@catladder/cli 0.0.0-next-dccc0a36 → 0.0.0-next-89bce6d0

package/dist/bundles/catenv/index.js

@@ -1902,6 +1902,14 @@ class VariableValueContainingReferences {
                 ? []
                 : [part]);
     }
+    /**
+     * concats values to this one and returns a new VariableValueContainingReferences.
+     * mirrors String.prototype.concat / BashExpression.concat so a VariableValue
+     * can be extended regardless of its concrete type
+     */
+    concat(...values) {
+        return new VariableValueContainingReferences([...this.parts, ...values]);
+    }
     toString(options = {
         quotes: false,
     }) {
@@ -1951,16 +1959,18 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.resolveAllReferences = void 0;
 const VariableValueContainingReferences_1 = __nccwpck_require__(70795);
 const resolveAllReferencesOnce_1 = __nccwpck_require__(98690);
+const hasUnresolvedReferences = (value) => value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences &&
+    value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference);
 const resolveAllReferences = async (values, getEnvVars) => {
     // replace until there aren't any references left
     let result = values;
     let i = 0;
-    while (Object.values(result).some((value) => value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference))) {
+    while (Object.values(result).some(hasUnresolvedReferences)) {
         const replaced = await (0, resolveAllReferencesOnce_1.resolveAllReferencesOnce)(result, getEnvVars);
         result = replaced;
         i++;
         if (i > 1000) {
-            const unresolved = Object.entries(result).filter(([key, value]) => value.parts.some((part) => part instanceof VariableValueContainingReferences_1.VariableReference));
+            const unresolved = Object.entries(result).filter(([key, value]) => hasUnresolvedReferences(value));
             throw new Error("Infinite loop detected in these variables: " +
                 unresolved
                     .map(([key, value]) => `${key} (last reference: ${value.parts.find((part) => part instanceof VariableValueContainingReferences_1.VariableReference)})`)
@@ -1984,7 +1994,9 @@ exports.resolveAllReferencesOnce = void 0;
 const VariableValueContainingReferences_1 = __nccwpck_require__(70795);
 const resolveReferencesOnce_1 = __nccwpck_require__(29767);
 const resolveAllReferencesOnce = async (values, getEnvVars) => {
-    const allReferences = Object.values(values).flatMap((value) => value === null || value === void 0 ? void 0 : value.parts.filter((part) => part instanceof VariableValueContainingReferences_1.VariableReference));
+    const allReferences = Object.values(values).flatMap((value) => value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences
+        ? value.parts.filter((part) => part instanceof VariableValueContainingReferences_1.VariableReference)
+        : []);
     const allComponentsUnique = Array.from(new Set(allReferences.map((reference) => reference.componentName)));
     const allEnvVarsInComponents = Object.fromEntries(await Promise.all(allComponentsUnique.map(async (componentName) => [
         componentName,
@@ -1992,7 +2004,7 @@ const resolveAllReferencesOnce = async (values, getEnvVars) => {
     ])));
     return Object.fromEntries(Object.entries(values).map(([key, value]) => [
         key,
-        value !== null && value !== undefined
+        value instanceof VariableValueContainingReferences_1.VariableValueContainingReferences
             ? (0, resolveReferencesOnce_1.resolveReferencesOnce)(value, ({ componentName, variableName }) => {
                 return allEnvVarsInComponents[componentName][variableName];
             })
@@ -2463,6 +2475,13 @@ class GithubBackend {
                     manualJobConditions[id] = `inputs.job == '${id}'`;
                     manualDispatchOptions.push(id);
                 }
+                // manual release mode: the workflow that runs a queued release
+                // once the main workflow completed green
+                const releaseOnGreen = (0, githubReleaseJobs_1.getGithubReleaseOnGreenWorkflow)(config, images, TRIGGER_WORKFLOWS.mainBranch.name, workflowEnv);
+                if (releaseOnGreen) {
+                    workflows[`${GENERATED_FILE_PREFIX}release-on-green.yml`] =
+                        releaseOnGreen;
+                }
             }
             if (Object.keys(jobs).length > 0) {
                 workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
@@ -3007,16 +3026,21 @@ exports.getUploadProviderIds = getUploadProviderIds;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGithubReleaseCheckJobs = exports.getGithubReleaseJobs = void 0;
+exports.getGithubReleaseCheckJobs = exports.getGithubReleaseOnGreenWorkflow = exports.getGithubReleaseJobs = void 0;
 const createGithubJobs_1 = __nccwpck_require__(57877);
 const release_1 = __nccwpck_require__(38904);
-const createReleaseJob = (config, images, needs, extraEnv) => {
+const shippedCatci_1 = __nccwpck_require__(79024);
+const CATCI = `${shippedCatci_1.GENERATED_CATCI_FOLDER}/index.js`;
+const createReleaseJob = (config, images, options = {}) => {
+    var _a;
     const method = (0, release_1.getReleaseMethod)(config);
     const resolved = images.resolveRef({ catladderImage: method.image });
-    const imageNeeds = resolved.need && typeof resolved.need === "object"
+    const imageNeeds = !options.skipImageNeeds &&
+        resolved.need &&
+        typeof resolved.need === "object"
         ? [(0, createGithubJobs_1.githubGlobalJobId)(resolved.need.job)]
         : [];
-    const allNeeds = [...imageNeeds, ...(needs !== null && needs !== void 0 ? needs : [])];
+    const allNeeds = [...imageNeeds, ...((_a = options.needs) !== null && _a !== void 0 ? _a : [])];
     return {
         name: "create release",
         "runs-on": "ubuntu-latest",
@@ -3045,7 +3069,7 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
         ...(allNeeds.length > 0 ? { needs: allNeeds } : {}),
         env: {
             GITHUB_TOKEN: "${{ github.token }}",
-            ...extraEnv,
+            ...options.extraEnv,
         },
         steps: [
             {
@@ -3055,8 +3079,21 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
                 // tags since the last release) to determine the version
                 with: { "fetch-depth": 0 },
             },
+            ...(options.queueCheck
+                ? [
+                    {
+                        name: "check main workflow",
+                        id: "queue",
+                        run: `node ${CATCI} release github-queue-check`,
+                        shell: "bash",
+                    },
+                ]
+                : []),
             {
                 name: "create release",
+                ...(options.queueCheck
+                    ? { if: "steps.queue.outputs.queued != 'true'" }
+                    : {}),
                 run: method.script,
                 shell: "bash",
             },
@@ -3070,7 +3107,10 @@ const createReleaseJob = (config, images, needs, extraEnv) => {
  *   workflow after all other jobs; a force variant goes to the manual
  *   tasks workflow
  * - otherwise (manual, the default): the release job goes to the
- *   manual tasks workflow
+ *   manual tasks workflow. Its queue-check step releases right away on
+ *   a green main run and otherwise queues the release for the
+ *   release-on-green workflow (see getGithubReleaseOnGreenWorkflow) —
+ *   the counterpart of gitlab's queue button + executor pair.
  */
 const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
     var _a;
@@ -3078,28 +3118,89 @@ const getGithubReleaseJobs = (config, mainWorkflowJobIds, images) => {
     if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
         return {
             main: {
-                "create-release": createReleaseJob(config, images, mainWorkflowJobIds),
+                "create-release": createReleaseJob(config, images, {
+                    needs: mainWorkflowJobIds,
+                }),
             },
             manual: {
-                "force-create-release": createReleaseJob(config, images, undefined, method.forceReleaseVariables),
+                "force-create-release": createReleaseJob(config, images, {
+                    extraEnv: method.forceReleaseVariables,
+                }),
             },
         };
     }
     return {
         main: {},
         manual: {
-            "create-release": createReleaseJob(config, images),
+            "create-release": createReleaseJob(config, images, { queueCheck: true }),
             // an explicit force option wherever the method distinguishes it
             // (e.g. changesets: release a patch bump without changesets)
             ...(method.forceReleaseVariables
                 ? {
-                    "force-create-release": createReleaseJob(config, images, undefined, method.forceReleaseVariables),
+                    "force-create-release": createReleaseJob(config, images, {
+                        extraEnv: method.forceReleaseVariables,
+                    }),
                 }
                 : {}),
         },
     };
 };
 exports.getGithubReleaseJobs = getGithubReleaseJobs;
+/**
+ * the release-on-green workflow (manual release mode only): runs on
+ * every completed main workflow run. A lightweight host job checks the
+ * queue marker (written by the create-release task while the main
+ * workflow was still running) — most runs have nothing queued and end
+ * after that single quick job. When the marker matches the completed
+ * run, the containerized release job creates the release.
+ *
+ * No image-build jobs here: the release image was ensured by the main
+ * workflow run that just completed (same commit, same content-hashed
+ * tag).
+ */
+const getGithubReleaseOnGreenWorkflow = (config, images, mainWorkflowName, workflowEnv) => {
+    var _a;
+    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
+        return null;
+    }
+    return {
+        name: "catladder release on green",
+        on: {
+            workflow_run: {
+                workflows: [mainWorkflowName],
+                types: ["completed"],
+            },
+        },
+        env: workflowEnv,
+        jobs: {
+            guard: {
+                name: "check queued release",
+                "runs-on": "ubuntu-latest",
+                // consuming the queue marker is a ref deletion
+                permissions: { contents: "write" },
+                env: { GITHUB_TOKEN: "${{ github.token }}" },
+                outputs: { release: "${{ steps.guard.outputs.release }}" },
+                steps: [
+                    { name: "Checkout", uses: "actions/checkout@v4" },
+                    {
+                        name: "check queued release",
+                        id: "guard",
+                        run: `node ${CATCI} release github-queued-guard "\${{ github.event.workflow_run.head_sha }}" "\${{ github.event.workflow_run.conclusion }}"`,
+                        shell: "bash",
+                    },
+                ],
+            },
+            "create-release": {
+                ...createReleaseJob(config, images, {
+                    needs: ["guard"],
+                    skipImageNeeds: true,
+                }),
+                if: "${{ needs.guard.outputs.release == 'true' }}",
+            },
+        },
+    };
+};
+exports.getGithubReleaseOnGreenWorkflow = getGithubReleaseOnGreenWorkflow;
 /**
  * the informational MR/PR check job of the release method (e.g. the
  * changeset check), added to the mr workflow. continue-on-error keeps
@@ -3294,6 +3395,7 @@ const config_1 = __nccwpck_require__(17860);
 const createAllJobs_1 = __nccwpck_require__(54114);
 const jobImagesPlan_1 = __nccwpck_require__(47864);
 const shippedCatci_1 = __nccwpck_require__(79024);
+const release_1 = __nccwpck_require__(38904);
 const index_1 = __nccwpck_require__(68906);
 const createGitlabJobs_1 = __nccwpck_require__(41509);
 const createGitlabPipeline_1 = __nccwpck_require__(94411);
@@ -3380,12 +3482,29 @@ class GitlabBackend {
     }
     async createPipeline(config, images) {
         const stages = (0, getPipelineStages_1.getPipelineStages)(config);
-        // release jobs first: they register their image on the plan, and the
-        // per-trigger job creation below emits the build jobs of all images
-        // registered so far
-        const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images);
+        // register the release image first: the per-trigger job creation
+        // below emits the build jobs of all images registered so far. The
+        // release jobs themselves are created afterwards — they need the
+        // main-branch job list for the queued-release executor's needs.
+        images.resolveRef({ catladderImage: (0, release_1.getReleaseMethod)(config).image });
         // for all triggers create jobs and add base rules
-        const allJobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async (trigger) => await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)))).then((j) => j.flat());
+        const jobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async (trigger) => ({
+            trigger,
+            jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
+        })));
+        const allJobsPerTrigger = jobsPerTrigger.flatMap(({ jobs }) => jobs);
+        // the jobs the queued-release executor waits for: everything that
+        // runs automatically in a main-branch pipeline. Manual jobs (stop,
+        // rollback, gates) are excluded — gitlab skips a job whose needs
+        // include an unplayed manual job.
+        const mainBranchJobNames = [
+            ...new Set(jobsPerTrigger
+                .filter(({ trigger }) => trigger === "mainBranch")
+                .flatMap(({ jobs }) => jobs)
+                .filter(({ gitlabJob }) => !isManualGitlabJob(gitlabJob))
+                .map(({ name }) => name)),
+        ];
+        const releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images, mainBranchJobNames);
         const allWorkspaceJobs = allJobsPerTrigger
             .filter((j) => { var _a; return ((_a = j.context) === null || _a === void 0 ? void 0 : _a.type) === "workspace"; }) // sort by componentName in the same order as they appear in the config
             // this is purely for better readability in git diffs when you add new components
@@ -3451,6 +3570,14 @@ class GitlabBackend {
     }
 }
 exports.GitlabBackend = GitlabBackend;
+/**
+ * whether a job can end up waiting for a human in a main-branch
+ * pipeline (catladder expresses manual-ness only through rules)
+ */
+function isManualGitlabJob(job) {
+    var _a;
+    return ((_a = job.rules) !== null && _a !== void 0 ? _a : []).some((rule) => rule.when === "manual");
+}
 function getGitlabRulesForTrigger(trigger) {
     // mainBranch: on push to main branch except it's a release commit
     // mr: on merge request
@@ -3983,91 +4110,179 @@ exports.getPipelineStages = getPipelineStages;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getGitlabReleaseJobs = void 0;
+exports.getGitlabReleaseJobs = exports.RELEASE_EXECUTOR_JOB_NAME = exports.RELEASE_BUTTON_JOB_NAME = void 0;
 const rules_1 = __nccwpck_require__(35086);
 const release_1 = __nccwpck_require__(38904);
 const EXPIRED_TOKEN_HELP = "echo '👉 If this job failed with access denied, the project access token might be invald - run `project-renew-token` in catladder CLI to fix.'";
+/**
+ * gitlab rejects jobs with more than 50 `needs:` entries (default
+ * limit). Pipelines beyond that fall back to the legacy manual release
+ * job, which is only playable once all prior stages finished.
+ */
+const GITLAB_MAX_NEEDS = 50;
+exports.RELEASE_BUTTON_JOB_NAME = "create release";
+exports.RELEASE_EXECUTOR_JOB_NAME = "🚀 release once pipeline succeeds";
 const baseReleaseRules = [
     rules_1.RULE_NEVER_ON_RELEASE_COMMIT,
     rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
     rules_1.RULE_NEVER_ON_SCHEDULE,
 ];
-const getGitlabReleaseJobs = (config, images) => {
+// NOTE: with `rules:`, when: manual defaults to allow_failure: false,
+// which turns every unclicked pipeline into status "blocked" — the
+// manual release jobs therefore carry allow_failure: true so pipelines
+// end "passed" when nobody releases
+const manualReleaseRules = [
+    ...baseReleaseRules,
+    {
+        if: rules_1.RULE_CONDITION_MAIN_BRANCH,
+        when: "manual",
+    },
+    {
+        if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
+        when: "manual",
+    },
+];
+const getGitlabReleaseJobs = (config, images, 
+/**
+ * names of the jobs that run automatically in main-branch pipelines
+ * (manual jobs excluded: a needed-but-unplayed manual job would make
+ * gitlab skip the release executor)
+ */
+mainBranchJobNames) => {
     var _a;
     const method = (0, release_1.getReleaseMethod)(config);
     // NOTE: only the resolved image url is used, not the `need`: release
-    // jobs have no `needs` on purpose — their stage ordering already
-    // guarantees the image build job (setup stage) ran, and adding a
-    // `needs` would switch gitlab to DAG mode, so the release job would no
-    // longer wait for the build/deploy stages.
+    // jobs have no `needs` on the whole pipeline on purpose — where they
+    // must wait for it, the wait is expressed by enumerating the jobs
+    // explicitly (see the executor below).
     const releaseImage = images.resolveRef({
         catladderImage: method.image,
     }).image;
-    return {
-        ["create release"]: {
-            stage: "release",
-            image: releaseImage,
-            script: [method.script],
-            after_script: [EXPIRED_TOKEN_HELP],
-            rules: [
-                ...baseReleaseRules,
-                {
-                    if: rules_1.RULE_CONDITION_MAIN_BRANCH,
-                    when: ((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto" ? "on_success" : "manual",
-                },
-                {
-                    if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
-                    when: "manual",
-                },
-            ],
-        },
+    const releaseJobBase = {
+        stage: "release",
+        image: releaseImage,
+        script: [method.script],
+        after_script: [EXPIRED_TOKEN_HELP],
+    };
+    const forceReleaseJob = {
         ["⚠️ force create release"]: {
-            stage: "release",
-            image: releaseImage,
-            script: [method.script],
-            after_script: [EXPIRED_TOKEN_HELP],
+            ...releaseJobBase,
             needs: [],
+            allow_failure: true,
             // force semantics of the method's script (e.g. changesets:
             // release a patch bump even without pending changesets)
             ...(method.forceReleaseVariables
                 ? { variables: method.forceReleaseVariables }
                 : {}),
+            rules: manualReleaseRules,
+        },
+    };
+    // informational MR check of the release method (e.g. the changeset
+    // check): warns via allow_failure, the report lands in the MR
+    // widget as an exposed artifact
+    const checkJob = method.checkScript
+        ? {
+            ["🦋 changeset check"]: {
+                stage: "test",
+                image: releaseImage,
+                script: [method.checkScript],
+                allow_failure: true,
+                artifacts: {
+                    paths: ["changeset-report.md"],
+                    expose_as: "changeset report",
+                    // the report must survive the warning exit
+                    when: "always",
+                },
+                rules: [
+                    rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
+                    rules_1.RULE_NEVER_ON_SCHEDULE,
+                    rules_1.RULE_IS_MERGE_REQUEST,
+                ],
+            },
+        }
+        : {};
+    if (((_a = config.releases) === null || _a === void 0 ? void 0 : _a.when) === "auto") {
+        return {
+            [exports.RELEASE_BUTTON_JOB_NAME]: {
+                ...releaseJobBase,
+                rules: [
+                    ...baseReleaseRules,
+                    {
+                        if: rules_1.RULE_CONDITION_MAIN_BRANCH,
+                        when: "on_success",
+                    },
+                    {
+                        if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
+                        when: "manual",
+                        // per-rule: only the unclicked hotfix button must not
+                        // block — a failed automatic release stays loud
+                        allow_failure: true,
+                    },
+                ],
+            },
+            ...forceReleaseJob,
+            ...checkJob,
+        };
+    }
+    const executorNeeds = [
+        { job: exports.RELEASE_BUTTON_JOB_NAME },
+        // optional: hotfix pipelines (and rules-filtered jobs) contain a
+        // different job subset
+        ...mainBranchJobNames.map((name) => ({ job: name, optional: true })),
+    ];
+    if (executorNeeds.length > GITLAB_MAX_NEEDS) {
+        console.warn(`⚠️ the main-branch pipeline has more than ${GITLAB_MAX_NEEDS} jobs — ` +
+            `the "${exports.RELEASE_BUTTON_JOB_NAME}" job falls back to being playable ` +
+            `only once the pipeline finished (gitlab caps needs: at ${GITLAB_MAX_NEEDS})`);
+        return {
+            [exports.RELEASE_BUTTON_JOB_NAME]: {
+                ...releaseJobBase,
+                allow_failure: true,
+                rules: manualReleaseRules,
+            },
+            ...forceReleaseJob,
+            ...checkJob,
+        };
+    }
+    return {
+        // the queue button: playable from the first second of the pipeline.
+        // It only records the intent to release — the executor below does
+        // the actual work once every other job succeeded. Clicking after the
+        // pipeline finished works the same (the executor starts right away).
+        [exports.RELEASE_BUTTON_JOB_NAME]: {
+            stage: "release",
+            image: releaseImage,
+            script: [
+                `echo "release queued — '${exports.RELEASE_EXECUTOR_JOB_NAME}' runs it as soon as every other job in this pipeline succeeded"`,
+            ],
+            needs: [],
+            // allow_failure keeps the unclicked button from blocking the
+            // pipeline AND makes the executor's needs treat it as optional
+            // (skipped executor instead of a forever-waiting pipeline)
+            allow_failure: true,
+            rules: manualReleaseRules,
+        },
+        // the executor: never played manually. Skipped when the button was
+        // not clicked; otherwise starts automatically as soon as the button
+        // and every other (non-manual) job of the pipeline succeeded, and
+        // is skipped when any of them failed.
+        [exports.RELEASE_EXECUTOR_JOB_NAME]: {
+            ...releaseJobBase,
+            needs: executorNeeds,
             rules: [
                 ...baseReleaseRules,
                 {
                     if: rules_1.RULE_CONDITION_MAIN_BRANCH,
-                    when: "manual",
+                    when: "on_success",
                 },
                 {
                     if: rules_1.RULE_CONDITION_HOTFIX_BRANCH,
-                    when: "manual",
+                    when: "on_success",
                 },
             ],
         },
-        // informational MR check of the release method (e.g. the changeset
-        // check): warns via allow_failure, the report lands in the MR
-        // widget as an exposed artifact
-        ...(method.checkScript
-            ? {
-                ["🦋 changeset check"]: {
-                    stage: "test",
-                    image: releaseImage,
-                    script: [method.checkScript],
-                    allow_failure: true,
-                    artifacts: {
-                        paths: ["changeset-report.md"],
-                        expose_as: "changeset report",
-                        // the report must survive the warning exit
-                        when: "always",
-                    },
-                    rules: [
-                        rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
-                        rules_1.RULE_NEVER_ON_SCHEDULE,
-                        rules_1.RULE_IS_MERGE_REQUEST,
-                    ],
-                },
-            }
-            : {}),
+        ...forceReleaseJob,
+        ...checkJob,
     };
 };
 exports.getGitlabReleaseJobs = getGitlabReleaseJobs;
@@ -6726,7 +6941,9 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
         const additionalEnvVars = deployConfigRaw
             ? deploy_1.DEPLOY_TYPES[deployConfigRaw.type].getAdditionalEnvVars(environmentContext)
             : {};
-        const HOSTNAME_INTERNAL = (_b = additionalEnvVars.HOSTNAME_INTERNAL) !== null && _b !== void 0 ? _b : "unknown-host.example.com";
+        // deploy types provide HOSTNAME_INTERNAL as a plain string or bash
+        // expression (never containing references)
+        const HOSTNAME_INTERNAL = ((_b = additionalEnvVars.HOSTNAME_INTERNAL) !== null && _b !== void 0 ? _b : "unknown-host.example.com");
         host = (_c = envConfigRaw === null || envConfigRaw === void 0 ? void 0 : envConfigRaw.host) !== null && _c !== void 0 ? _c : HOSTNAME_INTERNAL;
         url = (0, bash_1.joinBashExpressions)(["https://", host]);
         predefinedVariables = {
@@ -6754,8 +6971,18 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
             componentName: ctx.componentName,
         }),
     ]));
-    const publicEnvVars = ((_g = options.shouldResolveReferences) !== null && _g !== void 0 ? _g : true)
-        ? await (0, bash_3.resolveAllReferences)(publicEnvVarsUnresolved, async (otherComponentName) => {
+    // predefined variables may contain references too (e.g. the embedded
+    // database connection string references the component's own DB_* vars), so
+    // we resolve references over the merged map. This way public var overrides
+    // (like DB_PASSWORD: "${otherComponent:DB_PASSWORD}") are picked up by the
+    // predefined variables that reference them
+    const mergedEnvVars = {
+        ...predefinedVariables,
+        ...secretEnvVars,
+        ...publicEnvVarsUnresolved,
+    };
+    const resolvedEnvVars = ((_g = options.shouldResolveReferences) !== null && _g !== void 0 ? _g : true)
+        ? await (0, bash_3.resolveAllReferences)(mergedEnvVars, async (otherComponentName) => {
             const { envVars: otherEnvVars } = await (0, exports.getEnvironmentVariables)({
                 ...ctx,
                 componentName: otherComponentName,
@@ -6764,12 +6991,8 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
             });
             return otherEnvVars;
         })
-        : publicEnvVarsUnresolved;
-    const envVars = addIndexVar({
-        ...predefinedVariables,
-        ...secretEnvVars,
-        ...publicEnvVars,
-    });
+        : mergedEnvVars;
+    const envVars = addIndexVar(resolvedEnvVars);
     return {
         envVars,
         secretEnvVarKeys,
@@ -8760,8 +8983,8 @@ const getCloudSqlVariables = ({ deployConfigRaw, environmentSlugPrefix, env, com
         };
         return {
             ...dbVars,
-            DATABASE_URL: (0, database_1.getDatabaseConnectionString)(deployConfigRaw.cloudSql, dbVars).concat(additionalQueryParamsString),
-            DATABASE_JDBC_URL: (0, database_1.getDatabaseJdbcUrl)(dbVars, (_c = deployConfigRaw.cloudSql.dbConnectionStringVariablesMode) !== null && _c !== void 0 ? _c : database_1.DEFAULT_DB_VARIABLES_MODE),
+            DATABASE_URL: (0, database_1.getDatabaseConnectionString)(deployConfigRaw.cloudSql, dbVars, componentName).concat(additionalQueryParamsString),
+            DATABASE_JDBC_URL: (0, database_1.getDatabaseJdbcUrl)(dbVars, (_c = deployConfigRaw.cloudSql.dbConnectionStringVariablesMode) !== null && _c !== void 0 ? _c : database_1.DEFAULT_DB_VARIABLES_MODE, componentName),
         };
     }
     return {};
@@ -8953,64 +9176,72 @@ const getDatabaseCreateScript = (context, deployConfig) => {
     ]);
 };
 exports.getDatabaseCreateScript = getDatabaseCreateScript;
-exports.DEFAULT_DB_VARIABLES_MODE = "legacy";
-const getVariableOrValue = (key, variables, mode) => {
-    return mode === "legacy" ? `$${key}` : variables[key];
-};
-const getDatabaseJdbcUrl = (variables, mode) => {
+exports.DEFAULT_DB_VARIABLES_MODE = "embedded";
+const getVariableOrValue = (key, mode, componentName) => {
+    // in embedded mode we reference the component's own env var, which gets
+    // resolved to its final value (including vars.public overrides) after all
+    // env vars have been merged
+    return mode === "legacy"
+        ? `$${key}`
+        : new bash_1.VariableReference(componentName, key);
+};
+const joinDbUrlParts = (parts, mode) => mode === "legacy"
+    ? (0, bash_1.joinBashExpressions)(parts)
+    : new bash_1.VariableValueContainingReferences(parts);
+const getDatabaseJdbcUrl = (variables, mode, componentName) => {
     const parts = [
         "jdbc:postgresql:///",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?cloudSqlInstance=",
-        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode),
+        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", mode, componentName),
         "&socketFactory=com.google.cloud.sql.postgres.SocketFactory&user=",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         "&password=",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getDatabaseJdbcUrl = getDatabaseJdbcUrl;
-const getRailsDatabaseConnectionString = (variables, mode) => {
+const getRailsDatabaseConnectionString = (variables, mode, componentName) => {
     const parts = [
         "postgresql://",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         ":",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
         "@",
         encodeURIComponent(`/cloudsql/${variables.CLOUD_SQL_INSTANCE_CONNECTION_NAME}`),
         "/",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?",
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getRailsDatabaseConnectionString = getRailsDatabaseConnectionString;
-const getPrismaDatabaseConnectionString = (variables, mode) => {
+const getPrismaDatabaseConnectionString = (variables, mode, componentName) => {
     const parts = [
         "postgresql://",
-        getVariableOrValue("DB_USER", variables, mode),
+        getVariableOrValue("DB_USER", mode, componentName),
         ":",
-        getVariableOrValue("DB_PASSWORD", variables, mode),
+        getVariableOrValue("DB_PASSWORD", mode, componentName),
         "@localhost/",
-        getVariableOrValue("DB_NAME", variables, mode),
+        getVariableOrValue("DB_NAME", mode, componentName),
         "?host=/cloudsql/",
-        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", variables, mode),
+        getVariableOrValue("CLOUD_SQL_INSTANCE_CONNECTION_NAME", mode, componentName),
     ];
-    return (0, bash_1.joinBashExpressions)(parts);
+    return joinDbUrlParts(parts, mode);
 };
 exports.getPrismaDatabaseConnectionString = getPrismaDatabaseConnectionString;
-const getDatabaseConnectionString = (config, variables) => {
+const getDatabaseConnectionString = (config, variables, componentName) => {
     var _a;
     const mode = (_a = config.dbConnectionStringVariablesMode) !== null && _a !== void 0 ? _a : exports.DEFAULT_DB_VARIABLES_MODE;
     switch (config.dbConnectionStringFormat) {
         case "jdbc":
-            return (0, exports.getDatabaseJdbcUrl)(variables, mode);
+            return (0, exports.getDatabaseJdbcUrl)(variables, mode, componentName);
         case "rails":
-            return (0, exports.getRailsDatabaseConnectionString)(variables, mode);
+            return (0, exports.getRailsDatabaseConnectionString)(variables, mode, componentName);
         default:
             // prisma
-            return (0, exports.getPrismaDatabaseConnectionString)(variables, mode);
+            return (0, exports.getPrismaDatabaseConnectionString)(variables, mode, componentName);
     }
 };
 exports.getDatabaseConnectionString = getDatabaseConnectionString;