@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-6916db3c

package/dist/bundles/catenv/index.js

@@ -2931,6 +2931,11 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
         ? runScript
         : scripts.add(id, runScript);
     const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
+    // github pages: the built site is handed to the official actions
+    // instead of being uploaded as a plain artifact. `deploy-pages`
+    // replaces the whole site, so there is no path_prefix equivalent —
+    // review previews are rejected upstream (see the pages deploy type).
+    const pagesPublishDir = job.pages ? artifactPaths[0] : undefined;
     const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map((service) => typeof service === "string" ? { name: service } : service);
     // docker runs natively on github runners, so gitlab's docker-in-docker
     // services are dropped. The job container stays: the runner mounts the
@@ -2976,14 +2981,38 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
      */
     const referencesSecrets = Object.values(env).some((value) => typeof value === "string" &&
         (value.includes("${{ secrets.") || value.includes("${{ vars.")));
-    const githubEnvironment = job.environment && isComponent
+    const githubEnvironment = pagesPublishDir
+        ? // github requires pages deployments to target the `github-pages`
+            // environment, and only the deploy step knows the final url.
+            // `secrets-sync-github` derives its targets from the generated
+            // workflows, so any secret this job references is synced there.
+            {
+                name: "github-pages",
+                url: "${{ steps.deployment.outputs.page_url }}",
+            }
+        : job.environment && isComponent
+            ? {
+                name: `${context.env}-${context.name}`,
+                ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            }
+            : referencesSecrets
+                ? { name: context.env }
+                : undefined;
+    // declaring `permissions` drops ALL default token grants, so a job
+    // that needs any special grant must also re-declare the ordinary ones:
+    // `contents: read` for the checkout and `packages: read` to pull its
+    // job image from the repo registry.
+    const specialPermissions = {
+        ...(pagesPublishDir ? { pages: "write", "id-token": "write" } : {}),
+        ...(job.idToken ? { "id-token": "write" } : {}),
+    };
+    const permissions = Object.keys(specialPermissions).length
         ? {
-            name: `${context.env}-${context.name}`,
-            ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            contents: "read",
+            ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),
+            ...specialPermissions,
         }
-        : referencesSecrets
-            ? { name: context.env }
-            : undefined;
+        : undefined;
     const githubJob = {
         name: githubJobName(context, job.name),
         "runs-on": "ubuntu-latest",
@@ -3006,6 +3035,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
             : {}),
         ...(Object.keys(services).length > 0 ? { services } : {}),
         ...(githubEnvironment ? { environment: githubEnvironment } : {}),
+        ...(permissions ? { permissions } : {}),
         env,
         steps: [
             ...(skipCheckout
@@ -3025,25 +3055,41 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                 run,
                 shell: "bash",
             },
-            ...(uploadProviderIds.has(id) || artifactPaths.length > 0
-                ? artifactPaths.length > 0
-                    ? [
-                        {
-                            name: "Upload artifacts",
-                            uses: "actions/upload-artifact@v4",
-                            with: {
-                                name: id,
-                                path: artifactPaths.join("\n"),
-                                "if-no-files-found": "warn",
-                                // gitlab artifacts include everything; upload-artifact
-                                // silently drops hidden files by default — which is
-                                // exactly where next.js builds live (.next)
-                                "include-hidden-files": true,
-                            },
-                        },
-                    ]
-                    : []
+            ...(pagesPublishDir
+                ? [
+                    {
+                        name: "Upload pages artifact",
+                        uses: "actions/upload-pages-artifact@v3",
+                        with: { path: pagesPublishDir },
+                    },
+                    {
+                        name: "Deploy to github pages",
+                        id: "deployment",
+                        uses: "actions/deploy-pages@v4",
+                    },
+                ]
                 : []),
+            ...(pagesPublishDir
+                ? []
+                : uploadProviderIds.has(id) || artifactPaths.length > 0
+                    ? artifactPaths.length > 0
+                        ? [
+                            {
+                                name: "Upload artifacts",
+                                uses: "actions/upload-artifact@v4",
+                                with: {
+                                    name: id,
+                                    path: artifactPaths.join("\n"),
+                                    "if-no-files-found": "warn",
+                                    // gitlab artifacts include everything; upload-artifact
+                                    // silently drops hidden files by default — which is
+                                    // exactly where next.js builds live (.next)
+                                    "include-hidden-files": true,
+                                },
+                            },
+                        ]
+                        : []
+                    : []),
         ],
     };
     return [id, githubJob];
@@ -3533,8 +3579,10 @@ const createGitlabPipeline_1 = __nccwpck_require__(94411);
 const gitlabReleaseJobs_1 = __nccwpck_require__(75512);
 const getPipelineStages_1 = __nccwpck_require__(29641);
 const sortGitLabJobDefProps_1 = __nccwpck_require__(71625);
+const writeFiles_1 = __nccwpck_require__(7396);
 const CATLADDER_GENERATED_FOLDER = ".catladder-generated";
 const GITLAB_GENERATED_FOLDER = CATLADDER_GENERATED_FOLDER + "/gitlab";
+const GITLAB_MAIN_FILE = ".gitlab-ci.yml";
 class GitlabBackend {
     constructor() {
         this.type = "gitlab";
@@ -3542,12 +3590,20 @@ class GitlabBackend {
     }
     async cleanup() {
         await (0, promises_1.rm)(this.generatedFolder, { force: true, recursive: true });
+        // `.gitlab-ci.yml` lives outside the generated folder, so it used to
+        // survive disabling the gitlab backend and kept a stale pipeline
+        // running. Only remove it when it is ours: a project that generates
+        // github only may well hand-maintain a gitlab file of its own.
+        const mainFile = await (0, promises_1.readFile)(GITLAB_MAIN_FILE, "utf-8").catch(() => null);
+        if (mainFile === null || mainFile === void 0 ? void 0 : mainFile.includes(writeFiles_1.GENERATED_FILE_MARKER)) {
+            await (0, promises_1.rm)(GITLAB_MAIN_FILE, { force: true });
+        }
     }
     async createFiles(config) {
         const images = this.createImagesPlan(config);
         const includes = await this.createIncludes(config, images);
         const mainFile = {
-            path: ".gitlab-ci.yml",
+            path: GITLAB_MAIN_FILE,
             content: {
                 include: includes.map((i) => i.path),
             },
@@ -3856,7 +3912,11 @@ const getFullReferencedJobNameFromWorkspace = (referencedJobName, workspaceName,
 const getJobName = (need) => (0, lodash_es_1.isObject)(need) ? need.job : need;
 const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
     var _a, _b, _c;
-    const { environment, envMode, requires, provides, name, needs, jobTags, script, variables, runnerVariables, gate, when: jobWhen, allow_failure: jobAllowFailure, cache: jobCache, caches, image: jobImage, ...rest } = job;
+    const { environment, envMode, requires, provides, name, needs, jobTags, script, variables, runnerVariables, gate, when: jobWhen, allow_failure: jobAllowFailure, cache: jobCache, caches, image: jobImage, 
+    // github lowers this to `permissions: id-token: write`; gitlab has
+    // no counterpart, and anything left in `rest` lands in the job yaml
+    // verbatim ("config contains unknown keys: idtoken")
+    idToken: _idToken, ...rest } = job;
     // catladder image references resolve to an image built in the repo's
     // own registry; the job additionally depends on the image build job
     const resolvedImage = images.resolve(jobImage);
@@ -4525,7 +4585,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = void 0;
+exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = exports.getAllPipelineTypes = void 0;
 const github_1 = __nccwpck_require__(48);
 const gitlab_1 = __nccwpck_require__(10744);
 __exportStar(__nccwpck_require__(33415), exports);
@@ -4535,6 +4595,13 @@ const BACKENDS = {
     gitlab: () => new gitlab_1.GitlabBackend(),
     github: () => new github_1.GithubBackend(),
 };
+/**
+ * every pipeline type catladder knows how to generate — regardless of
+ * what the config enables. Cleanup uses this to also reach backends that
+ * were switched off (their files would otherwise linger).
+ */
+const getAllPipelineTypes = () => Object.keys(BACKENDS);
+exports.getAllPipelineTypes = getAllPipelineTypes;
 const getPipelineBackend = (type) => {
     const createBackend = BACKENDS[type];
     if (!createBackend) {
@@ -4577,7 +4644,7 @@ exports.getVaultConfig = getVaultConfig;
 const getEnabledPipelineTypes = (config) => {
     var _a;
     if (config.pipelines) {
-        const enabled = Object.keys(BACKENDS).filter((type) => { var _a; return (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type]; });
+        const enabled = (0, exports.getAllPipelineTypes)().filter((type) => { var _a; return (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type]; });
         if (enabled.length === 0) {
             throw new Error("`pipelines` is configured, but no pipeline type is enabled");
         }
@@ -7774,6 +7841,7 @@ exports.RUNNER_IMAGE_BUILD_CONTEXT = {
     "docker-build": "self",
     "semantic-release": "self",
     changesets: "self",
+    "npm-publish": "self",
     "agent-claude": "self",
 };
 /**
@@ -7913,6 +7981,7 @@ class DeployJob extends jobs_1.CatladderJob {
             artifacts: jobDefinition.artifacts,
             services: jobDefinition.services,
             pages: jobDefinition.pages,
+            idToken: jobDefinition.idToken,
             allow_failure: (_e = jobDefinition.allow_failure) !== null && _e !== void 0 ? _e : deployConfig === null || deployConfig === void 0 ? void 0 : deployConfig.allowFailure,
             envMode: "stagePerEnv", // makes it easier to run manual tasks er env
             needs: [],
@@ -10170,7 +10239,12 @@ const createNpmPackageDeployJobs = (context) => {
     ];
     return (0, base_1.createDeployementJobs)(context, {
         deploy: {
-            image: (0, runner_1.getRunnerImage)("jobs-default"),
+            // dedicated image: publishing needs npm >= 11.5.1 for trusted
+            // publishing (OIDC), which jobs-default's node does not carry
+            image: (0, runner_1.getRunnerImage)("npm-publish"),
+            // github: lowered to `id-token: write` so npm can exchange the
+            // workflow's OIDC token for short-lived publish credentials
+            idToken: true,
             script: [
                 // catci derives version + dist-tag from the pipeline trigger,
                 // sets the version in package.json and runs npm publish
@@ -10227,9 +10301,14 @@ const createPagesDeployJobs = async (context) => {
         // should not happen
         throw new Error("deploy config is not pages");
     }
-    if (context.pipelineType === "github") {
-        // don't fail the whole github generation of a multi-backend project
-        console.warn(`component "${context.name}": the pages deploy type is not yet supported on the github backend — no deploy jobs generated`);
+    const onGithub = context.pipelineType === "github";
+    if (onGithub && context.environment.envType === "review") {
+        // github pages serves ONE site per repository and deploy-pages
+        // replaces all of it — there is no path_prefix equivalent, so per-PR
+        // previews cannot exist (deploy-pages has a `preview` input, but it
+        // is alpha and not publicly available). Warn instead of throwing, so
+        // the github generation of a multi-backend project still succeeds.
+        console.warn(`component "${context.name}": github pages cannot host per-merge-request previews (one site per repository) — no review deploy job generated`);
         return [];
     }
     // review environments publish under their own path prefix (gitlab
@@ -10252,8 +10331,14 @@ const createPagesDeployJobs = async (context) => {
                     : []),
                 ...deployConfig.script,
                 // the gitlab environment url should point at the published site
-                // (the base deploy job reports $ROOT_URL as environment url)
-                `export ROOT_URL="$CI_PAGES_URL${pathPrefix ? `/${pathPrefix}` : ""}"`,
+                // (the base deploy job reports $ROOT_URL as environment url).
+                // On github the url is only known after deploy-pages ran, so the
+                // backend takes it from that step's output instead.
+                ...(onGithub
+                    ? []
+                    : [
+                        `export ROOT_URL="$CI_PAGES_URL${pathPrefix ? `/${pathPrefix}` : ""}"`,
+                    ]),
             ],
             variables: {},
             runnerVariables: {
@@ -11242,6 +11327,16 @@ async function generatePipelineFiles(context, pipelineType) {
         await (0, promises_1.rm)(jobImagesPlan_1.GENERATED_IMAGES_FOLDER, { recursive: true, force: true });
         // same for the materialized catci bundle (union across backends)
         await (0, promises_1.rm)(shippedCatci_1.GENERATED_CATCI_FOLDER, { recursive: true, force: true });
+        // clean up the backends that are NOT enabled (any more): each
+        // backend only ever removed its own files while it was enabled, so
+        // disabling one in `pipelines` used to leave its pipeline files
+        // behind forever — and a stale `.gitlab-ci.yml` keeps running a
+        // stale pipeline. Only safe on a full generation, where the enabled
+        // set is authoritative.
+        const disabledTypes = (0, backends_1.getAllPipelineTypes)().filter((type) => !pipelineTypes.includes(type));
+        for (const type of disabledTypes) {
+            await (0, backends_1.getPipelineBackend)(type).cleanup();
+        }
         // agent skills are backend-independent, materialized once per full
         // generation
         await (0, agentSkills_1.generateAgentSkills)(context);
@@ -12206,9 +12301,15 @@ exports.removeUndefined = removeUndefined;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.FileWriter = exports.yamlStringifyOptions = void 0;
+exports.FileWriter = exports.yamlStringifyOptions = exports.GENERATED_FILE_MARKER = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const yaml_1 = __nccwpck_require__(33483);
+/**
+ * the line that marks a file as catladder-generated. Cleanup code uses
+ * it to tell a generated file apart from a hand-maintained one at the
+ * same path (e.g. a `.gitlab-ci.yml` a project wrote itself).
+ */
+exports.GENERATED_FILE_MARKER = "🐱 🔨 This file is generated by catladder";
 exports.yamlStringifyOptions = {
     // prevents colapsing long command statements into multiple lines
     lineWidth: 0,
@@ -12268,7 +12369,7 @@ class FileWriter {
     getAutoGeneratedHeader(commentChar) {
         return [
             "-------------------------------------------------",
-            `🐱 🔨 This file is generated by catladder`,
+            exports.GENERATED_FILE_MARKER,
             `🚨 Do not edit this file manually 🚨`,
             "-------------------------------------------------",
         ]