@catladder/cli 5.0.1 → 5.1.0

package/dist/bundles/cli/index.js

@@ -616,7 +616,7 @@ exports.checkCloudRun = checkCloudRun;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.checkGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
+const secrets_1 = __nccwpck_require__(85200);
 const concurrency_1 = __nccwpck_require__(59723);
 const github_1 = __nccwpck_require__(41353);
 const githubMergeGating_1 = __nccwpck_require__(14966);
@@ -637,14 +637,14 @@ const checkGithub = async (report, config) => {
         report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
         return;
     }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
     if (!repo) {
         report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
         return;
     }
     let targets;
     try {
-        targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+        targets = await (0, secrets_1.collectSecretTargets)(config);
     }
     catch (e) {
         report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
@@ -1260,10 +1260,10 @@ const setupAccessTokens = async (instance) => {
         await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`, { value: newToken.token }, "PUT");
     }
     catch (e) {
-        if (e.message !== "not found") {
+        if (!(e instanceof gitlab_1.GitlabNotFoundError)) {
             throw e;
         }
-        // not found
+        // the variable does not exist yet: create it
         await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables`, {
             key: "GL_TOKEN",
             value: newToken.token,
@@ -1566,7 +1566,7 @@ const promises_1 = __nccwpck_require__(91943);
 const os_1 = __nccwpck_require__(70857);
 const path_1 = __nccwpck_require__(16928);
 const util_1 = __nccwpck_require__(39023);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
+const secrets_1 = __nccwpck_require__(85200);
 const github_1 = __nccwpck_require__(41353);
 const githubMergeGating_1 = __nccwpck_require__(14966);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -1600,7 +1600,7 @@ const setupGithub = async (instance, config) => {
         instance.log("⚠️ github cli (gh) not authenticated — skipping github merge-gating setup (run: gh auth login)");
         return;
     }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
     if (!repo) {
         instance.log(`⚠️ no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — skipping github merge-gating setup`);
         return;
@@ -1770,15 +1770,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupKubernetes = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
 const child_process_promise_1 = __nccwpck_require__(11542);
+const secrets_1 = __nccwpck_require__(85200);
 const cluster_1 = __nccwpck_require__(8034);
 const gitlab_1 = __nccwpck_require__(17697);
 const ensureNamespace_1 = __importDefault(__nccwpck_require__(308));
-const setupKubernetes = async (instance, context) => {
-    var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("cannot run setupKubernetes on non-kubernetes deployments");
+/**
+ * the cluster pulls the images from the gitlab container registry, and
+ * a deploy token is how it authenticates there. Nothing to do when the
+ * project has no gitlab pipeline (the images live elsewhere then).
+ */
+const ensureGitlabDeployToken = async (instance, config) => {
+    if (!config || !(0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        return;
     }
     const { id: projectId } = await (0, gitlab_1.getProjectInfo)(instance);
     const deploy_tokens = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/deploy_tokens`);
@@ -1790,6 +1795,14 @@ const setupKubernetes = async (instance, context) => {
             scopes: ["read_registry"],
         }, "POST");
     }
+};
+const setupKubernetes = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("cannot run setupKubernetes on non-kubernetes deployments");
+    }
+    await ensureGitlabDeployToken(instance, await (0, getProjectConfig_1.getProjectConfig)());
     const fullName = (0, pipeline_1.getFullKubernetesClusterName)(deployConfig.cluster);
     instance.log(`cluster: ${fullName}`);
     await (0, cluster_1.connectToCluster)(fullName);
@@ -1872,8 +1885,11 @@ EOF
     }
     instance.log("service accounts created / updated!");
     instance.log("");
-    instance.log("pusing secrets to gitlab...");
-    await (0, gitlab_1.upsertAllVariables)(instance, vars, context.env, context.name, false);
+    instance.log("storing the cluster credentials...");
+    await (0, secrets_1.writeSecretsAndMirror)(instance, [{ env: context.env, componentName: context.name, secrets: vars }], 
+    // the service account token is recreated on every run — the
+    // previous one is worth nothing
+    { backup: false });
     instance.log("done!");
 };
 exports.setupKubernetes = setupKubernetes;
@@ -2719,7 +2735,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandMrUnpin = exports.commandMrPin = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(78034);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({ enumerable: true, get: function () { return commandKubeCurrentContext_1.commandKubeCurrentContext; } }));
@@ -2779,6 +2795,9 @@ var commandProjectRestoreDb_1 = __nccwpck_require__(69233);
 Object.defineProperty(exports, "commandProjectRestoreDb", ({ enumerable: true, get: function () { return commandProjectRestoreDb_1.commandProjectRestoreDb; } }));
 var commandSecurityEvaluate_1 = __nccwpck_require__(86851);
 Object.defineProperty(exports, "commandSecurityEvaluate", ({ enumerable: true, get: function () { return commandSecurityEvaluate_1.commandSecurityEvaluate; } }));
+var commandMrPin_1 = __nccwpck_require__(31318);
+Object.defineProperty(exports, "commandMrPin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrPin; } }));
+Object.defineProperty(exports, "commandMrUnpin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrUnpin; } }));
 // Project k8s commands
 var commandNamespace_1 = __nccwpck_require__(25918);
 Object.defineProperty(exports, "commandNamespace", ({ enumerable: true, get: function () { return commandNamespace_1.commandNamespace; } }));
@@ -3175,6 +3194,7 @@ const common_tags_1 = __nccwpck_require__(110);
 const defineCommand_1 = __nccwpck_require__(19096);
 const editAsFile_1 = __nccwpck_require__(3072);
 const promise_1 = __nccwpck_require__(23161);
+const secrets_1 = __nccwpck_require__(85200);
 const document_1 = __nccwpck_require__(96716);
 const scope_1 = __nccwpck_require__(8513);
 const parseKeysInput_1 = __nccwpck_require__(93560);
@@ -3237,7 +3257,7 @@ exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
             ctx.log("⏭️ these secrets are still unset and will not be written:");
             skipped.forEach((entry) => ctx.log(`  - ${entry}`));
         }
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
         ctx.log("");
     },
@@ -3442,6 +3462,132 @@ exports.commandCiJobLog = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 31318:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandMrUnpin = exports.commandMrPin = void 0;
+const child_process_promise_1 = __nccwpck_require__(11542);
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const defineCommand_1 = __nccwpck_require__(19096);
+const gitlab_1 = __nccwpck_require__(17697);
+const PIN_LABEL_COLOR = "#428fdc";
+/**
+ * the configured pin label — errors when the project cannot pin
+ * (github-only, or pinning disabled)
+ */
+const getPinLabel = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        throw new Error("pinning review apps needs the gitlab pipeline — github has no auto-stop, review apps live until the pull request is closed");
+    }
+    const { pinLabel } = (0, pipeline_1.getAutoStopConfig)(config);
+    if (pinLabel === false) {
+        throw new Error("review-app pinning is disabled in this project (autoStop.pinLabel: false)");
+    }
+    return pinLabel;
+};
+const findMr = async (io, projectId, mrIid) => {
+    if (mrIid) {
+        return (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/merge_requests/${mrIid}`);
+    }
+    const branch = (await (0, child_process_promise_1.exec)("git rev-parse --abbrev-ref HEAD")).stdout.trim();
+    const mrs = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/merge_requests?state=opened&source_branch=${encodeURIComponent(branch)}`);
+    if (!(mrs === null || mrs === void 0 ? void 0 : mrs.length)) {
+        throw new Error(`no open merge request found for branch '${branch}' — pass one with --mr <iid>`);
+    }
+    return mrs[0];
+};
+const ensurePinLabelExists = async (io, projectId, pinLabel) => {
+    const existing = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels?search=${encodeURIComponent(pinLabel)}`);
+    if (existing === null || existing === void 0 ? void 0 : existing.some((label) => label.name === pinLabel)) {
+        return;
+    }
+    await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels`, {
+        name: pinLabel,
+        color: PIN_LABEL_COLOR,
+        description: "review apps of this MR are pinned — deploys use auto_stop_in: never (managed by catladder)",
+    }, "POST");
+    io.log(`created the '${pinLabel}' label in the project`);
+};
+exports.commandMrPin = (0, defineCommand_1.defineCommand)({
+    name: "mr pin",
+    description: "pin the review apps of a merge request (disable their auto-stop) by adding the pin label; merging or closing the MR still stops them",
+    group: "mr",
+    inputs: {
+        mr: {
+            type: "number",
+            message: "merge request IID (defaults to the open MR of the current branch)",
+            positional: true,
+            required: false,
+        },
+        pipeline: {
+            type: "boolean",
+            message: "trigger a merge-request pipeline so the pin takes effect immediately",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        var _a, _b;
+        const pinLabel = await getPinLabel();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
+        await ensurePinLabelExists(ctx, projectId, pinLabel);
+        if ((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel)) {
+            ctx.log(`already pinned: mr!${mr.iid} carries the '${pinLabel}' label`);
+        }
+        else {
+            await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, { add_labels: pinLabel }, "PUT");
+            ctx.log(`📌 pinned mr!${mr.iid} "${mr.title}" — label '${pinLabel}' added`);
+        }
+        // the label only affects pipelines created after it was set, so
+        // trigger one — otherwise the currently deployed review apps keep
+        // their old auto-stop timer until the next push
+        if ((_b = (await ctx.get("pipeline"))) !== null && _b !== void 0 ? _b : true) {
+            const pipeline = await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}/pipelines`, {}, "POST");
+            ctx.log(`🚀 triggered a pipeline so the pin takes effect now: ${pipeline.web_url}`);
+        }
+        else {
+            ctx.log("the pin takes effect with the next pipeline of the MR");
+        }
+    },
+});
+exports.commandMrUnpin = (0, defineCommand_1.defineCommand)({
+    name: "mr unpin",
+    description: "unpin the review apps of a merge request — the auto-stop timer re-arms with the next deploy",
+    group: "mr",
+    inputs: {
+        mr: {
+            type: "number",
+            message: "merge request IID (defaults to the open MR of the current branch)",
+            positional: true,
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        var _a;
+        const pinLabel = await getPinLabel();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
+        if (!((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel))) {
+            ctx.log(`mr!${mr.iid} is not pinned (no '${pinLabel}' label)`);
+            return;
+        }
+        await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, { remove_labels: pinLabel }, "PUT");
+        ctx.log(`unpinned mr!${mr.iid} — label '${pinLabel}' removed`);
+        ctx.log("the deployed review apps stay pinned until the next deploy re-arms their auto-stop timer");
+    },
+});
+//# sourceMappingURL=commandMrPin.js.map
+
+/***/ }),
+
 /***/ 30119:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -3874,131 +4020,12 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+exports.commandSecretsSyncGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const getProjectConfig_1 = __nccwpck_require__(70478);
 const defineCommand_1 = __nccwpck_require__(19096);
+const secrets_1 = __nccwpck_require__(85200);
 const github_1 = __nccwpck_require__(41353);
-/**
- * all secrets declared in the config, with their values read from the
- * vault (github secrets are write-only and can never act as a source)
- */
-const collectSecretsFromVault = async (io, envFilter) => {
-    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-    const kinds = new Map();
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-        for (const env of envs) {
-            if (envFilter && !envFilter.includes(env)) {
-                continue;
-            }
-            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-            const keys = [
-                ...secretEnvVarKeys,
-                ...jobOnlyVars.build.secretEnvVarKeys,
-                ...jobOnlyVars.deploy.secretEnvVarKeys,
-            ];
-            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-        }
-    }
-    const names = [...kinds.keys()];
-    const values = await (await io.getVaultManager()).readSecrets(names, io);
-    const secrets = names
-        .filter((name) => values[name] !== undefined)
-        .map((name) => {
-        var _a;
-        return ({
-            name,
-            value: values[name],
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        });
-    });
-    const missing = names.filter((name) => values[name] === undefined);
-    return { secrets, missing };
-};
-exports.collectSecretsFromVault = collectSecretsFromVault;
-/** marker for repo-level (environment-less) targets */
-const REPO_LEVEL = "";
-/**
- * derives which github environment(s) each secret/variable must live in
- * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
- * vars.X }}` reference in a job's env targets that job's environment
- * (or the repo level when the job has none). Deriving from the real
- * output means the sync can never drift from what the workflows expect.
- *
- * Environment secrets are the answer to github's cap of 100 secrets
- * per REPO (a multi-env project easily exceeds it): the cap applies
- * per environment instead.
- */
-const collectSecretTargets = async (config) => {
-    var _a;
-    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
-    const targets = new Map();
-    for (const workflow of Object.values(workflows)) {
-        for (const job of Object.values(workflow.jobs)) {
-            const environment = typeof job.environment === "object"
-                ? job.environment.name
-                : job.environment;
-            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
-                if (typeof value !== "string")
-                    continue;
-                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
-                    const name = match[1];
-                    if (!targets.has(name)) {
-                        targets.set(name, new Set());
-                    }
-                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
-                }
-            }
-        }
-    }
-    return targets;
-};
-exports.collectSecretTargets = collectSecretTargets;
-/**
- * pushes vault values to github via the gh cli: sensitive ones as
- * secrets (masked), "variable"-kind ones as variables (plain) — each
- * into the environment(s) whose jobs reference them
- */
-const pushSecretsToGithub = async (io, repo, secrets, targets) => {
-    const environments = [
-        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
-    ];
-    for (const environment of environments) {
-        await (0, github_1.ensureGithubEnvironment)(repo, environment);
-        io.log(`🌍 environment ${environment}`);
-    }
-    for (const { name, value, kind } of secrets) {
-        const envs = targets.get(name);
-        if (!envs) {
-            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
-            continue;
-        }
-        for (const environment of envs) {
-            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
-            if (kind === "variable") {
-                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
-                io.log(`📖 ${name} (variable)${suffix}`);
-            }
-            else {
-                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
-                io.log(`✅ ${name}${suffix}`);
-            }
-        }
-    }
-};
-exports.pushSecretsToGithub = pushSecretsToGithub;
-/**
- * resolves the github repository from the configured git remote
- * (`pipelines.github.gitRemote`, defaults to origin)
- */
-const getConfiguredGithubRepo = async () => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        return undefined;
-    }
-    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
-};
-exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
 /**
  * copies the catladder secrets from the vault to github actions
  * repository secrets, keeping the exact same names, so the github
@@ -4035,12 +4062,12 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!(await (0, github_1.isGhAuthenticated)())) {
             throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
         }
-        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, exports.getConfiguredGithubRepo)());
+        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, secrets_1.getConfiguredGithubRepo)());
         if (!repo) {
             throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
         }
         const envFilter = (_b = (await ctx.get("env"))) === null || _b === void 0 ? void 0 : _b.split(",").map((e) => e.trim());
-        const { secrets, missing } = await (0, exports.collectSecretsFromVault)(ctx, envFilter);
+        const { secrets, missing } = await (0, secrets_1.collectSecretsFromVault)(ctx, envFilter);
         if (missing.length > 0) {
             ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
             missing.forEach((name) => ctx.log(`  - ${name}`));
@@ -4057,7 +4084,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
+        await (0, secrets_1.pushSecretsToGithub)(ctx, repo, secrets, await (0, secrets_1.collectSecretTargets)(config));
         ctx.log("");
         ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
     },
@@ -4621,6 +4648,7 @@ const fs_extra_1 = __nccwpck_require__(20925);
 const yaml_1 = __nccwpck_require__(99292);
 const defineCommand_1 = __nccwpck_require__(19096);
 const readStdin_1 = __nccwpck_require__(89973);
+const secrets_1 = __nccwpck_require__(85200);
 const document_1 = __nccwpck_require__(96716);
 const scope_1 = __nccwpck_require__(8513);
 const parseKeysInput_1 = __nccwpck_require__(93560);
@@ -4683,7 +4711,7 @@ exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });
@@ -4701,7 +4729,7 @@ exports.commandSecretsSet = void 0;
 const fs_extra_1 = __nccwpck_require__(20925);
 const defineCommand_1 = __nccwpck_require__(19096);
 const readStdin_1 = __nccwpck_require__(89973);
-const document_1 = __nccwpck_require__(96716);
+const secrets_1 = __nccwpck_require__(85200);
 const scope_1 = __nccwpck_require__(8513);
 const resolveValue = async (io, value, valueFile) => {
     if (valueFile) {
@@ -4772,7 +4800,7 @@ exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
             componentName,
             secrets: { [key]: value },
         }));
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });
@@ -4786,12 +4814,8 @@ exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
-const getProjectConfig_1 = __nccwpck_require__(70478);
-const github_1 = __nccwpck_require__(41353);
-const gitlab_1 = __nccwpck_require__(17697);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 /** placeholder for secrets that have no value in the vault yet */
 exports.FILL_ME = "🚨 FILL ME";
 /* for convenience, parse json values. that makes it easier to edit secrets that are objects */
@@ -4889,123 +4913,49 @@ const collectSecretsWrites = (document, scoped) => {
     return { writes, skipped };
 };
 exports.collectSecretsWrites = collectSecretsWrites;
+//# sourceMappingURL=document.js.map
+
+/***/ }),
+
+/***/ 93560:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.parseKeysInput = void 0;
+/** parses a comma-separated `--key` input into a list of keys */
+const parseKeysInput = (input) => {
+    const keys = input === null || input === void 0 ? void 0 : input.split(",").map((key) => key.trim()).filter(Boolean);
+    return keys && keys.length > 0 ? keys : undefined;
+};
+exports.parseKeysInput = parseKeysInput;
+//# sourceMappingURL=parseKeysInput.js.map
+
+/***/ }),
+
+/***/ 8513:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.formatScope = exports.getScopedSecretKeys = exports.getDeclaredSecretKeys = exports.secretsScopeChoices = exports.resolveSecretsScope = void 0;
+const getProjectConfig_1 = __nccwpck_require__(70478);
 /**
- * writes secrets to the vault (the source of truth) and mirrors them
- * to every enabled CI backend — which backends exist is invisible to
- * the caller
+ * resolves a scope expression to component → envs:
+ * - (empty): all components, all envs
+ * - `env:component`: one env of one component
+ * - `env` / `env:`: one env, every component that has it
+ * - `:component`: every env of one component
  */
-const writeSecretsAndMirror = async (io, writes) => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
+const resolveSecretsScope = async (scope) => {
+    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    if (Object.keys(all).length === 0) {
         throw new Error("no catladder config found");
     }
-    io.log("");
-    io.log("writing secrets to the vault, please wait...");
-    io.log("");
-    for (const { env, componentName, secrets } of writes) {
-        io.log("writing " + env + ":" + componentName + "...\n");
-        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
-        io.log("");
-        io.log("✅ " + env + ":" + componentName);
-        io.log("--------------------------------\n");
-    }
-    await mirrorSecretsToCiBackends(io, config, writes);
-};
-exports.writeSecretsAndMirror = writeSecretsAndMirror;
-/**
- * the vault is the source of truth; every enabled CI backend receives
- * a mirrored copy of the written secrets (gitlab variables, github
- * secrets), so all CI systems stay in sync
- */
-const mirrorSecretsToCiBackends = async (io, config, writes) => {
-    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
-    // gitlab mirror (unless gitlab is the vault itself, then it is
-    // already written)
-    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
-        for (const { env, componentName, secrets } of writes) {
-            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
-        }
-        io.log("✅ mirrored to gitlab");
-    }
-    if (!enabled.includes("github")) {
-        return;
-    }
-    const kinds = new Map();
-    for (const { env, componentName } of writes) {
-        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-        [
-            ...secretEnvVarKeys,
-            ...jobOnlyVars.build.secretEnvVarKeys,
-            ...jobOnlyVars.deploy.secretEnvVarKeys,
-        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-    }
-    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
-        var _a;
-        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
-        return {
-            name,
-            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        };
-    }));
-    if (secrets.length === 0) {
-        return;
-    }
-    if (!(await (0, github_1.isGhAuthenticated)())) {
-        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-    if (!repo) {
-        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
-};
-//# sourceMappingURL=document.js.map
-
-/***/ }),
-
-/***/ 93560:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.parseKeysInput = void 0;
-/** parses a comma-separated `--key` input into a list of keys */
-const parseKeysInput = (input) => {
-    const keys = input === null || input === void 0 ? void 0 : input.split(",").map((key) => key.trim()).filter(Boolean);
-    return keys && keys.length > 0 ? keys : undefined;
-};
-exports.parseKeysInput = parseKeysInput;
-//# sourceMappingURL=parseKeysInput.js.map
-
-/***/ }),
-
-/***/ 8513:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.formatScope = exports.getScopedSecretKeys = exports.getDeclaredSecretKeys = exports.secretsScopeChoices = exports.resolveSecretsScope = void 0;
-const getProjectConfig_1 = __nccwpck_require__(70478);
-/**
- * resolves a scope expression to component → envs:
- * - (empty): all components, all envs
- * - `env:component`: one env of one component
- * - `env` / `env:`: one env, every component that has it
- * - `:component`: every env of one component
- */
-const resolveSecretsScope = async (scope) => {
-    const all = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-    if (Object.keys(all).length === 0) {
-        throw new Error("no catladder config found");
-    }
-    if (!scope) {
-        return all;
+    if (!scope) {
+        return all;
     }
     const [env, componentName] = scope.split(":").map((x) => x || null);
     if (componentName && !(componentName in all)) {
@@ -6060,7 +6010,7 @@ const hash = (str, length) => {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
 const child_process_promise_1 = __nccwpck_require__(11542);
-const gitlab_1 = __nccwpck_require__(17697);
+const secrets_1 = __nccwpck_require__(85200);
 const serviceAccountNames_1 = __nccwpck_require__(67851);
 const accountExists = async (fullIdentifier) => {
     try {
@@ -6097,9 +6047,20 @@ const upsertGcloudServiceAccount = async (context, account) => {
 const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, account, secretName) => {
     instance.log("upserting service account " + account.name + "...");
     const key = await upsertGcloudServiceAccount(context, account);
-    await (0, gitlab_1.upsertAllVariables)(instance, {
-        [secretName]: key,
-    }, context.env, context.name);
+    // through the vault (and from there to every enabled ci backend) —
+    // the key is a secret like any other, the deploy jobs read it under
+    // its declared name. Writing it to gitlab directly would break every
+    // project that has no gitlab.
+    await (0, secrets_1.writeSecretsAndMirror)(instance, [
+        {
+            env: context.env,
+            componentName: context.name,
+            secrets: { [secretName]: key },
+        },
+    ], 
+    // a fresh key is created on every run, the previous one is deleted
+    // at google — a backup copy of it would only be a dead secret
+    { backup: false });
     instance.log("done!");
 };
 exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;
@@ -6176,23 +6137,338 @@ const getGitRemoteHostAndPath = async (remoteName = "origin") => {
     if (!(gitRemoteHost === null || gitRemoteHost === void 0 ? void 0 : gitRemoteHost.length) || !(gitRemotePath === null || gitRemotePath === void 0 ? void 0 : gitRemotePath.length)) {
         throw new Error(`Failed to parse git remote hostname and path from git configs remote.${remoteName}.url! ${remoteUrl}`);
     }
-    return { gitRemoteHost, gitRemotePath };
-};
-exports.getGitRemoteHostAndPath = getGitRemoteHostAndPath;
-const gitProjectInformation = async () => {
-    const [{ gitRemoteHost, gitRemotePath }, projectRootPath] = await Promise.all([(0, exports.getGitRemoteHostAndPath)(), (0, exports.getProjectRootPath)()]);
-    return {
-        gitRemoteHost,
-        gitRemotePath,
-        projectRootPath,
-    };
+    return { gitRemoteHost, gitRemotePath };
+};
+exports.getGitRemoteHostAndPath = getGitRemoteHostAndPath;
+const gitProjectInformation = async () => {
+    const [{ gitRemoteHost, gitRemotePath }, projectRootPath] = await Promise.all([(0, exports.getGitRemoteHostAndPath)(), (0, exports.getProjectRootPath)()]);
+    return {
+        gitRemoteHost,
+        gitRemotePath,
+        projectRootPath,
+    };
+};
+exports.gitProjectInformation = gitProjectInformation;
+//# sourceMappingURL=gitProjectInformation.js.map
+
+/***/ }),
+
+/***/ 77721:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+__exportStar(__nccwpck_require__(40403), exports);
+__exportStar(__nccwpck_require__(86884), exports);
+__exportStar(__nccwpck_require__(3328), exports);
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 32839:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getk8sApiBatchBeta = exports.getk8sApiBatch = exports.getk8sApi = void 0;
+const client_node_1 = __nccwpck_require__(67235);
+const getKubeConfig = () => {
+    const kc = new client_node_1.KubeConfig();
+    kc.loadFromDefault();
+    return kc;
+};
+/**
+ * get kubernetes client. avoid reusing the instance when context get changed
+ * @returns kuberenetes client
+ */
+const getk8sApi = () => {
+    const kc = getKubeConfig();
+    return kc.makeApiClient(client_node_1.CoreV1Api);
+};
+exports.getk8sApi = getk8sApi;
+const getk8sApiBatch = () => {
+    const kc = getKubeConfig();
+    return kc.makeApiClient(client_node_1.BatchV1Api);
+};
+exports.getk8sApiBatch = getk8sApiBatch;
+const getk8sApiBatchBeta = () => {
+    const kc = getKubeConfig();
+    return kc.makeApiClient(client_node_1.BatchV1beta1Api);
+};
+exports.getk8sApiBatchBeta = getk8sApiBatchBeta;
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 79107:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getProjectPodNames = exports.getProjectPvcs = exports.getProjectPods = void 0;
+const parseChoice_1 = __nccwpck_require__(70769);
+const k8sApi_1 = __nccwpck_require__(32839);
+const projects_1 = __nccwpck_require__(20575);
+const getProjectPods = async (envComponent) => {
+    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
+    const k8sApi = (0, k8sApi_1.getk8sApi)();
+    const res = await k8sApi.listNamespacedPod(namespace);
+    const { componentName } = (0, parseChoice_1.parseChoice)(envComponent);
+    return res.body.items.filter((item) => { var _a, _b; return componentName ? (_b = (_a = item.metadata) === null || _a === void 0 ? void 0 : _a.name) === null || _b === void 0 ? void 0 : _b.includes(componentName + "-") : true; });
+};
+exports.getProjectPods = getProjectPods;
+const getProjectPvcs = async (envComponent) => {
+    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
+    const k8sApi = (0, k8sApi_1.getk8sApi)();
+    const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
+    return res.body.items;
+};
+exports.getProjectPvcs = getProjectPvcs;
+const getProjectPodNames = async (envComponent) => {
+    const pods = await (0, exports.getProjectPods)(envComponent);
+    return pods.map((n) => n.metadata.name);
+};
+exports.getProjectPodNames = getProjectPodNames;
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 14178:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.openGoogleCloudKubernetesDashboard = exports.openGoogleCloudLogs = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const openDashboard_1 = __nccwpck_require__(74241);
+const openGoogleCloudLogs = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const resource = `k8s_container/cluster_name/${cluster.name}${namespace ? `/namespace_name/${namespace}` : ""}`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "logs/viewer", {
+        project: cluster.projectId,
+        resource: resource,
+    });
+};
+exports.openGoogleCloudLogs = openGoogleCloudLogs;
+const openGoogleCloudKubernetesDashboard = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "kubernetes/workload", {
+        project: cluster.projectId,
+        pageState: pageState,
+    });
+};
+exports.openGoogleCloudKubernetesDashboard = openGoogleCloudKubernetesDashboard;
+//# sourceMappingURL=openKubernetesDashboards.js.map
+
+/***/ }),
+
+/***/ 76775:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.startKubePortForward = void 0;
+const portForwards_1 = __nccwpck_require__(5368);
+const startKubePortForward = async (podname, localPort, remotePort, namespace) => {
+    const name = `kube/${namespace}/${podname}/${localPort}:${remotePort}`;
+    await (0, portForwards_1.startPortForwardCommand)(name, `kubectl port-forward ${podname} ${localPort}:${remotePort} -n ${namespace}`);
+};
+exports.startKubePortForward = startKubePortForward;
+//# sourceMappingURL=portForward.js.map
+
+/***/ }),
+
+/***/ 55689:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+// we can't import the package.json directly, because the bundling process will inline it
+// but the version is only set during deployement, when its already bundled
+// instead we need to use require.main.path to get the path of the main module, which is actually the file in the bin
+// this will point to the root package.json
+var _a;
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+const path = ((_a = require.main) === null || _a === void 0 ? void 0 : _a.path) + "/../package.json";
+const ownPkg = require(path);
+exports["default"] = ownPkg;
+//# sourceMappingURL=packageInfos.js.map
+
+/***/ }),
+
+/***/ 97245:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const github_1 = __nccwpck_require__(41353);
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async (io, envFilter) => {
+    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    const kinds = new Map();
+    for (const [componentName, envs] of Object.entries(envAndComponents)) {
+        for (const env of envs) {
+            if (envFilter && !envFilter.includes(env)) {
+                continue;
+            }
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+            const keys = [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ];
+            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+        }
+    }
+    const names = [...kinds.keys()];
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const secrets = names
+        .filter((name) => values[name] !== undefined)
+        .map((name) => {
+        var _a;
+        return ({
+            name,
+            value: values[name],
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        });
+    });
+    const missing = names.filter((name) => values[name] === undefined);
+    return { secrets, missing };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/** marker for repo-level (environment-less) targets */
+const REPO_LEVEL = "";
+/**
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+const collectSecretTargets = async (config) => {
+    var _a;
+    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
+    const targets = new Map();
+    for (const workflow of Object.values(workflows)) {
+        for (const job of Object.values(workflow.jobs)) {
+            const environment = typeof job.environment === "object"
+                ? job.environment.name
+                : job.environment;
+            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
+                if (typeof value !== "string")
+                    continue;
+                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
+                    const name = match[1];
+                    if (!targets.has(name)) {
+                        targets.set(name, new Set());
+                    }
+                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
+                }
+            }
+        }
+    }
+    return targets;
+};
+exports.collectSecretTargets = collectSecretTargets;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
+ */
+const pushSecretsToGithub = async (io, repo, secrets, targets) => {
+    const environments = [
+        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
+    ];
+    for (const environment of environments) {
+        await (0, github_1.ensureGithubEnvironment)(repo, environment);
+        io.log(`🌍 environment ${environment}`);
+    }
+    for (const { name, value, kind } of secrets) {
+        const envs = targets.get(name);
+        if (!envs) {
+            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
+            continue;
+        }
+        for (const environment of envs) {
+            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
+            if (kind === "variable") {
+                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
+                io.log(`📖 ${name} (variable)${suffix}`);
+            }
+            else {
+                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
+                io.log(`✅ ${name}${suffix}`);
+            }
+        }
+    }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        return undefined;
+    }
+    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
 };
-exports.gitProjectInformation = gitProjectInformation;
-//# sourceMappingURL=gitProjectInformation.js.map
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+//# sourceMappingURL=github.js.map
 
 /***/ }),
 
-/***/ 77721:
+/***/ 85200:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
 "use strict";
@@ -6212,164 +6488,104 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-__exportStar(__nccwpck_require__(40403), exports);
-__exportStar(__nccwpck_require__(86884), exports);
-__exportStar(__nccwpck_require__(3328), exports);
+__exportStar(__nccwpck_require__(97245), exports);
+__exportStar(__nccwpck_require__(31298), exports);
 //# sourceMappingURL=index.js.map
 
 /***/ }),
 
-/***/ 32839:
+/***/ 31298:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getk8sApiBatchBeta = exports.getk8sApiBatch = exports.getk8sApi = void 0;
-const client_node_1 = __nccwpck_require__(67235);
-const getKubeConfig = () => {
-    const kc = new client_node_1.KubeConfig();
-    kc.loadFromDefault();
-    return kc;
-};
+exports.writeSecretsAndMirror = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const github_1 = __nccwpck_require__(41353);
+const gitlab_1 = __nccwpck_require__(17697);
+const github_2 = __nccwpck_require__(97245);
 /**
- * get kubernetes client. avoid reusing the instance when context get changed
- * @returns kuberenetes client
+ * the one door for writing secret values: they go into the vault (the
+ * source of truth) and are mirrored to every enabled CI backend —
+ * which vault and which backends exist is invisible to the caller.
+ *
+ * Everything that produces a secret value must come through here: the
+ * secrets commands, but also the credentials `project setup`
+ * provisions (gcloud service account keys, kubernetes tokens).
  */
-const getk8sApi = () => {
-    const kc = getKubeConfig();
-    return kc.makeApiClient(client_node_1.CoreV1Api);
-};
-exports.getk8sApi = getk8sApi;
-const getk8sApiBatch = () => {
-    const kc = getKubeConfig();
-    return kc.makeApiClient(client_node_1.BatchV1Api);
-};
-exports.getk8sApiBatch = getk8sApiBatch;
-const getk8sApiBatchBeta = () => {
-    const kc = getKubeConfig();
-    return kc.makeApiClient(client_node_1.BatchV1beta1Api);
-};
-exports.getk8sApiBatchBeta = getk8sApiBatchBeta;
-//# sourceMappingURL=index.js.map
-
-/***/ }),
-
-/***/ 79107:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getProjectPodNames = exports.getProjectPvcs = exports.getProjectPods = void 0;
-const parseChoice_1 = __nccwpck_require__(70769);
-const k8sApi_1 = __nccwpck_require__(32839);
-const projects_1 = __nccwpck_require__(20575);
-const getProjectPods = async (envComponent) => {
-    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
-    const k8sApi = (0, k8sApi_1.getk8sApi)();
-    const res = await k8sApi.listNamespacedPod(namespace);
-    const { componentName } = (0, parseChoice_1.parseChoice)(envComponent);
-    return res.body.items.filter((item) => { var _a, _b; return componentName ? (_b = (_a = item.metadata) === null || _a === void 0 ? void 0 : _a.name) === null || _b === void 0 ? void 0 : _b.includes(componentName + "-") : true; });
-};
-exports.getProjectPods = getProjectPods;
-const getProjectPvcs = async (envComponent) => {
-    const namespace = await (0, projects_1.getProjectNamespace)(envComponent);
-    const k8sApi = (0, k8sApi_1.getk8sApi)();
-    const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
-    return res.body.items;
-};
-exports.getProjectPvcs = getProjectPvcs;
-const getProjectPodNames = async (envComponent) => {
-    const pods = await (0, exports.getProjectPods)(envComponent);
-    return pods.map((n) => n.metadata.name);
-};
-exports.getProjectPodNames = getProjectPodNames;
-//# sourceMappingURL=index.js.map
-
-/***/ }),
-
-/***/ 14178:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.openGoogleCloudKubernetesDashboard = exports.openGoogleCloudLogs = void 0;
-const pipeline_1 = __nccwpck_require__(53695);
-const openDashboard_1 = __nccwpck_require__(74241);
-const openGoogleCloudLogs = async (instance, context) => {
-    var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("context is not of type kubernetes");
+const writeSecretsAndMirror = async (io, writes, options = {}) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
     }
-    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
-        throw new Error("no gcloud custer configured");
+    io.log("");
+    io.log("writing secrets to the vault, please wait...");
+    io.log("");
+    for (const { env, componentName, secrets } of writes) {
+        io.log("writing " + env + ":" + componentName + "...\n");
+        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets, io, options);
+        io.log("");
+        io.log("✅ " + env + ":" + componentName);
+        io.log("--------------------------------\n");
     }
-    const namespace = context.environment.envVars.KUBE_NAMESPACE;
-    const cluster = deployConfig.cluster;
-    const resource = `k8s_container/cluster_name/${cluster.name}${namespace ? `/namespace_name/${namespace}` : ""}`;
-    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "logs/viewer", {
-        project: cluster.projectId,
-        resource: resource,
-    });
+    await mirrorSecretsToCiBackends(io, config, writes, options);
 };
-exports.openGoogleCloudLogs = openGoogleCloudLogs;
-const openGoogleCloudKubernetesDashboard = async (instance, context) => {
+exports.writeSecretsAndMirror = writeSecretsAndMirror;
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (io, config, writes, options) => {
     var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("context is not of type kubernetes");
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    // gitlab mirror (unless gitlab is the vault itself, then it is
+    // already written)
+    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+        for (const { env, componentName, secrets } of writes) {
+            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName, (_a = options.backup) !== null && _a !== void 0 ? _a : true);
+        }
+        io.log("✅ mirrored to gitlab");
     }
-    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
-        throw new Error("no gcloud custer configured");
+    if (!enabled.includes("github")) {
+        return;
     }
-    const namespace = context.environment.envVars.KUBE_NAMESPACE;
-    const cluster = deployConfig.cluster;
-    const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
-    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "kubernetes/workload", {
-        project: cluster.projectId,
-        pageState: pageState,
-    });
-};
-exports.openGoogleCloudKubernetesDashboard = openGoogleCloudKubernetesDashboard;
-//# sourceMappingURL=openKubernetesDashboards.js.map
-
-/***/ }),
-
-/***/ 76775:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.startKubePortForward = void 0;
-const portForwards_1 = __nccwpck_require__(5368);
-const startKubePortForward = async (podname, localPort, remotePort, namespace) => {
-    const name = `kube/${namespace}/${podname}/${localPort}:${remotePort}`;
-    await (0, portForwards_1.startPortForwardCommand)(name, `kubectl port-forward ${podname} ${localPort}:${remotePort} -n ${namespace}`);
+    const kinds = new Map();
+    for (const { env, componentName } of writes) {
+        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+        [
+            ...secretEnvVarKeys,
+            ...jobOnlyVars.build.secretEnvVarKeys,
+            ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
+        var _a;
+        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+        return {
+            name,
+            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        };
+    }));
+    if (secrets.length === 0) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    const repo = await (0, github_2.getConfiguredGithubRepo)();
+    if (!repo) {
+        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+    await (0, github_2.pushSecretsToGithub)(io, repo, secrets, await (0, github_2.collectSecretTargets)(config));
 };
-exports.startKubePortForward = startKubePortForward;
-//# sourceMappingURL=portForward.js.map
-
-/***/ }),
-
-/***/ 55689:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-// we can't import the package.json directly, because the bundling process will inline it
-// but the version is only set during deployement, when its already bundled
-// instead we need to use require.main.path to get the path of the main module, which is actually the file in the bin
-// this will point to the root package.json
-var _a;
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-const path = ((_a = require.main) === null || _a === void 0 ? void 0 : _a.path) + "/../package.json";
-const ownPkg = require(path);
-exports["default"] = ownPkg;
-//# sourceMappingURL=packageInfos.js.map
+//# sourceMappingURL=writeSecrets.js.map
 
 /***/ }),
 
@@ -6910,7 +7126,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
+exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.GitlabNotFoundError = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const lodash_es_1 = __nccwpck_require__(50210);
 const memoizee_1 = __importDefault(__nccwpck_require__(6575));
@@ -6962,6 +7178,20 @@ const getGitlabToken = async (io) => {
     return (0, preferences_1.getPreference)(TOKEN_KEY);
 };
 exports.getGitlabToken = getGitlabToken;
+/**
+ * a gitlab api call that came back 404. Carries the path so a caller
+ * that wants to treat "does not exist yet" as normal can say so
+ * (`instanceof`) instead of matching on a message.
+ */
+class GitlabNotFoundError extends Error {
+    constructor(path, host) {
+        super(`gitlab api: ${path} not found on ${host}`);
+        this.path = path;
+        this.host = host;
+        this.name = "GitlabNotFoundError";
+    }
+}
+exports.GitlabNotFoundError = GitlabNotFoundError;
 const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
     const [rootToken, { gitRemoteHost }] = await Promise.all([
         (0, exports.getGitlabToken)(io),
@@ -6983,7 +7213,7 @@ const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
         return null;
     }
     if (result.status === 404) {
-        throw new Error("not found");
+        throw new GitlabNotFoundError(path, gitRemoteHost);
     }
     throw new Error(`Could not send request to gitlab api ${path}: ${result.status} "${result.statusText}".\nResponse: ${JSON.stringify(await result.json(), null, 2)}`);
 };
@@ -7009,9 +7239,20 @@ const doGitlabRequestAllPages = async (io, path) => {
 };
 exports.doGitlabRequestAllPages = doGitlabRequestAllPages;
 const getProjectInfo = async (io) => {
-    const { gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
-    const project = await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
-    return project;
+    const { gitRemoteHost, gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
+    try {
+        return await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
+    }
+    catch (e) {
+        if (e instanceof GitlabNotFoundError) {
+            // the classic: the remote is not a gitlab at all (a github one,
+            // say), so the request goes to a host without /api/v4 and every
+            // path answers 404
+            throw new Error(`no gitlab project '${gitRemotePath}' on '${gitRemoteHost}'. ` +
+                "Check the git remote and `pipelines` in catladder.ts — this command talks to the gitlab api.");
+        }
+        throw e;
+    }
 };
 exports.getProjectInfo = getProjectInfo;
 exports.getAllVariables = (0, memoizee_1.default)(async (io, n = 5) => {
@@ -7566,7 +7807,14 @@ class BitwardenVault {
         }
         return secrets;
     }
+    /**
+     * upserts into the item's yaml note. The note is rewritten as a
+     * whole, so the values that are not part of this write have to be
+     * carried over — a single-key write (`secrets-set`, a credential
+     * provisioned by `project setup`) must not drop the rest.
+     */
     async writeSecrets(io, env, componentName, secrets) {
+        var _a;
         const { config, collectionName } = this;
         const bwSession = await this.session(io);
         const collection = await findCollection(bwSession, collectionName);
@@ -7579,7 +7827,10 @@ class BitwardenVault {
             "--search",
             name,
         ])).find((item) => item.name === name);
-        const notes = (0, yaml_1.stringify)(secrets);
+        const previous = (existing === null || existing === void 0 ? void 0 : existing.notes)
+            ? ((_a = (0, yaml_1.parse)(existing.notes)) !== null && _a !== void 0 ? _a : {})
+            : {};
+        const notes = (0, yaml_1.stringify)({ ...previous, ...secrets });
         if (existing) {
             await (0, bw_1.runBw)(bwSession, [
                 "edit",
@@ -7633,8 +7884,9 @@ class GitlabVault {
         const variables = await (0, gitlab_1.getAllVariables)(io);
         return Object.fromEntries(variables.map((v) => [v.key, v.value]));
     }
-    async writeSecrets(io, env, componentName, secrets) {
-        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+    async writeSecrets(io, env, componentName, secrets, options = {}) {
+        var _a;
+        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName, (_a = options.backup) !== null && _a !== void 0 ? _a : true);
     }
 }
 exports.GitlabVault = GitlabVault;
@@ -7720,11 +7972,11 @@ class VaultManager {
      * writes secrets of one env/component to the vault and updates the
      * local cache (write-through, "local" env only)
      */
-    async writeSecrets(env, componentName, secrets, io = this.io) {
+    async writeSecrets(env, componentName, secrets, io = this.io, options = {}) {
         if (!io) {
             throw new Error("writing to the vault requires an interactive context");
         }
-        await this.vault.writeSecrets(io, env, componentName, secrets);
+        await this.vault.writeSecrets(io, env, componentName, secrets, options);
         if (env === CACHED_ENV) {
             await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
                 key,
@@ -8723,6 +8975,43 @@ exports.getAgentSkillTargets = getAgentSkillTargets;
 
 /***/ }),
 
+/***/ 72792:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPinLabelRegexSource = exports.getAutoStopConfig = exports.DEFAULT_PIN_LABEL = exports.DEFAULT_DEV_AUTO_STOP = exports.DEFAULT_REVIEW_AUTO_STOP = exports.REVIEW_AUTO_STOP_VARIABLE = void 0;
+const lodash_es_1 = __nccwpck_require__(50210);
+/**
+ * pipeline-level variable holding the `auto_stop_in` of review
+ * environments. Review deploy jobs reference it instead of a literal,
+ * so the pin label's workflow rule can override it to `never` for the
+ * whole pipeline (all components at once).
+ */
+exports.REVIEW_AUTO_STOP_VARIABLE = "CL_REVIEW_AUTO_STOP";
+exports.DEFAULT_REVIEW_AUTO_STOP = "1 week";
+exports.DEFAULT_DEV_AUTO_STOP = "4 weeks";
+exports.DEFAULT_PIN_LABEL = "catladder::pin-review";
+const getAutoStopConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f;
+    return ({
+        review: (_b = (_a = config.autoStop) === null || _a === void 0 ? void 0 : _a.review) !== null && _b !== void 0 ? _b : exports.DEFAULT_REVIEW_AUTO_STOP,
+        dev: (_d = (_c = config.autoStop) === null || _c === void 0 ? void 0 : _c.dev) !== null && _d !== void 0 ? _d : exports.DEFAULT_DEV_AUTO_STOP,
+        pinLabel: (_f = (_e = config.autoStop) === null || _e === void 0 ? void 0 : _e.pinLabel) !== null && _f !== void 0 ? _f : exports.DEFAULT_PIN_LABEL,
+    });
+};
+exports.getAutoStopConfig = getAutoStopConfig;
+/**
+ * matches the pin label inside `$CI_MERGE_REQUEST_LABELS`
+ * (comma-separated) — anchored so `pin` never matches `no-pin`
+ */
+const getPinLabelRegexSource = (pinLabel) => `(^|,)${(0, lodash_es_1.escapeRegExp)(pinLabel).replaceAll("/", "\\/")}(,|$)`;
+exports.getPinLabelRegexSource = getPinLabelRegexSource;
+//# sourceMappingURL=autoStop.js.map
+
+/***/ }),
+
 /***/ 48476:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -10101,6 +10390,7 @@ exports.GitlabBackend = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
+const autoStop_1 = __nccwpck_require__(72792);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
 const shippedCatci_1 = __nccwpck_require__(27967);
@@ -10286,6 +10576,7 @@ class GitlabBackend {
                 // per-pipeline-type variables (pipelines.gitlab.runnerVariables)
                 ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
             },
+            autoStop: (0, autoStop_1.getAutoStopConfig)(config),
         });
     }
 }
@@ -10730,6 +11021,7 @@ function getGitlabNeedsForWorkspaceJob(context, { needs }, allJobs) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createGitlabPipelineWithDefaults = void 0;
 const bash_1 = __nccwpck_require__(94143);
+const autoStop_1 = __nccwpck_require__(72792);
 const rules_1 = __nccwpck_require__(78503);
 /**
  * gitlab requires a top-level default image for jobs that don't set their
@@ -10738,7 +11030,8 @@ const rules_1 = __nccwpck_require__(78503);
  * build-free image (a catladder job image would drag in a build job).
  */
 const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...config }) => {
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, autoStop, ...config }) => {
+    const pinLabel = autoStop && autoStop.pinLabel;
     return {
         image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
         variables: {
@@ -10747,6 +11040,10 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
             CACHE_COMPRESSION_LEVEL: "fast", // same as above, but for caches
             TRANSFER_METER_FREQUENCY: "5s", // how often we should update the transfer meter for cache upload/download
             GIT_DEPTH: "1", // no need the full depth
+            // review env lifetime — the pin-label workflow rule below
+            // overrides this to "never" (workflow rule variables take
+            // precedence over pipeline-level variables)
+            ...(pinLabel ? { [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: autoStop.review } : {}),
             ...(variables !== null && variables !== void 0 ? variables : {}),
         },
         before_script: [
@@ -10763,6 +11060,20 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
                         PIPELINE_NAME: "Thinking...",
                     },
                 },
+                // pinned MRs (rules stop at the first match, so this must come
+                // before the plain merge-request rule)
+                ...(pinLabel
+                    ? [
+                        {
+                            if: `${rules_1.RULE_IS_MERGE_REQUEST.if} && $CI_MERGE_REQUEST_LABELS =~ /${(0, autoStop_1.getPinLabelRegexSource)(pinLabel)}/`,
+                            variables: {
+                                PIPELINE_ICON: "🐱📌",
+                                PIPELINE_NAME: "mr$CI_MERGE_REQUEST_IID - $CI_MERGE_REQUEST_TITLE",
+                                [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: "never",
+                            },
+                        },
+                    ]
+                    : []),
                 {
                     if: rules_1.RULE_IS_MERGE_REQUEST.if,
                     variables: {
@@ -14477,6 +14788,7 @@ const docker_1 = __nccwpck_require__(12354);
 const context_1 = __nccwpck_require__(73938);
 const jobs_1 = __nccwpck_require__(98521);
 const utils_1 = __nccwpck_require__(71286);
+const autoStop_1 = __nccwpck_require__(72792);
 const stop_1 = __nccwpck_require__(35937);
 const variables_1 = __nccwpck_require__(54768);
 exports.DEPLOY_JOB_NAME = "🚀 Deploy";
@@ -14485,10 +14797,15 @@ class DeployJob extends jobs_1.CatladderJob {
         var _a, _b, _c, _d, _e, _f, _g;
         const hasDocker = (0, docker_1.requiresDockerBuild)(context);
         const isStoppable = (0, utils_1.contextIsStoppable)(context);
+        const autoStopConfig = (0, autoStop_1.getAutoStopConfig)(context.fullConfig);
         const autoStop = context.environment.envType === "review"
-            ? "1 week"
+            ? // review envs read the lifetime from a pipeline variable, so
+                // the pin label's workflow rule can override it to "never"
+                autoStopConfig.pinLabel === false
+                    ? autoStopConfig.review
+                    : `$${autoStop_1.REVIEW_AUTO_STOP_VARIABLE}`
             : context.environment.envType === "dev"
-                ? "4 weeks"
+                ? autoStopConfig.dev
                 : undefined;
         const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
         // if auto or manual is configured explicitly, use that
@@ -17317,6 +17634,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(46734), exports);
+__exportStar(__nccwpck_require__(72792), exports);
 __exportStar(__nccwpck_require__(62853), exports);
 __exportStar(__nccwpck_require__(63557), exports);
 __exportStar(__nccwpck_require__(78503), exports);