@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/packages/pipeline/src/agentSkills/shippedSkills.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getShippedSkills = exports.getShippedSkillsDir = exports.AGENT_SKILL_PREFIX = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+/**
+ * all catladder skills use this prefix; it marks the namespace
+ * catladder owns inside the agent skill directories (regeneration may
+ * remove stale `catladder-*` skills it generated earlier)
+ */
+exports.AGENT_SKILL_PREFIX = "catladder-";
+/**
+ * the directory containing the agent skill definitions shipped with
+ * the package (copied into dist at build time; the repository layout
+ * is the fallback for development and tests)
+ */
+const getShippedSkillsDir = () => {
+    const candidates = [
+        // built pipeline package: dist/agentSkills -> dist/skills
+        // bundled cli package (what consumers install): the ncc bundles live
+        // in dist/bundles/<name>, so both resolve to dist/bundles/skills
+        (0, path_1.join)(__dirname, "..", "skills"),
+        // cli tsc dist (catenv-dev): dist/packages/pipeline/src/agentSkills -> dist/skills
+        // repository: packages/pipeline/src/agentSkills -> <root>/skills
+        (0, path_1.join)(__dirname, "..", "..", "..", "..", "skills"),
+    ];
+    const found = candidates.find((candidate) => (0, fs_1.existsSync)(candidate));
+    if (!found) {
+        throw new Error("shipped agent skill definitions not found");
+    }
+    return found;
+};
+exports.getShippedSkillsDir = getShippedSkillsDir;
+const readFilesRecursively = (dir, relativeTo) => (0, fs_1.readdirSync)(dir)
+    .sort()
+    .flatMap((entry) => {
+    const fullPath = (0, path_1.join)(dir, entry);
+    if ((0, fs_1.statSync)(fullPath).isDirectory()) {
+        return readFilesRecursively(fullPath, relativeTo);
+    }
+    return [
+        {
+            relativePath: fullPath.slice(relativeTo.length + 1),
+            content: (0, fs_1.readFileSync)(fullPath, "utf-8"),
+        },
+    ];
+});
+const getShippedSkills = () => {
+    const skillsDir = (0, exports.getShippedSkillsDir)();
+    return (0, fs_1.readdirSync)(skillsDir)
+        .sort()
+        .filter((entry) => (0, fs_1.statSync)((0, path_1.join)(skillsDir, entry)).isDirectory())
+        .map((name) => {
+        const skillDir = (0, path_1.join)(skillsDir, name);
+        return { name, files: readFilesRecursively(skillDir, skillDir) };
+    });
+};
+exports.getShippedSkills = getShippedSkills;
+//# sourceMappingURL=shippedSkills.js.map

package/dist/packages/pipeline/src/agentSkills/shippedSkills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shippedSkills.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/agentSkills/shippedSkills.ts"],"names":[],"mappings":";;;AAAA,2BAAqE;AACrE,+BAA4B;AAE5B;;;;GAIG;AACU,QAAA,kBAAkB,GAAG,YAAY,CAAC;AAS/C;;;;GAIG;AACI,MAAM,mBAAmB,GAAG,GAAW,EAAE;IAC9C,MAAM,UAAU,GAAG;QACjB,0DAA0D;QAC1D,qEAAqE;QACrE,iEAAiE;QACjE,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC/B,mFAAmF;QACnF,iEAAiE;QACjE,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;KAClD,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,eAAU,EAAC,SAAS,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAfW,QAAA,mBAAmB,uBAe9B;AAEF,MAAM,oBAAoB,GAAG,CAC3B,GAAW,EACX,UAAkB,EACgC,EAAE,CACpD,IAAA,gBAAW,EAAC,GAAG,CAAC;KACb,IAAI,EAAE;KACN,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;IACjB,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,IAAI,IAAA,aAAQ,EAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACrC,OAAO,oBAAoB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACpD,CAAC;IACD,OAAO;QACL;YACE,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;YACnD,OAAO,EAAE,IAAA,iBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC;SACzC;KACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEA,MAAM,gBAAgB,GAAG,GAAmB,EAAE;IACnD,MAAM,SAAS,GAAG,IAAA,2BAAmB,GAAE,CAAC;IACxC,OAAO,IAAA,gBAAW,EAAC,SAAS,CAAC;SAC1B,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,aAAQ,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;SACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,QAAQ,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;AACP,CAAC,CAAC;AATW,QAAA,gBAAgB,oBAS3B"}

package/dist/packages/pipeline/src/agentSkills/types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * where agent skills get materialized, per agent ecosystem:
+ * - claude-code: the Claude Code project skills directory (the default)
+ * - agents: the cross-agent universal skills directory
+ *   (https://agents.md convention). Opt-in — as of now no widely-used
+ *   agent reads `.agents/skills/`; a repo that wants cross-agent
+ *   discovery can also just symlink `.agents/skills` → `.claude/skills`
+ *   once itself instead of enabling this target.
+ */
+export declare const AGENT_SKILL_TARGET_DIRS: {
+    readonly "claude-code": ".claude/skills";
+    readonly agents: ".agents/skills";
+};
+export type AgentSkillTargetName = keyof typeof AGENT_SKILL_TARGET_DIRS;
+/**
+ * the target(s) written when `agentSkills` does not name any explicitly.
+ * Claude Code is the only agent that consumes these skills today, so we
+ * default to it alone rather than duplicating every skill into
+ * `.agents/skills/` (extra committed files + diff noise on every run).
+ */
+export declare const DEFAULT_AGENT_SKILL_TARGETS: AgentSkillTargetName[];
+/**
+ * agent skills materialization, see {@link Config.agentSkills}
+ */
+export type AgentSkillsConfig = boolean | {
+    /**
+     * which agent skill directories to write to.
+     * Defaults to {@link DEFAULT_AGENT_SKILL_TARGETS} (`claude-code`).
+     */
+    targets?: AgentSkillTargetName[];
+};
+export declare const getAgentSkillTargets: (agentSkills: AgentSkillsConfig | undefined) => AgentSkillTargetName[];

package/dist/packages/pipeline/src/agentSkills/types.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAgentSkillTargets = exports.DEFAULT_AGENT_SKILL_TARGETS = exports.AGENT_SKILL_TARGET_DIRS = void 0;
+/**
+ * where agent skills get materialized, per agent ecosystem:
+ * - claude-code: the Claude Code project skills directory (the default)
+ * - agents: the cross-agent universal skills directory
+ *   (https://agents.md convention). Opt-in — as of now no widely-used
+ *   agent reads `.agents/skills/`; a repo that wants cross-agent
+ *   discovery can also just symlink `.agents/skills` → `.claude/skills`
+ *   once itself instead of enabling this target.
+ */
+exports.AGENT_SKILL_TARGET_DIRS = {
+    "claude-code": ".claude/skills",
+    agents: ".agents/skills",
+};
+/**
+ * the target(s) written when `agentSkills` does not name any explicitly.
+ * Claude Code is the only agent that consumes these skills today, so we
+ * default to it alone rather than duplicating every skill into
+ * `.agents/skills/` (extra committed files + diff noise on every run).
+ */
+exports.DEFAULT_AGENT_SKILL_TARGETS = [
+    "claude-code",
+];
+const getAgentSkillTargets = (agentSkills) => {
+    var _a;
+    if (agentSkills === false)
+        return [];
+    if (agentSkills === true || agentSkills === undefined) {
+        return [...exports.DEFAULT_AGENT_SKILL_TARGETS];
+    }
+    return (_a = agentSkills.targets) !== null && _a !== void 0 ? _a : [...exports.DEFAULT_AGENT_SKILL_TARGETS];
+};
+exports.getAgentSkillTargets = getAgentSkillTargets;
+//# sourceMappingURL=types.js.map

package/dist/packages/pipeline/src/agentSkills/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/agentSkills/types.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;GAQG;AACU,QAAA,uBAAuB,GAAG;IACrC,aAAa,EAAE,gBAAgB;IAC/B,MAAM,EAAE,gBAAgB;CAChB,CAAC;AAIX;;;;;GAKG;AACU,QAAA,2BAA2B,GAA2B;IACjE,aAAa;CACd,CAAC;AAeK,MAAM,oBAAoB,GAAG,CAClC,WAA0C,EAClB,EAAE;;IAC1B,IAAI,WAAW,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,mCAA2B,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAA,WAAW,CAAC,OAAO,mCAAI,CAAC,GAAG,mCAA2B,CAAC,CAAC;AACjE,CAAC,CAAC;AARW,QAAA,oBAAoB,wBAQ/B"}

package/dist/packages/pipeline/src/backends/github/GithubBackend.d.ts

@@ -0,0 +1,15 @@
+import type { Config } from "../../types";
+import type { GithubWorkflow } from "../../types/github-types";
+import type { PipelineBackend, PipelineFile } from "../types";
+import { JobImagesPlan } from "../../customImages/jobImagesPlan";
+import { GithubScriptFiles } from "./scriptFiles";
+export declare class GithubBackend implements PipelineBackend {
+    readonly type: "github";
+    cleanup(): Promise<void>;
+    createFiles(config: Config): Promise<PipelineFile[]>;
+    private createImagesPlan;
+    /**
+     * all workflows keyed by file name, mainly for testing purposes
+     */
+    createWorkflows(config: Config, images?: JobImagesPlan, scripts?: GithubScriptFiles): Promise<Record<string, GithubWorkflow>>;
+}

package/dist/packages/pipeline/src/backends/github/GithubBackend.js

@@ -0,0 +1,368 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GithubBackend = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const createAllJobs_1 = require("../../pipeline/createAllJobs");
+const config_1 = require("../../types/config");
+const ciVariables_1 = require("./ciVariables");
+const index_1 = require("../index");
+const createGithubJobs_1 = require("./createGithubJobs");
+const jobImagesPlan_1 = require("../../customImages/jobImagesPlan");
+const ensureImageJobs_1 = require("./ensureImageJobs");
+const aggregateCheckJob_1 = require("./aggregateCheckJob");
+const shippedCatci_1 = require("../../catci/shippedCatci");
+const githubReleaseJobs_1 = require("./githubReleaseJobs");
+const scriptFiles_1 = require("./scriptFiles");
+const WORKFLOWS_FOLDER = ".github/workflows";
+/**
+ * generated workflow files are prefixed so that cleanup never touches
+ * user-maintained workflows in the same folder
+ */
+const GENERATED_FILE_PREFIX = "catladder-";
+// NOTE on the emoji prefixes: github sorts the Actions sidebar by raw
+// code point, so the prefix decides the order. 🛠️ (U+1F6E0) is the
+// highest, which keeps the pipeline workflows below the triggerable
+// action workflows (↩️ ▶️ 🚀 🛑) — the things a human clicks come
+// first, and 🛑 (U+1F6D1) puts the stop actions after ▶️ deploy.
+const TRIGGER_WORKFLOWS = {
+    mr: {
+        name: "🛠️ catladder review",
+        on: { pull_request: { types: ["opened", "synchronize", "reopened"] } },
+        concurrency: {
+            group: "catladder-review-${{ github.event.number }}",
+            "cancel-in-progress": true,
+        },
+    },
+    mainBranch: {
+        name: "🛠️ catladder main",
+        // TODO: make the default branch configurable
+        on: { push: { branches: ["main"] } },
+    },
+    taggedRelease: {
+        name: "🛠️ catladder release",
+        // tags pushed with the default GITHUB_TOKEN (as the release job
+        // does) don't trigger `on: push: tags` — the release job therefore
+        // also dispatches this workflow explicitly for the new tag
+        on: { push: { tags: ["v*"] }, workflow_dispatch: {} },
+    },
+};
+class GithubBackend {
+    constructor() {
+        this.type = "github";
+    }
+    async cleanup() {
+        const entries = await (0, promises_1.readdir)(WORKFLOWS_FOLDER).catch(() => []);
+        await Promise.all(entries
+            .filter((file) => file.startsWith(GENERATED_FILE_PREFIX))
+            .map((file) => (0, promises_1.unlink)((0, path_1.join)(WORKFLOWS_FOLDER, file))));
+        await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, { recursive: true, force: true });
+    }
+    async createFiles(config) {
+        const images = this.createImagesPlan(config);
+        const scripts = new scriptFiles_1.GithubScriptFiles();
+        const workflows = await this.createWorkflows(config, images, scripts);
+        return [
+            ...Object.entries(workflows).map(([fileName, workflow]) => ({
+                path: (0, path_1.join)(WORKFLOWS_FOLDER, fileName),
+                content: workflow,
+            })),
+            // materialized job scripts and image definitions (repo mode)
+            ...scripts.getGeneratedFiles(),
+            ...images.getGeneratedFiles(),
+            // catci: the CI companion the release job's security audit runs
+            ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
+        ];
+    }
+    createImagesPlan(config) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
+    }
+    /**
+     * all workflows keyed by file name, mainly for testing purposes
+     */
+    async createWorkflows(config, images = this.createImagesPlan(config), scripts = new scriptFiles_1.GithubScriptFiles()) {
+        var _a, _b, _c, _d;
+        const workflows = {};
+        // per-pipeline-type variables (pipelines.github.runnerVariables);
+        // workflow-level env, so job-level runnerVariables take precedence
+        const workflowEnv = {
+            ...ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
+            ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
+        };
+        const reviewStopJobs = {};
+        // jobs routed to the per-kind workflow_dispatch workflows (deploy /
+        // stop / rollback). A manual job and its build closure live there
+        // instead of an automatic workflow; `conditions` is the `if` that
+        // selects each one from the dispatch input, `options` the leaf jobs
+        // that become dropdown choices (closure jobs run because their leaf
+        // was chosen, not on their own). A closure job serving leaves of
+        // several kinds is duplicated into each kind's workflow.
+        const manualKindBuckets = {
+            deploy: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+            stop: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+            rollback: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+        };
+        for (const trigger of config_1.ALL_PIPELINE_TRIGGERS) {
+            const allJobs = await (0, createAllJobs_1.createAllJobs)({
+                config,
+                trigger,
+                pipelineType: this.type,
+            });
+            const uploadProviderIds = (0, createGithubJobs_1.getUploadProviderIds)(allJobs);
+            const secretKinds = (0, createGithubJobs_1.collectSecretKinds)(allJobs);
+            // build every job of the trigger up front: partitioning the manual
+            // jobs needs the whole dependency graph.
+            // NOTE: agent jobs are gitlab-only and skipped on github
+            const triggerJobs = new Map();
+            [...allJobs.workspaces, ...allJobs.components].forEach(({ context, jobs: contextJobs }) => contextJobs.forEach((job) => {
+                const [id, githubJob] = (0, createGithubJobs_1.makeGithubJob)(context, job, allJobs, uploadProviderIds, images, scripts, secretKinds);
+                triggerJobs.set(id, { githubJob, job, context });
+            }));
+            // review-stop jobs run in their own on:pull_request:closed workflow
+            for (const [id, { githubJob, job, context }] of [...triggerJobs]) {
+                if (isReviewStopJob(context, job)) {
+                    reviewStopJobs[id] = githubJob;
+                    triggerJobs.delete(id);
+                }
+            }
+            // leaf manual jobs: an explicit manual gate (e.g. a prod deploy) or
+            // a stop/rollback task with no automatic trigger. Each becomes a
+            // dispatch choice.
+            const leafIds = [...triggerJobs]
+                .filter(([, { job }]) => job.gate === "manual" || isManualTaskJob(job))
+                .map(([id]) => id);
+            // A manual leaf drags its whole connected region into the manual
+            // workflow, in both directions, so that a dispatch runs the complete
+            // flow and nothing is left dangling in the automatic workflow:
+            //  - upstream (jobs the leaf needs): github artifacts are scoped to
+            //    a single run, so a dispatched job can't reuse the automatic
+            //    run's build — it has to rebuild, so the build moves too.
+            //  - downstream (jobs that need the leaf, e.g. a post-deploy verify):
+            //    they can't run automatically once their prerequisite is manual.
+            // Needs pointing outside the trigger (the global image-build jobs)
+            // exist in every workflow and are left alone. Because catladder's
+            // deploy/verify jobs are per env, a leaf's region stays within its
+            // env and never swallows another env's automatic chain.
+            // servesLeaves maps every moved job to the leaves that own it.
+            const dependents = new Map();
+            for (const [id, { githubJob }] of triggerJobs) {
+                for (const need of (_a = githubJob.needs) !== null && _a !== void 0 ? _a : []) {
+                    if (!triggerJobs.has(need))
+                        continue;
+                    const list = dependents.get(need);
+                    if (list)
+                        list.push(id);
+                    else
+                        dependents.set(need, [id]);
+                }
+            }
+            const servesLeaves = new Map();
+            for (const leaf of leafIds) {
+                const stack = [leaf];
+                let cur;
+                while ((cur = stack.pop()) !== undefined) {
+                    let leaves = servesLeaves.get(cur);
+                    if (leaves === null || leaves === void 0 ? void 0 : leaves.has(leaf))
+                        continue; // already walked for this leaf
+                    if (!leaves) {
+                        leaves = new Set();
+                        servesLeaves.set(cur, leaves);
+                    }
+                    leaves.add(leaf);
+                    for (const need of (_c = (_b = triggerJobs.get(cur)) === null || _b === void 0 ? void 0 : _b.githubJob.needs) !== null && _c !== void 0 ? _c : []) {
+                        if (triggerJobs.has(need))
+                            stack.push(need); // upstream deps
+                    }
+                    for (const dependent of (_d = dependents.get(cur)) !== null && _d !== void 0 ? _d : []) {
+                        stack.push(dependent); // downstream consumers
+                    }
+                }
+            }
+            const kindOfLeaf = new Map(leafIds.map((id) => [id, manualKind(triggerJobs.get(id).job)]));
+            const jobs = {};
+            for (const [id, { githubJob }] of triggerJobs) {
+                const leaves = servesLeaves.get(id);
+                if (leaves) {
+                    // one entry per kind the job serves — restricted to that
+                    // kind's leaves, so the `if` only references its own inputs
+                    for (const kind of new Set([...leaves].map((leaf) => kindOfLeaf.get(leaf)))) {
+                        const bucket = manualKindBuckets[kind];
+                        bucket.jobs[id] = githubJob;
+                        bucket.conditions[id] = [...leaves]
+                            .filter((leaf) => kindOfLeaf.get(leaf) === kind)
+                            .sort()
+                            .map((leaf) => `inputs.job == '${leaf}'`)
+                            .join(" || ");
+                    }
+                }
+                else {
+                    jobs[id] = githubJob;
+                }
+            }
+            for (const id of leafIds) {
+                const bucket = manualKindBuckets[kindOfLeaf.get(id)];
+                bucket.options.push(id);
+                const context = triggerJobs.get(id).context;
+                if (context.type === "component") {
+                    bucket.envTypes.push(context.environment.envType);
+                }
+            }
+            if (trigger === "mr") {
+                Object.assign(jobs, (0, githubReleaseJobs_1.getGithubReleaseCheckJobs)(config, images));
+            }
+            if (trigger === "mainBranch") {
+                // auto release mode: the release job runs at the end of the
+                // main workflow itself
+                Object.assign(jobs, (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs), images));
+                // the dispatch workflow to trigger a release by hand (with a
+                // force checkbox where the method distinguishes it)
+                workflows[`${GENERATED_FILE_PREFIX}create-release.yml`] =
+                    (0, githubReleaseJobs_1.getGithubCreateReleaseWorkflow)(config, images, workflowEnv);
+                // manual release mode: the workflow that runs a queued release
+                // once the main workflow completed green
+                const releaseOnGreen = (0, githubReleaseJobs_1.getGithubReleaseOnGreenWorkflow)(config, images, TRIGGER_WORKFLOWS.mainBranch.name, workflowEnv);
+                if (releaseOnGreen) {
+                    workflows[`${GENERATED_FILE_PREFIX}release-on-green.yml`] =
+                        releaseOnGreen;
+                }
+            }
+            if (Object.keys(jobs).length > 0) {
+                const workflowJobs = { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...jobs };
+                workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
+                    ...TRIGGER_WORKFLOWS[trigger],
+                    ...workflowPermissions(images),
+                    env: workflowEnv,
+                    // the review workflow additionally gets the aggregate job —
+                    // the one stable required-status context for branch
+                    // protection. Requiring real job names instead goes stale on
+                    // every component change: a renamed required job blocks its
+                    // own PR forever, a new component's jobs are silently not
+                    // required. Added at finalization so its needs cover the
+                    // image-build jobs too.
+                    jobs: trigger === "mr"
+                        ? { ...workflowJobs, ...(0, aggregateCheckJob_1.makeAggregateCheckJob)(workflowJobs) }
+                        : workflowJobs,
+                };
+            }
+        }
+        if (Object.keys(reviewStopJobs).length > 0) {
+            workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = {
+                name: "🛑 catladder stop review app",
+                on: {
+                    pull_request: { types: ["closed"] },
+                    // tearing a review app down while its pull request is still
+                    // open (gitlab offers this as a manual job in the MR
+                    // pipeline); the automatic teardown on close stays the
+                    // normal path
+                    workflow_dispatch: {
+                        inputs: {
+                            pr: {
+                                description: "number of the pull request whose review app to stop",
+                                required: true,
+                                type: "string",
+                            },
+                        },
+                    },
+                },
+                ...workflowPermissions(images),
+                env: {
+                    ...workflowEnv,
+                    // a dispatched run has no pull_request event to take the
+                    // number from — fall back to the input
+                    CL_PR_NUMBER: "${{ github.event.number || inputs.pr }}",
+                },
+                jobs: { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...reviewStopJobs },
+            };
+        }
+        for (const [kind, bucket] of Object.entries(manualKindBuckets)) {
+            if (Object.keys(bucket.jobs).length === 0) {
+                continue;
+            }
+            const options = [...new Set(bucket.options)];
+            // a single candidate needs no dropdown — the dispatch just runs it
+            const singleTask = options.length === 1;
+            // one common env across the kind's tasks → carry it in the name
+            // ("▶️ catladder deploy prod"); mixed envs keep the generic name
+            // and the dropdown distinguishes
+            const envTypes = [...new Set(bucket.envTypes)];
+            const envSuffix = envTypes.length === 1 &&
+                bucket.envTypes.length === bucket.options.length
+                ? ` ${envTypes[0]}`
+                : "";
+            workflows[`${GENERATED_FILE_PREFIX}${kind}.yml`] = {
+                name: `${MANUAL_KIND_WORKFLOW_NAMES[kind]}${envSuffix}`,
+                on: {
+                    workflow_dispatch: singleTask
+                        ? {}
+                        : {
+                            inputs: {
+                                job: {
+                                    description: "the task to run",
+                                    required: true,
+                                    type: "choice",
+                                    options,
+                                },
+                            },
+                        },
+                },
+                ...workflowPermissions(images),
+                env: workflowEnv,
+                jobs: {
+                    ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images),
+                    ...Object.fromEntries(Object.entries(bucket.jobs).map(([id, job]) => [
+                        id,
+                        singleTask
+                            ? job
+                            : { ...job, if: `\${{ ${bucket.conditions[id]} }}` },
+                    ])),
+                },
+            };
+        }
+        return workflows;
+    }
+}
+exports.GithubBackend = GithubBackend;
+/**
+ * job images are built and pushed to ghcr, which needs packages:write
+ */
+const workflowPermissions = (_images) => ({
+    permissions: { contents: "read", packages: "write" },
+});
+const workflowFileName = (trigger) => {
+    switch (trigger) {
+        case "mr":
+            return "review.yml";
+        case "mainBranch":
+            return "main.yml";
+        case "taggedRelease":
+            return "release.yml";
+    }
+    throw new Error(`${trigger} is not supported`);
+};
+/**
+ * stop jobs of review environments run in their own workflow when the
+ * pull request is closed (the counterpart of gitlab's on_stop wiring)
+ */
+const isReviewStopJob = (context, job) => {
+    var _a;
+    return ((_a = job.environment) === null || _a === void 0 ? void 0 : _a.action) === "stop" &&
+        context.type === "component" &&
+        context.environment.envType === "review";
+};
+/**
+ * stop/rollback jobs of non-review environments have no automatic
+ * trigger; they are collected in workflow_dispatch workflows
+ * (gitlab runs them as manual jobs inside the pipeline)
+ */
+const isManualTaskJob = (job) => job.stage === "stop" || job.stage === "rollback";
+const MANUAL_KIND_WORKFLOW_NAMES = {
+    deploy: "▶️ catladder deploy",
+    stop: "🛑 catladder stop",
+    rollback: "↩️ catladder rollback",
+};
+const manualKind = (job) => job.stage === "stop"
+    ? "stop"
+    : job.stage === "rollback"
+        ? "rollback"
+        : "deploy";
+//# sourceMappingURL=GithubBackend.js.map

package/dist/packages/pipeline/src/backends/github/GithubBackend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GithubBackend.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/GithubBackend.ts"],"names":[],"mappings":";;;AAAA,0CAAkD;AAClD,+BAA4B;AAC5B,gEAA6D;AAE7D,+CAA2D;AAI3D,+CAA6D;AAC7D,oCAA8C;AAC9C,yDAI4B;AAC5B,oEAAiE;AACjE,uDAA8D;AAC9D,2DAA4D;AAC5D,2DAAkE;AAClE,2DAK6B;AAC7B,+CAAyE;AAEzE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,MAAM,iBAAiB,GAGnB;IACF,EAAE,EAAE;QACF,IAAI,EAAE,sBAAsB;QAC5B,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;QACtE,WAAW,EAAE;YACX,KAAK,EAAE,6CAA6C;YACpD,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,oBAAoB;QAC1B,6CAA6C;QAC7C,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;KACrC;IACD,aAAa,EAAE;QACb,IAAI,EAAE,uBAAuB;QAC7B,gEAAgE;QAChE,mEAAmE;QACnE,2DAA2D;QAC3D,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE;KACtD;CACF,CAAC;AAEF,MAAa,aAAa;IAA1B;QACW,SAAI,GAAG,QAAiB,CAAC;IAoUpC,CAAC;IAlUC,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO;aACJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,IAAA,WAAI,EAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,IAAA,aAAE,EAAC,mCAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEtE,OAAO;YACL,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1D,IAAI,EAAE,IAAA,WAAI,EAAC,gBAAgB,EAAE,QAAQ,CAAC;gBACtC,OAAO,EAAE,QAA8C;aACxD,CAAC,CAAC;YACH,6DAA6D;YAC7D,GAAG,OAAO,CAAC,iBAAiB,EAAE;YAC9B,GAAG,MAAM,CAAC,iBAAiB,EAAE;YAC7B,gEAAgE;YAChE,GAAG,IAAA,qCAAsB,GAAE;SAC5B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,OAAO,IAAI,6BAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,SAAwB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EACrD,UAA6B,IAAI,+BAAiB,EAAE;;QAEpD,MAAM,SAAS,GAAmC,EAAE,CAAC;QAErD,kEAAkE;QAClE,mEAAmE;QACnE,MAAM,WAAW,GAAG;YAClB,GAAG,0CAA4B;YAC/B,GAAG,IAAA,0BAAkB,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,eAAe;SACzD,CAAC;QAEF,MAAM,cAAc,GAA8B,EAAE,CAAC;QACrD,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,iBAAiB,GAAyC;YAC9D,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC/D,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YAC7D,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;SAClE,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,8BAAqB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAa,EAAC;gBAClC,MAAM;gBACN,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,IAAI;aACxB,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAA,uCAAoB,EAAC,OAAO,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,OAAO,CAAC,CAAC;YAEhD,mEAAmE;YACnE,yCAAyC;YACzC,yDAAyD;YACzD,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;YACJ,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CACpD,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACjC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,IAAA,gCAAa,EACnC,OAAO,EACP,GAAG,EACH,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,WAAW,CACZ,CAAC;gBACF,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,CACL,CAAC;YAEF,oEAAoE;YACpE,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,EAAE,CAAC;gBACjE,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClC,cAAc,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;oBAC/B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;YAED,oEAAoE;YACpE,iEAAiE;YACjE,mBAAmB;YACnB,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,CAAC;iBAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;iBACtE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAErB,iEAAiE;YACjE,qEAAqE;YACrE,+DAA+D;YAC/D,oEAAoE;YACpE,iEAAiE;YACjE,8DAA8D;YAC9D,sEAAsE;YACtE,qEAAqE;YACrE,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnE,wDAAwD;YACxD,+DAA+D;YAC/D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;YAC/C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC9C,KAAK,MAAM,IAAI,IAAI,MAAA,SAAS,CAAC,KAAK,mCAAI,EAAE,EAAE,CAAC;oBACzC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAS;oBACrC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAClC,IAAI,IAAI;wBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;;wBACnB,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;YACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;YACpD,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,IAAI,GAAuB,CAAC;gBAC5B,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;oBACzC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnC,IAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,GAAG,CAAC,IAAI,CAAC;wBAAE,SAAS,CAAC,+BAA+B;oBAChE,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;wBACnB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBAChC,CAAC;oBACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACjB,KAAK,MAAM,IAAI,IAAI,MAAA,MAAA,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,0CAAE,SAAS,CAAC,KAAK,mCAAI,EAAE,EAAE,CAAC;wBAC/D,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;4BAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB;oBAC/D,CAAC;oBACD,KAAK,MAAM,SAAS,IAAI,MAAA,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,mCAAI,EAAE,EAAE,CAAC;wBAClD,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB;oBAChD,CAAC;gBACH,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAChE,CAAC;YACF,MAAM,IAAI,GAA8B,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACpC,IAAI,MAAM,EAAE,CAAC;oBACX,yDAAyD;oBACzD,4DAA4D;oBAC5D,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CACxB,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CACjD,EAAE,CAAC;wBACF,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;wBACvC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;wBAC5B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;6BAChC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;6BAC/C,IAAI,EAAE;6BACN,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kBAAkB,IAAI,GAAG,CAAC;6BACxC,IAAI,CAAC,MAAM,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;gBACtD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,OAAO,CAAC;gBAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;oBACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,6CAAyB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,4DAA4D;gBAC5D,uBAAuB;gBACvB,MAAM,CAAC,MAAM,CACX,IAAI,EACJ,IAAA,wCAAoB,EAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CACxD,CAAC;gBAEF,6DAA6D;gBAC7D,oDAAoD;gBACpD,SAAS,CAAC,GAAG,qBAAqB,oBAAoB,CAAC;oBACrD,IAAA,kDAA8B,EAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;gBAE9D,+DAA+D;gBAC/D,yCAAyC;gBACzC,MAAM,cAAc,GAAG,IAAA,mDAA+B,EACpD,MAAM,EACN,MAAM,EACN,iBAAiB,CAAC,UAAU,CAAC,IAAI,EACjC,WAAW,CACZ,CAAC;gBACF,IAAI,cAAc,EAAE,CAAC;oBACnB,SAAS,CAAC,GAAG,qBAAqB,sBAAsB,CAAC;wBACvD,cAAc,CAAC;gBACnB,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,YAAY,GAAG,EAAE,GAAG,IAAA,2CAAyB,EAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC;gBACvE,SAAS,CAAC,GAAG,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG;oBAClE,GAAG,iBAAiB,CAAC,OAAO,CAAC;oBAC7B,GAAG,mBAAmB,CAAC,MAAM,CAAC;oBAC9B,GAAG,EAAE,WAAW;oBAChB,4DAA4D;oBAC5D,oDAAoD;oBACpD,6DAA6D;oBAC7D,4DAA4D;oBAC5D,0DAA0D;oBAC1D,yDAAyD;oBACzD,wBAAwB;oBACxB,IAAI,EACF,OAAO,KAAK,IAAI;wBACd,CAAC,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,IAAA,yCAAqB,EAAC,YAAY,CAAC,EAAE;wBAC7D,CAAC,CAAC,YAAY;iBACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,GAAG,qBAAqB,iBAAiB,CAAC,GAAG;gBACrD,IAAI,EAAE,8BAA8B;gBACpC,EAAE,EAAE;oBACF,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;oBACnC,4DAA4D;oBAC5D,qDAAqD;oBACrD,uDAAuD;oBACvD,cAAc;oBACd,iBAAiB,EAAE;wBACjB,MAAM,EAAE;4BACN,EAAE,EAAE;gCACF,WAAW,EACT,qDAAqD;gCACvD,QAAQ,EAAE,IAAI;gCACd,IAAI,EAAE,QAAQ;6BACf;yBACF;qBACF;iBACF;gBACD,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE;oBACH,GAAG,WAAW;oBACd,yDAAyD;oBACzD,uCAAuC;oBACvC,YAAY,EAAE,yCAAyC;iBACxD;gBACD,IAAI,EAAE,EAAE,GAAG,IAAA,2CAAyB,EAAC,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAE5D,EAAE,CAAC;YACF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7C,mEAAmE;YACnE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;YACxC,gEAAgE;YAChE,iEAAiE;YACjE,iCAAiC;YACjC,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC/C,MAAM,SAAS,GACb,QAAQ,CAAC,MAAM,KAAK,CAAC;gBACrB,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM;gBAC9C,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE;gBACnB,CAAC,CAAC,EAAE,CAAC;YACT,SAAS,CAAC,GAAG,qBAAqB,GAAG,IAAI,MAAM,CAAC,GAAG;gBACjD,IAAI,EAAE,GAAG,0BAA0B,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE;gBACvD,EAAE,EAAE;oBACF,iBAAiB,EAAE,UAAU;wBAC3B,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC;4BACE,MAAM,EAAE;gCACN,GAAG,EAAE;oCACH,WAAW,EAAE,iBAAiB;oCAC9B,QAAQ,EAAE,IAAI;oCACd,IAAI,EAAE,QAAQ;oCACd,OAAO;iCACR;6BACF;yBACF;iBACN;gBACD,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,WAAW;gBAChB,IAAI,EAAE;oBACJ,GAAG,IAAA,2CAAyB,EAAC,MAAM,CAAC;oBACpC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;wBAC7C,EAAE;wBACF,UAAU;4BACR,CAAC,CAAC,GAAG;4BACL,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,QAAQ,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE;qBACvD,CAAC,CACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AArUD,sCAqUC;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC;IACvD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;CACrD,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,OAAwB,EAAU,EAAE;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,YAAY,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,UAAU,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mBAAmB,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAiB,EAAE,EAAE;;IAC9D,OAAA,CAAA,MAAA,GAAG,CAAC,WAAW,0CAAE,MAAM,MAAK,MAAM;QAClC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC5B,OAAO,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAA;CAAA,CAAC;AAE3C;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiB,EAAE,EAAE,CAC5C,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC;AAsBnD,MAAM,0BAA0B,GAA+B;IAC7D,MAAM,EAAE,qBAAqB;IAC7B,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,uBAAuB;CAClC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,GAAiB,EAAc,EAAE,CACnD,GAAG,CAAC,KAAK,KAAK,MAAM;IAClB,CAAC,CAAC,MAAM;IACR,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,UAAU;QACxB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,QAAQ,CAAC"}

package/dist/packages/pipeline/src/backends/github/aggregateCheckJob.d.ts

@@ -0,0 +1,26 @@
+import type { GithubJob } from "../../types/github-types";
+export declare const AGGREGATE_CHECK_JOB_ID = "catladder-ok";
+export declare const AGGREGATE_CHECK_JOB_NAME = "catladder \u2705";
+/**
+ * one job that succeeds exactly when every other job of the review
+ * workflow succeeded — the single, STABLE required-status context for
+ * branch protection.
+ *
+ * Requiring the real job names instead goes stale on every component
+ * change: a renamed required job never reports on the very PR that
+ * renames it ("Expected — waiting for status", unmergeable), and a new
+ * component's jobs are silently not required at all. This job's `needs`
+ * are regenerated with the workflow, so protection stays correct with
+ * a single one-time setup.
+ *
+ * Semantics:
+ * - `if: always()` — the job must run (and fail) when an ancestor
+ *   failed; without it a failed need would leave it skipped, and a
+ *   skipped required check blocks the merge with no explanation.
+ * - a skipped need counts as failure: review jobs are unconditional,
+ *   so skipped always means "an ancestor failed".
+ * - `continue-on-error` jobs (security audit, changeset check) report
+ *   `success` to `needs` even when red, so they stay non-blocking here
+ *   by the same mechanism that keeps their workflow green.
+ */
+export declare const makeAggregateCheckJob: (reviewJobs: Record<string, GithubJob>) => Record<string, GithubJob>;

package/dist/packages/pipeline/src/backends/github/aggregateCheckJob.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeAggregateCheckJob = exports.AGGREGATE_CHECK_JOB_NAME = exports.AGGREGATE_CHECK_JOB_ID = void 0;
+exports.AGGREGATE_CHECK_JOB_ID = "catladder-ok";
+exports.AGGREGATE_CHECK_JOB_NAME = "catladder ✅";
+/**
+ * one job that succeeds exactly when every other job of the review
+ * workflow succeeded — the single, STABLE required-status context for
+ * branch protection.
+ *
+ * Requiring the real job names instead goes stale on every component
+ * change: a renamed required job never reports on the very PR that
+ * renames it ("Expected — waiting for status", unmergeable), and a new
+ * component's jobs are silently not required at all. This job's `needs`
+ * are regenerated with the workflow, so protection stays correct with
+ * a single one-time setup.
+ *
+ * Semantics:
+ * - `if: always()` — the job must run (and fail) when an ancestor
+ *   failed; without it a failed need would leave it skipped, and a
+ *   skipped required check blocks the merge with no explanation.
+ * - a skipped need counts as failure: review jobs are unconditional,
+ *   so skipped always means "an ancestor failed".
+ * - `continue-on-error` jobs (security audit, changeset check) report
+ *   `success` to `needs` even when red, so they stay non-blocking here
+ *   by the same mechanism that keeps their workflow green.
+ */
+const makeAggregateCheckJob = (reviewJobs) => ({
+    [exports.AGGREGATE_CHECK_JOB_ID]: {
+        name: exports.AGGREGATE_CHECK_JOB_NAME,
+        "runs-on": "ubuntu-latest",
+        needs: Object.keys(reviewJobs).sort(),
+        if: "always()",
+        steps: [
+            {
+                name: exports.AGGREGATE_CHECK_JOB_NAME,
+                // the needs context only interpolates inside the workflow file,
+                // so this script stays inline
+                run: [
+                    `results='\${{ toJSON(needs) }}'`,
+                    `echo "$results"`,
+                    `if echo "$results" | grep -qE '"result": "(failure|cancelled|skipped)"'; then`,
+                    `  echo "a required job did not succeed"; exit 1`,
+                    `fi`,
+                ].join("\n"),
+                shell: "bash",
+            },
+        ],
+    },
+});
+exports.makeAggregateCheckJob = makeAggregateCheckJob;
+//# sourceMappingURL=aggregateCheckJob.js.map

package/dist/packages/pipeline/src/backends/github/aggregateCheckJob.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aggregateCheckJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/aggregateCheckJob.ts"],"names":[],"mappings":";;;AAEa,QAAA,sBAAsB,GAAG,cAAc,CAAC;AACxC,QAAA,wBAAwB,GAAG,aAAa,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,MAAM,qBAAqB,GAAG,CACnC,UAAqC,EACV,EAAE,CAAC,CAAC;IAC/B,CAAC,8BAAsB,CAAC,EAAE;QACxB,IAAI,EAAE,gCAAwB;QAC9B,SAAS,EAAE,eAAe;QAC1B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE;QACrC,EAAE,EAAE,UAAU;QACd,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,gCAAwB;gBAC9B,gEAAgE;gBAChE,8BAA8B;gBAC9B,GAAG,EAAE;oBACH,iCAAiC;oBACjC,iBAAiB;oBACjB,+EAA+E;oBAC/E,iDAAiD;oBACjD,IAAI;iBACL,CAAC,IAAI,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,MAAM;aACd;SACF;KACF;CACF,CAAC,CAAC;AAxBU,QAAA,qBAAqB,yBAwB/B"}

package/dist/packages/pipeline/src/backends/github/ciVariables.d.ts

@@ -0,0 +1,14 @@
+import type { CiVariableName } from "../../bash/ciVariables";
+/**
+ * how the github backend names the predefined CI variables.
+ *
+ * GITHUB_* variables are provided by github actions natively; the CL_*
+ * variables are injected by the {@link GithubBackend} itself (workflow or
+ * job level), because github has no direct counterpart.
+ */
+export declare const GITHUB_CI_VARIABLES: Record<CiVariableName, string>;
+/**
+ * the workflow-level env the backend injects to provide the CL_*
+ * variables referenced by {@link GITHUB_CI_VARIABLES}
+ */
+export declare const GITHUB_INJECTED_WORKFLOW_ENV: Record<string, string>;