@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/packages/pipeline/src/backends/github/ciVariables.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_INJECTED_WORKFLOW_ENV = exports.GITHUB_CI_VARIABLES = void 0;
+/**
+ * how the github backend names the predefined CI variables.
+ *
+ * GITHUB_* variables are provided by github actions natively; the CL_*
+ * variables are injected by the {@link GithubBackend} itself (workflow or
+ * job level), because github has no direct counterpart.
+ */
+exports.GITHUB_CI_VARIABLES = {
+    commitSha: "GITHUB_SHA",
+    jobToken: "CL_JOB_TOKEN",
+    jobImage: "CL_JOB_IMAGE",
+    registry: "CL_REGISTRY",
+    registryImage: "CL_REGISTRY_IMAGE",
+    registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
+};
+/**
+ * the workflow-level env the backend injects to provide the CL_*
+ * variables referenced by {@link GITHUB_CI_VARIABLES}
+ */
+exports.GITHUB_INJECTED_WORKFLOW_ENV = {
+    CL_JOB_TOKEN: "${{ github.token }}",
+    CL_REGISTRY: "ghcr.io",
+    CL_REGISTRY_IMAGE: "ghcr.io/${{ github.repository }}",
+    CL_REGISTRY_USER: "${{ github.actor }}",
+    // empty outside of pull request events
+    CL_PR_NUMBER: "${{ github.event.number }}",
+};
+//# sourceMappingURL=ciVariables.js.map

package/dist/packages/pipeline/src/backends/github/ciVariables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,oEAAoE;IACpE,wDAAwD;IACxD,gBAAgB,EAAE,cAAc;CACjC,CAAC;AAEF;;;GAGG;AACU,QAAA,4BAA4B,GAA2B;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,uCAAuC;IACvC,YAAY,EAAE,4BAA4B;CAC3C,CAAC"}

package/dist/packages/pipeline/src/backends/github/createGithubJobs.d.ts

@@ -0,0 +1,27 @@
+import type { AllCatladderJobs } from "../../pipeline/createAllJobs";
+import type { Context } from "../../types";
+import type { GithubJob } from "../../types/github-types";
+import type { CatladderJob, CatladderJobNeed } from "../../types/jobs";
+import type { JobImagesPlan } from "../../customImages/jobImagesPlan";
+import type { GithubScriptFiles } from "./scriptFiles";
+export declare const githubJobId: (context: Context, jobName: string) => string;
+/** id of a job without component/workspace context (e.g. image builds) */
+export declare const githubGlobalJobId: (jobName: string) => string;
+type ResolvedNeed = {
+    id: string;
+    artifacts: boolean;
+};
+export declare const resolveGithubNeeds: (context: Context, job: CatladderJob, allJobs: AllCatladderJobs, extraNeeds?: CatladderJobNeed[]) => ResolvedNeed[];
+export type SecretKinds = Map<string, "secret" | "variable">;
+/**
+ * the kind of every vault-stored var of all components, keyed by its
+ * CL_* name — the lookup for cross-component references
+ */
+export declare const collectSecretKinds: (allJobs: AllCatladderJobs) => SecretKinds;
+export declare const makeGithubJob: (context: Context, job: CatladderJob, allJobs: AllCatladderJobs, uploadProviderIds: Set<string>, images: JobImagesPlan, scripts: GithubScriptFiles, secretKinds?: SecretKinds) => [id: string, githubJob: GithubJob];
+/**
+ * the ids of all jobs whose artifacts are consumed by other jobs
+ * (they need an upload step)
+ */
+export declare const getUploadProviderIds: (allJobs: AllCatladderJobs) => Set<string>;
+export {};

package/dist/packages/pipeline/src/backends/github/createGithubJobs.js

@@ -0,0 +1,432 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getUploadProviderIds = exports.makeGithubJob = exports.collectSecretKinds = exports.resolveGithubNeeds = exports.githubGlobalJobId = exports.githubJobId = void 0;
+const lodash_es_1 = require("lodash-es");
+const getInjectVarsScript_1 = require("../../bash/getInjectVarsScript");
+const createJobCache_1 = require("../../build/cache/createJobCache");
+const getEnvironmentVariables_1 = require("../../context/getEnvironmentVariables");
+const utils_1 = require("../../utils");
+const gitlab_1 = require("../../utils/gitlab");
+const scriptFunctions_1 = require("./scriptFunctions");
+const ciVariables_1 = require("./ciVariables");
+/**
+ * runner variables that only make sense on gitlab runners and must not
+ * leak into github jobs (docker-in-docker daemon config, kubernetes
+ * executor resource requests, gitlab clone strategy)
+ */
+const GITLAB_ONLY_RUNNER_VARIABLES = new Set([
+    "DOCKER_HOST",
+    "DOCKER_TLS_CERTDIR",
+    "DOCKER_DRIVER",
+    "KUBERNETES_CPU_REQUEST",
+    "KUBERNETES_MEMORY_REQUEST",
+    "KUBERNETES_CPU_LIMIT",
+    "KUBERNETES_MEMORY_LIMIT",
+    "GIT_STRATEGY",
+]);
+/**
+ * github runs docker natively on its runners, gitlab needs a
+ * docker-in-docker service for it
+ */
+const isDindService = (image) => /(^|\/)docker:.*dind/.test(image);
+const slug = (value) => {
+    const slugged = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    // job ids must start with a letter or _
+    return /^[a-z_]/.test(slugged) ? slugged : `job-${slugged}`;
+};
+const githubJobId = (context, jobName) => slug(`${context.type === "workspace" ? "ws-" : ""}${context.name}-${jobName}-${context.env}`);
+exports.githubJobId = githubJobId;
+/** id of a job without component/workspace context (e.g. image builds) */
+const githubGlobalJobId = (jobName) => slug(jobName);
+exports.githubGlobalJobId = githubGlobalJobId;
+const githubJobName = (context, jobName) => `${context.name} ${jobName} | ${context.env}`;
+const resolveNeed = (context, need, allJobs) => {
+    var _a;
+    const env = context.env;
+    const findComponentJob = (componentName, jobName) => {
+        const provider = allJobs.components.find((c) => c.context.name === componentName && c.context.env === env);
+        const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find((j) => j.name === jobName);
+        if (!provider || !job) {
+            throw new Error(`unknown job referenced: '${jobName}' from '${env}:${componentName}'`);
+        }
+        return (0, exports.githubJobId)(provider.context, jobName);
+    };
+    const findWorkspaceJob = (workspaceName, jobName) => {
+        const provider = allJobs.workspaces.find((w) => w.context.name === workspaceName && w.context.env === env);
+        const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find((j) => j.name === jobName);
+        if (!provider || !job) {
+            throw new Error(`unknown job referenced: '${jobName}' from workspace '${env}:${workspaceName}'`);
+        }
+        return (0, exports.githubJobId)(provider.context, jobName);
+    };
+    if ((0, lodash_es_1.isObject)(need)) {
+        if ("global" in need && need.global) {
+            return { id: (0, exports.githubGlobalJobId)(need.job), artifacts: need.artifacts };
+        }
+        if ("workspaceName" in need && need.workspaceName) {
+            return {
+                id: findWorkspaceJob(need.workspaceName, need.job),
+                artifacts: need.artifacts,
+            };
+        }
+        return {
+            id: findComponentJob((_a = ("componentName" in need ? need.componentName : undefined)) !== null && _a !== void 0 ? _a : context.name, need.job),
+            artifacts: need.artifacts,
+        };
+    }
+    return {
+        id: context.type === "workspace"
+            ? findWorkspaceJob(context.name, need)
+            : findComponentJob(context.name, need),
+        // plain string needs download artifacts by default (gitlab semantics)
+        artifacts: true,
+    };
+};
+const resolveGithubNeeds = (context, job, allJobs, extraNeeds = []) => {
+    var _a;
+    const resolved = [...extraNeeds, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])].map((need) => resolveNeed(context, need, allJobs));
+    // deduplicate by provider id, explicit entries win (they come last)
+    return [...new Map(resolved.map((n) => [n.id, n])).values()].sort((a, b) => a.id.localeCompare(b.id));
+};
+exports.resolveGithubNeeds = resolveGithubNeeds;
+/** step id of a referenceable cache restore step (see `cacheId`) */
+const cacheStepId = (cacheId) => `cache-${cacheId.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+const createCacheSteps = (context, job) => {
+    var _a, _b;
+    if (!((_a = job.caches) === null || _a === void 0 ? void 0 : _a.length)) {
+        return [];
+    }
+    const lowered = (0, utils_1.ensureArray)((_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : []);
+    // caches marked redundantOnExactHitOf skip their (expensive) restore
+    // when the referenced sibling cache hit its exact key — e.g. the yarn
+    // zip cache is never read when node_modules restored for the same
+    // lockfile. The referenced cache's step must come first (its
+    // `cache-hit` output drives the `if`), so providers are emitted
+    // before dependents; the reorder is github-only and does not affect
+    // the gitlab cache list.
+    const referencedIds = new Set(lowered
+        .map((cache) => cache.redundantOnExactHitOf)
+        .filter((id) => !!id));
+    const providedIds = new Set(lowered.map((cache) => cache.cacheId).filter((id) => !!id));
+    const ordered = [
+        ...lowered.filter((cache) => !cache.redundantOnExactHitOf),
+        ...lowered.filter((cache) => cache.redundantOnExactHitOf),
+    ];
+    return ordered.map((cache) => {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
+        const key = cache.key;
+        const { cacheKey, restoreKeyPrefix, label } = typeof key === "string" || key === undefined
+            ? ((_b = cache.keyFiles) === null || _b === void 0 ? void 0 : _b.length)
+                ? {
+                    // content-keyed: an unchanged hash is an exact hit and the
+                    // cache is never re-saved (no per-run copies, no races
+                    // between parallel jobs saving the same key)
+                    cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ hashFiles(${cache.keyFiles
+                        .map((f) => `'${f}'`)
+                        .join(", ")}) }}`,
+                    restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+                    label: key !== null && key !== void 0 ? key : "cache",
+                }
+                : {
+                    // unique key per run so the cache is re-saved, restored via prefix
+                    cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ github.run_id }}`,
+                    restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+                    label: key !== null && key !== void 0 ? key : "cache",
+                }
+            : {
+                cacheKey: `${(_c = key.prefix) !== null && _c !== void 0 ? _c : "files"}-\${{ hashFiles(${((_d = key.files) !== null && _d !== void 0 ? _d : [])
+                    .map((f) => `'${f}'`)
+                    .join(", ")}) }}`,
+                restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
+                label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(","),
+            };
+        // the sibling-hit condition only applies when the referenced cache
+        // is actually part of this job — otherwise restore unconditionally
+        const skipCondition = cache.redundantOnExactHitOf &&
+            providedIds.has(cache.redundantOnExactHitOf)
+            ? `\${{ steps.${cacheStepId(cache.redundantOnExactHitOf)}.outputs.cache-hit != 'true' }}`
+            : undefined;
+        return {
+            name: `Cache ${label}`,
+            // referenced caches carry an id so dependents can read cache-hit
+            ...(cache.cacheId && referencedIds.has(cache.cacheId)
+                ? { id: cacheStepId(cache.cacheId) }
+                : {}),
+            ...(skipCondition ? { if: skipCondition } : {}),
+            // pull-only caches are restored but never saved
+            uses: cache.policy === "pull"
+                ? "actions/cache/restore@v4"
+                : "actions/cache@v4",
+            with: {
+                path: paths.join("\n"),
+                key: cacheKey,
+                "restore-keys": restoreKeyPrefix,
+            },
+        };
+    });
+};
+/**
+ * how a vault-stored value reaches the job env: masked github secret,
+ * or plain (unmasked) github variable for non-sensitive values — those
+ * stay readable in logs and usable in environment urls
+ */
+const vaultValueExpression = (name, kinds) => kinds.get(name) === "variable"
+    ? `\${{ vars.${name} }}`
+    : `\${{ secrets.${name} }}`;
+/**
+ * the kind of every vault-stored var of all components, keyed by its
+ * CL_* name — the lookup for cross-component references
+ */
+const collectSecretKinds = (allJobs) => {
+    const kinds = new Map();
+    allJobs.components.forEach(({ context }) => {
+        var _a, _b;
+        const entries = [
+            ...context.environment.secretEnvVarKeys,
+            ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []),
+            ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
+        ];
+        entries.forEach(({ key, kind }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    });
+    return kinds;
+};
+exports.collectSecretKinds = collectSecretKinds;
+const getSecretsEnv = (context, kinds) => {
+    var _a, _b;
+    const keys = [
+        ...context.environment.secretEnvVarKeys,
+        ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []),
+        ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
+    ];
+    return Object.fromEntries(keys.map(({ key }) => {
+        const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key);
+        return [name, vaultValueExpression(name, kinds)];
+    }));
+};
+/**
+ * every CL_* variable the job script reads must exist in the job env.
+ * On gitlab all project variables are implicitly available in every
+ * job — cross-component references (`${other-component:KEY}`) rely on
+ * that. Github jobs only see what is injected explicitly, so the
+ * script is scanned for the names it actually references.
+ */
+const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)]
+    .map((match) => match[1])
+    .filter((name) => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV))
+    .map((name) => [name, vaultValueExpression(name, kinds)]));
+const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    const id = (0, exports.githubJobId)(context, job.name);
+    const isComponent = context.type === "component";
+    const createsJobEnv = !!job.environment &&
+        isComponent &&
+        (!job.environment.action || job.environment.action === "start");
+    const skipCheckout = ((_a = job.runnerVariables) === null || _a === void 0 ? void 0 : _a.GIT_STRATEGY) === "none";
+    const resolved = images.resolve(job.image);
+    const needs = (0, exports.resolveGithubNeeds)(context, job, allJobs, resolved.need ? [resolved.need] : []);
+    const image = typeof resolved.image === "string"
+        ? resolved.image
+        : Array.isArray(resolved.image)
+            ? resolved.image[0]
+            : (_b = resolved.image) === null || _b === void 0 ? void 0 : _b.name;
+    const runScript = [
+        ...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(),
+        ...(0, gitlab_1.collapseableSection)("injectvars", "Injecting variables")((0, getInjectVarsScript_1.getInjectVarsScript)((_c = job.variables) !== null && _c !== void 0 ? _c : {})),
+        ...((_e = (_d = job.script) === null || _d === void 0 ? void 0 : _d.filter(utils_1.notNil)) !== null && _e !== void 0 ? _e : []),
+        ...(createsJobEnv ? [`echo "url=$ROOT_URL" >> "$GITHUB_OUTPUT"`] : []),
+    ].join("\n");
+    // scripts live in committed files to keep workflows under github's
+    // 512 KB limit. Two classes of jobs must keep their script inline:
+    // jobs without a checkout have no repo files, and `${{ }}` expressions
+    // are only interpolated inside the workflow file itself.
+    const run = skipCheckout || runScript.includes("${{")
+        ? runScript
+        : scripts.add(id, runScript);
+    const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
+    // github pages: the built site is handed to the official actions
+    // instead of being uploaded as a plain artifact. `deploy-pages`
+    // replaces the whole site, so there is no path_prefix equivalent —
+    // review previews are rejected upstream (see the pages deploy type).
+    const pagesPublishDir = job.pages ? artifactPaths[0] : undefined;
+    const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map((service) => typeof service === "string" ? { name: service } : service);
+    // docker runs natively on github runners, so gitlab's docker-in-docker
+    // services are dropped. The job container stays: the runner mounts the
+    // host's docker socket into it, and images like docker-build carry the
+    // helper scripts (ensure*Dockerfile etc.) the job scripts rely on.
+    const services = Object.fromEntries(declaredServices
+        .filter((service) => !isDindService(service.name))
+        .map((service) => [
+        slug("alias" in service && service.alias ? service.alias : service.name),
+        {
+            image: service.name,
+            ...("variables" in service && service.variables
+                ? { env: service.variables }
+                : {}),
+        },
+    ]));
+    const env = {
+        ...Object.fromEntries(Object.entries((_j = job.runnerVariables) !== null && _j !== void 0 ? _j : {}).filter(([key]) => !GITLAB_ONLY_RUNNER_VARIABLES.has(key))),
+        ...(isComponent ? getSecretsEnv(context, secretKinds) : {}),
+        ...getReferencedSecretsEnv(runScript, secretKinds),
+        CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner",
+    };
+    /**
+     * the github environment of the job — serving two purposes:
+     * deployment tracking on deploy jobs, and access to environment
+     * secrets (the repo-level cap of 100 secrets doesn't scale to
+     * multiple envs). Names are keyed by env NAME, never env type: an
+     * app can have several envs of the same type.
+     *
+     * - deploy jobs: `<env>-<component>` — static (unlike the former
+     *   per-PR review names), so environment secrets can attach, and
+     *   each component keeps its own deployment badge/url in the
+     *   github ui. For review, PRs share the component's environment:
+     *   a newer PR's deploy marks the previous one Inactive (the badge,
+     *   not the app) — the price of a static name.
+     * - other jobs referencing secrets join the shared `<env>`
+     *   environment — deliberately NOT the per-component one, whose
+     *   Active deploy badge their deployment records would displace.
+     *   NOTE: build-time and deploy-time vars are not differentiated
+     *   yet, so this environment holds roughly ALL of the env's
+     *   secrets (the build's dotenv references every component).
+     * - jobs without secret references get no environment
+     */
+    const referencesSecrets = Object.values(env).some((value) => typeof value === "string" &&
+        (value.includes("${{ secrets.") || value.includes("${{ vars.")));
+    const githubEnvironment = pagesPublishDir
+        ? // github requires pages deployments to target the `github-pages`
+            // environment, and only the deploy step knows the final url.
+            // `secrets-sync-github` derives its targets from the generated
+            // workflows, so any secret this job references is synced there.
+            {
+                name: "github-pages",
+                url: "${{ steps.deployment.outputs.page_url }}",
+            }
+        : job.environment && isComponent
+            ? {
+                name: `${context.env}-${context.name}`,
+                ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            }
+            : referencesSecrets
+                ? { name: context.env }
+                : undefined;
+    // declaring `permissions` drops ALL default token grants, so a job
+    // that needs any special grant must also re-declare the ordinary ones:
+    // `contents: read` for the checkout and `packages: read` to pull its
+    // job image from the repo registry.
+    const specialPermissions = {
+        ...(pagesPublishDir ? { pages: "write", "id-token": "write" } : {}),
+        ...(job.idToken ? { "id-token": "write" } : {}),
+    };
+    const permissions = Object.keys(specialPermissions).length
+        ? {
+            contents: "read",
+            ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),
+            ...specialPermissions,
+        }
+        : undefined;
+    const githubJob = {
+        name: githubJobName(context, job.name),
+        "runs-on": "ubuntu-latest",
+        ...(needs.length > 0 ? { needs: needs.map((n) => n.id) } : {}),
+        ...(image
+            ? {
+                container: {
+                    image,
+                    // private images in the repo's registry need credentials
+                    ...(resolved.fromRepoRegistry
+                        ? {
+                            credentials: {
+                                username: "${{ github.actor }}",
+                                password: "${{ github.token }}",
+                            },
+                        }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(Object.keys(services).length > 0 ? { services } : {}),
+        ...(githubEnvironment ? { environment: githubEnvironment } : {}),
+        ...(permissions ? { permissions } : {}),
+        // gitlab's allow_failure has a direct github counterpart. Without
+        // this the flag was silently dropped: a `pages` deploy (allowFailure
+        // by default, so a broken site publish cannot block the pipeline)
+        // failed the whole workflow — and took every job that needs it,
+        // including the release, down with it.
+        ...(job.allow_failure ? { "continue-on-error": true } : {}),
+        env,
+        steps: [
+            ...(skipCheckout
+                ? []
+                : [{ name: "Checkout", uses: "actions/checkout@v4" }]),
+            ...createCacheSteps(context, job),
+            ...needs
+                .filter((n) => n.artifacts)
+                .map((n) => ({
+                name: `Download artifacts from ${n.id}`,
+                uses: "actions/download-artifact@v4",
+                with: { name: n.id },
+            })),
+            {
+                name: job.name,
+                id: "main",
+                run,
+                shell: "bash",
+            },
+            ...(pagesPublishDir
+                ? [
+                    {
+                        name: "Upload pages artifact",
+                        uses: "actions/upload-pages-artifact@v3",
+                        with: { path: pagesPublishDir },
+                    },
+                    {
+                        name: "Deploy to github pages",
+                        id: "deployment",
+                        uses: "actions/deploy-pages@v4",
+                    },
+                ]
+                : []),
+            ...(pagesPublishDir
+                ? []
+                : uploadProviderIds.has(id) || artifactPaths.length > 0
+                    ? artifactPaths.length > 0
+                        ? [
+                            {
+                                name: "Upload artifacts",
+                                uses: "actions/upload-artifact@v4",
+                                with: {
+                                    name: id,
+                                    path: artifactPaths.join("\n"),
+                                    "if-no-files-found": "warn",
+                                    // gitlab artifacts include everything; upload-artifact
+                                    // silently drops hidden files by default — which is
+                                    // exactly where next.js builds live (.next)
+                                    "include-hidden-files": true,
+                                },
+                            },
+                        ]
+                        : []
+                    : []),
+        ],
+    };
+    return [id, githubJob];
+};
+exports.makeGithubJob = makeGithubJob;
+/**
+ * the ids of all jobs whose artifacts are consumed by other jobs
+ * (they need an upload step)
+ */
+const getUploadProviderIds = (allJobs) => {
+    const ids = new Set();
+    [...allJobs.workspaces, ...allJobs.components].forEach(({ context, jobs }) => jobs.forEach((job) => (0, exports.resolveGithubNeeds)(context, job, allJobs)
+        .filter((n) => n.artifacts)
+        .forEach((n) => ids.add(n.id))));
+    return ids;
+};
+exports.getUploadProviderIds = getUploadProviderIds;
+//# sourceMappingURL=createGithubJobs.js.map

package/dist/packages/pipeline/src/backends/github/createGithubJobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createGithubJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/createGithubJobs.ts"],"names":[],"mappings":";;;AAAA,yCAAqC;AACrC,wEAAqE;AACrE,qEAAkF;AAClF,mFAAyE;AASzE,uCAAkD;AAClD,+CAAyD;AACzD,uDAAuE;AAGvE,+CAA6D;AAE7D;;;;GAIG;AACH,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,aAAa;IACb,oBAAoB;IACpB,eAAe;IACf,wBAAwB;IACxB,2BAA2B;IAC3B,sBAAsB;IACtB,yBAAyB;IACzB,cAAc;CACf,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAE3E,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE;IAC7B,MAAM,OAAO,GAAG,KAAK;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,wCAAwC;IACxC,OAAO,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC;AAC9D,CAAC,CAAC;AAEK,MAAM,WAAW,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,EAAE,CAC/D,IAAI,CACF,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CACxF,CAAC;AAHS,QAAA,WAAW,eAGpB;AAEJ,0EAA0E;AACnE,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAAvD,QAAA,iBAAiB,qBAAsC;AAEpE,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAE,OAAe,EAAE,EAAE,CAC1D,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC;AAIhD,MAAM,WAAW,GAAG,CAClB,OAAgB,EAChB,IAAsB,EACtB,OAAyB,EACX,EAAE;;IAChB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IAExB,MAAM,gBAAgB,GAAG,CAAC,aAAqB,EAAE,OAAe,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CACjE,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,WAAW,GAAG,IAAI,aAAa,GAAG,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,mBAAW,EAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,CAAC,aAAqB,EAAE,OAAe,EAAE,EAAE;QAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,KAAK,GAAG,CACjE,CAAC;QACF,MAAM,GAAG,GAAG,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,4BAA4B,OAAO,qBAAqB,GAAG,IAAI,aAAa,GAAG,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAA,mBAAW,EAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC,CAAC;IAEF,IAAI,IAAA,oBAAQ,EAAC,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAA,yBAAiB,EAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACxE,CAAC;QACD,IAAI,eAAe,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YAClD,OAAO;gBACL,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC;gBAClD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,gBAAgB,CAClB,MAAA,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,mCACxD,OAAO,CAAC,IAAI,EACd,IAAI,CAAC,GAAG,CACT;YACD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EACA,OAAO,CAAC,IAAI,KAAK,WAAW;YAC1B,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;YACtC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1C,sEAAsE;QACtE,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,kBAAkB,GAAG,CAChC,OAAgB,EAChB,GAAiB,EACjB,OAAyB,EACzB,aAAiC,EAAE,EACnB,EAAE;;IAClB,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAClE,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CACpC,CAAC;IACF,oEAAoE;IACpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzE,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CACzB,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,kBAAkB,sBAa7B;AAEF,oEAAoE;AACpE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CACtC,SAAS,OAAO,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;AAErD,MAAM,gBAAgB,GAAG,CACvB,OAAgB,EAChB,GAAiB,EACH,EAAE;;IAChB,IAAI,CAAC,CAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,MAAM,CAAA,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,mBAAW,EACzB,MAAA,IAAA,+CAA8B,EAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,mCAAI,EAAE,CAC1D,CAAC;IAEF,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,6DAA6D;IAC7D,gEAAgE;IAChE,oEAAoE;IACpE,yBAAyB;IACzB,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,OAAO;SACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;SAC3C,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACtC,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzE,CAAC;IACF,MAAM,OAAO,GAAG;QACd,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;QAC1D,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;KAC1D,CAAC;IAEF,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC3B,MAAM,KAAK,GAAG,IAAA,mBAAW,EAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,KAAK,EAAE,GACzC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS;YAC1C,CAAC,CAAC,CAAA,MAAA,KAAK,CAAC,QAAQ,0CAAE,MAAM;gBACtB,CAAC,CAAC;oBACE,2DAA2D;oBAC3D,uDAAuD;oBACvD,6CAA6C;oBAC7C,QAAQ,EAAE,GAAG,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO,mBAAmB,KAAK,CAAC,QAAQ;yBACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;yBACpB,IAAI,CAAC,IAAI,CAAC,MAAM;oBACnB,gBAAgB,EAAE,GAAG,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO,GAAG;oBACtC,KAAK,EAAE,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO;iBACtB;gBACH,CAAC,CAAC;oBACE,mEAAmE;oBACnE,QAAQ,EAAE,GAAG,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO,wBAAwB;oBACnD,gBAAgB,EAAE,GAAG,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO,GAAG;oBACtC,KAAK,EAAE,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,OAAO;iBACtB;YACL,CAAC,CAAC;gBACE,QAAQ,EAAE,GAAG,MAAA,GAAG,CAAC,MAAM,mCAAI,OAAO,mBAAmB,CACnD,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAChB;qBACE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;qBACpB,IAAI,CAAC,IAAI,CAAC,MAAM;gBACnB,gBAAgB,EAAE,GAAG,MAAA,GAAG,CAAC,MAAM,mCAAI,OAAO,GAAG;gBAC7C,KAAK,EAAE,MAAA,GAAG,CAAC,MAAM,mCAAI,CAAC,MAAA,GAAG,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aACjD,CAAC;QACR,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,aAAa,GACjB,KAAK,CAAC,qBAAqB;YAC3B,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC;YAC1C,CAAC,CAAC,cAAc,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,iCAAiC;YACzF,CAAC,CAAC,SAAS,CAAC;QAEhB,OAAO;YACL,IAAI,EAAE,SAAS,KAAK,EAAE;YACtB,iEAAiE;YACjE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;gBACnD,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;gBACpC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,gDAAgD;YAChD,IAAI,EACF,KAAK,CAAC,MAAM,KAAK,MAAM;gBACrB,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,kBAAkB;YACxB,IAAI,EAAE;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;gBACtB,GAAG,EAAE,QAAQ;gBACb,cAAc,EAAE,gBAAgB;aACjC;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAIF;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAE,KAAkB,EAAU,EAAE,CACxE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,UAAU;IAC5B,CAAC,CAAC,aAAa,IAAI,KAAK;IACxB,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC;AAEhC;;;GAGG;AACI,MAAM,kBAAkB,GAAG,CAAC,OAAyB,EAAe,EAAE;IAC3E,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAE,CAAC;IACrC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;;QACzC,MAAM,OAAO,GAAG;YACd,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB;YACvC,GAAG,CAAC,MAAA,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,mCAAI,EAAE,CAAC;YACjE,GAAG,CAAC,MAAA,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAC;SACnE,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAChC,KAAK,CAAC,GAAG,CACP,IAAA,0CAAgB,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAChD,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CACjB,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAhBW,QAAA,kBAAkB,sBAgB7B;AAEF,MAAM,aAAa,GAAG,CACpB,OAAyB,EACzB,KAAkB,EACM,EAAE;;IAC1B,MAAM,IAAI,GAAG;QACX,GAAG,OAAO,CAAC,WAAW,CAAC,gBAAgB;QACvC,GAAG,CAAC,MAAA,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,gBAAgB,mCAAI,EAAE,CAAC;QACjE,GAAG,CAAC,MAAA,OAAO,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,mCAAI,EAAE,CAAC;KACnE,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;QACnB,MAAM,IAAI,GAAG,IAAA,0CAAgB,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACnD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAG,CAC9B,MAAc,EACd,KAAkB,EACM,EAAE,CAC1B,MAAM,CAAC,WAAW,CAChB,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC;KAChD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KACxB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,0CAA4B,CAAC,CAAC;KACzD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAC5D,CAAC;AAEG,MAAM,aAAa,GAAG,CAC3B,OAAgB,EAChB,GAAiB,EACjB,OAAyB,EACzB,iBAA8B,EAC9B,MAAqB,EACrB,OAA0B,EAC1B,cAA2B,IAAI,GAAG,EAAE,EACA,EAAE;;IACtC,MAAM,EAAE,GAAG,IAAA,mBAAW,EAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC;IAEjD,MAAM,aAAa,GACjB,CAAC,CAAC,GAAG,CAAC,WAAW;QACjB,WAAW;QACX,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;IAElE,MAAM,YAAY,GAAG,CAAA,MAAA,GAAG,CAAC,eAAe,0CAAE,YAAY,MAAK,MAAM,CAAC;IAElE,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAA,0BAAkB,EAC9B,OAAO,EACP,GAAG,EACH,OAAO,EACP,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC;IAEF,MAAM,KAAK,GACT,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAChC,CAAC,CAAC,QAAQ,CAAC,KAAK;QAChB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACnB,CAAC,CAAC,MAAA,QAAQ,CAAC,KAAK,0CAAE,IAAI,CAAC;IAE7B,MAAM,SAAS,GAAG;QAChB,GAAG,IAAA,oDAAkC,GAAE;QACvC,GAAG,IAAA,4BAAmB,EACpB,YAAY,EACZ,qBAAqB,CACtB,CAAC,IAAA,yCAAmB,EAAC,MAAA,GAAG,CAAC,SAAS,mCAAI,EAAE,CAAC,CAAC;QAC3C,GAAG,CAAC,MAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,MAAM,CAAC,cAAM,CAAC,mCAAI,EAAE,CAAC;QACrC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,GAAG,GACP,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAEjC,MAAM,aAAa,GAAG,MAAA,MAAA,GAAG,CAAC,SAAS,0CAAE,KAAK,mCAAI,EAAE,CAAC;IAEjD,iEAAiE;IACjE,gEAAgE;IAChE,mEAAmE;IACnE,qEAAqE;IACrE,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,MAAM,gBAAgB,GAAG,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5D,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAC1D,CAAC;IACF,uEAAuE;IACvE,uEAAuE;IACvE,uEAAuE;IACvE,mEAAmE;IAEnE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,gBAAgB;SACb,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC;QACzC,IAAI,CACF,OAAO,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CACnE;QACD;YACE,KAAK,EAAE,OAAO,CAAC,IAAI;YACnB,GAAG,CAAC,WAAW,IAAI,OAAO,IAAI,OAAO,CAAC,SAAS;gBAC7C,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,SAAmC,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;SACR;KACF,CAAC,CACL,CAAC;IAEF,MAAM,GAAG,GAAG;QACV,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,MAAA,GAAG,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAClD,CACF;QACD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC;QAClD,YAAY,EAAE,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,QAAQ;KAChC,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAClE,CAAC;IACF,MAAM,iBAAiB,GAAG,eAAe;QACvC,CAAC,CAAC,iEAAiE;YACjE,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE;gBACE,IAAI,EAAE,cAAc;gBACpB,GAAG,EAAE,0CAA0C;aAChD;QACH,CAAC,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW;YAC9B,CAAC,CAAC;gBACE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE;gBACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,+BAA+B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACH,CAAC,CAAC,iBAAiB;gBACjB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE;gBACvB,CAAC,CAAC,SAAS,CAAC;IAElB,mEAAmE;IACnE,uEAAuE;IACvE,qEAAqE;IACrE,oCAAoC;IACpC,MAAM,kBAAkB,GAAG;QACzB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM;QACxD,CAAC,CAAC;YACE,QAAQ,EAAE,MAAM;YAChB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,kBAAkB;SACtB;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,SAAS,GAAc;QAC3B,IAAI,EAAE,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC;QACtC,SAAS,EAAE,eAAe;QAC1B,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,KAAK;YACP,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK;oBACL,yDAAyD;oBACzD,GAAG,CAAC,QAAQ,CAAC,gBAAgB;wBAC3B,CAAC,CAAC;4BACE,WAAW,EAAE;gCACX,QAAQ,EAAE,qBAAqB;gCAC/B,QAAQ,EAAE,qBAAqB;6BAChC;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,kEAAkE;QAClE,qEAAqE;QACrE,kEAAkE;QAClE,gEAAgE;QAChE,uCAAuC;QACvC,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG;QACH,KAAK,EAAE;YACL,GAAG,CAAC,YAAY;gBACd,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACxD,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC;YACjC,GAAG,KAAK;iBACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;iBAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,2BAA2B,CAAC,CAAC,EAAE,EAAE;gBACvC,IAAI,EAAE,8BAA8B;gBACpC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;aACrB,CAAC,CAAC;YACL;gBACE,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,EAAE,EAAE,MAAM;gBACV,GAAG;gBACH,KAAK,EAAE,MAAM;aACd;YACD,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,uBAAuB;wBAC7B,IAAI,EAAE,kCAAkC;wBACxC,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE;qBAChC;oBACD;wBACE,IAAI,EAAE,wBAAwB;wBAC9B,EAAE,EAAE,YAAY;wBAChB,IAAI,EAAE,yBAAyB;qBAChC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;oBACrD,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;wBACxB,CAAC,CAAC;4BACE;gCACE,IAAI,EAAE,kBAAkB;gCACxB,IAAI,EAAE,4BAA4B;gCAClC,IAAI,EAAE;oCACJ,IAAI,EAAE,EAAE;oCACR,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;oCAC9B,mBAAmB,EAAE,MAAM;oCAC3B,uDAAuD;oCACvD,oDAAoD;oCACpD,4CAA4C;oCAC5C,sBAAsB,EAAE,IAAI;iCAC7B;6BACF;yBACF;wBACH,CAAC,CAAC,EAAE;oBACN,CAAC,CAAC,EAAE,CAAC;SACV;KACF,CAAC;IAEF,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACzB,CAAC,CAAC;AAnPW,QAAA,aAAa,iBAmPxB;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,CAClC,OAAyB,EACZ,EAAE;IACf,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAC3E,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CACnB,IAAA,0BAAkB,EAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1B,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CACjC,CACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAZW,QAAA,oBAAoB,wBAY/B"}

package/dist/packages/pipeline/src/backends/github/ensureImageJobs.d.ts

@@ -0,0 +1,12 @@
+import type { JobImagesPlan } from "../../customImages/jobImagesPlan";
+import type { GithubJob } from "../../types/github-types";
+/**
+ * the image build jobs: always run (github has no server-side
+ * changes-filter), the existence check makes unchanged runs fast.
+ * Docker is native on github runners — no container, no dind.
+ * `only` restricts to the named images (e.g. the create-release
+ * workflow needs just the release image).
+ */
+export declare const makeEnsureImageGithubJobs: (images: JobImagesPlan, options?: {
+    only?: string[];
+}) => Record<string, GithubJob>;

package/dist/packages/pipeline/src/backends/github/ensureImageJobs.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeEnsureImageGithubJobs = void 0;
+const createGithubJobs_1 = require("./createGithubJobs");
+const scriptFunctions_1 = require("./scriptFunctions");
+const utils_1 = require("../../utils");
+/**
+ * the image build jobs: always run (github has no server-side
+ * changes-filter), the existence check makes unchanged runs fast.
+ * Docker is native on github runners — no container, no dind.
+ * `only` restricts to the named images (e.g. the create-release
+ * workflow needs just the release image).
+ */
+const makeEnsureImageGithubJobs = (images, options = {}) => Object.fromEntries(images
+    .getEnsureJobs()
+    .filter((job) => !options.only || options.only.includes(job.name))
+    .map((job) => {
+    var _a, _b;
+    return [
+        (0, createGithubJobs_1.githubGlobalJobId)(job.name),
+        {
+            name: job.name,
+            "runs-on": "ubuntu-latest",
+            steps: [
+                { name: "Checkout", uses: "actions/checkout@v4" },
+                {
+                    name: job.name,
+                    id: "main",
+                    run: [
+                        ...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(),
+                        ...((_b = (_a = job.script) === null || _a === void 0 ? void 0 : _a.filter(utils_1.notNil)) !== null && _b !== void 0 ? _b : []),
+                    ].join("\n"),
+                    shell: "bash",
+                },
+            ],
+        },
+    ];
+}));
+exports.makeEnsureImageGithubJobs = makeEnsureImageGithubJobs;
+//# sourceMappingURL=ensureImageJobs.js.map

package/dist/packages/pipeline/src/backends/github/ensureImageJobs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensureImageJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ensureImageJobs.ts"],"names":[],"mappings":";;;AAEA,yDAAuD;AACvD,uDAAuE;AACvE,uCAAqC;AAErC;;;;;;GAMG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAqB,EACrB,UAA+B,EAAE,EACN,EAAE,CAC7B,MAAM,CAAC,WAAW,CAChB,MAAM;KACH,aAAa,EAAE;KACf,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;KACjE,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;IAAC,OAAA;QACZ,IAAA,oCAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;QAC3B;YACE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;gBACjD;oBACE,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,MAAM;oBACV,GAAG,EAAE;wBACH,GAAG,IAAA,oDAAkC,GAAE;wBACvC,GAAG,CAAC,MAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,MAAM,CAAC,cAAM,CAAC,mCAAI,EAAE,CAAC;qBACtC,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,MAAM;iBACd;aACF;SACkB;KACtB,CAAA;CAAA,CAAC,CACL,CAAC;AA3BS,QAAA,yBAAyB,6BA2BlC"}

package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.d.ts

@@ -0,0 +1,42 @@
+import type { JobImagesPlan } from "../../customImages/jobImagesPlan";
+import type { Config } from "../../types";
+import type { GithubJob, GithubWorkflow } from "../../types/github-types";
+/**
+ * the release jobs of the main-branch workflow: with releases.when ===
+ * "auto" the release runs at the end of every main workflow run.
+ * Manual releasing happens via the create-release dispatch workflow
+ * (see getGithubCreateReleaseWorkflow) instead.
+ */
+export declare const getGithubReleaseJobs: (config: Config, mainWorkflowJobIds: string[], images: JobImagesPlan) => Record<string, GithubJob>;
+/**
+ * the dispatch workflow to trigger a release by hand — a first-class
+ * entry in the Actions sidebar (the counterpart of gitlab's `create
+ * release` button). Its queue-check step releases right away when the
+ * main workflow run for HEAD is green and otherwise queues the release
+ * for the release-on-green workflow. Where the release method
+ * distinguishes a force mode (e.g. changesets: release a patch bump
+ * without pending changesets), forcing is a checkbox input — a forced
+ * release skips the queue-check and releases immediately, whatever the
+ * pipeline state.
+ */
+export declare const getGithubCreateReleaseWorkflow: (config: Config, images: JobImagesPlan, workflowEnv: Record<string, string>) => GithubWorkflow;
+/**
+ * the release-on-green workflow (manual release mode only): runs on
+ * every completed main workflow run. A lightweight host job checks the
+ * queue marker (written by the create-release task while the main
+ * workflow was still running) — most runs have nothing queued and end
+ * after that single quick job. When the marker matches the completed
+ * run, the containerized release job creates the release.
+ *
+ * No image-build jobs here: the release image was ensured by the main
+ * workflow run that just completed (same commit, same content-hashed
+ * tag).
+ */
+export declare const getGithubReleaseOnGreenWorkflow: (config: Config, images: JobImagesPlan, mainWorkflowName: string, workflowEnv: Record<string, string>) => GithubWorkflow | null;
+/**
+ * the informational MR/PR check job of the release method (e.g. the
+ * changeset check), added to the mr workflow. continue-on-error keeps
+ * a missing changeset from blocking the PR — the sticky PR comment is
+ * the visible surface on github.
+ */
+export declare const getGithubReleaseCheckJobs: (config: Config, images: JobImagesPlan) => Record<string, GithubJob>;