@catladder/cli 0.0.0-next-78f04d3f → 0.0.0-next-ddc387fe

package/dist/bundles/catenv/index.js

@@ -1902,6 +1902,14 @@ class VariableValueContainingReferences {
                 ? []
                 : [part]);
     }
+    /**
+     * concats values to this one and returns a new VariableValueContainingReferences.
+     * mirrors String.prototype.concat / BashExpression.concat so a VariableValue
+     * can be extended regardless of its concrete type
+     */
+    concat(...values) {
+        return new VariableValueContainingReferences([...this.parts, ...values]);
+    }
     toString(options = {
         quotes: false,
     }) {
@@ -1951,16 +1959,18 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.resolveAllReferences = void 0;
 const VariableValueContainingReferences_1 = __nccwpck_require__(70795);
 const resolveAllReferencesOnce_1 = __nccwpck_require__(98690);
+const hasUnresolvedReferences = (value) => value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences &&
+    value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference);
 const resolveAllReferences = async (values, getEnvVars) => {
     // replace until there aren't any references left
     let result = values;
     let i = 0;
-    while (Object.values(result).some((value) => value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference))) {
+    while (Object.values(result).some(hasUnresolvedReferences)) {
         const replaced = await (0, resolveAllReferencesOnce_1.resolveAllReferencesOnce)(result, getEnvVars);
         result = replaced;
         i++;
         if (i > 1000) {
-            const unresolved = Object.entries(result).filter(([key, value]) => value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference));
+            const unresolved = Object.entries(result).filter(([key, value]) => hasUnresolvedReferences(value));
             throw new Error("Infinite loop detected in these variables: " +
                 unresolved
                     .map(([key, value]) => `${key} (last reference: ${value.parts.find((part) => part instanceof VariableValueContainingReferences_1.VariableReference)})`)
@@ -1984,7 +1994,9 @@ exports.resolveAllReferencesOnce = void 0;
 const VariableValueContainingReferences_1 = __nccwpck_require__(70795);
 const resolveReferencesOnce_1 = __nccwpck_require__(29767);
 const resolveAllReferencesOnce = async (values, getEnvVars) => {
-    const allReferences = Object.values(values).flatMap((value) => value === null || value === void 0 ? void 0 : value.parts.filter((part) => part instanceof VariableValueContainingReferences_1.VariableReference));
+    const allReferences = Object.values(values).flatMap((value) => value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences
+        ? value.parts.filter((part) => part instanceof VariableValueContainingReferences_1.VariableReference)
+        : []);
     const allComponentsUnique = Array.from(new Set(allReferences.map((reference) => reference.componentName)));
     const allEnvVarsInComponents = Object.fromEntries(await Promise.all(allComponentsUnique.map(async (componentName) => [
         componentName,
@@ -1992,7 +2004,7 @@ const resolveAllReferencesOnce = async (values, getEnvVars) => {
     ])));
     return Object.fromEntries(Object.entries(values).map(([key, value]) => [
         key,
-        value !== null && value !== undefined
+        value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences
             ? (0, resolveReferencesOnce_1.resolveReferencesOnce)(value, ({ componentName, variableName }) => {
                 return allEnvVarsInComponents[componentName][variableName];
             })
@@ -2276,9 +2288,8 @@ const ciVariables_1 = __nccwpck_require__(88393);
 const index_1 = __nccwpck_require__(68906);
 const createGithubJobs_1 = __nccwpck_require__(57877);
 const jobImagesPlan_1 = __nccwpck_require__(47864);
-const scriptFunctions_1 = __nccwpck_require__(79252);
+const ensureImageJobs_1 = __nccwpck_require__(70051);
 const shippedCatci_1 = __nccwpck_require__(79024);
-const utils_1 = __nccwpck_require__(24516);
 const githubReleaseJobs_1 = __nccwpck_require__(89800);
 const scriptFiles_1 = __nccwpck_require__(30966);
 const WORKFLOWS_FOLDER = ".github/workflows";
@@ -2287,9 +2298,13 @@ const WORKFLOWS_FOLDER = ".github/workflows";
  * user-maintained workflows in the same folder
  */
 const GENERATED_FILE_PREFIX = "catladder-";
+// NOTE on the emoji prefixes: github sorts the Actions sidebar by raw
+// code point, so the 🛠️ (U+1F6E0) prefix makes the pipeline workflows
+// sort BELOW the triggerable action workflows (↩️ ⏹️ ▶️ 🚀, all lower
+// code points) — the things a human clicks come first.
 const TRIGGER_WORKFLOWS = {
     mr: {
-        name: "catladder review",
+        name: "🛠️ catladder review",
         on: { pull_request: { types: ["opened", "synchronize", "reopened"] } },
         concurrency: {
             group: "catladder-review-${{ github.event.number }}",
@@ -2297,12 +2312,12 @@ const TRIGGER_WORKFLOWS = {
         },
     },
     mainBranch: {
-        name: "catladder main",
+        name: "🛠️ catladder main",
         // TODO: make the default branch configurable
         on: { push: { branches: ["main"] } },
     },
     taggedRelease: {
-        name: "catladder release",
+        name: "🛠️ catladder release",
         // tags pushed with the default GITHUB_TOKEN (as the release job
         // does) don't trigger `on: push: tags` — the release job therefore
         // also dispatches this workflow explicitly for the new tag
@@ -2352,15 +2367,18 @@ class GithubBackend {
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
         const reviewStopJobs = {};
-        // jobs routed to the workflow_dispatch "manual tasks" workflow. A
-        // manual job and its build closure live here instead of an automatic
-        // workflow; `manualJobConditions` is the `if` that selects each one
-        // from the dispatch input, `manualDispatchOptions` the leaf jobs that
-        // become dropdown choices (closure jobs run because their leaf was
-        // chosen, not on their own).
-        const manualJobs = {};
-        const manualJobConditions = {};
-        const manualDispatchOptions = [];
+        // jobs routed to the per-kind workflow_dispatch workflows (deploy /
+        // stop / rollback). A manual job and its build closure live there
+        // instead of an automatic workflow; `conditions` is the `if` that
+        // selects each one from the dispatch input, `options` the leaf jobs
+        // that become dropdown choices (closure jobs run because their leaf
+        // was chosen, not on their own). A closure job serving leaves of
+        // several kinds is duplicated into each kind's workflow.
+        const manualKindBuckets = {
+            deploy: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+            stop: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+            rollback: { jobs: {}, conditions: {}, options: [], envTypes: [] },
+        };
         for (const trigger of config_1.ALL_PIPELINE_TRIGGERS) {
             const allJobs = await (0, createAllJobs_1.createAllJobs)({
                 config,
@@ -2437,32 +2455,46 @@ class GithubBackend {
                     }
                 }
             }
+            const kindOfLeaf = new Map(leafIds.map((id) => [id, manualKind(triggerJobs.get(id).job)]));
             const jobs = {};
             for (const [id, { githubJob }] of triggerJobs) {
                 const leaves = servesLeaves.get(id);
                 if (leaves) {
-                    manualJobs[id] = githubJob;
-                    manualJobConditions[id] = [...leaves]
-                        .sort()
-                        .map((leaf) => `inputs.job == '${leaf}'`)
-                        .join(" || ");
+                    // one entry per kind the job serves — restricted to that
+                    // kind's leaves, so the `if` only references its own inputs
+                    for (const kind of new Set([...leaves].map((leaf) => kindOfLeaf.get(leaf)))) {
+                        const bucket = manualKindBuckets[kind];
+                        bucket.jobs[id] = githubJob;
+                        bucket.conditions[id] = [...leaves]
+                            .filter((leaf) => kindOfLeaf.get(leaf) === kind)
+                            .sort()
+                            .map((leaf) => `inputs.job == '${leaf}'`)
+                            .join(" || ");
+                    }
                 }
                 else {
                     jobs[id] = githubJob;
                 }
             }
-            manualDispatchOptions.push(...leafIds);
+            for (const id of leafIds) {
+                const bucket = manualKindBuckets[kindOfLeaf.get(id)];
+                bucket.options.push(id);
+                const context = triggerJobs.get(id).context;
+                if (context.type === "component") {
+                    bucket.envTypes.push(context.environment.envType);
+                }
+            }
             if (trigger === "mr") {
                 Object.assign(jobs, (0, githubReleaseJobs_1.getGithubReleaseCheckJobs)(config, images));
             }
             if (trigger === "mainBranch") {
-                const releaseJobs = (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs), images);
-                Object.assign(jobs, releaseJobs.main);
-                for (const [id, job] of Object.entries(releaseJobs.manual)) {
-                    manualJobs[id] = job;
-                    manualJobConditions[id] = `inputs.job == '${id}'`;
-                    manualDispatchOptions.push(id);
-                }
+                // auto release mode: the release job runs at the end of the
+                // main workflow itself
+                Object.assign(jobs, (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs), images));
+                // the dispatch workflow to trigger a release by hand (with a
+                // force checkbox where the method distinguishes it)
+                workflows[`${GENERATED_FILE_PREFIX}create-release.yml`] =
+                    (0, githubReleaseJobs_1.getGithubCreateReleaseWorkflow)(config, images, workflowEnv);
                 // manual release mode: the workflow that runs a queued release
                 // once the main workflow completed green
                 const releaseOnGreen = (0, githubReleaseJobs_1.getGithubReleaseOnGreenWorkflow)(config, images, TRIGGER_WORKFLOWS.mainBranch.name, workflowEnv);
@@ -2476,41 +2508,59 @@ class GithubBackend {
                     ...TRIGGER_WORKFLOWS[trigger],
                     ...workflowPermissions(images),
                     env: workflowEnv,
-                    jobs: { ...makeEnsureImageGithubJobs(images), ...jobs },
+                    jobs: { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...jobs },
                 };
             }
         }
         if (Object.keys(reviewStopJobs).length > 0) {
             workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = {
-                name: "catladder review stop",
+                name: "🛠️ catladder review stop",
                 on: { pull_request: { types: ["closed"] } },
                 ...workflowPermissions(images),
                 env: workflowEnv,
-                jobs: { ...makeEnsureImageGithubJobs(images), ...reviewStopJobs },
+                jobs: { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...reviewStopJobs },
             };
         }
-        if (Object.keys(manualJobs).length > 0) {
-            workflows[`${GENERATED_FILE_PREFIX}manual.yml`] = {
-                name: "catladder manual tasks",
+        for (const [kind, bucket] of Object.entries(manualKindBuckets)) {
+            if (Object.keys(bucket.jobs).length === 0) {
+                continue;
+            }
+            const options = [...new Set(bucket.options)];
+            // a single candidate needs no dropdown — the dispatch just runs it
+            const singleTask = options.length === 1;
+            // one common env across the kind's tasks → carry it in the name
+            // ("▶️ catladder deploy prod"); mixed envs keep the generic name
+            // and the dropdown distinguishes
+            const envTypes = [...new Set(bucket.envTypes)];
+            const envSuffix = envTypes.length === 1 &&
+                bucket.envTypes.length === bucket.options.length
+                ? ` ${envTypes[0]}`
+                : "";
+            workflows[`${GENERATED_FILE_PREFIX}${kind}.yml`] = {
+                name: `${MANUAL_KIND_WORKFLOW_NAMES[kind]}${envSuffix}`,
                 on: {
-                    workflow_dispatch: {
-                        inputs: {
-                            job: {
-                                description: "the task to run",
-                                required: true,
-                                type: "choice",
-                                options: [...new Set(manualDispatchOptions)],
+                    workflow_dispatch: singleTask
+                        ? {}
+                        : {
+                            inputs: {
+                                job: {
+                                    description: "the task to run",
+                                    required: true,
+                                    type: "choice",
+                                    options,
+                                },
                             },
                         },
-                    },
                 },
                 ...workflowPermissions(images),
                 env: workflowEnv,
                 jobs: {
-                    ...makeEnsureImageGithubJobs(images),
-                    ...Object.fromEntries(Object.entries(manualJobs).map(([id, job]) => [
+                    ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images),
+                    ...Object.fromEntries(Object.entries(bucket.jobs).map(([id, job]) => [
                         id,
-                        { ...job, if: `\${{ ${manualJobConditions[id]} }}` },
+                        singleTask
+                            ? job
+                            : { ...job, if: `\${{ ${bucket.conditions[id]} }}` },
                     ])),
                 },
             };
@@ -2525,33 +2575,6 @@ exports.GithubBackend = GithubBackend;
 const workflowPermissions = (_images) => ({
     permissions: { contents: "read", packages: "write" },
 });
-/**
- * the image build jobs: always run (github has no server-side
- * changes-filter), the existence check makes unchanged runs fast.
- * Docker is native on github runners — no container, no dind.
- */
-const makeEnsureImageGithubJobs = (images) => Object.fromEntries(images.getEnsureJobs().map((job) => {
-    var _a, _b;
-    return [
-        (0, createGithubJobs_1.githubGlobalJobId)(job.name),
-        {
-            name: job.name,
-            "runs-on": "ubuntu-latest",
-            steps: [
-                { name: "Checkout", uses: "actions/checkout@v4" },
-                {
-                    name: job.name,
-                    id: "main",
-                    run: [
-                        ...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(),
-                        ...((_b = (_a = job.script) === null || _a === void 0 ? void 0 : _a.filter(utils_1.notNil)) !== null && _b !== void 0 ? _b : []),
-                    ].join("\n"),
-                    shell: "bash",
-                },
-            ],
-        },
-    ];
-}));
 const workflowFileName = (trigger) => {
     switch (trigger) {
         case "mr":
@@ -2575,10 +2598,20 @@ const isReviewStopJob = (context, job) => {
 };
 /**
  * stop/rollback jobs of non-review environments have no automatic
- * trigger; they are collected in a workflow_dispatch workflow
+ * trigger; they are collected in workflow_dispatch workflows
  * (gitlab runs them as manual jobs inside the pipeline)
  */
 const isManualTaskJob = (job) => job.stage === "stop" || job.stage === "rollback";
+const MANUAL_KIND_WORKFLOW_NAMES = {
+    deploy: "▶️ catladder deploy",
+    stop: "⏹️ catladder stop",
+    rollback: "↩️ catladder rollback",
+};
+const manualKind = (job) => job.stage === "stop"
+    ? "stop"
+    : job.stage === "rollback"
+        ? "rollback"
+        : "deploy";
 //# sourceMappingURL=GithubBackend.js.map
 
 /***/ }),
@@ -3008,17 +3041,78 @@ exports.getUploadProviderIds = getUploadProviderIds;
 
 /***/ }),
 
+/***/ 70051:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.makeEnsureImageGithubJobs = void 0;
+const createGithubJobs_1 = __nccwpck_require__(57877);
+const scriptFunctions_1 = __nccwpck_require__(79252);
+const utils_1 = __nccwpck_require__(24516);
+/**
+ * the image build jobs: always run (github has no server-side
+ * changes-filter), the existence check makes unchanged runs fast.
+ * Docker is native on github runners — no container, no dind.
+ * `only` restricts to the named images (e.g. the create-release
+ * workflow needs just the release image).
+ */
+const makeEnsureImageGithubJobs = (images, options = {}) => Object.fromEntries(images
+    .getEnsureJobs()
+    .filter((job) => !options.only || options.only.includes(job.name))
+    .map((job) => {
+    var _a, _b;
+    return [
+        (0, createGithubJobs_1.githubGlobalJobId)(job.name),
+        {
+            name: job.name,
+            "runs-on": "ubuntu-latest",
+            steps: [
+                { name: "Checkout", uses: "actions/checkout@v4" },
+                {
+                    name: job.name,
+                    id: "main",
+                    run: [
+                        ...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(),
+                        ...((_b = (_a = job.script) === null || _a === void 0 ? void 0 : _a.filter(utils_1.notNil)) !== null && _b !== void 0 ? _b : []),
+                    ].join("\n"),
+                    shell: "bash",
+                },
+            ],
+        },
+    ];
+}));
+exports.makeEnsureImageGithubJobs = makeEnsureImageGithubJobs;
+//# sourceMappingURL=ensureImageJobs.js.map
+
+/***/ }),
+
 /***/ 89800:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGithubReleaseCheckJobs = exports.getGithubReleaseOnGreenWorkflow = exports.getGithubReleaseJobs = void 0;
+exports.getGithubReleaseCheckJobs = exports.getGithubReleaseOnGreenWorkflow = exports.getGithubCreateReleaseWorkflow = exports.getGithubReleaseJobs = void 0;
 const createGithubJobs_1 = __nccwpck_require__(57877);
+const ensureImageJobs_1 = __nccwpck_require__(70051);
 const release_1 = __nccwpck_require__(38904);
 const shippedCatci_1 = __nccwpck_require__(79024);
 const CATCI = `${shippedCatci_1.GENERATED_CATCI_FOLDER}/index.js`;
+/**
+ * the build job of the release image only — the create-release
+ * dispatch workflow needs no other image (empty for external images)
+ */
+const makeReleaseImageEnsureJobs = (config, images) => {
+    const resolved = images.resolveRef({
+        catladderImage: (0, release_1.getReleaseMethod)(config).image,
+    });
+    if (!resolved.need || typeof resolved.need !== "object") {
+        return {};
+    }
+    return (0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images, { only: [resolved.need.job] });
+};
 const createReleaseJob = (config, images, options = {}) => {
     var _a;
     const method = (0, release_1.getReleaseMethod)(config);
@@ -3072,6 +3166,7 @@ const createReleaseJob = (config, images, options = {}) => {
                     {
                         name: "check main workflow",
                         id: "queue",
+                        ...(options.queueCheckIf ? { if: options.queueCheckIf } : {}),
                         run: `node ${CATCI} release github-queue-check`,
                         shell: "bash",
                     },
@@ -3089,51 +3184,75 @@ const createReleaseJob = (config, images, options = {}) => {
     };
 };
 /**
- * the release jobs for the github backend (the counterpart of the
- * gitlab release jobs):
- * - releases.when === "auto": the release job runs in the main-branch
- *   workflow after all other jobs; a force variant goes to the manual
- *   tasks workflow
- * - otherwise (manual, the default): the release job goes to the
- *   manual tasks workflow. Its queue-check step releases right away on
- *   a green main run and otherwise queues the release for the
- *   release-on-green workflow (see getGithubReleaseOnGreenWorkflow) —
- *   the counterpart of gitlab's queue button + executor pair.
+ * the release jobs of the main-branch workflow: with releases.when ===
+ * "auto" the release runs at the end of every main workflow run.
+ * Manual releasing happens via the create-release dispatch workflow
+ * (see getGithubCreateReleaseWorkflow) instead.
  */
 const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
     var _a;
-    const method = (0, release_1.getReleaseMethod)(config);
-    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
-        return {
-            main: {
-                "create-release": createReleaseJob(config, images, {
-                    needs: mainWorkflowJobIds,
-                }),
-            },
-            manual: {
-                "force-create-release": createReleaseJob(config, images, {
-                    extraEnv: method.forceReleaseVariables,
-                }),
-            },
-        };
+    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) !== "auto") {
+        return {};
     }
     return {
-        main: {},
-        manual: {
-            "create-release": createReleaseJob(config, images, { queueCheck: true }),
-            // an explicit force option wherever the method distinguishes it
-            // (e.g. changesets: release a patch bump without changesets)
-            ...(method.forceReleaseVariables
+        "create-release": createReleaseJob(config, images, {
+            needs: mainWorkflowJobIds,
+        }),
+    };
+};
+exports.getGithubReleaseJobs = getGithubReleaseJobs;
+/**
+ * the dispatch workflow to trigger a release by hand — a first-class
+ * entry in the Actions sidebar (the counterpart of gitlab's `create
+ * release` button). Its queue-check step releases right away when the
+ * main workflow run for HEAD is green and otherwise queues the release
+ * for the release-on-green workflow. Where the release method
+ * distinguishes a force mode (e.g. changesets: release a patch bump
+ * without pending changesets), forcing is a checkbox input — a forced
+ * release skips the queue-check and releases immediately, whatever the
+ * pipeline state.
+ */
+const getGithubCreateReleaseWorkflow = (config, images, workflowEnv) => {
+    const method = (0, release_1.getReleaseMethod)(config);
+    const forceVariables = method.forceReleaseVariables;
+    const job = createReleaseJob(config, images, {
+        queueCheck: true,
+        ...(forceVariables
+            ? {
+                queueCheckIf: "${{ !inputs.force }}",
+                // only effective when the force checkbox is ticked
+                extraEnv: Object.fromEntries(Object.entries(forceVariables).map(([key, value]) => [
+                    key,
+                    `\${{ inputs.force && '${value}' || '' }}`,
+                ])),
+            }
+            : {}),
+    });
+    return {
+        name: "🚀 catladder create release",
+        on: {
+            workflow_dispatch: forceVariables
                 ? {
-                    "force-create-release": createReleaseJob(config, images, {
-                        extraEnv: method.forceReleaseVariables,
-                    }),
+                    inputs: {
+                        force: {
+                            description: "force: release even without pending changes (patch bump), ignoring the pipeline state",
+                            required: false,
+                            type: "boolean",
+                            default: false,
+                        },
+                    },
                 }
-                : {}),
+                : {},
+        },
+        permissions: { contents: "read", packages: "write" },
+        env: workflowEnv,
+        jobs: {
+            ...makeReleaseImageEnsureJobs(config, images),
+            "create-release": job,
         },
     };
 };
-exports.getGithubReleaseJobs = getGithubReleaseJobs;
+exports.getGithubCreateReleaseWorkflow = getGithubCreateReleaseWorkflow;
 /**
  * the release-on-green workflow (manual release mode only): runs on
  * every completed main workflow run. A lightweight host job checks the
@@ -3152,7 +3271,7 @@ const getGithubReleaseOnGreenWorkflow = (config, images, mainWorkflowName, workf
         return null;
     }
     return {
-        name: "catladder release on green",
+        name: "🛠️ catladder release on green",
         on: {
             workflow_run: {
                 workflows: [mainWorkflowName],
@@ -6929,7 +7048,9 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
         const additionalEnvVars = deployConfigRaw
             ? deploy_1.DEPLOY_TYPES[deployConfigRaw.type].getAdditionalEnvVars(environmentContext)
             : {};
-        const HOSTNAME_INTERNAL = (_b = additionalEnvVars.HOSTNAME_INTERNAL) !== null && _b !== void 0 ? _b : "unknown-host.example.com";
+        // deploy types provide HOSTNAME_INTERNAL as a plain string or bash
+        // expression (never containing references)
+        const HOSTNAME_INTERNAL = ((_b = additionalEnvVars.HOSTNAME_INTERNAL) !== null && _b !== void 0 ? _b : "unknown-host.example.com");
         host = (_c = envConfigRaw === null || envConfigRaw === void 0 ? void 0 : envConfigRaw.host) !== null && _c !== void 0 ? _c : HOSTNAME_INTERNAL;
         url = (0, bash_1.joinBashExpressions)(["https://", host]);
         predefinedVariables = {
@@ -6957,8 +7078,18 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
             componentName: ctx.componentName,
         }),
     ]));
-    const publicEnvVars = ((_g = options.shouldResolveReferences) !== null && _g !== void 0 ? _g : true)
-        ? await (0, bash_3.resolveAllReferences)(publicEnvVarsUnresolved, async (otherComponentName) => {
+    // predefined variables may contain references too (e.g. the embedded
+    // database connection string references the component's own DB_* vars), so
+    // we resolve references over the merged map. This way public var overrides
+    // (like DB_PASSWORD: "${otherComponent:DB_PASSWORD}") are picked up by the
+    // predefined variables that reference them
+    const mergedEnvVars = {
+        ...predefinedVariables,
+        ...secretEnvVars,
+        ...publicEnvVarsUnresolved,
+    };
+    const resolvedEnvVars = ((_g = options.shouldResolveReferences) !== null && _g !== void 0 ? _g : true)
+        ? await (0, bash_3.resolveAllReferences)(mergedEnvVars, async (otherComponentName) => {
             const { envVars: otherEnvVars } = await (0, exports.getEnvironmentVariables)({
                 ...ctx,
                 componentName: otherComponentName,
@@ -6967,12 +7098,8 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
             });
             return otherEnvVars;
         })
-        : publicEnvVarsUnresolved;
-    const envVars = addIndexVar({
-        ...predefinedVariables,
-        ...secretEnvVars,
-        ...publicEnvVars,
-    });
+        : mergedEnvVars;
+    const envVars = addIndexVar(resolvedEnvVars);
     return {
         envVars,
         secretEnvVarKeys,
@@ -8963,8 +9090,8 @@ const getCloudSqlVariables = ({ deployConfigRaw, environmentSlugPrefix, env, com
         };
         return {
             ...dbVars,
-            DATABASE_URL: (0, database_1.getDatabaseConnectionString)(deployConfigRaw.cloudSql, dbVars).concat(additionalQueryParamsString),
-            DATABASE_JDBC_URL: (0, database_1.getDatabaseJdbcUrl)(dbVars, (_c = deployConfigRaw.cloudSql.dbConnectionStringVariablesMode) !== null && _c !== void 0 ? _c : database_1.DEFAULT_DB_VARIABLES_MODE),
+            DATABASE_URL: (0, database_1.getDatabaseConnectionString)(deployConfigRaw.cloudSql, dbVars, componentName).concat(additionalQueryParamsString),
+            DATABASE_JDBC_URL: (0, database_1.getDatabaseJdbcUrl)(dbVars, (_c = deployConfigRaw.cloudSql.dbConnectionStringVariablesMode) !== null && _c !== void 0 ? _c : database_1.DEFAULT_DB_VARIABLES_MODE, componentName),
         };
     }
     return {};
@@ -9156,64 +9283,72 @@ const getDatabaseCreateScript = (context, deployConfig) => {
     ]);
 };
 exports.getDatabaseCreateScript = getDatabaseCreateScript;
-exports.DEFAULT_DB_VARIABLES_MODE = "legacy";
-const getVariableOrValue = (key, variables, mode) => {
-    return mode === "legacy" ? `$${key}` : variables[key];
-};
-const getDatabaseJdbcUrl = (variables, mode) => {
+exports.DEFAULT_DB_VARIABLES_MODE = "embedded";
+const getVariableOrValue = (key, mode, componentName) => {
+    // in embedded mode we reference the component's own env var, which gets
+    // resolved to its final value (including vars.public overrides) after all
+    // env vars have been merged
+    return mode === "legacy"
+        ? `$${key}`
+        : new bash_1.VariableReference(componentName, key);
+};
+const joinDbUrlParts = (parts, mode) => mode === "legacy"
+    ? (0, bash_1.joinBashExpressions)(parts)
+    : new bash_1.VariableValueContainingReferences(parts);
+const getDatabaseJdbcUrl = (variables, mode, componentName) => {
     const parts = [
         "jdbc:postgresql:///",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?cloudSqlInstance=",
-        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode),
+        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", mode, componentName),
         "&socketFactory=com.google.cloud.sql.postgres.SocketFactory&user=",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         "&password=",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getDatabaseJdbcUrl = getDatabaseJdbcUrl;
-const getRailsDatabaseConnectionString = (variables, mode) => {
+const getRailsDatabaseConnectionString = (variables, mode, componentName) => {
     const parts = [
         "postgresql://",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         ":",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
         "@",
         encodeURIComponent(`/cloudsql/${variables.CLOUD_SQL_INSTANCE_CONNECTION_NAME}`),
         "/",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?",
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getRailsDatabaseConnectionString = getRailsDatabaseConnectionString;
-const getPrismaDatabaseConnectionString = (variables, mode) => {
+const getPrismaDatabaseConnectionString = (variables, mode, componentName) => {
     const parts = [
         "postgresql://",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         ":",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
         "@localhost/",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?host=/cloudsql/",
-        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode),
+        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", mode, componentName),
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getPrismaDatabaseConnectionString = getPrismaDatabaseConnectionString;
-const getDatabaseConnectionString = (config, variables) => {
+const getDatabaseConnectionString = (config, variables, componentName) => {
     var _a;
     const mode = (_a = config.dbConnectionStringVariablesMode) !== null && _a !== void 0 ? _a : exports.DEFAULT_DB_VARIABLES_MODE;
     switch (config.dbConnectionStringFormat) {
         case "jdbc":
-            return (0, exports.getDatabaseJdbcUrl)(variables, mode);
+            return (0, exports.getDatabaseJdbcUrl)(variables, mode, componentName);
         case "rails":
-            return (0, exports.getRailsDatabaseConnectionString)(variables, mode);
+            return (0, exports.getRailsDatabaseConnectionString)(variables, mode, componentName);
         default:
             // prisma
-            return (0, exports.getPrismaDatabaseConnectionString)(variables, mode);
+            return (0, exports.getPrismaDatabaseConnectionString)(variables, mode, componentName);
     }
 };
 exports.getDatabaseConnectionString = getDatabaseConnectionString;