                // create one, and zero blocks are what an empty tar is
+                `  head -c 10240 /dev/zero > ${archive}`,
+                "else",
+                `  tar -cf ${archive} -- "\${paths[@]}"`,
+                "fi",
+            ].join("\n"),
+            shell: "bash",
+        },
+        {
+            name: "Upload artifacts",
+            ...ifCondition,
+            uses: "actions/upload-artifact@v4",
+            with: {
+                name: jobId,
+                path: archive,
+                "if-no-files-found": "error",
+            },
+        },
+    ];
+};
+exports.createArtifactUploadSteps = createArtifactUploadSteps;
+const createArtifactDownloadSteps = (providerIds) => providerIds.length === 0
+    ? []
+    : [
+        ...providerIds.map((id) => ({
+            name: `Download artifacts from ${id}`,
+            uses: "actions/download-artifact@v4",
+            with: { name: id },
+        })),
+        {
+            name: "Extract artifacts",
+            run: providerIds
+                .flatMap((id) => [
+                `tar -xf ${(0, exports.artifactArchiveFile)(id)}`,
+                `rm ${(0, exports.artifactArchiveFile)(id)}`,
+            ])
+                .join("\n"),
+            shell: "bash",
+        },
+    ];
+exports.createArtifactDownloadSteps = createArtifactDownloadSteps;
+//# sourceMappingURL=artifactArchive.js.map
+
+/***/ }),
+
 /***/ 17300:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -3171,6 +3262,7 @@ const utils_1 = __nccwpck_require__(49401);
 const gitlab_1 = __nccwpck_require__(86962);
 const scriptFunctions_1 = __nccwpck_require__(85873);
 const ciVariables_1 = __nccwpck_require__(17300);
+const artifactArchive_1 = __nccwpck_require__(75125);
 /**
  * runner variables that only make sense on gitlab runners and must not
  * leak into github jobs (docker-in-docker daemon config, kubernetes
@@ -3381,7 +3473,7 @@ const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script
     .filter((name) => !ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV_NAMES.has(name))
     .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     const id = (0, exports.githubJobId)(context, job.name);
     const isComponent = context.type === "component";
     const createsJobEnv = !!job.environment &&
@@ -3526,13 +3618,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                 ? []
                 : [{ name: "Checkout", uses: "actions/checkout@v4" }]),
             ...createCacheSteps(context, job),
-            ...needs
-                .filter((n) => n.artifacts)
-                .map((n) => ({
-                name: `Download artifacts from ${n.id}`,
-                uses: "actions/download-artifact@v4",
-                with: { name: n.id },
-            })),
+            ...(0, artifactArchive_1.createArtifactDownloadSteps)(needs.filter((n) => n.artifacts).map((n) => n.id)),
             {
                 name: job.name,
                 id: "main",
@@ -3553,27 +3639,15 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                     },
                 ]
                 : []),
-            ...(pagesPublishDir
-                ? []
-                : uploadProviderIds.has(id) || artifactPaths.length > 0
-                    ? artifactPaths.length > 0
-                        ? [
-                            {
-                                name: "Upload artifacts",
-                                uses: "actions/upload-artifact@v4",
-                                with: {
-                                    name: id,
-                                    path: artifactPaths.join("\n"),
-                                    "if-no-files-found": "warn",
-                                    // gitlab artifacts include everything; upload-artifact
-                                    // silently drops hidden files by default — which is
-                                    // exactly where next.js builds live (.next)
-                                    "include-hidden-files": true,
-                                },
-                            },
-                        ]
-                        : []
-                    : []),
+            ...(!pagesPublishDir && artifactPaths.length > 0
+                ? (0, artifactArchive_1.createArtifactUploadSteps)(id, artifactPaths, 
+                // gitlab's `artifacts.when`: steps only run on success by default
+                ((_k = job.artifacts) === null || _k === void 0 ? void 0 : _k.when) === "always"
+                    ? "always()"
+                    : ((_l = job.artifacts) === null || _l === void 0 ? void 0 : _l.when) === "on_failure"
+                        ? "failure()"
+                        : undefined)
+                : []),
         ],
     };
     return [id, githubJob];
@@ -4266,7 +4340,6 @@ class GitlabBackend {
         return [mainInclude, ...componentIncludes];
     }
     async createPipeline(config, images) {
-        const stages = (0, getPipelineStages_1.getPipelineStages)(config);
         // register the release image first: the per-trigger job creation
         // below emits the build jobs of all images registered so far. The
         // release jobs themselves are created afterwards — they need the
@@ -4285,6 +4358,9 @@ class GitlabBackend {
             jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
         })));
         const allJobsPerTrigger = jobsPerTrigger.flatMap(({ jobs }) => jobs);
+        const stages = (0, getPipelineStages_1.getPipelineStages)(config, new Set(allJobsPerTrigger
+            .map(({ gitlabJob }) => gitlabJob.stage)
+            .filter((stage) => typeof stage === "string")));
         // the jobs the queued-release executor waits for: everything that
         // runs automatically in a main-branch pipeline. Manual jobs (stop,
         // rollback, gates) are excluded — gitlab skips a job whose needs
@@ -4939,14 +5015,23 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getPipelineStages = void 0;
 const config_1 = __nccwpck_require__(11646);
 const jobs_1 = __nccwpck_require__(98521);
+/**
+ * stages that only appear in the pipeline when a job uses them, so that
+ * projects not using the feature keep their generated files unchanged
+ */
+const OPTIONAL_STAGES = ["post-build"];
 /**
  * while technically not required, we group different envs in its own stage
  * each job from `createJobs` that is defined as `envMode: "stagePerEnv"` will have `deploy dev`, etc. instead of just `deploy`
  * this is just so that it looks nicer in gitlab and makes running mutliple manual tasks more easy to use
+ *
+ * `usedStages` are the stages of all generated jobs; optional stages are
+ * dropped when none of them is used.
  */
-function getPipelineStages(config) {
+function getPipelineStages(config, usedStages = new Set()) {
     const allEnvs = (0, config_1.getAllEnvsInAllComponents)(config).filter((e) => e !== "local");
-    const stages = jobs_1.BASE_STAGES.reduce((acc, baseStage) => [
+    const isUsed = (baseStage) => [...usedStages].some((stage) => stage === baseStage || stage.startsWith(`${baseStage} `));
+    const stages = jobs_1.BASE_STAGES.filter((baseStage) => !OPTIONAL_STAGES.includes(baseStage) || isUsed(baseStage)).reduce((acc, baseStage) => [
         ...acc,
         baseStage,
         ...allEnvs.map((e) => `${baseStage} ${e}`),
@@ -6082,7 +6167,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.hasDockerfile = exports.getDockerBuildDefaultScript = exports.getDockerBuildScriptWithBuiltInDockerFile = exports.gitlabDockerLogin = exports.DockerBuildJob = exports.getDockerJobBaseProps = exports.DOCKER_BUILD_JOB_NAME = exports.getDockerBuildVariables = exports.requiresDockerBuild = exports.getDockerImageVariables = void 0;
+exports.hasDockerfile = exports.getDockerBuildDefaultScript = exports.getDockerBuildScriptWithBuiltInDockerFile = exports.gitlabDockerLogin = exports.DockerBuildJob = exports.getDockerJobBaseProps = exports.DOCKER_BUILD_JOB_NAME = exports.getDockerBuildVariables = exports.requiresDockerBuild = exports.getReuseMainBranchImageScript = exports.getDockerImageVariables = void 0;
 const fs_1 = __nccwpck_require__(79896);
 const lodash_es_1 = __nccwpck_require__(50210);
 const path_1 = __importDefault(__nccwpck_require__(16928));
@@ -6090,6 +6175,7 @@ const deploy_1 = __nccwpck_require__(3659);
 const artifactsRegistry_1 = __nccwpck_require__(44330);
 const gcloudServiceAccountLoginCommands_1 = __nccwpck_require__(54799);
 const ciVariables_1 = __nccwpck_require__(91215);
+const configruedEnvs_1 = __nccwpck_require__(38866);
 const runner_1 = __nccwpck_require__(92146);
 const jobs_1 = __nccwpck_require__(98521);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -6121,6 +6207,52 @@ const getDockerImageVariables = (context) => {
     };
 };
 exports.getDockerImageVariables = getDockerImageVariables;
+const shellQuote = (value) => `'${value.replace(/'/g, `'\\''`)}'`;
+/**
+ * script that copies the main branch image instead of building it, see
+ * `build.reuseMainBranchImage`. Exits the job when it
+ * reused an image, so the build script after it only runs as fallback.
+ */
+const getReuseMainBranchImageScript = (context) => {
+    var _a, _b;
+    const buildConfig = context.build.config;
+    // only standalone builds have the option, workspace builds don't
+    const option = "reuseMainBranchImage" in buildConfig
+        ? buildConfig.reuseMainBranchImage
+        : undefined;
+    const { fullConfig, name, env } = context;
+    if (!option ||
+        !(0, configruedEnvs_1.getAllEnvsByTrigger)(fullConfig, name, "taggedRelease").includes(env)) {
+        return [];
+    }
+    if ((0, deploy_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
+        throw new Error(`${name}: build.reuseMainBranchImage is not supported for google-cloudrun deploys`);
+    }
+    const [mainBranchEnv] = (0, configruedEnvs_1.getAllEnvsByTrigger)(fullConfig, name, "mainBranch");
+    if (!mainBranchEnv) {
+        throw new Error(`${name}: build.reuseMainBranchImage needs an env that builds on the main branch (e.g. dev)`);
+    }
+    const releaseFiles = (_b = (option === true ? undefined : option.releaseFiles)) !== null && _b !== void 0 ? _b : [
+        "CHANGELOG.md",
+    ];
+    const sha = (0, ciVariables_1.getCiVariable)(context, "commitSha");
+    return [
+        ...(0, exports.gitlabDockerLogin)(context),
+        `REUSE_IMAGE="${(0, ciVariables_1.getCiVariable)(context, "registryImage")}/${mainBranchEnv}/${name}"`,
+        `reuse_sha=""
+if docker buildx imagetools inspect "$REUSE_IMAGE:${sha}" >/dev/null 2>&1; then
+  reuse_sha="${sha}"
+elif git fetch --quiet --depth=2 origin "${sha}" && [ -z "$(git diff --name-only "${sha}^" "${sha}" | grep -vxF ${releaseFiles.map((f) => `-e ${shellQuote(f)}`).join(" ")})" ]; then
+  reuse_sha="$(git rev-parse "${sha}^")"
+fi
+if [ -n "$reuse_sha" ] && docker buildx imagetools create --prefer-index=false --tag "$DOCKER_IMAGE:$DOCKER_IMAGE_TAG" "$REUSE_IMAGE:$reuse_sha"; then
+  echo "♻️ reused $REUSE_IMAGE:$reuse_sha, skipping the build"
+  exit 0
+fi
+echo "no main branch image to reuse, building the image"`,
+    ];
+};
+exports.getReuseMainBranchImageScript = getReuseMainBranchImageScript;
 /**
  * Weather the context requires a docker build
  */
@@ -6192,7 +6324,7 @@ class DockerBuildJob extends jobs_1.CatladderJob {
             provides: ["dockerImage"],
             caches: cache,
             ...(0, exports.getDockerJobBaseProps)(),
-            script: script || [],
+            script: [...(0, exports.getReuseMainBranchImageScript)(context), ...(script || [])],
             variables: {
                 ...(0, removeUndefined_1.removeUndefined)((0, exports.getDockerBuildVariables)(context)),
                 ...(0, removeUndefined_1.removeUndefined)(variables !== null && variables !== void 0 ? variables : {}),
@@ -7348,6 +7480,9 @@ const getEnvType_1 = __nccwpck_require__(46080);
 const getConfiguredAndDefaultEnvs = (config, componentName, envTypes) => {
     var _a, _b;
     const configuredEnvs = (_a = config.components[componentName].env) !== null && _a !== void 0 ? _a : {};
+    if ((0, types_1.isEnvironmentDisabled)(config.environments, "local")) {
+        throw new Error(`environment "local" cannot be disabled (environments.local: false) — it is only used for local development`);
+    }
     // the default envs have the same name as the env types
     // these can be disabled with settimg them to `false`
     // this is the list of all not disabled envs. These are always returned
@@ -7356,6 +7491,7 @@ const getConfiguredAndDefaultEnvs = (config, componentName, envTypes) => {
     // component deploys to them unless it opts out with `env.<name>: false`
     const declaredEnvs = Object.keys((_b = config.environments) !== null && _b !== void 0 ? _b : {})
         .filter((envName) => !(0, types_1.isKnowEnvType)(envName)) // default envs are already handled above
+        .filter((envName) => !(0, types_1.isEnvironmentDisabled)(config.environments, envName))
         .map((envName) => {
         const envType = (0, getEnvType_1.getDeclaredEnvType)(config.environments, envName);
         if (!envType) {
@@ -7372,13 +7508,15 @@ const getConfiguredAndDefaultEnvs = (config, componentName, envTypes) => {
         config.type &&
         envTypes.includes(config.type))
         .map(([envName]) => envName);
+    // envs disabled project-wide (`environments.<name>: false`) exist for
+    // no component — this wins over any per-component config of the env
     return [
         ...new Set([
             ...enabledDefaultEnvs,
             ...declaredEnvs,
             ...configuredCustomEnvs,
         ]),
-    ];
+    ].filter((envName) => !(0, types_1.isEnvironmentDisabled)(config.environments, envName));
 };
 const getAllEnvs = (config, componentName) => {
     return getConfiguredAndDefaultEnvs(config, componentName, types_1.DEFAULT_ENV_TYPES);
@@ -7825,6 +7963,9 @@ const assertValidInheritTarget = (environments, env, target) => {
     if (target === "local") {
         throw new Error(`environment "${env}" cannot inherit from "local" — local is not a deployment environment`);
     }
+    if ((0, config_1.isEnvironmentDisabled)(environments, target)) {
+        throw new Error(`environment "${env}" inherits from "${target}", which is disabled (environments.${target}: false)`);
+    }
     if (!(0, config_1.isKnowEnvType)(target) && !(environments === null || environments === void 0 ? void 0 : environments[target])) {
         throw new Error(`environment "${env}" inherits from unknown environment "${target}"`);
     }
@@ -7840,7 +7981,7 @@ const getInheritedConfigChain = (environments, env) => {
     const seen = new Set([env]);
     let current = env;
     for (;;) {
-        const target = (0, exports.normalizeEnvInherit)((_a = environments === null || environments === void 0 ? void 0 : environments[current]) === null || _a === void 0 ? void 0 : _a.inherit).config;
+        const target = (0, exports.normalizeEnvInherit)((_a = (0, config_1.getEnvironmentConfig)(environments, current)) === null || _a === void 0 ? void 0 : _a.inherit).config;
         if (!target)
             break;
         assertValidInheritTarget(environments, current, target);
@@ -7864,7 +8005,7 @@ const getSecretsEnv = (environments, env) => {
     const seen = new Set([env]);
     let current = env;
     for (;;) {
-        const target = (0, exports.normalizeEnvInherit)((_a = environments === null || environments === void 0 ? void 0 : environments[current]) === null || _a === void 0 ? void 0 : _a.inherit).secrets;
+        const target = (0, exports.normalizeEnvInherit)((_a = (0, config_1.getEnvironmentConfig)(environments, current)) === null || _a === void 0 ? void 0 : _a.inherit).secrets;
         if (!target)
             return current;
         assertValidInheritTarget(environments, current, target);
@@ -7937,7 +8078,7 @@ const getDefaultOnForType = (envType) => {
  */
 const getEnvOn = (env, envConfig, environments) => {
     var _a;
-    const on = (_a = environments === null || environments === void 0 ? void 0 : environments[env]) === null || _a === void 0 ? void 0 : _a.on;
+    const on = (_a = (0, types_1.getEnvironmentConfig)(environments, env)) === null || _a === void 0 ? void 0 : _a.on;
     if (on !== undefined)
         return on;
     return getDefaultOnForType((0, getEnvType_1.getEnvType)(env, envConfig, environments));
@@ -7962,7 +8103,7 @@ const getEnvInherit_1 = __nccwpck_require__(52181);
  * the type of the env they inherit their config from
  */
 const getDeclaredEnvType = (environments, env, seen = new Set()) => {
-    const declared = environments === null || environments === void 0 ? void 0 : environments[env];
+    const declared = (0, types_1.getEnvironmentConfig)(environments, env);
     if (declared === null || declared === void 0 ? void 0 : declared.type)
         return declared.type;
     if ((0, types_1.isKnowEnvType)(env))
@@ -8029,6 +8170,7 @@ exports.getEnvironment = getEnvironment;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getEnvironmentContext = void 0;
 const bash_1 = __nccwpck_require__(94143);
+const config_1 = __nccwpck_require__(75591);
 const getEnvConfig_1 = __nccwpck_require__(69578);
 const getEnvInstance_1 = __nccwpck_require__(13055);
 const getEnvInherit_1 = __nccwpck_require__(52181);
@@ -8040,7 +8182,7 @@ const getEnvironmentSlugPrefix = (env, instance) => {
     return env;
 };
 const getEnvironmentContext = ({ env, componentName, config, pipelineType, }) => {
-    var _a, _b;
+    var _a;
     const envConfigRaw = (0, getEnvConfig_1.getEnvConfig)(config, componentName, env);
     const envType = (0, getEnvType_1.getEnvType)(env, envConfigRaw, config.environments);
     const instance = (0, getEnvInstance_1.getEnvInstance)(envConfigRaw, env, pipelineType, config.environments);
@@ -8048,7 +8190,7 @@ const getEnvironmentContext = ({ env, componentName, config, pipelineType, }) =>
     // config; undefined means the env type's default applies
     const autoStop = envConfigRaw.autoStop !== undefined
         ? envConfigRaw.autoStop
-        : (_b = (_a = config.environments) === null || _a === void 0 ? void 0 : _a[env]) === null || _b === void 0 ? void 0 : _b.autoStop;
+        : (_a = (0, config_1.getEnvironmentConfig)(config.environments, env)) === null || _a === void 0 ? void 0 : _a.autoStop;
     const environmentSlugPrefix = getEnvironmentSlugPrefix(env, instance);
     const environmentSlug = environmentSlugPrefix.concat(`-${componentName}`);
     const fullName = (0, bash_1.joinBashExpressions)([config.customerName, config.appName, environmentSlug], "-");
@@ -8973,14 +9115,20 @@ class DeployJob extends jobs_1.CatladderJob {
                     : []),
             ];
         // we don't want to deploy when there is a broken test
-        const qualityGateRequirement = {
-            capability: "qualityGate",
-            artifacts: false,
-            // use test from workspace build
-            from: (0, context_1.componentContextHasWorkspaceBuild)(context)
-                ? { workspace: context.build.workspaceName }
-                : undefined,
-        };
+        const qualityGateRequirements = [
+            // the component's own gates (e.g. post-build tests, custom test jobs)
+            { capability: "qualityGate", artifacts: false },
+            // ...and the gates of the workspace build it is built in
+            ...((0, context_1.componentContextHasWorkspaceBuild)(context)
+                ? [
+                    {
+                        capability: "qualityGate",
+                        artifacts: false,
+                        from: { workspace: context.build.workspaceName },
+                    },
+                ]
+                : []),
+        ];
         super({
             name: exports.DEPLOY_JOB_NAME,
             script: jobDefinition.script,
@@ -8997,7 +9145,7 @@ class DeployJob extends jobs_1.CatladderJob {
                 ...waitForRequirements,
                 // if the build is disabled, we don't need to wait for it
                 ...(context.build.type !== "disabled"
-                    ? [...buildRequirements, qualityGateRequirement]
+                    ? [...buildRequirements, ...qualityGateRequirements]
                     : []),
             ],
             gate: whenDeploy,
@@ -9861,7 +10009,9 @@ const getSchedulerArgs = (scheduler, context) => {
                 appFullName: context.environment.fullName,
                 projectId,
                 region,
-            }),
+                // lands in a script line (not an exported variable), so the
+                // raw expression is what the shell has to see
+            }).toString(),
             "message-body": body
                 ? '"' + (0, bash_1.bashEscape)(JSON.stringify(body)) + '"'
                 : undefined,
@@ -10301,11 +10451,16 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getCloudRunJobExecuteUrl = void 0;
+const bash_1 = __nccwpck_require__(94143);
 const jobName_1 = __nccwpck_require__(65576);
 function getCloudRunJobExecuteUrl(jobName, { region, projectId, appFullName, }) {
     const uriBase = `https://${region}-run.googleapis.com/apis/run.googleapis.com/v1/namespaces/${projectId}/jobs`;
     const fullJobName = (0, jobName_1.getCloudRunJobName)(appFullName, jobName);
-    return `${uriBase}/${fullJobName}:run`;
+    // joined, not interpolated: on review envs the job name is a bash
+    // expression (the review slug), and a template string would demote
+    // it to a plain string — its quotes then get escaped as literal
+    // characters when the variable is exported
+    return (0, bash_1.joinBashExpressions)([uriBase, "/", fullJobName, ":run"]);
 }
 exports.getCloudRunJobExecuteUrl = getCloudRunJobExecuteUrl;
 //# sourceMappingURL=cloudRunExecutionUrl.js.map
@@ -11766,6 +11921,7 @@ __exportStar(__nccwpck_require__(15707), exports);
 __exportStar(__nccwpck_require__(45492), exports);
 __exportStar(__nccwpck_require__(3659), exports);
 __exportStar(__nccwpck_require__(50713), exports);
+__exportStar(__nccwpck_require__(28458), exports);
 __exportStar(__nccwpck_require__(26041), exports);
 __exportStar(__nccwpck_require__(47663), exports);
 __exportStar(__nccwpck_require__(91804), exports);
@@ -12363,6 +12519,7 @@ exports.createJobsForComponentContext = void 0;
 const build_1 = __nccwpck_require__(45492);
 const deploy_1 = __nccwpck_require__(3659);
 const jobs_1 = __nccwpck_require__(98521);
+const createPostBuildTestJobs_1 = __nccwpck_require__(61844);
 const createVerifyJobs_1 = __nccwpck_require__(66900);
 const injectDefaultVarsInCustomJobs = (context, jobs) => jobs.map(({ variables, ...job }) => {
     var _a;
@@ -12382,17 +12539,26 @@ const getCustomJobs = (context) => {
     return injectDefaultVarsInCustomJobs(context, rawJobs);
 };
 const createJobsForComponentContext = async (context) => {
-    const [buildJobs, deployJobs, verifyJobs] = await Promise.all([
+    const [buildJobs, postBuildTestJobs, deployJobs, verifyJobs] = await Promise.all([
         context.build.type !== "disabled"
             ? build_1.BUILD_TYPES[context.build.buildType].jobs(context)
             : [],
+        (0, createPostBuildTestJobs_1.createPostBuildTestJobs)(context),
         context.componentConfig.deploy !== false
             ? deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context)
             : [],
         (0, createVerifyJobs_1.createVerifyJobs)(context),
     ]);
     const customJobs = getCustomJobs(context);
-    return [...buildJobs, ...deployJobs, ...verifyJobs, ...customJobs];
+    const otherJobs = [...buildJobs, ...deployJobs, ...verifyJobs, ...customJobs];
+    (0, createPostBuildTestJobs_1.assertUniquePostBuildTestNames)(context, postBuildTestJobs, otherJobs);
+    return [
+        ...buildJobs,
+        ...postBuildTestJobs,
+        ...deployJobs,
+        ...verifyJobs,
+        ...customJobs,
+    ];
 };
 exports.createJobsForComponentContext = createJobsForComponentContext;
 //# sourceMappingURL=createJobsForComponent.js.map
@@ -12407,9 +12573,14 @@ exports.createJobsForComponentContext = createJobsForComponentContext;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createJobsForWorkspace = void 0;
 const build_1 = __nccwpck_require__(45492);
+const createPostBuildTestJobs_1 = __nccwpck_require__(61844);
 const createJobsForWorkspace = async (context) => {
-    const buildJobs = await build_1.WORKSPACE_BUILD_TYPES[context.build.buildType].jobs(context);
-    return buildJobs;
+    const [buildJobs, postBuildTestJobs] = await Promise.all([
+        build_1.WORKSPACE_BUILD_TYPES[context.build.buildType].jobs(context),
+        (0, createPostBuildTestJobs_1.createPostBuildTestJobs)(context),
+    ]);
+    (0, createPostBuildTestJobs_1.assertUniquePostBuildTestNames)(context, postBuildTestJobs, buildJobs);
+    return [...buildJobs, ...postBuildTestJobs];
 };
 exports.createJobsForWorkspace = createJobsForWorkspace;
 //# sourceMappingURL=createJobsForWorkspace.js.map
@@ -12687,15 +12858,18 @@ const getPackageManagerInfoForComponent = async (config, componentName) => {
     const patchFiles = baseInfo.type === "pnpm"
         ? (0, pnpmUtils_1.getPnpmPatchFiles)(componentIsInWorkspace ? workspaceRoot : component.dir)
         : [];
+    // sort the variable parts: their order depends on package.json key order
+    // and dependency traversal, and an unstable order rewrites the generated
+    // pipeline files on every regeneration without any real change
     const pathsToCopyInDocker = [
         ...new Set([
             packageJson,
             ...(workspacePackageJson ? [workspacePackageJson] : []),
             lockFile,
             ...configFilePaths,
-            ...allWorkspaceManifests,
-            ...patchFiles,
-            ...currentWorkspaceDependencies,
+            ...[...allWorkspaceManifests].sort(),
+            ...[...patchFiles].sort(),
+            ...[...currentWorkspaceDependencies].sort(),
         ]),
     ];
     return {
@@ -12875,6 +13049,7 @@ exports.resolveRequirements = void 0;
 const DEFAULT_STAGE_CAPABILITIES = {
     build: "build",
     test: "qualityGate",
+    "post-build": "qualityGate",
     deploy: "deployment",
 };
 /**
@@ -13016,6 +13191,216 @@ exports.getWorkspaceDependencies = getWorkspaceDependencies;
 
 /***/ }),
 
+/***/ 61844:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertUniquePostBuildTestNames = exports.createPostBuildTestJobs = exports.postBuildTestJobName = exports.POST_BUILD_TEST_STAGE = void 0;
+const createArtifactsConfig_1 = __nccwpck_require__(14149);
+const cache_1 = __nccwpck_require__(74559);
+const constants_1 = __nccwpck_require__(5576);
+const packageManagerInstall_1 = __nccwpck_require__(28419);
+const types_1 = __nccwpck_require__(35249);
+const runner_1 = __nccwpck_require__(92146);
+const jobs_1 = __nccwpck_require__(98521);
+const utils_1 = __nccwpck_require__(49401);
+exports.POST_BUILD_TEST_STAGE = "post-build";
+const postBuildTestJobName = (name) => `🔬 ${name}`;
+exports.postBuildTestJobName = postBuildTestJobName;
+const getPostBuildTestsConfig = (context) => {
+    if (context.type === "workspace") {
+        return context.build.config.postBuildTests;
+    }
+    if (context.build.type === "disabled") {
+        return undefined;
+    }
+    return context.build.config.postBuildTests;
+};
+/**
+ * whether the build output is a node project, so the job has to install
+ * the dependencies before running the tests
+ */
+const isNodeBuild = (context) => {
+    if (context.type === "workspace") {
+        return true; // workspace builds are node builds
+    }
+    if (context.build.type === "fromWorkspace") {
+        return true;
+    }
+    if (context.build.type === "standalone") {
+        return (0, types_1.isOfBuildType)(context.build.config, "node", "node-static", "storybook", "meteor");
+    }
+    return false;
+};
+const hasBuildCommand = (buildCommand) => buildCommand !== null && buildCommand !== false;
+/**
+ * whether the build creates an app build job with artifacts. Rails builds
+ * and builds with `buildCommand: false` only build the docker image.
+ */
+const hasBuildArtifacts = (context) => {
+    if (context.type === "workspace") {
+        return hasBuildCommand(context.build.config.buildCommand);
+    }
+    if (context.build.type === "fromWorkspace") {
+        return hasBuildCommand(context.build.workspaceBuildConfig.buildCommand);
+    }
+    if (context.build.type === "standalone") {
+        return (!(0, types_1.isOfBuildType)(context.build.config, "rails") &&
+            hasBuildCommand(context.build.config.buildCommand));
+    }
+    return false;
+};
+const getDefaultImage = (context) => {
+    if (context.type === "component" &&
+        context.build.type === "standalone" &&
+        (0, types_1.isOfBuildType)(context.build.config, "custom")) {
+        // custom builds bring their own toolchain image
+        return context.build.config.jobImage;
+    }
+    return (0, runner_1.getRunnerImage)("jobs-default");
+};
+/**
+ * jobs for `postBuildTests`: they run after the build in the `post-build`
+ * stage, against the build artifacts, and act as quality gates, so a
+ * failing post-build test blocks the deploy.
+ */
+const createPostBuildTestJobs = async (context) => {
+    var _a;
+    // like lint and test: tagged releases deploy what was already tested
+    if (context.trigger === "taggedRelease") {
+        return [];
+    }
+    const tests = Object.entries((_a = getPostBuildTestsConfig(context)) !== null && _a !== void 0 ? _a : {}).filter((entry) => entry[1] !== false);
+    if (tests.length === 0) {
+        return [];
+    }
+    const nodeBuild = isNodeBuild(context);
+    const [packageManagerInstall, nodeCache] = nodeBuild
+        ? await Promise.all([
+            (0, packageManagerInstall_1.getPackageManagerInstall)(context),
+            // pull-only: the build job is the designated cache writer
+            (0, cache_1.getNodeCache)(context, "pull"),
+        ])
+        : [null, null];
+    // components built in a workspace test the workspace build output
+    const from = context.type === "component" && context.build.type === "fromWorkspace"
+        ? { workspace: context.build.workspaceName }
+        : undefined;
+    const buildRequirement = hasBuildArtifacts(context)
+        ? { capability: "buildArtifacts", artifacts: true, strict: true, from }
+        : // no build artifacts (e.g. rails): run after the build (docker image)
+            { capability: "build", artifacts: false, from };
+    return tests.map(([name, test]) => {
+        var _a, _b, _c;
+        const artifactsConfig = (0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, test.artifactsReports, test.artifacts);
+        return new jobs_1.CatladderJob({
+            name: (0, exports.postBuildTestJobName)(name),
+            stage: exports.POST_BUILD_TEST_STAGE,
+            envMode: "stagePerEnv",
+            provides: ["qualityGate"],
+            needs: [],
+            requires: [buildRequirement],
+            image: (_a = test.jobImage) !== null && _a !== void 0 ? _a : getDefaultImage(context),
+            services: test.services,
+            // neutral cache declarations, lowered by each backend
+            caches: nodeCache !== null && nodeCache !== void 0 ? nodeCache : undefined,
+            variables: {
+                APP_PATH: context.build.dir,
+                ...(context.type === "component"
+                    ? context.environment.jobOnlyVars.build.envVars
+                    : {}),
+                ...((_b = test.vars) !== null && _b !== void 0 ? _b : {}),
+            },
+            runnerVariables: {
+                ...(nodeBuild ? constants_1.NODE_RUNNER_BUILD_VARIABLES : {}),
+                ...((_c = test.runnerVariables) !== null && _c !== void 0 ? _c : {}),
+            },
+            script: [
+                ...(nodeBuild ? (0, packageManagerInstall_1.ensureNodeVersion)(context) : []),
+                `cd ${context.build.dir}`,
+                ...(packageManagerInstall !== null && packageManagerInstall !== void 0 ? packageManagerInstall : []),
+                ...(0, utils_1.ensureArray)(test.command),
+            ],
+            allow_failure: test.allowFailure,
+            // reports and screenshots are most needed when the tests fail
+            ...(artifactsConfig
+                ? {
+                    artifacts: {
+                        when: "always",
+                        ...artifactsConfig.artifacts,
+                    },
+                }
+                : {}),
+        });
+    });
+};
+exports.createPostBuildTestJobs = createPostBuildTestJobs;
+const jobIdOf = (jobName) => jobName
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+/**
+ * post-build test names are chosen by the user. Github job ids drop the
+ * emoji of the job name, so e.g. a post-build test named `test` would
+ * clash with the `🧪 test` job.
+ */
+const assertUniquePostBuildTestNames = (context, postBuildTestJobs, otherJobs) => {
+    const seenIds = new Set(otherJobs.map((job) => jobIdOf(job.name)));
+    // also catches two post-build tests that only differ in case or
+    // punctuation (e.g. `e2e` and `E2E`)
+    const clash = postBuildTestJobs.find((job) => {
+        const id = jobIdOf(job.name);
+        const isClash = seenIds.has(id);
+        seenIds.add(id);
+        return isClash;
+    });
+    if (clash) {
+        throw new Error(`${context.name}: post-build test '${clash.name}' clashes with another job of the same name, please rename it in postBuildTests`);
+    }
+};
+exports.assertUniquePostBuildTestNames = assertUniquePostBuildTestNames;
+//# sourceMappingURL=createPostBuildTestJobs.js.map
+
+/***/ }),
+
+/***/ 28458:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+__exportStar(__nccwpck_require__(92967), exports);
+__exportStar(__nccwpck_require__(61844), exports);
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 92967:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+//# sourceMappingURL=types.js.map
+
+/***/ }),
+
 /***/ 26041:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -13212,7 +13597,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isKnowEnvType = exports.DEFAULT_ENV_TYPES = exports.DEFAULT_ENVS = exports.ENV_TYPES = exports.envTriggerEquals = exports.isBranchTrigger = exports.ALL_PIPELINE_TRIGGERS = void 0;
+exports.isEnvironmentDisabled = exports.getEnvironmentConfig = exports.isKnowEnvType = exports.DEFAULT_ENV_TYPES = exports.DEFAULT_ENVS = exports.ENV_TYPES = exports.envTriggerEquals = exports.isBranchTrigger = exports.ALL_PIPELINE_TRIGGERS = void 0;
 exports.ALL_PIPELINE_TRIGGERS = [
     "mainBranch",
     "mr",
@@ -13255,6 +13640,14 @@ const isKnowEnvType = (env) => {
     return env in exports.ENV_TYPES;
 };
 exports.isKnowEnvType = isKnowEnvType;
+/**
+ * the project-wide config of `env` (undefined when not declared or
+ * disabled)
+ */
+const getEnvironmentConfig = (environments, env) => (environments === null || environments === void 0 ? void 0 : environments[env]) || undefined;
+exports.getEnvironmentConfig = getEnvironmentConfig;
+const isEnvironmentDisabled = (environments, env) => (environments === null || environments === void 0 ? void 0 : environments[env]) === false;
+exports.isEnvironmentDisabled = isEnvironmentDisabled;
 //# sourceMappingURL=config.js.map
 
 /***/ }),
@@ -13341,6 +13734,7 @@ exports.BASE_STAGES = [
     "setup",
     "test",
     "build",
+    "post-build",
     "deploy",
     "verify",
     "agents",