@catladder/cli 0.0.0-main-8aca4de2 → 0.0.0-main-91b2d412

package/dist/apps/cli/commands/project/setup/setupKubernetes.js

@@ -46,7 +46,7 @@ var cluster_1 = require("../../../../../utils/cluster");
 var gitlab_1 = require("../../../../../utils/gitlab");
 var ensureNamespace_1 = __importDefault(require("../utils/ensureNamespace"));
 var setupKubernetes = function (instance, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var deployConfig, fullName, namespace, serviceAccountName, KUBE_URL, e_1, tokenName, KUBE_CA_PEM, KUBE_TOKEN, vars;
+    var deployConfig, fullName, namespace, serviceAccountName, KUBE_URL, e_1, secretName, KUBE_CA_PEM, KUBE_TOKEN, vars, missing;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -98,13 +98,16 @@ var setupKubernetes = function (instance, context) { return __awaiter(void 0, vo
             case 11:
                 // upsert role in the ns
                 _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get serviceaccount --namespace ".concat(namespace, " ").concat(serviceAccountName, " -o jsonpath='{.secrets[0].name}'")).then(function (c) { return c.stdout.trim(); })];
+                secretName = "".concat(serviceAccountName, "-secret");
+                // create token for the service account
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("\nkubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: ".concat(secretName, "\n  namespace: ").concat(namespace, "\n  annotations:\n    kubernetes.io/service-account.name: ").concat(serviceAccountName, "\ntype: kubernetes.io/service-account-token\nEOF\n  "))];
             case 12:
-                tokenName = _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(tokenName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['ca\\.crt']}\"")).then(function (c) { return c.stdout.trim(); })];
+                // create token for the service account
+                _a.sent();
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(secretName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['ca\\.crt']}\"")).then(function (c) { return c.stdout.trim(); })];
             case 13:
                 KUBE_CA_PEM = _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(tokenName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['token']}\" | base64 --decode")).then(function (c) { return c.stdout.trim(); })];
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(secretName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['token']}\" | base64 --decode")).then(function (c) { return c.stdout.trim(); })];
             case 14:
                 KUBE_TOKEN = _a.sent();
                 vars = {
@@ -112,6 +115,14 @@ var setupKubernetes = function (instance, context) { return __awaiter(void 0, vo
                     KUBE_CA_PEM: KUBE_CA_PEM,
                     KUBE_URL: KUBE_URL
                 };
+                missing = Object.entries(vars).filter(function (e) { return !e[1]; });
+                if (missing.length > 0) {
+                    throw new Error("could not setup credentials. Missing vars: " +
+                        missing.map(function (m) { return m[0]; }).join(", ") +
+                        ". Check whether your local kubectl is still working for '" +
+                        fullName +
+                        "'");
+                }
                 instance.log("service accounts created / updated!");
                 instance.log("");
                 instance.log("pusing secrets to gitlab...");

package/dist/apps/cli/commands/project/setup/setupKubernetes.js.map

@@ -1 +1 @@
-{"version":3,"file":"setupKubernetes.js","sourceRoot":"","sources":["../../../../../../src/apps/cli/commands/project/setup/setupKubernetes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAG6B;AAE7B,+DAA6C;AAC7C,wDAAgE;AAChE,sDAAiE;AACjE,6EAAuD;AAEhD,IAAM,eAAe,GAAG,UAC7B,QAAyB,EACzB,OAAgB;;;;;gBAEV,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;gBACpD,IAAI,CAAC,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;iBAC7E;gBAEK,QAAQ,GAAG,IAAA,uCAA4B,EAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACpE,QAAQ,CAAC,GAAG,CAAC,mBAAY,QAAQ,CAAE,CAAC,CAAC;gBAErC,qBAAM,IAAA,0BAAgB,EAAC,QAAQ,CAAC,EAAA;;gBAAhC,SAAgC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBACrB,qBAAM,IAAA,4BAAe,EAAC,OAAO,CAAC,EAAA;;gBAA1C,SAAS,GAAG,SAA8B;gBAChD,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,SAAS,GAAG,qBAAqB,CAAC,CAAC;gBAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,mBAAmB;gBAEnB,mFAAmF;gBACnF,gEAAgE;gBAChE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBACvC,kBAAkB,GAAG,aAAM,OAAO,CAAC,aAAa,YAAS,CAAC;gBAC/C,qBAAM,IAAA,4BAAI,EACzB,kHAAkH,CACnH,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,QAAQ,GAAG,SAEa;;;;gBAI5B,qBAAM,IAAA,4BAAI,EACR,oDAA6C,SAAS,cAAI,kBAAkB,CAAE,CAC/E,EAAA;;gBAFD,SAEC,CAAC;gBACF,qBAAM,IAAA,4BAAI,EACR,iDAA0C,SAAS,cAAI,kBAAkB,CAAE,CAC5E,EAAA;;gBAFD,SAEC,CAAC;gBACF,qBAAM,IAAA,4BAAI,EACR,0CAAmC,SAAS,cAAI,kBAAkB,CAAE,CACrE,EAAA;;gBAFD,SAEC,CAAC;;;;;oBAKJ,qBAAM,IAAA,4BAAI,EACR,oDAA6C,SAAS,cAAI,kBAAkB,CAAE,CAC/E,EAAA;;gBAFD,SAEC,CAAC;gBAEF,wBAAwB;gBAExB,qBAAM,IAAA,4BAAI,EAAC,wHAIE,SAAS,uBACd,kBAAkB,2jBASlB,kBAAkB,4BACb,SAAS,8DAGZ,kBAAkB,+BACZ,SAAS,+CAGjB,kBAAkB,mDAG3B,CAAC,EAAA;;gBA3BA,wBAAwB;gBAExB,SAyBA,CAAC;gBAGiB,qBAAM,IAAA,4BAAI,EAC1B,iDAA0C,SAAS,cAAI,kBAAkB,sCAAmC,CAC7G,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,SAAS,GAAG,SAEY;gBAEV,qBAAM,IAAA,4BAAI,EAC5B,6BAAsB,SAAS,0BAAgB,SAAS,4CAAuC,CAChG,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,WAAW,GAAG,SAEU;gBACX,qBAAM,IAAA,4BAAI,EAC3B,6BAAsB,SAAS,0BAAgB,SAAS,2DAAsD,CAC/G,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,UAAU,GAAG,SAEW;gBAExB,IAAI,GAAG;oBACX,UAAU,YAAA;oBACV,WAAW,aAAA;oBACX,QAAQ,UAAA;iBACT,CAAC;gBAEF,QAAQ,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBAEpD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBAE5C,qBAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,WAAW,CAAC,SAAS,EAC7B,OAAO,CAAC,aAAa,EACrB,KAAK,CAAC,YAAY;qBACnB,EAAA;;gBAND,SAMC,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;;;;KACvB,CAAC;AA3GW,QAAA,eAAe,mBA2G1B"}
+{"version":3,"file":"setupKubernetes.js","sourceRoot":"","sources":["../../../../../../src/apps/cli/commands/project/setup/setupKubernetes.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,gDAG6B;AAE7B,+DAA6C;AAC7C,wDAAgE;AAChE,sDAAiE;AACjE,6EAAuD;AAEhD,IAAM,eAAe,GAAG,UAC7B,QAAyB,EACzB,OAAgB;;;;;gBAEV,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;gBACpD,IAAI,CAAC,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE;oBAC/C,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;iBAC7E;gBAEK,QAAQ,GAAG,IAAA,uCAA4B,EAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACpE,QAAQ,CAAC,GAAG,CAAC,mBAAY,QAAQ,CAAE,CAAC,CAAC;gBAErC,qBAAM,IAAA,0BAAgB,EAAC,QAAQ,CAAC,EAAA;;gBAAhC,SAAgC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBACrB,qBAAM,IAAA,4BAAe,EAAC,OAAO,CAAC,EAAA;;gBAA1C,SAAS,GAAG,SAA8B;gBAChD,QAAQ,CAAC,GAAG,CAAC,YAAY,GAAG,SAAS,GAAG,qBAAqB,CAAC,CAAC;gBAC/D,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,mBAAmB;gBAEnB,mFAAmF;gBACnF,gEAAgE;gBAChE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;gBACvC,kBAAkB,GAAG,aAAM,OAAO,CAAC,aAAa,YAAS,CAAC;gBAC/C,qBAAM,IAAA,4BAAI,EACzB,kHAAkH,CACnH,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,QAAQ,GAAG,SAEa;;;;gBAI5B,qBAAM,IAAA,4BAAI,EACR,oDAA6C,SAAS,cAAI,kBAAkB,CAAE,CAC/E,EAAA;;gBAFD,SAEC,CAAC;gBACF,qBAAM,IAAA,4BAAI,EACR,iDAA0C,SAAS,cAAI,kBAAkB,CAAE,CAC5E,EAAA;;gBAFD,SAEC,CAAC;gBACF,qBAAM,IAAA,4BAAI,EACR,0CAAmC,SAAS,cAAI,kBAAkB,CAAE,CACrE,EAAA;;gBAFD,SAEC,CAAC;;;;;oBAKJ,qBAAM,IAAA,4BAAI,EACR,oDAA6C,SAAS,cAAI,kBAAkB,CAAE,CAC/E,EAAA;;gBAFD,SAEC,CAAC;gBAEF,wBAAwB;gBAExB,qBAAM,IAAA,4BAAI,EAAC,wHAIE,SAAS,uBACd,kBAAkB,2jBASlB,kBAAkB,4BACb,SAAS,8DAGZ,kBAAkB,+BACZ,SAAS,+CAGjB,kBAAkB,mDAG3B,CAAC,EAAA;;gBA3BA,wBAAwB;gBAExB,SAyBA,CAAC;gBAEK,UAAU,GAAG,UAAG,kBAAkB,YAAS,CAAC;gBAClD,uCAAuC;gBACvC,qBAAM,IAAA,4BAAI,EAAC,uFAKH,UAAU,4BACL,SAAS,uEAEkB,kBAAkB,yDAGzD,CAAC,EAAA;;gBAZF,uCAAuC;gBACvC,SAWE,CAAC;gBAEiB,qBAAM,IAAA,4BAAI,EAC5B,6BAAsB,UAAU,0BAAgB,SAAS,4CAAuC,CACjG,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,WAAW,GAAG,SAEU;gBACX,qBAAM,IAAA,4BAAI,EAC3B,6BAAsB,UAAU,0BAAgB,SAAS,2DAAsD,CAChH,CAAC,IAAI,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAf,CAAe,CAAC,EAAA;;gBAFxB,UAAU,GAAG,SAEW;gBAExB,IAAI,GAAG;oBACX,UAAU,YAAA;oBACV,WAAW,aAAA;oBACX,QAAQ,UAAA;iBACT,CAAC;gBAEI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,CAAC,CAAC,CAAC,EAAL,CAAK,CAAC,CAAC;gBAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE;oBACtB,MAAM,IAAI,KAAK,CACb,6CAA6C;wBAC3C,OAAO,CAAC,GAAG,CAAC,UAAC,CAAC,IAAK,OAAA,CAAC,CAAC,CAAC,CAAC,EAAJ,CAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;wBACnC,2DAA2D;wBAC3D,QAAQ;wBACR,GAAG,CACN,CAAC;iBACH;gBAED,QAAQ,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBAEpD,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACjB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;gBAE5C,qBAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,IAAI,EACJ,OAAO,CAAC,WAAW,CAAC,SAAS,EAC7B,OAAO,CAAC,aAAa,EACrB,KAAK,CAAC,YAAY;qBACnB,EAAA;;gBAND,SAMC,CAAC;gBACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;;;;KACvB,CAAC;AAhIW,QAAA,eAAe,mBAgI1B"}

package/dist/bundles/catenv/index.js

@@ -40211,7 +40211,7 @@ exports.readConfigSync = readConfigSync;
 
 exports.__esModule = true;
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "main-8aca4de2" || 0;
+exports.PIPELINE_IMAGE_TAG = "main-91b2d412" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -43718,6 +43718,7 @@ exports.__esModule = true;
 exports.createJobsForComponent = void 0;
 var lodash_1 = __nccwpck_require__(3255);
 var build_1 = __nccwpck_require__(3760);
+var reporting_1 = __nccwpck_require__(3545);
 var context_1 = __nccwpck_require__(2041);
 var deploy_1 = __nccwpck_require__(223);
 var getCommitInfo_1 = __nccwpck_require__(5923);
@@ -43745,8 +43746,9 @@ var createRawJobs = function (context) {
   }
   var buildJobs = build_1.BUILD_TYPES[context.componentConfig.build.type].jobs(context);
   var deployJobs = deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context);
+  var reportingJobs = (0, reporting_1.createReportingJobs)(context);
   var customJobs = getCustomJobs(context);
-  return __spreadArray(__spreadArray(__spreadArray([], __read(buildJobs), false), __read(deployJobs), false), __read(customJobs), false);
+  return __spreadArray(__spreadArray(__spreadArray(__spreadArray([], __read(buildJobs), false), __read(deployJobs), false), __read(reportingJobs), false), __read(customJobs), false);
 };
 var createJobsForComponent = function (config, componentName, env, trigger) {
   return __awaiter(void 0, void 0, void 0, function () {
@@ -44793,6 +44795,61 @@ exports.mergeWithMergingArrays = mergeWithMergingArrays;
 
 /***/ }),
 
+/***/ 3545:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+exports.__esModule = true;
+exports.createReportingJobs = void 0;
+var base_1 = __nccwpck_require__(9177);
+var utils_1 = __nccwpck_require__(7461);
+var STAGE = "verify";
+var SBOM_GENERATE_JOB_NAME = "🧾 sbom";
+var SBOM_FILE = "__sbom.json";
+var createSbomGenerateJob = function (context) {
+  var _a, _b, _c, _d, _e;
+  var buildConfig = context.componentConfig.build;
+  var defaultImage = "aquasec/trivy:0.38.3";
+  var defaultScript = ["trivy fs --quiet --format cyclonedx --output \"".concat(SBOM_FILE, "\" ").concat(((_a = context.packageManagerInfo) === null || _a === void 0 ? void 0 : _a.componentIsInWorkspace) ? "." : context.componentConfig.dir)];
+  var image = buildConfig.type === "custom" && buildConfig.sbom !== false ? (_c = (_b = buildConfig.sbom) === null || _b === void 0 ? void 0 : _b.jobImage) !== null && _c !== void 0 ? _c : defaultImage : defaultImage;
+  var script = buildConfig.type === "custom" && buildConfig.sbom !== false ? (_e = (0, utils_1.ensureArray)((_d = buildConfig.sbom) === null || _d === void 0 ? void 0 : _d.command)) !== null && _e !== void 0 ? _e : defaultScript : defaultScript;
+  return {
+    name: SBOM_GENERATE_JOB_NAME,
+    stage: STAGE,
+    needs: context.componentConfig.deploy !== false ? [base_1.DEPLOY_JOB_NAME] : [],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image: image,
+    script: script,
+    allow_failure: true,
+    artifacts: {
+      paths: [SBOM_FILE]
+    }
+  };
+};
+var createSbomUploadJob = function (context) {
+  return {
+    name: "🧾 sbom upload",
+    stage: STAGE,
+    needs: [SBOM_GENERATE_JOB_NAME],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image: "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+    script: ["/dtrackuploader https://dep.panter.dev/ \"$DT_KEY\" upload \"".concat(context.fullConfig.customerName, "-").concat(context.fullConfig.appName, "/").concat(context.componentName, "\" \"").concat(context.environment.shortName, "\" \"").concat(SBOM_FILE, "\" vex.json")],
+    allow_failure: true
+  };
+};
+var createReportingJobs = function (context) {
+  return context.componentConfig.build.type === "custom" && context.componentConfig.build.sbom === false ? [] : [createSbomGenerateJob(context), createSbomUploadJob(context)];
+};
+exports.createReportingJobs = createReportingJobs;
+
+/***/ }),
+
 /***/ 9904:
 /***/ ((module) => {
 

package/dist/bundles/cli/index.js

@@ -4654,7 +4654,7 @@ var cluster_1 = __nccwpck_require__(66894);
 var gitlab_1 = __nccwpck_require__(79818);
 var ensureNamespace_1 = __importDefault(__nccwpck_require__(99489));
 var setupKubernetes = function (instance, context) { return __awaiter(void 0, void 0, void 0, function () {
-    var deployConfig, fullName, namespace, serviceAccountName, KUBE_URL, e_1, tokenName, KUBE_CA_PEM, KUBE_TOKEN, vars;
+    var deployConfig, fullName, namespace, serviceAccountName, KUBE_URL, e_1, secretName, KUBE_CA_PEM, KUBE_TOKEN, vars, missing;
     return __generator(this, function (_a) {
         switch (_a.label) {
             case 0:
@@ -4706,13 +4706,16 @@ var setupKubernetes = function (instance, context) { return __awaiter(void 0, vo
             case 11:
                 // upsert role in the ns
                 _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get serviceaccount --namespace ".concat(namespace, " ").concat(serviceAccountName, " -o jsonpath='{.secrets[0].name}'")).then(function (c) { return c.stdout.trim(); })];
+                secretName = "".concat(serviceAccountName, "-secret");
+                // create token for the service account
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("\nkubectl apply -f - <<EOF\napiVersion: v1\nkind: Secret\nmetadata:\n  name: ".concat(secretName, "\n  namespace: ").concat(namespace, "\n  annotations:\n    kubernetes.io/service-account.name: ").concat(serviceAccountName, "\ntype: kubernetes.io/service-account-token\nEOF\n  "))];
             case 12:
-                tokenName = _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(tokenName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['ca\\.crt']}\"")).then(function (c) { return c.stdout.trim(); })];
+                // create token for the service account
+                _a.sent();
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(secretName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['ca\\.crt']}\"")).then(function (c) { return c.stdout.trim(); })];
             case 13:
                 KUBE_CA_PEM = _a.sent();
-                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(tokenName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['token']}\" | base64 --decode")).then(function (c) { return c.stdout.trim(); })];
+                return [4 /*yield*/, (0, child_process_promise_1.exec)("kubectl get secret ".concat(secretName, " --namespace ").concat(namespace, " -o jsonpath=\"{['data']['token']}\" | base64 --decode")).then(function (c) { return c.stdout.trim(); })];
             case 14:
                 KUBE_TOKEN = _a.sent();
                 vars = {
@@ -4720,6 +4723,14 @@ var setupKubernetes = function (instance, context) { return __awaiter(void 0, vo
                     KUBE_CA_PEM: KUBE_CA_PEM,
                     KUBE_URL: KUBE_URL
                 };
+                missing = Object.entries(vars).filter(function (e) { return !e[1]; });
+                if (missing.length > 0) {
+                    throw new Error("could not setup credentials. Missing vars: " +
+                        missing.map(function (m) { return m[0]; }).join(", ") +
+                        ". Check whether your local kubectl is still working for '" +
+                        fullName +
+                        "'");
+                }
                 instance.log("service accounts created / updated!");
                 instance.log("");
                 instance.log("pusing secrets to gitlab...");
@@ -351503,7 +351514,7 @@ exports.readConfigSync = readConfigSync;
 
 exports.__esModule = true;
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "main-8aca4de2" || 0;
+exports.PIPELINE_IMAGE_TAG = "main-91b2d412" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -355010,6 +355021,7 @@ exports.__esModule = true;
 exports.createJobsForComponent = void 0;
 var lodash_1 = __nccwpck_require__(23255);
 var build_1 = __nccwpck_require__(73760);
+var reporting_1 = __nccwpck_require__(43545);
 var context_1 = __nccwpck_require__(22041);
 var deploy_1 = __nccwpck_require__(90223);
 var getCommitInfo_1 = __nccwpck_require__(5923);
@@ -355037,8 +355049,9 @@ var createRawJobs = function (context) {
   }
   var buildJobs = build_1.BUILD_TYPES[context.componentConfig.build.type].jobs(context);
   var deployJobs = deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context);
+  var reportingJobs = (0, reporting_1.createReportingJobs)(context);
   var customJobs = getCustomJobs(context);
-  return __spreadArray(__spreadArray(__spreadArray([], __read(buildJobs), false), __read(deployJobs), false), __read(customJobs), false);
+  return __spreadArray(__spreadArray(__spreadArray(__spreadArray([], __read(buildJobs), false), __read(deployJobs), false), __read(reportingJobs), false), __read(customJobs), false);
 };
 var createJobsForComponent = function (config, componentName, env, trigger) {
   return __awaiter(void 0, void 0, void 0, function () {
@@ -356085,6 +356098,61 @@ exports.mergeWithMergingArrays = mergeWithMergingArrays;
 
 /***/ }),
 
+/***/ 43545:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+exports.__esModule = true;
+exports.createReportingJobs = void 0;
+var base_1 = __nccwpck_require__(89177);
+var utils_1 = __nccwpck_require__(37461);
+var STAGE = "verify";
+var SBOM_GENERATE_JOB_NAME = "🧾 sbom";
+var SBOM_FILE = "__sbom.json";
+var createSbomGenerateJob = function (context) {
+  var _a, _b, _c, _d, _e;
+  var buildConfig = context.componentConfig.build;
+  var defaultImage = "aquasec/trivy:0.38.3";
+  var defaultScript = ["trivy fs --quiet --format cyclonedx --output \"".concat(SBOM_FILE, "\" ").concat(((_a = context.packageManagerInfo) === null || _a === void 0 ? void 0 : _a.componentIsInWorkspace) ? "." : context.componentConfig.dir)];
+  var image = buildConfig.type === "custom" && buildConfig.sbom !== false ? (_c = (_b = buildConfig.sbom) === null || _b === void 0 ? void 0 : _b.jobImage) !== null && _c !== void 0 ? _c : defaultImage : defaultImage;
+  var script = buildConfig.type === "custom" && buildConfig.sbom !== false ? (_e = (0, utils_1.ensureArray)((_d = buildConfig.sbom) === null || _d === void 0 ? void 0 : _d.command)) !== null && _e !== void 0 ? _e : defaultScript : defaultScript;
+  return {
+    name: SBOM_GENERATE_JOB_NAME,
+    stage: STAGE,
+    needs: context.componentConfig.deploy !== false ? [base_1.DEPLOY_JOB_NAME] : [],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image: image,
+    script: script,
+    allow_failure: true,
+    artifacts: {
+      paths: [SBOM_FILE]
+    }
+  };
+};
+var createSbomUploadJob = function (context) {
+  return {
+    name: "🧾 sbom upload",
+    stage: STAGE,
+    needs: [SBOM_GENERATE_JOB_NAME],
+    envMode: "jobPerEnv",
+    variables: {},
+    cache: undefined,
+    image: "git.panter.ch:5001/open-source/dependency-track-uploader:dtrackuploader-v0.2.1",
+    script: ["/dtrackuploader https://dep.panter.dev/ \"$DT_KEY\" upload \"".concat(context.fullConfig.customerName, "-").concat(context.fullConfig.appName, "/").concat(context.componentName, "\" \"").concat(context.environment.shortName, "\" \"").concat(SBOM_FILE, "\" vex.json")],
+    allow_failure: true
+  };
+};
+var createReportingJobs = function (context) {
+  return context.componentConfig.build.type === "custom" && context.componentConfig.build.sbom === false ? [] : [createSbomGenerateJob(context), createSbomUploadJob(context)];
+};
+exports.createReportingJobs = createReportingJobs;
+
+/***/ }),
+
 /***/ 15058:
 /***/ ((module) => {