@catladder/cli 5.0.1 → 5.1.1

package/dist/bundles/cli/index.js

@@ -616,7 +616,7 @@ exports.checkCloudRun = checkCloudRun;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.checkGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
+const secrets_1 = __nccwpck_require__(85200);
 const concurrency_1 = __nccwpck_require__(59723);
 const github_1 = __nccwpck_require__(41353);
 const githubMergeGating_1 = __nccwpck_require__(14966);
@@ -637,14 +637,14 @@ const checkGithub = async (report, config) => {
         report.warn("github cli (gh) not authenticated — github checks skipped", "run: gh auth login");
         return;
     }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
     if (!repo) {
         report.fail(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote`);
         return;
     }
     let targets;
     try {
-        targets = await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config);
+        targets = await (0, secrets_1.collectSecretTargets)(config);
     }
     catch (e) {
         report.warn(`could not generate the github workflows to derive secret references (${e.message})`);
@@ -802,6 +802,73 @@ const checkGithubMergeGating = async (report, repo) => {
 
 /***/ }),
 
+/***/ 12668:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.checkGithubImageCasing = void 0;
+const promises_1 = __nccwpck_require__(91943);
+const path_1 = __nccwpck_require__(16928);
+const pipeline_1 = __nccwpck_require__(53695);
+const secrets_1 = __nccwpck_require__(85200);
+const WORKFLOWS_FOLDER = ".github/workflows";
+const GENERATED_FILE_PREFIX = "catladder-";
+/**
+ * the generated workflow files, or an empty list when none exist yet
+ */
+const readGeneratedWorkflows = async () => {
+    const entries = await (0, promises_1.readdir)(WORKFLOWS_FOLDER).catch(() => []);
+    return Promise.all(entries
+        .filter((file) => file.startsWith(GENERATED_FILE_PREFIX))
+        .map((file) => (0, promises_1.readFile)((0, path_1.join)(WORKFLOWS_FOLDER, file), "utf8")));
+};
+/**
+ * ghcr image paths must be lowercase, but `${{ github.repository }}`
+ * interpolates github's display casing — so a repository whose owner or
+ * name contains an uppercase character needs a lowercased literal in the
+ * generated workflows. Generation bakes that in, which means committed
+ * workflows generated by an older catladder (or hand-edited ones) still
+ * carry the expression and fail every docker job with
+ * `repository name must be lowercase`.
+ *
+ * Unlike the rest of the github checks this needs no `gh` login — only
+ * the git remote and the committed files.
+ */
+const checkGithubImageCasing = async (report, config) => {
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github"))
+        return;
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
+    if (!repo || repo === repo.toLowerCase()) {
+        // an all-lowercase repository keeps the expression on purpose (it
+        // stays correct in forks), and an unresolvable remote is reported
+        // by checkGithub already
+        return;
+    }
+    report.section("github image names");
+    const workflows = await readGeneratedWorkflows();
+    if (workflows.length === 0) {
+        report.warn(`no generated workflows in ${WORKFLOWS_FOLDER} to check`, "run: catenv");
+        return;
+    }
+    const stale = workflows.filter((content) => content.includes(pipeline_1.GHCR_REPOSITORY_EXPRESSION));
+    if (stale.length > 0) {
+        report.fail(`'${repo}' is mixed-case, but ${stale.length}/${workflows.length} generated workflows still use ${pipeline_1.GHCR_REPOSITORY_EXPRESSION} — ghcr rejects uppercase image paths, so every docker job fails with "repository name must be lowercase"`, "run: catenv (and commit the regenerated workflows)");
+        return;
+    }
+    const uppercase = workflows.flatMap((content) => [...content.matchAll(/ghcr\.io\/\S*[A-Z]\S*/g)].map(([match]) => match));
+    if (uppercase.length > 0) {
+        report.fail(`uppercase ghcr image paths in the generated workflows: ${[...new Set(uppercase)].join(", ")}`, `run: catenv — if it persists, set pipelines.github.repository (the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote resolves to '${repo}')`);
+        return;
+    }
+    report.ok(`ghcr image paths lowercased for '${repo}'`);
+};
+exports.checkGithubImageCasing = checkGithubImageCasing;
+//# sourceMappingURL=checkGithubImageCasing.js.map
+
+/***/ }),
+
 /***/ 26904:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -946,6 +1013,7 @@ const pipeline_1 = __nccwpck_require__(53695);
 const getProjectConfig_1 = __nccwpck_require__(70478);
 const checkCloudRun_1 = __nccwpck_require__(55869);
 const checkGithub_1 = __nccwpck_require__(88480);
+const checkGithubImageCasing_1 = __nccwpck_require__(12668);
 const checkGitlab_1 = __nccwpck_require__(26904);
 const checkStore_1 = __nccwpck_require__(62878);
 const DoctorReport_1 = __nccwpck_require__(87354);
@@ -981,6 +1049,7 @@ const doctorProject = async (instance, onlyComponents) => {
         await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
     }
     await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+    await (0, checkGithubImageCasing_1.checkGithubImageCasing)(report, config);
     await (0, checkGithub_1.checkGithub)(report, config);
     report.summarize();
 };
@@ -1260,10 +1329,10 @@ const setupAccessTokens = async (instance) => {
         await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables/GL_TOKEN`, { value: newToken.token }, "PUT");
     }
     catch (e) {
-        if (e.message !== "not found") {
+        if (!(e instanceof gitlab_1.GitlabNotFoundError)) {
             throw e;
         }
-        // not found
+        // the variable does not exist yet: create it
         await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/variables`, {
             key: "GL_TOKEN",
             value: newToken.token,
@@ -1566,7 +1635,7 @@ const promises_1 = __nccwpck_require__(91943);
 const os_1 = __nccwpck_require__(70857);
 const path_1 = __nccwpck_require__(16928);
 const util_1 = __nccwpck_require__(39023);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
+const secrets_1 = __nccwpck_require__(85200);
 const github_1 = __nccwpck_require__(41353);
 const githubMergeGating_1 = __nccwpck_require__(14966);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
@@ -1600,7 +1669,7 @@ const setupGithub = async (instance, config) => {
         instance.log("⚠️ github cli (gh) not authenticated — skipping github merge-gating setup (run: gh auth login)");
         return;
     }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
     if (!repo) {
         instance.log(`⚠️ no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — skipping github merge-gating setup`);
         return;
@@ -1770,15 +1839,20 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.setupKubernetes = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
 const child_process_promise_1 = __nccwpck_require__(11542);
+const secrets_1 = __nccwpck_require__(85200);
 const cluster_1 = __nccwpck_require__(8034);
 const gitlab_1 = __nccwpck_require__(17697);
 const ensureNamespace_1 = __importDefault(__nccwpck_require__(308));
-const setupKubernetes = async (instance, context) => {
-    var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("cannot run setupKubernetes on non-kubernetes deployments");
+/**
+ * the cluster pulls the images from the gitlab container registry, and
+ * a deploy token is how it authenticates there. Nothing to do when the
+ * project has no gitlab pipeline (the images live elsewhere then).
+ */
+const ensureGitlabDeployToken = async (instance, config) => {
+    if (!config || !(0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        return;
     }
     const { id: projectId } = await (0, gitlab_1.getProjectInfo)(instance);
     const deploy_tokens = await (0, gitlab_1.doGitlabRequest)(instance, `projects/${projectId}/deploy_tokens`);
@@ -1790,6 +1864,14 @@ const setupKubernetes = async (instance, context) => {
             scopes: ["read_registry"],
         }, "POST");
     }
+};
+const setupKubernetes = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("cannot run setupKubernetes on non-kubernetes deployments");
+    }
+    await ensureGitlabDeployToken(instance, await (0, getProjectConfig_1.getProjectConfig)());
     const fullName = (0, pipeline_1.getFullKubernetesClusterName)(deployConfig.cluster);
     instance.log(`cluster: ${fullName}`);
     await (0, cluster_1.connectToCluster)(fullName);
@@ -1872,8 +1954,11 @@ EOF
     }
     instance.log("service accounts created / updated!");
     instance.log("");
-    instance.log("pusing secrets to gitlab...");
-    await (0, gitlab_1.upsertAllVariables)(instance, vars, context.env, context.name, false);
+    instance.log("storing the cluster credentials...");
+    await (0, secrets_1.writeSecretsAndMirror)(instance, [{ env: context.env, componentName: context.name, secrets: vars }], 
+    // the service account token is recreated on every run — the
+    // previous one is worth nothing
+    { backup: false });
     instance.log("done!");
 };
 exports.setupKubernetes = setupKubernetes;
@@ -2719,7 +2804,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandMrUnpin = exports.commandMrPin = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(78034);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({ enumerable: true, get: function () { return commandKubeCurrentContext_1.commandKubeCurrentContext; } }));
@@ -2779,6 +2864,9 @@ var commandProjectRestoreDb_1 = __nccwpck_require__(69233);
 Object.defineProperty(exports, "commandProjectRestoreDb", ({ enumerable: true, get: function () { return commandProjectRestoreDb_1.commandProjectRestoreDb; } }));
 var commandSecurityEvaluate_1 = __nccwpck_require__(86851);
 Object.defineProperty(exports, "commandSecurityEvaluate", ({ enumerable: true, get: function () { return commandSecurityEvaluate_1.commandSecurityEvaluate; } }));
+var commandMrPin_1 = __nccwpck_require__(31318);
+Object.defineProperty(exports, "commandMrPin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrPin; } }));
+Object.defineProperty(exports, "commandMrUnpin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrUnpin; } }));
 // Project k8s commands
 var commandNamespace_1 = __nccwpck_require__(25918);
 Object.defineProperty(exports, "commandNamespace", ({ enumerable: true, get: function () { return commandNamespace_1.commandNamespace; } }));
@@ -3175,6 +3263,7 @@ const common_tags_1 = __nccwpck_require__(110);
 const defineCommand_1 = __nccwpck_require__(19096);
 const editAsFile_1 = __nccwpck_require__(3072);
 const promise_1 = __nccwpck_require__(23161);
+const secrets_1 = __nccwpck_require__(85200);
 const document_1 = __nccwpck_require__(96716);
 const scope_1 = __nccwpck_require__(8513);
 const parseKeysInput_1 = __nccwpck_require__(93560);
@@ -3237,7 +3326,7 @@ exports.commandConfigSecrets = (0, defineCommand_1.defineCommand)({
             ctx.log("⏭️ these secrets are still unset and will not be written:");
             skipped.forEach((entry) => ctx.log(`  - ${entry}`));
         }
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
         ctx.log("");
     },
@@ -3442,6 +3531,132 @@ exports.commandCiJobLog = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 31318:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandMrUnpin = exports.commandMrPin = void 0;
+const child_process_promise_1 = __nccwpck_require__(11542);
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const defineCommand_1 = __nccwpck_require__(19096);
+const gitlab_1 = __nccwpck_require__(17697);
+const PIN_LABEL_COLOR = "#428fdc";
+/**
+ * the configured pin label — errors when the project cannot pin
+ * (github-only, or pinning disabled)
+ */
+const getPinLabel = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        throw new Error("pinning review apps needs the gitlab pipeline — github has no auto-stop, review apps live until the pull request is closed");
+    }
+    const { pinLabel } = (0, pipeline_1.getAutoStopConfig)(config);
+    if (pinLabel === false) {
+        throw new Error("review-app pinning is disabled in this project (autoStop.pinLabel: false)");
+    }
+    return pinLabel;
+};
+const findMr = async (io, projectId, mrIid) => {
+    if (mrIid) {
+        return (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/merge_requests/${mrIid}`);
+    }
+    const branch = (await (0, child_process_promise_1.exec)("git rev-parse --abbrev-ref HEAD")).stdout.trim();
+    const mrs = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/merge_requests?state=opened&source_branch=${encodeURIComponent(branch)}`);
+    if (!(mrs === null || mrs === void 0 ? void 0 : mrs.length)) {
+        throw new Error(`no open merge request found for branch '${branch}' — pass one with --mr <iid>`);
+    }
+    return mrs[0];
+};
+const ensurePinLabelExists = async (io, projectId, pinLabel) => {
+    const existing = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels?search=${encodeURIComponent(pinLabel)}`);
+    if (existing === null || existing === void 0 ? void 0 : existing.some((label) => label.name === pinLabel)) {
+        return;
+    }
+    await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels`, {
+        name: pinLabel,
+        color: PIN_LABEL_COLOR,
+        description: "review apps of this MR are pinned — deploys use auto_stop_in: never (managed by catladder)",
+    }, "POST");
+    io.log(`created the '${pinLabel}' label in the project`);
+};
+exports.commandMrPin = (0, defineCommand_1.defineCommand)({
+    name: "mr pin",
+    description: "pin the review apps of a merge request (disable their auto-stop) by adding the pin label; merging or closing the MR still stops them",
+    group: "mr",
+    inputs: {
+        mr: {
+            type: "number",
+            message: "merge request IID (defaults to the open MR of the current branch)",
+            positional: true,
+            required: false,
+        },
+        pipeline: {
+            type: "boolean",
+            message: "trigger a merge-request pipeline so the pin takes effect immediately",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        var _a, _b;
+        const pinLabel = await getPinLabel();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
+        await ensurePinLabelExists(ctx, projectId, pinLabel);
+        if ((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel)) {
+            ctx.log(`already pinned: mr!${mr.iid} carries the '${pinLabel}' label`);
+        }
+        else {
+            await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, { add_labels: pinLabel }, "PUT");
+            ctx.log(`📌 pinned mr!${mr.iid} "${mr.title}" — label '${pinLabel}' added`);
+        }
+        // the label only affects pipelines created after it was set, so
+        // trigger one — otherwise the currently deployed review apps keep
+        // their old auto-stop timer until the next push
+        if ((_b = (await ctx.get("pipeline"))) !== null && _b !== void 0 ? _b : true) {
+            const pipeline = await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}/pipelines`, {}, "POST");
+            ctx.log(`🚀 triggered a pipeline so the pin takes effect now: ${pipeline.web_url}`);
+        }
+        else {
+            ctx.log("the pin takes effect with the next pipeline of the MR");
+        }
+    },
+});
+exports.commandMrUnpin = (0, defineCommand_1.defineCommand)({
+    name: "mr unpin",
+    description: "unpin the review apps of a merge request — the auto-stop timer re-arms with the next deploy",
+    group: "mr",
+    inputs: {
+        mr: {
+            type: "number",
+            message: "merge request IID (defaults to the open MR of the current branch)",
+            positional: true,
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        var _a;
+        const pinLabel = await getPinLabel();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
+        if (!((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel))) {
+            ctx.log(`mr!${mr.iid} is not pinned (no '${pinLabel}' label)`);
+            return;
+        }
+        await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, { remove_labels: pinLabel }, "PUT");
+        ctx.log(`unpinned mr!${mr.iid} — label '${pinLabel}' removed`);
+        ctx.log("the deployed review apps stay pinned until the next deploy re-arms their auto-stop timer");
+    },
+});
+//# sourceMappingURL=commandMrPin.js.map
+
+/***/ }),
+
 /***/ 30119:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -3874,131 +4089,12 @@ exports.commandSecretsClearBackups = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandSecretsSyncGithub = exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+exports.commandSecretsSyncGithub = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const getProjectConfig_1 = __nccwpck_require__(70478);
 const defineCommand_1 = __nccwpck_require__(19096);
+const secrets_1 = __nccwpck_require__(85200);
 const github_1 = __nccwpck_require__(41353);
-/**
- * all secrets declared in the config, with their values read from the
- * vault (github secrets are write-only and can never act as a source)
- */
-const collectSecretsFromVault = async (io, envFilter) => {
-    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
-    const kinds = new Map();
-    for (const [componentName, envs] of Object.entries(envAndComponents)) {
-        for (const env of envs) {
-            if (envFilter && !envFilter.includes(env)) {
-                continue;
-            }
-            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-            const keys = [
-                ...secretEnvVarKeys,
-                ...jobOnlyVars.build.secretEnvVarKeys,
-                ...jobOnlyVars.deploy.secretEnvVarKeys,
-            ];
-            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-        }
-    }
-    const names = [...kinds.keys()];
-    const values = await (await io.getVaultManager()).readSecrets(names, io);
-    const secrets = names
-        .filter((name) => values[name] !== undefined)
-        .map((name) => {
-        var _a;
-        return ({
-            name,
-            value: values[name],
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        });
-    });
-    const missing = names.filter((name) => values[name] === undefined);
-    return { secrets, missing };
-};
-exports.collectSecretsFromVault = collectSecretsFromVault;
-/** marker for repo-level (environment-less) targets */
-const REPO_LEVEL = "";
-/**
- * derives which github environment(s) each secret/variable must live in
- * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
- * vars.X }}` reference in a job's env targets that job's environment
- * (or the repo level when the job has none). Deriving from the real
- * output means the sync can never drift from what the workflows expect.
- *
- * Environment secrets are the answer to github's cap of 100 secrets
- * per REPO (a multi-env project easily exceeds it): the cap applies
- * per environment instead.
- */
-const collectSecretTargets = async (config) => {
-    var _a;
-    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
-    const targets = new Map();
-    for (const workflow of Object.values(workflows)) {
-        for (const job of Object.values(workflow.jobs)) {
-            const environment = typeof job.environment === "object"
-                ? job.environment.name
-                : job.environment;
-            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
-                if (typeof value !== "string")
-                    continue;
-                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
-                    const name = match[1];
-                    if (!targets.has(name)) {
-                        targets.set(name, new Set());
-                    }
-                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
-                }
-            }
-        }
-    }
-    return targets;
-};
-exports.collectSecretTargets = collectSecretTargets;
-/**
- * pushes vault values to github via the gh cli: sensitive ones as
- * secrets (masked), "variable"-kind ones as variables (plain) — each
- * into the environment(s) whose jobs reference them
- */
-const pushSecretsToGithub = async (io, repo, secrets, targets) => {
-    const environments = [
-        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
-    ];
-    for (const environment of environments) {
-        await (0, github_1.ensureGithubEnvironment)(repo, environment);
-        io.log(`🌍 environment ${environment}`);
-    }
-    for (const { name, value, kind } of secrets) {
-        const envs = targets.get(name);
-        if (!envs) {
-            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
-            continue;
-        }
-        for (const environment of envs) {
-            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
-            if (kind === "variable") {
-                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
-                io.log(`📖 ${name} (variable)${suffix}`);
-            }
-            else {
-                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
-                io.log(`✅ ${name}${suffix}`);
-            }
-        }
-    }
-};
-exports.pushSecretsToGithub = pushSecretsToGithub;
-/**
- * resolves the github repository from the configured git remote
- * (`pipelines.github.gitRemote`, defaults to origin)
- */
-const getConfiguredGithubRepo = async () => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        return undefined;
-    }
-    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
-};
-exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
 /**
  * copies the catladder secrets from the vault to github actions
  * repository secrets, keeping the exact same names, so the github
@@ -4035,12 +4131,12 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!(await (0, github_1.isGhAuthenticated)())) {
             throw new Error("the github cli (gh) is not installed or not authenticated — run `gh auth login` first");
         }
-        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, exports.getConfiguredGithubRepo)());
+        const repo = (_a = (await ctx.get("repo"))) !== null && _a !== void 0 ? _a : (await (0, secrets_1.getConfiguredGithubRepo)());
         if (!repo) {
             throw new Error(`no github repository found on the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote — pass it as owner/name or configure pipelines.github.gitRemote`);
         }
         const envFilter = (_b = (await ctx.get("env"))) === null || _b === void 0 ? void 0 : _b.split(",").map((e) => e.trim());
-        const { secrets, missing } = await (0, exports.collectSecretsFromVault)(ctx, envFilter);
+        const { secrets, missing } = await (0, secrets_1.collectSecretsFromVault)(ctx, envFilter);
         if (missing.length > 0) {
             ctx.log(`⚠️ ${missing.length} secrets are not set in the vault and will be skipped:`);
             missing.forEach((name) => ctx.log(`  - ${name}`));
@@ -4057,7 +4153,7 @@ exports.commandSecretsSyncGithub = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, exports.pushSecretsToGithub)(ctx, repo, secrets, await (0, exports.collectSecretTargets)(config));
+        await (0, secrets_1.pushSecretsToGithub)(ctx, repo, secrets, await (0, secrets_1.collectSecretTargets)(config));
         ctx.log("");
         ctx.log("done! 😻 the github pipeline can use them as ${{ secrets.<NAME> }}");
     },
@@ -4621,6 +4717,7 @@ const fs_extra_1 = __nccwpck_require__(20925);
 const yaml_1 = __nccwpck_require__(99292);
 const defineCommand_1 = __nccwpck_require__(19096);
 const readStdin_1 = __nccwpck_require__(89973);
+const secrets_1 = __nccwpck_require__(85200);
 const document_1 = __nccwpck_require__(96716);
 const scope_1 = __nccwpck_require__(8513);
 const parseKeysInput_1 = __nccwpck_require__(93560);
@@ -4683,7 +4780,7 @@ exports.commandSecretsPush = (0, defineCommand_1.defineCommand)({
         if (!confirmed) {
             throw new Error("abort");
         }
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });
@@ -4701,7 +4798,7 @@ exports.commandSecretsSet = void 0;
 const fs_extra_1 = __nccwpck_require__(20925);
 const defineCommand_1 = __nccwpck_require__(19096);
 const readStdin_1 = __nccwpck_require__(89973);
-const document_1 = __nccwpck_require__(96716);
+const secrets_1 = __nccwpck_require__(85200);
 const scope_1 = __nccwpck_require__(8513);
 const resolveValue = async (io, value, valueFile) => {
     if (valueFile) {
@@ -4772,7 +4869,7 @@ exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
             componentName,
             secrets: { [key]: value },
         }));
-        await (0, document_1.writeSecretsAndMirror)(ctx, writes);
+        await (0, secrets_1.writeSecretsAndMirror)(ctx, writes);
         ctx.log("done! 😻");
     },
 });
@@ -4786,12 +4883,8 @@ exports.commandSecretsSet = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.writeSecretsAndMirror = exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
+exports.collectSecretsWrites = exports.checkSecretsDocument = exports.buildSecretsDocument = exports.FILL_ME = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
-const getProjectConfig_1 = __nccwpck_require__(70478);
-const github_1 = __nccwpck_require__(41353);
-const gitlab_1 = __nccwpck_require__(17697);
-const commandSecretsSyncGithub_1 = __nccwpck_require__(27565);
 /** placeholder for secrets that have no value in the vault yet */
 exports.FILL_ME = "🚨 FILL ME";
 /* for convenience, parse json values. that makes it easier to edit secrets that are objects */
@@ -4889,80 +4982,6 @@ const collectSecretsWrites = (document, scoped) => {
     return { writes, skipped };
 };
 exports.collectSecretsWrites = collectSecretsWrites;
-/**
- * writes secrets to the vault (the source of truth) and mirrors them
- * to every enabled CI backend — which backends exist is invisible to
- * the caller
- */
-const writeSecretsAndMirror = async (io, writes) => {
-    const config = await (0, getProjectConfig_1.getProjectConfig)();
-    if (!config) {
-        throw new Error("no catladder config found");
-    }
-    io.log("");
-    io.log("writing secrets to the vault, please wait...");
-    io.log("");
-    for (const { env, componentName, secrets } of writes) {
-        io.log("writing " + env + ":" + componentName + "...\n");
-        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets);
-        io.log("");
-        io.log("✅ " + env + ":" + componentName);
-        io.log("--------------------------------\n");
-    }
-    await mirrorSecretsToCiBackends(io, config, writes);
-};
-exports.writeSecretsAndMirror = writeSecretsAndMirror;
-/**
- * the vault is the source of truth; every enabled CI backend receives
- * a mirrored copy of the written secrets (gitlab variables, github
- * secrets), so all CI systems stay in sync
- */
-const mirrorSecretsToCiBackends = async (io, config, writes) => {
-    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
-    // gitlab mirror (unless gitlab is the vault itself, then it is
-    // already written)
-    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
-        for (const { env, componentName, secrets } of writes) {
-            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
-        }
-        io.log("✅ mirrored to gitlab");
-    }
-    if (!enabled.includes("github")) {
-        return;
-    }
-    const kinds = new Map();
-    for (const { env, componentName } of writes) {
-        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
-        [
-            ...secretEnvVarKeys,
-            ...jobOnlyVars.build.secretEnvVarKeys,
-            ...jobOnlyVars.deploy.secretEnvVarKeys,
-        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
-    }
-    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
-        var _a;
-        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
-        return {
-            name,
-            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
-            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
-        };
-    }));
-    if (secrets.length === 0) {
-        return;
-    }
-    if (!(await (0, github_1.isGhAuthenticated)())) {
-        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    const repo = await (0, commandSecretsSyncGithub_1.getConfiguredGithubRepo)();
-    if (!repo) {
-        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
-        return;
-    }
-    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
-    await (0, commandSecretsSyncGithub_1.pushSecretsToGithub)(io, repo, secrets, await (0, commandSecretsSyncGithub_1.collectSecretTargets)(config));
-};
 //# sourceMappingURL=document.js.map
 
 /***/ }),
@@ -6060,7 +6079,7 @@ const hash = (str, length) => {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.upsertGcloudServiceAccountAndSaveSecret = exports.accountExists = void 0;
 const child_process_promise_1 = __nccwpck_require__(11542);
-const gitlab_1 = __nccwpck_require__(17697);
+const secrets_1 = __nccwpck_require__(85200);
 const serviceAccountNames_1 = __nccwpck_require__(67851);
 const accountExists = async (fullIdentifier) => {
     try {
@@ -6097,9 +6116,20 @@ const upsertGcloudServiceAccount = async (context, account) => {
 const upsertGcloudServiceAccountAndSaveSecret = async (instance, context, account, secretName) => {
     instance.log("upserting service account " + account.name + "...");
     const key = await upsertGcloudServiceAccount(context, account);
-    await (0, gitlab_1.upsertAllVariables)(instance, {
-        [secretName]: key,
-    }, context.env, context.name);
+    // through the vault (and from there to every enabled ci backend) —
+    // the key is a secret like any other, the deploy jobs read it under
+    // its declared name. Writing it to gitlab directly would break every
+    // project that has no gitlab.
+    await (0, secrets_1.writeSecretsAndMirror)(instance, [
+        {
+            env: context.env,
+            componentName: context.name,
+            secrets: { [secretName]: key },
+        },
+    ], 
+    // a fresh key is created on every run, the previous one is deleted
+    // at google — a backup copy of it would only be a dead secret
+    { backup: false });
     instance.log("done!");
 };
 exports.upsertGcloudServiceAccountAndSaveSecret = upsertGcloudServiceAccountAndSaveSecret;
@@ -6279,97 +6309,352 @@ const getProjectPvcs = async (envComponent) => {
     const res = await k8sApi.listNamespacedPersistentVolumeClaim(namespace);
     return res.body.items;
 };
-exports.getProjectPvcs = getProjectPvcs;
-const getProjectPodNames = async (envComponent) => {
-    const pods = await (0, exports.getProjectPods)(envComponent);
-    return pods.map((n) => n.metadata.name);
+exports.getProjectPvcs = getProjectPvcs;
+const getProjectPodNames = async (envComponent) => {
+    const pods = await (0, exports.getProjectPods)(envComponent);
+    return pods.map((n) => n.metadata.name);
+};
+exports.getProjectPodNames = getProjectPodNames;
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 14178:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.openGoogleCloudKubernetesDashboard = exports.openGoogleCloudLogs = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const openDashboard_1 = __nccwpck_require__(74241);
+const openGoogleCloudLogs = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const resource = `k8s_container/cluster_name/${cluster.name}${namespace ? `/namespace_name/${namespace}` : ""}`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "logs/viewer", {
+        project: cluster.projectId,
+        resource: resource,
+    });
+};
+exports.openGoogleCloudLogs = openGoogleCloudLogs;
+const openGoogleCloudKubernetesDashboard = async (instance, context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
+        throw new Error("context is not of type kubernetes");
+    }
+    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
+        throw new Error("no gcloud custer configured");
+    }
+    const namespace = context.environment.envVars.KUBE_NAMESPACE;
+    const cluster = deployConfig.cluster;
+    const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
+    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "kubernetes/workload", {
+        project: cluster.projectId,
+        pageState: pageState,
+    });
+};
+exports.openGoogleCloudKubernetesDashboard = openGoogleCloudKubernetesDashboard;
+//# sourceMappingURL=openKubernetesDashboards.js.map
+
+/***/ }),
+
+/***/ 76775:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.startKubePortForward = void 0;
+const portForwards_1 = __nccwpck_require__(5368);
+const startKubePortForward = async (podname, localPort, remotePort, namespace) => {
+    const name = `kube/${namespace}/${podname}/${localPort}:${remotePort}`;
+    await (0, portForwards_1.startPortForwardCommand)(name, `kubectl port-forward ${podname} ${localPort}:${remotePort} -n ${namespace}`);
+};
+exports.startKubePortForward = startKubePortForward;
+//# sourceMappingURL=portForward.js.map
+
+/***/ }),
+
+/***/ 55689:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+// we can't import the package.json directly, because the bundling process will inline it
+// but the version is only set during deployement, when its already bundled
+// instead we need to use require.main.path to get the path of the main module, which is actually the file in the bin
+// this will point to the root package.json
+var _a;
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+const path = ((_a = require.main) === null || _a === void 0 ? void 0 : _a.path) + "/../package.json";
+const ownPkg = require(path);
+exports["default"] = ownPkg;
+//# sourceMappingURL=packageInfos.js.map
+
+/***/ }),
+
+/***/ 97245:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getConfiguredGithubRepo = exports.pushSecretsToGithub = exports.collectSecretTargets = exports.collectSecretsFromVault = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const github_1 = __nccwpck_require__(41353);
+/**
+ * all secrets declared in the config, with their values read from the
+ * vault (github secrets are write-only and can never act as a source)
+ */
+const collectSecretsFromVault = async (io, envFilter) => {
+    const envAndComponents = await (0, getProjectConfig_1.getAllComponentsWithAllEnvsHierarchical)();
+    const kinds = new Map();
+    for (const [componentName, envs] of Object.entries(envAndComponents)) {
+        for (const env of envs) {
+            if (envFilter && !envFilter.includes(env)) {
+                continue;
+            }
+            const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+            const keys = [
+                ...secretEnvVarKeys,
+                ...jobOnlyVars.build.secretEnvVarKeys,
+                ...jobOnlyVars.deploy.secretEnvVarKeys,
+            ];
+            keys.forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+        }
+    }
+    const names = [...kinds.keys()];
+    const values = await (await io.getVaultManager()).readSecrets(names, io);
+    const secrets = names
+        .filter((name) => values[name] !== undefined)
+        .map((name) => {
+        var _a;
+        return ({
+            name,
+            value: values[name],
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        });
+    });
+    const missing = names.filter((name) => values[name] === undefined);
+    return { secrets, missing };
+};
+exports.collectSecretsFromVault = collectSecretsFromVault;
+/** marker for repo-level (environment-less) targets */
+const REPO_LEVEL = "";
+/**
+ * derives which github environment(s) each secret/variable must live in
+ * by scanning the GENERATED workflows: a `${{ secrets.X }}` / `${{
+ * vars.X }}` reference in a job's env targets that job's environment
+ * (or the repo level when the job has none). Deriving from the real
+ * output means the sync can never drift from what the workflows expect.
+ *
+ * Environment secrets are the answer to github's cap of 100 secrets
+ * per REPO (a multi-env project easily exceeds it): the cap applies
+ * per environment instead.
+ */
+const collectSecretTargets = async (config) => {
+    var _a;
+    const workflows = await new pipeline_1.GithubBackend().createWorkflows(config);
+    const targets = new Map();
+    for (const workflow of Object.values(workflows)) {
+        for (const job of Object.values(workflow.jobs)) {
+            const environment = typeof job.environment === "object"
+                ? job.environment.name
+                : job.environment;
+            for (const value of Object.values((_a = job.env) !== null && _a !== void 0 ? _a : {})) {
+                if (typeof value !== "string")
+                    continue;
+                for (const match of value.matchAll(/\$\{\{\s*(?:secrets|vars)\.([A-Za-z0-9_]+)\s*\}\}/g)) {
+                    const name = match[1];
+                    if (!targets.has(name)) {
+                        targets.set(name, new Set());
+                    }
+                    targets.get(name).add(environment !== null && environment !== void 0 ? environment : REPO_LEVEL);
+                }
+            }
+        }
+    }
+    return targets;
+};
+exports.collectSecretTargets = collectSecretTargets;
+/**
+ * pushes vault values to github via the gh cli: sensitive ones as
+ * secrets (masked), "variable"-kind ones as variables (plain) — each
+ * into the environment(s) whose jobs reference them
+ */
+const pushSecretsToGithub = async (io, repo, secrets, targets) => {
+    const environments = [
+        ...new Set([...targets.values()].flatMap((envs) => [...envs].filter((env) => env !== REPO_LEVEL))),
+    ];
+    for (const environment of environments) {
+        await (0, github_1.ensureGithubEnvironment)(repo, environment);
+        io.log(`🌍 environment ${environment}`);
+    }
+    for (const { name, value, kind } of secrets) {
+        const envs = targets.get(name);
+        if (!envs) {
+            io.log(`⏭️ ${name} (not referenced by any generated workflow)`);
+            continue;
+        }
+        for (const environment of envs) {
+            const suffix = environment === REPO_LEVEL ? "" : ` → ${environment}`;
+            if (kind === "variable") {
+                await (0, github_1.setGithubVariable)(repo, name, value, environment || undefined);
+                io.log(`📖 ${name} (variable)${suffix}`);
+            }
+            else {
+                await (0, github_1.setGithubSecret)(repo, name, value, environment || undefined);
+                io.log(`✅ ${name}${suffix}`);
+            }
+        }
+    }
+};
+exports.pushSecretsToGithub = pushSecretsToGithub;
+/**
+ * resolves the github repository from the configured git remote
+ * (`pipelines.github.gitRemote`, defaults to origin)
+ */
+const getConfiguredGithubRepo = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        return undefined;
+    }
+    return (0, github_1.getGithubRepoFromRemote)((0, pipeline_1.getPipelineGitRemote)(config, "github"));
+};
+exports.getConfiguredGithubRepo = getConfiguredGithubRepo;
+//# sourceMappingURL=github.js.map
+
+/***/ }),
+
+/***/ 85200:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
-exports.getProjectPodNames = getProjectPodNames;
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+__exportStar(__nccwpck_require__(97245), exports);
+__exportStar(__nccwpck_require__(31298), exports);
 //# sourceMappingURL=index.js.map
 
 /***/ }),
 
-/***/ 14178:
+/***/ 31298:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.openGoogleCloudKubernetesDashboard = exports.openGoogleCloudLogs = void 0;
+exports.writeSecretsAndMirror = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
-const openDashboard_1 = __nccwpck_require__(74241);
-const openGoogleCloudLogs = async (instance, context) => {
-    var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("context is not of type kubernetes");
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const github_1 = __nccwpck_require__(41353);
+const gitlab_1 = __nccwpck_require__(17697);
+const github_2 = __nccwpck_require__(97245);
+/**
+ * the one door for writing secret values: they go into the vault (the
+ * source of truth) and are mirrored to every enabled CI backend —
+ * which vault and which backends exist is invisible to the caller.
+ *
+ * Everything that produces a secret value must come through here: the
+ * secrets commands, but also the credentials `project setup`
+ * provisions (gcloud service account keys, kubernetes tokens).
+ */
+const writeSecretsAndMirror = async (io, writes, options = {}) => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
     }
-    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
-        throw new Error("no gcloud custer configured");
+    io.log("");
+    io.log("writing secrets to the vault, please wait...");
+    io.log("");
+    for (const { env, componentName, secrets } of writes) {
+        io.log("writing " + env + ":" + componentName + "...\n");
+        await (await io.getVaultManager()).writeSecrets(env, componentName, secrets, io, options);
+        io.log("");
+        io.log("✅ " + env + ":" + componentName);
+        io.log("--------------------------------\n");
     }
-    const namespace = context.environment.envVars.KUBE_NAMESPACE;
-    const cluster = deployConfig.cluster;
-    const resource = `k8s_container/cluster_name/${cluster.name}${namespace ? `/namespace_name/${namespace}` : ""}`;
-    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "logs/viewer", {
-        project: cluster.projectId,
-        resource: resource,
-    });
+    await mirrorSecretsToCiBackends(io, config, writes, options);
 };
-exports.openGoogleCloudLogs = openGoogleCloudLogs;
-const openGoogleCloudKubernetesDashboard = async (instance, context) => {
+exports.writeSecretsAndMirror = writeSecretsAndMirror;
+/**
+ * the vault is the source of truth; every enabled CI backend receives
+ * a mirrored copy of the written secrets (gitlab variables, github
+ * secrets), so all CI systems stay in sync
+ */
+const mirrorSecretsToCiBackends = async (io, config, writes, options) => {
     var _a;
-    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
-    if (!(0, pipeline_1.isOfDeployType)(deployConfig, "kubernetes")) {
-        throw new Error("context is not of type kubernetes");
+    const enabled = (0, pipeline_1.getEnabledPipelineTypes)(config);
+    // gitlab mirror (unless gitlab is the vault itself, then it is
+    // already written)
+    if ((0, pipeline_1.getVaultConfig)(config).type !== "gitlab" && enabled.includes("gitlab")) {
+        for (const { env, componentName, secrets } of writes) {
+            await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName, (_a = options.backup) !== null && _a !== void 0 ? _a : true);
+        }
+        io.log("✅ mirrored to gitlab");
     }
-    if (!deployConfig.cluster || deployConfig.cluster.type !== "gcloud") {
-        throw new Error("no gcloud custer configured");
+    if (!enabled.includes("github")) {
+        return;
     }
-    const namespace = context.environment.envVars.KUBE_NAMESPACE;
-    const cluster = deployConfig.cluster;
-    const pageState = `("savedViews":("c":["gke/${cluster.region}/${cluster.name}"],"n":["${namespace}"],"i":"4e42e0b9cd6147f8a4fba7516752ec48"))`;
-    await (0, openDashboard_1.openGoogleCloudDashboard)(instance, "kubernetes/workload", {
-        project: cluster.projectId,
-        pageState: pageState,
-    });
-};
-exports.openGoogleCloudKubernetesDashboard = openGoogleCloudKubernetesDashboard;
-//# sourceMappingURL=openKubernetesDashboards.js.map
-
-/***/ }),
-
-/***/ 76775:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.startKubePortForward = void 0;
-const portForwards_1 = __nccwpck_require__(5368);
-const startKubePortForward = async (podname, localPort, remotePort, namespace) => {
-    const name = `kube/${namespace}/${podname}/${localPort}:${remotePort}`;
-    await (0, portForwards_1.startPortForwardCommand)(name, `kubectl port-forward ${podname} ${localPort}:${remotePort} -n ${namespace}`);
+    const kinds = new Map();
+    for (const { env, componentName } of writes) {
+        const { secretEnvVarKeys, jobOnlyVars } = await (0, getProjectConfig_1.getEnvironment)(env, componentName);
+        [
+            ...secretEnvVarKeys,
+            ...jobOnlyVars.build.secretEnvVarKeys,
+            ...jobOnlyVars.deploy.secretEnvVarKeys,
+        ].forEach(({ key, kind }) => kinds.set((0, pipeline_1.getSecretVarName)(env, componentName, key), kind !== null && kind !== void 0 ? kind : "secret"));
+    }
+    const secrets = writes.flatMap(({ env, componentName, secrets }) => Object.entries(secrets).map(([key, value]) => {
+        var _a;
+        const name = (0, pipeline_1.getSecretVarName)(env, componentName, key);
+        return {
+            name,
+            value: typeof value === "string" ? value : JSON.stringify(value !== null && value !== void 0 ? value : ""),
+            kind: (_a = kinds.get(name)) !== null && _a !== void 0 ? _a : "secret",
+        };
+    }));
+    if (secrets.length === 0) {
+        return;
+    }
+    if (!(await (0, github_1.isGhAuthenticated)())) {
+        io.log("⚠️ github pipeline is enabled, but the github cli (gh) is not authenticated — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    const repo = await (0, github_2.getConfiguredGithubRepo)();
+    if (!repo) {
+        io.log("⚠️ github pipeline is enabled, but no github repository was found — run `project secrets-sync-github` later to mirror the secrets");
+        return;
+    }
+    io.log(`mirroring ${secrets.length} secrets to github ('${repo}')...`);
+    await (0, github_2.pushSecretsToGithub)(io, repo, secrets, await (0, github_2.collectSecretTargets)(config));
 };
-exports.startKubePortForward = startKubePortForward;
-//# sourceMappingURL=portForward.js.map
-
-/***/ }),
-
-/***/ 55689:
-/***/ ((__unused_webpack_module, exports) => {
-
-"use strict";
-
-// we can't import the package.json directly, because the bundling process will inline it
-// but the version is only set during deployement, when its already bundled
-// instead we need to use require.main.path to get the path of the main module, which is actually the file in the bin
-// this will point to the root package.json
-var _a;
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-const path = ((_a = require.main) === null || _a === void 0 ? void 0 : _a.path) + "/../package.json";
-const ownPkg = require(path);
-exports["default"] = ownPkg;
-//# sourceMappingURL=packageInfos.js.map
+//# sourceMappingURL=writeSecrets.js.map
 
 /***/ }),
 
@@ -6766,6 +7051,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ghApiJson = exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.listGithubVariableNames = exports.listGithubSecretNames = exports.listGithubEnvironments = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = __nccwpck_require__(35317);
 const util_1 = __nccwpck_require__(39023);
+const pipeline_1 = __nccwpck_require__(53695);
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * whether the github cli (gh) is installed and authenticated
@@ -6788,8 +7074,7 @@ exports.isGhAuthenticated = isGhAuthenticated;
 const getGithubRepoFromRemote = async (remoteName) => {
     try {
         const { stdout } = await execFile("git", ["remote", "get-url", remoteName]);
-        const match = stdout.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/);
-        return match === null || match === void 0 ? void 0 : match[1];
+        return (0, pipeline_1.parseGithubRepoFromRemoteUrl)(stdout);
     }
     catch (_a) {
         return undefined;
@@ -6910,7 +7195,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
+exports.upsertAllVariables = exports.clearBackups = exports.getVariableValueByRawName = exports.getAllVariables = exports.getProjectInfo = exports.doGitlabRequestAllPages = exports.doGitlabRequest = exports.GitlabNotFoundError = exports.getGitlabToken = exports.setupGitlabToken = exports.hasGitlabToken = void 0;
 const pipeline_1 = __nccwpck_require__(53695);
 const lodash_es_1 = __nccwpck_require__(50210);
 const memoizee_1 = __importDefault(__nccwpck_require__(6575));
@@ -6962,6 +7247,20 @@ const getGitlabToken = async (io) => {
     return (0, preferences_1.getPreference)(TOKEN_KEY);
 };
 exports.getGitlabToken = getGitlabToken;
+/**
+ * a gitlab api call that came back 404. Carries the path so a caller
+ * that wants to treat "does not exist yet" as normal can say so
+ * (`instanceof`) instead of matching on a message.
+ */
+class GitlabNotFoundError extends Error {
+    constructor(path, host) {
+        super(`gitlab api: ${path} not found on ${host}`);
+        this.path = path;
+        this.host = host;
+        this.name = "GitlabNotFoundError";
+    }
+}
+exports.GitlabNotFoundError = GitlabNotFoundError;
 const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
     const [rootToken, { gitRemoteHost }] = await Promise.all([
         (0, exports.getGitlabToken)(io),
@@ -6983,7 +7282,7 @@ const doGitlabRequest = async (io, path, data = undefined, method = "GET") => {
         return null;
     }
     if (result.status === 404) {
-        throw new Error("not found");
+        throw new GitlabNotFoundError(path, gitRemoteHost);
     }
     throw new Error(`Could not send request to gitlab api ${path}: ${result.status} "${result.statusText}".\nResponse: ${JSON.stringify(await result.json(), null, 2)}`);
 };
@@ -7009,9 +7308,20 @@ const doGitlabRequestAllPages = async (io, path) => {
 };
 exports.doGitlabRequestAllPages = doGitlabRequestAllPages;
 const getProjectInfo = async (io) => {
-    const { gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
-    const project = await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
-    return project;
+    const { gitRemoteHost, gitRemotePath } = await (0, gitProjectInformation_1.getGitRemoteHostAndPath)();
+    try {
+        return await (0, exports.doGitlabRequest)(io, `projects/${encodeURIComponent(gitRemotePath)}`);
+    }
+    catch (e) {
+        if (e instanceof GitlabNotFoundError) {
+            // the classic: the remote is not a gitlab at all (a github one,
+            // say), so the request goes to a host without /api/v4 and every
+            // path answers 404
+            throw new Error(`no gitlab project '${gitRemotePath}' on '${gitRemoteHost}'. ` +
+                "Check the git remote and `pipelines` in catladder.ts — this command talks to the gitlab api.");
+        }
+        throw e;
+    }
 };
 exports.getProjectInfo = getProjectInfo;
 exports.getAllVariables = (0, memoizee_1.default)(async (io, n = 5) => {
@@ -7566,7 +7876,14 @@ class BitwardenVault {
         }
         return secrets;
     }
+    /**
+     * upserts into the item's yaml note. The note is rewritten as a
+     * whole, so the values that are not part of this write have to be
+     * carried over — a single-key write (`secrets-set`, a credential
+     * provisioned by `project setup`) must not drop the rest.
+     */
     async writeSecrets(io, env, componentName, secrets) {
+        var _a;
         const { config, collectionName } = this;
         const bwSession = await this.session(io);
         const collection = await findCollection(bwSession, collectionName);
@@ -7579,7 +7896,10 @@ class BitwardenVault {
             "--search",
             name,
         ])).find((item) => item.name === name);
-        const notes = (0, yaml_1.stringify)(secrets);
+        const previous = (existing === null || existing === void 0 ? void 0 : existing.notes)
+            ? ((_a = (0, yaml_1.parse)(existing.notes)) !== null && _a !== void 0 ? _a : {})
+            : {};
+        const notes = (0, yaml_1.stringify)({ ...previous, ...secrets });
         if (existing) {
             await (0, bw_1.runBw)(bwSession, [
                 "edit",
@@ -7633,8 +7953,9 @@ class GitlabVault {
         const variables = await (0, gitlab_1.getAllVariables)(io);
         return Object.fromEntries(variables.map((v) => [v.key, v.value]));
     }
-    async writeSecrets(io, env, componentName, secrets) {
-        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName);
+    async writeSecrets(io, env, componentName, secrets, options = {}) {
+        var _a;
+        await (0, gitlab_1.upsertAllVariables)(io, secrets, env, componentName, (_a = options.backup) !== null && _a !== void 0 ? _a : true);
     }
 }
 exports.GitlabVault = GitlabVault;
@@ -7720,11 +8041,11 @@ class VaultManager {
      * writes secrets of one env/component to the vault and updates the
      * local cache (write-through, "local" env only)
      */
-    async writeSecrets(env, componentName, secrets, io = this.io) {
+    async writeSecrets(env, componentName, secrets, io = this.io, options = {}) {
         if (!io) {
             throw new Error("writing to the vault requires an interactive context");
         }
-        await this.vault.writeSecrets(io, env, componentName, secrets);
+        await this.vault.writeSecrets(io, env, componentName, secrets, options);
         if (env === CACHED_ENV) {
             await (0, cache_1.updateSecretsCache)(this.vault.id, env, componentName, Object.fromEntries(Object.entries(secrets).map(([key, value]) => [
                 key,
@@ -8723,6 +9044,43 @@ exports.getAgentSkillTargets = getAgentSkillTargets;
 
 /***/ }),
 
+/***/ 72792:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getPinLabelRegexSource = exports.getAutoStopConfig = exports.DEFAULT_PIN_LABEL = exports.DEFAULT_DEV_AUTO_STOP = exports.DEFAULT_REVIEW_AUTO_STOP = exports.REVIEW_AUTO_STOP_VARIABLE = void 0;
+const lodash_es_1 = __nccwpck_require__(50210);
+/**
+ * pipeline-level variable holding the `auto_stop_in` of review
+ * environments. Review deploy jobs reference it instead of a literal,
+ * so the pin label's workflow rule can override it to `never` for the
+ * whole pipeline (all components at once).
+ */
+exports.REVIEW_AUTO_STOP_VARIABLE = "CL_REVIEW_AUTO_STOP";
+exports.DEFAULT_REVIEW_AUTO_STOP = "1 week";
+exports.DEFAULT_DEV_AUTO_STOP = "4 weeks";
+exports.DEFAULT_PIN_LABEL = "catladder::pin-review";
+const getAutoStopConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f;
+    return ({
+        review: (_b = (_a = config.autoStop) === null || _a === void 0 ? void 0 : _a.review) !== null && _b !== void 0 ? _b : exports.DEFAULT_REVIEW_AUTO_STOP,
+        dev: (_d = (_c = config.autoStop) === null || _c === void 0 ? void 0 : _c.dev) !== null && _d !== void 0 ? _d : exports.DEFAULT_DEV_AUTO_STOP,
+        pinLabel: (_f = (_e = config.autoStop) === null || _e === void 0 ? void 0 : _e.pinLabel) !== null && _f !== void 0 ? _f : exports.DEFAULT_PIN_LABEL,
+    });
+};
+exports.getAutoStopConfig = getAutoStopConfig;
+/**
+ * matches the pin label inside `$CI_MERGE_REQUEST_LABELS`
+ * (comma-separated) — anchored so `pin` never matches `no-pin`
+ */
+const getPinLabelRegexSource = (pinLabel) => `(^|,)${(0, lodash_es_1.escapeRegExp)(pinLabel).replaceAll("/", "\\/")}(,|$)`;
+exports.getPinLabelRegexSource = getPinLabelRegexSource;
+//# sourceMappingURL=autoStop.js.map
+
+/***/ }),
+
 /***/ 48476:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -8735,6 +9093,7 @@ const path_1 = __nccwpck_require__(16928);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const config_1 = __nccwpck_require__(75591);
 const ciVariables_1 = __nccwpck_require__(17300);
+const registryImage_1 = __nccwpck_require__(24333);
 const index_1 = __nccwpck_require__(62853);
 const createGithubJobs_1 = __nccwpck_require__(73474);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
@@ -8788,7 +9147,10 @@ class GithubBackend {
         await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, { recursive: true, force: true });
     }
     async createFiles(config) {
-        const images = this.createImagesPlan(config);
+        // ghcr rejects uppercase image paths, and `${{ github.repository }}`
+        // interpolates github's display casing — a mixed-case owner or repo
+        // needs a lowercased literal instead (see ./ghcr)
+        const images = this.createImagesPlan(config, await (0, registryImage_1.resolveGithubRegistryImage)(config));
         const scripts = new scriptFiles_1.GithubScriptFiles();
         const workflows = await this.createWorkflows(config, images, scripts);
         return [
@@ -8803,8 +9165,8 @@ class GithubBackend {
             ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
         ];
     }
-    createImagesPlan(config) {
-        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
+    createImagesPlan(config, registryImage) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images, registryImage);
     }
     /**
      * all workflows keyed by file name, mainly for testing purposes
@@ -8813,9 +9175,11 @@ class GithubBackend {
         var _a, _b, _c, _d;
         const workflows = {};
         // per-pipeline-type variables (pipelines.github.runnerVariables);
-        // workflow-level env, so job-level runnerVariables take precedence
+        // workflow-level env, so job-level runnerVariables take precedence.
+        // The images plan is the single source of the ghcr namespace, so the
+        // workflow env and the container images can never disagree.
         const workflowEnv = {
-            ...ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
+            ...(0, ciVariables_1.getGithubInjectedWorkflowEnv)(images.registryImageRef()),
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
         const reviewStopJobs = {};
@@ -9158,12 +9522,13 @@ exports.makeAggregateCheckJob = makeAggregateCheckJob;
 /***/ }),
 
 /***/ 17300:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.GITHUB_INJECTED_WORKFLOW_ENV = exports.GITHUB_CI_VARIABLES = void 0;
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = exports.getGithubInjectedWorkflowEnv = exports.GITHUB_CI_VARIABLES = void 0;
+const ghcr_1 = __nccwpck_require__(59011);
 /**
  * how the github backend names the predefined CI variables.
  *
@@ -9184,16 +9549,28 @@ exports.GITHUB_CI_VARIABLES = {
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
- * variables referenced by {@link GITHUB_CI_VARIABLES}
+ * variables referenced by {@link GITHUB_CI_VARIABLES}.
+ *
+ * `registryImage` is the ghcr namespace to push to — the actions
+ * expression for an all-lowercase repository, a lowercased literal for
+ * a mixed-case one (see `./ghcr`).
  */
-exports.GITHUB_INJECTED_WORKFLOW_ENV = {
+const getGithubInjectedWorkflowEnv = (registryImage = ghcr_1.GHCR_REPOSITORY_EXPRESSION) => ({
     CL_JOB_TOKEN: "${{ github.token }}",
     CL_REGISTRY: "ghcr.io",
-    CL_REGISTRY_IMAGE: "ghcr.io/${{ github.repository }}",
+    CL_REGISTRY_IMAGE: registryImage,
     CL_REGISTRY_USER: "${{ github.actor }}",
     // empty outside of pull request events
     CL_PR_NUMBER: "${{ github.event.number }}",
-};
+});
+exports.getGithubInjectedWorkflowEnv = getGithubInjectedWorkflowEnv;
+/**
+ * the names of the injected workflow-level env — the values differ per
+ * repository (see {@link getGithubInjectedWorkflowEnv}), the names never
+ * do, so lookups that only ask "does the workflow already provide this?"
+ * use this instead.
+ */
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = new Set(Object.keys((0, exports.getGithubInjectedWorkflowEnv)()));
 //# sourceMappingURL=ciVariables.js.map
 
 /***/ }),
@@ -9420,7 +9797,7 @@ const getSecretsEnv = (context, kinds) => {
  */
 const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)]
     .map((match) => match[1])
-    .filter((name) => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV))
+    .filter((name) => !ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV_NAMES.has(name))
     .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j;
@@ -9684,6 +10061,53 @@ exports.makeEnsureImageGithubJobs = makeEnsureImageGithubJobs;
 
 /***/ }),
 
+/***/ 59011:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.toGhcrRegistryImage = exports.parseGithubRepoFromRemoteUrl = exports.GHCR_REPOSITORY_EXPRESSION = void 0;
+/**
+ * the ghcr namespace expressed through the actions context — portable
+ * across forks, and what every all-lowercase repository keeps using
+ */
+exports.GHCR_REPOSITORY_EXPRESSION = "ghcr.io/${{ github.repository }}";
+/**
+ * parses `owner/name` out of a github remote url (ssh or https, with or
+ * without the `.git` suffix).
+ *
+ * Shared with the cli (`apps/cli/src/utils/github.ts`) so the two can't
+ * drift apart.
+ */
+const parseGithubRepoFromRemoteUrl = (url) => { var _a; return (_a = url.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/)) === null || _a === void 0 ? void 0 : _a[1]; };
+exports.parseGithubRepoFromRemoteUrl = parseGithubRepoFromRemoteUrl;
+/**
+ * the ghcr image prefix for an `owner/name` repository.
+ *
+ * The OCI distribution spec only allows `[a-z0-9]` plus `.`, `_` and `-`
+ * separators in a repository name, so a mixed-case owner or repo (very
+ * common for org logins: `AcmeCorp`, …) makes the docker client reject
+ * every tag before it even reaches the network. Lowercasing is not a
+ * workaround: the org `AcmeCorp` owns the namespace `ghcr.io/acmecorp`,
+ * so the lowercased path is the correct address.
+ *
+ * Returns the `${{ github.repository }}` expression when lowercasing
+ * would change nothing — it is equivalent for those repositories, and
+ * unlike a literal it keeps working in a fork (whose token can only
+ * push to the fork's own namespace).
+ */
+const toGhcrRegistryImage = (repository) => {
+    const lowercased = repository.toLowerCase();
+    return lowercased === repository
+        ? exports.GHCR_REPOSITORY_EXPRESSION
+        : `ghcr.io/${lowercased}`;
+};
+exports.toGhcrRegistryImage = toGhcrRegistryImage;
+//# sourceMappingURL=ghcr.js.map
+
+/***/ }),
+
 /***/ 25073:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -9993,12 +10417,70 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(48476), exports);
 __exportStar(__nccwpck_require__(17300), exports);
+__exportStar(__nccwpck_require__(59011), exports);
+__exportStar(__nccwpck_require__(24333), exports);
 __exportStar(__nccwpck_require__(61071), exports);
 __exportStar(__nccwpck_require__(82145), exports);
 //# sourceMappingURL=index.js.map
 
 /***/ }),
 
+/***/ 24333:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.resolveGithubRegistryImage = exports.githubRegistryImageFromConfig = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const index_1 = __nccwpck_require__(62853);
+const ghcr_1 = __nccwpck_require__(59011);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * the ghcr image prefix derived from the config alone
+ * (`pipelines.github.repository`), without touching git.
+ *
+ * Used where generation must stay pure and hermetic (tests, examples);
+ * {@link resolveGithubRegistryImage} adds the git remote fallback.
+ */
+const githubRegistryImageFromConfig = (config) => {
+    const { repository } = (0, index_1.getPipelineOptions)(config, "github");
+    return repository ? (0, ghcr_1.toGhcrRegistryImage)(repository) : undefined;
+};
+exports.githubRegistryImageFromConfig = githubRegistryImageFromConfig;
+/**
+ * the ghcr image prefix to generate with: the configured repository, or
+ * the one the github git remote points at.
+ *
+ * Falls back to the `${{ github.repository }}` expression when the
+ * remote is unavailable (a checkout without the remote, a tarball, …).
+ * That is the pre-existing behavior and correct for every all-lowercase
+ * repository; `project doctor` catches the mixed-case case it is not
+ * correct for.
+ */
+const resolveGithubRegistryImage = async (config) => {
+    const fromConfig = (0, exports.githubRegistryImageFromConfig)(config);
+    if (fromConfig) {
+        return fromConfig;
+    }
+    const remote = (0, index_1.getPipelineGitRemote)(config, "github");
+    try {
+        const { stdout } = await execFile("git", ["remote", "get-url", remote]);
+        const repository = (0, ghcr_1.parseGithubRepoFromRemoteUrl)(stdout);
+        return repository
+            ? (0, ghcr_1.toGhcrRegistryImage)(repository)
+            : ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+    catch (_a) {
+        return ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+};
+exports.resolveGithubRegistryImage = resolveGithubRegistryImage;
+//# sourceMappingURL=registryImage.js.map
+
+/***/ }),
+
 /***/ 61071:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -10101,6 +10583,7 @@ exports.GitlabBackend = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
+const autoStop_1 = __nccwpck_require__(72792);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
 const shippedCatci_1 = __nccwpck_require__(27967);
@@ -10286,6 +10769,7 @@ class GitlabBackend {
                 // per-pipeline-type variables (pipelines.gitlab.runnerVariables)
                 ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
             },
+            autoStop: (0, autoStop_1.getAutoStopConfig)(config),
         });
     }
 }
@@ -10730,6 +11214,7 @@ function getGitlabNeedsForWorkspaceJob(context, { needs }, allJobs) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createGitlabPipelineWithDefaults = void 0;
 const bash_1 = __nccwpck_require__(94143);
+const autoStop_1 = __nccwpck_require__(72792);
 const rules_1 = __nccwpck_require__(78503);
 /**
  * gitlab requires a top-level default image for jobs that don't set their
@@ -10738,7 +11223,8 @@ const rules_1 = __nccwpck_require__(78503);
  * build-free image (a catladder job image would drag in a build job).
  */
 const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...config }) => {
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, autoStop, ...config }) => {
+    const pinLabel = autoStop && autoStop.pinLabel;
     return {
         image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
         variables: {
@@ -10747,6 +11233,10 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
             CACHE_COMPRESSION_LEVEL: "fast", // same as above, but for caches
             TRANSFER_METER_FREQUENCY: "5s", // how often we should update the transfer meter for cache upload/download
             GIT_DEPTH: "1", // no need the full depth
+            // review env lifetime — the pin-label workflow rule below
+            // overrides this to "never" (workflow rule variables take
+            // precedence over pipeline-level variables)
+            ...(pinLabel ? { [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: autoStop.review } : {}),
             ...(variables !== null && variables !== void 0 ? variables : {}),
         },
         before_script: [
@@ -10763,6 +11253,20 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, ...
                         PIPELINE_NAME: "Thinking...",
                     },
                 },
+                // pinned MRs (rules stop at the first match, so this must come
+                // before the plain merge-request rule)
+                ...(pinLabel
+                    ? [
+                        {
+                            if: `${rules_1.RULE_IS_MERGE_REQUEST.if} && $CI_MERGE_REQUEST_LABELS =~ /${(0, autoStop_1.getPinLabelRegexSource)(pinLabel)}/`,
+                            variables: {
+                                PIPELINE_ICON: "🐱📌",
+                                PIPELINE_NAME: "mr$CI_MERGE_REQUEST_IID - $CI_MERGE_REQUEST_TITLE",
+                                [autoStop_1.REVIEW_AUTO_STOP_VARIABLE]: "never",
+                            },
+                        },
+                    ]
+                    : []),
                 {
                     if: rules_1.RULE_IS_MERGE_REQUEST.if,
                     variables: {
@@ -14086,6 +14590,7 @@ exports.JobImagesPlan = exports.PROJECT_IMAGES_FOLDER = exports.GENERATED_IMAGES
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const ciVariables_1 = __nccwpck_require__(91215);
+const ghcr_1 = __nccwpck_require__(59011);
 const docker_1 = __nccwpck_require__(12354);
 const runner_1 = __nccwpck_require__(92146);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -14146,9 +14651,16 @@ exports.PROJECT_IMAGES_FOLDER = `${exports.GENERATED_IMAGES_FOLDER}/project`;
  * Reference-driven: only images actually used by a job are built.
  */
 class JobImagesPlan {
-    constructor(pipelineType, projectImages = {}) {
+    constructor(pipelineType, projectImages = {}, 
+    /**
+     * the registry image prefix to generate with, overriding the
+     * pipeline type's default. On github this carries the lowercased
+     * ghcr namespace (see `resolveGithubRegistryImage`).
+     */
+    registryImage) {
         this.pipelineType = pipelineType;
         this.projectImages = projectImages;
+        this.registryImage = registryImage;
         this.used = new Map();
         this.usedProject = new Map();
     }
@@ -14173,11 +14685,14 @@ class JobImagesPlan {
     }
     /**
      * the registry image prefix. On github, container images can't use
-     * runtime env vars — the expression form is required.
+     * runtime env vars — a literal or an actions expression is required.
      */
     registryImageRef() {
+        if (this.registryImage) {
+            return this.registryImage;
+        }
         return this.pipelineType === "github"
-            ? "ghcr.io/${{ github.repository }}"
+            ? ghcr_1.GHCR_REPOSITORY_EXPRESSION
             : `${(0, ciVariables_1.getCiVariable)({ pipelineType: this.pipelineType }, "registryImage")}`;
     }
     useProject(name) {
@@ -14477,6 +14992,7 @@ const docker_1 = __nccwpck_require__(12354);
 const context_1 = __nccwpck_require__(73938);
 const jobs_1 = __nccwpck_require__(98521);
 const utils_1 = __nccwpck_require__(71286);
+const autoStop_1 = __nccwpck_require__(72792);
 const stop_1 = __nccwpck_require__(35937);
 const variables_1 = __nccwpck_require__(54768);
 exports.DEPLOY_JOB_NAME = "🚀 Deploy";
@@ -14485,10 +15001,15 @@ class DeployJob extends jobs_1.CatladderJob {
         var _a, _b, _c, _d, _e, _f, _g;
         const hasDocker = (0, docker_1.requiresDockerBuild)(context);
         const isStoppable = (0, utils_1.contextIsStoppable)(context);
+        const autoStopConfig = (0, autoStop_1.getAutoStopConfig)(context.fullConfig);
         const autoStop = context.environment.envType === "review"
-            ? "1 week"
+            ? // review envs read the lifetime from a pipeline variable, so
+                // the pin label's workflow rule can override it to "never"
+                autoStopConfig.pinLabel === false
+                    ? autoStopConfig.review
+                    : `$${autoStop_1.REVIEW_AUTO_STOP_VARIABLE}`
             : context.environment.envType === "dev"
-                ? "4 weeks"
+                ? autoStopConfig.dev
                 : undefined;
         const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
         // if auto or manual is configured explicitly, use that
@@ -17317,6 +17838,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(46734), exports);
+__exportStar(__nccwpck_require__(72792), exports);
 __exportStar(__nccwpck_require__(62853), exports);
 __exportStar(__nccwpck_require__(63557), exports);
 __exportStar(__nccwpck_require__(78503), exports);