@catladder/cli 0.0.0-next-dccc0a36 → 0.0.0-next-78f04d3f

package/dist/bundles/catenv/index.js

@@ -2463,6 +2463,13 @@ class GithubBackend {
                     manualJobConditions[id] = `inputs.job == '${id}'`;
                     manualDispatchOptions.push(id);
                 }
+                // manual release mode: the workflow that runs a queued release
+                // once the main workflow completed green
+                const releaseOnGreen = (0, githubReleaseJobs_1.getGithubReleaseOnGreenWorkflow)(config, images, TRIGGER_WORKFLOWS.mainBranch.name, workflowEnv);
+                if (releaseOnGreen) {
+                    workflows[`${GENERATED_FILE_PREFIX}release-on-green.yml`] =
+                        releaseOnGreen;
+                }
             }
             if (Object.keys(jobs).length > 0) {
                 workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
@@ -3007,16 +3014,21 @@ exports.getUploadProviderIds = getUploadProviderIds;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGithubReleaseCheckJobs = exports.getGithubReleaseJobs = void 0;
+exports.getGithubReleaseCheckJobs = exports.getGithubReleaseOnGreenWorkflow = exports.getGithubReleaseJobs = void 0;
 const createGithubJobs_1 = __nccwpck_require__(57877);
 const release_1 = __nccwpck_require__(38904);
-const createReleaseJob = (config, images, needs, extraEnv) => {
+const shippedCatci_1 = __nccwpck_require__(79024);
+const CATCI = `${shippedCatci_1.GENERATED_CATCI_FOLDER}/index.js`;
+const createReleaseJob = (config, images, options = {}) => {
+    var _a;
     const method = (0, release_1.getReleaseMethod)(config);
     const resolved = images.resolveRef({ catladderImage: method.image });
-    const imageNeeds = resolved.need && typeof resolved.need === "object"
+    const imageNeeds = !options.skipImageNeeds &&
+        resolved.need &&
+        typeof resolved.need === "object"
         ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]
         : [];
-    const allNeeds = [...imageNeeds, ...(needs !== null && needs !== void 0 ? needs : [])];
+    const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];
     return {
         name: "create release",
         "runs-on": "ubuntu-latest",
@@ -3045,7 +3057,7 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
-            ...extraEnv,
+            ...options.extraEnv,
         },
         steps: [
             {
@@ -3055,8 +3067,21 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
                 // tags since the last release) to determine the version
                 with: { "fetch-depth": 0 },
             },
+            ...(options.queueCheck
+                ? [
+                    {
+                        name: "check main workflow",
+                        id: "queue",
+                        run: `node ${CATCI} release github-queue-check`,
+                        shell: "bash",
+                    },
+                ]
+                : []),
             {
                 name: "create release",
+                ...(options.queueCheck
+                    ? { if: "steps.queue.outputs.queued != 'true'" }
+                    : {}),
                 run: method.script,
                 shell: "bash",
             },
@@ -3070,7 +3095,10 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
  *   workflow after all other jobs; a force variant goes to the manual
  *   tasks workflow
  * - otherwise (manual, the default): the release job goes to the
- *   manual tasks workflow
+ *   manual tasks workflow. Its queue-check step releases right away on
+ *   a green main run and otherwise queues the release for the
+ *   release-on-green workflow (see getGithubReleaseOnGreenWorkflow) —
+ *   the counterpart of gitlab's queue button + executor pair.
  */
 const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
     var _a;
@@ -3078,28 +3106,89 @@ const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
     if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
         return {
             main: {
-                "create-release": createReleaseJob(config, images, mainWorkflowJobIds),
+                "create-release": createReleaseJob(config, images, {
+                    needs: mainWorkflowJobIds,
+                }),
             },
             manual: {
-                "force-create-release": createReleaseJob(config, images, undefined, method.forceReleaseVariables),
+                "force-create-release": createReleaseJob(config, images, {
+                    extraEnv: method.forceReleaseVariables,
+                }),
             },
         };
     }
     return {
         main: {},
         manual: {
-            "create-release": createReleaseJob(config, images),
+            "create-release": createReleaseJob(config, images, { queueCheck: true }),
             // an explicit force option wherever the method distinguishes it
             // (e.g. changesets: release a patch bump without changesets)
             ...(method.forceReleaseVariables
                 ? {
-                    "force-create-release": createReleaseJob(config, images, undefined, method.forceReleaseVariables),
+                    "force-create-release": createReleaseJob(config, images, {
+                        extraEnv: method.forceReleaseVariables,
+                    }),
                 }
                 : {}),
         },
     };
 };
 exports.getGithubReleaseJobs = getGithubReleaseJobs;
+/**
+ * the release-on-green workflow (manual release mode only): runs on
+ * every completed main workflow run. A lightweight host job checks the
+ * queue marker (written by the create-release task while the main
+ * workflow was still running) — most runs have nothing queued and end
+ * after that single quick job. When the marker matches the completed
+ * run, the containerized release job creates the release.
+ *
+ * No image-build jobs here: the release image was ensured by the main
+ * workflow run that just completed (same commit, same content-hashed
+ * tag).
+ */
+const getGithubReleaseOnGreenWorkflow = (config, images, mainWorkflowName, workflowEnv) => {
+    var _a;
+    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
+        return null;
+    }
+    return {
+        name: "catladder release on green",
+        on: {
+            workflow_run: {
+                workflows: [mainWorkflowName],
+                types: ["completed"],
+            },
+        },
+        env: workflowEnv,
+        jobs: {
+            guard: {
+                name: "check queued release",
+                "runs-on": "ubuntu-latest",
+                // consuming the queue marker is a ref deletion
+                permissions: { contents: "write" },
+                env: { GITHUB_TOKEN: "${{ github.token }}" },
+                outputs: { release: "${{ steps.guard.outputs.release }}" },
+                steps: [
+                    { name: "Checkout", uses: "actions/checkout@v4" },
+                    {
+                        name: "check queued release",
+                        id: "guard",
+                        run: `node ${CATCI} release github-queued-guard "\${{ github.event.workflow_run.head_sha }}" "\${{ github.event.workflow_run.conclusion }}"`,
+                        shell: "bash",
+                    },
+                ],
+            },
+            "create-release": {
+                ...createReleaseJob(config, images, {
+                    needs: ["guard"],
+                    skipImageNeeds: true,
+                }),
+                if: "${{ needs.guard.outputs.release == 'true' }}",
+            },
+        },
+    };
+};
+exports.getGithubReleaseOnGreenWorkflow = getGithubReleaseOnGreenWorkflow;
 /**
  * the informational MR/PR check job of the release method (e.g. the
  * changeset check), added to the mr workflow. continue-on-error keeps
@@ -3294,6 +3383,7 @@ const config_1 = __nccwpck_require__(17860);
 const createAllJobs_1 = __nccwpck_require__(54114);
 const jobImagesPlan_1 = __nccwpck_require__(47864);
 const shippedCatci_1 = __nccwpck_require__(79024);
+const release_1 = __nccwpck_require__(38904);
 const index_1 = __nccwpck_require__(68906);
 const createGitlabJobs_1 = __nccwpck_require__(41509);
 const createGitlabPipeline_1 = __nccwpck_require__(94411);
@@ -3380,12 +3470,29 @@ class GitlabBackend {
     }
     async createPipeline(config, images) {
         const stages = (0, getPipelineStages_1.getPipelineStages)(config);
-        // release jobs first: they register their image on the plan, and the
-        // per-trigger job creation below emits the build jobs of all images
-        // registered so far
-        const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images);
+        // register the release image first: the per-trigger job creation
+        // below emits the build jobs of all images registered so far. The
+        // release jobs themselves are created afterwards — they need the
+        // main-branch job list for the queued-release executor's needs.
+        images.resolveRef({ catladderImage: (0, release_1.getReleaseMethod)(config).image });
         // for all triggers create jobs and add base rules
-        const allJobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async (trigger) => await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)))).then((j) => j.flat());
+        const jobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async (trigger) => ({
+            trigger,
+            jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
+        })));
+        const allJobsPerTrigger = jobsPerTrigger.flatMap(({ jobs }) => jobs);
+        // the jobs the queued-release executor waits for: everything that
+        // runs automatically in a main-branch pipeline. Manual jobs (stop,
+        // rollback, gates) are excluded — gitlab skips a job whose needs
+        // include an unplayed manual job.
+        const mainBranchJobNames = [
+            ...new Set(jobsPerTrigger
+                .filter(({ trigger }) => trigger === "mainBranch")
+                .flatMap(({ jobs }) => jobs)
+                .filter(({ gitlabJob }) => !isManualGitlabJob(gitlabJob))
+                .map(({ name }) => name)),
+        ];
+        const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images, mainBranchJobNames);
         const allWorkspaceJobs = allJobsPerTrigger
             .filter((j) => { var _a; return ((_a = j.context) === null || _a === void 0 ? void 0 : _a.type) === "workspace"; }) // sort by componentName in the same order as they appear in the config
             // this is purely for better readability in git diffs when you add new components
@@ -3451,6 +3558,14 @@ class GitlabBackend {
     }
 }
 exports.GitlabBackend = GitlabBackend;
+/**
+ * whether a job can end up waiting for a human in a main-branch
+ * pipeline (catladder expresses manual-ness only through rules)
+ */
+function isManualGitlabJob(job) {
+    var _a;
+    return ((_a = job.rules) !== null && _a !== void 0 ? _a : []).some((rule) => rule.when === "manual");
+}
 function getGitlabRulesForTrigger(trigger) {
     // mainBranch: on push to main branch except it's a release commit
     // mr: on merge request
@@ -3983,91 +4098,179 @@ exports.getPipelineStages = getPipelineStages;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGitlabReleaseJobs = void 0;
+exports.getGitlabReleaseJobs = exports.RELEASE_EXECUTOR_JOB_NAME = exports.RELEASE_BUTTON_JOB_NAME = void 0;
 const rules_1 = __nccwpck_require__(35086);
 const release_1 = __nccwpck_require__(38904);
 const EXPIRED_TOKEN_HELP = "echo '👉 If this job failed with access denied, the project access token might be invald - run `project-renew-token` in catladder CLI to fix.'";
+/**
+ * gitlab rejects jobs with more than 50 `needs:` entries (default
+ * limit). Pipelines beyond that fall back to the legacy manual release
+ * job, which is only playable once all prior stages finished.
+ */
+const GITLAB_MAX_NEEDS = 50;
+exports.RELEASE_BUTTON_JOB_NAME = "create release";
+exports.RELEASE_EXECUTOR_JOB_NAME = "🚀 release once pipeline succeeds";
 const baseReleaseRules = [
     rules_1.RULE_NEVER_ON_RELEASE_COMMIT,
     rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
     rules_1.RULE_NEVER_ON_SCHEDULE,
 ];
-const getGitlabReleaseJobs = (config, images) => {
+// NOTE: with `rules:`, when: manual defaults to allow_failure: false,
+// which turns every unclicked pipeline into status "blocked" — the
+// manual release jobs therefore carry allow_failure: true so pipelines
+// end "passed" when nobody releases
+const manualReleaseRules = [
+    ...baseReleaseRules,
+    {
+        if: rules_1.RULE_CONDITION_MAIN_BRANCH,
+        when: "manual",
+    },
+    {
+        if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
+        when: "manual",
+    },
+];
+const getGitlabReleaseJobs = (config, images, 
+/**
+ * names of the jobs that run automatically in main-branch pipelines
+ * (manual jobs excluded: a needed-but-unplayed manual job would make
+ * gitlab skip the release executor)
+ */
+mainBranchJobNames) => {
     var _a;
     const method = (0, release_1.getReleaseMethod)(config);
     // NOTE: only the resolved image url is used, not the `need`: release
-    // jobs have no `needs` on purpose — their stage ordering already
-    // guarantees the image build job (setup stage) ran, and adding a
-    // `needs` would switch gitlab to DAG mode, so the release job would no
-    // longer wait for the build/deploy stages.
+    // jobs have no `needs` on the whole pipeline on purpose — where they
+    // must wait for it, the wait is expressed by enumerating the jobs
+    // explicitly (see the executor below).
     const releaseImage = images.resolveRef({
         catladderImage: method.image,
     }).image;
-    return {
-        ["create release"]: {
-            stage: "release",
-            image: releaseImage,
-            script: [method.script],
-            after_script: [EXPIRED_TOKEN_HELP],
-            rules: [
-                ...baseReleaseRules,
-                {
-                    if: rules_1.RULE_CONDITION_MAIN_BRANCH,
-                    when: ((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto" ? "on_success" : "manual",
-                },
-                {
-                    if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
-                    when: "manual",
-                },
-            ],
-        },
+    const releaseJobBase = {
+        stage: "release",
+        image: releaseImage,
+        script: [method.script],
+        after_script: [EXPIRED_TOKEN_HELP],
+    };
+    const forceReleaseJob = {
         ["⚠️ force create release"]: {
-            stage: "release",
-            image: releaseImage,
-            script: [method.script],
-            after_script: [EXPIRED_TOKEN_HELP],
+            ...releaseJobBase,
             needs: [],
+            allow_failure: true,
             // force semantics of the method's script (e.g. changesets:
             // release a patch bump even without pending changesets)
             ...(method.forceReleaseVariables
                 ? { variables: method.forceReleaseVariables }
                 : {}),
+            rules: manualReleaseRules,
+        },
+    };
+    // informational MR check of the release method (e.g. the changeset
+    // check): warns via allow_failure, the report lands in the MR
+    // widget as an exposed artifact
+    const checkJob = method.checkScript
+        ? {
+            ["🦋 changeset check"]: {
+                stage: "test",
+                image: releaseImage,
+                script: [method.checkScript],
+                allow_failure: true,
+                artifacts: {
+                    paths: ["changeset-report.md"],
+                    expose_as: "changeset report",
+                    // the report must survive the warning exit
+                    when: "always",
+                },
+                rules: [
+                    rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
+                    rules_1.RULE_NEVER_ON_SCHEDULE,
+                    rules_1.RULE_IS_MERGE_REQUEST,
+                ],
+            },
+        }
+        : {};
+    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
+        return {
+            [exports.RELEASE_BUTTON_JOB_NAME]: {
+                ...releaseJobBase,
+                rules: [
+                    ...baseReleaseRules,
+                    {
+                        if: rules_1.RULE_CONDITION_MAIN_BRANCH,
+                        when: "on_success",
+                    },
+                    {
+                        if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
+                        when: "manual",
+                        // per-rule: only the unclicked hotfix button must not
+                        // block — a failed automatic release stays loud
+                        allow_failure: true,
+                    },
+                ],
+            },
+            ...forceReleaseJob,
+            ...checkJob,
+        };
+    }
+    const executorNeeds = [
+        { job: exports.RELEASE_BUTTON_JOB_NAME },
+        // optional: hotfix pipelines (and rules-filtered jobs) contain a
+        // different job subset
+        ...mainBranchJobNames.map((name) => ({ job: name, optional: true })),
+    ];
+    if (executorNeeds.length > GITLAB_MAX_NEEDS) {
+        console.warn(`⚠️ the main-branch pipeline has more than ${GITLAB_MAX_NEEDS} jobs — ` +
+            `the "${exports.RELEASE_BUTTON_JOB_NAME}" job falls back to being playable ` +
+            `only once the pipeline finished (gitlab caps needs: at ${GITLAB_MAX_NEEDS})`);
+        return {
+            [exports.RELEASE_BUTTON_JOB_NAME]: {
+                ...releaseJobBase,
+                allow_failure: true,
+                rules: manualReleaseRules,
+            },
+            ...forceReleaseJob,
+            ...checkJob,
+        };
+    }
+    return {
+        // the queue button: playable from the first second of the pipeline.
+        // It only records the intent to release — the executor below does
+        // the actual work once every other job succeeded. Clicking after the
+        // pipeline finished works the same (the executor starts right away).
+        [exports.RELEASE_BUTTON_JOB_NAME]: {
+            stage: "release",
+            image: releaseImage,
+            script: [
+                `echo "release queued — '${exports.RELEASE_EXECUTOR_JOB_NAME}' runs it as soon as every other job in this pipeline succeeded"`,
+            ],
+            needs: [],
+            // allow_failure keeps the unclicked button from blocking the
+            // pipeline AND makes the executor's needs treat it as optional
+            // (skipped executor instead of a forever-waiting pipeline)
+            allow_failure: true,
+            rules: manualReleaseRules,
+        },
+        // the executor: never played manually. Skipped when the button was
+        // not clicked; otherwise starts automatically as soon as the button
+        // and every other (non-manual) job of the pipeline succeeded, and
+        // is skipped when any of them failed.
+        [exports.RELEASE_EXECUTOR_JOB_NAME]: {
+            ...releaseJobBase,
+            needs: executorNeeds,
             rules: [
                 ...baseReleaseRules,
                 {
                     if: rules_1.RULE_CONDITION_MAIN_BRANCH,
-                    when: "manual",
+                    when: "on_success",
                 },
                 {
                     if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
-                    when: "manual",
+                    when: "on_success",
                 },
             ],
         },
-        // informational MR check of the release method (e.g. the changeset
-        // check): warns via allow_failure, the report lands in the MR
-        // widget as an exposed artifact
-        ...(method.checkScript
-            ? {
-                ["🦋 changeset check"]: {
-                    stage: "test",
-                    image: releaseImage,
-                    script: [method.checkScript],
-                    allow_failure: true,
-                    artifacts: {
-                        paths: ["changeset-report.md"],
-                        expose_as: "changeset report",
-                        // the report must survive the warning exit
-                        when: "always",
-                    },
-                    rules: [
-                        rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
-                        rules_1.RULE_NEVER_ON_SCHEDULE,
-                        rules_1.RULE_IS_MERGE_REQUEST,
-                    ],
-                },
-            }
-            : {}),
+        ...forceReleaseJob,
+        ...checkJob,
     };
 };
 exports.getGitlabReleaseJobs = getGitlabReleaseJobs;