@catladder/cli 0.0.0-next-71c49b28 → 0.0.0-next-5dc1f907

package/dist/cli/src/apps/cli/commands/project/doctor/index.js

@@ -0,0 +1,48 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.doctorProject = void 0;
+const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
+const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
+const checkCloudRun_1 = require("./checkCloudRun");
+const checkGithub_1 = require("./checkGithub");
+const checkGitlab_1 = require("./checkGitlab");
+const checkStore_1 = require("./checkStore");
+const DoctorReport_1 = require("./DoctorReport");
+/**
+ * read-only health check: compares the state `project setup` (and
+ * `project secrets-sync-github`) would provision for the CURRENT config
+ * against what is actually there, and reports drift together with the
+ * command that heals it. `project setup` is a point-in-time
+ * provisioner, so config edits that change required infrastructure
+ * (IAM roles, services, secrets) drift silently until something breaks
+ * in ci — the doctor surfaces that before it does.
+ *
+ * The component filter only narrows the per-component checks; the
+ * cheap project-global checks (store, gitlab, github) always run.
+ */
+const doctorProject = async (instance, onlyComponents) => {
+  const config = await (0, getProjectConfig_1.getProjectConfig)();
+  if (!config) {
+    throw new Error("no catladder config found");
+  }
+  instance.log("🐱 🩺 checking project health — read-only, nothing will be changed");
+  const report = new DoctorReport_1.DoctorReport(instance);
+  await (0, checkStore_1.checkStore)(report);
+  let contexts = [];
+  try {
+    contexts = await (0, getProjectConfig_1.getAllPipelineContexts)(onlyComponents);
+  } catch (e) {
+    report.section("pipeline contexts");
+    report.fail(`could not create pipeline contexts: ${e.message}`, "run: catladder project setup");
+  }
+  if ((0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+    await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
+  }
+  await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+  await (0, checkGithub_1.checkGithub)(report, config);
+  report.summarize();
+};
+exports.doctorProject = doctorProject;

package/dist/cli/src/apps/cli/commands/project/doctor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAjCW,QAAA,aAAa,iBAiCxB"}

package/dist/cli/src/apps/cli/commands/project/setup/setupAccessTokens.js

@@ -11,7 +11,10 @@ const setupAccessTokens = async instance => {
   const {
     id: projectId
   } = await (0, gitlab_1.getProjectInfo)(instance);
-  const projectTokens = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/access_tokens`);
+  // all pages: rotated tokens accumulate one (inactive) entry per
+  // rotation, so the active one quickly moves past the first page —
+  // missing it here created a brand-new duplicate token on every setup
+  const projectTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
   const token = projectTokens.find(t => t.name === TOKEN_NAME && t.active === true);
   const expires_at = (0, date_fns_1.format)((0, date_fns_1.add)(new Date(), {
     years: 1,

package/dist/cli/src/apps/cli/commands/project/setup/setupAccessTokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"setupAccessTokens.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupAccessTokens.ts"],"names":[],"mappings":";;;AACA,uCAAuC;AACvC,wDAA8E;AAE9E,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAE/B,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAY,EAAE,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC;IAEzD,MAAM,aAAa,GAAG,MAAM,IAAA,wBAAe,EACzC,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAClD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,iBAAM,EACvB,IAAA,cAAG,EAAC,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EACvC,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK;QACpB,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,kBAAkB,KAAK,CAAC,EAAE,SAAS,EACxD,EAAE,UAAU,EAAE,EACd,MAAM,CACP;QACH,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,gBAAgB,EACrC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAClC,YAAY,EAAE,EAAE,EAAE,aAAa;YAC/B,UAAU;SACX,EACD,MAAM,CACP,CAAC;IAEN,IAAI,CAAC;QACH,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,qBAAqB,CAAC,CAAC;QAC5E,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,qBAAqB,EAC1C,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EACzB,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,CAAC;QACV,CAAC;QACD,YAAY;QACZ,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,YAAY,EACjC;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI;SACb,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,CACV,kEAAkE,CACnE,CAAC;AACJ,CAAC,CAAC;AA/DW,QAAA,iBAAiB,qBA+D5B"}
+{"version":3,"file":"setupAccessTokens.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupAccessTokens.ts"],"names":[],"mappings":";;;AACA,uCAAuC;AACvC,wDAIqC;AAErC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAE/B,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAY,EAAE,EAAE;IACtD,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,MAAM,IAAA,uBAAc,EAAC,QAAQ,CAAC,CAAC;IAEzD,gEAAgE;IAChE,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,aAAa,GAAG,MAAM,IAAA,gCAAuB,EACjD,QAAQ,EACR,YAAY,SAAS,gBAAgB,CACtC,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAClD,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,iBAAM,EACvB,IAAA,cAAG,EAAC,IAAI,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EACvC,YAAY,CACb,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK;QACpB,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,kBAAkB,KAAK,CAAC,EAAE,SAAS,EACxD,EAAE,UAAU,EAAE,EACd,MAAM,CACP;QACH,CAAC,CAAC,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,gBAAgB,EACrC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAClC,YAAY,EAAE,EAAE,EAAE,aAAa;YAC/B,UAAU;SACX,EACD,MAAM,CACP,CAAC;IAEN,IAAI,CAAC;QACH,MAAM,IAAA,wBAAe,EAAC,QAAQ,EAAE,YAAY,SAAS,qBAAqB,CAAC,CAAC;QAC5E,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,qBAAqB,EAC1C,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EACzB,KAAK,CACN,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YAC9B,MAAM,CAAC,CAAC;QACV,CAAC;QACD,YAAY;QACZ,MAAM,IAAA,wBAAe,EACnB,QAAQ,EACR,YAAY,SAAS,YAAY,EACjC;YACE,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,IAAI;SACb,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,CACV,kEAAkE,CACnE,CAAC;AACJ,CAAC,CAAC;AAlEW,QAAA,iBAAiB,qBAkE5B"}

package/dist/cli/src/apps/cli/commands/project/setup/setupCloudRun.d.ts

@@ -1,3 +1,24 @@
 import type { ComponentContext } from "../../../../../../../pipeline/src/index.js";
 import type { IO } from "../../../../../core/types";
+export declare const CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+export declare const getCloudRunRequiredServices: (config: {
+  cloudSql?: unknown;
+}) => string[];
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+export declare const getCloudRunDeployRoles: (config: {
+  cloudSql?: unknown;
+}) => string[];
 export declare const setupCloudRun: (instance: IO, context: ComponentContext) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/setup/setupCloudRun.js

@@ -3,13 +3,40 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.setupCloudRun = void 0;
+exports.setupCloudRun = exports.getCloudRunDeployRoles = exports.getCloudRunRequiredServices = exports.CLOUD_RUN_DEPLOY_SA_NAME = void 0;
 const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
 const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
 const enableServices_1 = require("../../../../../gcloud/enableServices");
 const getProjectNumber_1 = require("../../../../../gcloud/getProjectNumber");
 const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
 const updateCatladderStore_1 = require("../../../../../store/updateCatladderStore");
+exports.CLOUD_RUN_DEPLOY_SA_NAME = "cl-d";
+/**
+ * the gcloud services the given deploy config requires.
+ *
+ * Shared with `project doctor`: setup enables them, doctor compares
+ * them against what is actually enabled — config edits after setup
+ * (e.g. adding `cloudSql`) would otherwise drift silently.
+ */
+const getCloudRunRequiredServices = config => ["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
+// for scheduling jobs
+"cloudresourcemanager.googleapis.com",
+// only required to get google cloud project number
+...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])];
+exports.getCloudRunRequiredServices = getCloudRunRequiredServices;
+/**
+ * the IAM roles the deploy service account needs for the given deploy
+ * config. Shared with `project doctor` (same rationale as
+ * {@link getCloudRunRequiredServices}) — the motivating case: a
+ * component gets `cloudSql` after its setup ran, deploys keep working,
+ * and only the review teardown hits the missing `cloudsql.admin`.
+ */
+const getCloudRunDeployRoles = config => [
+// TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
+"roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
+// for scheduling
+...(config.cloudSql ? ["roles/cloudsql.admin"] : [])];
+exports.getCloudRunDeployRoles = getCloudRunDeployRoles;
 const setupCloudRun = async (instance, context) => {
   var _a, _b;
   if (!(0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
@@ -18,11 +45,7 @@ const setupCloudRun = async (instance, context) => {
   const config = (_b = context.deploy) === null || _b === void 0 ? void 0 : _b.config;
   // enable services
   instance.log("enable required services...");
-  await (0, enableServices_1.enableGCloudServices)(["run.googleapis.com", "artifactregistry.googleapis.com", "cloudscheduler.googleapis.com",
-  // for scheduling jobs
-  "cloudresourcemanager.googleapis.com",
-  // only required to get google cloud project number
-  ...(config.cloudSql ? ["sqladmin.googleapis.com", "sql-component.googleapis.com"] : [])], config);
+  await (0, enableServices_1.enableGCloudServices)((0, exports.getCloudRunRequiredServices)(config), config);
   instance.log("upsert artifacts registry...");
   await (0, artifactsRegistry_1.upsertGcloudArtifactsRegistry)(config);
   instance.log("upsert deploy service account...");
@@ -30,11 +53,8 @@ const setupCloudRun = async (instance, context) => {
     projectId: config.projectId,
     displayName: "Catladder gcloud deploy",
     description: "This service account deploys to google cloud",
-    name: "cl-d",
-    // TODO: run.admin is a bit much, would be better to follow https://stackoverflow.com/questions/55788714/deploying-to-cloud-run-with-a-custom-service-account-failed-with-iam-serviceacco
-    roles: ["roles/artifactregistry.repoAdmin", "roles/run.admin", "roles/iam.serviceAccountUser", "roles/cloudscheduler.admin",
-    // for scheduling
-    ...(config.cloudSql ? ["roles/cloudsql.admin"] : [])]
+    name: exports.CLOUD_RUN_DEPLOY_SA_NAME,
+    roles: (0, exports.getCloudRunDeployRoles)(config)
   }, pipeline_1.GCLOUD_DEPLOY_CREDENTIALS_KEY);
   // the project number is needed at generation time to construct cloud
   // run's deterministic urls (<service>-<projectNumber>.<region>.run.app)

package/dist/cli/src/apps/cli/commands/project/setup/setupCloudRun.js.map

@@ -1 +1 @@
-{"version":3,"file":"setupCloudRun.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAG7B,+EAAwF;AACxF,yEAA4E;AAC5E,6EAAkF;AAClF,2EAAgG;AAChG,oFAAiF;AAE1E,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAEtC,kBAAkB;IAElB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC5C,MAAM,IAAA,qCAAoB,EACxB;QACE,oBAAoB;QACpB,iCAAiC;QACjC,+BAA+B,EAAE,sBAAsB;QACvD,qCAAqC,EAAE,mDAAmD;QAC1F,GAAG,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,EACD,MAAM,CACP,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,MAAM,IAAA,iDAA6B,EAAC,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD,MAAM,IAAA,yDAAuC,EAC3C,QAAQ,EACR,OAAO,EACP;QACE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,MAAM;QACZ,yLAAyL;QACzL,KAAK,EAAE;YACL,kCAAkC;YAClC,iBAAiB;YACjB,8BAA8B;YAC9B,4BAA4B,EAAE,iBAAiB;YAC/C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,EACD,wCAA6B,CAC9B,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,IAAA,2CAAwB,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC;IAEjD,MAAM,IAAA,2CAAoB,EAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,KAAK;QACR,cAAc,EAAE;YACd,GAAG,KAAK,CAAC,cAAc;YACvB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE;SACtC;KACF,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AA9DW,QAAA,aAAa,iBA8DxB"}
+{"version":3,"file":"setupCloudRun.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAG7B,+EAAwF;AACxF,yEAA4E;AAC5E,6EAAkF;AAClF,2EAAgG;AAChG,oFAAiF;AAEpE,QAAA,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;GAMG;AACI,MAAM,2BAA2B,GAAG,CAAC,MAE3C,EAAY,EAAE,CAAC;IACd,oBAAoB;IACpB,iCAAiC;IACjC,+BAA+B,EAAE,sBAAsB;IACvD,qCAAqC,EAAE,mDAAmD;IAC1F,GAAG,CAAC,MAAM,CAAC,QAAQ;QACjB,CAAC,CAAC,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;QAC7D,CAAC,CAAC,EAAE,CAAC;CACR,CAAC;AAVW,QAAA,2BAA2B,+BAUtC;AAEF;;;;;;GAMG;AACI,MAAM,sBAAsB,GAAG,CAAC,MAEtC,EAAY,EAAE,CAAC;IACd,yLAAyL;IACzL,kCAAkC;IAClC,iBAAiB;IACjB,8BAA8B;IAC9B,4BAA4B,EAAE,iBAAiB;IAC/C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACrD,CAAC;AATW,QAAA,sBAAsB,0BASjC;AAEK,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAEtC,kBAAkB;IAElB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC5C,MAAM,IAAA,qCAAoB,EAAC,IAAA,mCAA2B,EAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,MAAM,IAAA,iDAA6B,EAAC,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD,MAAM,IAAA,yDAAuC,EAC3C,QAAQ,EACR,OAAO,EACP;QACE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,gCAAwB;QAC9B,KAAK,EAAE,IAAA,8BAAsB,EAAC,MAAM,CAAC;KACtC,EACD,wCAA6B,CAC9B,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,IAAA,2CAAwB,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC;IAEjD,MAAM,IAAA,2CAAoB,EAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,KAAK;QACR,cAAc,EAAE;YACd,GAAG,KAAK,CAAC,cAAc;YACvB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE;SACtC;KACF,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AA5CW,QAAA,aAAa,iBA4CxB"}

package/dist/cli/src/commands/index.d.ts

@@ -18,6 +18,7 @@ export { commandTriggerCronjobGeneral } from "./project/k8s/commandTriggerCronjo
 export { commandRenewToken } from "./project/commandRenewToken";
 export { commandGetMyTotalWorktime } from "./project/commandGetMyTotalWorktime";
 export { commandSetup } from "./project/commandSetup";
+export { commandDoctor } from "./project/commandDoctor";
 export { commandCiJobOpen, commandCiJobLog } from "./project/commandGitlabCi";
 export { commandProjectRestoreDb } from "./project/commandProjectRestoreDb";
 export { commandSecurityEvaluate } from "./project/commandSecurityEvaluate";

package/dist/cli/src/commands/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = require("./general/commandKubeCurrentContext");
 Object.defineProperty(exports, "commandKubeCurrentContext", {
@@ -146,6 +146,13 @@ Object.defineProperty(exports, "commandSetup", {
     return commandSetup_1.commandSetup;
   }
 });
+var commandDoctor_1 = require("./project/commandDoctor");
+Object.defineProperty(exports, "commandDoctor", {
+  enumerable: true,
+  get: function () {
+    return commandDoctor_1.commandDoctor;
+  }
+});
 var commandGitlabCi_1 = require("./project/commandGitlabCi");
 Object.defineProperty(exports, "commandCiJobOpen", {
   enumerable: true,

package/dist/cli/src/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAC/B,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAE/B,mBAAmB;AACnB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,+EAA8E;AAArE,oIAAA,wBAAwB,OAAA;AACjC,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AACxB,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AACrC,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,6DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC1C,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAEhC,uBAAuB;AACvB,mEAAkE;AAAzD,oHAAA,gBAAgB,OAAA;AACzB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,qEAAoE;AAA3D,sHAAA,iBAAiB,OAAA;AAC1B,yEAAwE;AAA/D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAC7B,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AAErC,mBAAmB;AACnB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAElC,oBAAoB;AACpB,gEAA+D;AAAtD,oHAAA,gBAAgB,OAAA;AAEzB,oBAAoB;AACpB,kFAAiF;AAAxE,sIAAA,yBAAyB,OAAA;AAClC,wFAAuF;AAA9E,4IAAA,4BAA4B,OAAA;AACrC,oFAAmF;AAA1E,wIAAA,0BAA0B,OAAA;AAEnC,eAAe;AACf,uDAAsD;AAA7C,gHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,kHAAA,eAAe,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":";;;AAAA,mBAAmB;AACnB,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAC/B,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,qEAAoE;AAA3D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,gIAAA,sBAAsB,OAAA;AAE/B,mBAAmB;AACnB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,mEAAkE;AAAzD,wHAAA,kBAAkB,OAAA;AAC3B,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,2DAA0D;AAAjD,gHAAA,cAAc,OAAA;AACvB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mFAAkF;AAAzE,wIAAA,0BAA0B,OAAA;AACnC,+EAA8E;AAArE,oIAAA,wBAAwB,OAAA;AACjC,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AACxB,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AACrC,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAC1B,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAClC,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,6DAA8E;AAArE,mHAAA,gBAAgB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAC1C,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAEhC,uBAAuB;AACvB,mEAAkE;AAAzD,oHAAA,gBAAgB,OAAA;AACzB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,iEAAgE;AAAvD,kHAAA,eAAe,OAAA;AACxB,qEAAoE;AAA3D,sHAAA,iBAAiB,OAAA;AAC1B,yEAAwE;AAA/D,0HAAA,mBAAmB,OAAA;AAC5B,2EAA0E;AAAjE,4HAAA,oBAAoB,OAAA;AAC7B,6EAAmF;AAA1E,qIAAA,4BAA4B,OAAA;AAErC,mBAAmB;AACnB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,6EAA4E;AAAnE,kIAAA,uBAAuB,OAAA;AAChC,iFAAgF;AAAvE,sIAAA,yBAAyB,OAAA;AAElC,oBAAoB;AACpB,gEAA+D;AAAtD,oHAAA,gBAAgB,OAAA;AAEzB,oBAAoB;AACpB,kFAAiF;AAAxE,sIAAA,yBAAyB,OAAA;AAClC,wFAAuF;AAA9E,4IAAA,4BAA4B,OAAA;AACrC,oFAAmF;AAA1E,wIAAA,0BAA0B,OAAA;AAEnC,eAAe;AACf,uDAAsD;AAA7C,gHAAA,cAAc,OAAA;AACvB,yDAAwD;AAA/C,kHAAA,eAAe,OAAA"}

package/dist/cli/src/commands/project/commandDoctor.d.ts

@@ -0,0 +1,8 @@
+export declare const commandDoctor: import("../../core").CommandDef<{
+  readonly component: {
+    readonly type: "string";
+    readonly message: "component name";
+    readonly positional: true;
+    readonly required: false;
+  };
+}>;

package/dist/cli/src/commands/project/commandDoctor.js

@@ -0,0 +1,25 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.commandDoctor = void 0;
+const doctor_1 = require("../../apps/cli/commands/project/doctor");
+const defineCommand_1 = require("../../core/defineCommand");
+exports.commandDoctor = (0, defineCommand_1.defineCommand)({
+  name: "project doctor",
+  description: "Checks for drift between the config and the provisioned infrastructure (read-only): service accounts, IAM roles, gitlab tokens, github secrets, store entries.",
+  group: "project",
+  inputs: {
+    component: {
+      type: "string",
+      message: "component name",
+      positional: true,
+      required: false
+    }
+  },
+  execute: async ctx => {
+    const component = await ctx.get("component");
+    await (0, doctor_1.doctorProject)(ctx, component);
+  }
+});

package/dist/cli/src/commands/project/commandDoctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandDoctor.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandDoctor.ts"],"names":[],"mappings":";;;AAAA,mEAAuE;AACvE,4DAAyD;AAE5C,QAAA,aAAa,GAAG,IAAA,6BAAa,EAAC;IACzC,IAAI,EAAE,gBAAgB;IACtB,WAAW,EACT,gKAAgK;IAClK,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,SAAS,EAAE;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gBAAgB;YACzB,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,IAAA,sBAAa,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/gcloud/artifactsRegistry.d.ts

@@ -1,4 +1,5 @@
 import type { Gcloudregion } from "../../../pipeline/src/index.js";
+export declare const CATLADDER_REGISTRY_NAME = "catladder-deploy";
 export declare const upsertGcloudArtifactsRegistry: (config: {
   projectId: string;
   region: Gcloudregion;

package/dist/cli/src/gcloud/artifactsRegistry.js

@@ -3,11 +3,12 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.upsertGcloudArtifactsRegistry = void 0;
+exports.upsertGcloudArtifactsRegistry = exports.CATLADDER_REGISTRY_NAME = void 0;
 const child_process_promise_1 = require("child-process-promise");
+exports.CATLADDER_REGISTRY_NAME = "catladder-deploy";
 const upsertGcloudArtifactsRegistry = async config => {
   try {
-    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create catladder-deploy --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
+    await (0, child_process_promise_1.exec)(`gcloud artifacts repositories create ${exports.CATLADDER_REGISTRY_NAME} --project="${config.projectId}" --repository-format=docker --location=${config.region}`);
   } catch (e) {
     // probably already exists
     //

package/dist/cli/src/gcloud/artifactsRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifactsRegistry.js","sourceRoot":"","sources":["../../../../src/gcloud/artifactsRegistry.ts"],"names":[],"mappings":";;;AACA,iEAA6C;AAEtC,MAAM,6BAA6B,GAAG,KAAK,EAAE,MAGnD,EAAE,EAAE;IACH,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EACR,oEAAoE,MAAM,CAAC,SAAS,2CAA2C,MAAM,CAAC,MAAM,EAAE,CAC/I,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0BAA0B;QAC1B,EAAE;IACJ,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,6BAA6B,iCAYxC"}
+{"version":3,"file":"artifactsRegistry.js","sourceRoot":"","sources":["../../../../src/gcloud/artifactsRegistry.ts"],"names":[],"mappings":";;;AACA,iEAA6C;AAEhC,QAAA,uBAAuB,GAAG,kBAAkB,CAAC;AAEnD,MAAM,6BAA6B,GAAG,KAAK,EAAE,MAGnD,EAAE,EAAE;IACH,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EACR,wCAAwC,+BAAuB,eAAe,MAAM,CAAC,SAAS,2CAA2C,MAAM,CAAC,MAAM,EAAE,CACzJ,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,0BAA0B;QAC1B,EAAE;IACJ,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,6BAA6B,iCAYxC"}

package/dist/cli/src/gcloud/serviceAccountNames.d.ts

@@ -0,0 +1,28 @@
+/**
+ * the parts of a component context the naming depends on — structural
+ * subset of `ComponentContext` so the naming stays a pure function
+ */
+export type ServiceAccountNamingContext = {
+  env: string;
+  name: string;
+  fullConfig: {
+    customerName: string;
+    appName: string;
+  };
+};
+/**
+ * the deterministic gcloud service account naming used by
+ * `project setup`. Extracted so `project doctor` can compute the
+ * expected identifier of an account without creating anything.
+ *
+ * gcloud limits account ids to 30 chars: the customer/app middle part
+ * (and, if even that is not enough, the env/component suffix) is
+ * replaced by a hash when the full name would not fit.
+ */
+export declare const getGcloudServiceAccountNames: (context: ServiceAccountNamingContext, account: {
+  name: string;
+  projectId: string;
+}) => {
+  fullName: string;
+  fullIdentifier: string;
+};

package/dist/cli/src/gcloud/serviceAccountNames.js

@@ -0,0 +1,51 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getGcloudServiceAccountNames = void 0;
+const crypto_1 = require("crypto");
+/**
+ * the deterministic gcloud service account naming used by
+ * `project setup`. Extracted so `project doctor` can compute the
+ * expected identifier of an account without creating anything.
+ *
+ * gcloud limits account ids to 30 chars: the customer/app middle part
+ * (and, if even that is not enough, the env/component suffix) is
+ * replaced by a hash when the full name would not fit.
+ */
+const getGcloudServiceAccountNames = (context, account) => {
+  const {
+    projectId,
+    name
+  } = account;
+  // name has limit of 30
+  const namePrefix = `${name}`;
+  const nameSuffixRaw = `${context.env}-${context.name}`;
+  const nameMiddleRaw = `${context.fullConfig.customerName}-${context.fullConfig.appName}`;
+  const MAX_LENGTH = 30;
+  const NUM_SEPARATORS = 2;
+  // we want to first hash middle, then suffix
+  // if for middle we have at least 1 char left, its ok, so we don't hash nameSuffix, otherwise we need to hash that as well
+  const middleMaxLength = MAX_LENGTH - namePrefix.length - nameSuffixRaw.length - NUM_SEPARATORS;
+  let nameMiddle;
+  let nameSuffix;
+  if (middleMaxLength < 1) {
+    nameMiddle = hashIfNessecary(nameMiddleRaw, 1);
+    nameSuffix = hashIfNessecary(nameSuffixRaw, MAX_LENGTH - namePrefix.length - 1 - NUM_SEPARATORS);
+  } else {
+    nameMiddle = hashIfNessecary(nameMiddleRaw, middleMaxLength);
+    nameSuffix = nameSuffixRaw;
+  }
+  const fullName = `${namePrefix}-${nameMiddle}-${nameSuffix}`;
+  const fullIdentifier = `${fullName}@${projectId}.iam.gserviceaccount.com`;
+  return {
+    fullName,
+    fullIdentifier
+  };
+};
+exports.getGcloudServiceAccountNames = getGcloudServiceAccountNames;
+const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
+const hash = (str, length) => {
+  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
+};

package/dist/cli/src/gcloud/serviceAccountNames.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccountNames.js","sourceRoot":"","sources":["../../../../src/gcloud/serviceAccountNames.ts"],"names":[],"mappings":";;;AAAA,mCAAoC;AAYpC;;;;;;;;GAQG;AACI,MAAM,4BAA4B,GAAG,CAC1C,OAAoC,EACpC,OAA4C,EACE,EAAE;IAChD,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IAEpC,uBAAuB;IACvB,MAAM,UAAU,GAAG,GAAG,IAAI,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,cAAc,GAAG,CAAC,CAAC;IAEzB,4CAA4C;IAC5C,0HAA0H;IAE1H,MAAM,eAAe,GACnB,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,cAAc,CAAC;IAEzE,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC/C,UAAU,GAAG,eAAe,CAC1B,aAAa,EACb,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CACpD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC7D,UAAU,GAAG,aAAa,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;IAC7D,MAAM,cAAc,GAAG,GAAG,QAAQ,IAAI,SAAS,0BAA0B,CAAC;IAE1E,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC,CAAC;AApCW,QAAA,4BAA4B,gCAoCvC;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAE,CACzD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAEtD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,EAAE;IAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC,CAAC"}

package/dist/cli/src/gcloud/serviceAccounts.js

@@ -5,8 +5,8 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
 const child_process_promise_1 = require("child-process-promise");
-const crypto_1 = require("crypto");
 const gitlab_1 = require("../utils/gitlab");
+const serviceAccountNames_1 = require("./serviceAccountNames");
 const accountExists = async fullIdentifier => {
   try {
     await (0, child_process_promise_1.exec)(`gcloud iam service-accounts describe ${fullIdentifier}`);
@@ -19,32 +19,15 @@ exports.accountExists = accountExists;
 const upsertGcloudServiceAccount = async (context, account) => {
   const {
     projectId,
-    name,
     displayName,
     roles,
     description
   } = account;
-  // name has limit of 30
-  const namePrefix = `${name}`;
-  const nameSuffixRaw = `${context.env}-${context.name}`;
-  const nameMiddleRaw = `${context.fullConfig.customerName}-${context.fullConfig.appName}`;
-  const MAX_LENGTH = 30;
-  const NUM_SEPARATORS = 2;
-  // we want to first hash middle, then suffix
-  // if for middle we have at least 1 char left, its ok, so we don't hash nameSuffix, otherwise we need to hash that as well
-  const middleMaxLength = MAX_LENGTH - namePrefix.length - nameSuffixRaw.length - NUM_SEPARATORS;
-  let nameMiddle;
-  let nameSuffix;
-  if (middleMaxLength < 1) {
-    nameMiddle = hashIfNessecary(nameMiddleRaw, 1);
-    nameSuffix = hashIfNessecary(nameSuffixRaw, MAX_LENGTH - namePrefix.length - 1 - NUM_SEPARATORS);
-  } else {
-    nameMiddle = hashIfNessecary(nameMiddleRaw, middleMaxLength);
-    nameSuffix = nameSuffixRaw;
-  }
-  const fullName = `${namePrefix}-${nameMiddle}-${nameSuffix}`;
+  const {
+    fullName,
+    fullIdentifier
+  } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, account);
   const fullDisplayName = `${context.fullConfig.customerName}-${context.fullConfig.appName} ${context.env}:${context.name} | ${displayName}`;
-  const fullIdentifier = `${fullName}@${projectId}.iam.gserviceaccount.com`;
   const existing = await (0, exports.accountExists)(fullIdentifier);
   if (!existing) {
     await (0, child_process_promise_1.exec)(`gcloud iam service-accounts create ${fullName} --display-name="${fullDisplayName}" --project="${projectId}"  --description="${description}"`);
@@ -71,8 +54,4 @@ const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, accoun
   }, context.env, context.name);
   instance.log("done!");
 };
-exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;
-const hashIfNessecary = (str, maxLength) => str.length > maxLength ? hash(str, maxLength) : str;
-const hash = (str, length) => {
-  return (0, crypto_1.createHmac)("sha256", str).digest("hex").substring(0, length);
-};
+exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;

package/dist/cli/src/gcloud/serviceAccounts.js.map

@@ -1 +1 @@
-{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAC7C,mCAAoC;AAEpC,4CAAqD;AAE9C,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAErE,uBAAuB;IACvB,MAAM,UAAU,GAAG,GAAG,IAAI,EAAE,CAAC;IAC7B,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,aAAa,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;IACzF,MAAM,UAAU,GAAG,EAAE,CAAC;IACtB,MAAM,cAAc,GAAG,CAAC,CAAC;IAEzB,4CAA4C;IAC5C,0HAA0H;IAE1H,MAAM,eAAe,GACnB,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,GAAG,cAAc,CAAC;IAEzE,IAAI,UAAkB,CAAC;IACvB,IAAI,UAAkB,CAAC;IACvB,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QAC/C,UAAU,GAAG,eAAe,CAC1B,aAAa,EACb,UAAU,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,GAAG,cAAc,CACpD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QAC7D,UAAU,GAAG,aAAa,CAAC;IAC7B,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,UAAU,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;IAE7D,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,cAAc,GAAG,GAAG,QAAQ,IAAI,SAAS,0BAA0B,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR;QACE,CAAC,UAAU,CAAC,EAAE,GAAG;KAClB,EACD,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,IAAI,CACb,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AAlBW,QAAA,uCAAuC,2CAkBlD;AAEF,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,EAAE,CACzD,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAEtD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,MAAc,EAAE,EAAE;IAC3C,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACtE,CAAC,CAAC"}
+{"version":3,"file":"serviceAccounts.js","sourceRoot":"","sources":["../../../../src/gcloud/serviceAccounts.ts"],"names":[],"mappings":";;;AAEA,iEAA6C;AAE7C,4CAAqD;AACrD,+DAAqE;AAE9D,MAAM,aAAa,GAAG,KAAK,EAAE,cAAsB,EAAE,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,IAAA,4BAAI,EAAC,wCAAwC,cAAc,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,aAAa,iBAOxB;AASF,MAAM,0BAA0B,GAAG,KAAK,EACtC,OAAyB,EACzB,OAAuB,EACN,EAAE;IACnB,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAE/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAA,kDAA4B,EAC/D,OAAO,EACP,OAAO,CACR,CAAC;IAEF,MAAM,eAAe,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC;IAE3I,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAA,4BAAI,EACR,sCAAsC,QAAQ,oBAAoB,eAAe,gBAAgB,SAAS,qBAAqB,WAAW,GAAG,CAC9I,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,cAAc,EAAE,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAA,4BAAI,EACR,0CAA0C,SAAS,aAAa,UAAU,WAAW,IAAI,mBAAmB,CAC7G,CAAC;IACJ,CAAC;IAED,aAAa;IAEb,wBAAwB;IACxB,MAAM,IAAI,GAAG,MAAM,IAAA,4BAAI,EACrB,uDAAuD,cAAc,kCAAkC,CACxG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAA,4BAAI,EACR,2CAA2C,GAAG,CAAC,IAAI,0BAA0B,cAAc,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,IAAA,4BAAI;IACf,kEAAkE;IAClE,qEAAqE,cAAc,QAAQ,CAC5F,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEK,MAAM,uCAAuC,GAAG,KAAK,EAC1D,QAAY,EACZ,OAAyB,EACzB,OAAuB,EACvB,UAAkB,EACH,EAAE;IACjB,QAAQ,CAAC,GAAG,CAAC,4BAA4B,GAAG,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,0BAA0B,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE/D,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR;QACE,CAAC,UAAU,CAAC,EAAE,GAAG;KAClB,EACD,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,IAAI,CACb,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC,CAAC;AAlBW,QAAA,uCAAuC,2CAkBlD"}

package/dist/cli/src/utils/concurrency.d.ts

@@ -0,0 +1,7 @@
+/**
+ * maps over items with at most `limit` calls in flight, preserving the
+ * input order in the result (unlike reporting-as-you-go, this lets
+ * callers run slow per-item lookups in parallel and still log the
+ * outcomes in a stable order)
+ */
+export declare const mapWithConcurrency: <T, R>(items: T[], limit: number, fn: (item: T, index: number) => Promise<R>) => Promise<R[]>;

package/dist/cli/src/utils/concurrency.js

@@ -0,0 +1,27 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.mapWithConcurrency = void 0;
+/**
+ * maps over items with at most `limit` calls in flight, preserving the
+ * input order in the result (unlike reporting-as-you-go, this lets
+ * callers run slow per-item lookups in parallel and still log the
+ * outcomes in a stable order)
+ */
+const mapWithConcurrency = async (items, limit, fn) => {
+  const results = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({
+    length: Math.max(1, Math.min(limit, items.length))
+  }, async () => {
+    while (next < items.length) {
+      const index = next++;
+      results[index] = await fn(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return results;
+};
+exports.mapWithConcurrency = mapWithConcurrency;

package/dist/cli/src/utils/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../../../../src/utils/concurrency.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAU,EACV,KAAa,EACb,EAA0C,EAC5B,EAAE;IAChB,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EACtD,KAAK,IAAI,EAAE;QACT,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;YACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAlBW,QAAA,kBAAkB,sBAkB7B"}

package/dist/cli/src/utils/github.d.ts

@@ -8,6 +8,16 @@ export declare const isGhAuthenticated: () => Promise<boolean>;
  * (`pipelines.github.gitRemote`, defaults to origin).
  */
 export declare const getGithubRepoFromRemote: (remoteName: string) => Promise<string | undefined>;
+/** names of all deployment environments of the repository */
+export declare const listGithubEnvironments: (repo: string) => Promise<string[]>;
+/**
+ * names of the actions secrets — of an environment, or of the repo
+ * level when no environment is given. Github secrets are write-only:
+ * names are all that can ever be inspected.
+ */
+export declare const listGithubSecretNames: (repo: string, environment?: string) => Promise<string[]>;
+/** names of the actions variables (environment or repo level) */
+export declare const listGithubVariableNames: (repo: string, environment?: string) => Promise<string[]>;
 /**
  * sets a github actions repository secret via the gh cli.
  * The value is passed via stdin so it never shows up in a process list.

package/dist/cli/src/utils/github.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.listGithubVariableNames = exports.listGithubSecretNames = exports.listGithubEnvironments = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -36,6 +36,31 @@ const getGithubRepoFromRemote = async remoteName => {
   }
 };
 exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
+/**
+ * runs a paginated `gh api` query and returns the jq-extracted lines
+ * (one value per line, e.g. names)
+ */
+const ghApiLines = async (path, jq) => {
+  const {
+    stdout
+  } = await execFile("gh", ["api", "--paginate", path, "--jq", jq], {
+    maxBuffer: 10 * 1024 * 1024
+  });
+  return stdout.split("\n").map(line => line.trim()).filter(Boolean);
+};
+/** names of all deployment environments of the repository */
+const listGithubEnvironments = repo => ghApiLines(`repos/${repo}/environments?per_page=100`, ".environments[].name");
+exports.listGithubEnvironments = listGithubEnvironments;
+/**
+ * names of the actions secrets — of an environment, or of the repo
+ * level when no environment is given. Github secrets are write-only:
+ * names are all that can ever be inspected.
+ */
+const listGithubSecretNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/secrets?per_page=100` : `repos/${repo}/actions/secrets?per_page=100`, ".secrets[].name");
+exports.listGithubSecretNames = listGithubSecretNames;
+/** names of the actions variables (environment or repo level) */
+const listGithubVariableNames = (repo, environment) => ghApiLines(environment ? `repos/${repo}/environments/${encodeURIComponent(environment)}/variables?per_page=100` : `repos/${repo}/actions/variables?per_page=100`, ".variables[].name");
+exports.listGithubVariableNames = listGithubVariableNames;
 const ghSetViaStdin = (kind, repo, name, value, environment) => new Promise((resolve, reject) => {
   var _a, _b;
   const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo, ...(environment ? ["--env", environment] : [])], {

package/dist/cli/src/utils/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAL/D,QAAA,eAAe,mBAKgD;AAE5E;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AALjE,QAAA,iBAAiB,qBAKgD;AAE9E;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAY,EACZ,WAAmB,EACJ,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,KAAK;QACL,IAAI;QACJ,KAAK;QACL,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;KAChE,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CACtE,CACF,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AA3BQ,QAAA,uBAAuB,2BA2B/B"}
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF;;;GAGG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAqB,EAAE;IACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EACvC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC;IACF,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC;AAEF,6DAA6D;AACtD,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAqB,EAAE,CACxE,UAAU,CAAC,SAAS,IAAI,4BAA4B,EAAE,sBAAsB,CAAC,CAAC;AADnE,QAAA,sBAAsB,0BAC6C;AAEhF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,uBAAuB;IACtF,CAAC,CAAC,SAAS,IAAI,+BAA+B,EAChD,iBAAiB,CAClB,CAAC;AATS,QAAA,qBAAqB,yBAS9B;AAEJ,iEAAiE;AAC1D,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,yBAAyB;IACxF,CAAC,CAAC,SAAS,IAAI,iCAAiC,EAClD,mBAAmB,CACpB,CAAC;AATS,QAAA,uBAAuB,2BAShC;AAEJ,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAL/D,QAAA,eAAe,mBAKgD;AAE5E;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AALjE,QAAA,iBAAiB,qBAKgD;AAE9E;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAY,EACZ,WAAmB,EACJ,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,KAAK;QACL,IAAI;QACJ,KAAK;QACL,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;KAChE,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CACtE,CACF,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AA3BQ,QAAA,uBAAuB,2BA2B/B"}

package/dist/cli/src/utils/gitlab.d.ts

@@ -5,6 +5,12 @@ export declare const setupGitlabToken: (io: IO) => Promise<void>;
 export declare const getGitlabToken: (io: IO | null) => Promise<string>;
 type Method = "GET" | "PUT" | "POST" | "DELETE";
 export declare const doGitlabRequest: <T = any>(io: IO | null, path: string, data?: any, method?: Method) => Promise<T>;
+/**
+ * GET a list endpoint across ALL pages (gitlab returns 20 items per
+ * page by default — long-lived projects easily exceed that, e.g.
+ * rotated access tokens accumulate one entry per rotation)
+ */
+export declare const doGitlabRequestAllPages: <T = any>(io: IO | null, path: string) => Promise<T[]>;
 export declare const getProjectInfo: (io: IO | null) => Promise<{
   id: string;
   web_url: string;