@catladder/cli 5.0.1 → 5.1.1

package/dist/apps/cli/src/vault/types.d.ts

@@ -17,9 +17,23 @@ export type SecretsVault = {
     readAllSecrets(io: IO | null): Promise<Record<string, string>>;
     /**
      * upserts the secrets of one env and component
-     * (keys as declared in the config, not the raw variable names)
+     * (keys as declared in the config, not the raw variable names).
+     * Upsert, not replace: values that are not part of `secrets` stay
+     * untouched.
      */
-    writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>): Promise<void>;
+    writeSecrets(io: IO, env: string, componentName: string, secrets: Record<string, unknown>, options?: WriteSecretsOptions): Promise<void>;
+};
+export type WriteSecretsOptions = {
+    /**
+     * keep the previous value around where the store supports it (the
+     * gitlab store writes `<KEY>_backup_<timestamp>` variables) —
+     * a hand-written secret's only undo.
+     *
+     * Machine-provisioned credentials (service account keys, kubernetes
+     * tokens) are regenerated on demand and their old value is worthless,
+     * so `project setup` writes them with `backup: false`.
+     */
+    backup?: boolean;
 };
 /**
  * how secret resolution may interact with the vault:

package/dist/bundles/catenv/index.js

@@ -978,7 +978,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
+exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.GitlabNotFoundError = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const lodash_es_1 = __nccwpck_require__(50210);
 const memoizee_1 = __importDefault(__nccwpck_require__(6575));
@@ -1030,6 +1030,20 @@ const getGitlabToken = async (io) => {
     return (0, preferences_1.getPreference)(TOKEN_KEY);
 };
 exports.getGitlabToken = getGitlabToken;
+/**
+ * a gitlab api call that came back 404. Carries the path so a caller
+ * that wants to treat "does not exist yet" as normal can say so
+ * (`instanceof`) instead of matching on a message.
+ */
+class GitlabNotFoundError extends Error {
+    constructor(path, host) {
+        super(`gitlab api: ${path} not found on ${host}`);
+        this.path = path;
+        this.host = host;
+        this.name = "GitlabNotFoundError";
+    }
+}
+exports.GitlabNotFoundError = GitlabNotFoundError;
 const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
     const [rootToken, { gitRemoteHost }] = await Promise.all([
         (0, exports.getGitlabToken)(io),
@@ -1051,7 +1065,7 @@ const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
         return null;
     }
     if (result.status === 404) {
-        throw new Error("not found");
+        throw new GitlabNotFoundError(path, gitRemoteHost);
     }
     throw new Error(`Could not send request to gitlab api ${path}: ${result.status} "${result.statusText}".\nResponse: ${JSON.stringify(await result.json(), null, 2)}`);
 };
@@ -1077,9 +1091,20 @@ const doGitlabRequestAllPages = async (io, path) => {
 };
 exports.doGitlabRequestAllPages = doGitlabRequestAllPages;
 const getProjectInfo = async (io) => {
-    const { gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
-    const project = await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
-    return project;
+    const { gitRemoteHost, gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
+    try {
+        return await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
+    }
+    catch (e) {
+        if (e instanceof GitlabNotFoundError) {
+            // the classic: the remote is not a gitlab at all (a github one,
+            // say), so the request goes to a host without /api/v4 and every
+            // path answers 404
+            throw new Error(`no gitlab project '${gitRemotePath}' on '${gitRemoteHost}'. ` +
+                "Check the git remote and `pipelines` in catladder.ts — this command talks to the gitlab api.");
+        }
+        throw e;
+    }
 };
 exports.getProjectInfo = getProjectInfo;
 exports.getAllVariables = (0, memoizee_1.default)(async (io, n = 5) => {
@@ -1400,7 +1425,14 @@ class BitwardenVault {
         }
         return secrets;
     }
+    /**
+     * upserts into the item's yaml note. The note is rewritten as a
+     * whole, so the values that are not part of this write have to be
+     * carried over — a single-key write (`secrets-set`, a credential
+     * provisioned by `project setup`) must not drop the rest.
+     */
     async writeSecrets(io, env, componentName, secrets) {
+        var _a;
         const { config, collectionName } = this;
         const bwSession = await this.session(io);
         const collection = await findCollection(bwSession, collectionName);
@@ -1413,7 +1445,10 @@ class BitwardenVault {
             "--search",
             name,
         ])).find((item) => item.name === name);
-        const notes = (0, yaml_1.stringify)(secrets);
+        const previous = (existing === null || existing === void 0 ? void 0 : existing.notes)
+            ? ((_a = (0, yaml_1.parse)(existing.notes)) !== null && _a !== void 0 ? _a : {})
+            : {};
+        const notes = (0, yaml_1.stringify)({ ...previous, ...secrets });
         if (existing) {
             await (0, bw_1.runBw)(bwSession, [
                 "edit",
@@ -1467,8 +1502,9 @@ class GitlabVault {
         const variables = await (0, gitlab_1.getAllVariables)(io);
         return Object.fromEntries(variables.map((v) => [v.key, v.value]));
     }
-    async writeSecrets(io, env, componentName, secrets) {
-        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+    async writeSecrets(io, env, componentName, secrets, options = {}) {
+        var _a;
+        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName, (_a = options.backup) !== null && _a !== void 0 ? _a : true);
     }
 }
 exports.GitlabVault = GitlabVault;
@@ -1554,11 +1590,11 @@ class VaultManager {
      * writes secrets of one env/component to the vault and updates the
      * local cache (write-through, "local" env only)
      */
-    async writeSecrets(env, componentName, secrets, io = this.io) {
+    async writeSecrets(env, componentName, secrets, io = this.io, options = {}) {
         if (!io) {
             throw new Error("writing to the vault requires an interactive context");
         }
-        await this.vault.writeSecrets(io, env, componentName, secrets);
+        await this.vault.writeSecrets(io, env, componentName, secrets, options);
         if (env === CACHED_ENV) {
             await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
                 key,
@@ -2557,6 +2593,43 @@ exports.getAgentSkillTargets = getAgentSkillTargets;
 
 /***/ }),
 
+/***/ 72792:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPinLabelRegexSource = exports.getAutoStopConfig = exports.DEFAULT_PIN_LABEL = exports.DEFAULT_DEV_AUTO_STOP = exports.DEFAULT_REVIEW_AUTO_STOP = exports.REVIEW_AUTO_STOP_VARIABLE = void 0;
+const lodash_es_1 = __nccwpck_require__(50210);
+/**
+ * pipeline-level variable holding the `auto_stop_in` of review
+ * environments. Review deploy jobs reference it instead of a literal,
+ * so the pin label's workflow rule can override it to `never` for the
+ * whole pipeline (all components at once).
+ */
+exports.REVIEW_AUTO_STOP_VARIABLE = "CL_REVIEW_AUTO_STOP";
+exports.DEFAULT_REVIEW_AUTO_STOP = "1 week";
+exports.DEFAULT_DEV_AUTO_STOP = "4 weeks";
+exports.DEFAULT_PIN_LABEL = "catladder::pin-review";
+const getAutoStopConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f;
+    return ({
+        review: (_b = (_a = config.autoStop) === null || _a === void 0 ? void 0 : _a.review) !== null && _b !== void 0 ? _b : exports.DEFAULT_REVIEW_AUTO_STOP,
+        dev: (_d = (_c = config.autoStop) === null || _c === void 0 ? void 0 : _c.dev) !== null && _d !== void 0 ? _d : exports.DEFAULT_DEV_AUTO_STOP,
+        pinLabel: (_f = (_e = config.autoStop) === null || _e === void 0 ? void 0 : _e.pinLabel) !== null && _f !== void 0 ? _f : exports.DEFAULT_PIN_LABEL,
+    });
+};
+exports.getAutoStopConfig = getAutoStopConfig;
+/**
+ * matches the pin label inside `$CI_MERGE_REQUEST_LABELS`
+ * (comma-separated) — anchored so `pin` never matches `no-pin`
+ */
+const getPinLabelRegexSource = (pinLabel) => `(^|,)${(0, lodash_es_1.escapeRegExp)(pinLabel).replaceAll("/", "\\/")}(,|$)`;
+exports.getPinLabelRegexSource = getPinLabelRegexSource;
+//# sourceMappingURL=autoStop.js.map
+
+/***/ }),
+
 /***/ 48476:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -2569,6 +2642,7 @@ const path_1 = __nccwpck_require__(16928);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const config_1 = __nccwpck_require__(75591);
 const ciVariables_1 = __nccwpck_require__(17300);
+const registryImage_1 = __nccwpck_require__(24333);
 const index_1 = __nccwpck_require__(62853);
 const createGithubJobs_1 = __nccwpck_require__(73474);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
@@ -2622,7 +2696,10 @@ class GithubBackend {
         await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, { recursive: true, force: true });
     }
     async createFiles(config) {
-        const images = this.createImagesPlan(config);
+        // ghcr rejects uppercase image paths, and `${{ github.repository }}`
+        // interpolates github's display casing — a mixed-case owner or repo
+        // needs a lowercased literal instead (see ./ghcr)
+        const images = this.createImagesPlan(config, await (0, registryImage_1.resolveGithubRegistryImage)(config));
         const scripts = new scriptFiles_1.GithubScriptFiles();
         const workflows = await this.createWorkflows(config, images, scripts);
         return [
@@ -2637,8 +2714,8 @@ class GithubBackend {
             ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
         ];
     }
-    createImagesPlan(config) {
-        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
+    createImagesPlan(config, registryImage) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images, registryImage);
     }
     /**
      * all workflows keyed by file name, mainly for testing purposes
@@ -2647,9 +2724,11 @@ class GithubBackend {
         var _a, _b, _c, _d;
         const workflows = {};
         // per-pipeline-type variables (pipelines.github.runnerVariables);
-        // workflow-level env, so job-level runnerVariables take precedence
+        // workflow-level env, so job-level runnerVariables take precedence.
+        // The images plan is the single source of the ghcr namespace, so the
+        // workflow env and the container images can never disagree.
         const workflowEnv = {
-            ...ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
+            ...(0, ciVariables_1.getGithubInjectedWorkflowEnv)(images.registryImageRef()),
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
         const reviewStopJobs = {};
@@ -2992,12 +3071,13 @@ exports.makeAggregateCheckJob = makeAggregateCheckJob;
 /***/ }),
 
 /***/ 17300:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.GITHUB_INJECTED_WORKFLOW_ENV = exports.GITHUB_CI_VARIABLES = void 0;
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = exports.getGithubInjectedWorkflowEnv = exports.GITHUB_CI_VARIABLES = void 0;
+const ghcr_1 = __nccwpck_require__(59011);
 /**
  * how the github backend names the predefined CI variables.
  *
@@ -3018,16 +3098,28 @@ exports.GITHUB_CI_VARIABLES = {
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
- * variables referenced by {@link GITHUB_CI_VARIABLES}
+ * variables referenced by {@link GITHUB_CI_VARIABLES}.
+ *
+ * `registryImage` is the ghcr namespace to push to — the actions
+ * expression for an all-lowercase repository, a lowercased literal for
+ * a mixed-case one (see `./ghcr`).
  */
-exports.GITHUB_INJECTED_WORKFLOW_ENV = {
+const getGithubInjectedWorkflowEnv = (registryImage = ghcr_1.GHCR_REPOSITORY_EXPRESSION) => ({
     CL_JOB_TOKEN: "${{ github.token }}",
     CL_REGISTRY: "ghcr.io",
-    CL_REGISTRY_IMAGE: "ghcr.io/${{ github.repository }}",
+    CL_REGISTRY_IMAGE: registryImage,
     CL_REGISTRY_USER: "${{ github.actor }}",
     // empty outside of pull request events
     CL_PR_NUMBER: "${{ github.event.number }}",
-};
+});
+exports.getGithubInjectedWorkflowEnv = getGithubInjectedWorkflowEnv;
+/**
+ * the names of the injected workflow-level env — the values differ per
+ * repository (see {@link getGithubInjectedWorkflowEnv}), the names never
+ * do, so lookups that only ask "does the workflow already provide this?"
+ * use this instead.
+ */
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = new Set(Object.keys((0, exports.getGithubInjectedWorkflowEnv)()));
 //# sourceMappingURL=ciVariables.js.map
 
 /***/ }),
@@ -3254,7 +3346,7 @@ const getSecretsEnv = (context, kinds) => {
  */
 const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)]
     .map((match) => match[1])
-    .filter((name) => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV))
+    .filter((name) => !ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV_NAMES.has(name))
     .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j;
@@ -3518,6 +3610,53 @@ exports.makeEnsureImageGithubJobs = makeEnsureImageGithubJobs;
 
 /***/ }),
 
+/***/ 59011:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.toGhcrRegistryImage = exports.parseGithubRepoFromRemoteUrl = exports.GHCR_REPOSITORY_EXPRESSION = void 0;
+/**
+ * the ghcr namespace expressed through the actions context — portable
+ * across forks, and what every all-lowercase repository keeps using
+ */
+exports.GHCR_REPOSITORY_EXPRESSION = "ghcr.io/${{ github.repository }}";
+/**
+ * parses `owner/name` out of a github remote url (ssh or https, with or
+ * without the `.git` suffix).
+ *
+ * Shared with the cli (`apps/cli/src/utils/github.ts`) so the two can't
+ * drift apart.
+ */
+const parseGithubRepoFromRemoteUrl = (url) => { var _a; return (_a = url.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/)) === null || _a === void 0 ? void 0 : _a[1]; };
+exports.parseGithubRepoFromRemoteUrl = parseGithubRepoFromRemoteUrl;
+/**
+ * the ghcr image prefix for an `owner/name` repository.
+ *
+ * The OCI distribution spec only allows `[a-z0-9]` plus `.`, `_` and `-`
+ * separators in a repository name, so a mixed-case owner or repo (very
+ * common for org logins: `AcmeCorp`, …) makes the docker client reject
+ * every tag before it even reaches the network. Lowercasing is not a
+ * workaround: the org `AcmeCorp` owns the namespace `ghcr.io/acmecorp`,
+ * so the lowercased path is the correct address.
+ *
+ * Returns the `${{ github.repository }}` expression when lowercasing
+ * would change nothing — it is equivalent for those repositories, and
+ * unlike a literal it keeps working in a fork (whose token can only
+ * push to the fork's own namespace).
+ */
+const toGhcrRegistryImage = (repository) => {
+    const lowercased = repository.toLowerCase();
+    return lowercased === repository
+        ? exports.GHCR_REPOSITORY_EXPRESSION
+        : `ghcr.io/${lowercased}`;
+};
+exports.toGhcrRegistryImage = toGhcrRegistryImage;
+//# sourceMappingURL=ghcr.js.map
+
+/***/ }),
+
 /***/ 25073:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -3827,12 +3966,70 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(48476), exports);
 __exportStar(__nccwpck_require__(17300), exports);
+__exportStar(__nccwpck_require__(59011), exports);
+__exportStar(__nccwpck_require__(24333), exports);
 __exportStar(__nccwpck_require__(61071), exports);
 __exportStar(__nccwpck_require__(82145), exports);
 //# sourceMappingURL=index.js.map
 
 /***/ }),
 
+/***/ 24333:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.resolveGithubRegistryImage = exports.githubRegistryImageFromConfig = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const index_1 = __nccwpck_require__(62853);
+const ghcr_1 = __nccwpck_require__(59011);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * the ghcr image prefix derived from the config alone
+ * (`pipelines.github.repository`), without touching git.
+ *
+ * Used where generation must stay pure and hermetic (tests, examples);
+ * {@link resolveGithubRegistryImage} adds the git remote fallback.
+ */
+const githubRegistryImageFromConfig = (config) => {
+    const { repository } = (0, index_1.getPipelineOptions)(config, "github");
+    return repository ? (0, ghcr_1.toGhcrRegistryImage)(repository) : undefined;
+};
+exports.githubRegistryImageFromConfig = githubRegistryImageFromConfig;
+/**
+ * the ghcr image prefix to generate with: the configured repository, or
+ * the one the github git remote points at.
+ *
+ * Falls back to the `${{ github.repository }}` expression when the
+ * remote is unavailable (a checkout without the remote, a tarball, …).
+ * That is the pre-existing behavior and correct for every all-lowercase
+ * repository; `project doctor` catches the mixed-case case it is not
+ * correct for.
+ */
+const resolveGithubRegistryImage = async (config) => {
+    const fromConfig = (0, exports.githubRegistryImageFromConfig)(config);
+    if (fromConfig) {
+        return fromConfig;
+    }
+    const remote = (0, index_1.getPipelineGitRemote)(config, "github");
+    try {
+        const { stdout } = await execFile("git", ["remote", "get-url", remote]);
+        const repository = (0, ghcr_1.parseGithubRepoFromRemoteUrl)(stdout);
+        return repository
+            ? (0, ghcr_1.toGhcrRegistryImage)(repository)
+            : ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+    catch (_a) {
+        return ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+};
+exports.resolveGithubRegistryImage = resolveGithubRegistryImage;
+//# sourceMappingURL=registryImage.js.map
+
+/***/ }),
+
 /***/ 61071:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -3935,6 +4132,7 @@ exports.GitlabBackend = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
+const autoStop_1 = __nccwpck_require__(72792);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
 const shippedCatci_1 = __nccwpck_require__(27967);
@@ -4120,6 +4318,7 @@ class GitlabBackend {
                 // per-pipeline-type variables (pipelines.gitlab.runnerVariables)
                 ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
             },
+            autoStop: (0, autoStop_1.getAutoStopConfig)(config),
         });
     }
 }
@@ -4564,6 +4763,7 @@ function getGitlabNeedsForWorkspaceJob(context, { needs }, allJobs) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createGitlabPipelineWithDefaults = void 0;
 const bash_1 = __nccwpck_require__(94143);
+const autoStop_1 = __nccwpck_require__(72792);
 const rules_1 = __nccwpck_require__(78503);
 /**
  * gitlab requires a top-level default image for jobs that don't set their
@@ -4572,7 +4772,8 @@ const rules_1 = __nccwpck_require__(78503);
  * build-free image (a catladder job image would drag in a build job).
  */
 const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...config }) => {
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, autoStop, ...config }) => {
+    const pinLabel = autoStop && autoStop.pinLabel;
     return {
         image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
         variables: {
@@ -4581,6 +4782,10 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
             CACHE_COMPRESSION_LEVEL: "fast", // same as above, but for caches
             TRANSFER_METER_FREQUENCY: "5s", // how often we should update the transfer meter for cache upload/download
             GIT_DEPTH: "1", // no need the full depth
+            // review env lifetime — the pin-label workflow rule below
+            // overrides this to "never" (workflow rule variables take
+            // precedence over pipeline-level variables)
+            ...(pinLabel ? { [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: autoStop.review } : {}),
             ...(variables !== null && variables !== void 0 ? variables : {}),
         },
         before_script: [
@@ -4597,6 +4802,20 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
                         PIPELINE_NAME: "Thinking...",
                     },
                 },
+                // pinned MRs (rules stop at the first match, so this must come
+                // before the plain merge-request rule)
+                ...(pinLabel
+                    ? [
+                        {
+                            if: `${rules_1.RULE_IS_MERGE_REQUEST.if} && $CI_MERGE_REQUEST_LABELS =~ /${(0, autoStop_1.getPinLabelRegexSource)(pinLabel)}/`,
+                            variables: {
+                                PIPELINE_ICON: "🐱📌",
+                                PIPELINE_NAME: "mr$CI_MERGE_REQUEST_IID - $CI_MERGE_REQUEST_TITLE",
+                                [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: "never",
+                            },
+                        },
+                    ]
+                    : []),
                 {
                     if: rules_1.RULE_IS_MERGE_REQUEST.if,
                     variables: {
@@ -7920,6 +8139,7 @@ exports.JobImagesPlan = exports.PROJECT_IMAGES_FOLDER = exports.GENERATED_IMAGES
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const ciVariables_1 = __nccwpck_require__(91215);
+const ghcr_1 = __nccwpck_require__(59011);
 const docker_1 = __nccwpck_require__(12354);
 const runner_1 = __nccwpck_require__(92146);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -7980,9 +8200,16 @@ exports.PROJECT_IMAGES_FOLDER = `${exports.GENERATED_IMAGES_FOLDER}/project`;
  * Reference-driven: only images actually used by a job are built.
  */
 class JobImagesPlan {
-    constructor(pipelineType, projectImages = {}) {
+    constructor(pipelineType, projectImages = {}, 
+    /**
+     * the registry image prefix to generate with, overriding the
+     * pipeline type's default. On github this carries the lowercased
+     * ghcr namespace (see `resolveGithubRegistryImage`).
+     */
+    registryImage) {
         this.pipelineType = pipelineType;
         this.projectImages = projectImages;
+        this.registryImage = registryImage;
         this.used = new Map();
         this.usedProject = new Map();
     }
@@ -8007,11 +8234,14 @@ class JobImagesPlan {
     }
     /**
      * the registry image prefix. On github, container images can't use
-     * runtime env vars — the expression form is required.
+     * runtime env vars — a literal or an actions expression is required.
      */
     registryImageRef() {
+        if (this.registryImage) {
+            return this.registryImage;
+        }
         return this.pipelineType === "github"
-            ? "ghcr.io/${{ github.repository }}"
+            ? ghcr_1.GHCR_REPOSITORY_EXPRESSION
             : `${(0, ciVariables_1.getCiVariable)({ pipelineType: this.pipelineType }, "registryImage")}`;
     }
     useProject(name) {
@@ -8311,6 +8541,7 @@ const docker_1 = __nccwpck_require__(12354);
 const context_1 = __nccwpck_require__(73938);
 const jobs_1 = __nccwpck_require__(98521);
 const utils_1 = __nccwpck_require__(71286);
+const autoStop_1 = __nccwpck_require__(72792);
 const stop_1 = __nccwpck_require__(35937);
 const variables_1 = __nccwpck_require__(54768);
 exports.DEPLOY_JOB_NAME = "🚀 Deploy";
@@ -8319,10 +8550,15 @@ class DeployJob extends jobs_1.CatladderJob {
         var _a, _b, _c, _d, _e, _f, _g;
         const hasDocker = (0, docker_1.requiresDockerBuild)(context);
         const isStoppable = (0, utils_1.contextIsStoppable)(context);
+        const autoStopConfig = (0, autoStop_1.getAutoStopConfig)(context.fullConfig);
         const autoStop = context.environment.envType === "review"
-            ? "1 week"
+            ? // review envs read the lifetime from a pipeline variable, so
+                // the pin label's workflow rule can override it to "never"
+                autoStopConfig.pinLabel === false
+                    ? autoStopConfig.review
+                    : `$${autoStop_1.REVIEW_AUTO_STOP_VARIABLE}`
             : context.environment.envType === "dev"
-                ? "4 weeks"
+                ? autoStopConfig.dev
                 : undefined;
         const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
         // if auto or manual is configured explicitly, use that
@@ -11151,6 +11387,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(46734), exports);
+__exportStar(__nccwpck_require__(72792), exports);
 __exportStar(__nccwpck_require__(62853), exports);
 __exportStar(__nccwpck_require__(63557), exports);
 __exportStar(__nccwpck_require__(78503), exports);