@catladder/cli 0.0.0-next-78d43d4a → 0.0.0-next-dbb75f51

package/dist/packages/pipeline/src/types/hooks.d.ts

@@ -29,7 +29,7 @@ type MaybePromise<T> = T | Promise<T>;
  * them silently. Prefer a first-class config option whenever one exists.
  *
  * If you need a hook, please raise an issue on
- * https://git.panter.ch/catladder/catladder/-/issues describing the use
+ * https://github.com/panter/catladder/issues describing the use
  * case. This feedback helps us generalize it into a supported feature.
  */
 export type Hooks = {

package/dist/packages/pipeline/src/types/jobDefinition.d.ts

@@ -4,7 +4,7 @@ export type AppBuildJobDefinition = Partial<Omit<CatladderJobSpec, "artifacts" |
     cache?: CacheConfig[];
 };
 export type DockerBuildJobDefinition = AppBuildJobDefinition;
-export type DeployJobDefinition = Pick<CatladderJobSpec, "script" | "variables" | "image" | "artifacts" | "services" | "runnerVariables" | "allow_failure" | "pages"> & {
+export type DeployJobDefinition = Pick<CatladderJobSpec, "script" | "variables" | "image" | "artifacts" | "services" | "runnerVariables" | "allow_failure" | "pages" | "idToken"> & {
     cache?: CacheConfig[];
 };
 export type StopJobDefinition = Pick<CatladderJobSpec, "script" | "variables" | "image" | "runnerVariables">;

package/dist/packages/pipeline/src/types/jobs.d.ts

@@ -152,6 +152,15 @@ export type CatladderJobCore<S = BaseStage> = {
      * declares that this job interacts with a deployment environment
      */
     environment?: CatladderJobEnvironmentConfig;
+    /**
+     * the job needs a workload-identity token from the CI system, to
+     * authenticate against a third party without a stored secret (e.g.
+     * npm trusted publishing).
+     *
+     * Lowered by the github backend to `permissions: id-token: write`.
+     * Ignored on gitlab, whose ID tokens are configured per job instead.
+     */
+    idToken?: boolean;
     /**
      * variables to pass
      */

package/dist/packages/pipeline/src/types/jobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/jobs.ts"],"names":[],"mappings":";;;AAIA,8DAA2D;AAsB9C,QAAA,WAAW,GAAG;IACzB,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;CACE,CAAC;AAWE,QAAA,YAAY,GAAG;IAC1B,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,YAAY;CACJ,CAAC;AA6NX;;;;;;;GAOG;AACH,4JAA4J;AAC5J,MAAa,YAAY;IACvB,YAAY,IAAyB;QACnC,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAe,EAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,IAAI,CACT,GAAkD;QAElD,OAAO,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;CACF;AAZD,oCAYC"}
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/jobs.ts"],"names":[],"mappings":";;;AAIA,8DAA2D;AAsB9C,QAAA,WAAW,GAAG;IACzB,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;CACE,CAAC;AAWE,QAAA,YAAY,GAAG;IAC1B,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,YAAY;CACJ,CAAC;AAuOX;;;;;;;GAOG;AACH,4JAA4J;AAC5J,MAAa,YAAY;IACvB,YAAY,IAAyB;QACnC,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAe,EAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,IAAI,CACT,GAAkD;QAElD,OAAO,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;CACF;AAZD,oCAYC"}

package/dist/packages/pipeline/src/utils/writeFiles.d.ts

@@ -4,6 +4,12 @@ import type { BaseHookContext } from "../types/hooks";
 type WriteFileOptions = {
     commentChar: string;
 };
+/**
+ * the line that marks a file as catladder-generated. Cleanup code uses
+ * it to tell a generated file apart from a hand-maintained one at the
+ * same path (e.g. a `.gitlab-ci.yml` a project wrote itself).
+ */
+export declare const GENERATED_FILE_MARKER = "\uD83D\uDC31 \uD83D\uDD28 This file is generated by catladder";
 type StringifyOptions = Exclude<Parameters<typeof stringify>[2], null | undefined | string | number>;
 export declare const yamlStringifyOptions: StringifyOptions;
 export declare class FileWriter {

package/dist/packages/pipeline/src/utils/writeFiles.js

@@ -1,8 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FileWriter = exports.yamlStringifyOptions = void 0;
+exports.FileWriter = exports.yamlStringifyOptions = exports.GENERATED_FILE_MARKER = void 0;
 const promises_1 = require("fs/promises");
 const yaml_1 = require("yaml");
+/**
+ * the line that marks a file as catladder-generated. Cleanup code uses
+ * it to tell a generated file apart from a hand-maintained one at the
+ * same path (e.g. a `.gitlab-ci.yml` a project wrote itself).
+ */
+exports.GENERATED_FILE_MARKER = "🐱 🔨 This file is generated by catladder";
 exports.yamlStringifyOptions = {
     // prevents colapsing long command statements into multiple lines
     lineWidth: 0,
@@ -62,7 +68,7 @@ class FileWriter {
     getAutoGeneratedHeader(commentChar) {
         return [
             "-------------------------------------------------",
-            `🐱 🔨 This file is generated by catladder`,
+            exports.GENERATED_FILE_MARKER,
             `🚨 Do not edit this file manually 🚨`,
             "-------------------------------------------------",
         ]

package/dist/packages/pipeline/src/utils/writeFiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"writeFiles.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/utils/writeFiles.ts"],"names":[],"mappings":";;;AAAA,0CAAwC;AACxC,+BAAiC;AAYpB,QAAA,oBAAoB,GAAqB;IACpD,iEAAiE;IACjE,SAAS,EAAE,CAAC;IACZ,4DAA4D;IAC5D,kBAAkB,EAAE,IAAI;IACxB,qEAAqE;IACrE,WAAW,EAAE,IAAI;CAClB,CAAC;AAEF,MAAa,UAAU;IACd,MAAM,CAAC,MAAM,CAAC,MAAc;QACjC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,OAAe;;QACxD,MAAM,kBAAkB,GACtB,MAAM,CAAA,MAAA,MAAA,IAAI,CAAC,MAAM,CAAC,KAAK,0CAAE,wBAAwB,mDAAG;YAClD,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO;SACR,CAAC,CAAA,CAAC;QACL,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,kBAAkB,aAAlB,kBAAkB,cAAlB,kBAAkB,GAAI,OAAO,EAAE;YACnD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,kBAAkB,CAAC,IAAY;;QAC7C,MAAM,QAAQ,GAAG,MAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,mCAAI,EAAE,CAAC;QAC7C,OAAO;YACL,QAAQ;YACR,IAAI;YACJ,SAAS,EAAE,MAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,mCAAI,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAY,EAAE,OAAe;QAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,OAAe,EACf,OAAyB;QAEzB,MAAM,IAAI,CAAC,YAAY,CACrB,IAAI,EACJ,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,IAAS;;QAChD,MAAM,eAAe,GAAG,MAAM,CAAA,MAAA,MAAA,IAAI,CAAC,MAAM,CAAC,KAAK,0CAAE,wBAAwB,mDACvE;YACE,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI;SACL,CACF,CAAA,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAC5B,IAAI,EACJ,IAAA,gBAAS,EAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,IAAI,EAAE,4BAAoB,CAAC,EACxD;YACE,WAAW,EAAE,GAAG;SACjB,CACF,CAAC;IACJ,CAAC;IAES,sBAAsB,CAAC,WAAmB;QAClD,OAAO;YACL,mDAAmD;YACnD,2CAA2C;YAC3C,sCAAsC;YACtC,mDAAmD;SACpD;aACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;aACvC,IAAI,CAAC,IAAI,CAAC;aACV,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF;AA5ED,gCA4EC"}
+{"version":3,"file":"writeFiles.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/utils/writeFiles.ts"],"names":[],"mappings":";;;AAAA,0CAAwC;AACxC,+BAAiC;AAQjC;;;;GAIG;AACU,QAAA,qBAAqB,GAChC,2CAA2C,CAAC;AAMjC,QAAA,oBAAoB,GAAqB;IACpD,iEAAiE;IACjE,SAAS,EAAE,CAAC;IACZ,4DAA4D;IAC5D,kBAAkB,EAAE,IAAI;IACxB,qEAAqE;IACrE,WAAW,EAAE,IAAI;CAClB,CAAC;AAEF,MAAa,UAAU;IACd,MAAM,CAAC,MAAM,CAAC,MAAc;QACjC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,OAAe;;QACxD,MAAM,kBAAkB,GACtB,MAAM,CAAA,MAAA,MAAA,IAAI,CAAC,MAAM,CAAC,KAAK,0CAAE,wBAAwB,mDAAG;YAClD,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO;SACR,CAAC,CAAA,CAAC;QACL,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,kBAAkB,aAAlB,kBAAkB,cAAlB,kBAAkB,GAAI,OAAO,EAAE;YACnD,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;IACL,CAAC;IAES,KAAK,CAAC,kBAAkB,CAAC,IAAY;;QAC7C,MAAM,QAAQ,GAAG,MAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,mCAAI,EAAE,CAAC;QAC7C,OAAO;YACL,QAAQ;YACR,IAAI;YACJ,SAAS,EAAE,MAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,mCAAI,EAAE;SACvC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,qBAAqB,CAAC,IAAY,EAAE,OAAe;QAC9D,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAEM,KAAK,CAAC,kBAAkB,CAC7B,IAAY,EACZ,OAAe,EACf,OAAyB;QAEzB,MAAM,IAAI,CAAC,YAAY,CACrB,IAAI,EACJ,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CACvE,CAAC;IACJ,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,IAAS;;QAChD,MAAM,eAAe,GAAG,MAAM,CAAA,MAAA,MAAA,IAAI,CAAC,MAAM,CAAC,KAAK,0CAAE,wBAAwB,mDACvE;YACE,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI;SACL,CACF,CAAA,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,CAC5B,IAAI,EACJ,IAAA,gBAAS,EAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,IAAI,EAAE,4BAAoB,CAAC,EACxD;YACE,WAAW,EAAE,GAAG;SACjB,CACF,CAAC;IACJ,CAAC;IAES,sBAAsB,CAAC,WAAmB;QAClD,OAAO;YACL,mDAAmD;YACnD,6BAAqB;YACrB,sCAAsC;YACtC,mDAAmD;SACpD;aACE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,WAAW,IAAI,IAAI,EAAE,CAAC;aACvC,IAAI,CAAC,IAAI,CAAC;aACV,MAAM,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;CACF;AA5ED,gCA4EC"}

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/README.md

@@ -1,6 +1,6 @@
 # The panter chart
 
-**Main chart used in https://git.panter.ch/catladder/gitlab-ci/ **
+**The default chart catladder deploys kubernetes components with.**
 
 Developing helm charts can be complex and they tend to be very verbose.
 Our goal is therefore to provide a common chart that provides all functionalities that you might need
@@ -21,4 +21,4 @@ This way we avoid having complexity in the projects and make it easier to share
 - support for namespace secrets and custom env-vars (using catladder-shell and gitlab-ci)
 - optional prisam1 (_deprecated, prisma2 does not need a separate instance anymore_)
 
-See https://git.panter.ch/catladder/catladder/ for usage information
+See https://github.com/panter/catladder for usage information

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/templates/_helpers.tpl

@@ -190,13 +190,3 @@ env:
 
 
 
-{{- define "visualReviewSnippet" -}}
-  <script
-    data-project-id='{{.Values.gitlab.projectId}}'
-    data-merge-request-id='{{.Values.gitlab.mergeRequestId}}'
-    data-mr-url='https://git.panter.ch'
-    data-project-path='{{.Values.gitlab.projectPath}}'
-    id='review-app-toolbar-script'
-    src='https://git.panter.ch/assets/webpack/visual_review_toolbar.js'>
-  </script>
-{{- end -}}

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/templates/app.ingress.yaml

@@ -16,11 +16,6 @@ metadata:
     nginx.ingress.kubernetes.io/rewrite-target: /$1  
     nginx.ingress.kubernetes.io/configuration-snippet: |
       more_set_headers "x-build-id: {{ .Values.global.BUILD_ID }}";
-    {{- if and .Values.gitlab.visualReviewEnabled (and  .Values.global.ENV_SHORT (eq .Values.global.ENV_SHORT "review"))}}
-      proxy_set_header Accept-Encoding ""; 
-      sub_filter_once on;
-      sub_filter "</head>" "{{- include "visualReviewSnippet" . | nindent 8 -}}</head>";
-    {{- end }}
   {{- range $key, $value := .Values.ingress.annotations }}
     {{ $key }}: {{ $value | quote }}
   {{- end }}

package/dist/runner-images/kubernetes/helm-charts/the-panter-chart/values.yaml

@@ -112,7 +112,6 @@ application:
     successThreshold: 1
 
 gitlab:
-  visualReviewEnabled: false
   app:
   env:
   projectPath:

package/dist/runner-images/npm-publish/Dockerfile

@@ -0,0 +1,12 @@
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git
+
+# npm trusted publishing (OIDC) needs npm >= 11.5.1; the npm bundled
+# with the node image is not guaranteed to be new enough, so pin the
+# major explicitly. Without it npm silently falls back to token auth.
+RUN npm install -g npm@11
+
+# no publish logic baked in: it lives in catci, which pipeline
+# generation materializes into the repository checkout
+# (.catladder-generated/catci)

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -45,10 +45,11 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
   # is gitlab-specific)
   PUBLISH_PLUGIN=""
 else
+  # no gitlabUrl: the plugin derives it from the CI-provided variables
+  # of the running instance. It used to be hardcoded to panter's gitlab,
+  # which broke the release on every other instance.
   PUBLISH_PLUGIN=',
-    ["@semantic-release/gitlab", {
-      "gitlabUrl": "https://git.panter.ch"
-    }]'
+    "@semantic-release/gitlab"'
 fi
 
 if [ ! -e .releaserc ]; then

package/dist/skills/catladder-config/SKILL.md

@@ -103,7 +103,7 @@ first.
 a dev needs `customJobs` or a transform hook, it almost always means
 catladder is missing a capability that other projects will need too.
 **Open an issue at
-https://git.panter.ch/catladder/catladder/-/issues** describing the use
+https://github.com/panter/catladder/issues** describing the use
 case (what you're trying to achieve and why the existing config can't
 express it) so it can be generalized into a supported feature — and,
 where possible, offer to help the dev write that issue. The goal is for

package/dist/skills/catladder-deploys/references/deploy-types.md

@@ -54,11 +54,12 @@ resources with `yarn catladder project setup`; detect drift with
 - `registry?: string` — registry url, default `https://registry.npmjs.org/`.
 - `distTag?: string` — overrides the derived dist-tag.
 - Version/dist-tag derivation: tagged release (`prod`) → tag version under `latest`; branch/MR → `0.0.0-<branch-slug>-<sha>` under `canary` (branches `next`/`beta` publish under their own dist-tag).
-- Requires the `NPM_TOKEN` secret (managed like any catladder secret). Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
+- Auth: the `NPM_TOKEN` secret (managed like any catladder secret), or — on github — **trusted publishing** with no stored token: register the package's trusted publisher on npmjs.com with the repo and the publishing **workflow filename** (`catladder-release.yml` for tagged releases). npm allows one trusted publisher per package, so canary publishes from the main/review workflows still need `NPM_TOKEN`. A set token always wins over OIDC.
+- Disable staging on the component (`env: { stage: false }`) so tagged releases publish directly.
 
 ## `pages`
 
-- `type: "pages"` — **required**. Publishes a static site on gitlab pages (not yet supported on the github backend).
+- `type: "pages"` — **required**. Publishes a static site on gitlab pages or github pages. On github the repo's Pages source must be set to "GitHub Actions" once; per-merge-request previews are gitlab-only (github serves one site per repository).
 - `script: string[]` — **required**; produces the site.
 - `publishDir?: string` — output directory relative to the repo root, default `"public"`.
 - `requiresInstall?: boolean` — run the package-manager install (yarn/pnpm) first (`requiresYarnInstall` is a deprecated alias).