@catladder/cli 5.6.0 → 5.7.1

package/dist/bundles/cli/index.js

@@ -2905,7 +2905,7 @@ exports.commandKubeStopPortforward = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandMrUnpin = exports.commandMrPin = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
+exports.commandStarwars = exports.commandDadjoke = exports.commandSecurityAuditCreate = exports.commandSecurityAuditEvaluate = exports.commandSecurityAuditCiJob = exports.commandRestoreDb = exports.commandMongoDestroyMember = exports.commandMongoPortForward = exports.commandMongoGetShell = exports.commandTriggerCronjobProject = exports.commandDeleteProject = exports.commandPauseProject = exports.commandDeletePods = exports.commandGetShell = exports.commandListPods = exports.commandNamespace = exports.commandMrReviewAppOff = exports.commandMrReviewAppOn = exports.commandMrUnpin = exports.commandMrPin = exports.commandSecurityEvaluate = exports.commandProjectRestoreDb = exports.commandCiJobLog = exports.commandCiJobOpen = exports.commandDoctor = exports.commandSetup = exports.commandGetMyTotalWorktime = exports.commandRenewToken = exports.commandTriggerCronjobGeneral = exports.commandOpenLogs = exports.commandSecretsSyncGithub = exports.commandSecretsClearBackups = exports.commandSecretsList = exports.commandSecretsSet = exports.commandSecretsPush = exports.commandSecretsPull = exports.commandConfigSecrets = exports.commandCloudSqlProxy = exports.commandOpenGit = exports.commandOpenEnv = exports.commandPortForward = exports.commandEnvVars = exports.commandKubePortForward = exports.commandKubeGetShell = exports.commandKubeStopPortforward = exports.commandKubeListPods = exports.commandKubeListSecrets = exports.commandKubeListNamespaces = exports.commandKubeCurrentContext = void 0;
 // General commands
 var commandKubeCurrentContext_1 = __nccwpck_require__(78034);
 Object.defineProperty(exports, "commandKubeCurrentContext", ({ enumerable: true, get: function () { return commandKubeCurrentContext_1.commandKubeCurrentContext; } }));
@@ -2968,6 +2968,9 @@ Object.defineProperty(exports, "commandSecurityEvaluate", ({ enumerable: true, g
 var commandMrPin_1 = __nccwpck_require__(31318);
 Object.defineProperty(exports, "commandMrPin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrPin; } }));
 Object.defineProperty(exports, "commandMrUnpin", ({ enumerable: true, get: function () { return commandMrPin_1.commandMrUnpin; } }));
+var commandMrReviewApp_1 = __nccwpck_require__(94390);
+Object.defineProperty(exports, "commandMrReviewAppOn", ({ enumerable: true, get: function () { return commandMrReviewApp_1.commandMrReviewAppOn; } }));
+Object.defineProperty(exports, "commandMrReviewAppOff", ({ enumerable: true, get: function () { return commandMrReviewApp_1.commandMrReviewAppOff; } }));
 // Project k8s commands
 var commandNamespace_1 = __nccwpck_require__(25918);
 Object.defineProperty(exports, "commandNamespace", ({ enumerable: true, get: function () { return commandNamespace_1.commandNamespace; } }));
@@ -3638,7 +3641,7 @@ exports.commandCiJobLog = (0, defineCommand_1.defineCommand)({
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.commandMrUnpin = exports.commandMrPin = void 0;
+exports.commandMrUnpin = exports.commandMrPin = exports.ensureLabelExists = exports.findMr = void 0;
 const child_process_promise_1 = __nccwpck_require__(11542);
 const pipeline_1 = __nccwpck_require__(53695);
 const getProjectConfig_1 = __nccwpck_require__(70478);
@@ -3674,18 +3677,16 @@ const findMr = async (io, projectId, mrIid) => {
     }
     return mrs[0];
 };
-const ensurePinLabelExists = async (io, projectId, pinLabel) => {
-    const existing = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels?search=${encodeURIComponent(pinLabel)}`);
-    if (existing === null || existing === void 0 ? void 0 : existing.some((label) => label.name === pinLabel)) {
+exports.findMr = findMr;
+const ensureLabelExists = async (io, projectId, name, description) => {
+    const existing = await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels?search=${encodeURIComponent(name)}`);
+    if (existing === null || existing === void 0 ? void 0 : existing.some((label) => label.name === name)) {
         return;
     }
-    await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels`, {
-        name: pinLabel,
-        color: PIN_LABEL_COLOR,
-        description: "review apps of this MR are pinned — deploys use auto_stop_in: never (managed by catladder)",
-    }, "POST");
-    io.log(`created the '${pinLabel}' label in the project`);
+    await (0, gitlab_1.doGitlabRequest)(io, `projects/${projectId}/labels`, { name, color: PIN_LABEL_COLOR, description }, "POST");
+    io.log(`created the '${name}' label in the project`);
 };
+exports.ensureLabelExists = ensureLabelExists;
 exports.commandMrPin = (0, defineCommand_1.defineCommand)({
     name: "mr pin",
     description: "pin the review apps of a merge request (disable their auto-stop) by adding the pin label; merging or closing the MR still stops them",
@@ -3707,8 +3708,8 @@ exports.commandMrPin = (0, defineCommand_1.defineCommand)({
         var _a, _b;
         const pinLabel = await getPinLabel();
         const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
-        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
-        await ensurePinLabelExists(ctx, projectId, pinLabel);
+        const mr = await (0, exports.findMr)(ctx, projectId, await ctx.get("mr"));
+        await (0, exports.ensureLabelExists)(ctx, projectId, pinLabel, "review apps of this MR are pinned — deploys use auto_stop_in: never (managed by catladder)");
         if ((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel)) {
             ctx.log(`already pinned: mr!${mr.iid} carries the '${pinLabel}' label`);
         }
@@ -3744,7 +3745,7 @@ exports.commandMrUnpin = (0, defineCommand_1.defineCommand)({
         var _a;
         const pinLabel = await getPinLabel();
         const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
-        const mr = await findMr(ctx, projectId, await ctx.get("mr"));
+        const mr = await (0, exports.findMr)(ctx, projectId, await ctx.get("mr"));
         if (!((_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(pinLabel))) {
             ctx.log(`mr!${mr.iid} is not pinned (no '${pinLabel}' label)`);
             return;
@@ -3758,6 +3759,115 @@ exports.commandMrUnpin = (0, defineCommand_1.defineCommand)({
 
 /***/ }),
 
+/***/ 94390:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.commandMrReviewAppOff = exports.commandMrReviewAppOn = void 0;
+const pipeline_1 = __nccwpck_require__(53695);
+const getProjectConfig_1 = __nccwpck_require__(70478);
+const defineCommand_1 = __nccwpck_require__(19096);
+const gitlab_1 = __nccwpck_require__(17697);
+const commandMrPin_1 = __nccwpck_require__(31318);
+/**
+ * the label switch of the project's review apps — errors when the
+ * project has none (github, or a policy without labels)
+ */
+const getSwitch = async () => {
+    const config = await (0, getProjectConfig_1.getProjectConfig)();
+    if (!config) {
+        throw new Error("no catladder config found");
+    }
+    const reviewApps = (0, pipeline_1.getReviewAppsConfig)(config);
+    const switchLabel = (0, pipeline_1.getReviewAppsSwitchLabel)(reviewApps);
+    if (!switchLabel) {
+        throw new Error(reviewApps.deploy === "manual"
+            ? "review apps deploy on request in this project (reviewApps.deploy: manual) — play the '🚀 deploy review' job of the MR pipeline"
+            : "review apps of this project are not switched by label (set reviewApps.deploy to optIn or optOut)");
+    }
+    if (!(0, pipeline_1.getEnabledPipelineTypes)(config).includes("gitlab")) {
+        throw new Error(`this command switches gitlab merge requests — on github, set the label on the pull request instead (gh pr edit --${switchLabel.deployOn === "labeled" ? "add" : "remove"}-label ${switchLabel.label}); the label change deploys by itself`);
+    }
+    return switchLabel;
+};
+const mrInput = {
+    mr: {
+        type: "number",
+        message: "merge request IID (defaults to the open MR of the current branch)",
+        positional: true,
+        required: false,
+    },
+};
+exports.commandMrReviewAppOn = (0, defineCommand_1.defineCommand)({
+    name: "mr review-app-on",
+    description: "deploy the review apps of a merge request: switches the reviewApps label on (opt-in: adds it, opt-out: removes the skip label) and triggers a pipeline, since gitlab doesn't start one for label changes",
+    group: "mr",
+    inputs: {
+        ...mrInput,
+        pipeline: {
+            type: "boolean",
+            message: "trigger a merge-request pipeline so the review apps deploy now",
+            required: false,
+        },
+    },
+    execute: async (ctx) => {
+        var _a, _b;
+        const switchLabel = await getSwitch();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await (0, commandMrPin_1.findMr)(ctx, projectId, await ctx.get("mr"));
+        if (switchLabel.deployOn === "labeled") {
+            await (0, commandMrPin_1.ensureLabelExists)(ctx, projectId, switchLabel.label, "review apps of this MR deploy (managed by catladder)");
+        }
+        const hasLabel = (_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(switchLabel.label);
+        if (hasLabel === (switchLabel.deployOn === "labeled")) {
+            ctx.log(`review apps of mr!${mr.iid} are already switched on`);
+        }
+        else {
+            await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, switchLabel.deployOn === "labeled"
+                ? { add_labels: switchLabel.label }
+                : { remove_labels: switchLabel.label }, "PUT");
+            ctx.log(`review apps of mr!${mr.iid} "${mr.title}" switched on — label '${switchLabel.label}' ${switchLabel.deployOn === "labeled" ? "added" : "removed"}`);
+        }
+        if ((_b = (await ctx.get("pipeline"))) !== null && _b !== void 0 ? _b : true) {
+            const pipeline = await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}/pipelines`, {}, "POST");
+            ctx.log(`🚀 triggered a pipeline that deploys them: ${pipeline.web_url}`);
+        }
+        else {
+            ctx.log("the review apps deploy with the next pipeline of the MR");
+        }
+    },
+});
+exports.commandMrReviewAppOff = (0, defineCommand_1.defineCommand)({
+    name: "mr review-app-off",
+    description: "stop deploying the review apps of a merge request: switches the reviewApps label off (opt-in: removes it, opt-out: adds the skip label). Running review apps stay until the MR closes or they auto-stop",
+    group: "mr",
+    inputs: mrInput,
+    execute: async (ctx) => {
+        var _a;
+        const switchLabel = await getSwitch();
+        const { id: projectId } = await (0, gitlab_1.getProjectInfo)(ctx);
+        const mr = await (0, commandMrPin_1.findMr)(ctx, projectId, await ctx.get("mr"));
+        if (switchLabel.stopOn === "labeled") {
+            await (0, commandMrPin_1.ensureLabelExists)(ctx, projectId, switchLabel.label, "review apps of this MR don't deploy (managed by catladder)");
+        }
+        const hasLabel = (_a = mr.labels) === null || _a === void 0 ? void 0 : _a.includes(switchLabel.label);
+        if (hasLabel === (switchLabel.stopOn === "labeled")) {
+            ctx.log(`review apps of mr!${mr.iid} are already switched off`);
+            return;
+        }
+        await (0, gitlab_1.doGitlabRequest)(ctx, `projects/${projectId}/merge_requests/${mr.iid}`, switchLabel.stopOn === "labeled"
+            ? { add_labels: switchLabel.label }
+            : { remove_labels: switchLabel.label }, "PUT");
+        ctx.log(`review apps of mr!${mr.iid} switched off — label '${switchLabel.label}' ${switchLabel.stopOn === "labeled" ? "added" : "removed"}`);
+        ctx.log("already running review apps stay until the MR is closed or they auto-stop — stop them earlier with the stop job of the MR pipeline");
+    },
+});
+//# sourceMappingURL=commandMrReviewApp.js.map
+
+/***/ }),
+
 /***/ 30119:
 /***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
 
@@ -9232,6 +9342,8 @@ const aggregateCheckJob_1 = __nccwpck_require__(82145);
 const shippedCatci_1 = __nccwpck_require__(27967);
 const githubReleaseJobs_1 = __nccwpck_require__(25073);
 const scriptFiles_1 = __nccwpck_require__(61071);
+const reviewApps_1 = __nccwpck_require__(67071);
+const reviewDeployWorkflow_1 = __nccwpck_require__(73671);
 const WORKFLOWS_FOLDER = ".github/workflows";
 /**
  * generated workflow files are prefixed so that cleanup never touches
@@ -9327,6 +9439,7 @@ class GithubBackend {
             ...(0, ciVariables_1.getGithubInjectedWorkflowEnv)(images.registryImageRef()),
             ...(0, index_1.getPipelineOptions)(config, this.type).runnerVariables,
         };
+        const reviewApps = (0, reviewApps_1.getReviewAppsConfig)(config);
         const reviewStopJobs = {};
         // jobs routed to the per-kind workflow_dispatch workflows (deploy /
         // stop / rollback). A manual job and its build closure live there
@@ -9369,6 +9482,39 @@ class GithubBackend {
                     triggerJobs.delete(id);
                 }
             }
+            // review delivery chains behind the per-PR deploy switch move to
+            // their own workflow (reviewApps config, or manual review deploys)
+            // When the label/draft policy already decides at the start of the
+            // review run, the chains stay in it behind that condition (one
+            // run, one app build); the review deploy workflow handles whatever
+            // changes later. Manual review deploys only live there.
+            let inRunDeliveryIds = [];
+            const inRunCondition = (0, reviewApps_1.isReviewDeployGated)(reviewApps)
+                ? (0, reviewDeployWorkflow_1.getInRunDeployCondition)(reviewApps)
+                : undefined;
+            if (trigger === "mr") {
+                const deliveryIds = (0, reviewDeployWorkflow_1.getGatedReviewDeliveryJobIds)(triggerJobs, reviewApps);
+                if (deliveryIds.length > 0) {
+                    workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE] = (0, reviewDeployWorkflow_1.makeReviewDeployWorkflow)({
+                        deliveryIds,
+                        triggerJobs,
+                        reviewApps,
+                        images,
+                        workflowEnv,
+                        permissions: workflowPermissions(images).permissions,
+                    });
+                    if (inRunCondition) {
+                        inRunDeliveryIds = deliveryIds;
+                        for (const id of deliveryIds) {
+                            const entry = triggerJobs.get(id);
+                            entry.githubJob = (0, reviewDeployWorkflow_1.withInRunCondition)(entry.githubJob, inRunCondition);
+                        }
+                    }
+                    else {
+                        deliveryIds.forEach((id) => triggerJobs.delete(id));
+                    }
+                }
+            }
             // leaf manual jobs: an explicit manual gate (e.g. a prod deploy) or
             // a stop/rollback task with no automatic trigger. Each becomes a
             // dispatch choice.
@@ -9472,7 +9618,7 @@ class GithubBackend {
             }
             if (Object.keys(jobs).length > 0) {
                 const workflowJobs = { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...jobs };
-                workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] = {
+                const workflow = {
                     ...getTriggerWorkflow(trigger),
                     ...workflowPermissions(images),
                     env: workflowEnv,
@@ -9484,13 +9630,30 @@ class GithubBackend {
                     // required. Added at finalization so its needs cover the
                     // image-build jobs too.
                     jobs: trigger === "mr"
-                        ? { ...workflowJobs, ...(0, aggregateCheckJob_1.makeAggregateCheckJob)(workflowJobs) }
+                        ? {
+                            ...workflowJobs,
+                            ...(0, aggregateCheckJob_1.makeAggregateCheckJob)(workflowJobs, inRunDeliveryIds),
+                            // the stable review app result of an in-run deploy
+                            ...(inRunCondition && inRunDeliveryIds.length > 0
+                                ? (0, reviewDeployWorkflow_1.makeReviewAppAggregateJob)(inRunDeliveryIds, inRunCondition)
+                                : {}),
+                            // once green, hand over to the review deploy workflow
+                            // when the PR deploys but this run didn't
+                            ...(workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE] &&
+                                (0, reviewApps_1.isReviewDeployGated)(reviewApps)
+                                ? (0, reviewDeployWorkflow_1.makeReviewDeployTriggerJob)(reviewApps, inRunCondition)
+                                : {}),
+                        }
                         : workflowJobs,
                 };
+                workflows[`${GENERATED_FILE_PREFIX}${workflowFileName(trigger)}`] =
+                    trigger === "mr" && reviewApps.drafts === "skip"
+                        ? (0, reviewDeployWorkflow_1.withDraftsSkipped)(workflow)
+                        : workflow;
             }
         }
         if (Object.keys(reviewStopJobs).length > 0) {
-            workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = {
+            const reviewStopWorkflow = {
                 name: "🛑 catladder stop review app",
                 on: {
                     pull_request: { types: ["closed"] },
@@ -9517,6 +9680,10 @@ class GithubBackend {
                 },
                 jobs: { ...(0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images), ...reviewStopJobs },
             };
+            workflows[`${GENERATED_FILE_PREFIX}review-stop.yml`] = workflows[reviewDeployWorkflow_1.REVIEW_DEPLOY_WORKFLOW_FILE]
+                ? (0, reviewDeployWorkflow_1.withReviewStopSwitch)(reviewStopWorkflow, reviewApps, (0, reviewApps_1.isReviewDeployGated)(reviewApps) &&
+                    (0, reviewDeployWorkflow_1.getInRunDeployCondition)(reviewApps) !== undefined)
+                : reviewStopWorkflow;
         }
         for (const [kind, bucket] of Object.entries(manualKindBuckets)) {
             if (Object.keys(bucket.jobs).length === 0) {
@@ -9651,7 +9818,12 @@ exports.AGGREGATE_CHECK_JOB_NAME = "catladder ✅";
  *   `success` to `needs` even when red, so they stay non-blocking here
  *   by the same mechanism that keeps their workflow green.
  */
-const makeAggregateCheckJob = (reviewJobs) => ({
+const makeAggregateCheckJob = (reviewJobs, 
+/**
+ * jobs that may be skipped on purpose (review delivery chains behind
+ * the reviewApps switch) — their skip is no failure, their failure is
+ */
+skippable = []) => ({
     [exports.AGGREGATE_CHECK_JOB_ID]: {
         name: exports.AGGREGATE_CHECK_JOB_NAME,
         "runs-on": "ubuntu-latest",
@@ -9662,13 +9834,22 @@ const makeAggregateCheckJob = (reviewJobs) => ({
                 name: exports.AGGREGATE_CHECK_JOB_NAME,
                 // the needs context only interpolates inside the workflow file,
                 // so this script stays inline
-                run: [
-                    `results='\${{ toJSON(needs) }}'`,
-                    `echo "$results"`,
-                    `if echo "$results" | grep -qE '"result": "(failure|cancelled|skipped)"'; then`,
-                    `  echo "a required job did not succeed"; exit 1`,
-                    `fi`,
-                ].join("\n"),
+                run: (skippable.length === 0
+                    ? [
+                        `results='\${{ toJSON(needs) }}'`,
+                        `echo "$results"`,
+                        `if echo "$results" | grep -qE '"result": "(failure|cancelled|skipped)"'; then`,
+                        `  echo "a required job did not succeed"; exit 1`,
+                        `fi`,
+                    ]
+                    : [
+                        `results='\${{ toJSON(needs) }}'`,
+                        `echo "$results"`,
+                        `failed=$(echo "$results" | jq -r --arg skippable ' ${[...skippable].sort().join(" ")} ' 'to_entries[] | .key as $job | select(.value.result == "failure" or .value.result == "cancelled" or (.value.result == "skipped" and ($skippable | contains(" " + $job + " ") | not))) | $job')`,
+                        `if [ -n "$failed" ]; then`,
+                        `  echo "required jobs did not succeed: $failed"; exit 1`,
+                        `fi`,
+                    ]).join("\n"),
                 shell: "bash",
             },
         ],
@@ -10713,6 +10894,523 @@ exports.resolveGithubRegistryImage = resolveGithubRegistryImage;
 
 /***/ }),
 
+/***/ 73671:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.withDraftsSkipped = exports.withReviewStopSwitch = exports.makeReviewDeployTriggerJob = exports.makeReviewAppAggregateJob = exports.REVIEW_APP_STATUS_CONTEXT = exports.REVIEW_APP_AGGREGATE_JOB_NAME = exports.REVIEW_APP_AGGREGATE_JOB_ID = exports.makeReviewDeployWorkflow = exports.getGatedReviewDeliveryJobIds = exports.withInRunCondition = exports.getInRunDeployCondition = exports.REVIEW_DEPLOY_WORKFLOW_FILE = void 0;
+const shippedCatci_1 = __nccwpck_require__(27967);
+const resolveRequirements_1 = __nccwpck_require__(81710);
+const reviewApps_1 = __nccwpck_require__(67071);
+const aggregateCheckJob_1 = __nccwpck_require__(82145);
+const ensureImageJobs_1 = __nccwpck_require__(77590);
+const CATCI = `${shippedCatci_1.GENERATED_CATCI_FOLDER}/index.js`;
+/**
+ * the generated review deploy workflow. Keep in sync with
+ * GITHUB_REVIEW_DEPLOY_WORKFLOW in apps/cli/src/reviewApps/github.ts.
+ */
+exports.REVIEW_DEPLOY_WORKFLOW_FILE = "catladder-deploy-review.yml";
+const GUARD_JOB_ID = "catladder-review-deploy-guard";
+const TRIGGER_JOB_ID = "catladder-review-deploy-trigger";
+/** the PR of the run — from the event, or the dispatch input */
+const PR_NUMBER_EXPRESSION = "github.event.number || inputs.pr";
+/** quote a value for a github expression string literal */
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/** combine a job's existing `if` with another condition */
+const andIf = (existing, condition) => {
+    if (!existing) {
+        return `\${{ ${condition} }}`;
+    }
+    const unwrapped = existing.replace(/^\$\{\{\s*([\s\S]*?)\s*\}\}$/, "$1");
+    return `\${{ (${unwrapped}) && (${condition}) }}`;
+};
+/**
+ * the condition under which the review workflow deploys the review apps
+ * ITSELF, decided from the pull request event at the start of the run
+ * (labels, draft) — the common case then needs one run and one app
+ * build, like gitlab's switch job. Whatever changes later (a label set
+ * during or after the run, a draft marked ready, an explicit request) is
+ * handled by the review deploy workflow. `deploy: "manual"` never
+ * deploys on its own: undefined.
+ */
+const getInRunDeployCondition = (reviewApps) => {
+    const labels = "github.event.pull_request.labels.*.name";
+    const policy = reviewApps.deploy === "optIn"
+        ? `contains(${labels}, ${literal(reviewApps.label)})`
+        : reviewApps.deploy === "optOut"
+            ? `!contains(${labels}, ${literal(reviewApps.skipLabel)})`
+            : reviewApps.deploy === "auto"
+                ? undefined
+                : null;
+    if (policy === null) {
+        return undefined;
+    }
+    const notDraft = reviewApps.drafts !== "likeReady"
+        ? "!github.event.pull_request.draft"
+        : undefined;
+    return [policy, notDraft].filter(Boolean).join(" && ") || "true";
+};
+exports.getInRunDeployCondition = getInRunDeployCondition;
+/** combine a job's `if` with the in-run deploy condition */
+const withInRunCondition = (job, condition) => ({
+    ...job,
+    if: andIf(job.if, condition),
+});
+exports.withInRunCondition = withInRunCondition;
+/**
+ * the review delivery jobs (docker → deploy → verify) that move out of
+ * the review workflow into the review deploy workflow:
+ * - all of them when the reviewApps config gates review deploys
+ * - otherwise those of components whose review deploy is manual
+ *   (`deploy.when: "manual"`) — github has no manual jobs inside a run,
+ *   and the generic manual-task dispatch can't carry the pull request
+ */
+const getGatedReviewDeliveryJobIds = (triggerJobs, reviewApps) => {
+    var _a;
+    const gatedByConfig = (0, reviewApps_1.isReviewDeployGated)(reviewApps);
+    const manualComponents = new Set([...triggerJobs.values()]
+        .filter(({ job, context }) => (0, reviewApps_1.isReviewDeliveryJob)(context, job) &&
+        job.stage === "deploy" &&
+        job.gate === "manual")
+        .map(({ context }) => context.name));
+    const ids = new Set([...triggerJobs]
+        .filter(([, { job, context }]) => (0, reviewApps_1.isReviewDeliveryJob)(context, job) &&
+        (gatedByConfig || manualComponents.has(context.name)))
+        .map(([id]) => id));
+    // jobs depending on a moved job (e.g. a custom e2e job waiting for a
+    // review deploy) can't stay behind: they move along
+    let grown = ids.size > 0;
+    while (grown) {
+        grown = false;
+        for (const [id, { githubJob }] of triggerJobs) {
+            if (!ids.has(id) && ((_a = githubJob.needs) === null || _a === void 0 ? void 0 : _a.some((need) => ids.has(need)))) {
+                ids.add(id);
+                grown = true;
+            }
+        }
+    }
+    return [...ids];
+};
+exports.getGatedReviewDeliveryJobIds = getGatedReviewDeliveryJobIds;
+/**
+ * the review deploy workflow (`▶️ catladder deploy review`): the review
+ * delivery chains of a pull request, behind a guard that decides
+ * whether this run deploys (see `catci review-app github-guard`).
+ *
+ * Started by
+ * - the review workflow, once it is green and the label/draft policy
+ *   says the PR deploys (`source: ci`)
+ * - switching the label on (opt-in: adding it, opt-out: removing the
+ *   skip label) or marking a draft ready (`drafts: "checksOnly"`)
+ * - a human or agent dispatching it with the PR number — explicit
+ *   requests always deploy, provided the PR's CI is green
+ *
+ * Artifacts are scoped to a single run, so the run rebuilds what the
+ * chains need (the app build); tests are not rerun — the guard checks
+ * the PR's `catladder ✅` instead.
+ */
+const makeReviewDeployWorkflow = ({ deliveryIds, triggerJobs, reviewApps, images, workflowEnv, permissions, }) => {
+    var _a, _b;
+    const delivery = new Set(deliveryIds);
+    const isQualityJob = (id) => {
+        const entry = triggerJobs.get(id);
+        return !!entry && (0, resolveRequirements_1.providesCapability)(entry.job, "qualityGate");
+    };
+    // the delivery jobs plus everything upstream they need from the
+    // trigger (rebuilt in this run), except the quality jobs
+    const included = new Set();
+    const stack = [...deliveryIds];
+    let current;
+    while ((current = stack.pop()) !== undefined) {
+        if (included.has(current))
+            continue;
+        included.add(current);
+        for (const need of (_b = (_a = triggerJobs.get(current)) === null || _a === void 0 ? void 0 : _a.githubJob.needs) !== null && _b !== void 0 ? _b : []) {
+            if (triggerJobs.has(need) && !isQualityJob(need))
+                stack.push(need);
+        }
+    }
+    // the guard runs first, every other job only when it says deploy
+    const gatedJob = (job) => {
+        var _a;
+        return ({
+            ...job,
+            needs: [GUARD_JOB_ID, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])],
+            if: andIf(job.if, `needs.${GUARD_JOB_ID}.outputs.deploy == 'true'`),
+        });
+    };
+    const checkoutPrHead = (step) => {
+        var _a;
+        return ((_a = step.uses) === null || _a === void 0 ? void 0 : _a.startsWith("actions/checkout@"))
+            ? {
+                ...step,
+                // the PR head — a label event's default is the merge ref
+                with: {
+                    ...step.with,
+                    ref: "${{ github.event.pull_request.head.sha || github.sha }}",
+                },
+            }
+            : step;
+    };
+    const chainJobs = Object.fromEntries([...included].sort().map((id) => {
+        const { githubJob } = triggerJobs.get(id);
+        return [
+            id,
+            gatedJob({
+                ...githubJob,
+                // the quality jobs stay in the review workflow — the guard
+                // checks their aggregate instead
+                ...(githubJob.needs
+                    ? {
+                        needs: githubJob.needs.filter((need) => !isQualityJob(need) || delivery.has(need)),
+                    }
+                    : {}),
+                steps: githubJob.steps.map(checkoutPrHead),
+            }),
+        ];
+    }));
+    // only the images the chains run in (not e.g. the release image)
+    const neededIds = new Set(Object.values(chainJobs).flatMap((job) => { var _a; return (_a = job.needs) !== null && _a !== void 0 ? _a : []; }));
+    const imageJobs = Object.fromEntries(Object.entries((0, ensureImageJobs_1.makeEnsureImageGithubJobs)(images))
+        .filter(([id]) => neededIds.has(id))
+        .map(([id, job]) => [id, gatedJob(job)]));
+    const switchLabel = (0, reviewApps_1.getReviewAppsSwitchLabel)(reviewApps);
+    const pullRequestTypes = [
+        ...(switchLabel ? [switchLabel.deployOn] : []),
+        ...(reviewApps.drafts === "checksOnly" ? ["ready_for_review"] : []),
+    ];
+    // pull request events that concern the review apps — other label
+    // changes must neither run the guard nor cancel a running deploy
+    const relevantEvent = [
+        "github.event_name == 'workflow_dispatch'",
+        ...(switchLabel
+            ? [
+                `(github.event.action == ${literal(switchLabel.deployOn)} && github.event.label.name == ${literal(switchLabel.label)})`,
+            ]
+            : []),
+        ...(reviewApps.drafts === "checksOnly"
+            ? ["github.event.action == 'ready_for_review'"]
+            : []),
+    ].join(" || ");
+    return {
+        name: "▶️ catladder deploy review",
+        on: {
+            workflow_dispatch: {
+                inputs: {
+                    pr: {
+                        description: "number of the pull request whose review apps to deploy",
+                        required: true,
+                        type: "string",
+                    },
+                    source: {
+                        description: "who requests the deploy: manual (always deploys) or ci (applies the label/draft policy)",
+                        required: false,
+                        type: "choice",
+                        options: ["manual", "ci"],
+                        default: "manual",
+                    },
+                },
+            },
+            ...(pullRequestTypes.length > 0
+                ? { pull_request: { types: pullRequestTypes } }
+                : {}),
+        },
+        concurrency: reviewDeployConcurrency(relevantEvent),
+        permissions,
+        env: { ...workflowEnv, CL_PR_NUMBER: `\${{ ${PR_NUMBER_EXPRESSION} }}` },
+        jobs: {
+            [GUARD_JOB_ID]: {
+                name: "🚦 review deploy guard",
+                "runs-on": "ubuntu-latest",
+                ...(pullRequestTypes.length > 0
+                    ? { if: `\${{ ${relevantEvent} }}` }
+                    : {}),
+                permissions: {
+                    contents: "read",
+                    "pull-requests": "read",
+                    checks: "read",
+                    statuses: "write",
+                },
+                env: {
+                    GITHUB_TOKEN: "${{ github.token }}",
+                    CL_REVIEW_APPS: JSON.stringify(reviewApps),
+                    CL_DEPLOY_SOURCE: "${{ github.event_name == 'workflow_dispatch' && (inputs.source || 'manual') || 'label' }}",
+                    CL_HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}",
+                },
+                outputs: { deploy: "${{ steps.main.outputs.deploy }}" },
+                steps: [
+                    catciCheckout(),
+                    {
+                        name: "🚦 review deploy guard",
+                        id: "main",
+                        run: `node ${CATCI} review-app github-guard`,
+                        shell: "bash",
+                    },
+                    {
+                        // the pull request shows the deploy in flight
+                        name: "report pending review app",
+                        if: "${{ steps.main.outputs.deploy == 'true' }}",
+                        env: { GH_TOKEN: "${{ github.token }}" },
+                        run: `gh api "repos/$GITHUB_REPOSITORY/statuses/$CL_HEAD_SHA" -f state=pending -f context="${exports.REVIEW_APP_STATUS_CONTEXT}" -f description="deploying the review apps" -f target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" > /dev/null`,
+                        shell: "bash",
+                    },
+                ],
+            },
+            ...imageJobs,
+            ...chainJobs,
+            ...(0, exports.makeReviewAppAggregateJob)([GUARD_JOB_ID, ...Object.keys(imageJobs), ...Object.keys(chainJobs)], `needs.${GUARD_JOB_ID}.outputs.deploy == 'true'`),
+        },
+    };
+};
+exports.makeReviewDeployWorkflow = makeReviewDeployWorkflow;
+exports.REVIEW_APP_AGGREGATE_JOB_ID = "catladder-review-app-ok";
+exports.REVIEW_APP_AGGREGATE_JOB_NAME = "catladder review app ✅";
+/** the commit status context the aggregate job reports */
+exports.REVIEW_APP_STATUS_CONTEXT = "catladder review app";
+/**
+ * one job with a STABLE name that succeeds exactly when the review apps
+ * of this run deployed and verified — the result a merge gate (a bot,
+ * or a branch rule for projects that deploy every PR) waits for,
+ * regardless of the project's components.
+ *
+ * It also reports a commit status on the PR head: runs started by a
+ * dispatch (the trigger job, or by hand) are attached to the commit but
+ * not shown on the pull request, a commit status always is.
+ *
+ * Runs only when the run deploys (the guard decided so, or the review
+ * workflow's start condition held) — a run that doesn't deploy says
+ * nothing about the review app (its check is skipped, the commit status
+ * untouched). Neither does a cancelled run (superseded by a newer
+ * deploy, or stopped): a gate keeps waiting instead of seeing red.
+ */
+const makeReviewAppAggregateJob = (needs, 
+/** when the run deploys the review apps (a github expression) */
+deploysWhen) => ({
+    [exports.REVIEW_APP_AGGREGATE_JOB_ID]: {
+        name: exports.REVIEW_APP_AGGREGATE_JOB_NAME,
+        "runs-on": "ubuntu-latest",
+        needs: [...needs].sort(),
+        if: `\${{ always() && (${deploysWhen}) }}`,
+        permissions: { statuses: "write" },
+        env: {
+            GH_TOKEN: "${{ github.token }}",
+            HEAD_SHA: "${{ github.event.pull_request.head.sha || github.sha }}",
+            RUN_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}",
+        },
+        steps: [
+            {
+                name: exports.REVIEW_APP_AGGREGATE_JOB_NAME,
+                // the needs context only interpolates inside the workflow file,
+                // so this script stays inline
+                run: [
+                    `results='\${{ toJSON(needs) }}'`,
+                    `echo "$results"`,
+                    `if echo "$results" | grep -qE '"result": "failure"'; then`,
+                    `  state=failure; description="the review apps did not deploy and verify"`,
+                    `elif echo "$results" | grep -qE '"result": "cancelled"'; then`,
+                    `  # superseded by a newer deploy, or stopped: no result, not red`,
+                    `  echo "cancelled — no review app result reported"; exit 0`,
+                    `elif echo "$results" | grep -qE '"result": "skipped"'; then`,
+                    `  state=failure; description="the review apps did not deploy and verify"`,
+                    `else`,
+                    `  state=success; description="review apps deployed and verified"`,
+                    `fi`,
+                    `gh api "repos/$GITHUB_REPOSITORY/statuses/$HEAD_SHA" -f state="$state" -f context="${exports.REVIEW_APP_STATUS_CONTEXT}" -f description="$description" -f target_url="$RUN_URL" > /dev/null`,
+                    `echo "$description"`,
+                    `[ "$state" = success ]`,
+                ].join("\n"),
+                shell: "bash",
+            },
+        ],
+    },
+});
+exports.makeReviewAppAggregateJob = makeReviewAppAggregateJob;
+/** a checkout of just the materialized catci */
+const catciCheckout = () => ({
+    name: "Checkout",
+    uses: "actions/checkout@v4",
+    with: { "sparse-checkout": shippedCatci_1.GENERATED_CATCI_FOLDER },
+});
+/**
+ * one deploy/stop of a PR's review apps at a time, the newest wins —
+ * shared by the deploy and the stop workflow, so closing a PR or
+ * switching the label off cancels a deploy in flight before tearing
+ * down. Events that don't concern the review apps get a group of
+ * their own, so they never cancel anything.
+ */
+const reviewDeployConcurrency = (relevantEvent) => ({
+    group: `catladder-review-deploy-\${{ ${PR_NUMBER_EXPRESSION} }}\${{ !(${relevantEvent}) && format('-ignored-{0}', github.run_id) || '' }}`,
+    "cancel-in-progress": true,
+});
+/**
+ * the last job of the review workflow: once it is green, dispatch the
+ * review deploy workflow when the label/draft policy says this PR
+ * deploys (read fresh from the PR, so a label set while CI ran counts).
+ * Only for policies that deploy on their own — `deploy: "manual"` waits
+ * for an explicit dispatch.
+ */
+const makeReviewDeployTriggerJob = (reviewApps, 
+/** the review workflow deployed itself when this held at its start */
+inRunCondition) => reviewApps.deploy === "manual"
+    ? {}
+    : {
+        [TRIGGER_JOB_ID]: {
+            name: "▶️ trigger review deploy",
+            "runs-on": "ubuntu-latest",
+            needs: [aggregateCheckJob_1.AGGREGATE_CHECK_JOB_ID],
+            ...(inRunCondition
+                ? {
+                    // NOT success(): it also checks the transitive needs,
+                    // and the chains this run skipped on purpose would make
+                    // it false — exactly when the trigger is needed
+                    if: `\${{ !cancelled() && needs.${aggregateCheckJob_1.AGGREGATE_CHECK_JOB_ID}.result == 'success' && !(${inRunCondition}) }}`,
+                }
+                : {}),
+            permissions: {
+                contents: "read",
+                "pull-requests": "read",
+                actions: "write",
+            },
+            env: {
+                GITHUB_TOKEN: "${{ github.token }}",
+                CL_REVIEW_APPS: JSON.stringify(reviewApps),
+                CL_HEAD_REF: "${{ github.head_ref }}",
+                CL_HEAD_SHA: "${{ github.event.pull_request.head.sha }}",
+            },
+            steps: [
+                catciCheckout(),
+                {
+                    name: "▶️ trigger review deploy",
+                    run: `node ${CATCI} review-app github-trigger`,
+                    shell: "bash",
+                },
+            ],
+        },
+    };
+exports.makeReviewDeployTriggerJob = makeReviewDeployTriggerJob;
+/**
+ * the review stop workflow under a label policy: switching the label
+ * off (opt-in: removing it, opt-out: adding the skip label) stops the
+ * review apps, like closing the PR does. It shares the deploy
+ * workflow's concurrency group, so a deploy in flight is cancelled
+ * first.
+ */
+const withReviewStopSwitch = (workflow, reviewApps, 
+/** the review workflow deploys itself (see getInRunDeployCondition) */
+reviewRunDeploys = false) => {
+    const switchLabel = (0, reviewApps_1.getReviewAppsSwitchLabel)(reviewApps);
+    const relevantEvent = [
+        "github.event_name == 'workflow_dispatch'",
+        "github.event.action == 'closed'",
+        ...(switchLabel
+            ? [
+                `(github.event.action == ${literal(switchLabel.stopOn)} && github.event.label.name == ${literal(switchLabel.label)})`,
+            ]
+            : []),
+    ].join(" || ");
+    return {
+        ...workflow,
+        on: {
+            ...workflow.on,
+            pull_request: {
+                types: ["closed", ...(switchLabel ? [switchLabel.stopOn] : [])],
+            },
+        },
+        concurrency: reviewDeployConcurrency(relevantEvent),
+        jobs: Object.fromEntries(Object.entries({
+            ...(reviewRunDeploys ? makeCancelReviewRunsJob() : {}),
+            ...Object.fromEntries(Object.entries(workflow.jobs).map(([id, job]) => {
+                var _a;
+                return [
+                    id,
+                    // the teardown waits until no review run deploys anymore
+                    reviewRunDeploys && !id.startsWith("catladder-image-")
+                        ? {
+                            ...job,
+                            needs: [CANCEL_REVIEW_RUNS_JOB_ID, ...((_a = job.needs) !== null && _a !== void 0 ? _a : [])],
+                        }
+                        : job,
+                ];
+            })),
+        }).map(([id, job]) => [
+            id,
+            switchLabel ? { ...job, if: andIf(job.if, relevantEvent) } : job,
+        ])),
+    };
+};
+exports.withReviewStopSwitch = withReviewStopSwitch;
+const CANCEL_REVIEW_RUNS_JOB_ID = "catladder-wait-review-runs";
+/**
+ * the review workflow deploys review apps itself, outside the deploy /
+ * stop concurrency group — a teardown would race a deploy still running
+ * there (the deploy finishing after the stop leaves the app and its
+ * database behind). So the stop first waits for the PR's unfinished
+ * review runs to end — cancelling them when the PR was closed, letting
+ * them finish when only the label was switched off (their CI still
+ * counts). Never fails: a stuck run must not keep the teardown from
+ * running (it gives up after 30 minutes).
+ */
+const makeCancelReviewRunsJob = () => ({
+    [CANCEL_REVIEW_RUNS_JOB_ID]: {
+        name: "wait for running review deploys",
+        "runs-on": "ubuntu-latest",
+        permissions: { actions: "write", "pull-requests": "read" },
+        env: { GH_TOKEN: "${{ github.token }}" },
+        steps: [
+            {
+                name: "wait for running review deploys",
+                run: [
+                    `branch=$(gh pr view "$CL_PR_NUMBER" -R "$GITHUB_REPOSITORY" --json headRefName -q .headRefName) || exit 0`,
+                    `runs=$(gh run list -R "$GITHUB_REPOSITORY" --workflow catladder-review.yml --branch "$branch" --limit 20 --json databaseId,status -q '.[] | select(.status != "completed") | .databaseId') || exit 0`,
+                    `# a closed PR's CI is worthless: cancel it. Otherwise let the`,
+                    `# PR's CI finish (cancelling it would leave catladder ✅ red)`,
+                    `if [ "$(jq -r '.action // ""' "$GITHUB_EVENT_PATH")" = closed ]; then`,
+                    `  for id in $runs; do echo "cancelling review run $id"; gh run cancel "$id" -R "$GITHUB_REPOSITORY" || true; done`,
+                    `fi`,
+                    `for id in $runs; do`,
+                    `  echo "waiting for review run $id"`,
+                    `  for _ in $(seq 1 360); do`,
+                    `    [ "$(gh run view "$id" -R "$GITHUB_REPOSITORY" --json status -q .status)" = completed ] && break`,
+                    `    sleep 5`,
+                    `  done`,
+                    `done`,
+                    `exit 0`,
+                ].join("\n"),
+                shell: "bash",
+            },
+        ],
+    },
+});
+/**
+ * `drafts: "skip"`: draft PRs run nothing — every job of the review
+ * workflow skips them, and marking the PR ready starts the run. A
+ * skipped `catladder ✅` can't let a draft through: drafts can't be
+ * merged.
+ */
+const withDraftsSkipped = (workflow) => {
+    const on = workflow.on;
+    return {
+        ...workflow,
+        on: {
+            ...workflow.on,
+            pull_request: {
+                ...on.pull_request,
+                types: [...on.pull_request.types, "ready_for_review"],
+            },
+        },
+        jobs: Object.fromEntries(Object.entries(workflow.jobs).map(([id, job]) => [
+            id,
+            { ...job, if: andIf(job.if, "!github.event.pull_request.draft") },
+        ])),
+    };
+};
+exports.withDraftsSkipped = withDraftsSkipped;
+//# sourceMappingURL=reviewDeployWorkflow.js.map
+
+/***/ }),
+
 /***/ 61071:
 /***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
 
@@ -10817,6 +11515,8 @@ const rules_1 = __nccwpck_require__(78503);
 const config_1 = __nccwpck_require__(75591);
 const configruedEnvs_1 = __nccwpck_require__(38866);
 const autoStop_1 = __nccwpck_require__(72792);
+const reviewApps_1 = __nccwpck_require__(67071);
+const reviewDeployGate_1 = __nccwpck_require__(3485);
 const createAllJobs_1 = __nccwpck_require__(83477);
 const jobImagesPlan_1 = __nccwpck_require__(59623);
 const shippedCatci_1 = __nccwpck_require__(27967);
@@ -10930,10 +11630,32 @@ class GitlabBackend {
             ...config_1.ALL_PIPELINE_TRIGGERS,
             ...branchTriggers,
         ];
-        const jobsPerTrigger = await Promise.all(allTriggers.map(async (trigger) => ({
-            trigger,
-            jobs: await (0, createGitlabJobs_1.createGitlabJobs)(await (0, createAllJobs_1.createAllJobs)({ config, trigger, pipelineType: this.type }), images, getGitlabRulesForTrigger(trigger)),
-        })));
+        const reviewApps = (0, reviewApps_1.getReviewAppsConfig)(config);
+        const jobsPerTrigger = await Promise.all(allTriggers.map(async (trigger) => {
+            const catladderJobs = await (0, createAllJobs_1.createAllJobs)({
+                config,
+                trigger,
+                pipelineType: this.type,
+            });
+            // review deploys behind one switch per MR (reviewApps config)
+            const reviewDeployGate = trigger === "mr"
+                ? (0, reviewDeployGate_1.addGitlabReviewDeployGate)(catladderJobs, reviewApps)
+                : undefined;
+            const jobs = await (0, createGitlabJobs_1.createGitlabJobs)(catladderJobs, images, getGitlabRulesForTrigger(trigger));
+            return {
+                trigger,
+                jobs: reviewDeployGate
+                    ? [
+                        {
+                            name: reviewDeployGate_1.REVIEW_DEPLOY_GATE_JOB_NAME,
+                            gitlabJob: reviewDeployGate,
+                            context: null,
+                        },
+                        ...jobs,
+                    ]
+                    : jobs,
+            };
+        }));
         const allJobsPerTrigger = jobsPerTrigger.flatMap(({ jobs }) => jobs);
         const stages = (0, getPipelineStages_1.getPipelineStages)(config, new Set(allJobsPerTrigger
             .map(({ gitlabJob }) => gitlabJob.stage)
@@ -11013,6 +11735,7 @@ class GitlabBackend {
             },
             branchPipelines: branchTriggers.map(({ branch }) => branch),
             autoStop: (0, autoStop_1.getAutoStopConfig)(config),
+            reviewApps,
         });
     }
 }
@@ -11467,21 +12190,23 @@ function getGitlabNeedsForWorkspaceJob(context, { needs }, allJobs) {
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.createGitlabPipelineWithDefaults = void 0;
+exports.createGitlabPipelineWithDefaults = exports.DEFAULT_PIPELINE_IMAGE = void 0;
 const bash_1 = __nccwpck_require__(94143);
 const autoStop_1 = __nccwpck_require__(72792);
+const reviewApps_1 = __nccwpck_require__(67071);
 const rules_1 = __nccwpck_require__(78503);
 /**
  * gitlab requires a top-level default image for jobs that don't set their
  * own. Every catladder-generated job sets an explicit image, so this
- * fallback is never actually pulled — it just needs to be a valid,
+ * fallback is never pulled for them — it just needs to be a valid,
  * build-free image (a catladder job image would drag in a build job).
+ * Trivial jobs (the review deploy switch) reuse it explicitly.
  */
-const DEFAULT_PIPELINE_IMAGE = "node:22";
-const createGitlabPipelineWithDefaults = ({ image, variables, before_script, branchPipelines = [], autoStop, ...config }) => {
+exports.DEFAULT_PIPELINE_IMAGE = "node:22";
+const createGitlabPipelineWithDefaults = ({ image, variables, before_script, branchPipelines = [], autoStop, reviewApps, ...config }) => {
     const pinLabel = autoStop && autoStop.pinLabel;
     return {
-        image: image !== null && image !== void 0 ? image : DEFAULT_PIPELINE_IMAGE,
+        image: image !== null && image !== void 0 ? image : exports.DEFAULT_PIPELINE_IMAGE,
         variables: {
             FF_USE_FASTZIP: "true", // enable fastzip - a faster zip implementation that also supports level configuration.
             ARTIFACT_COMPRESSION_LEVEL: "fast", // we value speed over compression
@@ -11519,6 +12244,16 @@ const createGitlabPipelineWithDefaults = ({ image, variables, before_script, bra
                         PIPELINE_NAME: "Thinking...",
                     },
                 },
+                // reviewApps.drafts: "skip" — draft MRs get no pipeline (rules
+                // stop at the first match, so this must come first)
+                ...((reviewApps === null || reviewApps === void 0 ? void 0 : reviewApps.drafts) === "skip"
+                    ? [
+                        {
+                            if: `${rules_1.RULE_IS_MERGE_REQUEST.if} && ${reviewApps_1.GITLAB_DRAFT_MR_CONDITION}`,
+                            when: "never",
+                        },
+                    ]
+                    : []),
                 // pinned MRs (rules stop at the first match, so this must come
                 // before the plain merge-request rule)
                 ...(pinLabel
@@ -11886,6 +12621,107 @@ exports.getReleaseGateJobNames = getReleaseGateJobNames;
 
 /***/ }),
 
+/***/ 3485:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.addGitlabReviewDeployGate = exports.REVIEW_DEPLOY_GATE_JOB_NAME = void 0;
+const reviewApps_1 = __nccwpck_require__(67071);
+const rules_1 = __nccwpck_require__(78503);
+const createGitlabPipeline_1 = __nccwpck_require__(32060);
+exports.REVIEW_DEPLOY_GATE_JOB_NAME = "🚀 deploy review";
+/**
+ * the review deploy switch of a merge request (see reviewApps.ts): ONE
+ * job per MR pipeline that unlocks the delivery chains (docker → deploy
+ * → verify) of all components' review apps, instead of a manual job per
+ * component — or a docker build per component in every pipeline.
+ *
+ * The chain heads `needs` the switch. It is a no-op job with
+ * `allow_failure: true`: while it is unplayed, gitlab marks its
+ * dependents skipped and the pipeline still passes ("Pipelines must
+ * succeed" keeps working); playing it resets them to created, so it
+ * can be played any time — early clicks wait for the builds and tests
+ * like the chains always did (the same mechanism as the release
+ * button).
+ *
+ * The label/draft policy decides whether it starts on its own. Label
+ * changes only apply to the next pipeline (gitlab doesn't start one for
+ * them) — `catladder mr review-app-on` sets the label and triggers one.
+ *
+ * Mutates the needs of the gated jobs; returns the switch job, or
+ * nothing when review deploys aren't gated (or nothing deploys).
+ */
+const addGitlabReviewDeployGate = (allJobs, reviewApps) => {
+    var _a;
+    if (!(0, reviewApps_1.isReviewDeployGated)(reviewApps)) {
+        return undefined;
+    }
+    let gated = false;
+    for (const { context, jobs } of allJobs.components) {
+        for (const job of jobs) {
+            // the chain heads: verify follows its deploy anyway
+            if ((0, reviewApps_1.isReviewDeliveryJob)(context, job) && job.stage !== "verify") {
+                job.needs = [
+                    ...((_a = job.needs) !== null && _a !== void 0 ? _a : []),
+                    { job: exports.REVIEW_DEPLOY_GATE_JOB_NAME, artifacts: false, global: true },
+                ];
+                gated = true;
+            }
+        }
+    }
+    if (!gated) {
+        return undefined;
+    }
+    const isMr = rules_1.RULE_IS_MERGE_REQUEST.if;
+    const manual = { when: "manual", allow_failure: true };
+    const auto = { when: "on_success" };
+    const policyRules = reviewApps.deploy === "optIn"
+        ? [
+            {
+                if: `${isMr} && $CI_MERGE_REQUEST_LABELS =~ ${(0, reviewApps_1.getGitlabLabelRegex)(reviewApps.label)}`,
+                ...auto,
+            },
+            { if: isMr, ...manual },
+        ]
+        : reviewApps.deploy === "optOut"
+            ? [
+                {
+                    if: `${isMr} && $CI_MERGE_REQUEST_LABELS =~ ${(0, reviewApps_1.getGitlabLabelRegex)(reviewApps.skipLabel)}`,
+                    ...manual,
+                },
+                { if: isMr, ...auto },
+            ]
+            : reviewApps.deploy === "manual"
+                ? [{ if: isMr, ...manual }]
+                : [{ if: isMr, ...auto }];
+    return {
+        stage: "setup",
+        image: createGitlabPipeline_1.DEFAULT_PIPELINE_IMAGE,
+        variables: { GIT_STRATEGY: "none" },
+        needs: [],
+        interruptible: true,
+        allow_failure: true,
+        script: [
+            `echo "review apps unlocked — the docker → deploy → verify chains of all components run as soon as their builds and tests succeeded"`,
+        ],
+        rules: [
+            rules_1.RULE_NEVER_ON_AGENT_TRIGGER,
+            // drafts never deploy on their own (drafts: "skip" has no
+            // pipeline at all, see the workflow rules)
+            ...(reviewApps.drafts !== "likeReady"
+                ? [{ if: `${isMr} && ${reviewApps_1.GITLAB_DRAFT_MR_CONDITION}`, ...manual }]
+                : []),
+            ...policyRules,
+        ],
+    };
+};
+exports.addGitlabReviewDeployGate = addGitlabReviewDeployGate;
+//# sourceMappingURL=reviewDeployGate.js.map
+
+/***/ }),
+
 /***/ 21444:
 /***/ ((__unused_webpack_module, exports) => {
 
@@ -15610,6 +16446,7 @@ const jobs_1 = __nccwpck_require__(98521);
 const utils_1 = __nccwpck_require__(71286);
 const autoStop_1 = __nccwpck_require__(72792);
 const stop_1 = __nccwpck_require__(35937);
+const reviewApps_1 = __nccwpck_require__(67071);
 const variables_1 = __nccwpck_require__(54768);
 exports.DEPLOY_JOB_NAME = "🚀 Deploy";
 class DeployJob extends jobs_1.CatladderJob {
@@ -15646,9 +16483,15 @@ class DeployJob extends jobs_1.CatladderJob {
             : ((_b = context.componentConfig.env) === null || _b === void 0 ? void 0 : _b.stage) === false
                 ? "auto" // is prod, but no staging, auto deploy
                 : "manual"; // manually deploy
-        const whenDeploy = whenDeployDefined
-            ? whenDeployDefined
-            : whenDeployDefault;
+        // gated review apps: one switch per MR/PR unlocks the whole delivery
+        // chain (see reviewApps.ts), the deploy itself then runs on its own
+        const isGatedReviewApp = context.environment.instance.type === "review" &&
+            (0, reviewApps_1.isReviewDeployGated)((0, reviewApps_1.getReviewAppsConfig)(context.fullConfig));
+        const whenDeploy = isGatedReviewApp
+            ? "auto"
+            : whenDeployDefined
+                ? whenDeployDefined
+                : whenDeployDefault;
         // wait for the deployment of other components first
         const waitForRequirements = (_d = (_c = deployConfig === null || deployConfig === void 0 ? void 0 : deployConfig.waitFor) === null || _c === void 0 ? void 0 : _c.map((c) => ({
             capability: "deployment",
@@ -18486,6 +19329,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 __exportStar(__nccwpck_require__(46734), exports);
 __exportStar(__nccwpck_require__(72792), exports);
+__exportStar(__nccwpck_require__(67071), exports);
 __exportStar(__nccwpck_require__(62853), exports);
 __exportStar(__nccwpck_require__(63557), exports);
 __exportStar(__nccwpck_require__(78503), exports);
@@ -19617,7 +20461,7 @@ exports.projectFileExists = projectFileExists;
 "use strict";
 
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.resolveRequirements = void 0;
+exports.resolveRequirements = exports.providesCapability = void 0;
 /**
  * jobs that don't declare `provides` get a capability derived from
  * their stage. This keeps e.g. custom jobs in the test stage acting
@@ -19648,6 +20492,7 @@ const providesCapability = (job, capability) => {
             ((_a = CAPABILITY_IMPLICATIONS[c]) !== null && _a !== void 0 ? _a : []).includes(capability);
     });
 };
+exports.providesCapability = providesCapability;
 /**
  * the planner: resolves the semantic `requires` declarations of all jobs
  * to concrete job dependencies (`needs`), now that all jobs of the
@@ -19689,7 +20534,7 @@ const expandRequirement = (context, job, requirement, allJobs) => {
                 c.context.env === env;
         })
             .flatMap((c) => c.jobs);
-    const providers = candidates.filter((candidate) => candidate !== job && providesCapability(candidate, capability));
+    const providers = candidates.filter((candidate) => candidate !== job && (0, exports.providesCapability)(candidate, capability));
     // consuming artifacts from nobody is almost always a broken config
     const isStrict = (_b = strict !== null && strict !== void 0 ? strict : artifacts) !== null && _b !== void 0 ? _b : false;
     if (isStrict && providers.length === 0) {
@@ -20003,6 +20848,143 @@ exports.getReleaseMethod = getReleaseMethod;
 
 /***/ }),
 
+/***/ 67071:
+/***/ (function(__unused_webpack_module, exports, __nccwpck_require__) {
+
+"use strict";
+
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.isReviewDeliveryJob = exports.GITLAB_DRAFT_MR_CONDITION = exports.getGitlabLabelRegex = exports.getReviewAppsSwitchLabel = exports.isReviewDeployGated = exports.getReviewAppsConfig = void 0;
+const autoStop_1 = __nccwpck_require__(72792);
+const reviewAppsPolicy_1 = __nccwpck_require__(49821);
+__exportStar(__nccwpck_require__(49821), exports);
+const getReviewAppsConfig = (config) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h;
+    return ({
+        deploy: (_b = (_a = config.reviewApps) === null || _a === void 0 ? void 0 : _a.deploy) !== null && _b !== void 0 ? _b : "auto",
+        // single colon on purpose: gitlab treats `a::b` labels as scoped and
+        // mutually exclusive, which would make this label and the
+        // `catladder::pin-review` pin label displace each other
+        label: (_d = (_c = config.reviewApps) === null || _c === void 0 ? void 0 : _c.label) !== null && _d !== void 0 ? _d : reviewAppsPolicy_1.DEFAULT_REVIEW_APP_LABEL,
+        skipLabel: (_f = (_e = config.reviewApps) === null || _e === void 0 ? void 0 : _e.skipLabel) !== null && _f !== void 0 ? _f : reviewAppsPolicy_1.DEFAULT_NO_REVIEW_APP_LABEL,
+        drafts: (_h = (_g = config.reviewApps) === null || _g === void 0 ? void 0 : _g.drafts) !== null && _h !== void 0 ? _h : "likeReady",
+    });
+};
+exports.getReviewAppsConfig = getReviewAppsConfig;
+/**
+ * whether the review deploys sit behind the per-MR/PR deploy switch
+ * instead of running in every pipeline
+ */
+const isReviewDeployGated = (config) => config.deploy !== "auto" || config.drafts === "checksOnly";
+exports.isReviewDeployGated = isReviewDeployGated;
+/**
+ * the label whose change switches the review apps on (`labeled` on
+ * opt-in, `unlabeled` on opt-out) or off (the inverse), if the mode is
+ * label-driven at all
+ */
+const getReviewAppsSwitchLabel = (config) => {
+    switch (config.deploy) {
+        case "optIn":
+            return { label: config.label, deployOn: "labeled", stopOn: "unlabeled" };
+        case "optOut":
+            return {
+                label: config.skipLabel,
+                deployOn: "unlabeled",
+                stopOn: "labeled",
+            };
+        default:
+            return undefined;
+    }
+};
+exports.getReviewAppsSwitchLabel = getReviewAppsSwitchLabel;
+/**
+ * gitlab: matches a label inside `$CI_MERGE_REQUEST_LABELS`
+ * (comma-separated) — anchored so `x` never matches `no-x`
+ */
+const getGitlabLabelRegex = (label) => `/${(0, autoStop_1.getPinLabelRegexSource)(label)}/`;
+exports.getGitlabLabelRegex = getGitlabLabelRegex;
+/**
+ * gitlab: a draft MR, by its title prefix — the only draft signal every
+ * gitlab version exposes to rules
+ */
+exports.GITLAB_DRAFT_MR_CONDITION = "$CI_MERGE_REQUEST_TITLE =~ /^\\s*(\\[draft\\]|\\(draft\\)|draft:)/i";
+/**
+ * whether a job belongs to the delivery chain of a review app — the
+ * docker image, the deploy and the post-deploy verification. These jobs
+ * sit behind the review deploy switch; quality jobs (lint, test, audit)
+ * and the app build never do.
+ */
+const isReviewDeliveryJob = (context, job) => {
+    var _a;
+    return context.type === "component" &&
+        context.environment.instance.type === "review" &&
+        (job.stage === "deploy" ||
+            job.stage === "verify" ||
+            ((_a = job.provides) !== null && _a !== void 0 ? _a : []).includes("dockerImage"));
+};
+exports.isReviewDeliveryJob = isReviewDeliveryJob;
+//# sourceMappingURL=reviewApps.js.map
+
+/***/ }),
+
+/***/ 49821:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.shouldAutoDeployReviewApps = exports.DEFAULT_NO_REVIEW_APP_LABEL = exports.DEFAULT_REVIEW_APP_LABEL = void 0;
+exports.DEFAULT_REVIEW_APP_LABEL = "catladder:review-app";
+exports.DEFAULT_NO_REVIEW_APP_LABEL = "catladder:no-review-app";
+/**
+ * whether the review apps of an MR/PR in the given state deploy
+ * automatically. An explicit request (playing the gate job, dispatching
+ * the deploy workflow) always deploys and doesn't consult this.
+ */
+const shouldAutoDeployReviewApps = (config, { labels, draft }) => {
+    if (draft && config.drafts !== "likeReady") {
+        return { deploy: false, reason: "drafts don't deploy review apps" };
+    }
+    switch (config.deploy) {
+        case "auto":
+            return { deploy: true, reason: "review apps deploy automatically" };
+        case "manual":
+            return {
+                deploy: false,
+                reason: "review apps only deploy on request (deploy: manual)",
+            };
+        case "optIn":
+            return labels.includes(config.label)
+                ? { deploy: true, reason: `the '${config.label}' label is set` }
+                : { deploy: false, reason: `the '${config.label}' label is not set` };
+        case "optOut":
+            return labels.includes(config.skipLabel)
+                ? { deploy: false, reason: `the '${config.skipLabel}' label is set` }
+                : {
+                    deploy: true,
+                    reason: `the '${config.skipLabel}' label is not set`,
+                };
+    }
+};
+exports.shouldAutoDeployReviewApps = shouldAutoDeployReviewApps;
+//# sourceMappingURL=reviewAppsPolicy.js.map
+
+/***/ }),
+
 /***/ 78503:
 /***/ ((__unused_webpack_module, exports) => {