@catladder/cli 0.0.0-next-e9e5af68 → 0.0.0-next-1c65899f

package/dist/pipeline/src/backends/github/createGithubJobs.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.getUploadProviderIds = exports.makeGithubJob = exports.collectSecretKinds = exports.resolveGithubNeeds = exports.githubGlobalJobId = exports.githubJobId = void 0;
 const lodash_es_1 = require("lodash-es");
 const getInjectVarsScript_1 = require("../../bash/getInjectVarsScript");
@@ -17,172 +14,198 @@ const ciVariables_1 = require("./ciVariables");
  * leak into github jobs (docker-in-docker daemon config, kubernetes
  * executor resource requests, gitlab clone strategy)
  */
-const GITLAB_ONLY_RUNNER_VARIABLES = new Set(["DOCKER_HOST", "DOCKER_TLS_CERTDIR", "DOCKER_DRIVER", "KUBERNETES_CPU_REQUEST", "KUBERNETES_MEMORY_REQUEST", "KUBERNETES_CPU_LIMIT", "KUBERNETES_MEMORY_LIMIT", "GIT_STRATEGY"]);
+const GITLAB_ONLY_RUNNER_VARIABLES = new Set([
+    "DOCKER_HOST",
+    "DOCKER_TLS_CERTDIR",
+    "DOCKER_DRIVER",
+    "KUBERNETES_CPU_REQUEST",
+    "KUBERNETES_MEMORY_REQUEST",
+    "KUBERNETES_CPU_LIMIT",
+    "KUBERNETES_MEMORY_LIMIT",
+    "GIT_STRATEGY",
+]);
 /**
  * github runs docker natively on its runners, gitlab needs a
  * docker-in-docker service for it
  */
-const isDindService = image => /(^|\/)docker:.*dind/.test(image);
-const slug = value => {
-  const slugged = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
-  // job ids must start with a letter or _
-  return /^[a-z_]/.test(slugged) ? slugged : `job-${slugged}`;
+const isDindService = (image) => /(^|\/)docker:.*dind/.test(image);
+const slug = (value) => {
+    const slugged = value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    // job ids must start with a letter or _
+    return /^[a-z_]/.test(slugged) ? slugged : `job-${slugged}`;
 };
 const githubJobId = (context, jobName) => slug(`${context.type === "workspace" ? "ws-" : ""}${context.name}-${jobName}-${context.env}`);
 exports.githubJobId = githubJobId;
 /** id of a job without component/workspace context (e.g. image builds) */
-const githubGlobalJobId = jobName => slug(jobName);
+const githubGlobalJobId = (jobName) => slug(jobName);
 exports.githubGlobalJobId = githubGlobalJobId;
 const githubJobName = (context, jobName) => `${context.name} ${jobName} | ${context.env}`;
 const resolveNeed = (context, need, allJobs) => {
-  var _a;
-  const env = context.env;
-  const findComponentJob = (componentName, jobName) => {
-    const provider = allJobs.components.find(c => c.context.name === componentName && c.context.env === env);
-    const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find(j => j.name === jobName);
-    if (!provider || !job) {
-      throw new Error(`unknown job referenced: '${jobName}' from '${env}:${componentName}'`);
-    }
-    return (0, exports.githubJobId)(provider.context, jobName);
-  };
-  const findWorkspaceJob = (workspaceName, jobName) => {
-    const provider = allJobs.workspaces.find(w => w.context.name === workspaceName && w.context.env === env);
-    const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find(j => j.name === jobName);
-    if (!provider || !job) {
-      throw new Error(`unknown job referenced: '${jobName}' from workspace '${env}:${workspaceName}'`);
-    }
-    return (0, exports.githubJobId)(provider.context, jobName);
-  };
-  if ((0, lodash_es_1.isObject)(need)) {
-    if ("global" in need && need.global) {
-      return {
-        id: (0, exports.githubGlobalJobId)(need.job),
-        artifacts: need.artifacts
-      };
-    }
-    if ("workspaceName" in need && need.workspaceName) {
-      return {
-        id: findWorkspaceJob(need.workspaceName, need.job),
-        artifacts: need.artifacts
-      };
+    var _a;
+    const env = context.env;
+    const findComponentJob = (componentName, jobName) => {
+        const provider = allJobs.components.find((c) => c.context.name === componentName && c.context.env === env);
+        const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find((j) => j.name === jobName);
+        if (!provider || !job) {
+            throw new Error(`unknown job referenced: '${jobName}' from '${env}:${componentName}'`);
+        }
+        return (0, exports.githubJobId)(provider.context, jobName);
+    };
+    const findWorkspaceJob = (workspaceName, jobName) => {
+        const provider = allJobs.workspaces.find((w) => w.context.name === workspaceName && w.context.env === env);
+        const job = provider === null || provider === void 0 ? void 0 : provider.jobs.find((j) => j.name === jobName);
+        if (!provider || !job) {
+            throw new Error(`unknown job referenced: '${jobName}' from workspace '${env}:${workspaceName}'`);
+        }
+        return (0, exports.githubJobId)(provider.context, jobName);
+    };
+    if ((0, lodash_es_1.isObject)(need)) {
+        if ("global" in need && need.global) {
+            return { id: (0, exports.githubGlobalJobId)(need.job), artifacts: need.artifacts };
+        }
+        if ("workspaceName" in need && need.workspaceName) {
+            return {
+                id: findWorkspaceJob(need.workspaceName, need.job),
+                artifacts: need.artifacts,
+            };
+        }
+        return {
+            id: findComponentJob((_a = ("componentName" in need ? need.componentName : undefined)) !== null && _a !== void 0 ? _a : context.name, need.job),
+            artifacts: need.artifacts,
+        };
     }
     return {
-      id: findComponentJob((_a = "componentName" in need ? need.componentName : undefined) !== null && _a !== void 0 ? _a : context.name, need.job),
-      artifacts: need.artifacts
+        id: context.type === "workspace"
+            ? findWorkspaceJob(context.name, need)
+            : findComponentJob(context.name, need),
+        // plain string needs download artifacts by default (gitlab semantics)
+        artifacts: true,
     };
-  }
-  return {
-    id: context.type === "workspace" ? findWorkspaceJob(context.name, need) : findComponentJob(context.name, need),
-    // plain string needs download artifacts by default (gitlab semantics)
-    artifacts: true
-  };
 };
 const resolveGithubNeeds = (context, job, allJobs, extraNeeds = []) => {
-  var _a;
-  const resolved = [...extraNeeds, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])].map(need => resolveNeed(context, need, allJobs));
-  // deduplicate by provider id, explicit entries win (they come last)
-  return [...new Map(resolved.map(n => [n.id, n])).values()].sort((a, b) => a.id.localeCompare(b.id));
+    var _a;
+    const resolved = [...extraNeeds, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])].map((need) => resolveNeed(context, need, allJobs));
+    // deduplicate by provider id, explicit entries win (they come last)
+    return [...new Map(resolved.map((n) => [n.id, n])).values()].sort((a, b) => a.id.localeCompare(b.id));
 };
 exports.resolveGithubNeeds = resolveGithubNeeds;
 /** step id of a referenceable cache restore step (see `cacheId`) */
-const cacheStepId = cacheId => `cache-${cacheId.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
+const cacheStepId = (cacheId) => `cache-${cacheId.replace(/[^a-zA-Z0-9_-]/g, "-")}`;
 const createCacheSteps = (context, job) => {
-  var _a, _b;
-  if (!((_a = job.caches) === null || _a === void 0 ? void 0 : _a.length)) {
-    return [];
-  }
-  const lowered = (0, utils_1.ensureArray)((_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : []);
-  // caches marked redundantOnExactHitOf skip their (expensive) restore
-  // when the referenced sibling cache hit its exact key — e.g. the yarn
-  // zip cache is never read when node_modules restored for the same
-  // lockfile. The referenced cache's step must come first (its
-  // `cache-hit` output drives the `if`), so providers are emitted
-  // before dependents; the reorder is github-only and does not affect
-  // the gitlab cache list.
-  const referencedIds = new Set(lowered.map(cache => cache.redundantOnExactHitOf).filter(id => !!id));
-  const providedIds = new Set(lowered.map(cache => cache.cacheId).filter(id => !!id));
-  const ordered = [...lowered.filter(cache => !cache.redundantOnExactHitOf), ...lowered.filter(cache => cache.redundantOnExactHitOf)];
-  return ordered.map(cache => {
-    var _a, _b, _c, _d, _e, _f, _g;
-    const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
-    const key = cache.key;
-    const {
-      cacheKey,
-      restoreKeyPrefix,
-      label
-    } = typeof key === "string" || key === undefined ? ((_b = cache.keyFiles) === null || _b === void 0 ? void 0 : _b.length) ? {
-      // content-keyed: an unchanged hash is an exact hit and the
-      // cache is never re-saved (no per-run copies, no races
-      // between parallel jobs saving the same key)
-      cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ hashFiles(${cache.keyFiles.map(f => `'${f}'`).join(", ")}) }}`,
-      restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
-      label: key !== null && key !== void 0 ? key : "cache"
-    } : {
-      // unique key per run so the cache is re-saved, restored via prefix
-      cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ github.run_id }}`,
-      restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
-      label: key !== null && key !== void 0 ? key : "cache"
-    } : {
-      cacheKey: `${(_c = key.prefix) !== null && _c !== void 0 ? _c : "files"}-\${{ hashFiles(${((_d = key.files) !== null && _d !== void 0 ? _d : []).map(f => `'${f}'`).join(", ")}) }}`,
-      restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
-      label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(",")
-    };
-    // the sibling-hit condition only applies when the referenced cache
-    // is actually part of this job — otherwise restore unconditionally
-    const skipCondition = cache.redundantOnExactHitOf && providedIds.has(cache.redundantOnExactHitOf) ? `\${{ steps.${cacheStepId(cache.redundantOnExactHitOf)}.outputs.cache-hit != 'true' }}` : undefined;
-    return {
-      name: `Cache ${label}`,
-      // referenced caches carry an id so dependents can read cache-hit
-      ...(cache.cacheId && referencedIds.has(cache.cacheId) ? {
-        id: cacheStepId(cache.cacheId)
-      } : {}),
-      ...(skipCondition ? {
-        if: skipCondition
-      } : {}),
-      // pull-only caches are restored but never saved
-      uses: cache.policy === "pull" ? "actions/cache/restore@v4" : "actions/cache@v4",
-      with: {
-        path: paths.join("\n"),
-        key: cacheKey,
-        "restore-keys": restoreKeyPrefix
-      }
-    };
-  });
+    var _a, _b;
+    if (!((_a = job.caches) === null || _a === void 0 ? void 0 : _a.length)) {
+        return [];
+    }
+    const lowered = (0, utils_1.ensureArray)((_b = (0, createJobCache_1.createJobCacheFromCacheConfigs)(context, job.caches)) !== null && _b !== void 0 ? _b : []);
+    // caches marked redundantOnExactHitOf skip their (expensive) restore
+    // when the referenced sibling cache hit its exact key — e.g. the yarn
+    // zip cache is never read when node_modules restored for the same
+    // lockfile. The referenced cache's step must come first (its
+    // `cache-hit` output drives the `if`), so providers are emitted
+    // before dependents; the reorder is github-only and does not affect
+    // the gitlab cache list.
+    const referencedIds = new Set(lowered
+        .map((cache) => cache.redundantOnExactHitOf)
+        .filter((id) => !!id));
+    const providedIds = new Set(lowered.map((cache) => cache.cacheId).filter((id) => !!id));
+    const ordered = [
+        ...lowered.filter((cache) => !cache.redundantOnExactHitOf),
+        ...lowered.filter((cache) => cache.redundantOnExactHitOf),
+    ];
+    return ordered.map((cache) => {
+        var _a, _b, _c, _d, _e, _f, _g;
+        const paths = (0, utils_1.ensureArray)((_a = cache.paths) !== null && _a !== void 0 ? _a : []);
+        const key = cache.key;
+        const { cacheKey, restoreKeyPrefix, label } = typeof key === "string" || key === undefined
+            ? ((_b = cache.keyFiles) === null || _b === void 0 ? void 0 : _b.length)
+                ? {
+                    // content-keyed: an unchanged hash is an exact hit and the
+                    // cache is never re-saved (no per-run copies, no races
+                    // between parallel jobs saving the same key)
+                    cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ hashFiles(${cache.keyFiles
+                        .map((f) => `'${f}'`)
+                        .join(", ")}) }}`,
+                    restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+                    label: key !== null && key !== void 0 ? key : "cache",
+                }
+                : {
+                    // unique key per run so the cache is re-saved, restored via prefix
+                    cacheKey: `${key !== null && key !== void 0 ? key : "cache"}-\${{ github.run_id }}`,
+                    restoreKeyPrefix: `${key !== null && key !== void 0 ? key : "cache"}-`,
+                    label: key !== null && key !== void 0 ? key : "cache",
+                }
+            : {
+                cacheKey: `${(_c = key.prefix) !== null && _c !== void 0 ? _c : "files"}-\${{ hashFiles(${((_d = key.files) !== null && _d !== void 0 ? _d : [])
+                    .map((f) => `'${f}'`)
+                    .join(", ")}) }}`,
+                restoreKeyPrefix: `${(_e = key.prefix) !== null && _e !== void 0 ? _e : "files"}-`,
+                label: (_f = key.prefix) !== null && _f !== void 0 ? _f : ((_g = key.files) !== null && _g !== void 0 ? _g : []).join(","),
+            };
+        // the sibling-hit condition only applies when the referenced cache
+        // is actually part of this job — otherwise restore unconditionally
+        const skipCondition = cache.redundantOnExactHitOf &&
+            providedIds.has(cache.redundantOnExactHitOf)
+            ? `\${{ steps.${cacheStepId(cache.redundantOnExactHitOf)}.outputs.cache-hit != 'true' }}`
+            : undefined;
+        return {
+            name: `Cache ${label}`,
+            // referenced caches carry an id so dependents can read cache-hit
+            ...(cache.cacheId && referencedIds.has(cache.cacheId)
+                ? { id: cacheStepId(cache.cacheId) }
+                : {}),
+            ...(skipCondition ? { if: skipCondition } : {}),
+            // pull-only caches are restored but never saved
+            uses: cache.policy === "pull"
+                ? "actions/cache/restore@v4"
+                : "actions/cache@v4",
+            with: {
+                path: paths.join("\n"),
+                key: cacheKey,
+                "restore-keys": restoreKeyPrefix,
+            },
+        };
+    });
 };
 /**
  * how a vault-stored value reaches the job env: masked github secret,
  * or plain (unmasked) github variable for non-sensitive values — those
  * stay readable in logs and usable in environment urls
  */
-const vaultValueExpression = (name, kinds) => kinds.get(name) === "variable" ? `\${{ vars.${name} }}` : `\${{ secrets.${name} }}`;
+const vaultValueExpression = (name, kinds) => kinds.get(name) === "variable"
+    ? `\${{ vars.${name} }}`
+    : `\${{ secrets.${name} }}`;
 /**
  * the kind of every vault-stored var of all components, keyed by its
  * CL_* name — the lookup for cross-component references
  */
-const collectSecretKinds = allJobs => {
-  const kinds = new Map();
-  allJobs.components.forEach(({
-    context
-  }) => {
-    var _a, _b;
-    const entries = [...context.environment.secretEnvVarKeys, ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []), ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : [])];
-    entries.forEach(({
-      key,
-      kind
-    }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
-  });
-  return kinds;
+const collectSecretKinds = (allJobs) => {
+    const kinds = new Map();
+    allJobs.components.forEach(({ context }) => {
+        var _a, _b;
+        const entries = [
+            ...context.environment.secretEnvVarKeys,
+            ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []),
+            ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
+        ];
+        entries.forEach(({ key, kind }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    });
+    return kinds;
 };
 exports.collectSecretKinds = collectSecretKinds;
 const getSecretsEnv = (context, kinds) => {
-  var _a, _b;
-  const keys = [...context.environment.secretEnvVarKeys, ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []), ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : [])];
-  return Object.fromEntries(keys.map(({
-    key
-  }) => {
-    const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key);
-    return [name, vaultValueExpression(name, kinds)];
-  }));
+    var _a, _b;
+    const keys = [
+        ...context.environment.secretEnvVarKeys,
+        ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []),
+        ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
+    ];
+    return Object.fromEntries(keys.map(({ key }) => {
+        const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key);
+        return [name, vaultValueExpression(name, kinds)];
+    }));
 };
 /**
  * every CL_* variable the job script reads must exist in the job env.
@@ -191,138 +214,167 @@ const getSecretsEnv = (context, kinds) => {
  * that. Github jobs only see what is injected explicitly, so the
  * script is scanned for the names it actually references.
  */
-const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)].map(match => match[1]).filter(name => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV)).map(name => [name, vaultValueExpression(name, kinds)]));
+const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)]
+    .map((match) => match[1])
+    .filter((name) => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV))
+    .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
-  var _a, _b, _c, _d, _e, _f, _g, _h, _j;
-  const id = (0, exports.githubJobId)(context, job.name);
-  const isComponent = context.type === "component";
-  const createsJobEnv = !!job.environment && isComponent && (!job.environment.action || job.environment.action === "start");
-  const skipCheckout = ((_a = job.runnerVariables) === null || _a === void 0 ? void 0 : _a.GIT_STRATEGY) === "none";
-  const resolved = images.resolve(job.image);
-  const needs = (0, exports.resolveGithubNeeds)(context, job, allJobs, resolved.need ? [resolved.need] : []);
-  const image = typeof resolved.image === "string" ? resolved.image : Array.isArray(resolved.image) ? resolved.image[0] : (_b = resolved.image) === null || _b === void 0 ? void 0 : _b.name;
-  const runScript = [...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(), ...(0, gitlab_1.collapseableSection)("injectvars", "Injecting variables")((0, getInjectVarsScript_1.getInjectVarsScript)((_c = job.variables) !== null && _c !== void 0 ? _c : {})), ...((_e = (_d = job.script) === null || _d === void 0 ? void 0 : _d.filter(utils_1.notNil)) !== null && _e !== void 0 ? _e : []), ...(createsJobEnv ? [`echo "url=$ROOT_URL" >> "$GITHUB_OUTPUT"`] : [])].join("\n");
-  // scripts live in committed files to keep workflows under github's
-  // 512 KB limit. Two classes of jobs must keep their script inline:
-  // jobs without a checkout have no repo files, and `${{ }}` expressions
-  // are only interpolated inside the workflow file itself.
-  const run = skipCheckout || runScript.includes("${{") ? runScript : scripts.add(id, runScript);
-  const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
-  const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map(service => typeof service === "string" ? {
-    name: service
-  } : service);
-  // docker runs natively on github runners, so gitlab's docker-in-docker
-  // services are dropped. The job container stays: the runner mounts the
-  // host's docker socket into it, and images like docker-build carry the
-  // helper scripts (ensure*Dockerfile etc.) the job scripts rely on.
-  const services = Object.fromEntries(declaredServices.filter(service => !isDindService(service.name)).map(service => [slug("alias" in service && service.alias ? service.alias : service.name), {
-    image: service.name,
-    ...("variables" in service && service.variables ? {
-      env: service.variables
-    } : {})
-  }]));
-  const env = {
-    ...Object.fromEntries(Object.entries((_j = job.runnerVariables) !== null && _j !== void 0 ? _j : {}).filter(([key]) => !GITLAB_ONLY_RUNNER_VARIABLES.has(key))),
-    ...(isComponent ? getSecretsEnv(context, secretKinds) : {}),
-    ...getReferencedSecretsEnv(runScript, secretKinds),
-    CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner"
-  };
-  /**
-   * the github environment of the job — serving two purposes:
-   * deployment tracking on deploy jobs, and access to environment
-   * secrets (the repo-level cap of 100 secrets doesn't scale to
-   * multiple envs). Names are keyed by env NAME, never env type: an
-   * app can have several envs of the same type.
-   *
-   * - deploy jobs: `<env>-<component>` — static (unlike the former
-   *   per-PR review names), so environment secrets can attach, and
-   *   each component keeps its own deployment badge/url in the
-   *   github ui. For review, PRs share the component's environment:
-   *   a newer PR's deploy marks the previous one Inactive (the badge,
-   *   not the app) — the price of a static name.
-   * - other jobs referencing secrets join the shared `<env>`
-   *   environment — deliberately NOT the per-component one, whose
-   *   Active deploy badge their deployment records would displace.
-   *   NOTE: build-time and deploy-time vars are not differentiated
-   *   yet, so this environment holds roughly ALL of the env's
-   *   secrets (the build's dotenv references every component).
-   * - jobs without secret references get no environment
-   */
-  const referencesSecrets = Object.values(env).some(value => typeof value === "string" && (value.includes("${{ secrets.") || value.includes("${{ vars.")));
-  const githubEnvironment = job.environment && isComponent ? {
-    name: `${context.env}-${context.name}`,
-    ...(createsJobEnv ? {
-      url: "${{ steps.main.outputs.url }}"
-    } : {})
-  } : referencesSecrets ? {
-    name: context.env
-  } : undefined;
-  const githubJob = {
-    name: githubJobName(context, job.name),
-    "runs-on": "ubuntu-latest",
-    ...(needs.length > 0 ? {
-      needs: needs.map(n => n.id)
-    } : {}),
-    ...(image ? {
-      container: {
-        image,
-        // private images in the repo's registry need credentials
-        ...(resolved.fromRepoRegistry ? {
-          credentials: {
-            username: "${{ github.actor }}",
-            password: "${{ github.token }}"
-          }
-        } : {})
-      }
-    } : {}),
-    ...(Object.keys(services).length > 0 ? {
-      services
-    } : {}),
-    ...(githubEnvironment ? {
-      environment: githubEnvironment
-    } : {}),
-    env,
-    steps: [...(skipCheckout ? [] : [{
-      name: "Checkout",
-      uses: "actions/checkout@v4"
-    }]), ...createCacheSteps(context, job), ...needs.filter(n => n.artifacts).map(n => ({
-      name: `Download artifacts from ${n.id}`,
-      uses: "actions/download-artifact@v4",
-      with: {
-        name: n.id
-      }
-    })), {
-      name: job.name,
-      id: "main",
-      run,
-      shell: "bash"
-    }, ...(uploadProviderIds.has(id) || artifactPaths.length > 0 ? artifactPaths.length > 0 ? [{
-      name: "Upload artifacts",
-      uses: "actions/upload-artifact@v4",
-      with: {
-        name: id,
-        path: artifactPaths.join("\n"),
-        "if-no-files-found": "warn",
-        // gitlab artifacts include everything; upload-artifact
-        // silently drops hidden files by default — which is
-        // exactly where next.js builds live (.next)
-        "include-hidden-files": true
-      }
-    }] : [] : [])]
-  };
-  return [id, githubJob];
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    const id = (0, exports.githubJobId)(context, job.name);
+    const isComponent = context.type === "component";
+    const createsJobEnv = !!job.environment &&
+        isComponent &&
+        (!job.environment.action || job.environment.action === "start");
+    const skipCheckout = ((_a = job.runnerVariables) === null || _a === void 0 ? void 0 : _a.GIT_STRATEGY) === "none";
+    const resolved = images.resolve(job.image);
+    const needs = (0, exports.resolveGithubNeeds)(context, job, allJobs, resolved.need ? [resolved.need] : []);
+    const image = typeof resolved.image === "string"
+        ? resolved.image
+        : Array.isArray(resolved.image)
+            ? resolved.image[0]
+            : (_b = resolved.image) === null || _b === void 0 ? void 0 : _b.name;
+    const runScript = [
+        ...(0, scriptFunctions_1.getGithubScriptFunctionDefinitions)(),
+        ...(0, gitlab_1.collapseableSection)("injectvars", "Injecting variables")((0, getInjectVarsScript_1.getInjectVarsScript)((_c = job.variables) !== null && _c !== void 0 ? _c : {})),
+        ...((_e = (_d = job.script) === null || _d === void 0 ? void 0 : _d.filter(utils_1.notNil)) !== null && _e !== void 0 ? _e : []),
+        ...(createsJobEnv ? [`echo "url=$ROOT_URL" >> "$GITHUB_OUTPUT"`] : []),
+    ].join("\n");
+    // scripts live in committed files to keep workflows under github's
+    // 512 KB limit. Two classes of jobs must keep their script inline:
+    // jobs without a checkout have no repo files, and `${{ }}` expressions
+    // are only interpolated inside the workflow file itself.
+    const run = skipCheckout || runScript.includes("${{")
+        ? runScript
+        : scripts.add(id, runScript);
+    const artifactPaths = (_g = (_f = job.artifacts) === null || _f === void 0 ? void 0 : _f.paths) !== null && _g !== void 0 ? _g : [];
+    const declaredServices = ((_h = job.services) !== null && _h !== void 0 ? _h : []).map((service) => typeof service === "string" ? { name: service } : service);
+    // docker runs natively on github runners, so gitlab's docker-in-docker
+    // services are dropped. The job container stays: the runner mounts the
+    // host's docker socket into it, and images like docker-build carry the
+    // helper scripts (ensure*Dockerfile etc.) the job scripts rely on.
+    const services = Object.fromEntries(declaredServices
+        .filter((service) => !isDindService(service.name))
+        .map((service) => [
+        slug("alias" in service && service.alias ? service.alias : service.name),
+        {
+            image: service.name,
+            ...("variables" in service && service.variables
+                ? { env: service.variables }
+                : {}),
+        },
+    ]));
+    const env = {
+        ...Object.fromEntries(Object.entries((_j = job.runnerVariables) !== null && _j !== void 0 ? _j : {}).filter(([key]) => !GITLAB_ONLY_RUNNER_VARIABLES.has(key))),
+        ...(isComponent ? getSecretsEnv(context, secretKinds) : {}),
+        ...getReferencedSecretsEnv(runScript, secretKinds),
+        CL_JOB_IMAGE: image !== null && image !== void 0 ? image : "runner",
+    };
+    /**
+     * the github environment of the job — serving two purposes:
+     * deployment tracking on deploy jobs, and access to environment
+     * secrets (the repo-level cap of 100 secrets doesn't scale to
+     * multiple envs). Names are keyed by env NAME, never env type: an
+     * app can have several envs of the same type.
+     *
+     * - deploy jobs: `<env>-<component>` — static (unlike the former
+     *   per-PR review names), so environment secrets can attach, and
+     *   each component keeps its own deployment badge/url in the
+     *   github ui. For review, PRs share the component's environment:
+     *   a newer PR's deploy marks the previous one Inactive (the badge,
+     *   not the app) — the price of a static name.
+     * - other jobs referencing secrets join the shared `<env>`
+     *   environment — deliberately NOT the per-component one, whose
+     *   Active deploy badge their deployment records would displace.
+     *   NOTE: build-time and deploy-time vars are not differentiated
+     *   yet, so this environment holds roughly ALL of the env's
+     *   secrets (the build's dotenv references every component).
+     * - jobs without secret references get no environment
+     */
+    const referencesSecrets = Object.values(env).some((value) => typeof value === "string" &&
+        (value.includes("${{ secrets.") || value.includes("${{ vars.")));
+    const githubEnvironment = job.environment && isComponent
+        ? {
+            name: `${context.env}-${context.name}`,
+            ...(createsJobEnv ? { url: "${{ steps.main.outputs.url }}" } : {}),
+        }
+        : referencesSecrets
+            ? { name: context.env }
+            : undefined;
+    const githubJob = {
+        name: githubJobName(context, job.name),
+        "runs-on": "ubuntu-latest",
+        ...(needs.length > 0 ? { needs: needs.map((n) => n.id) } : {}),
+        ...(image
+            ? {
+                container: {
+                    image,
+                    // private images in the repo's registry need credentials
+                    ...(resolved.fromRepoRegistry
+                        ? {
+                            credentials: {
+                                username: "${{ github.actor }}",
+                                password: "${{ github.token }}",
+                            },
+                        }
+                        : {}),
+                },
+            }
+            : {}),
+        ...(Object.keys(services).length > 0 ? { services } : {}),
+        ...(githubEnvironment ? { environment: githubEnvironment } : {}),
+        env,
+        steps: [
+            ...(skipCheckout
+                ? []
+                : [{ name: "Checkout", uses: "actions/checkout@v4" }]),
+            ...createCacheSteps(context, job),
+            ...needs
+                .filter((n) => n.artifacts)
+                .map((n) => ({
+                name: `Download artifacts from ${n.id}`,
+                uses: "actions/download-artifact@v4",
+                with: { name: n.id },
+            })),
+            {
+                name: job.name,
+                id: "main",
+                run,
+                shell: "bash",
+            },
+            ...(uploadProviderIds.has(id) || artifactPaths.length > 0
+                ? artifactPaths.length > 0
+                    ? [
+                        {
+                            name: "Upload artifacts",
+                            uses: "actions/upload-artifact@v4",
+                            with: {
+                                name: id,
+                                path: artifactPaths.join("\n"),
+                                "if-no-files-found": "warn",
+                                // gitlab artifacts include everything; upload-artifact
+                                // silently drops hidden files by default — which is
+                                // exactly where next.js builds live (.next)
+                                "include-hidden-files": true,
+                            },
+                        },
+                    ]
+                    : []
+                : []),
+        ],
+    };
+    return [id, githubJob];
 };
 exports.makeGithubJob = makeGithubJob;
 /**
  * the ids of all jobs whose artifacts are consumed by other jobs
  * (they need an upload step)
  */
-const getUploadProviderIds = allJobs => {
-  const ids = new Set();
-  [...allJobs.workspaces, ...allJobs.components].forEach(({
-    context,
-    jobs
-  }) => jobs.forEach(job => (0, exports.resolveGithubNeeds)(context, job, allJobs).filter(n => n.artifacts).forEach(n => ids.add(n.id))));
-  return ids;
+const getUploadProviderIds = (allJobs) => {
+    const ids = new Set();
+    [...allJobs.workspaces, ...allJobs.components].forEach(({ context, jobs }) => jobs.forEach((job) => (0, exports.resolveGithubNeeds)(context, job, allJobs)
+        .filter((n) => n.artifacts)
+        .forEach((n) => ids.add(n.id))));
+    return ids;
 };
-exports.getUploadProviderIds = getUploadProviderIds;
+exports.getUploadProviderIds = getUploadProviderIds;
+//# sourceMappingURL=createGithubJobs.js.map