@catladder/cli 5.2.0 → 5.3.1

package/dist/bundles/catenv/index.js

@@ -756,7 +756,10 @@ const getEnvironment = async (env, componentName) => {
 };
 exports.getEnvironment = getEnvironment;
 const getGitlabVar = async (io, env, componentName, variableName) => {
-    const rawVariableName = (0, pipeline_1.getSecretVarName)(env, componentName, variableName);
+    const config = await (0, exports.getProjectConfig)();
+    // an env sharing another env's secrets (inherit) reads that env's variables
+    const secretsEnv = (0, pipeline_1.getSecretsEnv)(config === null || config === void 0 ? void 0 : config.environments, env);
+    const rawVariableName = (0, pipeline_1.getSecretVarName)(secretsEnv, componentName, variableName);
     return await (0, gitlab_1.getVariableValueByRawName)(io, rawVariableName);
 };
 exports.getGitlabVar = getGitlabVar;
@@ -2641,6 +2644,7 @@ const promises_1 = __nccwpck_require__(91943);
 const path_1 = __nccwpck_require__(16928);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const config_1 = __nccwpck_require__(75591);
+const configruedEnvs_1 = __nccwpck_require__(38866);
 const ciVariables_1 = __nccwpck_require__(17300);
 const registryImage_1 = __nccwpck_require__(24333);
 const index_1 = __nccwpck_require__(62853);
@@ -2693,6 +2697,12 @@ const TRIGGER_WORKFLOWS = {
         },
     },
 };
+const getTriggerWorkflow = (trigger) => (0, config_1.isBranchTrigger)(trigger)
+    ? {
+        name: `🛠️ catladder ${trigger.branch}`,
+        on: { push: { branches: [trigger.branch] } },
+    }
+    : TRIGGER_WORKFLOWS[trigger];
 class GithubBackend {
     constructor() {
         this.type = "github";
@@ -2753,7 +2763,13 @@ class GithubBackend {
             stop: { jobs: {}, conditions: {}, options: [], envTypes: [] },
             rollback: { jobs: {}, conditions: {}, options: [], envTypes: [] },
         };
-        for (const trigger of config_1.ALL_PIPELINE_TRIGGERS) {
+        // branch triggers (envs with `on: { branch: ... }`) each get their
+        // own push-triggered workflow next to the built-in ones
+        const allTriggers = [
+            ...config_1.ALL_PIPELINE_TRIGGERS,
+            ...(0, configruedEnvs_1.getConfiguredBranchTriggers)(config),
+        ];
+        for (const trigger of allTriggers) {
             const allJobs = await (0, createAllJobs_1.createAllJobs)({
                 config,
                 trigger,
@@ -2880,7 +2896,7 @@ class GithubBackend {
             if (Object.keys(jobs).length > 0) {
                 const workflowJobs = { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...jobs };
                 workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
-                    ...TRIGGER_WORKFLOWS[trigger],
+                    ...getTriggerWorkflow(trigger),
                     ...workflowPermissions(images),
                     env: workflowEnv,
                     // the review workflow additionally gets the aggregate job —
@@ -2980,6 +2996,11 @@ const workflowPermissions = (_images) => ({
     permissions: { contents: "read", packages: "write" },
 });
 const workflowFileName = (trigger) => {
+    if ((0, config_1.isBranchTrigger)(trigger)) {
+        // branch names may contain characters that don't belong in a file
+        // name (e.g. "release/next")
+        return `branch-${trigger.branch.replace(/[^a-zA-Z0-9]+/g, "-")}.yml`;
+    }
     switch (trigger) {
         case "mr":
             return "review.yml";
@@ -2998,7 +3019,9 @@ const isReviewStopJob = (context, job) => {
     var _a;
     return ((_a = job.environment) === null || _a === void 0 ? void 0 : _a.action) === "stop" &&
         context.type === "component" &&
-        context.environment.envType === "review";
+        // a review app (one instance per pull request) is torn down when its
+        // pull request closes; stable envs get dispatch-triggered stop jobs
+        context.environment.instance.type === "review";
 };
 /**
  * stop/rollback jobs of non-review environments have no automatic
@@ -3329,7 +3352,7 @@ const collectSecretKinds = (allJobs) => {
             ...((_a = context.environment.jobOnlyVars.build.secretEnvVarKeys) !== null && _a !== void 0 ? _a : []),
             ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
         ];
-        entries.forEach(({ key, kind }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
+        entries.forEach(({ key, kind }) => kinds.set((0, getEnvironmentVariables_1.getSecretVarName)(context.environment.secretsEnv, context.name, key), kind !== null && kind !== void 0 ? kind : "secret"));
     });
     return kinds;
 };
@@ -3342,7 +3365,7 @@ const getSecretsEnv = (context, kinds) => {
         ...((_b = context.environment.jobOnlyVars.deploy.secretEnvVarKeys) !== null && _b !== void 0 ? _b : []),
     ];
     return Object.fromEntries(keys.map(({ key }) => {
-        const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.env, context.name, key);
+        const name = (0, getEnvironmentVariables_1.getSecretVarName)(context.environment.secretsEnv, context.name, key);
         return [name, vaultValueExpression(name, kinds)];
     }));
 };
@@ -4141,6 +4164,7 @@ exports.GitlabBackend = void 0;
 const promises_1 = __nccwpck_require__(91943);
 const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
+const configruedEnvs_1 = __nccwpck_require__(38866);
 const autoStop_1 = __nccwpck_require__(72792);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
@@ -4248,8 +4272,15 @@ class GitlabBackend {
         // release jobs themselves are created afterwards — they need the
         // main-branch job list for the queued-release executor's needs.
         images.resolveRef({ catladderImage: (0, release_1.getReleaseMethod)(config).image });
-        // for all triggers create jobs and add base rules
-        const jobsPerTrigger = await Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(async (trigger) => ({
+        // for all triggers create jobs and add base rules. Branch triggers
+        // (envs with `on: { branch: ... }`) each get their own pipeline next
+        // to the built-in ones.
+        const branchTriggers = (0, configruedEnvs_1.getConfiguredBranchTriggers)(config);
+        const allTriggers = [
+            ...config_1.ALL_PIPELINE_TRIGGERS,
+            ...branchTriggers,
+        ];
+        const jobsPerTrigger = await Promise.all(allTriggers.map(async (trigger) => ({
             trigger,
             jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
         })));
@@ -4327,6 +4358,7 @@ class GitlabBackend {
                 // per-pipeline-type variables (pipelines.gitlab.runnerVariables)
                 ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
             },
+            branchPipelines: branchTriggers.map(({ branch }) => branch),
             autoStop: (0, autoStop_1.getAutoStopConfig)(config),
         });
     }
@@ -4344,6 +4376,13 @@ function getGitlabRulesForTrigger(trigger) {
     // mainBranch: on push to main branch except it's a release commit
     // mr: on merge request
     // taggedRelease: on tag
+    // { branch }: on push to that specific branch
+    if ((0, config_1.isBranchTrigger)(trigger)) {
+        return [
+            rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
+            { if: `$CI_COMMIT_BRANCH == "${trigger.branch}"` },
+        ];
+    }
     switch (trigger) {
         case "mainBranch":
             return [
@@ -4596,16 +4635,21 @@ const addGitlabEnvironment = (context, catladderJobEnvironment, job, allJobs) =>
         return job;
     }
     const { env, name, environment } = context;
-    const { envVars, envType } = environment;
+    const { envVars, instance } = environment;
     const { onStop, autoStopIn, action } = catladderJobEnvironment;
     // those can be dynamic, so we therefore have to do this: https://docs.gitlab.com/ee/ci/environments/#set-a-dynamic-environment-url
-    const dotEnvFile = "gitlab_environment.env";
+    // absolute: deploy scripts may `cd` into the component dir (pages,
+    // custom), while gitlab resolves `reports.dotenv` relative to the
+    // project dir — a relative file would land in <dir>/ and never be
+    // picked up ("no matching files"), leaving the environment without url
+    const dotEnvFileName = "gitlab_environment.env";
+    const dotEnvFile = `"$CI_PROJECT_DIR/${dotEnvFileName}"`;
     const createsJobEnv = !catladderJobEnvironment.action ||
         catladderJobEnvironment.action === "start";
     const artifacts = (0, lodash_es_1.merge)((_a = job.artifacts) !== null && _a !== void 0 ? _a : {}, createsJobEnv
         ? {
             reports: {
-                dotenv: dotEnvFile,
+                dotenv: dotEnvFileName,
             },
         }
         : {});
@@ -4613,7 +4657,7 @@ const addGitlabEnvironment = (context, catladderJobEnvironment, job, allJobs) =>
         `echo "${exports.GITLAB_ENVIRONMENT_URL_VARIABLE}=${(0, bash_1.getBashVariable)("ROOT_URL")}" >> ${dotEnvFile}`,
     ];
     // this is NOT a bashVariable since it NEEDS to be used as a string in gitlab
-    const gitlabEnvironmentName = envType === "review"
+    const gitlabEnvironmentName = instance.type === "review"
         ? `${env}/$CI_COMMIT_REF_NAME/${name}` // FIXME: should be replaced with mr name as well
         : `${env}/${name}`;
     return {
@@ -4781,7 +4825,7 @@ const rules_1 = __nccwpck_require__(78503);
  * build-free image (a catladder job image would drag in a build job).
  */
 const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, autoStop, ...config }) => {
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, branchPipelines = [], autoStop, ...config }) => {
     const pinLabel = autoStop && autoStop.pinLabel;
     return {
         image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
@@ -4862,6 +4906,13 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, aut
                         PIPELINE_NAME: "Main - $CI_COMMIT_TITLE",
                     },
                 },
+                ...branchPipelines.map((branch) => ({
+                    if: `$CI_COMMIT_BRANCH == "${branch}"`,
+                    variables: {
+                        PIPELINE_ICON: "🐱🔨",
+                        PIPELINE_NAME: `${branch} - $CI_COMMIT_TITLE`,
+                    },
+                })),
                 {
                     when: "always", // fallback
                     variables: {
@@ -4987,8 +5038,10 @@ mainBranchJobNames) => {
         },
     };
     // informational MR check of the release method (e.g. the changeset
-    // check): warns via allow_failure, the report lands in the MR
-    // widget as an exposed artifact
+    // check): the report lands in the MR widget as an exposed artifact.
+    // The check script exits 0 even when it warns — gitlab only resolves
+    // exposed artifacts of successful jobs, a failed (allow_failure) job
+    // leaves the widget spinning on "Loading artifacts" forever
     const checkJob = method.checkScript
         ? {
             ["🦋 changeset check"]: {
@@ -5003,7 +5056,7 @@ mainBranchJobNames) => {
                 artifacts: {
                     paths: ["changeset-report.md"],
                     expose_as: "changeset report",
-                    // the report must survive the warning exit
+                    // keep the report should the check itself crash
                     when: "always",
                 },
                 rules: [
@@ -7288,8 +7341,10 @@ exports.createCatenvContext = createCatenvContext;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getAllEnvsByTrigger = exports.getAllEnvsInAllComponents = exports.getAllEnvs = void 0;
+exports.getConfiguredBranchTriggers = exports.getAllEnvsByTrigger = exports.getAllEnvsInAllComponents = exports.getAllEnvs = void 0;
 const types_1 = __nccwpck_require__(63557);
+const getEnvOn_1 = __nccwpck_require__(60601);
+const getEnvType_1 = __nccwpck_require__(46080);
 const getConfiguredAndDefaultEnvs = (config, componentName, envTypes) => {
     var _a, _b;
     const configuredEnvs = (_a = config.components[componentName].env) !== null && _a !== void 0 ? _a : {};
@@ -7297,13 +7352,33 @@ const getConfiguredAndDefaultEnvs = (config, componentName, envTypes) => {
     // these can be disabled with settimg them to `false`
     // this is the list of all not disabled envs. These are always returned
     const enabledDefaultEnvs = envTypes.filter((e) => configuredEnvs[e] !== false);
-    const configuredCustomEnvs = Object.entries((_b = config.components[componentName].env) !== null && _b !== void 0 ? _b : {})
+    // envs declared project-wide (top-level `environments`): every
+    // component deploys to them unless it opts out with `env.<name>: false`
+    const declaredEnvs = Object.keys((_b = config.environments) !== null && _b !== void 0 ? _b : {})
+        .filter((envName) => !(0, types_1.isKnowEnvType)(envName)) // default envs are already handled above
+        .map((envName) => {
+        const envType = (0, getEnvType_1.getDeclaredEnvType)(config.environments, envName);
+        if (!envType) {
+            throw new Error(`environment "${envName}" needs a type (dev, review, stage, prod) or an inherit`);
+        }
+        return [envName, envType];
+    })
+        .filter(([envName, envType]) => envTypes.includes(envType) && configuredEnvs[envName] !== false)
+        .map(([envName]) => envName);
+    // legacy: custom envs declared per component via their `type`
+    const configuredCustomEnvs = Object.entries(configuredEnvs)
         .filter(([, config]) => config &&
         "type" in config &&
         config.type &&
         envTypes.includes(config.type))
         .map(([envName]) => envName);
-    return [...new Set([...enabledDefaultEnvs, ...configuredCustomEnvs])];
+    return [
+        ...new Set([
+            ...enabledDefaultEnvs,
+            ...declaredEnvs,
+            ...configuredCustomEnvs,
+        ]),
+    ];
 };
 const getAllEnvs = (config, componentName) => {
     return getConfiguredAndDefaultEnvs(config, componentName, types_1.DEFAULT_ENV_TYPES);
@@ -7315,11 +7390,38 @@ const getAllEnvsInAllComponents = (config) => {
     ];
 };
 exports.getAllEnvsInAllComponents = getAllEnvsInAllComponents;
+/**
+ * the resolved `on` of one env of a component (the project-wide `on`
+ * of the env, falling back to the env type's default trigger)
+ */
+const getEnvOnForComponentEnv = (config, componentName, env) => {
+    var _a;
+    const entry = (_a = config.components[componentName].env) === null || _a === void 0 ? void 0 : _a[env];
+    return (0, getEnvOn_1.getEnvOn)(env, entry && entry !== false ? entry : {}, config.environments);
+};
 const getAllEnvsByTrigger = (config, componentName, trigger) => {
-    const envTypesByTrigger = (0, types_1.getEnvTypesByTrigger)(trigger);
-    return getConfiguredAndDefaultEnvs(config, componentName, envTypesByTrigger);
+    return (0, exports.getAllEnvs)(config, componentName).filter((env) => (0, types_1.envTriggerEquals)(getEnvOnForComponentEnv(config, componentName, env), trigger));
 };
 exports.getAllEnvsByTrigger = getAllEnvsByTrigger;
+/**
+ * all branch triggers declared by any env of any component (via
+ * `on: { branch: "..." }`), deduplicated and sorted for deterministic
+ * pipeline generation. Each gets its own pipeline next to the built-in
+ * triggers.
+ */
+const getConfiguredBranchTriggers = (config) => {
+    const branches = new Set();
+    for (const componentName of Object.keys(config.components)) {
+        for (const env of (0, exports.getAllEnvs)(config, componentName)) {
+            const on = getEnvOnForComponentEnv(config, componentName, env);
+            if (on && (0, types_1.isBranchTrigger)(on)) {
+                branches.add(on.branch);
+            }
+        }
+    }
+    return [...branches].sort().map((branch) => ({ branch }));
+};
+exports.getConfiguredBranchTriggers = getConfiguredBranchTriggers;
 //# sourceMappingURL=configruedEnvs.js.map
 
 /***/ }),
@@ -7650,53 +7752,237 @@ exports.getBuildInfoVariables = getBuildInfoVariables;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getEnvConfig = void 0;
 const lodash_es_1 = __nccwpck_require__(50210);
+const getEnvInherit_1 = __nccwpck_require__(52181);
 const getEnvConfig = (config, componentName, env) => {
-    var _a, _b;
+    var _a;
     const defaultConfig = config.components[componentName];
     if (!defaultConfig) {
         throw new Error("unknown component " + componentName);
     }
-    const envCustomizations = (_b = (_a = defaultConfig.env) === null || _a === void 0 ? void 0 : _a[env]) !== null && _b !== void 0 ? _b : {};
-    if (envCustomizations === false) {
-        // env is disabled, still return the default config
-        return defaultConfig;
-    }
-    /**
-     * env config is merged with default. Arrays are not merged.
-     * you can customize this by providing a function that takes the default value as argument
-     */
-    return (0, lodash_es_1.mergeWith)(
+    // env config is layered onto the component config: the per-component
+    // overrides of inherited envs first (oldest ancestor first, see
+    // `environments.<name>.inherit`), the env's own overrides last
+    const chain = [...(0, getEnvInherit_1.getInheritedConfigChain)(config.environments, env), env];
     // mergeWith unfortunatly mutates the first object, so we need to clone it.
     // Passing empty object also doesn't work for us, because that will mess with the customizer function (second argument isn't nessecary the customized value)
-    (0, lodash_es_1.cloneDeep)(defaultConfig), envCustomizations, (defaultValue, customValue, key, obj, source) => {
-        // check if custom value is a function (and default is not),
-        // we currently don't have config options, that are functions, but we might in the future (customJobs is an exception)
-        if (typeof customValue === "function" &&
-            typeof defaultValue !== "function") {
-            return customValue(defaultValue);
+    const result = (0, lodash_es_1.cloneDeep)(defaultConfig);
+    for (const chainEnv of chain) {
+        const envCustomizations = (_a = defaultConfig.env) === null || _a === void 0 ? void 0 : _a[chainEnv];
+        if (!envCustomizations || envCustomizations === false) {
+            if (chainEnv === env && envCustomizations === false) {
+                // env is disabled, still return the default config
+                return defaultConfig;
+            }
+            continue;
         }
-        return undefined;
-    });
+        /**
+         * env config is merged with default. Arrays are not merged.
+         * you can customize this by providing a function that takes the default value as argument
+         */
+        (0, lodash_es_1.mergeWith)(result, 
+        // `host` must stay unique per env and `type` is the inherited
+        // env's identity — neither is inherited
+        chainEnv === env
+            ? envCustomizations
+            : (0, lodash_es_1.omit)(envCustomizations, ["host", "type"]), (defaultValue, customValue, key, obj, source) => {
+            // check if custom value is a function (and default is not),
+            // we currently don't have config options, that are functions, but we might in the future (customJobs is an exception)
+            if (typeof customValue === "function" &&
+                typeof defaultValue !== "function") {
+                return customValue(defaultValue);
+            }
+            return undefined;
+        });
+    }
+    return result;
 };
 exports.getEnvConfig = getEnvConfig;
 //# sourceMappingURL=getEnvConfig.js.map
 
 /***/ }),
 
+/***/ 52181:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getSecretsEnv = exports.getInheritedConfigChain = exports.normalizeEnvInherit = void 0;
+const config_1 = __nccwpck_require__(75591);
+const normalizeEnvInherit = (inherit) => {
+    if (!inherit)
+        return {};
+    if (typeof inherit === "string") {
+        return { config: inherit, secrets: inherit };
+    }
+    return {
+        config: inherit.config,
+        secrets: inherit.secrets === false ? undefined : inherit.secrets,
+    };
+};
+exports.normalizeEnvInherit = normalizeEnvInherit;
+const assertValidInheritTarget = (environments, env, target) => {
+    if (target === "local") {
+        throw new Error(`environment "${env}" cannot inherit from "local" — local is not a deployment environment`);
+    }
+    if (!(0, config_1.isKnowEnvType)(target) && !(environments === null || environments === void 0 ? void 0 : environments[target])) {
+        throw new Error(`environment "${env}" inherits from unknown environment "${target}"`);
+    }
+};
+/**
+ * the chain of envs whose per-component config overrides feed into
+ * `env`, oldest ancestor first (env itself not included). Cycles and
+ * unknown/`local` targets are an error.
+ */
+const getInheritedConfigChain = (environments, env) => {
+    var _a;
+    const chain = [];
+    const seen = new Set([env]);
+    let current = env;
+    for (;;) {
+        const target = (0, exports.normalizeEnvInherit)((_a = environments === null || environments === void 0 ? void 0 : environments[current]) === null || _a === void 0 ? void 0 : _a.inherit).config;
+        if (!target)
+            break;
+        assertValidInheritTarget(environments, current, target);
+        if (seen.has(target)) {
+            throw new Error(`environment "${env}" has a cyclic config inheritance via "${target}"`);
+        }
+        seen.add(target);
+        chain.unshift(target);
+        current = target;
+    }
+    return chain;
+};
+exports.getInheritedConfigChain = getInheritedConfigChain;
+/**
+ * the env whose secret values `env` uses (follows `inherit` secret
+ * sharing transitively; the env itself when it has its own secrets).
+ * All secret variable names must be built with this env.
+ */
+const getSecretsEnv = (environments, env) => {
+    var _a;
+    const seen = new Set([env]);
+    let current = env;
+    for (;;) {
+        const target = (0, exports.normalizeEnvInherit)((_a = environments === null || environments === void 0 ? void 0 : environments[current]) === null || _a === void 0 ? void 0 : _a.inherit).secrets;
+        if (!target)
+            return current;
+        assertValidInheritTarget(environments, current, target);
+        if (seen.has(target)) {
+            throw new Error(`environment "${env}" has a cyclic secrets inheritance via "${target}"`);
+        }
+        seen.add(target);
+        current = target;
+    }
+};
+exports.getSecretsEnv = getSecretsEnv;
+//# sourceMappingURL=getEnvInherit.js.map
+
+/***/ }),
+
+/***/ 13055:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getEnvInstance = void 0;
+const bash_1 = __nccwpck_require__(94143);
+const bashExpressionPerPipelineType_1 = __nccwpck_require__(6495);
+const getEnvOn_1 = __nccwpck_require__(60601);
+const REVIEW_SLUG = {
+    default: "unknown-review-slug",
+    gitlab: new bash_1.BashExpression(`$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })`),
+    // CL_PR_NUMBER is injected by the github backend at the workflow level
+    github: new bash_1.BashExpression(`$([ -n "$CL_PR_NUMBER" ] && echo "pr$CL_PR_NUMBER" || echo "unknown")`),
+};
+const getEnvInstance = (envConfig, env, pipelineType, environments) => {
+    // an env deploying per merge request is a review app — one dynamic
+    // instance per MR, identified by the review slug
+    if ((0, getEnvOn_1.getEnvOn)(env, envConfig, environments) === "mr") {
+        return {
+            type: "review",
+            reviewSlug: (0, bashExpressionPerPipelineType_1.getBashExpressionPerPipelineType)(REVIEW_SLUG, pipelineType),
+        };
+    }
+    return { type: "stable" };
+};
+exports.getEnvInstance = getEnvInstance;
+//# sourceMappingURL=getEnvInstance.js.map
+
+/***/ }),
+
+/***/ 60601:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getEnvOn = void 0;
+const types_1 = __nccwpck_require__(63557);
+const getEnvType_1 = __nccwpck_require__(46080);
+const getDefaultOnForType = (envType) => {
+    var _a;
+    const triggers = types_1.ENV_TYPES[envType].triggers;
+    return (_a = triggers[0]) !== null && _a !== void 0 ? _a : false;
+};
+/**
+ * resolves when an env deploys: the project-wide `on` config of the env
+ * (top-level `environments`), falling back to the default of its env
+ * type (dev → mainBranch, review → mr, stage/prod → taggedRelease,
+ * local → false).
+ *
+ * `on` is deliberately not configurable per component — an environment
+ * deploys at one point in time for the whole project.
+ */
+const getEnvOn = (env, envConfig, environments) => {
+    var _a;
+    const on = (_a = environments === null || environments === void 0 ? void 0 : environments[env]) === null || _a === void 0 ? void 0 : _a.on;
+    if (on !== undefined)
+        return on;
+    return getDefaultOnForType((0, getEnvType_1.getEnvType)(env, envConfig, environments));
+};
+exports.getEnvOn = getEnvOn;
+//# sourceMappingURL=getEnvOn.js.map
+
+/***/ }),
+
 /***/ 46080:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getEnvType = void 0;
+exports.getEnvType = exports.getDeclaredEnvType = void 0;
 const types_1 = __nccwpck_require__(63557);
-const getEnvType = (env, envConfig) => {
-    if (envConfig.type)
-        return envConfig.type;
-    if ((0, types_1.isKnowEnvType)(env)) {
+const getEnvInherit_1 = __nccwpck_require__(52181);
+/**
+ * the type of a project-wide declared env: its explicit `type`, its
+ * name (when it is itself an env type), or — for envs that inherit —
+ * the type of the env they inherit their config from
+ */
+const getDeclaredEnvType = (environments, env, seen = new Set()) => {
+    const declared = environments === null || environments === void 0 ? void 0 : environments[env];
+    if (declared === null || declared === void 0 ? void 0 : declared.type)
+        return declared.type;
+    if ((0, types_1.isKnowEnvType)(env))
         return env;
+    const inheritTarget = (0, getEnvInherit_1.normalizeEnvInherit)(declared === null || declared === void 0 ? void 0 : declared.inherit).config;
+    if (inheritTarget && !seen.has(inheritTarget)) {
+        seen.add(inheritTarget);
+        return (0, exports.getDeclaredEnvType)(environments, inheritTarget, seen);
     }
+    return undefined;
+};
+exports.getDeclaredEnvType = getDeclaredEnvType;
+const getEnvType = (env, envConfig, environments) => {
+    // legacy: per-component custom envs declare their type themselves
+    if (envConfig.type)
+        return envConfig.type;
+    // project-wide declaration (top-level `environments`)
+    const declaredType = (0, exports.getDeclaredEnvType)(environments, env);
+    if (declaredType)
+        return declaredType;
     throw new Error("unknown env type: " + env);
 };
 exports.getEnvType = getEnvType;
@@ -7722,8 +8008,11 @@ const getEnvironment = async (ctx) => {
         envType,
         fullName: envContext.fullName,
         slugPrefix: envContext.environmentSlugPrefix,
+        instance: envContext.instance,
         reviewSlug: envContext.reviewSlug,
         slug: envContext.environmentSlug,
+        autoStop: envContext.autoStop,
+        secretsEnv: envContext.secretsEnv,
         ...variables,
     };
 };
@@ -7741,19 +8030,26 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getEnvironmentContext = void 0;
 const bash_1 = __nccwpck_require__(94143);
 const getEnvConfig_1 = __nccwpck_require__(69578);
+const getEnvInstance_1 = __nccwpck_require__(13055);
+const getEnvInherit_1 = __nccwpck_require__(52181);
 const getEnvType_1 = __nccwpck_require__(46080);
-const getReviewSlug_1 = __nccwpck_require__(77360);
-const getEnvironmentSlugPrefix = (env, reviewSlug) => {
-    if (reviewSlug) {
-        return (0, bash_1.joinBashExpressions)([env, reviewSlug], "-");
+const getEnvironmentSlugPrefix = (env, instance) => {
+    if (instance.type === "review") {
+        return (0, bash_1.joinBashExpressions)([env, instance.reviewSlug], "-");
     }
     return env;
 };
 const getEnvironmentContext = ({ env, componentName, config, pipelineType, }) => {
+    var _a, _b;
     const envConfigRaw = (0, getEnvConfig_1.getEnvConfig)(config, componentName, env);
-    const envType = (0, getEnvType_1.getEnvType)(env, envConfigRaw);
-    const reviewSlug = (0, getReviewSlug_1.getReviewSlug)(envConfigRaw, env, pipelineType);
-    const environmentSlugPrefix = getEnvironmentSlugPrefix(env, reviewSlug);
+    const envType = (0, getEnvType_1.getEnvType)(env, envConfigRaw, config.environments);
+    const instance = (0, getEnvInstance_1.getEnvInstance)(envConfigRaw, env, pipelineType, config.environments);
+    // component-level autoStop overrides the project-wide environment
+    // config; undefined means the env type's default applies
+    const autoStop = envConfigRaw.autoStop !== undefined
+        ? envConfigRaw.autoStop
+        : (_b = (_a = config.environments) === null || _a === void 0 ? void 0 : _a[env]) === null || _b === void 0 ? void 0 : _b.autoStop;
+    const environmentSlugPrefix = getEnvironmentSlugPrefix(env, instance);
     const environmentSlug = environmentSlugPrefix.concat(`-${componentName}`);
     const fullName = (0, bash_1.joinBashExpressions)([config.customerName, config.appName, environmentSlug], "-");
     return {
@@ -7762,10 +8058,13 @@ const getEnvironmentContext = ({ env, componentName, config, pipelineType, }) =>
         buildConfigRaw: envConfigRaw.build,
         environmentSlugPrefix,
         environmentSlug,
-        reviewSlug,
+        instance,
+        reviewSlug: instance.type === "review" ? instance.reviewSlug : null,
         pipelineType,
         fullName,
         envType,
+        autoStop,
+        secretsEnv: (0, getEnvInherit_1.getSecretsEnv)(config.environments, env),
         componentName,
         env,
         fullConfig: config,
@@ -7850,7 +8149,7 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
         ...(0, envVars_1.normalizeSecretVarsConfig)((_f = envConfigRaw.vars) === null || _f === void 0 ? void 0 : _f.secret),
         ...additionalSecretKeys,
     ];
-    const secretEnvVars = (0, envVars_1.makeSecretEnvVarMapping)(env, componentName, secretEnvVarKeys);
+    const secretEnvVars = (0, envVars_1.makeSecretEnvVarMapping)(environmentContext.secretsEnv, componentName, secretEnvVarKeys);
     const publicEnvVarsRawSanitized = (0, envVars_1.stringifyValues)(publicEnvVarsRaw);
     const publicEnvVarsUnresolved = Object.fromEntries(Object.entries(publicEnvVarsRawSanitized).map(([key, value]) => [
         key,
@@ -7884,11 +8183,11 @@ const getEnvironmentVariables = async (ctx, options = {}) => {
         envVars,
         secretEnvVarKeys,
         jobOnlyVars: {
-            build: await (0, transformJobOnlyVars_1.transformJobOnlyVars)(env, componentName, (buildConfigRaw &&
+            build: await (0, transformJobOnlyVars_1.transformJobOnlyVars)(environmentContext.secretsEnv, componentName, (buildConfigRaw &&
                 (0, types_1.isStandaloneBuildConfig)(buildConfigRaw) &&
                 buildConfigRaw.jobVars) ||
                 null),
-            deploy: await (0, transformJobOnlyVars_1.transformJobOnlyVars)(env, componentName, (deployConfigRaw && deployConfigRaw.jobVars) || null),
+            deploy: await (0, transformJobOnlyVars_1.transformJobOnlyVars)(environmentContext.secretsEnv, componentName, (deployConfigRaw && deployConfigRaw.jobVars) || null),
         },
     };
 };
@@ -7900,7 +8199,7 @@ const addIndexVar = (vars) => ({
     ...vars,
     _ALL_ENV_VAR_KEYS: JSON.stringify(Object.keys(vars)),
 });
-const getSecretVarNameForContext = (context, key) => (0, exports.getSecretVarName)(context.env, context.name, key);
+const getSecretVarNameForContext = (context, key) => (0, exports.getSecretVarName)(context.environment.secretsEnv, context.name, key);
 exports.getSecretVarNameForContext = getSecretVarNameForContext;
 //# sourceMappingURL=getEnvironmentVariables.js.map
 
@@ -7944,34 +8243,6 @@ exports.getLabels = getLabels;
 
 /***/ }),
 
-/***/ 77360:
-/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
-
-"use strict";
-
-Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.getReviewSlug = void 0;
-const bash_1 = __nccwpck_require__(94143);
-const bashExpressionPerPipelineType_1 = __nccwpck_require__(6495);
-const getEnvType_1 = __nccwpck_require__(46080);
-const REVIEW_SLUG = {
-    default: "unknown-review-slug",
-    gitlab: new bash_1.BashExpression(`$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })`),
-    // CL_PR_NUMBER is injected by the github backend at the workflow level
-    github: new bash_1.BashExpression(`$([ -n "$CL_PR_NUMBER" ] && echo "pr$CL_PR_NUMBER" || echo "unknown")`),
-};
-const getReviewSlug = (envConfig, env, pipelineType) => {
-    const envType = (0, getEnvType_1.getEnvType)(env, envConfig);
-    if (envType === "review") {
-        return (0, bashExpressionPerPipelineType_1.getBashExpressionPerPipelineType)(REVIEW_SLUG, pipelineType);
-    }
-    return null; // not a review app;
-};
-exports.getReviewSlug = getReviewSlug;
-//# sourceMappingURL=getReviewSlug.js.map
-
-/***/ }),
-
 /***/ 15707:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -7994,6 +8265,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(53373), exports);
 __exportStar(__nccwpck_require__(69578), exports);
+__exportStar(__nccwpck_require__(52181), exports);
 __exportStar(__nccwpck_require__(21494), exports);
 __exportStar(__nccwpck_require__(17429), exports);
 //# sourceMappingURL=index.js.map
@@ -8603,8 +8875,11 @@ class DeployJob extends jobs_1.CatladderJob {
         var _a, _b, _c, _d, _e, _f, _g;
         const hasDocker = (0, docker_1.requiresDockerBuild)(context);
         const isStoppable = (0, utils_1.contextIsStoppable)(context);
+        // env-level autoStop config wins; the env type only supplies the
+        // default (via the project-wide `autoStop` durations)
+        const autoStopConfigured = context.environment.autoStop;
         const autoStopConfig = (0, autoStop_1.getAutoStopConfig)(context.fullConfig);
-        const autoStop = context.environment.envType === "review"
+        const autoStopDefault = context.environment.envType === "review"
             ? // review envs read the lifetime from a pipeline variable, so
                 // the pin label's workflow rule can override it to "never"
                 autoStopConfig.pinLabel === false
@@ -8613,6 +8888,13 @@ class DeployJob extends jobs_1.CatladderJob {
             : context.environment.envType === "dev"
                 ? autoStopConfig.dev
                 : undefined;
+        // NOTE: an explicit env-level autoStop is a literal — a review env
+        // overriding it opts out of the pin-label variable indirection
+        const autoStop = autoStopConfigured === undefined
+            ? autoStopDefault
+            : autoStopConfigured === false
+                ? undefined
+                : autoStopConfigured;
         const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
         // if auto or manual is configured explicitly, use that
         const whenDeployDefined = deployConfig && deployConfig.when ? deployConfig.when : undefined;
@@ -8880,7 +9162,8 @@ exports.getArtifactsRegistryDockerUrl = getArtifactsRegistryDockerUrl;
  * lecacyReviewImageName is only temporary. In old versions the images had no reviewslug in review apps, which makes cleanup harder. We delete all those images now, but need the path
  */
 const getArtifactsRegistryImageName = (context, lecacyReviewImageName = false) => {
-    if (lecacyReviewImageName && context.environment.envType !== "review") {
+    const { instance } = context.environment;
+    if (lecacyReviewImageName && instance.type !== "review") {
         throw new Error("lecacyReviewImageName is only allowed for review app");
     }
     const dockerUrl = (0, exports.getArtifactsRegistryDockerUrl)(context);
@@ -8888,8 +9171,8 @@ const getArtifactsRegistryImageName = (context, lecacyReviewImageName = false) =
         dockerUrl,
         context.env,
         context.name,
-        ...(context.environment.reviewSlug && !lecacyReviewImageName
-            ? [context.environment.reviewSlug]
+        ...(instance.type === "review" && !lecacyReviewImageName
+            ? [instance.reviewSlug]
             : []),
     ];
     return (0, bash_1.joinBashExpressions)(gcloudImagePath, "/");
@@ -8939,7 +9222,7 @@ const getDeleteUnusedImagesCommands = (context, keep = 0) => {
         ...getDeleteImageCommands(buildCacheImageName, 1),
         // because a recent version of catladder had no review-slug in the image name, we have to delete those as well
         // we can later remove this line in some months
-        ...(context.environment.envType === "review"
+        ...(context.environment.instance.type === "review"
             ? (0, gitlab_1.allowFailureInScripts)(getDeleteImageCommands((0, exports.getArtifactsRegistryImageName)(context, true), 0))
             : []),
     ];
@@ -8960,12 +9243,18 @@ const gitlab_1 = __nccwpck_require__(86962);
 const artifactsRegistry_1 = __nccwpck_require__(44330);
 const cloudRunRevisions_1 = __nccwpck_require__(55698);
 const getRemoveOldRevisionsAndImagesCommand = (context, when) => {
+    var _a;
     if (when === "onStop") {
         // service is already deleted, so we don't need to delete old revisions, just delete all images
         return (0, artifactsRegistry_1.getDeleteUnusedImagesCommands)(context);
     }
-    // this number only targets inactive revisions
-    const revisionsToKeep = context.environment.envType === "prod" ? 5 : 0;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    const configuredRevisionsToKeep = deployConfig && deployConfig.type === "google-cloudrun"
+        ? deployConfig.revisionsToKeep
+        : undefined;
+    // this number only targets inactive revisions; the env type only
+    // supplies the default (prod keeps a rollback history)
+    const revisionsToKeep = configuredRevisionsToKeep !== null && configuredRevisionsToKeep !== void 0 ? configuredRevisionsToKeep : (context.environment.envType === "prod" ? 5 : 0);
     // this number needs to be higher than inactive after deploy, so we add one
     const imagesToKeep = revisionsToKeep + 1;
     const deleteOldRevisionsCommands = (0, cloudRunRevisions_1.getDeleteUnusedRevisionsCommands)(context, revisionsToKeep);
@@ -9872,7 +10161,7 @@ const cloudRunExecutionUrl_1 = __nccwpck_require__(49963);
 const database_1 = __nccwpck_require__(11595);
 const getServiceName_1 = __nccwpck_require__(33102);
 exports.GCLOUD_DEPLOY_CREDENTIALS_KEY = "GCLOUD_DEPLOY_credentialsKey";
-const getCloudSqlVariables = ({ deployConfigRaw, environmentSlugPrefix, env, componentName, fullConfig, }) => {
+const getCloudSqlVariables = ({ deployConfigRaw, environmentSlugPrefix, secretsEnv, componentName, fullConfig, }) => {
     var _a, _b, _c;
     if (deployConfigRaw && deployConfigRaw.cloudSql) {
         const DB_NAME = (0, utils_1.getFullDbName)(deployConfigRaw.cloudSql, fullConfig, environmentSlugPrefix, componentName);
@@ -9883,7 +10172,7 @@ const getCloudSqlVariables = ({ deployConfigRaw, environmentSlugPrefix, env, com
             CLOUD_SQL_INSTANCE_CONNECTION_NAME: deployConfigRaw.cloudSql.instanceConnectionName,
             DB_NAME: DB_NAME,
             DB_USER: (_b = deployConfigRaw.cloudSql.dbUser) !== null && _b !== void 0 ? _b : "postgres",
-            DB_PASSWORD: "$" + (0, context_1.getSecretVarName)(env, componentName, "DB_PASSWORD"),
+            DB_PASSWORD: "$" + (0, context_1.getSecretVarName)(secretsEnv, componentName, "DB_PASSWORD"),
         };
         return {
             ...dbVars,
@@ -10356,7 +10645,7 @@ const fromComponentContext = (context) => {
         environmentSlugPrefix: context.environment.slugPrefix,
         componentName: context.name,
         env: context.env,
-        isReviewEnv: context.environment.envType === "review",
+        isReviewEnv: context.environment.instance.type === "review",
         deployConfig: deployConfig && deployConfig.type === "google-cloudrun"
             ? deployConfig
             : null,
@@ -10368,7 +10657,7 @@ const fromEnvironmentContext = (context) => ({
     environmentSlugPrefix: context.environmentSlugPrefix,
     componentName: context.componentName,
     env: context.env,
-    isReviewEnv: context.envType === "review",
+    isReviewEnv: context.instance.type === "review",
     deployConfig: context.deployConfigRaw || null,
     config: context.fullConfig,
 });
@@ -10822,9 +11111,9 @@ exports.KUBERNETES_DEPLOY_TYPE = {
     jobs: deployJob_1.createKubernetesDeployJobs,
     defaults: () => ({}),
     additionalSecretKeys: additionalSecretKeys_1.additionalKubernetesSecretKeys,
-    getAdditionalEnvVars: ({ componentName, fullConfig, deployConfigRaw, env, reviewSlug, envType, }) => {
+    getAdditionalEnvVars: ({ componentName, fullConfig, deployConfigRaw, env, instance, }) => {
         var _a;
-        const KUBE_APP_NAME_PREFIX = envType === "review" && reviewSlug ? reviewSlug.concat("-") : "";
+        const KUBE_APP_NAME_PREFIX = instance.type === "review" ? instance.reviewSlug.concat("-") : "";
         const KUBE_APP_NAME = KUBE_APP_NAME_PREFIX.concat(componentName);
         const KUBE_NAMESPACE = (0, __1.getKubernetesNamespace)(fullConfig, env);
         const componentSlug = (0, slugify_1.default)(componentName);
@@ -10833,7 +11122,7 @@ exports.KUBERNETES_DEPLOY_TYPE = {
             "panter.cloud";
         const HOSTNAME_INTERNAL = (0, bash_1.joinBashExpressions)([
             componentSlug,
-            ...(envType === "review" && reviewSlug ? [reviewSlug] : []),
+            ...(instance.type === "review" ? [instance.reviewSlug] : []),
             env,
             fullConfig.appName,
             fullConfig.customerName,
@@ -11191,7 +11480,8 @@ const createPagesDeployJobs = async (context) => {
         throw new Error("deploy config is not pages");
     }
     const onGithub = context.pipelineType === "github";
-    if (onGithub && context.environment.envType === "review") {
+    const isReviewApp = context.environment.instance.type === "review";
+    if (onGithub && isReviewApp) {
         // github pages serves ONE site per repository and deploy-pages
         // replaces all of it — there is no path_prefix equivalent, so per-PR
         // previews cannot exist (deploy-pages has a `preview` input, but it
@@ -11202,7 +11492,7 @@ const createPagesDeployJobs = async (context) => {
     }
     // review environments publish under their own path prefix (gitlab
     // parallel deployments) — every merge request gets a site preview
-    const pathPrefix = context.environment.envType === "review" ? "mr-$CI_MERGE_REQUEST_IID" : "";
+    const pathPrefix = isReviewApp ? "mr-$CI_MERGE_REQUEST_IID" : "";
     const publishDir = (_b = deployConfig.publishDir) !== null && _b !== void 0 ? _b : "public";
     const packageManagerInstall = await (0, packageManagerInstall_1.getPackageManagerInstall)(context, {
         noCustomPostInstall: true,
@@ -12899,12 +13189,22 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.isKnowEnvType = exports.DEFAULT_ENV_TYPES = exports.DEFAULT_ENVS = exports.getEnvTypesByTrigger = exports.ENV_TYPES = exports.ALL_PIPELINE_TRIGGERS = void 0;
+exports.isKnowEnvType = exports.DEFAULT_ENV_TYPES = exports.DEFAULT_ENVS = exports.ENV_TYPES = exports.envTriggerEquals = exports.isBranchTrigger = exports.ALL_PIPELINE_TRIGGERS = void 0;
 exports.ALL_PIPELINE_TRIGGERS = [
     "mainBranch",
     "mr",
     "taggedRelease",
 ];
+const isBranchTrigger = (trigger) => typeof trigger === "object" && trigger !== null && "branch" in trigger;
+exports.isBranchTrigger = isBranchTrigger;
+const envTriggerEquals = (a, b) => {
+    if (a === undefined || a === false)
+        return false;
+    if ((0, exports.isBranchTrigger)(b))
+        return (0, exports.isBranchTrigger)(a) && a.branch === b.branch;
+    return a === b;
+};
+exports.envTriggerEquals = envTriggerEquals;
 /**
  * all env types with their trigger.
  * Each env type has a default env with the same name which is always included
@@ -12926,15 +13226,6 @@ exports.ENV_TYPES = {
         triggers: [],
     },
 };
-/**
- *
- * @param trigger a trigger
- * @returns array of env types for that trigger. this is also the list of default envs
- */
-const getEnvTypesByTrigger = (trigger) => Object.entries(exports.ENV_TYPES)
-    .filter(([, e]) => e.triggers.includes(trigger))
-    .map(([e]) => e);
-exports.getEnvTypesByTrigger = getEnvTypesByTrigger;
 exports.DEFAULT_ENVS = Object.keys(exports.ENV_TYPES);
 exports.DEFAULT_ENV_TYPES = exports.DEFAULT_ENVS;
 const isKnowEnvType = (env) => {