@catladder/cli 0.0.0-next-1cd29c1f → 0.0.0-next-52feb889

package/dist/bundles/catenv/index.js

@@ -397,7 +397,7 @@ program.parse();
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.getProjectConfig = exports.parseChoice = void 0;
+exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.invalidateProjectConfig = exports.getProjectConfig = exports.parseChoice = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const gitlab_1 = __nccwpck_require__(4508);
 const projects_1 = __nccwpck_require__(57414);
@@ -427,6 +427,15 @@ const getProjectConfig = async () => {
   return currentConfig;
 };
 exports.getProjectConfig = getProjectConfig;
+/**
+ * drops the cached config so the next access re-reads it from disk —
+ * needed after writing the catladder store, which is attached to the
+ * config (`config.store`) at read time
+ */
+const invalidateProjectConfig = () => {
+  currentConfig = null;
+};
+exports.invalidateProjectConfig = invalidateProjectConfig;
 const getProjectComponents = async () => {
   const config = await (0, exports.getProjectConfig)();
   if (!config) return [];
@@ -5136,7 +5145,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-1cd29c1f" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-52feb889" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -5747,6 +5756,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 __exportStar(__nccwpck_require__(14847), exports);
+__exportStar(__nccwpck_require__(57044), exports);
 __exportStar(__nccwpck_require__(14956), exports);
 __exportStar(__nccwpck_require__(85855), exports);
 
@@ -6151,7 +6161,9 @@ exports.RUNNER_IMAGE_BUILD_CONTEXT = {
  */
 const getShippedImagesDir = () => {
   const candidates = [
-  // built package: dist/customImages -> dist/runner-images
+  // built pipeline package: dist/customImages -> dist/runner-images
+  // bundled cli package (what consumers install): the ncc bundles live
+  // in dist/bundles/<name>, so both resolve to dist/bundles/runner-images
   (0, path_1.join)(__dirname, "..", "runner-images"),
   // repository: pipeline/src/customImages -> <root>/runner-images
   (0, path_1.join)(__dirname, "..", "..", "..", "runner-images")];
@@ -7032,8 +7044,11 @@ const getCreateScheduleScript = context => {
     config
   }, jobIndex) => {
     var _a;
+    // `headers` is pulled out of the shared args because the flag name differs
+    // between create (`--headers`) and update (`--update-headers`).
     const {
       uri,
+      headers,
       ...args
     } = getSchedulerArgs(config, context);
     const argsString = (0, createArgsString_1.createArgsString)({
@@ -7044,12 +7059,15 @@ const getCreateScheduleScript = context => {
       schedule: `"${config.schedule}"`,
       "max-retry-attempts": (_a = config.maxRetryAttempts) !== null && _a !== void 0 ? _a : 0
     });
-    return [jobIndex === 0 ? `exist_scheduler_names="$(\n  ${(0, common_1.gcloudSchedulerCmd)()} jobs list --filter='httpTarget.uri ~ ${context.env}.*${context.name}' --format='value(name)' --limit=999 --location='${location}' --project='${project}'\n)"` : null, `current_job_uri="${uri}"`, `current_scheduler_name="${fullName}"`, `if echo "$exist_scheduler_names" | grep -Fx "$current_scheduler_name" >/dev/null; then`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs update http "$current_scheduler_name" ${argsString}`, `else`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs create http "$current_scheduler_name" ${argsString}`, `fi`].filter(utils_1.notNil).join("\n");
+    const headersValue = headers ? `"${(0, bash_1.bashEscape)(headers)}"` : undefined;
+    const createHeadersArg = headersValue ? ` --headers=${headersValue}` : "";
+    const updateHeadersArg = headersValue ? ` --update-headers=${headersValue}` : "";
+    return [jobIndex === 0 ? `exist_scheduler_names="$(\n  ${(0, common_1.gcloudSchedulerCmd)()} jobs list --filter='httpTarget.uri ~ ${context.env}.*${context.name}' --format='value(name)' --limit=999 --location='${location}' --project='${project}'\n)"` : null, `current_job_uri="${uri}"`, `current_scheduler_name="${fullName}"`, `if echo "$exist_scheduler_names" | grep -Fx "$current_scheduler_name" >/dev/null; then`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs update http "$current_scheduler_name" ${argsString}${updateHeadersArg}`, `else`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs create http "$current_scheduler_name" ${argsString}${createHeadersArg}`, `fi`].filter(utils_1.notNil).join("\n");
   });
 };
 exports.getCreateScheduleScript = getCreateScheduleScript;
 const getSchedulerArgs = (scheduler, context) => {
-  var _a;
+  var _a, _b;
   if (scheduler.type === "job") {
     const {
       projectId,
@@ -7077,10 +7095,19 @@ const getSchedulerArgs = (scheduler, context) => {
     };
   }
   if (scheduler.type === "http") {
+    // default the Content-Type to application/json when a body is sent and the
+    // user didn't set one explicitly. Otherwise Cloud Scheduler falls back to
+    // application/octet-stream, which is rarely what's intended.
+    const hasContentType = Object.keys((_b = scheduler.headers) !== null && _b !== void 0 ? _b : {}).some(k => k.toLowerCase() === "content-type");
+    const headers = scheduler.body && !hasContentType ? {
+      "Content-Type": "application/json",
+      ...scheduler.headers
+    } : scheduler.headers;
     return {
       uri: scheduler.url,
-      "message-body": scheduler.body,
+      "message-body": scheduler.body ? '"' + (0, bash_1.bashEscape)(scheduler.body) + '"' : undefined,
       "http-method": scheduler.method,
+      headers: headers ? Object.entries(headers).map(([k, v]) => `${k}=${v}`).join(",") : undefined,
       "oidc-service-account-email": `"${(0, common_1.getComputeServiceAccountEmail)(context)}"`
     };
   }
@@ -9697,6 +9724,10 @@ exports.getCatladderStorePath = getCatladderStorePath;
 /**
  * reads and validates the catladder store. Returns an empty store when the
  * file does not exist (project setup has not run yet).
+ *
+ * An unreadable or invalid store is treated the same as a missing one
+ * (with a warning): the store only holds machine-fetched values, so the
+ * remedy is always rerunning project setup — not hand-editing the file.
  */
 const readCatladderStore = (directory = process.cwd()) => {
   var _a;
@@ -9704,9 +9735,14 @@ const readCatladderStore = (directory = process.cwd()) => {
   if (!(0, fs_1.existsSync)(path)) {
     return {};
   }
-  return exports.catladderStoreSchema.parse((_a = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, {
-    encoding: "utf-8"
-  }))) !== null && _a !== void 0 ? _a : {});
+  try {
+    return exports.catladderStoreSchema.parse((_a = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, {
+      encoding: "utf-8"
+    }))) !== null && _a !== void 0 ? _a : {});
+  } catch (error) {
+    console.warn(`⚠️ ignoring invalid ${exports.CATLADDER_STORE_FILE} (rerun "catladder project setup" to regenerate it): ${error instanceof Error ? error.message : error}`);
+    return {};
+  }
 };
 exports.readCatladderStore = readCatladderStore;
 /**

package/dist/bundles/cli/index.js

@@ -587,6 +587,77 @@ exports.projectConfigSecrets = projectConfigSecrets;
 
 /***/ }),
 
+/***/ 22661:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.ensureGcloudProjectNumbers = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const getProjectNumber_1 = __nccwpck_require__(68666);
+const updateCatladderStore_1 = __nccwpck_require__(66487);
+const projects_1 = __nccwpck_require__(57414);
+/**
+ * fetches the gcloud project numbers of all cloud run deploys into the
+ * catladder store.
+ *
+ * This must run BEFORE any pipeline context is created: context creation
+ * computes the deterministic cloud run urls, which read the project
+ * number from the store and throw when it is missing — on a fresh
+ * project that would make `project setup` fail with the very error it is
+ * supposed to fix (chicken-and-egg).
+ */
+const ensureGcloudProjectNumbers = async instance => {
+  var _a;
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) return;
+  const projectIds = new Set();
+  for (const {
+    componentName,
+    env
+  } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+    const {
+      deploy
+    } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+    if (deploy && deploy.type === "google-cloudrun") {
+      projectIds.add(deploy.projectId);
+    }
+  }
+  const root = (_a = await (0, projects_1.getGitRoot)()) !== null && _a !== void 0 ? _a : process.cwd();
+  const store = (0, pipeline_1.readCatladderStore)(root);
+  const missing = [...projectIds].filter(projectId => {
+    var _a, _b;
+    return !((_b = (_a = store.gcloudProjects) === null || _a === void 0 ? void 0 : _a[projectId]) === null || _b === void 0 ? void 0 : _b.projectNumber);
+  });
+  for (const projectId of missing) {
+    instance.log(`fetch gcloud project number for ${projectId}...`);
+    const projectNumber = await (0, getProjectNumber_1.fetchGcloudProjectNumber)(projectId);
+    instance.log(`project number: ${projectNumber}`);
+    await (0, updateCatladderStore_1.updateCatladderStore)(current => ({
+      ...current,
+      gcloudProjects: {
+        ...current.gcloudProjects,
+        [projectId]: {
+          projectNumber
+        }
+      }
+    }));
+  }
+  if (missing.length > 0) {
+    // the store is attached to the config at read time; drop the cached
+    // config so contexts created after this pre-pass see the new values
+    (0, getProjectConfig_1.invalidateProjectConfig)();
+  }
+};
+exports.ensureGcloudProjectNumbers = ensureGcloudProjectNumbers;
+
+/***/ }),
+
 /***/ 80426:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -603,7 +674,10 @@ const setupContext_1 = __nccwpck_require__(63516);
 const setupTopic_1 = __nccwpck_require__(66992);
 const setupAgents_1 = __nccwpck_require__(73861);
 const logSection_1 = __nccwpck_require__(87105);
+const ensureGcloudProjectNumbers_1 = __nccwpck_require__(22661);
 const setupProject = async (instance, onlyComponents) => {
+  // must come first: creating contexts already requires the store
+  await (0, ensureGcloudProjectNumbers_1.ensureGcloudProjectNumbers)(instance);
   const allContext = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
   instance.log("will setup those contexts:");
   allContext.forEach(context => {
@@ -4373,7 +4447,7 @@ exports.uninstallCompletions = uninstallCompletions;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.getProjectConfig = exports.parseChoice = void 0;
+exports.getJobOnlyEnvVarsResolved = exports.getEnvVarsResolved = exports.getGitlabVar = exports.getEnvironment = exports.getAllPipelineContexts = exports.getAllComponentsWithAllEnvsHierarchical = exports.getAllComponentsWithAllEnvsFlat = exports.getPipelineContextByChoice = exports.getProjectComponents = exports.invalidateProjectConfig = exports.getProjectConfig = exports.parseChoice = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const gitlab_1 = __nccwpck_require__(4508);
 const projects_1 = __nccwpck_require__(57414);
@@ -4403,6 +4477,15 @@ const getProjectConfig = async () => {
   return currentConfig;
 };
 exports.getProjectConfig = getProjectConfig;
+/**
+ * drops the cached config so the next access re-reads it from disk —
+ * needed after writing the catladder store, which is attached to the
+ * config (`config.store`) at read time
+ */
+const invalidateProjectConfig = () => {
+  currentConfig = null;
+};
+exports.invalidateProjectConfig = invalidateProjectConfig;
 const getProjectComponents = async () => {
   const config = await (0, exports.getProjectConfig)();
   if (!config) return [];
@@ -4661,8 +4744,12 @@ const createCopyDbScript = ({
   const copyDBScript = `
       set -e
 
-      ${targetPSQL(`-c 'drop database "${targetDbName}" WITH (FORCE)' 1> /dev/null || true`)}
-      ${targetPSQL(`-c 'create database "${targetDbName}"' 1> /dev/null`)}
+      ${targetPSQL(
+  // connect to the always-existing "postgres" maintenance database:
+  // without an explicit dbname, psql falls back to the username and
+  // fails with e.g. 'FATAL: database "user" does not exist'
+  `--dbname=postgres -c 'drop database "${targetDbName}" WITH (FORCE)' 1> /dev/null || true`)}
+      ${targetPSQL(`--dbname=postgres -c 'create database "${targetDbName}"' 1> /dev/null`)}
       echo "Estimating database size..."
       DB_SIZE=$(PGPASSWORD=${encodedSourcePassword} psql --dbname=postgres://${encodedSourceUsername}:${encodedSourcePassword}@localhost:${sourcePort}/${sourceDbName} -t -A -c "SELECT pg_database_size('${sourceDbName}')")
       # pg_database_size includes indexes, TOAST, and free space — pg_dump output is roughly 40% of that
@@ -10309,7 +10396,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-1cd29c1f" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-52feb889" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -10920,6 +11007,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 __exportStar(__nccwpck_require__(14847), exports);
+__exportStar(__nccwpck_require__(57044), exports);
 __exportStar(__nccwpck_require__(14956), exports);
 __exportStar(__nccwpck_require__(85855), exports);
 
@@ -11324,7 +11412,9 @@ exports.RUNNER_IMAGE_BUILD_CONTEXT = {
  */
 const getShippedImagesDir = () => {
   const candidates = [
-  // built package: dist/customImages -> dist/runner-images
+  // built pipeline package: dist/customImages -> dist/runner-images
+  // bundled cli package (what consumers install): the ncc bundles live
+  // in dist/bundles/<name>, so both resolve to dist/bundles/runner-images
   (0, path_1.join)(__dirname, "..", "runner-images"),
   // repository: pipeline/src/customImages -> <root>/runner-images
   (0, path_1.join)(__dirname, "..", "..", "..", "runner-images")];
@@ -12205,8 +12295,11 @@ const getCreateScheduleScript = context => {
     config
   }, jobIndex) => {
     var _a;
+    // `headers` is pulled out of the shared args because the flag name differs
+    // between create (`--headers`) and update (`--update-headers`).
     const {
       uri,
+      headers,
       ...args
     } = getSchedulerArgs(config, context);
     const argsString = (0, createArgsString_1.createArgsString)({
@@ -12217,12 +12310,15 @@ const getCreateScheduleScript = context => {
       schedule: `"${config.schedule}"`,
       "max-retry-attempts": (_a = config.maxRetryAttempts) !== null && _a !== void 0 ? _a : 0
     });
-    return [jobIndex === 0 ? `exist_scheduler_names="$(\n  ${(0, common_1.gcloudSchedulerCmd)()} jobs list --filter='httpTarget.uri ~ ${context.env}.*${context.name}' --format='value(name)' --limit=999 --location='${location}' --project='${project}'\n)"` : null, `current_job_uri="${uri}"`, `current_scheduler_name="${fullName}"`, `if echo "$exist_scheduler_names" | grep -Fx "$current_scheduler_name" >/dev/null; then`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs update http "$current_scheduler_name" ${argsString}`, `else`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs create http "$current_scheduler_name" ${argsString}`, `fi`].filter(utils_1.notNil).join("\n");
+    const headersValue = headers ? `"${(0, bash_1.bashEscape)(headers)}"` : undefined;
+    const createHeadersArg = headersValue ? ` --headers=${headersValue}` : "";
+    const updateHeadersArg = headersValue ? ` --update-headers=${headersValue}` : "";
+    return [jobIndex === 0 ? `exist_scheduler_names="$(\n  ${(0, common_1.gcloudSchedulerCmd)()} jobs list --filter='httpTarget.uri ~ ${context.env}.*${context.name}' --format='value(name)' --limit=999 --location='${location}' --project='${project}'\n)"` : null, `current_job_uri="${uri}"`, `current_scheduler_name="${fullName}"`, `if echo "$exist_scheduler_names" | grep -Fx "$current_scheduler_name" >/dev/null; then`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs update http "$current_scheduler_name" ${argsString}${updateHeadersArg}`, `else`, `  ${(0, common_1.gcloudSchedulerCmd)()} jobs create http "$current_scheduler_name" ${argsString}${createHeadersArg}`, `fi`].filter(utils_1.notNil).join("\n");
   });
 };
 exports.getCreateScheduleScript = getCreateScheduleScript;
 const getSchedulerArgs = (scheduler, context) => {
-  var _a;
+  var _a, _b;
   if (scheduler.type === "job") {
     const {
       projectId,
@@ -12250,10 +12346,19 @@ const getSchedulerArgs = (scheduler, context) => {
     };
   }
   if (scheduler.type === "http") {
+    // default the Content-Type to application/json when a body is sent and the
+    // user didn't set one explicitly. Otherwise Cloud Scheduler falls back to
+    // application/octet-stream, which is rarely what's intended.
+    const hasContentType = Object.keys((_b = scheduler.headers) !== null && _b !== void 0 ? _b : {}).some(k => k.toLowerCase() === "content-type");
+    const headers = scheduler.body && !hasContentType ? {
+      "Content-Type": "application/json",
+      ...scheduler.headers
+    } : scheduler.headers;
     return {
       uri: scheduler.url,
-      "message-body": scheduler.body,
+      "message-body": scheduler.body ? '"' + (0, bash_1.bashEscape)(scheduler.body) + '"' : undefined,
       "http-method": scheduler.method,
+      headers: headers ? Object.entries(headers).map(([k, v]) => `${k}=${v}`).join(",") : undefined,
       "oidc-service-account-email": `"${(0, common_1.getComputeServiceAccountEmail)(context)}"`
     };
   }
@@ -14870,6 +14975,10 @@ exports.getCatladderStorePath = getCatladderStorePath;
 /**
  * reads and validates the catladder store. Returns an empty store when the
  * file does not exist (project setup has not run yet).
+ *
+ * An unreadable or invalid store is treated the same as a missing one
+ * (with a warning): the store only holds machine-fetched values, so the
+ * remedy is always rerunning project setup — not hand-editing the file.
  */
 const readCatladderStore = (directory = process.cwd()) => {
   var _a;
@@ -14877,9 +14986,14 @@ const readCatladderStore = (directory = process.cwd()) => {
   if (!(0, fs_1.existsSync)(path)) {
     return {};
   }
-  return exports.catladderStoreSchema.parse((_a = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, {
-    encoding: "utf-8"
-  }))) !== null && _a !== void 0 ? _a : {});
+  try {
+    return exports.catladderStoreSchema.parse((_a = (0, yaml_1.parse)((0, fs_1.readFileSync)(path, {
+      encoding: "utf-8"
+    }))) !== null && _a !== void 0 ? _a : {});
+  } catch (error) {
+    console.warn(`⚠️ ignoring invalid ${exports.CATLADDER_STORE_FILE} (rerun "catladder project setup" to regenerate it): ${error instanceof Error ? error.message : error}`);
+    return {};
+  }
 };
 exports.readCatladderStore = readCatladderStore;
 /**

package/dist/bundles/runner-images/agent-claude/Dockerfile

@@ -0,0 +1,5 @@
+FROM node:24-alpine3.21
+
+RUN apk update && apk add --no-cache git curl bash
+
+RUN npm install -g @anthropic-ai/claude-code@2.1.139 @zereight/mcp-gitlab@2.1.10

package/dist/bundles/runner-images/docker-build/Dockerfile

@@ -0,0 +1,26 @@
+
+FROM docker:29.5.1
+
+# add bash
+RUN apk add --no-cache bash 
+
+# for glcoud
+ARG GCLOUD_SDK_VERSION=525.0.0
+
+RUN apk --update add curl python3 py3-crcmod libc6-compat
+RUN curl -O https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-sdk-${GCLOUD_SDK_VERSION}-linux-x86_64.tar.gz && \
+    tar zxvf google-cloud-sdk-${GCLOUD_SDK_VERSION}-linux-x86_64.tar.gz && \
+    rm google-cloud-sdk-${GCLOUD_SDK_VERSION}-linux-x86_64.tar.gz && \
+    ./google-cloud-sdk/install.sh
+ENV PATH="/google-cloud-sdk/bin:${PATH}"
+
+# end gcloud
+
+# for scripts
+
+RUN mkdir p /scripts
+COPY ./scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"
+

package/dist/bundles/runner-images/docker-build/scripts/ensureMeteorDockerfile

@@ -0,0 +1,55 @@
+#!/bin/bash
+
+if [ ! -f $APP_DIR/.dockerignore ]; then
+
+    cat >$APP_DIR/.dockerignore <<EOF
+$APP_DIR/node_modules
+**/__snapshots__/**
+.git
+
+EOF
+fi
+
+if [ ! -f $APP_DIR/Dockerfile ]; then
+    echo "Creating Dockerfile"
+    if [[ ! -z "$METEOR_OVERRIDE_NODE_VERSION" ]]; then
+        NODE_VERSION=$METEOR_OVERRIDE_NODE_VERSION
+    else
+        NODE_VERSION_FULL=$(cat $APP_DIR/dist/bundle/.node_version.txt)
+        NODE_VERSION=${NODE_VERSION_FULL/v/} # remove v
+    fi
+    if [ "$NODE_VERSION" = "14.21.4" ]; then
+        DOCKER_IMAGE="meteor/node:$NODE_VERSION" # meteor maintenance for because of fibers
+    else
+        DOCKER_IMAGE="node:$NODE_VERSION"
+    fi
+    cat >$APP_DIR/Dockerfile <<EOF
+FROM $DOCKER_IMAGE
+
+# install yarn. new meteor image has no yarn installed
+# only install if it does not exist
+RUN command -v yarn || npm install --global yarn
+
+
+$DOCKERFILE_ADDITIONS
+
+# we copy also source code and scripts for commands
+# This is technically not required for meteor, but useful if we have additional scripts 
+WORKDIR /src
+$METEOR_INSTALL_SCRIPTS
+
+
+# copy the bundle
+COPY $APP_DIR/dist /src/dist
+
+# now install meteor deps
+RUN cd /src/dist/bundle/programs/server && npm install
+
+$DOCKERFILE_ADDITIONS_END
+
+WORKDIR /src/dist/bundle
+
+CMD ["node", "main.js"]
+EOF
+
+fi

package/dist/bundles/runner-images/docker-build/scripts/ensureNginxDockerfile

@@ -0,0 +1,85 @@
+#!/bin/bash
+
+# ensure nginx config
+echo "ensureNginxDockerfile in $APP_DIR"
+
+if [ ! -f $APP_DIR/nginx.conf ]; then
+    echo "Creating nginx.conf"
+
+    cat >$APP_DIR/nginx.conf <<NGINX
+    
+server {
+    listen       8080;
+    server_name  localhost;
+    error_page 404 =200 /index.html;
+
+    charset utf-8;
+
+    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+    add_header Referrer-Policy "strict-origin-when-cross-origin";
+    add_header X-Content-Type-Options "nosniff";
+    add_header X-Frame-Options "SAMEORIGIN";
+
+    location / {
+        root   /usr/share/nginx/html;
+        index  index.html index.htm;
+    }
+
+    location /__health {
+        access_log off;
+        types { } default_type "text/html; charset=utf-8";
+        return 200 "ok\n";
+    }
+
+    # https://trac.nginx.org/nginx/ticket/2216
+    include mime.types;
+    types
+    {
+        application/javascript mjs;
+    }
+}
+
+NGINX
+
+fi
+# ensure docker ignore
+if [ ! -f $APP_DIR/.dockerignore ]; then
+
+    cat >.dockerignore <<EOF
+**/node_modules
+**/__snapshots__/**
+.git
+
+EOF
+
+fi
+
+if [ ! -f $APP_DIR/Dockerfile ]; then
+    echo "Creating Dockerfile"
+
+    cat >$APP_DIR/Dockerfile <<EOF
+
+$DOCKERFILE_ADDITIONS
+
+FROM nginx:stable
+WORKDIR /app
+
+RUN sed --in-place "s/^\s*user .*//" /etc/nginx/nginx.conf && \
+    chown -R nginx:nginx /app && \
+    chmod -R 755 /app && \
+    chown -R nginx:nginx /var/cache/nginx && \
+    chown -R nginx:nginx /var/log/nginx && \
+    chown -R nginx:nginx /etc/nginx/conf.d && \
+    touch /var/run/nginx.pid && \
+    chown -R nginx:nginx /var/run/nginx.pid
+
+COPY $APP_DIR/nginx.conf /etc/nginx/conf.d/default.conf
+COPY $APP_DIR/dist/ /usr/share/nginx/html/
+
+$DOCKERFILE_ADDITIONS_END
+
+USER nginx
+EXPOSE 8080
+
+EOF
+fi

package/dist/bundles/runner-images/docker-build/scripts/ensureNodeDockerfile

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+# the default dockerfile includes node alpine
+
+# the dockerignore ignores node_modules as these have to be rebuilt anyway
+# as well as __snapshots__ are used for unitests (if any)
+
+if [ ! -f $APP_DIR/.dockerignore ]; then
+
+    cat >$APP_DIR/.dockerignore <<EOF
+**/node_modules
+**/__snapshots__/**
+.git
+
+EOF
+
+fi
+
+if [ -f $APP_DIR/.nvmrc ]; then
+    NODE_VERSION="$(cat $APP_DIR/.nvmrc | sed '/^$/d' | sed 's/[a-z-]//g')"
+elif [ -f .nvmrc ]; then
+    NODE_VERSION="$(cat .nvmrc | sed '/^$/d' | sed 's/[a-z-]//g')"
+else
+    NODE_VERSION=14
+fi
+
+if [ ! -f $APP_DIR/Dockerfile ]; then
+    echo "Creating Dockerfile"
+
+    cat >$APP_DIR/Dockerfile <<EOF
+FROM node:$NODE_VERSION-alpine
+
+
+
+$DOCKERFILE_ADDITIONS
+
+RUN apk add --no-cache git curl
+USER node
+
+$DOCKER_COPY_WORKSPACE_FILES
+
+WORKDIR /app/$APP_DIR
+
+$DOCKER_COPY_AND_INSTALL_APP
+
+
+$DOCKERFILE_ADDITIONS_END
+
+EOF
+fi

package/dist/bundles/runner-images/gcloud/Dockerfile

@@ -0,0 +1,3 @@
+
+FROM google/cloud-sdk:latest
+

package/dist/bundles/runner-images/jobs-default/Dockerfile

@@ -0,0 +1,22 @@
+
+
+FROM node:18
+
+RUN rm /bin/sh && \
+    ln -s /bin/bash /bin/sh && \
+    mkdir -p /root/.nvm
+
+# set high timeout for yarn, see https://github.com/dhis2/notes/issues/29
+RUN yarn config set network-timeout 600000 -g
+
+# install nvm && some common node versions
+RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash && \
+    source /root/.nvm/nvm.sh && \
+    chmod +x /root/.nvm/nvm.sh && \
+    /root/.nvm/nvm.sh install 12 && \
+    /root/.nvm/nvm.sh install 14 && \
+    /root/.nvm/nvm.sh install 16 && \
+    /root/.nvm/nvm.sh install 18 && \
+    /root/.nvm/nvm.sh install 20 && \
+    /root/.nvm/nvm.sh install 22 && \
+    /root/.nvm/nvm.sh install 24

package/dist/bundles/runner-images/jobs-meteor/Dockerfile

@@ -0,0 +1,7 @@
+# syntax = docker.io/devthefuture/dockerfile-x
+
+
+INCLUDE ./jobs-default/Dockerfile
+
+# add meteor (used by some apps)
+RUN curl https://install.meteor.com/?release=2.13.3 | sh

package/dist/bundles/runner-images/jobs-testing-chrome/Dockerfile

@@ -0,0 +1,15 @@
+# syntax = docker.io/devthefuture/dockerfile-x
+
+INCLUDE ./jobs-default/Dockerfile
+
+# add sources
+# Google Chrome (for testing purposes)
+RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - && \
+    sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
+
+# install some sources
+# not sure if libxss1 is required
+RUN apt-get update && apt-get install -y \
+    libxss1 \ 
+    google-chrome-stable
+

package/dist/bundles/runner-images/kubernetes/Dockerfile

@@ -0,0 +1,26 @@
+
+FROM alpine:3.15
+
+# add bash curl and git
+RUN apk add --no-cache bash curl git
+
+
+# kubernetes & helm
+ENV KUBERNETES_VERSION 1.19.14
+RUN curl -L -o /usr/bin/kubectl "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl" ;\
+    chmod +x /usr/bin/kubectl ;\
+    kubectl version --client
+
+#  helm 3
+ENV HELM_VERSION 3.10.0
+RUN curl "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" | tar zx ;\
+    mv linux-amd64/helm /usr/bin/helm ;\
+    helm version --client
+
+
+COPY ./scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"
+
+COPY ./helm-charts /helm-charts