@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCloudRun = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
+const serviceAccountNames_1 = require("../../../../../gcloud/serviceAccountNames");
+const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
+const concurrency_1 = require("../../../../../utils/concurrency");
+const setupCloudRun_1 = require("../setup/setupCloudRun");
+const GcloudProjectInspector_1 = require("./GcloudProjectInspector");
+const getCloudRunConfig = (context) => {
+    var _a;
+    const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
+        throw new Error("not a cloud run context");
+    }
+    return config;
+};
+/**
+ * compares the gcloud state `setupCloudRun` would provision for the
+ * CURRENT config against what is actually there: enabled services and
+ * artifacts registry per project, deploy service account existence and
+ * IAM roles per component/env.
+ *
+ * The motivating case (#70): a component gets `cloudSql` after its
+ * setup ran — deploys keep working and only the review teardown hits
+ * the missing `roles/cloudsql.admin` as a 403 in ci.
+ */
+const checkCloudRun = async (report, contexts) => {
+    var _a;
+    const cloudRunContexts = contexts.filter((context) => { var _a; return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun"); });
+    if (cloudRunContexts.length === 0)
+        return;
+    report.section("google cloud run infrastructure");
+    const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
+    if (!(await inspector.isAuthenticated())) {
+        report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
+        return;
+    }
+    // project-level: enabled services + artifacts registry. The required
+    // services are the union over all components deploying to the project
+    // (cloudSql on any of them requires the sql services).
+    const byProject = new Map();
+    for (const context of cloudRunContexts) {
+        const { projectId } = getCloudRunConfig(context);
+        byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
+    }
+    for (const [projectId, projectContexts] of byProject) {
+        const requiredServices = new Set(projectContexts.flatMap((context) => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
+        try {
+            const enabled = await inspector.getEnabledServices(projectId);
+            const missing = [...requiredServices].filter((service) => !enabled.has(service));
+            if (missing.length === 0) {
+                report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
+            }
+            else {
+                report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
+            }
+        }
+        catch (e) {
+            report.warn(`${projectId}: could not list enabled services (${e.message})`);
+        }
+        const regions = new Set(projectContexts.map((context) => getCloudRunConfig(context).region));
+        for (const region of regions) {
+            if (await inspector.hasArtifactsRegistry(projectId, region)) {
+                report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
+            }
+            else {
+                report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
+            }
+        }
+    }
+    // per component/env: deploy service account exists and carries every
+    // role the current config implies
+    const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async (context) => {
+        const config = getCloudRunConfig(context);
+        const { fullIdentifier } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+            name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
+            projectId: config.projectId,
+        });
+        if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
+            return { context, fullIdentifier, exists: false, missingRoles: [] };
+        }
+        const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
+        const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter((role) => !boundRoles.includes(role));
+        return { context, fullIdentifier, exists: true, missingRoles };
+    });
+    for (const { context, fullIdentifier, exists, missingRoles } of results) {
+        const label = `${context.env}:${context.name}`;
+        if (!exists) {
+            report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
+        }
+        else if (missingRoles.length > 0) {
+            report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
+        }
+        else {
+            report.ok(`${label}: service account exists with all config-implied roles`);
+        }
+    }
+};
+exports.checkCloudRun = checkCloudRun;
+//# sourceMappingURL=checkCloudRun.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkCloudRun.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,+EAAkF;AAClF,mFAAyF;AACzF,2EAAsE;AACtE,kEAAsE;AACtE,0DAIgC;AAEhC,qEAAkE;AAElE,MAAM,iBAAiB,GAAG,CAAC,OAAyB,EAAE,EAAE;;IACtD,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IACtC,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,QAA4B,EAC5B,EAAE;;IACF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,WACnD,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,CAAA,EAAA,CAC1D,CAAC;IACF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAE1C,MAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,+CAAsB,EAAE,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,IAAI,CACT,+DAA+D,EAC/D,wBAAwB,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,qEAAqE;IACrE,sEAAsE;IACtE,uDAAuD;IACvD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,MAAM,EAAE,SAAS,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACjD,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,MAAA,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,IAAI,SAAS,EAAE,CAAC;QACrD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,eAAe,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAClC,IAAA,2CAA2B,EAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CACxD,CACF,CAAC;QACF,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,CAAC,GAAG,gBAAgB,CAAC,CAAC,MAAM,CAC1C,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CACnC,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,SAAS,gBAAgB,CAAC,IAAI,4BAA4B,CACvE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3D,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,sCAAsC,CAAC,CAAC,OAAO,GAAG,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CACpE,CAAC;QACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,EAAE,CACP,GAAG,SAAS,yBAAyB,2CAAuB,eAAe,MAAM,EAAE,CACpF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,GAAG,SAAS,yBAAyB,2CAAuB,gBAAgB,MAAM,EAAE,EACpF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,kCAAkC;IAClC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAkB,EACtC,gBAAgB,EAChB,CAAC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAAC,OAAO,EAAE;YAC/D,IAAI,EAAE,wCAAwB;YAC9B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAA,+BAAa,EAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,gBAAgB,CACjD,MAAM,CAAC,SAAS,EAChB,kBAAkB,cAAc,EAAE,CACnC,CAAC;QACF,MAAM,YAAY,GAAG,IAAA,sCAAsB,EAAC,MAAM,CAAC,CAAC,MAAM,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CACrC,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACjE,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,OAAO,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,4BAA4B,cAAc,iBAAiB,EACnE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CACT,GAAG,KAAK,uCAAuC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxE,gCAAgC,OAAO,CAAC,IAAI,EAAE,CAC/C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,KAAK,wDAAwD,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAnHW,QAAA,aAAa,iBAmHxB"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithub.d.ts

@@ -0,0 +1,10 @@
+import type { Config } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+export declare const checkGithub: (report: DoctorReport, config: Config) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithub.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGithub = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const commandSecretsSyncGithub_1 = require("../../../../../commands/project/commandSecretsSyncGithub");
+const concurrency_1 = require("../../../../../utils/concurrency");
+const github_1 = require("../../../../../utils/github");
+/** marker for repo-level (environment-less) targets, see collectSecretTargets */
+const REPO_LEVEL = "";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+const checkGithub = async (report, config) => {
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github"))
+        return;
+    report.section("github environments & secrets");
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
+        return;
+    }
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
+        return;
+    }
+    let targets;
+    try {
+        targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+    }
+    catch (e) {
+        report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
+        return;
+    }
+    const referencedNamesOf = (environment) => [...targets.entries()]
+        .filter(([, envs]) => envs.has(environment))
+        .map(([name]) => name);
+    const environmentsNeeded = [
+        ...new Set([...targets.values()].flatMap((envs) => [...envs])),
+    ]
+        .filter((environment) => environment !== REPO_LEVEL)
+        .sort();
+    let existingEnvironments;
+    try {
+        existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
+    }
+    catch (e) {
+        report.warn(`could not list environments of ${repo} (${e.message})`);
+        return;
+    }
+    const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async (environment) => {
+        const referenced = referencedNamesOf(environment);
+        if (!existingEnvironments.has(environment)) {
+            return { environment, referenced, exists: false };
+        }
+        const [secrets, variables] = await Promise.all([
+            (0, github_1.listGithubSecretNames)(repo, environment),
+            (0, github_1.listGithubVariableNames)(repo, environment),
+        ]);
+        // github secret names are case-insensitive and the api returns
+        // them uppercased — compare accordingly
+        const present = new Set([...secrets, ...variables].map((name) => name.toUpperCase()));
+        const referencedUpper = new Set(referenced.map((name) => name.toUpperCase()));
+        return {
+            environment,
+            referenced,
+            exists: true,
+            missing: referenced.filter((name) => !present.has(name.toUpperCase())),
+            stale: [...present].filter((name) => !referencedUpper.has(name)),
+        };
+    });
+    for (const result of perEnvironment) {
+        const { environment, referenced } = result;
+        if (!result.exists) {
+            report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
+            continue;
+        }
+        if (result.missing.length > 0) {
+            report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
+        }
+        else {
+            report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+        }
+        if (result.stale.length > 0) {
+            report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+        }
+    }
+    const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
+    if (repoLevelReferenced.length > 0) {
+        const [secrets, variables] = await Promise.all([
+            (0, github_1.listGithubSecretNames)(repo),
+            (0, github_1.listGithubVariableNames)(repo),
+        ]);
+        const present = new Set([...secrets, ...variables].map((name) => name.toUpperCase()));
+        const missing = repoLevelReferenced.filter((name) => !present.has(name.toUpperCase()));
+        if (missing.length > 0) {
+            report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
+        }
+        else {
+            report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+        }
+    }
+    await checkGithubMergeGating(report, repo);
+};
+exports.checkGithub = checkGithub;
+/**
+ * verifies the merge gating `project setup` configures: auto-merge
+ * enabled and the generated `catladder ✅` aggregate check required on
+ * the default branch. Without it a PR is mergeable while its checks
+ * are still running — gitlab ships this behavior built-in, github
+ * silently does not.
+ */
+const checkGithubMergeGating = async (report, repo) => {
+    var _a, _b;
+    let repoInfo;
+    try {
+        repoInfo = await (0, github_1.ghApiJson)("GET", `repos/${repo}`);
+    }
+    catch (e) {
+        report.warn(`could not read repo settings of ${repo} (${e.message})`);
+        return;
+    }
+    if (repoInfo.allow_auto_merge) {
+        report.ok("auto-merge enabled");
+    }
+    else {
+        report.fail("auto-merge disabled — the merge-when-pipeline-succeeds button cannot appear", "run: catladder project setup");
+    }
+    const branch = repoInfo.default_branch;
+    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null);
+    const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
+    if (checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
+        report.ok(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}`);
+    }
+    else {
+        report.fail(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' is not a required check on ${branch} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
+    }
+    const stale = checks.filter((c) => c.context !== pipeline_1.AGGREGATE_CHECK_JOB_NAME);
+    if (stale.length > 0) {
+        report.warn(`${branch} requires ${stale.length} additional named check(s) (${stale
+            .map((c) => c.context)
+            .join(", ")}) — job names change with components; prefer only '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}'`);
+    }
+};
+//# sourceMappingURL=checkGithub.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uGAGkE;AAClE,kEAAsE;AACtE,wDAMqC;AAGrC,iFAAiF;AACjF,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;GAMG;AACI,MAAM,WAAW,GAAG,KAAK,EAAE,MAAoB,EAAE,MAAc,EAAE,EAAE;IACxE,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAChE,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEhD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,2DAA2D,EAC3D,oBAAoB,CACrB,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CACT,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CACvF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,wEAAwE,CAAC,CAAC,OAAO,GAAG,CACrF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAChD,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;KAC/D;SACE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;SACnD,IAAI,EAAE,CAAC;IAEV,IAAI,oBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,oBAAoB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAA,+BAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,gCAAkB,EAC7C,kBAAkB,EAClB,CAAC,EACD,KAAK,EAAE,WAAW,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,EAAE,WAAW,CAAC;YACxC,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;QACH,+DAA+D;QAC/D,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;QACF,OAAO;YACL,WAAW;YACX,UAAU;YACV,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,gBAAgB,WAAW,qBAAqB,UAAU,CAAC,MAAM,2CAA2C,EAC5G,4CAA4C,CAC7C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxH,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,WAAW,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,qDAAqD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,CAAC;YAC3B,IAAA,gCAAuB,EAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,uBAAuB,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/G,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,mBAAmB,mBAAmB,CAAC,MAAM,uCAAuC,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC;AAjIW,QAAA,WAAW,eAiItB;AAEF;;;;;;GAMG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAAE,MAAoB,EAAE,IAAY,EAAE,EAAE;;IAC1E,IAAI,QAA+D,CAAC;IACpE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,6EAA6E,EAC7E,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAS,EAChC,KAAK,EACL,SAAS,IAAI,aAAa,MAAM,aAAa,CAC9C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,MAAM,GACV,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,mCAAwB,iBAAiB,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,IAAI,mCAAwB,gCAAgC,MAAM,6DAA6D,EAC/H,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,aAAa,KAAK,CAAC,MAAM,+BAA+B,KAAK;aACnE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrB,IAAI,CACH,IAAI,CACL,sDAAsD,mCAAwB,GAAG,CACrF,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGitlab.d.ts

@@ -0,0 +1,13 @@
+import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+export declare const checkGitlab: (instance: IO, report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGitlab.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGitlab = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const date_fns_1 = require("date-fns");
+const gitlab_1 = require("../../../../../utils/gitlab");
+const EXPIRY_WARNING_DAYS = 30;
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+const checkGitlab = async (instance, report, contexts) => {
+    report.section("gitlab project setup");
+    let projectId;
+    try {
+        projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
+    }
+    catch (e) {
+        report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
+        return;
+    }
+    try {
+        const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+        const activeTokens = tokens.filter((t) => t.name === "semantic-release" && t.active === true);
+        // the GL_TOKEN ci variable holds exactly one of them — judge by the
+        // one that lives longest
+        const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
+        if (activeTokens.length > 1) {
+            report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+        }
+        if (!token) {
+            report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
+        }
+        else {
+            const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
+            if (daysLeft < 0) {
+                report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
+            }
+            else if (daysLeft <= EXPIRY_WARNING_DAYS) {
+                report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
+            }
+            else {
+                report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
+            }
+        }
+        try {
+            await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+            report.ok("GL_TOKEN ci variable present");
+        }
+        catch (_a) {
+            report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
+        }
+        const { topics } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
+        if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
+            report.ok("'catladder' project topic set");
+        }
+        else {
+            report.fail("'catladder' project topic missing", "run: catladder project setup");
+        }
+        if (contexts.some((context) => { var _a; return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes"); })) {
+            const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
+            if (deployTokens.find((t) => t.name === "gitlab-deploy-token")) {
+                report.ok("'gitlab-deploy-token' registry deploy token present");
+            }
+            else {
+                report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
+            }
+        }
+    }
+    catch (e) {
+        report.warn(`gitlab checks aborted (${e.message})`);
+    }
+};
+exports.checkGitlab = checkGitlab;
+//# sourceMappingURL=checkGitlab.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGitlab.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGitlab.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGitlab.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AACrD,uCAAoD;AAEpD,wDAIqC;AAGrC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAE/B;;;;;;;;GAQG;AACI,MAAM,WAAW,GAAG,KAAK,EAC9B,QAAY,EACZ,MAAoB,EACpB,QAA4B,EAC5B,EAAE;IACF,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEvC,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,2DAA2D,CAAC,CAAC,OAAO,GAAG,CACxE,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAA,gCAAuB,EAC1C,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;QACF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAC1D,CAAC;QACF,oEAAoE;QACpE,yBAAyB;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CACzD,CAAC,CAAC,CAAC,CAAC;QACL,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,GAAG,YAAY,CAAC,MAAM,0GAA0G,CACjI,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CACT,mDAAmD,EACnD,8BAA8B,CAC/B,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,IAAA,mCAAwB,EACvC,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAC1B,IAAI,IAAI,EAAE,CACX,CAAC;YACF,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CACT,uCAAuC,KAAK,CAAC,UAAU,EAAE,EACzD,kDAAkD,CACnD,CAAC;YACJ,CAAC;iBAAM,IAAI,QAAQ,IAAI,mBAAmB,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CACT,uCAAuC,QAAQ,UAAU,KAAK,CAAC,UAAU,GAAG,EAC5E,kDAAkD,CACnD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,EAAE,CACP,4CAA4C,KAAK,CAAC,UAAU,GAAG,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,qBAAqB,CAC3C,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC;QAC5C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,EAAE,CAAC,CAAC;QAC5E,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,mCAAmC,EACnC,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QAED,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,WACxB,OAAA,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,YAAY,CAAC,CAAA,EAAA,CACrD,EACD,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,IAAA,gCAAuB,EAChD,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;YACF,IACE,YAAY,CAAC,IAAI,CACf,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,CAC1D,EACD,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,qDAAqD,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF,8BAA8B,CAC/B,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC;AA9GW,QAAA,WAAW,eA8GtB"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkStore.d.ts

@@ -0,0 +1,8 @@
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+export declare const checkStore: (report: DoctorReport) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkStore.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkStore = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const projects_1 = require("../../../../../utils/projects");
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+const checkStore = async (report) => {
+    var _a, _b, _c;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    const projectIds = new Set();
+    for (const { componentName, env, } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+        const { deploy } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+        if (deploy && deploy.type === "google-cloudrun") {
+            projectIds.add(deploy.projectId);
+        }
+    }
+    if (projectIds.size === 0)
+        return;
+    report.section("catladder store (.catladder-store/store.yml)");
+    const root = (_a = (await (0, projects_1.getGitRoot)())) !== null && _a !== void 0 ? _a : process.cwd();
+    const store = (0, pipeline_1.readCatladderStore)(root);
+    for (const projectId of projectIds) {
+        const projectNumber = (_c = (_b = store.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+        if (projectNumber) {
+            report.ok(`project number for ${projectId}: ${projectNumber}`);
+        }
+        else {
+            report.fail(`missing project number for ${projectId}`, "run: catladder project setup");
+        }
+    }
+};
+exports.checkStore = checkStore;
+//# sourceMappingURL=checkStore.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkStore.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkStore.ts"],"names":[],"mappings":";;;AAAA,kDAAuE;AACvE,6EAGgD;AAChD,4DAA2D;AAG3D;;;;;GAKG;AACI,MAAM,UAAU,GAAG,KAAK,EAAE,MAAoB,EAAE,EAAE;;IACvD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,EACT,aAAa,EACb,GAAG,GACJ,IAAI,MAAM,IAAA,kDAA+B,GAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAElC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,IAAA,qBAAU,GAAE,CAAC,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,MAAA,MAAA,KAAK,CAAC,cAAc,0CAAG,SAAS,CAAC,0CAAE,aAAa,CAAC;QACvE,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,EAAE,CAAC,sBAAsB,SAAS,KAAK,aAAa,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,8BAA8B,SAAS,EAAE,EACzC,8BAA8B,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AA5BW,QAAA,UAAU,cA4BrB"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.d.ts

@@ -0,0 +1,14 @@
+import type { IO } from "../../../../../core/types";
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+export declare const doctorProject: (instance: IO, onlyComponents?: string | string[]) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.doctorProject = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const checkCloudRun_1 = require("./checkCloudRun");
+const checkGithub_1 = require("./checkGithub");
+const checkGitlab_1 = require("./checkGitlab");
+const checkStore_1 = require("./checkStore");
+const DoctorReport_1 = require("./DoctorReport");
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+const doctorProject = async (instance, onlyComponents) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    instance.log("🐱 🩺 checking project health — read-only, nothing will be changed");
+    const report = new DoctorReport_1.DoctorReport(instance);
+    await (0, checkStore_1.checkStore)(report);
+    let contexts = [];
+    try {
+        contexts = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
+    }
+    catch (e) {
+        report.section("pipeline contexts");
+        report.fail(`could not create pipeline contexts: ${e.message}`, "run: catladder project setup");
+    }
+    if ((0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
+    }
+    await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+    await (0, checkGithub_1.checkGithub)(report, config);
+    report.summarize();
+};
+exports.doctorProject = doctorProject;
+//# sourceMappingURL=index.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAjCW,QAAA,aAAa,iBAiCxB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/ensureGcloudProjectNumbers.d.ts

@@ -0,0 +1,12 @@
+import type { IO } from "../../../../../core/types";
+/**
+ * fetches the gcloud project numbers of all cloud run deploys into the
+ * catladder store.
+ *
+ * This must run BEFORE any pipeline context is created: context creation
+ * computes the deterministic cloud run urls, which read the project
+ * number from the store and throw when it is missing — on a fresh
+ * project that would make `project setup` fail with the very error it is
+ * supposed to fix (chicken-and-egg).
+ */
+export declare const ensureGcloudProjectNumbers: (instance: IO) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/ensureGcloudProjectNumbers.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ensureGcloudProjectNumbers = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const getProjectNumber_1 = require("../../../../../gcloud/getProjectNumber");
+const updateCatladderStore_1 = require("../../../../../store/updateCatladderStore");
+const projects_1 = require("../../../../../utils/projects");
+/**
+ * fetches the gcloud project numbers of all cloud run deploys into the
+ * catladder store.
+ *
+ * This must run BEFORE any pipeline context is created: context creation
+ * computes the deterministic cloud run urls, which read the project
+ * number from the store and throw when it is missing — on a fresh
+ * project that would make `project setup` fail with the very error it is
+ * supposed to fix (chicken-and-egg).
+ */
+const ensureGcloudProjectNumbers = async (instance) => {
+    var _a;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config)
+        return;
+    const projectIds = new Set();
+    for (const { componentName, env, } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+        const { deploy } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+        if (deploy && deploy.type === "google-cloudrun") {
+            projectIds.add(deploy.projectId);
+        }
+    }
+    const root = (_a = (await (0, projects_1.getGitRoot)())) !== null && _a !== void 0 ? _a : process.cwd();
+    const store = (0, pipeline_1.readCatladderStore)(root);
+    const missing = [...projectIds].filter((projectId) => { var _a, _b; return !((_b = (_a = store.gcloudProjects) === null || _a === void 0 ? void 0 : _a[projectId]) === null || _b === void 0 ? void 0 : _b.projectNumber); });
+    for (const projectId of missing) {
+        instance.log(`fetch gcloud project number for ${projectId}...`);
+        const projectNumber = await (0, getProjectNumber_1.fetchGcloudProjectNumber)(projectId);
+        instance.log(`project number: ${projectNumber}`);
+        await (0, updateCatladderStore_1.updateCatladderStore)((current) => ({
+            ...current,
+            gcloudProjects: {
+                ...current.gcloudProjects,
+                [projectId]: { projectNumber },
+            },
+        }));
+    }
+    if (missing.length > 0) {
+        // the store is attached to the config at read time; drop the cached
+        // config so contexts created after this pre-pass see the new values
+        (0, getProjectConfig_1.invalidateProjectConfig)();
+    }
+};
+exports.ensureGcloudProjectNumbers = ensureGcloudProjectNumbers;
+//# sourceMappingURL=ensureGcloudProjectNumbers.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/ensureGcloudProjectNumbers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureGcloudProjectNumbers.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/ensureGcloudProjectNumbers.ts"],"names":[],"mappings":";;;AAAA,kDAAuE;AACvE,6EAIgD;AAEhD,6EAAkF;AAClF,oFAAiF;AACjF,4DAA2D;AAE3D;;;;;;;;;GASG;AACI,MAAM,0BAA0B,GAAG,KAAK,EAAE,QAAY,EAAE,EAAE;;IAC/D,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,EACT,aAAa,EACb,GAAG,GACJ,IAAI,MAAM,IAAA,kDAA+B,GAAE,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,uBAAY,EAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YAChD,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,IAAA,qBAAU,GAAE,CAAC,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,MAAM,CACpC,CAAC,SAAS,EAAE,EAAE,eAAC,OAAA,CAAC,CAAA,MAAA,MAAA,KAAK,CAAC,cAAc,0CAAG,SAAS,CAAC,0CAAE,aAAa,CAAA,CAAA,EAAA,CACjE,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,QAAQ,CAAC,GAAG,CAAC,mCAAmC,SAAS,KAAK,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,MAAM,IAAA,2CAAwB,EAAC,SAAS,CAAC,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,aAAa,EAAE,CAAC,CAAC;QACjD,MAAM,IAAA,2CAAoB,EAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvC,GAAG,OAAO;YACV,cAAc,EAAE;gBACd,GAAG,OAAO,CAAC,cAAc;gBACzB,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE;aAC/B;SACF,CAAC,CAAC,CAAC;IACN,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,oEAAoE;QACpE,oEAAoE;QACpE,IAAA,0CAAuB,GAAE,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAvCW,QAAA,0BAA0B,8BAuCrC"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/index.d.ts

@@ -0,0 +1,2 @@
+import type { IO } from "../../../../../core/types";
+export declare const setupProject: (instance: IO, onlyComponents?: string | string[]) => Promise<void>;