@catladder/cli 5.2.0 → 5.3.1

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "5.2.0",
+  "version": "5.3.1",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/commands/project/commandPortForward.ts

@@ -59,7 +59,7 @@ export const commandPortForward = defineCommand({
 
       const { fullName } = context.environment;
       let serviceName: string = fullName.toString();
-      if (context.environment.envType === "review") {
+      if (context.environment.instance.type === "review") {
         const mr = await ctx.get("mr");
         serviceName = serviceName
           .toString()

package/src/commands/project/secrets/scope.ts

@@ -1,6 +1,8 @@
+import { getSecretsEnv } from "@catladder/pipeline";
 import {
   getAllComponentsWithAllEnvsHierarchical,
   getEnvironment,
+  getProjectConfig,
 } from "../../../config/getProjectConfig";
 
 /** which envs of which components a secrets command operates on */
@@ -8,6 +10,26 @@ export type SecretsScope = {
   [componentName: string]: string[];
 };
 
+/**
+ * envs that share another env's secrets (`environments.<name>.inherit`)
+ * have no secret store of their own — the secrets commands operate on
+ * the source env instead
+ */
+const withoutSharedSecretEnvs = async (
+  all: SecretsScope,
+): Promise<SecretsScope> => {
+  const config = await getProjectConfig();
+  const environments = config?.environments;
+  return Object.fromEntries(
+    Object.entries(all)
+      .map(([componentName, envs]): [string, string[]] => [
+        componentName,
+        envs.filter((env) => getSecretsEnv(environments, env) === env),
+      ])
+      .filter(([, envs]) => envs.length > 0),
+  );
+};
+
 /**
  * resolves a scope expression to component → envs:
  * - (empty): all components, all envs
@@ -18,7 +40,9 @@ export type SecretsScope = {
 export const resolveSecretsScope = async (
   scope?: string,
 ): Promise<SecretsScope> => {
-  const all = await getAllComponentsWithAllEnvsHierarchical();
+  const all = await withoutSharedSecretEnvs(
+    await getAllComponentsWithAllEnvsHierarchical(),
+  );
   if (Object.keys(all).length === 0) {
     throw new Error("no catladder config found");
   }
@@ -28,6 +52,16 @@ export const resolveSecretsScope = async (
 
   const [env, componentName] = scope.split(":").map((x) => x || null);
 
+  if (env) {
+    const config = await getProjectConfig();
+    const secretsEnv = getSecretsEnv(config?.environments, env);
+    if (secretsEnv !== env) {
+      throw new Error(
+        `environment "${env}" shares its secrets with "${secretsEnv}" (environments.${env}.inherit) — manage them via "${secretsEnv}"`,
+      );
+    }
+  }
+
   if (componentName && !(componentName in all)) {
     throw new Error(
       `unknown component "${componentName}" — components: ${Object.keys(all).join(", ")}`,
@@ -59,7 +93,9 @@ export const resolveSecretsScope = async (
  * (one component, all envs) forms
  */
 export const secretsScopeChoices = async (): Promise<string[]> => {
-  const all = await getAllComponentsWithAllEnvsHierarchical();
+  const all = await withoutSharedSecretEnvs(
+    await getAllComponentsWithAllEnvsHierarchical(),
+  );
   const pairs = Object.entries(all).flatMap(([componentName, envs]) =>
     envs.map((env) => `${env}:${componentName}`),
   );

package/src/config/getProjectConfig.ts

@@ -8,6 +8,7 @@ import {
   getAllEnvs,
   getEnvironment as _getEnvironment,
   createComponentContext,
+  getSecretsEnv,
   getSecretVarName,
 } from "@catladder/pipeline";
 
@@ -125,7 +126,14 @@ export const getGitlabVar = async (
   componentName: string,
   variableName: string,
 ) => {
-  const rawVariableName = getSecretVarName(env, componentName, variableName);
+  const config = await getProjectConfig();
+  // an env sharing another env's secrets (inherit) reads that env's variables
+  const secretsEnv = getSecretsEnv(config?.environments, env);
+  const rawVariableName = getSecretVarName(
+    secretsEnv,
+    componentName,
+    variableName,
+  );
   return await getVariableValueByRawName(io, rawVariableName);
 };
 

package/src/release/__tests__/changesetCheckJob.test.ts

@@ -0,0 +1,68 @@
+import { mkdtemp, readFile, rm } from "fs/promises";
+import { tmpdir } from "os";
+import { join } from "path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { CHANGESET_REPORT_FILE, changesetCheckJob } from "../changesetCheckJob";
+
+// the merge request's diff against its target branch: the only git
+// output the check parses
+const gitMock = vi.hoisted(() => ({ addedFiles: [] as string[] }));
+
+vi.mock("../releaseGit", () => ({
+  ensureReleaseHistory: vi.fn(async () => undefined),
+  getLastReleaseTag: vi.fn(async () => "v1.2.3"),
+  git: vi.fn(async (command: string) =>
+    command === "diff" ? gitMock.addedFiles.join("\n") : "",
+  ),
+}));
+
+vi.mock("../changesetsReleaseJob", () => ({
+  readPendingChangesets: vi.fn(async () => []),
+}));
+
+let cwd: string;
+let workDir: string;
+
+beforeEach(async () => {
+  cwd = process.cwd();
+  workDir = await mkdtemp(join(tmpdir(), "changeset-check-"));
+  process.chdir(workDir);
+  process.exitCode = undefined;
+  vi.spyOn(console, "log").mockImplementation(() => undefined);
+  vi.stubEnv("GITHUB_ACTIONS", undefined as any);
+  vi.stubEnv("GL_TOKEN", undefined as any);
+  vi.stubEnv("CI_MERGE_REQUEST_TARGET_BRANCH_NAME", "main");
+});
+
+afterEach(async () => {
+  process.chdir(cwd);
+  process.exitCode = undefined;
+  vi.unstubAllEnvs();
+  vi.restoreAllMocks();
+  await rm(workDir, { recursive: true, force: true });
+});
+
+describe("changesetCheckJob on gitlab", () => {
+  it("exits 0 when the merge request adds no changeset — a failed job would never resolve its exposed report", async () => {
+    gitMock.addedFiles = ["src/index.ts"];
+
+    await changesetCheckJob();
+
+    expect(process.exitCode).toBeUndefined();
+    const report = await readFile(CHANGESET_REPORT_FILE, "utf-8");
+    expect(report).toContain("adds no changeset");
+    expect(console.log).toHaveBeenCalledWith(
+      expect.stringContaining("⚠️  this merge request adds no changeset"),
+    );
+  });
+
+  it("exits 0 and reports the changesets the merge request adds", async () => {
+    gitMock.addedFiles = [".changeset/brave-cats.md"];
+
+    await changesetCheckJob();
+
+    expect(process.exitCode).toBeUndefined();
+    const report = await readFile(CHANGESET_REPORT_FILE, "utf-8");
+    expect(report).toContain("adds 1 changeset: `brave-cats.md`");
+  });
+});

package/src/release/changesetCheckJob.ts

@@ -4,8 +4,9 @@
  * reports which changesets the merge request adds, what is pending and
  * what version merging would release. The report goes to the job log,
  * to `changeset-report.md` (exposed as an artifact on gitlab) and to a
- * sticky MR/PR comment where a token allows it. Exits 1 (the job runs
- * with allow_failure) when the merge request adds no changeset.
+ * sticky MR/PR comment where a token allows it. Always exits 0: a
+ * missing changeset is a warning carried by the report, not a job
+ * failure (see the end of {@link changesetCheckJob}).
  */
 import { existsSync } from "fs";
 import { writeFile } from "fs/promises";
@@ -203,11 +204,17 @@ export const changesetCheckJob = async () => {
     return;
   }
   if (!result.addsChangeset) {
+    // the job stays green on both platforms — the report, the log and
+    // the sticky comment carry the "no changeset" warning instead:
+    // - github has no "warning" job state: exiting non-zero would show
+    //   the job as failed (a red ❌ and "exit code 1"), which reads
+    //   like something broke.
+    // - gitlab only resolves the exposed artifact (the MR widget's
+    //   "changeset report" link) of a SUCCESSFUL job: for a failed
+    //   allow_failure job `exposed_artifacts.json` answers 204 forever
+    //   and the widget spins on "Loading artifacts" — exactly on the
+    //   MRs that need the report.
     if (onGithub()) {
-      // github has no "warning" job state: exiting non-zero would show
-      // the job as failed (a red ❌ and "exit code 1"), which reads like
-      // something broke. A warning annotation plus the step summary and
-      // the sticky PR comment carry the signal instead.
       console.log(
         "::warning title=No changeset::this pull request adds no changeset — " +
           "if the change is user-facing, add one so it appears in the next release's changelog",
@@ -215,10 +222,11 @@ export const changesetCheckJob = async () => {
       appendStepSummary(
         result.markdown.replace(`${CHANGESET_CHECK_MARKER}\n`, ""),
       );
-      return;
+    } else {
+      console.log(
+        "⚠️  this merge request adds no changeset — if the change is user-facing, " +
+          "add one so it appears in the next release's changelog (see the changeset report)",
+      );
     }
-    // gitlab: exit 1 turns the (allow_failure) job yellow so reviewers
-    // notice
-    process.exitCode = 1;
   }
 };

package/src/secrets/github.ts

@@ -30,17 +30,20 @@ export const collectSecretsFromVault = async (io: IO, envFilter?: string[]) => {
       if (envFilter && !envFilter.includes(env)) {
         continue;
       }
-      const { secretEnvVarKeys, jobOnlyVars } = await getEnvironment(
-        env,
-        componentName,
-      );
+      const { secretEnvVarKeys, jobOnlyVars, secretsEnv } =
+        await getEnvironment(env, componentName);
       const keys = [
         ...secretEnvVarKeys,
         ...jobOnlyVars.build.secretEnvVarKeys,
         ...jobOnlyVars.deploy.secretEnvVarKeys,
       ];
+      // secretsEnv: an env sharing another env's secrets (inherit)
+      // references that env's variable names
       keys.forEach(({ key, kind }) =>
-        kinds.set(getSecretVarName(env, componentName, key), kind ?? "secret"),
+        kinds.set(
+          getSecretVarName(secretsEnv ?? env, componentName, key),
+          kind ?? "secret",
+        ),
       );
     }
   }

package/dist/packages/pipeline/src/context/getReviewSlug.d.ts

@@ -1,4 +0,0 @@
-import { type StringOrBashExpression } from "../../../bash/src/index.js";
-import type { PipelineType } from "../types";
-import type { EnvConfigWithComponent } from "../types/config";
-export declare const getReviewSlug: (envConfig: EnvConfigWithComponent, env: string, pipelineType?: PipelineType) => StringOrBashExpression | null;

package/dist/packages/pipeline/src/context/getReviewSlug.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"getReviewSlug.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/context/getReviewSlug.ts"],"names":[],"mappings":";;;AAAA,0CAA8E;AAE9E,yFAAyF;AAGzF,6CAA0C;AAC1C,MAAM,WAAW,GAAkC;IACjD,OAAO,EAAE,qBAAqB;IAC9B,MAAM,EAAE,IAAI,qBAAc,CACxB,0JAA0J,CAC3J;IACD,uEAAuE;IACvE,MAAM,EAAE,IAAI,qBAAc,CACxB,uEAAuE,CACxE;CACF,CAAC;AAEK,MAAM,aAAa,GAAG,CAC3B,SAAiC,EACjC,GAAW,EACX,YAA2B,EACI,EAAE;IACjC,MAAM,OAAO,GAAG,IAAA,uBAAU,EAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAA,gEAAgC,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,oBAAoB;AACnC,CAAC,CAAC;AAVW,QAAA,aAAa,iBAUxB"}