@catladder/cli 0.0.0-next-8b9ad5ca → 0.0.0-next-1cd29c1f

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js

@@ -128,12 +128,30 @@ const mirrorSecretsToCiBackends = async (instance, config, envAndComponents, val
   if (!enabled.includes("github")) {
     return;
   }
+  const kinds = new Map();
+  for (const [componentName, envs] of Object.entries(envAndComponents)) {
+    for (const env of envs) {
+      const {
+        secretEnvVarKeys,
+        jobOnlyVars
+      } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+      [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys].forEach(({
+        key,
+        kind
+      }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+  }
   const secrets = Object.entries(envAndComponents).flatMap(([componentName, envs]) => envs.flatMap(env => {
     var _a;
-    return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => ({
-      name: (0, pipeline_1.getSecretVarName)(env, componentName, key),
-      value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : "")
-    }));
+    return Object.entries((_a = valuesToEdit[componentName][env]) !== null && _a !== void 0 ? _a : {}).map(([key, value]) => {
+      var _a;
+      const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+      return {
+        name,
+        value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+        kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret"
+      };
+    });
   }));
   if (secrets.length === 0) {
     return;

package/dist/cli/src/apps/cli/commands/project/commandConfigSecrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,oGAG+D;AAC/D,6DAA0D;AAC1D,qDAA6D;AAC7D,qDAA8D;AAC9D,uDAAkD;AAOlD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;IAC9C,OAAO;QACL,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,8BAA8B,GAAG,KAAK,EAC1C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAAY,EACZ,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,IAAA,qCAAkB,EAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,MAAM,IAAA,4CAAyB,EACpD,QAAQ,EACR,GAAG,EACH,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,aAAa;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,oHAAoH;QACpH,MAAM,gBAAgB,GACpB,KAAK,KAAK,GAAG,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,KAAK,EACnB,QAAY,EACZ,gBAEC,EACD,EAAE;IACF,IAAI,YAAY,GAAS,MAAM,CAAC,WAAW,CACzC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACtB,GAAG;YACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACrD,CAAC,CACH,CACF;KACF,CAAC,CACH,CACF,CAAC;IACF,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,EAAE,CAAC;QACjB,YAAY,GAAG,MAAM,IAAA,uBAAU,EAC7B,WAAW,CAAC,YAAY,CAAC,EACzB,IAAA,0BAAY,EAAA;;;UAGR,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/B,GAAG,CACF,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,IAAI,CAAC;;SAEZ,CACJ,CAAC;QACF,mBAAmB;QACnB,SAAS,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,wDAAwD;gBACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;gBAEF,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAA,sBAAU,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;gBAEvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,QAAQ,CAAC,GAAG,CACV,4CAA4C,aAAa,GAAG,CAC7D,CAAC;oBACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;wBAC7D,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;wBACtD,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAED,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAE/D,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;YAC/D,MAAM,CACJ,MAAM,QAAQ,CAAC,eAAe,EAAE,CACjC,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,CAC7B,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,QAAY,EACZ,MAAc,EACd,gBAAuD,EACvD,YAAkB,EAClB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAChC,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CACtD,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QACnB,OAAA,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC;YAC/C,KAAK,EACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;SAClE,CAAC,CACH,CAAA;KAAA,CACF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IAC7E,MAAM,IAAA,8CAAmB,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAM,EAAE,YAAqB,EAAE,EAAE;IAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,mBAAmB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAA,8BAAW,EAAC,YAAY,CAAC,CAAC;QAEzD,wEAAwE;QACxE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAC;YAChD,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,EAAE,EAAE;gBAChB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAlBW,QAAA,oBAAoB,wBAkB/B"}
+{"version":3,"file":"commandConfigSecrets.js","sourceRoot":"","sources":["../../../../../../../src/apps/cli/commands/project/commandConfigSecrets.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAE7B,6CAA2C;AAC3C,yCAAuC;AAEvC,0EAQ6C;AAC7C,oGAG+D;AAC/D,6DAA0D;AAC1D,qDAA6D;AAC7D,qDAA8D;AAC9D,uDAAkD;AAOlD,+FAA+F;AAC/F,MAAM,WAAW,GAAG,CAAC,CAAO,EAAE,EAAE,CAC9B,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE;IAC9C,OAAO;QACL,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YAC3C,GAAG;YACH,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC3C,IAAI,CAAC;oBACH,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAClC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC,CAAC,CACH;SACF,CAAC,CACH;KACF,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ,MAAM,8BAA8B,GAAG,KAAK,EAC1C,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;IACF,OAAO;QACL,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;QACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;QACtC,GAAG,gBAAgB;KACpB;SACE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;SACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,KAAK,EAC5B,QAAY,EACZ,GAAW,EACX,aAAqB,EACrB,EAAE;IACF,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;IAEF,MAAM,aAAa,GAAG,MAAM,IAAA,qCAAkB,EAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,MAAM,IAAA,4CAAyB,EACpD,QAAQ,EACR,GAAG,EACH,aAAa,CACd,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,aAAa;QAChB,GAAG,cAAc;KAClB,CAAC;IACF,OAAO,MAAM,CAAC,WAAW,CACvB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,oHAAoH;QACpH,MAAM,gBAAgB,GACpB,KAAK,KAAK,GAAG,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC;AACF,MAAM,OAAO,GAAG,KAAK,EACnB,QAAY,EACZ,gBAEC,EACD,EAAE;IACF,IAAI,YAAY,GAAS,MAAM,CAAC,WAAW,CACzC,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QACpE,aAAa;QACb,MAAM,CAAC,WAAW,CAChB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YACtB,GAAG;YACH,MAAM,gBAAgB,CAAC,QAAQ,EAAE,GAAG,EAAE,aAAa,CAAC;SACrD,CAAC,CACH,CACF;KACF,CAAC,CACH,CACF,CAAC;IACF,IAAI,SAAS,GAAG,IAAI,CAAC;IACrB,OAAO,SAAS,EAAE,CAAC;QACjB,YAAY,GAAG,MAAM,IAAA,uBAAU,EAC7B,WAAW,CAAC,YAAY,CAAC,EACzB,IAAA,0BAAY,EAAA;;;UAGR,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;aAC/B,GAAG,CACF,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpE;aACA,IAAI,CAAC,IAAI,CAAC;;SAEZ,CACJ,CAAC;QACF,mBAAmB;QACnB,SAAS,GAAG,KAAK,CAAC;QAClB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC;oBAC/C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,wDAAwD;gBACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAC3D,GAAG,EACH,aAAa,CACd,CAAC;gBAEF,MAAM,SAAS,GAAG,IAAA,sBAAU,EAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,IAAA,sBAAU,EAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;gBAEvD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC/C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,QAAQ,CAAC,GAAG,CACV,4CAA4C,aAAa,GAAG,CAC7D,CAAC;oBACF,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjB,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,QAAQ,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;wBAC7D,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC9C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;wBACtD,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;wBAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACnB,CAAC;oBAED,MAAM,IAAA,eAAK,EAAC,IAAI,CAAC,CAAC;oBAClB,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;oBAE/D,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC3B,CAAC;oBACD,SAAS,GAAG,IAAI,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IAED,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,QAAQ,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IACjE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjB,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,QAAQ,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,OAAO,CAAC,CAAC;YAC/D,MAAM,CACJ,MAAM,QAAQ,CAAC,eAAe,EAAE,CACjC,CAAC,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACrE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjB,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,aAAa,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,CAC7B,QAAQ,EACR,MAAM,EACN,gBAAgB,EAChB,YAAY,CACb,CAAC;IAEF,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACnB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,KAAK,EACrC,QAAY,EACZ,MAAc,EACd,gBAAuD,EACvD,YAAkB,EAClB,EAAE;IACF,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;IAEhD,+DAA+D;IAC/D,mBAAmB;IACnB,IAAI,IAAA,yBAAc,EAAC,MAAM,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAChC,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF;gBACE,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC1B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,OAAO,CACtD,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,EAAE,CACxB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QACnB,OAAA,MAAM,CAAC,OAAO,CAAC,MAAA,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,mCAAI,EAAE,CAAC,CAAC,GAAG,CACxD,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;;YACf,MAAM,IAAI,GAAG,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;YACvD,OAAO;gBACL,IAAI;gBACJ,KAAK,EACH,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC;gBACjE,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;aAC7C,CAAC;QACJ,CAAC,CACF,CAAA;KAAA,CACF,CACJ,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;QACjC,QAAQ,CAAC,GAAG,CACV,6IAA6I,CAC9I,CAAC;QACF,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAA,kDAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,CACV,mIAAmI,CACpI,CAAC;QACF,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,wBAAwB,IAAI,OAAO,CAAC,CAAC;IAC7E,MAAM,IAAA,8CAAmB,EAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC,CAAC;AAEK,MAAM,oBAAoB,GAAG,KAAK,EAAE,EAAM,EAAE,YAAqB,EAAE,EAAE;IAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,mBAAmB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;QAC5E,MAAM,OAAO,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,IAAA,8BAAW,EAAC,YAAY,CAAC,CAAC;QAEzD,wEAAwE;QACxE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,UAAU,GAAG,MAAM,IAAA,uCAAoB,GAAE,CAAC;YAChD,MAAM,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,OAAO,CAAC,EAAE,EAAE;gBAChB,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,CAAC;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAlBW,QAAA,oBAAoB,wBAkB/B"}

package/dist/cli/src/apps/cli/commands/project/setup/setupCloudRun.js

@@ -6,10 +6,10 @@ Object.defineProperty(exports, "__esModule", {
 exports.setupCloudRun = void 0;
 const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
 const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
-const getCloudRunDomainSuffix_1 = require("../../../../../gcloud/cloudRun/getCloudRunDomainSuffix");
 const enableServices_1 = require("../../../../../gcloud/enableServices");
+const getProjectNumber_1 = require("../../../../../gcloud/getProjectNumber");
 const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
-const gitlab_1 = require("../../../../../utils/gitlab");
+const updateCatladderStore_1 = require("../../../../../store/updateCatladderStore");
 const setupCloudRun = async (instance, context) => {
   var _a, _b;
   if (!(0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun")) {
@@ -36,17 +36,19 @@ const setupCloudRun = async (instance, context) => {
     // for scheduling
     ...(config.cloudSql ? ["roles/cloudsql.admin"] : [])]
   }, pipeline_1.GCLOUD_DEPLOY_CREDENTIALS_KEY);
-  // gcloud run automatically gives us a hostname
-  // but the pipeline need to know it before deployment
-  // so we get this through some magic and add this as a ci/cd variable
-  // the pipeline than can use this to construct the canonical host
-  instance.log("get service domain suffix... that might take a while initially");
-  const suffix = await (0, getCloudRunDomainSuffix_1.getCloudRunDomainSuffix)(config);
-  instance.log("domain suffix: " + suffix);
-  await (0, gitlab_1.upsertAllVariables)(instance, {
-    [pipeline_1.GCLOUD_RUN_CANONICAL_HOST_SUFFIX]: suffix
-  }, context.env, context.name, false,
-  // backup
-  false);
+  // the project number is needed at generation time to construct cloud
+  // run's deterministic urls (<service>-<projectNumber>.<region>.run.app)
+  instance.log("fetch gcloud project number...");
+  const projectNumber = await (0, getProjectNumber_1.fetchGcloudProjectNumber)(config.projectId);
+  instance.log("project number: " + projectNumber);
+  await (0, updateCatladderStore_1.updateCatladderStore)(store => ({
+    ...store,
+    gcloudProjects: {
+      ...store.gcloudProjects,
+      [config.projectId]: {
+        projectNumber
+      }
+    }
+  }));
 };
 exports.setupCloudRun = setupCloudRun;

package/dist/cli/src/apps/cli/commands/project/setup/setupCloudRun.js.map

@@ -1 +1 @@
-{"version":3,"file":"setupCloudRun.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAI6B;AAG7B,+EAAwF;AACxF,oGAAiG;AACjG,yEAA4E;AAC5E,2EAAgG;AAChG,wDAAiE;AAE1D,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAEtC,kBAAkB;IAElB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC5C,MAAM,IAAA,qCAAoB,EACxB;QACE,oBAAoB;QACpB,iCAAiC;QACjC,+BAA+B,EAAE,sBAAsB;QACvD,qCAAqC,EAAE,mDAAmD;QAC1F,GAAG,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,EACD,MAAM,CACP,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,MAAM,IAAA,iDAA6B,EAAC,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD,MAAM,IAAA,yDAAuC,EAC3C,QAAQ,EACR,OAAO,EACP;QACE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,MAAM;QACZ,yLAAyL;QACzL,KAAK,EAAE;YACL,kCAAkC;YAClC,iBAAiB;YACjB,8BAA8B;YAC9B,4BAA4B,EAAE,iBAAiB;YAC/C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,EACD,wCAA6B,CAC9B,CAAC;IAEF,+CAA+C;IAC/C,qDAAqD;IACrD,qEAAqE;IACrE,iEAAiE;IACjE,QAAQ,CAAC,GAAG,CACV,gEAAgE,CACjE,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,iDAAuB,EAAC,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC,CAAC;IAEzC,MAAM,IAAA,2BAAkB,EACtB,QAAQ,EACR;QACE,CAAC,2CAAgC,CAAC,EAAE,MAAM;KAC3C,EACD,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,IAAI,EACZ,KAAK,EAAE,SAAS;IAChB,KAAK,CACN,CAAC;AACJ,CAAC,CAAC;AArEW,QAAA,aAAa,iBAqExB"}
+{"version":3,"file":"setupCloudRun.js","sourceRoot":"","sources":["../../../../../../../../src/apps/cli/commands/project/setup/setupCloudRun.ts"],"names":[],"mappings":";;;AACA,kDAG6B;AAG7B,+EAAwF;AACxF,yEAA4E;AAC5E,6EAAkF;AAClF,2EAAgG;AAChG,oFAAiF;AAE1E,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,OAAyB,EACzB,EAAE;;IACF,IAAI,CAAC,IAAA,yBAAc,EAAC,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAEtC,kBAAkB;IAElB,QAAQ,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC5C,MAAM,IAAA,qCAAoB,EACxB;QACE,oBAAoB;QACpB,iCAAiC;QACjC,+BAA+B,EAAE,sBAAsB;QACvD,qCAAqC,EAAE,mDAAmD;QAC1F,GAAG,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,CAAC,yBAAyB,EAAE,8BAA8B,CAAC;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,EACD,MAAM,CACP,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC7C,MAAM,IAAA,iDAA6B,EAAC,MAAM,CAAC,CAAC;IAE5C,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACjD,MAAM,IAAA,yDAAuC,EAC3C,QAAQ,EACR,OAAO,EACP;QACE,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,yBAAyB;QACtC,WAAW,EAAE,8CAA8C;QAC3D,IAAI,EAAE,MAAM;QACZ,yLAAyL;QACzL,KAAK,EAAE;YACL,kCAAkC;YAClC,iBAAiB;YACjB,8BAA8B;YAC9B,4BAA4B,EAAE,iBAAiB;YAC/C,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;KACF,EACD,wCAA6B,CAC9B,CAAC;IAEF,qEAAqE;IACrE,wEAAwE;IACxE,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,IAAA,2CAAwB,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,kBAAkB,GAAG,aAAa,CAAC,CAAC;IAEjD,MAAM,IAAA,2CAAoB,EAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrC,GAAG,KAAK;QACR,cAAc,EAAE;YACd,GAAG,KAAK,CAAC,cAAc;YACvB,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE;SACtC;KACF,CAAC,CAAC,CAAC;AACN,CAAC,CAAC;AA9DW,QAAA,aAAa,iBA8DxB"}

package/dist/cli/src/commands/project/commandSecretsSyncGithub.d.ts

@@ -3,19 +3,22 @@ import type { IO } from "../../core/types";
  * all secrets declared in the config, with their values read from the
  * vault (github secrets are write-only and can never act as a source)
  */
-export declare const collectSecretsFromVault: (io: IO) => Promise<{
+export declare const collectSecretsFromVault: (io: IO, envFilter?: string[]) => Promise<{
   secrets: {
     name: string;
     value: string;
+    kind: "secret" | "variable";
   }[];
   missing: string[];
 }>;
 /**
- * pushes secrets to github repository secrets via the gh cli
+ * pushes vault values to github via the gh cli: sensitive ones as repo
+ * secrets (masked), "variable"-kind ones as repo variables (plain)
  */
 export declare const pushSecretsToGithub: (io: IO, repo: string, secrets: {
   name: string;
   value: string;
+  kind: "secret" | "variable";
 }[]) => Promise<void>;
 /**
  * resolves the github repository from the configured git remote
@@ -34,4 +37,10 @@ export declare const commandSecretsSyncGithub: import("../../core/types").Comman
     readonly positional: true;
     readonly required: false;
   };
+  readonly env: {
+    readonly type: "string";
+    readonly message: "only sync these environments (comma-separated, e.g. review,dev) — github allows at most 100 repo secrets";
+    readonly positional: true;
+    readonly required: false;
+  };
 }>;

package/dist/cli/src/commands/project/commandSecretsSyncGithub.js

@@ -12,26 +12,35 @@ const github_1 = require("../../utils/github");
  * all secrets declared in the config, with their values read from the
  * vault (github secrets are write-only and can never act as a source)
  */
-const collectSecretsFromVault = async io => {
+const collectSecretsFromVault = async (io, envFilter) => {
   const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-  const names = [];
+  const kinds = new Map();
   for (const [componentName, envs] of Object.entries(envAndComponents)) {
     for (const env of envs) {
+      if (envFilter && !envFilter.includes(env)) {
+        continue;
+      }
       const {
         secretEnvVarKeys,
         jobOnlyVars
       } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
       const keys = [...secretEnvVarKeys, ...jobOnlyVars.build.secretEnvVarKeys, ...jobOnlyVars.deploy.secretEnvVarKeys];
       keys.forEach(({
-        key
-      }) => names.push((0, pipeline_1.getSecretVarName)(env, componentName, key)));
+        key,
+        kind
+      }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
     }
   }
+  const names = [...kinds.keys()];
   const values = await (await io.getVaultManager()).readSecrets(names, io);
-  const secrets = names.filter(name => values[name] !== undefined).map(name => ({
-    name,
-    value: values[name]
-  }));
+  const secrets = names.filter(name => values[name] !== undefined).map(name => {
+    var _a;
+    return {
+      name,
+      value: values[name],
+      kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret"
+    };
+  });
   const missing = names.filter(name => values[name] === undefined);
   return {
     secrets,
@@ -40,15 +49,22 @@ const collectSecretsFromVault = async io => {
 };
 exports.collectSecretsFromVault = collectSecretsFromVault;
 /**
- * pushes secrets to github repository secrets via the gh cli
+ * pushes vault values to github via the gh cli: sensitive ones as repo
+ * secrets (masked), "variable"-kind ones as repo variables (plain)
  */
 const pushSecretsToGithub = async (io, repo, secrets) => {
   for (const {
     name,
-    value
+    value,
+    kind
   } of secrets) {
-    await (0, github_1.setGithubSecret)(repo, name, value);
-    io.log(`✅ ${name}`);
+    if (kind === "variable") {
+      await (0, github_1.setGithubVariable)(repo, name, value);
+      io.log(`📖 ${name} (variable)`);
+    } else {
+      await (0, github_1.setGithubSecret)(repo, name, value);
+      io.log(`✅ ${name}`);
+    }
   }
 };
 exports.pushSecretsToGithub = pushSecretsToGithub;
@@ -79,10 +95,16 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
       message: "github repository (owner/name)",
       positional: true,
       required: false
+    },
+    env: {
+      type: "string",
+      message: "only sync these environments (comma-separated, e.g. review,dev) — github allows at most 100 repo secrets",
+      positional: true,
+      required: false
     }
   },
   execute: async ctx => {
-    var _a;
+    var _a, _b;
     const config = await (0, getProjectConfig_1.getProjectConfig)();
     if (!config) {
       throw new Error("no catladder config found");
@@ -98,10 +120,11 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
     if (!repo) {
       throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
     }
+    const envFilter = (_b = await ctx.get("env")) === null || _b === void 0 ? void 0 : _b.split(",").map(e => e.trim());
     const {
       secrets,
       missing
-    } = await (0, exports.collectSecretsFromVault)(ctx);
+    } = await (0, exports.collectSecretsFromVault)(ctx, envFilter);
     if (missing.length > 0) {
       ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
       missing.forEach(name => ctx.log(`  - ${name}`));

package/dist/cli/src/commands/project/commandSecretsSyncGithub.js.map

@@ -1 +1 @@
-{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAC7B,oEAIuC;AACvC,4DAAyD;AAEzD,+CAI4B;AAE5B;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,EAAE;IACtD,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CACvB,KAAK,CAAC,IAAI,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AA3BW,QAAA,uBAAuB,2BA2BlC;AAEF;;GAEG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAA0C,EAC1C,EAAE;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,OAAO,EAAE,CAAC;QACtC,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACtB,CAAC;AACH,CAAC,CAAC;AATW,QAAA,mBAAmB,uBAS9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,+BAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,GAAG,CAAC,CAAC;QAEhE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,2BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}
+{"version":3,"file":"commandSecretsSyncGithub.js","sourceRoot":"","sources":["../../../../../src/commands/project/commandSecretsSyncGithub.ts"],"names":[],"mappings":";;;AAAA,kDAI6B;AAC7B,oEAIuC;AACvC,4DAAyD;AAEzD,+CAK4B;AAE5B;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAAE,EAAM,EAAE,SAAoB,EAAE,EAAE;IAC5E,MAAM,gBAAgB,GAAG,MAAM,IAAA,0DAAuC,GAAE,CAAC;IAEzE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACvD,KAAK,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1C,SAAS;YACX,CAAC;YACD,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,GAAG,MAAM,IAAA,iCAAc,EAC5D,GAAG,EACH,aAAa,CACd,CAAC;YACF,MAAM,IAAI,GAAG;gBACX,GAAG,gBAAgB;gBACnB,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB;gBACrC,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB;aACvC,CAAC;YACF,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,CAC7B,KAAK,CAAC,GAAG,CAAC,IAAA,2BAAgB,EAAC,GAAG,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,KAAK;SAClB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;SAC5C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;;QAAC,OAAA,CAAC;YACd,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,MAAA,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAK,QAAkB;SAC7C,CAAC,CAAA;KAAA,CAAC,CAAC;IACN,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC;IACnE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC,CAAC;AAnCW,QAAA,uBAAuB,2BAmClC;AAEF;;;GAGG;AACI,MAAM,mBAAmB,GAAG,KAAK,EACtC,EAAM,EACN,IAAY,EACZ,OAAuE,EACvE,EAAE;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC5C,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,MAAM,IAAA,0BAAiB,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3C,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACzC,EAAE,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAdW,QAAA,mBAAmB,uBAc9B;AAEF;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,IAE1C,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAA,gCAAuB,EAAC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzE,CAAC,CAAC;AARW,QAAA,uBAAuB,2BAQlC;AAEF;;;;GAIG;AACU,QAAA,wBAAwB,GAAG,IAAA,6BAAa,EAAC;IACpD,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACT,gGAAgG;IAClG,KAAK,EAAE,SAAS;IAChB,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;QACD,GAAG,EAAE;YACH,IAAI,EAAE,QAAQ;YACd,OAAO,EACL,0GAA0G;YAC5G,UAAU,EAAE,IAAI;YAChB,QAAQ,EAAE,KAAK;SAChB;KACF;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;;QACrB,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;QACxC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,wEAAwE,CACzE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAA,0BAAiB,GAAE,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,mCAAI,CAAC,MAAM,IAAA,+BAAuB,GAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,0EAA0E,CACvJ,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,0CAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,+BAAuB,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,GAAG,CACL,MAAM,OAAO,CAAC,MAAM,wDAAwD,CAC7E,CAAC;YACF,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,gBAAgB,IAAI,IAAI,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACtD,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACpD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAA,2BAAmB,EAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACZ,GAAG,CAAC,GAAG,CACL,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/cli/src/gcloud/getProjectNumber.d.ts

@@ -0,0 +1,5 @@
+/**
+ * resolves the numeric gcloud project number for a project id.
+ * Requires `cloudresourcemanager.googleapis.com` to be enabled.
+ */
+export declare const fetchGcloudProjectNumber: (projectId: string) => Promise<string>;

package/dist/cli/src/gcloud/getProjectNumber.js

@@ -0,0 +1,20 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.fetchGcloudProjectNumber = void 0;
+const child_process_promise_1 = require("child-process-promise");
+/**
+ * resolves the numeric gcloud project number for a project id.
+ * Requires `cloudresourcemanager.googleapis.com` to be enabled.
+ */
+const fetchGcloudProjectNumber = async projectId => {
+  const result = await (0, child_process_promise_1.exec)(`gcloud projects describe ${projectId} --format="value(projectNumber)"`);
+  const projectNumber = result.stdout.trim();
+  if (!/^\d+$/.test(projectNumber)) {
+    throw new Error(`could not determine the gcloud project number for "${projectId}" (got: "${projectNumber}")`);
+  }
+  return projectNumber;
+};
+exports.fetchGcloudProjectNumber = fetchGcloudProjectNumber;

package/dist/cli/src/gcloud/getProjectNumber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getProjectNumber.js","sourceRoot":"","sources":["../../../../src/gcloud/getProjectNumber.ts"],"names":[],"mappings":";;;AAAA,iEAA6C;AAE7C;;;GAGG;AACI,MAAM,wBAAwB,GAAG,KAAK,EAC3C,SAAiB,EACA,EAAE;IACnB,MAAM,MAAM,GAAG,MAAM,IAAA,4BAAI,EACvB,4BAA4B,SAAS,kCAAkC,CACxE,CAAC;IACF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,sDAAsD,SAAS,YAAY,aAAa,IAAI,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAbW,QAAA,wBAAwB,4BAanC"}

package/dist/cli/src/store/updateCatladderStore.d.ts

@@ -0,0 +1,10 @@
+import type { CatladderStore } from "../../../pipeline/src/index.js";
+/**
+ * applies an update to `.catladder-store/store.yml` at the git root,
+ * creating the folder on first use
+ */
+export declare const updateCatladderStore: (update: (store: CatladderStore) => CatladderStore) => Promise<{
+  gcloudProjects?: Record<string, {
+    projectNumber: string;
+  }>;
+}>;

package/dist/cli/src/store/updateCatladderStore.js

@@ -0,0 +1,32 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.updateCatladderStore = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const pipeline_1 = require("../../../pipeline/src/index.js");
+const yaml_1 = require("yaml");
+const projects_1 = require("../utils/projects");
+const HEADER = `# managed by catladder — written by \`catladder project setup\`.
+# Non-secret, machine-fetched values needed to generate the pipeline.
+# Check this file in. If it is missing, rerun \`catladder project setup\`.
+`;
+/**
+ * applies an update to `.catladder-store/store.yml` at the git root,
+ * creating the folder on first use
+ */
+const updateCatladderStore = async update => {
+  var _a;
+  const root = (_a = await (0, projects_1.getGitRoot)()) !== null && _a !== void 0 ? _a : process.cwd();
+  const store = (0, pipeline_1.readCatladderStore)(root);
+  const updated = pipeline_1.catladderStoreSchema.parse(update(store));
+  const path = (0, pipeline_1.getCatladderStorePath)(root);
+  await (0, promises_1.mkdir)((0, path_1.dirname)(path), {
+    recursive: true
+  });
+  await (0, promises_1.writeFile)(path, HEADER + (0, yaml_1.stringify)(updated));
+  return updated;
+};
+exports.updateCatladderStore = updateCatladderStore;

package/dist/cli/src/store/updateCatladderStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updateCatladderStore.js","sourceRoot":"","sources":["../../../../src/store/updateCatladderStore.ts"],"names":[],"mappings":";;;AAAA,0CAA+C;AAC/C,+BAA+B;AAG/B,kDAI6B;AAC7B,+BAAiC;AAEjC,gDAA+C;AAE/C,MAAM,MAAM,GAAG;;;CAGd,CAAC;AAEF;;;GAGG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,MAAiD,EACjD,EAAE;;IACF,MAAM,IAAI,GAAG,MAAA,CAAC,MAAM,IAAA,qBAAU,GAAE,CAAC,mCAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,IAAA,6BAAkB,EAAC,IAAI,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,+BAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAA,gCAAqB,EAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAA,gBAAK,EAAC,IAAA,cAAO,EAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAA,oBAAS,EAAC,IAAI,EAAE,MAAM,GAAG,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAC,CAAC;IACnD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAVW,QAAA,oBAAoB,wBAU/B"}

package/dist/cli/src/utils/github.d.ts

@@ -12,4 +12,9 @@ export declare const getGithubRepoFromRemote: (remoteName: string) => Promise<st
  * sets a github actions repository secret via the gh cli.
  * The value is passed via stdin so it never shows up in a process list.
  */
-export declare const setGithubSecret: (repo: string, name: string, value: string) => Promise<void>;
+export declare const setGithubSecret: (repo: string, name: string, value: string) => Promise<void>;
+/**
+ * sets a github actions repository variable (plain, unmasked) via the
+ * gh cli — for vault values classified as not sensitive
+ */
+export declare const setGithubVariable: (repo: string, name: string, value: string) => Promise<void>;

package/dist/cli/src/utils/github.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
+exports.setGithubVariable = exports.setGithubSecret = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -36,19 +36,26 @@ const getGithubRepoFromRemote = async remoteName => {
   }
 };
 exports.getGithubRepoFromRemote = getGithubRepoFromRemote;
-/**
- * sets a github actions repository secret via the gh cli.
- * The value is passed via stdin so it never shows up in a process list.
- */
-const setGithubSecret = async (repo, name, value) => new Promise((resolve, reject) => {
+const ghSetViaStdin = (kind, repo, name, value) => new Promise((resolve, reject) => {
   var _a, _b;
-  const child = (0, child_process_1.spawn)("gh", ["secret", "set", name, "--repo", repo], {
+  const child = (0, child_process_1.spawn)("gh", [kind, "set", name, "--repo", repo], {
     stdio: ["pipe", "ignore", "pipe"]
   });
   let stderr = "";
   (_a = child.stderr) === null || _a === void 0 ? void 0 : _a.on("data", data => stderr += data);
   child.on("error", reject);
-  child.on("close", code => code === 0 ? resolve() : reject(new Error(`gh secret set ${name} failed: ${stderr.trim()}`)));
+  child.on("close", code => code === 0 ? resolve() : reject(new Error(`gh ${kind} set ${name} failed: ${stderr.trim()}`)));
   (_b = child.stdin) === null || _b === void 0 ? void 0 : _b.end(value);
 });
-exports.setGithubSecret = setGithubSecret;
+/**
+ * sets a github actions repository secret via the gh cli.
+ * The value is passed via stdin so it never shows up in a process list.
+ */
+const setGithubSecret = async (repo, name, value) => ghSetViaStdin("secret", repo, name, value);
+exports.setGithubSecret = setGithubSecret;
+/**
+ * sets a github actions repository variable (plain, unmasked) via the
+ * gh cli — for vault values classified as not sensitive
+ */
+const setGithubVariable = async (repo, name, value) => ghSetViaStdin("variable", repo, name, value);
+exports.setGithubVariable = setGithubVariable;

package/dist/cli/src/utils/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACE,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACxE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAlBQ,QAAA,eAAe,mBAkBvB"}
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACE,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE;QAC7D,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAJlD,QAAA,eAAe,mBAImC;AAE/D;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACE,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAJpD,QAAA,iBAAiB,qBAImC"}

package/dist/pipeline/src/backends/github/GithubBackend.d.ts

@@ -1,12 +1,15 @@
 import type { Config } from "../../types";
 import type { GithubWorkflow } from "../../types/github-types";
 import type { PipelineBackend, PipelineFile } from "../types";
+import { JobImagesPlan } from "../../customImages/jobImagesPlan";
+import { GithubScriptFiles } from "./scriptFiles";
 export declare class GithubBackend implements PipelineBackend {
   readonly type: "github";
   cleanup(): Promise<void>;
   createFiles(config: Config): Promise<PipelineFile[]>;
+  private createImagesPlan;
   /**
    * all workflows keyed by file name, mainly for testing purposes
    */
-  createWorkflows(config: Config): Promise<Record<string, GithubWorkflow>>;
+  createWorkflows(config: Config, images?: JobImagesPlan, scripts?: GithubScriptFiles): Promise<Record<string, GithubWorkflow>>;
 }

package/dist/pipeline/src/backends/github/GithubBackend.js

@@ -10,7 +10,11 @@ const createAllJobs_1 = require("../../pipeline/createAllJobs");
 const config_1 = require("../../types/config");
 const ciVariables_1 = require("./ciVariables");
 const createGithubJobs_1 = require("./createGithubJobs");
+const jobImagesPlan_1 = require("../../customImages/jobImagesPlan");
+const scriptFunctions_1 = require("./scriptFunctions");
+const utils_1 = require("../../utils");
 const githubReleaseJobs_1 = require("./githubReleaseJobs");
+const scriptFiles_1 = require("./scriptFiles");
 const WORKFLOWS_FOLDER = ".github/workflows";
 /**
  * generated workflow files are prefixed so that cleanup never touches
@@ -55,18 +59,29 @@ class GithubBackend {
   async cleanup() {
     const entries = await (0, promises_1.readdir)(WORKFLOWS_FOLDER).catch(() => []);
     await Promise.all(entries.filter(file => file.startsWith(GENERATED_FILE_PREFIX)).map(file => (0, promises_1.unlink)((0, path_1.join)(WORKFLOWS_FOLDER, file))));
+    await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, {
+      recursive: true,
+      force: true
+    });
   }
   async createFiles(config) {
-    const workflows = await this.createWorkflows(config);
-    return Object.entries(workflows).map(([fileName, workflow]) => ({
+    const images = this.createImagesPlan(config);
+    const scripts = new scriptFiles_1.GithubScriptFiles();
+    const workflows = await this.createWorkflows(config, images, scripts);
+    return [...Object.entries(workflows).map(([fileName, workflow]) => ({
       path: (0, path_1.join)(WORKFLOWS_FOLDER, fileName),
       content: workflow
-    }));
+    })),
+    // materialized job scripts and image definitions (repo mode)
+    ...scripts.getGeneratedFiles(), ...images.getGeneratedFiles()];
+  }
+  createImagesPlan(config) {
+    return new jobImagesPlan_1.JobImagesPlan((0, jobImagesPlan_1.getJobImagesMode)(config, this.type), this.type);
   }
   /**
    * all workflows keyed by file name, mainly for testing purposes
    */
-  async createWorkflows(config) {
+  async createWorkflows(config, images = this.createImagesPlan(config), scripts = new scriptFiles_1.GithubScriptFiles()) {
     const workflows = {};
     const reviewStopJobs = {};
     const manualJobs = {};
@@ -77,13 +92,14 @@ class GithubBackend {
         pipelineType: this.type
       });
       const uploadProviderIds = (0, createGithubJobs_1.getUploadProviderIds)(allJobs);
+      const secretKinds = (0, createGithubJobs_1.collectSecretKinds)(allJobs);
       const jobs = {};
       // NOTE: agent jobs are gitlab-only and skipped on github
       [...allJobs.workspaces, ...allJobs.components].forEach(({
         context,
         jobs: contextJobs
       }) => contextJobs.forEach(job => {
-        const [id, githubJob] = (0, createGithubJobs_1.makeGithubJob)(context, job, allJobs, uploadProviderIds);
+        const [id, githubJob] = (0, createGithubJobs_1.makeGithubJob)(context, job, allJobs, uploadProviderIds, images, scripts, secretKinds);
         if (isReviewStopJob(context, job)) {
           reviewStopJobs[id] = githubJob;
         } else if (isManualTaskJob(job)) {
@@ -93,15 +109,19 @@ class GithubBackend {
         }
       }));
       if (trigger === "mainBranch") {
-        const releaseJobs = (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs));
+        const releaseJobs = (0, githubReleaseJobs_1.getGithubReleaseJobs)(config, Object.keys(jobs), images);
         Object.assign(jobs, releaseJobs.main);
         Object.assign(manualJobs, releaseJobs.manual);
       }
       if (Object.keys(jobs).length > 0) {
         workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
           ...TRIGGER_WORKFLOWS[trigger],
+          ...workflowPermissions(images),
           env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-          jobs
+          jobs: {
+            ...makeEnsureImageGithubJobs(images),
+            ...jobs
+          }
         };
       }
     }
@@ -113,8 +133,12 @@ class GithubBackend {
             types: ["closed"]
           }
         },
+        ...workflowPermissions(images),
         env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-        jobs: reviewStopJobs
+        jobs: {
+          ...makeEnsureImageGithubJobs(images),
+          ...reviewStopJobs
+        }
       };
     }
     if (Object.keys(manualJobs).length > 0) {
@@ -132,17 +156,51 @@ class GithubBackend {
             }
           }
         },
+        ...workflowPermissions(images),
         env: ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
-        jobs: Object.fromEntries(Object.entries(manualJobs).map(([id, job]) => [id, {
-          ...job,
-          if: `\${{ inputs.job == '${id}' }}`
-        }]))
+        jobs: {
+          ...makeEnsureImageGithubJobs(images),
+          ...Object.fromEntries(Object.entries(manualJobs).map(([id, job]) => [id, {
+            ...job,
+            if: `\${{ inputs.job == '${id}' }}`
+          }]))
+        }
       };
     }
     return workflows;
   }
 }
 exports.GithubBackend = GithubBackend;
+/**
+ * repo mode needs packages:write for pushing job images to ghcr
+ */
+const workflowPermissions = images => images.mode === "repo" ? {
+  permissions: {
+    contents: "read",
+    packages: "write"
+  }
+} : {};
+/**
+ * the image build jobs: always run (github has no server-side
+ * changes-filter), the existence check makes unchanged runs fast.
+ * Docker is native on github runners — no container, no dind.
+ */
+const makeEnsureImageGithubJobs = images => Object.fromEntries(images.getEnsureJobs().map(job => {
+  var _a, _b;
+  return [(0, createGithubJobs_1.githubGlobalJobId)(job.name), {
+    name: job.name,
+    "runs-on": "ubuntu-latest",
+    steps: [{
+      name: "Checkout",
+      uses: "actions/checkout@v4"
+    }, {
+      name: job.name,
+      id: "main",
+      run: [...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(), ...((_b = (_a = job.script) === null || _a === void 0 ? void 0 : _a.filter(utils_1.notNil)) !== null && _b !== void 0 ? _b : [])].join("\n"),
+      shell: "bash"
+    }]
+  }];
+}));
 const workflowFileName = trigger => {
   switch (trigger) {
     case "mr":