@catladder/cli 0.0.0-next-8cc9134a → 0.0.0-next-78d43d4a

package/dist/bundles/catenv/index.js

@@ -2658,6 +2658,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
@@ -3788,6 +3791,7 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map
 
@@ -9746,6 +9750,7 @@ exports.createKubernetesCloudsqlBaseValues = createKubernetesCloudsqlBaseValues;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = __nccwpck_require__(72700);
 const getEnvironmentVariables_1 = __nccwpck_require__(44776);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
@@ -9778,6 +9783,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/bundles/cli/index.js

@@ -8651,6 +8651,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
@@ -9781,6 +9784,7 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map
 
@@ -15739,6 +15743,7 @@ exports.createKubernetesCloudsqlBaseValues = createKubernetesCloudsqlBaseValues;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = __nccwpck_require__(72700);
 const getEnvironmentVariables_1 = __nccwpck_require__(44776);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
@@ -15771,6 +15776,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -1,11 +1,23 @@
 #!/bin/bash
 set -e
 
+# The credentials come from DOCKER_REGISTRY_USER / DOCKER_REGISTRY_PASSWORD,
+# which the deploy job resolves per CI backend (gitlab: CI_REGISTRY_USER +
+# CI_REGISTRY_PASSWORD, github: the actor + workflow token) — the raw
+# gitlab names used to be hardcoded here, which left the secret without
+# credentials on the github backend.
+#
+# Both of those are job-scoped and expire with the pipeline: the initial
+# pull works, but a pod rescheduled later can no longer re-pull. Projects
+# that need durable pulls declare long-lived registry credentials as
+# secrets named CI_DEPLOY_USER / CI_DEPLOY_PASSWORD, which win here.
+#
+# --docker-email is deliberately gone: it is optional for a
+# docker-registry secret and its only source was $GITLAB_USER_EMAIL.
 echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
 kubectl create secret -n "$KUBE_NAMESPACE" \
     docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
     --docker-server="$DOCKER_REGISTRY" \
-    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
-    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
-    --docker-email="$GITLAB_USER_EMAIL" \
+    --docker-username="${CI_DEPLOY_USER:-$DOCKER_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$DOCKER_REGISTRY_PASSWORD}" \
     -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/bundles/skills/catladder-migrate-ci-backend/SKILL.md

@@ -193,16 +193,40 @@ See the `catladder-releases` skill for how the release jobs differ
 
 ## Step 7 — registry and the first run
 
-The container registry changes with the backend: `$CI_REGISTRY_IMAGE` on
-GitLab, `ghcr.io/<owner>/<repo>` on GitHub. Consequences to state
-explicitly:
-
-- The first pipeline on the new backend **rebuilds every job image and
-  every app image** — it will be slow, and that is expected, not a bug.
-- The deploy target must be able to **pull from the new registry**.
-  catladder does not manage image-pull credentials on the cluster or on
-  Cloud Run, so check GHCR package visibility / the pull secret with
-  whoever owns the target *before* pointing a real environment at it.
+The **job images** (the catladder runner images) always live in the CI
+system's own registry, so they change host with the backend:
+`$CI_REGISTRY_IMAGE` on GitLab, `ghcr.io/<owner>/<repo>` on GitHub. The
+first pipeline on the new backend therefore **rebuilds every job image**
+— it will be slow, and that is expected, not a bug.
+
+Where the **app image** goes depends on the deploy type:
+
+- **`google-cloudrun`** — the image goes to Google Artifact Registry
+  (`<region>-docker.pkg.dev/<projectId>/catladder-deploy/…`) on both
+  backends. Cloud Run can only pull from AR/GCR, so a backend migration
+  does not move the app image at all. Nothing to do here.
+- **`kubernetes`** — the app image lives in the CI registry and does
+  move. catladder handles the pull itself: every deploy runs
+  `kubernetesCreateSecret`, which writes a `docker-registry` secret
+  (`gitlab-registry-<component>`) into the namespace, and the chart wires
+  it in as `imagePullSecrets`. Note the secret keeps its historical name
+  on both backends.
+
+The credential behind that secret differs per backend, and this is the
+one thing to raise before a kubernetes component moves to GitHub:
+
+- **GitLab** provisions a durable one automatically —
+  `catladder project setup` creates a `gitlab-deploy-token` (scope
+  `read_registry`), GitLab exposes it to jobs as `CI_DEPLOY_USER` /
+  `CI_DEPLOY_PASSWORD`, and `project doctor` fails when it is missing.
+- **GitHub has no equivalent.** The deploy falls back to the workflow
+  token, which expires with the run: the initial pull succeeds and the
+  job goes green, but a pod rescheduled later cannot re-pull —
+  `ImagePullBackOff` weeks after a deploy that looked fine. Until that
+  is solved (catladder issue #75), a project moving kubernetes to GitHub
+  must supply a long-lived registry credential itself, declared as
+  secrets named `CI_DEPLOY_USER` / `CI_DEPLOY_PASSWORD` (a PAT with
+  `read:packages`), which take precedence in the deploy.
 
 ## Step 8 — run both, compare, then cut over
 

package/dist/packages/pipeline/src/backends/github/ciVariables.js

@@ -15,6 +15,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*

package/dist/packages/pipeline/src/backends/github/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;CACjC,CAAC;AAEF;;;GAGG;AACU,QAAA,4BAA4B,GAA2B;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,uCAAuC;IACvC,YAAY,EAAE,4BAA4B;CAC3C,CAAC"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,oEAAoE;IACpE,wDAAwD;IACxD,gBAAgB,EAAE,cAAc;CACjC,CAAC;AAEF;;;GAGG;AACU,QAAA,4BAA4B,GAA2B;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,uCAAuC;IACvC,YAAY,EAAE,4BAA4B;CAC3C,CAAC"}

package/dist/packages/pipeline/src/backends/gitlab/ciVariables.js

@@ -12,5 +12,6 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map

package/dist/packages/pipeline/src/backends/gitlab/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;CACjC,CAAC"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,sBAAsB;CACzC,CAAC"}

package/dist/packages/pipeline/src/bash/ciVariables.d.ts

@@ -6,7 +6,7 @@ import { BashExpression } from "../../../bash/src/index.js";
  * of hardcoding e.g. gitlab's `$CI_*` variables, so that other pipeline
  * types can map them to their own predefined variables.
  */
-export type CiVariableName = "commitSha" | "jobToken" | "jobImage" | "registry" | "registryImage" | "registryUser";
+export type CiVariableName = "commitSha" | "jobToken" | "jobImage" | "registry" | "registryImage" | "registryUser" | "registryPassword";
 /**
  * resolves a platform-neutral CI variable to a bash expression for the
  * pipeline type of the given context.

package/dist/packages/pipeline/src/bash/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/bash/ciVariables.ts"],"names":[],"mappings":";;;AAAA,gEAAqE;AACrE,gEAAqE;AAErE,0CAAiD;AAgBjD,MAAM,8BAA8B,GAEhC;IACF,MAAM,EAAE,iCAAmB;IAC3B,MAAM,EAAE,iCAAmB;CAC5B,CAAC;AAEF;;;GAGG;AACI,MAAM,aAAa,GAAG,CAC3B,OAAwC,EACxC,IAAoB,EACJ,EAAE;;IAClB,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC;IACtD,OAAO,IAAI,qBAAc,CACvB,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/bash/ciVariables.ts"],"names":[],"mappings":";;;AAAA,gEAAqE;AACrE,gEAAqE;AAErE,0CAAiD;AAiBjD,MAAM,8BAA8B,GAEhC;IACF,MAAM,EAAE,iCAAmB;IAC3B,MAAM,EAAE,iCAAmB;CAC5B,CAAC;AAEF;;;GAGG;AACI,MAAM,aAAa,GAAG,CAC3B,OAAwC,EACxC,IAAoB,EACJ,EAAE;;IAClB,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC;IACtD,OAAO,IAAI,qBAAc,CACvB,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB"}

package/dist/packages/pipeline/src/deploy/kubernetes/deployJob.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = require("../../bash/ciVariables");
 const getEnvironmentVariables_1 = require("../../context/getEnvironmentVariables");
 const runner_1 = require("../../runner");
 const base_1 = require("../base");
@@ -33,6 +34,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/packages/pipeline/src/deploy/kubernetes/deployJob.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/kubernetes/deployJob.ts"],"names":[],"mappings":";;;AAAA,mFAAmF;AACnF,yCAA8C;AAG9C,kCAAgD;AAEhD,oCAA0C;AAC1C,6CAAgD;AAEhD,0CAA4D;AAC5D,+CAAyD;AAEzD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACpC,MAAM,0BAA0B,GAAG,CACxC,OAAyB,EACT,EAAE;;IAClB,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,sBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,oBAAoB;QACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAA4D;QACtE,KAAK,EAAE,IAAA,uBAAc,EAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,KAAK;YACpB,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,eAAe,EAAE,QAAQ;qBAC1B;oBACD,IAAI,EAAE,QAAQ;iBACf;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE;YACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;YAC9B,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;YAC1C,qBAAqB,EAAE,GAAG;YAC1B,6BAA6B,EAAE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YAChE,sBAAsB,EACpB,MAAA,YAAY,CAAC,SAAS,mCAAI,+BAA+B;YAC3D,SAAS,EAAE;gBACT,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC;aAC3C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,cAAc,EAAE,OAAO,CAAC,IAAI;SAC7B;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG;QACrB,+BAA+B,WAAW,gBAAgB,IAAA,oDAA0B,EAClF,OAAO,EACP,UAAU,CACX,qCAAqC,IAAA,oDAA0B,EAC9D,OAAO,EACP,aAAa,CACd,kCAAkC;QACnC,mCAAmC,WAAW,eAAe,IAAA,oDAA0B,EACrF,OAAO,EACP,YAAY,CACb,GAAG;QACJ,+BAA+B,WAAW,gBAAgB,WAAW,aAAa,WAAW,kBAAkB,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,GAAG;QAC5J,+BAA+B,WAAW,GAAG;KAC9C,CAAC;IAEF,OAAO,IAAA,4BAAqB,EAAC,OAAO,EAAE;QACpC,MAAM,EAAE;YACN,GAAG,MAAM;YACT,MAAM,EAAE;gBACN,GAAG,cAAc;gBACjB,GAAG,IAAA,4BAAmB,EACpB,gBAAgB,EAChB,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CACpD,CACC,IAAA,gCAAyB,EAAC,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CACtE;gBACD,wBAAwB;gBACxB,kBAAkB;gBAElB,+BAA+B;aAChC;SACF;QACD,IAAI,EAAE;YACJ,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,kBAAkB,CAAC;SAChD;QACD,QAAQ,EAAE;YACR,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,oBAAoB,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AA/EW,QAAA,0BAA0B,8BA+ErC"}
+{"version":3,"file":"deployJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/kubernetes/deployJob.ts"],"names":[],"mappings":";;;AAAA,wDAAuD;AACvD,mFAAmF;AACnF,yCAA8C;AAG9C,kCAAgD;AAEhD,oCAA0C;AAC1C,6CAAgD;AAEhD,0CAA4D;AAC5D,+CAAyD;AAEzD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACpC,MAAM,0BAA0B,GAAG,CACxC,OAAyB,EACT,EAAE;;IAClB,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,sBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,oBAAoB;QACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAA4D;QACtE,KAAK,EAAE,IAAA,uBAAc,EAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,KAAK;YACpB,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,eAAe,EAAE,QAAQ;qBAC1B;oBACD,IAAI,EAAE,QAAQ;iBACf;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE;YACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;YAC9B,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;YAC1C,qBAAqB,EAAE,GAAG;YAC1B,6BAA6B,EAAE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,gEAAgE;YAChE,+CAA+C;YAC/C,oBAAoB,EAAE,IAAA,2BAAa,EAAC,OAAO,EAAE,cAAc,CAAC;YAC5D,wBAAwB,EAAE,IAAA,2BAAa,EAAC,OAAO,EAAE,kBAAkB,CAAC;YACpE,sBAAsB,EACpB,MAAA,YAAY,CAAC,SAAS,mCAAI,+BAA+B;YAC3D,SAAS,EAAE;gBACT,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC;aAC3C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,cAAc,EAAE,OAAO,CAAC,IAAI;SAC7B;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG;QACrB,+BAA+B,WAAW,gBAAgB,IAAA,oDAA0B,EAClF,OAAO,EACP,UAAU,CACX,qCAAqC,IAAA,oDAA0B,EAC9D,OAAO,EACP,aAAa,CACd,kCAAkC;QACnC,mCAAmC,WAAW,eAAe,IAAA,oDAA0B,EACrF,OAAO,EACP,YAAY,CACb,GAAG;QACJ,+BAA+B,WAAW,gBAAgB,WAAW,aAAa,WAAW,kBAAkB,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,GAAG;QAC5J,+BAA+B,WAAW,GAAG;KAC9C,CAAC;IAEF,OAAO,IAAA,4BAAqB,EAAC,OAAO,EAAE;QACpC,MAAM,EAAE;YACN,GAAG,MAAM;YACT,MAAM,EAAE;gBACN,GAAG,cAAc;gBACjB,GAAG,IAAA,4BAAmB,EACpB,gBAAgB,EAChB,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CACpD,CACC,IAAA,gCAAyB,EAAC,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CACtE;gBACD,wBAAwB;gBACxB,kBAAkB;gBAElB,+BAA+B;aAChC;SACF;QACD,IAAI,EAAE;YACJ,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,kBAAkB,CAAC;SAChD;QACD,QAAQ,EAAE;YACR,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,oBAAoB,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AArFW,QAAA,0BAA0B,8BAqFrC"}

package/dist/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -1,11 +1,23 @@
 #!/bin/bash
 set -e
 
+# The credentials come from DOCKER_REGISTRY_USER / DOCKER_REGISTRY_PASSWORD,
+# which the deploy job resolves per CI backend (gitlab: CI_REGISTRY_USER +
+# CI_REGISTRY_PASSWORD, github: the actor + workflow token) — the raw
+# gitlab names used to be hardcoded here, which left the secret without
+# credentials on the github backend.
+#
+# Both of those are job-scoped and expire with the pipeline: the initial
+# pull works, but a pod rescheduled later can no longer re-pull. Projects
+# that need durable pulls declare long-lived registry credentials as
+# secrets named CI_DEPLOY_USER / CI_DEPLOY_PASSWORD, which win here.
+#
+# --docker-email is deliberately gone: it is optional for a
+# docker-registry secret and its only source was $GITLAB_USER_EMAIL.
 echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
 kubectl create secret -n "$KUBE_NAMESPACE" \
     docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
     --docker-server="$DOCKER_REGISTRY" \
-    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
-    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
-    --docker-email="$GITLAB_USER_EMAIL" \
+    --docker-username="${CI_DEPLOY_USER:-$DOCKER_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$DOCKER_REGISTRY_PASSWORD}" \
     -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/skills/catladder-migrate-ci-backend/SKILL.md

@@ -193,16 +193,40 @@ See the `catladder-releases` skill for how the release jobs differ
 
 ## Step 7 — registry and the first run
 
-The container registry changes with the backend: `$CI_REGISTRY_IMAGE` on
-GitLab, `ghcr.io/<owner>/<repo>` on GitHub. Consequences to state
-explicitly:
-
-- The first pipeline on the new backend **rebuilds every job image and
-  every app image** — it will be slow, and that is expected, not a bug.
-- The deploy target must be able to **pull from the new registry**.
-  catladder does not manage image-pull credentials on the cluster or on
-  Cloud Run, so check GHCR package visibility / the pull secret with
-  whoever owns the target *before* pointing a real environment at it.
+The **job images** (the catladder runner images) always live in the CI
+system's own registry, so they change host with the backend:
+`$CI_REGISTRY_IMAGE` on GitLab, `ghcr.io/<owner>/<repo>` on GitHub. The
+first pipeline on the new backend therefore **rebuilds every job image**
+— it will be slow, and that is expected, not a bug.
+
+Where the **app image** goes depends on the deploy type:
+
+- **`google-cloudrun`** — the image goes to Google Artifact Registry
+  (`<region>-docker.pkg.dev/<projectId>/catladder-deploy/…`) on both
+  backends. Cloud Run can only pull from AR/GCR, so a backend migration
+  does not move the app image at all. Nothing to do here.
+- **`kubernetes`** — the app image lives in the CI registry and does
+  move. catladder handles the pull itself: every deploy runs
+  `kubernetesCreateSecret`, which writes a `docker-registry` secret
+  (`gitlab-registry-<component>`) into the namespace, and the chart wires
+  it in as `imagePullSecrets`. Note the secret keeps its historical name
+  on both backends.
+
+The credential behind that secret differs per backend, and this is the
+one thing to raise before a kubernetes component moves to GitHub:
+
+- **GitLab** provisions a durable one automatically —
+  `catladder project setup` creates a `gitlab-deploy-token` (scope
+  `read_registry`), GitLab exposes it to jobs as `CI_DEPLOY_USER` /
+  `CI_DEPLOY_PASSWORD`, and `project doctor` fails when it is missing.
+- **GitHub has no equivalent.** The deploy falls back to the workflow
+  token, which expires with the run: the initial pull succeeds and the
+  job goes green, but a pod rescheduled later cannot re-pull —
+  `ImagePullBackOff` weeks after a deploy that looked fine. Until that
+  is solved (catladder issue #75), a project moving kubernetes to GitHub
+  must supply a long-lived registry credential itself, declared as
+  secrets named `CI_DEPLOY_USER` / `CI_DEPLOY_PASSWORD` (a PAT with
+  `read:packages`), which take precedence in the deploy.
 
 ## Step 8 — run both, compare, then cut over