@catladder/cli 0.0.0-next-71c49b28 → 0.0.0-next-5dc1f907

package/dist/bundles/cli/index.js

@@ -587,6 +587,580 @@ exports.projectConfigSecrets = projectConfigSecrets;
 
 /***/ }),
 
+/***/ 88089:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.DoctorReport = void 0;
+/**
+ * collects the results of all doctor checks: each check logs
+ * immediately (progressive output like `project setup`) and problems
+ * are repeated in the final summary together with the command that
+ * heals them. The report itself never mutates anything — doctor
+ * diagnoses, setup heals.
+ */
+class DoctorReport {
+  constructor(io) {
+    this.io = io;
+    this.passed = 0;
+    this.warnings = [];
+    this.problems = [];
+    this.currentSection = "";
+  }
+  section(title) {
+    this.currentSection = title;
+    this.io.log("");
+    this.io.log("🩺 " + title);
+  }
+  ok(message) {
+    this.passed++;
+    this.io.log("  ✅ " + message);
+  }
+  warn(message, remediation) {
+    this.warnings.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ⚠️ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  fail(message, remediation) {
+    this.problems.push({
+      section: this.currentSection,
+      message,
+      remediation
+    });
+    this.io.log("  ❌ " + message);
+    if (remediation) this.io.log("     ↳ " + remediation);
+  }
+  get hasProblems() {
+    return this.problems.length > 0;
+  }
+  summarize() {
+    const {
+      io
+    } = this;
+    io.log("");
+    io.log("==================================================================================");
+    io.log(`🩺 doctor summary: ${this.passed} checks passed, ` + `${this.warnings.length} warnings, ${this.problems.length} problems`);
+    if (!this.hasProblems) {
+      io.log("");
+      io.log("everything looks healthy 😻");
+      return;
+    }
+    io.log("");
+    for (const {
+      section,
+      message,
+      remediation
+    } of this.problems) {
+      io.log(`❌ [${section}] ${message}`);
+      if (remediation) io.log(`   ↳ ${remediation}`);
+    }
+  }
+}
+exports.DoctorReport = DoctorReport;
+
+/***/ }),
+
+/***/ 44952:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.GcloudProjectInspector = void 0;
+const child_process_promise_1 = __nccwpck_require__(51748);
+const artifactsRegistry_1 = __nccwpck_require__(41624);
+/**
+ * read-only gcloud queries for the doctor, cached per project: checking
+ * many component/env contexts of the same gcloud project costs one
+ * `get-iam-policy` / `services list` call, not one per context
+ */
+class GcloudProjectInspector {
+  constructor() {
+    this.iamBindings = new Map();
+    this.enabledServices = new Map();
+  }
+  async isAuthenticated() {
+    try {
+      await (0, child_process_promise_1.exec)("gcloud auth print-access-token");
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+  getIamBindings(projectId) {
+    if (!this.iamBindings.has(projectId)) {
+      this.iamBindings.set(projectId, (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`).then(result => {
+        var _a;
+        return (_a = JSON.parse(result.stdout).bindings) !== null && _a !== void 0 ? _a : [];
+      }));
+    }
+    return this.iamBindings.get(projectId);
+  }
+  /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
+  async getRolesOfMember(projectId, member) {
+    const bindings = await this.getIamBindings(projectId);
+    return bindings.filter(binding => {
+      var _a;
+      return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member);
+    }).map(binding => binding.role);
+  }
+  getEnabledServices(projectId) {
+    if (!this.enabledServices.has(projectId)) {
+      this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then(result => new Set(result.stdout.split("\n").map(line => line.trim()).filter(Boolean))));
+    }
+    return this.enabledServices.get(projectId);
+  }
+  async hasArtifactsRegistry(projectId, region) {
+    try {
+      await (0, child_process_promise_1.exec)(`gcloud artifacts repositories describe ${artifactsRegistry_1.CATLADDER_REGISTRY_NAME} --project="${projectId}" --location=${region}`);
+      return true;
+    } catch (_a) {
+      return false;
+    }
+  }
+}
+exports.GcloudProjectInspector = GcloudProjectInspector;
+
+/***/ }),
+
+/***/ 65424:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkCloudRun = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const artifactsRegistry_1 = __nccwpck_require__(41624);
+const serviceAccountNames_1 = __nccwpck_require__(83798);
+const serviceAccounts_1 = __nccwpck_require__(35611);
+const concurrency_1 = __nccwpck_require__(5092);
+const setupCloudRun_1 = __nccwpck_require__(51629);
+const GcloudProjectInspector_1 = __nccwpck_require__(44952);
+const getCloudRunConfig = context => {
+  var _a;
+  const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+  if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
+    throw new Error("not a cloud run context");
+  }
+  return config;
+};
+/**
+ * compares the gcloud state `setupCloudRun` would provision for the
+ * CURRENT config against what is actually there: enabled services and
+ * artifacts registry per project, deploy service account existence and
+ * IAM roles per component/env.
+ *
+ * The motivating case (#70): a component gets `cloudSql` after its
+ * setup ran — deploys keep working and only the review teardown hits
+ * the missing `roles/cloudsql.admin` as a 403 in ci.
+ */
+const checkCloudRun = async (report, contexts) => {
+  var _a;
+  const cloudRunContexts = contexts.filter(context => {
+    var _a;
+    return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun");
+  });
+  if (cloudRunContexts.length === 0) return;
+  report.section("google cloud run infrastructure");
+  const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
+  if (!(await inspector.isAuthenticated())) {
+    report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
+    return;
+  }
+  // project-level: enabled services + artifacts registry. The required
+  // services are the union over all components deploying to the project
+  // (cloudSql on any of them requires the sql services).
+  const byProject = new Map();
+  for (const context of cloudRunContexts) {
+    const {
+      projectId
+    } = getCloudRunConfig(context);
+    byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
+  }
+  for (const [projectId, projectContexts] of byProject) {
+    const requiredServices = new Set(projectContexts.flatMap(context => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
+    try {
+      const enabled = await inspector.getEnabledServices(projectId);
+      const missing = [...requiredServices].filter(service => !enabled.has(service));
+      if (missing.length === 0) {
+        report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
+      } else {
+        report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
+      }
+    } catch (e) {
+      report.warn(`${projectId}: could not list enabled services (${e.message})`);
+    }
+    const regions = new Set(projectContexts.map(context => getCloudRunConfig(context).region));
+    for (const region of regions) {
+      if (await inspector.hasArtifactsRegistry(projectId, region)) {
+        report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
+      } else {
+        report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
+      }
+    }
+  }
+  // per component/env: deploy service account exists and carries every
+  // role the current config implies
+  const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async context => {
+    const config = getCloudRunConfig(context);
+    const {
+      fullIdentifier
+    } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+      name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
+      projectId: config.projectId
+    });
+    if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
+      return {
+        context,
+        fullIdentifier,
+        exists: false,
+        missingRoles: []
+      };
+    }
+    const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
+    const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter(role => !boundRoles.includes(role));
+    return {
+      context,
+      fullIdentifier,
+      exists: true,
+      missingRoles
+    };
+  });
+  for (const {
+    context,
+    fullIdentifier,
+    exists,
+    missingRoles
+  } of results) {
+    const label = `${context.env}:${context.name}`;
+    if (!exists) {
+      report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
+    } else if (missingRoles.length > 0) {
+      report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
+    } else {
+      report.ok(`${label}: service account exists with all config-implied roles`);
+    }
+  }
+};
+exports.checkCloudRun = checkCloudRun;
+
+/***/ }),
+
+/***/ 93265:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkGithub = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const commandSecretsSyncGithub_1 = __nccwpck_require__(50962);
+const concurrency_1 = __nccwpck_require__(5092);
+const github_1 = __nccwpck_require__(18036);
+/** marker for repo-level (environment-less) targets, see collectSecretTargets */
+const REPO_LEVEL = "";
+/**
+ * compares the secret/variable NAMES the generated github workflows
+ * reference against what is actually set — per github environment, the
+ * same mapping `project secrets-sync-github` writes. Values cannot be
+ * compared: github secrets are write-only by design (the vault stays
+ * the source of truth).
+ */
+const checkGithub = async (report, config) => {
+  if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) return;
+  report.section("github environments & secrets");
+  if (!(await (0, github_1.isGhAuthenticated)())) {
+    report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
+    return;
+  }
+  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+  if (!repo) {
+    report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
+    return;
+  }
+  let targets;
+  try {
+    targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+  } catch (e) {
+    report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
+    return;
+  }
+  const referencedNamesOf = environment => [...targets.entries()].filter(([, envs]) => envs.has(environment)).map(([name]) => name);
+  const environmentsNeeded = [...new Set([...targets.values()].flatMap(envs => [...envs]))].filter(environment => environment !== REPO_LEVEL).sort();
+  let existingEnvironments;
+  try {
+    existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
+  } catch (e) {
+    report.warn(`could not list environments of ${repo} (${e.message})`);
+    return;
+  }
+  const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async environment => {
+    const referenced = referencedNamesOf(environment);
+    if (!existingEnvironments.has(environment)) {
+      return {
+        environment,
+        referenced,
+        exists: false
+      };
+    }
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo, environment), (0, github_1.listGithubVariableNames)(repo, environment)]);
+    // github secret names are case-insensitive and the api returns
+    // them uppercased — compare accordingly
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const referencedUpper = new Set(referenced.map(name => name.toUpperCase()));
+    return {
+      environment,
+      referenced,
+      exists: true,
+      missing: referenced.filter(name => !present.has(name.toUpperCase())),
+      stale: [...present].filter(name => !referencedUpper.has(name))
+    };
+  });
+  for (const result of perEnvironment) {
+    const {
+      environment,
+      referenced
+    } = result;
+    if (!result.exists) {
+      report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
+      continue;
+    }
+    if (result.missing.length > 0) {
+      report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+    }
+    if (result.stale.length > 0) {
+      report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+    }
+  }
+  const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
+  if (repoLevelReferenced.length > 0) {
+    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo), (0, github_1.listGithubVariableNames)(repo)]);
+    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
+    const missing = repoLevelReferenced.filter(name => !present.has(name.toUpperCase()));
+    if (missing.length > 0) {
+      report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
+    } else {
+      report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+    }
+  }
+};
+exports.checkGithub = checkGithub;
+
+/***/ }),
+
+/***/ 47273:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkGitlab = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const date_fns_1 = __nccwpck_require__(84022);
+const gitlab_1 = __nccwpck_require__(4508);
+const EXPIRY_WARNING_DAYS = 30;
+/**
+ * the gitlab-side outputs of `project setup`: the semantic-release
+ * access token (+ its GL_TOKEN ci variable), the catladder topic and —
+ * for kubernetes deploys — the registry deploy token.
+ *
+ * Kubernetes namespace/rbac checks are deliberately skipped: they would
+ * require connecting kubectl to every cluster, which switches the local
+ * kubeconfig context — doctor must not change anything.
+ */
+const checkGitlab = async (instance, report, contexts) => {
+  report.section("gitlab project setup");
+  let projectId;
+  try {
+    projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
+  } catch (e) {
+    report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
+    return;
+  }
+  try {
+    const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+    const activeTokens = tokens.filter(t => t.name === "semantic-release" && t.active === true);
+    // the GL_TOKEN ci variable holds exactly one of them — judge by the
+    // one that lives longest
+    const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
+    if (activeTokens.length > 1) {
+      report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+    }
+    if (!token) {
+      report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
+    } else {
+      const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
+      if (daysLeft < 0) {
+        report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
+      } else if (daysLeft <= EXPIRY_WARNING_DAYS) {
+        report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
+      } else {
+        report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
+      }
+    }
+    try {
+      await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+      report.ok("GL_TOKEN ci variable present");
+    } catch (_a) {
+      report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
+    }
+    const {
+      topics
+    } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
+    if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
+      report.ok("'catladder' project topic set");
+    } else {
+      report.fail("'catladder' project topic missing", "run: catladder project setup");
+    }
+    if (contexts.some(context => {
+      var _a;
+      return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes");
+    })) {
+      const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
+      if (deployTokens.find(t => t.name === "gitlab-deploy-token")) {
+        report.ok("'gitlab-deploy-token' registry deploy token present");
+      } else {
+        report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
+      }
+    }
+  } catch (e) {
+    report.warn(`gitlab checks aborted (${e.message})`);
+  }
+};
+exports.checkGitlab = checkGitlab;
+
+/***/ }),
+
+/***/ 21141:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.checkStore = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const projects_1 = __nccwpck_require__(57414);
+/**
+ * every google-cloudrun project in the config needs its project number
+ * in the committed store — the deterministic cloud run urls
+ * (<service>-<projectNumber>.<region>.run.app) are computed from it at
+ * generation time. This check is fully offline.
+ */
+const checkStore = async report => {
+  var _a, _b, _c;
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  const projectIds = new Set();
+  for (const {
+    componentName,
+    env
+  } of await (0, getProjectConfig_1.getAllComponentsWithAllEnvsFlat)()) {
+    const {
+      deploy
+    } = (0, pipeline_1.getEnvConfig)(config, componentName, env);
+    if (deploy && deploy.type === "google-cloudrun") {
+      projectIds.add(deploy.projectId);
+    }
+  }
+  if (projectIds.size === 0) return;
+  report.section("catladder store (.catladder-store/store.yml)");
+  const root = (_a = await (0, projects_1.getGitRoot)()) !== null && _a !== void 0 ? _a : process.cwd();
+  const store = (0, pipeline_1.readCatladderStore)(root);
+  for (const projectId of projectIds) {
+    const projectNumber = (_c = (_b = store.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+    if (projectNumber) {
+      report.ok(`project number for ${projectId}: ${projectNumber}`);
+    } else {
+      report.fail(`missing project number for ${projectId}`, "run: catladder project setup");
+    }
+  }
+};
+exports.checkStore = checkStore;
+
+/***/ }),
+
+/***/ 96270:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.doctorProject = void 0;
+const pipeline_1 = __nccwpck_require__(60241);
+const getProjectConfig_1 = __nccwpck_require__(50001);
+const checkCloudRun_1 = __nccwpck_require__(65424);
+const checkGithub_1 = __nccwpck_require__(93265);
+const checkGitlab_1 = __nccwpck_require__(47273);
+const checkStore_1 = __nccwpck_require__(21141);
+const DoctorReport_1 = __nccwpck_require__(88089);
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+const doctorProject = async (instance, onlyComponents) => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
+  instance.log("🐱 🩺 checking project health — read-only, nothing will be changed");
+  const report = new DoctorReport_1.DoctorReport(instance);
+  await (0, checkStore_1.checkStore)(report);
+  let contexts = [];
+  try {
+    contexts = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
+  } catch (e) {
+    report.section("pipeline contexts");
+    report.fail(`could not create pipeline contexts: ${e.message}`, "run: catladder project setup");
+  }
+  if ((0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+    await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
+  }
+  await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+  await (0, checkGithub_1.checkGithub)(report, config);
+  report.summarize();
+};
+exports.doctorProject = doctorProject;
+
+/***/ }),
+
 /***/ 22661:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -746,7 +1320,10 @@ const setupAccessTokens = async instance => {
   const {
     id: projectId
   } = await (0, gitlab_1.getProjectInfo)(instance);
-  const projectTokens = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/access_tokens`);
+  // all pages: rotated tokens accumulate one (inactive) entry per
+  // rotation, so the active one quickly moves past the first page —
+  // missing it here created a brand-new duplicate token on every setup
+  const projectTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
   const token = projectTokens.find(t => t.name === TOKEN_NAME && t.active === true);
   const expires_at = (0, date_fns_1.format)((0, date_fns_1.add)(new Date(), {
     years: 1,
@@ -963,13 +1540,40 @@ exports.setupAgents = setupAgents;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.setupCloudRun = void 0;
+exports.setupCloudRun = exports.getCloudRunDeployRoles = exports.getCloudRunRequiredServices = exports.CLOUD_RUN_DEPLOY_SA_NAME = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const artifactsRegistry_1 = __nccwpck_require__(41624);
 const enableServices_1 = __nccwpck_require__(96761);
 const getProjectNumber_1 = __nccwpck_require__(68666);
 const serviceAccounts_1 = __nccwpck_require__(35611);
 const updateCatladderStore_1 = __nccwpck_require__(66487);
+exports.CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+const getCloudRunRequiredServices = config => ["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
+// for scheduling jobs
+"cloudresourcemanager.googleapis.com",
+// only required to get google cloud project number
+...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])];
+exports.getCloudRunRequiredServices = getCloudRunRequiredServices;
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+const getCloudRunDeployRoles = config => [
+// TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
+"roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
+// for scheduling
+...(config.cloudSql ? ["roles/cloudsql.admin"] : [])];
+exports.getCloudRunDeployRoles = getCloudRunDeployRoles;
 const setupCloudRun = async (instance, context) => {
   var _a, _b;
   if (!(0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
@@ -978,11 +1582,7 @@ const setupCloudRun = async (instance, context) => {
   const config = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
   // enable services
   instance.log("enable required services...");
-  await (0, enableServices_1.enableGCloudServices)(["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
-  // for scheduling jobs
-  "cloudresourcemanager.googleapis.com",
-  // only required to get google cloud project number
-  ...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])], config);
+  await (0, enableServices_1.enableGCloudServices)((0, exports.getCloudRunRequiredServices)(config), config);
   instance.log("upsert artifacts registry...");
   await (0, artifactsRegistry_1.upsertGcloudArtifactsRegistry)(config);
   instance.log("upsert deploy service account...");
@@ -990,11 +1590,8 @@ const setupCloudRun = async (instance, context) => {
     projectId: config.projectId,
     displayName: "Catladder gcloud deploy",
     description: "This service account deploys to google cloud",
-    name: "cl-d",
-    // TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
-    roles: ["roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
-    // for scheduling
-    ...(config.cloudSql ? ["roles/cloudsql.admin"] : [])]
+    name: exports.CLOUD_RUN_DEPLOY_SA_NAME,
+    roles: (0, exports.getCloudRunDeployRoles)(config)
   }, pipeline_1.GCLOUD_DEPLOY_CREDENTIALS_KEY);
   // the project number is needed at generation time to construct cloud
   // run's deterministic urls (<service>-<projectNumber>.<region>.run.app)
@@ -2064,7 +2661,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(70243);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({
@@ -2207,6 +2804,13 @@ Object.defineProperty(exports, "commandSetup", ({
     return commandSetup_1.commandSetup;
   }
 }));
+var commandDoctor_1 = __nccwpck_require__(80248);
+Object.defineProperty(exports, "commandDoctor", ({
+  enumerable: true,
+  get: function () {
+    return commandDoctor_1.commandDoctor;
+  }
+}));
 var commandGitlabCi_1 = __nccwpck_require__(57076);
 Object.defineProperty(exports, "commandCiJobOpen", ({
   enumerable: true,
@@ -2750,6 +3354,38 @@ exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 80248:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.commandDoctor = void 0;
+const doctor_1 = __nccwpck_require__(96270);
+const defineCommand_1 = __nccwpck_require__(39489);
+exports.commandDoctor = (0, defineCommand_1.defineCommand)({
+  name: "project doctor",
+  description: "Checks for drift between the config and the provisioned infrastructure (read-only): service accounts, IAM roles, gitlab tokens, github secrets, store entries.",
+  group: "project",
+  inputs: {
+    component: {
+      type: "string",
+      message: "component name",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    const component = await ctx.get("component");
+    await (0, doctor_1.doctorProject)(ctx, component);
+  }
+});
+
+/***/ }),
+
 /***/ 47838:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -4743,11 +5379,12 @@ exports.MissingInputError = MissingInputError;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertGcloudArtifactsRegistry = void 0;
+exports.upsertGcloudArtifactsRegistry = exports.CATLADDER_REGISTRY_NAME = void 0;
 const child_process_promise_1 = __nccwpck_require__(51748);
+exports.CATLADDER_REGISTRY_NAME = "catladder-deploy";
 const upsertGcloudArtifactsRegistry = async config => {
   try {
-    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create catladder-deploy --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
+    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create ${exports.CATLADDER_REGISTRY_NAME} --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
   } catch (e) {
     // probably already exists
     //
@@ -5006,7 +5643,7 @@ exports.openGoogleCloudDashboard = openGoogleCloudDashboard;
 
 /***/ }),
 
-/***/ 35611:
+/***/ 83798:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
@@ -5015,26 +5652,21 @@ exports.openGoogleCloudDashboard = openGoogleCloudDashboard;
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
-const child_process_promise_1 = __nccwpck_require__(51748);
+exports.getGcloudServiceAccountNames = void 0;
 const crypto_1 = __nccwpck_require__(76982);
-const gitlab_1 = __nccwpck_require__(4508);
-const accountExists = async fullIdentifier => {
-  try {
-    await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
-    return true;
-  } catch (_a) {
-    return false;
-  }
-};
-exports.accountExists = accountExists;
-const upsertGcloudServiceAccount = async (context, account) => {
+/**
+ * the deterministic gcloud service account naming used by
+ * `project setup`. Extracted so `project doctor` can compute the
+ * expected identifier of an account without creating anything.
+ *
+ * gcloud limits account ids to 30 chars: the customer/app middle part
+ * (and, if even that is not enough, the env/component suffix) is
+ * replaced by a hash when the full name would not fit.
+ */
+const getGcloudServiceAccountNames = (context, account) => {
   const {
     projectId,
-    name,
-    displayName,
-    roles,
-    description
+    name
   } = account;
   // name has limit of 30
   const namePrefix = `${name}`;
@@ -5055,8 +5687,54 @@ const upsertGcloudServiceAccount = async (context, account) => {
     nameSuffix = nameSuffixRaw;
   }
   const fullName = `${namePrefix}-${nameMiddle}-${nameSuffix}`;
-  const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | ${displayName}`;
   const fullIdentifier = `${fullName}@${projectId}.iam.gserviceaccount.com`;
+  return {
+    fullName,
+    fullIdentifier
+  };
+};
+exports.getGcloudServiceAccountNames = getGcloudServiceAccountNames;
+const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
+const hash = (str, length) => {
+  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
+};
+
+/***/ }),
+
+/***/ 35611:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
+const child_process_promise_1 = __nccwpck_require__(51748);
+const gitlab_1 = __nccwpck_require__(4508);
+const serviceAccountNames_1 = __nccwpck_require__(83798);
+const accountExists = async fullIdentifier => {
+  try {
+    await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
+    return true;
+  } catch (_a) {
+    return false;
+  }
+};
+exports.accountExists = accountExists;
+const upsertGcloudServiceAccount = async (context, account) => {
+  const {
+    projectId,
+    displayName,
+    roles,
+    description
+  } = account;
+  const {
+    fullName,
+    fullIdentifier
+  } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, account);
+  const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | ${displayName}`;
   const existing = await (0, exports.accountExists)(fullIdentifier);
   if (!existing) {
     await (0, child_process_promise_1.exec)(`gcloud iam service-accounts create ${fullName} --display-name="${fullDisplayName}" --project="${projectId}"  --description="${description}"`);
@@ -5084,10 +5762,6 @@ const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, accoun
   instance.log("done!");
 };
 exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;
-const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
-const hash = (str, length) => {
-  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
-};
 
 /***/ }),
 
@@ -5665,6 +6339,40 @@ exports.connectToCluster = connectToCluster;
 
 /***/ }),
 
+/***/ 5092:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+
+Object.defineProperty(exports, "__esModule", ({
+  value: true
+}));
+exports.mapWithConcurrency = void 0;
+/**
+ * maps over items with at most `limit` calls in flight, preserving the
+ * input order in the result (unlike reporting-as-you-go, this lets
+ * callers run slow per-item lookups in parallel and still log the
+ * outcomes in a stable order)
+ */
+const mapWithConcurrency = async (items, limit, fn) => {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({
+    length: Math.max(1, Math.min(limit, items.length))
+  }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+};
+exports.mapWithConcurrency = mapWithConcurrency;
+
+/***/ }),
+
 /***/ 82805:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -5778,7 +6486,7 @@ exports["default"] = async () => {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.listGithubVariableNames = exports.listGithubSecretNames = exports.listGithubEnvironments = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = __nccwpck_require__(35317);
 const util_1 = __nccwpck_require__(39023);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -5811,6 +6519,31 @@ const getGithubRepoFromRemote = async remoteName => {
   }
 };
 exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+/**
+ * runs a paginated `gh api` query and returns the jq-extracted lines
+ * (one value per line, e.g. names)
+ */
+const ghApiLines = async (path, jq) => {
+  const {
+    stdout
+  } = await execFile("gh", ["api", "--paginate", path, "--jq", jq], {
+    maxBuffer: 10 * 1024 * 1024
+  });
+  return stdout.split("\n").map(line => line.trim()).filter(Boolean);
+};
+/** names of all deployment environments of the repository */
+const listGithubEnvironments = repo => ghApiLines(`repos/${repo}/environments?per_page=100`, ".environments[].name");
+exports.listGithubEnvironments = listGithubEnvironments;
+/**
+ * names of the actions secrets — of an environment, or of the repo
+ * level when no environment is given. Github secrets are write-only:
+ * names are all that can ever be inspected.
+ */
+const listGithubSecretNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/secrets?per_page=100` : `repos/${repo}/actions/secrets?per_page=100`, ".secrets[].name");
+exports.listGithubSecretNames = listGithubSecretNames;
+/** names of the actions variables (environment or repo level) */
+const listGithubVariableNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/variables?per_page=100` : `repos/${repo}/actions/variables?per_page=100`, ".variables[].name");
+exports.listGithubVariableNames = listGithubVariableNames;
 const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
   var _a, _b;
   const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {
@@ -5866,7 +6599,7 @@ var __importDefault = this && this.__importDefault || function (mod) {
 Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
-exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
+exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
 const pipeline_1 = __nccwpck_require__(60241);
 const lodash_es_1 = __nccwpck_require__(64284);
 const memoizee_1 = __importDefault(__nccwpck_require__(57009));
@@ -5937,6 +6670,24 @@ const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
   throw new Error(`Could not send request to gitlab api ${path}: ${result.status} "${result.statusText}".\nResponse: ${JSON.stringify(await result.json(), null, 2)}`);
 };
 exports.doGitlabRequest = doGitlabRequest;
+/**
+ * GET a list endpoint across ALL pages (gitlab returns 20 items per
+ * page by default — long-lived projects easily exceed that, e.g.
+ * rotated access tokens accumulate one entry per rotation)
+ */
+const doGitlabRequestAllPages = async (io, path) => {
+  const PER_PAGE = 100;
+  const separator = path.includes("?") ? "&" : "?";
+  const all = [];
+  for (let page = 1;; page++) {
+    const items = await (0, exports.doGitlabRequest)(io, `${path}${separator}per_page=${PER_PAGE}&page=${page}`);
+    if (!(items === null || items === void 0 ? void 0 : items.length)) break;
+    all.push(...items);
+    if (items.length < PER_PAGE) break;
+  }
+  return all;
+};
+exports.doGitlabRequestAllPages = doGitlabRequestAllPages;
 const getProjectInfo = async io => {
   const {
     gitRemotePath
@@ -7205,13 +7956,25 @@ const resolveGithubNeeds = (context, job, allJobs, extraNeeds = []) => {
   return [...new Map(resolved.map(n => [n.id, n])).values()].sort((a, b) => a.id.localeCompare(b.id));
 };
 exports.resolveGithubNeeds = resolveGithubNeeds;
+/** step id of a referenceable cache restore step (see `cacheId`) */
+const cacheStepId = cacheId => `cache-${cacheId.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
 const createCacheSteps = (context, job) => {
   var _a, _b;
   if (!((_a = job.caches) === null || _a === void 0 ? void 0 : _a.length)) {
     return [];
   }
-  const lowered = (_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : [];
-  return (0, utils_1.ensureArray)(lowered).map(cache => {
+  const lowered = (0, utils_1.ensureArray)((_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : []);
+  // caches marked redundantOnExactHitOf skip their (expensive) restore
+  // when the referenced sibling cache hit its exact key — e.g. the yarn
+  // zip cache is never read when node_modules restored for the same
+  // lockfile. The referenced cache's step must come first (its
+  // `cache-hit` output drives the `if`), so providers are emitted
+  // before dependents; the reorder is github-only and does not affect
+  // the gitlab cache list.
+  const referencedIds = new Set(lowered.map(cache => cache.redundantOnExactHitOf).filter(id => !!id));
+  const providedIds = new Set(lowered.map(cache => cache.cacheId).filter(id => !!id));
+  const ordered = [...lowered.filter(cache => !cache.redundantOnExactHitOf), ...lowered.filter(cache => cache.redundantOnExactHitOf)];
+  return ordered.map(cache => {
     var _a, _b, _c, _d, _e, _f, _g;
     const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
     const key = cache.key;
@@ -7236,8 +7999,18 @@ const createCacheSteps = (context, job) => {
       restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
       label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(",")
     };
+    // the sibling-hit condition only applies when the referenced cache
+    // is actually part of this job — otherwise restore unconditionally
+    const skipCondition = cache.redundantOnExactHitOf && providedIds.has(cache.redundantOnExactHitOf) ? `\${{ steps.${cacheStepId(cache.redundantOnExactHitOf)}.outputs.cache-hit != 'true' }}` : undefined;
     return {
       name: `Cache ${label}`,
+      // referenced caches carry an id so dependents can read cache-hit
+      ...(cache.cacheId && referencedIds.has(cache.cacheId) ? {
+        id: cacheStepId(cache.cacheId)
+      } : {}),
+      ...(skipCondition ? {
+        if: skipCondition
+      } : {}),
       // pull-only caches are restored but never saved
       uses: cache.policy === "pull" ? "actions/cache/restore@v4" : "actions/cache@v4",
       with: {
@@ -8012,15 +8785,16 @@ const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
   const when = jobWhen !== null && jobWhen !== void 0 ? jobWhen : gate ? gate === "manual" ? "manual" : "on_success" : undefined;
   const allow_failure = jobAllowFailure !== null && jobAllowFailure !== void 0 ? jobAllowFailure : gate ? gate === "manual" : undefined;
   // the neutral `caches` declarations resolve to gitlab cache configs;
-  // an explicitly set gitlab `cache` takes precedence. `keyFiles` is a
-  // github-only content-key hint and must not leak into the gitlab yaml
-  const stripKeyFiles = resolved => Array.isArray(resolved) ? resolved.map(({
+  // an explicitly set gitlab `cache` takes precedence. keyFiles /
+  // cacheId / redundantOnExactHitOf are github-only hints (content
+  // keys, conditional restore) and must not leak into the gitlab yaml
+  const stripGithubCacheHints = ({
     keyFiles: _keyFiles,
+    cacheId: _cacheId,
+    redundantOnExactHitOf: _redundantOnExactHitOf,
     ...cacheRest
-  }) => cacheRest) : (({
-    keyFiles: _keyFiles,
-    ...cacheRest
-  }) => cacheRest)(resolved);
+  }) => cacheRest;
+  const stripKeyFiles = resolved => Array.isArray(resolved) ? resolved.map(stripGithubCacheHints) : stripGithubCacheHints(resolved);
   const resolvedCaches = caches && context.type !== "agent" ? (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, caches) : undefined;
   const cache = jobCache !== null && jobCache !== void 0 ? jobCache : resolvedCaches && stripKeyFiles(resolvedCaches);
   const stage = envMode === "stagePerEnv" && context.type !== "agent" ? `${job.stage} ${context.env}` : job.stage;
@@ -9314,6 +10088,8 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
     pathMode,
     buildDir,
     keyFiles,
+    cacheId,
+    redundantOnExactHitOf,
     ...rest
   }) => {
     var _a;
@@ -9330,6 +10106,12 @@ const createJobCacheFromCacheConfigs = (context, caches) => {
       ...((keyFiles === null || keyFiles === void 0 ? void 0 : keyFiles.length) ? {
         keyFiles: keyFiles.map(f => pathMode === "absolute" ? f : (0, path_1.join)(baseDir, f))
       } : {}),
+      ...(cacheId ? {
+        cacheId
+      } : {}),
+      ...(redundantOnExactHitOf ? {
+        redundantOnExactHitOf
+      } : {}),
       ...rest
     };
   });
@@ -9873,6 +10655,12 @@ exports.getNodeCache = exports.getNodeModulesCache = exports.getYarnCache = void
 const lodash_es_1 = __nccwpck_require__(64284);
 const path_1 = __nccwpck_require__(16928);
 const slugify_1 = __importDefault(__nccwpck_require__(54206));
+/**
+ * stable reference between the two node caches: the yarn (zip) cache
+ * declares itself redundant when the node_modules cache scored an
+ * exact-lockfile hit (github skips the ~0.6GB download on warm runs)
+ */
+const NODE_MODULES_CACHE_ID = "node-modules";
 const getYarnCache = async (context, policy = "pull-push") => {
   const packageManagerInfo = await context.packageManagerInfo;
   const componentIsInWorkspace = context.type === "component" && "componentIsInWorkspace" in packageManagerInfo && packageManagerInfo.componentIsInWorkspace;
@@ -9884,7 +10672,12 @@ const getYarnCache = async (context, policy = "pull-push") => {
     paths: [".yarn"],
     // content-key for immutable-cache backends (github); the lockfile
     // decides whether the cached content could have changed
-    keyFiles: ["yarn.lock"]
+    keyFiles: ["yarn.lock"],
+    // the .yarn zips (~hundreds of MB) are only read when yarn has to
+    // (re)install packages. When the node_modules cache hit for the
+    // same lockfile, install verifies via install-state.gz and never
+    // opens a zip — so github skips downloading this cache entirely
+    redundantOnExactHitOf: NODE_MODULES_CACHE_ID
   }];
 };
 exports.getYarnCache = getYarnCache;
@@ -9908,6 +10701,9 @@ const getNodeModulesCache = async (context, policy = "pull-push") => {
     // decides whether the cached content could have changed (absolute
     // pathMode: resolve the standalone component's lockfile explicitly)
     keyFiles: [componentIsInWorkspace ? "yarn.lock" : (0, path_1.join)(context.build.dir, "yarn.lock")],
+    // referenced by the yarn cache: an exact hit here makes the yarn
+    // zips unnecessary (see redundantOnExactHitOf on getYarnCache)
+    cacheId: NODE_MODULES_CACHE_ID,
     policy,
     paths: [...(componentIsInWorkspace ? (0, lodash_es_1.uniq)(["node_modules", ...((_a = workspaces.map(w => (0, path_1.join)(w.location, "node_modules"))) !== null && _a !== void 0 ? _a : []), ...(!isClassic ? [".yarn/install-state.gz", ...((_b = workspaces.map(w => (0, path_1.join)(w.location, ".yarn/install-state.gz"))) !== null && _b !== void 0 ? _b : [])] : [])]) : [(0, path_1.join)(context.build.dir, "node_modules"), ...(!isClassic ? [(0, path_1.join)(context.build.dir, ".yarn/install-state.gz")] : [])])]
   }];
@@ -10595,7 +11391,7 @@ Object.defineProperty(exports, "__esModule", ({
   value: true
 }));
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-71c49b28" || 0;
+exports.PIPELINE_IMAGE_TAG = "next-5dc1f907" || 0;
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || 0;
 
 /***/ }),