@catladder/cli 5.1.2 → 5.2.0

package/dist/packages/pipeline/src/backends/gitlab/gitlabReleaseJobs.d.ts

@@ -7,6 +7,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         stage: string;
         image: string;
         script: string[];
+        interruptible: true;
         allow_failure: true;
         artifacts: {
             paths: string[];
@@ -42,6 +43,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         rules: {
@@ -58,6 +60,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
         needs?: undefined;
         allow_failure?: undefined;
     };
@@ -81,6 +84,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         rules: {
@@ -97,6 +101,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
         needs?: undefined;
         allow_failure?: undefined;
     };
@@ -105,6 +110,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         stage: string;
         image: string;
         script: string[];
+        interruptible: true;
         allow_failure: true;
         artifacts: {
             paths: string[];
@@ -140,6 +146,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         allow_failure: true;
@@ -157,6 +164,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
         needs?: undefined;
     };
 } | {
@@ -179,6 +187,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         allow_failure: true;
@@ -196,6 +205,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
         needs?: undefined;
     };
 } | {
@@ -203,6 +213,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         stage: string;
         image: string;
         script: string[];
+        interruptible: true;
         allow_failure: true;
         artifacts: {
             paths: string[];
@@ -238,11 +249,13 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         stage: string;
         image: string;
         script: string[];
+        interruptible: false;
         needs: any[];
         allow_failure: true;
         rules: {
@@ -277,6 +290,7 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
 } | {
     "\uD83E\uDD8B changeset check"?: undefined;
@@ -298,11 +312,13 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
     "create release": {
         stage: string;
         image: string;
         script: string[];
+        interruptible: false;
         needs: any[];
         allow_failure: true;
         rules: {
@@ -337,5 +353,6 @@ export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPla
         image: string;
         script: string[];
         after_script: string[];
+        interruptible: false;
     };
 };

package/dist/packages/pipeline/src/backends/gitlab/gitlabReleaseJobs.js

@@ -53,6 +53,12 @@ mainBranchJobNames) => {
         image: releaseImage,
         script: [method.script],
         after_script: [EXPIRED_TOKEN_HELP],
+        // a release in flight must never be killed by a new commit — a
+        // half-published version (tag pushed, npm publish missing) is not
+        // recoverable by re-running. Under gitlab's default "conservative"
+        // auto-cancel this also shields the rest of the pipeline, but only
+        // once the release actually started, which is late by construction.
+        interruptible: false,
     };
     const forceReleaseJob = {
         ["⚠️ force create release"]: {
@@ -76,6 +82,10 @@ mainBranchJobNames) => {
                 stage: "test",
                 image: releaseImage,
                 script: [method.checkScript],
+                // a redundant report is worthless: without this the job
+                // defaults to interruptible: false and, once started, stops
+                // gitlab from auto-cancelling the superseded MR pipeline
+                interruptible: true,
                 allow_failure: true,
                 artifacts: {
                     paths: ["changeset-report.md"],
@@ -145,6 +155,9 @@ mainBranchJobNames) => {
             script: [
                 `echo "release queued — '${exports.RELEASE_EXECUTOR_JOB_NAME}' runs it as soon as every other job in this pipeline succeeded"`,
             ],
+            // the recorded intent must survive a new commit: cancelling it
+            // would silently drop the queued release
+            interruptible: false,
             needs: [],
             // allow_failure keeps the unclicked button from blocking the
             // pipeline AND makes the executor's needs treat it as optional

package/dist/packages/pipeline/src/backends/gitlab/gitlabReleaseJobs.js.map

@@ -1 +1 @@
-{"version":3,"file":"gitlabReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/gitlabReleaseJobs.ts"],"names":[],"mappings":";;;AAAA,uCAOqB;AAErB,2CAAiD;AAIjD,MAAM,kBAAkB,GACtB,gJAAgJ,CAAC;AAEnJ;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEf,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AAC3C,QAAA,yBAAyB,GAAG,mCAAmC,CAAC;AAE7E,MAAM,gBAAgB,GAAG;IACvB,oCAA4B;IAC5B,mCAA2B;IAC3B,8BAAsB;CACvB,CAAC;AAEF,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,oCAAoC;AACpC,MAAM,kBAAkB,GAAG;IACzB,GAAG,gBAAgB;IACnB;QACE,EAAE,EAAE,kCAA0B;QAC9B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,EAAE,EAAE,oCAA4B;QAChC,IAAI,EAAE,QAAQ;KACf;CACqB,CAAC;AAElB,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,MAAqB;AACrB;;;;GAIG;AACH,kBAA4B,EAC5B,EAAE;;IACF,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,uCAAuC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC,KAAK;KAC7B,CAAC,CAAC,KAAK,CAAC;IAET,MAAM,cAAc,GAAG;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,CAAC,kBAAkB,CAAC;KACZ,CAAC;IAEzB,MAAM,eAAe,GAAG;QACtB,CAAC,yBAAyB,CAAC,EAAE;YAC3B,GAAG,cAAc;YACjB,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,IAAI;YACnB,2DAA2D;YAC3D,wDAAwD;YACxD,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,kBAAkB;SACH;KACzB,CAAC;IAEF,mEAAmE;IACnE,8DAA8D;IAC9D,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW;QACjC,CAAC,CAAC;YACE,CAAC,oBAAoB,CAAC,EAAE;gBACtB,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC5B,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE;oBACT,KAAK,EAAE,CAAC,qBAAqB,CAAC;oBAC9B,SAAS,EAAE,kBAAkB;oBAC7B,2CAA2C;oBAC3C,IAAI,EAAE,QAAiB;iBACxB;gBACD,KAAK,EAAE;oBACL,mCAA2B;oBAC3B,8BAAsB;oBACtB,6BAAqB;iBACC;aACF;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO;YACL,CAAC,+BAAuB,CAAC,EAAE;gBACzB,GAAG,cAAc;gBACjB,KAAK,EAAE;oBACL,GAAG,gBAAgB;oBACnB;wBACE,EAAE,EAAE,kCAA0B;wBAC9B,IAAI,EAAE,YAAY;qBACnB;oBACD;wBACE,EAAE,EAAE,oCAA4B;wBAChC,IAAI,EAAE,QAAQ;wBACd,sDAAsD;wBACtD,gDAAgD;wBAChD,aAAa,EAAE,IAAI;qBACpB;iBACqB;aACF;YACxB,GAAG,eAAe;YAClB,GAAG,QAAQ;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,EAAE,GAAG,EAAE,+BAAuB,EAAE;QAChC,iEAAiE;QACjE,uBAAuB;QACvB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACrE,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,6CAA6C,gBAAgB,UAAU;YACrE,QAAQ,+BAAuB,qCAAqC;YACpE,0DAA0D,gBAAgB,GAAG,CAChF,CAAC;QACF,OAAO;YACL,CAAC,+BAAuB,CAAC,EAAE;gBACzB,GAAG,cAAc;gBACjB,aAAa,EAAE,IAAI;gBACnB,KAAK,EAAE,kBAAkB;aACH;YACxB,GAAG,eAAe;YAClB,GAAG,QAAQ;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,CAAC,+BAAuB,CAAC,EAAE;YACzB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE;gBACN,2BAA2B,iCAAyB,kEAAkE;aACvH;YACD,KAAK,EAAE,EAAE;YACT,6DAA6D;YAC7D,+DAA+D;YAC/D,2DAA2D;YAC3D,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,kBAAkB;SACH;QACxB,mEAAmE;QACnE,oEAAoE;QACpE,kEAAkE;QAClE,sCAAsC;QACtC,CAAC,iCAAyB,CAAC,EAAE;YAC3B,GAAG,cAAc;YACjB,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE;gBACL,GAAG,gBAAgB;gBACnB;oBACE,EAAE,EAAE,kCAA0B;oBAC9B,IAAI,EAAE,YAAY;iBACnB;gBACD;oBACE,EAAE,EAAE,oCAA4B;oBAChC,IAAI,EAAE,YAAY;iBACnB;aACqB;SACF;QACxB,GAAG,eAAe;QAClB,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC,CAAC;AAzJW,QAAA,oBAAoB,wBAyJ/B"}
+{"version":3,"file":"gitlabReleaseJobs.js","sourceRoot":"","sources":["../../../../../../../../packages/pipeline/src/backends/gitlab/gitlabReleaseJobs.ts"],"names":[],"mappings":";;;AAAA,uCAOqB;AAErB,2CAAiD;AAIjD,MAAM,kBAAkB,GACtB,gJAAgJ,CAAC;AAEnJ;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEf,QAAA,uBAAuB,GAAG,gBAAgB,CAAC;AAC3C,QAAA,yBAAyB,GAAG,mCAAmC,CAAC;AAE7E,MAAM,gBAAgB,GAAG;IACvB,oCAA4B;IAC5B,mCAA2B;IAC3B,8BAAsB;CACvB,CAAC;AAEF,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,oCAAoC;AACpC,MAAM,kBAAkB,GAAG;IACzB,GAAG,gBAAgB;IACnB;QACE,EAAE,EAAE,kCAA0B;QAC9B,IAAI,EAAE,QAAQ;KACf;IACD;QACE,EAAE,EAAE,oCAA4B;QAChC,IAAI,EAAE,QAAQ;KACf;CACqB,CAAC;AAElB,MAAM,oBAAoB,GAAG,CAClC,MAAc,EACd,MAAqB;AACrB;;;;GAIG;AACH,kBAA4B,EAC5B,EAAE;;IACF,MAAM,MAAM,GAAG,IAAA,0BAAgB,EAAC,MAAM,CAAC,CAAC;IACxC,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,uCAAuC;IACvC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC;QACrC,cAAc,EAAE,MAAM,CAAC,KAAK;KAC7B,CAAC,CAAC,KAAK,CAAC;IAET,MAAM,cAAc,GAAG;QACrB,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,YAAY;QACnB,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACvB,YAAY,EAAE,CAAC,kBAAkB,CAAC;QAClC,+DAA+D;QAC/D,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,oEAAoE;QACpE,aAAa,EAAE,KAAK;KACE,CAAC;IAEzB,MAAM,eAAe,GAAG;QACtB,CAAC,yBAAyB,CAAC,EAAE;YAC3B,GAAG,cAAc;YACjB,KAAK,EAAE,EAAE;YACT,aAAa,EAAE,IAAI;YACnB,2DAA2D;YAC3D,wDAAwD;YACxD,GAAG,CAAC,MAAM,CAAC,qBAAqB;gBAC9B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACP,KAAK,EAAE,kBAAkB;SACH;KACzB,CAAC;IAEF,mEAAmE;IACnE,8DAA8D;IAC9D,gCAAgC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW;QACjC,CAAC,CAAC;YACE,CAAC,oBAAoB,CAAC,EAAE;gBACtB,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;gBAC5B,wDAAwD;gBACxD,4DAA4D;gBAC5D,yDAAyD;gBACzD,aAAa,EAAE,IAAI;gBACnB,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE;oBACT,KAAK,EAAE,CAAC,qBAAqB,CAAC;oBAC9B,SAAS,EAAE,kBAAkB;oBAC7B,2CAA2C;oBAC3C,IAAI,EAAE,QAAiB;iBACxB;gBACD,KAAK,EAAE;oBACL,mCAA2B;oBAC3B,8BAAsB;oBACtB,6BAAqB;iBACC;aACF;SACzB;QACH,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,CAAA,MAAA,MAAM,CAAC,QAAQ,0CAAE,IAAI,MAAK,MAAM,EAAE,CAAC;QACrC,OAAO;YACL,CAAC,+BAAuB,CAAC,EAAE;gBACzB,GAAG,cAAc;gBACjB,KAAK,EAAE;oBACL,GAAG,gBAAgB;oBACnB;wBACE,EAAE,EAAE,kCAA0B;wBAC9B,IAAI,EAAE,YAAY;qBACnB;oBACD;wBACE,EAAE,EAAE,oCAA4B;wBAChC,IAAI,EAAE,QAAQ;wBACd,sDAAsD;wBACtD,gDAAgD;wBAChD,aAAa,EAAE,IAAI;qBACpB;iBACqB;aACF;YACxB,GAAG,eAAe;YAClB,GAAG,QAAQ;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG;QACpB,EAAE,GAAG,EAAE,+BAAuB,EAAE;QAChC,iEAAiE;QACjE,uBAAuB;QACvB,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;KACrE,CAAC;IAEF,IAAI,aAAa,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CACV,6CAA6C,gBAAgB,UAAU;YACrE,QAAQ,+BAAuB,qCAAqC;YACpE,0DAA0D,gBAAgB,GAAG,CAChF,CAAC;QACF,OAAO;YACL,CAAC,+BAAuB,CAAC,EAAE;gBACzB,GAAG,cAAc;gBACjB,aAAa,EAAE,IAAI;gBACnB,KAAK,EAAE,kBAAkB;aACH;YACxB,GAAG,eAAe;YAClB,GAAG,QAAQ;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,qEAAqE;QACrE,CAAC,+BAAuB,CAAC,EAAE;YACzB,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE;gBACN,2BAA2B,iCAAyB,kEAAkE;aACvH;YACD,+DAA+D;YAC/D,yCAAyC;YACzC,aAAa,EAAE,KAAK;YACpB,KAAK,EAAE,EAAE;YACT,6DAA6D;YAC7D,+DAA+D;YAC/D,2DAA2D;YAC3D,aAAa,EAAE,IAAI;YACnB,KAAK,EAAE,kBAAkB;SACH;QACxB,mEAAmE;QACnE,oEAAoE;QACpE,kEAAkE;QAClE,sCAAsC;QACtC,CAAC,iCAAyB,CAAC,EAAE;YAC3B,GAAG,cAAc;YACjB,KAAK,EAAE,aAAa;YACpB,KAAK,EAAE;gBACL,GAAG,gBAAgB;gBACnB;oBACE,EAAE,EAAE,kCAA0B;oBAC9B,IAAI,EAAE,YAAY;iBACnB;gBACD;oBACE,EAAE,EAAE,oCAA4B;oBAChC,IAAI,EAAE,YAAY;iBACnB;aACqB;SACF;QACxB,GAAG,eAAe;QAClB,GAAG,QAAQ;KACZ,CAAC;AACJ,CAAC,CAAC;AAtKW,QAAA,oBAAoB,wBAsK/B"}

package/dist/packages/pipeline/src/types/gitlab-types.d.ts

@@ -4,6 +4,33 @@ export { Retry, Image as GitlabJobImage } from "./gitlab-ci-yml";
 export type Artifacts = GitlabCiArtifacts;
 export type { GitlabJobCache };
 export type GitlabRule = Exclude<Exclude<Rules, null>[number], string | string[]>;
+/**
+ * gitlab's auto-cancel policy for redundant pipelines. Tunes the
+ * project setting "Auto-cancel redundant pipelines" (Settings > CI/CD >
+ * General pipelines) — it does NOT enable it: with the setting off,
+ * nothing is ever cancelled regardless of this.
+ *
+ * needs gitlab >= 16.8 (top-level) / >= 16.10 (per workflow rule).
+ */
+export interface GitlabAutoCancel {
+    /**
+     * - `conservative` (gitlab's default): cancel the whole pipeline, but
+     *   only while no `interruptible: false` job has *started* — a single
+     *   such job then shields every other job from cancellation
+     * - `interruptible`: cancel every `interruptible: true` job, with no
+     *   such veto
+     * - `none`: never auto-cancel
+     */
+    on_new_commit?: "conservative" | "interruptible" | "none";
+    on_job_failure?: "all" | "none";
+}
+/**
+ * a workflow rule may override {@link GitlabAutoCancel} per pipeline
+ * kind — job rules may not.
+ */
+export type GitlabWorkflowRule = GitlabRule & {
+    auto_cancel?: GitlabAutoCancel;
+};
 export type GitlabEnvironment = Omit<Exclude<JobTemplate["environment"], undefined | string>, "deployment_tier">;
 export interface GitlabJobDef extends Pick<JobTemplate, "after_script" | "allow_failure" | "artifacts" | "before_script" | "coverage" | "dependencies" | "environment" | "except" | "hooks" | "image" | "interruptible" | "needs" | "only" | "parallel" | "release" | "resource_group" | "retry" | "rules" | "script" | "services" | "stage" | "tags" | "trigger" | "variables"> {
     stage: JobTemplate["stage"];
@@ -23,8 +50,9 @@ export interface GitlabJobDef extends Pick<JobTemplate, "after_script" | "allow_
 export interface GitlabPipeline extends Pick<JobTemplate, "variables"> {
     image: string;
     workflow?: {
-        rules: GitlabRule[];
         name?: string;
+        auto_cancel?: GitlabAutoCancel;
+        rules: GitlabWorkflowRule[];
         variables?: Record<string, string>;
     };
     stages: string[];

package/dist/runner-images/semantic-release/Dockerfile

@@ -4,7 +4,9 @@
 # (@semantic-release/git and @semantic-release/changelog need node >=24.15).
 FROM node:24-alpine
 
-RUN apk add --no-cache bash git git-lfs
+# openssh: on github the release job pushes with the release deploy key
+# over ssh (see scripts/semanticRelease)
+RUN apk add --no-cache bash git git-lfs openssh-client
 
 # add semantic release
 # NOTE: pin every dependency exactly. These are the semantic-release@25 line

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -39,7 +39,34 @@ fi
 
 echo "doing semantic release"
 
+SEMANTIC_RELEASE_ARGS=()
+# the commit message suffix, see the @semantic-release/git config below
+RELEASE_COMMIT_SUFFIX=""
 if [ "$GITHUB_ACTIONS" = "true" ]; then
+  # [skip ci] on github only: a push with the deploy key triggers
+  # workflows (unlike a push with GITHUB_TOKEN), and neither the release
+  # commit nor the tag needs a push-triggered run — the taggedRelease
+  # workflow is dispatched explicitly at the end, the marker keeps it
+  # the only run (same as the changesets path). On gitlab the tag
+  # pipeline MUST fire natively, so no marker there.
+  RELEASE_COMMIT_SUFFIX=" [skip ci]"
+
+  if [ -n "$CATLADDER_RELEASE_KEY" ]; then
+    # merge gating (a ruleset requiring the `catladder ✅` check on the
+    # default branch) rejects the release push unless it comes from the
+    # release deploy key — the workflow token can never bypass a
+    # ruleset. catci writes the key, points git's ssh at it and checks
+    # that the key reaches the repository (a clear failure here instead
+    # of a GH013 inside @semantic-release/git). The ssh url has to be
+    # passed explicitly: semantic-release takes package.json's
+    # `repository` over origin, and origin is the token-authenticated
+    # https url actions/checkout left behind.
+    RELEASE_REPOSITORY_URL=$(node "$CATCI" release github-deploy-key-remote)
+    SEMANTIC_RELEASE_ARGS+=(--repository-url "$RELEASE_REPOSITORY_URL")
+  else
+    echo "CATLADDER_RELEASE_KEY not set — pushing with the workflow token (fails on a repository with merge gating: run 'catladder project setup')"
+  fi
+
   # the github counterpart of the gitlab plugin below: it creates the
   # entry on the releases page with the generated notes. Everything
   # beyond that is switched off on purpose — commenting on the
@@ -62,6 +89,10 @@ else
     "@semantic-release/gitlab"'
 fi
 
+# NOTE: a project bringing its own .releaserc has to keep "[skip ci]" in
+# the git plugin's commit message on github (see RELEASE_COMMIT_SUFFIX),
+# otherwise a deploy-key push starts the main workflow for the release
+# commit and a second taggedRelease run for the tag.
 if [ ! -e .releaserc ]; then
   cat >.releaserc <<EOF
 {
@@ -98,7 +129,7 @@ if [ ! -e .releaserc ]; then
     # loop-prevention rule keys on the literal "chore(release)" prefix, so keep
     # this literal. Don't "fix" it back to \${branch.type}.
     ["@semantic-release/git", {
-      "message": "chore(release): \${nextRelease.version}\n\n\${nextRelease.notes}"
+      "message": "chore(release): \${nextRelease.version}${RELEASE_COMMIT_SUFFIX}\n\n\${nextRelease.notes}"
     }]${PUBLISH_PLUGIN}
     ],
   "branches": [
@@ -124,11 +155,13 @@ if [ "$GITHUB_ACTIONS" = "true" ]; then
   TAGS_BEFORE=$(git tag --list 'v[0-9]*')
 fi
 
-semantic-release
+semantic-release "${SEMANTIC_RELEASE_ARGS[@]}"
 
 # tags pushed with the default GITHUB_TOKEN don't trigger `on: push:
-# tags` workflows (github's recursion guard) — dispatch the
-# taggedRelease workflow explicitly for a tag semantic-release created
+# tags` workflows (github's recursion guard), and a deploy-key push
+# carries [skip ci] (see above) — dispatch the taggedRelease workflow
+# explicitly for a tag semantic-release created, whichever way it was
+# pushed
 if [ "$GITHUB_ACTIONS" = "true" ] && [ -f "$CATCI" ]; then
   if [ -z "$TAGS_BEFORE" ]; then
     NEW_TAG=$(git tag --list 'v[0-9]*' | tail -n1)

package/dist/skills/catladder-migrate-ci-backend/SKILL.md

@@ -183,10 +183,15 @@ skill for the exact command surface.
 - **GitLab** needs a `GL_TOKEN` project access token (named
   `semantic-release`) to push the release commit and tag. It is created
   and rotated by `yarn catladder project setup`.
-- **GitHub** needs nothing extra — the release jobs use the built-in
-  `github.token`. Tags pushed by that token do not retrigger workflows,
-  so the release job dispatches the tagged-release workflow explicitly;
-  that is built in and needs no configuration.
+- **GitHub** needs the release deploy key that `yarn catladder project
+  setup` provisions together with the merge gating (Step 9): the release
+  job pushes the release commit and tag over ssh with it, because the
+  built-in `github.token` can never bypass the required `catladder ✅`
+  check on the default branch (the push fails with GH013 otherwise).
+  Without merge gating the job falls back to the token. The release
+  commit carries `[skip ci]` and the release job dispatches the
+  tagged-release workflow explicitly (one run per tag); that is built
+  in and needs no configuration.
 - **Only one backend should own releases at a time.** Both backends
   generate release jobs, and with `releases: { when: "auto" }` both would
   try to tag the same commit. During the parallel phase, agree with the
@@ -287,9 +292,13 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   token bypass rulesets, so setup provisions a write deploy key
   ("catladder release", private half in the `CATLADDER_RELEASE_KEY`
   actions secret; deploy keys never expire) that the release job
-  pushes with over ssh. Classic branch protection has no bypass list
+  pushes with over ssh — with both release methods, semantic-release
+  and changesets. Classic branch protection has no bypass list
   at all, which is why setup uses a ruleset and migrates old
-  classic-protection gating away. `project doctor` verifies all of it.
+  classic-protection gating away. `project doctor` verifies all of it,
+  including that the committed release workflow runs the release image
+  of the installed catladder (an older semantic-release image pushed
+  with the token and ignored the key — regenerate with `catenv`).
   Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the

package/dist/skills/catladder-pipelines/SKILL.md

@@ -37,6 +37,38 @@ Generated layout:
 Stages: setup → test → build → deploy → verify (post-deploy checks),
 plus stop jobs for review-app teardown.
 
+## Superseded pipelines are cancelled
+
+Pushing a new commit cancels the pipeline of the previous one, so the
+runners are not busy with results nobody will read.
+
+| Pipeline | On a new commit |
+|---|---|
+| `mr` | cancelled |
+| `mainBranch` (dev) | cancelled, except a release already running |
+| `taggedRelease` | **runs through** — never cancelled |
+| agent runs (`trigger`) | **runs through** — never cancelled |
+
+- **GitHub**: the generated MR workflow sets `concurrency` with
+  `cancel-in-progress: true`.
+- **GitLab**: generated `workflow:auto_cancel:on_new_commit:
+  interruptible`, with per-rule `none` for tags and agent runs. Every
+  job carries an explicit `interruptible`, jobs that must finish
+  (release jobs, agent jobs) carry `interruptible: false`.
+
+**GitLab requires the project setting too.** The generated YAML only
+tunes *how* redundant pipelines are cancelled — it does not switch the
+feature on. If old pipelines keep running, check **Settings > CI/CD >
+General pipelines > Auto-cancel redundant pipelines**; with that
+checkbox off nothing is ever cancelled. (`catladder project-doctor`
+does not check this.)
+
+**Adding a hand-written GitLab job?** Set `interruptible` explicitly.
+GitLab defaults it to `false`, and a non-interruptible job that has
+started keeps *itself* alive — under gitlab's own default
+(`conservative`, which catladder overrides) it would shield the whole
+pipeline from cancellation.
+
 ## Review-app auto-stop and pinning (GitLab)
 
 GitLab review environments stop automatically after 1 week, dev

package/dist/skills/catladder-releases/SKILL.md

@@ -128,6 +128,20 @@ the `security` commands in the `catladder-cli` reference.
   MR adding a changeset describing the accumulated work.
 - Wrong version bump → check commit types (semantic-release) or the bump
   levels in the changeset files (changesets).
+- GitHub: the push is rejected with `GH013 … Required status check
+  "catladder ✅" is expected` (or GH006) → the release push has to use
+  the release deploy key, the only actor that bypasses the merge-gating
+  ruleset. `yarn catladder project setup` provisions it (deploy key
+  `catladder release` + secret `CATLADDER_RELEASE_KEY`), `yarn catladder
+  project doctor` verifies it — including that the committed release
+  workflow runs the current release image; an older semantic-release
+  image pushed with the workflow token and ignored the key (regenerate
+  with `yarn catenv` and commit).
+- GitHub, semantic-release with a project-provided `.releaserc`: keep
+  `[skip ci]` in the `@semantic-release/git` commit message. The
+  deploy-key push triggers workflows, and without the marker the release
+  commit starts a main run and the tag a second tagged run next to the
+  one the release job dispatches.
 - Tag pushed but nothing on the releases page → with `changesets` the
   entry is created via the host api after the push and never fails the
   job (the release itself is done); look for the `could not create the