@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/apps/cli/src/kubernetes/index.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProjectPodNames = exports.getProjectPvcs = exports.getProjectPods = void 0;
+const parseChoice_1 = require("../config/parseChoice");
+const k8sApi_1 = require("../k8sApi");
+const projects_1 = require("../utils/projects");
+const getProjectPods = async (envComponent) => {
+    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
+    const k8sApi = (0, k8sApi_1.getk8sApi)();
+    const res = await k8sApi.listNamespacedPod(namespace);
+    const { componentName } = (0, parseChoice_1.parseChoice)(envComponent);
+    return res.body.items.filter((item) => { var _a, _b; return componentName ? (_b = (_a = item.metadata) === null || _a === void 0 ? void 0 : _a.name) === null || _b === void 0 ? void 0 : _b.includes(componentName + "-") : true; });
+};
+exports.getProjectPods = getProjectPods;
+const getProjectPvcs = async (envComponent) => {
+    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
+    const k8sApi = (0, k8sApi_1.getk8sApi)();
+    const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
+    return res.body.items;
+};
+exports.getProjectPvcs = getProjectPvcs;
+const getProjectPodNames = async (envComponent) => {
+    const pods = await (0, exports.getProjectPods)(envComponent);
+    return pods.map((n) => n.metadata.name);
+};
+exports.getProjectPodNames = getProjectPodNames;
+//# sourceMappingURL=index.js.map

package/dist/apps/cli/src/kubernetes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/kubernetes/index.ts"],"names":[],"mappings":";;;AAAA,uDAAoD;AACpD,sCAAsC;AACtC,gDAAwD;AAEjD,MAAM,cAAc,GAAG,KAAK,EAAE,YAAoB,EAAE,EAAE;IAC3D,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAmB,EAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAEtD,MAAM,EAAE,aAAa,EAAE,GAAG,IAAA,yBAAW,EAAC,YAAY,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,eACpC,OAAA,aAAa,CAAC,CAAC,CAAC,MAAA,MAAA,IAAI,CAAC,QAAQ,0CAAE,IAAI,0CAAE,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA,EAAA,CAC1E,CAAC;AACJ,CAAC,CAAC;AATW,QAAA,cAAc,kBASzB;AAEK,MAAM,cAAc,GAAG,KAAK,EAAE,YAAoB,EAAE,EAAE;IAC3D,MAAM,SAAS,GAAG,MAAM,IAAA,8BAAmB,EAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAA,kBAAS,GAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;IAExE,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;AACxB,CAAC,CAAC;AANW,QAAA,cAAc,kBAMzB;AAEK,MAAM,kBAAkB,GAAG,KAAK,EAAE,YAAoB,EAAE,EAAE;IAC/D,MAAM,IAAI,GAAG,MAAM,IAAA,sBAAc,EAAC,YAAY,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC,CAAC;AAHW,QAAA,kBAAkB,sBAG7B"}

package/dist/apps/cli/src/kubernetes/openKubernetesDashboards.d.ts

@@ -0,0 +1,4 @@
+import type { ComponentContext } from "../../../../packages/pipeline/src/index.js";
+import type { IO } from "../core/types";
+export declare const openGoogleCloudLogs: (instance: IO, context: ComponentContext) => Promise<void>;
+export declare const openGoogleCloudKubernetesDashboard: (instance: IO, context: ComponentContext) => Promise<void>;

package/dist/apps/cli/src/kubernetes/openKubernetesDashboards.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openGoogleCloudKubernetesDashboard = exports.openGoogleCloudLogs = void 0;
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
+const openDashboard_1 = require("../gcloud/openDashboard");
+const openGoogleCloudLogs = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const resource = `k8s_container/cluster_name/${cluster.name}${namespace ? `/namespace_name/${namespace}` : ""}`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "logs/viewer", {
+        project: cluster.projectId,
+        resource: resource,
+    });
+};
+exports.openGoogleCloudLogs = openGoogleCloudLogs;
+const openGoogleCloudKubernetesDashboard = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "kubernetes/workload", {
+        project: cluster.projectId,
+        pageState: pageState,
+    });
+};
+exports.openGoogleCloudKubernetesDashboard = openGoogleCloudKubernetesDashboard;
+//# sourceMappingURL=openKubernetesDashboards.js.map

package/dist/apps/cli/src/kubernetes/openKubernetesDashboards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openKubernetesDashboards.js","sourceRoot":"","sources":["../../../../../src/kubernetes/openKubernetesDashboards.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AAErD,2DAAmE;AAE5D,MAAM,mBAAmB,GAAG,KAAK,EACtC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IAErC,MAAM,QAAQ,GAAG,8BAA8B,OAAO,CAAC,IAAI,GACzD,SAAS,CAAC,CAAC,CAAC,mBAAmB,SAAS,EAAE,CAAC,CAAC,CAAC,EAC/C,EAAE,CAAC;IAEH,MAAM,IAAA,wCAAwB,EAAC,QAAQ,EAAE,aAAa,EAAE;QACtD,OAAO,EAAE,OAAO,CAAC,SAAS;QAC1B,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;AACL,CAAC,CAAC;AAxBW,QAAA,mBAAmB,uBAwB9B;AAEK,MAAM,kCAAkC,GAAG,KAAK,EACrD,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;IAC7D,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IACrC,MAAM,SAAS,GAAG,4BAA4B,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,YAAY,SAAS,6CAA6C,CAAC;IAE/I,MAAM,IAAA,wCAAwB,EAAC,QAAQ,EAAE,qBAAqB,EAAE;QAC9D,OAAO,EAAE,OAAO,CAAC,SAAS;QAC1B,SAAS,EAAE,SAAS;KACrB,CAAC,CAAC;AACL,CAAC,CAAC;AApBW,QAAA,kCAAkC,sCAoB7C"}

package/dist/apps/cli/src/kubernetes/portForward.d.ts

@@ -0,0 +1 @@
+export declare const startKubePortForward: (podname: string, localPort: number, remotePort: number, namespace: string) => Promise<void>;

package/dist/apps/cli/src/kubernetes/portForward.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startKubePortForward = void 0;
+const portForwards_1 = require("../utils/portForwards");
+const startKubePortForward = async (podname, localPort, remotePort, namespace) => {
+    const name = `kube/${namespace}/${podname}/${localPort}:${remotePort}`;
+    await (0, portForwards_1.startPortForwardCommand)(name, `kubectl port-forward ${podname} ${localPort}:${remotePort} -n ${namespace}`);
+};
+exports.startKubePortForward = startKubePortForward;
+//# sourceMappingURL=portForward.js.map

package/dist/apps/cli/src/kubernetes/portForward.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portForward.js","sourceRoot":"","sources":["../../../../../src/kubernetes/portForward.ts"],"names":[],"mappings":";;;AAAA,wDAAgE;AAEzD,MAAM,oBAAoB,GAAG,KAAK,EACvC,OAAe,EACf,SAAiB,EACjB,UAAkB,EAClB,SAAiB,EACjB,EAAE;IACF,MAAM,IAAI,GAAG,QAAQ,SAAS,IAAI,OAAO,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;IAEvE,MAAM,IAAA,sCAAuB,EAC3B,IAAI,EACJ,wBAAwB,OAAO,IAAI,SAAS,IAAI,UAAU,OAAO,SAAS,EAAE,CAC7E,CAAC;AACJ,CAAC,CAAC;AAZW,QAAA,oBAAoB,wBAY/B"}

package/dist/apps/cli/src/packageInfos.d.ts

@@ -0,0 +1,2 @@
+declare const ownPkg: any;
+export default ownPkg;

package/dist/apps/cli/src/packageInfos.js

@@ -0,0 +1,11 @@
+"use strict";
+// we can't import the package.json directly, because the bundling process will inline it
+// but the version is only set during deployement, when its already bundled
+// instead we need to use require.main.path to get the path of the main module, which is actually the file in the bin
+// this will point to the root package.json
+var _a;
+Object.defineProperty(exports, "__esModule", { value: true });
+const path = ((_a = require.main) === null || _a === void 0 ? void 0 : _a.path) + "/../package.json";
+const ownPkg = require(path);
+exports.default = ownPkg;
+//# sourceMappingURL=packageInfos.js.map

package/dist/apps/cli/src/packageInfos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"packageInfos.js","sourceRoot":"","sources":["../../../../src/packageInfos.ts"],"names":[],"mappings":";AAAA,yFAAyF;AACzF,2EAA2E;AAC3E,qHAAqH;AACrH,2CAA2C;;;AAE3C,MAAM,IAAI,GAAG,CAAA,MAAA,OAAO,CAAC,IAAI,0CAAE,IAAI,IAAG,kBAAkB,CAAC;AACrD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE7B,kBAAe,MAAM,CAAC"}

package/dist/apps/cli/src/publish/npmPublishJob.d.ts

@@ -0,0 +1,11 @@
+export declare const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+export type NpmPublishJobOptions = {
+    dir: string;
+    envType: string;
+    access?: string;
+    registry?: string;
+    distTag?: string;
+};
+export declare const npmPublishJob: (options: NpmPublishJobOptions) => Promise<void>;
+/** parses the `catci publish npm --flag value ...` argument list */
+export declare const parseNpmPublishArgs: (args: string[]) => NpmPublishJobOptions | null;

package/dist/apps/cli/src/publish/npmPublishJob.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseNpmPublishArgs = exports.npmPublishJob = exports.DEFAULT_NPM_REGISTRY = void 0;
+/**
+ * the npmPackage deploy CI job (run by catci: `catci publish npm`):
+ * derives version + dist-tag from the pipeline trigger, stamps the
+ * version into the package's package.json and runs `npm publish`.
+ */
+const child_process_1 = require("child_process");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const npmPublishPlan_1 = require("./npmPublishPlan");
+exports.DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
+/**
+ * reads the trigger context from the CI provider's predefined
+ * variables (gitlab or github)
+ */
+const readCiContext = (options) => {
+    var _a, _b, _c, _d;
+    const env = process.env;
+    if (env.GITLAB_CI === "true") {
+        return {
+            ciTag: env.CI_COMMIT_TAG || null,
+            refSlug: (_a = env.CI_COMMIT_REF_SLUG) !== null && _a !== void 0 ? _a : "",
+            shortSha: (_b = env.CI_COMMIT_SHORT_SHA) !== null && _b !== void 0 ? _b : "",
+        };
+    }
+    if (env.GITHUB_ACTIONS === "true") {
+        return {
+            ciTag: env.GITHUB_REF_TYPE === "tag" ? ((_c = env.GITHUB_REF_NAME) !== null && _c !== void 0 ? _c : null) : null,
+            // GITHUB_HEAD_REF is the source branch on pull_request events
+            refSlug: (0, npmPublishPlan_1.slugifyRef)(env.GITHUB_HEAD_REF || env.GITHUB_REF_NAME || ""),
+            shortSha: ((_d = env.GITHUB_SHA) !== null && _d !== void 0 ? _d : "").slice(0, 8),
+        };
+    }
+    throw new Error(`publish npm for "${options.dir}" must run in a gitlab or github CI job (no CI provider detected)`);
+};
+const setPackageVersion = async (dir, version) => {
+    const packageJsonPath = (0, path_1.join)(dir, "package.json");
+    const pkg = JSON.parse(await (0, promises_1.readFile)(packageJsonPath, "utf-8"));
+    pkg.version = version;
+    await (0, promises_1.writeFile)(packageJsonPath, JSON.stringify(pkg, null, 2) + "\n");
+    return pkg.name;
+};
+/**
+ * writes the auth .npmrc and returns its absolute path. It is passed to
+ * npm as userconfig: in a workspace monorepo npm resolves its project
+ * prefix to the workspace ROOT, so a package-local .npmrc would be
+ * silently ignored (ENEEDAUTH). npm expands `${NPM_TOKEN}` from the job
+ * environment at run time and never includes .npmrc in the tarball.
+ */
+const writeNpmrc = async (dir, registry) => {
+    const registryHost = registry.replace(/^https?:/, "").replace(/\/?$/, "/");
+    const npmrcPath = (0, path_1.resolve)(dir, ".npmrc");
+    await (0, promises_1.writeFile)(npmrcPath, `${registryHost}:_authToken=\${NPM_TOKEN}\n`);
+    return npmrcPath;
+};
+/**
+ * whether the CI job can mint an OIDC token for npm trusted publishing.
+ * github actions exposes these two only when the job declares
+ * `permissions: id-token: write` (catladder sets it via the job's
+ * `idToken` flag).
+ */
+const hasOidcCredentials = () => !!process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
+    !!process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+const npmPublish = (dir, npmrcPath, args) => new Promise((resolvePromise, reject) => {
+    const child = (0, child_process_1.spawn)("npm", ["publish", ...args], {
+        cwd: dir,
+        stdio: "inherit",
+        env: {
+            ...process.env,
+            ...(npmrcPath ? { NPM_CONFIG_USERCONFIG: npmrcPath } : {}),
+        },
+    });
+    child.on("error", reject);
+    child.on("exit", (code) => code === 0
+        ? resolvePromise()
+        : reject(new Error(`npm publish exited with ${code}`)));
+});
+const npmPublishJob = async (options) => {
+    var _a, _b;
+    const oidc = hasOidcCredentials();
+    if (!oidc && !process.env.NPM_TOKEN) {
+        throw new Error("NPM_TOKEN is not set — configure it as a catladder secret for this component, or publish from a workflow registered as a trusted publisher on npm");
+    }
+    const registry = (_a = options.registry) !== null && _a !== void 0 ? _a : exports.DEFAULT_NPM_REGISTRY;
+    const plan = (0, npmPublishPlan_1.computeNpmPublishPlan)({
+        envType: options.envType,
+        distTagOverride: options.distTag,
+        ...readCiContext(options),
+    });
+    const name = await setPackageVersion(options.dir, plan.version);
+    // with OIDC available npm mints its own short-lived credentials, and
+    // an .npmrc referencing an unset ${NPM_TOKEN} would only get in the
+    // way. A token, when present, still wins as the fallback.
+    const npmrcPath = oidc && !process.env.NPM_TOKEN
+        ? undefined
+        : await writeNpmrc(options.dir, registry);
+    console.log(`publishing ${name}@${plan.version} (dist-tag ${plan.distTag}) to ${registry}${npmrcPath ? "" : " via trusted publishing (OIDC)"}`);
+    await npmPublish(options.dir, npmrcPath, [
+        "--tag",
+        plan.distTag,
+        "--access",
+        (_b = options.access) !== null && _b !== void 0 ? _b : "public",
+        "--registry",
+        registry,
+        // publish exactly this package, not the workspace set npm may
+        // otherwise derive from the monorepo root
+        "--workspaces=false",
+    ]);
+    console.log(`published ${name}@${plan.version} 🚀`);
+};
+exports.npmPublishJob = npmPublishJob;
+/** parses the `catci publish npm --flag value ...` argument list */
+const parseNpmPublishArgs = (args) => {
+    const options = {};
+    for (let i = 0; i < args.length; i += 2) {
+        const flag = args[i];
+        const value = args[i + 1];
+        if (!(flag === null || flag === void 0 ? void 0 : flag.startsWith("--")) || value === undefined)
+            return null;
+        options[flag.slice(2)] = value;
+    }
+    const { dir, access, registry } = options;
+    const envType = options["env-type"];
+    const distTag = options["dist-tag"];
+    if (!dir || !envType)
+        return null;
+    return { dir, envType, access, registry, distTag };
+};
+exports.parseNpmPublishArgs = parseNpmPublishArgs;
+//# sourceMappingURL=npmPublishJob.js.map

package/dist/apps/cli/src/publish/npmPublishJob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmPublishJob.js","sourceRoot":"","sources":["../../../../../src/publish/npmPublishJob.ts"],"names":[],"mappings":";;;AAAA;;;;GAIG;AACH,iDAAsC;AACtC,0CAAkD;AAClD,+BAAqC;AAErC,qDAAqE;AAExD,QAAA,oBAAoB,GAAG,6BAA6B,CAAC;AAUlE;;;GAGG;AACH,MAAM,aAAa,GAAG,CACpB,OAA6B,EAC2B,EAAE;;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,IAAI,GAAG,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;YAChC,OAAO,EAAE,MAAA,GAAG,CAAC,kBAAkB,mCAAI,EAAE;YACrC,QAAQ,EAAE,MAAA,GAAG,CAAC,mBAAmB,mCAAI,EAAE;SACxC,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAClC,OAAO;YACL,KAAK,EACH,GAAG,CAAC,eAAe,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAA,GAAG,CAAC,eAAe,mCAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;YACtE,8DAA8D;YAC9D,OAAO,EAAE,IAAA,2BAAU,EAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC;YACrE,QAAQ,EAAE,CAAC,MAAA,GAAG,CAAC,UAAU,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,CAAC,GAAG,mEAAmE,CACnG,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,GAAW,EAAE,OAAe,EAAE,EAAE;IAC/D,MAAM,eAAe,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACtB,MAAM,IAAA,oBAAS,EAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC,IAAc,CAAC;AAC5B,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAE,EAAE;IACzD,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAA,cAAO,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAA,oBAAS,EACb,SAAS,EAET,GAAG,YAAY,6BAA6B,CAC7C,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,GAAG,EAAE,CAC9B,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B;IAC1C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;AAE/C,MAAM,UAAU,GAAG,CACjB,GAAW,EACX,SAA6B,EAC7B,IAAc,EACd,EAAE,CACF,IAAI,OAAO,CAAO,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,EAAE;QAC/C,GAAG,EAAE,GAAG;QACR,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;KACF,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,cAAc,EAAE;QAClB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,IAAI,EAAE,CAAC,CAAC,CACzD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEE,MAAM,aAAa,GAAG,KAAK,EAAE,OAA6B,EAAE,EAAE;;IACnE,MAAM,IAAI,GAAG,kBAAkB,EAAE,CAAC;IAClC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,mJAAmJ,CACpJ,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,4BAAoB,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAA,sCAAqB,EAAC;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe,EAAE,OAAO,CAAC,OAAO;QAChC,GAAG,aAAa,CAAC,OAAO,CAAC;KAC1B,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAChE,qEAAqE;IACrE,oEAAoE;IACpE,0DAA0D;IAC1D,MAAM,SAAS,GACb,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS;QAC5B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAE9C,OAAO,CAAC,GAAG,CACT,cAAc,IAAI,IAAI,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,OAAO,QAAQ,QAAQ,GAC1E,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gCACnB,EAAE,CACH,CAAC;IACF,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE;QACvC,OAAO;QACP,IAAI,CAAC,OAAO;QACZ,UAAU;QACV,MAAA,OAAO,CAAC,MAAM,mCAAI,QAAQ;QAC1B,YAAY;QACZ,QAAQ;QACR,8DAA8D;QAC9D,0CAA0C;QAC1C,oBAAoB;KACrB,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;AACtD,CAAC,CAAC;AAxCW,QAAA,aAAa,iBAwCxB;AAEF,oEAAoE;AAC7D,MAAM,mBAAmB,GAAG,CACjC,IAAc,EACe,EAAE;IAC/B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,UAAU,CAAC,IAAI,CAAC,CAAA,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC,CAAC;AAfW,QAAA,mBAAmB,uBAe9B"}

package/dist/apps/cli/src/publish/npmPublishPlan.d.ts

@@ -0,0 +1,34 @@
+/**
+ * pure derivation of what an npmPackage deploy publishes — version and
+ * dist-tag from the pipeline trigger. Kept free of process/env access
+ * so it is trivially testable; `npmPublishJob` supplies the CI context.
+ */
+export type NpmPublishContext = {
+    /** catladder env type of the deploy job (passed by the generated job) */
+    envType: string;
+    /** git tag the pipeline runs for, without `refs/` prefix; null on branch/MR pipelines */
+    ciTag: string | null;
+    /** slugified branch name (the source branch for merge requests) */
+    refSlug: string;
+    /** short commit sha */
+    shortSha: string;
+    /** explicit dist-tag from the deploy config, overrides the derivation */
+    distTagOverride?: string;
+};
+export type NpmPublishPlan = {
+    version: string;
+    distTag: string;
+};
+/**
+ * branches whose canary publishes get their own dist-tag instead of
+ * `canary`, so consumers can track them (`yarn add pkg@next`)
+ */
+export declare const BRANCH_DIST_TAGS: string[];
+export declare const computeNpmPublishPlan: (ctx: NpmPublishContext) => NpmPublishPlan;
+/**
+ * mirrors gitlab's CI_COMMIT_REF_SLUG derivation (github has no
+ * equivalent predefined variable): lowercased, everything except
+ * `0-9a-z` replaced with `-`, shortened to 63 bytes, trimmed of
+ * leading/trailing `-`
+ */
+export declare const slugifyRef: (ref: string) => string;

package/dist/apps/cli/src/publish/npmPublishPlan.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * pure derivation of what an npmPackage deploy publishes — version and
+ * dist-tag from the pipeline trigger. Kept free of process/env access
+ * so it is trivially testable; `npmPublishJob` supplies the CI context.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.slugifyRef = exports.computeNpmPublishPlan = exports.BRANCH_DIST_TAGS = void 0;
+/**
+ * branches whose canary publishes get their own dist-tag instead of
+ * `canary`, so consumers can track them (`yarn add pkg@next`)
+ */
+exports.BRANCH_DIST_TAGS = ["next", "beta"];
+const computeNpmPublishPlan = (ctx) => {
+    var _a, _b;
+    if (ctx.envType === "prod" || ctx.envType === "stage") {
+        if (!ctx.ciTag) {
+            throw new Error(`npm publish for env type "${ctx.envType}" expects a tagged-release pipeline, but no git tag is set`);
+        }
+        return {
+            version: ctx.ciTag.replace(/^v/, ""),
+            distTag: (_a = ctx.distTagOverride) !== null && _a !== void 0 ? _a : "latest",
+        };
+    }
+    return {
+        version: `0.0.0-${ctx.refSlug}-${ctx.shortSha}`,
+        distTag: (_b = ctx.distTagOverride) !== null && _b !== void 0 ? _b : (exports.BRANCH_DIST_TAGS.includes(ctx.refSlug) ? ctx.refSlug : "canary"),
+    };
+};
+exports.computeNpmPublishPlan = computeNpmPublishPlan;
+/**
+ * mirrors gitlab's CI_COMMIT_REF_SLUG derivation (github has no
+ * equivalent predefined variable): lowercased, everything except
+ * `0-9a-z` replaced with `-`, shortened to 63 bytes, trimmed of
+ * leading/trailing `-`
+ */
+const slugifyRef = (ref) => ref
+    .toLowerCase()
+    .replace(/[^0-9a-z]/g, "-")
+    .slice(0, 63)
+    .replace(/^-+|-+$/g, "");
+exports.slugifyRef = slugifyRef;
+//# sourceMappingURL=npmPublishPlan.js.map

package/dist/apps/cli/src/publish/npmPublishPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npmPublishPlan.js","sourceRoot":"","sources":["../../../../../src/publish/npmPublishPlan.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAoBH;;;GAGG;AACU,QAAA,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE1C,MAAM,qBAAqB,GAAG,CACnC,GAAsB,EACN,EAAE;;IAClB,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,6BAA6B,GAAG,CAAC,OAAO,4DAA4D,CACrG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACpC,OAAO,EAAE,MAAA,GAAG,CAAC,eAAe,mCAAI,QAAQ;SACzC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,SAAS,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,EAAE;QAC/C,OAAO,EACL,MAAA,GAAG,CAAC,eAAe,mCACnB,CAAC,wBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;KACpE,CAAC;AACJ,CAAC,CAAC;AApBW,QAAA,qBAAqB,yBAoBhC;AAEF;;;;;GAKG;AACI,MAAM,UAAU,GAAG,CAAC,GAAW,EAAU,EAAE,CAChD,GAAG;KACA,WAAW,EAAE;KACb,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC;KAC1B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACZ,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AALhB,QAAA,UAAU,cAKM"}

package/dist/apps/cli/src/release/changesetCheck.d.ts

@@ -0,0 +1,40 @@
+/**
+ * pure logic of the changeset check (run in MR/PR pipelines by catci):
+ * given the changesets added by the merge request and everything
+ * pending on the branch, render the markdown report shown as job
+ * output, exposed artifact and sticky MR/PR comment.
+ */
+import type { Changeset } from "./changesets";
+/**
+ * identifies the sticky comment across pushes: the check finds the
+ * existing comment carrying this marker and updates it in place
+ * instead of posting a new one
+ */
+export declare const CHANGESET_CHECK_MARKER = "<!-- catladder-changeset-check -->";
+export type ChangesetCheckInput = {
+    /**
+     * file names of changesets ADDED by this merge request (relative to
+     * `.changeset/`)
+     */
+    addedFiles: string[];
+    /**
+     * all changesets pending on this branch (added here or merged
+     * earlier and not yet released)
+     */
+    pending: Changeset[];
+    lastTag: string | null;
+    /** platform wording: "merge request" (gitlab) or "pull request" (github) */
+    requestLabel: string;
+    /**
+     * the project's package manager, so the "how to add one" hint names a
+     * command that actually exists there
+     */
+    packageManager: "yarn" | "pnpm";
+};
+export type ChangesetCheckResult = {
+    /** whether this merge request adds at least one changeset */
+    addsChangeset: boolean;
+    /** the full report, marker included (comment + artifact body) */
+    markdown: string;
+};
+export declare const runChangesetCheck: ({ addedFiles, pending, lastTag, requestLabel, packageManager, }: ChangesetCheckInput) => ChangesetCheckResult;

package/dist/apps/cli/src/release/changesetCheck.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runChangesetCheck = exports.CHANGESET_CHECK_MARKER = void 0;
+const changesets_1 = require("./changesets");
+/**
+ * identifies the sticky comment across pushes: the check finds the
+ * existing comment carrying this marker and updates it in place
+ * instead of posting a new one
+ */
+exports.CHANGESET_CHECK_MARKER = "<!-- catladder-changeset-check -->";
+const runChangesetCheck = ({ addedFiles, pending, lastTag, requestLabel, packageManager, }) => {
+    const addsChangeset = addedFiles.length > 0;
+    const lines = [exports.CHANGESET_CHECK_MARKER, "## 🦋 Changeset check", ""];
+    if (addsChangeset) {
+        lines.push(`✅ This ${requestLabel} adds ${addedFiles.length} changeset${addedFiles.length === 1 ? "" : "s"}: ${addedFiles.map((f) => `\`${f}\``).join(", ")}`);
+    }
+    else {
+        lines.push(`⚠️ **This ${requestLabel} adds no changeset.** If the change is user-facing it will be missing from the next release's changelog — add \`.changeset/<name>.md\` (or run \`${packageManager} changeset\`). For docs/chore changes this warning can be ignored.`);
+    }
+    lines.push("");
+    if (pending.length === 0) {
+        lines.push("No changesets are pending — merging will **not** trigger a release.");
+    }
+    else {
+        const version = (0, changesets_1.getNextVersion)(lastTag, (0, changesets_1.maxBump)(pending.map((c) => c.bump)));
+        lines.push(`${pending.length} changeset${pending.length === 1 ? " is" : "s are"} pending after merge — the next release will be **v${version}**${lastTag ? ` (from ${lastTag})` : " (first release)"}:`, "", "<details><summary>Changelog preview</summary>", "", (0, changesets_1.renderChangelogEntries)(pending), "", "</details>");
+    }
+    return { addsChangeset, markdown: lines.join("\n") };
+};
+exports.runChangesetCheck = runChangesetCheck;
+//# sourceMappingURL=changesetCheck.js.map

package/dist/apps/cli/src/release/changesetCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changesetCheck.js","sourceRoot":"","sources":["../../../../../src/release/changesetCheck.ts"],"names":[],"mappings":";;;AAOA,6CAA+E;AAE/E;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,oCAAoC,CAAC;AA8BpE,MAAM,iBAAiB,GAAG,CAAC,EAChC,UAAU,EACV,OAAO,EACP,OAAO,EACP,YAAY,EACZ,cAAc,GACM,EAAwB,EAAE;IAC9C,MAAM,aAAa,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAE5C,MAAM,KAAK,GAAa,CAAC,8BAAsB,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAE9E,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CACR,UAAU,YAAY,SAAS,UAAU,CAAC,MAAM,aAAa,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnJ,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,aAAa,YAAY,oJAAoJ,cAAc,oEAAoE,CAChQ,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACR,qEAAqE,CACtE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAA,2BAAc,EAC5B,OAAO,EACP,IAAA,oBAAO,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACpC,CAAC;QACF,KAAK,CAAC,IAAI,CACR,GAAG,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,sDAAsD,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,OAAO,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,EAC5L,EAAE,EACF,+CAA+C,EAC/C,EAAE,EACF,IAAA,mCAAsB,EAAC,OAAO,CAAC,EAC/B,EAAE,EACF,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACvD,CAAC,CAAC;AA3CW,QAAA,iBAAiB,qBA2C5B"}

package/dist/apps/cli/src/release/changesetCheckJob.d.ts

@@ -0,0 +1,2 @@
+export declare const CHANGESET_REPORT_FILE = "changeset-report.md";
+export declare const changesetCheckJob: () => Promise<void>;

package/dist/apps/cli/src/release/changesetCheckJob.js

@@ -0,0 +1,188 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.changesetCheckJob = exports.CHANGESET_REPORT_FILE = void 0;
+/**
+ * the changeset check CI job (run by catci via the `changesetCheck`
+ * script of the `changesets` job image, in MR/PR pipelines only):
+ * reports which changesets the merge request adds, what is pending and
+ * what version merging would release. The report goes to the job log,
+ * to `changeset-report.md` (exposed as an artifact on gitlab) and to a
+ * sticky MR/PR comment where a token allows it. Exits 1 (the job runs
+ * with allow_failure) when the merge request adds no changeset.
+ */
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const changesetCheck_1 = require("./changesetCheck");
+const changesetsReleaseJob_1 = require("./changesetsReleaseJob");
+const releaseGit_1 = require("./releaseGit");
+const stepSummary_1 = require("./stepSummary");
+exports.CHANGESET_REPORT_FILE = "changeset-report.md";
+const onGithub = () => process.env.GITHUB_ACTIONS === "true";
+/**
+ * the repo's package manager, from the lockfile in the checkout — the
+ * hint for adding a changeset should name a command the project has
+ */
+const detectPackageManager = () => (0, fs_1.existsSync)("pnpm-lock.yaml") ? "pnpm" : "yarn";
+/**
+ * the changeset files added by this merge request: diffed against the
+ * merge base with the target branch (fetched explicitly — CI checkouts
+ * don't carry the target branch). Returns null when there is no MR/PR
+ * context to diff against.
+ */
+const getAddedChangesetFiles = async () => {
+    const targetBranch = onGithub()
+        ? process.env.GITHUB_BASE_REF
+        : process.env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME;
+    if (!targetBranch) {
+        return null;
+    }
+    await (0, releaseGit_1.git)("fetch", "--quiet", "origin", targetBranch);
+    // FETCH_HEAD instead of origin/<branch>: CI remotes don't always
+    // carry the standard branch refspec
+    const mergeBase = await (0, releaseGit_1.git)("merge-base", "HEAD", "FETCH_HEAD");
+    const diff = await (0, releaseGit_1.git)("diff", "--name-only", "--diff-filter=A", mergeBase, "HEAD");
+    return diff
+        .split("\n")
+        .filter((file) => file.startsWith(".changeset/") &&
+        file.endsWith(".md") &&
+        !file.toLowerCase().endsWith("readme.md"))
+        .map((file) => file.slice(".changeset/".length));
+};
+const findSticky = (comments) => comments.find((comment) => { var _a; return (_a = comment.body) === null || _a === void 0 ? void 0 : _a.includes(changesetCheck_1.CHANGESET_CHECK_MARKER); });
+const request = async (url, init) => {
+    var _a;
+    const response = await fetch(url, init);
+    if (!response.ok) {
+        throw new Error(`${(_a = init.method) !== null && _a !== void 0 ? _a : "GET"} ${url} failed: ${response.status} ${await response.text()}`);
+    }
+    return response;
+};
+/**
+ * sticky PR comment via the workflow's own token
+ * (`permissions: pull-requests: write`)
+ */
+const upsertGithubComment = async (markdown) => {
+    var _a, _b;
+    const token = process.env.GITHUB_TOKEN;
+    const apiUrl = (_a = process.env.GITHUB_API_URL) !== null && _a !== void 0 ? _a : "https://api.github.com";
+    const repository = process.env.GITHUB_REPOSITORY;
+    // pull_request workflows check out refs/pull/<number>/merge
+    const prNumber = parseInt((_b = process.env.GITHUB_REF_NAME) !== null && _b !== void 0 ? _b : "");
+    if (!token || !repository || !prNumber) {
+        console.log("no PR context/token — skipping the PR comment");
+        return;
+    }
+    const headers = {
+        authorization: `Bearer ${token}`,
+        accept: "application/vnd.github+json",
+        "content-type": "application/json",
+    };
+    const comments = await (await request(`${apiUrl}/repos/${repository}/issues/${prNumber}/comments?per_page=100`, { headers })).json();
+    const existing = findSticky(comments);
+    if (existing) {
+        await request(`${apiUrl}/repos/${repository}/issues/comments/${existing.id}`, {
+            method: "PATCH",
+            headers,
+            body: JSON.stringify({ body: markdown }),
+        });
+    }
+    else {
+        await request(`${apiUrl}/repos/${repository}/issues/${prNumber}/comments`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ body: markdown }),
+        });
+    }
+    console.log("updated the sticky PR comment");
+};
+/**
+ * sticky MR note — only when the project makes GL_TOKEN available to
+ * MR pipelines (opt-in: an api-scope token in MR pipelines is a
+ * security trade-off). Without it the report is still in the job log
+ * and the exposed artifact.
+ */
+const upsertGitlabComment = async (markdown) => {
+    const token = process.env.GL_TOKEN;
+    if (!token) {
+        console.log("GL_TOKEN is not available in this pipeline — skipping the MR comment (report available in the job log and the exposed artifact)");
+        return;
+    }
+    const apiUrl = process.env.CI_API_V4_URL;
+    const projectId = process.env.CI_PROJECT_ID;
+    const mrIid = process.env.CI_MERGE_REQUEST_IID;
+    if (!apiUrl || !projectId || !mrIid) {
+        console.log("no MR context — skipping the MR comment");
+        return;
+    }
+    const headers = {
+        "PRIVATE-TOKEN": token,
+        "content-type": "application/json",
+    };
+    const notesUrl = `${apiUrl}/projects/${projectId}/merge_requests/${mrIid}/notes`;
+    const notes = await (await request(`${notesUrl}?per_page=100`, { headers })).json();
+    const existing = findSticky(notes);
+    if (existing) {
+        await request(`${notesUrl}/${existing.id}`, {
+            method: "PUT",
+            headers,
+            body: JSON.stringify({ body: markdown }),
+        });
+    }
+    else {
+        await request(notesUrl, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ body: markdown }),
+        });
+    }
+    console.log("updated the sticky MR comment");
+};
+const changesetCheckJob = async () => {
+    await (0, releaseGit_1.ensureReleaseHistory)();
+    const pending = await (0, changesetsReleaseJob_1.readPendingChangesets)();
+    const lastTag = await (0, releaseGit_1.getLastReleaseTag)();
+    const addedFiles = await getAddedChangesetFiles();
+    const result = (0, changesetCheck_1.runChangesetCheck)({
+        addedFiles: addedFiles !== null && addedFiles !== void 0 ? addedFiles : [],
+        pending,
+        lastTag,
+        requestLabel: onGithub() ? "pull request" : "merge request",
+        packageManager: detectPackageManager(),
+    });
+    console.log(result.markdown.replace(`${changesetCheck_1.CHANGESET_CHECK_MARKER}\n`, ""));
+    await (0, promises_1.writeFile)(exports.CHANGESET_REPORT_FILE, result.markdown);
+    // a failed comment must not fail the check — the report has already
+    // been printed and written
+    try {
+        if (onGithub()) {
+            await upsertGithubComment(result.markdown);
+        }
+        else {
+            await upsertGitlabComment(result.markdown);
+        }
+    }
+    catch (error) {
+        console.warn(`could not update the sticky comment: ${error}`);
+    }
+    if (addedFiles === null) {
+        console.log("not running against a merge request — check skipped");
+        return;
+    }
+    if (!result.addsChangeset) {
+        if (onGithub()) {
+            // github has no "warning" job state: exiting non-zero would show
+            // the job as failed (a red ❌ and "exit code 1"), which reads like
+            // something broke. A warning annotation plus the step summary and
+            // the sticky PR comment carry the signal instead.
+            console.log("::warning title=No changeset::this pull request adds no changeset — " +
+                "if the change is user-facing, add one so it appears in the next release's changelog");
+            (0, stepSummary_1.appendStepSummary)(result.markdown.replace(`${changesetCheck_1.CHANGESET_CHECK_MARKER}\n`, ""));
+            return;
+        }
+        // gitlab: exit 1 turns the (allow_failure) job yellow so reviewers
+        // notice
+        process.exitCode = 1;
+    }
+};
+exports.changesetCheckJob = changesetCheckJob;
+//# sourceMappingURL=changesetCheckJob.js.map