npm - @catladder/cli - Versions diffs - 0.0.0-next-6ea918c7 → 0.0.0-next-08efdbb7 - Mend

@catladder/cli 0.0.0-next-6ea918c7 → 0.0.0-next-08efdbb7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (28) hide show

package/dist/bundles/catenv/index.js CHANGED Viewed

@@ -1897,22 +1897,29 @@ const createCacheSteps = (context, job) => {
   }
   const lowered = (_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : [];
   return (0, utils_1.ensureArray)(lowered).map(cache => {
-    var _a, _b, _c, _d, _e, _f;
+    var _a, _b, _c, _d, _e, _f, _g;
     const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
     const key = cache.key;
     const {
       cacheKey,
       restoreKeyPrefix,
       label
-    } = typeof key === "string" || key === undefined ? {
+    } = typeof key === "string" || key === undefined ? ((_b = cache.keyFiles) === null || _b === void 0 ? void 0 : _b.length) ? {
+      // content-keyed: an unchanged hash is an exact hit and the
+      // cache is never re-saved (no per-run copies, no races
+      // between parallel jobs saving the same key)
+      cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ hashFiles(${cache.keyFiles.map(f => `'${f}'`).join(", ")}) }}`,
+      restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+      label: key !== null && key !== void 0 ? key : "cache"
+    } : {
       // unique key per run so the cache is re-saved, restored via prefix
       cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ github.run_id }}`,
       restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
       label: key !== null && key !== void 0 ? key : "cache"
     } : {
-      cacheKey: `${(_b = key.prefix) !== null && _b !== void 0 ? _b : "files"}-\${{ hashFiles(${((_c = key.files) !== null && _c !== void 0 ? _c : []).map(f => `'${f}'`).join(", ")}) }}`,
-      restoreKeyPrefix: `${(_d = key.prefix) !== null && _d !== void 0 ? _d : "files"}-`,
-      label: (_e = key.prefix) !== null && _e !== void 0 ? _e : ((_f = key.files) !== null && _f !== void 0 ? _f : []).join(",")
+      cacheKey: `${(_c = key.prefix) !== null && _c !== void 0 ? _c : "files"}-\${{ hashFiles(${((_d = key.files) !== null && _d !== void 0 ? _d : []).map(f => `'${f}'`).join(", ")}) }}`,
+      restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
+      label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(",")
     };
     return {
       name: `Cache ${label}`,
@@ -2004,6 +2011,36 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
     ...getReferencedSecretsEnv(runScript, secretKinds),
     CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
   };
+  /**
+   * the github environment of the job — serving two purposes:
+   * deployment tracking on deploy jobs, and access to environment
+   * secrets (the repo-level cap of 100 secrets doesn't scale to
+   * multiple envs). Names are keyed by env NAME, never env type: an
+   * app can have several envs of the same type.
+   *
+   * - deploy jobs: `<env>-<component>` — static (unlike the former
+   *   per-PR review names), so environment secrets can attach, and
+   *   each component keeps its own deployment badge/url in the
+   *   github ui. For review, PRs share the component's environment:
+   *   a newer PR's deploy marks the previous one Inactive (the badge,
+   *   not the app) — the price of a static name.
+   * - other jobs referencing secrets join the shared `<env>`
+   *   environment — deliberately NOT the per-component one, whose
+   *   Active deploy badge their deployment records would displace.
+   *   NOTE: build-time and deploy-time vars are not differentiated
+   *   yet, so this environment holds roughly ALL of the env's
+   *   secrets (the build's dotenv references every component).
+   * - jobs without secret references get no environment
+   */
+  const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
+  const githubEnvironment = job.environment && isComponent ? {
+    name: `${context.env}-${context.name}`,
+    ...(createsJobEnv ? {
+      url: "${{ steps.main.outputs.url }}"
+    } : {})
+  } : referencesSecrets ? {
+    name: context.env
+  } : undefined;
   const githubJob = {
     name: githubJobName(context, job.name),
     "runs-on": "ubuntu-latest",
@@ -2025,13 +2062,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
     ...(Object.keys(services).length > 0 ? {
       services
     } : {}),
-    ...(job.environment && isComponent ? {
-      environment: {
-        name: context.environment.envType === "review" ? `review-pr\${{ github.event.number }}-${context.name}` : `${context.env}-${context.name}`,
-        ...(createsJobEnv ? {
-          url: "${{ steps.main.outputs.url }}"
-        } : {})
-      }
+    ...(githubEnvironment ? {
+      environment: githubEnvironment
     } : {}),
     env,
     steps: [...(skipCheckout ? [] : [{
@@ -2665,8 +2697,17 @@ const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
   const when = jobWhen !== null && jobWhen !== void 0 ? jobWhen : gate ? gate === "manual" ? "manual" : "on_success" : undefined;
   const allow_failure = jobAllowFailure !== null && jobAllowFailure !== void 0 ? jobAllowFailure : gate ? gate === "manual" : undefined;
   // the neutral `caches` declarations resolve to gitlab cache configs;
-  // an explicitly set gitlab `cache` takes precedence
-  const cache = jobCache !== null && jobCache !== void 0 ? jobCache : caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
+  // an explicitly set gitlab `cache` takes precedence. `keyFiles` is a
+  // github-only content-key hint and must not leak into the gitlab yaml
+  const stripKeyFiles = resolved => Array.isArray(resolved) ? resolved.map(({
+    keyFiles: _keyFiles,
+    ...cacheRest
+  }) => cacheRest) : (({
+    keyFiles: _keyFiles,
+    ...cacheRest
+  }) => cacheRest)(resolved);
+  const resolvedCaches = caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
+  const cache = jobCache !== null && jobCache !== void 0 ? jobCache : resolvedCaches && stripKeyFiles(resolvedCaches);
   const stage = envMode === "stagePerEnv" && context.type !== "agent" ? `${job.stage} ${context.env}` : job.stage;
   const deduplicatedGitlabNeeds = getGitlabNeeds(context, job, allJobs, imageNeeds);
   const fullJobName = getFullJobName({
@@ -3957,6 +3998,7 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
     scope,
     pathMode,
     buildDir,
+    keyFiles,
     ...rest
   }) => {
     var _a;
@@ -3970,6 +4012,9 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
       key: transformedKey,
       policy: policy !== null && policy !== void 0 ? policy : "pull-push",
       paths: pathMode === "absolute" ? paths : paths === null || paths === void 0 ? void 0 : paths.map(p => (0, path_1.join)(baseDir, p)),
+      ...((keyFiles === null || keyFiles === void 0 ? void 0 : keyFiles.length) ? {
+        keyFiles: keyFiles.map(f => pathMode === "absolute" ? f : (0, path_1.join)(baseDir, f))
+      } : {}),
       ...rest
     };
   });
@@ -4521,7 +4566,10 @@ const getYarnCache = async (context, policy = "pull-push") => {
     pathMode: componentIsInWorkspace ? "absolute" : "relative",
     key: "yarn",
     policy,
-    paths: [".yarn"]
+    paths: [".yarn"],
+    // content-key for immutable-cache backends (github); the lockfile
+    // decides whether the cached content could have changed
+    keyFiles: ["yarn.lock"]
   }];
 };
 exports.getYarnCache = getYarnCache;
@@ -4541,6 +4589,10 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
     // if component is in a shared workspace, use workspace cache. use individual cache else
     key: componentIsInWorkspace ? "node-modules-workspace" : (0, slugify_1.default)(context.build.dir) + "-node-modules",
     // we use the dirname, not the component name, because in certain cases we have two apps in the same directory and want to share the cache, e.g. when having storybook in the same package.json
+    // content-key for immutable-cache backends (github); the lockfile
+    // decides whether the cached content could have changed (absolute
+    // pathMode: resolve the standalone component's lockfile explicitly)
+    keyFiles: [componentIsInWorkspace ? "yarn.lock" : (0, path_1.join)(context.build.dir, "yarn.lock")],
     policy,
     paths: [...(componentIsInWorkspace ? (0, lodash_es_1.uniq)(["node_modules", ...((_a = workspaces.map(w => (0, path_1.join)(w.location, "node_modules"))) !== null && _a !== void 0 ? _a : []), ...(!isClassic ? [".yarn/install-state.gz", ...((_b = workspaces.map(w => (0, path_1.join)(w.location, ".yarn/install-state.gz"))) !== null && _b !== void 0 ? _b : [])] : [])]) : [(0, path_1.join)(context.build.dir, "node_modules"), ...(!isClassic ? [(0, path_1.join)(context.build.dir, ".yarn/install-state.gz")] : [])])]
   }];
@@ -5224,7 +5276,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-6ea918c7" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-08efdbb7" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 /***/ }),

package/dist/bundles/cli/index.js CHANGED Viewed

@@ -560,7 +560,7 @@ const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, val
     return;
   }
   instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
+  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
 };
 const projectConfigSecrets = async (io, envComponent) => {
   if (!envComponent) {
@@ -3392,7 +3392,7 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretsFromVault = void 0;
+exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const getProjectConfig_1 = __nccwpck_require__(50001);
 const defineCommand_1 = __nccwpck_require__(39489);
@@ -3437,22 +3437,71 @@ const collectSecretsFromVault = async (io, envFilter) => {
   };
 };
 exports.collectSecretsFromVault = collectSecretsFromVault;
+/** marker for repo-level (environment-less) targets */
+const REPO_LEVEL = "";
 /**
- * pushes vault values to github via the gh cli: sensitive ones as repo
- * secrets (masked), "variable"-kind ones as repo variables (plain)
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+const collectSecretTargets = async config => {
+  var _a;
+  const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
+  const targets = new Map();
+  for (const workflow of Object.values(workflows)) {
+    for (const job of Object.values(workflow.jobs)) {
+      const environment = typeof job.environment === "object" ? job.environment.name : job.environment;
+      for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
+        if (typeof value !== "string") continue;
+        for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
+          const name = match[1];
+          if (!targets.has(name)) {
+            targets.set(name, new Set());
+          }
+          targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
+        }
+      }
+    }
+  }
+  return targets;
+};
+exports.collectSecretTargets = collectSecretTargets;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
  */
-const pushSecretsToGithub = async (io, repo, secrets) => {
+const pushSecretsToGithub = async (io, repo, secrets, targets) => {
+  const environments = [...new Set([...targets.values()].flatMap(envs => [...envs].filter(env => env !== REPO_LEVEL)))];
+  for (const environment of environments) {
+    await (0, github_1.ensureGithubEnvironment)(repo, environment);
+    io.log(`🌍 environment ${environment}`);
+  }
   for (const {
     name,
     value,
     kind
   } of secrets) {
-    if (kind === "variable") {
-      await (0, github_1.setGithubVariable)(repo, name, value);
-      io.log(`📖 ${name} (variable)`);
-    } else {
-      await (0, github_1.setGithubSecret)(repo, name, value);
-      io.log(`✅ ${name}`);
+    const envs = targets.get(name);
+    if (!envs) {
+      io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
+      continue;
+    }
+    for (const environment of envs) {
+      const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
+      if (kind === "variable") {
+        await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
+        io.log(`📖 ${name} (variable)${suffix}`);
+      } else {
+        await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
+        io.log(`✅ ${name}${suffix}`);
+      }
     }
   }
 };
@@ -3532,7 +3581,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
     if (!confirmed) {
       throw new Error("abort");
     }
-    await (0, exports.pushSecretsToGithub)(ctx, repo, secrets);
+    await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
     ctx.log("");
     ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
   }
@@ -5729,7 +5778,7 @@ exports["default"] = async () => {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = __nccwpck_require__(35317);
 const util_1 = __nccwpck_require__(39023);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -5762,9 +5811,9 @@ const getGithubRepoFromRemote = async remoteName => {
   }
 };
 exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
-const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject) => {
+const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
   var _a, _b;
-  const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo], {
+  const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {
     stdio: ["pipe", "ignore", "pipe"]
   });
   let stderr = "";
@@ -5777,14 +5826,29 @@ const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject)
  * sets a github actions repository secret via the gh cli.
  * The value is passed via stdin so it never shows up in a process list.
  */
-const setGithubSecret = async (repo, name, value) => ghSetViaStdin("secret", repo, name, value);
+const setGithubSecret = async (repo, name, value, environment) => ghSetViaStdin("secret", repo, name, value, environment);
 exports.setGithubSecret = setGithubSecret;
 /**
  * sets a github actions repository variable (plain, unmasked) via the
  * gh cli — for vault values classified as not sensitive
  */
-const setGithubVariable = async (repo, name, value) => ghSetViaStdin("variable", repo, name, value);
+const setGithubVariable = async (repo, name, value, environment) => ghSetViaStdin("variable", repo, name, value, environment);
 exports.setGithubVariable = setGithubVariable;
+/**
+ * creates the github environment when it does not exist (idempotent —
+ * PUT with an empty body leaves existing settings untouched)
+ */
+const ensureGithubEnvironment = async (repo, environment) => new Promise((resolve, reject) => {
+  var _a;
+  const child = (0, child_process_1.spawn)("gh", ["api", "-X", "PUT", `repos/${repo}/environments/${encodeURIComponent(environment)}`], {
+    stdio: ["ignore", "ignore", "pipe"]
+  });
+  let stderr = "";
+  (_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
+  child.on("error", reject);
+  child.on("close", code => code === 0 ? resolve() : reject(new Error(`creating github environment ${environment} failed: ${stderr.trim()}`)));
+});
+exports.ensureGithubEnvironment = ensureGithubEnvironment;
 /***/ }),
@@ -7148,22 +7212,29 @@ const createCacheSteps = (context, job) => {
   }
   const lowered = (_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : [];
   return (0, utils_1.ensureArray)(lowered).map(cache => {
-    var _a, _b, _c, _d, _e, _f;
+    var _a, _b, _c, _d, _e, _f, _g;
     const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
     const key = cache.key;
     const {
       cacheKey,
       restoreKeyPrefix,
       label
-    } = typeof key === "string" || key === undefined ? {
+    } = typeof key === "string" || key === undefined ? ((_b = cache.keyFiles) === null || _b === void 0 ? void 0 : _b.length) ? {
+      // content-keyed: an unchanged hash is an exact hit and the
+      // cache is never re-saved (no per-run copies, no races
+      // between parallel jobs saving the same key)
+      cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ hashFiles(${cache.keyFiles.map(f => `'${f}'`).join(", ")}) }}`,
+      restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+      label: key !== null && key !== void 0 ? key : "cache"
+    } : {
       // unique key per run so the cache is re-saved, restored via prefix
       cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ github.run_id }}`,
       restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
       label: key !== null && key !== void 0 ? key : "cache"
     } : {
-      cacheKey: `${(_b = key.prefix) !== null && _b !== void 0 ? _b : "files"}-\${{ hashFiles(${((_c = key.files) !== null && _c !== void 0 ? _c : []).map(f => `'${f}'`).join(", ")}) }}`,
-      restoreKeyPrefix: `${(_d = key.prefix) !== null && _d !== void 0 ? _d : "files"}-`,
-      label: (_e = key.prefix) !== null && _e !== void 0 ? _e : ((_f = key.files) !== null && _f !== void 0 ? _f : []).join(",")
+      cacheKey: `${(_c = key.prefix) !== null && _c !== void 0 ? _c : "files"}-\${{ hashFiles(${((_d = key.files) !== null && _d !== void 0 ? _d : []).map(f => `'${f}'`).join(", ")}) }}`,
+      restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
+      label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(",")
     };
     return {
       name: `Cache ${label}`,
@@ -7255,6 +7326,36 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
     ...getReferencedSecretsEnv(runScript, secretKinds),
     CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
   };
+  /**
+   * the github environment of the job — serving two purposes:
+   * deployment tracking on deploy jobs, and access to environment
+   * secrets (the repo-level cap of 100 secrets doesn't scale to
+   * multiple envs). Names are keyed by env NAME, never env type: an
+   * app can have several envs of the same type.
+   *
+   * - deploy jobs: `<env>-<component>` — static (unlike the former
+   *   per-PR review names), so environment secrets can attach, and
+   *   each component keeps its own deployment badge/url in the
+   *   github ui. For review, PRs share the component's environment:
+   *   a newer PR's deploy marks the previous one Inactive (the badge,
+   *   not the app) — the price of a static name.
+   * - other jobs referencing secrets join the shared `<env>`
+   *   environment — deliberately NOT the per-component one, whose
+   *   Active deploy badge their deployment records would displace.
+   *   NOTE: build-time and deploy-time vars are not differentiated
+   *   yet, so this environment holds roughly ALL of the env's
+   *   secrets (the build's dotenv references every component).
+   * - jobs without secret references get no environment
+   */
+  const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
+  const githubEnvironment = job.environment && isComponent ? {
+    name: `${context.env}-${context.name}`,
+    ...(createsJobEnv ? {
+      url: "${{ steps.main.outputs.url }}"
+    } : {})
+  } : referencesSecrets ? {
+    name: context.env
+  } : undefined;
   const githubJob = {
     name: githubJobName(context, job.name),
     "runs-on": "ubuntu-latest",
@@ -7276,13 +7377,8 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
     ...(Object.keys(services).length > 0 ? {
       services
     } : {}),
-    ...(job.environment && isComponent ? {
-      environment: {
-        name: context.environment.envType === "review" ? `review-pr\${{ github.event.number }}-${context.name}` : `${context.env}-${context.name}`,
-        ...(createsJobEnv ? {
-          url: "${{ steps.main.outputs.url }}"
-        } : {})
-      }
+    ...(githubEnvironment ? {
+      environment: githubEnvironment
     } : {}),
     env,
     steps: [...(skipCheckout ? [] : [{
@@ -7916,8 +8012,17 @@ const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
   const when = jobWhen !== null && jobWhen !== void 0 ? jobWhen : gate ? gate === "manual" ? "manual" : "on_success" : undefined;
   const allow_failure = jobAllowFailure !== null && jobAllowFailure !== void 0 ? jobAllowFailure : gate ? gate === "manual" : undefined;
   // the neutral `caches` declarations resolve to gitlab cache configs;
-  // an explicitly set gitlab `cache` takes precedence
-  const cache = jobCache !== null && jobCache !== void 0 ? jobCache : caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
+  // an explicitly set gitlab `cache` takes precedence. `keyFiles` is a
+  // github-only content-key hint and must not leak into the gitlab yaml
+  const stripKeyFiles = resolved => Array.isArray(resolved) ? resolved.map(({
+    keyFiles: _keyFiles,
+    ...cacheRest
+  }) => cacheRest) : (({
+    keyFiles: _keyFiles,
+    ...cacheRest
+  }) => cacheRest)(resolved);
+  const resolvedCaches = caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
+  const cache = jobCache !== null && jobCache !== void 0 ? jobCache : resolvedCaches && stripKeyFiles(resolvedCaches);
   const stage = envMode === "stagePerEnv" && context.type !== "agent" ? `${job.stage} ${context.env}` : job.stage;
   const deduplicatedGitlabNeeds = getGitlabNeeds(context, job, allJobs, imageNeeds);
   const fullJobName = getFullJobName({
@@ -9208,6 +9313,7 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
     scope,
     pathMode,
     buildDir,
+    keyFiles,
     ...rest
   }) => {
     var _a;
@@ -9221,6 +9327,9 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
       key: transformedKey,
       policy: policy !== null && policy !== void 0 ? policy : "pull-push",
       paths: pathMode === "absolute" ? paths : paths === null || paths === void 0 ? void 0 : paths.map(p => (0, path_1.join)(baseDir, p)),
+      ...((keyFiles === null || keyFiles === void 0 ? void 0 : keyFiles.length) ? {
+        keyFiles: keyFiles.map(f => pathMode === "absolute" ? f : (0, path_1.join)(baseDir, f))
+      } : {}),
       ...rest
     };
   });
@@ -9772,7 +9881,10 @@ const getYarnCache = async (context, policy = "pull-push") => {
     pathMode: componentIsInWorkspace ? "absolute" : "relative",
     key: "yarn",
     policy,
-    paths: [".yarn"]
+    paths: [".yarn"],
+    // content-key for immutable-cache backends (github); the lockfile
+    // decides whether the cached content could have changed
+    keyFiles: ["yarn.lock"]
   }];
 };
 exports.getYarnCache = getYarnCache;
@@ -9792,6 +9904,10 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
     // if component is in a shared workspace, use workspace cache. use individual cache else
     key: componentIsInWorkspace ? "node-modules-workspace" : (0, slugify_1.default)(context.build.dir) + "-node-modules",
     // we use the dirname, not the component name, because in certain cases we have two apps in the same directory and want to share the cache, e.g. when having storybook in the same package.json
+    // content-key for immutable-cache backends (github); the lockfile
+    // decides whether the cached content could have changed (absolute
+    // pathMode: resolve the standalone component's lockfile explicitly)
+    keyFiles: [componentIsInWorkspace ? "yarn.lock" : (0, path_1.join)(context.build.dir, "yarn.lock")],
     policy,
     paths: [...(componentIsInWorkspace ? (0, lodash_es_1.uniq)(["node_modules", ...((_a = workspaces.map(w => (0, path_1.join)(w.location, "node_modules"))) !== null && _a !== void 0 ? _a : []), ...(!isClassic ? [".yarn/install-state.gz", ...((_b = workspaces.map(w => (0, path_1.join)(w.location, ".yarn/install-state.gz"))) !== null && _b !== void 0 ? _b : [])] : [])]) : [(0, path_1.join)(context.build.dir, "node_modules"), ...(!isClassic ? [(0, path_1.join)(context.build.dir, ".yarn/install-state.gz")] : [])])]
   }];
@@ -10475,7 +10591,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-6ea918c7" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-08efdbb7" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 /***/ }),

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js CHANGED Viewed

@@ -166,7 +166,7 @@ const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, val
     return;
   }
   instance.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets);
+  await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(instance, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
 };
 const projectConfigSecrets = async (io, envComponent) => {
   if (!envComponent) {

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,~~oGAG~~+D;AAC/D,6DAA0D;AAC1D,qDAA6D;AAC7D,qDAA8D;AAC9D,uDAAkD;AAOlD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;IAC9C,OAAO;QACL,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,8BAA8B,GAAG,KAAK,EAC1C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAAY,EACZ,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,IAAA,qCAAkB,EAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,MAAM,IAAA,4CAAyB,EACpD,QAAQ,EACR,GAAG,EACH,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,aAAa;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,oHAAoH;QACpH,MAAM,gBAAgB,GACpB,KAAK,KAAK,GAAG,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,KAAK,EACnB,QAAY,EACZ,gBAEC,EACD,EAAE;IACF,IAAI,YAAY,GAAS,MAAM,CAAC,WAAW,CACzC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACtB,GAAG;YACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACrD,CAAC,CACH,CACF;KACF,CAAC,CACH,CACF,CAAC;IACF,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,EAAE,CAAC;QACjB,YAAY,GAAG,MAAM,IAAA,uBAAU,EAC7B,WAAW,CAAC,YAAY,CAAC,EACzB,IAAA,0BAAY,EAAA;;;UAGR,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/B,GAAG,CACF,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,IAAI,CAAC;;SAEZ,CACJ,CAAC;QACF,mBAAmB;QACnB,SAAS,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,wDAAwD;gBACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;gBAEF,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAA,sBAAU,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;gBAEvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,QAAQ,CAAC,GAAG,CACV,4CAA4C,aAAa,GAAG,CAC7D,CAAC;oBACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;wBAC7D,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;wBACtD,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAED,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAE/D,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;YAC/D,MAAM,CACJ,MAAM,QAAQ,CAAC,eAAe,EAAE,CACjC,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,CAC7B,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,QAAY,EACZ,MAAc,EACd,gBAAuD,EACvD,YAAkB,EAClB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAChC,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF;gBACE,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CACtD,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QACnB,OAAA,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;YACf,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;gBACjE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;aAC7C,CAAC;QACJ,CAAC,CACF,CAAA;KAAA,CACF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IAC7E,MAAM,IAAA,8CAAmB,~~EAAC~~,QAAQ,~~EAAE~~,IAAI,~~EAAE~~,OAAO,CAAC,CAAC;~~AACrD~~,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAM,EAAE,YAAqB,EAAE,EAAE;IAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,mBAAmB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAA,8BAAW,EAAC,YAAY,CAAC,CAAC;QAEzD,wEAAwE;QACxE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAC;YAChD,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,EAAE,EAAE;gBAChB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAlBW,QAAA,oBAAoB,wBAkB/B"}
1	+ {"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,oGAI+D;AAC/D,6DAA0D;AAC1D,qDAA6D;AAC7D,qDAA8D;AAC9D,uDAAkD;AAOlD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;IAC9C,OAAO;QACL,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,8BAA8B,GAAG,KAAK,EAC1C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAAY,EACZ,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,IAAA,qCAAkB,EAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,MAAM,IAAA,4CAAyB,EACpD,QAAQ,EACR,GAAG,EACH,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,aAAa;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,oHAAoH;QACpH,MAAM,gBAAgB,GACpB,KAAK,KAAK,GAAG,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,KAAK,EACnB,QAAY,EACZ,gBAEC,EACD,EAAE;IACF,IAAI,YAAY,GAAS,MAAM,CAAC,WAAW,CACzC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACtB,GAAG;YACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACrD,CAAC,CACH,CACF;KACF,CAAC,CACH,CACF,CAAC;IACF,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,EAAE,CAAC;QACjB,YAAY,GAAG,MAAM,IAAA,uBAAU,EAC7B,WAAW,CAAC,YAAY,CAAC,EACzB,IAAA,0BAAY,EAAA;;;UAGR,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/B,GAAG,CACF,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,IAAI,CAAC;;SAEZ,CACJ,CAAC;QACF,mBAAmB;QACnB,SAAS,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,wDAAwD;gBACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;gBAEF,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAA,sBAAU,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;gBAEvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,QAAQ,CAAC,GAAG,CACV,4CAA4C,aAAa,GAAG,CAC7D,CAAC;oBACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;wBAC7D,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;wBACtD,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAED,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAE/D,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;YAC/D,MAAM,CACJ,MAAM,QAAQ,CAAC,eAAe,EAAE,CACjC,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,CAC7B,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,QAAY,EACZ,MAAc,EACd,gBAAuD,EACvD,YAAkB,EAClB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAChC,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF;gBACE,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CACtD,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QACnB,OAAA,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;YACf,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;gBACjE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;aAC7C,CAAC;QACJ,CAAC,CACF,CAAA;KAAA,CACF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IAC7E,MAAM,IAAA,8CAAmB,EACvB,QAAQ,EACR,IAAI,EACJ,OAAO,EACP,MAAM,IAAA,+CAAoB,EAAC,MAAM,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAM,EAAE,YAAqB,EAAE,EAAE;IAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,mBAAmB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAA,8BAAW,EAAC,YAAY,CAAC,CAAC;QAEzD,wEAAwE;QACxE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAC;YAChD,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,EAAE,EAAE;gBAChB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAlBW,QAAA,oBAAoB,wBAkB/B"}

package/dist/cli/src/commands/project/commandSecretsSyncGithub.d.ts CHANGED Viewed

@@ -1,3 +1,4 @@
+import type { Config } from "../../../../pipeline/src/index.js";
 import type { IO } from "../../core/types";
 /**
  * all secrets declared in the config, with their values read from the
@@ -12,14 +13,27 @@ export declare const collectSecretsFromVault: (io: IO, envFilter?: string[]) =>
   missing: string[];
 }>;
 /**
- * pushes vault values to github via the gh cli: sensitive ones as repo
- * secrets (masked), "variable"-kind ones as repo variables (plain)
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+export declare const collectSecretTargets: (config: Config) => Promise<Map<string, Set<string>>>;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
  */
 export declare const pushSecretsToGithub: (io: IO, repo: string, secrets: {
   name: string;
   value: string;
   kind: "secret" | "variable";
-}[]) => Promise<void>;
+}[], targets: Map<string, Set<string>>) => Promise<void>;
 /**
  * resolves the github repository from the configured git remote
  * (`pipelines.github.gitRemote`, defaults to origin)