@catladder/cli 0.0.0-next-52feb889 → 0.0.0-next-c177efda

package/dist/bundles/catenv/index.js

@@ -1533,6 +1533,7 @@ const ciVariables_1 = __nccwpck_require__(25474);
 const createGithubJobs_1 = __nccwpck_require__(14016);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
 const scriptFunctions_1 = __nccwpck_require__(75759);
+const shippedCatci_1 = __nccwpck_require__(93401);
 const utils_1 = __nccwpck_require__(20595);
 const githubReleaseJobs_1 = __nccwpck_require__(55611);
 const scriptFiles_1 = __nccwpck_require__(59189);
@@ -1594,7 +1595,9 @@ class GithubBackend {
       content: workflow
     })),
     // materialized job scripts and image definitions (repo mode)
-    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles()];
+    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles(),
+    // catci: the CI companion the release job's security audit runs
+    ...(0, shippedCatci_1.getCatciGeneratedFiles)()];
   }
   createImagesPlan(config) {
     return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
@@ -2299,6 +2302,7 @@ const rules_1 = __nccwpck_require__(44565);
 const config_1 = __nccwpck_require__(96925);
 const createAllJobs_1 = __nccwpck_require__(83671);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
+const shippedCatci_1 = __nccwpck_require__(93401);
 const createGitlabJobs_1 = __nccwpck_require__(80512);
 const createGitlabPipeline_1 = __nccwpck_require__(61862);
 const gitlabReleaseJobs_1 = __nccwpck_require__(35531);
@@ -2328,7 +2332,9 @@ class GitlabBackend {
     };
     return [mainFile, ...includes,
     // materialized image definitions (repo mode)
-    ...images.getGeneratedFiles()];
+    ...images.getGeneratedFiles(),
+    // catci: the CI companion the release job's security audit runs
+    ...(0, shippedCatci_1.getCatciGeneratedFiles)()];
   }
   createImagesPlan(config) {
     return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
@@ -2392,6 +2398,10 @@ class GitlabBackend {
   }
   async createPipeline(config, images) {
     const stages = (0, getPipelineStages_1.getPipelineStages)(config);
+    // release jobs first: they register their image on the plan, and the
+    // per-trigger job creation below emits the build jobs of all images
+    // registered so far
+    const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images);
     // for all triggers create jobs and add base rules
     const allJobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async trigger => await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({
       config,
@@ -2451,7 +2461,7 @@ class GitlabBackend {
       stages: [...stages, "release"],
       jobs: {
         ...allJobs,
-        ...Object.fromEntries(Object.entries((0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config)).map(([name, gitlabJob]) => [name, {
+        ...Object.fromEntries(Object.entries(releaseJobs).map(([name, gitlabJob]) => [name, {
           gitlabJob,
           context: null
         }]))
@@ -2988,15 +2998,22 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports.getGitlabReleaseJobs = void 0;
 const rules_1 = __nccwpck_require__(44565);
-const runner_1 = __nccwpck_require__(92348);
 const EXPIRED_TOKEN_HELP = "echo '👉 If this job failed with access denied, the project access token might be invald - run `project-renew-token` in catladder CLI to fix.'";
 const baseReleaseRules = [rules_1.RULE_NEVER_ON_RELEASE_COMMIT, rules_1.RULE_NEVER_ON_AGENT_TRIGGER, rules_1.RULE_NEVER_ON_SCHEDULE];
-const getGitlabReleaseJobs = config => {
+const getGitlabReleaseJobs = (config, images) => {
   var _a;
+  // NOTE: only the resolved image url is used, not the `need`: release
+  // jobs have no `needs` on purpose — their stage ordering already
+  // guarantees the image build job (setup stage) ran, and adding a
+  // `needs` would switch gitlab to DAG mode, so the release job would no
+  // longer wait for the build/deploy stages.
+  const releaseImage = images.resolveRef({
+    catladderImage: "semantic-release"
+  }).image;
   return {
     ["create release"]: {
       stage: "release",
-      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+      image: releaseImage,
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       rules: [...baseReleaseRules, {
@@ -3009,7 +3026,7 @@ const getGitlabReleaseJobs = config => {
     },
     ["⚠️ force create release"]: {
       stage: "release",
-      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+      image: releaseImage,
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       needs: [],
@@ -3367,8 +3384,12 @@ const escapeForDotEnv = (value, options = {
     // instead of doing it part-wise, we just do it all at once
     const containsAnyBashExpression = value.parts.some(part => part instanceof BashExpression_1.BashExpression);
     if (!containsAnyBashExpression) {
+      // all parts are literal: the value never passes through bash, so it
+      // must NOT be bash-escaped — `quotes: "double"` would bake literal
+      // \" into the env value (e.g. JSON values, since the deterministic
+      // cloud run urls made such values fully literal)
       return (0, exports.escapeForDotEnv)(value.toString({
-        quotes: "double"
+        quotes: false
       }));
     } else {
       const result = escapeBashExpressionForDotEnv(new BashExpression_1.BashExpression(value.toString({
@@ -4974,6 +4995,52 @@ exports.isOfBuildType = isOfBuildType;
 
 /***/ }),
 
+/***/ 93401:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.getCatciGeneratedFiles = exports.GENERATED_CATCI_FOLDER = void 0;
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+exports.GENERATED_CATCI_FOLDER = ".catladder-generated/catci";
+/**
+ * the ncc-bundled catci (catladder's CI companion), shipped with the
+ * package. Built by the cli workspace (`scripts/bundle`); pipeline
+ * generation materializes it into `.catladder-generated/catci/` so CI
+ * jobs (e.g. the release job's security audit) can run it with plain
+ * `node` — no install step, no catladder baked into job images, and
+ * always the exact version that generated the pipeline.
+ */
+const getShippedCatciBundle = () => {
+  const candidates = [
+  // ncc bundle (what consumers run): dist/bundles/<entry> -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "catci", "index.js"),
+  // cli tsc dist (catenv-dev): dist/pipeline/src/catci -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "bundles", "catci", "index.js"),
+  // repository (pipeline/src/catci): <root>/cli/dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "cli", "dist", "bundles", "catci", "index.js")];
+  const found = candidates.find(candidate => (0, fs_1.existsSync)(candidate));
+  if (!found) {
+    throw new Error("shipped catci bundle not found — run a full catladder build (`yarn build`) first");
+  }
+  return found;
+};
+/**
+ * the catci files to materialize into the generated folder
+ */
+const getCatciGeneratedFiles = () => [{
+  path: (0, path_1.join)(exports.GENERATED_CATCI_FOLDER, "index.js"),
+  content: (0, fs_1.readFileSync)(getShippedCatciBundle(), "utf-8")
+}];
+exports.getCatciGeneratedFiles = getCatciGeneratedFiles;
+
+/***/ }),
+
 /***/ 35233:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -5145,7 +5212,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-52feb889" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-c177efda" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -6139,11 +6206,13 @@ exports.RUNNER_IMAGE_DEPENDENCIES = {
  */
 /**
  * images that cannot be built from the shipped definitions and always
- * come from the central registry: semantic-release bakes catladder's
- * own cli sources into the image (repo-root build context).
- * TODO: make the semantic-release image self-contained.
+ * come from the central registry. Empty since the semantic-release
+ * image became self-contained (the security audit runs the
+ * materialized catci bundle instead of a baked-in catladder cli) —
+ * kept as the escape hatch should an image ever need central-only
+ * treatment again.
  */
-exports.CENTRAL_ONLY_IMAGES = new Set(["semantic-release"]);
+exports.CENTRAL_ONLY_IMAGES = new Set();
 exports.RUNNER_IMAGE_BUILD_CONTEXT = {
   "jobs-default": "root",
   "jobs-meteor": "root",
@@ -9271,6 +9340,7 @@ const path_1 = __nccwpck_require__(16928);
 const backends_1 = __nccwpck_require__(93243);
 const gitlab_1 = __nccwpck_require__(8475);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
+const shippedCatci_1 = __nccwpck_require__(93401);
 /**
  * generates the pipeline files of all pipeline types enabled in the
  * config (see `pipelines`). Pass an explicit `pipelineType` to generate
@@ -9287,6 +9357,11 @@ async function generatePipelineFiles(context, pipelineType) {
       recursive: true,
       force: true
     });
+    // same for the materialized catci bundle (union across backends)
+    await (0, promises_1.rm)(shippedCatci_1.GENERATED_CATCI_FOLDER, {
+      recursive: true,
+      force: true
+    });
   }
   for (const type of pipelineTypes) {
     await generatePipelineFilesForBackend(context, (0, backends_1.getPipelineBackend)(type));

package/dist/bundles/cli/index.js

@@ -6784,6 +6784,7 @@ const ciVariables_1 = __nccwpck_require__(25474);
 const createGithubJobs_1 = __nccwpck_require__(14016);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
 const scriptFunctions_1 = __nccwpck_require__(75759);
+const shippedCatci_1 = __nccwpck_require__(93401);
 const utils_1 = __nccwpck_require__(20595);
 const githubReleaseJobs_1 = __nccwpck_require__(55611);
 const scriptFiles_1 = __nccwpck_require__(59189);
@@ -6845,7 +6846,9 @@ class GithubBackend {
       content: workflow
     })),
     // materialized job scripts and image definitions (repo mode)
-    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles()];
+    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles(),
+    // catci: the CI companion the release job's security audit runs
+    ...(0, shippedCatci_1.getCatciGeneratedFiles)()];
   }
   createImagesPlan(config) {
     return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
@@ -7550,6 +7553,7 @@ const rules_1 = __nccwpck_require__(44565);
 const config_1 = __nccwpck_require__(96925);
 const createAllJobs_1 = __nccwpck_require__(83671);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
+const shippedCatci_1 = __nccwpck_require__(93401);
 const createGitlabJobs_1 = __nccwpck_require__(80512);
 const createGitlabPipeline_1 = __nccwpck_require__(61862);
 const gitlabReleaseJobs_1 = __nccwpck_require__(35531);
@@ -7579,7 +7583,9 @@ class GitlabBackend {
     };
     return [mainFile, ...includes,
     // materialized image definitions (repo mode)
-    ...images.getGeneratedFiles()];
+    ...images.getGeneratedFiles(),
+    // catci: the CI companion the release job's security audit runs
+    ...(0, shippedCatci_1.getCatciGeneratedFiles)()];
   }
   createImagesPlan(config) {
     return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
@@ -7643,6 +7649,10 @@ class GitlabBackend {
   }
   async createPipeline(config, images) {
     const stages = (0, getPipelineStages_1.getPipelineStages)(config);
+    // release jobs first: they register their image on the plan, and the
+    // per-trigger job creation below emits the build jobs of all images
+    // registered so far
+    const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images);
     // for all triggers create jobs and add base rules
     const allJobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async trigger => await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({
       config,
@@ -7702,7 +7712,7 @@ class GitlabBackend {
       stages: [...stages, "release"],
       jobs: {
         ...allJobs,
-        ...Object.fromEntries(Object.entries((0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config)).map(([name, gitlabJob]) => [name, {
+        ...Object.fromEntries(Object.entries(releaseJobs).map(([name, gitlabJob]) => [name, {
           gitlabJob,
           context: null
         }]))
@@ -8239,15 +8249,22 @@ Object.defineProperty(exports, "__esModule", ({
 }));
 exports.getGitlabReleaseJobs = void 0;
 const rules_1 = __nccwpck_require__(44565);
-const runner_1 = __nccwpck_require__(92348);
 const EXPIRED_TOKEN_HELP = "echo '👉 If this job failed with access denied, the project access token might be invald - run `project-renew-token` in catladder CLI to fix.'";
 const baseReleaseRules = [rules_1.RULE_NEVER_ON_RELEASE_COMMIT, rules_1.RULE_NEVER_ON_AGENT_TRIGGER, rules_1.RULE_NEVER_ON_SCHEDULE];
-const getGitlabReleaseJobs = config => {
+const getGitlabReleaseJobs = (config, images) => {
   var _a;
+  // NOTE: only the resolved image url is used, not the `need`: release
+  // jobs have no `needs` on purpose — their stage ordering already
+  // guarantees the image build job (setup stage) ran, and adding a
+  // `needs` would switch gitlab to DAG mode, so the release job would no
+  // longer wait for the build/deploy stages.
+  const releaseImage = images.resolveRef({
+    catladderImage: "semantic-release"
+  }).image;
   return {
     ["create release"]: {
       stage: "release",
-      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+      image: releaseImage,
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       rules: [...baseReleaseRules, {
@@ -8260,7 +8277,7 @@ const getGitlabReleaseJobs = config => {
     },
     ["⚠️ force create release"]: {
       stage: "release",
-      image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+      image: releaseImage,
       script: ["semanticRelease"],
       after_script: [EXPIRED_TOKEN_HELP],
       needs: [],
@@ -8618,8 +8635,12 @@ const escapeForDotEnv = (value, options = {
     // instead of doing it part-wise, we just do it all at once
     const containsAnyBashExpression = value.parts.some(part => part instanceof BashExpression_1.BashExpression);
     if (!containsAnyBashExpression) {
+      // all parts are literal: the value never passes through bash, so it
+      // must NOT be bash-escaped — `quotes: "double"` would bake literal
+      // \" into the env value (e.g. JSON values, since the deterministic
+      // cloud run urls made such values fully literal)
       return (0, exports.escapeForDotEnv)(value.toString({
-        quotes: "double"
+        quotes: false
       }));
     } else {
       const result = escapeBashExpressionForDotEnv(new BashExpression_1.BashExpression(value.toString({
@@ -10225,6 +10246,52 @@ exports.isOfBuildType = isOfBuildType;
 
 /***/ }),
 
+/***/ 93401:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.getCatciGeneratedFiles = exports.GENERATED_CATCI_FOLDER = void 0;
+const fs_1 = __nccwpck_require__(79896);
+const path_1 = __nccwpck_require__(16928);
+exports.GENERATED_CATCI_FOLDER = ".catladder-generated/catci";
+/**
+ * the ncc-bundled catci (catladder's CI companion), shipped with the
+ * package. Built by the cli workspace (`scripts/bundle`); pipeline
+ * generation materializes it into `.catladder-generated/catci/` so CI
+ * jobs (e.g. the release job's security audit) can run it with plain
+ * `node` — no install step, no catladder baked into job images, and
+ * always the exact version that generated the pipeline.
+ */
+const getShippedCatciBundle = () => {
+  const candidates = [
+  // ncc bundle (what consumers run): dist/bundles/<entry> -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "catci", "index.js"),
+  // cli tsc dist (catenv-dev): dist/pipeline/src/catci -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "bundles", "catci", "index.js"),
+  // repository (pipeline/src/catci): <root>/cli/dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "cli", "dist", "bundles", "catci", "index.js")];
+  const found = candidates.find(candidate => (0, fs_1.existsSync)(candidate));
+  if (!found) {
+    throw new Error("shipped catci bundle not found — run a full catladder build (`yarn build`) first");
+  }
+  return found;
+};
+/**
+ * the catci files to materialize into the generated folder
+ */
+const getCatciGeneratedFiles = () => [{
+  path: (0, path_1.join)(exports.GENERATED_CATCI_FOLDER, "index.js"),
+  content: (0, fs_1.readFileSync)(getShippedCatciBundle(), "utf-8")
+}];
+exports.getCatciGeneratedFiles = getCatciGeneratedFiles;
+
+/***/ }),
+
 /***/ 35233:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -10396,7 +10463,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-52feb889" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-c177efda" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),
@@ -11390,11 +11457,13 @@ exports.RUNNER_IMAGE_DEPENDENCIES = {
  */
 /**
  * images that cannot be built from the shipped definitions and always
- * come from the central registry: semantic-release bakes catladder's
- * own cli sources into the image (repo-root build context).
- * TODO: make the semantic-release image self-contained.
+ * come from the central registry. Empty since the semantic-release
+ * image became self-contained (the security audit runs the
+ * materialized catci bundle instead of a baked-in catladder cli) —
+ * kept as the escape hatch should an image ever need central-only
+ * treatment again.
  */
-exports.CENTRAL_ONLY_IMAGES = new Set(["semantic-release"]);
+exports.CENTRAL_ONLY_IMAGES = new Set();
 exports.RUNNER_IMAGE_BUILD_CONTEXT = {
   "jobs-default": "root",
   "jobs-meteor": "root",
@@ -14522,6 +14591,7 @@ const path_1 = __nccwpck_require__(16928);
 const backends_1 = __nccwpck_require__(93243);
 const gitlab_1 = __nccwpck_require__(8475);
 const jobImagesPlan_1 = __nccwpck_require__(11585);
+const shippedCatci_1 = __nccwpck_require__(93401);
 /**
  * generates the pipeline files of all pipeline types enabled in the
  * config (see `pipelines`). Pass an explicit `pipelineType` to generate
@@ -14538,6 +14608,11 @@ async function generatePipelineFiles(context, pipelineType) {
       recursive: true,
       force: true
     });
+    // same for the materialized catci bundle (union across backends)
+    await (0, promises_1.rm)(shippedCatci_1.GENERATED_CATCI_FOLDER, {
+      recursive: true,
+      force: true
+    });
   }
   for (const type of pipelineTypes) {
     await generatePipelineFilesForBackend(context, (0, backends_1.getPipelineBackend)(type));

package/dist/bundles/runner-images/semantic-release/Dockerfile

@@ -1,11 +1,7 @@
-# build context is the root directory
 FROM node:lts-alpine
 
 RUN apk add --no-cache bash git git-lfs
 
-RUN mkdir /packages
-COPY ./cli /packages/cli
-
 # add semantic release
 RUN yarn global add \
     semantic-release@^19 \
@@ -14,11 +10,10 @@ RUN yarn global add \
     https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
     @semantic-release/changelog \
     @semantic-release/gitlab@9 \
-    @semantic-release/exec@6 \
-    /packages/cli
+    @semantic-release/exec@6
 
 RUN mkdir -p /scripts
-COPY ./runner-images/semantic-release/scripts/* /scripts/
+COPY ./scripts/* /scripts/
 RUN chmod +x /scripts/*
 
 ENV PATH="/scripts:${PATH}"

package/dist/bundles/runner-images/semantic-release/scripts/semanticRelease

@@ -9,7 +9,24 @@ set -e
 # better branches settings: https://github.com/semantic-release/semantic-release/issues/1581
 
 echo "doing security audit check"
-catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+CATCI=".catladder-generated/catci/index.js"
+if [ -f "$CATCI" ]; then
+  # catci is materialized by pipeline generation — always the exact
+  # catladder version that generated this pipeline
+  if [ "$GITHUB_ACTIONS" = "true" ]; then
+    # github: gate only — the MR remediation is gitlab-specific
+    node "$CATCI" security-audit check ./
+  else
+    node "$CATCI" security-audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+  fi
+elif command -v catladder > /dev/null 2>&1; then
+  # repos generated by old catladder versions (no materialized catci):
+  # the central image still bakes the cli in
+  catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+else
+  echo "neither $CATCI nor the catladder cli found — regenerate the pipeline with a current catladder version (catenv)"
+  exit 1
+fi
 
 echo "doing semantic release"
 

package/dist/bundles/runner-images/semantic-release-central.Dockerfile

@@ -0,0 +1,34 @@
+# LEGACY-COMPAT build of the semantic-release image for the CENTRAL
+# registry only (build context: repo root, see .gitlab-ci-yaml-custom.yaml).
+#
+# The shipped definition (semantic-release/Dockerfile) is self-contained:
+# repos generated by current catladder run the security audit via the
+# materialized `.catladder-generated/catci/` bundle. But the central
+# `:latest` tag is shared with repos on OLD catladder versions whose
+# generated pipelines expect `catladder` on the PATH — so the central
+# build additionally bakes the cli in, exactly as before.
+#
+# Delete together with the central registry / central mode.
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git git-lfs
+
+RUN mkdir /packages
+COPY ./cli /packages/cli
+
+# add semantic release
+RUN yarn global add \
+    semantic-release@^19 \
+    @semantic-release/commit-analyzer \
+    @semantic-release/release-notes-generator \
+    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
+    @semantic-release/changelog \
+    @semantic-release/gitlab@9 \
+    @semantic-release/exec@6 \
+    /packages/cli
+
+RUN mkdir -p /scripts
+COPY ./runner-images/semantic-release/scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"

package/dist/cli/src/catci.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/cli/src/catci.js

@@ -0,0 +1,100 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+/**
+ * catci — catladder's CI companion.
+ *
+ * A minimal, treeshaken bundle of the CLI commands that CI jobs need.
+ * It is materialized into `.catladder-generated/catci/` by pipeline
+ * generation, so jobs can run it with plain `node` — always the exact
+ * version that generated the pipeline, with no install step and no
+ * catladder baked into job images.
+ *
+ * Deliberately no CLI framework: the surface is tiny and the callers
+ * are generated scripts, not humans.
+ */
+const rest_1 = require("@gitbeaker/rest");
+const evaluateSecurityAudit_1 = require("./security/evaluateSecurityAudit");
+const createSecurityAuditMergeRequest_1 = require("./security/createSecurityAuditMergeRequest");
+const GITLAB_HOST = "https://git.panter.ch";
+const USAGE = `catci — catladder CI companion
+
+usage:
+  catci security-audit ci-job <path> <gitlab-token> <main-branch> <project-id> <user-id>
+      evaluates ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME}; creates a gitlab MR with the
+      audit template when the document is missing (and exits 1)
+
+  catci security-audit check <path>
+      evaluates ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME}; exits 1 with instructions when
+      the document is missing or unanswered (no remediation — works on
+      any CI, including github)
+`;
+const fail = message => {
+  console.error(message);
+  process.exit(1);
+};
+/**
+ * shared gate: evaluates the audit document and prints the overview.
+ * Returns null when the document could not be evaluated (missing or
+ * unparseable) so the caller can decide on remediation.
+ */
+const evaluateGate = async path => {
+  const evaluation = await (0, evaluateSecurityAudit_1.evaluateSecurityAudit)({
+    path
+  });
+  if (evaluation.isErr()) {
+    return null;
+  }
+  if (evaluation.value.score.answeredTopics === 0) {
+    fail(`audit document has no answered topics\n` + `please answer security topics in ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME} by adding responsible people and check/cross in the table`);
+  }
+  console.log((0, evaluateSecurityAudit_1.makeSecurityAuditOverview)(evaluation.value));
+  return evaluation.value;
+};
+const securityAuditCheck = async path => {
+  const evaluation = await evaluateGate(path);
+  if (!evaluation) {
+    fail(`could not evaluate ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME}\n` + `please add a ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME} security audit document to the repository ` + `(run \`catladder security audit create\` locally to generate the template)`);
+  }
+};
+const securityAuditCiJob = async (path, token, mainBranch, projectId, userId) => {
+  const evaluation = await evaluateGate(path);
+  if (evaluation) {
+    return;
+  }
+  console.log("could not evaluate security audit document");
+  console.log("creating new merge request with security audit template...");
+  const api = new rest_1.Gitlab({
+    host: GITLAB_HOST,
+    token
+  });
+  const mr = await (0, createSecurityAuditMergeRequest_1.createSecurityAuditMergeRequest)({
+    api,
+    mainBranch,
+    projectId,
+    userId: parseInt(userId)
+  });
+  if (mr.isErr()) {
+    fail(`could not create merge request with security audit template: ${mr.error}`);
+    return;
+  }
+  console.log("security audit merge request created successfully");
+  console.log(`please finish the MR by updating ${createSecurityAuditMergeRequest_1.SECURITY_AUDIT_FILE_NAME}: ${mr.value.web_url}`);
+  process.exit(1);
+};
+const main = async () => {
+  const [group, command, ...args] = process.argv.slice(2);
+  if (group === "security-audit" && command === "ci-job" && args.length === 5) {
+    const [path, token, mainBranch, projectId, userId] = args;
+    return securityAuditCiJob(path, token, mainBranch, projectId, userId);
+  }
+  if (group === "security-audit" && command === "check" && args.length === 1) {
+    return securityAuditCheck(args[0]);
+  }
+  fail(USAGE);
+};
+main().catch(error => {
+  fail(`catci failed: ${error instanceof Error ? error.message : error}`);
+});

package/dist/cli/src/catci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catci.js","sourceRoot":"","sources":["../../../src/catci.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;;GAWG;AACH,0CAAyC;AACzC,4EAG0C;AAC1C,gGAGoD;AAEpD,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,MAAM,KAAK,GAAG;;;;kBAII,0DAAwB;;;;kBAIxB,0DAAwB;;;CAGzC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;IACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;IAC1C,MAAM,UAAU,GAAG,MAAM,IAAA,6CAAqB,EAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,cAAc,KAAK,CAAC,EAAE,CAAC;QAChD,IAAI,CACF,yCAAyC;YACvC,oCAAoC,0DAAwB,4DAA4D,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAA,iDAAyB,EAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;IAChD,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CACF,sBAAsB,0DAAwB,IAAI;YAChD,gBAAgB,0DAAwB,6CAA6C;YACrF,4EAA4E,CAC/E,CAAC;IACJ,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC9B,IAAY,EACZ,KAAa,EACb,UAAkB,EAClB,SAAiB,EACjB,MAAc,EACd,EAAE;IACF,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAE1E,MAAM,GAAG,GAAG,IAAI,aAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,MAAM,IAAA,iEAA+B,EAAC;QAC/C,GAAG;QACH,UAAU;QACV,SAAS;QACT,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;KACzB,CAAC,CAAC;IAEH,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;QACf,IAAI,CACF,gEAAgE,EAAE,CAAC,KAAK,EAAE,CAC3E,CAAC;QACF,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CACT,oCAAoC,0DAAwB,KAAK,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CACpF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;IACtB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,gBAAgB,IAAI,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QAC1D,OAAO,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,KAAK,KAAK,gBAAgB,IAAI,OAAO,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,CAAC;AACd,CAAC,CAAC;AAEF,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,IAAI,CAAC,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC,CAAC,CAAC"}

package/dist/pipeline/src/backends/github/GithubBackend.js

@@ -12,6 +12,7 @@ const ciVariables_1 = require("./ciVariables");
 const createGithubJobs_1 = require("./createGithubJobs");
 const jobImagesPlan_1 = require("../../customImages/jobImagesPlan");
 const scriptFunctions_1 = require("./scriptFunctions");
+const shippedCatci_1 = require("../../catci/shippedCatci");
 const utils_1 = require("../../utils");
 const githubReleaseJobs_1 = require("./githubReleaseJobs");
 const scriptFiles_1 = require("./scriptFiles");
@@ -73,7 +74,9 @@ class GithubBackend {
       content: workflow
     })),
     // materialized job scripts and image definitions (repo mode)
-    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles()];
+    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles(),
+    // catci: the CI companion the release job's security audit runs
+    ...(0, shippedCatci_1.getCatciGeneratedFiles)()];
   }
   createImagesPlan(config) {
     return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);

package/dist/pipeline/src/backends/github/GithubBackend.js.map

@@ -1 +1 @@
-{"version":3,"file":"GithubBackend.js","sourceRoot":"","sources":["../../../../../../pipeline/src/backends/github/GithubBackend.ts"],"names":[],"mappings":";;;AAAA,0CAAkD;AAClD,+BAA4B;AAC5B,gEAA6D;AAE7D,+CAA2D;AAI3D,+CAA6D;AAC7D,yDAK4B;AAC5B,oEAG0C;AAC1C,uDAAuE;AACvE,uCAAqC;AACrC,2DAA2D;AAC3D,+CAAyE;AAEzE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,MAAM,iBAAiB,GAGnB;IACF,EAAE,EAAE;QACF,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;QACtE,WAAW,EAAE;YACX,KAAK,EAAE,6CAA6C;YACpD,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,gBAAgB;QACtB,6CAA6C;QAC7C,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;KACrC;IACD,aAAa,EAAE;QACb,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;KAC/B;CACF,CAAC;AAEF,MAAa,aAAa;IAA1B;QACW,SAAI,GAAG,QAAiB,CAAC;IA4IpC,CAAC;IA1IC,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO;aACJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,IAAA,WAAI,EAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,IAAA,aAAE,EAAC,mCAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEtE,OAAO;YACL,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1D,IAAI,EAAE,IAAA,WAAI,EAAC,gBAAgB,EAAE,QAAQ,CAAC;gBACtC,OAAO,EAAE,QAA8C;aACxD,CAAC,CAAC;YACH,6DAA6D;YAC7D,GAAG,OAAO,CAAC,iBAAiB,EAAE;YAC9B,GAAG,MAAM,CAAC,iBAAiB,EAAE;SAC9B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,OAAO,IAAI,6BAAa,CAAC,IAAA,gCAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,SAAwB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EACrD,UAA6B,IAAI,+BAAiB,EAAE;QAEpD,MAAM,SAAS,GAAmC,EAAE,CAAC;QAErD,MAAM,cAAc,GAA8B,EAAE,CAAC;QACrD,MAAM,UAAU,GAA8B,EAAE,CAAC;QAEjD,KAAK,MAAM,OAAO,IAAI,8BAAqB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAa,EAAC;gBAClC,MAAM;gBACN,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,IAAI;aACxB,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAA,uCAAoB,EAAC,OAAO,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,OAAO,CAAC,CAAC;YAChD,MAAM,IAAI,GAA8B,EAAE,CAAC;YAE3C,yDAAyD;YACzD,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CACpD,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACjC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,IAAA,gCAAa,EACnC,OAAO,EACP,GAAG,EACH,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,WAAW,CACZ,CAAC;gBACF,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClC,cAAc,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBACjC,CAAC;qBAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,UAAU,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,CACL,CAAC;YAEF,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,wCAAoB,EACtC,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,MAAM,CACP,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,SAAS,CAAC,GAAG,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG;oBAClE,GAAG,iBAAiB,CAAC,OAAO,CAAC;oBAC7B,GAAG,mBAAmB,CAAC,MAAM,CAAC;oBAC9B,GAAG,EAAE,0CAA4B;oBACjC,IAAI,EAAE,EAAE,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,GAAG,qBAAqB,iBAAiB,CAAC,GAAG;gBACrD,IAAI,EAAE,uBAAuB;gBAC7B,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC3C,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,0CAA4B;gBACjC,IAAI,EAAE,EAAE,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,SAAS,CAAC,GAAG,qBAAqB,YAAY,CAAC,GAAG;gBAChD,IAAI,EAAE,wBAAwB;gBAC9B,EAAE,EAAE;oBACF,iBAAiB,EAAE;wBACjB,MAAM,EAAE;4BACN,GAAG,EAAE;gCACH,WAAW,EAAE,iBAAiB;gCAC9B,QAAQ,EAAE,IAAI;gCACd,IAAI,EAAE,QAAQ;gCACd,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;6BACjC;yBACF;qBACF;iBACF;gBACD,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,0CAA4B;gBACjC,IAAI,EAAE;oBACJ,GAAG,yBAAyB,CAAC,MAAM,CAAC;oBACpC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;wBAC5C,EAAE;wBACF,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE;qBAChD,CAAC,CACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA7ID,sCA6IC;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAqB,EAAE,EAAE,CACpD,MAAM,CAAC,IAAI,KAAK,MAAM;IACpB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC1D,CAAC,CAAC,EAAE,CAAC;AAET;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAChC,MAAqB,EACM,EAAE,CAC7B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;IAAC,OAAA;QAClC,IAAA,oCAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;QAC3B;YACE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;gBACjD;oBACE,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,MAAM;oBACV,GAAG,EAAE;wBACH,GAAG,IAAA,oDAAkC,GAAE;wBACvC,GAAG,CAAC,MAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,MAAM,CAAC,cAAM,CAAC,mCAAI,EAAE,CAAC;qBACtC,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,MAAM;iBACd;aACF;SACkB;KACtB,CAAA;CAAA,CAAC,CACH,CAAC;AAEJ,MAAM,gBAAgB,GAAG,CAAC,OAAwB,EAAU,EAAE;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,YAAY,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,UAAU,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mBAAmB,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAiB,EAAE,EAAE;;IAC9D,OAAA,CAAA,MAAA,GAAG,CAAC,WAAW,0CAAE,MAAM,MAAK,MAAM;QAClC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC5B,OAAO,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAA;CAAA,CAAC;AAE3C;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiB,EAAE,EAAE,CAC5C,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC"}
+{"version":3,"file":"GithubBackend.js","sourceRoot":"","sources":["../../../../../../pipeline/src/backends/github/GithubBackend.ts"],"names":[],"mappings":";;;AAAA,0CAAkD;AAClD,+BAA4B;AAC5B,gEAA6D;AAE7D,+CAA2D;AAI3D,+CAA6D;AAC7D,yDAK4B;AAC5B,oEAG0C;AAC1C,uDAAuE;AACvE,2DAAkE;AAClE,uCAAqC;AACrC,2DAA2D;AAC3D,+CAAyE;AAEzE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAE7C;;;GAGG;AACH,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C,MAAM,iBAAiB,GAGnB;IACF,EAAE,EAAE;QACF,IAAI,EAAE,kBAAkB;QACxB,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,EAAE;QACtE,WAAW,EAAE;YACX,KAAK,EAAE,6CAA6C;YACpD,oBAAoB,EAAE,IAAI;SAC3B;KACF;IACD,UAAU,EAAE;QACV,IAAI,EAAE,gBAAgB;QACtB,6CAA6C;QAC7C,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE;KACrC;IACD,aAAa,EAAE;QACb,IAAI,EAAE,mBAAmB;QACzB,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE;KAC/B;CACF,CAAC;AAEF,MAAa,aAAa;IAA1B;QACW,SAAI,GAAG,QAAiB,CAAC;IA8IpC,CAAC;IA5IC,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAChE,MAAM,OAAO,CAAC,GAAG,CACf,OAAO;aACJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,iBAAM,EAAC,IAAA,WAAI,EAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,CACvD,CAAC;QACF,MAAM,IAAA,aAAE,EAAC,mCAAqB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEtE,OAAO;YACL,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1D,IAAI,EAAE,IAAA,WAAI,EAAC,gBAAgB,EAAE,QAAQ,CAAC;gBACtC,OAAO,EAAE,QAA8C;aACxD,CAAC,CAAC;YACH,6DAA6D;YAC7D,GAAG,OAAO,CAAC,iBAAiB,EAAE;YAC9B,GAAG,MAAM,CAAC,iBAAiB,EAAE;YAC7B,gEAAgE;YAChE,GAAG,IAAA,qCAAsB,GAAE;SAC5B,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,MAAc;QACrC,OAAO,IAAI,6BAAa,CAAC,IAAA,gCAAgB,EAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,SAAwB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EACrD,UAA6B,IAAI,+BAAiB,EAAE;QAEpD,MAAM,SAAS,GAAmC,EAAE,CAAC;QAErD,MAAM,cAAc,GAA8B,EAAE,CAAC;QACrD,MAAM,UAAU,GAA8B,EAAE,CAAC;QAEjD,KAAK,MAAM,OAAO,IAAI,8BAAqB,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,MAAM,IAAA,6BAAa,EAAC;gBAClC,MAAM;gBACN,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,IAAI;aACxB,CAAC,CAAC;YAEH,MAAM,iBAAiB,GAAG,IAAA,uCAAoB,EAAC,OAAO,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAA,qCAAkB,EAAC,OAAO,CAAC,CAAC;YAChD,MAAM,IAAI,GAA8B,EAAE,CAAC;YAE3C,yDAAyD;YACzD,CAAC,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,CACpD,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CACjC,WAAW,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;gBAC1B,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,IAAA,gCAAa,EACnC,OAAO,EACP,GAAG,EACH,OAAO,EACP,iBAAiB,EACjB,MAAM,EACN,OAAO,EACP,WAAW,CACZ,CAAC;gBACF,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;oBAClC,cAAc,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBACjC,CAAC;qBAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;oBAChC,UAAU,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,CACL,CAAC;YAEF,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,MAAM,WAAW,GAAG,IAAA,wCAAoB,EACtC,MAAM,EACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EACjB,MAAM,CACP,CAAC;gBACF,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtC,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjC,SAAS,CAAC,GAAG,qBAAqB,GAAG,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG;oBAClE,GAAG,iBAAiB,CAAC,OAAO,CAAC;oBAC7B,GAAG,mBAAmB,CAAC,MAAM,CAAC;oBAC9B,GAAG,EAAE,0CAA4B;oBACjC,IAAI,EAAE,EAAE,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,EAAE;iBACxD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,SAAS,CAAC,GAAG,qBAAqB,iBAAiB,CAAC,GAAG;gBACrD,IAAI,EAAE,uBAAuB;gBAC7B,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE;gBAC3C,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,0CAA4B;gBACjC,IAAI,EAAE,EAAE,GAAG,yBAAyB,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvC,SAAS,CAAC,GAAG,qBAAqB,YAAY,CAAC,GAAG;gBAChD,IAAI,EAAE,wBAAwB;gBAC9B,EAAE,EAAE;oBACF,iBAAiB,EAAE;wBACjB,MAAM,EAAE;4BACN,GAAG,EAAE;gCACH,WAAW,EAAE,iBAAiB;gCAC9B,QAAQ,EAAE,IAAI;gCACd,IAAI,EAAE,QAAQ;gCACd,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;6BACjC;yBACF;qBACF;iBACF;gBACD,GAAG,mBAAmB,CAAC,MAAM,CAAC;gBAC9B,GAAG,EAAE,0CAA4B;gBACjC,IAAI,EAAE;oBACJ,GAAG,yBAAyB,CAAC,MAAM,CAAC;oBACpC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;wBAC5C,EAAE;wBACF,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,uBAAuB,EAAE,MAAM,EAAE;qBAChD,CAAC,CACH;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA/ID,sCA+IC;AAED;;GAEG;AACH,MAAM,mBAAmB,GAAG,CAAC,MAAqB,EAAE,EAAE,CACpD,MAAM,CAAC,IAAI,KAAK,MAAM;IACpB,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC1D,CAAC,CAAC,EAAE,CAAC;AAET;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAChC,MAAqB,EACM,EAAE,CAC7B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;;IAAC,OAAA;QAClC,IAAA,oCAAiB,EAAC,GAAG,CAAC,IAAI,CAAC;QAC3B;YACE,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,SAAS,EAAE,eAAe;YAC1B,KAAK,EAAE;gBACL,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE;gBACjD;oBACE,IAAI,EAAE,GAAG,CAAC,IAAI;oBACd,EAAE,EAAE,MAAM;oBACV,GAAG,EAAE;wBACH,GAAG,IAAA,oDAAkC,GAAE;wBACvC,GAAG,CAAC,MAAA,MAAA,GAAG,CAAC,MAAM,0CAAE,MAAM,CAAC,cAAM,CAAC,mCAAI,EAAE,CAAC;qBACtC,CAAC,IAAI,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,MAAM;iBACd;aACF;SACkB;KACtB,CAAA;CAAA,CAAC,CACH,CAAC;AAEJ,MAAM,gBAAgB,GAAG,CAAC,OAAwB,EAAU,EAAE;IAC5D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,IAAI;YACP,OAAO,YAAY,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,UAAU,CAAC;QACpB,KAAK,eAAe;YAClB,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,mBAAmB,CAAC,CAAC;AACjD,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,GAAiB,EAAE,EAAE;;IAC9D,OAAA,CAAA,MAAA,GAAG,CAAC,WAAW,0CAAE,MAAM,MAAK,MAAM;QAClC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC5B,OAAO,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ,CAAA;CAAA,CAAC;AAE3C;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,GAAiB,EAAE,EAAE,CAC5C,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,KAAK,KAAK,UAAU,CAAC"}