@catladder/cli 5.1.0 → 5.1.2

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubImageCasing.d.ts

@@ -0,0 +1,15 @@
+import type { Config } from "../../../../../../../../packages/pipeline/src/index.js";
+import type { DoctorReport } from "./DoctorReport";
+/**
+ * ghcr image paths must be lowercase, but `${{ github.repository }}`
+ * interpolates github's display casing — so a repository whose owner or
+ * name contains an uppercase character needs a lowercased literal in the
+ * generated workflows. Generation bakes that in, which means committed
+ * workflows generated by an older catladder (or hand-edited ones) still
+ * carry the expression and fail every docker job with
+ * `repository name must be lowercase`.
+ *
+ * Unlike the rest of the github checks this needs no `gh` login — only
+ * the git remote and the committed files.
+ */
+export declare const checkGithubImageCasing: (report: DoctorReport, config: Config) => Promise<void>;

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubImageCasing.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkGithubImageCasing = void 0;
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.js");
+const secrets_1 = require("../../../../../secrets");
+const WORKFLOWS_FOLDER = ".github/workflows";
+const GENERATED_FILE_PREFIX = "catladder-";
+/**
+ * the generated workflow files, or an empty list when none exist yet
+ */
+const readGeneratedWorkflows = async () => {
+    const entries = await (0, promises_1.readdir)(WORKFLOWS_FOLDER).catch(() => []);
+    return Promise.all(entries
+        .filter((file) => file.startsWith(GENERATED_FILE_PREFIX))
+        .map((file) => (0, promises_1.readFile)((0, path_1.join)(WORKFLOWS_FOLDER, file), "utf8")));
+};
+/**
+ * ghcr image paths must be lowercase, but `${{ github.repository }}`
+ * interpolates github's display casing — so a repository whose owner or
+ * name contains an uppercase character needs a lowercased literal in the
+ * generated workflows. Generation bakes that in, which means committed
+ * workflows generated by an older catladder (or hand-edited ones) still
+ * carry the expression and fail every docker job with
+ * `repository name must be lowercase`.
+ *
+ * Unlike the rest of the github checks this needs no `gh` login — only
+ * the git remote and the committed files.
+ */
+const checkGithubImageCasing = async (report, config) => {
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("github"))
+        return;
+    const repo = await (0, secrets_1.getConfiguredGithubRepo)();
+    if (!repo || repo === repo.toLowerCase()) {
+        // an all-lowercase repository keeps the expression on purpose (it
+        // stays correct in forks), and an unresolvable remote is reported
+        // by checkGithub already
+        return;
+    }
+    report.section("github image names");
+    const workflows = await readGeneratedWorkflows();
+    if (workflows.length === 0) {
+        report.warn(`no generated workflows in ${WORKFLOWS_FOLDER} to check`, "run: catenv");
+        return;
+    }
+    const stale = workflows.filter((content) => content.includes(pipeline_1.GHCR_REPOSITORY_EXPRESSION));
+    if (stale.length > 0) {
+        report.fail(`'${repo}' is mixed-case, but ${stale.length}/${workflows.length} generated workflows still use ${pipeline_1.GHCR_REPOSITORY_EXPRESSION} — ghcr rejects uppercase image paths, so every docker job fails with "repository name must be lowercase"`, "run: catenv (and commit the regenerated workflows)");
+        return;
+    }
+    const uppercase = workflows.flatMap((content) => [...content.matchAll(/ghcr\.io\/\S*[A-Z]\S*/g)].map(([match]) => match));
+    if (uppercase.length > 0) {
+        report.fail(`uppercase ghcr image paths in the generated workflows: ${[...new Set(uppercase)].join(", ")}`, `run: catenv — if it persists, set pipelines.github.repository (the '${(0, pipeline_1.getPipelineGitRemote)(config, "github")}' remote resolves to '${repo}')`);
+        return;
+    }
+    report.ok(`ghcr image paths lowercased for '${repo}'`);
+};
+exports.checkGithubImageCasing = checkGithubImageCasing;
+//# sourceMappingURL=checkGithubImageCasing.js.map

package/dist/apps/cli/src/apps/cli/commands/project/doctor/checkGithubImageCasing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkGithubImageCasing.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/checkGithubImageCasing.ts"],"names":[],"mappings":";;;AAAA,0CAAgD;AAChD,+BAA4B;AAE5B,kDAI6B;AAC7B,oDAAiE;AAGjE,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAE3C;;GAEG;AACH,MAAM,sBAAsB,GAAG,KAAK,IAAuB,EAAE;IAC3D,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,GAAG,CAChB,OAAO;SACJ,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAA,WAAI,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CACjE,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;GAWG;AACI,MAAM,sBAAsB,GAAG,KAAK,EACzC,MAAoB,EACpB,MAAc,EACd,EAAE;IACF,IAAI,CAAC,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO;IAEhE,MAAM,IAAI,GAAG,MAAM,IAAA,iCAAuB,GAAE,CAAC;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,yBAAyB;QACzB,OAAO;IACT,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAErC,MAAM,SAAS,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,6BAA6B,gBAAgB,WAAW,EACxD,aAAa,CACd,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CACzC,OAAO,CAAC,QAAQ,CAAC,qCAA0B,CAAC,CAC7C,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,IAAI,CACT,IAAI,IAAI,wBAAwB,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,kCAAkC,qCAA0B,2GAA2G,EACvO,oDAAoD,CACrD,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CACxE,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,0DAA0D,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC9F,uEAAuE,IAAA,+BAAoB,EAAC,MAAM,EAAE,QAAQ,CAAC,yBAAyB,IAAI,IAAI,CAC/I,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,CAAC,EAAE,CAAC,oCAAoC,IAAI,GAAG,CAAC,CAAC;AACzD,CAAC,CAAC;AAhDW,QAAA,sBAAsB,0BAgDjC"}

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js

@@ -5,6 +5,7 @@ const pipeline_1 = require("../../../../../../../../packages/pipeline/src/index.
 const getProjectConfig_1 = require("../../../../../config/getProjectConfig");
 const checkCloudRun_1 = require("./checkCloudRun");
 const checkGithub_1 = require("./checkGithub");
+const checkGithubImageCasing_1 = require("./checkGithubImageCasing");
 const checkGitlab_1 = require("./checkGitlab");
 const checkStore_1 = require("./checkStore");
 const DoctorReport_1 = require("./DoctorReport");
@@ -40,6 +41,7 @@ const doctorProject = async (instance, onlyComponents) => {
         await (0, checkGitlab_1.checkGitlab)(instance, report, contexts);
     }
     await (0, checkCloudRun_1.checkCloudRun)(report, contexts);
+    await (0, checkGithubImageCasing_1.checkGithubImageCasing)(report, config);
     await (0, checkGithub_1.checkGithub)(report, config);
     report.summarize();
 };

package/dist/apps/cli/src/apps/cli/commands/project/doctor/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAjCW,QAAA,aAAa,iBAiCxB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../../../src/apps/cli/commands/project/doctor/index.ts"],"names":[],"mappings":";;;AACA,kDAA8D;AAC9D,6EAGgD;AAEhD,mDAAgD;AAChD,+CAA4C;AAC5C,qEAAkE;AAClE,+CAA4C;AAC5C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;;;GAWG;AACI,MAAM,aAAa,GAAG,KAAK,EAChC,QAAY,EACZ,cAAkC,EAClC,EAAE;IACF,MAAM,MAAM,GAAG,MAAM,IAAA,mCAAgB,GAAE,CAAC;IACxC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,GAAG,CACV,oEAAoE,CACrE,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,2BAAY,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAA,uBAAU,EAAC,MAAM,CAAC,CAAC;IAEzB,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,IAAA,yCAAsB,EAAC,cAAc,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,CACT,uCAAuC,CAAC,CAAC,OAAO,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;IAED,IAAI,IAAA,kCAAuB,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,MAAM,IAAA,yBAAW,EAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,IAAA,6BAAa,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAA,+CAAsB,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,IAAA,yBAAW,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAElC,MAAM,CAAC,SAAS,EAAE,CAAC;AACrB,CAAC,CAAC;AAlCW,QAAA,aAAa,iBAkCxB"}

package/dist/apps/cli/src/utils/github.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ghApiJson = exports.ensureGithubEnvironment = exports.setGithubVariable = exports.setGithubSecret = exports.listGithubVariableNames = exports.listGithubSecretNames = exports.listGithubEnvironments = exports.getGithubRepoFromRemote = exports.isGhAuthenticated = void 0;
 const child_process_1 = require("child_process");
 const util_1 = require("util");
+const pipeline_1 = require("../../../../packages/pipeline/src/index.js");
 const execFile = (0, util_1.promisify)(child_process_1.execFile);
 /**
  * whether the github cli (gh) is installed and authenticated
@@ -25,8 +26,7 @@ exports.isGhAuthenticated = isGhAuthenticated;
 const getGithubRepoFromRemote = async (remoteName) => {
     try {
         const { stdout } = await execFile("git", ["remote", "get-url", remoteName]);
-        const match = stdout.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/);
-        return match === null || match === void 0 ? void 0 : match[1];
+        return (0, pipeline_1.parseGithubRepoFromRemoteUrl)(stdout);
     }
     catch (_a) {
         return undefined;

package/dist/apps/cli/src/utils/github.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AAEjC,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CACxB,gDAAgD,CACjD,CAAC;QACF,OAAO,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,CAAC;IACpB,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAZW,QAAA,uBAAuB,2BAYlC;AAEF;;;GAGG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAqB,EAAE;IACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EACvC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC;IACF,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC;AAEF,6DAA6D;AACtD,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAqB,EAAE,CACxE,UAAU,CAAC,SAAS,IAAI,4BAA4B,EAAE,sBAAsB,CAAC,CAAC;AADnE,QAAA,sBAAsB,0BAC6C;AAEhF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,uBAAuB;IACtF,CAAC,CAAC,SAAS,IAAI,+BAA+B,EAChD,iBAAiB,CAClB,CAAC;AATS,QAAA,qBAAqB,yBAS9B;AAEJ,iEAAiE;AAC1D,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,yBAAyB;IACxF,CAAC,CAAC,SAAS,IAAI,iCAAiC,EAClD,mBAAmB,CACpB,CAAC;AATS,QAAA,uBAAuB,2BAShC;AAEJ,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAL/D,QAAA,eAAe,mBAKgD;AAE5E;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AALjE,QAAA,iBAAiB,qBAKgD;AAE9E;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAY,EACZ,WAAmB,EACJ,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,KAAK;QACL,IAAI;QACJ,KAAK;QACL,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;KAChE,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CACtE,CACF,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AA3BQ,QAAA,uBAAuB,2BA2B/B;AAEL,+EAA+E;AACxE,MAAM,SAAS,GAAG,KAAK,EAC5B,MAAmD,EACnD,IAAY,EACZ,IAAc,EACF,EAAE;;IACd,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,EAAE,CAAC;QACT,MAAA,KAAK,CAAC,KAAK,0CAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;YACR,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,SAAe,CAAC;YACzD,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/D,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AA3BW,QAAA,SAAS,aA2BpB"}
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../../../src/utils/github.ts"],"names":[],"mappings":";;;AAAA,iDAA8D;AAC9D,+BAAiC;AACjC,kDAAmE;AAEnE,MAAM,QAAQ,GAAG,IAAA,gBAAS,EAAC,wBAAU,CAAC,CAAC;AAEvC;;GAEG;AACI,MAAM,iBAAiB,GAAG,KAAK,IAAsB,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAPW,QAAA,iBAAiB,qBAO5B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,UAAkB,EACW,EAAE;IAC/B,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAA,uCAA4B,EAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AATW,QAAA,uBAAuB,2BASlC;AAEF;;;GAGG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAqB,EAAE;IACvE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAC/B,IAAI,EACJ,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EACvC,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAChC,CAAC;IACF,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC,CAAC;AAEF,6DAA6D;AACtD,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAqB,EAAE,CACxE,UAAU,CAAC,SAAS,IAAI,4BAA4B,EAAE,sBAAsB,CAAC,CAAC;AADnE,QAAA,sBAAsB,0BAC6C;AAEhF;;;;GAIG;AACI,MAAM,qBAAqB,GAAG,CACnC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,uBAAuB;IACtF,CAAC,CAAC,SAAS,IAAI,+BAA+B,EAChD,iBAAiB,CAClB,CAAC;AATS,QAAA,qBAAqB,yBAS9B;AAEJ,iEAAiE;AAC1D,MAAM,uBAAuB,GAAG,CACrC,IAAY,EACZ,WAAoB,EACD,EAAE,CACrB,UAAU,CACR,WAAW;IACT,CAAC,CAAC,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,yBAAyB;IACxF,CAAC,CAAC,SAAS,IAAI,iCAAiC,EAClD,mBAAmB,CACpB,CAAC;AATS,QAAA,uBAAuB,2BAShC;AAEJ,MAAM,aAAa,GAAG,CACpB,IAA2B,EAC3B,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,IAAI;QACJ,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,EACD,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACzE,CAAC;IACF,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC,CAAC,CAAC;AAEL;;;GAGG;AACI,MAAM,eAAe,GAAG,KAAK,EAClC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AAL/D,QAAA,eAAe,mBAKgD;AAE5E;;;GAGG;AACI,MAAM,iBAAiB,GAAG,KAAK,EACpC,IAAY,EACZ,IAAY,EACZ,KAAa,EACb,WAAoB,EACL,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;AALjE,QAAA,iBAAiB,qBAKgD;AAE9E;;;GAGG;AACI,MAAM,uBAAuB,GAAG,KAAK,EAC1C,IAAY,EACZ,WAAmB,EACJ,EAAE,CACjB,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;;IACpC,MAAM,KAAK,GAAG,IAAA,qBAAK,EACjB,IAAI,EACJ;QACE,KAAK;QACL,IAAI;QACJ,KAAK;QACL,SAAS,IAAI,iBAAiB,kBAAkB,CAAC,WAAW,CAAC,EAAE;KAChE,EACD,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CACxC,CAAC;IACF,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;QACR,CAAC,CAAC,OAAO,EAAE;QACX,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CACP,+BAA+B,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CACtE,CACF,CACN,CAAC;AACJ,CAAC,CAAC,CAAC;AA3BQ,QAAA,uBAAuB,2BA2B/B;AAEL,+EAA+E;AACxE,MAAM,SAAS,GAAG,KAAK,EAC5B,MAAmD,EACnD,IAAY,EACZ,IAAc,EACF,EAAE;;IACd,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;QACtE,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClD,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,MAAA,KAAK,CAAC,MAAM,0CAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,EAAE,CAAC;QACT,MAAA,KAAK,CAAC,KAAK,0CAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAA,KAAK,CAAC,KAAK,0CAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;YACR,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,SAAe,CAAC;YACzD,CAAC,CAAC,MAAM,CACJ,IAAI,KAAK,CAAC,UAAU,MAAM,IAAI,IAAI,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAC/D,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AA3BW,QAAA,SAAS,aA2BpB"}

package/dist/bundles/catenv/index.js

@@ -2642,6 +2642,7 @@ const path_1 = __nccwpck_require__(16928);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const config_1 = __nccwpck_require__(75591);
 const ciVariables_1 = __nccwpck_require__(17300);
+const registryImage_1 = __nccwpck_require__(24333);
 const index_1 = __nccwpck_require__(62853);
 const createGithubJobs_1 = __nccwpck_require__(73474);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
@@ -2695,7 +2696,10 @@ class GithubBackend {
         await (0, promises_1.rm)(scriptFiles_1.GITHUB_SCRIPTS_FOLDER, { recursive: true, force: true });
     }
     async createFiles(config) {
-        const images = this.createImagesPlan(config);
+        // ghcr rejects uppercase image paths, and `${{ github.repository }}`
+        // interpolates github's display casing — a mixed-case owner or repo
+        // needs a lowercased literal instead (see ./ghcr)
+        const images = this.createImagesPlan(config, await (0, registryImage_1.resolveGithubRegistryImage)(config));
         const scripts = new scriptFiles_1.GithubScriptFiles();
         const workflows = await this.createWorkflows(config, images, scripts);
         return [
@@ -2710,8 +2714,8 @@ class GithubBackend {
             ...(0, shippedCatci_1.getCatciGeneratedFiles)(),
         ];
     }
-    createImagesPlan(config) {
-        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images);
+    createImagesPlan(config, registryImage) {
+        return new jobImagesPlan_1.JobImagesPlan(this.type, config.images, registryImage);
     }
     /**
      * all workflows keyed by file name, mainly for testing purposes
@@ -2720,9 +2724,11 @@ class GithubBackend {
         var _a, _b, _c, _d;
         const workflows = {};
         // per-pipeline-type variables (pipelines.github.runnerVariables);
-        // workflow-level env, so job-level runnerVariables take precedence
+        // workflow-level env, so job-level runnerVariables take precedence.
+        // The images plan is the single source of the ghcr namespace, so the
+        // workflow env and the container images can never disagree.
         const workflowEnv = {
-            ...ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV,
+            ...(0, ciVariables_1.getGithubInjectedWorkflowEnv)(images.registryImageRef()),
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
         const reviewStopJobs = {};
@@ -3065,12 +3071,13 @@ exports.makeAggregateCheckJob = makeAggregateCheckJob;
 /***/ }),
 
 /***/ 17300:
-/***/ ((__unused_webpack_module, exports) => {
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.GITHUB_INJECTED_WORKFLOW_ENV = exports.GITHUB_CI_VARIABLES = void 0;
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = exports.getGithubInjectedWorkflowEnv = exports.GITHUB_CI_VARIABLES = void 0;
+const ghcr_1 = __nccwpck_require__(59011);
 /**
  * how the github backend names the predefined CI variables.
  *
@@ -3091,16 +3098,28 @@ exports.GITHUB_CI_VARIABLES = {
 };
 /**
  * the workflow-level env the backend injects to provide the CL_*
- * variables referenced by {@link GITHUB_CI_VARIABLES}
+ * variables referenced by {@link GITHUB_CI_VARIABLES}.
+ *
+ * `registryImage` is the ghcr namespace to push to — the actions
+ * expression for an all-lowercase repository, a lowercased literal for
+ * a mixed-case one (see `./ghcr`).
  */
-exports.GITHUB_INJECTED_WORKFLOW_ENV = {
+const getGithubInjectedWorkflowEnv = (registryImage = ghcr_1.GHCR_REPOSITORY_EXPRESSION) => ({
     CL_JOB_TOKEN: "${{ github.token }}",
     CL_REGISTRY: "ghcr.io",
-    CL_REGISTRY_IMAGE: "ghcr.io/${{ github.repository }}",
+    CL_REGISTRY_IMAGE: registryImage,
     CL_REGISTRY_USER: "${{ github.actor }}",
     // empty outside of pull request events
     CL_PR_NUMBER: "${{ github.event.number }}",
-};
+});
+exports.getGithubInjectedWorkflowEnv = getGithubInjectedWorkflowEnv;
+/**
+ * the names of the injected workflow-level env — the values differ per
+ * repository (see {@link getGithubInjectedWorkflowEnv}), the names never
+ * do, so lookups that only ask "does the workflow already provide this?"
+ * use this instead.
+ */
+exports.GITHUB_INJECTED_WORKFLOW_ENV_NAMES = new Set(Object.keys((0, exports.getGithubInjectedWorkflowEnv)()));
 //# sourceMappingURL=ciVariables.js.map
 
 /***/ }),
@@ -3327,7 +3346,7 @@ const getSecretsEnv = (context, kinds) => {
  */
 const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script.matchAll(/\$\{?(CL_[A-Za-z0-9_]+)\}?/g)]
     .map((match) => match[1])
-    .filter((name) => !(name in ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV))
+    .filter((name) => !ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV_NAMES.has(name))
     .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
     var _a, _b, _c, _d, _e, _f, _g, _h, _j;
@@ -3591,6 +3610,53 @@ exports.makeEnsureImageGithubJobs = makeEnsureImageGithubJobs;
 
 /***/ }),
 
+/***/ 59011:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.toGhcrRegistryImage = exports.parseGithubRepoFromRemoteUrl = exports.GHCR_REPOSITORY_EXPRESSION = void 0;
+/**
+ * the ghcr namespace expressed through the actions context — portable
+ * across forks, and what every all-lowercase repository keeps using
+ */
+exports.GHCR_REPOSITORY_EXPRESSION = "ghcr.io/${{ github.repository }}";
+/**
+ * parses `owner/name` out of a github remote url (ssh or https, with or
+ * without the `.git` suffix).
+ *
+ * Shared with the cli (`apps/cli/src/utils/github.ts`) so the two can't
+ * drift apart.
+ */
+const parseGithubRepoFromRemoteUrl = (url) => { var _a; return (_a = url.match(/github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/)) === null || _a === void 0 ? void 0 : _a[1]; };
+exports.parseGithubRepoFromRemoteUrl = parseGithubRepoFromRemoteUrl;
+/**
+ * the ghcr image prefix for an `owner/name` repository.
+ *
+ * The OCI distribution spec only allows `[a-z0-9]` plus `.`, `_` and `-`
+ * separators in a repository name, so a mixed-case owner or repo (very
+ * common for org logins: `AcmeCorp`, …) makes the docker client reject
+ * every tag before it even reaches the network. Lowercasing is not a
+ * workaround: the org `AcmeCorp` owns the namespace `ghcr.io/acmecorp`,
+ * so the lowercased path is the correct address.
+ *
+ * Returns the `${{ github.repository }}` expression when lowercasing
+ * would change nothing — it is equivalent for those repositories, and
+ * unlike a literal it keeps working in a fork (whose token can only
+ * push to the fork's own namespace).
+ */
+const toGhcrRegistryImage = (repository) => {
+    const lowercased = repository.toLowerCase();
+    return lowercased === repository
+        ? exports.GHCR_REPOSITORY_EXPRESSION
+        : `ghcr.io/${lowercased}`;
+};
+exports.toGhcrRegistryImage = toGhcrRegistryImage;
+//# sourceMappingURL=ghcr.js.map
+
+/***/ }),
+
 /***/ 25073:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -3900,12 +3966,70 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(48476), exports);
 __exportStar(__nccwpck_require__(17300), exports);
+__exportStar(__nccwpck_require__(59011), exports);
+__exportStar(__nccwpck_require__(24333), exports);
 __exportStar(__nccwpck_require__(61071), exports);
 __exportStar(__nccwpck_require__(82145), exports);
 //# sourceMappingURL=index.js.map
 
 /***/ }),
 
+/***/ 24333:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.resolveGithubRegistryImage = exports.githubRegistryImageFromConfig = void 0;
+const child_process_1 = __nccwpck_require__(35317);
+const util_1 = __nccwpck_require__(39023);
+const index_1 = __nccwpck_require__(62853);
+const ghcr_1 = __nccwpck_require__(59011);
+const execFile = (0, util_1.promisify)(child_process_1.execFile);
+/**
+ * the ghcr image prefix derived from the config alone
+ * (`pipelines.github.repository`), without touching git.
+ *
+ * Used where generation must stay pure and hermetic (tests, examples);
+ * {@link resolveGithubRegistryImage} adds the git remote fallback.
+ */
+const githubRegistryImageFromConfig = (config) => {
+    const { repository } = (0, index_1.getPipelineOptions)(config, "github");
+    return repository ? (0, ghcr_1.toGhcrRegistryImage)(repository) : undefined;
+};
+exports.githubRegistryImageFromConfig = githubRegistryImageFromConfig;
+/**
+ * the ghcr image prefix to generate with: the configured repository, or
+ * the one the github git remote points at.
+ *
+ * Falls back to the `${{ github.repository }}` expression when the
+ * remote is unavailable (a checkout without the remote, a tarball, …).
+ * That is the pre-existing behavior and correct for every all-lowercase
+ * repository; `project doctor` catches the mixed-case case it is not
+ * correct for.
+ */
+const resolveGithubRegistryImage = async (config) => {
+    const fromConfig = (0, exports.githubRegistryImageFromConfig)(config);
+    if (fromConfig) {
+        return fromConfig;
+    }
+    const remote = (0, index_1.getPipelineGitRemote)(config, "github");
+    try {
+        const { stdout } = await execFile("git", ["remote", "get-url", remote]);
+        const repository = (0, ghcr_1.parseGithubRepoFromRemoteUrl)(stdout);
+        return repository
+            ? (0, ghcr_1.toGhcrRegistryImage)(repository)
+            : ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+    catch (_a) {
+        return ghcr_1.GHCR_REPOSITORY_EXPRESSION;
+    }
+};
+exports.resolveGithubRegistryImage = resolveGithubRegistryImage;
+//# sourceMappingURL=registryImage.js.map
+
+/***/ }),
+
 /***/ 61071:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -7045,7 +7169,7 @@ exports.isOfBuildType = isOfBuildType;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getCatciGeneratedFiles = exports.GENERATED_CATCI_FOLDER = void 0;
+exports.getCatciGeneratedFiles = exports.makeCatciGeneratedFiles = exports.GENERATED_CATCI_FOLDER = void 0;
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 exports.GENERATED_CATCI_FOLDER = ".catladder-generated/catci";
@@ -7073,14 +7197,29 @@ const getShippedCatciBundle = () => {
     return found;
 };
 /**
- * the catci files to materialize into the generated folder
+ * the files that make up the materialized catci folder for a given
+ * bundle content
  */
-const getCatciGeneratedFiles = () => [
+const makeCatciGeneratedFiles = (bundle) => [
     {
         path: (0, path_1.join)(exports.GENERATED_CATCI_FOLDER, "index.js"),
-        content: (0, fs_1.readFileSync)(getShippedCatciBundle(), "utf-8"),
+        content: bundle,
+    },
+    {
+        // the bundle is commonjs (ncc output using `__dirname`), but node
+        // resolves the module format from the nearest package.json: a
+        // consumer whose root package.json declares `"type": "module"`
+        // would parse the bundle as ESM and crash on the first `__dirname`.
+        // a sibling package.json pins the folder to commonjs regardless.
+        path: (0, path_1.join)(exports.GENERATED_CATCI_FOLDER, "package.json"),
+        content: `${JSON.stringify({ type: "commonjs" }, null, 2)}\n`,
     },
 ];
+exports.makeCatciGeneratedFiles = makeCatciGeneratedFiles;
+/**
+ * the catci files to materialize into the generated folder
+ */
+const getCatciGeneratedFiles = () => (0, exports.makeCatciGeneratedFiles)((0, fs_1.readFileSync)(getShippedCatciBundle(), "utf-8"));
 exports.getCatciGeneratedFiles = getCatciGeneratedFiles;
 //# sourceMappingURL=shippedCatci.js.map
 
@@ -8015,6 +8154,7 @@ exports.JobImagesPlan = exports.PROJECT_IMAGES_FOLDER = exports.GENERATED_IMAGES
 const fs_1 = __nccwpck_require__(79896);
 const path_1 = __nccwpck_require__(16928);
 const ciVariables_1 = __nccwpck_require__(91215);
+const ghcr_1 = __nccwpck_require__(59011);
 const docker_1 = __nccwpck_require__(12354);
 const runner_1 = __nccwpck_require__(92146);
 const gitlab_1 = __nccwpck_require__(86962);
@@ -8075,9 +8215,16 @@ exports.PROJECT_IMAGES_FOLDER = `${exports.GENERATED_IMAGES_FOLDER}/project`;
  * Reference-driven: only images actually used by a job are built.
  */
 class JobImagesPlan {
-    constructor(pipelineType, projectImages = {}) {
+    constructor(pipelineType, projectImages = {}, 
+    /**
+     * the registry image prefix to generate with, overriding the
+     * pipeline type's default. On github this carries the lowercased
+     * ghcr namespace (see `resolveGithubRegistryImage`).
+     */
+    registryImage) {
         this.pipelineType = pipelineType;
         this.projectImages = projectImages;
+        this.registryImage = registryImage;
         this.used = new Map();
         this.usedProject = new Map();
     }
@@ -8102,11 +8249,14 @@ class JobImagesPlan {
     }
     /**
      * the registry image prefix. On github, container images can't use
-     * runtime env vars — the expression form is required.
+     * runtime env vars — a literal or an actions expression is required.
      */
     registryImageRef() {
+        if (this.registryImage) {
+            return this.registryImage;
+        }
         return this.pipelineType === "github"
-            ? "ghcr.io/${{ github.repository }}"
+            ? ghcr_1.GHCR_REPOSITORY_EXPRESSION
             : `${(0, ciVariables_1.getCiVariable)({ pipelineType: this.pipelineType }, "registryImage")}`;
     }
     useProject(name) {