@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-6916db3c

package/dist/bundles/cli/index.js

@@ -2959,6 +2959,7 @@ const child_process_promise_1 = __nccwpck_require__(42242);
 const lodash_es_1 = __nccwpck_require__(50866);
 const open_1 = __importDefault(__nccwpck_require__(81776));
 const defineCommand_1 = __nccwpck_require__(40317);
+const gitlabHost_1 = __nccwpck_require__(83534);
 const gitlab_1 = __nccwpck_require__(8680);
 const statusEmojiMap = {
     failed: "🙀",
@@ -3033,7 +3034,7 @@ exports.commandCiJobLog = (0, defineCommand_1.defineCommand)({
         const id = selectedJob.id;
         let finished = false;
         while (!finished) {
-            const trace = await (0, child_process_promise_1.exec)(`curl -s --header "PRIVATE-TOKEN: ${await (0, gitlab_1.getGitlabToken)(ctx)}" "https://git.panter.ch/api/v4/projects/${projectId}/jobs/${id}/trace"`);
+            const trace = await (0, child_process_promise_1.exec)(`curl -s --header "PRIVATE-TOKEN: ${await (0, gitlab_1.getGitlabToken)(ctx)}" "${await (0, gitlabHost_1.getGitlabHostUrl)()}/api/v4/projects/${projectId}/jobs/${id}/trace"`);
             const job = await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/jobs/${id}`);
             if (trace.stdout) {
                 ctx.log(trace.stdout);
@@ -4725,7 +4726,7 @@ const defineCommand_1 = __nccwpck_require__(40317);
 const rest_1 = __nccwpck_require__(37650);
 const evaluateSecurityAudit_1 = __nccwpck_require__(79392);
 const createSecurityAuditMergeRequest_1 = __nccwpck_require__(91276);
-const GITLAB_HOST = "https://git.panter.ch";
+const gitlabHost_1 = __nccwpck_require__(83534);
 exports.commandSecurityAuditCiJob = (0, defineCommand_1.defineCommand)({
     name: "security audit ci-job",
     description: "Evaluates security audit document. Creates MR with template if missing.",
@@ -4763,7 +4764,7 @@ exports.commandSecurityAuditCiJob = (0, defineCommand_1.defineCommand)({
             const mainBranch = await ctx.get("mainBranch");
             const projectId = await ctx.get("projectId");
             const userId = await ctx.get("userId");
-            const api = new rest_1.Gitlab({ host: GITLAB_HOST, token });
+            const api = new rest_1.Gitlab({ host: await (0, gitlabHost_1.getGitlabHostUrl)(), token });
             const mr = await (0, createSecurityAuditMergeRequest_1.createSecurityAuditMergeRequest)({
                 api,
                 mainBranch,
@@ -4803,7 +4804,7 @@ exports.commandSecurityAuditCreate = void 0;
 const defineCommand_1 = __nccwpck_require__(40317);
 const rest_1 = __nccwpck_require__(37650);
 const createSecurityAuditMergeRequest_1 = __nccwpck_require__(91276);
-const GITLAB_HOST = "https://git.panter.ch";
+const gitlabHost_1 = __nccwpck_require__(83534);
 exports.commandSecurityAuditCreate = (0, defineCommand_1.defineCommand)({
     name: "security audit create",
     description: "Creates a MR with the latest security audit template document",
@@ -4835,7 +4836,7 @@ exports.commandSecurityAuditCreate = (0, defineCommand_1.defineCommand)({
         const mainBranch = await ctx.get("mainBranch");
         const projectId = await ctx.get("projectId");
         const userId = await ctx.get("userId");
-        const api = new rest_1.Gitlab({ host: GITLAB_HOST, token });
+        const api = new rest_1.Gitlab({ host: await (0, gitlabHost_1.getGitlabHostUrl)(), token });
         const result = await (0, createSecurityAuditMergeRequest_1.createSecurityAuditMergeRequest)({
             api,
             mainBranch,
@@ -6722,6 +6723,40 @@ exports.upsertAllVariables = upsertAllVariables;
 
 /***/ }),
 
+/***/ 83534:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getGitlabHostUrl = void 0;
+const gitProjectInformation_1 = __nccwpck_require__(83851);
+/**
+ * the base url of the gitlab instance this project lives on.
+ *
+ * Never hardcode an instance: catladder is used outside panter, and the
+ * host was baked in as https://git.panter.ch in several places, which
+ * silently broke every consumer on another gitlab.
+ *
+ * - in a gitlab CI job, `CI_SERVER_URL` is the authoritative value
+ *   (predefined, already includes the scheme)
+ * - locally, derive it from the git remote
+ *
+ * @param remoteName the remote to derive from outside CI (default origin)
+ */
+const getGitlabHostUrl = async (remoteName = "origin") => {
+    const fromCi = process.env.CI_SERVER_URL;
+    if (fromCi) {
+        return fromCi.replace(/\/+$/, "");
+    }
+    const { gitRemoteHost } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)(remoteName);
+    return `https://${gitRemoteHost}`;
+};
+exports.getGitlabHostUrl = getGitlabHostUrl;
+//# sourceMappingURL=gitlabHost.js.map
+
+/***/ }),
+
 /***/ 66697:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -8924,6 +8959,11 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
         ? runScript
         : scripts.add(id, runScript);
     const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
+    // github pages: the built site is handed to the official actions
+    // instead of being uploaded as a plain artifact. `deploy-pages`
+    // replaces the whole site, so there is no path_prefix equivalent —
+    // review previews are rejected upstream (see the pages deploy type).
+    const pagesPublishDir = job.pages ? artifactPaths[0] : undefined;
     const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map((service) => typeof service === "string" ? { name: service } : service);
     // docker runs natively on github runners, so gitlab's docker-in-docker
     // services are dropped. The job container stays: the runner mounts the
@@ -8969,14 +9009,38 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
      */
     const referencesSecrets = Object.values(env).some((value) => typeof value === "string" &&
         (value.includes("${{ secrets.") || value.includes("${{ vars.")));
-    const githubEnvironment = job.environment && isComponent
+    const githubEnvironment = pagesPublishDir
+        ? // github requires pages deployments to target the `github-pages`
+            // environment, and only the deploy step knows the final url.
+            // `secrets-sync-github` derives its targets from the generated
+            // workflows, so any secret this job references is synced there.
+            {
+                name: "github-pages",
+                url: "${{ steps.deployment.outputs.page_url }}",
+            }
+        : job.environment && isComponent
+            ? {
+                name: `${context.env}-${context.name}`,
+                ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            }
+            : referencesSecrets
+                ? { name: context.env }
+                : undefined;
+    // declaring `permissions` drops ALL default token grants, so a job
+    // that needs any special grant must also re-declare the ordinary ones:
+    // `contents: read` for the checkout and `packages: read` to pull its
+    // job image from the repo registry.
+    const specialPermissions = {
+        ...(pagesPublishDir ? { pages: "write", "id-token": "write" } : {}),
+        ...(job.idToken ? { "id-token": "write" } : {}),
+    };
+    const permissions = Object.keys(specialPermissions).length
         ? {
-            name: `${context.env}-${context.name}`,
-            ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            contents: "read",
+            ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),
+            ...specialPermissions,
         }
-        : referencesSecrets
-            ? { name: context.env }
-            : undefined;
+        : undefined;
     const githubJob = {
         name: githubJobName(context, job.name),
         "runs-on": "ubuntu-latest",
@@ -8999,6 +9063,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
             : {}),
         ...(Object.keys(services).length > 0 ? { services } : {}),
         ...(githubEnvironment ? { environment: githubEnvironment } : {}),
+        ...(permissions ? { permissions } : {}),
         env,
         steps: [
             ...(skipCheckout
@@ -9018,25 +9083,41 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                 run,
                 shell: "bash",
             },
-            ...(uploadProviderIds.has(id) || artifactPaths.length > 0
-                ? artifactPaths.length > 0
-                    ? [
-                        {
-                            name: "Upload artifacts",
-                            uses: "actions/upload-artifact@v4",
-                            with: {
-                                name: id,
-                                path: artifactPaths.join("\n"),
-                                "if-no-files-found": "warn",
-                                // gitlab artifacts include everything; upload-artifact
-                                // silently drops hidden files by default — which is
-                                // exactly where next.js builds live (.next)
-                                "include-hidden-files": true,
-                            },
-                        },
-                    ]
-                    : []
+            ...(pagesPublishDir
+                ? [
+                    {
+                        name: "Upload pages artifact",
+                        uses: "actions/upload-pages-artifact@v3",
+                        with: { path: pagesPublishDir },
+                    },
+                    {
+                        name: "Deploy to github pages",
+                        id: "deployment",
+                        uses: "actions/deploy-pages@v4",
+                    },
+                ]
                 : []),
+            ...(pagesPublishDir
+                ? []
+                : uploadProviderIds.has(id) || artifactPaths.length > 0
+                    ? artifactPaths.length > 0
+                        ? [
+                            {
+                                name: "Upload artifacts",
+                                uses: "actions/upload-artifact@v4",
+                                with: {
+                                    name: id,
+                                    path: artifactPaths.join("\n"),
+                                    "if-no-files-found": "warn",
+                                    // gitlab artifacts include everything; upload-artifact
+                                    // silently drops hidden files by default — which is
+                                    // exactly where next.js builds live (.next)
+                                    "include-hidden-files": true,
+                                },
+                            },
+                        ]
+                        : []
+                    : []),
         ],
     };
     return [id, githubJob];
@@ -9526,8 +9607,10 @@ const createGitlabPipeline_1 = __nccwpck_require__(94411);
 const gitlabReleaseJobs_1 = __nccwpck_require__(75512);
 const getPipelineStages_1 = __nccwpck_require__(29641);
 const sortGitLabJobDefProps_1 = __nccwpck_require__(71625);
+const writeFiles_1 = __nccwpck_require__(7396);
 const CATLADDER_GENERATED_FOLDER = ".catladder-generated";
 const GITLAB_GENERATED_FOLDER = CATLADDER_GENERATED_FOLDER + "/gitlab";
+const GITLAB_MAIN_FILE = ".gitlab-ci.yml";
 class GitlabBackend {
     constructor() {
         this.type = "gitlab";
@@ -9535,12 +9618,20 @@ class GitlabBackend {
     }
     async cleanup() {
         await (0, promises_1.rm)(this.generatedFolder, { force: true, recursive: true });
+        // `.gitlab-ci.yml` lives outside the generated folder, so it used to
+        // survive disabling the gitlab backend and kept a stale pipeline
+        // running. Only remove it when it is ours: a project that generates
+        // github only may well hand-maintain a gitlab file of its own.
+        const mainFile = await (0, promises_1.readFile)(GITLAB_MAIN_FILE, "utf-8").catch(() => null);
+        if (mainFile === null || mainFile === void 0 ? void 0 : mainFile.includes(writeFiles_1.GENERATED_FILE_MARKER)) {
+            await (0, promises_1.rm)(GITLAB_MAIN_FILE, { force: true });
+        }
     }
     async createFiles(config) {
         const images = this.createImagesPlan(config);
         const includes = await this.createIncludes(config, images);
         const mainFile = {
-            path: ".gitlab-ci.yml",
+            path: GITLAB_MAIN_FILE,
             content: {
                 include: includes.map((i) => i.path),
             },
@@ -9849,7 +9940,11 @@ const getFullReferencedJobNameFromWorkspace = (referencedJobName, workspaceName,
 const getJobName = (need) => (0, lodash_es_1.isObject)(need) ? need.job : need;
 const makeGitlabJob = (context, job, allJobs, images, baseRules) => {
     var _a, _b, _c;
-    const { environment, envMode, requires, provides, name, needs, jobTags, script, variables, runnerVariables, gate, when: jobWhen, allow_failure: jobAllowFailure, cache: jobCache, caches, image: jobImage, ...rest } = job;
+    const { environment, envMode, requires, provides, name, needs, jobTags, script, variables, runnerVariables, gate, when: jobWhen, allow_failure: jobAllowFailure, cache: jobCache, caches, image: jobImage, 
+    // github lowers this to `permissions: id-token: write`; gitlab has
+    // no counterpart, and anything left in `rest` lands in the job yaml
+    // verbatim ("config contains unknown keys: idtoken")
+    idToken: _idToken, ...rest } = job;
     // catladder image references resolve to an image built in the repo's
     // own registry; the job additionally depends on the image build job
     const resolvedImage = images.resolve(jobImage);
@@ -10518,7 +10613,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = void 0;
+exports.getEnabledPipelineTypes = exports.getVaultConfig = exports.getPipelineGitRemote = exports.getPipelineOptions = exports.getPipelineBackend = exports.getAllPipelineTypes = void 0;
 const github_1 = __nccwpck_require__(48);
 const gitlab_1 = __nccwpck_require__(10744);
 __exportStar(__nccwpck_require__(33415), exports);
@@ -10528,6 +10623,13 @@ const BACKENDS = {
     gitlab: () => new gitlab_1.GitlabBackend(),
     github: () => new github_1.GithubBackend(),
 };
+/**
+ * every pipeline type catladder knows how to generate — regardless of
+ * what the config enables. Cleanup uses this to also reach backends that
+ * were switched off (their files would otherwise linger).
+ */
+const getAllPipelineTypes = () => Object.keys(BACKENDS);
+exports.getAllPipelineTypes = getAllPipelineTypes;
 const getPipelineBackend = (type) => {
     const createBackend = BACKENDS[type];
     if (!createBackend) {
@@ -10570,7 +10672,7 @@ exports.getVaultConfig = getVaultConfig;
 const getEnabledPipelineTypes = (config) => {
     var _a;
     if (config.pipelines) {
-        const enabled = Object.keys(BACKENDS).filter((type) => { var _a; return (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type]; });
+        const enabled = (0, exports.getAllPipelineTypes)().filter((type) => { var _a; return (_a = config.pipelines) === null || _a === void 0 ? void 0 : _a[type]; });
         if (enabled.length === 0) {
             throw new Error("`pipelines` is configured, but no pipeline type is enabled");
         }
@@ -13767,6 +13869,7 @@ exports.RUNNER_IMAGE_BUILD_CONTEXT = {
     "docker-build": "self",
     "semantic-release": "self",
     changesets: "self",
+    "npm-publish": "self",
     "agent-claude": "self",
 };
 /**
@@ -13906,6 +14009,7 @@ class DeployJob extends jobs_1.CatladderJob {
             artifacts: jobDefinition.artifacts,
             services: jobDefinition.services,
             pages: jobDefinition.pages,
+            idToken: jobDefinition.idToken,
             allow_failure: (_e = jobDefinition.allow_failure) !== null && _e !== void 0 ? _e : deployConfig === null || deployConfig === void 0 ? void 0 : deployConfig.allowFailure,
             envMode: "stagePerEnv", // makes it easier to run manual tasks er env
             needs: [],
@@ -16163,7 +16267,12 @@ const createNpmPackageDeployJobs = (context) => {
     ];
     return (0, base_1.createDeployementJobs)(context, {
         deploy: {
-            image: (0, runner_1.getRunnerImage)("jobs-default"),
+            // dedicated image: publishing needs npm >= 11.5.1 for trusted
+            // publishing (OIDC), which jobs-default's node does not carry
+            image: (0, runner_1.getRunnerImage)("npm-publish"),
+            // github: lowered to `id-token: write` so npm can exchange the
+            // workflow's OIDC token for short-lived publish credentials
+            idToken: true,
             script: [
                 // catci derives version + dist-tag from the pipeline trigger,
                 // sets the version in package.json and runs npm publish
@@ -16220,9 +16329,14 @@ const createPagesDeployJobs = async (context) => {
         // should not happen
         throw new Error("deploy config is not pages");
     }
-    if (context.pipelineType === "github") {
-        // don't fail the whole github generation of a multi-backend project
-        console.warn(`component "${context.name}": the pages deploy type is not yet supported on the github backend — no deploy jobs generated`);
+    const onGithub = context.pipelineType === "github";
+    if (onGithub && context.environment.envType === "review") {
+        // github pages serves ONE site per repository and deploy-pages
+        // replaces all of it — there is no path_prefix equivalent, so per-PR
+        // previews cannot exist (deploy-pages has a `preview` input, but it
+        // is alpha and not publicly available). Warn instead of throwing, so
+        // the github generation of a multi-backend project still succeeds.
+        console.warn(`component "${context.name}": github pages cannot host per-merge-request previews (one site per repository) — no review deploy job generated`);
         return [];
     }
     // review environments publish under their own path prefix (gitlab
@@ -16245,8 +16359,14 @@ const createPagesDeployJobs = async (context) => {
                     : []),
                 ...deployConfig.script,
                 // the gitlab environment url should point at the published site
-                // (the base deploy job reports $ROOT_URL as environment url)
-                `export ROOT_URL="$CI_PAGES_URL${pathPrefix ? `/${pathPrefix}` : ""}"`,
+                // (the base deploy job reports $ROOT_URL as environment url).
+                // On github the url is only known after deploy-pages ran, so the
+                // backend takes it from that step's output instead.
+                ...(onGithub
+                    ? []
+                    : [
+                        `export ROOT_URL="$CI_PAGES_URL${pathPrefix ? `/${pathPrefix}` : ""}"`,
+                    ]),
             ],
             variables: {},
             runnerVariables: {
@@ -17235,6 +17355,16 @@ async function generatePipelineFiles(context, pipelineType) {
         await (0, promises_1.rm)(jobImagesPlan_1.GENERATED_IMAGES_FOLDER, { recursive: true, force: true });
         // same for the materialized catci bundle (union across backends)
         await (0, promises_1.rm)(shippedCatci_1.GENERATED_CATCI_FOLDER, { recursive: true, force: true });
+        // clean up the backends that are NOT enabled (any more): each
+        // backend only ever removed its own files while it was enabled, so
+        // disabling one in `pipelines` used to leave its pipeline files
+        // behind forever — and a stale `.gitlab-ci.yml` keeps running a
+        // stale pipeline. Only safe on a full generation, where the enabled
+        // set is authoritative.
+        const disabledTypes = (0, backends_1.getAllPipelineTypes)().filter((type) => !pipelineTypes.includes(type));
+        for (const type of disabledTypes) {
+            await (0, backends_1.getPipelineBackend)(type).cleanup();
+        }
         // agent skills are backend-independent, materialized once per full
         // generation
         await (0, agentSkills_1.generateAgentSkills)(context);
@@ -18199,9 +18329,15 @@ exports.removeUndefined = removeUndefined;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.FileWriter = exports.yamlStringifyOptions = void 0;
+exports.FileWriter = exports.yamlStringifyOptions = exports.GENERATED_FILE_MARKER = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const yaml_1 = __nccwpck_require__(33483);
+/**
+ * the line that marks a file as catladder-generated. Cleanup code uses
+ * it to tell a generated file apart from a hand-maintained one at the
+ * same path (e.g. a `.gitlab-ci.yml` a project wrote itself).
+ */
+exports.GENERATED_FILE_MARKER = "🐱 🔨 This file is generated by catladder";
 exports.yamlStringifyOptions = {
     // prevents colapsing long command statements into multiple lines
     lineWidth: 0,
@@ -18261,7 +18397,7 @@ class FileWriter {
     getAutoGeneratedHeader(commentChar) {
         return [
             "-------------------------------------------------",
-            `🐱 🔨 This file is generated by catladder`,
+            exports.GENERATED_FILE_MARKER,
             `🚨 Do not edit this file manually 🚨`,
             "-------------------------------------------------",
         ]

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/_helpers.tpl

@@ -190,13 +190,3 @@ env:
 
 
 
-{{- define "visualReviewSnippet" -}}
-  <script
-    data-project-id='{{.Values.gitlab.projectId}}'
-    data-merge-request-id='{{.Values.gitlab.mergeRequestId}}'
-    data-mr-url='https://git.panter.ch'
-    data-project-path='{{.Values.gitlab.projectPath}}'
-    id='review-app-toolbar-script'
-    src='https://git.panter.ch/assets/webpack/visual_review_toolbar.js'>
-  </script>
-{{- end -}}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.ingress.yaml

@@ -16,11 +16,6 @@ metadata:
     nginx.ingress.kubernetes.io/rewrite-target: /$1  
     nginx.ingress.kubernetes.io/configuration-snippet: |
       more_set_headers "x-build-id: {{ .Values.global.BUILD_ID }}";
-    {{- if and .Values.gitlab.visualReviewEnabled (and  .Values.global.ENV_SHORT (eq .Values.global.ENV_SHORT "review"))}}
-      proxy_set_header Accept-Encoding ""; 
-      sub_filter_once on;
-      sub_filter "</head>" "{{- include "visualReviewSnippet" . | nindent 8 -}}</head>";
-    {{- end }}
   {{- range $key, $value := .Values.ingress.annotations }}
     {{ $key }}: {{ $value | quote }}
   {{- end }}

package/dist/bundles/runner-images/kubernetes/helm-charts/the-panter-chart/values.yaml

@@ -112,7 +112,6 @@ application:
     successThreshold: 1
 
 gitlab:
-  visualReviewEnabled: false
   app:
   env:
   projectPath:

package/dist/bundles/runner-images/npm-publish/Dockerfile

@@ -0,0 +1,12 @@
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git
+
+# npm trusted publishing (OIDC) needs npm >= 11.5.1; the npm bundled
+# with the node image is not guaranteed to be new enough, so pin the
+# major explicitly. Without it npm silently falls back to token auth.
+RUN npm install -g npm@11
+
+# no publish logic baked in: it lives in catci, which pipeline
+# generation materializes into the repository checkout
+# (.catladder-generated/catci)

package/dist/bundles/runner-images/semantic-release/scripts/semanticRelease

@@ -45,10 +45,11 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
   # is gitlab-specific)
   PUBLISH_PLUGIN=""
 else
+  # no gitlabUrl: the plugin derives it from the CI-provided variables
+  # of the running instance. It used to be hardcoded to panter's gitlab,
+  # which broke the release on every other instance.
   PUBLISH_PLUGIN=',
-    ["@semantic-release/gitlab", {
-      "gitlabUrl": "https://git.panter.ch"
-    }]'
+    "@semantic-release/gitlab"'
 fi
 
 if [ ! -e .releaserc ]; then

package/dist/bundles/skills/catladder-deploys/references/deploy-types.md

@@ -54,11 +54,12 @@ resources with `yarn catladder project setup`; detect drift with
 - `registry?: string` — registry url, default `https://registry.npmjs.org/`.
 - `distTag?: string` — overrides the derived dist-tag.
 - Version/dist-tag derivation: tagged release (`prod`) → tag version under `latest`; branch/MR → `0.0.0-<branch-slug>-<sha>` under `canary` (branches `next`/`beta` publish under their own dist-tag).
-- Requires the `NPM_TOKEN` secret (managed like any catladder secret). Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
+- Auth: the `NPM_TOKEN` secret (managed like any catladder secret), or — on github — **trusted publishing** with no stored token: register the package's trusted publisher on npmjs.com with the repo and the publishing **workflow filename** (`catladder-release.yml` for tagged releases). npm allows one trusted publisher per package, so canary publishes from the main/review workflows still need `NPM_TOKEN`. A set token always wins over OIDC.
+- Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
 
 ## `pages`
 
-- `type: "pages"` — **required**. Publishes a static site on gitlab pages (not yet supported on the github backend).
+- `type: "pages"` — **required**. Publishes a static site on gitlab pages or github pages. On github the repo's Pages source must be set to "GitHub Actions" once; per-merge-request previews are gitlab-only (github serves one site per repository).
 - `script: string[]` — **required**; produces the site.
 - `publishDir?: string` — output directory relative to the repo root, default `"public"`.
 - `requiresInstall?: boolean` — run the package-manager install (yarn/pnpm) first (`requiresYarnInstall` is a deprecated alias).

package/dist/packages/pipeline/src/backends/github/createGithubJobs.js

@@ -247,6 +247,11 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
         ? runScript
         : scripts.add(id, runScript);
     const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
+    // github pages: the built site is handed to the official actions
+    // instead of being uploaded as a plain artifact. `deploy-pages`
+    // replaces the whole site, so there is no path_prefix equivalent —
+    // review previews are rejected upstream (see the pages deploy type).
+    const pagesPublishDir = job.pages ? artifactPaths[0] : undefined;
     const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map((service) => typeof service === "string" ? { name: service } : service);
     // docker runs natively on github runners, so gitlab's docker-in-docker
     // services are dropped. The job container stays: the runner mounts the
@@ -292,14 +297,38 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
      */
     const referencesSecrets = Object.values(env).some((value) => typeof value === "string" &&
         (value.includes("${{ secrets.") || value.includes("${{ vars.")));
-    const githubEnvironment = job.environment && isComponent
+    const githubEnvironment = pagesPublishDir
+        ? // github requires pages deployments to target the `github-pages`
+            // environment, and only the deploy step knows the final url.
+            // `secrets-sync-github` derives its targets from the generated
+            // workflows, so any secret this job references is synced there.
+            {
+                name: "github-pages",
+                url: "${{ steps.deployment.outputs.page_url }}",
+            }
+        : job.environment && isComponent
+            ? {
+                name: `${context.env}-${context.name}`,
+                ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            }
+            : referencesSecrets
+                ? { name: context.env }
+                : undefined;
+    // declaring `permissions` drops ALL default token grants, so a job
+    // that needs any special grant must also re-declare the ordinary ones:
+    // `contents: read` for the checkout and `packages: read` to pull its
+    // job image from the repo registry.
+    const specialPermissions = {
+        ...(pagesPublishDir ? { pages: "write", "id-token": "write" } : {}),
+        ...(job.idToken ? { "id-token": "write" } : {}),
+    };
+    const permissions = Object.keys(specialPermissions).length
         ? {
-            name: `${context.env}-${context.name}`,
-            ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+            contents: "read",
+            ...(resolved.fromRepoRegistry ? { packages: "read" } : {}),
+            ...specialPermissions,
         }
-        : referencesSecrets
-            ? { name: context.env }
-            : undefined;
+        : undefined;
     const githubJob = {
         name: githubJobName(context, job.name),
         "runs-on": "ubuntu-latest",
@@ -322,6 +351,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
             : {}),
         ...(Object.keys(services).length > 0 ? { services } : {}),
         ...(githubEnvironment ? { environment: githubEnvironment } : {}),
+        ...(permissions ? { permissions } : {}),
         env,
         steps: [
             ...(skipCheckout
@@ -341,25 +371,41 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                 run,
                 shell: "bash",
             },
-            ...(uploadProviderIds.has(id) || artifactPaths.length > 0
-                ? artifactPaths.length > 0
-                    ? [
-                        {
-                            name: "Upload artifacts",
-                            uses: "actions/upload-artifact@v4",
-                            with: {
-                                name: id,
-                                path: artifactPaths.join("\n"),
-                                "if-no-files-found": "warn",
-                                // gitlab artifacts include everything; upload-artifact
-                                // silently drops hidden files by default — which is
-                                // exactly where next.js builds live (.next)
-                                "include-hidden-files": true,
-                            },
-                        },
-                    ]
-                    : []
+            ...(pagesPublishDir
+                ? [
+                    {
+                        name: "Upload pages artifact",
+                        uses: "actions/upload-pages-artifact@v3",
+                        with: { path: pagesPublishDir },
+                    },
+                    {
+                        name: "Deploy to github pages",
+                        id: "deployment",
+                        uses: "actions/deploy-pages@v4",
+                    },
+                ]
                 : []),
+            ...(pagesPublishDir
+                ? []
+                : uploadProviderIds.has(id) || artifactPaths.length > 0
+                    ? artifactPaths.length > 0
+                        ? [
+                            {
+                                name: "Upload artifacts",
+                                uses: "actions/upload-artifact@v4",
+                                with: {
+                                    name: id,
+                                    path: artifactPaths.join("\n"),
+                                    "if-no-files-found": "warn",
+                                    // gitlab artifacts include everything; upload-artifact
+                                    // silently drops hidden files by default — which is
+                                    // exactly where next.js builds live (.next)
+                                    "include-hidden-files": true,
+                                },
+                            },
+                        ]
+                        : []
+                    : []),
         ],
     };
     return [id, githubJob];