@catladder/cli 0.0.0-main-bd7c0346 → 0.0.0-main-fd9c5f51

package/dist/bundles/catenv/index.js

@@ -3581,6 +3581,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/bundles/cli/index.js

@@ -761,14 +761,31 @@ const checkGithubMergeGating = async (report, repo) => {
         ? await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets/${named.id}`).catch(() => null)
         : null;
     if (ruleset && (0, githubMergeGating_1.rulesetProvidesMergeGating)(ruleset)) {
-        report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, release job can push`);
+        report.ok(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}': '${pipeline_1.AGGREGATE_CHECK_JOB_NAME}' required on ${branch}, deploy-key bypass for the release push`);
     }
     else if (ruleset) {
-        report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or release-job bypass missing)`, "run: catladder project setup");
+        report.fail(`ruleset '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' exists but is incomplete (inactive, check not required, or deploy-key bypass missing)`, "run: catladder project setup");
     }
     else {
         report.fail(`no '${githubMergeGating_1.MERGE_GATING_RULESET_NAME}' ruleset on ${repo} — PRs can merge while the pipeline is red or still running`, "run: catladder project setup");
     }
+    try {
+        const [keys, secretNames] = await Promise.all([
+            (0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
+            (0, github_1.listGithubSecretNames)(repo),
+        ]);
+        const key = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
+        const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
+        if (key && !key.read_only && hasSecret) {
+            report.ok(`release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
+        }
+        else {
+            report.fail(`release deploy key incomplete (key: ${key ? (key.read_only ? "read-only" : "ok") : "missing"}, secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET}: ${hasSecret ? "set" : "missing"}) — the release job cannot push past the merge gating`, "run: catladder project setup");
+        }
+    }
+    catch (e) {
+        report.warn(`could not check the release deploy key (${e.message})`);
+    }
     const protection = await (0, github_1.ghApiJson)("GET", `repos/${repo}/branches/${branch}/protection`).catch(() => null);
     const checks = (_b = (_a = protection === null || protection === void 0 ? void 0 : protection.required_status_checks) === null || _a === void 0 ? void 0 : _a.checks) !== null && _b !== void 0 ? _b : [];
     if (checks.some((c) => c.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME)) {
@@ -978,7 +995,7 @@ exports.doctorProject = doctorProject;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
+exports.rulesetProvidesMergeGating = exports.desiredMergeGatingRuleset = exports.RELEASE_DEPLOY_KEY_SECRET = exports.RELEASE_DEPLOY_KEY_TITLE = exports.MERGE_GATING_RULESET_NAME = exports.GITHUB_ACTIONS_APP_ID = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 /**
  * github merge gating — shared between `project setup` (writes it) and
@@ -987,17 +1004,30 @@ const pipeline_1 = __nccwpck_require__(53695);
  * The gating lives in a repository RULESET, not classic branch
  * protection: only rulesets can carry bypass actors, and the release
  * job needs one. It pushes the release commit and tag straight to the
- * default branch with the workflow token — under classic protection
- * the required `catladder ✅` check rejects that push (GH006), because
- * the fresh release commit cannot have a passing check yet. The bypass
- * covers the GitHub Actions app, i.e. pushes made by workflows, while
- * PRs and humans stay gated. (Gitlab's counterpart is the
- * maintainer-role project access token, which may push to protected
- * branches by default — the same trade-off, made by the platform.)
- */
-/** the app id of GitHub Actions — the actor workflow tokens act as */
+ * default branch — under classic protection the required `catladder ✅`
+ * check rejects that push (GH006), because the fresh release commit
+ * cannot have a passing check yet.
+ *
+ * The bypass actor is a DEPLOY KEY: github deliberately refuses the
+ * built-in GitHub Actions app on bypass lists (any collaborator could
+ * push anywhere by authoring a workflow), so the workflow token can
+ * never bypass. Instead `project setup` provisions a write deploy key
+ * (public half on the repo, private half as an actions secret) and the
+ * release job pushes over ssh with it. Deploy keys are repo-scoped,
+ * only admins can add them, and they never expire — gitlab's
+ * counterpart is the maintainer-role `GL_TOKEN`, which has to be
+ * renewed yearly.
+ */
+/** the app id of GitHub Actions — the integration reporting the check */
 exports.GITHUB_ACTIONS_APP_ID = 15368;
 exports.MERGE_GATING_RULESET_NAME = "catladder merge gating";
+/** title of the deploy key `project setup` registers on the repo */
+exports.RELEASE_DEPLOY_KEY_TITLE = "catladder release";
+/**
+ * actions secret holding the deploy key's private half; the generated
+ * release jobs pass it to catci, which pushes over ssh when it is set
+ */
+exports.RELEASE_DEPLOY_KEY_SECRET = "CATLADDER_RELEASE_KEY";
 /** the ruleset `project setup` creates (and restores on drift) */
 const desiredMergeGatingRuleset = () => ({
     name: exports.MERGE_GATING_RULESET_NAME,
@@ -1020,18 +1050,16 @@ const desiredMergeGatingRuleset = () => ({
         },
     ],
     bypass_actors: [
-        {
-            actor_id: exports.GITHUB_ACTIONS_APP_ID,
-            actor_type: "Integration",
-            bypass_mode: "always",
-        },
+        // deploy keys carry no id — the bypass covers every deploy key of
+        // the repository (adding one requires admin anyway)
+        { actor_id: null, actor_type: "DeployKey", bypass_mode: "always" },
     ],
 });
 exports.desiredMergeGatingRuleset = desiredMergeGatingRuleset;
 /**
  * whether a ruleset provides working merge gating: active, requires
- * the aggregate check, and lets the release job (GitHub Actions app)
- * bypass it. Extra rules or bypass actors someone added are fine.
+ * the aggregate check, and lets the release deploy key bypass it.
+ * Extra rules or bypass actors someone added are fine.
  */
 const rulesetProvidesMergeGating = (ruleset) => {
     var _a, _b;
@@ -1041,9 +1069,7 @@ const rulesetProvidesMergeGating = (ruleset) => {
             return rule.type === "required_status_checks" &&
                 ((_b = (_a = rule.parameters) === null || _a === void 0 ? void 0 : _a.required_status_checks) !== null && _b !== void 0 ? _b : []).some((check) => check.context === pipeline_1.AGGREGATE_CHECK_JOB_NAME);
         }) &&
-        ((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "Integration" &&
-            actor.actor_id === exports.GITHUB_ACTIONS_APP_ID &&
-            actor.bypass_mode === "always");
+        ((_b = ruleset.bypass_actors) !== null && _b !== void 0 ? _b : []).some((actor) => actor.actor_type === "DeployKey" && actor.bypass_mode === "always");
 };
 exports.rulesetProvidesMergeGating = rulesetProvidesMergeGating;
 //# sourceMappingURL=githubMergeGating.js.map
@@ -1145,13 +1171,14 @@ const setupProject = async (instance, onlyComponents) => {
     });
     const enabledPipelines = config ? (0, pipeline_1.getEnabledPipelineTypes)(config) : [];
     await (0, logSection_1.logSection)(instance, "base setup", async () => {
-        // gitlab-specific provisioning (access token, agent webhooks) —
-        // meaningless (and failing) on a github-only project
+        // gitlab-specific provisioning (access token, agent webhooks, the
+        // `catladder` project topic) — meaningless (and failing) on a
+        // github-only project
         if (enabledPipelines.includes("gitlab")) {
             await (0, setupAccessTokens_1.setupAccessTokens)(instance);
             await (0, setupAgents_1.setupAgents)(instance);
+            await (0, setupTopic_1.setupTopic)(instance);
         }
-        await (0, setupTopic_1.setupTopic)(instance);
         if (config) {
             await (0, setupGithub_1.setupGithub)(instance, config);
         }
@@ -1534,9 +1561,15 @@ exports.setupContext = setupContext;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const child_process_1 = __nccwpck_require__(35317);
+const promises_1 = __nccwpck_require__(91943);
+const os_1 = __nccwpck_require__(70857);
+const path_1 = __nccwpck_require__(16928);
+const util_1 = __nccwpck_require__(39023);
 const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 const github_1 = __nccwpck_require__(41353);
 const githubMergeGating_1 = __nccwpck_require__(14966);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * configures github merge gating — the sane default gitlab ships
  * built-in and a fresh github repository lacks entirely: without it a
@@ -1544,11 +1577,14 @@ const githubMergeGating_1 = __nccwpck_require__(14966);
  * auto-merge button never appears.
  *
  * - repo settings: allow auto-merge, delete merged head branches
+ * - the release deploy key: a write deploy key on the repo, its
+ *   private half stored as the CATLADDER_RELEASE_KEY actions secret —
+ *   the release job pushes the release commit and tag with it
  * - a repository ruleset on the default branch requiring the generated
  *   `catladder ✅` aggregate check (the one stable context — individual
- *   job names change with every component add/rename), with a bypass
- *   for the GitHub Actions app so the release job can push the release
- *   commit and tag (see githubMergeGating.ts for the full rationale)
+ *   job names change with every component add/rename), with a deploy
+ *   key bypass so the release push goes through (see
+ *   githubMergeGating.ts for the full rationale)
  *
  * Earlier versions required the check via classic branch protection,
  * which has no bypass list — the release job's direct push to the
@@ -1580,6 +1616,7 @@ const setupGithub = async (instance, config) => {
     else {
         instance.log("✅ auto-merge already enabled");
     }
+    await ensureReleaseDeployKey(instance, repo);
     const branch = repoInfo.default_branch;
     const rulesets = await (0, github_1.ghApiJson)("GET", `repos/${repo}/rulesets?per_page=100`);
     const existing = rulesets.find((r) => r.name === githubMergeGating_1.MERGE_GATING_RULESET_NAME);
@@ -1600,6 +1637,57 @@ const setupGithub = async (instance, config) => {
     await migrateAwayFromClassicProtection(instance, repo, branch);
 };
 exports.setupGithub = setupGithub;
+/**
+ * provisions the release deploy key: an ed25519 keypair whose public
+ * half becomes a write deploy key on the repo and whose private half
+ * becomes the CATLADDER_RELEASE_KEY actions secret. The key and the
+ * secret only work as a pair, so when either half is missing the pair
+ * is rotated (github secrets are write-only — the private half can
+ * never be read back to check it matches).
+ */
+const ensureReleaseDeployKey = async (instance, repo) => {
+    const [keys, secretNames] = await Promise.all([
+        (0, github_1.ghApiJson)("GET", `repos/${repo}/keys?per_page=100`),
+        (0, github_1.listGithubSecretNames)(repo),
+    ]);
+    const existingKey = keys.find((k) => k.title === githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE);
+    const hasSecret = secretNames.some((name) => name.toUpperCase() === githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET);
+    if (existingKey && !existingKey.read_only && hasSecret) {
+        instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' + secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} in place`);
+        return;
+    }
+    if (existingKey) {
+        await (0, github_1.ghApiJson)("DELETE", `repos/${repo}/keys/${existingKey.id}`);
+        instance.log(`♻️ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' rotated (${existingKey.read_only
+            ? "was read-only"
+            : `secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} missing`})`);
+    }
+    const dir = await (0, promises_1.mkdtemp)((0, path_1.join)((0, os_1.tmpdir)(), "catladder-release-key-"));
+    try {
+        const keyFile = (0, path_1.join)(dir, "id_ed25519");
+        await execFile("ssh-keygen", [
+            ...["-t", "ed25519"],
+            ...["-C", `${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE} (${repo})`],
+            ...["-N", ""],
+            ...["-f", keyFile],
+            "-q",
+        ]);
+        const [privateKey, publicKey] = await Promise.all([
+            (0, promises_1.readFile)(keyFile, "utf-8"),
+            (0, promises_1.readFile)(`${keyFile}.pub`, "utf-8"),
+        ]);
+        await (0, github_1.ghApiJson)("POST", `repos/${repo}/keys`, {
+            title: githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE,
+            key: publicKey.trim(),
+            read_only: false,
+        });
+        await (0, github_1.setGithubSecret)(repo, githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET, privateKey);
+    }
+    finally {
+        await (0, promises_1.rm)(dir, { recursive: true, force: true });
+    }
+    instance.log(`✅ release deploy key '${githubMergeGating_1.RELEASE_DEPLOY_KEY_TITLE}' registered, private half stored as secret ${githubMergeGating_1.RELEASE_DEPLOY_KEY_SECRET} — the release job pushes with it`);
+};
 /**
  * removes the aggregate check from a classic branch protection rule
  * set up by earlier catladder versions — with the check now required
@@ -9659,6 +9747,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/bundles/runner-images/changesets/Dockerfile

@@ -1,6 +1,7 @@
 FROM node:lts-alpine
 
-RUN apk add --no-cache bash git git-lfs
+# openssh: the release job pushes with the release deploy key over ssh
+RUN apk add --no-cache bash git git-lfs openssh-client
 
 # no release tooling baked in: the changesets release logic lives in
 # catci, which is materialized into the repository checkout

package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md

@@ -264,13 +264,17 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   branch requiring the generated **`catladder ✅`** aggregate check
   (the one stable context — never require individual job names, they
   change with every component add/rename and a stale required name
-  blocks its own PR forever). The ruleset carries a bypass for the
-  GitHub Actions app: the release job pushes the release commit and
-  tag straight to the default branch with the workflow token, which a
-  required check would otherwise reject (GH006 — classic branch
-  protection has no bypass list, which is why setup uses a ruleset and
-  migrates old classic-protection gating away). `project doctor`
-  verifies all of it. Required reviews stay a human choice.
+  blocks its own PR forever). The ruleset carries a **deploy-key
+  bypass**: the release job pushes the release commit and tag straight
+  to the default branch, which the required check would otherwise
+  reject (GH006) — and github deliberately never lets the workflow
+  token bypass rulesets, so setup provisions a write deploy key
+  ("catladder release", private half in the `CATLADDER_RELEASE_KEY`
+  actions secret; deploy keys never expire) that the release job
+  pushes with over ssh. Classic branch protection has no bypass list
+  at all, which is why setup uses a ruleset and migrates old
+  classic-protection gating away. `project doctor` verifies all of it.
+  Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,

package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js

@@ -57,6 +57,11 @@ const createReleaseJob = (config, images, options = {}) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
+            // the release deploy key (provisioned by `project setup`): the
+            // release push must bypass the merge-gating ruleset, which only
+            // a deploy key can — empty when not provisioned, then the job
+            // pushes with the workflow token (fine without gating)
+            CATLADDER_RELEASE_KEY: "${{ secrets.CATLADDER_RELEASE_KEY }}",
             ...options.extraEnv,
         },
         steps: [

package/dist/packages/pipeline/src/backends/github/githubReleaseJobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"githubReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/githubReleaseJobs.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AACvD,uDAA8D;AAC9D,2CAAiD;AACjD,2DAAkE;AAIlE,MAAM,KAAK,GAAG,GAAG,qCAAsB,WAAW,CAAC;AAEnD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CACjC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,EAAE,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,KAAK;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAA,2CAAyB,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,MAAqB,EACrB,UAqBI,EAAE,EACK,EAAE;;IACb,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,CAAC,OAAO,CAAC,cAAc;QACvB,QAAQ,CAAC,IAAI;QACb,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,QAAQ,EAAE,qBAAqB;wBAC/B,QAAQ,EAAE,qBAAqB;qBAChC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,2CAA2C;QAC3C,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,EAAE;YACH,YAAY,EAAE,qBAAqB;YACnC,GAAG,OAAO,CAAC,QAAQ;SACpB;QACD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,2DAA2D;gBAC3D,wDAAwD;gBACxD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;aAC3B;YACD,GAAG,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,qBAAqB;wBAC3B,EAAE,EAAE,OAAO;wBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,EAAE,QAAQ,KAAK,6BAA6B;wBAC/C,KAAK,EAAE,MAAM;qBACd;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,OAAO,CAAC,UAAU;oBACpB,CAAC,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,EAAE,MAAM,CAAC,MAAM;gBAClB,KAAK,EAAE,MAAM;aACd;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,kBAA4B,EAC5B,MAAqB,EACM,EAAE;;IAC7B,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;YACjD,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,oBAAoB,wBAa/B;AAEF;;;;;;;;;;GAUG;AACI,MAAM,8BAA8B,GAAG,CAC5C,MAAc,EACd,MAAqB,EACrB,WAAmC,EACnB,EAAE;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;QAC3C,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC;gBACE,YAAY,EAAE,sBAAsB;gBACpC,mDAAmD;gBACnD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnD,GAAG;oBACH,yBAAyB,KAAK,YAAY;iBAC3C,CAAC,CACH;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE;YACF,iBAAiB,EAAE,cAAc;gBAC/B,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,KAAK,EAAE;4BACL,WAAW,EACT,uFAAuF;4BACzF,QAAQ,EAAE,KAAK;4BACf,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,KAAK;yBACf;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE;SACP;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC;YAC7C,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,+BAA+B,GAAG,CAC7C,MAAc,EACd,MAAqB,EACrB,gBAAwB,EACxB,WAAmC,EACZ,EAAE;;IACzB,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE;YACF,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,gBAAgB,CAAC;gBAC7B,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB;SACF;QACD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,+CAA+C;gBAC/C,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,GAAG,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE;gBAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;gBAC1D,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;oBACjD;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,EAAE,EAAE,OAAO;wBACX,GAAG,EAAE,QAAQ,KAAK,0HAA0H;wBAC5I,KAAK,EAAE,MAAM;qBACd;iBACF;aACF;YACD,gBAAgB,EAAE;gBAChB,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;oBAClC,KAAK,EAAE,CAAC,OAAO,CAAC;oBAChB,cAAc,EAAE,IAAI;iBACrB,CAAC;gBACF,EAAE,EAAE,8CAA8C;aACnD;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AA7CW,QAAA,+BAA+B,mCA6C1C;AAEF;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAChD,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;oBAC3B,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,QAAQ,EAAE,qBAAqB;4BAC/B,QAAQ,EAAE,qBAAqB;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,MAAM;gBAChB,eAAe,EAAE,OAAO;gBACxB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,mBAAmB,EAAE,IAAI;YACzB,GAAG,EAAE;gBACH,YAAY,EAAE,qBAAqB;aACpC;YACD,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,qBAAqB;oBAC3B,4DAA4D;oBAC5D,cAAc;oBACd,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;iBAC3B;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,GAAG,EAAE,MAAM,CAAC,WAAW;oBACvB,KAAK,EAAE,MAAM;iBACd;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAtDW,QAAA,yBAAyB,6BAsDpC"}
+{"version":3,"file":"githubReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/githubReleaseJobs.ts"],"names":[],"mappings":";;;AACA,yDAAuD;AACvD,uDAA8D;AAC9D,2CAAiD;AACjD,2DAAkE;AAIlE,MAAM,KAAK,GAAG,GAAG,qCAAsB,WAAW,CAAC;AAEnD;;;GAGG;AACH,MAAM,0BAA0B,GAAG,CACjC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,cAAc,EAAE,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC,KAAK;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,IAAA,2CAAyB,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,MAAqB,EACrB,UAqBI,EAAE,EACK,EAAE;;IACb,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,CAAC,OAAO,CAAC,cAAc;QACvB,QAAQ,CAAC,IAAI;QACb,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,QAAQ,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,CAAC,MAAA,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,CAAC;IAC3D,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,eAAe;QAC1B,SAAS,EAAE;YACT,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;gBAC3B,CAAC,CAAC;oBACE,WAAW,EAAE;wBACX,QAAQ,EAAE,qBAAqB;wBAC/B,QAAQ,EAAE,qBAAqB;qBAChC;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR;QACD,gEAAgE;QAChE,kEAAkE;QAClE,6DAA6D;QAC7D,+DAA+D;QAC/D,mEAAmE;QACnE,2CAA2C;QAC3C,WAAW,EAAE;YACX,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D;QACD,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,EAAE;YACH,YAAY,EAAE,qBAAqB;YACnC,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,qBAAqB,EAAE,sCAAsC;YAC7D,GAAG,OAAO,CAAC,QAAQ;SACpB;QACD,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,qBAAqB;gBAC3B,2DAA2D;gBAC3D,wDAAwD;gBACxD,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;aAC3B;YACD,GAAG,CAAC,OAAO,CAAC,UAAU;gBACpB,CAAC,CAAC;oBACE;wBACE,IAAI,EAAE,qBAAqB;wBAC3B,EAAE,EAAE,OAAO;wBACX,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7D,GAAG,EAAE,QAAQ,KAAK,6BAA6B;wBAC/C,KAAK,EAAE,MAAM;qBACd;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP;gBACE,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,OAAO,CAAC,UAAU;oBACpB,CAAC,CAAC,EAAE,EAAE,EAAE,sCAAsC,EAAE;oBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,EAAE,MAAM,CAAC,MAAM;gBAClB,KAAK,EAAE,MAAM;aACd;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;GAKG;AACI,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,kBAA4B,EAC5B,MAAqB,EACM,EAAE;;IAC7B,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO;QACL,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;YACjD,KAAK,EAAE,kBAAkB;SAC1B,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAbW,QAAA,oBAAoB,wBAa/B;AAEF;;;;;;;;;;GAUG;AACI,MAAM,8BAA8B,GAAG,CAC5C,MAAc,EACd,MAAqB,EACrB,WAAmC,EACnB,EAAE;IAClB,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,MAAM,cAAc,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACpD,MAAM,GAAG,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;QAC3C,UAAU,EAAE,IAAI;QAChB,GAAG,CAAC,cAAc;YAChB,CAAC,CAAC;gBACE,YAAY,EAAE,sBAAsB;gBACpC,mDAAmD;gBACnD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnD,GAAG;oBACH,yBAAyB,KAAK,YAAY;iBAC3C,CAAC,CACH;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IACH,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,EAAE,EAAE;YACF,iBAAiB,EAAE,cAAc;gBAC/B,CAAC,CAAC;oBACE,MAAM,EAAE;wBACN,KAAK,EAAE;4BACL,WAAW,EACT,uFAAuF;4BACzF,QAAQ,EAAE,KAAK;4BACf,IAAI,EAAE,SAAS;4BACf,OAAO,EAAE,KAAK;yBACf;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE;SACP;QACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE;QACpD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,GAAG,0BAA0B,CAAC,MAAM,EAAE,MAAM,CAAC;YAC7C,gBAAgB,EAAE,GAAG;SACtB;KACF,CAAC;AACJ,CAAC,CAAC;AA9CW,QAAA,8BAA8B,kCA8CzC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,+BAA+B,GAAG,CAC7C,MAAc,EACd,MAAqB,EACrB,gBAAwB,EACxB,WAAmC,EACZ,EAAE;;IACzB,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI,EAAE,gCAAgC;QACtC,EAAE,EAAE;YACF,YAAY,EAAE;gBACZ,SAAS,EAAE,CAAC,gBAAgB,CAAC;gBAC7B,KAAK,EAAE,CAAC,WAAW,CAAC;aACrB;SACF;QACD,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE;YACJ,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,eAAe;gBAC1B,+CAA+C;gBAC/C,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE;gBAClC,GAAG,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE;gBAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,oCAAoC,EAAE;gBAC1D,KAAK,EAAE;oBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;oBACjD;wBACE,IAAI,EAAE,sBAAsB;wBAC5B,EAAE,EAAE,OAAO;wBACX,GAAG,EAAE,QAAQ,KAAK,0HAA0H;wBAC5I,KAAK,EAAE,MAAM;qBACd;iBACF;aACF;YACD,gBAAgB,EAAE;gBAChB,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE;oBAClC,KAAK,EAAE,CAAC,OAAO,CAAC;oBAChB,cAAc,EAAE,IAAI;iBACrB,CAAC;gBACF,EAAE,EAAE,8CAA8C;aACnD;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AA7CW,QAAA,+BAA+B,mCA6C1C;AAEF;;;;;GAKG;AACI,MAAM,yBAAyB,GAAG,CACvC,MAAc,EACd,MAAqB,EACM,EAAE;IAC7B,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ;QAChD,CAAC,CAAC,CAAC,IAAA,oCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO;QACL,iBAAiB,EAAE;YACjB,IAAI,EAAE,iBAAiB;YACvB,SAAS,EAAE,eAAe;YAC1B,SAAS,EAAE;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,GAAG,CAAC,QAAQ,CAAC,gBAAgB;oBAC3B,CAAC,CAAC;wBACE,WAAW,EAAE;4BACX,QAAQ,EAAE,qBAAqB;4BAC/B,QAAQ,EAAE,qBAAqB;yBAChC;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,WAAW,EAAE;gBACX,QAAQ,EAAE,MAAM;gBAChB,eAAe,EAAE,OAAO;gBACxB,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,mBAAmB,EAAE,IAAI;YACzB,GAAG,EAAE;gBACH,YAAY,EAAE,qBAAqB;aACpC;YACD,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,qBAAqB;oBAC3B,4DAA4D;oBAC5D,cAAc;oBACd,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE;iBAC3B;gBACD;oBACE,IAAI,EAAE,iBAAiB;oBACvB,GAAG,EAAE,MAAM,CAAC,WAAW;oBACvB,KAAK,EAAE,MAAM;iBACd;aACF;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAtDW,QAAA,yBAAyB,6BAsDpC"}

package/dist/runner-images/changesets/Dockerfile

@@ -1,6 +1,7 @@
 FROM node:lts-alpine
 
-RUN apk add --no-cache bash git git-lfs
+# openssh: the release job pushes with the release deploy key over ssh
+RUN apk add --no-cache bash git git-lfs openssh-client
 
 # no release tooling baked in: the changesets release logic lives in
 # catci, which is materialized into the repository checkout

package/dist/skills/catladder-migrate-ci-backend/SKILL.md

@@ -264,13 +264,17 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   branch requiring the generated **`catladder ✅`** aggregate check
   (the one stable context — never require individual job names, they
   change with every component add/rename and a stale required name
-  blocks its own PR forever). The ruleset carries a bypass for the
-  GitHub Actions app: the release job pushes the release commit and
-  tag straight to the default branch with the workflow token, which a
-  required check would otherwise reject (GH006 — classic branch
-  protection has no bypass list, which is why setup uses a ruleset and
-  migrates old classic-protection gating away). `project doctor`
-  verifies all of it. Required reviews stay a human choice.
+  blocks its own PR forever). The ruleset carries a **deploy-key
+  bypass**: the release job pushes the release commit and tag straight
+  to the default branch, which the required check would otherwise
+  reject (GH006) — and github deliberately never lets the workflow
+  token bypass rulesets, so setup provisions a write deploy key
+  ("catladder release", private half in the `CATLADDER_RELEASE_KEY`
+  actions secret; deploy keys never expire) that the release job
+  pushes with over ssh. Classic branch protection has no bypass list
+  at all, which is why setup uses a ruleset and migrates old
+  classic-protection gating away. `project doctor` verifies all of it.
+  Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,