@catladder/cli 0.0.0-main-a6b45abe → 0.0.0-main-fd9c5f51

package/dist/bundles/catenv/index.js

@@ -3581,6 +3581,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/bundles/cli/index.js

@@ -619,6 +619,7 @@ const pipeline_1 = __nccwpck_require__(53695);
 const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 const concurrency_1 = __nccwpck_require__(59723);
 const github_1 = __nccwpck_require__(41353);
+const githubMergeGating_1 = __nccwpck_require__(14966);
 /** marker for repo-level (environment-less) targets, see collectSecretTargets */
 const REPO_LEVEL = "";
 /**
@@ -722,10 +723,13 @@ const checkGithub = async (report, config) => {
 exports.checkGithub = checkGithub;
 /**
  * verifies the merge gating `project setup` configures: auto-merge
- * enabled and the generated `catladder ✅` aggregate check required on
- * the default branch. Without it a PR is mergeable while its checks
- * are still running — gitlab ships this behavior built-in, github
- * silently does not.
+ * enabled and the `catladder merge gating` ruleset requiring the
+ * generated `catladder ✅` aggregate check on the default branch (with
+ * the bypass that lets the release job push). Without the check a PR
+ * is mergeable while its checks are still running — gitlab ships this
+ * behavior built-in, github silently does not. The check required via
+ * classic branch protection instead is flagged: that setup rejects the
+ * release job's own push (GH006).
  */
 const checkGithubMergeGating = async (report, repo) => {
     var _a, _b;
@@ -744,17 +748,52 @@ const checkGithubMergeGating = async (report, repo) => {
         report.fail("auto-merge disabled — the merge-when-pipeline-succeeds button cannot appear", "run: catladder project setup");
     }
     const branch = repoInfo.default_branch;
+    let rulesets;
+    try {
+        rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
+    }
+    catch (e) {
+        report.warn(`could not list rulesets of ${repo} (${e.message})`);
+        return;
+    }
+    const named = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
+    const ruleset = named
+        ? await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${named.id}`).catch(() => null)
+        : null;
+    if (ruleset && (0, githubMergeGating_1.rulesetProvidesMergeGating)(ruleset)) {
+        report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, deploy-key bypass for the release push`);
+    }
+    else if (ruleset) {
+        report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or deploy-key bypass missing)`, "run: catladder project setup");
+    }
+    else {
+        report.fail(`no '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' ruleset on ${repo} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
+    }
+    try {
+        const [keys, secretNames] = await Promise.all([
+            (0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
+            (0, github_1.listGithubSecretNames)(repo),
+        ]);
+        const key = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
+        const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
+        if (key && !key.read_only && hasSecret) {
+            report.ok(`release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
+        }
+        else {
+            report.fail(`release deploy key incomplete (key: ${key ? (key.read_only ? "read-only" : "ok") : "missing"}, secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET}: ${hasSecret ? "set" : "missing"}) — the release job cannot push past the merge gating`, "run: catladder project setup");
+        }
+    }
+    catch (e) {
+        report.warn(`could not check the release deploy key (${e.message})`);
+    }
     const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null);
     const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
     if (checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
-        report.ok(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}`);
-    }
-    else {
-        report.fail(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' is not a required check on ${branch} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
+        report.fail(`'${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' is still required via classic branch protection on ${branch} — that rejects the release job's push (GH006)`, "run: catladder project setup");
     }
     const stale = checks.filter((c) => c.context !== pipeline_1.AGGREGATE_CHECK_JOB_NAME);
     if (stale.length > 0) {
-        report.warn(`${branch} requires ${stale.length} additional named check(s) (${stale
+        report.warn(`${branch} requires ${stale.length} additional named check(s) via classic branch protection (${stale
             .map((c) => c.context)
             .join(", ")}) — job names change with components; prefer only '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}'`);
     }
@@ -950,6 +989,93 @@ exports.doctorProject = doctorProject;
 
 /***/ }),
 
+/***/ 14966:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.RELEASE_DEPLOY_KEY_SECRET = exports.RELEASE_DEPLOY_KEY_TITLE = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+/**
+ * github merge gating — shared between `project setup` (writes it) and
+ * `project doctor` (verifies it).
+ *
+ * The gating lives in a repository RULESET, not classic branch
+ * protection: only rulesets can carry bypass actors, and the release
+ * job needs one. It pushes the release commit and tag straight to the
+ * default branch — under classic protection the required `catladder ✅`
+ * check rejects that push (GH006), because the fresh release commit
+ * cannot have a passing check yet.
+ *
+ * The bypass actor is a DEPLOY KEY: github deliberately refuses the
+ * built-in GitHub Actions app on bypass lists (any collaborator could
+ * push anywhere by authoring a workflow), so the workflow token can
+ * never bypass. Instead `project setup` provisions a write deploy key
+ * (public half on the repo, private half as an actions secret) and the
+ * release job pushes over ssh with it. Deploy keys are repo-scoped,
+ * only admins can add them, and they never expire — gitlab's
+ * counterpart is the maintainer-role `GL_TOKEN`, which has to be
+ * renewed yearly.
+ */
+/** the app id of GitHub Actions — the integration reporting the check */
+exports.GITHUB_ACTIONS_APP_ID = 15368;
+exports.MERGE_GATING_RULESET_NAME = "catladder merge gating";
+/** title of the deploy key `project setup` registers on the repo */
+exports.RELEASE_DEPLOY_KEY_TITLE = "catladder release";
+/**
+ * actions secret holding the deploy key's private half; the generated
+ * release jobs pass it to catci, which pushes over ssh when it is set
+ */
+exports.RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
+/** the ruleset `project setup` creates (and restores on drift) */
+const desiredMergeGatingRuleset = () => ({
+    name: exports.MERGE_GATING_RULESET_NAME,
+    target: "branch",
+    enforcement: "active",
+    conditions: { ref_name: { include: ["~DEFAULT_BRANCH"], exclude: [] } },
+    rules: [
+        {
+            type: "required_status_checks",
+            parameters: {
+                strict_required_status_checks_policy: false,
+                do_not_enforce_on_create: false,
+                required_status_checks: [
+                    {
+                        context: pipeline_1.AGGREGATE_CHECK_JOB_NAME,
+                        integration_id: exports.GITHUB_ACTIONS_APP_ID,
+                    },
+                ],
+            },
+        },
+    ],
+    bypass_actors: [
+        // deploy keys carry no id — the bypass covers every deploy key of
+        // the repository (adding one requires admin anyway)
+        { actor_id: null, actor_type: "DeployKey", bypass_mode: "always" },
+    ],
+});
+exports.desiredMergeGatingRuleset = desiredMergeGatingRuleset;
+/**
+ * whether a ruleset provides working merge gating: active, requires
+ * the aggregate check, and lets the release deploy key bypass it.
+ * Extra rules or bypass actors someone added are fine.
+ */
+const rulesetProvidesMergeGating = (ruleset) => {
+    var _a, _b;
+    return ruleset.enforcement === "active" &&
+        ((_a = ruleset.rules) !== null && _a !== void 0 ? _a : []).some((rule) => {
+            var _a, _b;
+            return rule.type === "required_status_checks" &&
+                ((_b = (_a = rule.parameters) === null || _a === void 0 ? void 0 : _a.required_status_checks) !== null && _b !== void 0 ? _b : []).some((check) => check.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME);
+        }) &&
+        ((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "DeployKey" && actor.bypass_mode === "always");
+};
+exports.rulesetProvidesMergeGating = rulesetProvidesMergeGating;
+//# sourceMappingURL=githubMergeGating.js.map
+
+/***/ }),
+
 /***/ 2231:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -1045,13 +1171,14 @@ const setupProject = async (instance, onlyComponents) => {
     });
     const enabledPipelines = config ? (0, pipeline_1.getEnabledPipelineTypes)(config) : [];
     await (0, logSection_1.logSection)(instance, "base setup", async () => {
-        // gitlab-specific provisioning (access token, agent webhooks) —
-        // meaningless (and failing) on a github-only project
+        // gitlab-specific provisioning (access token, agent webhooks, the
+        // `catladder` project topic) — meaningless (and failing) on a
+        // github-only project
         if (enabledPipelines.includes("gitlab")) {
             await (0, setupAccessTokens_1.setupAccessTokens)(instance);
             await (0, setupAgents_1.setupAgents)(instance);
+            await (0, setupTopic_1.setupTopic)(instance);
         }
-        await (0, setupTopic_1.setupTopic)(instance);
         if (config) {
             await (0, setupGithub_1.setupGithub)(instance, config);
         }
@@ -1434,8 +1561,15 @@ exports.setupContext = setupContext;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const child_process_1 = __nccwpck_require__(35317);
+const promises_1 = __nccwpck_require__(91943);
+const os_1 = __nccwpck_require__(70857);
+const path_1 = __nccwpck_require__(16928);
+const util_1 = __nccwpck_require__(39023);
 const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 const github_1 = __nccwpck_require__(41353);
+const githubMergeGating_1 = __nccwpck_require__(14966);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * configures github merge gating — the sane default gitlab ships
  * built-in and a fresh github repository lacks entirely: without it a
@@ -1443,18 +1577,22 @@ const github_1 = __nccwpck_require__(41353);
  * auto-merge button never appears.
  *
  * - repo settings: allow auto-merge, delete merged head branches
- * - branch protection on the default branch: require the generated
+ * - the release deploy key: a write deploy key on the repo, its
+ *   private half stored as the CATLADDER_RELEASE_KEY actions secret —
+ *   the release job pushes the release commit and tag with it
+ * - a repository ruleset on the default branch requiring the generated
  *   `catladder ✅` aggregate check (the one stable context — individual
- *   job names change with every component add/rename)
+ *   job names change with every component add/rename), with a deploy
+ *   key bypass so the release push goes through (see
+ *   githubMergeGating.ts for the full rationale)
  *
- * Deliberately non-destructive: existing protection settings
- * (enforce-admins, required reviews, restrictions, strictness) are
- * preserved; the aggregate context is merged into the required checks
- * rather than replacing them. Admins can still bypass per PR — this is
- * a default, not a cage.
+ * Earlier versions required the check via classic branch protection,
+ * which has no bypass list — the release job's direct push to the
+ * default branch bounced off catladder's own gating (GH006). Setup
+ * migrates that away: the aggregate context is removed from an
+ * existing classic rule, everything else in it is preserved.
  */
 const setupGithub = async (instance, config) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
     if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) {
         return;
     }
@@ -1478,34 +1616,128 @@ const setupGithub = async (instance, config) => {
     else {
         instance.log("✅ auto-merge already enabled");
     }
+    await ensureReleaseDeployKey(instance, repo);
     const branch = repoInfo.default_branch;
-    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null); // 404: branch not protected yet
-    const existingChecks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
-    if (existingChecks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
-        instance.log(`✅ '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' already required on ${branch}`);
+    const rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
+    const existing = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
+    if (!existing) {
+        await (0, github_1.ghApiJson)("POST", `repos/${repo}/rulesets`, (0, githubMergeGating_1.desiredMergeGatingRuleset)());
+        instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch} — merges wait for the pipeline, the release job can push`);
+    }
+    else {
+        const detail = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${existing.id}`);
+        if ((0, githubMergeGating_1.rulesetProvidesMergeGating)(detail)) {
+            instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' already in place on ${branch}`);
+        }
+        else {
+            await (0, github_1.ghApiJson)("PUT", `repos/${repo}/rulesets/${existing.id}`, (0, githubMergeGating_1.desiredMergeGatingRuleset)());
+            instance.log(`✅ ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' restored — '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required, release-job bypass in place`);
+        }
+    }
+    await migrateAwayFromClassicProtection(instance, repo, branch);
+};
+exports.setupGithub = setupGithub;
+/**
+ * provisions the release deploy key: an ed25519 keypair whose public
+ * half becomes a write deploy key on the repo and whose private half
+ * becomes the CATLADDER_RELEASE_KEY actions secret. The key and the
+ * secret only work as a pair, so when either half is missing the pair
+ * is rotated (github secrets are write-only — the private half can
+ * never be read back to check it matches).
+ */
+const ensureReleaseDeployKey = async (instance, repo) => {
+    const [keys, secretNames] = await Promise.all([
+        (0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
+        (0, github_1.listGithubSecretNames)(repo),
+    ]);
+    const existingKey = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
+    const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
+    if (existingKey && !existingKey.read_only && hasSecret) {
+        instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
         return;
     }
-    // merge into whatever protection exists; PUT replaces the whole rule,
-    // so every preserved setting must be carried over explicitly
+    if (existingKey) {
+        await (0, github_1.ghApiJson)("DELETE", `repos/${repo}/keys/${existingKey.id}`);
+        instance.log(`♻️ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' rotated (${existingKey.read_only
+            ? "was read-only"
+            : `secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} missing`})`);
+    }
+    const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "catladder-release-key-"));
+    try {
+        const keyFile = (0, path_1.join)(dir, "id_ed25519");
+        await execFile("ssh-keygen", [
+            ...["-t", "ed25519"],
+            ...["-C", `${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE} (${repo})`],
+            ...["-N", ""],
+            ...["-f", keyFile],
+            "-q",
+        ]);
+        const [privateKey, publicKey] = await Promise.all([
+            (0, promises_1.readFile)(keyFile, "utf-8"),
+            (0, promises_1.readFile)(`${keyFile}.pub`, "utf-8"),
+        ]);
+        await (0, github_1.ghApiJson)("POST", `repos/${repo}/keys`, {
+            title: githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE,
+            key: publicKey.trim(),
+            read_only: false,
+        });
+        await (0, github_1.setGithubSecret)(repo, githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET, privateKey);
+    }
+    finally {
+        await (0, promises_1.rm)(dir, { recursive: true, force: true });
+    }
+    instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' registered, private half stored as secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} — the release job pushes with it`);
+};
+/**
+ * removes the aggregate check from a classic branch protection rule
+ * set up by earlier catladder versions — with the check now required
+ * via the ruleset, the classic one would still reject the release
+ * job's push. Everything else in the rule is preserved; the whole rule
+ * is deleted when the check was all it carried.
+ */
+const migrateAwayFromClassicProtection = async (instance, repo, branch) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1;
+    const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null); // 404: branch not protected
+    const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
+    if (!checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
+        return;
+    }
+    const remaining = checks.filter((c) => c.context !== pipeline_1.AGGREGATE_CHECK_JOB_NAME);
+    const carriesAnythingElse = remaining.length > 0 ||
+        ((_c = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _c === void 0 ? void 0 : _c.enabled) ||
+        (protection === null || protection === void 0 ? void 0 : protection.required_pull_request_reviews) ||
+        (protection === null || protection === void 0 ? void 0 : protection.restrictions) ||
+        ((_d = protection === null || protection === void 0 ? void 0 : protection.required_linear_history) === null || _d === void 0 ? void 0 : _d.enabled) ||
+        ((_e = protection === null || protection === void 0 ? void 0 : protection.required_conversation_resolution) === null || _e === void 0 ? void 0 : _e.enabled) ||
+        ((_f = protection === null || protection === void 0 ? void 0 : protection.required_signatures) === null || _f === void 0 ? void 0 : _f.enabled) ||
+        ((_g = protection === null || protection === void 0 ? void 0 : protection.lock_branch) === null || _g === void 0 ? void 0 : _g.enabled) ||
+        ((_h = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _h === void 0 ? void 0 : _h.enabled) ||
+        ((_j = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _j === void 0 ? void 0 : _j.enabled);
+    if (!carriesAnythingElse) {
+        await (0, github_1.ghApiJson)("DELETE", `repos/${repo}/branches/${branch}/protection`);
+        instance.log(`✅ classic branch protection on ${branch} removed — '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' was all it carried, and it is now required via the ruleset`);
+        return;
+    }
+    // PUT replaces the whole rule, so every preserved setting must be
+    // carried over explicitly
     await (0, github_1.ghApiJson)("PUT", `repos/${repo}/branches/${branch}/protection`, {
-        required_status_checks: {
-            strict: (_d = (_c = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _c === void 0 ? void 0 : _c.strict) !== null && _d !== void 0 ? _d : false,
-            checks: [
-                ...existingChecks.map(({ context, app_id }) => ({
+        required_status_checks: remaining.length > 0
+            ? {
+                strict: (_l = (_k = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _k === void 0 ? void 0 : _k.strict) !== null && _l !== void 0 ? _l : false,
+                checks: remaining.map(({ context, app_id }) => ({
                     context,
                     ...(app_id !== undefined ? { app_id } : {}),
                 })),
-                { context: pipeline_1.AGGREGATE_CHECK_JOB_NAME },
-            ],
-        },
-        enforce_admins: (_f = (_e = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _e === void 0 ? void 0 : _e.enabled) !== null && _f !== void 0 ? _f : false,
+            }
+            : null,
+        enforce_admins: (_o = (_m = protection === null || protection === void 0 ? void 0 : protection.enforce_admins) === null || _m === void 0 ? void 0 : _m.enabled) !== null && _o !== void 0 ? _o : false,
         required_pull_request_reviews: (protection === null || protection === void 0 ? void 0 : protection.required_pull_request_reviews)
             ? {
-                required_approving_review_count: (_g = protection.required_pull_request_reviews
-                    .required_approving_review_count) !== null && _g !== void 0 ? _g : 0,
-                dismiss_stale_reviews: (_h = protection.required_pull_request_reviews.dismiss_stale_reviews) !== null && _h !== void 0 ? _h : false,
-                require_code_owner_reviews: (_j = protection.required_pull_request_reviews
-                    .require_code_owner_reviews) !== null && _j !== void 0 ? _j : false,
+                required_approving_review_count: (_p = protection.required_pull_request_reviews
+                    .required_approving_review_count) !== null && _p !== void 0 ? _p : 0,
+                dismiss_stale_reviews: (_q = protection.required_pull_request_reviews.dismiss_stale_reviews) !== null && _q !== void 0 ? _q : false,
+                require_code_owner_reviews: (_r = protection.required_pull_request_reviews
+                    .require_code_owner_reviews) !== null && _r !== void 0 ? _r : false,
             }
             : null,
         restrictions: (protection === null || protection === void 0 ? void 0 : protection.restrictions)
@@ -1515,12 +1747,14 @@ const setupGithub = async (instance, config) => {
                 apps: protection.restrictions.apps.map((a) => a.slug),
             }
             : null,
-        allow_force_pushes: (_l = (_k = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _k === void 0 ? void 0 : _k.enabled) !== null && _l !== void 0 ? _l : false,
-        allow_deletions: (_o = (_m = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _m === void 0 ? void 0 : _m.enabled) !== null && _o !== void 0 ? _o : false,
+        required_linear_history: (_t = (_s = protection === null || protection === void 0 ? void 0 : protection.required_linear_history) === null || _s === void 0 ? void 0 : _s.enabled) !== null && _t !== void 0 ? _t : false,
+        required_conversation_resolution: (_v = (_u = protection === null || protection === void 0 ? void 0 : protection.required_conversation_resolution) === null || _u === void 0 ? void 0 : _u.enabled) !== null && _v !== void 0 ? _v : false,
+        lock_branch: (_x = (_w = protection === null || protection === void 0 ? void 0 : protection.lock_branch) === null || _w === void 0 ? void 0 : _w.enabled) !== null && _x !== void 0 ? _x : false,
+        allow_force_pushes: (_z = (_y = protection === null || protection === void 0 ? void 0 : protection.allow_force_pushes) === null || _y === void 0 ? void 0 : _y.enabled) !== null && _z !== void 0 ? _z : false,
+        allow_deletions: (_1 = (_0 = protection === null || protection === void 0 ? void 0 : protection.allow_deletions) === null || _0 === void 0 ? void 0 : _0.enabled) !== null && _1 !== void 0 ? _1 : false,
     });
-    instance.log(`✅ branch protection on ${branch}: '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required (merges now wait for the pipeline)`);
+    instance.log(`✅ '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' removed from classic branch protection on ${branch} — now required via the ruleset; the rest of the rule is preserved`);
 };
-exports.setupGithub = setupGithub;
 //# sourceMappingURL=setupGithub.js.map
 
 /***/ }),
@@ -9513,6 +9747,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/bundles/runner-images/changesets/Dockerfile

@@ -1,6 +1,7 @@
 FROM node:lts-alpine
 
-RUN apk add --no-cache bash git git-lfs
+# openssh: the release job pushes with the release deploy key over ssh
+RUN apk add --no-cache bash git git-lfs openssh-client
 
 # no release tooling baked in: the changesets release logic lives in
 # catci, which is materialized into the repository checkout

package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md

@@ -260,13 +260,21 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   PR is mergeable the moment it opens, checks still running, and the
   auto-merge button does not even appear. `yarn catladder project setup`
   configures it: auto-merge + delete-merged-branches on the repo, and a
-  branch protection rule on the default branch requiring the generated
-  **`catladder ✅`** aggregate check (the one stable context — never
-  require individual job names, they change with every component
-  add/rename and a stale required name blocks its own PR forever).
-  `project doctor` verifies it. Two things stay human choices: "Do not
-  allow bypassing" (leave it off — generated CI means a generation bug
-  can only be fixed via the admin bypass) and required reviews.
+  repository **ruleset** (`catladder merge gating`) on the default
+  branch requiring the generated **`catladder ✅`** aggregate check
+  (the one stable context — never require individual job names, they
+  change with every component add/rename and a stale required name
+  blocks its own PR forever). The ruleset carries a **deploy-key
+  bypass**: the release job pushes the release commit and tag straight
+  to the default branch, which the required check would otherwise
+  reject (GH006) — and github deliberately never lets the workflow
+  token bypass rulesets, so setup provisions a write deploy key
+  ("catladder release", private half in the `CATLADDER_RELEASE_KEY`
+  actions secret; deploy keys never expire) that the release job
+  pushes with over ssh. Classic branch protection has no bypass list
+  at all, which is why setup uses a ruleset and migrates old
+  classic-protection gating away. `project doctor` verifies all of it.
+  Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,

package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

@@ -57,6 +57,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"githubReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/githubReleaseJobs.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AACvD,uDAA8D;AAC9D,2CAAiD;AACjD,2DAAkE;AAIlE,MAAM,KAAK,GAAG,GAAG,qCAAsB,WAAW,CAAC;AAEnD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CACjC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,EAAE,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,KAAK;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAA,2CAAyB,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,MAAqB,EACrB,UAqBI,EAAE,EACK,EAAE;;IACb,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,CAAC,OAAO,CAAC,cAAc;QACvB,QAAQ,CAAC,IAAI;QACb,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,QAAQ,EAAE,qBAAqB;wBAC/B,QAAQ,EAAE,qBAAqB;qBAChC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,2CAA2C;QAC3C,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,EAAE;YACH,YAAY,EAAE,qBAAqB;YACnC,GAAG,OAAO,CAAC,QAAQ;SACpB;QACD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,2DAA2D;gBAC3D,wDAAwD;gBACxD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;aAC3B;YACD,GAAG,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,qBAAqB;wBAC3B,EAAE,EAAE,OAAO;wBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,EAAE,QAAQ,KAAK,6BAA6B;wBAC/C,KAAK,EAAE,MAAM;qBACd;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,OAAO,CAAC,UAAU;oBACpB,CAAC,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,EAAE,MAAM,CAAC,MAAM;gBAClB,KAAK,EAAE,MAAM;aACd;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,kBAA4B,EAC5B,MAAqB,EACM,EAAE;;IAC7B,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;YACjD,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,oBAAoB,wBAa/B;AAEF;;;;;;;;;;GAUG;AACI,MAAM,8BAA8B,GAAG,CAC5C,MAAc,EACd,MAAqB,EACrB,WAAmC,EACnB,EAAE;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;QAC3C,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC;gBACE,YAAY,EAAE,sBAAsB;gBACpC,mDAAmD;gBACnD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnD,GAAG;oBACH,yBAAyB,KAAK,YAAY;iBAC3C,CAAC,CACH;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE;YACF,iBAAiB,EAAE,cAAc;gBAC/B,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,KAAK,EAAE;4BACL,WAAW,EACT,uFAAuF;4BACzF,QAAQ,EAAE,KAAK;4BACf,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,KAAK;yBACf;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE;SACP;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC;YAC7C,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,+BAA+B,GAAG,CAC7C,MAAc,EACd,MAAqB,EACrB,gBAAwB,EACxB,WAAmC,EACZ,EAAE;;IACzB,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE;YACF,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,gBAAgB,CAAC;gBAC7B,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB;SACF;QACD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,+CAA+C;gBAC/C,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,GAAG,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE;gBAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;gBAC1D,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;oBACjD;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,EAAE,EAAE,OAAO;wBACX,GAAG,EAAE,QAAQ,KAAK,0HAA0H;wBAC5I,KAAK,EAAE,MAAM;qBACd;iBACF;aACF;YACD,gBAAgB,EAAE;gBAChB,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;oBAClC,KAAK,EAAE,CAAC,OAAO,CAAC;oBAChB,cAAc,EAAE,IAAI;iBACrB,CAAC;gBACF,EAAE,EAAE,8CAA8C;aACnD;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AA7CW,QAAA,+BAA+B,mCA6C1C;AAEF;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAChD,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;oBAC3B,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,QAAQ,EAAE,qBAAqB;4BAC/B,QAAQ,EAAE,qBAAqB;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,MAAM;gBAChB,eAAe,EAAE,OAAO;gBACxB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,mBAAmB,EAAE,IAAI;YACzB,GAAG,EAAE;gBACH,YAAY,EAAE,qBAAqB;aACpC;YACD,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,qBAAqB;oBAC3B,4DAA4D;oBAC5D,cAAc;oBACd,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;iBAC3B;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,GAAG,EAAE,MAAM,CAAC,WAAW;oBACvB,KAAK,EAAE,MAAM;iBACd;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAtDW,QAAA,yBAAyB,6BAsDpC"}
+{"version":3,"file":"githubReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/githubReleaseJobs.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AACvD,uDAA8D;AAC9D,2CAAiD;AACjD,2DAAkE;AAIlE,MAAM,KAAK,GAAG,GAAG,qCAAsB,WAAW,CAAC;AAEnD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CACjC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,EAAE,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,KAAK;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAA,2CAAyB,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,MAAqB,EACrB,UAqBI,EAAE,EACK,EAAE;;IACb,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,CAAC,OAAO,CAAC,cAAc;QACvB,QAAQ,CAAC,IAAI;QACb,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,QAAQ,EAAE,qBAAqB;wBAC/B,QAAQ,EAAE,qBAAqB;qBAChC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,2CAA2C;QAC3C,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,EAAE;YACH,YAAY,EAAE,qBAAqB;YACnC,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,qBAAqB,EAAE,sCAAsC;YAC7D,GAAG,OAAO,CAAC,QAAQ;SACpB;QACD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,2DAA2D;gBAC3D,wDAAwD;gBACxD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;aAC3B;YACD,GAAG,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,qBAAqB;wBAC3B,EAAE,EAAE,OAAO;wBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,EAAE,QAAQ,KAAK,6BAA6B;wBAC/C,KAAK,EAAE,MAAM;qBACd;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,OAAO,CAAC,UAAU;oBACpB,CAAC,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,EAAE,MAAM,CAAC,MAAM;gBAClB,KAAK,EAAE,MAAM;aACd;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,kBAA4B,EAC5B,MAAqB,EACM,EAAE;;IAC7B,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;YACjD,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,oBAAoB,wBAa/B;AAEF;;;;;;;;;;GAUG;AACI,MAAM,8BAA8B,GAAG,CAC5C,MAAc,EACd,MAAqB,EACrB,WAAmC,EACnB,EAAE;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;QAC3C,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC;gBACE,YAAY,EAAE,sBAAsB;gBACpC,mDAAmD;gBACnD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnD,GAAG;oBACH,yBAAyB,KAAK,YAAY;iBAC3C,CAAC,CACH;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE;YACF,iBAAiB,EAAE,cAAc;gBAC/B,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,KAAK,EAAE;4BACL,WAAW,EACT,uFAAuF;4BACzF,QAAQ,EAAE,KAAK;4BACf,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,KAAK;yBACf;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE;SACP;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC;YAC7C,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,+BAA+B,GAAG,CAC7C,MAAc,EACd,MAAqB,EACrB,gBAAwB,EACxB,WAAmC,EACZ,EAAE;;IACzB,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE;YACF,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,gBAAgB,CAAC;gBAC7B,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB;SACF;QACD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,+CAA+C;gBAC/C,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,GAAG,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE;gBAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;gBAC1D,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;oBACjD;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,EAAE,EAAE,OAAO;wBACX,GAAG,EAAE,QAAQ,KAAK,0HAA0H;wBAC5I,KAAK,EAAE,MAAM;qBACd;iBACF;aACF;YACD,gBAAgB,EAAE;gBAChB,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;oBAClC,KAAK,EAAE,CAAC,OAAO,CAAC;oBAChB,cAAc,EAAE,IAAI;iBACrB,CAAC;gBACF,EAAE,EAAE,8CAA8C;aACnD;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AA7CW,QAAA,+BAA+B,mCA6C1C;AAEF;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAChD,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;oBAC3B,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,QAAQ,EAAE,qBAAqB;4BAC/B,QAAQ,EAAE,qBAAqB;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,MAAM;gBAChB,eAAe,EAAE,OAAO;gBACxB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,mBAAmB,EAAE,IAAI;YACzB,GAAG,EAAE;gBACH,YAAY,EAAE,qBAAqB;aACpC;YACD,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,qBAAqB;oBAC3B,4DAA4D;oBAC5D,cAAc;oBACd,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;iBAC3B;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,GAAG,EAAE,MAAM,CAAC,WAAW;oBACvB,KAAK,EAAE,MAAM;iBACd;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAtDW,QAAA,yBAAyB,6BAsDpC"}

package/dist/runner-images/changesets/Dockerfile

@@ -1,6 +1,7 @@
 FROM node:lts-alpine
 
-RUN apk add --no-cache bash git git-lfs
+# openssh: the release job pushes with the release deploy key over ssh
+RUN apk add --no-cache bash git git-lfs openssh-client
 
 # no release tooling baked in: the changesets release logic lives in
 # catci, which is materialized into the repository checkout

package/dist/skills/catladder-migrate-ci-backend/SKILL.md

@@ -260,13 +260,21 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   PR is mergeable the moment it opens, checks still running, and the
   auto-merge button does not even appear. `yarn catladder project setup`
   configures it: auto-merge + delete-merged-branches on the repo, and a
-  branch protection rule on the default branch requiring the generated
-  **`catladder ✅`** aggregate check (the one stable context — never
-  require individual job names, they change with every component
-  add/rename and a stale required name blocks its own PR forever).
-  `project doctor` verifies it. Two things stay human choices: "Do not
-  allow bypassing" (leave it off — generated CI means a generation bug
-  can only be fixed via the admin bypass) and required reviews.
+  repository **ruleset** (`catladder merge gating`) on the default
+  branch requiring the generated **`catladder ✅`** aggregate check
+  (the one stable context — never require individual job names, they
+  change with every component add/rename and a stale required name
+  blocks its own PR forever). The ruleset carries a **deploy-key
+  bypass**: the release job pushes the release commit and tag straight
+  to the default branch, which the required check would otherwise
+  reject (GH006) — and github deliberately never lets the workflow
+  token bypass rulesets, so setup provisions a write deploy key
+  ("catladder release", private half in the `CATLADDER_RELEASE_KEY`
+  actions secret; deploy keys never expire) that the release job
+  pushes with over ssh. Classic branch protection has no bypass list
+  at all, which is why setup uses a ruleset and migrates old
+  classic-protection gating away. `project doctor` verifies all of it.
+  Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,