@catladder/cli 0.0.0-next-4e7c6848 → 0.0.0-next-6a4450e0

package/dist/bundles/cli/index.js

@@ -2,7 +2,7 @@
 /******/ 	var __webpack_modules__ = ({
 
 /***/ 48618:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
@@ -11,6 +11,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.BaseContext = void 0;
+const vaultManagerAccess_1 = __nccwpck_require__(37881);
 /**
  * Base class for CommandContext implementations.
  * Handles caching, the `get()` method, and `promptDirect` delegation.
@@ -20,6 +21,10 @@ class BaseContext {
   constructor(command) {
     this.command = command;
     this.cache = new Map();
+    this.vaultManagerGetter = (0, vaultManagerAccess_1.createVaultManagerGetter)(() => this);
+  }
+  getVaultManager() {
+    return this.vaultManagerGetter();
   }
   get(name) {
     if (!this.cache.has(name)) {
@@ -91,6 +96,7 @@ Object.defineProperty(exports, "__esModule", ({
 exports.createTerminalIO = exports.createTerminalContext = void 0;
 const types_1 = __nccwpck_require__(92284);
 const baseContext_1 = __nccwpck_require__(48618);
+const vaultManagerAccess_1 = __nccwpck_require__(37881);
 /**
  * Resolve choices from a choices function.
  */
@@ -155,6 +161,10 @@ class TerminalContext extends baseContext_1.BaseContext {
     super(command);
     this.options = options;
   }
+  get interactive() {
+    var _a;
+    return (_a = this.options.interactive) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true;
+  }
   log(message) {
     console.log(message);
   }
@@ -229,7 +239,10 @@ exports.createTerminalContext = createTerminalContext;
  * Create a bare IO instance for terminal helper functions.
  */
 function createTerminalIO(options = {}) {
-  return {
+  var _a;
+  const io = {
+    interactive: (_a = options.interactive) !== null && _a !== void 0 ? _a : process.stdin.isTTY === true,
+    getVaultManager: (0, vaultManagerAccess_1.createVaultManagerGetter)(() => io),
     log(message) {
       console.log(message);
     },
@@ -255,11 +268,45 @@ function createTerminalIO(options = {}) {
       throw new types_1.MissingInputError(spec.name, spec.message);
     }
   };
+  return io;
 }
 exports.createTerminalIO = createTerminalIO;
 
 /***/ }),
 
+/***/ 37881:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.createVaultManagerGetter = void 0;
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const VaultManager_1 = __nccwpck_require__(55771);
+/**
+ * lazily creates the vault manager of a context (once per context),
+ * loading the project config on first use
+ */
+const createVaultManagerGetter = (io, options = {}) => {
+  let managerPromise;
+  return () => managerPromise !== null && managerPromise !== void 0 ? managerPromise : managerPromise = (async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+      throw new Error("no catladder config found — the secrets vault needs a project config");
+    }
+    return new VaultManager_1.VaultManager(config, {
+      ...options,
+      io: io()
+    });
+  })();
+};
+exports.createVaultManagerGetter = createVaultManagerGetter;
+
+/***/ }),
+
 /***/ 38365:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -355,7 +402,9 @@ const pipeline_1 = __nccwpck_require__(60241);
 const common_tags_1 = __nccwpck_require__(63779);
 const lodash_es_1 = __nccwpck_require__(64284);
 const getProjectConfig_1 = __nccwpck_require__(50001);
+const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
 const editAsFile_1 = __nccwpck_require__(82805);
+const github_1 = __nccwpck_require__(18036);
 const gitlab_1 = __nccwpck_require__(4508);
 const promise_1 = __nccwpck_require__(51762);
 /* for convenience, parse json objects. that makes it easier to edit secrets that are object */
@@ -433,21 +482,86 @@ const doItFor = async (instance, envAndComponents) => {
       }
     }
   }
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
   instance.log("");
-  instance.log("upserting all variables, please wait...");
+  instance.log("writing all secrets to the vault, please wait...");
   instance.log("");
   for (const [componentName, envs] of Object.entries(envAndComponents)) {
     for (const env of envs) {
-      instance.log("upserting " + env + ":" + componentName + "...\n");
-      await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
+      instance.log("writing " + env + ":" + componentName + "...\n");
+      await (await instance.getVaultManager()).writeSecrets(env, componentName, valuesToEdit[componentName][env]);
       instance.log("");
       instance.log("✅ " + env + ":" + componentName);
       instance.log("--------------------------------\n");
     }
   }
+  await mirrorSecretsToCiBackends(instance, config, envAndComponents, valuesToEdit);
   instance.log("done! 😻");
   instance.log("");
 };
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the edited secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, valuesToEdit) => {
+  const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+  // gitlab mirror (unless gitlab is the vault itself, then it is
+  // already written)
+  if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+    for (const [componentName, envs] of Object.entries(envAndComponents)) {
+      for (const env of envs) {
+        await (0, gitlab_1.upsertAllVariables)(instance, valuesToEdit[componentName][env], env, componentName);
+      }
+    }
+    instance.log("✅ mirrored to gitlab");
+  }
+  if (!enabled.includes("github")) {
+    return;
+  }
+  const kinds = new Map();
+  for (const [componentName, envs] of Object.entries(envAndComponents)) {
+    for (const env of envs) {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+      [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].forEach(({
+        key,
+        kind
+      }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+  }
+  const secrets = Object.entries(envAndComponents).flatMap(([componentName, envs]) => envs.flatMap(env => {
+    var _a;
+    return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => {
+      var _a;
+      const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+      return {
+        name,
+        value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+        kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret"
+      };
+    });
+  }));
+  if (secrets.length === 0) {
+    return;
+  }
+  if (!(await (0, github_1.isGhAuthenticated)())) {
+    instance.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+    return;
+  }
+  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+  if (!repo) {
+    instance.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+    return;
+  }
+  instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
+};
 const projectConfigSecrets = async (io, envComponent) => {
   if (!envComponent) {
     const allEnvAndcomponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
@@ -1874,7 +1988,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(70243);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({
@@ -1975,6 +2089,13 @@ Object.defineProperty(exports, "commandSecretsClearBackups", ({
     return commandSecretsClearBackups_1.commandSecretsClearBackups;
   }
 }));
+var commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
+Object.defineProperty(exports, "commandSecretsSyncGithub", ({
+  enumerable: true,
+  get: function () {
+    return commandSecretsSyncGithub_1.commandSecretsSyncGithub;
+  }
+}));
 var commandOpenLogs_1 = __nccwpck_require__(98720);
 Object.defineProperty(exports, "commandOpenLogs", ({
   enumerable: true,
@@ -3186,6 +3307,163 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 50962:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const defineCommand_1 = __nccwpck_require__(39489);
+const github_1 = __nccwpck_require__(18036);
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async (io, envFilter) => {
+  const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+  const kinds = new Map();
+  for (const [componentName, envs] of Object.entries(envAndComponents)) {
+    for (const env of envs) {
+      if (envFilter && !envFilter.includes(env)) {
+        continue;
+      }
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+      const keys = [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys];
+      keys.forEach(({
+        key,
+        kind
+      }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+  }
+  const names = [...kinds.keys()];
+  const values = await (await io.getVaultManager()).readSecrets(names, io);
+  const secrets = names.filter(name => values[name] !== undefined).map(name => {
+    var _a;
+    return {
+      name,
+      value: values[name],
+      kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret"
+    };
+  });
+  const missing = names.filter(name => values[name] === undefined);
+  return {
+    secrets,
+    missing
+  };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as repo
+ * secrets (masked), "variable"-kind ones as repo variables (plain)
+ */
+const pushSecretsToGithub = async (io, repo, secrets) => {
+  for (const {
+    name,
+    value,
+    kind
+  } of secrets) {
+    if (kind === "variable") {
+      await (0, github_1.setGithubVariable)(repo, name, value);
+      io.log(`📖 ${name} (variable)`);
+    } else {
+      await (0, github_1.setGithubSecret)(repo, name, value);
+      io.log(`✅ ${name}`);
+    }
+  }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    return undefined;
+  }
+  return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
+};
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+/**
+ * copies the catladder secrets from the vault to github actions
+ * repository secrets, keeping the exact same names, so the github
+ * pipeline can reference them as ${{ secrets.<NAME> }}.
+ */
+exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
+  name: "project secrets-sync-github",
+  description: "copies all secrets from the vault to github repo secrets (same names), for the github pipeline",
+  group: "project",
+  inputs: {
+    repo: {
+      type: "string",
+      message: "github repository (owner/name)",
+      positional: true,
+      required: false
+    },
+    env: {
+      type: "string",
+      message: "only sync these environments (comma-separated, e.g. review,dev) — github allows at most 100 repo secrets",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    var _a, _b;
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+      throw new Error("no catladder config found");
+    }
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    if (!enabled.includes("github")) {
+      throw new Error("the github pipeline is not enabled in `pipelines` — nothing to sync to");
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+      throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
+    }
+    const repo = (_a = await ctx.get("repo")) !== null && _a !== void 0 ? _a : await (0, exports.getConfiguredGithubRepo)();
+    if (!repo) {
+      throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
+    }
+    const envFilter = (_b = await ctx.get("env")) === null || _b === void 0 ? void 0 : _b.split(",").map(e => e.trim());
+    const {
+      secrets,
+      missing
+    } = await (0, exports.collectSecretsFromVault)(ctx, envFilter);
+    if (missing.length > 0) {
+      ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
+      missing.forEach(name => ctx.log(`  - ${name}`));
+      ctx.log("");
+    }
+    if (secrets.length === 0) {
+      ctx.log("no secrets to sync 🤷");
+      return;
+    }
+    ctx.log(`about to set ${secrets.length} secrets on '${repo}':`);
+    secrets.forEach(({
+      name
+    }) => ctx.log(`  - ${name}`));
+    ctx.log("");
+    const confirmed = await ctx.confirm("continue? 🤔");
+    if (!confirmed) {
+      throw new Error("abort");
+    }
+    await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
+    ctx.log("");
+    ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
+  }
+});
+
+/***/ }),
+
 /***/ 92494:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -4179,14 +4457,24 @@ const getGitlabVar = async (io, env, componentName, variableName) => {
 };
 exports.getGitlabVar = getGitlabVar;
 const resolveSecrets = async (io, varSets) => {
-  const allVariablesInGitlab = await (0, gitlab_1.getAllVariables)(io);
+  // the secret variables actually referenced by the env var values —
+  // when they are all in the local cache, the vault is not contacted
+  const referencedNames = [...new Set(varSets.flatMap(({
+    envVars
+  }) => Object.values(envVars).flatMap(value => {
+    var _a;
+    return (_a = `${value}`.match(/\$CL_\w+/g)) !== null && _a !== void 0 ? _a : [];
+  })))].map(reference => reference.slice(1));
+  const vaultManager = await io.getVaultManager();
+  const secrets = await vaultManager.readSecrets(referencedNames, io);
+  const secretEntries = Object.entries(secrets);
   return Object.fromEntries(varSets.flatMap(({
     envVars,
     secretEnvVarKeys
   }) => Object.entries(envVars).filter(([key, value]) => {
     var _a;
     return value !== undefined && value !== null && !((_a = secretEnvVarKeys.find(k => k.key === key)) === null || _a === void 0 ? void 0 : _a.hidden);
-  }).map(([key, value]) => [key, allVariablesInGitlab.reduce((acc, curr) => acc.replace(new RegExp("\\$" + curr.key, "g"), curr.value), `${value}`)])));
+  }).map(([key, value]) => [key, secretEntries.reduce((acc, [name, secretValue]) => acc.replace(new RegExp("\\$" + name, "g"), secretValue), `${value}`)])));
 };
 const getEnvVarsResolved = async (io, env, componentName) => {
   if (!componentName) {
@@ -4291,8 +4579,15 @@ exports.defineCommand = defineCommand;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.MissingInputError = void 0;
+exports.MissingInputError = exports.NonInteractiveError = void 0;
 // ─── Errors ──────────────────────────────────────────────────────────
+class NonInteractiveError extends Error {
+  constructor(interaction) {
+    super(`${interaction} requires an interactive terminal, but this context is not interactive`);
+    this.name = "NonInteractiveError";
+  }
+}
+exports.NonInteractiveError = NonInteractiveError;
 class MissingInputError extends Error {
   constructor(inputName, promptMessage) {
     super(`Missing required input: "${inputName}" (${promptMessage}). ` + `Provide it via --${inputName}=<value> or --inputs='{"${inputName}": ...}'`);
@@ -4742,14 +5037,14 @@ exports.getProjectRootPath = getProjectRootPath;
 /**
  * Get the git remote hostname and project path from the git config.
  */
-const getGitRemoteHostAndPath = async () => {
+const getGitRemoteHostAndPath = async (remoteName = "origin") => {
   var _a;
-  const remoteUrl = await (0, gitConfig_1.gitConfigGet)("remote.origin.url");
+  const remoteUrl = await (0, gitConfig_1.gitConfigGet)(`remote.${remoteName}.url`);
   const remoteReg = /(https:\/\/|git@)([^:/]+)[:/]([^.]*)(\.git)?/;
   const match = (_a = remoteUrl.match(remoteReg)) !== null && _a !== void 0 ? _a : [];
   const [,, gitRemoteHost, gitRemotePath] = match;
   if (!(gitRemoteHost === null || gitRemoteHost === void 0 ? void 0 : gitRemoteHost.length) || !(gitRemotePath === null || gitRemotePath === void 0 ? void 0 : gitRemotePath.length)) {
-    throw new Error(`Failed to parse git remote hostname and path from git configs remote.origin.url! ${remoteUrl}`);
+    throw new Error(`Failed to parse git remote hostname and path from git configs remote.${remoteName}.url! ${remoteUrl}`);
   }
   return {
     gitRemoteHost,
@@ -5306,6 +5601,74 @@ exports["default"] = async () => {
 
 /***/ }),
 
+/***/ 18036:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * whether the github cli (gh) is installed and authenticated
+ */
+const isGhAuthenticated = async () => {
+  try {
+    await execFile("gh", ["auth", "status"]);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+};
+exports.isGhAuthenticated = isGhAuthenticated;
+/**
+ * the github repository (owner/name) a git remote points to.
+ * Which remote belongs to github is configured per pipeline type
+ * (`pipelines.github.gitRemote`, defaults to origin).
+ */
+const getGithubRepoFromRemote = async remoteName => {
+  try {
+    const {
+      stdout
+    } = await execFile("git", ["remote", "get-url", remoteName]);
+    const match = stdout.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/);
+    return match === null || match === void 0 ? void 0 : match[1];
+  } catch (_a) {
+    return undefined;
+  }
+};
+exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject) => {
+  var _a, _b;
+  const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo], {
+    stdio: ["pipe", "ignore", "pipe"]
+  });
+  let stderr = "";
+  (_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
+  child.on("error", reject);
+  child.on("close", code => code === 0 ? resolve() : reject(new Error(`gh ${kind} set ${name} failed: ${stderr.trim()}`)));
+  (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.end(value);
+});
+/**
+ * sets a github actions repository secret via the gh cli.
+ * The value is passed via stdin so it never shows up in a process list.
+ */
+const setGithubSecret = async (repo, name, value) => ghSetViaStdin("secret", repo, name, value);
+exports.setGithubSecret = setGithubSecret;
+/**
+ * sets a github actions repository variable (plain, unmasked) via the
+ * gh cli — for vault values classified as not sensitive
+ */
+const setGithubVariable = async (repo, name, value) => ghSetViaStdin("variable", repo, name, value);
+exports.setGithubVariable = setGithubVariable;
+
+/***/ }),
+
 /***/ 4508:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -5845,6 +6208,445 @@ exports.getShell = getShell;
 
 /***/ }),
 
+/***/ 63510:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.BitwardenVault = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const yaml_1 = __nccwpck_require__(6637);
+const bw_1 = __nccwpck_require__(52211);
+const DEFAULT_COLLECTION = "catladder";
+const SECURE_NOTE_TYPE = 2;
+/**
+ * one yaml note per env and component:
+ * `<customerName>/<appName>/<env>/<componentName>/secrets.yml`
+ */
+const itemName = (config, env, componentName) => `${config.customerName}/${config.appName}/${env}/${componentName}/secrets.yml`;
+const itemPrefix = config => `${config.customerName}/${config.appName}/`;
+/**
+ * parses env and componentName back out of an item name
+ */
+const parseItemName = (config, name) => {
+  const match = name.slice(itemPrefix(config).length).match(/^([^/]+)\/([^/]+)\/secrets\.yml$/);
+  return match ? {
+    env: match[1],
+    componentName: match[2]
+  } : null;
+};
+const findCollection = async (session, collectionName) => {
+  const collections = await (0, bw_1.runBwJson)(session, ["list", "collections", "--search", collectionName]);
+  const collection = collections.find(c => c.name === collectionName);
+  if (!collection) {
+    throw new Error(`bitwarden collection '${collectionName}' not found — create it and make sure you have access`);
+  }
+  return collection;
+};
+const encodePayload = payload => Buffer.from(JSON.stringify(payload), "utf-8").toString("base64");
+class BitwardenVault {
+  constructor(config, options,
+  /**
+   * whether a locked bitwarden may be unlocked interactively
+   * (false with catenv --vault-mode no-prompt)
+   */
+  allowPrompt) {
+    var _a;
+    this.config = config;
+    this.allowPrompt = allowPrompt;
+    this.collectionName = (_a = options.collection) !== null && _a !== void 0 ? _a : DEFAULT_COLLECTION;
+    this.id = `bitwarden:${this.collectionName}`;
+  }
+  session(io) {
+    return (0, bw_1.getBwSession)(io, {
+      allowPrompt: this.allowPrompt
+    });
+  }
+  async readAllSecrets(io) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const items = await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id]);
+    const secrets = {};
+    for (const item of items) {
+      const parsed = parseItemName(config, item.name);
+      if (!parsed || !item.notes) {
+        continue;
+      }
+      const values = (0, yaml_1.parse)(item.notes);
+      Object.entries(values !== null && values !== void 0 ? values : {}).forEach(([key, value]) => {
+        secrets[(0, pipeline_1.getSecretVarName)(parsed.env, parsed.componentName, key)] = typeof value === "string" ? value : JSON.stringify(value);
+      });
+    }
+    return secrets;
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    const {
+      config,
+      collectionName
+    } = this;
+    const bwSession = await this.session(io);
+    const collection = await findCollection(bwSession, collectionName);
+    const name = itemName(config, env, componentName);
+    const existing = (await (0, bw_1.runBwJson)(bwSession, ["list", "items", "--collectionid", collection.id, "--search", name])).find(item => item.name === name);
+    const notes = (0, yaml_1.stringify)(secrets);
+    if (existing) {
+      await (0, bw_1.runBw)(bwSession, ["edit", "item", existing.id, encodePayload({
+        ...existing,
+        notes
+      })]);
+    } else {
+      await (0, bw_1.runBw)(bwSession, ["create", "item", encodePayload({
+        type: SECURE_NOTE_TYPE,
+        secureNote: {
+          type: 0
+        },
+        name,
+        notes,
+        ...(collection.organizationId ? {
+          organizationId: collection.organizationId,
+          collectionIds: [collection.id]
+        } : {})
+      })]);
+    }
+  }
+}
+exports.BitwardenVault = BitwardenVault;
+
+/***/ }),
+
+/***/ 31107:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.GitlabVault = void 0;
+const gitlab_1 = __nccwpck_require__(4508);
+/**
+ * the legacy (and default) vault: the gitlab project variables double
+ * as the secret store
+ */
+class GitlabVault {
+  constructor() {
+    this.id = "gitlab";
+  }
+  async readAllSecrets(io) {
+    const variables = await (0, gitlab_1.getAllVariables)(io);
+    return Object.fromEntries(variables.map(v => [v.key, v.value]));
+  }
+  async writeSecrets(io, env, componentName, secrets) {
+    await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+  }
+}
+exports.GitlabVault = GitlabVault;
+
+/***/ }),
+
+/***/ 55771:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.VaultManager = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const BitwardenVault_1 = __nccwpck_require__(63510);
+const cache_1 = __nccwpck_require__(14236);
+const GitlabVault_1 = __nccwpck_require__(31107);
+/**
+ * only secrets of this env are cached locally — the other envs'
+ * secrets have no business sitting on developer machines
+ */
+const CACHED_ENV = "local";
+/**
+ * owns the configured vault, the secrets mode and the local cache.
+ * The vault is the readable source of truth for secrets; CI backends
+ * only receive mirrored copies.
+ */
+class VaultManager {
+  constructor(config, options = {}) {
+    var _a, _b;
+    this.config = config;
+    /** refresh mode bypasses the cache only once per manager */
+    this.refreshed = false;
+    this.mode = (_a = options.mode) !== null && _a !== void 0 ? _a : "auto";
+    this.io = (_b = options.io) !== null && _b !== void 0 ? _b : null;
+    this.vault = this.createVault();
+  }
+  createVault() {
+    const vaultConfig = (0, pipeline_1.getVaultConfig)(this.config);
+    switch (vaultConfig.type) {
+      case "gitlab":
+        return new GitlabVault_1.GitlabVault();
+      case "bitwarden":
+        return new BitwardenVault_1.BitwardenVault(this.config, vaultConfig, this.mode === "auto" || this.mode === "refresh");
+    }
+  }
+  /**
+   * the vault secrets, served from the local cache when it contains
+   * all required names; otherwise (depending on the mode) refreshed
+   * from the vault. Only the "local" env is (re-)cached.
+   */
+  async readSecrets(requiredNames, io = this.io) {
+    const bypassCache = this.mode === "refresh" && !this.refreshed;
+    const cache = bypassCache ? null : await (0, cache_1.readSecretsCache)();
+    // known entries include recorded misses (null values), so declared
+    // but intentionally unset secrets don't force a vault refresh
+    const known = (cache === null || cache === void 0 ? void 0 : cache.vaultId) === this.vault.id ? flattenSecrets(cache.secrets) : undefined;
+    const missing = requiredNames.filter(name => !(name in (known !== null && known !== void 0 ? known : {})));
+    // nothing missing (or nothing required at all): don't touch the vault
+    if (missing.length === 0 && (known || requiredNames.length === 0)) {
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    if (this.mode === "offline") {
+      if (missing.length > 0) {
+        io === null || io === void 0 ? void 0 : io.log(`⚠️ vault is offline (--vault-mode offline) and ${missing.length} secrets are not in the local cache: ${missing.join(", ")}`);
+      }
+      return withoutMisses(known !== null && known !== void 0 ? known : {});
+    }
+    const secrets = await this.vault.readAllSecrets(io);
+    this.refreshed = true;
+    await (0, cache_1.writeSecretsCache)(this.vault.id, await this.cacheableSubset(secrets));
+    return secrets;
+  }
+  /**
+   * writes secrets of one env/component to the vault and updates the
+   * local cache (write-through, "local" env only)
+   */
+  async writeSecrets(env, componentName, secrets, io = this.io) {
+    if (!io) {
+      throw new Error("writing to the vault requires an interactive context");
+    }
+    await this.vault.writeSecrets(io, env, componentName, secrets);
+    if (env === CACHED_ENV) {
+      await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [key, typeof value === "string" ? value : JSON.stringify(value)])));
+    }
+  }
+  /**
+   * the subset of the vault secrets that may be cached: the declared
+   * secrets of the "local" env, per component, as a hierarchy
+   */
+  async cacheableSubset(flatSecrets) {
+    const local = {};
+    for (const componentName of Object.keys(this.config.components)) {
+      const keys = await this.declaredSecretKeys(componentName);
+      const values = Object.fromEntries(keys.map(key => {
+        var _a;
+        return [key,
+        // null records "absent in the vault" (a known miss)
+        (_a = flatSecrets[(0, pipeline_1.getSecretVarName)(CACHED_ENV, componentName, key)]) !== null && _a !== void 0 ? _a : null];
+      }));
+      if (Object.keys(values).length > 0) {
+        local[componentName] = values;
+      }
+    }
+    return Object.keys(local).length > 0 ? {
+      [CACHED_ENV]: local
+    } : {};
+  }
+  async declaredSecretKeys(componentName) {
+    try {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, pipeline_1.getEnvironment)({
+        config: this.config,
+        componentName,
+        env: CACHED_ENV
+      });
+      return [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].map(({
+        key
+      }) => key);
+    } catch (_a) {
+      // components without a local env simply have nothing to cache
+      return [];
+    }
+  }
+}
+exports.VaultManager = VaultManager;
+/**
+ * the cache hierarchy as a flat map of raw secret variable names
+ * (null values = recorded misses)
+ */
+const flattenSecrets = secrets => Object.fromEntries(Object.entries(secrets).flatMap(([env, components]) => Object.entries(components).flatMap(([componentName, values]) => Object.entries(values).map(([key, value]) => [(0, pipeline_1.getSecretVarName)(env, componentName, key), value]))));
+/**
+ * only actual values — recorded misses stay unresolved, like any other
+ * unset variable
+ */
+const withoutMisses = known => Object.fromEntries(Object.entries(known).filter(entry => entry[1] !== null));
+
+/***/ }),
+
+/***/ 52211:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.runBwJson = exports.runBw = exports.getBwSession = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const preferences_1 = __nccwpck_require__(66261);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+const SESSION_PREFERENCE = "bwsession";
+class BitwardenLockedError extends Error {
+  constructor() {
+    super("bitwarden is locked and prompting is disabled — run `bw unlock` or catenv without --vault-mode no-prompt");
+  }
+}
+/**
+ * runs an interactive bw command that prints a session key on stdout
+ * (login/unlock) while the user types the password on the terminal
+ */
+const interactiveSessionCommand = args => new Promise((resolve, reject) => {
+  var _a;
+  const child = (0, child_process_1.spawn)("bw", [...args, "--raw"], {
+    stdio: ["inherit", "pipe", "inherit"]
+  });
+  let session = "";
+  (_a = child.stdout) === null || _a === void 0 ? void 0 : _a.on("data", data => session += data.toString("utf-8"));
+  child.on("error", reject);
+  child.on("close", code => code === 0 && session.trim() ? resolve(session.trim()) : reject(new Error(`bw ${args[0]} failed`)));
+});
+const getBwStatus = async session => {
+  try {
+    const {
+      stdout
+    } = await execFile("bw", ["status"], {
+      env: {
+        ...process.env,
+        ...(session ? {
+          BW_SESSION: session
+        } : {})
+      }
+    });
+    return JSON.parse(stdout).status;
+  } catch (_a) {
+    return "unauthenticated";
+  }
+};
+/**
+ * a working bw session: reuses the cached one, otherwise unlocks (or
+ * logs in) interactively — unless prompting is disabled
+ */
+const getBwSession = async (io, {
+  allowPrompt
+}) => {
+  const cached = (await (0, preferences_1.hasPreference)(SESSION_PREFERENCE)) ? String(await (0, preferences_1.getPreference)(SESSION_PREFERENCE)) : null;
+  const status = await getBwStatus(cached);
+  if (status === "unlocked" && cached) {
+    return cached;
+  }
+  if (!allowPrompt) {
+    throw new BitwardenLockedError();
+  }
+  io === null || io === void 0 ? void 0 : io.log("");
+  io === null || io === void 0 ? void 0 : io.log(status === "unauthenticated" ? "# Please login to Bitwarden:" : "# Bitwarden is locked, please unlock:");
+  io === null || io === void 0 ? void 0 : io.log("");
+  const session = await interactiveSessionCommand([status === "unauthenticated" ? "login" : "unlock"]);
+  await (0, preferences_1.setPreference)(SESSION_PREFERENCE, session);
+  await (0, exports.runBw)(session, ["sync"]);
+  return session;
+};
+exports.getBwSession = getBwSession;
+/**
+ * runs a bw command with the given session and returns stdout
+ */
+const runBw = async (session, args) => {
+  const {
+    stdout
+  } = await execFile("bw", [...args, "--raw", "--nointeraction"], {
+    env: {
+      ...process.env,
+      BW_SESSION: session
+    },
+    maxBuffer: 50 * 1024 * 1024
+  });
+  return stdout;
+};
+exports.runBw = runBw;
+const runBwJson = async (session, args) => JSON.parse(await (0, exports.runBw)(session, args));
+exports.runBwJson = runBwJson;
+
+/***/ }),
+
+/***/ 14236:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.updateSecretsCache = exports.writeSecretsCache = exports.readSecretsCache = void 0;
+const promises_1 = __nccwpck_require__(91943);
+const path_1 = __nccwpck_require__(16928);
+const gitProjectInformation_1 = __nccwpck_require__(21111);
+const getCacheFolder = async () => (0, path_1.join)(await (0, gitProjectInformation_1.getProjectRootPath)(), ".catladder");
+const getCachePath = async () => (0, path_1.join)(await getCacheFolder(), "secrets.json");
+const readSecretsCache = async () => {
+  try {
+    return JSON.parse(await (0, promises_1.readFile)(await getCachePath(), "utf-8"));
+  } catch (_a) {
+    return null;
+  }
+};
+exports.readSecretsCache = readSecretsCache;
+const writeSecretsCache = async (vaultId, secrets) => {
+  const folder = await getCacheFolder();
+  await (0, promises_1.mkdir)(folder, {
+    recursive: true
+  });
+  // the folder ignores itself, so the cache can never be committed
+  await (0, promises_1.writeFile)((0, path_1.join)(folder, ".gitignore"), "*\n");
+  const cache = {
+    vaultId,
+    updatedAt: new Date().toISOString(),
+    secrets
+  };
+  await (0, promises_1.writeFile)(await getCachePath(), JSON.stringify(cache, null, 2));
+};
+exports.writeSecretsCache = writeSecretsCache;
+/**
+ * merges freshly written secrets of one env/component into the cache
+ * (write-through from config-secrets), so the next catenv run doesn't
+ * need the vault
+ */
+const updateSecretsCache = async (vaultId, env, componentName, values) => {
+  var _a;
+  const existing = await (0, exports.readSecretsCache)();
+  const secrets = (existing === null || existing === void 0 ? void 0 : existing.vaultId) === vaultId ? existing.secrets : {};
+  secrets[env] = {
+    ...secrets[env],
+    [componentName]: {
+      ...((_a = secrets[env]) === null || _a === void 0 ? void 0 : _a[componentName]),
+      ...values
+    }
+  };
+  await (0, exports.writeSecretsCache)(vaultId, secrets);
+};
+exports.updateSecretsCache = updateSecretsCache;
+
+/***/ }),
+
 /***/ 54038:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -5861,7 +6663,11 @@ const createAllJobs_1 = __nccwpck_require__(83671);
 const config_1 = __nccwpck_require__(96925);
 const ciVariables_1 = __nccwpck_require__(25474);
 const createGithubJobs_1 = __nccwpck_require__(14016);
+const jobImagesPlan_1 = __nccwpck_require__(11585);
+const scriptFunctions_1 = __nccwpck_require__(75759);
+const utils_1 = __nccwpck_require__(20595);
 const githubReleaseJobs_1 = __nccwpck_require__(55611);
+const scriptFiles_1 = __nccwpck_require__(59189);
 const WORKFLOWS_FOLDER = ".github/workflows";
 /**
  * generated workflow files are prefixed so that cleanup never touches
@@ -5906,18 +6712,29 @@ class GithubBackend {
   async cleanup() {
     const entries = await (0, promises_1.readdir)(WORKFLOWS_FOLDER).catch(() => []);
     await Promise.all(entries.filter(file => file.startsWith(GENERATED_FILE_PREFIX)).map(file => (0, promises_1.unlink)((0, path_1.join)(WORKFLOWS_FOLDER, file))));
+    await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, {
+      recursive: true,
+      force: true
+    });
   }
   async createFiles(config) {
-    const workflows = await this.createWorkflows(config);
-    return Object.entries(workflows).map(([fileName, workflow]) => ({
+    const images = this.createImagesPlan(config);
+    const scripts = new scriptFiles_1.GithubScriptFiles();
+    const workflows = await this.createWorkflows(config, images, scripts);
+    return [...Object.entries(workflows).map(([fileName, workflow]) => ({
       path: (0, path_1.join)(WORKFLOWS_FOLDER, fileName),
       content: workflow
-    }));
+    })),
+    // materialized job scripts and image definitions (repo mode)
+    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles()];
+  }
+  createImagesPlan(config) {
+    return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
   }
   /**
    * all workflows keyed by file name, mainly for testing purposes
    */
-  async createWorkflows(config) {
+  async createWorkflows(config, images = this.createImagesPlan(config), scripts = new scriptFiles_1.GithubScriptFiles()) {
     const workflows = {};
     const reviewStopJobs = {};
     const manualJobs = {};
@@ -5928,13 +6745,14 @@ class GithubBackend {
         pipelineType: this.type
       });
       const uploadProviderIds = (0, createGithubJobs_1.getUploadProviderIds)(allJobs);
+      const secretKinds = (0, createGithubJobs_1.collectSecretKinds)(allJobs);
       const jobs = {};
       // NOTE: agent jobs are gitlab-only and skipped on github
       [...allJobs.workspaces, ...allJobs.components].forEach(({
         context,
         jobs: contextJobs
       }) => contextJobs.forEach(job => {
-        const [id, githubJob] = (0, createGithubJobs_1.makeGithubJob)(context, job, allJobs, uploadProviderIds);
+        const [id, githubJob] = (0, createGithubJobs_1.makeGithubJob)(context, job, allJobs, uploadProviderIds, images, scripts, secretKinds);
         if (isReviewStopJob(context, job)) {
           reviewStopJobs[id] = githubJob;
         } else if (isManualTaskJob(job)) {
@@ -5944,15 +6762,19 @@ class GithubBackend {
         }
       }));
       if (trigger === "mainBranch") {
-        const releaseJobs = (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs));
+        const releaseJobs = (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs), images);
         Object.assign(jobs, releaseJobs.main);
         Object.assign(manualJobs, releaseJobs.manual);
       }
       if (Object.keys(jobs).length > 0) {
         workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
           ...TRIGGER_WORKFLOWS[trigger],
+          ...workflowPermissions(images),
           env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-          jobs
+          jobs: {
+            ...makeEnsureImageGithubJobs(images),
+            ...jobs
+          }
         };
       }
     }
@@ -5964,8 +6786,12 @@ class GithubBackend {
             types: ["closed"]
           }
         },
+        ...workflowPermissions(images),
         env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-        jobs: reviewStopJobs
+        jobs: {
+          ...makeEnsureImageGithubJobs(images),
+          ...reviewStopJobs
+        }
       };
     }
     if (Object.keys(manualJobs).length > 0) {
@@ -5983,17 +6809,51 @@ class GithubBackend {
             }
           }
         },
+        ...workflowPermissions(images),
         env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-        jobs: Object.fromEntries(Object.entries(manualJobs).map(([id, job]) => [id, {
-          ...job,
-          if: `\${{ inputs.job == '${id}' }}`
-        }]))
+        jobs: {
+          ...makeEnsureImageGithubJobs(images),
+          ...Object.fromEntries(Object.entries(manualJobs).map(([id, job]) => [id, {
+            ...job,
+            if: `\${{ inputs.job == '${id}' }}`
+          }]))
+        }
       };
     }
     return workflows;
   }
 }
 exports.GithubBackend = GithubBackend;
+/**
+ * repo mode needs packages:write for pushing job images to ghcr
+ */
+const workflowPermissions = images => images.mode === "repo" ? {
+  permissions: {
+    contents: "read",
+    packages: "write"
+  }
+} : {};
+/**
+ * the image build jobs: always run (github has no server-side
+ * changes-filter), the existence check makes unchanged runs fast.
+ * Docker is native on github runners — no container, no dind.
+ */
+const makeEnsureImageGithubJobs = images => Object.fromEntries(images.getEnsureJobs().map(job => {
+  var _a, _b;
+  return [(0, createGithubJobs_1.githubGlobalJobId)(job.name), {
+    name: job.name,
+    "runs-on": "ubuntu-latest",
+    steps: [{
+      name: "Checkout",
+      uses: "actions/checkout@v4"
+    }, {
+      name: job.name,
+      id: "main",
+      run: [...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(), ...((_b = (_a = job.script) === null || _a === void 0 ? void 0 : _a.filter(utils_1.notNil)) !== null && _b !== void 0 ? _b : [])].join("\n"),
+      shell: "bash"
+    }]
+  }];
+}));
 const workflowFileName = trigger => {
   switch (trigger) {
     case "mr":
@@ -6044,7 +6904,8 @@ exports.GITHUB_CI_VARIABLES = {
   jobToken: "CL_JOB_TOKEN",
   jobImage: "CL_JOB_IMAGE",
   registry: "CL_REGISTRY",
-  registryImage: "CL_REGISTRY_IMAGE"
+  registryImage: "CL_REGISTRY_IMAGE",
+  registryUser: "CL_REGISTRY_USER"
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
@@ -6054,6 +6915,7 @@ exports.GITHUB_INJECTED_WORKFLOW_ENV = {
   CL_JOB_TOKEN: "${{ github.token }}",
   CL_REGISTRY: "ghcr.io",
   CL_REGISTRY_IMAGE: "ghcr.io/${{ github.repository }}",
+  CL_REGISTRY_USER: "${{ github.actor }}",
   // empty outside of pull request events
   CL_PR_NUMBER: "${{ github.event.number }}"
 };
@@ -6069,7 +6931,7 @@ exports.GITHUB_INJECTED_WORKFLOW_ENV = {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getUploadProviderIds = exports.makeGithubJob = exports.resolveGithubNeeds = exports.githubJobId = void 0;
+exports.getUploadProviderIds = exports.makeGithubJob = exports.collectSecretKinds = exports.resolveGithubNeeds = exports.githubGlobalJobId = exports.githubJobId = void 0;
 const lodash_es_1 = __nccwpck_require__(64284);
 const getInjectVarsScript_1 = __nccwpck_require__(90436);
 const createJobCache_1 = __nccwpck_require__(65644);
@@ -6077,6 +6939,7 @@ const getEnvironmentVariables_1 = __nccwpck_require__(85855);
 const utils_1 = __nccwpck_require__(20595);
 const gitlab_1 = __nccwpck_require__(13468);
 const scriptFunctions_1 = __nccwpck_require__(75759);
+const ciVariables_1 = __nccwpck_require__(25474);
 /**
  * runner variables that only make sense on gitlab runners and must not
  * leak into github jobs (docker-in-docker daemon config, kubernetes
@@ -6095,6 +6958,9 @@ const slug = value => {
 };
 const githubJobId = (context, jobName) => slug(`${context.type === "workspace" ? "ws-" : ""}${context.name}-${jobName}-${context.env}`);
 exports.githubJobId = githubJobId;
+/** id of a job without component/workspace context (e.g. image builds) */
+const githubGlobalJobId = jobName => slug(jobName);
+exports.githubGlobalJobId = githubGlobalJobId;
 const githubJobName = (context, jobName) => `${context.name} ${jobName} | ${context.env}`;
 const resolveNeed = (context, need, allJobs) => {
   var _a;
@@ -6116,6 +6982,12 @@ const resolveNeed = (context, need, allJobs) => {
     return (0, exports.githubJobId)(provider.context, jobName);
   };
   if ((0, lodash_es_1.isObject)(need)) {
+    if ("global" in need && need.global) {
+      return {
+        id: (0, exports.githubGlobalJobId)(need.job),
+        artifacts: need.artifacts
+      };
+    }
     if ("workspaceName" in need && need.workspaceName) {
       return {
         id: findWorkspaceJob(need.workspaceName, need.job),
@@ -6133,9 +7005,9 @@ const resolveNeed = (context, need, allJobs) => {
     artifacts: true
   };
 };
-const resolveGithubNeeds = (context, job, allJobs) => {
+const resolveGithubNeeds = (context, job, allJobs, extraNeeds = []) => {
   var _a;
-  const resolved = ((_a = job.needs) !== null && _a !== void 0 ? _a : []).map(need => resolveNeed(context, need, allJobs));
+  const resolved = [...extraNeeds, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])].map(need => resolveNeed(context, need, allJobs));
   // deduplicate by provider id, explicit entries win (they come last)
   return [...new Map(resolved.map(n => [n.id, n])).values()].sort((a, b) => a.id.localeCompare(b.id));
 };
@@ -6176,29 +7048,73 @@ const createCacheSteps = (context, job) => {
     };
   });
 };
-const getSecretsEnv = context => {
+/**
+ * how a vault-stored value reaches the job env: masked github secret,
+ * or plain (unmasked) github variable for non-sensitive values — those
+ * stay readable in logs and usable in environment urls
+ */
+const vaultValueExpression = (name, kinds) => kinds.get(name) === "variable" ? `\${{ vars.${name} }}` : `\${{ secrets.${name} }}`;
+/**
+ * the kind of every vault-stored var of all components, keyed by its
+ * CL_* name — the lookup for cross-component references
+ */
+const collectSecretKinds = allJobs => {
+  const kinds = new Map();
+  allJobs.components.forEach(({
+    context
+  }) => {
+    var _a, _b;
+    const entries = [...context.environment.secretEnvVarKeys, ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []), ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : [])];
+    entries.forEach(({
+      key,
+      kind
+    }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
+  });
+  return kinds;
+};
+exports.collectSecretKinds = collectSecretKinds;
+const getSecretsEnv = (context, kinds) => {
   var _a, _b;
   const keys = [...context.environment.secretEnvVarKeys, ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []), ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : [])];
   return Object.fromEntries(keys.map(({
     key
   }) => {
     const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key);
-    return [name, `\${{ secrets.${name} }}`];
+    return [name, vaultValueExpression(name, kinds)];
   }));
 };
-const makeGithubJob = (context, job, allJobs, uploadProviderIds) => {
+/**
+ * every CL_* variable the job script reads must exist in the job env.
+ * On gitlab all project variables are implicitly available in every
+ * job — cross-component references (`${other-component:KEY}`) rely on
+ * that. Github jobs only see what is injected explicitly, so the
+ * script is scanned for the names it actually references.
+ */
+const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)].map(match => match[1]).filter(name => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV)).map(name => [name, vaultValueExpression(name, kinds)]));
+const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
   var _a, _b, _c, _d, _e, _f, _g, _h, _j;
   const id = (0, exports.githubJobId)(context, job.name);
   const isComponent = context.type === "component";
   const createsJobEnv = !!job.environment && isComponent && (!job.environment.action || job.environment.action === "start");
   const skipCheckout = ((_a = job.runnerVariables) === null || _a === void 0 ? void 0 : _a.GIT_STRATEGY) === "none";
-  const needs = (0, exports.resolveGithubNeeds)(context, job, allJobs);
-  const image = typeof job.image === "string" ? job.image : Array.isArray(job.image) ? job.image[0] : (_b = job.image) === null || _b === void 0 ? void 0 : _b.name;
+  const resolved = images.resolve(job.image);
+  const needs = (0, exports.resolveGithubNeeds)(context, job, allJobs, resolved.need ? [resolved.need] : []);
+  const image = typeof resolved.image === "string" ? resolved.image : Array.isArray(resolved.image) ? resolved.image[0] : (_b = resolved.image) === null || _b === void 0 ? void 0 : _b.name;
   const runScript = [...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(), ...(0, gitlab_1.collapseableSection)("injectvars", "Injecting variables")((0, getInjectVarsScript_1.getInjectVarsScript)((_c = job.variables) !== null && _c !== void 0 ? _c : {})), ...((_e = (_d = job.script) === null || _d === void 0 ? void 0 : _d.filter(utils_1.notNil)) !== null && _e !== void 0 ? _e : []), ...(createsJobEnv ? [`echo "url=$ROOT_URL" >> "$GITHUB_OUTPUT"`] : [])].join("\n");
+  // scripts live in committed files to keep workflows under github's
+  // 512 KB limit. Two classes of jobs must keep their script inline:
+  // jobs without a checkout have no repo files, and `${{ }}` expressions
+  // are only interpolated inside the workflow file itself.
+  const run = skipCheckout || runScript.includes("${{") ? runScript : scripts.add(id, runScript);
   const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
-  const services = Object.fromEntries(((_h = job.services) !== null && _h !== void 0 ? _h : []).map(service => typeof service === "string" ? {
+  const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map(service => typeof service === "string" ? {
     name: service
-  } : service).filter(service => !isDindService(service.name)).map(service => [slug("alias" in service && service.alias ? service.alias : service.name), {
+  } : service);
+  // docker runs natively on github runners, so gitlab's docker-in-docker
+  // services are dropped. The job container stays: the runner mounts the
+  // host's docker socket into it, and images like docker-build carry the
+  // helper scripts (ensure*Dockerfile etc.) the job scripts rely on.
+  const services = Object.fromEntries(declaredServices.filter(service => !isDindService(service.name)).map(service => [slug("alias" in service && service.alias ? service.alias : service.name), {
     image: service.name,
     ...("variables" in service && service.variables ? {
       env: service.variables
@@ -6206,7 +7122,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds) => {
   }]));
   const env = {
     ...Object.fromEntries(Object.entries((_j = job.runnerVariables) !== null && _j !== void 0 ? _j : {}).filter(([key]) => !GITLAB_ONLY_RUNNER_VARIABLES.has(key))),
-    ...(isComponent ? getSecretsEnv(context) : {}),
+    ...(isComponent ? getSecretsEnv(context, secretKinds) : {}),
+    ...getReferencedSecretsEnv(runScript, secretKinds),
     CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
   };
   const githubJob = {
@@ -6217,7 +7134,14 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds) => {
     } : {}),
     ...(image ? {
       container: {
-        image
+        image,
+        // private images in the repo's registry need credentials
+        ...(resolved.fromRepoRegistry ? {
+          credentials: {
+            username: "${{ github.actor }}",
+            password: "${{ github.token }}"
+          }
+        } : {})
       }
     } : {}),
     ...(Object.keys(services).length > 0 ? {
@@ -6244,7 +7168,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds) => {
     })), {
       name: job.name,
       id: "main",
-      run: runScript,
+      run,
       shell: "bash"
     }, ...(uploadProviderIds.has(id) || artifactPaths.length > 0 ? artifactPaths.length > 0 ? [{
       name: "Upload artifacts",
@@ -6252,7 +7176,11 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds) => {
       with: {
         name: id,
         path: artifactPaths.join("\n"),
-        "if-no-files-found": "warn"
+        "if-no-files-found": "warn",
+        // gitlab artifacts include everything; upload-artifact
+        // silently drops hidden files by default — which is
+        // exactly where next.js builds live (.next)
+        "include-hidden-files": true
       }
     }] : [] : [])]
   };
@@ -6285,36 +7213,49 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.getGithubReleaseJobs = void 0;
-const runner_1 = __nccwpck_require__(92348);
-const createReleaseJob = needs => ({
-  name: "create release",
-  "runs-on": "ubuntu-latest",
-  container: {
-    image: (0, runner_1.getRunnerImage)("semantic-release")
-  },
-  // semantic-release pushes the version tag and release commit
-  permissions: {
-    contents: "write"
-  },
-  ...(needs && needs.length > 0 ? {
-    needs
-  } : {}),
-  env: {
-    GITHUB_TOKEN: "${{ github.token }}"
-  },
-  steps: [{
-    name: "Checkout",
-    uses: "actions/checkout@v4",
-    // semantic-release needs the full history to determine the version
-    with: {
-      "fetch-depth": 0
-    }
-  }, {
+const createGithubJobs_1 = __nccwpck_require__(14016);
+const createReleaseJob = (images, needs) => {
+  const resolved = images.resolveRef({
+    catladderImage: "semantic-release"
+  });
+  const imageNeeds = resolved.need && typeof resolved.need === "object" ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)] : [];
+  const allNeeds = [...imageNeeds, ...(needs !== null && needs !== void 0 ? needs : [])];
+  return {
     name: "create release",
-    run: "semanticRelease",
-    shell: "bash"
-  }]
-});
+    "runs-on": "ubuntu-latest",
+    container: {
+      image: resolved.image,
+      ...(resolved.fromRepoRegistry ? {
+        credentials: {
+          username: "${{ github.actor }}",
+          password: "${{ github.token }}"
+        }
+      } : {})
+    },
+    // semantic-release pushes the version tag and release commit
+    permissions: {
+      contents: "write"
+    },
+    ...(allNeeds.length > 0 ? {
+      needs: allNeeds
+    } : {}),
+    env: {
+      GITHUB_TOKEN: "${{ github.token }}"
+    },
+    steps: [{
+      name: "Checkout",
+      uses: "actions/checkout@v4",
+      // semantic-release needs the full history to determine the version
+      with: {
+        "fetch-depth": 0
+      }
+    }, {
+      name: "create release",
+      run: "semanticRelease",
+      shell: "bash"
+    }]
+  };
+};
 /**
  * the release jobs for the github backend (the counterpart of the
  * gitlab release jobs):
@@ -6324,22 +7265,22 @@ const createReleaseJob = needs => ({
  * - otherwise (manual, the default): the release job goes to the
  *   manual tasks workflow
  */
-const getGithubReleaseJobs = (config, mainWorkflowJobIds) => {
+const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
   var _a;
   if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
     return {
       main: {
-        "create-release": createReleaseJob(mainWorkflowJobIds)
+        "create-release": createReleaseJob(images, mainWorkflowJobIds)
       },
       manual: {
-        "force-create-release": createReleaseJob()
+        "force-create-release": createReleaseJob(images)
       }
     };
   }
   return {
     main: {},
     manual: {
-      "create-release": createReleaseJob()
+      "create-release": createReleaseJob(images)
     }
   };
 };
@@ -6377,6 +7318,64 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 __exportStar(__nccwpck_require__(54038), exports);
 __exportStar(__nccwpck_require__(25474), exports);
+__exportStar(__nccwpck_require__(59189), exports);
+
+/***/ }),
+
+/***/ 59189:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.GithubScriptFiles = exports.GITHUB_SCRIPTS_FOLDER = void 0;
+const path_1 = __nccwpck_require__(16928);
+/**
+ * folder for job scripts materialized into the repository (committed,
+ * like the image definitions). Owned entirely by the github backend.
+ */
+exports.GITHUB_SCRIPTS_FOLDER = ".catladder-generated/github/scripts";
+/**
+ * github silently ignores workflow files larger than 512 KB — no run,
+ * no check suite, no error. Inlining every job's bash script blows past
+ * that limit on bigger projects, so job scripts are materialized into
+ * committed files and the workflow step only invokes them.
+ *
+ * Scripts containing `${{ ... }}` expressions must stay inline: the
+ * runner only interpolates expressions in the workflow file itself,
+ * never in files read at runtime.
+ */
+class GithubScriptFiles {
+  constructor() {
+    this.files = new Map();
+  }
+  /**
+   * materializes a job script into a committed file and returns the
+   * step command invoking it
+   */
+  add(jobId, script) {
+    const path = (0, path_1.join)(exports.GITHUB_SCRIPTS_FOLDER, `${jobId}.sh`);
+    // `shell: bash` steps run with `bash -eo pipefail`; the script file
+    // must fail exactly like the inline version did
+    const content = `#!/usr/bin/env bash\nset -eo pipefail\n\n${script}\n`;
+    const existing = this.files.get(path);
+    if (existing !== undefined && existing !== content) {
+      throw new Error(`conflicting scripts for job id '${jobId}'`);
+    }
+    this.files.set(path, content);
+    return `bash ${path}`;
+  }
+  getGeneratedFiles() {
+    return [...this.files.entries()].map(([path, content]) => ({
+      path,
+      content
+    }));
+  }
+}
+exports.GithubScriptFiles = GithubScriptFiles;
 
 /***/ }),
 
@@ -6431,6 +7430,7 @@ const promises_1 = __nccwpck_require__(91943);
 const rules_1 = __nccwpck_require__(44565);
 const config_1 = __nccwpck_require__(96925);
 const createAllJobs_1 = __nccwpck_require__(83671);
+const jobImagesPlan_1 = __nccwpck_require__(11585);
 const createGitlabJobs_1 = __nccwpck_require__(80512);
 const createGitlabPipeline_1 = __nccwpck_require__(61862);
 const gitlabReleaseJobs_1 = __nccwpck_require__(35531);
@@ -6450,31 +7450,38 @@ class GitlabBackend {
     });
   }
   async createFiles(config) {
-    const includes = await this.createIncludes(config);
+    const images = this.createImagesPlan(config);
+    const includes = await this.createIncludes(config, images);
     const mainFile = {
       path: ".gitlab-ci.yml",
       content: {
         include: includes.map(i => i.path)
       }
     };
-    return [mainFile, ...includes];
+    return [mainFile, ...includes,
+    // materialized image definitions (repo mode)
+    ...images.getGeneratedFiles()];
+  }
+  createImagesPlan(config) {
+    return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
   }
   /**
    * the complete pipeline as one object (all includes merged into one),
    * mainly for testing purposes
    */
   async createCompletePipeline(config) {
-    const includes = await this.createIncludes(config);
+    const includes = await this.createIncludes(config, this.createImagesPlan(config));
     return includes.reduce((acc, {
       content
     }) => {
       return {
         ...acc,
+        // includes are always yaml objects
         ...content // merge all includes into one object
       };
     }, {});
   }
-  async createIncludes(config) {
+  async createIncludes(config, images) {
     const {
       jobs,
       image,
@@ -6482,7 +7489,7 @@ class GitlabBackend {
       variables,
       workflow,
       ...pipelineRest
-    } = await this.createPipeline(config);
+    } = await this.createPipeline(config, images);
     // we will create 1 include per component or workspace
     // this is for better readability in git diffs and to avoid problems with yaml files beeing too large
     // group by context
@@ -6515,14 +7522,14 @@ class GitlabBackend {
     };
     return [mainInclude, ...componentIncludes];
   }
-  async createPipeline(config) {
+  async createPipeline(config, images) {
     const stages = (0, getPipelineStages_1.getPipelineStages)(config);
     // for all triggers create jobs and add base rules
     const allJobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async trigger => await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({
       config,
       trigger,
       pipelineType: this.type
-    }), getGitlabRulesForTrigger(trigger)))).then(j => j.flat());
+    }), images, getGitlabRulesForTrigger(trigger)))).then(j => j.flat());
     const allWorkspaceJobs = allJobsPerTrigger.filter(j => {
       var _a;
       return ((_a = j.context) === null || _a === void 0 ? void 0 : _a.type) === "workspace";
@@ -6551,7 +7558,9 @@ class GitlabBackend {
       var _a;
       return ((_a = j.context) === null || _a === void 0 ? void 0 : _a.type) === "agent";
     });
-    const allJobs = [...allWorkspaceJobs, ...allComponentJobs, ...allGlobalJobs].reduce((acc, {
+    // context-less jobs (image build jobs)
+    const allContextlessJobs = allJobsPerTrigger.filter(j => j.context === null);
+    const allJobs = [...allContextlessJobs, ...allWorkspaceJobs, ...allComponentJobs, ...allGlobalJobs].reduce((acc, {
       gitlabJob,
       name,
       context
@@ -6665,7 +7674,8 @@ exports.GITLAB_CI_VARIABLES = {
   jobToken: "CI_JOB_TOKEN",
   jobImage: "CI_JOB_IMAGE",
   registry: "CI_REGISTRY",
-  registryImage: "CI_REGISTRY_IMAGE"
+  registryImage: "CI_REGISTRY_IMAGE",
+  registryUser: "CI_REGISTRY_USER"
 };
 
 /***/ }),
@@ -6734,7 +7744,7 @@ const getFullReferencedJobNameFromWorkspace = (referencedJobName, workspaceName,
   });
 };
 const getJobName = need => (0, lodash_es_1.isObject)(need) ? need.job : need;
-const makeGitlabJob = (context, job, allJobs, baseRules) => {
+const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
   var _a, _b;
   const {
     environment,
@@ -6752,8 +7762,14 @@ const makeGitlabJob = (context, job, allJobs, baseRules) => {
     allow_failure: jobAllowFailure,
     cache: jobCache,
     caches,
+    image: jobImage,
     ...rest
   } = job;
+  // catladder image references resolve according to the jobImages mode;
+  // in repo mode the job additionally depends on the image build job
+  const resolvedImage = images.resolve(jobImage);
+  const image = resolvedImage.image;
+  const imageNeeds = resolvedImage.need ? [resolvedImage.need] : [];
   // the neutral `gate` translates to gitlab's when/allow_failure;
   // explicitly set gitlab fields take precedence
   const when = jobWhen !== null && jobWhen !== void 0 ? jobWhen : gate ? gate === "manual" ? "manual" : "on_success" : undefined;
@@ -6762,7 +7778,7 @@ const makeGitlabJob = (context, job, allJobs, baseRules) => {
   // an explicitly set gitlab `cache` takes precedence
   const cache = jobCache !== null && jobCache !== void 0 ? jobCache : caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
   const stage = envMode === "stagePerEnv" && context.type !== "agent" ? `${job.stage} ${context.env}` : job.stage;
-  const deduplicatedGitlabNeeds = getGitlabNeeds(context, job, allJobs);
+  const deduplicatedGitlabNeeds = getGitlabNeeds(context, job, allJobs, imageNeeds);
   const fullJobName = getFullJobName({
     type: context.type,
     name,
@@ -6791,6 +7807,7 @@ const makeGitlabJob = (context, job, allJobs, baseRules) => {
     retry: defaults_1.BASE_RETRY,
     interruptible: true,
     ...rest,
+    image,
     allow_failure,
     cache: cache ? (0, cache_1.addCacheFallback)(cache, context) : undefined,
     rules: rules.length > 0 ? rules : undefined,
@@ -6866,13 +7883,13 @@ const addGitlabEnvironment = (context, catladderJobEnvironment, job, allJobs) =>
     script: [...((_b = job.script) !== null && _b !== void 0 ? _b : []), ...(createsJobEnv ? scriptToAdd : [])]
   };
 };
-const createGitlabJobs = async (allJobs, baseRules) => {
-  return [...allJobs.workspaces, ...allJobs.components, ...allJobs.agents].flatMap(({
+const createGitlabJobs = async (allJobs, images, baseRules) => {
+  const contextualJobs = [...allJobs.workspaces, ...allJobs.components, ...allJobs.agents].flatMap(({
     context,
     jobs
   }) => {
     return jobs.map(job => {
-      const [fullJobName, gitlabJob] = (0, exports.makeGitlabJob)(context, job, allJobs, baseRules);
+      const [fullJobName, gitlabJob] = (0, exports.makeGitlabJob)(context, job, allJobs, images, baseRules);
       return {
         name: fullJobName,
         gitlabJob,
@@ -6880,13 +7897,66 @@ const createGitlabJobs = async (allJobs, baseRules) => {
       };
     });
   });
+  // image build jobs (repo mode): no context, plain names, their
+  // rules:changes combined with the trigger rules
+  const imageJobs = images.getEnsureJobs().map(job => ({
+    name: job.name,
+    gitlabJob: makeEnsureImageGitlabJob(job, baseRules),
+    context: null
+  }));
+  return [...imageJobs, ...contextualJobs];
 };
 exports.createGitlabJobs = createGitlabJobs;
-function getGitlabNeeds(context, job, allJobs) {
+/**
+ * lowers an image build job: only runs when the (generated) image
+ * definition changed, within the trigger's base rules
+ */
+const makeEnsureImageGitlabJob = (job, baseRules) => {
+  var _a, _b, _c, _d;
+  const changes = (_b = (_a = job.rules) === null || _a === void 0 ? void 0 : _a[0]) === null || _b === void 0 ? void 0 : _b.changes;
+  const rules = (baseRules !== null && baseRules !== void 0 ? baseRules : []).map(baseRule => baseRule.when === "never" ? baseRule : {
+    ...baseRule,
+    changes
+  });
+  return (0, removeUndefined_1.removeUndefined)({
+    retry: defaults_1.BASE_RETRY,
+    interruptible: true,
+    image: job.image,
+    services: job.services,
+    rules: rules.length > 0 ? rules : [{
+      changes
+    }],
+    variables: job.runnerVariables,
+    script: (_d = (_c = job.script) === null || _c === void 0 ? void 0 : _c.filter(utils_1.notNil)) !== null && _d !== void 0 ? _d : [],
+    stage: job.stage,
+    needs: []
+  });
+};
+function getGitlabNeeds(context, job, allJobs, extraNeeds = []) {
   var _a;
-  const needs = context.type === "workspace" ? getGitlabNeedsForWorkspaceJob(context, job, allJobs) : context.type === "agent" ? (_a = job.needs) !== null && _a !== void 0 ? _a : null : getGitlabNeedsForComponentJob(context, job, allJobs);
+  const jobWithExtraNeeds = extraNeeds.length > 0 ? {
+    ...job,
+    needs: [...extraNeeds, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])]
+  } : job;
+  const needs = context.type === "workspace" ? getGitlabNeedsForWorkspaceJob(context, jobWithExtraNeeds, allJobs) : context.type === "agent" ? mapAgentNeeds(jobWithExtraNeeds.needs) : getGitlabNeedsForComponentJob(context, jobWithExtraNeeds, allJobs);
   return needs ? deduplicateNeeds(needs) : undefined;
 }
+/**
+ * agent jobs use their needs as-is; global needs (image build jobs)
+ * keep their plain name and optional flag
+ */
+function mapAgentNeeds(needs) {
+  if (!needs) {
+    return null;
+  }
+  return needs.map(n => (0, lodash_es_1.isObject)(n) && "global" in n && n.global ? {
+    job: n.job,
+    artifacts: n.artifacts,
+    ...(n.optional ? {
+      optional: true
+    } : {})
+  } : n);
+}
 function deduplicateNeeds(needs) {
   return needs ? [...new Map(needs.map(n => [(0, lodash_es_1.isObject)(n) ? n.job : n, n])).values()] : undefined;
 }
@@ -6895,11 +7965,19 @@ function getGitlabNeedsForComponentJob(context, {
 }, allJobs) {
   return (needs !== null && needs !== void 0 ? needs : []).map(n => {
     var _a;
-    return (0, lodash_es_1.isObject)(n) ? "workspaceName" in n ? {
+    return (0, lodash_es_1.isObject)(n) ? "global" in n && n.global ?
+    // global jobs (e.g. image builds) keep their plain name
+    {
+      job: n.job,
+      artifacts: n.artifacts,
+      ...(n.optional ? {
+        optional: true
+      } : {})
+    } : "workspaceName" in n && n.workspaceName ? {
       job: getFullReferencedJobNameFromWorkspace(n.job, n.workspaceName, context.env, allJobs),
       artifacts: n.artifacts
     } : {
-      job: getFullReferencedJobNameFromComponent(n.job, (_a = n.componentName) !== null && _a !== void 0 ? _a : context.name, context.env, allJobs),
+      job: getFullReferencedJobNameFromComponent(n.job, "componentName" in n ? (_a = n.componentName) !== null && _a !== void 0 ? _a : context.name : context.name, context.env, allJobs),
       artifacts: n.artifacts
     } : getFullReferencedJobNameFromComponent(n, context.name, context.env, allJobs);
   }) // sort in a predictable manner for snapshot tests
@@ -6912,7 +7990,13 @@ function getGitlabNeedsForComponentJob(context, {
 function getGitlabNeedsForWorkspaceJob(context, {
   needs
 }, allJobs) {
-  return (needs !== null && needs !== void 0 ? needs : []).map(n => (0, lodash_es_1.isObject)(n) ? {
+  return (needs !== null && needs !== void 0 ? needs : []).map(n => (0, lodash_es_1.isObject)(n) ? "global" in n && n.global ? {
+    job: n.job,
+    artifacts: n.artifacts,
+    ...(n.optional ? {
+      optional: true
+    } : {})
+  } : {
     job: getFullReferencedJobNameFromWorkspace(n.job, "workspaceName" in n && n.workspaceName ? n.workspaceName : context.name, context.env, allJobs),
     artifacts: n.artifacts
   } : getFullReferencedJobNameFromWorkspace(n, context.name, context.env, allJobs)) // sort in a predictable manner for snapshot tests
@@ -6941,7 +8025,7 @@ const createGitlabPipelineWithDefaults = ({
   ...config
 }) => {
   return {
-    image: image !== null && image !== void 0 ? image : (0, runner_1.getRunnerImage)("jobs-default"),
+    image: image !== null && image !== void 0 ? image : (0, runner_1.getCentralRunnerImageUrl)("jobs-default"),
     // default image
     variables: {
       FF_USE_FASTZIP: "true",
@@ -7044,7 +8128,7 @@ const getGitlabReleaseJobs = config => {
   return {
     ["create release"]: {
       stage: "release",
-      image: (0, runner_1.getRunnerImage)("semantic-release"),
+      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       rules: [...baseReleaseRules, {
@@ -7057,7 +8141,7 @@ const getGitlabReleaseJobs = config => {
     },
     ["⚠️ force create release"]: {
       stage: "release",
-      image: (0, runner_1.getRunnerImage)("semantic-release"),
+      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       needs: [],
@@ -7163,7 +8247,7 @@ var __exportStar = this && this.__exportStar || function (m, exports) {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getEnabledPipelineTypes = exports.getPipelineBackend = void 0;
+exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = void 0;
 const github_1 = __nccwpck_require__(99635);
 const gitlab_1 = __nccwpck_require__(8475);
 __exportStar(__nccwpck_require__(92474), exports);
@@ -7181,6 +8265,38 @@ const getPipelineBackend = type => {
   return createBackend();
 };
 exports.getPipelineBackend = getPipelineBackend;
+/**
+ * the options of an enabled pipeline type (empty object when enabled
+ * with `true`)
+ */
+const getPipelineOptions = (config, type) => {
+  var _a;
+  const value = (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type];
+  return typeof value === "object" ? value : {};
+};
+exports.getPipelineOptions = getPipelineOptions;
+/**
+ * the git remote pointing to the repository of this pipeline type's CI
+ * system (e.g. during a migration, gitlab may be `origin` and github a
+ * second remote)
+ */
+const getPipelineGitRemote = (config, type) => {
+  var _a;
+  return (_a = (0, exports.getPipelineOptions)(config, type).gitRemote) !== null && _a !== void 0 ? _a : "origin";
+};
+exports.getPipelineGitRemote = getPipelineGitRemote;
+/**
+ * the normalized secrets vault of a config (string shorthands resolved
+ * to their object form; defaults to the legacy gitlab store)
+ */
+const getVaultConfig = config => {
+  var _a, _b;
+  const vault = (_b = (_a = config.secrets) === null || _a === void 0 ? void 0 : _a.vault) !== null && _b !== void 0 ? _b : "gitlab";
+  return typeof vault === "string" ? {
+    type: vault
+  } : vault;
+};
+exports.getVaultConfig = getVaultConfig;
 /**
  * the pipeline types enabled for this config. Multiple types can be
  * enabled at once (parallel generation, e.g. during a CI migration).
@@ -8768,7 +9884,10 @@ const getYarnInstallCommand = async context => {
   // inline builds make debugging easier as it prints it out in the logs, instead of writing it in temp files
   return `yarn install --immutable --inline-builds`;
 };
-const ensureNodeVersion = context => (0, gitlab_1.collapseableSection)("nodeinstall", "Ensure node version")(["if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi", "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi"]);
+const ensureNodeVersion = context => (0, gitlab_1.collapseableSection)("nodeinstall", "Ensure node version")([
+// github actions overrides HOME in container jobs, so also look
+// for nvm where the catladder images install it (/root/.nvm)
+'if [ -f "$HOME/.nvm/nvm.sh" ]; then source "$HOME/.nvm/nvm.sh"; elif [ -f /root/.nvm/nvm.sh ]; then export NVM_DIR=/root/.nvm; source /root/.nvm/nvm.sh; fi', "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi"]);
 exports.ensureNodeVersion = ensureNodeVersion;
 const getYarnInstall = async (context, options) => {
   const postInstall = context.type !== "workspace" && context.build.type !== "disabled" && "postInstall" in context.build.config ? context.build.config.postInstall : null;
@@ -9147,7 +10266,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-4e7c6848" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-6a4450e0" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -9559,7 +10678,7 @@ const getBasePredefinedVariables = ctx => {
   };
 };
 const getEnvironmentVariables = async (ctx, options = {}) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h;
+  var _a, _b, _c, _d, _e, _f, _g;
   const environmentContext = (0, getEnvironmentContext_1.getEnvironmentContext)(ctx);
   const {
     config,
@@ -9616,13 +10735,13 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
   }
   const publicEnvVarsRaw = (_e = (_d = envConfigRaw.vars) === null || _d === void 0 ? void 0 : _d.public) !== null && _e !== void 0 ? _e : {};
   const additionalSecretKeys = deployConfigRaw ? deploy_1.DEPLOY_TYPES[deployConfigRaw.type].additionalSecretKeys(environmentContext) : [];
-  const secretEnvVarKeys = [...(0, envVars_1.stringListToSecreteEnvVarList)((_g = (_f = envConfigRaw.vars) === null || _f === void 0 ? void 0 : _f.secret) !== null && _g !== void 0 ? _g : []), ...additionalSecretKeys];
+  const secretEnvVarKeys = [...(0, envVars_1.normalizeSecretVarsConfig)((_f = envConfigRaw.vars) === null || _f === void 0 ? void 0 : _f.secret), ...additionalSecretKeys];
   const secretEnvVars = (0, envVars_1.makeSecretEnvVarMapping)(env, componentName, secretEnvVarKeys);
   const publicEnvVarsRawSanitized = (0, envVars_1.stringifyValues)(publicEnvVarsRaw);
   const publicEnvVarsUnresolved = Object.fromEntries(Object.entries(publicEnvVarsRawSanitized).map(([key, value]) => [key, (0, VariableValueContainingReferences_1.createVariableValueContainingReferencesFromString)(value, {
     componentName: ctx.componentName
   })]));
-  const publicEnvVars = ((_h = options.shouldResolveReferences) !== null && _h !== void 0 ? _h : true) ? await (0, resolveAllReferences_1.resolveAllReferences)(publicEnvVarsUnresolved, async otherComponentName => {
+  const publicEnvVars = ((_g = options.shouldResolveReferences) !== null && _g !== void 0 ? _g : true) ? await (0, resolveAllReferences_1.resolveAllReferences)(publicEnvVarsUnresolved, async otherComponentName => {
     const {
       envVars: otherEnvVars
     } = await (0, exports.getEnvironmentVariables)({
@@ -9782,7 +10901,7 @@ const envVars_1 = __nccwpck_require__(94946);
  * @returns
  */
 const transformJobOnlyVars = async (env, componentName, vars) => {
-  var _a, _b;
+  var _a;
   if (!vars) {
     return {
       envVars: {},
@@ -9790,7 +10909,7 @@ const transformJobOnlyVars = async (env, componentName, vars) => {
     };
   }
   const publicVars = (0, envVars_1.stringifyValues)((_a = vars === null || vars === void 0 ? void 0 : vars.public) !== null && _a !== void 0 ? _a : {});
-  const secretEnvVarKeys = (0, envVars_1.stringListToSecreteEnvVarList)((_b = vars === null || vars === void 0 ? void 0 : vars.secret) !== null && _b !== void 0 ? _b : []);
+  const secretEnvVarKeys = (0, envVars_1.normalizeSecretVarsConfig)(vars === null || vars === void 0 ? void 0 : vars.secret);
   const deployJobOnlySecretEnvVars = (vars === null || vars === void 0 ? void 0 : vars.secret) ? (0, envVars_1.makeSecretEnvVarMapping)(env, componentName, secretEnvVarKeys) : {};
   const envVars = {
     ...deployJobOnlySecretEnvVars,
@@ -9814,7 +10933,7 @@ exports.transformJobOnlyVars = transformJobOnlyVars;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.makeSecretEnvVarMapping = exports.stringListToSecreteEnvVarList = exports.stringifyValues = void 0;
+exports.makeSecretEnvVarMapping = exports.normalizeSecretVarsConfig = exports.stringListToSecreteEnvVarList = exports.stringifyValues = void 0;
 const lodash_es_1 = __nccwpck_require__(64284);
 const getEnvironmentVariables_1 = __nccwpck_require__(85855);
 const BashExpression_1 = __nccwpck_require__(25354);
@@ -9824,6 +10943,27 @@ const stringListToSecreteEnvVarList = keys => keys.map(key => ({
   key
 }));
 exports.stringListToSecreteEnvVarList = stringListToSecreteEnvVarList;
+/**
+ * normalizes both config forms of vault-stored env vars: the deprecated
+ * plain string[] (all keys secret) and the record form carrying a kind
+ * (or config object) per key
+ */
+const normalizeSecretVarsConfig = secret => {
+  if (!secret) {
+    return [];
+  }
+  if (Array.isArray(secret)) {
+    return (0, exports.stringListToSecreteEnvVarList)(secret);
+  }
+  return Object.entries(secret).map(([key, config]) => typeof config === "string" ? {
+    key,
+    kind: config
+  } : {
+    key,
+    ...config
+  });
+};
+exports.normalizeSecretVarsConfig = normalizeSecretVarsConfig;
 const makeSecretEnvVarMapping = (env, componentName, secretEnvVars) => {
   return Object.fromEntries(secretEnvVars.map(({
     key
@@ -9833,6 +10973,330 @@ exports.makeSecretEnvVarMapping = makeSecretEnvVarMapping;
 
 /***/ }),
 
+/***/ 53231:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.computeCustomImageHash = void 0;
+const crypto_1 = __nccwpck_require__(76982);
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+const IGNORED_FILES = new Set([".DS_Store", "Thumbs.db"]);
+const isIgnoredFile = path => {
+  var _a;
+  return IGNORED_FILES.has((_a = path.split("/").pop()) !== null && _a !== void 0 ? _a : "");
+};
+function listFilesRecursive(dir) {
+  const resolved = (0, path_1.resolve)(dir);
+  const entries = (0, fs_1.readdirSync)(resolved, {
+    recursive: true,
+    encoding: "utf-8"
+  });
+  return entries.filter(entry => {
+    if (isIgnoredFile(entry)) {
+      // OS junk files exist locally but not in CI checkouts — they
+      // must never influence the content hash
+      return false;
+    }
+    const fullPath = (0, path_1.join)(resolved, entry);
+    return (0, fs_1.statSync)(fullPath).isFile();
+  }).sort();
+}
+function computeCustomImageHash(config) {
+  var _a;
+  const hash = (0, crypto_1.createHash)("sha256");
+  const watchedPaths = [];
+  // Hash all files in the dir (includes the Dockerfile and any context files)
+  const dirFiles = listFilesRecursive(config.dir);
+  for (const file of dirFiles) {
+    const fullPath = (0, path_1.join)((0, path_1.resolve)(config.dir), file);
+    hash.update(file); // include relative path for disambiguation
+    hash.update((0, fs_1.readFileSync)(fullPath));
+  }
+  watchedPaths.push(`${config.dir}/**/*`);
+  // extra dirs (e.g. included base image definitions)
+  for (const extraDir of (_a = config.extraDirs) !== null && _a !== void 0 ? _a : []) {
+    for (const file of listFilesRecursive(extraDir)) {
+      hash.update(file);
+      hash.update((0, fs_1.readFileSync)((0, path_1.join)((0, path_1.resolve)(extraDir), file)));
+    }
+    watchedPaths.push(`${extraDir}/**/*`);
+  }
+  // Hash extra paths (for files outside the dir)
+  if (config.hashExtraPaths) {
+    // Extra paths are literal file paths (not globs) for simplicity
+    const extraFiles = [...config.hashExtraPaths].sort();
+    for (const file of extraFiles) {
+      hash.update(file);
+      hash.update((0, fs_1.readFileSync)(file));
+    }
+    watchedPaths.push(...config.hashExtraPaths);
+  }
+  // Hash build args (sorted keys for determinism)
+  if (config.buildArgs) {
+    const sorted = Object.entries(config.buildArgs).sort(([a], [b]) => a.localeCompare(b));
+    hash.update(JSON.stringify(sorted));
+  }
+  return {
+    hash: hash.digest("hex").slice(0, 12),
+    watchedPaths
+  };
+}
+exports.computeCustomImageHash = computeCustomImageHash;
+
+/***/ }),
+
+/***/ 11585:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.JobImagesPlan = exports.getJobImagesMode = exports.GENERATED_IMAGES_FOLDER = void 0;
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+const ciVariables_1 = __nccwpck_require__(14489);
+const docker_1 = __nccwpck_require__(12764);
+const constants_1 = __nccwpck_require__(43480);
+const runner_1 = __nccwpck_require__(92348);
+const gitlab_1 = __nccwpck_require__(13468);
+const hash_1 = __nccwpck_require__(53231);
+const shippedImages_1 = __nccwpck_require__(77734);
+exports.GENERATED_IMAGES_FOLDER = ".catladder-generated/images";
+/**
+ * the official docker cli image used to build the job images — NOT a
+ * catladder image, so building images never depends on one (bootstrap)
+ */
+const BUILDER_IMAGE = "docker.io/docker:29.5.1";
+const getJobImagesMode = (config, pipelineType) => {
+  var _a;
+  // the central registry is not reachable from github runners
+  if (pipelineType === "github" && config.jobImages === "central") {
+    throw new Error(`jobImages: "central" is not supported on github: catladder's central registry (${constants_1.DOCKER_REGISTRY}) is unreachable from github runners. Use "repo" (the default) instead.`);
+  }
+  return (_a = config.jobImages) !== null && _a !== void 0 ? _a : pipelineType === "github" ? "repo" : "central";
+};
+exports.getJobImagesMode = getJobImagesMode;
+const ensureJobName = name => `🐳 job image ${name}`;
+/**
+ * plans the catladder job images of one backend run: resolves image
+ * references, and (in repo mode) collects the image build jobs and the
+ * image definitions to materialize into the generated files.
+ *
+ * Reference-driven: only images actually used by a job are built.
+ */
+class JobImagesPlan {
+  constructor(mode, pipelineType) {
+    this.mode = mode;
+    this.pipelineType = pipelineType;
+    this.used = new Map();
+  }
+  /**
+   * resolves a job image (marker or concrete) to a concrete image url
+   * plus the build job dependency in repo mode
+   */
+  resolve(image) {
+    if (!(0, runner_1.isCatladderImageRef)(image)) {
+      return {
+        image
+      };
+    }
+    return this.resolveRef(image);
+  }
+  resolveRef(ref) {
+    const name = ref.catladderImage;
+    if (this.mode === "central" || shippedImages_1.CENTRAL_ONLY_IMAGES.has(name)) {
+      return {
+        image: (0, runner_1.getCentralRunnerImageUrl)(name)
+      };
+    }
+    const {
+      hash
+    } = this.use(name);
+    return {
+      image: `${this.registryImageRef()}/catladder/${name}:${hash}`,
+      fromRepoRegistry: true,
+      need: {
+        job: ensureJobName(name),
+        artifacts: false,
+        optional: true,
+        global: true
+      }
+    };
+  }
+  /**
+   * the registry image prefix. On github, container images can't use
+   * runtime env vars — the expression form is required.
+   */
+  registryImageRef() {
+    return this.pipelineType === "github" ? "ghcr.io/${{ github.repository }}" : `${(0, ciVariables_1.getCiVariable)({
+      pipelineType: this.pipelineType
+    }, "registryImage")}`;
+  }
+  use(name) {
+    var _a;
+    const existing = this.used.get(name);
+    if (existing) {
+      return existing;
+    }
+    const dependencies = (_a = shippedImages_1.RUNNER_IMAGE_DEPENDENCIES[name]) !== null && _a !== void 0 ? _a : [];
+    // dependencies are materialized (and hashed) as part of this image,
+    // but also usable standalone
+    dependencies.forEach(dependency => this.use(dependency));
+    const {
+      hash
+    } = (0, hash_1.computeCustomImageHash)({
+      dir: (0, shippedImages_1.getShippedImageDir)(name),
+      extraDirs: dependencies.map(dependency => (0, shippedImages_1.getShippedImageDir)(dependency))
+    });
+    const entry = {
+      hash
+    };
+    this.used.set(name, entry);
+    return entry;
+  }
+  /**
+   * the image build jobs for all used images (repo mode; empty in
+   * central mode)
+   */
+  getEnsureJobs() {
+    return [...this.used.entries()].map(([name, {
+      hash
+    }]) => this.createEnsureJob(name, hash));
+  }
+  createEnsureJob(name, hash) {
+    var _a;
+    const ctx = {
+      pipelineType: this.pipelineType
+    };
+    const registryUser = (0, ciVariables_1.getCiVariable)(ctx, "registryUser");
+    const jobToken = (0, ciVariables_1.getCiVariable)(ctx, "jobToken");
+    const registry = (0, ciVariables_1.getCiVariable)(ctx, "registry");
+    const imageRef = `${this.registryImageRef()}/catladder/${name}:${hash}`;
+    const watchedDirs = [name, ...((_a = shippedImages_1.RUNNER_IMAGE_DEPENDENCIES[name]) !== null && _a !== void 0 ? _a : [])];
+    const {
+      services,
+      runnerVariables
+    } = (0, docker_1.getDockerJobBaseProps)();
+    return {
+      name: ensureJobName(name),
+      stage: "setup",
+      image: BUILDER_IMAGE,
+      services,
+      runnerVariables,
+      needs: [],
+      // gitlab: only run when the image definition changed; github has
+      // no equivalent and always runs (the existence check is fast)
+      rules: [{
+        changes: watchedDirs.map(dir => `${exports.GENERATED_IMAGES_FOLDER}/${dir}/**/*`)
+      }],
+      variables: {},
+      script: [...(0, gitlab_1.collapseableSection)("docker-login", "Docker Login")([`docker login --username ${registryUser} --password ${jobToken} ${registry}`]), ...(0, gitlab_1.collapseableSection)("check-image", "Checking if image exists")([`if docker manifest inspect ${imageRef} > /dev/null 2>&1; then`, `  echo "Image ${imageRef} already exists, skipping build"`, `  exit 0`, `fi`]), ...(0, gitlab_1.collapseableSection)("docker-build", "Building image")([`DOCKER_BUILDKIT=1 docker build -t ${imageRef} -f ${exports.GENERATED_IMAGES_FOLDER}/${name}/Dockerfile ${shippedImages_1.RUNNER_IMAGE_BUILD_CONTEXT[name] === "root" ? exports.GENERATED_IMAGES_FOLDER : `${exports.GENERATED_IMAGES_FOLDER}/${name}`}`]), ...(0, gitlab_1.collapseableSection)("docker-push", "Pushing image")([`docker push ${imageRef}`])]
+    };
+  }
+  /**
+   * the image definitions of all used images, materialized into the
+   * generated files (so pipelines build from committed, reviewable
+   * files and gitlab's rules:changes can watch them)
+   */
+  getGeneratedFiles() {
+    return [...this.used.keys()].flatMap(name => {
+      const dir = (0, shippedImages_1.getShippedImageDir)(name);
+      return listFilesRecursive(dir).map(file => ({
+        path: (0, path_1.join)(exports.GENERATED_IMAGES_FOLDER, name, file),
+        content: (0, fs_1.readFileSync)((0, path_1.join)(dir, file), "utf-8")
+      }));
+    });
+  }
+}
+exports.JobImagesPlan = JobImagesPlan;
+const IGNORED_FILES = new Set([".DS_Store", "Thumbs.db"]);
+const listFilesRecursive = dir => (0, fs_1.readdirSync)(dir, {
+  recursive: true,
+  encoding: "utf-8"
+}).filter(entry => {
+  var _a;
+  // OS junk files exist locally but not in CI checkouts
+  return !IGNORED_FILES.has((_a = entry.split("/").pop()) !== null && _a !== void 0 ? _a : "") && (0, fs_1.statSync)((0, path_1.join)(dir, entry)).isFile();
+}).sort();
+
+/***/ }),
+
+/***/ 77734:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.getShippedImageDir = exports.getShippedImagesDir = exports.RUNNER_IMAGE_BUILD_CONTEXT = exports.CENTRAL_ONLY_IMAGES = exports.RUNNER_IMAGE_DEPENDENCIES = void 0;
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+/**
+ * images whose Dockerfile INCLUDEs another image's Dockerfile
+ * (dockerfile-x/dockerfile-plus, resolved against the images root as
+ * build context)
+ */
+exports.RUNNER_IMAGE_DEPENDENCIES = {
+  "jobs-meteor": ["jobs-default"],
+  "jobs-testing-chrome": ["jobs-default"]
+};
+/**
+ * the docker build context of each image, mirroring the central image
+ * builds: the jobs family builds from the images root (their
+ * Dockerfiles INCLUDE sibling images), the others from their own dir
+ * (their COPY paths are relative to it)
+ */
+/**
+ * images that cannot be built from the shipped definitions and always
+ * come from the central registry: semantic-release bakes catladder's
+ * own cli sources into the image (repo-root build context).
+ * TODO: make the semantic-release image self-contained.
+ */
+exports.CENTRAL_ONLY_IMAGES = new Set(["semantic-release"]);
+exports.RUNNER_IMAGE_BUILD_CONTEXT = {
+  "jobs-default": "root",
+  "jobs-meteor": "root",
+  "jobs-testing-chrome": "root",
+  kubernetes: "self",
+  "docker-build": "self",
+  gcloud: "self",
+  "semantic-release": "self",
+  "agent-claude": "self"
+};
+/**
+ * the directory containing the image definitions shipped with the
+ * package (copied into dist at build time; the repository layout is
+ * the fallback for development and tests)
+ */
+const getShippedImagesDir = () => {
+  const candidates = [
+  // built package: dist/customImages -> dist/runner-images
+  (0, path_1.join)(__dirname, "..", "runner-images"),
+  // repository: pipeline/src/customImages -> <root>/runner-images
+  (0, path_1.join)(__dirname, "..", "..", "..", "runner-images")];
+  const found = candidates.find(candidate => (0, fs_1.existsSync)(candidate));
+  if (!found) {
+    throw new Error("shipped job image definitions not found");
+  }
+  return found;
+};
+exports.getShippedImagesDir = getShippedImagesDir;
+const getShippedImageDir = name => (0, path_1.join)((0, exports.getShippedImagesDir)(), name);
+exports.getShippedImageDir = getShippedImageDir;
+
+/***/ }),
+
 /***/ 84628:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -11052,13 +12516,18 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
     }
     return {};
   },
-  additionalSecretKeys: ctx => [{
+  additionalSecretKeys: ctx => [
+  // deploy-time credentials don't exist for the local env
+  ...(ctx.envType !== "local" ? [{
     key: exports.GCLOUD_DEPLOY_CREDENTIALS_KEY,
     hidden: true
   }, {
     key: exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX,
-    hidden: true
-  }, ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
+    hidden: true,
+    // a public url fragment, not sensitive: masking it would
+    // suppress environment urls on github and break log links
+    kind: "variable"
+  }] : []), ...(ctx.deployConfigRaw && ctx.deployConfigRaw.cloudSql ? [{
     key: "DB_PASSWORD"
   }] : [])],
   getAdditionalEnvVars: ctx => {
@@ -11066,7 +12535,8 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       fullName,
       env,
       componentName,
-      deployConfigRaw
+      deployConfigRaw,
+      envType
     } = ctx;
     const HOSTNAME_INTERNAL = (0, BashExpression_1.joinBashExpressions)([fullName, (0, BashExpression_1.getBashVariable)((0, context_1.getSecretVarName)(env, componentName, exports.GCLOUD_RUN_CANONICAL_HOST_SUFFIX))], "-").toLowerCase();
     const jobTriggers = deployConfigRaw && deployConfigRaw.jobs ? Object.fromEntries(Object.entries(deployConfigRaw.jobs).filter(([name, job]) => Boolean(job)).map(([name, job]) => ["CLOUD_RUN_JOB_TRIGGER_URL_" + (0, gitlab_1.sanitizeForBashVariable)(name), (0, cloudRunExecutionUrl_1.getCloudRunJobExecuteUrl)(name, {
@@ -11075,7 +12545,11 @@ exports.GCLOUD_RUN_DEPLOY_TYPE = {
       region: deployConfigRaw.region
     })])) : {};
     return {
-      HOSTNAME_INTERNAL,
+      // references the canonical host suffix secret, which doesn't
+      // exist for the local env
+      ...(envType !== "local" ? {
+        HOSTNAME_INTERNAL
+      } : {}),
       ...getCloudSqlVariables(ctx),
       ...jobTriggers,
       DEPLOY_CLOUD_RUN_SERVICE_NAME: (0, getServiceName_1.getServiceNameForEnvContext)(ctx),
@@ -11168,7 +12642,10 @@ const getDatabaseDeleteScript = (context, deployConfig) => {
   // unfortunatly the database cannot be deleted right after the service has stopped, as it might still have connections
   // we have to repeate this process
   return [`echo "deleting database ${DB_NAME}..."`, `echo "👆 this can take multiple attemps (3-5min), because google cloud run may still have a connection to the database after the cloud run service is shut down"`, (0, gitlab_1.repeatOnFailure)(`gcloud sql databases delete ${DB_NAME} --instance=${instanceId} --project ${projectId}`, {
-    pauseInSeconds: 10
+    pauseInSeconds: 10,
+    // connections normally clear within 3-5min; anything beyond is
+    // a permanent error (missing permission, wrong instance, ...)
+    maxAttempts: 30
   })];
 };
 exports.getDatabaseDeleteScript = getDatabaseDeleteScript;
@@ -12892,6 +14369,7 @@ const promises_1 = __nccwpck_require__(91943);
 const path_1 = __nccwpck_require__(16928);
 const backends_1 = __nccwpck_require__(93243);
 const gitlab_1 = __nccwpck_require__(8475);
+const jobImagesPlan_1 = __nccwpck_require__(11585);
 /**
  * generates the pipeline files of all pipeline types enabled in the
  * config (see `pipelines`). Pass an explicit `pipelineType` to generate
@@ -12899,6 +14377,16 @@ const gitlab_1 = __nccwpck_require__(8475);
  */
 async function generatePipelineFiles(context, pipelineType) {
   const pipelineTypes = pipelineType ? [pipelineType] : (0, backends_1.getEnabledPipelineTypes)(context.config);
+  if (!pipelineType) {
+    // the materialized image definitions are a union across all enabled
+    // backends and no single backend may wipe them — cleaned once per
+    // full generation, so images that fell out of use don't linger (and
+    // keep triggering gitlab's rules:changes)
+    await (0, promises_1.rm)(jobImagesPlan_1.GENERATED_IMAGES_FOLDER, {
+      recursive: true,
+      force: true
+    });
+  }
   for (const type of pipelineTypes) {
     await generatePipelineFilesForBackend(context, (0, backends_1.getPipelineBackend)(type));
   }
@@ -12916,7 +14404,11 @@ async function generatePipelineFilesForBackend(context, backend) {
     await (0, promises_1.mkdir)((0, path_1.dirname)(path), {
       recursive: true
     });
-    await context.fileWriter.writeYamlfile(path, content);
+    if (typeof content === "string") {
+      await context.fileWriter.writeGeneratedFileRaw(path, content);
+    } else {
+      await context.fileWriter.writeYamlfile(path, content);
+    }
   }));
 }
 /**
@@ -13272,10 +14764,23 @@ exports.RULE_CONDITION_HOTFIX_BRANCH = "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x)
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.getRunnerImage = void 0;
+exports.getCentralRunnerImageUrl = exports.getRunnerImage = exports.isCatladderImageRef = void 0;
 const constants_1 = __nccwpck_require__(43480);
-const getRunnerImage = imageName => constants_1.DOCKER_REGISTRY + "/" + imageName + ":" + constants_1.PIPELINE_IMAGE_TAG;
+const isCatladderImageRef = value => typeof value === "object" && value !== null && "catladderImage" in value && typeof value.catladderImage === "string";
+exports.isCatladderImageRef = isCatladderImageRef;
+/**
+ * job creators use this to reference a catladder-provided job image;
+ * the backends resolve it to a concrete image url
+ */
+const getRunnerImage = imageName => ({
+  catladderImage: imageName
+});
 exports.getRunnerImage = getRunnerImage;
+/**
+ * the image url in catladder's central registry (the classic behavior)
+ */
+const getCentralRunnerImageUrl = imageName => constants_1.DOCKER_REGISTRY + "/" + imageName + ":" + constants_1.PIPELINE_IMAGE_TAG;
+exports.getCentralRunnerImageUrl = getCentralRunnerImageUrl;
 
 /***/ }),
 
@@ -13490,8 +14995,14 @@ const sanitizeForBashVariable = name => name.replace(/-/g, "_");
 exports.sanitizeForBashVariable = sanitizeForBashVariable;
 const repeatOnFailure = (command, options) => {
   return `
+    _attempt=0
     until ${command}
     do
+      _attempt=$((_attempt+1))
+      if [ "$_attempt" -ge ${options.maxAttempts} ]; then
+        echo "giving up after ${options.maxAttempts} attempts"
+        exit 1
+      fi
       echo "Trying again."
       sleep ${options.pauseInSeconds}
     done
@@ -13679,6 +15190,14 @@ class FileWriter {
       extension: (_b = path.split(".").pop()) !== null && _b !== void 0 ? _b : ""
     };
   }
+  /**
+   * writes content verbatim (no auto-generated header) — e.g. for
+   * materialized dockerfiles, where a leading comment would break
+   * parser directives like `# syntax = ...`
+   */
+  async writeGeneratedFileRaw(path, content) {
+    await this.writeTheFile(path, content);
+  }
   async writeGeneratedFile(path, content, options) {
     await this.writeTheFile(path, [this.getAutoGeneratedHeader(options.commentChar), content].join("\n"));
   }