@catladder/cli 0.0.0-main-414c8270 → 0.0.0-main-0acdca98

package/dist/bundles/catenv/index.js

@@ -91,7 +91,7 @@ var getAllVariablesToPrint = function (config, choice) { return __awaiter(void 0
                 currentComponent = _a;
                 variables = {};
                 if (!currentComponent) return [3 /*break*/, 5];
-                return [4 /*yield*/, (0, getProjectConfig_1.getEnvVars)(null, env, currentComponent)];
+                return [4 /*yield*/, (0, getProjectConfig_1.getEnvVarsResolved)(null, env, currentComponent)];
             case 4:
                 variables = _d.sent();
                 return [3 /*break*/, 7];
@@ -99,7 +99,7 @@ var getAllVariablesToPrint = function (config, choice) { return __awaiter(void 0
                     var subappvars, _a;
                     return __generator(this, function (_b) {
                         switch (_b.label) {
-                            case 0: return [4 /*yield*/, (0, getProjectConfig_1.getEnvVars)(null, env, componentName)];
+                            case 0: return [4 /*yield*/, (0, getProjectConfig_1.getEnvVarsResolved)(null, env, componentName)];
                             case 1:
                                 subappvars = _b.sent();
                                 _a = [{}];
@@ -176,6 +176,17 @@ var choice = process.argv[2] ? (0, parseChoice_1.parseChoice)(process.argv[2]) :
 
 "use strict";
 
+var __assign = (this && this.__assign) || function () {
+    __assign = Object.assign || function(t) {
+        for (var s, i = 1, n = arguments.length; i < n; i++) {
+            s = arguments[i];
+            for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p))
+                t[p] = s[p];
+        }
+        return t;
+    };
+    return __assign.apply(this, arguments);
+};
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
@@ -220,7 +231,7 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 exports.__esModule = true;
-exports.getEnvVars = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.getGitlabCi = exports.getGitlabCiFilePath = exports.getProjectConfig = exports.parseChoice = void 0;
+exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.getGitlabCi = exports.getGitlabCiFilePath = exports.getProjectConfig = exports.parseChoice = void 0;
 var pipeline_1 = __nccwpck_require__(5355);
 var gitlab_1 = __nccwpck_require__(9818);
 var projects_1 = __nccwpck_require__(1619);
@@ -424,27 +435,55 @@ var resolveSecrets = function (vorpal, allEnvVars) { return __awaiter(void 0, vo
         }
     });
 }); };
-var getEnvVars = function (vorpal, env, componentName) { return __awaiter(void 0, void 0, void 0, function () {
+var getEnvVarsResolved = function (vorpal, env, componentName) { return __awaiter(void 0, void 0, void 0, function () {
     var envionment, e_2;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
-                _a.trys.push([0, 2, , 3]);
-                return [4 /*yield*/, (0, exports.getEnvironment)(env, componentName)];
+                if (!componentName) {
+                    return [2 /*return*/, {}];
+                }
+                _a.label = 1;
             case 1:
+                _a.trys.push([1, 3, , 4]);
+                return [4 /*yield*/, (0, exports.getEnvironment)(env, componentName)];
+            case 2:
                 envionment = _a.sent();
                 // in the pipeline the secrets alreadyy exists  and bash will expand them
                 // but here we need to manually load them
                 return [2 /*return*/, resolveSecrets(vorpal, envionment.envVars)];
-            case 2:
+            case 3:
                 e_2 = _a.sent();
                 // env is disabled
                 return [2 /*return*/, {}];
+            case 4: return [2 /*return*/];
+        }
+    });
+}); };
+exports.getEnvVarsResolved = getEnvVarsResolved;
+/**
+ *
+ * is used to get job only vars that should also be editable locally with catladder.
+ */
+var getJobOnlyEnvVarsResolved = function (vorpal, env, componentName) { return __awaiter(void 0, void 0, void 0, function () {
+    var envionment, e_3;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                _a.trys.push([0, 2, , 3]);
+                return [4 /*yield*/, (0, exports.getEnvironment)(env, componentName)];
+            case 1:
+                envionment = _a.sent();
+                return [2 /*return*/, resolveSecrets(vorpal, __assign(__assign({}, envionment.jobOnlyVars.build.envVars), envionment.jobOnlyVars.deploy.envVars))];
+            case 2:
+                e_3 = _a.sent();
+                // env is disabled
+                return [2 /*return*/, {}];
             case 3: return [2 /*return*/];
         }
     });
 }); };
-exports.getEnvVars = getEnvVars;
+exports.getJobOnlyEnvVarsResolved = getJobOnlyEnvVarsResolved;
 //# sourceMappingURL=getProjectConfig.js.map
 
 /***/ }),
@@ -38790,7 +38829,7 @@ var createBuildJob = function (context, _a) {
     image: (0, __1.getRunnerImage)("jobs-default"),
     needs: [],
     cache: [],
-    variables: __assign(__assign(__assign(__assign({}, constants_1.RUNNER_BUILD_RESOURCE_VARIABLES), variables !== null && variables !== void 0 ? variables : {}), context.environment.envVars), (_b = context.componentConfig.build.extraVars) !== null && _b !== void 0 ? _b : {}),
+    variables: __assign(__assign(__assign(__assign(__assign({}, constants_1.RUNNER_BUILD_RESOURCE_VARIABLES), variables !== null && variables !== void 0 ? variables : {}), context.environment.envVars), context.environment.jobOnlyVars.build.envVars), (_b = context.componentConfig.build.extraVars) !== null && _b !== void 0 ? _b : {}),
     script: __spreadArray(__spreadArray(__spreadArray(__spreadArray([], __read((0, writeBuildInfo_1.writeBuildInfo)(context)), false), __read((0, yarn_1.ensureNodeVersion)(context)), false), ["cd ".concat(context.componentConfig.dir)], false), __read((_c = (0, utils_1.ensureArray)(script)) !== null && _c !== void 0 ? _c : []), false),
     artifacts: {
       paths: [(0, path_1.join)(context.componentConfig.dir, "__build_info.json")],
@@ -39029,9 +39068,9 @@ var createCustomTestJobs = function (context) {
     throw new Error("deploy config is not custom");
   }
   var base = {
-    variables: __assign(__assign({
+    variables: __assign(__assign(__assign({
       APP_PATH: context.componentConfig.dir
-    }, RUNNER_CUSTOM_TEST_VARIABLES), (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {}),
+    }, RUNNER_CUSTOM_TEST_VARIABLES), context.environment.jobOnlyVars.build.envVars), (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {}),
     services: buildConfig.jobServices,
     cache: buildConfig.jobCache,
     stage: "test",
@@ -39722,9 +39761,9 @@ var createNodeTestJobs = function (context) {
   }
   var buildConfig = context.componentConfig.build;
   var base = {
-    variables: __assign(__assign({
+    variables: __assign(__assign(__assign({
       APP_PATH: context.componentConfig.dir
-    }, constants_1.NODE_RUNNER_BUILD_VARIABLES), (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {}),
+    }, constants_1.NODE_RUNNER_BUILD_VARIABLES), context.environment.jobOnlyVars.build.envVars), (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {}),
     stage: "test",
     needs: [],
     envMode: "none"
@@ -39841,6 +39880,16 @@ exports.getDockerAppCopyAndBuildScript = getDockerAppCopyAndBuildScript;
 "use strict";
 
 
+var __assign = this && this.__assign || function () {
+  __assign = Object.assign || function (t) {
+    for (var s, i = 1, n = arguments.length; i < n; i++) {
+      s = arguments[i];
+      for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+    }
+    return t;
+  };
+  return __assign.apply(this, arguments);
+};
 var __read = this && this.__read || function (o, n) {
   var m = typeof Symbol === "function" && o[Symbol.iterator];
   if (!m) return o;
@@ -39882,7 +39931,7 @@ var createRailsBuildJobs = function (context) {
     return "--env '".concat(k).concat(v ? "=".concat(v) : "", "'");
   }).join(" ");
   return [(0, docker_1.createDockerBuildJobBase)(context, {
-    variables: context.componentConfig.build.extraVars,
+    variables: __assign(__assign({}, context.environment.jobOnlyVars.build.envVars), context.componentConfig.build.extraVars),
     // custom script
     script: [docker_1.gitlabDockerLogin, "docker pull $DOCKER_CACHE_IMAGE || true", "wget --output-document=- https://github.com/buildpacks/pack/releases/download/v".concat(cnbConf === null || cnbConf === void 0 ? void 0 : cnbConf.packVersion, "/pack-v").concat(cnbConf === null || cnbConf === void 0 ? void 0 : cnbConf.packVersion, "-linux.tgz | tar -zx --directory /usr/local/bin pack"), "chmod +x /usr/local/bin/pack",
     //  replace private git ssh gem sources with https to make bundler with credentials via env var work
@@ -39999,7 +40048,7 @@ var createRailsTestJobs = function (context) {
   }
   var buildConfig = context.componentConfig.build;
   var base = {
-    variables: (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {},
+    variables: __assign(__assign({}, context.environment.jobOnlyVars.build.envVars), (_b = buildConfig.extraVars) !== null && _b !== void 0 ? _b : {}),
     stage: "test",
     needs: [],
     envMode: "none"
@@ -40232,7 +40281,7 @@ exports.readConfigSync = readConfigSync;
 
 exports.__esModule = true;
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "main-414c8270" || 0;
+exports.PIPELINE_IMAGE_TAG = "main-0acdca98" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -40288,6 +40337,16 @@ exports.getEnvType = getEnvType;
 "use strict";
 
 
+var __assign = this && this.__assign || function () {
+  __assign = Object.assign || function (t) {
+    for (var s, i = 1, n = arguments.length; i < n; i++) {
+      s = arguments[i];
+      for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+    }
+    return t;
+  };
+  return __assign.apply(this, arguments);
+};
 var __awaiter = this && this.__awaiter || function (thisArg, _arguments, P, generator) {
   function adopt(value) {
     return value instanceof P ? value : new P(function (resolve) {
@@ -40409,30 +40468,26 @@ var getEnvironmentContext_1 = __nccwpck_require__(4650);
 var getEnvironmentVariables_1 = __nccwpck_require__(6602);
 var getEnvironment = function (config, componentName, env, commitInfo) {
   return __awaiter(void 0, void 0, void 0, function () {
-    var _a, envVars, secretEnvVarKeys, host, url, envContext, envType;
-    return __generator(this, function (_b) {
-      switch (_b.label) {
+    var variables, envContext, envType;
+    return __generator(this, function (_a) {
+      switch (_a.label) {
         case 0:
           return [4 /*yield*/, (0, getEnvironmentVariables_1.getEnvironmentVariables)(config, componentName, env, commitInfo)];
         case 1:
-          _a = _b.sent(), envVars = _a.envVars, secretEnvVarKeys = _a.secretEnvVarKeys, host = _a.host, url = _a.url;
+          variables = _a.sent();
           envContext = (0, getEnvironmentContext_1.getEnvironmentContext)(config, env, componentName, commitInfo);
           envType = envContext.envType;
-          return [2 /*return*/, {
+          return [2 /*return*/, __assign({
             envType: envType,
-            host: host,
-            url: url,
             gitlabEnvironment: {
               name: envContext.gitlabEnvironmentName,
-              url: url
+              url: variables.url
             },
             fullName: envContext.fullName,
             slugPrefix: envContext.environmentSlugPrefix,
             slug: envContext.environmentSlug,
-            shortName: env,
-            envVars: envVars,
-            secretEnvVarKeys: secretEnvVarKeys
-          }];
+            shortName: env
+          }, variables)];
       }
     });
   });
@@ -40649,19 +40704,22 @@ var lodash_1 = __nccwpck_require__(3255);
 var deploy_1 = __nccwpck_require__(223);
 var getEnvironmentContext_1 = __nccwpck_require__(4650);
 var resolveReferences_1 = __nccwpck_require__(928);
+var envVars_1 = __nccwpck_require__(7185);
+var transformJobOnlyVars_1 = __nccwpck_require__(4674);
 var getEnvironmentVariables = function (config, componentName, env, commitInfo, alreadyVisited // to prevent endless loop
 ) {
   if (alreadyVisited === void 0) {
     alreadyVisited = {};
   }
   return __awaiter(void 0, void 0, void 0, function () {
-    var environmentContext, envConfigRaw, deployConfigRaw, envType, basePredefinedVariables, predefinedVariables, host, url, devLocalConfig, port, additionalEnvVars, publicEnvVarsRaw, additionalSecretKeys, secretEnvVarKeys, secretEnvVars, legacyFromComponents, publicEnvVarsRawWithLegasyFromComponents, publicEnvVarsRawSanitized, envVarsRaw, envVars;
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-    return __generator(this, function (_k) {
-      switch (_k.label) {
+    var environmentContext, envConfigRaw, deployConfigRaw, buildConfigRaw, envType, basePredefinedVariables, predefinedVariables, host, url, devLocalConfig, port, additionalEnvVars, publicEnvVarsRaw, additionalSecretKeys, secretEnvVarKeys, secretEnvVars, legacyFromComponents, publicEnvVarsRawWithLegacyFromComponents, publicEnvVarsRawSanitized, envVarsRaw, envVars;
+    var _a, _b;
+    var _c, _d, _e, _f, _g, _h, _j, _k, _l;
+    return __generator(this, function (_m) {
+      switch (_m.label) {
         case 0:
           environmentContext = (0, getEnvironmentContext_1.getEnvironmentContext)(config, env, componentName, commitInfo);
-          envConfigRaw = environmentContext.envConfigRaw, deployConfigRaw = environmentContext.deployConfigRaw, envType = environmentContext.envType;
+          envConfigRaw = environmentContext.envConfigRaw, deployConfigRaw = environmentContext.deployConfigRaw, buildConfigRaw = environmentContext.buildConfigRaw, envType = environmentContext.envType;
           basePredefinedVariables = {
             ENV_SHORT: env,
             APP_DIR: envConfigRaw.dir,
@@ -40672,7 +40730,7 @@ var getEnvironmentVariables = function (config, componentName, env, commitInfo,
           };
           if (envType === "local") {
             devLocalConfig = envConfigRaw;
-            port = (_a = devLocalConfig.port) !== null && _a !== void 0 ? _a : 3000;
+            port = (_c = devLocalConfig.port) !== null && _c !== void 0 ? _c : 3000;
             host = "localhost:" + port;
             url = "http://" + host;
             predefinedVariables = {
@@ -40682,7 +40740,7 @@ var getEnvironmentVariables = function (config, componentName, env, commitInfo,
             };
           } else {
             additionalEnvVars = deployConfigRaw ? deploy_1.DEPLOY_TYPES[deployConfigRaw.type].getAdditionalEnvVars(environmentContext) : {};
-            host = (_c = (_b = envConfigRaw === null || envConfigRaw === void 0 ? void 0 : envConfigRaw.host) !== null && _b !== void 0 ? _b : additionalEnvVars.HOST_CANONICAL) !== null && _c !== void 0 ? _c : "unknown-host.example.com";
+            host = (_e = (_d = envConfigRaw === null || envConfigRaw === void 0 ? void 0 : envConfigRaw.host) !== null && _d !== void 0 ? _d : additionalEnvVars.HOST_CANONICAL) !== null && _e !== void 0 ? _e : "unknown-host.example.com";
             url = "https://".concat(host);
             predefinedVariables = __assign(__assign(__assign(__assign({}, basePredefinedVariables), config.components[componentName].build.type === "rails" ? {} : {
               HOST: host
@@ -40690,25 +40748,13 @@ var getEnvironmentVariables = function (config, componentName, env, commitInfo,
               ROOT_URL: url
             }), additionalEnvVars);
           }
-          publicEnvVarsRaw = (_e = (_d = envConfigRaw.vars) === null || _d === void 0 ? void 0 : _d.public) !== null && _e !== void 0 ? _e : {};
+          publicEnvVarsRaw = (_g = (_f = envConfigRaw.vars) === null || _f === void 0 ? void 0 : _f.public) !== null && _g !== void 0 ? _g : {};
           additionalSecretKeys = deployConfigRaw ? deploy_1.DEPLOY_TYPES[deployConfigRaw.type].additionalSecretKeys(environmentContext) : [];
-          secretEnvVarKeys = __spreadArray(__spreadArray([], __read(((_g = (_f = envConfigRaw.vars) === null || _f === void 0 ? void 0 : _f.secret) !== null && _g !== void 0 ? _g : []).map(function (key) {
-            return {
-              key: key
-            };
-          })), false), __read(additionalSecretKeys), false);
-          secretEnvVars = Object.fromEntries(secretEnvVarKeys.map(function (_a) {
-            var key = _a.key;
-            return [key, "$".concat((0, exports.getSecretVarName)(env, componentName, key))];
-          }));
-          legacyFromComponents = (_j = (_h = envConfigRaw.vars) === null || _h === void 0 ? void 0 : _h.fromComponents) !== null && _j !== void 0 ? _j : {};
-          publicEnvVarsRawWithLegasyFromComponents = (0, lodash_1.merge)({}, (0, resolveReferences_1.translateLegacyFromComponents)(legacyFromComponents), publicEnvVarsRaw);
-          publicEnvVarsRawSanitized = Object.fromEntries(Object.entries(publicEnvVarsRawWithLegasyFromComponents).map(function (_a) {
-            var _b = __read(_a, 2),
-              key = _b[0],
-              value = _b[1];
-            return [key, (0, lodash_1.isObject)(value) ? JSON.stringify(value) : "".concat(value)];
-          }));
+          secretEnvVarKeys = __spreadArray(__spreadArray([], __read((0, envVars_1.stringListToSecreteEnvVarList)((_j = (_h = envConfigRaw.vars) === null || _h === void 0 ? void 0 : _h.secret) !== null && _j !== void 0 ? _j : [])), false), __read(additionalSecretKeys), false);
+          secretEnvVars = (0, envVars_1.makeSecretEnvVarMapping)(env, componentName, secretEnvVarKeys);
+          legacyFromComponents = (_l = (_k = envConfigRaw.vars) === null || _k === void 0 ? void 0 : _k.fromComponents) !== null && _l !== void 0 ? _l : {};
+          publicEnvVarsRawWithLegacyFromComponents = (0, lodash_1.merge)({}, (0, resolveReferences_1.translateLegacyFromComponents)(legacyFromComponents), publicEnvVarsRaw);
+          publicEnvVarsRawSanitized = (0, envVars_1.stringifyValues)(publicEnvVarsRawWithLegacyFromComponents);
           envVarsRaw = addIndexVar(__assign(__assign(__assign({}, predefinedVariables), secretEnvVars), publicEnvVarsRawSanitized));
           return [4 /*yield*/, (0, resolveReferences_1.resolveReferences)(envVarsRaw, function (otherComponentName, alreadyVisited) {
             return __awaiter(void 0, void 0, void 0, function () {
@@ -40725,13 +40771,18 @@ var getEnvironmentVariables = function (config, componentName, env, commitInfo,
             });
           }, alreadyVisited)];
         case 1:
-          envVars = _k.sent();
-          return [2 /*return*/, {
+          envVars = _m.sent();
+          _a = {
             envVars: envVars,
-            secretEnvVarKeys: secretEnvVarKeys,
-            host: host,
-            url: url
-          }];
+            secretEnvVarKeys: secretEnvVarKeys
+          };
+          _b = {};
+          return [4 /*yield*/, (0, transformJobOnlyVars_1.transformJobOnlyVars)(env, componentName, buildConfigRaw && buildConfigRaw.jobVars || null)];
+        case 2:
+          _b.build = _m.sent();
+          return [4 /*yield*/, (0, transformJobOnlyVars_1.transformJobOnlyVars)(env, componentName, deployConfigRaw && deployConfigRaw.jobVars || null)];
+        case 3:
+          return [2 /*return*/, (_a.jobOnlyVars = (_b.deploy = _m.sent(), _b), _a.host = host, _a.url = url, _a)];
       }
     });
   });
@@ -41243,6 +41294,232 @@ exports.translateLegacyFromComponents = translateLegacyFromComponents;
 
 /***/ }),
 
+/***/ 4674:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+
+var __assign = this && this.__assign || function () {
+  __assign = Object.assign || function (t) {
+    for (var s, i = 1, n = arguments.length; i < n; i++) {
+      s = arguments[i];
+      for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p)) t[p] = s[p];
+    }
+    return t;
+  };
+  return __assign.apply(this, arguments);
+};
+var __awaiter = this && this.__awaiter || function (thisArg, _arguments, P, generator) {
+  function adopt(value) {
+    return value instanceof P ? value : new P(function (resolve) {
+      resolve(value);
+    });
+  }
+  return new (P || (P = Promise))(function (resolve, reject) {
+    function fulfilled(value) {
+      try {
+        step(generator.next(value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function rejected(value) {
+      try {
+        step(generator["throw"](value));
+      } catch (e) {
+        reject(e);
+      }
+    }
+    function step(result) {
+      result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected);
+    }
+    step((generator = generator.apply(thisArg, _arguments || [])).next());
+  });
+};
+var __generator = this && this.__generator || function (thisArg, body) {
+  var _ = {
+      label: 0,
+      sent: function () {
+        if (t[0] & 1) throw t[1];
+        return t[1];
+      },
+      trys: [],
+      ops: []
+    },
+    f,
+    y,
+    t,
+    g;
+  return g = {
+    next: verb(0),
+    "throw": verb(1),
+    "return": verb(2)
+  }, typeof Symbol === "function" && (g[Symbol.iterator] = function () {
+    return this;
+  }), g;
+  function verb(n) {
+    return function (v) {
+      return step([n, v]);
+    };
+  }
+  function step(op) {
+    if (f) throw new TypeError("Generator is already executing.");
+    while (_) try {
+      if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+      if (y = 0, t) op = [op[0] & 2, t.value];
+      switch (op[0]) {
+        case 0:
+        case 1:
+          t = op;
+          break;
+        case 4:
+          _.label++;
+          return {
+            value: op[1],
+            done: false
+          };
+        case 5:
+          _.label++;
+          y = op[1];
+          op = [0];
+          continue;
+        case 7:
+          op = _.ops.pop();
+          _.trys.pop();
+          continue;
+        default:
+          if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) {
+            _ = 0;
+            continue;
+          }
+          if (op[0] === 3 && (!t || op[1] > t[0] && op[1] < t[3])) {
+            _.label = op[1];
+            break;
+          }
+          if (op[0] === 6 && _.label < t[1]) {
+            _.label = t[1];
+            t = op;
+            break;
+          }
+          if (t && _.label < t[2]) {
+            _.label = t[2];
+            _.ops.push(op);
+            break;
+          }
+          if (t[2]) _.ops.pop();
+          _.trys.pop();
+          continue;
+      }
+      op = body.call(thisArg, _);
+    } catch (e) {
+      op = [6, e];
+      y = 0;
+    } finally {
+      f = t = 0;
+    }
+    if (op[0] & 5) throw op[1];
+    return {
+      value: op[0] ? op[1] : void 0,
+      done: true
+    };
+  }
+};
+exports.__esModule = true;
+exports.transformJobOnlyVars = void 0;
+var envVars_1 = __nccwpck_require__(7185);
+/**
+ * transform EnvVars for environment.
+ *
+ * currently does not resolve references and is only used for additional job-only-vars
+ * @param vars
+ * @returns
+ */
+var transformJobOnlyVars = function (env, componentName, vars) {
+  return __awaiter(void 0, void 0, void 0, function () {
+    var publicVars, secretEnvVarKeys, deployJobOnlySecretEnvVars, envVars;
+    var _a, _b;
+    return __generator(this, function (_c) {
+      if (!vars) {
+        return [2 /*return*/, {
+          envVars: {},
+          secretEnvVarKeys: []
+        }];
+      }
+      publicVars = (0, envVars_1.stringifyValues)((_a = vars === null || vars === void 0 ? void 0 : vars.public) !== null && _a !== void 0 ? _a : {});
+      secretEnvVarKeys = (0, envVars_1.stringListToSecreteEnvVarList)((_b = vars === null || vars === void 0 ? void 0 : vars.secret) !== null && _b !== void 0 ? _b : []);
+      deployJobOnlySecretEnvVars = (vars === null || vars === void 0 ? void 0 : vars.secret) ? (0, envVars_1.makeSecretEnvVarMapping)(env, componentName, secretEnvVarKeys) : {};
+      envVars = __assign(__assign({}, deployJobOnlySecretEnvVars), publicVars);
+      return [2 /*return*/, {
+        envVars: envVars,
+        secretEnvVarKeys: secretEnvVarKeys
+      }];
+    });
+  });
+};
+exports.transformJobOnlyVars = transformJobOnlyVars;
+
+/***/ }),
+
+/***/ 7185:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+
+var __read = this && this.__read || function (o, n) {
+  var m = typeof Symbol === "function" && o[Symbol.iterator];
+  if (!m) return o;
+  var i = m.call(o),
+    r,
+    ar = [],
+    e;
+  try {
+    while ((n === void 0 || n-- > 0) && !(r = i.next()).done) ar.push(r.value);
+  } catch (error) {
+    e = {
+      error: error
+    };
+  } finally {
+    try {
+      if (r && !r.done && (m = i["return"])) m.call(i);
+    } finally {
+      if (e) throw e.error;
+    }
+  }
+  return ar;
+};
+exports.__esModule = true;
+exports.makeSecretEnvVarMapping = exports.stringListToSecreteEnvVarList = exports.stringifyValues = void 0;
+var lodash_1 = __nccwpck_require__(3255);
+var getEnvironmentVariables_1 = __nccwpck_require__(6602);
+var stringifyValues = function (obj) {
+  return Object.fromEntries(Object.entries(obj).map(function (_a) {
+    var _b = __read(_a, 2),
+      key = _b[0],
+      value = _b[1];
+    return [key, (0, lodash_1.isObject)(value) ? JSON.stringify(value) : "".concat(value)];
+  }));
+};
+exports.stringifyValues = stringifyValues;
+var stringListToSecreteEnvVarList = function (keys) {
+  return keys.map(function (key) {
+    return {
+      key: key
+    };
+  });
+};
+exports.stringListToSecreteEnvVarList = stringListToSecreteEnvVarList;
+var makeSecretEnvVarMapping = function (env, componentName, secretEnvVars) {
+  return Object.fromEntries(secretEnvVars.map(function (_a) {
+    var key = _a.key;
+    return [key, "$".concat((0, getEnvironmentVariables_1.getSecretVarName)(env, componentName, key))];
+  }));
+};
+exports.makeSecretEnvVarMapping = makeSecretEnvVarMapping;
+
+/***/ }),
+
 /***/ 7383:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -41324,7 +41601,7 @@ var getBaseDeploymentJob = function (context) {
     }],
     allow_failure: whenDeploy === "manual" ? true : false,
     stage: "deploy",
-    variables: __assign(__assign(__assign(__assign({}, DEPLOY_RUNNER_VARIABLES), context.environment.envVars), hasDocker ? (0, docker_1.getDockerImageVariables)(context) : {}), context.componentConfig.deploy ? (_d = context.componentConfig.deploy.extraVars) !== null && _d !== void 0 ? _d : {} : {}),
+    variables: __assign(__assign(__assign(__assign(__assign({}, DEPLOY_RUNNER_VARIABLES), context.environment.envVars), hasDocker ? (0, docker_1.getDockerImageVariables)(context) : {}), context.environment.jobOnlyVars.deploy.envVars), context.componentConfig.deploy ? (_d = context.componentConfig.deploy.extraVars) !== null && _d !== void 0 ? _d : {} : {}),
     environment: __assign(__assign({}, context.environment.gitlabEnvironment), isStoppable ? {
       on_stop: exports.STOP_JOB_NAME,
       auto_stop_in: autoStop
@@ -41346,7 +41623,7 @@ var getBaseDeploymentStopJob = function (context) {
       when: "manual",
       allow_failure: true
     }],
-    variables: __assign(__assign({}, DEPLOY_RUNNER_VARIABLES), {
+    variables: __assign(__assign(__assign({}, DEPLOY_RUNNER_VARIABLES), context.environment.jobOnlyVars.deploy.envVars), {
       GIT_STRATEGY: "none"
     }),
     stage: "stop",
@@ -41365,7 +41642,7 @@ var getBaseRollbackJob = function (context) {
       when: "manual",
       allow_failure: true
     }],
-    variables: __assign(__assign({}, DEPLOY_RUNNER_VARIABLES), {
+    variables: __assign(__assign(__assign({}, DEPLOY_RUNNER_VARIABLES), context.environment.jobOnlyVars.deploy.envVars), {
       GIT_STRATEGY: "none"
     }),
     stage: "rollback",