@catladder/cli 0.0.0-next-e9e5af68 → 0.0.0-next-1c65899f

package/dist/cli/src/apps/cli/commands/project/doctor/GcloudProjectInspector.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.GcloudProjectInspector = void 0;
 const child_process_promise_1 = require("child-process-promise");
 const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
@@ -12,48 +9,50 @@ const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
  * `get-iam-policy` / `services list` call, not one per context
  */
 class GcloudProjectInspector {
-  constructor() {
-    this.iamBindings = new Map();
-    this.enabledServices = new Map();
-  }
-  async isAuthenticated() {
-    try {
-      await (0, child_process_promise_1.exec)("gcloud auth print-access-token");
-      return true;
-    } catch (_a) {
-      return false;
+    constructor() {
+        this.iamBindings = new Map();
+        this.enabledServices = new Map();
     }
-  }
-  getIamBindings(projectId) {
-    if (!this.iamBindings.has(projectId)) {
-      this.iamBindings.set(projectId, (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`).then(result => {
-        var _a;
-        return (_a = JSON.parse(result.stdout).bindings) !== null && _a !== void 0 ? _a : [];
-      }));
+    async isAuthenticated() {
+        try {
+            await (0, child_process_promise_1.exec)("gcloud auth print-access-token");
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
     }
-    return this.iamBindings.get(projectId);
-  }
-  /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
-  async getRolesOfMember(projectId, member) {
-    const bindings = await this.getIamBindings(projectId);
-    return bindings.filter(binding => {
-      var _a;
-      return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member);
-    }).map(binding => binding.role);
-  }
-  getEnabledServices(projectId) {
-    if (!this.enabledServices.has(projectId)) {
-      this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then(result => new Set(result.stdout.split("\n").map(line => line.trim()).filter(Boolean))));
+    getIamBindings(projectId) {
+        if (!this.iamBindings.has(projectId)) {
+            this.iamBindings.set(projectId, (0, child_process_promise_1.exec)(`gcloud projects get-iam-policy ${projectId} --format=json`).then((result) => { var _a; return (_a = JSON.parse(result.stdout).bindings) !== null && _a !== void 0 ? _a : []; }));
+        }
+        return this.iamBindings.get(projectId);
     }
-    return this.enabledServices.get(projectId);
-  }
-  async hasArtifactsRegistry(projectId, region) {
-    try {
-      await (0, child_process_promise_1.exec)(`gcloud artifacts repositories describe ${artifactsRegistry_1.CATLADDER_REGISTRY_NAME} --project="${projectId}" --location=${region}`);
-      return true;
-    } catch (_a) {
-      return false;
+    /** all roles bound to the given member (e.g. "serviceAccount:<email>") */
+    async getRolesOfMember(projectId, member) {
+        const bindings = await this.getIamBindings(projectId);
+        return bindings
+            .filter((binding) => { var _a; return (_a = binding.members) === null || _a === void 0 ? void 0 : _a.includes(member); })
+            .map((binding) => binding.role);
+    }
+    getEnabledServices(projectId) {
+        if (!this.enabledServices.has(projectId)) {
+            this.enabledServices.set(projectId, (0, child_process_promise_1.exec)(`gcloud services list --enabled --project=${projectId} --format="value(config.name)"`).then((result) => new Set(result.stdout
+                .split("\n")
+                .map((line) => line.trim())
+                .filter(Boolean))));
+        }
+        return this.enabledServices.get(projectId);
+    }
+    async hasArtifactsRegistry(projectId, region) {
+        try {
+            await (0, child_process_promise_1.exec)(`gcloud artifacts repositories describe ${artifactsRegistry_1.CATLADDER_REGISTRY_NAME} --project="${projectId}" --location=${region}`);
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
     }
-  }
 }
-exports.GcloudProjectInspector = GcloudProjectInspector;
+exports.GcloudProjectInspector = GcloudProjectInspector;
+//# sourceMappingURL=GcloudProjectInspector.js.map

package/dist/cli/src/apps/cli/commands/project/doctor/checkCloudRun.d.ts

@@ -10,4 +10,4 @@ import type { DoctorReport } from "./DoctorReport";
  * setup ran — deploys keep working and only the review teardown hits
  * the missing `roles/cloudsql.admin` as a 403 in ci.
  */
-export declare const checkCloudRun: (report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;
+export declare const checkCloudRun: (report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkCloudRun.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkCloudRun = void 0;
 const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
 const artifactsRegistry_1 = require("../../../../../gcloud/artifactsRegistry");
@@ -11,13 +8,13 @@ const serviceAccounts_1 = require("../../../../../gcloud/serviceAccounts");
 const concurrency_1 = require("../../../../../utils/concurrency");
 const setupCloudRun_1 = require("../setup/setupCloudRun");
 const GcloudProjectInspector_1 = require("./GcloudProjectInspector");
-const getCloudRunConfig = context => {
-  var _a;
-  const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-  if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
-    throw new Error("not a cloud run context");
-  }
-  return config;
+const getCloudRunConfig = (context) => {
+    var _a;
+    const config = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(config, "google-cloudrun")) {
+        throw new Error("not a cloud run context");
+    }
+    return config;
 };
 /**
  * compares the gcloud state `setupCloudRun` would provision for the
@@ -30,91 +27,76 @@ const getCloudRunConfig = context => {
  * the missing `roles/cloudsql.admin` as a 403 in ci.
  */
 const checkCloudRun = async (report, contexts) => {
-  var _a;
-  const cloudRunContexts = contexts.filter(context => {
     var _a;
-    return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun");
-  });
-  if (cloudRunContexts.length === 0) return;
-  report.section("google cloud run infrastructure");
-  const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
-  if (!(await inspector.isAuthenticated())) {
-    report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
-    return;
-  }
-  // project-level: enabled services + artifacts registry. The required
-  // services are the union over all components deploying to the project
-  // (cloudSql on any of them requires the sql services).
-  const byProject = new Map();
-  for (const context of cloudRunContexts) {
-    const {
-      projectId
-    } = getCloudRunConfig(context);
-    byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
-  }
-  for (const [projectId, projectContexts] of byProject) {
-    const requiredServices = new Set(projectContexts.flatMap(context => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
-    try {
-      const enabled = await inspector.getEnabledServices(projectId);
-      const missing = [...requiredServices].filter(service => !enabled.has(service));
-      if (missing.length === 0) {
-        report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
-      } else {
-        report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
-      }
-    } catch (e) {
-      report.warn(`${projectId}: could not list enabled services (${e.message})`);
+    const cloudRunContexts = contexts.filter((context) => { var _a; return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "google-cloudrun"); });
+    if (cloudRunContexts.length === 0)
+        return;
+    report.section("google cloud run infrastructure");
+    const inspector = new GcloudProjectInspector_1.GcloudProjectInspector();
+    if (!(await inspector.isAuthenticated())) {
+        report.fail("gcloud is not authenticated — all google cloud checks skipped", "run: gcloud auth login");
+        return;
     }
-    const regions = new Set(projectContexts.map(context => getCloudRunConfig(context).region));
-    for (const region of regions) {
-      if (await inspector.hasArtifactsRegistry(projectId, region)) {
-        report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
-      } else {
-        report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
-      }
+    // project-level: enabled services + artifacts registry. The required
+    // services are the union over all components deploying to the project
+    // (cloudSql on any of them requires the sql services).
+    const byProject = new Map();
+    for (const context of cloudRunContexts) {
+        const { projectId } = getCloudRunConfig(context);
+        byProject.set(projectId, [...((_a = byProject.get(projectId)) !== null && _a !== void 0 ? _a : []), context]);
     }
-  }
-  // per component/env: deploy service account exists and carries every
-  // role the current config implies
-  const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async context => {
-    const config = getCloudRunConfig(context);
-    const {
-      fullIdentifier
-    } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
-      name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
-      projectId: config.projectId
-    });
-    if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
-      return {
-        context,
-        fullIdentifier,
-        exists: false,
-        missingRoles: []
-      };
+    for (const [projectId, projectContexts] of byProject) {
+        const requiredServices = new Set(projectContexts.flatMap((context) => (0, setupCloudRun_1.getCloudRunRequiredServices)(getCloudRunConfig(context))));
+        try {
+            const enabled = await inspector.getEnabledServices(projectId);
+            const missing = [...requiredServices].filter((service) => !enabled.has(service));
+            if (missing.length === 0) {
+                report.ok(`${projectId}: all ${requiredServices.size} required services enabled`);
+            }
+            else {
+                report.fail(`${projectId}: services not enabled: ${missing.join(", ")}`, "run: catladder project setup");
+            }
+        }
+        catch (e) {
+            report.warn(`${projectId}: could not list enabled services (${e.message})`);
+        }
+        const regions = new Set(projectContexts.map((context) => getCloudRunConfig(context).region));
+        for (const region of regions) {
+            if (await inspector.hasArtifactsRegistry(projectId, region)) {
+                report.ok(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' exists in ${region}`);
+            }
+            else {
+                report.fail(`${projectId}: artifacts registry '${artifactsRegistry_1.CATLADDER_REGISTRY_NAME}' missing in ${region}`, "run: catladder project setup");
+            }
+        }
     }
-    const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
-    const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter(role => !boundRoles.includes(role));
-    return {
-      context,
-      fullIdentifier,
-      exists: true,
-      missingRoles
-    };
-  });
-  for (const {
-    context,
-    fullIdentifier,
-    exists,
-    missingRoles
-  } of results) {
-    const label = `${context.env}:${context.name}`;
-    if (!exists) {
-      report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
-    } else if (missingRoles.length > 0) {
-      report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
-    } else {
-      report.ok(`${label}: service account exists with all config-implied roles`);
+    // per component/env: deploy service account exists and carries every
+    // role the current config implies
+    const results = await (0, concurrency_1.mapWithConcurrency)(cloudRunContexts, 5, async (context) => {
+        const config = getCloudRunConfig(context);
+        const { fullIdentifier } = (0, serviceAccountNames_1.getGcloudServiceAccountNames)(context, {
+            name: setupCloudRun_1.CLOUD_RUN_DEPLOY_SA_NAME,
+            projectId: config.projectId,
+        });
+        if (!(await (0, serviceAccounts_1.accountExists)(fullIdentifier))) {
+            return { context, fullIdentifier, exists: false, missingRoles: [] };
+        }
+        const boundRoles = await inspector.getRolesOfMember(config.projectId, `serviceAccount:${fullIdentifier}`);
+        const missingRoles = (0, setupCloudRun_1.getCloudRunDeployRoles)(config).filter((role) => !boundRoles.includes(role));
+        return { context, fullIdentifier, exists: true, missingRoles };
+    });
+    for (const { context, fullIdentifier, exists, missingRoles } of results) {
+        const label = `${context.env}:${context.name}`;
+        if (!exists) {
+            report.fail(`${label}: deploy service account ${fullIdentifier} does not exist`, `run: catladder project setup ${context.name}`);
+        }
+        else if (missingRoles.length > 0) {
+            report.fail(`${label}: service account is missing roles: ${missingRoles.join(", ")}`, `run: catladder project setup ${context.name}`);
+        }
+        else {
+            report.ok(`${label}: service account exists with all config-implied roles`);
+        }
     }
-  }
 };
-exports.checkCloudRun = checkCloudRun;
+exports.checkCloudRun = checkCloudRun;
+//# sourceMappingURL=checkCloudRun.js.map

package/dist/cli/src/apps/cli/commands/project/doctor/checkGithub.d.ts

@@ -7,4 +7,4 @@ import type { DoctorReport } from "./DoctorReport";
  * compared: github secrets are write-only by design (the vault stays
  * the source of truth).
  */
-export declare const checkGithub: (report: DoctorReport, config: Config) => Promise<void>;
+export declare const checkGithub: (report: DoctorReport, config: Config) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGithub.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkGithub = void 0;
 const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
 const commandSecretsSyncGithub_1 = require("../../../../../commands/project/commandSecretsSyncGithub");
@@ -18,83 +15,94 @@ const REPO_LEVEL = "";
  * the source of truth).
  */
 const checkGithub = async (report, config) => {
-  if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github")) return;
-  report.section("github environments & secrets");
-  if (!(await (0, github_1.isGhAuthenticated)())) {
-    report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
-    return;
-  }
-  const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-  if (!repo) {
-    report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
-    return;
-  }
-  let targets;
-  try {
-    targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
-  } catch (e) {
-    report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
-    return;
-  }
-  const referencedNamesOf = environment => [...targets.entries()].filter(([, envs]) => envs.has(environment)).map(([name]) => name);
-  const environmentsNeeded = [...new Set([...targets.values()].flatMap(envs => [...envs]))].filter(environment => environment !== REPO_LEVEL).sort();
-  let existingEnvironments;
-  try {
-    existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
-  } catch (e) {
-    report.warn(`could not list environments of ${repo} (${e.message})`);
-    return;
-  }
-  const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async environment => {
-    const referenced = referencedNamesOf(environment);
-    if (!existingEnvironments.has(environment)) {
-      return {
-        environment,
-        referenced,
-        exists: false
-      };
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github"))
+        return;
+    report.section("github environments & secrets");
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
+        return;
     }
-    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo, environment), (0, github_1.listGithubVariableNames)(repo, environment)]);
-    // github secret names are case-insensitive and the api returns
-    // them uppercased — compare accordingly
-    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
-    const referencedUpper = new Set(referenced.map(name => name.toUpperCase()));
-    return {
-      environment,
-      referenced,
-      exists: true,
-      missing: referenced.filter(name => !present.has(name.toUpperCase())),
-      stale: [...present].filter(name => !referencedUpper.has(name))
-    };
-  });
-  for (const result of perEnvironment) {
-    const {
-      environment,
-      referenced
-    } = result;
-    if (!result.exists) {
-      report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
-      continue;
+    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    if (!repo) {
+        report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
+        return;
     }
-    if (result.missing.length > 0) {
-      report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
-    } else {
-      report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+    let targets;
+    try {
+        targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
     }
-    if (result.stale.length > 0) {
-      report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+    catch (e) {
+        report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
+        return;
     }
-  }
-  const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
-  if (repoLevelReferenced.length > 0) {
-    const [secrets, variables] = await Promise.all([(0, github_1.listGithubSecretNames)(repo), (0, github_1.listGithubVariableNames)(repo)]);
-    const present = new Set([...secrets, ...variables].map(name => name.toUpperCase()));
-    const missing = repoLevelReferenced.filter(name => !present.has(name.toUpperCase()));
-    if (missing.length > 0) {
-      report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
-    } else {
-      report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+    const referencedNamesOf = (environment) => [...targets.entries()]
+        .filter(([, envs]) => envs.has(environment))
+        .map(([name]) => name);
+    const environmentsNeeded = [
+        ...new Set([...targets.values()].flatMap((envs) => [...envs])),
+    ]
+        .filter((environment) => environment !== REPO_LEVEL)
+        .sort();
+    let existingEnvironments;
+    try {
+        existingEnvironments = new Set(await (0, github_1.listGithubEnvironments)(repo));
+    }
+    catch (e) {
+        report.warn(`could not list environments of ${repo} (${e.message})`);
+        return;
+    }
+    const perEnvironment = await (0, concurrency_1.mapWithConcurrency)(environmentsNeeded, 8, async (environment) => {
+        const referenced = referencedNamesOf(environment);
+        if (!existingEnvironments.has(environment)) {
+            return { environment, referenced, exists: false };
+        }
+        const [secrets, variables] = await Promise.all([
+            (0, github_1.listGithubSecretNames)(repo, environment),
+            (0, github_1.listGithubVariableNames)(repo, environment),
+        ]);
+        // github secret names are case-insensitive and the api returns
+        // them uppercased — compare accordingly
+        const present = new Set([...secrets, ...variables].map((name) => name.toUpperCase()));
+        const referencedUpper = new Set(referenced.map((name) => name.toUpperCase()));
+        return {
+            environment,
+            referenced,
+            exists: true,
+            missing: referenced.filter((name) => !present.has(name.toUpperCase())),
+            stale: [...present].filter((name) => !referencedUpper.has(name)),
+        };
+    });
+    for (const result of perEnvironment) {
+        const { environment, referenced } = result;
+        if (!result.exists) {
+            report.fail(`environment '${environment}' does not exist (${referenced.length} referenced secrets have nowhere to live)`, "run: catladder project secrets-sync-github");
+            continue;
+        }
+        if (result.missing.length > 0) {
+            report.fail(`${environment}: missing ${result.missing.length}/${referenced.length} referenced secrets: ${result.missing.join(", ")}`, "run: catladder project secrets-sync-github");
+        }
+        else {
+            report.ok(`${environment}: all ${referenced.length} referenced secrets/variables present`);
+        }
+        if (result.stale.length > 0) {
+            report.warn(`${environment}: ${result.stale.length} set but not referenced by any workflow (stale?): ${result.stale.join(", ")}`);
+        }
+    }
+    const repoLevelReferenced = referencedNamesOf(REPO_LEVEL);
+    if (repoLevelReferenced.length > 0) {
+        const [secrets, variables] = await Promise.all([
+            (0, github_1.listGithubSecretNames)(repo),
+            (0, github_1.listGithubVariableNames)(repo),
+        ]);
+        const present = new Set([...secrets, ...variables].map((name) => name.toUpperCase()));
+        const missing = repoLevelReferenced.filter((name) => !present.has(name.toUpperCase()));
+        if (missing.length > 0) {
+            report.fail(`repo level: missing ${missing.length}/${repoLevelReferenced.length} referenced secrets: ${missing.join(", ")}`, "run: catladder project secrets-sync-github");
+        }
+        else {
+            report.ok(`repo level: all ${repoLevelReferenced.length} referenced secrets/variables present`);
+        }
     }
-  }
 };
-exports.checkGithub = checkGithub;
+exports.checkGithub = checkGithub;
+//# sourceMappingURL=checkGithub.js.map

package/dist/cli/src/apps/cli/commands/project/doctor/checkGitlab.d.ts

@@ -10,4 +10,4 @@ import type { DoctorReport } from "./DoctorReport";
  * require connecting kubectl to every cluster, which switches the local
  * kubeconfig context — doctor must not change anything.
  */
-export declare const checkGitlab: (instance: IO, report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;
+export declare const checkGitlab: (instance: IO, report: DoctorReport, contexts: ComponentContext[]) => Promise<void>;

package/dist/cli/src/apps/cli/commands/project/doctor/checkGitlab.js

@@ -1,8 +1,5 @@
 "use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
+Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkGitlab = void 0;
 const pipeline_1 = require("../../../../../../../pipeline/src/index.js");
 const date_fns_1 = require("date-fns");
@@ -18,62 +15,66 @@ const EXPIRY_WARNING_DAYS = 30;
  * kubeconfig context — doctor must not change anything.
  */
 const checkGitlab = async (instance, report, contexts) => {
-  report.section("gitlab project setup");
-  let projectId;
-  try {
-    projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
-  } catch (e) {
-    report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
-    return;
-  }
-  try {
-    const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
-    const activeTokens = tokens.filter(t => t.name === "semantic-release" && t.active === true);
-    // the GL_TOKEN ci variable holds exactly one of them — judge by the
-    // one that lives longest
-    const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
-    if (activeTokens.length > 1) {
-      report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+    report.section("gitlab project setup");
+    let projectId;
+    try {
+        projectId = (await (0, gitlab_1.getProjectInfo)(instance)).id;
     }
-    if (!token) {
-      report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
-    } else {
-      const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
-      if (daysLeft < 0) {
-        report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
-      } else if (daysLeft <= EXPIRY_WARNING_DAYS) {
-        report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
-      } else {
-        report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
-      }
+    catch (e) {
+        report.warn(`could not reach the gitlab api — gitlab checks skipped (${e.message})`);
+        return;
     }
     try {
-      await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
-      report.ok("GL_TOKEN ci variable present");
-    } catch (_a) {
-      report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
-    }
-    const {
-      topics
-    } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
-    if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
-      report.ok("'catladder' project topic set");
-    } else {
-      report.fail("'catladder' project topic missing", "run: catladder project setup");
+        const tokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/access_tokens`);
+        const activeTokens = tokens.filter((t) => t.name === "semantic-release" && t.active === true);
+        // the GL_TOKEN ci variable holds exactly one of them — judge by the
+        // one that lives longest
+        const token = activeTokens.sort((a, b) => String(b.expires_at).localeCompare(String(a.expires_at)))[0];
+        if (activeTokens.length > 1) {
+            report.warn(`${activeTokens.length} active 'semantic-release' tokens exist — duplicates from earlier setups, consider revoking the old ones`);
+        }
+        if (!token) {
+            report.fail("no active 'semantic-release' project access token", "run: catladder project setup");
+        }
+        else {
+            const daysLeft = (0, date_fns_1.differenceInCalendarDays)(new Date(token.expires_at), new Date());
+            if (daysLeft < 0) {
+                report.fail(`'semantic-release' token expired on ${token.expires_at}`, "run: catladder project setup (rotates the token)");
+            }
+            else if (daysLeft <= EXPIRY_WARNING_DAYS) {
+                report.warn(`'semantic-release' token expires in ${daysLeft} days (${token.expires_at})`, "run: catladder project setup (rotates the token)");
+            }
+            else {
+                report.ok(`'semantic-release' token active (expires ${token.expires_at})`);
+            }
+        }
+        try {
+            await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`);
+            report.ok("GL_TOKEN ci variable present");
+        }
+        catch (_a) {
+            report.fail("GL_TOKEN ci variable missing", "run: catladder project setup");
+        }
+        const { topics } = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}`);
+        if (topics === null || topics === void 0 ? void 0 : topics.includes("catladder")) {
+            report.ok("'catladder' project topic set");
+        }
+        else {
+            report.fail("'catladder' project topic missing", "run: catladder project setup");
+        }
+        if (contexts.some((context) => { var _a; return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes"); })) {
+            const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
+            if (deployTokens.find((t) => t.name === "gitlab-deploy-token")) {
+                report.ok("'gitlab-deploy-token' registry deploy token present");
+            }
+            else {
+                report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
+            }
+        }
     }
-    if (contexts.some(context => {
-      var _a;
-      return (0, pipeline_1.isOfDeployType)((_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config, "kubernetes");
-    })) {
-      const deployTokens = await (0, gitlab_1.doGitlabRequestAllPages)(instance, `projects/${projectId}/deploy_tokens`);
-      if (deployTokens.find(t => t.name === "gitlab-deploy-token")) {
-        report.ok("'gitlab-deploy-token' registry deploy token present");
-      } else {
-        report.fail("'gitlab-deploy-token' registry deploy token missing (kubernetes cannot pull images)", "run: catladder project setup");
-      }
+    catch (e) {
+        report.warn(`gitlab checks aborted (${e.message})`);
     }
-  } catch (e) {
-    report.warn(`gitlab checks aborted (${e.message})`);
-  }
 };
-exports.checkGitlab = checkGitlab;
+exports.checkGitlab = checkGitlab;
+//# sourceMappingURL=checkGitlab.js.map

package/dist/cli/src/apps/cli/commands/project/doctor/checkStore.d.ts

@@ -5,4 +5,4 @@ import type { DoctorReport } from "./DoctorReport";
  * (<service>-<projectNumber>.<region>.run.app) are computed from it at
  * generation time. This check is fully offline.
  */
-export declare const checkStore: (report: DoctorReport) => Promise<void>;
+export declare const checkStore: (report: DoctorReport) => Promise<void>;