@catladder/cli 0.0.0-next-8cc9134a → 0.0.0-next-f2614a3a

package/dist/bundles/catenv/index.js

@@ -2658,6 +2658,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
@@ -3788,6 +3791,7 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map
 
@@ -9746,6 +9750,7 @@ exports.createKubernetesCloudsqlBaseValues = createKubernetesCloudsqlBaseValues;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = __nccwpck_require__(72700);
 const getEnvironmentVariables_1 = __nccwpck_require__(44776);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
@@ -9778,6 +9783,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/bundles/cli/index.js

@@ -8651,6 +8651,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
@@ -9781,6 +9784,7 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map
 
@@ -15739,6 +15743,7 @@ exports.createKubernetesCloudsqlBaseValues = createKubernetesCloudsqlBaseValues;
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = __nccwpck_require__(72700);
 const getEnvironmentVariables_1 = __nccwpck_require__(44776);
 const runner_1 = __nccwpck_require__(71065);
 const base_1 = __nccwpck_require__(93664);
@@ -15771,6 +15776,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/bundles/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -1,11 +1,23 @@
 #!/bin/bash
 set -e
 
+# The credentials come from DOCKER_REGISTRY_USER / DOCKER_REGISTRY_PASSWORD,
+# which the deploy job resolves per CI backend (gitlab: CI_REGISTRY_USER +
+# CI_REGISTRY_PASSWORD, github: the actor + workflow token) — the raw
+# gitlab names used to be hardcoded here, which left the secret without
+# credentials on the github backend.
+#
+# Both of those are job-scoped and expire with the pipeline: the initial
+# pull works, but a pod rescheduled later can no longer re-pull. Projects
+# that need durable pulls declare long-lived registry credentials as
+# secrets named CI_DEPLOY_USER / CI_DEPLOY_PASSWORD, which win here.
+#
+# --docker-email is deliberately gone: it is optional for a
+# docker-registry secret and its only source was $GITLAB_USER_EMAIL.
 echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
 kubectl create secret -n "$KUBE_NAMESPACE" \
     docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
     --docker-server="$DOCKER_REGISTRY" \
-    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
-    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
-    --docker-email="$GITLAB_USER_EMAIL" \
+    --docker-username="${CI_DEPLOY_USER:-$DOCKER_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$DOCKER_REGISTRY_PASSWORD}" \
     -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -

package/dist/packages/pipeline/src/backends/github/ciVariables.js

@@ -15,6 +15,9 @@ exports.GITHUB_CI_VARIABLES = {
     registry: "CL_REGISTRY",
     registryImage: "CL_REGISTRY_IMAGE",
     registryUser: "CL_REGISTRY_USER",
+    // github has no separate registry password: ghcr authenticates with
+    // the workflow token, the same one CL_JOB_TOKEN carries
+    registryPassword: "CL_JOB_TOKEN",
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*

package/dist/packages/pipeline/src/backends/github/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;CACjC,CAAC;AAEF;;;GAGG;AACU,QAAA,4BAA4B,GAA2B;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,uCAAuC;IACvC,YAAY,EAAE,4BAA4B;CAC3C,CAAC"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/github/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,YAAY;IACvB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,oEAAoE;IACpE,wDAAwD;IACxD,gBAAgB,EAAE,cAAc;CACjC,CAAC;AAEF;;;GAGG;AACU,QAAA,4BAA4B,GAA2B;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,kCAAkC;IACrD,gBAAgB,EAAE,qBAAqB;IACvC,uCAAuC;IACvC,YAAY,EAAE,4BAA4B;CAC3C,CAAC"}

package/dist/packages/pipeline/src/backends/gitlab/ciVariables.js

@@ -12,5 +12,6 @@ exports.GITLAB_CI_VARIABLES = {
     registry: "CI_REGISTRY",
     registryImage: "CI_REGISTRY_IMAGE",
     registryUser: "CI_REGISTRY_USER",
+    registryPassword: "CI_REGISTRY_PASSWORD",
 };
 //# sourceMappingURL=ciVariables.js.map

package/dist/packages/pipeline/src/backends/gitlab/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;CACjC,CAAC"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/ciVariables.ts"],"names":[],"mappings":";;;AAEA;;;GAGG;AACU,QAAA,mBAAmB,GAAmC;IACjE,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,aAAa;IACvB,aAAa,EAAE,mBAAmB;IAClC,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,sBAAsB;CACzC,CAAC"}

package/dist/packages/pipeline/src/bash/ciVariables.d.ts

@@ -6,7 +6,7 @@ import { BashExpression } from "../../../bash/src/index.js";
  * of hardcoding e.g. gitlab's `$CI_*` variables, so that other pipeline
  * types can map them to their own predefined variables.
  */
-export type CiVariableName = "commitSha" | "jobToken" | "jobImage" | "registry" | "registryImage" | "registryUser";
+export type CiVariableName = "commitSha" | "jobToken" | "jobImage" | "registry" | "registryImage" | "registryUser" | "registryPassword";
 /**
  * resolves a platform-neutral CI variable to a bash expression for the
  * pipeline type of the given context.

package/dist/packages/pipeline/src/bash/ciVariables.js.map

@@ -1 +1 @@
-{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/bash/ciVariables.ts"],"names":[],"mappings":";;;AAAA,gEAAqE;AACrE,gEAAqE;AAErE,0CAAiD;AAgBjD,MAAM,8BAA8B,GAEhC;IACF,MAAM,EAAE,iCAAmB;IAC3B,MAAM,EAAE,iCAAmB;CAC5B,CAAC;AAEF;;;GAGG;AACI,MAAM,aAAa,GAAG,CAC3B,OAAwC,EACxC,IAAoB,EACJ,EAAE;;IAClB,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC;IACtD,OAAO,IAAI,qBAAc,CACvB,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB"}
+{"version":3,"file":"ciVariables.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/bash/ciVariables.ts"],"names":[],"mappings":";;;AAAA,gEAAqE;AACrE,gEAAqE;AAErE,0CAAiD;AAiBjD,MAAM,8BAA8B,GAEhC;IACF,MAAM,EAAE,iCAAmB;IAC3B,MAAM,EAAE,iCAAmB;CAC5B,CAAC;AAEF;;;GAGG;AACI,MAAM,aAAa,GAAG,CAC3B,OAAwC,EACxC,IAAoB,EACJ,EAAE;;IAClB,sEAAsE;IACtE,qEAAqE;IACrE,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,YAAY,mCAAI,QAAQ,CAAC;IACtD,OAAO,IAAI,qBAAc,CACvB,IAAI,8BAA8B,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;AACJ,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB"}

package/dist/packages/pipeline/src/deploy/kubernetes/deployJob.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createKubernetesDeployJobs = void 0;
+const ciVariables_1 = require("../../bash/ciVariables");
 const getEnvironmentVariables_1 = require("../../context/getEnvironmentVariables");
 const runner_1 = require("../../runner");
 const base_1 = require("../base");
@@ -33,6 +34,12 @@ const createKubernetesDeployJobs = (context) => {
             RELEASE_NAME: context.environment.fullName,
             HELM_EXPERIMENTAL_OCI: "1",
             KUBE_DOCKER_IMAGE_PULL_SECRET: `gitlab-registry-${context.name}`,
+            // credentials for the image pull secret kubernetesCreateSecret
+            // writes into the namespace. Resolved per backend (gitlab: the
+            // registry user + password, github: the actor + workflow token)
+            // so the script itself stays backend-agnostic.
+            DOCKER_REGISTRY_USER: (0, ciVariables_1.getCiVariable)(context, "registryUser"),
+            DOCKER_REGISTRY_PASSWORD: (0, ciVariables_1.getCiVariable)(context, "registryPassword"),
             HELM_GITLAB_CHART_NAME: (_b = deployConfig.chartName) !== null && _b !== void 0 ? _b : "/helm-charts/the-panter-chart",
             HELM_ARGS: [
                 ...(deployConfig.debug ? ["--debug"] : []),

package/dist/packages/pipeline/src/deploy/kubernetes/deployJob.js.map

@@ -1 +1 @@
-{"version":3,"file":"deployJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/kubernetes/deployJob.ts"],"names":[],"mappings":";;;AAAA,mFAAmF;AACnF,yCAA8C;AAG9C,kCAAgD;AAEhD,oCAA0C;AAC1C,6CAAgD;AAEhD,0CAA4D;AAC5D,+CAAyD;AAEzD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACpC,MAAM,0BAA0B,GAAG,CACxC,OAAyB,EACT,EAAE;;IAClB,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,sBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,oBAAoB;QACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAA4D;QACtE,KAAK,EAAE,IAAA,uBAAc,EAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,KAAK;YACpB,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,eAAe,EAAE,QAAQ;qBAC1B;oBACD,IAAI,EAAE,QAAQ;iBACf;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE;YACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;YAC9B,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;YAC1C,qBAAqB,EAAE,GAAG;YAC1B,6BAA6B,EAAE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YAChE,sBAAsB,EACpB,MAAA,YAAY,CAAC,SAAS,mCAAI,+BAA+B;YAC3D,SAAS,EAAE;gBACT,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC;aAC3C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,cAAc,EAAE,OAAO,CAAC,IAAI;SAC7B;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG;QACrB,+BAA+B,WAAW,gBAAgB,IAAA,oDAA0B,EAClF,OAAO,EACP,UAAU,CACX,qCAAqC,IAAA,oDAA0B,EAC9D,OAAO,EACP,aAAa,CACd,kCAAkC;QACnC,mCAAmC,WAAW,eAAe,IAAA,oDAA0B,EACrF,OAAO,EACP,YAAY,CACb,GAAG;QACJ,+BAA+B,WAAW,gBAAgB,WAAW,aAAa,WAAW,kBAAkB,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,GAAG;QAC5J,+BAA+B,WAAW,GAAG;KAC9C,CAAC;IAEF,OAAO,IAAA,4BAAqB,EAAC,OAAO,EAAE;QACpC,MAAM,EAAE;YACN,GAAG,MAAM;YACT,MAAM,EAAE;gBACN,GAAG,cAAc;gBACjB,GAAG,IAAA,4BAAmB,EACpB,gBAAgB,EAChB,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CACpD,CACC,IAAA,gCAAyB,EAAC,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CACtE;gBACD,wBAAwB;gBACxB,kBAAkB;gBAElB,+BAA+B;aAChC;SACF;QACD,IAAI,EAAE;YACJ,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,kBAAkB,CAAC;SAChD;QACD,QAAQ,EAAE;YACR,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,oBAAoB,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AA/EW,QAAA,0BAA0B,8BA+ErC"}
+{"version":3,"file":"deployJob.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/deploy/kubernetes/deployJob.ts"],"names":[],"mappings":";;;AAAA,wDAAuD;AACvD,mFAAmF;AACnF,yCAA8C;AAG9C,kCAAgD;AAEhD,oCAA0C;AAC1C,6CAAgD;AAEhD,0CAA4D;AAC5D,+CAAyD;AAEzD,MAAM,eAAe,GAAG,kBAAkB,CAAC;AACpC,MAAM,0BAA0B,GAAG,CACxC,OAAyB,EACT,EAAE;;IAClB,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,IAAA,sBAAc,EAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAChD,oBAAoB;QACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,MAAM,GAA4D;QACtE,KAAK,EAAE,IAAA,uBAAc,EAAC,YAAY,CAAC;QACnC,GAAG,CAAC,YAAY,CAAC,KAAK;YACpB,CAAC,CAAC;gBACE,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,eAAe,EAAE,QAAQ;qBAC1B;oBACD,IAAI,EAAE,QAAQ;iBACf;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE;YACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;YAC9B,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;YAC1C,qBAAqB,EAAE,GAAG;YAC1B,6BAA6B,EAAE,mBAAmB,OAAO,CAAC,IAAI,EAAE;YAChE,+DAA+D;YAC/D,+DAA+D;YAC/D,gEAAgE;YAChE,+CAA+C;YAC/C,oBAAoB,EAAE,IAAA,2BAAa,EAAC,OAAO,EAAE,cAAc,CAAC;YAC5D,wBAAwB,EAAE,IAAA,2BAAa,EAAC,OAAO,EAAE,kBAAkB,CAAC;YACpE,sBAAsB,EACpB,MAAA,YAAY,CAAC,SAAS,mCAAI,+BAA+B;YAC3D,SAAS,EAAE;gBACT,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,MAAA,YAAY,CAAC,kBAAkB,mCAAI,EAAE,CAAC;aAC3C,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,cAAc,EAAE,OAAO,CAAC,IAAI;SAC7B;KACF,CAAC;IAEF,MAAM,WAAW,GAAG,QAAQ,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;IAC3D,MAAM,cAAc,GAAG;QACrB,+BAA+B,WAAW,gBAAgB,IAAA,oDAA0B,EAClF,OAAO,EACP,UAAU,CACX,qCAAqC,IAAA,oDAA0B,EAC9D,OAAO,EACP,aAAa,CACd,kCAAkC;QACnC,mCAAmC,WAAW,eAAe,IAAA,oDAA0B,EACrF,OAAO,EACP,YAAY,CACb,GAAG;QACJ,+BAA+B,WAAW,gBAAgB,WAAW,aAAa,WAAW,kBAAkB,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,GAAG;QAC5J,+BAA+B,WAAW,GAAG;KAC9C,CAAC;IAEF,OAAO,IAAA,4BAAqB,EAAC,OAAO,EAAE;QACpC,MAAM,EAAE;YACN,GAAG,MAAM;YACT,MAAM,EAAE;gBACN,GAAG,cAAc;gBACjB,GAAG,IAAA,4BAAmB,EACpB,gBAAgB,EAChB,QAAQ,GAAG,eAAe,GAAG,sBAAsB,CACpD,CACC,IAAA,gCAAyB,EAAC,IAAA,6BAAgB,EAAC,OAAO,CAAC,EAAE,eAAe,CAAC,CACtE;gBACD,wBAAwB;gBACxB,kBAAkB;gBAElB,+BAA+B;aAChC;SACF;QACD,IAAI,EAAE;YACJ,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,kBAAkB,CAAC;SAChD;QACD,QAAQ,EAAE;YACR,GAAG,MAAM;YACT,MAAM,EAAE,CAAC,GAAG,cAAc,EAAE,oBAAoB,CAAC;SAClD;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AArFW,QAAA,0BAA0B,8BAqFrC"}

package/dist/runner-images/kubernetes/scripts/kubernetesCreateSecret

@@ -1,11 +1,23 @@
 #!/bin/bash
 set -e
 
+# The credentials come from DOCKER_REGISTRY_USER / DOCKER_REGISTRY_PASSWORD,
+# which the deploy job resolves per CI backend (gitlab: CI_REGISTRY_USER +
+# CI_REGISTRY_PASSWORD, github: the actor + workflow token) — the raw
+# gitlab names used to be hardcoded here, which left the secret without
+# credentials on the github backend.
+#
+# Both of those are job-scoped and expire with the pipeline: the initial
+# pull works, but a pod rescheduled later can no longer re-pull. Projects
+# that need durable pulls declare long-lived registry credentials as
+# secrets named CI_DEPLOY_USER / CI_DEPLOY_PASSWORD, which win here.
+#
+# --docker-email is deliberately gone: it is optional for a
+# docker-registry secret and its only source was $GITLAB_USER_EMAIL.
 echo "KUBE_NAMESPACE: '$KUBE_NAMESPACE', KUBE_DOCKER_IMAGE_PULL_SECRET: '$KUBE_DOCKER_IMAGE_PULL_SECRET'"
 kubectl create secret -n "$KUBE_NAMESPACE" \
     docker-registry $KUBE_DOCKER_IMAGE_PULL_SECRET \
     --docker-server="$DOCKER_REGISTRY" \
-    --docker-username="${CI_DEPLOY_USER:-$CI_REGISTRY_USER}" \
-    --docker-password="${CI_DEPLOY_PASSWORD:-$CI_REGISTRY_PASSWORD}" \
-    --docker-email="$GITLAB_USER_EMAIL" \
+    --docker-username="${CI_DEPLOY_USER:-$DOCKER_REGISTRY_USER}" \
+    --docker-password="${CI_DEPLOY_PASSWORD:-$DOCKER_REGISTRY_PASSWORD}" \
     -o yaml --dry-run | kubectl replace -n "$KUBE_NAMESPACE" --force -f -