@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/maintenance.deployment.yml

@@ -0,0 +1,45 @@
+{{- if (.Values.maintenance) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  annotations:
+  name: {{ template "fullname" . }}-maintenance
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: {{ template "fullname" . }}-maintenance
+      release: {{ .Release.Name }}
+  strategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 1
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: {{ template "fullname" . }}-maintenance
+        release: {{ .Release.Name }}
+    spec:
+      {{- if .Values.image.pullSecret }}
+      imagePullSecrets:
+        - name: {{ .Values.image.pullSecret }}
+      {{- end }}
+      containers:
+      - image: {{ .Values.maintenance.image }}
+        imagePullPolicy: Always
+        name: {{ template "fullname" . }}-maintenance
+        resources: {}
+        securityContext:
+          privileged: false
+        terminationMessagePath: /dev/termination-log
+        terminationMessagePolicy: File
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/maintenance.service.yml

@@ -0,0 +1,24 @@
+{{- if (.Values.maintenance) }}
+apiVersion: v1
+kind: Service
+metadata:
+  annotations:
+  name: {{ template "fullname" . }}-maintenance
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+spec:
+  ports:
+  - port: 80
+    protocol: TCP
+    targetPort: 80
+    name: {{ template "fullname" . }}-maintenance-service
+  selector:
+    app: {{ template "fullname" . }}-maintenance
+    release: {{ .Release.Name }}
+  sessionAffinity: None
+  type: ClusterIP
+status:
+  loadBalancer: {}
+
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/mongodb.backup.cronjob.yml

@@ -0,0 +1,120 @@
+{{- if and (.Values.mongodb.enabled) (.Values.mongodb.backup.enabled) }}
+
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+  labels:
+    app: {{ .Release.Name }}
+  namespace: {{ .Release.Namespace }}
+  
+spec:
+  schedule: {{.Values.mongodb.backup.schedule }}
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName:  {{ template "fullname" . }}-mongodb-backup
+          restartPolicy: OnFailure
+          containers:
+            - name: backup-cron
+            
+              env:
+                - name: M_RELEASE_NAME
+                  value: {{ template "fullname" . }}-mongodb
+                - name: MONGODB_ROOT_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: {{ template "fullname" $ }}-app-secrets
+                      key: MONGODB_ROOT_PASSWORD
+                - name: VSC_NAME
+                  value: {{ .Values.mongodb.backup.volumeSnapshotClass }}
+              image: {{ .Values.mongodb.backup.image }}
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/bash
+                - -i
+                - -c
+                - |
+                    set -e
+                    echo alias M_CMD=\'mongo admin --host {{ .Values.mongodb.backup.hostToBackup }} {{- if .Values.mongodb.auth.enabled }} --authenticationDatabase admin -u root -p "\"${MONGODB_ROOT_PASSWORD}\"" {{- end }} --quiet --eval\' >> ~/.bashrc
+                    source ~/.bashrc
+                    echo -e "[+] Check if it is a Primary node to make it stepDown\n"
+                    if [[ `M_CMD " db.runCommand( { isMaster: 1 } )['ismaster']"` != "false" ]]
+                    then
+                      echo -e "[+] Stepping Down\n"
+                      M_CMD "rs.stepDown()"
+                    fi
+                    echo -e "[+] Send Slave to Freeze\n"
+                    M_CMD "rs.freeze(99999999999)"
+                    export E_TIME=$(date +%s)
+                    echo -e "[+] Creating snapshot object\n"
+                    cat <<EOF | kubectl apply -f -
+                    apiVersion: snapshot.storage.k8s.io/v1beta1
+                    kind: VolumeSnapshot
+                    metadata:
+                      name: snapshot-${M_RELEASE_NAME}-${E_TIME}
+                    spec:
+                      volumeSnapshotClassName: ${VSC_NAME}
+                      source:
+                        persistentVolumeClaimName:  {{ .Values.mongodb.backup.pvcToBackup }}
+                    EOF
+                    echo -e "[+] Waiting for snapshot to finish\n"
+                    while : ; do
+                      result=$(kubectl get volumesnapshot   -o custom-columns='READY:.status.readyToUse' --field-selector metadata.name=snapshot-${M_RELEASE_NAME}-${E_TIME} | grep -v READY)
+                      [[ "${result}" == "true" ]] && break
+                      echo "[-] still waiting for snapshot to be ready .. "
+                      sleep 1
+                    done
+                    echo -e "[+] Snapshot finished, unfreeze Slave\n"
+                    M_CMD "rs.freeze(0)"
+                    echo -e "[+] Snapshotting finished successfully\n"
+                    kubectl get volumesnapshots --no-headers --output=custom-columns="NAME:metadata.name,CREATED:status.creationTime" | while read name creation; do
+                      if [[ "${name}" =~ ^snapshot-$M_RELEASE_NAME-[0-9]*$ ]] && [[ "${creation}" < "$(date --date "now 90 days ago" +%F)" ]]; then
+                        echo "[+] Removing expired snapshot ${name} created on ${creation}"
+                        kubectl delete volumesnapshot "${name}"
+                      fi
+                    done
+---
+
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+---
+
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - services
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - "snapshot.storage.k8s.io/v1beta1"
+      - "snapshot.storage.k8s.io"
+    resources:
+      - "volumesnapshots"
+    verbs:
+      - "*"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "fullname" . }}-mongodb-backup
+roleRef:
+  kind: Role
+  name: {{ template "fullname" . }}-mongodb-backup
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+  - kind: ServiceAccount
+    name: {{ template "fullname" . }}-mongodb-backup
+
+
+{{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/values.yaml

@@ -0,0 +1,153 @@
+# Default values for manulstack helm chart.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+global:
+  componentName: web
+  ENV_SHORT: dev
+  BUILD_ID:
+image:
+  repository:
+  name:
+  pullPolicy: Always
+  pullSecret: gitlab-registry
+
+service:
+  type: ClusterIP
+  externalPort: 80
+  internalPort: 8080
+  additionalPorts: []
+
+env:
+  public:
+    NODE_ENV: production
+    TZ: Europe/Zurich
+  secret: {}
+
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: nginx
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/affinity: cookie
+    nginx.ingress.kubernetes.io/affinity-mode: persistent
+    nginx.ingress.kubernetes.io/session-cookie-hash: sha1
+    nginx.ingress.kubernetes.io/session-cookie-name: route
+    nginx.ingress.kubernetes.io/session-cookie-path: /
+  tls: []
+
+jobDefaults:
+  resources:
+    limits:
+      cpu: 1000m
+    requests:
+      cpu: 50m
+      memory: 350Mi
+
+application:
+  enabled: true
+  replicas: 1
+  hostCanonical:
+  command:
+  # these requests are usually overridden by the gitlab include and values
+  resources:
+    limits:
+      cpu: 1000m
+      memory: 600Mi
+    requests:
+      cpu: 50m
+      memory: 150Mi
+  updateStrategy:
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+    type: RollingUpdate
+
+  worker:
+    enabled: false
+    useExclusivePool: false
+    service:
+      enabled: false
+      type: ClusterIP
+      externalPort: 80
+      internalPort: 8080
+      additionalPorts: []
+    livenessProbe: true
+    resources:
+      limits:
+        cpu: 1000m
+        memory: 1000Mi
+      requests:
+        cpu: 50m
+        memory: 350Mi
+  startupProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: startup
+    failureThreshold: 60
+    timeoutSeconds: 3
+    periodSeconds: 5
+  livenessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: liveness
+    periodSeconds: 5
+    timeoutSeconds: 10
+  readinessProbe:
+    httpGet:
+      path: /__health
+      port: 8080
+      httpHeaders:
+        - name: X-PAN-HEALTHCHECK
+          value: readiness
+    failureThreshold: 3
+    timeoutSeconds: 3
+    periodSeconds: 5
+    successThreshold: 1
+
+gitlab:
+  app:
+  env:
+  projectPath:
+  mergeRequestId:
+  projectId:
+
+## features
+
+mongodb:
+  enabled: false
+  dbName: app
+  backup:
+    enabled: false
+  # see https://github.com/bitnami/charts/issues/10264#issuecomment-1181574288
+  livenessProbe:
+    enabled: false
+  customLivenessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval "db.adminCommand('ping')"
+  readinessProbe:
+    enabled: false
+  customReadinessProbe:
+    exec:
+      command:
+        - sh
+        - -c
+        - mongo --port $MONGODB_PORT_NUMBER --eval 'db.isMaster().ismaster || db.isMaster().secondary' | grep -q 'true'
+
+secretsFromOtherComponent: {}
+mapServiceUrlToEnv: {}
+cloudsql:
+  enabled: false
+
+mailhog:
+  enabled: false
+  useOauth: true

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -0,0 +1,23 @@
+#!/bin/bash
+set -e
+
+# The credentials come from DOCKER_REGISTRY_USER / DOCKER_REGISTRY_PASSWORD,
+# which the deploy job resolves per CI backend (gitlab: CI_REGISTRY_USER +
+# CI_REGISTRY_PASSWORD, github: the actor + workflow token) — the raw
+# gitlab names used to be hardcoded here, which left the secret without
+# credentials on the github backend.
+#
+# Both of those are job-scoped and expire with the pipeline: the initial
+# pull works, but a pod rescheduled later can no longer re-pull. Projects
+# that need durable pulls declare long-lived registry credentials as
+# secrets named CI_DEPLOY_USER / CI_DEPLOY_PASSWORD, which win here.
+#
+# --docker-email is deliberately gone: it is optional for a
+# docker-registry secret and its only source was $GITLAB_USER_EMAIL.
+echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
+kubectl create secret -n "$KUBE_NAMESPACE" \
+    docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
+    --docker-server="$DOCKER_REGISTRY" \
+    --docker-username="${CI_DEPLOY_USER:-$DOCKER_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$DOCKER_REGISTRY_PASSWORD}" \
+    -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesDelete

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+echo "Delete $RELEASE_NAME"
+helm uninstall "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesDeploy

@@ -0,0 +1,57 @@
+#!/bin/bash
+set -e
+
+echo "Deploy to kubernetes"
+echo "Release: $RELEASE_NAME"
+echo "URL (canonical): $HOSTNAME_INTERNAL"
+
+# this bash-brainfuck simply splits $helmArgs by newline to an array...
+readarray -t helmArgsArray <<<"$HELM_ARGS"
+
+#Log the time until selfdestruct in case of review environment
+if [[ ${ENV_SHORT} == "review" ]]; then echo "NOTE - This deployment will stop itself after 2 weeks"; fi
+
+if [[ ${ENV_SHORT} == "review" ]]; then
+    # auto rollback
+    set +e # disable fail job on error
+    helmStatus=$(helm status --namespace $KUBE_NAMESPACE $RELEASE_NAME 2>/dev/null | awk -F': ' -v key="STATUS" '$1==key {print $2}')
+    helmRevision=$(helm status --namespace $KUBE_NAMESPACE $RELEASE_NAME 2>/dev/null | awk -F': ' -v key="REVISION" '$1==key {print $2}')
+    if [ "$helmStatus" = "failed" ] || [ "$helmStatus" = "pending-install" ] || [ "$helmStatus" = "pending-upgrade" ]; then
+        # rollback
+        echo "helm deployment is pending or failed, rollback (only on review)..."
+        if [ "$helmRevision" = "1" ]; then
+            helm uninstall "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"
+        else
+            helm rollback "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"
+        fi
+
+    fi
+    set -e # reenable
+
+fi
+
+echo "doing helm upgrade"
+helm upgrade --install "$RELEASE_NAME" "$HELM_GITLAB_CHART_NAME" \
+    --timeout="30m0s" \
+    --set global.appName="$KUBE_APP_NAME" \
+    --set global.appPrefix="$KUBE_APP_NAME_PREFIX" \
+    --set global.ENV_SHORT="$ENV_SHORT" \
+    --set global.BUILD_ID="$BUILD_INFO_ID" \
+    --set image.repository="$CI_REGISTRY_IMAGE" \
+    --set image.pullSecret="$KUBE_DOCKER_IMAGE_PULL_SECRET" \
+    --set image.name="$DOCKER_IMAGE_NAME" \
+    --set image.tag="$DOCKER_IMAGE_TAG" \
+    --set image.pullPolicy=IfNotPresent \
+    --set application.hostCanonical="$HOSTNAME_INTERNAL" \
+    --set mongodb.fullnameOverride=$KUBE_APP_NAME-mongodb \
+    --set mailhog.fullnameOverride=$KUBE_APP_NAME-mailhog \
+    --set gitlab.visualReviewEnabled="$GITLAB_VISUAL_REVIEW_ENABLED" \
+    --set gitlab.app="$CI_PROJECT_PATH_SLUG" \
+    --set gitlab.projectPath="$CI_PROJECT_PATH" \
+    --set gitlab.mergeRequestId="$CI_MERGE_REQUEST_IID" \
+    --set gitlab.projectId="$CI_PROJECT_ID" \
+    --set gitlab.env="$CI_ENVIRONMENT_SLUG" \
+    --set namespace="$KUBE_NAMESPACE" \
+    --namespace="$KUBE_NAMESPACE" \
+    ${helmArgsArray[@]} \
+    --values __all_values.yml

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesRollback

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+echo "Rolling back $RELEASE_NAME"
+helm rollback "$RELEASE_NAME" --namespace "$KUBE_NAMESPACE"

package/dist/bundles/runner-images/npm-publish/Dockerfile

@@ -0,0 +1,12 @@
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git
+
+# npm trusted publishing (OIDC) needs npm >= 11.5.1; the npm bundled
+# with the node image is not guaranteed to be new enough, so pin the
+# major explicitly. Without it npm silently falls back to token auth.
+RUN npm install -g npm@11
+
+# no publish logic baked in: it lives in catci, which pipeline
+# generation materializes into the repository checkout
+# (.catladder-generated/catci)

package/dist/bundles/runner-images/semantic-release/Dockerfile

@@ -0,0 +1,30 @@
+# job images are addressed by a content hash of this directory — the
+# build must be reproducible, so every dependency is pinned exactly.
+# node:24 satisfies the newer plugins' engine requirements
+# (@semantic-release/git and @semantic-release/changelog need node >=24.15).
+FROM node:24-alpine
+
+RUN apk add --no-cache bash git git-lfs
+
+# add semantic release
+# NOTE: pin every dependency exactly. These are the semantic-release@25 line
+# (all ESM — v25 loads plugins via dynamic import, so changelog@7/git@11 are
+# fine). Every plugin declares `semantic-release` as a peer dependency, so a
+# plugin major that outpaces the semantic-release major fails the release job
+# with "plugins configuration is invalid" — bump them together. Upstream
+# @semantic-release/git replaces the old panter fork; see
+# scripts/semanticRelease for why the commit message is hardcoded.
+RUN yarn global add \
+    semantic-release@25.0.8 \
+    @semantic-release/commit-analyzer@13.0.1 \
+    @semantic-release/release-notes-generator@14.1.1 \
+    @semantic-release/git@11.0.0 \
+    @semantic-release/changelog@7.0.0 \
+    @semantic-release/gitlab@13.3.3 \
+    @semantic-release/exec@7.1.0
+
+RUN mkdir -p /scripts
+COPY ./scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"

package/dist/bundles/runner-images/semantic-release/scripts/semanticRelease

@@ -0,0 +1,133 @@
+#!/bin/bash
+set -e
+
+# 0. check and evalaute security audit or create MR with security audit template (and exit 1)
+# 1. create "@semantic-release/changelog"
+# 2. commit it to git (and push)
+# 3. optional: update package.json
+
+# better branches settings: https://github.com/semantic-release/semantic-release/issues/1581
+
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # github container jobs: the workspace volume is owned by the host
+  # runner user while this step runs as the container user, and the
+  # safe.directory entry actions/checkout writes goes to a temporary
+  # HOME that is gone by now — git would refuse the repo ("dubious
+  # ownership", surfacing as ENOGITREPO from semantic-release)
+  git config --global --add safe.directory "$(pwd)"
+fi
+
+echo "doing security audit check"
+CATCI=".catladder-generated/catci/index.js"
+if [ -f "$CATCI" ]; then
+  # catci is materialized by pipeline generation — always the exact
+  # catladder version that generated this pipeline
+  if [ "$GITHUB_ACTIONS" = "true" ]; then
+    # github: gate only — the MR remediation is gitlab-specific
+    node "$CATCI" security-audit check ./
+  else
+    node "$CATCI" security-audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+  fi
+elif command -v catladder > /dev/null 2>&1; then
+  # repos generated by old catladder versions (no materialized catci):
+  # the central image still bakes the cli in
+  catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+else
+  echo "neither $CATCI nor the catladder cli found — regenerate the pipeline with a current catladder version (catenv)"
+  exit 1
+fi
+
+echo "doing semantic release"
+
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # the gitlab publish plugin would fail on github; skip it (the tag
+  # and changelog commit still happen, only the gitlab release entry
+  # is gitlab-specific)
+  PUBLISH_PLUGIN=""
+else
+  # no gitlabUrl: the plugin derives it from the CI-provided variables
+  # of the running instance. It used to be hardcoded to panter's gitlab,
+  # which broke the release on every other instance.
+  PUBLISH_PLUGIN=',
+    "@semantic-release/gitlab"'
+fi
+
+if [ ! -e .releaserc ]; then
+  cat >.releaserc <<EOF
+{
+  "plugins": [
+      [
+      "@semantic-release/commit-analyzer",
+      {
+        preset: "angular",
+        releaseRules: [
+          { breaking: true, release: "major" },
+          { revert: true, release: "patch" },
+
+          { type: "feat", release: "minor" },
+          { type: "docs", release: "patch" },
+          { type: "fix", release: "patch" },
+          { type: "perf", release: "patch" },
+          # always fall back to a patch release
+          {
+            header: "**",
+            release: "patch",
+          },
+        ],
+      },
+    ],
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/changelog",
+    # message prefix hardcoded to "release" on purpose. Ideally this would be
+    # "chore(\${branch.type})", but upstream @semantic-release/git passes the
+    # branch *name* (not the object) into the template, so \${branch.type} is
+    # never available (see https://github.com/semantic-release/git/pull/213,
+    # open/ignored since 2020 — the README documents branch.type but the code
+    # never wired it up; the old panter fork existed only to patch this). On the
+    # default branch branch.type is always "release", and the pipeline
+    # loop-prevention rule keys on the literal "chore(release)" prefix, so keep
+    # this literal. Don't "fix" it back to \${branch.type}.
+    ["@semantic-release/git", {
+      "message": "chore(release): \${nextRelease.version}\n\n\${nextRelease.notes}"
+    }]${PUBLISH_PLUGIN}
+    ],
+  "branches": [
+    "+([0-9])?(.{+([0-9]),x}).x",
+    "master",
+    "main",
+    "next",
+    "next-major",
+    {
+      "name": "beta",
+      "prerelease": true
+    },
+    {
+      "name": "alpha",
+      "prerelease": true
+    }
+  ],
+}
+EOF
+fi
+
+if [ "$GITHUB_ACTIONS" = "true" ]; then
+  TAGS_BEFORE=$(git tag --list 'v[0-9]*')
+fi
+
+semantic-release
+
+# tags pushed with the default GITHUB_TOKEN don't trigger `on: push:
+# tags` workflows (github's recursion guard) — dispatch the
+# taggedRelease workflow explicitly for a tag semantic-release created
+if [ "$GITHUB_ACTIONS" = "true" ] && [ -f "$CATCI" ]; then
+  if [ -z "$TAGS_BEFORE" ]; then
+    NEW_TAG=$(git tag --list 'v[0-9]*' | tail -n1)
+  else
+    NEW_TAG=$(git tag --list 'v[0-9]*' | grep -Fxv -f <(printf '%s\n' "$TAGS_BEFORE") | tail -n1 || true)
+  fi
+  if [ -n "$NEW_TAG" ]; then
+    node "$CATCI" release dispatch-tagged-workflow "$NEW_TAG"
+  else
+    echo "no new release tag created — skipping taggedRelease dispatch"
+  fi
+fi