@catladder/pipeline 0.0.0-next-52feb889 → 0.0.0-next-c177efda

package/dist/backends/github/GithubBackend.js

@@ -184,6 +184,7 @@ var ciVariables_1 = require("./ciVariables");
 var createGithubJobs_1 = require("./createGithubJobs");
 var jobImagesPlan_1 = require("../../customImages/jobImagesPlan");
 var scriptFunctions_1 = require("./scriptFunctions");
+var shippedCatci_1 = require("../../catci/shippedCatci");
 var utils_1 = require("../../utils");
 var githubReleaseJobs_1 = require("./githubReleaseJobs");
 var scriptFiles_1 = require("./scriptFiles");
@@ -268,7 +269,7 @@ var GithubBackend = /** @class */function () {
             return [4 /*yield*/, this.createWorkflows(config, images, scripts)];
           case 1:
             workflows = _a.sent();
-            return [2 /*return*/, __spreadArray(__spreadArray(__spreadArray([], __read(Object.entries(workflows).map(function (_a) {
+            return [2 /*return*/, __spreadArray(__spreadArray(__spreadArray(__spreadArray([], __read(Object.entries(workflows).map(function (_a) {
               var _b = __read(_a, 2),
                 fileName = _b[0],
                 workflow = _b[1];
@@ -276,7 +277,7 @@ var GithubBackend = /** @class */function () {
                 path: (0, path_1.join)(WORKFLOWS_FOLDER, fileName),
                 content: workflow
               };
-            })), false), __read(scripts.getGeneratedFiles()), false), __read(images.getGeneratedFiles()), false)];
+            })), false), __read(scripts.getGeneratedFiles()), false), __read(images.getGeneratedFiles()), false), __read((0, shippedCatci_1.getCatciGeneratedFiles)()), false)];
         }
       });
     });

package/dist/backends/gitlab/GitlabBackend.js

@@ -173,6 +173,7 @@ var rules_1 = require("../../rules");
 var config_1 = require("../../types/config");
 var createAllJobs_1 = require("../../pipeline/createAllJobs");
 var jobImagesPlan_1 = require("../../customImages/jobImagesPlan");
+var shippedCatci_1 = require("../../catci/shippedCatci");
 var createGitlabJobs_1 = require("./createGitlabJobs");
 var createGitlabPipeline_1 = require("./createGitlabPipeline");
 var gitlabReleaseJobs_1 = require("./gitlabReleaseJobs");
@@ -219,7 +220,7 @@ var GitlabBackend = /** @class */function () {
                 })
               }
             };
-            return [2 /*return*/, __spreadArray(__spreadArray([mainFile], __read(includes), false), __read(images.getGeneratedFiles()), false)];
+            return [2 /*return*/, __spreadArray(__spreadArray(__spreadArray([mainFile], __read(includes), false), __read(images.getGeneratedFiles()), false), __read((0, shippedCatci_1.getCatciGeneratedFiles)()), false)];
         }
       });
     });
@@ -295,12 +296,13 @@ var GitlabBackend = /** @class */function () {
   };
   GitlabBackend.prototype.createPipeline = function (config, images) {
     return __awaiter(this, void 0, void 0, function () {
-      var stages, allJobsPerTrigger, allWorkspaceJobs, allComponentJobs, allGlobalJobs, allContextlessJobs, allJobs;
+      var stages, releaseJobs, allJobsPerTrigger, allWorkspaceJobs, allComponentJobs, allGlobalJobs, allContextlessJobs, allJobs;
       var _this = this;
       return __generator(this, function (_a) {
         switch (_a.label) {
           case 0:
             stages = (0, getPipelineStages_1.getPipelineStages)(config);
+            releaseJobs = (0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config, images);
             return [4 /*yield*/, Promise.all(config_1.ALL_PIPELINE_TRIGGERS.map(function (trigger) {
               return __awaiter(_this, void 0, void 0, function () {
                 var _a;
@@ -384,7 +386,7 @@ var GitlabBackend = /** @class */function () {
             }, {});
             return [2 /*return*/, (0, createGitlabPipeline_1.createGitlabPipelineWithDefaults)({
               stages: __spreadArray(__spreadArray([], __read(stages), false), ["release"], false),
-              jobs: __assign(__assign({}, allJobs), Object.fromEntries(Object.entries((0, gitlabReleaseJobs_1.getGitlabReleaseJobs)(config)).map(function (_a) {
+              jobs: __assign(__assign({}, allJobs), Object.fromEntries(Object.entries(releaseJobs).map(function (_a) {
                 var _b = __read(_a, 2),
                   name = _b[0],
                   gitlabJob = _b[1];

package/dist/backends/gitlab/gitlabReleaseJobs.d.ts

@@ -1,5 +1,6 @@
+import type { JobImagesPlan } from "../../customImages/jobImagesPlan";
 import type { Config } from "../../types/config";
-export declare const getGitlabReleaseJobs: (config: Config) => {
+export declare const getGitlabReleaseJobs: (config: Config, images: JobImagesPlan) => {
   "create release": {
     stage: string;
     image: string;

package/dist/backends/gitlab/gitlabReleaseJobs.js

@@ -36,15 +36,22 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.getGitlabReleaseJobs = void 0;
 var rules_1 = require("../../rules");
-var runner_1 = require("../../runner");
 var EXPIRED_TOKEN_HELP = "echo '👉 If this job failed with access denied, the project access token might be invald - run `project-renew-token` in catladder CLI to fix.'";
 var baseReleaseRules = [rules_1.RULE_NEVER_ON_RELEASE_COMMIT, rules_1.RULE_NEVER_ON_AGENT_TRIGGER, rules_1.RULE_NEVER_ON_SCHEDULE];
-var getGitlabReleaseJobs = function (config) {
+var getGitlabReleaseJobs = function (config, images) {
   var _a;
   var _b;
+  // NOTE: only the resolved image url is used, not the `need`: release
+  // jobs have no `needs` on purpose — their stage ordering already
+  // guarantees the image build job (setup stage) ran, and adding a
+  // `needs` would switch gitlab to DAG mode, so the release job would no
+  // longer wait for the build/deploy stages.
+  var releaseImage = images.resolveRef({
+    catladderImage: "semantic-release"
+  }).image;
   return _a = {}, _a["create release"] = {
     stage: "release",
-    image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+    image: releaseImage,
     script: ["semanticRelease"],
     after_script: [EXPIRED_TOKEN_HELP],
     rules: __spreadArray(__spreadArray([], __read(baseReleaseRules), false), [{
@@ -56,7 +63,7 @@ var getGitlabReleaseJobs = function (config) {
     }], false)
   }, _a["⚠️ force create release"] = {
     stage: "release",
-    image: (0, runner_1.getCentralRunnerImageUrl)("semantic-release"),
+    image: releaseImage,
     script: ["semanticRelease"],
     after_script: [EXPIRED_TOKEN_HELP],
     needs: [],

package/dist/bash/bashEscape.js

@@ -105,8 +105,12 @@ var escapeForDotEnv = function (value, options) {
       return part instanceof BashExpression_1.BashExpression;
     });
     if (!containsAnyBashExpression) {
+      // all parts are literal: the value never passes through bash, so it
+      // must NOT be bash-escaped — `quotes: "double"` would bake literal
+      // \" into the env value (e.g. JSON values, since the deterministic
+      // cloud run urls made such values fully literal)
       return (0, exports.escapeForDotEnv)(value.toString({
-        quotes: "double"
+        quotes: false
       }));
     } else {
       var result = escapeBashExpressionForDotEnv(new BashExpression_1.BashExpression(value.toString({

package/dist/catci/shippedCatci.d.ts

@@ -0,0 +1,8 @@
+export declare const GENERATED_CATCI_FOLDER = ".catladder-generated/catci";
+/**
+ * the catci files to materialize into the generated folder
+ */
+export declare const getCatciGeneratedFiles: () => Array<{
+  path: string;
+  content: string;
+}>;

package/dist/catci/shippedCatci.js

@@ -0,0 +1,43 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getCatciGeneratedFiles = exports.GENERATED_CATCI_FOLDER = void 0;
+var fs_1 = require("fs");
+var path_1 = require("path");
+exports.GENERATED_CATCI_FOLDER = ".catladder-generated/catci";
+/**
+ * the ncc-bundled catci (catladder's CI companion), shipped with the
+ * package. Built by the cli workspace (`scripts/bundle`); pipeline
+ * generation materializes it into `.catladder-generated/catci/` so CI
+ * jobs (e.g. the release job's security audit) can run it with plain
+ * `node` — no install step, no catladder baked into job images, and
+ * always the exact version that generated the pipeline.
+ */
+var getShippedCatciBundle = function () {
+  var candidates = [
+  // ncc bundle (what consumers run): dist/bundles/<entry> -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "catci", "index.js"),
+  // cli tsc dist (catenv-dev): dist/pipeline/src/catci -> dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "bundles", "catci", "index.js"),
+  // repository (pipeline/src/catci): <root>/cli/dist/bundles/catci
+  (0, path_1.join)(__dirname, "..", "..", "..", "cli", "dist", "bundles", "catci", "index.js")];
+  var found = candidates.find(function (candidate) {
+    return (0, fs_1.existsSync)(candidate);
+  });
+  if (!found) {
+    throw new Error("shipped catci bundle not found — run a full catladder build (`yarn build`) first");
+  }
+  return found;
+};
+/**
+ * the catci files to materialize into the generated folder
+ */
+var getCatciGeneratedFiles = function () {
+  return [{
+    path: (0, path_1.join)(exports.GENERATED_CATCI_FOLDER, "index.js"),
+    content: (0, fs_1.readFileSync)(getShippedCatciBundle(), "utf-8")
+  }];
+};
+exports.getCatciGeneratedFiles = getCatciGeneratedFiles;

package/dist/constants.js

@@ -4,5 +4,5 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.DOCKER_REGISTRY = exports.PIPELINE_IMAGE_TAG = void 0;
-exports.PIPELINE_IMAGE_TAG = "next-52feb889" || "latest";
+exports.PIPELINE_IMAGE_TAG = "next-c177efda" || "latest";
 exports.DOCKER_REGISTRY = "git.panter.ch:5001/catladder/catladder" || "git.panter.ch:5001/catladder/catladder";

package/dist/customImages/shippedImages.d.ts

@@ -13,9 +13,11 @@ export declare const RUNNER_IMAGE_DEPENDENCIES: Partial<Record<RunnerImageName,
  */
 /**
  * images that cannot be built from the shipped definitions and always
- * come from the central registry: semantic-release bakes catladder's
- * own cli sources into the image (repo-root build context).
- * TODO: make the semantic-release image self-contained.
+ * come from the central registry. Empty since the semantic-release
+ * image became self-contained (the security audit runs the
+ * materialized catci bundle instead of a baked-in catladder cli) —
+ * kept as the escape hatch should an image ever need central-only
+ * treatment again.
  */
 export declare const CENTRAL_ONLY_IMAGES: ReadonlySet<RunnerImageName>;
 export declare const RUNNER_IMAGE_BUILD_CONTEXT: Record<RunnerImageName, "root" | "self">;

package/dist/customImages/shippedImages.js

@@ -23,11 +23,13 @@ exports.RUNNER_IMAGE_DEPENDENCIES = {
  */
 /**
  * images that cannot be built from the shipped definitions and always
- * come from the central registry: semantic-release bakes catladder's
- * own cli sources into the image (repo-root build context).
- * TODO: make the semantic-release image self-contained.
+ * come from the central registry. Empty since the semantic-release
+ * image became self-contained (the security audit runs the
+ * materialized catci bundle instead of a baked-in catladder cli) —
+ * kept as the escape hatch should an image ever need central-only
+ * treatment again.
  */
-exports.CENTRAL_ONLY_IMAGES = new Set(["semantic-release"]);
+exports.CENTRAL_ONLY_IMAGES = new Set();
 exports.RUNNER_IMAGE_BUILD_CONTEXT = {
   "jobs-default": "root",
   "jobs-meteor": "root",

package/dist/pipeline/generatePipelineFiles.js

@@ -140,6 +140,7 @@ var path_1 = require("path");
 var backends_1 = require("../backends");
 var gitlab_1 = require("../backends/gitlab");
 var jobImagesPlan_1 = require("../customImages/jobImagesPlan");
+var shippedCatci_1 = require("../catci/shippedCatci");
 /**
  * generates the pipeline files of all pipeline types enabled in the
  * config (see `pipelines`). Pass an explicit `pipelineType` to generate
@@ -153,7 +154,7 @@ function generatePipelineFiles(context, pipelineType) {
       switch (_b.label) {
         case 0:
           pipelineTypes = pipelineType ? [pipelineType] : (0, backends_1.getEnabledPipelineTypes)(context.config);
-          if (!!pipelineType) return [3 /*break*/, 2];
+          if (!!pipelineType) return [3 /*break*/, 3];
           // the materialized image definitions are a union across all enabled
           // backends and no single backend may wipe them — cleaned once per
           // full generation, so images that fell out of use don't linger (and
@@ -168,37 +169,45 @@ function generatePipelineFiles(context, pipelineType) {
           // full generation, so images that fell out of use don't linger (and
           // keep triggering gitlab's rules:changes)
           _b.sent();
-          _b.label = 2;
+          // same for the materialized catci bundle (union across backends)
+          return [4 /*yield*/, (0, promises_1.rm)(shippedCatci_1.GENERATED_CATCI_FOLDER, {
+            recursive: true,
+            force: true
+          })];
         case 2:
-          _b.trys.push([2, 7, 8, 9]);
-          pipelineTypes_1 = __values(pipelineTypes), pipelineTypes_1_1 = pipelineTypes_1.next();
+          // same for the materialized catci bundle (union across backends)
+          _b.sent();
           _b.label = 3;
         case 3:
-          if (!!pipelineTypes_1_1.done) return [3 /*break*/, 6];
+          _b.trys.push([3, 8, 9, 10]);
+          pipelineTypes_1 = __values(pipelineTypes), pipelineTypes_1_1 = pipelineTypes_1.next();
+          _b.label = 4;
+        case 4:
+          if (!!pipelineTypes_1_1.done) return [3 /*break*/, 7];
           type = pipelineTypes_1_1.value;
           return [4 /*yield*/, generatePipelineFilesForBackend(context, (0, backends_1.getPipelineBackend)(type))];
-        case 4:
-          _b.sent();
-          _b.label = 5;
         case 5:
-          pipelineTypes_1_1 = pipelineTypes_1.next();
-          return [3 /*break*/, 3];
+          _b.sent();
+          _b.label = 6;
         case 6:
-          return [3 /*break*/, 9];
+          pipelineTypes_1_1 = pipelineTypes_1.next();
+          return [3 /*break*/, 4];
         case 7:
+          return [3 /*break*/, 10];
+        case 8:
           e_1_1 = _b.sent();
           e_1 = {
             error: e_1_1
           };
-          return [3 /*break*/, 9];
-        case 8:
+          return [3 /*break*/, 10];
+        case 9:
           try {
             if (pipelineTypes_1_1 && !pipelineTypes_1_1.done && (_a = pipelineTypes_1.return)) _a.call(pipelineTypes_1);
           } finally {
             if (e_1) throw e_1.error;
           }
           return [7 /*endfinally*/];
-        case 9:
+        case 10:
           return [2 /*return*/];
       }
     });

package/dist/runner-images/semantic-release/Dockerfile

@@ -1,11 +1,7 @@
-# build context is the root directory
 FROM node:lts-alpine
 
 RUN apk add --no-cache bash git git-lfs
 
-RUN mkdir /packages
-COPY ./cli /packages/cli
-
 # add semantic release
 RUN yarn global add \
     semantic-release@^19 \
@@ -14,11 +10,10 @@ RUN yarn global add \
     https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
     @semantic-release/changelog \
     @semantic-release/gitlab@9 \
-    @semantic-release/exec@6 \
-    /packages/cli
+    @semantic-release/exec@6
 
 RUN mkdir -p /scripts
-COPY ./runner-images/semantic-release/scripts/* /scripts/
+COPY ./scripts/* /scripts/
 RUN chmod +x /scripts/*
 
 ENV PATH="/scripts:${PATH}"

package/dist/runner-images/semantic-release/scripts/semanticRelease

@@ -9,7 +9,24 @@ set -e
 # better branches settings: https://github.com/semantic-release/semantic-release/issues/1581
 
 echo "doing security audit check"
-catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+CATCI=".catladder-generated/catci/index.js"
+if [ -f "$CATCI" ]; then
+  # catci is materialized by pipeline generation — always the exact
+  # catladder version that generated this pipeline
+  if [ "$GITHUB_ACTIONS" = "true" ]; then
+    # github: gate only — the MR remediation is gitlab-specific
+    node "$CATCI" security-audit check ./
+  else
+    node "$CATCI" security-audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+  fi
+elif command -v catladder > /dev/null 2>&1; then
+  # repos generated by old catladder versions (no materialized catci):
+  # the central image still bakes the cli in
+  catladder security audit ci-job ./ "$GL_TOKEN" "$CI_DEFAULT_BRANCH" "$CI_PROJECT_ID" "$GITLAB_USER_ID"
+else
+  echo "neither $CATCI nor the catladder cli found — regenerate the pipeline with a current catladder version (catenv)"
+  exit 1
+fi
 
 echo "doing semantic release"
 

package/dist/runner-images/semantic-release-central.Dockerfile

@@ -0,0 +1,34 @@
+# LEGACY-COMPAT build of the semantic-release image for the CENTRAL
+# registry only (build context: repo root, see .gitlab-ci-yaml-custom.yaml).
+#
+# The shipped definition (semantic-release/Dockerfile) is self-contained:
+# repos generated by current catladder run the security audit via the
+# materialized `.catladder-generated/catci/` bundle. But the central
+# `:latest` tag is shared with repos on OLD catladder versions whose
+# generated pipelines expect `catladder` on the PATH — so the central
+# build additionally bakes the cli in, exactly as before.
+#
+# Delete together with the central registry / central mode.
+FROM node:lts-alpine
+
+RUN apk add --no-cache bash git git-lfs
+
+RUN mkdir /packages
+COPY ./cli /packages/cli
+
+# add semantic release
+RUN yarn global add \
+    semantic-release@^19 \
+    @semantic-release/commit-analyzer \
+    @semantic-release/release-notes-generator \
+    https://github.com/panter/git.git#b4037626cc583d3e9f7995ea0604b23730d0a22e \
+    @semantic-release/changelog \
+    @semantic-release/gitlab@9 \
+    @semantic-release/exec@6 \
+    /packages/cli
+
+RUN mkdir -p /scripts
+COPY ./runner-images/semantic-release/scripts/* /scripts/
+RUN chmod +x /scripts/*
+
+ENV PATH="/scripts:${PATH}"