@catladder/cli 0.0.0-next-d71e41ba → 0.0.0-next-dccc0a36

package/dist/packages/pipeline/src/types/config.d.ts

@@ -1,7 +1,7 @@
 import type { BuildConfig } from "../build/types";
 import type { DeployConfig } from "../deploy/types";
 import type { CatladderJobSpec } from "./jobs";
-import type { ComponentContext } from "./context";
+import type { ComponentContext, PackageManagerType } from "./context";
 import type { PartialDeep } from "./utils";
 import type { PipelineType, WorkspaceBuildConfig } from "..";
 import type { AgentConfig } from "./agent";
@@ -9,6 +9,7 @@ import type { Hooks } from "./hooks";
 import type { ReleaseConfig } from "./release";
 import type { CatladderStore } from "../store";
 import type { AgentSkillsConfig } from "../agentSkills/types";
+import type { ProjectImageConfig } from "../customImages/projectImages";
 import type { VerifyConfig } from "../verify/types";
 export declare const ALL_PIPELINE_TRIGGERS: readonly ["mainBranch", "mr", "taggedRelease"];
 export type PipelineTrigger = (typeof ALL_PIPELINE_TRIGGERS)[number];
@@ -255,6 +256,13 @@ export type Config<C extends ConfigProps = never> = {
      * how secrets are stored and shared (see {@link SecretsConfig})
      */
     secrets?: SecretsConfig;
+    /**
+     * which package manager the project uses. Usually not needed:
+     * catladder autodetects it from the `packageManager` field in
+     * package.json or the lockfile present (pnpm-lock.yaml / yarn.lock),
+     * falling back to yarn. Set it to override the detection.
+     */
+    packageManager?: PackageManagerType;
     /**
      * materialize the agent skills shipped with catladder (usage guides
      * for AI coding agents like Claude Code) into the repository, so
@@ -287,6 +295,13 @@ export type Config<C extends ConfigProps = never> = {
      */
     domainCanonical?: string;
     agents?: Record<string, AgentConfig>;
+    /**
+     * docker images declared by the project, built automatically in the
+     * pipeline: content-hashed into the project's own registry and only
+     * rebuilt when their inputs change. Reference them in any `jobImage`
+     * field via `{ image: "<key>" }`.
+     */
+    images?: Record<string, ProjectImageConfig>;
     builds?: Record<string, WorkspaceBuildConfig>;
     /**
      * components (sub apps)

package/dist/packages/pipeline/src/types/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/config.ts"],"names":[],"mappings":";;;AAca,QAAA,qBAAqB,GAAG;IACnC,YAAY;IACZ,IAAI;IACJ,eAAe;CACP,CAAC;AAGX;;;GAGG;AACU,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE;QACH,QAAQ,EAAE,CAAC,YAAY,CAAC;KACzB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,CAAC,IAAI,CAAC;KACjB;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,EAAE;KACb;CACO,CAAC;AAEX;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAE,EAAE,CAC/D,MAAM,CAAC,OAAO,CAAC,iBAAS,CAAC;KACtB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,QAAuC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D;KACA,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAY,CAAC,CAAC;AALnB,QAAA,oBAAoB,wBAKD;AAEnB,QAAA,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAS,CAAC,CAAC;AACtC,QAAA,iBAAiB,GAAG,oBAAyB,CAAC;AAGpD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAkB,EAAE;IAC3D,OAAO,GAAG,IAAI,iBAAS,CAAC;AAC1B,CAAC,CAAC;AAFW,QAAA,aAAa,iBAExB"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/config.ts"],"names":[],"mappings":";;;AAea,QAAA,qBAAqB,GAAG;IACnC,YAAY;IACZ,IAAI;IACJ,eAAe;CACP,CAAC;AAGX;;;GAGG;AACU,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE;QACH,QAAQ,EAAE,CAAC,YAAY,CAAC;KACzB;IACD,MAAM,EAAE;QACN,QAAQ,EAAE,CAAC,IAAI,CAAC;KACjB;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD,IAAI,EAAE;QACJ,QAAQ,EAAE,CAAC,eAAe,CAAC;KAC5B;IACD,KAAK,EAAE;QACL,QAAQ,EAAE,EAAE;KACb;CACO,CAAC;AAEX;;;;GAIG;AACI,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAE,EAAE,CAC/D,MAAM,CAAC,OAAO,CAAC,iBAAS,CAAC;KACtB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,CAAC,CAAC,QAAuC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC7D;KACA,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAY,CAAC,CAAC;AALnB,QAAA,oBAAoB,wBAKD;AAEnB,QAAA,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAS,CAAC,CAAC;AACtC,QAAA,iBAAiB,GAAG,oBAAyB,CAAC;AAGpD,MAAM,aAAa,GAAG,CAAC,GAAW,EAAkB,EAAE;IAC3D,OAAO,GAAG,IAAI,iBAAS,CAAC;AAC1B,CAAC,CAAC;AAFW,QAAA,aAAa,iBAExB"}

package/dist/packages/pipeline/src/types/context.d.ts

@@ -45,23 +45,31 @@ export type YarnWorkspace = {
     workspaceDependencies: string[];
     mismatchedWorkspaceDependencies: string[];
 };
+export type PackageManagerType = "yarn" | "pnpm";
 export type YarnPackageManagerInfoBase = {
     type: "yarn";
     version: string;
     workspaces: YarnWorkspace[];
     isClassic: boolean;
 };
-export type YarnPackageManagerInfoComponent = YarnPackageManagerInfoBase & {
+export type PnpmPackageManagerInfoBase = {
+    type: "pnpm";
+    version: string;
+    workspaces: YarnWorkspace[];
+};
+type PackageManagerInfoComponentPart = {
     currentWorkspace?: YarnWorkspace;
     componentIsInWorkspace: boolean;
     pathsToCopyInDocker: string[];
     currentWorkspaceDependencies: string[];
 };
-export type PackageManagerInfoComponent = YarnPackageManagerInfoComponent;
+export type YarnPackageManagerInfoComponent = YarnPackageManagerInfoBase & PackageManagerInfoComponentPart;
+export type PnpmPackageManagerInfoComponent = PnpmPackageManagerInfoBase & PackageManagerInfoComponentPart;
+export type PackageManagerInfoComponent = YarnPackageManagerInfoComponent | PnpmPackageManagerInfoComponent;
 /**
  * not confuse with yarn workspaces
  */
-export type PackageManagerInfoBase = YarnPackageManagerInfoBase;
+export type PackageManagerInfoBase = YarnPackageManagerInfoBase | PnpmPackageManagerInfoBase;
 export type ContextBeforeConfig = {
     componentName: string;
     fullConfig: Config;

package/dist/packages/pipeline/src/types/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/context.ts"],"names":[],"mappings":";;;AA8LO,MAAM,iCAAiC,GAAG,CAC/C,OAAgD,EACK,EAAE;IACvD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC7C,CAAC,CAAC;AAJW,QAAA,iCAAiC,qCAI5C;AAEK,MAAM,iCAAiC,GAAG,CAC/C,OAAgD,EACQ,EAAE;IAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC;AAChD,CAAC,CAAC;AAJW,QAAA,iCAAiC,qCAI5C"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/context.ts"],"names":[],"mappings":";;;AAiNO,MAAM,iCAAiC,GAAG,CAC/C,OAAgD,EACK,EAAE;IACvD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAC7C,CAAC,CAAC;AAJW,QAAA,iCAAiC,qCAI5C;AAEK,MAAM,iCAAiC,GAAG,CAC/C,OAAgD,EACQ,EAAE;IAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC;AAChD,CAAC,CAAC;AAJW,QAAA,iCAAiC,qCAI5C"}

package/dist/packages/pipeline/src/types/jobs.d.ts

@@ -1,5 +1,6 @@
 import type { UnspecifiedEnvVars } from "..";
 import type { CatladderImageRef } from "../runner";
+import type { ProjectImageRef } from "../customImages/projectImages";
 import type { CacheConfig } from "../build/types";
 import type { Artifacts, GitlabJobCache, GitlabJobDef, GitlabJobImage, GitlabRule } from "./gitlab-types";
 export type CatladderJobCache = GitlabJobCache & {
@@ -186,7 +187,7 @@ export type GitlabJobFields = {
      * catladder-provided job image (resolved by the backend to an image
      * built in the repository's own registry)
      */
-    image?: GitlabJobImage | CatladderImageRef;
+    image?: GitlabJobImage | CatladderImageRef | ProjectImageRef;
     /**
      * whether failures are allowed
      */

package/dist/packages/pipeline/src/types/jobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/jobs.ts"],"names":[],"mappings":";;;AAGA,8DAA2D;AAsB9C,QAAA,WAAW,GAAG;IACzB,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;CACE,CAAC;AAWE,QAAA,YAAY,GAAG;IAC1B,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,YAAY;CACJ,CAAC;AA6NX;;;;;;;GAOG;AACH,4JAA4J;AAC5J,MAAa,YAAY;IACvB,YAAY,IAAyB;QACnC,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAe,EAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,IAAI,CACT,GAAkD;QAElD,OAAO,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;CACF;AAZD,oCAYC"}
+{"version":3,"file":"jobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/types/jobs.ts"],"names":[],"mappings":";;;AAIA,8DAA2D;AAsB9C,QAAA,WAAW,GAAG;IACzB,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,MAAM;CACE,CAAC;AAWE,QAAA,YAAY,GAAG;IAC1B,OAAO;IACP,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,YAAY;CACJ,CAAC;AA6NX;;;;;;;GAOG;AACH,4JAA4J;AAC5J,MAAa,YAAY;IACvB,YAAY,IAAyB;QACnC,uDAAuD;QACvD,2DAA2D;QAC3D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,iCAAe,EAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,CAAC,IAAI,CACT,GAAkD;QAElD,OAAO,GAAG,YAAY,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;CACF;AAZD,oCAYC"}

package/dist/packages/pipeline/src/verify/createVerifyJobs.js

@@ -4,7 +4,7 @@ exports.createVerifyJobs = exports.VERIFY_JOB_NAME = void 0;
 const createArtifactsConfig_1 = require("../build/base/createArtifactsConfig");
 const cache_1 = require("../build/node/cache");
 const constants_1 = require("../build/node/constants");
-const yarn_1 = require("../build/node/yarn");
+const packageManagerInstall_1 = require("../build/node/packageManagerInstall");
 const deploy_1 = require("../deploy");
 const runner_1 = require("../runner");
 const utils_1 = require("../utils");
@@ -21,9 +21,9 @@ const createVerifyJobs = async (context) => {
         return [];
     }
     const isNodeBuild = context.build.type !== "disabled" && context.build.buildType === "node";
-    const [yarnInstall, nodeCache] = isNodeBuild
+    const [packageManagerInstall, nodeCache] = isNodeBuild
         ? await Promise.all([
-            (0, yarn_1.getYarnInstall)(context),
+            (0, packageManagerInstall_1.getPackageManagerInstall)(context),
             (0, cache_1.getNodeCache)(context, "pull"),
         ])
         : [null, null];
@@ -59,9 +59,9 @@ const createVerifyJobs = async (context) => {
             },
             script: [
                 ...setupScript,
-                ...(yarnInstall ? (0, yarn_1.ensureNodeVersion)(context) : []),
+                ...(packageManagerInstall ? (0, packageManagerInstall_1.ensureNodeVersion)(context) : []),
                 `cd ${context.build.dir}`,
-                ...(yarnInstall !== null && yarnInstall !== void 0 ? yarnInstall : []),
+                ...(packageManagerInstall !== null && packageManagerInstall !== void 0 ? packageManagerInstall : []),
                 ...(0, utils_1.ensureArray)(verifyConfig.command),
             ],
             allow_failure: verifyConfig.allowFailure,

package/dist/packages/pipeline/src/verify/createVerifyJobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"createVerifyJobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/verify/createVerifyJobs.ts"],"names":[],"mappings":";;;AAAA,+EAA4E;AAC5E,+CAAmD;AACnD,uDAAsE;AACtE,6CAAuE;AACvE,sCAAyC;AACzC,sCAA2C;AAG3C,oCAAuC;AAE1B,QAAA,eAAe,GAAG,WAAW,CAAC;AAEpC,MAAM,gBAAgB,GAAG,KAAK,EACnC,OAAyB,EACA,EAAE;;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,qDAAqD;QACrD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GACf,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC;IAE1E,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG,WAAW;QAC1C,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAA,qBAAc,EAAC,OAAO,CAAC;YACvB,IAAA,oBAAY,EAAC,OAAO,EAAE,MAAM,CAAC;SAC9B,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,WAAW,GACf,MAAA,MAAA,MAAA,qBAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAC,oBAAoB,mDAAG,OAAO,CAAC,mCAAI,EAAE,CAAC;IAExE,OAAO;QACL;YACE,IAAI,EAAE,uBAAe;YACrB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE;gBACR,uCAAuC;gBACvC,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC9C,6DAA6D;gBAC7D,GAAG,CAAC,MAAA,YAAY,CAAC,OAAO,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;oBACtD,UAAU,EAAE,YAAqB;oBACjC,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE;oBAClC,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;aACJ;YACD,KAAK,EAAE,MAAA,YAAY,CAAC,QAAQ,mCAAI,IAAA,uBAAc,EAAC,qBAAqB,CAAC;YACrE,+DAA+D;YAC/D,gEAAgE;YAChE,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,SAAS;YAC9B,SAAS,EAAE;gBACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;aAC/B;YACD,eAAe,EAAE;gBACf,GAAG,uCAA2B;gBAC9B,GAAG,CAAC,MAAA,YAAY,CAAC,eAAe,mCAAI,EAAE,CAAC;aACxC;YACD,MAAM,EAAE;gBACN,GAAG,WAAW;gBACd,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAA,wBAAiB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,GAAG,CAAC,WAAW,aAAX,WAAW,cAAX,WAAW,GAAI,EAAE,CAAC;gBACtB,GAAG,IAAA,mBAAW,EAAC,YAAY,CAAC,OAAO,CAAC;aACrC;YACD,aAAa,EAAE,YAAY,CAAC,YAAY;YACxC,GAAG,IAAA,6CAAqB,EACtB,OAAO,CAAC,KAAK,CAAC,GAAG,EACjB,YAAY,CAAC,gBAAgB,EAC7B,YAAY,CAAC,SAAS,CACvB;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAvEW,QAAA,gBAAgB,oBAuE3B"}
+{"version":3,"file":"createVerifyJobs.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/verify/createVerifyJobs.ts"],"names":[],"mappings":";;;AAAA,+EAA4E;AAC5E,+CAAmD;AACnD,uDAAsE;AACtE,+EAG6C;AAC7C,sCAAyC;AACzC,sCAA2C;AAG3C,oCAAuC;AAE1B,QAAA,eAAe,GAAG,WAAW,CAAC;AAEpC,MAAM,gBAAgB,GAAG,KAAK,EACnC,OAAyB,EACA,EAAE;;IAC3B,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,MAAM,CAAC;IACpD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,qDAAqD;QACrD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,WAAW,GACf,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC;IAE1E,MAAM,CAAC,qBAAqB,EAAE,SAAS,CAAC,GAAG,WAAW;QACpD,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,IAAA,gDAAwB,EAAC,OAAO,CAAC;YACjC,IAAA,oBAAY,EAAC,OAAO,EAAE,MAAM,CAAC;SAC9B,CAAC;QACJ,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEjB,MAAM,WAAW,GACf,MAAA,MAAA,MAAA,qBAAY,CAAC,YAAY,CAAC,IAAI,CAAC,EAAC,oBAAoB,mDAAG,OAAO,CAAC,mCAAI,EAAE,CAAC;IAExE,OAAO;QACL;YACE,IAAI,EAAE,uBAAe;YACrB,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,aAAa;YACtB,QAAQ,EAAE;gBACR,uCAAuC;gBACvC,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC9C,6DAA6D;gBAC7D,GAAG,CAAC,MAAA,YAAY,CAAC,OAAO,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;oBACtD,UAAU,EAAE,YAAqB;oBACjC,IAAI,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE;oBAClC,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,IAAI;iBACb,CAAC,CAAC;aACJ;YACD,KAAK,EAAE,MAAA,YAAY,CAAC,QAAQ,mCAAI,IAAA,uBAAc,EAAC,qBAAqB,CAAC;YACrE,+DAA+D;YAC/D,gEAAgE;YAChE,kEAAkE;YAClE,iEAAiE;YACjE,MAAM,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,SAAS;YAC9B,SAAS,EAAE;gBACT,GAAG,OAAO,CAAC,WAAW,CAAC,OAAO;aAC/B;YACD,eAAe,EAAE;gBACf,GAAG,uCAA2B;gBAC9B,GAAG,CAAC,MAAA,YAAY,CAAC,eAAe,mCAAI,EAAE,CAAC;aACxC;YACD,MAAM,EAAE;gBACN,GAAG,WAAW;gBACd,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAA,yCAAiB,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACzB,GAAG,CAAC,qBAAqB,aAArB,qBAAqB,cAArB,qBAAqB,GAAI,EAAE,CAAC;gBAChC,GAAG,IAAA,mBAAW,EAAC,YAAY,CAAC,OAAO,CAAC;aACrC;YACD,aAAa,EAAE,YAAY,CAAC,YAAY;YACxC,GAAG,IAAA,6CAAqB,EACtB,OAAO,CAAC,KAAK,CAAC,GAAG,EACjB,YAAY,CAAC,gBAAgB,EAC7B,YAAY,CAAC,SAAS,CACvB;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAvEW,QAAA,gBAAgB,oBAuE3B"}

package/dist/runner-images/docker-build/scripts/ensureNodeDockerfile

@@ -35,10 +35,17 @@ FROM node:$NODE_VERSION-alpine
 $DOCKERFILE_ADDITIONS
 
 RUN apk add --no-cache git curl
-USER node
+# package-manager setup (e.g. installing pnpm globally) and the
+# workspace-file copy run as root: pnpm ADDs a tar whose extracted
+# parent dirs come out root-owned (ADD --chown only covers the files),
+# so it needs a root chown before the node user can write node_modules.
+# The actual install below still runs as the unprivileged node user.
+$DOCKER_SETUP_PACKAGE_MANAGER
 
 $DOCKER_COPY_WORKSPACE_FILES
 
+USER node
+
 WORKDIR /app/$APP_DIR
 
 $DOCKER_COPY_AND_INSTALL_APP

package/dist/runner-images/jobs-default/Dockerfile

@@ -9,6 +9,10 @@ RUN rm /bin/sh && \
 # set high timeout for yarn, see https://github.com/dhis2/notes/issues/29
 RUN yarn config set network-timeout 600000 -g
 
+# pnpm for projects using it (pnpm self-switches to the version pinned
+# in the project's packageManager field)
+RUN npm install -g pnpm
+
 # install nvm && some common node versions
 RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash && \
     source /root/.nvm/nvm.sh && \

package/dist/skills/catladder-builds/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: catladder-builds
-description: Configuring how a component is built in a catladder project — the `build` config in catladder.ts (build types node / rails / meteor / custom, build & start commands, artifacts, caching, lint/test/audit jobs, the Docker image, and shared workspace builds). Use when adding or changing a component's build, choosing a build type, wiring a Dockerfile/nginx image, tuning the build/test/lint jobs, or setting up a monorepo workspace build. Triggers on "build config", "buildCommand", "build type", "Dockerfile", "docker image", "rails build", "monorepo build", "artifacts".
+description: Configuring how a component is built in a catladder project — the `build` config in catladder.ts (build types node / rails / meteor / custom, build & start commands, artifacts, caching, lint/test/audit jobs, the Docker image, project-declared job images, and shared workspace builds). Use when adding or changing a component's build, choosing a build type, wiring a Dockerfile/nginx image, declaring a custom CI job image (`images` config), tuning the build/test/lint jobs, or setting up a monorepo workspace build. Triggers on "build config", "buildCommand", "build type", "Dockerfile", "docker image", "job image", "jobImage", "custom image", "project image", "rails build", "monorepo build", "artifacts".
 ---
 
 # Component builds with catladder
@@ -28,11 +28,26 @@ components: {
 Set `build: false` to disable building for a component (e.g. a
 deploy-only or docker-tag component).
 
+Node-family builds work with **yarn or pnpm**: catladder autodetects the
+package manager (from the `packageManager` field in package.json or the
+lockfile) and generates the matching install commands, caches and
+default build/lint/test commands. Override with `packageManager:
+"pnpm" | "yarn"` at the top level of `catladder.ts` if needed. The
+`meteor` build type is yarn-only.
+
+pnpm gotchas: dependency build scripts must be approved in
+pnpm-workspace.yaml (`allowBuilds` map since pnpm 11,
+`onlyBuiltDependencies` list on pnpm 10); pnpm runs the root
+`prepare` script even during the production install in the docker
+build — guard husky with `"prepare": "husky || true"`; `pnpm run`
+prints a banner to stdout, so use `pnpm --silent run` in piped
+commands.
+
 ## Build types
 
 | Type | Use for | Notes |
 |---|---|---|
-| `node` | Node/JS apps (Next.js, Vite, plain node) | default `yarn build` + `yarn start`; `docker` selects the runtime image |
+| `node` | Node/JS apps (Next.js, Vite, plain node) | default `<pm> build` + `<pm> start` (yarn or pnpm, autodetected); `docker` selects the runtime image |
 | `rails` | Ruby on Rails apps | Cloud Native Buildpacks when there is no `Dockerfile`; Postgres test DB |
 | `meteor` | Meteor apps | starts `node main.js` |
 | `custom` | anything else | you provide the `jobImage` and `docker` config (both required) |
@@ -46,8 +61,9 @@ type: `build: { from: "web" }` (see workspace builds below).
 - `buildCommand` — the build step (`string | string[] | null | false`;
   `false`/`null` skips building).
 - `startCommand` — how the app is started at runtime.
-- `postInstall` — commands run after `yarn install` (node family; needed
-  e.g. for Yarn PnP where `package.json` postinstall won't run).
+- `postInstall` — commands run after the package-manager install (node
+  family; needed e.g. for Yarn PnP where `package.json` postinstall
+  won't run).
 - `lint` / `test` / `audit` — customize (`{ command, jobImage, … }`) or
   set to `false` to disable that job.
 - `artifactsPaths` / `artifactsExcludePaths` — extra build artifacts
@@ -55,11 +71,58 @@ type: `build: { from: "web" }` (see workspace builds below).
 - `cache` — build caching (see the `catladder-pipelines` skill for the
   caching model).
 - `jobImage`, `jobTags`, `jobVars`, `runnerVariables` — the CI image,
-  runner tags, build-only env vars, and extra runner variables.
+  runner tags, build-only env vars, and extra runner variables. A
+  `jobImage` is a concrete image url or `{ image: "<name>" }`
+  referencing a project image (see below).
 - `docker` — the image build strategy: a built-in
   (`{ type: "nginx" | "node" | "meteor" }`) or
   `{ type: "custom" }` (expects a `Dockerfile`).
 
+## Project images (custom CI job images)
+
+When a job needs a toolchain catladder doesn't ship (Java, Playwright,
+…), declare a Docker image at the top level under `images` and reference
+it in any `jobImage` field (build, `test.jobImage`, custom/pages deploy,
+verify):
+
+```ts
+images: {
+  // (a) a directory in the repo (default context = the dir)
+  "java-build": {
+    dir: "docker/java-build",                 // contains the Dockerfile
+    buildArgs: { MAVEN_VERSION: "3.9.9" },    // optional, part of the content hash
+    hashExtraPaths: ["shared/settings.xml"],  // optional extra hashed+watched files
+  },
+  // (b) inline (default context = repo root); materialized into
+  // .catladder-generated/images/project/<name>/Dockerfile
+  "db-tools": {
+    dockerfile: ["FROM alpine:3.21", "RUN apk add --no-cache postgresql17-client"],
+  },
+},
+components: {
+  api: {
+    build: { type: "custom", jobImage: { image: "java-build" }, docker: { type: "custom" } },
+  },
+}
+```
+
+`dir` and `dockerfile` are mutually exclusive. `context` overrides the
+build context (relative to the repo root) — needed when the image
+`COPY`s files from outside its `dir`.
+
+Catladder generates a `🐳 image <name>` job (setup stage) that builds
+the image content-hashed into the project registry
+(`…/job-images/<name>:<hash>`) and skips when it already exists — works
+on GitLab and GitHub.
+
+**The build context is not hashed** (it can be the whole repo) — only
+the Dockerfile / `dir`, `buildArgs` and `hashExtraPaths` are. Files
+pulled in via `COPY` that should trigger a rebuild belong in
+`hashExtraPaths`.
+
+Generation (`yarn catenv`) fails fast on an undeclared image name, a
+missing `dir`, or a `dir` without a `Dockerfile`.
+
 ## Workspace builds (monorepos)
 
 For a shared build across several components, declare it once at the top

package/dist/skills/catladder-builds/references/build-types.md

@@ -10,7 +10,7 @@ generated pipeline files.
 |---|---|---|
 | `buildCommand` | `string \| string[] \| null \| false` | build step; `false`/`null` skips it |
 | `startCommand` | `string` | runtime start command |
-| `postInstall` | `string \| string[]` | runs after `yarn install` (node family) |
+| `postInstall` | `string \| string[]` | runs after the package-manager install (node family) |
 | `lint` / `test` / `audit` | `false \| TestJobCustom` | customize or disable the job |
 | `artifactsPaths` | `string[]` | extra artifacts (`dist`, `.next` always included) |
 | `artifactsExcludePaths` | `string[]` | artifact excludes |
@@ -19,7 +19,7 @@ generated pipeline files.
 | `jobVars` | `EnvVars` | env vars only in build jobs |
 | `runnerVariables` | `Record<string,string>` | extra runner vars (also for `services:`) |
 | `jobTags` | `string[]` | runner tags |
-| `jobImage` | `GitlabJobImage` | custom CI image for the build |
+| `jobImage` | `JobImageConfig` | CI image for the build: a concrete image or `{ image: "<name>" }` referencing a project image |
 | `docker` | see below | the deployable image strategy |
 
 `TestJobCustom` (for `lint`/`test`/`audit`): `command`, `jobImage`,
@@ -29,8 +29,9 @@ generated pipeline files.
 ## Per-type options & defaults
 
 ### `node`
-- `docker?` — built-in node image `{ type: "node", yarnRebuildEnabled?: boolean (default true), additionsBegin?: string[], additionsEnd?: string[] }`, or a custom docker config.
-- Defaults: `buildCommand: "yarn build"`, `startCommand: "yarn start"`, artifacts `["dist", ".next"]`, excludes `[".next/cache/**/*"]`.
+- Works with yarn **and pnpm** — the package manager is autodetected (`packageManager` field / lockfile), overridable via top-level `packageManager: "pnpm" | "yarn"` in `catladder.ts`.
+- `docker?` — built-in node image `{ type: "node", yarnRebuildEnabled?: boolean (default true, yarn berry only), additionsBegin?: string[], additionsEnd?: string[] }`, or a custom docker config.
+- Defaults: `buildCommand: "<pm> build"`, `startCommand: "<pm> start"` (`yarn`/`pnpm` per detection), artifacts `["dist", ".next"]`, excludes `[".next/cache/**/*"]`.
 
 ### `rails`
 - `test?.databaseImage?` — test DB container image (Postgres only; default `docker.io/postgres:latest`).
@@ -41,12 +42,13 @@ generated pipeline files.
   - `buildVars?: Record<string, string | undefined>` — Bundler / Rails asset-precompile vars (`undefined` inherits from the component's env vars).
 
 ### `meteor`
+- Yarn-only (meteor's bundler is yarn-based) — a pnpm project cannot use this build type.
 - `installScripts?: boolean` — run `yarn install` inside the source folder in the image (only needed with custom image scripts).
 - `docker?` — meteor built-in or custom. Default `startCommand: "node main.js"`.
 
 ### `custom`
 - `type: "custom"` — **required**.
-- `jobImage: GitlabJobImage` — **required** CI image.
+- `jobImage: JobImageConfig` — **required** CI image (concrete image or `{ image: "<name>" }` project-image ref).
 - `docker: BuildConfigDocker` — **required** image build config.
 - `jobServices?: Services` — services for lint/test/audit/build jobs.
 - `lint?` / `test?` / `audit?: TestJobCustom` — disabled unless set.
@@ -68,5 +70,5 @@ defaulted `buildCommand: "yarn build-storybook --quiet -o ./dist"`.
 Top-level `builds: Record<string, WorkspaceBuildConfig>`. Only
 `type: "node"` is supported.
 
-- Node workspace build: `dir?`, `buildCommand?` (default `yarn build`), `dockerDefaults?: { yarnRebuildEnabled }`, plus shared `lint?` (default `{ command: "yarn lint" }`), `test?` (default `{ command: "yarn test" }`), `audit?`, `runnerVariables?`, `artifactsReports?`, `jobImage?`, `jobTags?`, `cache?`.
+- Node workspace build: `dir?`, `buildCommand?` (default `<pm> build`), `dockerDefaults?: { yarnRebuildEnabled }`, plus shared `lint?` (default `{ command: "<pm> lint" }`), `test?` (default `{ command: "<pm> test" }`), `audit?`, `runnerVariables?`, `artifactsReports?`, `jobImage?`, `jobTags?`, `cache?` (`<pm>` = `yarn`/`pnpm` per detection).
 - A component references it via `build: { from: "<name>", docker?, startCommand?, artifactsPaths?, artifactsExcludePaths?, cache? }` — the per-component overrides layer on top of the shared build.

package/dist/skills/catladder-cli/references/commands.md

@@ -3,8 +3,9 @@
 <!-- rendered from the command definitions by
      apps/cli/src/scripts/generateCliSkillReference.ts — do not edit -->
 
-All commands run non-interactively as `yarn catladder <command> ...`;
-see SKILL.md for how to pass inputs.
+All commands run non-interactively as `yarn catladder <command> ...`
+(`pnpm catladder ...` in pnpm projects); see SKILL.md for how to
+pass inputs.
 
 ## `catladder cloudsql restore-db`
 

package/dist/skills/catladder-config/SKILL.md

@@ -64,6 +64,11 @@ Key concepts:
 - **Pipelines**: `pipelines: { gitlab: true, github: true }` selects
   which CI systems get generated files. Options objects instead of
   `true` allow per-pipeline settings (e.g. `runnerVariables`).
+- **Package manager**: yarn and pnpm are supported and autodetected
+  (from the `packageManager` field in package.json or the lockfile;
+  yarn is the fallback). `packageManager: "pnpm" | "yarn"` at the top
+  level overrides the detection. In pnpm projects, run the CLIs as
+  `pnpm catenv` / `pnpm catladder`.
 
 ## Common tasks
 

package/dist/skills/catladder-deploys/SKILL.md

@@ -121,7 +121,7 @@ docs: {
   build: false,
   deploy: {
     type: "pages",
-    requiresYarnInstall: true,
+    requiresInstall: true,
     script: ["yarn workspace docs build"],
   },
 },

package/dist/skills/catladder-deploys/references/deploy-types.md

@@ -61,7 +61,7 @@ resources with `yarn catladder project setup`; detect drift with
 - `type: "pages"` — **required**. Publishes a static site on gitlab pages (not yet supported on the github backend).
 - `script: string[]` — **required**; produces the site.
 - `publishDir?: string` — output directory relative to the repo root, default `"public"`.
-- `requiresYarnInstall?: boolean` — run `yarn install` first.
+- `requiresInstall?: boolean` — run the package-manager install (yarn/pnpm) first (`requiresYarnInstall` is a deprecated alias).
 - `jobImage?: GitlabJobImage`; also accepts `cache`.
 - Review envs publish under an `mr-<iid>` path prefix (parallel deployments → MR previews; exposed as `$PAGES_PREFIX`); other envs publish at the root. The environment url is the published pages url.
 - Defaults to `allowFailure: true`.
@@ -75,7 +75,7 @@ resources with `yarn catladder project setup`; detect drift with
 - `type: "custom"` — **required**.
 - `requiresDocker: boolean` — **required**; whether the deploy needs a built Docker image.
 - `script: string[]` — **required**; the deploy script.
-- `requiresYarnInstall?: boolean` — whether the script needs `yarn install`.
+- `requiresInstall?: boolean` — whether the script needs the package-manager install (`requiresYarnInstall` is a deprecated alias).
 - `stopScript?: string[]` — script to stop/tear down the environment.
 - `jobImage?: GitlabJobImage`.
 - Also accepts `cache` (via `WithCacheConfig`).

package/dist/skills/catladder-pipelines/SKILL.md

@@ -29,17 +29,29 @@ plus stop jobs for review-app teardown.
 
 ## Job images and catci
 
-Jobs run in catladder-provided images. Their definitions are
-materialized into `.catladder-generated/images/` and built in the
-project's own registry (content-hashed, rebuilt only on change).
+Jobs run in catladder-provided images (`🐳 catladder image <name>` build
+jobs). Their definitions are materialized into
+`.catladder-generated/images/` and built in the project's own registry
+under `catladder/` (content-hashed, rebuilt only on change).
 `.catladder-generated/catci/` holds a small bundled CI companion used by
 generated jobs (e.g. the release security audit) — all generated, never
 edit.
 
+Projects can declare their own job images under `images` in
+`catladder.ts` (`🐳 image <name>` build jobs, pushed to `job-images/` in
+the registry) and reference them in any `jobImage` field via
+`{ image: "<name>" }` — see the `catladder-builds` skill. A declared
+Dockerfile directory is used in place; an inline `dockerfile` is
+materialized into `.catladder-generated/images/project/<name>/`. Either
+way the build job is skipped when the content hash already exists in
+the registry.
+
 ## Caching
 
 Cache configuration is generated per build type; node builds cache
-`node_modules` and the yarn cache. GitLab uses mutable caches with
+`node_modules` and the package manager's download cache (the `.yarn`
+zip cache, or for pnpm projects a project-local `.pnpm-store`). GitLab
+uses mutable caches with
 fallback keys (review branches fall back to the dev cache); GitHub uses
 immutable lockfile-keyed caches where only the build job writes.
 Caching behavior is changed via the build config in `catladder.ts`,