@catladder/cli 0.0.0-main-bd7c0346 → 0.0.0-main-77e3e0e5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithub.js +19 -2
- package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithub.js.map +1 -1
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.d.ts +24 -11
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.js +28 -19
- package/dist/apps/cli/src/apps/cli/commands/project/githubMergeGating.js.map +1 -1
- package/dist/apps/cli/src/apps/cli/commands/project/setup/index.js +4 -3
- package/dist/apps/cli/src/apps/cli/commands/project/setup/index.js.map +1 -1
- package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.d.ts +6 -3
- package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.js +64 -3
- package/dist/apps/cli/src/apps/cli/commands/project/setup/setupGithub.js.map +1 -1
- package/dist/apps/cli/src/release/changesetsReleaseJob.js +54 -12
- package/dist/apps/cli/src/release/changesetsReleaseJob.js.map +1 -1
- package/dist/apps/cli/src/release/releaseGit.d.ts +2 -0
- package/dist/apps/cli/src/release/releaseGit.js +9 -1
- package/dist/apps/cli/src/release/releaseGit.js.map +1 -1
- package/dist/bundles/catci/index.js +5 -5
- package/dist/bundles/catenv/index.js +5 -0
- package/dist/bundles/cli/index.js +121 -28
- package/dist/bundles/runner-images/changesets/Dockerfile +2 -1
- package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md +11 -7
- package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js +5 -0
- package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js.map +1 -1
- package/dist/runner-images/changesets/Dockerfile +2 -1
- package/dist/skills/catladder-migrate-ci-backend/SKILL.md +11 -7
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +1 -1
- package/src/apps/cli/commands/project/__tests__/githubMergeGating.test.ts +19 -8
- package/src/apps/cli/commands/project/doctor/checkGithub.ts +32 -2
- package/src/apps/cli/commands/project/githubMergeGating.ts +29 -18
- package/src/apps/cli/commands/project/setup/index.ts +4 -3
- package/src/apps/cli/commands/project/setup/setupGithub.ts +88 -4
- package/src/release/changesetsReleaseJob.ts +71 -14
- package/src/release/releaseGit.ts +11 -0
|
@@ -147,14 +147,31 @@ const checkGithubMergeGating = async (report, repo) => {
|
|
|
147
147
|
? await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${named.id}`).catch(() => null)
|
|
148
148
|
: null;
|
|
149
149
|
if (ruleset && (0, githubMergeGating_1.rulesetProvidesMergeGating)(ruleset)) {
|
|
150
|
-
report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch},
|
|
150
|
+
report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, deploy-key bypass for the release push`);
|
|
151
151
|
}
|
|
152
152
|
else if (ruleset) {
|
|
153
|
-
report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or
|
|
153
|
+
report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or deploy-key bypass missing)`, "run: catladder project setup");
|
|
154
154
|
}
|
|
155
155
|
else {
|
|
156
156
|
report.fail(`no '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' ruleset on ${repo} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
|
|
157
157
|
}
|
|
158
|
+
try {
|
|
159
|
+
const [keys, secretNames] = await Promise.all([
|
|
160
|
+
(0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
|
|
161
|
+
(0, github_1.listGithubSecretNames)(repo),
|
|
162
|
+
]);
|
|
163
|
+
const key = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
|
|
164
|
+
const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
|
|
165
|
+
if (key && !key.read_only && hasSecret) {
|
|
166
|
+
report.ok(`release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
|
|
167
|
+
}
|
|
168
|
+
else {
|
|
169
|
+
report.fail(`release deploy key incomplete (key: ${key ? (key.read_only ? "read-only" : "ok") : "missing"}, secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET}: ${hasSecret ? "set" : "missing"}) — the release job cannot push past the merge gating`, "run: catladder project setup");
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
catch (e) {
|
|
173
|
+
report.warn(`could not check the release deploy key (${e.message})`);
|
|
174
|
+
}
|
|
158
175
|
const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null);
|
|
159
176
|
const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
|
|
160
177
|
if (checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"checkGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uGAGkE;AAClE,kEAAsE;AACtE,wDAMqC;AAErC,
|
|
1
|
+
{"version":3,"file":"checkGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uGAGkE;AAClE,kEAAsE;AACtE,wDAMqC;AAErC,4DAK8B;AAG9B,iFAAiF;AACjF,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;GAMG;AACI,MAAM,WAAW,GAAG,KAAK,EAAE,MAAoB,EAAE,MAAc,EAAE,EAAE;IACxE,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAChE,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAEhD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CACT,2DAA2D,EAC3D,oBAAoB,CACrB,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CACT,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CACvF,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAiC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CACT,wEAAwE,CAAC,CAAC,OAAO,GAAG,CACrF,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,WAAmB,EAAE,EAAE,CAChD,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;SACnB,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;SAC3C,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;IAE3B,MAAM,kBAAkB,GAAG;QACzB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;KAC/D;SACE,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,UAAU,CAAC;SACnD,IAAI,EAAE,CAAC;IAEV,IAAI,oBAAiC,CAAC;IACtC,IAAI,CAAC;QACH,oBAAoB,GAAG,IAAI,GAAG,CAAC,MAAM,IAAA,+BAAsB,EAAC,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,kCAAkC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,MAAM,cAAc,GAAG,MAAM,IAAA,gCAAkB,EAC7C,kBAAkB,EAClB,CAAC,EACD,KAAK,EAAE,WAAW,EAAE,EAAE;QACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAc,EAAE,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,EAAE,WAAW,CAAC;YACxC,IAAA,gCAAuB,EAAC,IAAI,EAAE,WAAW,CAAC;SAC3C,CAAC,CAAC;QACH,+DAA+D;QAC/D,wCAAwC;QACxC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7C,CAAC;QACF,OAAO;YACL,WAAW;YACX,UAAU;YACV,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACjE,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CACT,gBAAgB,WAAW,qBAAqB,UAAU,CAAC,MAAM,2CAA2C,EAC5G,4CAA4C,CAC7C,CAAC;YACF,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,aAAa,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,wBAAwB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACxH,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,GAAG,WAAW,SAAS,UAAU,CAAC,MAAM,uCAAuC,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CACT,GAAG,WAAW,KAAK,MAAM,CAAC,KAAK,CAAC,MAAM,qDAAqD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,mBAAmB,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1D,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC7C,IAAA,8BAAqB,EAAC,IAAI,CAAC;YAC3B,IAAA,gCAAuB,EAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,GAAG,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC7D,CAAC;QACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CACxC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,IAAI,CACT,uBAAuB,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,MAAM,wBAAwB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC/G,4CAA4C,CAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,mBAAmB,mBAAmB,CAAC,MAAM,uCAAuC,CACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC;AAjIW,QAAA,WAAW,eAiItB;AAEF;;;;;;;;;GASG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAAE,MAAoB,EAAE,IAAY,EAAE,EAAE;;IAC1E,IAAI,QAA+D,CAAC;IACpE,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,mCAAmC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,6EAA6E,EAC7E,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,IAAI,QAA6C,CAAC;IAClD,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,SAAS,IAAI,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,8BAA8B,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6CAAyB,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;QACnB,CAAC,CAAC,MAAM,IAAA,kBAAS,EACb,KAAK,EACL,SAAS,IAAI,aAAa,KAAK,CAAC,EAAE,EAAE,CACrC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,OAAO,IAAI,IAAA,8CAA0B,EAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,EAAE,CACP,YAAY,6CAAyB,OAAO,mCAAwB,iBAAiB,MAAM,0CAA0C,CACtI,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CACT,YAAY,6CAAyB,yFAAyF,EAC9H,8BAA8B,CAC/B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CACT,OAAO,6CAAyB,gBAAgB,IAAI,6DAA6D,EACjH,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC5C,IAAA,kBAAS,EACP,KAAK,EACL,SAAS,IAAI,oBAAoB,CAClC;YACD,IAAA,8BAAqB,EAAC,IAAI,CAAC;SAC5B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,4CAAwB,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,6CAAyB,CAC3D,CAAC;QACF,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;YACvC,MAAM,CAAC,EAAE,CACP,uBAAuB,4CAAwB,cAAc,6CAAyB,WAAW,CAClG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CACT,uCACE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAC/C,YAAY,6CAAyB,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,uDAAuD,EAC9H,8BAA8B,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAS,EAChC,KAAK,EACL,SAAS,IAAI,aAAa,MAAM,aAAa,CAC9C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,MAAM,GACV,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,EAAE,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CACT,IAAI,mCAAwB,wDAAwD,MAAM,gDAAgD,EAC1I,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,CAAC;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,GAAG,MAAM,aAAa,KAAK,CAAC,MAAM,6DAA6D,KAAK;aACjG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;aACrB,IAAI,CACH,IAAI,CACL,sDAAsD,mCAAwB,GAAG,CACrF,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}
|
|
@@ -5,17 +5,30 @@
|
|
|
5
5
|
* The gating lives in a repository RULESET, not classic branch
|
|
6
6
|
* protection: only rulesets can carry bypass actors, and the release
|
|
7
7
|
* job needs one. It pushes the release commit and tag straight to the
|
|
8
|
-
* default branch
|
|
9
|
-
*
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
14
|
-
*
|
|
8
|
+
* default branch — under classic protection the required `catladder ✅`
|
|
9
|
+
* check rejects that push (GH006), because the fresh release commit
|
|
10
|
+
* cannot have a passing check yet.
|
|
11
|
+
*
|
|
12
|
+
* The bypass actor is a DEPLOY KEY: github deliberately refuses the
|
|
13
|
+
* built-in GitHub Actions app on bypass lists (any collaborator could
|
|
14
|
+
* push anywhere by authoring a workflow), so the workflow token can
|
|
15
|
+
* never bypass. Instead `project setup` provisions a write deploy key
|
|
16
|
+
* (public half on the repo, private half as an actions secret) and the
|
|
17
|
+
* release job pushes over ssh with it. Deploy keys are repo-scoped,
|
|
18
|
+
* only admins can add them, and they never expire — gitlab's
|
|
19
|
+
* counterpart is the maintainer-role `GL_TOKEN`, which has to be
|
|
20
|
+
* renewed yearly.
|
|
15
21
|
*/
|
|
16
|
-
/** the app id of GitHub Actions — the
|
|
22
|
+
/** the app id of GitHub Actions — the integration reporting the check */
|
|
17
23
|
export declare const GITHUB_ACTIONS_APP_ID = 15368;
|
|
18
24
|
export declare const MERGE_GATING_RULESET_NAME = "catladder merge gating";
|
|
25
|
+
/** title of the deploy key `project setup` registers on the repo */
|
|
26
|
+
export declare const RELEASE_DEPLOY_KEY_TITLE = "catladder release";
|
|
27
|
+
/**
|
|
28
|
+
* actions secret holding the deploy key's private half; the generated
|
|
29
|
+
* release jobs pass it to catci, which pushes over ssh when it is set
|
|
30
|
+
*/
|
|
31
|
+
export declare const RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
|
|
19
32
|
export type GithubRuleset = {
|
|
20
33
|
id: number;
|
|
21
34
|
name: string;
|
|
@@ -57,14 +70,14 @@ export declare const desiredMergeGatingRuleset: () => {
|
|
|
57
70
|
};
|
|
58
71
|
}[];
|
|
59
72
|
bypass_actors: {
|
|
60
|
-
actor_id:
|
|
73
|
+
actor_id: any;
|
|
61
74
|
actor_type: string;
|
|
62
75
|
bypass_mode: string;
|
|
63
76
|
}[];
|
|
64
77
|
};
|
|
65
78
|
/**
|
|
66
79
|
* whether a ruleset provides working merge gating: active, requires
|
|
67
|
-
* the aggregate check, and lets the release
|
|
68
|
-
*
|
|
80
|
+
* the aggregate check, and lets the release deploy key bypass it.
|
|
81
|
+
* Extra rules or bypass actors someone added are fine.
|
|
69
82
|
*/
|
|
70
83
|
export declare const rulesetProvidesMergeGating: (ruleset: GithubRuleset) => boolean;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
|
|
3
|
+
exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.RELEASE_DEPLOY_KEY_SECRET = exports.RELEASE_DEPLOY_KEY_TITLE = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
|
|
4
4
|
const pipeline_1 = require("../../../../../../../packages/pipeline/src/index.js");
|
|
5
5
|
/**
|
|
6
6
|
* github merge gating — shared between `project setup` (writes it) and
|
|
@@ -9,17 +9,30 @@ const pipeline_1 = require("../../../../../../../packages/pipeline/src/index.js"
|
|
|
9
9
|
* The gating lives in a repository RULESET, not classic branch
|
|
10
10
|
* protection: only rulesets can carry bypass actors, and the release
|
|
11
11
|
* job needs one. It pushes the release commit and tag straight to the
|
|
12
|
-
* default branch
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
-
*
|
|
16
|
-
*
|
|
17
|
-
*
|
|
18
|
-
*
|
|
12
|
+
* default branch — under classic protection the required `catladder ✅`
|
|
13
|
+
* check rejects that push (GH006), because the fresh release commit
|
|
14
|
+
* cannot have a passing check yet.
|
|
15
|
+
*
|
|
16
|
+
* The bypass actor is a DEPLOY KEY: github deliberately refuses the
|
|
17
|
+
* built-in GitHub Actions app on bypass lists (any collaborator could
|
|
18
|
+
* push anywhere by authoring a workflow), so the workflow token can
|
|
19
|
+
* never bypass. Instead `project setup` provisions a write deploy key
|
|
20
|
+
* (public half on the repo, private half as an actions secret) and the
|
|
21
|
+
* release job pushes over ssh with it. Deploy keys are repo-scoped,
|
|
22
|
+
* only admins can add them, and they never expire — gitlab's
|
|
23
|
+
* counterpart is the maintainer-role `GL_TOKEN`, which has to be
|
|
24
|
+
* renewed yearly.
|
|
19
25
|
*/
|
|
20
|
-
/** the app id of GitHub Actions — the
|
|
26
|
+
/** the app id of GitHub Actions — the integration reporting the check */
|
|
21
27
|
exports.GITHUB_ACTIONS_APP_ID = 15368;
|
|
22
28
|
exports.MERGE_GATING_RULESET_NAME = "catladder merge gating";
|
|
29
|
+
/** title of the deploy key `project setup` registers on the repo */
|
|
30
|
+
exports.RELEASE_DEPLOY_KEY_TITLE = "catladder release";
|
|
31
|
+
/**
|
|
32
|
+
* actions secret holding the deploy key's private half; the generated
|
|
33
|
+
* release jobs pass it to catci, which pushes over ssh when it is set
|
|
34
|
+
*/
|
|
35
|
+
exports.RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
|
|
23
36
|
/** the ruleset `project setup` creates (and restores on drift) */
|
|
24
37
|
const desiredMergeGatingRuleset = () => ({
|
|
25
38
|
name: exports.MERGE_GATING_RULESET_NAME,
|
|
@@ -42,18 +55,16 @@ const desiredMergeGatingRuleset = () => ({
|
|
|
42
55
|
},
|
|
43
56
|
],
|
|
44
57
|
bypass_actors: [
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
bypass_mode: "always",
|
|
49
|
-
},
|
|
58
|
+
// deploy keys carry no id — the bypass covers every deploy key of
|
|
59
|
+
// the repository (adding one requires admin anyway)
|
|
60
|
+
{ actor_id: null, actor_type: "DeployKey", bypass_mode: "always" },
|
|
50
61
|
],
|
|
51
62
|
});
|
|
52
63
|
exports.desiredMergeGatingRuleset = desiredMergeGatingRuleset;
|
|
53
64
|
/**
|
|
54
65
|
* whether a ruleset provides working merge gating: active, requires
|
|
55
|
-
* the aggregate check, and lets the release
|
|
56
|
-
*
|
|
66
|
+
* the aggregate check, and lets the release deploy key bypass it.
|
|
67
|
+
* Extra rules or bypass actors someone added are fine.
|
|
57
68
|
*/
|
|
58
69
|
const rulesetProvidesMergeGating = (ruleset) => {
|
|
59
70
|
var _a, _b;
|
|
@@ -63,9 +74,7 @@ const rulesetProvidesMergeGating = (ruleset) => {
|
|
|
63
74
|
return rule.type === "required_status_checks" &&
|
|
64
75
|
((_b = (_a = rule.parameters) === null || _a === void 0 ? void 0 : _a.required_status_checks) !== null && _b !== void 0 ? _b : []).some((check) => check.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME);
|
|
65
76
|
}) &&
|
|
66
|
-
((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "
|
|
67
|
-
actor.actor_id === exports.GITHUB_ACTIONS_APP_ID &&
|
|
68
|
-
actor.bypass_mode === "always");
|
|
77
|
+
((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "DeployKey" && actor.bypass_mode === "always");
|
|
69
78
|
};
|
|
70
79
|
exports.rulesetProvidesMergeGating = rulesetProvidesMergeGating;
|
|
71
80
|
//# sourceMappingURL=githubMergeGating.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"githubMergeGating.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/githubMergeGating.ts"],"names":[],"mappings":";;;AAAA,kDAA+D;AAE/D
|
|
1
|
+
{"version":3,"file":"githubMergeGating.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/githubMergeGating.ts"],"names":[],"mappings":";;;AAAA,kDAA+D;AAE/D;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,yEAAyE;AAC5D,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAE9B,QAAA,yBAAyB,GAAG,wBAAwB,CAAC;AAElE,oEAAoE;AACvD,QAAA,wBAAwB,GAAG,mBAAmB,CAAC;AAE5D;;;GAGG;AACU,QAAA,yBAAyB,GAAG,uBAAuB,CAAC;AAmBjE,kEAAkE;AAC3D,MAAM,yBAAyB,GAAG,GAAG,EAAE,CAAC,CAAC;IAC9C,IAAI,EAAE,iCAAyB;IAC/B,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,QAAQ;IACrB,UAAU,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE;IACvE,KAAK,EAAE;QACL;YACE,IAAI,EAAE,wBAAwB;YAC9B,UAAU,EAAE;gBACV,oCAAoC,EAAE,KAAK;gBAC3C,wBAAwB,EAAE,KAAK;gBAC/B,sBAAsB,EAAE;oBACtB;wBACE,OAAO,EAAE,mCAAwB;wBACjC,cAAc,EAAE,6BAAqB;qBACtC;iBACF;aACF;SACF;KACF;IACD,aAAa,EAAE;QACb,kEAAkE;QAClE,oDAAoD;QACpD,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE;KACnE;CACF,CAAC,CAAC;AAzBU,QAAA,yBAAyB,6BAyBnC;AAEH;;;;GAIG;AACI,MAAM,0BAA0B,GAAG,CAAC,OAAsB,EAAW,EAAE;;IAC5E,OAAA,OAAO,CAAC,WAAW,KAAK,QAAQ;QAChC,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE;;YACP,OAAA,IAAI,CAAC,IAAI,KAAK,wBAAwB;gBACtC,CAAC,MAAA,MAAA,IAAI,CAAC,UAAU,0CAAE,sBAAsB,mCAAI,EAAE,CAAC,CAAC,IAAI,CAClD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,mCAAwB,CACtD,CAAA;SAAA,CACJ;QACD,CAAC,MAAA,OAAO,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,IAAI,CAChC,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,UAAU,KAAK,WAAW,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,CACrE,CAAA;CAAA,CAAC;AAZS,QAAA,0BAA0B,8BAYnC"}
|
|
@@ -29,13 +29,14 @@ const setupProject = async (instance, onlyComponents) => {
|
|
|
29
29
|
});
|
|
30
30
|
const enabledPipelines = config ? (0, pipeline_1.getEnabledPipelineTypes)(config) : [];
|
|
31
31
|
await (0, logSection_1.logSection)(instance, "base setup", async () => {
|
|
32
|
-
// gitlab-specific provisioning (access token, agent webhooks
|
|
33
|
-
// meaningless (and failing) on a
|
|
32
|
+
// gitlab-specific provisioning (access token, agent webhooks, the
|
|
33
|
+
// `catladder` project topic) — meaningless (and failing) on a
|
|
34
|
+
// github-only project
|
|
34
35
|
if (enabledPipelines.includes("gitlab")) {
|
|
35
36
|
await (0, setupAccessTokens_1.setupAccessTokens)(instance);
|
|
36
37
|
await (0, setupAgents_1.setupAgents)(instance);
|
|
38
|
+
await (0, setupTopic_1.setupTopic)(instance);
|
|
37
39
|
}
|
|
38
|
-
await (0, setupTopic_1.setupTopic)(instance);
|
|
39
40
|
if (config) {
|
|
40
41
|
await (0, setupGithub_1.setupGithub)(instance, config);
|
|
41
42
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/index.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6EAGgD;AAChD,2DAAwD;AACxD,iDAA8C;AAC9C,6CAA0C;AAC1C,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,6EAA0E;AAEnE,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAA,8BAAmB,EAAC,IAAA,8BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,MAAM,IAAA,uDAA0B,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC3C,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;QAClD,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/index.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6EAGgD;AAChD,2DAAwD;AACxD,iDAA8C;AAC9C,6CAA0C;AAC1C,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,6EAA0E;AAEnE,MAAM,YAAY,GAAG,KAAK,EAC/B,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,uEAAuE;IACvE,0EAA0E;IAC1E,uEAAuE;IACvE,uEAAuE;IACvE,oEAAoE;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAA,8BAAmB,EAAC,IAAA,8BAAmB,EAAC,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,MAAM,IAAA,uDAA0B,EAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAChE,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC3C,UAAU,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,IAAA,uBAAU,EAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,IAAI,EAAE;QAClD,kEAAkE;QAClE,8DAA8D;QAC9D,sBAAsB;QACtB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxC,MAAM,IAAA,qCAAiB,EAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;YAC5B,MAAM,IAAA,uBAAU,EAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,IAAA,2BAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,eAAe,CAAC,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD;QACE,kCAAkC;QAClC,2BAA2B;QAC3B,qDAAqD;QACrD,qBAAqB;QACrB,eAAe;KAChB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnB,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;AArDW,QAAA,YAAY,gBAqDvB"}
|
|
@@ -7,11 +7,14 @@ import type { IO } from "../../../../../core/types";
|
|
|
7
7
|
* auto-merge button never appears.
|
|
8
8
|
*
|
|
9
9
|
* - repo settings: allow auto-merge, delete merged head branches
|
|
10
|
+
* - the release deploy key: a write deploy key on the repo, its
|
|
11
|
+
* private half stored as the CATLADDER_RELEASE_KEY actions secret —
|
|
12
|
+
* the release job pushes the release commit and tag with it
|
|
10
13
|
* - a repository ruleset on the default branch requiring the generated
|
|
11
14
|
* `catladder ✅` aggregate check (the one stable context — individual
|
|
12
|
-
* job names change with every component add/rename), with a
|
|
13
|
-
*
|
|
14
|
-
*
|
|
15
|
+
* job names change with every component add/rename), with a deploy
|
|
16
|
+
* key bypass so the release push goes through (see
|
|
17
|
+
* githubMergeGating.ts for the full rationale)
|
|
15
18
|
*
|
|
16
19
|
* Earlier versions required the check via classic branch protection,
|
|
17
20
|
* which has no bypass list — the release job's direct push to the
|
|
@@ -2,9 +2,15 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.setupGithub = void 0;
|
|
4
4
|
const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
|
|
5
|
+
const child_process_1 = require("child_process");
|
|
6
|
+
const promises_1 = require("fs/promises");
|
|
7
|
+
const os_1 = require("os");
|
|
8
|
+
const path_1 = require("path");
|
|
9
|
+
const util_1 = require("util");
|
|
5
10
|
const commandSecretsSyncGithub_1 = require("../../../../../commands/project/commandSecretsSyncGithub");
|
|
6
11
|
const github_1 = require("../../../../../utils/github");
|
|
7
12
|
const githubMergeGating_1 = require("../githubMergeGating");
|
|
13
|
+
const execFile = (0, util_1.promisify)(child_process_1.execFile);
|
|
8
14
|
/**
|
|
9
15
|
* configures github merge gating — the sane default gitlab ships
|
|
10
16
|
* built-in and a fresh github repository lacks entirely: without it a
|
|
@@ -12,11 +18,14 @@ const githubMergeGating_1 = require("../githubMergeGating");
|
|
|
12
18
|
* auto-merge button never appears.
|
|
13
19
|
*
|
|
14
20
|
* - repo settings: allow auto-merge, delete merged head branches
|
|
21
|
+
* - the release deploy key: a write deploy key on the repo, its
|
|
22
|
+
* private half stored as the CATLADDER_RELEASE_KEY actions secret —
|
|
23
|
+
* the release job pushes the release commit and tag with it
|
|
15
24
|
* - a repository ruleset on the default branch requiring the generated
|
|
16
25
|
* `catladder ✅` aggregate check (the one stable context — individual
|
|
17
|
-
* job names change with every component add/rename), with a
|
|
18
|
-
*
|
|
19
|
-
*
|
|
26
|
+
* job names change with every component add/rename), with a deploy
|
|
27
|
+
* key bypass so the release push goes through (see
|
|
28
|
+
* githubMergeGating.ts for the full rationale)
|
|
20
29
|
*
|
|
21
30
|
* Earlier versions required the check via classic branch protection,
|
|
22
31
|
* which has no bypass list — the release job's direct push to the
|
|
@@ -48,6 +57,7 @@ const setupGithub = async (instance, config) => {
|
|
|
48
57
|
else {
|
|
49
58
|
instance.log("✅ auto-merge already enabled");
|
|
50
59
|
}
|
|
60
|
+
await ensureReleaseDeployKey(instance, repo);
|
|
51
61
|
const branch = repoInfo.default_branch;
|
|
52
62
|
const rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
|
|
53
63
|
const existing = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
|
|
@@ -68,6 +78,57 @@ const setupGithub = async (instance, config) => {
|
|
|
68
78
|
await migrateAwayFromClassicProtection(instance, repo, branch);
|
|
69
79
|
};
|
|
70
80
|
exports.setupGithub = setupGithub;
|
|
81
|
+
/**
|
|
82
|
+
* provisions the release deploy key: an ed25519 keypair whose public
|
|
83
|
+
* half becomes a write deploy key on the repo and whose private half
|
|
84
|
+
* becomes the CATLADDER_RELEASE_KEY actions secret. The key and the
|
|
85
|
+
* secret only work as a pair, so when either half is missing the pair
|
|
86
|
+
* is rotated (github secrets are write-only — the private half can
|
|
87
|
+
* never be read back to check it matches).
|
|
88
|
+
*/
|
|
89
|
+
const ensureReleaseDeployKey = async (instance, repo) => {
|
|
90
|
+
const [keys, secretNames] = await Promise.all([
|
|
91
|
+
(0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
|
|
92
|
+
(0, github_1.listGithubSecretNames)(repo),
|
|
93
|
+
]);
|
|
94
|
+
const existingKey = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
|
|
95
|
+
const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
|
|
96
|
+
if (existingKey && !existingKey.read_only && hasSecret) {
|
|
97
|
+
instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
|
|
98
|
+
return;
|
|
99
|
+
}
|
|
100
|
+
if (existingKey) {
|
|
101
|
+
await (0, github_1.ghApiJson)("DELETE", `repos/${repo}/keys/${existingKey.id}`);
|
|
102
|
+
instance.log(`♻️ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' rotated (${existingKey.read_only
|
|
103
|
+
? "was read-only"
|
|
104
|
+
: `secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} missing`})`);
|
|
105
|
+
}
|
|
106
|
+
const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "catladder-release-key-"));
|
|
107
|
+
try {
|
|
108
|
+
const keyFile = (0, path_1.join)(dir, "id_ed25519");
|
|
109
|
+
await execFile("ssh-keygen", [
|
|
110
|
+
...["-t", "ed25519"],
|
|
111
|
+
...["-C", `${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE} (${repo})`],
|
|
112
|
+
...["-N", ""],
|
|
113
|
+
...["-f", keyFile],
|
|
114
|
+
"-q",
|
|
115
|
+
]);
|
|
116
|
+
const [privateKey, publicKey] = await Promise.all([
|
|
117
|
+
(0, promises_1.readFile)(keyFile, "utf-8"),
|
|
118
|
+
(0, promises_1.readFile)(`${keyFile}.pub`, "utf-8"),
|
|
119
|
+
]);
|
|
120
|
+
await (0, github_1.ghApiJson)("POST", `repos/${repo}/keys`, {
|
|
121
|
+
title: githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE,
|
|
122
|
+
key: publicKey.trim(),
|
|
123
|
+
read_only: false,
|
|
124
|
+
});
|
|
125
|
+
await (0, github_1.setGithubSecret)(repo, githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET, privateKey);
|
|
126
|
+
}
|
|
127
|
+
finally {
|
|
128
|
+
await (0, promises_1.rm)(dir, { recursive: true, force: true });
|
|
129
|
+
}
|
|
130
|
+
instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' registered, private half stored as secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} — the release job pushes with it`);
|
|
131
|
+
};
|
|
71
132
|
/**
|
|
72
133
|
* removes the aggregate check from a classic branch protection rule
|
|
73
134
|
* set up by earlier catladder versions — with the check now required
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"setupGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,uGAAmG;AAEnG,
|
|
1
|
+
{"version":3,"file":"setupGithub.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/setup/setupGithub.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAC7B,iDAAuD;AACvD,0CAAoD;AACpD,2BAA4B;AAC5B,+BAA4B;AAC5B,+BAAiC;AACjC,uGAAmG;AAEnG,wDAKqC;AAErC,4DAM8B;AAE9B,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACI,MAAM,WAAW,GAAG,KAAK,EAAE,QAAY,EAAE,MAAc,EAAE,EAAE;IAChE,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,gGAAgG,CACjG,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,yCAAyC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,+CAA+C,CAC/H,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAI7B,KAAK,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;IAE3B,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACnE,MAAM,IAAA,kBAAS,EAAC,OAAO,EAAE,SAAS,IAAI,EAAE,EAAE;YACxC,gBAAgB,EAAE,IAAI;YACtB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,sBAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAS,EAC9B,KAAK,EACL,SAAS,IAAI,wBAAwB,CACtC,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,6CAAyB,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,kBAAS,EACb,MAAM,EACN,SAAS,IAAI,WAAW,EACxB,IAAA,6CAAyB,GAAE,CAC5B,CAAC;QACF,QAAQ,CAAC,GAAG,CACV,cAAc,6CAAyB,OAAO,mCAAwB,iBAAiB,MAAM,2DAA2D,CACzJ,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,IAAA,kBAAS,EAC5B,KAAK,EACL,SAAS,IAAI,aAAa,QAAQ,CAAC,EAAE,EAAE,CACxC,CAAC;QACF,IAAI,IAAA,8CAA0B,EAAC,MAAM,CAAC,EAAE,CAAC;YACvC,QAAQ,CAAC,GAAG,CACV,cAAc,6CAAyB,yBAAyB,MAAM,EAAE,CACzE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,kBAAS,EACb,KAAK,EACL,SAAS,IAAI,aAAa,QAAQ,CAAC,EAAE,EAAE,EACvC,IAAA,6CAAyB,GAAE,CAC5B,CAAC;YACF,QAAQ,CAAC,GAAG,CACV,cAAc,6CAAyB,iBAAiB,mCAAwB,yCAAyC,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,gCAAgC,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC;AAzEW,QAAA,WAAW,eAyEtB;AAEF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,KAAK,EAAE,QAAY,EAAE,IAAY,EAAE,EAAE;IAClE,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5C,IAAA,kBAAS,EACP,KAAK,EACL,SAAS,IAAI,oBAAoB,CAClC;QACD,IAAA,8BAAqB,EAAC,IAAI,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,4CAAwB,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAChC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,6CAAyB,CAC3D,CAAC;IACF,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;QACvD,QAAQ,CAAC,GAAG,CACV,yBAAyB,4CAAwB,cAAc,6CAAyB,WAAW,CACpG,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAA,kBAAS,EAAC,QAAQ,EAAE,SAAS,IAAI,SAAS,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,QAAQ,CAAC,GAAG,CACV,0BAA0B,4CAAwB,cAChD,WAAW,CAAC,SAAS;YACnB,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,UAAU,6CAAyB,UACzC,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACxC,MAAM,QAAQ,CAAC,YAAY,EAAE;YAC3B,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC;YACpB,GAAG,CAAC,IAAI,EAAE,GAAG,4CAAwB,KAAK,IAAI,GAAG,CAAC;YAClD,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;YAClB,IAAI;SACL,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChD,IAAA,mBAAQ,EAAC,OAAO,EAAE,OAAO,CAAC;YAC1B,IAAA,mBAAQ,EAAC,GAAG,OAAO,MAAM,EAAE,OAAO,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,IAAA,kBAAS,EAAC,MAAM,EAAE,SAAS,IAAI,OAAO,EAAE;YAC5C,KAAK,EAAE,4CAAwB;YAC/B,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE;YACrB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,6CAAyB,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,yBAAyB,4CAAwB,+CAA+C,6CAAyB,mCAAmC,CAC7J,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,gCAAgC,GAAG,KAAK,EAC5C,QAAY,EACZ,IAAY,EACZ,MAAc,EACd,EAAE;;IACF,MAAM,UAAU,GAAG,MAAM,IAAA,kBAAS,EAChC,KAAK,EACL,SAAS,IAAI,aAAa,MAAM,aAAa,CAC9C,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,4BAA4B;IACjD,MAAM,MAAM,GACV,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAAC,EAAE,CAAC;QAChE,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,mCAAwB,CAC9C,CAAC;IACF,MAAM,mBAAmB,GACvB,SAAS,CAAC,MAAM,GAAG,CAAC;SACpB,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,cAAc,0CAAE,OAAO,CAAA;SACnC,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,6BAA6B,CAAA;SACzC,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY,CAAA;SACxB,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,uBAAuB,0CAAE,OAAO,CAAA;SAC5C,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,gCAAgC,0CAAE,OAAO,CAAA;SACrD,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,mBAAmB,0CAAE,OAAO,CAAA;SACxC,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,WAAW,0CAAE,OAAO,CAAA;SAChC,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,kBAAkB,0CAAE,OAAO,CAAA;SACvC,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,eAAe,0CAAE,OAAO,CAAA,CAAC;IACvC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAA,kBAAS,EAAC,QAAQ,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa,CAAC,CAAC;QACzE,QAAQ,CAAC,GAAG,CACV,kCAAkC,MAAM,eAAe,mCAAwB,8DAA8D,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,kEAAkE;IAClE,0BAA0B;IAC1B,MAAM,IAAA,kBAAS,EAAC,KAAK,EAAE,SAAS,IAAI,aAAa,MAAM,aAAa,EAAE;QACpE,sBAAsB,EACpB,SAAS,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,CAAC;gBACE,MAAM,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,sBAAsB,0CAAE,MAAM,mCAAI,KAAK;gBAC3D,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC9C,OAAO;oBACP,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C,CAAC,CAAC;aACJ;YACH,CAAC,CAAC,IAAI;QACV,cAAc,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,cAAc,0CAAE,OAAO,mCAAI,KAAK;QAC5D,6BAA6B,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,6BAA6B;YACtE,CAAC,CAAC;gBACE,+BAA+B,EAC7B,MAAA,UAAU,CAAC,6BAA6B;qBACrC,+BAA+B,mCAAI,CAAC;gBACzC,qBAAqB,EACnB,MAAA,UAAU,CAAC,6BAA6B,CAAC,qBAAqB,mCAC9D,KAAK;gBACP,0BAA0B,EACxB,MAAA,UAAU,CAAC,6BAA6B;qBACrC,0BAA0B,mCAAI,KAAK;aACzC;YACH,CAAC,CAAC,IAAI;QACR,YAAY,EAAE,CAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,YAAY;YACpC,CAAC,CAAC;gBACE,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;gBAC7D,KAAK,EAAE,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5D,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;aAC3D;YACH,CAAC,CAAC,IAAI;QACR,uBAAuB,EACrB,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,uBAAuB,0CAAE,OAAO,mCAAI,KAAK;QACvD,gCAAgC,EAC9B,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,gCAAgC,0CAAE,OAAO,mCAAI,KAAK;QAChE,WAAW,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,WAAW,0CAAE,OAAO,mCAAI,KAAK;QACtD,kBAAkB,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,kBAAkB,0CAAE,OAAO,mCAAI,KAAK;QACpE,eAAe,EAAE,MAAA,MAAA,UAAU,aAAV,UAAU,uBAAV,UAAU,CAAE,eAAe,0CAAE,OAAO,mCAAI,KAAK;KAC/D,CAAC,CAAC;IACH,QAAQ,CAAC,GAAG,CACV,MAAM,mCAAwB,+CAA+C,MAAM,oEAAoE,CACxJ,CAAC;AACJ,CAAC,CAAC"}
|
|
@@ -10,6 +10,7 @@ exports.changesetsReleaseJob = exports.dispatchTaggedReleaseWorkflow = exports.r
|
|
|
10
10
|
*/
|
|
11
11
|
const fs_1 = require("fs");
|
|
12
12
|
const promises_1 = require("fs/promises");
|
|
13
|
+
const os_1 = require("os");
|
|
13
14
|
const path_1 = require("path");
|
|
14
15
|
const changesets_1 = require("./changesets");
|
|
15
16
|
const releaseGit_1 = require("./releaseGit");
|
|
@@ -50,8 +51,12 @@ const requireEnv = (name) => {
|
|
|
50
51
|
* - gitlab: CI checkouts have a read-only origin, so push via an
|
|
51
52
|
* authenticated url with GL_TOKEN (the same project access token
|
|
52
53
|
* semantic-release uses)
|
|
53
|
-
* - github:
|
|
54
|
-
*
|
|
54
|
+
* - github: over ssh with the release deploy key
|
|
55
|
+
* (CATLADDER_RELEASE_KEY, provisioned by `project setup`) — merge
|
|
56
|
+
* gating requires the `catladder ✅` check on the default branch,
|
|
57
|
+
* and only a deploy key can bypass that (github deliberately never
|
|
58
|
+
* lets the workflow token bypass rulesets). Without the secret the
|
|
59
|
+
* push falls back to origin, which works on repos without gating.
|
|
55
60
|
*/
|
|
56
61
|
const pushCommitAndTag = async (tag) => {
|
|
57
62
|
var _a;
|
|
@@ -60,21 +65,25 @@ const pushCommitAndTag = async (tag) => {
|
|
|
60
65
|
// rederived an existing version)
|
|
61
66
|
if (process.env.GITHUB_ACTIONS === "true") {
|
|
62
67
|
const branch = requireEnv("GITHUB_REF_NAME");
|
|
68
|
+
const refs = [`HEAD:refs/heads/${branch}`, tag];
|
|
69
|
+
const deployKey = process.env.CATLADDER_RELEASE_KEY;
|
|
70
|
+
if (deployKey) {
|
|
71
|
+
await pushWithDeployKey(deployKey, refs);
|
|
72
|
+
return;
|
|
73
|
+
}
|
|
63
74
|
try {
|
|
64
|
-
await (0, releaseGit_1.git)("push", "--atomic", "origin",
|
|
75
|
+
await (0, releaseGit_1.git)("push", "--atomic", "origin", ...refs);
|
|
65
76
|
}
|
|
66
77
|
catch (e) {
|
|
67
|
-
// GH006:
|
|
68
|
-
//
|
|
69
|
-
//
|
|
70
|
-
// for the actions app, which `project setup` configures
|
|
78
|
+
// GH006: a required status check rejects the fresh release
|
|
79
|
+
// commit (it cannot have a passing check yet) — the push needs
|
|
80
|
+
// the release deploy key, which `project setup` provisions
|
|
71
81
|
if (/GH006|protected branch/i.test(`${(_a = e === null || e === void 0 ? void 0 : e.message) !== null && _a !== void 0 ? _a : e}`)) {
|
|
72
82
|
throw new Error(`pushing the release to '${branch}' was rejected by its branch protection:\n` +
|
|
73
83
|
`${e.message}\n` +
|
|
74
|
-
`The
|
|
75
|
-
`
|
|
76
|
-
`
|
|
77
|
-
`Run \`catladder project setup\` to migrate the merge gating, then rerun this job.`);
|
|
84
|
+
`The workflow token cannot bypass a required status check on '${branch}'. ` +
|
|
85
|
+
`Run \`catladder project setup\` to provision the release deploy key ` +
|
|
86
|
+
`(${RELEASE_KEY_ENV} secret + ruleset bypass), then rerun this job.`);
|
|
78
87
|
}
|
|
79
88
|
throw e;
|
|
80
89
|
}
|
|
@@ -87,6 +96,31 @@ const pushCommitAndTag = async (tag) => {
|
|
|
87
96
|
const remote = `https://oauth2:${token}@${host}/${projectPath}.git`;
|
|
88
97
|
await (0, releaseGit_1.git)("push", "--atomic", remote, `HEAD:refs/heads/${branch}`, tag);
|
|
89
98
|
};
|
|
99
|
+
const RELEASE_KEY_ENV = "CATLADDER_RELEASE_KEY";
|
|
100
|
+
/**
|
|
101
|
+
* pushes over ssh with the release deploy key — the only actor that
|
|
102
|
+
* can bypass the merge-gating ruleset on the default branch
|
|
103
|
+
*/
|
|
104
|
+
const pushWithDeployKey = async (privateKey, refs) => {
|
|
105
|
+
var _a;
|
|
106
|
+
const serverUrl = (_a = process.env.GITHUB_SERVER_URL) !== null && _a !== void 0 ? _a : "https://github.com";
|
|
107
|
+
const host = new URL(serverUrl).host;
|
|
108
|
+
const repository = requireEnv("GITHUB_REPOSITORY");
|
|
109
|
+
const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "release-key-"));
|
|
110
|
+
try {
|
|
111
|
+
const keyFile = (0, path_1.join)(dir, "id_ed25519");
|
|
112
|
+
// a key file without a trailing newline is rejected by openssh
|
|
113
|
+
await (0, promises_1.writeFile)(keyFile, privateKey.endsWith("\n") ? privateKey : `${privateKey}\n`, {
|
|
114
|
+
mode: 0o600,
|
|
115
|
+
});
|
|
116
|
+
await (0, releaseGit_1.gitWithEnv)({
|
|
117
|
+
GIT_SSH_COMMAND: `ssh -i ${keyFile} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`,
|
|
118
|
+
}, "push", "--atomic", `git@${host}:${repository}.git`, ...refs);
|
|
119
|
+
}
|
|
120
|
+
finally {
|
|
121
|
+
await (0, promises_1.rm)(dir, { recursive: true, force: true });
|
|
122
|
+
}
|
|
123
|
+
};
|
|
90
124
|
/**
|
|
91
125
|
* tags pushed with the default GITHUB_TOKEN do not trigger `on: push:
|
|
92
126
|
* tags` workflows (github's recursion guard), so the taggedRelease
|
|
@@ -161,7 +195,15 @@ const changesetsReleaseJob = async () => {
|
|
|
161
195
|
else {
|
|
162
196
|
await (0, releaseGit_1.git)("add", CHANGELOG_FILE, CHANGESET_DIR);
|
|
163
197
|
}
|
|
164
|
-
|
|
198
|
+
// [skip ci] on github only: deploy-key pushes trigger workflows
|
|
199
|
+
// (unlike GITHUB_TOKEN pushes), and neither the release commit nor
|
|
200
|
+
// the tag needs a push-triggered run — the taggedRelease workflow is
|
|
201
|
+
// dispatched explicitly below, [skip ci] keeps it the only run. On
|
|
202
|
+
// gitlab the tag pipeline MUST fire natively, so no marker there
|
|
203
|
+
// (release-commit branch pipelines are already filtered by rules).
|
|
204
|
+
const onGithub = process.env.GITHUB_ACTIONS === "true";
|
|
205
|
+
const subject = `chore(release): ${version}${onGithub ? " [skip ci]" : ""}`;
|
|
206
|
+
await (0, releaseGit_1.git)("commit", "-m", `${subject}\n\n${entries}`);
|
|
165
207
|
await (0, releaseGit_1.git)("tag", tag);
|
|
166
208
|
await pushCommitAndTag(tag);
|
|
167
209
|
console.log(`released ${tag}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"changesetsReleaseJob.js","sourceRoot":"","sources":["../../../../../src/release/changesetsReleaseJob.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,2BAAgC;AAChC,
|
|
1
|
+
{"version":3,"file":"changesetsReleaseJob.js","sourceRoot":"","sources":["../../../../../src/release/changesetsReleaseJob.ts"],"names":[],"mappings":";;;AAAA;;;;;;GAMG;AACH,2BAAgC;AAChC,0CAAwE;AACxE,2BAA4B;AAC5B,+BAA4B;AAE5B,6CAMsB;AACtB,6CAKsB;AACtB,+CAAkD;AAElD,MAAM,aAAa,GAAG,YAAY,CAAC;AACnC,MAAM,cAAc,GAAG,cAAc,CAAC;AAEtC;;;;GAIG;AACH,MAAM,8BAA8B,GAAG,uBAAuB,CAAC;AAExD,MAAM,qBAAqB,GAAG,KAAK,IAAI,EAAE;IAC9C,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAC1B,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,WAAW,CACrE,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAChB,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CACvB,IAAA,+BAAkB,EAChB,IAAI,EACJ,MAAM,IAAA,mBAAQ,EAAC,IAAA,WAAI,EAAC,aAAa,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CACnD,CACF,CACF,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,qBAAqB,yBAahC;AAEF,MAAM,iBAAiB,GAAG,KAAK,IAAI,EAAE;IACnC,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAG,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;IACvD,MAAM,IAAA,gBAAG,EACP,QAAQ,EACR,WAAW,EACX,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,WAAW,CAC/C,CAAC;IACF,MAAM,IAAA,gBAAG,EACP,QAAQ,EACR,YAAY,EACZ,QAAQ;QACN,CAAC,CAAC,uDAAuD;QACzD,CAAC,CAAC,6BAA6B,CAClC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;;IAC7C,iEAAiE;IACjE,+DAA+D;IAC/D,iCAAiC;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,CAAC,mBAAmB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,2DAA2D;YAC3D,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,yBAAyB,CAAC,IAAI,CAAC,GAAG,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,mCAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,4CAA4C;oBAC3E,GAAG,CAAC,CAAC,OAAO,IAAI;oBAChB,gEAAgE,MAAM,KAAK;oBAC3E,sEAAsE;oBACtE,IAAI,eAAe,iDAAiD,CACvE,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,kBAAkB,KAAK,IAAI,IAAI,IAAI,WAAW,MAAM,CAAC;IACpE,MAAM,IAAA,gBAAG,EAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAEhD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,KAAK,EAAE,UAAkB,EAAE,IAAc,EAAE,EAAE;;IACrE,MAAM,SAAS,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,iBAAiB,mCAAI,oBAAoB,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;IACrC,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,IAAA,kBAAO,EAAC,IAAA,WAAI,EAAC,IAAA,WAAM,GAAE,EAAE,cAAc,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACxC,+DAA+D;QAC/D,MAAM,IAAA,oBAAS,EACb,OAAO,EACP,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,EAC1D;YACE,IAAI,EAAE,KAAK;SACZ,CACF,CAAC;QACF,MAAM,IAAA,uBAAU,EACd;YACE,eAAe,EAAE,UAAU,OAAO,4DAA4D;SAC/F,EACD,MAAM,EACN,UAAU,EACV,OAAO,IAAI,IAAI,UAAU,MAAM,EAC/B,GAAG,IAAI,CACR,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,IAAA,aAAE,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;GAMG;AACI,MAAM,6BAA6B,GAAG,KAAK,EAAE,GAAW,EAAE,EAAE;;IACjE,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,mCAAI,wBAAwB,CAAC;IACtE,MAAM,UAAU,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,MAAM,UAAU,UAAU,sBAAsB,8BAA8B,aAAa,EAC9F;QACE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,MAAM,EAAE,6BAA6B;SACtC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;KACnC,CACF,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,eAAe,8BAA8B,QAAQ,GAAG,YAAY,QAAQ,CAAC,MAAM,IAAI,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,cAAc,8BAA8B,QAAQ,GAAG,EAAE,CAAC,CAAC;AACzE,CAAC,CAAC;AArBW,QAAA,6BAA6B,iCAqBxC;AAEF;;;;;GAKG;AACH,MAAM,wBAAwB,GAAc;IAC1C,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,OAAO;IACb,OAAO,EAAE,4CAA4C;CACtD,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAqB,GAAE,CAAC;IAC9C,MAAM,WAAW,GACf,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,MAAM,CAAC;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CACT,0BAA0B,aAAa,wBAAwB,CAChE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,kBAAkB,IAAA,eAAU,EAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,8EAA8E,CAC/I,CAAC;QACF,OAAO,CAAC,GAAG,CACT,mEAAmE,CACpE,CAAC;QACF,IAAA,+BAAiB,EACf,wDAAwD,aAAa,OAAO;YAC1E,6EAA6E,CAChF,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,IAAA,iCAAoB,GAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,IAAA,8BAAiB,GAAE,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAA,2BAAc,EAC5B,OAAO,EACP,IAAA,oBAAO,EAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CACvC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,OAAO,EAAE,CAAC;IAC1B,OAAO,CAAC,GAAG,CACT,aAAa,GAAG,KAAK,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,eAAe,MAAM,UAAU,CAAC,MAAM,gBAAgB,CACvF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAA,mCAAsB,EAAC,UAAU,CAAC,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,IAAA,mBAAQ,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,IAAI,CACX,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAA,oBAAS,EACb,cAAc,EACd,IAAA,+BAAkB,EAAC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,CAAC,GAAG;IACf,kEAAkE;IAClE,wBAAwB;IACxB,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,aAAE,EAAC,IAAA,WAAI,EAAC,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CACxE,CAAC;IAEF,MAAM,iBAAiB,EAAE,CAAC;IAC1B,uEAAuE;IACvE,uDAAuD;IACvD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,cAAc,EAAE,aAAa,CAAC,CAAC;IAClD,CAAC;IACD,gEAAgE;IAChE,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;IACvD,MAAM,OAAO,GAAG,mBAAmB,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC5E,MAAM,IAAA,gBAAG,EAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;IACtD,MAAM,IAAA,gBAAG,EAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtB,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IAC/B,IAAA,+BAAiB,EAAC,iBAAiB,GAAG,SAAS,OAAO,EAAE,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,MAAM,IAAA,qCAA6B,EAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC,CAAC;AA5EW,QAAA,oBAAoB,wBA4E/B"}
|
|
@@ -1,4 +1,6 @@
|
|
|
1
1
|
export declare const git: (...args: string[]) => Promise<string>;
|
|
2
|
+
/** like `git`, but with extra environment variables (e.g. GIT_SSH_COMMAND) */
|
|
3
|
+
export declare const gitWithEnv: (env: Record<string, string>, ...args: string[]) => Promise<string>;
|
|
2
4
|
/**
|
|
3
5
|
* CI checkouts are usually shallow and tagless (gitlab clones with
|
|
4
6
|
* depth 1; github's checkout needs fetch-depth: 0) — the local history
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.getLastReleaseTag = exports.ensureReleaseHistory = exports.git = void 0;
|
|
3
|
+
exports.getLastReleaseTag = exports.ensureReleaseHistory = exports.gitWithEnv = exports.git = void 0;
|
|
4
4
|
/**
|
|
5
5
|
* git helpers shared by the release-related catci jobs (changesets
|
|
6
6
|
* release, changeset check).
|
|
@@ -13,6 +13,14 @@ const git = async (...args) => {
|
|
|
13
13
|
return stdout.trim();
|
|
14
14
|
};
|
|
15
15
|
exports.git = git;
|
|
16
|
+
/** like `git`, but with extra environment variables (e.g. GIT_SSH_COMMAND) */
|
|
17
|
+
const gitWithEnv = async (env, ...args) => {
|
|
18
|
+
const { stdout } = await execFile("git", args, {
|
|
19
|
+
env: { ...process.env, ...env },
|
|
20
|
+
});
|
|
21
|
+
return stdout.trim();
|
|
22
|
+
};
|
|
23
|
+
exports.gitWithEnv = gitWithEnv;
|
|
16
24
|
/**
|
|
17
25
|
* CI checkouts are usually shallow and tagless (gitlab clones with
|
|
18
26
|
* depth 1; github's checkout needs fetch-depth: 0) — the local history
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"releaseGit.js","sourceRoot":"","sources":["../../../../../src/release/releaseGit.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,iDAAuD;AACvD,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEhC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,IAAc,EAAmB,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAHW,QAAA,GAAG,OAGd;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,IAAA,WAAG,EAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,IAAA,WAAG,EAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,WAAG,EAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CACV,qCAAqC,CAAC,wDAAwD,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAfW,QAAA,oBAAoB,wBAe/B;AAEK,MAAM,iBAAiB,GAAG,KAAK,IAA4B,EAAE;IAClE,IAAI,CAAC;QACH,iEAAiE;QACjE,8DAA8D;QAC9D,2BAA2B;QAC3B,OAAO,MAAM,IAAA,WAAG,EAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AATW,QAAA,iBAAiB,qBAS5B"}
|
|
1
|
+
{"version":3,"file":"releaseGit.js","sourceRoot":"","sources":["../../../../../src/release/releaseGit.ts"],"names":[],"mappings":";;;AAAA;;;GAGG;AACH,iDAAuD;AACvD,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEhC,MAAM,GAAG,GAAG,KAAK,EAAE,GAAG,IAAc,EAAmB,EAAE;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AAHW,QAAA,GAAG,OAGd;AAEF,8EAA8E;AACvE,MAAM,UAAU,GAAG,KAAK,EAC7B,GAA2B,EAC3B,GAAG,IAAc,EACA,EAAE;IACnB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE;QAC7C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;KAChC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC,CAAC;AARW,QAAA,UAAU,cAQrB;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,KAAK,IAAI,EAAE;IAC7C,MAAM,OAAO,GAAG,MAAM,IAAA,WAAG,EAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC,KAAK,CACrE,GAAG,EAAE,CAAC,OAAO,CACd,CAAC;IACF,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,IAAA,WAAG,EAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,WAAG,EAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CACV,qCAAqC,CAAC,wDAAwD,CAC/F,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAfW,QAAA,oBAAoB,wBAe/B;AAEK,MAAM,iBAAiB,GAAG,KAAK,IAA4B,EAAE;IAClE,IAAI,CAAC;QACH,iEAAiE;QACjE,8DAA8D;QAC9D,2BAA2B;QAC3B,OAAO,MAAM,IAAA,WAAG,EAAC,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AATW,QAAA,iBAAiB,qBAS5B"}
|