@catladder/cli 5.5.0 → 5.7.0

package/dist/bundles/catenv/index.js

@@ -2655,6 +2655,8 @@ const aggregateCheckJob_1 = __nccwpck_require__(82145);
 const shippedCatci_1 = __nccwpck_require__(27967);
 const githubReleaseJobs_1 = __nccwpck_require__(25073);
 const scriptFiles_1 = __nccwpck_require__(61071);
+const reviewApps_1 = __nccwpck_require__(67071);
+const reviewDeployWorkflow_1 = __nccwpck_require__(73671);
 const WORKFLOWS_FOLDER = ".github/workflows";
 /**
  * generated workflow files are prefixed so that cleanup never touches
@@ -2750,6 +2752,7 @@ class GithubBackend {
             ...(0, ciVariables_1.getGithubInjectedWorkflowEnv)(images.registryImageRef()),
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
+        const reviewApps = (0, reviewApps_1.getReviewAppsConfig)(config);
         const reviewStopJobs = {};
         // jobs routed to the per-kind workflow_dispatch workflows (deploy /
         // stop / rollback). A manual job and its build closure live there
@@ -2792,6 +2795,39 @@ class GithubBackend {
                     triggerJobs.delete(id);
                 }
             }
+            // review delivery chains behind the per-PR deploy switch move to
+            // their own workflow (reviewApps config, or manual review deploys)
+            // When the label/draft policy already decides at the start of the
+            // review run, the chains stay in it behind that condition (one
+            // run, one app build); the review deploy workflow handles whatever
+            // changes later. Manual review deploys only live there.
+            let inRunDeliveryIds = [];
+            const inRunCondition = (0, reviewApps_1.isReviewDeployGated)(reviewApps)
+                ? (0, reviewDeployWorkflow_1.getInRunDeployCondition)(reviewApps)
+                : undefined;
+            if (trigger === "mr") {
+                const deliveryIds = (0, reviewDeployWorkflow_1.getGatedReviewDeliveryJobIds)(triggerJobs, reviewApps);
+                if (deliveryIds.length > 0) {
+                    workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE] = (0, reviewDeployWorkflow_1.makeReviewDeployWorkflow)({
+                        deliveryIds,
+                        triggerJobs,
+                        reviewApps,
+                        images,
+                        workflowEnv,
+                        permissions: workflowPermissions(images).permissions,
+                    });
+                    if (inRunCondition) {
+                        inRunDeliveryIds = deliveryIds;
+                        for (const id of deliveryIds) {
+                            const entry = triggerJobs.get(id);
+                            entry.githubJob = (0, reviewDeployWorkflow_1.withInRunCondition)(entry.githubJob, inRunCondition);
+                        }
+                    }
+                    else {
+                        deliveryIds.forEach((id) => triggerJobs.delete(id));
+                    }
+                }
+            }
             // leaf manual jobs: an explicit manual gate (e.g. a prod deploy) or
             // a stop/rollback task with no automatic trigger. Each becomes a
             // dispatch choice.
@@ -2895,7 +2931,7 @@ class GithubBackend {
             }
             if (Object.keys(jobs).length > 0) {
                 const workflowJobs = { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...jobs };
-                workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
+                const workflow = {
                     ...getTriggerWorkflow(trigger),
                     ...workflowPermissions(images),
                     env: workflowEnv,
@@ -2907,13 +2943,30 @@ class GithubBackend {
                     // required. Added at finalization so its needs cover the
                     // image-build jobs too.
                     jobs: trigger === "mr"
-                        ? { ...workflowJobs, ...(0, aggregateCheckJob_1.makeAggregateCheckJob)(workflowJobs) }
+                        ? {
+                            ...workflowJobs,
+                            ...(0, aggregateCheckJob_1.makeAggregateCheckJob)(workflowJobs, inRunDeliveryIds),
+                            // the stable review app result of an in-run deploy
+                            ...(inRunCondition && inRunDeliveryIds.length > 0
+                                ? (0, reviewDeployWorkflow_1.makeReviewAppAggregateJob)(inRunDeliveryIds, inRunCondition)
+                                : {}),
+                            // once green, hand over to the review deploy workflow
+                            // when the PR deploys but this run didn't
+                            ...(workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE] &&
+                                (0, reviewApps_1.isReviewDeployGated)(reviewApps)
+                                ? (0, reviewDeployWorkflow_1.makeReviewDeployTriggerJob)(reviewApps, inRunCondition)
+                                : {}),
+                        }
                         : workflowJobs,
                 };
+                workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] =
+                    trigger === "mr" && reviewApps.drafts === "skip"
+                        ? (0, reviewDeployWorkflow_1.withDraftsSkipped)(workflow)
+                        : workflow;
             }
         }
         if (Object.keys(reviewStopJobs).length > 0) {
-            workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = {
+            const reviewStopWorkflow = {
                 name: "🛑 catladder stop review app",
                 on: {
                     pull_request: { types: ["closed"] },
@@ -2940,6 +2993,10 @@ class GithubBackend {
                 },
                 jobs: { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...reviewStopJobs },
             };
+            workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE]
+                ? (0, reviewDeployWorkflow_1.withReviewStopSwitch)(reviewStopWorkflow, reviewApps, (0, reviewApps_1.isReviewDeployGated)(reviewApps) &&
+                    (0, reviewDeployWorkflow_1.getInRunDeployCondition)(reviewApps) !== undefined)
+                : reviewStopWorkflow;
         }
         for (const [kind, bucket] of Object.entries(manualKindBuckets)) {
             if (Object.keys(bucket.jobs).length === 0) {
@@ -3074,7 +3131,12 @@ exports.AGGREGATE_CHECK_JOB_NAME = "catladder ✅";
  *   `success` to `needs` even when red, so they stay non-blocking here
  *   by the same mechanism that keeps their workflow green.
  */
-const makeAggregateCheckJob = (reviewJobs) => ({
+const makeAggregateCheckJob = (reviewJobs, 
+/**
+ * jobs that may be skipped on purpose (review delivery chains behind
+ * the reviewApps switch) — their skip is no failure, their failure is
+ */
+skippable = []) => ({
     [exports.AGGREGATE_CHECK_JOB_ID]: {
         name: exports.AGGREGATE_CHECK_JOB_NAME,
         "runs-on": "ubuntu-latest",
@@ -3085,13 +3147,22 @@ const makeAggregateCheckJob = (reviewJobs) => ({
                 name: exports.AGGREGATE_CHECK_JOB_NAME,
                 // the needs context only interpolates inside the workflow file,
                 // so this script stays inline
-                run: [
-                    `results='\${{ toJSON(needs) }}'`,
-                    `echo "$results"`,
-                    `if echo "$results" | grep -qE '"result": "(failure|cancelled|skipped)"'; then`,
-                    `  echo "a required job did not succeed"; exit 1`,
-                    `fi`,
-                ].join("\n"),
+                run: (skippable.length === 0
+                    ? [
+                        `results='\${{ toJSON(needs) }}'`,
+                        `echo "$results"`,
+                        `if echo "$results" | grep -qE '"result": "(failure|cancelled|skipped)"'; then`,
+                        `  echo "a required job did not succeed"; exit 1`,
+                        `fi`,
+                    ]
+                    : [
+                        `results='\${{ toJSON(needs) }}'`,
+                        `echo "$results"`,
+                        `failed=$(echo "$results" | jq -r --arg skippable ' ${[...skippable].sort().join(" ")} ' 'to_entries[] | .key as $job | select(.value.result == "failure" or .value.result == "cancelled" or (.value.result == "skipped" and ($skippable | contains(" " + $job + " ") | not))) | $job')`,
+                        `if [ -n "$failed" ]; then`,
+                        `  echo "required jobs did not succeed: $failed"; exit 1`,
+                        `fi`,
+                    ]).join("\n"),
                 shell: "bash",
             },
         ],
@@ -3102,6 +3173,97 @@ exports.makeAggregateCheckJob = makeAggregateCheckJob;
 
 /***/ }),
 
+/***/ 75125:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.createArtifactDownloadSteps = exports.createArtifactUploadSteps = exports.artifactArchiveFile = void 0;
+/**
+ * Artifacts are handed between github jobs as ONE tar archive instead
+ * of letting upload-artifact walk the paths itself.
+ *
+ * upload-artifact does not preserve symlinks (it uploads the target's
+ * content) nor file modes, and it strips the paths' common ancestor.
+ * Gitlab artifacts keep all of that, and builds rely on it: next.js
+ * with turbopack writes `.next/node_modules/<pkg>-<hash>` as relative
+ * symlinks into the pnpm virtual store. Copied as plain directories,
+ * node resolves the package's own dependencies from the wrong place
+ * and the app crashes with ERR_MODULE_NOT_FOUND at runtime. tar keeps
+ * symlinks, modes and the paths relative to the repo root (github's
+ * own docs recommend it for exactly this).
+ *
+ * The archive is not hidden (upload-artifact skips hidden files) and
+ * lives in the workspace, the one path run steps and actions agree on
+ * inside job containers too.
+ */
+const artifactArchiveFile = (jobId) => `catladder-artifacts-${jobId}.tar`;
+exports.artifactArchiveFile = artifactArchiveFile;
+const createArtifactUploadSteps = (jobId, paths, condition) => {
+    const archive = (0, exports.artifactArchiveFile)(jobId);
+    const ifCondition = condition ? { if: condition } : {};
+    return [
+        {
+            name: "Archive artifacts",
+            ...ifCondition,
+            run: [
+                "shopt -s nullglob globstar",
+                "paths=()",
+                // unquoted on purpose: artifact paths may be globs. Non-matching
+                // globs vanish (nullglob), missing literal paths are skipped —
+                // gitlab only warns about both, so do we
+                `for path in ${paths.join(" ")}; do`,
+                '  if [ -e "$path" ] || [ -L "$path" ]; then paths+=("$path"); else echo "::warning::artifact path not found: $path"; fi',
+                "done",
+                "if [ ${#paths[@]} -eq 0 ]; then",
+                // an empty archive keeps downstream downloads from failing.
+                // Written by hand: busybox tar (alpine job images) refuses to
+                // create one, and zero blocks are what an empty tar is
+                `  head -c 10240 /dev/zero > ${archive}`,
+                "else",
+                `  tar -cf ${archive} -- "\${paths[@]}"`,
+                "fi",
+            ].join("\n"),
+            shell: "bash",
+        },
+        {
+            name: "Upload artifacts",
+            ...ifCondition,
+            uses: "actions/upload-artifact@v4",
+            with: {
+                name: jobId,
+                path: archive,
+                "if-no-files-found": "error",
+            },
+        },
+    ];
+};
+exports.createArtifactUploadSteps = createArtifactUploadSteps;
+const createArtifactDownloadSteps = (providerIds) => providerIds.length === 0
+    ? []
+    : [
+        ...providerIds.map((id) => ({
+            name: `Download artifacts from ${id}`,
+            uses: "actions/download-artifact@v4",
+            with: { name: id },
+        })),
+        {
+            name: "Extract artifacts",
+            run: providerIds
+                .flatMap((id) => [
+                `tar -xf ${(0, exports.artifactArchiveFile)(id)}`,
+                `rm ${(0, exports.artifactArchiveFile)(id)}`,
+            ])
+                .join("\n"),
+            shell: "bash",
+        },
+    ];
+exports.createArtifactDownloadSteps = createArtifactDownloadSteps;
+//# sourceMappingURL=artifactArchive.js.map
+
+/***/ }),
+
 /***/ 17300:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -3171,6 +3333,7 @@ const utils_1 = __nccwpck_require__(49401);
 const gitlab_1 = __nccwpck_require__(86962);
 const scriptFunctions_1 = __nccwpck_require__(85873);
 const ciVariables_1 = __nccwpck_require__(17300);
+const artifactArchive_1 = __nccwpck_require__(75125);
 /**
  * runner variables that only make sense on gitlab runners and must not
  * leak into github jobs (docker-in-docker daemon config, kubernetes
@@ -3381,7 +3544,7 @@ const getReferencedSecretsEnv = (script, kinds) => Object.fromEntries([...script
     .filter((name) => !ciVariables_1.GITHUB_INJECTED_WORKFLOW_ENV_NAMES.has(name))
     .map((name) => [name, vaultValueExpression(name, kinds)]));
 const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts, secretKinds = new Map()) => {
-    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
     const id = (0, exports.githubJobId)(context, job.name);
     const isComponent = context.type === "component";
     const createsJobEnv = !!job.environment &&
@@ -3526,13 +3689,7 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                 ? []
                 : [{ name: "Checkout", uses: "actions/checkout@v4" }]),
             ...createCacheSteps(context, job),
-            ...needs
-                .filter((n) => n.artifacts)
-                .map((n) => ({
-                name: `Download artifacts from ${n.id}`,
-                uses: "actions/download-artifact@v4",
-                with: { name: n.id },
-            })),
+            ...(0, artifactArchive_1.createArtifactDownloadSteps)(needs.filter((n) => n.artifacts).map((n) => n.id)),
             {
                 name: job.name,
                 id: "main",
@@ -3553,27 +3710,15 @@ const makeGithubJob = (context, job, allJobs, uploadProviderIds, images, scripts
                     },
                 ]
                 : []),
-            ...(pagesPublishDir
-                ? []
-                : uploadProviderIds.has(id) || artifactPaths.length > 0
-                    ? artifactPaths.length > 0
-                        ? [
-                            {
-                                name: "Upload artifacts",
-                                uses: "actions/upload-artifact@v4",
-                                with: {
-                                    name: id,
-                                    path: artifactPaths.join("\n"),
-                                    "if-no-files-found": "warn",
-                                    // gitlab artifacts include everything; upload-artifact
-                                    // silently drops hidden files by default — which is
-                                    // exactly where next.js builds live (.next)
-                                    "include-hidden-files": true,
-                                },
-                            },
-                        ]
-                        : []
-                    : []),
+            ...(!pagesPublishDir && artifactPaths.length > 0
+                ? (0, artifactArchive_1.createArtifactUploadSteps)(id, artifactPaths, 
+                // gitlab's `artifacts.when`: steps only run on success by default
+                ((_k = job.artifacts) === null || _k === void 0 ? void 0 : _k.when) === "always"
+                    ? "always()"
+                    : ((_l = job.artifacts) === null || _l === void 0 ? void 0 : _l.when) === "on_failure"
+                        ? "failure()"
+                        : undefined)
+                : []),
         ],
     };
     return [id, githubJob];
@@ -4062,6 +4207,523 @@ exports.resolveGithubRegistryImage = resolveGithubRegistryImage;
 
 /***/ }),
 
+/***/ 73671:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.withDraftsSkipped = exports.withReviewStopSwitch = exports.makeReviewDeployTriggerJob = exports.makeReviewAppAggregateJob = exports.REVIEW_APP_STATUS_CONTEXT = exports.REVIEW_APP_AGGREGATE_JOB_NAME = exports.REVIEW_APP_AGGREGATE_JOB_ID = exports.makeReviewDeployWorkflow = exports.getGatedReviewDeliveryJobIds = exports.withInRunCondition = exports.getInRunDeployCondition = exports.REVIEW_DEPLOY_WORKFLOW_FILE = void 0;
+const shippedCatci_1 = __nccwpck_require__(27967);
+const resolveRequirements_1 = __nccwpck_require__(81710);
+const reviewApps_1 = __nccwpck_require__(67071);
+const aggregateCheckJob_1 = __nccwpck_require__(82145);
+const ensureImageJobs_1 = __nccwpck_require__(77590);
+const CATCI = `${shippedCatci_1.GENERATED_CATCI_FOLDER}/index.js`;
+/**
+ * the generated review deploy workflow. Keep in sync with
+ * GITHUB_REVIEW_DEPLOY_WORKFLOW in apps/cli/src/reviewApps/github.ts.
+ */
+exports.REVIEW_DEPLOY_WORKFLOW_FILE = "catladder-deploy-review.yml";
+const GUARD_JOB_ID = "catladder-review-deploy-guard";
+const TRIGGER_JOB_ID = "catladder-review-deploy-trigger";
+/** the PR of the run — from the event, or the dispatch input */
+const PR_NUMBER_EXPRESSION = "github.event.number || inputs.pr";
+/** quote a value for a github expression string literal */
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/** combine a job's existing `if` with another condition */
+const andIf = (existing, condition) => {
+    if (!existing) {
+        return `\${{ ${condition} }}`;
+    }
+    const unwrapped = existing.replace(/^\$\{\{\s*([\s\S]*?)\s*\}\}$/, "$1");
+    return `\${{ (${unwrapped}) && (${condition}) }}`;
+};
+/**
+ * the condition under which the review workflow deploys the review apps
+ * ITSELF, decided from the pull request event at the start of the run
+ * (labels, draft) — the common case then needs one run and one app
+ * build, like gitlab's switch job. Whatever changes later (a label set
+ * during or after the run, a draft marked ready, an explicit request) is
+ * handled by the review deploy workflow. `deploy: "manual"` never
+ * deploys on its own: undefined.
+ */
+const getInRunDeployCondition = (reviewApps) => {
+    const labels = "github.event.pull_request.labels.*.name";
+    const policy = reviewApps.deploy === "optIn"
+        ? `contains(${labels}, ${literal(reviewApps.label)})`
+        : reviewApps.deploy === "optOut"
+            ? `!contains(${labels}, ${literal(reviewApps.skipLabel)})`
+            : reviewApps.deploy === "auto"
+                ? undefined
+                : null;
+    if (policy === null) {
+        return undefined;
+    }
+    const notDraft = reviewApps.drafts !== "likeReady"
+        ? "!github.event.pull_request.draft"
+        : undefined;
+    return [policy, notDraft].filter(Boolean).join(" && ") || "true";
+};
+exports.getInRunDeployCondition = getInRunDeployCondition;
+/** combine a job's `if` with the in-run deploy condition */
+const withInRunCondition = (job, condition) => ({
+    ...job,
+    if: andIf(job.if, condition),
+});
+exports.withInRunCondition = withInRunCondition;
+/**
+ * the review delivery jobs (docker → deploy → verify) that move out of
+ * the review workflow into the review deploy workflow:
+ * - all of them when the reviewApps config gates review deploys
+ * - otherwise those of components whose review deploy is manual
+ *   (`deploy.when: "manual"`) — github has no manual jobs inside a run,
+ *   and the generic manual-task dispatch can't carry the pull request
+ */
+const getGatedReviewDeliveryJobIds = (triggerJobs, reviewApps) => {
+    var _a;
+    const gatedByConfig = (0, reviewApps_1.isReviewDeployGated)(reviewApps);
+    const manualComponents = new Set([...triggerJobs.values()]
+        .filter(({ job, context }) => (0, reviewApps_1.isReviewDeliveryJob)(context, job) &&
+        job.stage === "deploy" &&
+        job.gate === "manual")
+        .map(({ context }) => context.name));
+    const ids = new Set([...triggerJobs]
+        .filter(([, { job, context }]) => (0, reviewApps_1.isReviewDeliveryJob)(context, job) &&
+        (gatedByConfig || manualComponents.has(context.name)))
+        .map(([id]) => id));
+    // jobs depending on a moved job (e.g. a custom e2e job waiting for a
+    // review deploy) can't stay behind: they move along
+    let grown = ids.size > 0;
+    while (grown) {
+        grown = false;
+        for (const [id, { githubJob }] of triggerJobs) {
+            if (!ids.has(id) && ((_a = githubJob.needs) === null || _a === void 0 ? void 0 : _a.some((need) => ids.has(need)))) {
+                ids.add(id);
+                grown = true;
+            }
+        }
+    }
+    return [...ids];
+};
+exports.getGatedReviewDeliveryJobIds = getGatedReviewDeliveryJobIds;
+/**
+ * the review deploy workflow (`▶️ catladder deploy review`): the review
+ * delivery chains of a pull request, behind a guard that decides
+ * whether this run deploys (see `catci review-app github-guard`).
+ *
+ * Started by
+ * - the review workflow, once it is green and the label/draft policy
+ *   says the PR deploys (`source: ci`)
+ * - switching the label on (opt-in: adding it, opt-out: removing the
+ *   skip label) or marking a draft ready (`drafts: "checksOnly"`)
+ * - a human or agent dispatching it with the PR number — explicit
+ *   requests always deploy, provided the PR's CI is green
+ *
+ * Artifacts are scoped to a single run, so the run rebuilds what the
+ * chains need (the app build); tests are not rerun — the guard checks
+ * the PR's `catladder ✅` instead.
+ */
+const makeReviewDeployWorkflow = ({ deliveryIds, triggerJobs, reviewApps, images, workflowEnv, permissions, }) => {
+    var _a, _b;
+    const delivery = new Set(deliveryIds);
+    const isQualityJob = (id) => {
+        const entry = triggerJobs.get(id);
+        return !!entry && (0, resolveRequirements_1.providesCapability)(entry.job, "qualityGate");
+    };
+    // the delivery jobs plus everything upstream they need from the
+    // trigger (rebuilt in this run), except the quality jobs
+    const included = new Set();
+    const stack = [...deliveryIds];
+    let current;
+    while ((current = stack.pop()) !== undefined) {
+        if (included.has(current))
+            continue;
+        included.add(current);
+        for (const need of (_b = (_a = triggerJobs.get(current)) === null || _a === void 0 ? void 0 : _a.githubJob.needs) !== null && _b !== void 0 ? _b : []) {
+            if (triggerJobs.has(need) && !isQualityJob(need))
+                stack.push(need);
+        }
+    }
+    // the guard runs first, every other job only when it says deploy
+    const gatedJob = (job) => {
+        var _a;
+        return ({
+            ...job,
+            needs: [GUARD_JOB_ID, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])],
+            if: andIf(job.if, `needs.${GUARD_JOB_ID}.outputs.deploy == 'true'`),
+        });
+    };
+    const checkoutPrHead = (step) => {
+        var _a;
+        return ((_a = step.uses) === null || _a === void 0 ? void 0 : _a.startsWith("actions/checkout@"))
+            ? {
+                ...step,
+                // the PR head — a label event's default is the merge ref
+                with: {
+                    ...step.with,
+                    ref: "${{ github.event.pull_request.head.sha || github.sha }}",
+                },
+            }
+            : step;
+    };
+    const chainJobs = Object.fromEntries([...included].sort().map((id) => {
+        const { githubJob } = triggerJobs.get(id);
+        return [
+            id,
+            gatedJob({
+                ...githubJob,
+                // the quality jobs stay in the review workflow — the guard
+                // checks their aggregate instead
+                ...(githubJob.needs
+                    ? {
+                        needs: githubJob.needs.filter((need) => !isQualityJob(need) || delivery.has(need)),
+                    }
+                    : {}),
+                steps: githubJob.steps.map(checkoutPrHead),
+            }),
+        ];
+    }));
+    // only the images the chains run in (not e.g. the release image)
+    const neededIds = new Set(Object.values(chainJobs).flatMap((job) => { var _a; return (_a = job.needs) !== null && _a !== void 0 ? _a : []; }));
+    const imageJobs = Object.fromEntries(Object.entries((0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images))
+        .filter(([id]) => neededIds.has(id))
+        .map(([id, job]) => [id, gatedJob(job)]));
+    const switchLabel = (0, reviewApps_1.getReviewAppsSwitchLabel)(reviewApps);
+    const pullRequestTypes = [
+        ...(switchLabel ? [switchLabel.deployOn] : []),
+        ...(reviewApps.drafts === "checksOnly" ? ["ready_for_review"] : []),
+    ];
+    // pull request events that concern the review apps — other label
+    // changes must neither run the guard nor cancel a running deploy
+    const relevantEvent = [
+        "github.event_name == 'workflow_dispatch'",
+        ...(switchLabel
+            ? [
+                `(github.event.action == ${literal(switchLabel.deployOn)} && github.event.label.name == ${literal(switchLabel.label)})`,
+            ]
+            : []),
+        ...(reviewApps.drafts === "checksOnly"
+            ? ["github.event.action == 'ready_for_review'"]
+            : []),
+    ].join(" || ");
+    return {
+        name: "▶️ catladder deploy review",
+        on: {
+            workflow_dispatch: {
+                inputs: {
+                    pr: {
+                        description: "number of the pull request whose review apps to deploy",
+                        required: true,
+                        type: "string",
+                    },
+                    source: {
+                        description: "who requests the deploy: manual (always deploys) or ci (applies the label/draft policy)",
+                        required: false,
+                        type: "choice",
+                        options: ["manual", "ci"],
+                        default: "manual",
+                    },
+                },
+            },
+            ...(pullRequestTypes.length > 0
+                ? { pull_request: { types: pullRequestTypes } }
+                : {}),
+        },
+        concurrency: reviewDeployConcurrency(relevantEvent),
+        permissions,
+        env: { ...workflowEnv, CL_PR_NUMBER: `\${{ ${PR_NUMBER_EXPRESSION} }}` },
+        jobs: {
+            [GUARD_JOB_ID]: {
+                name: "🚦 review deploy guard",
+                "runs-on": "ubuntu-latest",
+                ...(pullRequestTypes.length > 0
+                    ? { if: `\${{ ${relevantEvent} }}` }
+                    : {}),
+                permissions: {
+                    contents: "read",
+                    "pull-requests": "read",
+                    checks: "read",
+                    statuses: "write",
+                },
+                env: {
+                    GITHUB_TOKEN: "${{ github.token }}",
+                    CL_REVIEW_APPS: JSON.stringify(reviewApps),
+                    CL_DEPLOY_SOURCE: "${{ github.event_name == 'workflow_dispatch' && (inputs.source || 'manual') || 'label' }}",
+                    CL_HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}",
+                },
+                outputs: { deploy: "${{ steps.main.outputs.deploy }}" },
+                steps: [
+                    catciCheckout(),
+                    {
+                        name: "🚦 review deploy guard",
+                        id: "main",
+                        run: `node ${CATCI} review-app github-guard`,
+                        shell: "bash",
+                    },
+                    {
+                        // the pull request shows the deploy in flight
+                        name: "report pending review app",
+                        if: "${{ steps.main.outputs.deploy == 'true' }}",
+                        env: { GH_TOKEN: "${{ github.token }}" },
+                        run: `gh api "repos/$GITHUB_REPOSITORY/statuses/$CL_HEAD_SHA" -f state=pending -f context="${exports.REVIEW_APP_STATUS_CONTEXT}" -f description="deploying the review apps" -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > /dev/null`,
+                        shell: "bash",
+                    },
+                ],
+            },
+            ...imageJobs,
+            ...chainJobs,
+            ...(0, exports.makeReviewAppAggregateJob)([GUARD_JOB_ID, ...Object.keys(imageJobs), ...Object.keys(chainJobs)], `needs.${GUARD_JOB_ID}.outputs.deploy == 'true'`),
+        },
+    };
+};
+exports.makeReviewDeployWorkflow = makeReviewDeployWorkflow;
+exports.REVIEW_APP_AGGREGATE_JOB_ID = "catladder-review-app-ok";
+exports.REVIEW_APP_AGGREGATE_JOB_NAME = "catladder review app ✅";
+/** the commit status context the aggregate job reports */
+exports.REVIEW_APP_STATUS_CONTEXT = "catladder review app";
+/**
+ * one job with a STABLE name that succeeds exactly when the review apps
+ * of this run deployed and verified — the result a merge gate (a bot,
+ * or a branch rule for projects that deploy every PR) waits for,
+ * regardless of the project's components.
+ *
+ * It also reports a commit status on the PR head: runs started by a
+ * dispatch (the trigger job, or by hand) are attached to the commit but
+ * not shown on the pull request, a commit status always is.
+ *
+ * Runs only when the run deploys (the guard decided so, or the review
+ * workflow's start condition held) — a run that doesn't deploy says
+ * nothing about the review app (its check is skipped, the commit status
+ * untouched). Neither does a cancelled run (superseded by a newer
+ * deploy, or stopped): a gate keeps waiting instead of seeing red.
+ */
+const makeReviewAppAggregateJob = (needs, 
+/** when the run deploys the review apps (a github expression) */
+deploysWhen) => ({
+    [exports.REVIEW_APP_AGGREGATE_JOB_ID]: {
+        name: exports.REVIEW_APP_AGGREGATE_JOB_NAME,
+        "runs-on": "ubuntu-latest",
+        needs: [...needs].sort(),
+        if: `\${{ always() && (${deploysWhen}) }}`,
+        permissions: { statuses: "write" },
+        env: {
+            GH_TOKEN: "${{ github.token }}",
+            HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}",
+            RUN_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+        },
+        steps: [
+            {
+                name: exports.REVIEW_APP_AGGREGATE_JOB_NAME,
+                // the needs context only interpolates inside the workflow file,
+                // so this script stays inline
+                run: [
+                    `results='\${{ toJSON(needs) }}'`,
+                    `echo "$results"`,
+                    `if echo "$results" | grep -qE '"result": "failure"'; then`,
+                    `  state=failure; description="the review apps did not deploy and verify"`,
+                    `elif echo "$results" | grep -qE '"result": "cancelled"'; then`,
+                    `  # superseded by a newer deploy, or stopped: no result, not red`,
+                    `  echo "cancelled — no review app result reported"; exit 0`,
+                    `elif echo "$results" | grep -qE '"result": "skipped"'; then`,
+                    `  state=failure; description="the review apps did not deploy and verify"`,
+                    `else`,
+                    `  state=success; description="review apps deployed and verified"`,
+                    `fi`,
+                    `gh api "repos/$GITHUB_REPOSITORY/statuses/$HEAD_SHA" -f state="$state" -f context="${exports.REVIEW_APP_STATUS_CONTEXT}" -f description="$description" -f target_url="$RUN_URL" > /dev/null`,
+                    `echo "$description"`,
+                    `[ "$state" = success ]`,
+                ].join("\n"),
+                shell: "bash",
+            },
+        ],
+    },
+});
+exports.makeReviewAppAggregateJob = makeReviewAppAggregateJob;
+/** a checkout of just the materialized catci */
+const catciCheckout = () => ({
+    name: "Checkout",
+    uses: "actions/checkout@v4",
+    with: { "sparse-checkout": shippedCatci_1.GENERATED_CATCI_FOLDER },
+});
+/**
+ * one deploy/stop of a PR's review apps at a time, the newest wins —
+ * shared by the deploy and the stop workflow, so closing a PR or
+ * switching the label off cancels a deploy in flight before tearing
+ * down. Events that don't concern the review apps get a group of
+ * their own, so they never cancel anything.
+ */
+const reviewDeployConcurrency = (relevantEvent) => ({
+    group: `catladder-review-deploy-\${{ ${PR_NUMBER_EXPRESSION} }}\${{ !(${relevantEvent}) && format('-ignored-{0}', github.run_id) || '' }}`,
+    "cancel-in-progress": true,
+});
+/**
+ * the last job of the review workflow: once it is green, dispatch the
+ * review deploy workflow when the label/draft policy says this PR
+ * deploys (read fresh from the PR, so a label set while CI ran counts).
+ * Only for policies that deploy on their own — `deploy: "manual"` waits
+ * for an explicit dispatch.
+ */
+const makeReviewDeployTriggerJob = (reviewApps, 
+/** the review workflow deployed itself when this held at its start */
+inRunCondition) => reviewApps.deploy === "manual"
+    ? {}
+    : {
+        [TRIGGER_JOB_ID]: {
+            name: "▶️ trigger review deploy",
+            "runs-on": "ubuntu-latest",
+            needs: [aggregateCheckJob_1.AGGREGATE_CHECK_JOB_ID],
+            ...(inRunCondition
+                ? {
+                    // NOT success(): it also checks the transitive needs,
+                    // and the chains this run skipped on purpose would make
+                    // it false — exactly when the trigger is needed
+                    if: `\${{ !cancelled() && needs.${aggregateCheckJob_1.AGGREGATE_CHECK_JOB_ID}.result == 'success' && !(${inRunCondition}) }}`,
+                }
+                : {}),
+            permissions: {
+                contents: "read",
+                "pull-requests": "read",
+                actions: "write",
+            },
+            env: {
+                GITHUB_TOKEN: "${{ github.token }}",
+                CL_REVIEW_APPS: JSON.stringify(reviewApps),
+                CL_HEAD_REF: "${{ github.head_ref }}",
+                CL_HEAD_SHA: "${{ github.event.pull_request.head.sha }}",
+            },
+            steps: [
+                catciCheckout(),
+                {
+                    name: "▶️ trigger review deploy",
+                    run: `node ${CATCI} review-app github-trigger`,
+                    shell: "bash",
+                },
+            ],
+        },
+    };
+exports.makeReviewDeployTriggerJob = makeReviewDeployTriggerJob;
+/**
+ * the review stop workflow under a label policy: switching the label
+ * off (opt-in: removing it, opt-out: adding the skip label) stops the
+ * review apps, like closing the PR does. It shares the deploy
+ * workflow's concurrency group, so a deploy in flight is cancelled
+ * first.
+ */
+const withReviewStopSwitch = (workflow, reviewApps, 
+/** the review workflow deploys itself (see getInRunDeployCondition) */
+reviewRunDeploys = false) => {
+    const switchLabel = (0, reviewApps_1.getReviewAppsSwitchLabel)(reviewApps);
+    const relevantEvent = [
+        "github.event_name == 'workflow_dispatch'",
+        "github.event.action == 'closed'",
+        ...(switchLabel
+            ? [
+                `(github.event.action == ${literal(switchLabel.stopOn)} && github.event.label.name == ${literal(switchLabel.label)})`,
+            ]
+            : []),
+    ].join(" || ");
+    return {
+        ...workflow,
+        on: {
+            ...workflow.on,
+            pull_request: {
+                types: ["closed", ...(switchLabel ? [switchLabel.stopOn] : [])],
+            },
+        },
+        concurrency: reviewDeployConcurrency(relevantEvent),
+        jobs: Object.fromEntries(Object.entries({
+            ...(reviewRunDeploys ? makeCancelReviewRunsJob() : {}),
+            ...Object.fromEntries(Object.entries(workflow.jobs).map(([id, job]) => {
+                var _a;
+                return [
+                    id,
+                    // the teardown waits until no review run deploys anymore
+                    reviewRunDeploys && !id.startsWith("catladder-image-")
+                        ? {
+                            ...job,
+                            needs: [CANCEL_REVIEW_RUNS_JOB_ID, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])],
+                        }
+                        : job,
+                ];
+            })),
+        }).map(([id, job]) => [
+            id,
+            switchLabel ? { ...job, if: andIf(job.if, relevantEvent) } : job,
+        ])),
+    };
+};
+exports.withReviewStopSwitch = withReviewStopSwitch;
+const CANCEL_REVIEW_RUNS_JOB_ID = "catladder-wait-review-runs";
+/**
+ * the review workflow deploys review apps itself, outside the deploy /
+ * stop concurrency group — a teardown would race a deploy still running
+ * there (the deploy finishing after the stop leaves the app and its
+ * database behind). So the stop first waits for the PR's unfinished
+ * review runs to end — cancelling them when the PR was closed, letting
+ * them finish when only the label was switched off (their CI still
+ * counts). Never fails: a stuck run must not keep the teardown from
+ * running (it gives up after 30 minutes).
+ */
+const makeCancelReviewRunsJob = () => ({
+    [CANCEL_REVIEW_RUNS_JOB_ID]: {
+        name: "wait for running review deploys",
+        "runs-on": "ubuntu-latest",
+        permissions: { actions: "write", "pull-requests": "read" },
+        env: { GH_TOKEN: "${{ github.token }}" },
+        steps: [
+            {
+                name: "wait for running review deploys",
+                run: [
+                    `branch=$(gh pr view "$CL_PR_NUMBER" -R "$GITHUB_REPOSITORY" --json headRefName -q .headRefName) || exit 0`,
+                    `runs=$(gh run list -R "$GITHUB_REPOSITORY" --workflow catladder-review.yml --branch "$branch" --limit 20 --json databaseId,status -q '.[] | select(.status != "completed") | .databaseId') || exit 0`,
+                    `# a closed PR's CI is worthless: cancel it. Otherwise let the`,
+                    `# PR's CI finish (cancelling it would leave catladder ✅ red)`,
+                    `if [ "$(jq -r '.action // ""' "$GITHUB_EVENT_PATH")" = closed ]; then`,
+                    `  for id in $runs; do echo "cancelling review run $id"; gh run cancel "$id" -R "$GITHUB_REPOSITORY" || true; done`,
+                    `fi`,
+                    `for id in $runs; do`,
+                    `  echo "waiting for review run $id"`,
+                    `  for _ in $(seq 1 360); do`,
+                    `    [ "$(gh run view "$id" -R "$GITHUB_REPOSITORY" --json status -q .status)" = completed ] && break`,
+                    `    sleep 5`,
+                    `  done`,
+                    `done`,
+                    `exit 0`,
+                ].join("\n"),
+                shell: "bash",
+            },
+        ],
+    },
+});
+/**
+ * `drafts: "skip"`: draft PRs run nothing — every job of the review
+ * workflow skips them, and marking the PR ready starts the run. A
+ * skipped `catladder ✅` can't let a draft through: drafts can't be
+ * merged.
+ */
+const withDraftsSkipped = (workflow) => {
+    const on = workflow.on;
+    return {
+        ...workflow,
+        on: {
+            ...workflow.on,
+            pull_request: {
+                ...on.pull_request,
+                types: [...on.pull_request.types, "ready_for_review"],
+            },
+        },
+        jobs: Object.fromEntries(Object.entries(workflow.jobs).map(([id, job]) => [
+            id,
+            { ...job, if: andIf(job.if, "!github.event.pull_request.draft") },
+        ])),
+    };
+};
+exports.withDraftsSkipped = withDraftsSkipped;
+//# sourceMappingURL=reviewDeployWorkflow.js.map
+
+/***/ }),
+
 /***/ 61071:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -4166,6 +4828,8 @@ const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
 const configruedEnvs_1 = __nccwpck_require__(38866);
 const autoStop_1 = __nccwpck_require__(72792);
+const reviewApps_1 = __nccwpck_require__(67071);
+const reviewDeployGate_1 = __nccwpck_require__(3485);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
 const shippedCatci_1 = __nccwpck_require__(27967);
@@ -4266,7 +4930,6 @@ class GitlabBackend {
         return [mainInclude, ...componentIncludes];
     }
     async createPipeline(config, images) {
-        const stages = (0, getPipelineStages_1.getPipelineStages)(config);
         // register the release image first: the per-trigger job creation
         // below emits the build jobs of all images registered so far. The
         // release jobs themselves are created afterwards — they need the
@@ -4280,11 +4943,36 @@ class GitlabBackend {
             ...config_1.ALL_PIPELINE_TRIGGERS,
             ...branchTriggers,
         ];
-        const jobsPerTrigger = await Promise.all(allTriggers.map(async (trigger) => ({
-            trigger,
-            jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
-        })));
+        const reviewApps = (0, reviewApps_1.getReviewAppsConfig)(config);
+        const jobsPerTrigger = await Promise.all(allTriggers.map(async (trigger) => {
+            const catladderJobs = await (0, createAllJobs_1.createAllJobs)({
+                config,
+                trigger,
+                pipelineType: this.type,
+            });
+            // review deploys behind one switch per MR (reviewApps config)
+            const reviewDeployGate = trigger === "mr"
+                ? (0, reviewDeployGate_1.addGitlabReviewDeployGate)(catladderJobs, reviewApps)
+                : undefined;
+            const jobs = await (0, createGitlabJobs_1.createGitlabJobs)(catladderJobs, images, getGitlabRulesForTrigger(trigger));
+            return {
+                trigger,
+                jobs: reviewDeployGate
+                    ? [
+                        {
+                            name: reviewDeployGate_1.REVIEW_DEPLOY_GATE_JOB_NAME,
+                            gitlabJob: reviewDeployGate,
+                            context: null,
+                        },
+                        ...jobs,
+                    ]
+                    : jobs,
+            };
+        }));
         const allJobsPerTrigger = jobsPerTrigger.flatMap(({ jobs }) => jobs);
+        const stages = (0, getPipelineStages_1.getPipelineStages)(config, new Set(allJobsPerTrigger
+            .map(({ gitlabJob }) => gitlabJob.stage)
+            .filter((stage) => typeof stage === "string")));
         // the jobs the queued-release executor waits for: everything that
         // runs automatically in a main-branch pipeline. Manual jobs (stop,
         // rollback, gates) are excluded — gitlab skips a job whose needs
@@ -4360,6 +5048,7 @@ class GitlabBackend {
             },
             branchPipelines: branchTriggers.map(({ branch }) => branch),
             autoStop: (0, autoStop_1.getAutoStopConfig)(config),
+            reviewApps,
         });
     }
 }
@@ -4814,21 +5503,23 @@ function getGitlabNeedsForWorkspaceJob(context, { needs }, allJobs) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.createGitlabPipelineWithDefaults = void 0;
+exports.createGitlabPipelineWithDefaults = exports.DEFAULT_PIPELINE_IMAGE = void 0;
 const bash_1 = __nccwpck_require__(94143);
 const autoStop_1 = __nccwpck_require__(72792);
+const reviewApps_1 = __nccwpck_require__(67071);
 const rules_1 = __nccwpck_require__(78503);
 /**
  * gitlab requires a top-level default image for jobs that don't set their
  * own. Every catladder-generated job sets an explicit image, so this
- * fallback is never actually pulled — it just needs to be a valid,
+ * fallback is never pulled for them — it just needs to be a valid,
  * build-free image (a catladder job image would drag in a build job).
+ * Trivial jobs (the review deploy switch) reuse it explicitly.
  */
-const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, branchPipelines = [], autoStop, ...config }) => {
+exports.DEFAULT_PIPELINE_IMAGE = "node:22";
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, branchPipelines = [], autoStop, reviewApps, ...config }) => {
     const pinLabel = autoStop && autoStop.pinLabel;
     return {
-        image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
+        image: image !== null && image !== void 0 ? image : exports.DEFAULT_PIPELINE_IMAGE,
         variables: {
             FF_USE_FASTZIP: "true", // enable fastzip - a faster zip implementation that also supports level configuration.
             ARTIFACT_COMPRESSION_LEVEL: "fast", // we value speed over compression
@@ -4866,6 +5557,16 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, bra
                         PIPELINE_NAME: "Thinking...",
                     },
                 },
+                // reviewApps.drafts: "skip" — draft MRs get no pipeline (rules
+                // stop at the first match, so this must come first)
+                ...((reviewApps === null || reviewApps === void 0 ? void 0 : reviewApps.drafts) === "skip"
+                    ? [
+                        {
+                            if: `${rules_1.RULE_IS_MERGE_REQUEST.if} && ${reviewApps_1.GITLAB_DRAFT_MR_CONDITION}`,
+                            when: "never",
+                        },
+                    ]
+                    : []),
                 // pinned MRs (rules stop at the first match, so this must come
                 // before the plain merge-request rule)
                 ...(pinLabel
@@ -4939,14 +5640,23 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.getPipelineStages = void 0;
 const config_1 = __nccwpck_require__(11646);
 const jobs_1 = __nccwpck_require__(98521);
+/**
+ * stages that only appear in the pipeline when a job uses them, so that
+ * projects not using the feature keep their generated files unchanged
+ */
+const OPTIONAL_STAGES = ["post-build"];
 /**
  * while technically not required, we group different envs in its own stage
  * each job from `createJobs` that is defined as `envMode: "stagePerEnv"` will have `deploy dev`, etc. instead of just `deploy`
  * this is just so that it looks nicer in gitlab and makes running mutliple manual tasks more easy to use
+ *
+ * `usedStages` are the stages of all generated jobs; optional stages are
+ * dropped when none of them is used.
  */
-function getPipelineStages(config) {
+function getPipelineStages(config, usedStages = new Set()) {
     const allEnvs = (0, config_1.getAllEnvsInAllComponents)(config).filter((e) => e !== "local");
-    const stages = jobs_1.BASE_STAGES.reduce((acc, baseStage) => [
+    const isUsed = (baseStage) => [...usedStages].some((stage) => stage === baseStage || stage.startsWith(`${baseStage} `));
+    const stages = jobs_1.BASE_STAGES.filter((baseStage) => !OPTIONAL_STAGES.includes(baseStage) || isUsed(baseStage)).reduce((acc, baseStage) => [
         ...acc,
         baseStage,
         ...allEnvs.map((e) => `${baseStage} ${e}`),
@@ -5224,6 +5934,107 @@ exports.getReleaseGateJobNames = getReleaseGateJobNames;
 
 /***/ }),
 
+/***/ 3485:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.addGitlabReviewDeployGate = exports.REVIEW_DEPLOY_GATE_JOB_NAME = void 0;
+const reviewApps_1 = __nccwpck_require__(67071);
+const rules_1 = __nccwpck_require__(78503);
+const createGitlabPipeline_1 = __nccwpck_require__(32060);
+exports.REVIEW_DEPLOY_GATE_JOB_NAME = "🚀 deploy review";
+/**
+ * the review deploy switch of a merge request (see reviewApps.ts): ONE
+ * job per MR pipeline that unlocks the delivery chains (docker → deploy
+ * → verify) of all components' review apps, instead of a manual job per
+ * component — or a docker build per component in every pipeline.
+ *
+ * The chain heads `needs` the switch. It is a no-op job with
+ * `allow_failure: true`: while it is unplayed, gitlab marks its
+ * dependents skipped and the pipeline still passes ("Pipelines must
+ * succeed" keeps working); playing it resets them to created, so it
+ * can be played any time — early clicks wait for the builds and tests
+ * like the chains always did (the same mechanism as the release
+ * button).
+ *
+ * The label/draft policy decides whether it starts on its own. Label
+ * changes only apply to the next pipeline (gitlab doesn't start one for
+ * them) — `catladder mr review-app-on` sets the label and triggers one.
+ *
+ * Mutates the needs of the gated jobs; returns the switch job, or
+ * nothing when review deploys aren't gated (or nothing deploys).
+ */
+const addGitlabReviewDeployGate = (allJobs, reviewApps) => {
+    var _a;
+    if (!(0, reviewApps_1.isReviewDeployGated)(reviewApps)) {
+        return undefined;
+    }
+    let gated = false;
+    for (const { context, jobs } of allJobs.components) {
+        for (const job of jobs) {
+            // the chain heads: verify follows its deploy anyway
+            if ((0, reviewApps_1.isReviewDeliveryJob)(context, job) && job.stage !== "verify") {
+                job.needs = [
+                    ...((_a = job.needs) !== null && _a !== void 0 ? _a : []),
+                    { job: exports.REVIEW_DEPLOY_GATE_JOB_NAME, artifacts: false, global: true },
+                ];
+                gated = true;
+            }
+        }
+    }
+    if (!gated) {
+        return undefined;
+    }
+    const isMr = rules_1.RULE_IS_MERGE_REQUEST.if;
+    const manual = { when: "manual", allow_failure: true };
+    const auto = { when: "on_success" };
+    const policyRules = reviewApps.deploy === "optIn"
+        ? [
+            {
+                if: `${isMr} && $CI_MERGE_REQUEST_LABELS =~ ${(0, reviewApps_1.getGitlabLabelRegex)(reviewApps.label)}`,
+                ...auto,
+            },
+            { if: isMr, ...manual },
+        ]
+        : reviewApps.deploy === "optOut"
+            ? [
+                {
+                    if: `${isMr} && $CI_MERGE_REQUEST_LABELS =~ ${(0, reviewApps_1.getGitlabLabelRegex)(reviewApps.skipLabel)}`,
+                    ...manual,
+                },
+                { if: isMr, ...auto },
+            ]
+            : reviewApps.deploy === "manual"
+                ? [{ if: isMr, ...manual }]
+                : [{ if: isMr, ...auto }];
+    return {
+        stage: "setup",
+        image: createGitlabPipeline_1.DEFAULT_PIPELINE_IMAGE,
+        variables: { GIT_STRATEGY: "none" },
+        needs: [],
+        interruptible: true,
+        allow_failure: true,
+        script: [
+            `echo "review apps unlocked — the docker → deploy → verify chains of all components run as soon as their builds and tests succeeded"`,
+        ],
+        rules: [
+            rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
+            // drafts never deploy on their own (drafts: "skip" has no
+            // pipeline at all, see the workflow rules)
+            ...(reviewApps.drafts !== "likeReady"
+                ? [{ if: `${isMr} && ${reviewApps_1.GITLAB_DRAFT_MR_CONDITION}`, ...manual }]
+                : []),
+            ...policyRules,
+        ],
+    };
+};
+exports.addGitlabReviewDeployGate = addGitlabReviewDeployGate;
+//# sourceMappingURL=reviewDeployGate.js.map
+
+/***/ }),
+
 /***/ 21444:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -8948,6 +9759,7 @@ const jobs_1 = __nccwpck_require__(98521);
 const utils_1 = __nccwpck_require__(71286);
 const autoStop_1 = __nccwpck_require__(72792);
 const stop_1 = __nccwpck_require__(35937);
+const reviewApps_1 = __nccwpck_require__(67071);
 const variables_1 = __nccwpck_require__(54768);
 exports.DEPLOY_JOB_NAME = "🚀 Deploy";
 class DeployJob extends jobs_1.CatladderJob {
@@ -8984,9 +9796,15 @@ class DeployJob extends jobs_1.CatladderJob {
             : ((_b = context.componentConfig.env) === null || _b === void 0 ? void 0 : _b.stage) === false
                 ? "auto" // is prod, but no staging, auto deploy
                 : "manual"; // manually deploy
-        const whenDeploy = whenDeployDefined
-            ? whenDeployDefined
-            : whenDeployDefault;
+        // gated review apps: one switch per MR/PR unlocks the whole delivery
+        // chain (see reviewApps.ts), the deploy itself then runs on its own
+        const isGatedReviewApp = context.environment.instance.type === "review" &&
+            (0, reviewApps_1.isReviewDeployGated)((0, reviewApps_1.getReviewAppsConfig)(context.fullConfig));
+        const whenDeploy = isGatedReviewApp
+            ? "auto"
+            : whenDeployDefined
+                ? whenDeployDefined
+                : whenDeployDefault;
         // wait for the deployment of other components first
         const waitForRequirements = (_d = (_c = deployConfig === null || deployConfig === void 0 ? void 0 : deployConfig.waitFor) === null || _c === void 0 ? void 0 : _c.map((c) => ({
             capability: "deployment",
@@ -9030,14 +9848,20 @@ class DeployJob extends jobs_1.CatladderJob {
                     : []),
             ];
         // we don't want to deploy when there is a broken test
-        const qualityGateRequirement = {
-            capability: "qualityGate",
-            artifacts: false,
-            // use test from workspace build
-            from: (0, context_1.componentContextHasWorkspaceBuild)(context)
-                ? { workspace: context.build.workspaceName }
-                : undefined,
-        };
+        const qualityGateRequirements = [
+            // the component's own gates (e.g. post-build tests, custom test jobs)
+            { capability: "qualityGate", artifacts: false },
+            // ...and the gates of the workspace build it is built in
+            ...((0, context_1.componentContextHasWorkspaceBuild)(context)
+                ? [
+                    {
+                        capability: "qualityGate",
+                        artifacts: false,
+                        from: { workspace: context.build.workspaceName },
+                    },
+                ]
+                : []),
+        ];
         super({
             name: exports.DEPLOY_JOB_NAME,
             script: jobDefinition.script,
@@ -9054,7 +9878,7 @@ class DeployJob extends jobs_1.CatladderJob {
                 ...waitForRequirements,
                 // if the build is disabled, we don't need to wait for it
                 ...(context.build.type !== "disabled"
-                    ? [...buildRequirements, qualityGateRequirement]
+                    ? [...buildRequirements, ...qualityGateRequirements]
                     : []),
             ],
             gate: whenDeploy,
@@ -11818,6 +12642,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(46734), exports);
 __exportStar(__nccwpck_require__(72792), exports);
+__exportStar(__nccwpck_require__(67071), exports);
 __exportStar(__nccwpck_require__(62853), exports);
 __exportStar(__nccwpck_require__(63557), exports);
 __exportStar(__nccwpck_require__(78503), exports);
@@ -11830,6 +12655,7 @@ __exportStar(__nccwpck_require__(15707), exports);
 __exportStar(__nccwpck_require__(45492), exports);
 __exportStar(__nccwpck_require__(3659), exports);
 __exportStar(__nccwpck_require__(50713), exports);
+__exportStar(__nccwpck_require__(28458), exports);
 __exportStar(__nccwpck_require__(26041), exports);
 __exportStar(__nccwpck_require__(47663), exports);
 __exportStar(__nccwpck_require__(91804), exports);
@@ -12427,6 +13253,7 @@ exports.createJobsForComponentContext = void 0;
 const build_1 = __nccwpck_require__(45492);
 const deploy_1 = __nccwpck_require__(3659);
 const jobs_1 = __nccwpck_require__(98521);
+const createPostBuildTestJobs_1 = __nccwpck_require__(61844);
 const createVerifyJobs_1 = __nccwpck_require__(66900);
 const injectDefaultVarsInCustomJobs = (context, jobs) => jobs.map(({ variables, ...job }) => {
     var _a;
@@ -12446,17 +13273,26 @@ const getCustomJobs = (context) => {
     return injectDefaultVarsInCustomJobs(context, rawJobs);
 };
 const createJobsForComponentContext = async (context) => {
-    const [buildJobs, deployJobs, verifyJobs] = await Promise.all([
+    const [buildJobs, postBuildTestJobs, deployJobs, verifyJobs] = await Promise.all([
         context.build.type !== "disabled"
             ? build_1.BUILD_TYPES[context.build.buildType].jobs(context)
             : [],
+        (0, createPostBuildTestJobs_1.createPostBuildTestJobs)(context),
         context.componentConfig.deploy !== false
             ? deploy_1.DEPLOY_TYPES[context.componentConfig.deploy.type].jobs(context)
             : [],
         (0, createVerifyJobs_1.createVerifyJobs)(context),
     ]);
     const customJobs = getCustomJobs(context);
-    return [...buildJobs, ...deployJobs, ...verifyJobs, ...customJobs];
+    const otherJobs = [...buildJobs, ...deployJobs, ...verifyJobs, ...customJobs];
+    (0, createPostBuildTestJobs_1.assertUniquePostBuildTestNames)(context, postBuildTestJobs, otherJobs);
+    return [
+        ...buildJobs,
+        ...postBuildTestJobs,
+        ...deployJobs,
+        ...verifyJobs,
+        ...customJobs,
+    ];
 };
 exports.createJobsForComponentContext = createJobsForComponentContext;
 //# sourceMappingURL=createJobsForComponent.js.map
@@ -12471,9 +13307,14 @@ exports.createJobsForComponentContext = createJobsForComponentContext;
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.createJobsForWorkspace = void 0;
 const build_1 = __nccwpck_require__(45492);
+const createPostBuildTestJobs_1 = __nccwpck_require__(61844);
 const createJobsForWorkspace = async (context) => {
-    const buildJobs = await build_1.WORKSPACE_BUILD_TYPES[context.build.buildType].jobs(context);
-    return buildJobs;
+    const [buildJobs, postBuildTestJobs] = await Promise.all([
+        build_1.WORKSPACE_BUILD_TYPES[context.build.buildType].jobs(context),
+        (0, createPostBuildTestJobs_1.createPostBuildTestJobs)(context),
+    ]);
+    (0, createPostBuildTestJobs_1.assertUniquePostBuildTestNames)(context, postBuildTestJobs, buildJobs);
+    return [...buildJobs, ...postBuildTestJobs];
 };
 exports.createJobsForWorkspace = createJobsForWorkspace;
 //# sourceMappingURL=createJobsForWorkspace.js.map
@@ -12933,7 +13774,7 @@ exports.projectFileExists = projectFileExists;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.resolveRequirements = void 0;
+exports.resolveRequirements = exports.providesCapability = void 0;
 /**
  * jobs that don't declare `provides` get a capability derived from
  * their stage. This keeps e.g. custom jobs in the test stage acting
@@ -12942,6 +13783,7 @@ exports.resolveRequirements = void 0;
 const DEFAULT_STAGE_CAPABILITIES = {
     build: "build",
     test: "qualityGate",
+    "post-build": "qualityGate",
     deploy: "deployment",
 };
 /**
@@ -12963,6 +13805,7 @@ const providesCapability = (job, capability) => {
             ((_a = CAPABILITY_IMPLICATIONS[c]) !== null && _a !== void 0 ? _a : []).includes(capability);
     });
 };
+exports.providesCapability = providesCapability;
 /**
  * the planner: resolves the semantic `requires` declarations of all jobs
  * to concrete job dependencies (`needs`), now that all jobs of the
@@ -13004,7 +13847,7 @@ const expandRequirement = (context, job, requirement, allJobs) => {
                 c.context.env === env;
         })
             .flatMap((c) => c.jobs);
-    const providers = candidates.filter((candidate) => candidate !== job && providesCapability(candidate, capability));
+    const providers = candidates.filter((candidate) => candidate !== job && (0, exports.providesCapability)(candidate, capability));
     // consuming artifacts from nobody is almost always a broken config
     const isStrict = (_b = strict !== null && strict !== void 0 ? strict : artifacts) !== null && _b !== void 0 ? _b : false;
     if (isStrict && providers.length === 0) {
@@ -13083,6 +13926,216 @@ exports.getWorkspaceDependencies = getWorkspaceDependencies;
 
 /***/ }),
 
+/***/ 61844:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.assertUniquePostBuildTestNames = exports.createPostBuildTestJobs = exports.postBuildTestJobName = exports.POST_BUILD_TEST_STAGE = void 0;
+const createArtifactsConfig_1 = __nccwpck_require__(14149);
+const cache_1 = __nccwpck_require__(74559);
+const constants_1 = __nccwpck_require__(5576);
+const packageManagerInstall_1 = __nccwpck_require__(28419);
+const types_1 = __nccwpck_require__(35249);
+const runner_1 = __nccwpck_require__(92146);
+const jobs_1 = __nccwpck_require__(98521);
+const utils_1 = __nccwpck_require__(49401);
+exports.POST_BUILD_TEST_STAGE = "post-build";
+const postBuildTestJobName = (name) => `🔬 ${name}`;
+exports.postBuildTestJobName = postBuildTestJobName;
+const getPostBuildTestsConfig = (context) => {
+    if (context.type === "workspace") {
+        return context.build.config.postBuildTests;
+    }
+    if (context.build.type === "disabled") {
+        return undefined;
+    }
+    return context.build.config.postBuildTests;
+};
+/**
+ * whether the build output is a node project, so the job has to install
+ * the dependencies before running the tests
+ */
+const isNodeBuild = (context) => {
+    if (context.type === "workspace") {
+        return true; // workspace builds are node builds
+    }
+    if (context.build.type === "fromWorkspace") {
+        return true;
+    }
+    if (context.build.type === "standalone") {
+        return (0, types_1.isOfBuildType)(context.build.config, "node", "node-static", "storybook", "meteor");
+    }
+    return false;
+};
+const hasBuildCommand = (buildCommand) => buildCommand !== null && buildCommand !== false;
+/**
+ * whether the build creates an app build job with artifacts. Rails builds
+ * and builds with `buildCommand: false` only build the docker image.
+ */
+const hasBuildArtifacts = (context) => {
+    if (context.type === "workspace") {
+        return hasBuildCommand(context.build.config.buildCommand);
+    }
+    if (context.build.type === "fromWorkspace") {
+        return hasBuildCommand(context.build.workspaceBuildConfig.buildCommand);
+    }
+    if (context.build.type === "standalone") {
+        return (!(0, types_1.isOfBuildType)(context.build.config, "rails") &&
+            hasBuildCommand(context.build.config.buildCommand));
+    }
+    return false;
+};
+const getDefaultImage = (context) => {
+    if (context.type === "component" &&
+        context.build.type === "standalone" &&
+        (0, types_1.isOfBuildType)(context.build.config, "custom")) {
+        // custom builds bring their own toolchain image
+        return context.build.config.jobImage;
+    }
+    return (0, runner_1.getRunnerImage)("jobs-default");
+};
+/**
+ * jobs for `postBuildTests`: they run after the build in the `post-build`
+ * stage, against the build artifacts, and act as quality gates, so a
+ * failing post-build test blocks the deploy.
+ */
+const createPostBuildTestJobs = async (context) => {
+    var _a;
+    // like lint and test: tagged releases deploy what was already tested
+    if (context.trigger === "taggedRelease") {
+        return [];
+    }
+    const tests = Object.entries((_a = getPostBuildTestsConfig(context)) !== null && _a !== void 0 ? _a : {}).filter((entry) => entry[1] !== false);
+    if (tests.length === 0) {
+        return [];
+    }
+    const nodeBuild = isNodeBuild(context);
+    const [packageManagerInstall, nodeCache] = nodeBuild
+        ? await Promise.all([
+            (0, packageManagerInstall_1.getPackageManagerInstall)(context),
+            // pull-only: the build job is the designated cache writer
+            (0, cache_1.getNodeCache)(context, "pull"),
+        ])
+        : [null, null];
+    // components built in a workspace test the workspace build output
+    const from = context.type === "component" && context.build.type === "fromWorkspace"
+        ? { workspace: context.build.workspaceName }
+        : undefined;
+    const buildRequirement = hasBuildArtifacts(context)
+        ? { capability: "buildArtifacts", artifacts: true, strict: true, from }
+        : // no build artifacts (e.g. rails): run after the build (docker image)
+            { capability: "build", artifacts: false, from };
+    return tests.map(([name, test]) => {
+        var _a, _b, _c;
+        const artifactsConfig = (0, createArtifactsConfig_1.createArtifactsConfig)(context.build.dir, test.artifactsReports, test.artifacts);
+        return new jobs_1.CatladderJob({
+            name: (0, exports.postBuildTestJobName)(name),
+            stage: exports.POST_BUILD_TEST_STAGE,
+            envMode: "stagePerEnv",
+            provides: ["qualityGate"],
+            needs: [],
+            requires: [buildRequirement],
+            image: (_a = test.jobImage) !== null && _a !== void 0 ? _a : getDefaultImage(context),
+            services: test.services,
+            // neutral cache declarations, lowered by each backend
+            caches: nodeCache !== null && nodeCache !== void 0 ? nodeCache : undefined,
+            variables: {
+                APP_PATH: context.build.dir,
+                ...(context.type === "component"
+                    ? context.environment.jobOnlyVars.build.envVars
+                    : {}),
+                ...((_b = test.vars) !== null && _b !== void 0 ? _b : {}),
+            },
+            runnerVariables: {
+                ...(nodeBuild ? constants_1.NODE_RUNNER_BUILD_VARIABLES : {}),
+                ...((_c = test.runnerVariables) !== null && _c !== void 0 ? _c : {}),
+            },
+            script: [
+                ...(nodeBuild ? (0, packageManagerInstall_1.ensureNodeVersion)(context) : []),
+                `cd ${context.build.dir}`,
+                ...(packageManagerInstall !== null && packageManagerInstall !== void 0 ? packageManagerInstall : []),
+                ...(0, utils_1.ensureArray)(test.command),
+            ],
+            allow_failure: test.allowFailure,
+            // reports and screenshots are most needed when the tests fail
+            ...(artifactsConfig
+                ? {
+                    artifacts: {
+                        when: "always",
+                        ...artifactsConfig.artifacts,
+                    },
+                }
+                : {}),
+        });
+    });
+};
+exports.createPostBuildTestJobs = createPostBuildTestJobs;
+const jobIdOf = (jobName) => jobName
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+/**
+ * post-build test names are chosen by the user. Github job ids drop the
+ * emoji of the job name, so e.g. a post-build test named `test` would
+ * clash with the `🧪 test` job.
+ */
+const assertUniquePostBuildTestNames = (context, postBuildTestJobs, otherJobs) => {
+    const seenIds = new Set(otherJobs.map((job) => jobIdOf(job.name)));
+    // also catches two post-build tests that only differ in case or
+    // punctuation (e.g. `e2e` and `E2E`)
+    const clash = postBuildTestJobs.find((job) => {
+        const id = jobIdOf(job.name);
+        const isClash = seenIds.has(id);
+        seenIds.add(id);
+        return isClash;
+    });
+    if (clash) {
+        throw new Error(`${context.name}: post-build test '${clash.name}' clashes with another job of the same name, please rename it in postBuildTests`);
+    }
+};
+exports.assertUniquePostBuildTestNames = assertUniquePostBuildTestNames;
+//# sourceMappingURL=createPostBuildTestJobs.js.map
+
+/***/ }),
+
+/***/ 28458:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+__exportStar(__nccwpck_require__(92967), exports);
+__exportStar(__nccwpck_require__(61844), exports);
+//# sourceMappingURL=index.js.map
+
+/***/ }),
+
+/***/ 92967:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+//# sourceMappingURL=types.js.map
+
+/***/ }),
+
 /***/ 26041:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -13108,6 +14161,143 @@ exports.getReleaseMethod = getReleaseMethod;
 
 /***/ }),
 
+/***/ 67071:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isReviewDeliveryJob = exports.GITLAB_DRAFT_MR_CONDITION = exports.getGitlabLabelRegex = exports.getReviewAppsSwitchLabel = exports.isReviewDeployGated = exports.getReviewAppsConfig = void 0;
+const autoStop_1 = __nccwpck_require__(72792);
+const reviewAppsPolicy_1 = __nccwpck_require__(49821);
+__exportStar(__nccwpck_require__(49821), exports);
+const getReviewAppsConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    return ({
+        deploy: (_b = (_a = config.reviewApps) === null || _a === void 0 ? void 0 : _a.deploy) !== null && _b !== void 0 ? _b : "auto",
+        // single colon on purpose: gitlab treats `a::b` labels as scoped and
+        // mutually exclusive, which would make this label and the
+        // `catladder::pin-review` pin label displace each other
+        label: (_d = (_c = config.reviewApps) === null || _c === void 0 ? void 0 : _c.label) !== null && _d !== void 0 ? _d : reviewAppsPolicy_1.DEFAULT_REVIEW_APP_LABEL,
+        skipLabel: (_f = (_e = config.reviewApps) === null || _e === void 0 ? void 0 : _e.skipLabel) !== null && _f !== void 0 ? _f : reviewAppsPolicy_1.DEFAULT_NO_REVIEW_APP_LABEL,
+        drafts: (_h = (_g = config.reviewApps) === null || _g === void 0 ? void 0 : _g.drafts) !== null && _h !== void 0 ? _h : "likeReady",
+    });
+};
+exports.getReviewAppsConfig = getReviewAppsConfig;
+/**
+ * whether the review deploys sit behind the per-MR/PR deploy switch
+ * instead of running in every pipeline
+ */
+const isReviewDeployGated = (config) => config.deploy !== "auto" || config.drafts === "checksOnly";
+exports.isReviewDeployGated = isReviewDeployGated;
+/**
+ * the label whose change switches the review apps on (`labeled` on
+ * opt-in, `unlabeled` on opt-out) or off (the inverse), if the mode is
+ * label-driven at all
+ */
+const getReviewAppsSwitchLabel = (config) => {
+    switch (config.deploy) {
+        case "optIn":
+            return { label: config.label, deployOn: "labeled", stopOn: "unlabeled" };
+        case "optOut":
+            return {
+                label: config.skipLabel,
+                deployOn: "unlabeled",
+                stopOn: "labeled",
+            };
+        default:
+            return undefined;
+    }
+};
+exports.getReviewAppsSwitchLabel = getReviewAppsSwitchLabel;
+/**
+ * gitlab: matches a label inside `$CI_MERGE_REQUEST_LABELS`
+ * (comma-separated) — anchored so `x` never matches `no-x`
+ */
+const getGitlabLabelRegex = (label) => `/${(0, autoStop_1.getPinLabelRegexSource)(label)}/`;
+exports.getGitlabLabelRegex = getGitlabLabelRegex;
+/**
+ * gitlab: a draft MR, by its title prefix — the only draft signal every
+ * gitlab version exposes to rules
+ */
+exports.GITLAB_DRAFT_MR_CONDITION = "$CI_MERGE_REQUEST_TITLE =~ /^\\s*(\\[draft\\]|\\(draft\\)|draft:)/i";
+/**
+ * whether a job belongs to the delivery chain of a review app — the
+ * docker image, the deploy and the post-deploy verification. These jobs
+ * sit behind the review deploy switch; quality jobs (lint, test, audit)
+ * and the app build never do.
+ */
+const isReviewDeliveryJob = (context, job) => {
+    var _a;
+    return context.type === "component" &&
+        context.environment.instance.type === "review" &&
+        (job.stage === "deploy" ||
+            job.stage === "verify" ||
+            ((_a = job.provides) !== null && _a !== void 0 ? _a : []).includes("dockerImage"));
+};
+exports.isReviewDeliveryJob = isReviewDeliveryJob;
+//# sourceMappingURL=reviewApps.js.map
+
+/***/ }),
+
+/***/ 49821:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.shouldAutoDeployReviewApps = exports.DEFAULT_NO_REVIEW_APP_LABEL = exports.DEFAULT_REVIEW_APP_LABEL = void 0;
+exports.DEFAULT_REVIEW_APP_LABEL = "catladder:review-app";
+exports.DEFAULT_NO_REVIEW_APP_LABEL = "catladder:no-review-app";
+/**
+ * whether the review apps of an MR/PR in the given state deploy
+ * automatically. An explicit request (playing the gate job, dispatching
+ * the deploy workflow) always deploys and doesn't consult this.
+ */
+const shouldAutoDeployReviewApps = (config, { labels, draft }) => {
+    if (draft && config.drafts !== "likeReady") {
+        return { deploy: false, reason: "drafts don't deploy review apps" };
+    }
+    switch (config.deploy) {
+        case "auto":
+            return { deploy: true, reason: "review apps deploy automatically" };
+        case "manual":
+            return {
+                deploy: false,
+                reason: "review apps only deploy on request (deploy: manual)",
+            };
+        case "optIn":
+            return labels.includes(config.label)
+                ? { deploy: true, reason: `the '${config.label}' label is set` }
+                : { deploy: false, reason: `the '${config.label}' label is not set` };
+        case "optOut":
+            return labels.includes(config.skipLabel)
+                ? { deploy: false, reason: `the '${config.skipLabel}' label is set` }
+                : {
+                    deploy: true,
+                    reason: `the '${config.skipLabel}' label is not set`,
+                };
+    }
+};
+exports.shouldAutoDeployReviewApps = shouldAutoDeployReviewApps;
+//# sourceMappingURL=reviewAppsPolicy.js.map
+
+/***/ }),
+
 /***/ 78503:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -13416,6 +14606,7 @@ exports.BASE_STAGES = [
     "setup",
     "test",
     "build",
+    "post-build",
     "deploy",
     "verify",
     "agents",