@catladder/cli 0.0.0-main-8dbb6c76 → 0.0.0-main-a6b45abe

package/dist/apps/cli/src/apps/cli/commands/project/setup/index.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupProject = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const setupAccessTokens_1 = require("./setupAccessTokens");
+const setupContext_1 = require("./setupContext");
+const setupTopic_1 = require("./setupTopic");
+const setupAgents_1 = require("./setupAgents");
+const setupGithub_1 = require("./setupGithub");
+const logSection_1 = require("./logSection");
+const ensureGcloudProjectNumbers_1 = require("./ensureGcloudProjectNumbers");
+const setupProject = async (instance, onlyComponents) => {
+    // refresh the agent skills first — store-independent, so it survives a
+    // later failure (e.g. missing gcloud auth in ensureGcloudProjectNumbers).
+    // This makes `catladder project setup` the one command that also lands
+    // the skills, so agents helping a migrating project get them even when
+    // catenv itself can't run yet (e.g. before the store is populated).
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (config) {
+        await (0, pipeline_1.generateAgentSkills)((0, pipeline_1.createCatenvContext)(config));
+    }
+    // must come first: creating contexts already requires the store
+    await (0, ensureGcloudProjectNumbers_1.ensureGcloudProjectNumbers)(instance);
+    const allContext = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
+    instance.log("will setup those contexts:");
+    allContext.forEach((context) => {
+        instance.log(` - ${context.name}:${context.env}`);
+    });
+    const enabledPipelines = config ? (0, pipeline_1.getEnabledPipelineTypes)(config) : [];
+    await (0, logSection_1.logSection)(instance, "base setup", async () => {
+        // gitlab-specific provisioning (access token, agent webhooks) —
+        // meaningless (and failing) on a github-only project
+        if (enabledPipelines.includes("gitlab")) {
+            await (0, setupAccessTokens_1.setupAccessTokens)(instance);
+            await (0, setupAgents_1.setupAgents)(instance);
+        }
+        await (0, setupTopic_1.setupTopic)(instance);
+        if (config) {
+            await (0, setupGithub_1.setupGithub)(instance, config);
+        }
+    });
+    for (const context of allContext) {
+        await (0, setupContext_1.setupContext)(instance, context);
+    }
+    instance.log("");
+    instance.log(`${enabledPipelines.join(" + ") || "gitlab"} is ready! 🥂`);
+    instance.log("\n");
+    instance.log("do not forget to make sure that:");
+    [
+        "you have __health route in place",
+        "lint and test are defined",
+        "secrets are configured (call project-config-secret)",
+        "eat your vegetables",
+        "be awesome 🤩",
+    ].forEach((tip) => instance.log(` - ${tip}`));
+    instance.log("\n");
+    instance.log("\n");
+};
+exports.setupProject = setupProject;
+//# sourceMappingURL=index.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/index.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6EAGgD;AAChD,2DAAwD;AACxD,iDAA8C;AAC9C,6CAA0C;AAC1C,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,6EAA0E;AAEnE,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAA,8BAAmB,EAAC,IAAA,8BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,MAAM,IAAA,uDAA0B,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC3C,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;QAClD,gEAAgE;QAChE,qDAAqD;QACrD,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAA,qCAAiB,EAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,IAAA,uBAAU,EAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAA,2BAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,eAAe,CAAC,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD;QACE,kCAAkC;QAClC,2BAA2B;QAC3B,qDAAqD;QACrD,qBAAqB;QACrB,eAAe;KAChB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;AApDW,QAAA,YAAY,gBAoDvB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/logSection.d.ts

@@ -0,0 +1,2 @@
+import type { IO } from "../../../../../core/types";
+export declare const logSection: (instance: IO, title: string, work: () => Promise<void>) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/logSection.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logSection = void 0;
+const logSection = async (instance, title, work) => {
+    instance.log("");
+    instance.log("==================================================================================");
+    instance.log("🐱 🔧 " + title + "...");
+    instance.log("");
+    await work();
+    instance.log("");
+    instance.log("✅    " + title + " done!");
+    instance.log("");
+    instance.log("==================================================================================");
+    instance.log("");
+};
+exports.logSection = logSection;
+//# sourceMappingURL=logSection.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/logSection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logSection.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/logSection.ts"],"names":[],"mappings":";;;AAEO,MAAM,UAAU,GAAG,KAAK,EAC7B,QAAY,EACZ,KAAa,EACb,IAAyB,EACzB,EAAE;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CACV,oFAAoF,CACrF,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,MAAM,IAAI,EAAE,CAAC;IACb,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CACV,oFAAoF,CACrF,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAnBW,QAAA,UAAU,cAmBrB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAccessTokens.d.ts

@@ -0,0 +1,2 @@
+import type { IO } from "../../../../../core/types";
+export declare const setupAccessTokens: (instance: IO) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAccessTokens.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupAccessTokens = void 0;
+const date_fns_1 = require("date-fns");
+const gitlab_1 = require("../../../../../utils/gitlab");
+const TOKEN_NAME = "semantic-release";
+const setupAccessTokens = async (instance) => {
+    const { id: projectId } = await (0, gitlab_1.getProjectInfo)(instance);
+    // all pages: rotated tokens accumulate one (inactive) entry per
+    // rotation, so the active one quickly moves past the first page —
+    // missing it here created a brand-new duplicate token on every setup
+    const projectTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+    const token = projectTokens.find((t) => t.name === TOKEN_NAME && t.active === true);
+    const expires_at = (0, date_fns_1.format)((0, date_fns_1.add)(new Date(), { years: 1, days: -1 }), "yyyy-MM-dd");
+    const newToken = token
+        ? await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/access_tokens/${token.id}/rotate`, { expires_at }, "POST")
+        : await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/access_tokens`, {
+            name: TOKEN_NAME,
+            scopes: ["api", "read_repository"],
+            access_level: 40, // Maintainer
+            expires_at,
+        }, "POST");
+    try {
+        await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+        await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`, { value: newToken.token }, "PUT");
+    }
+    catch (e) {
+        if (e.message !== "not found") {
+            throw e;
+        }
+        // not found
+        await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables`, {
+            key: "GL_TOKEN",
+            value: newToken.token,
+            masked: true,
+        }, "POST");
+    }
+    instance.log("Token configured for semantic release. Renew me again in a year!");
+};
+exports.setupAccessTokens = setupAccessTokens;
+//# sourceMappingURL=setupAccessTokens.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAccessTokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupAccessTokens.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupAccessTokens.ts"],"names":[],"mappings":";;;AACA,uCAAuC;AACvC,wDAIqC;AAErC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAE/B,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAY,EAAE,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,aAAa,GAAG,MAAM,IAAA,gCAAuB,EACjD,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAClD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,iBAAM,EACvB,IAAA,cAAG,EAAC,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EACvC,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK;QACpB,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,kBAAkB,KAAK,CAAC,EAAE,SAAS,EACxD,EAAE,UAAU,EAAE,EACd,MAAM,CACP;QACH,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,gBAAgB,EACrC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAClC,YAAY,EAAE,EAAE,EAAE,aAAa;YAC/B,UAAU;SACX,EACD,MAAM,CACP,CAAC;IAEN,IAAI,CAAC;QACH,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,qBAAqB,CAAC,CAAC;QAC5E,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,qBAAqB,EAC1C,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EACzB,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,CAAC;QACV,CAAC;QACD,YAAY;QACZ,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,YAAY,EACjC;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI;SACb,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,CACV,kEAAkE,CACnE,CAAC;AACJ,CAAC,CAAC;AAlEW,QAAA,iBAAiB,qBAkE5B"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAgents.d.ts

@@ -0,0 +1,2 @@
+import type { IO } from "../../../../../core/types";
+export declare const setupAgents: (instance: IO) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAgents.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupAgents = void 0;
+const gitlab_1 = require("../../../../../utils/gitlab");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const gitProjectInformation_1 = require("../../../../../git/gitProjectInformation");
+const git_1 = require("../../../../../git");
+const listTriggerTokens = async (instance, projectId) => {
+    return await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/triggers`);
+};
+const deleteTriggerToken = async (instance, projectId, triggerId) => {
+    await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/triggers/${triggerId}`, undefined, "DELETE");
+};
+const createTriggerToken = async (instance, projectId, description) => {
+    return await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/triggers`, { description }, "POST");
+};
+const listWebhooks = async (instance, projectId) => {
+    return await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/hooks`);
+};
+const createWebhook = async (instance, projectId, webhookData) => {
+    return await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/hooks`, webhookData, "POST");
+};
+const updateWebhook = async (instance, projectId, hookId, webhookData) => {
+    return await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/hooks/${hookId}`, webhookData, "PUT");
+};
+const setupAgentWebhook = async (instance, projectId, agentName, triggerToken) => {
+    const webhookName = `cl_agent_${agentName}_webhook`;
+    const { gitRemoteHost } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
+    const mainBranch = await (0, git_1.getMainBranch)();
+    const webhookUrl = `https://${gitRemoteHost}/api/v4/projects/${projectId}/ref/${mainBranch}/trigger/pipeline?token=${triggerToken}`;
+    instance.log(`Setting up webhook for agent: ${agentName}`);
+    // List existing webhooks
+    const existingWebhooks = await listWebhooks(instance, projectId);
+    // Find existing webhook by name
+    const existingWebhook = existingWebhooks.find((webhook) => webhook.name === webhookName);
+    // Custom webhook template from the user's specification
+    const customWebhookTemplate = JSON.stringify({
+        variables: {
+            ASSIGNEE_USER_ID: "{{object_attributes.assignee_id}}",
+            OBJECT_DESCRIPTION: "{{object_attributes.description}}",
+        },
+        payload: {
+            object_kind: "{{object_kind}}",
+            event_type: "{{event_type}}",
+            user_id: "{{user.id}}",
+            user_name: "{{user.name}}",
+            user_username: "{{user.username}}",
+            user_avatar_url: "{{user.avatar_url}}",
+            user_email: "{{user.email}}",
+            project_id: "{{project.id}}",
+            project_name: "{{project.name}}",
+            project_web_url: "{{project.web_url}}",
+            project_namespace: "{{project.namespace}}",
+            project_path_with_namespace: "{{project.path_with_namespace}}",
+            object_attributes_id: "{{object_attributes.id}}",
+            object_attributes_iid: "{{object_attributes.iid}}",
+            object_attributes_title: "{{object_attributes.title}}",
+            object_attributes_description: "{{object_attributes.description}}",
+            object_attributes_state: "{{object_attributes.state}}",
+            object_attributes_created_at: "{{object_attributes.created_at}}",
+            object_attributes_updated_at: "{{object_attributes.updated_at}}",
+            object_attributes_url: "{{object_attributes.url}}",
+            object_attributes_action: "{{object_attributes.action}}",
+            object_attributes_noteable_type: "{{object_attributes.noteable_type}}",
+            merge_request_id: "{{merge_request.id}}",
+            merge_request_iid: "{{merge_request.iid}}",
+            merge_request_title: "{{merge_request.title}}",
+            merge_request_source_branch: "{{merge_request.source_branch}}",
+            merge_request_time_estimate: "{{merge_request.time_estimate}}",
+            merge_request_description: "{{merge_request.description}}",
+            merge_request_merge_status: "{{merge_request.merge_status}}",
+            merge_request_last_commit_title: "{{merge_request.last_commit.title}}",
+            merge_request_last_commit_message: "{{merge_request.last_commit.message}}",
+            merge_request_last_commit_author_name: "{{merge_request.last_commit.author.name}}",
+            merge_request_last_commit_author_email: "{{merge_request.last_commit.author.email}}",
+        },
+    });
+    const webhookData = {
+        url: webhookUrl,
+        name: webhookName,
+        description: `Agent webhook for ${agentName} - triggers pipeline with custom payload`,
+        issues_events: true,
+        confidential_issues_events: false,
+        merge_requests_events: false,
+        note_events: true,
+        confidential_note_events: false,
+        custom_webhook_template: customWebhookTemplate,
+    };
+    let webhook;
+    if (existingWebhook) {
+        instance.log(`Updating existing webhook: ${webhookName} (ID: ${existingWebhook.id})`);
+        webhook = await updateWebhook(instance, projectId, existingWebhook.id, webhookData);
+        instance.log(`✅ Updated webhook: ${webhook.name}`);
+    }
+    else {
+        instance.log(`Creating new webhook: ${webhookName}`);
+        webhook = await createWebhook(instance, projectId, webhookData);
+        instance.log(`✅ Created webhook: ${webhook.name}`);
+    }
+    instance.log(`   Webhook ID: ${webhook.id}`);
+    instance.log(`   Webhook URL: ${webhook.url}`);
+    return webhook;
+};
+const setupAgentTriggerToken = async (instance, projectId, agentName) => {
+    const tokenName = `cl_agent_${agentName}`;
+    instance.log(`Setting up trigger token for agent: ${agentName}`);
+    // List existing trigger tokens
+    const existingTokens = await listTriggerTokens(instance, projectId);
+    // Find and delete existing cl_agent_<agentName> tokens
+    const existingAgentTokens = existingTokens.filter((token) => token.description.startsWith(`cl_agent_${agentName}`));
+    for (const token of existingAgentTokens) {
+        instance.log(`Deleting existing trigger token: ${token.description} (ID: ${token.id})`);
+        await deleteTriggerToken(instance, projectId, token.id);
+    }
+    // Create new trigger token
+    const description = `${tokenName} - Agent trigger token for ${agentName}`;
+    const newToken = await createTriggerToken(instance, projectId, description);
+    instance.log(`✅ Created new trigger token: ${newToken.description}`);
+    instance.log(`   Token ID: ${newToken.id}`);
+    instance.log(`   Token: ${newToken.token}`);
+    return newToken;
+};
+const setupAgent = async (instance, agentName, agentConfig) => {
+    const { id: projectId } = await (0, gitlab_1.getProjectInfo)(instance);
+    instance.log(`🤖 Setting up agent: ${agentName}`);
+    // Setup trigger token for this agent
+    const triggerToken = await setupAgentTriggerToken(instance, projectId, agentName);
+    // Setup webhook for this agent
+    await setupAgentWebhook(instance, projectId, agentName, triggerToken.token);
+    instance.log(`✅ Agent ${agentName} setup complete!`);
+};
+const setupAgents = async (instance) => {
+    var _a;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    instance.log("");
+    instance.log("🤖 Setting up agents...");
+    const agents = (_a = config.agents) !== null && _a !== void 0 ? _a : {};
+    const agentEntries = Object.entries(agents);
+    if (agentEntries.length === 0) {
+        instance.log("No agents configured in project config");
+        return;
+    }
+    for (const [agentName, agentConfig] of agentEntries) {
+        if (agentConfig.type === "claude" && agentConfig) {
+            await setupAgent(instance, agentName, agentConfig);
+        }
+    }
+    instance.log("✅ All agents setup complete!");
+    instance.log("");
+    instance.log("🔧 Manual setup required:");
+    instance.log("Please configure these environment variables in GitLab CI/CD unless they are already set (by group or global):");
+    instance.log("   Go to Settings > CI/CD > Variables and add:");
+    instance.log("   - CLAUDE_CODE_OAUTH_TOKEN or ANTHROPIC_API_KEY (your Anthropic API key, mark as Protected & Masked)");
+    instance.log("   - AGENT_GITLAB_PERSONAL_ACCESS_TOKEN (token from agent.claude user, mark as Protected & Masked)");
+};
+exports.setupAgents = setupAgents;
+//# sourceMappingURL=setupAgents.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupAgents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupAgents.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupAgents.ts"],"names":[],"mappings":";;;AACA,wDAA8E;AAC9E,6EAA0E;AAC1E,oFAAmF;AACnF,4CAAmD;AAyDnD,MAAM,iBAAiB,GAAG,KAAK,EAC7B,QAAY,EACZ,SAAiB,EACQ,EAAE;IAC3B,OAAO,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,WAAW,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,QAAY,EACZ,SAAiB,EACjB,SAAiB,EACF,EAAE;IACjB,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,aAAa,SAAS,EAAE,EAC7C,SAAS,EACT,QAAQ,CACT,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,QAAY,EACZ,SAAiB,EACjB,WAAmB,EACI,EAAE;IACzB,OAAO,MAAM,IAAA,wBAAe,EAC1B,QAAQ,EACR,YAAY,SAAS,WAAW,EAChC,EAAE,WAAW,EAAE,EACf,MAAM,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EACxB,QAAY,EACZ,SAAiB,EACG,EAAE;IACtB,OAAO,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,QAAQ,CAAC,CAAC;AACxE,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EACzB,QAAY,EACZ,SAAiB,EACjB,WAAwB,EACN,EAAE;IACpB,OAAO,MAAM,IAAA,wBAAe,EAC1B,QAAQ,EACR,YAAY,SAAS,QAAQ,EAC7B,WAAW,EACX,MAAM,CACP,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EACzB,QAAY,EACZ,SAAiB,EACjB,MAAc,EACd,WAAwB,EACN,EAAE;IACpB,OAAO,MAAM,IAAA,wBAAe,EAC1B,QAAQ,EACR,YAAY,SAAS,UAAU,MAAM,EAAE,EACvC,WAAW,EACX,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAC7B,QAAY,EACZ,SAAiB,EACjB,SAAiB,EACjB,YAAoB,EACF,EAAE;IACpB,MAAM,WAAW,GAAG,YAAY,SAAS,UAAU,CAAC;IACpD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,IAAA,+CAAuB,GAAE,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,IAAA,mBAAa,GAAE,CAAC;IACzC,MAAM,UAAU,GAAG,WAAW,aAAa,oBAAoB,SAAS,QAAQ,UAAU,2BAA2B,YAAY,EAAE,CAAC;IAEpI,QAAQ,CAAC,GAAG,CAAC,iCAAiC,SAAS,EAAE,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,gBAAgB,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEjE,gCAAgC;IAChC,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAC3C,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAC1C,CAAC;IAEF,wDAAwD;IACxD,MAAM,qBAAqB,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3C,SAAS,EAAE;YACT,gBAAgB,EAAE,mCAAmC;YACrD,kBAAkB,EAAE,mCAAmC;SACxD;QACD,OAAO,EAAE;YACP,WAAW,EAAE,iBAAiB;YAC9B,UAAU,EAAE,gBAAgB;YAC5B,OAAO,EAAE,aAAa;YACtB,SAAS,EAAE,eAAe;YAC1B,aAAa,EAAE,mBAAmB;YAClC,eAAe,EAAE,qBAAqB;YACtC,UAAU,EAAE,gBAAgB;YAC5B,UAAU,EAAE,gBAAgB;YAC5B,YAAY,EAAE,kBAAkB;YAChC,eAAe,EAAE,qBAAqB;YACtC,iBAAiB,EAAE,uBAAuB;YAC1C,2BAA2B,EAAE,iCAAiC;YAC9D,oBAAoB,EAAE,0BAA0B;YAChD,qBAAqB,EAAE,2BAA2B;YAClD,uBAAuB,EAAE,6BAA6B;YACtD,6BAA6B,EAAE,mCAAmC;YAClE,uBAAuB,EAAE,6BAA6B;YACtD,4BAA4B,EAAE,kCAAkC;YAChE,4BAA4B,EAAE,kCAAkC;YAChE,qBAAqB,EAAE,2BAA2B;YAClD,wBAAwB,EAAE,8BAA8B;YACxD,+BAA+B,EAAE,qCAAqC;YACtE,gBAAgB,EAAE,sBAAsB;YACxC,iBAAiB,EAAE,uBAAuB;YAC1C,mBAAmB,EAAE,yBAAyB;YAC9C,2BAA2B,EAAE,iCAAiC;YAC9D,2BAA2B,EAAE,iCAAiC;YAC9D,yBAAyB,EAAE,+BAA+B;YAC1D,0BAA0B,EAAE,gCAAgC;YAC5D,+BAA+B,EAAE,qCAAqC;YACtE,iCAAiC,EAC/B,uCAAuC;YACzC,qCAAqC,EACnC,2CAA2C;YAC7C,sCAAsC,EACpC,4CAA4C;SAC/C;KACF,CAAC,CAAC;IAEH,MAAM,WAAW,GAAgB;QAC/B,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,qBAAqB,SAAS,0CAA0C;QACrF,aAAa,EAAE,IAAI;QACnB,0BAA0B,EAAE,KAAK;QACjC,qBAAqB,EAAE,KAAK;QAC5B,WAAW,EAAE,IAAI;QACjB,wBAAwB,EAAE,KAAK;QAC/B,uBAAuB,EAAE,qBAAqB;KAC/C,CAAC;IAEF,IAAI,OAAgB,CAAC;IAErB,IAAI,eAAe,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,CACV,8BAA8B,WAAW,SAAS,eAAe,CAAC,EAAE,GAAG,CACxE,CAAC;QACF,OAAO,GAAG,MAAM,aAAa,CAC3B,QAAQ,EACR,SAAS,EACT,eAAe,CAAC,EAAE,EAClB,WAAW,CACZ,CAAC;QACF,QAAQ,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;QACrD,OAAO,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAChE,QAAQ,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAE/C,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,QAAY,EACZ,SAAiB,EACjB,SAAiB,EACM,EAAE;IACzB,MAAM,SAAS,GAAG,YAAY,SAAS,EAAE,CAAC;IAE1C,QAAQ,CAAC,GAAG,CAAC,uCAAuC,SAAS,EAAE,CAAC,CAAC;IAEjE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAEpE,uDAAuD;IACvD,MAAM,mBAAmB,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1D,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,SAAS,EAAE,CAAC,CACtD,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,mBAAmB,EAAE,CAAC;QACxC,QAAQ,CAAC,GAAG,CACV,oCAAoC,KAAK,CAAC,WAAW,SAAS,KAAK,CAAC,EAAE,GAAG,CAC1E,CAAC;QACF,MAAM,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,2BAA2B;IAC3B,MAAM,WAAW,GAAG,GAAG,SAAS,8BAA8B,SAAS,EAAE,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAE5E,QAAQ,CAAC,GAAG,CAAC,gCAAgC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,QAAQ,CAAC,GAAG,CAAC,gBAAgB,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,QAAQ,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAE5C,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,EACtB,QAAY,EACZ,SAAiB,EACjB,WAAwB,EACxB,EAAE;IACF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC;IAEzD,QAAQ,CAAC,GAAG,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;IAElD,qCAAqC;IACrC,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAC/C,QAAQ,EACR,SAAS,EACT,SAAS,CACV,CAAC;IAEF,+BAA+B;IAC/B,MAAM,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAE5E,QAAQ,CAAC,GAAG,CAAC,WAAW,SAAS,kBAAkB,CAAC,CAAC;AACvD,CAAC,CAAC;AAEK,MAAM,WAAW,GAAG,KAAK,EAAE,QAAY,EAAE,EAAE;;IAChD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IAExC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,MAAA,MAAM,CAAC,MAAM,mCAAI,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,YAAY,EAAE,CAAC;QACpD,IAAI,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,WAAW,EAAE,CAAC;YACjD,MAAM,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAC1C,QAAQ,CAAC,GAAG,CACV,gHAAgH,CACjH,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;IAC/D,QAAQ,CAAC,GAAG,CACV,wGAAwG,CACzG,CAAC;IACF,QAAQ,CAAC,GAAG,CACV,oGAAoG,CACrG,CAAC;AACJ,CAAC,CAAC;AAjCW,QAAA,WAAW,eAiCtB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupCloudRun.d.ts

@@ -0,0 +1,24 @@
+import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+export declare const CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+export declare const getCloudRunRequiredServices: (config: {
+    cloudSql?: unknown;
+}) => string[];
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+export declare const getCloudRunDeployRoles: (config: {
+    cloudSql?: unknown;
+}) => string[];
+export declare const setupCloudRun: (instance: IO, context: ComponentContext) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupCloudRun.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCloudRun = exports.getCloudRunDeployRoles = exports.getCloudRunRequiredServices = exports.CLOUD_RUN_DEPLOY_SA_NAME = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
+const enableServices_1 = require("../../../../../gcloud/enableServices");
+const getProjectNumber_1 = require("../../../../../gcloud/getProjectNumber");
+const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
+const updateCatladderStore_1 = require("../../../../../store/updateCatladderStore");
+exports.CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+const getCloudRunRequiredServices = (config) => [
+    "run.googleapis.com",
+    "artifactregistry.googleapis.com",
+    "cloudscheduler.googleapis.com", // for scheduling jobs
+    "cloudresourcemanager.googleapis.com", // only required to get google cloud project number
+    ...(config.cloudSql
+        ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"]
+        : []),
+];
+exports.getCloudRunRequiredServices = getCloudRunRequiredServices;
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+const getCloudRunDeployRoles = (config) => [
+    // TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
+    "roles/artifactregistry.repoAdmin",
+    "roles/run.admin",
+    "roles/iam.serviceAccountUser",
+    "roles/cloudscheduler.admin", // for scheduling
+    ...(config.cloudSql ? ["roles/cloudsql.admin"] : []),
+];
+exports.getCloudRunDeployRoles = getCloudRunDeployRoles;
+const setupCloudRun = async (instance, context) => {
+    var _a, _b;
+    if (!(0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
+        throw new Error("deploy config is not of type 'google-cloudrun'");
+    }
+    const config = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
+    // enable services
+    instance.log("enable required services...");
+    await (0, enableServices_1.enableGCloudServices)((0, exports.getCloudRunRequiredServices)(config), config);
+    instance.log("upsert artifacts registry...");
+    await (0, artifactsRegistry_1.upsertGcloudArtifactsRegistry)(config);
+    instance.log("upsert deploy service account...");
+    await (0, serviceAccounts_1.upsertGcloudServiceAccountAndSaveSecret)(instance, context, {
+        projectId: config.projectId,
+        displayName: "Catladder gcloud deploy",
+        description: "This service account deploys to google cloud",
+        name: exports.CLOUD_RUN_DEPLOY_SA_NAME,
+        roles: (0, exports.getCloudRunDeployRoles)(config),
+    }, pipeline_1.GCLOUD_DEPLOY_CREDENTIALS_KEY);
+    // the project number is needed at generation time to construct cloud
+    // run's deterministic urls (<service>-<projectNumber>.<region>.run.app)
+    instance.log("fetch gcloud project number...");
+    const projectNumber = await (0, getProjectNumber_1.fetchGcloudProjectNumber)(config.projectId);
+    instance.log("project number: " + projectNumber);
+    await (0, updateCatladderStore_1.updateCatladderStore)((store) => ({
+        ...store,
+        gcloudProjects: {
+            ...store.gcloudProjects,
+            [config.projectId]: { projectNumber },
+        },
+    }));
+};
+exports.setupCloudRun = setupCloudRun;
+//# sourceMappingURL=setupCloudRun.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupCloudRun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupCloudRun.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAG7B,+EAAwF;AACxF,yEAA4E;AAC5E,6EAAkF;AAClF,2EAAgG;AAChG,oFAAiF;AAEpE,QAAA,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACI,MAAM,2BAA2B,GAAG,CAAC,MAE3C,EAAY,EAAE,CAAC;IACd,oBAAoB;IACpB,iCAAiC;IACjC,+BAA+B,EAAE,sBAAsB;IACvD,qCAAqC,EAAE,mDAAmD;IAC1F,GAAG,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;CACR,CAAC;AAVW,QAAA,2BAA2B,+BAUtC;AAEF;;;;;;GAMG;AACI,MAAM,sBAAsB,GAAG,CAAC,MAEtC,EAAY,EAAE,CAAC;IACd,yLAAyL;IACzL,kCAAkC;IAClC,iBAAiB;IACjB,8BAA8B;IAC9B,4BAA4B,EAAE,iBAAiB;IAC/C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC;AATW,QAAA,sBAAsB,0BASjC;AAEK,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAEtC,kBAAkB;IAElB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC5C,MAAM,IAAA,qCAAoB,EAAC,IAAA,mCAA2B,EAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,MAAM,IAAA,iDAA6B,EAAC,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD,MAAM,IAAA,yDAAuC,EAC3C,QAAQ,EACR,OAAO,EACP;QACE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,gCAAwB;QAC9B,KAAK,EAAE,IAAA,8BAAsB,EAAC,MAAM,CAAC;KACtC,EACD,wCAA6B,CAC9B,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,IAAA,2CAAwB,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC;IAEjD,MAAM,IAAA,2CAAoB,EAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,KAAK;QACR,cAAc,EAAE;YACd,GAAG,KAAK,CAAC,cAAc;YACvB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE;SACtC;KACF,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AA5CW,QAAA,aAAa,iBA4CxB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupContext.d.ts

@@ -0,0 +1,3 @@
+import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+export declare const setupContext: (instance: IO, context: ComponentContext) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupContext.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupContext = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const setupCloudRun_1 = require("./setupCloudRun");
+const setupKubernetes_1 = require("./setupKubernetes");
+const logSection_1 = require("./logSection");
+const setupContext = async (instance, context) => {
+    await (0, logSection_1.logSection)(instance, "setting up " + context.env + ":" + context.name, async () => {
+        var _a, _b;
+        if ((0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
+            await (0, setupCloudRun_1.setupCloudRun)(instance, context);
+        }
+        const deployConfig = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
+        if ((0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+            await (0, setupKubernetes_1.setupKubernetes)(instance, context);
+        }
+    });
+};
+exports.setupContext = setupContext;
+//# sourceMappingURL=setupContext.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupContext.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupContext.ts"],"names":[],"mappings":";;;AACA,kDAAqD;AAErD,mDAAgD;AAEhD,uDAAoD;AACpD,6CAA0C;AAEnC,MAAM,YAAY,GAAG,KAAK,EAAE,QAAY,EAAE,OAAyB,EAAE,EAAE;IAC5E,MAAM,IAAA,uBAAU,EACd,QAAQ,EACR,aAAa,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,EAChD,KAAK,IAAI,EAAE;;QACT,IAAI,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAA,6BAAa,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;QAC5C,IAAI,IAAA,yBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC/C,MAAM,IAAA,iCAAe,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC;AAfW,QAAA,YAAY,gBAevB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.d.ts

@@ -0,0 +1,20 @@
+import type { Config } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+/**
+ * configures github merge gating — the sane default gitlab ships
+ * built-in and a fresh github repository lacks entirely: without it a
+ * PR is mergeable the moment it opens, checks still running, and the
+ * auto-merge button never appears.
+ *
+ * - repo settings: allow auto-merge, delete merged head branches
+ * - branch protection on the default branch: require the generated
+ *   `catladder ✅` aggregate check (the one stable context — individual
+ *   job names change with every component add/rename)
+ *
+ * Deliberately non-destructive: existing protection settings
+ * (enforce-admins, required reviews, restrictions, strictness) are
+ * preserved; the aggregate context is merged into the required checks
+ * rather than replacing them. Admins can still bypass per PR — this is
+ * a default, not a cage.
+ */
+export declare const setupGithub: (instance: IO, config: Config) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupGithub = void 0;
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const commandSecretsSyncGithub_1 = require("../../../../../commands/project/commandSecretsSyncGithub");
+const github_1 = require("../../../../../utils/github");
+/**
+ * configures github merge gating — the sane default gitlab ships
+ * built-in and a fresh github repository lacks entirely: without it a
+ * PR is mergeable the moment it opens, checks still running, and the
+ * auto-merge button never appears.
+ *
+ * - repo settings: allow auto-merge, delete merged head branches
+ * - branch protection on the default branch: require the generated
+ *   `catladder ✅` aggregate check (the one stable context — individual
+ *   job names change with every component add/rename)
+ *
+ * Deliberately non-destructive: existing protection settings
+ * (enforce-admins, required reviews, restrictions, strictness) are
+ * preserved; the aggregate context is merged into the required checks
+ * rather than replacing them. Admins can still bypass per PR — this is
+ * a default, not a cage.
+ */
+const setupGithub = async (instance, config) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        instance.log("⚠️ github cli (gh) not authenticated — skipping github merge-gating setup (run: gh auth login)");
+        return;
+    }
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        instance.log(`⚠️ no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — skipping github merge-gating setup`);
+        return;
+    }
+    const repoInfo = await (0, github_1.ghApiJson)("GET", `repos/${repo}`);
+    if (!repoInfo.allow_auto_merge || !repoInfo.delete_branch_on_merge) {
+        await (0, github_1.ghApiJson)("PATCH", `repos/${repo}`, {
+            allow_auto_merge: true,
+            delete_branch_on_merge: true,
+        });
+        instance.log("✅ auto-merge + delete-merged-branches enabled");
+    }
+    else {
+        instance.log("✅ auto-merge already enabled");
+    }
+    const branch = repoInfo.default_branch;
+    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null); // 404: branch not protected yet
+    const existingChecks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
+    if (existingChecks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
+        instance.log(`✅ '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' already required on ${branch}`);
+        return;
+    }
+    // merge into whatever protection exists; PUT replaces the whole rule,
+    // so every preserved setting must be carried over explicitly
+    await (0, github_1.ghApiJson)("PUT", `repos/${repo}/branches/${branch}/protection`, {
+        required_status_checks: {
+            strict: (_d = (_c = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _c === void 0 ? void 0 : _c.strict) !== null && _d !== void 0 ? _d : false,
+            checks: [
+                ...existingChecks.map(({ context, app_id }) => ({
+                    context,
+                    ...(app_id !== undefined ? { app_id } : {}),
+                })),
+                { context: pipeline_1.AGGREGATE_CHECK_JOB_NAME },
+            ],
+        },
+        enforce_admins: (_f = (_e = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _e === void 0 ? void 0 : _e.enabled) !== null && _f !== void 0 ? _f : false,
+        required_pull_request_reviews: (protection === null || protection === void 0 ? void 0 : protection.required_pull_request_reviews)
+            ? {
+                required_approving_review_count: (_g = protection.required_pull_request_reviews
+                    .required_approving_review_count) !== null && _g !== void 0 ? _g : 0,
+                dismiss_stale_reviews: (_h = protection.required_pull_request_reviews.dismiss_stale_reviews) !== null && _h !== void 0 ? _h : false,
+                require_code_owner_reviews: (_j = protection.required_pull_request_reviews
+                    .require_code_owner_reviews) !== null && _j !== void 0 ? _j : false,
+            }
+            : null,
+        restrictions: (protection === null || protection === void 0 ? void 0 : protection.restrictions)
+            ? {
+                users: protection.restrictions.users.map((u) => u.login),
+                teams: protection.restrictions.teams.map((t) => t.slug),
+                apps: protection.restrictions.apps.map((a) => a.slug),
+            }
+            : null,
+        allow_force_pushes: (_l = (_k = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _k === void 0 ? void 0 : _k.enabled) !== null && _l !== void 0 ? _l : false,
+        allow_deletions: (_o = (_m = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _m === void 0 ? void 0 : _m.enabled) !== null && _o !== void 0 ? _o : false,
+    });
+    instance.log(`✅ branch protection on ${branch}: '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required (merges now wait for the pipeline)`);
+};
+exports.setupGithub = setupGithub;
+//# sourceMappingURL=setupGithub.js.map

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uGAAmG;AAEnG,wDAA2E;AAE3E;;;;;;;;;;;;;;;;GAgBG;AACI,MAAM,WAAW,GAAG,KAAK,EAAE,QAAY,EAAE,MAAc,EAAE,EAAE;;IAChE,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,gGAAgG,CACjG,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,yCAAyC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,+CAA+C,CAC/H,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAI7B,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAE3B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACnE,MAAM,IAAA,kBAAS,EAAC,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE;YACxC,gBAAgB,EAAE,IAAI;YACtB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAS,EAChC,KAAK,EACL,SAAS,IAAI,aAAa,MAAM,aAAa,CAC9C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC;IAErD,MAAM,cAAc,GAClB,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,EAAE,CAAC;IACnD,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,EAAE,CAAC;QACvE,QAAQ,CAAC,GAAG,CACV,MAAM,mCAAwB,yBAAyB,MAAM,EAAE,CAChE,CAAC;QACF,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa,EAAE;QACpE,sBAAsB,EAAE;YACtB,MAAM,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,KAAK;YAC3D,MAAM,EAAE;gBACN,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC9C,OAAO;oBACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;gBACH,EAAE,OAAO,EAAE,mCAAwB,EAAE;aACtC;SACF;QACD,cAAc,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,cAAc,0CAAE,OAAO,mCAAI,KAAK;QAC5D,6BAA6B,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,6BAA6B;YACtE,CAAC,CAAC;gBACE,+BAA+B,EAC7B,MAAA,UAAU,CAAC,6BAA6B;qBACrC,+BAA+B,mCAAI,CAAC;gBACzC,qBAAqB,EACnB,MAAA,UAAU,CAAC,6BAA6B,CAAC,qBAAqB,mCAC9D,KAAK;gBACP,0BAA0B,EACxB,MAAA,UAAU,CAAC,6BAA6B;qBACrC,0BAA0B,mCAAI,KAAK;aACzC;YACH,CAAC,CAAC,IAAI;QACR,YAAY,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY;YACpC,CAAC,CAAC;gBACE,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5D,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAC3D;YACH,CAAC,CAAC,IAAI;QACR,kBAAkB,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,kBAAkB,0CAAE,OAAO,mCAAI,KAAK;QACpE,eAAe,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,eAAe,0CAAE,OAAO,mCAAI,KAAK;KAC/D,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CACV,0BAA0B,MAAM,MAAM,mCAAwB,+CAA+C,CAC9G,CAAC;AACJ,CAAC,CAAC;AAzFW,QAAA,WAAW,eAyFtB"}

package/dist/apps/cli/src/apps/cli/commands/project/setup/setupKubernetes.d.ts

@@ -0,0 +1,3 @@
+import type { ComponentContext } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { IO } from "../../../../../core/types";
+export declare const setupKubernetes: (instance: IO, context: ComponentContext) => Promise<void>;