@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-6916db3c

package/dist/runner-images/npm-publish/Dockerfile

@@ -0,0 +1,12 @@
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git
+
+# npm trusted publishing (OIDC) needs npm >= 11.5.1; the npm bundled
+# with the node image is not guaranteed to be new enough, so pin the
+# major explicitly. Without it npm silently falls back to token auth.
+RUN npm install -g npm@11
+
+# no publish logic baked in: it lives in catci, which pipeline
+# generation materializes into the repository checkout
+# (.catladder-generated/catci)

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -45,10 +45,11 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
   # is gitlab-specific)
   PUBLISH_PLUGIN=""
 else
+  # no gitlabUrl: the plugin derives it from the CI-provided variables
+  # of the running instance. It used to be hardcoded to panter's gitlab,
+  # which broke the release on every other instance.
   PUBLISH_PLUGIN=',
-    ["@semantic-release/gitlab", {
-      "gitlabUrl": "https://git.panter.ch"
-    }]'
+    "@semantic-release/gitlab"'
 fi
 
 if [ ! -e .releaserc ]; then

package/dist/skills/catladder-deploys/references/deploy-types.md

@@ -54,11 +54,12 @@ resources with `yarn catladder project setup`; detect drift with
 - `registry?: string` — registry url, default `https://registry.npmjs.org/`.
 - `distTag?: string` — overrides the derived dist-tag.
 - Version/dist-tag derivation: tagged release (`prod`) → tag version under `latest`; branch/MR → `0.0.0-<branch-slug>-<sha>` under `canary` (branches `next`/`beta` publish under their own dist-tag).
-- Requires the `NPM_TOKEN` secret (managed like any catladder secret). Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
+- Auth: the `NPM_TOKEN` secret (managed like any catladder secret), or — on github — **trusted publishing** with no stored token: register the package's trusted publisher on npmjs.com with the repo and the publishing **workflow filename** (`catladder-release.yml` for tagged releases). npm allows one trusted publisher per package, so canary publishes from the main/review workflows still need `NPM_TOKEN`. A set token always wins over OIDC.
+- Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
 
 ## `pages`
 
-- `type: "pages"` — **required**. Publishes a static site on gitlab pages (not yet supported on the github backend).
+- `type: "pages"` — **required**. Publishes a static site on gitlab pages or github pages. On github the repo's Pages source must be set to "GitHub Actions" once; per-merge-request previews are gitlab-only (github serves one site per repository).
 - `script: string[]` — **required**; produces the site.
 - `publishDir?: string` — output directory relative to the repo root, default `"public"`.
 - `requiresInstall?: boolean` — run the package-manager install (yarn/pnpm) first (`requiresYarnInstall` is a deprecated alias).