@catladder/pipeline 1.163.0 → 1.163.2

package/examples/__snapshots__/meteor-kubernetes.test.ts.snap

@@ -1,2503 +1,1840 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`matches snapshot for meteor-kubernetes 1`] = `
-{
-  "mainBranch": {
-    "image": "path/to/docker/jobs-default:the-version",
-    "jobs": {
-      "web ↩️ Rollback ⚠️ | dev ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "access",
-          "name": "dev/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="dev"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="dev"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-dev"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-dev-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"",
-          "kubectl config use-context "kube-pan-my-app-dev-web"",
-          "kubernetesRollback",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "rollback dev",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 👮 lint": {
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-default:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "yarn lint",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 app | dev ": {
-        "artifacts": {
-          "expire_in": "1 day",
-          "paths": [
-            "app/__build_info.json",
-            "app/dist",
-          ],
-          "reports": {
-            "junit": undefined,
-          },
-          "when": "always",
-        },
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "webmeteor-build-cache",
-            "paths": [
-              "app/.meteor/local/resolver-result-cache.json",
-              "app/.meteor/local/plugin-cache",
-              "app/.meteor/local/isopacks",
-              "app/.meteor/local/bundler-cache/scanner",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-meteor:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export METEOR_DISABLE_OPTIMISTIC_CACHING="1"",
-          "export ENV_SHORT="dev"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="dev"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-dev"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "echo "add healthcheck package"",
-          "meteor add panter:healthroute --allow-superuser",
-          "meteor add qualia:prod-shell --allow-superuser",
-          "TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory",
-          "cp ./__build_info.json ./dist/bundle/programs/server",
-        ],
-        "stage": "build",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 docker | dev ": {
-        "image": "path/to/docker/docker-build:the-version",
-        "interruptible": true,
-        "needs": [
-          "web 🔨 app | dev ",
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_DIR="app"",
-          "export DOCKER_BUILD_CONTEXT="."",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="dev/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export METEOR_INSTALL_SCRIPTS=""",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "ensureMeteorDockerfile",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"",
-          "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"",
-          "docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"",
-          "docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
-          "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE",
-          "docker push $DOCKER_CACHE_IMAGE",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"",
-        ],
-        "services": [
-          {
-            "command": [
-              "--tls=false",
-            ],
-            "name": "docker:24.0.6-dind",
-          },
-        ],
-        "stage": "build",
-        "variables": {
-          "DOCKER_BUILDKIT": "1",
-          "DOCKER_DRIVER": "overlay2",
-          "DOCKER_HOST": "tcp://0.0.0.0:2375",
-          "DOCKER_TLS_CERTDIR": "",
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "2Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🚀 Deploy | dev ": {
-        "allow_failure": false,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "auto_stop_in": "4 weeks",
-          "name": "dev/web",
-          "on_stop": "web 🛑 Stop ⚠️ | dev ",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [
-          {
-            "artifacts": false,
-            "job": "web 👮 lint",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 app | dev ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 docker | dev ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🧪 test",
-          },
-          {
-            "artifacts": true,
-            "job": "web 🧾 sbom | dev ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🛡 audit",
-          },
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "on_success",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="dev"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="dev"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-dev"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="dev/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export RELEASE_NAME="pan-my-app-dev-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"",
-          "kubectl config use-context "kube-pan-my-app-dev-web"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
-          "cat > __all_values.yml <<EOF
-env:
-  secret:
-    MONGODB_ROOT_PASSWORD: |-
-$(printf %s "$CL_dev_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
-    MONGO_URL: |-
-      mongodb://root:$CL_dev_web_MONGODB_ROOT_PASSWORD@web-mongodb.pan-my-app-dev.svc.cluster.local:27017/app?authSource=admin
-  public:
-    ENV_SHORT: |-
-      dev
-    APP_DIR: |-
-      app
-    ENV_TYPE: |-
-      dev
-    BUILD_INFO_BUILD_ID: |-
-$(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
-    BUILD_INFO_BUILD_TIME: |-
-$(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
-    BUILD_INFO_CURRENT_VERSION: |-
-$(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
-    HOST: |-
-      web.dev.my-app.pan.panter.cloud
-    ROOT_URL: |-
-      https://web.dev.my-app.pan.panter.cloud
-    HOST_INTERNAL: |-
-      web.dev.my-app.pan.panter.cloud
-    HOST_CANONICAL: |-
-      web.dev.my-app.pan.panter.cloud
-    ROOT_URL_INTERNAL: |-
-      https://web.dev.my-app.pan.panter.cloud
-    KUBE_NAMESPACE: |-
-      pan-my-app-dev
-    KUBE_APP_NAME: |-
-      web
-    KUBE_APP_NAME_PREFIX: ""
-    _ALL_ENV_VAR_KEYS: |-
-      ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
-application:
-  host: |-
-    web.dev.my-app.pan.panter.cloud
-  command: |-
-    node main.js
-  livenessProbe:
-    httpGet:
-      path: |-
-        __health
-  readinessProbe:
-    httpGet:
-      path: |-
-        __health
-  startupProbe:
-    httpGet:
-      path: |-
-        __health
-  worker:
-    enabled: true
-mongodb:
-  enabled: true
-  auth:
-    enabled: true
-    rootPassword: |-
-      $CL_dev_web_MONGODB_ROOT_PASSWORD
-    replicaSetKey: |-
-      $CL_dev_web_MONGODB_REPLICASET_KEY
-  persistence:
-    storageClass: |-
-      standard-rwo
-  backup:
-    enabled: false
-    hostToBackup: |-
-      web-mongodb.pan-my-app-dev.svc.cluster.local:27017
-    pvcToBackup: |-
-      web-mongodb
-    image: |-
-      mrelite/kubectlmongoshell:v1.0
-    schedule: |-
-      0 4 * * *
-    volumeSnapshotClass: |-
-      snapshotclass
-  architecture: |-
-    standalone
+exports[`matches snapshot for meteor-kubernetes local pipeline YAML 1`] = `
+"image: path/to/docker/jobs-default:the-version
+stages:
+  - setup
+  - setup dev
+  - setup review
+  - setup stage
+  - setup prod
+  - test
+  - test dev
+  - test review
+  - test stage
+  - test prod
+  - build
+  - build dev
+  - build review
+  - build stage
+  - build prod
+  - deploy
+  - deploy dev
+  - deploy review
+  - deploy stage
+  - deploy prod
+  - verify
+  - verify dev
+  - verify review
+  - verify stage
+  - verify prod
+  - rollback
+  - rollback dev
+  - rollback review
+  - rollback stage
+  - rollback prod
+  - stop
+  - stop dev
+  - stop review
+  - stop stage
+  - stop prod
+  - release
+variables:
+  FF_USE_FASTZIP: 'true'
+  ARTIFACT_COMPRESSION_LEVEL: fast
+  CACHE_COMPRESSION_LEVEL: fast
+  TRANSFER_METER_FREQUENCY: 5s
+  GIT_DEPTH: '1'
+web 🛡 audit:
+  stage: test
+  image: path/to/docker/jobs-default:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_PATH="app"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - cd app
+    - yarn npm audit --environment production
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: &a1
+    max: 2
+    when:
+      - runner_system_failure
+      - stuck_or_timeout_failure
+  interruptible: true
+  allow_failure: true
+web 👮 lint:
+  stage: test
+  image: path/to/docker/jobs-default:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_PATH="app"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - yarn lint
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+web 🧪 test:
+  stage: test
+  image: path/to/docker/jobs-testing-chrome:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_PATH="app"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - yarn test
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+    - if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+'web 🔨 app | dev ':
+  stage: build
+  image: path/to/docker/jobs-meteor:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export METEOR_DISABLE_OPTIMISTIC_CACHING="1"
+    - export ENV_SHORT="dev"
+    - export APP_DIR="app"
+    - export ENV_TYPE="dev"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-dev"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - echo "add healthcheck package"
+    - meteor add panter:healthroute --allow-superuser
+    - meteor add qualia:prod-shell --allow-superuser
+    - TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory
+    - cp ./__build_info.json ./dist/bundle/programs/server
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+    - key: webmeteor-build-cache
+      policy: pull-push
+      paths:
+        - app/.meteor/local/resolver-result-cache.json
+        - app/.meteor/local/plugin-cache
+        - app/.meteor/local/isopacks
+        - app/.meteor/local/bundler-cache/scanner
+  artifacts:
+    paths:
+      - app/__build_info.json
+      - app/dist
+    expire_in: 1 day
+    when: always
+    reports: {}
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs: []
+  retry: *a1
+  interruptible: true
+'web 🔨 docker | dev ':
+  stage: build
+  image: path/to/docker/docker-build:the-version
+  services:
+    - name: docker:24.0.6-dind
+      command:
+        - --tls=false
+  variables:
+    DOCKER_HOST: tcp://0.0.0.0:2375
+    DOCKER_TLS_CERTDIR: ''
+    DOCKER_DRIVER: overlay2
+    DOCKER_BUILDKIT: '1'
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 2Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_DIR="app"
+    - export DOCKER_BUILD_CONTEXT="."
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="dev/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export METEOR_INSTALL_SCRIPTS=""
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - ensureMeteorDockerfile
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"
+    - docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"
+    - docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"
+    - docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG
+    - docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE
+    - docker push $DOCKER_CACHE_IMAGE
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs:
+    - 'web 🔨 app | dev '
+  retry: *a1
+  interruptible: true
+'web 🧾 sbom | dev ':
+  stage: build
+  image: aquasec/trivy:0.38.3
+  variables: {}
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - trivy fs --quiet --format cyclonedx --output "__sbom.json" app
+  artifacts:
+    paths:
+      - __sbom.json
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🚀 Deploy | dev ':
+  stage: deploy dev
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="dev"
+    - export APP_DIR="app"
+    - export ENV_TYPE="dev"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-dev"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="dev/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export RELEASE_NAME="pan-my-app-dev-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"
+    - kubectl config use-context "kube-pan-my-app-dev-web"
+    - echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"
+    - |
+      cat > __all_values.yml <<EOF
+      env:
+        secret:
+          MONGODB_ROOT_PASSWORD: |-
+      $(printf %s "$CL_dev_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
+          MONGO_URL: |-
+            mongodb://root:$CL_dev_web_MONGODB_ROOT_PASSWORD@web-mongodb.pan-my-app-dev.svc.cluster.local:27017/app?authSource=admin
+        public:
+          ENV_SHORT: |-
+            dev
+          APP_DIR: |-
+            app
+          ENV_TYPE: |-
+            dev
+          BUILD_INFO_BUILD_ID: |-
+      $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
+          BUILD_INFO_BUILD_TIME: |-
+      $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
+          BUILD_INFO_CURRENT_VERSION: |-
+      $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
+          HOST: |-
+            web.dev.my-app.pan.panter.cloud
+          ROOT_URL: |-
+            https://web.dev.my-app.pan.panter.cloud
+          HOST_INTERNAL: |-
+            web.dev.my-app.pan.panter.cloud
+          HOST_CANONICAL: |-
+            web.dev.my-app.pan.panter.cloud
+          ROOT_URL_INTERNAL: |-
+            https://web.dev.my-app.pan.panter.cloud
+          KUBE_NAMESPACE: |-
+            pan-my-app-dev
+          KUBE_APP_NAME: |-
+            web
+          KUBE_APP_NAME_PREFIX: ""
+          _ALL_ENV_VAR_KEYS: |-
+            ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
+      application:
+        host: |-
+          web.dev.my-app.pan.panter.cloud
+        command: |-
+          node main.js
+        livenessProbe:
+          httpGet:
+            path: |-
+              __health
+        readinessProbe:
+          httpGet:
+            path: |-
+              __health
+        startupProbe:
+          httpGet:
+            path: |-
+              __health
+        worker:
+          enabled: true
+      mongodb:
+        enabled: true
+        auth:
+          enabled: true
+          rootPassword: |-
+            $CL_dev_web_MONGODB_ROOT_PASSWORD
+          replicaSetKey: |-
+            $CL_dev_web_MONGODB_REPLICASET_KEY
+        persistence:
+          storageClass: |-
+            standard-rwo
+        backup:
+          enabled: false
+          hostToBackup: |-
+            web-mongodb.pan-my-app-dev.svc.cluster.local:27017
+          pvcToBackup: |-
+            web-mongodb
+          image: |-
+            mrelite/kubectlmongoshell:v1.0
+          schedule: |-
+            0 4 * * *
+          volumeSnapshotClass: |-
+            snapshotclass
+        architecture: |-
+          standalone
 
-EOF
-",
-          "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
-          "kubernetesCreateSecret",
-          "kubernetesDeploy",
-          "echo 'Uploading SBOM to Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.dev.my-app.pan.panter.cloud" "__sbom.json" vex.json || true",
-          "echo deployment successful 😻",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "deploy dev",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛑 Stop ⚠️ | dev ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "stop",
-          "name": "dev/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
-            "when": "on_success",
-          },
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="dev"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="dev"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-dev"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-dev-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"",
-          "kubectl config use-context "kube-pan-my-app-dev-web"",
-          "kubernetesDelete",
-          "echo 'Disabling component in Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.dev.my-app.pan.panter.cloud" || true",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "stop dev",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛡 audit": {
-        "allow_failure": true,
-        "image": "path/to/docker/jobs-default:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "cd app",
-          "yarn npm audit --environment production",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🧪 test": {
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-testing-chrome:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "yarn test",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🧾 sbom | dev ": {
-        "allow_failure": true,
-        "artifacts": {
-          "paths": [
-            "__sbom.json",
-          ],
-        },
-        "image": "aquasec/trivy:0.38.3",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "trivy fs --quiet --format cyclonedx --output "__sbom.json" app",
-        ],
-        "stage": "build",
-        "variables": {},
-      },
-    },
-    "stages": [
-      "setup",
-      "setup dev",
-      "setup review",
-      "setup stage",
-      "setup prod",
-      "test",
-      "test dev",
-      "test review",
-      "test stage",
-      "test prod",
-      "build",
-      "build dev",
-      "build review",
-      "build stage",
-      "build prod",
-      "deploy",
-      "deploy dev",
-      "deploy review",
-      "deploy stage",
-      "deploy prod",
-      "verify",
-      "verify dev",
-      "verify review",
-      "verify stage",
-      "verify prod",
-      "rollback",
-      "rollback dev",
-      "rollback review",
-      "rollback stage",
-      "rollback prod",
-      "stop",
-      "stop dev",
-      "stop review",
-      "stop stage",
-      "stop prod",
-    ],
-    "variables": {
-      "ARTIFACT_COMPRESSION_LEVEL": "fast",
-      "CACHE_COMPRESSION_LEVEL": "fast",
-      "FF_USE_FASTZIP": "true",
-      "GIT_DEPTH": "1",
-      "TRANSFER_METER_FREQUENCY": "5s",
-    },
-    "workflow": {
-      "rules": [
-        {
-          "if": "$CI_COMMIT_TAG",
-        },
-        {
-          "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
-          "when": "never",
-        },
-        {
-          "if": "$CI_PIPELINE_SOURCE  == "schedule"",
-          "when": "never",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
-        },
-        {
-          "if": "$CI_MERGE_REQUEST_ID",
-        },
-      ],
-    },
-  },
-  "mr": {
-    "image": "path/to/docker/jobs-default:the-version",
-    "jobs": {
-      "web ↩️ Rollback ⚠️ | review ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "access",
-          "name": "review/$CI_COMMIT_REF_NAME/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="review"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="review"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-review"",
-          "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
-          "export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"",
-          "kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "kubernetesRollback",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "rollback review",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 👮 lint": {
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-default:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "yarn lint",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 app | review ": {
-        "artifacts": {
-          "expire_in": "1 day",
-          "paths": [
-            "app/__build_info.json",
-            "app/dist",
-          ],
-          "reports": {
-            "junit": undefined,
-          },
-          "when": "always",
-        },
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "webmeteor-build-cache",
-            "paths": [
-              "app/.meteor/local/resolver-result-cache.json",
-              "app/.meteor/local/plugin-cache",
-              "app/.meteor/local/isopacks",
-              "app/.meteor/local/bundler-cache/scanner",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-meteor:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export METEOR_DISABLE_OPTIMISTIC_CACHING="1"",
-          "export ENV_SHORT="review"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="review"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-review"",
-          "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
-          "export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "echo "add healthcheck package"",
-          "meteor add panter:healthroute --allow-superuser",
-          "meteor add qualia:prod-shell --allow-superuser",
-          "TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory",
-          "cp ./__build_info.json ./dist/bundle/programs/server",
-        ],
-        "stage": "build",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 docker | review ": {
-        "image": "path/to/docker/docker-build:the-version",
-        "interruptible": true,
-        "needs": [
-          "web 🔨 app | review ",
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_DIR="app"",
-          "export DOCKER_BUILD_CONTEXT="."",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="review/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export METEOR_INSTALL_SCRIPTS=""",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "ensureMeteorDockerfile",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"",
-          "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"",
-          "docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"",
-          "docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
-          "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE",
-          "docker push $DOCKER_CACHE_IMAGE",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"",
-        ],
-        "services": [
-          {
-            "command": [
-              "--tls=false",
-            ],
-            "name": "docker:24.0.6-dind",
-          },
-        ],
-        "stage": "build",
-        "variables": {
-          "DOCKER_BUILDKIT": "1",
-          "DOCKER_DRIVER": "overlay2",
-          "DOCKER_HOST": "tcp://0.0.0.0:2375",
-          "DOCKER_TLS_CERTDIR": "",
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "2Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🚀 Deploy | review ": {
-        "allow_failure": false,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "auto_stop_in": "1 week",
-          "name": "review/$CI_COMMIT_REF_NAME/web",
-          "on_stop": "web 🛑 Stop ⚠️ | review ",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [
-          {
-            "artifacts": false,
-            "job": "web 👮 lint",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 app | review ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 docker | review ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🧪 test",
-          },
-          {
-            "artifacts": true,
-            "job": "web 🧾 sbom | review ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🛡 audit",
-          },
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "on_success",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="review"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="review"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-review"",
-          "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
-          "export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="review/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"",
-          "kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
-          "cat > __all_values.yml <<EOF
-env:
-  secret:
-    MONGODB_ROOT_PASSWORD: |-
-$(printf %s "$CL_review_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
-    MONGO_URL: |-
-      mongodb://root:$CL_review_web_MONGODB_ROOT_PASSWORD@$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb.pan-my-app-review.svc.cluster.local:27017/app?authSource=admin
-  public:
-    ENV_SHORT: |-
-      review
-    APP_DIR: |-
-      app
-    ENV_TYPE: |-
-      review
-    BUILD_INFO_BUILD_ID: |-
-$(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
-    BUILD_INFO_BUILD_TIME: |-
-$(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
-    BUILD_INFO_CURRENT_VERSION: |-
-$(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
-    HOST: |-
-$(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
-    ROOT_URL: |-
-$(printf %s "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
-    HOST_INTERNAL: |-
-$(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
-    HOST_CANONICAL: |-
-$(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
-    ROOT_URL_INTERNAL: |-
-$(printf %s "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
-    KUBE_NAMESPACE: |-
-      pan-my-app-review
-    KUBE_APP_NAME: |-
-$(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" | sed 's/^/      /')
-    KUBE_APP_NAME_PREFIX: |-
-$(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-" | sed 's/^/      /')
-    _ALL_ENV_VAR_KEYS: |-
-      ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
-application:
-  host: |-
-$(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/    /')
-  command: |-
-    node main.js
-  livenessProbe:
-    httpGet:
-      path: |-
-        __health
-  readinessProbe:
-    httpGet:
-      path: |-
-        __health
-  startupProbe:
-    httpGet:
-      path: |-
-        __health
-  worker:
-    enabled: true
-mongodb:
-  enabled: true
-  auth:
-    enabled: true
-    rootPassword: |-
-      $CL_review_web_MONGODB_ROOT_PASSWORD
-    replicaSetKey: |-
-      $CL_review_web_MONGODB_REPLICASET_KEY
-  persistence:
-    storageClass: |-
-      standard-rwo
-  backup:
-    enabled: false
-    hostToBackup: |-
-      $([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb.pan-my-app-review.svc.cluster.local:27017
-    pvcToBackup: |-
-      $([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb
-    image: |-
-      mrelite/kubectlmongoshell:v1.0
-    schedule: |-
-      0 4 * * *
-    volumeSnapshotClass: |-
-      snapshotclass
-  architecture: |-
-    standalone
+      EOF
+    - echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"
+    - kubernetesCreateSecret
+    - kubernetesDeploy
+    - echo 'Uploading SBOM to Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.dev.my-app.pan.panter.cloud" "__sbom.json" vex.json || true
+    - echo deployment successful 😻
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: dev/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    on_stop: 'web 🛑 Stop ⚠️ | dev '
+    auto_stop_in: 4 weeks
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - when: on_success
+      if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs:
+    - job: web 👮 lint
+      artifacts: false
+    - job: 'web 🔨 app | dev '
+      artifacts: false
+    - job: 'web 🔨 docker | dev '
+      artifacts: false
+    - job: web 🧪 test
+      artifacts: false
+    - job: 'web 🧾 sbom | dev '
+      artifacts: true
+    - job: web 🛡 audit
+      artifacts: false
+  retry: *a1
+  interruptible: true
+  allow_failure: false
+'web 🛑 Stop ⚠️ | dev ':
+  stage: stop dev
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="dev"
+    - export APP_DIR="app"
+    - export ENV_TYPE="dev"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-dev"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-dev-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"
+    - kubectl config use-context "kube-pan-my-app-dev-web"
+    - kubernetesDelete
+    - echo 'Disabling component in Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.dev.my-app.pan.panter.cloud" || true
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: dev/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: stop
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/
+      when: on_success
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - when: manual
+      if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web ↩️ Rollback ⚠️ | dev ':
+  stage: rollback dev
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="dev"
+    - export APP_DIR="app"
+    - export ENV_TYPE="dev"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.dev.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.dev.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.dev.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.dev.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-dev"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_dev_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-dev-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-dev-web" --server="$CL_dev_web_KUBE_URL" --certificate-authority <(echo $CL_dev_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-dev-web" --token="$CL_dev_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-dev-web" --cluster="kube-pan-my-app-dev-web" --user="kube-pan-my-app-dev-web" --namespace="pan-my-app-dev"
+    - kubectl config use-context "kube-pan-my-app-dev-web"
+    - kubernetesRollback
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.dev.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: dev/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: access
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: never
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+    - when: manual
+      if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🔨 app | review ':
+  stage: build
+  image: path/to/docker/jobs-meteor:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export METEOR_DISABLE_OPTIMISTIC_CACHING="1"
+    - export ENV_SHORT="review"
+    - export APP_DIR="app"
+    - export ENV_TYPE="review"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-review"
+    - export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"
+    - export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - echo "add healthcheck package"
+    - meteor add panter:healthroute --allow-superuser
+    - meteor add qualia:prod-shell --allow-superuser
+    - TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory
+    - cp ./__build_info.json ./dist/bundle/programs/server
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+    - key: webmeteor-build-cache
+      policy: pull-push
+      paths:
+        - app/.meteor/local/resolver-result-cache.json
+        - app/.meteor/local/plugin-cache
+        - app/.meteor/local/isopacks
+        - app/.meteor/local/bundler-cache/scanner
+  artifacts:
+    paths:
+      - app/__build_info.json
+      - app/dist
+    expire_in: 1 day
+    when: always
+    reports: {}
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+'web 🔨 docker | review ':
+  stage: build
+  image: path/to/docker/docker-build:the-version
+  services:
+    - name: docker:24.0.6-dind
+      command:
+        - --tls=false
+  variables:
+    DOCKER_HOST: tcp://0.0.0.0:2375
+    DOCKER_TLS_CERTDIR: ''
+    DOCKER_DRIVER: overlay2
+    DOCKER_BUILDKIT: '1'
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 2Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_DIR="app"
+    - export DOCKER_BUILD_CONTEXT="."
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="review/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export METEOR_INSTALL_SCRIPTS=""
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - ensureMeteorDockerfile
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"
+    - docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"
+    - docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"
+    - docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG
+    - docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE
+    - docker push $DOCKER_CACHE_IMAGE
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+  needs:
+    - 'web 🔨 app | review '
+  retry: *a1
+  interruptible: true
+'web 🧾 sbom | review ':
+  stage: build
+  image: aquasec/trivy:0.38.3
+  variables: {}
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - trivy fs --quiet --format cyclonedx --output "__sbom.json" app
+  artifacts:
+    paths:
+      - __sbom.json
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🚀 Deploy | review ':
+  stage: deploy review
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="review"
+    - export APP_DIR="app"
+    - export ENV_TYPE="review"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-review"
+    - export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"
+    - export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="review/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"
+    - kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"
+    - |
+      cat > __all_values.yml <<EOF
+      env:
+        secret:
+          MONGODB_ROOT_PASSWORD: |-
+      $(printf %s "$CL_review_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
+          MONGO_URL: |-
+            mongodb://root:$CL_review_web_MONGODB_ROOT_PASSWORD@$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb.pan-my-app-review.svc.cluster.local:27017/app?authSource=admin
+        public:
+          ENV_SHORT: |-
+            review
+          APP_DIR: |-
+            app
+          ENV_TYPE: |-
+            review
+          BUILD_INFO_BUILD_ID: |-
+      $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
+          BUILD_INFO_BUILD_TIME: |-
+      $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
+          BUILD_INFO_CURRENT_VERSION: |-
+      $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
+          HOST: |-
+      $(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
+          ROOT_URL: |-
+      $(printf %s "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
+          HOST_INTERNAL: |-
+      $(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
+          HOST_CANONICAL: |-
+      $(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
+          ROOT_URL_INTERNAL: |-
+      $(printf %s "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/      /')
+          KUBE_NAMESPACE: |-
+            pan-my-app-review
+          KUBE_APP_NAME: |-
+      $(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" | sed 's/^/      /')
+          KUBE_APP_NAME_PREFIX: |-
+      $(printf %s "$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-" | sed 's/^/      /')
+          _ALL_ENV_VAR_KEYS: |-
+            ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
+      application:
+        host: |-
+      $(printf %s "web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" | sed 's/^/    /')
+        command: |-
+          node main.js
+        livenessProbe:
+          httpGet:
+            path: |-
+              __health
+        readinessProbe:
+          httpGet:
+            path: |-
+              __health
+        startupProbe:
+          httpGet:
+            path: |-
+              __health
+        worker:
+          enabled: true
+      mongodb:
+        enabled: true
+        auth:
+          enabled: true
+          rootPassword: |-
+            $CL_review_web_MONGODB_ROOT_PASSWORD
+          replicaSetKey: |-
+            $CL_review_web_MONGODB_REPLICASET_KEY
+        persistence:
+          storageClass: |-
+            standard-rwo
+        backup:
+          enabled: false
+          hostToBackup: |-
+            $([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb.pan-my-app-review.svc.cluster.local:27017
+          pvcToBackup: |-
+            $([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web-mongodb
+          image: |-
+            mrelite/kubectlmongoshell:v1.0
+          schedule: |-
+            0 4 * * *
+          volumeSnapshotClass: |-
+            snapshotclass
+        architecture: |-
+          standalone
 
-EOF
-",
-          "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
-          "kubernetesCreateSecret",
-          "kubernetesDeploy",
-          "echo 'Uploading SBOM to Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" "__sbom.json" vex.json || true",
-          "echo deployment successful 😻",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "deploy review",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛑 Stop ⚠️ | review ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "stop",
-          "name": "review/$CI_COMMIT_REF_NAME/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
-            "when": "on_success",
-          },
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="review"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="review"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-review"",
-          "export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"",
-          "export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"",
-          "kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"",
-          "kubernetesDelete",
-          "echo 'Disabling component in Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" || true",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "stop review",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛡 audit": {
-        "allow_failure": true,
-        "image": "path/to/docker/jobs-default:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "cd app",
-          "yarn npm audit --environment production",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🧪 test": {
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-testing-chrome:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_PATH="app"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "yarn test",
-        ],
-        "stage": "test",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🧾 sbom | review ": {
-        "allow_failure": true,
-        "artifacts": {
-          "paths": [
-            "__sbom.json",
-          ],
-        },
-        "image": "aquasec/trivy:0.38.3",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "trivy fs --quiet --format cyclonedx --output "__sbom.json" app",
-        ],
-        "stage": "build",
-        "variables": {},
-      },
-    },
-    "stages": [
-      "setup",
-      "setup dev",
-      "setup review",
-      "setup stage",
-      "setup prod",
-      "test",
-      "test dev",
-      "test review",
-      "test stage",
-      "test prod",
-      "build",
-      "build dev",
-      "build review",
-      "build stage",
-      "build prod",
-      "deploy",
-      "deploy dev",
-      "deploy review",
-      "deploy stage",
-      "deploy prod",
-      "verify",
-      "verify dev",
-      "verify review",
-      "verify stage",
-      "verify prod",
-      "rollback",
-      "rollback dev",
-      "rollback review",
-      "rollback stage",
-      "rollback prod",
-      "stop",
-      "stop dev",
-      "stop review",
-      "stop stage",
-      "stop prod",
-    ],
-    "variables": {
-      "ARTIFACT_COMPRESSION_LEVEL": "fast",
-      "CACHE_COMPRESSION_LEVEL": "fast",
-      "FF_USE_FASTZIP": "true",
-      "GIT_DEPTH": "1",
-      "TRANSFER_METER_FREQUENCY": "5s",
-    },
-    "workflow": {
-      "rules": [
-        {
-          "if": "$CI_COMMIT_TAG",
-        },
-        {
-          "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
-          "when": "never",
-        },
-        {
-          "if": "$CI_PIPELINE_SOURCE  == "schedule"",
-          "when": "never",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
-        },
-        {
-          "if": "$CI_MERGE_REQUEST_ID",
-        },
-      ],
-    },
-  },
-  "taggedRelease": {
-    "image": "path/to/docker/jobs-default:the-version",
-    "jobs": {
-      "web ↩️ Rollback ⚠️ | prod ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "access",
-          "name": "prod/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="prod"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="prod"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="www.example.com"",
-          "export ROOT_URL="https://www.example.com"",
-          "export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-prod"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"",
-          "export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"",
-          "export RELEASE_NAME="pan-my-app-prod-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"",
-          "kubectl config use-context "kube-pan-my-app-prod-web"",
-          "kubernetesRollback",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env",
-        ],
-        "stage": "rollback prod",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web ↩️ Rollback ⚠️ | stage ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "access",
-          "name": "stage/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="stage"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="stage"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-stage"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-stage-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"",
-          "kubectl config use-context "kube-pan-my-app-stage-web"",
-          "kubernetesRollback",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "rollback stage",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🔨 app | prod ": {
-        "artifacts": {
-          "expire_in": "1 day",
-          "paths": [
-            "app/__build_info.json",
-            "app/dist",
-          ],
-          "reports": {
-            "junit": undefined,
-          },
-          "when": "always",
-        },
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "webmeteor-build-cache",
-            "paths": [
-              "app/.meteor/local/resolver-result-cache.json",
-              "app/.meteor/local/plugin-cache",
-              "app/.meteor/local/isopacks",
-              "app/.meteor/local/bundler-cache/scanner",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-meteor:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export METEOR_DISABLE_OPTIMISTIC_CACHING="1"",
-          "export ENV_SHORT="prod"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="prod"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="www.example.com"",
-          "export ROOT_URL="https://www.example.com"",
-          "export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-prod"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"",
-          "export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "echo "add healthcheck package"",
-          "meteor add panter:healthroute --allow-superuser",
-          "meteor add qualia:prod-shell --allow-superuser",
-          "TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory",
-          "cp ./__build_info.json ./dist/bundle/programs/server",
-        ],
-        "stage": "build",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 app | stage ": {
-        "artifacts": {
-          "expire_in": "1 day",
-          "paths": [
-            "app/__build_info.json",
-            "app/dist",
-          ],
-          "reports": {
-            "junit": undefined,
-          },
-          "when": "always",
-        },
-        "cache": [
-          {
-            "key": "app-yarn",
-            "paths": [
-              "app/.yarn",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "app-node-modules",
-            "paths": [
-              "app/node_modules",
-            ],
-            "policy": "pull-push",
-          },
-          {
-            "key": "webmeteor-build-cache",
-            "paths": [
-              "app/.meteor/local/resolver-result-cache.json",
-              "app/.meteor/local/plugin-cache",
-              "app/.meteor/local/isopacks",
-              "app/.meteor/local/bundler-cache/scanner",
-            ],
-            "policy": "pull-push",
-          },
-        ],
-        "image": "path/to/docker/jobs-meteor:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export METEOR_DISABLE_OPTIMISTIC_CACHING="1"",
-          "export ENV_SHORT="stage"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="stage"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-stage"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "cd app",
-          "echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"",
-          "if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi",
-          "if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi",
-          "echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"",
-          "yarn install --immutable",
-          "echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"",
-          "echo "add healthcheck package"",
-          "meteor add panter:healthroute --allow-superuser",
-          "meteor add qualia:prod-shell --allow-superuser",
-          "TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory",
-          "cp ./__build_info.json ./dist/bundle/programs/server",
-        ],
-        "stage": "build",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "4Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 docker | prod ": {
-        "image": "path/to/docker/docker-build:the-version",
-        "interruptible": true,
-        "needs": [
-          "web 🔨 app | prod ",
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_DIR="app"",
-          "export DOCKER_BUILD_CONTEXT="."",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="prod/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export METEOR_INSTALL_SCRIPTS=""",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "ensureMeteorDockerfile",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"",
-          "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"",
-          "docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"",
-          "docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
-          "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE",
-          "docker push $DOCKER_CACHE_IMAGE",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"",
-        ],
-        "services": [
-          {
-            "command": [
-              "--tls=false",
-            ],
-            "name": "docker:24.0.6-dind",
-          },
-        ],
-        "stage": "build",
-        "variables": {
-          "DOCKER_BUILDKIT": "1",
-          "DOCKER_DRIVER": "overlay2",
-          "DOCKER_HOST": "tcp://0.0.0.0:2375",
-          "DOCKER_TLS_CERTDIR": "",
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "2Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🔨 docker | stage ": {
-        "image": "path/to/docker/docker-build:the-version",
-        "interruptible": true,
-        "needs": [
-          "web 🔨 app | stage ",
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export APP_DIR="app"",
-          "export DOCKER_BUILD_CONTEXT="."",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="stage/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export METEOR_INSTALL_SCRIPTS=""",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "ensureMeteorDockerfile",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"",
-          "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"",
-          "docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"",
-          "docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
-          "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE",
-          "docker push $DOCKER_CACHE_IMAGE",
-          "echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"",
-        ],
-        "services": [
-          {
-            "command": [
-              "--tls=false",
-            ],
-            "name": "docker:24.0.6-dind",
-          },
-        ],
-        "stage": "build",
-        "variables": {
-          "DOCKER_BUILDKIT": "1",
-          "DOCKER_DRIVER": "overlay2",
-          "DOCKER_HOST": "tcp://0.0.0.0:2375",
-          "DOCKER_TLS_CERTDIR": "",
-          "KUBERNETES_CPU_REQUEST": "0.45",
-          "KUBERNETES_MEMORY_LIMIT": "2Gi",
-          "KUBERNETES_MEMORY_REQUEST": "1Gi",
-        },
-      },
-      "web 🚀 Deploy | prod ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "auto_stop_in": undefined,
-          "name": "prod/web",
-          "on_stop": "web 🛑 Stop ⚠️ | prod ",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [
-          {
-            "artifacts": false,
-            "job": "web 🔨 app | prod ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 docker | prod ",
-          },
-          {
-            "artifacts": true,
-            "job": "web 🧾 sbom | prod ",
-          },
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="prod"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="prod"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="www.example.com"",
-          "export ROOT_URL="https://www.example.com"",
-          "export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-prod"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"",
-          "export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="prod/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export RELEASE_NAME="pan-my-app-prod-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"",
-          "kubectl config use-context "kube-pan-my-app-prod-web"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
-          "cat > __all_values.yml <<EOF
-env:
-  secret:
-    MONGODB_ROOT_PASSWORD: |-
-$(printf %s "$CL_prod_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
-    MONGODB_REPLICASET_KEY: |-
-$(printf %s "$CL_prod_web_MONGODB_REPLICASET_KEY" | sed 's/^/      /')
-    MONGO_URL: |-
-      mongodb://root:$CL_prod_web_MONGODB_ROOT_PASSWORD@web-mongodb-0.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017,web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017/app?replicaSet=rs0&authSource=admin
-    MONGO_OPLOG_URL: |-
-      mongodb://root:$CL_prod_web_MONGODB_ROOT_PASSWORD@web-mongodb-0.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017,web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017/local?replicaSet=rs0&authSource=admin
-  public:
-    ENV_SHORT: |-
-      prod
-    APP_DIR: |-
-      app
-    ENV_TYPE: |-
-      prod
-    BUILD_INFO_BUILD_ID: |-
-$(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
-    BUILD_INFO_BUILD_TIME: |-
-$(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
-    BUILD_INFO_CURRENT_VERSION: |-
-$(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
-    HOST: |-
-      www.example.com
-    ROOT_URL: |-
-      https://www.example.com
-    HOST_INTERNAL: |-
-      web.prod.my-app.pan.panter.cloud
-    HOST_CANONICAL: |-
-      web.prod.my-app.pan.panter.cloud
-    ROOT_URL_INTERNAL: |-
-      https://web.prod.my-app.pan.panter.cloud
-    KUBE_NAMESPACE: |-
-      pan-my-app-prod
-    KUBE_APP_NAME: |-
-      web
-    KUBE_APP_NAME_PREFIX: ""
-    _ALL_ENV_VAR_KEYS: |-
-      ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD","MONGODB_REPLICASET_KEY"]
-application:
-  host: |-
-    www.example.com
-  command: |-
-    node main.js
-  livenessProbe:
-    httpGet:
-      path: |-
-        __health
-  readinessProbe:
-    httpGet:
-      path: |-
-        __health
-  startupProbe:
-    httpGet:
-      path: |-
-        __health
-  worker:
-    enabled: true
-  redirects:
-    - host: |-
-        example.com
-mongodb:
-  enabled: true
-  auth:
-    enabled: true
-    rootPassword: |-
-      $CL_prod_web_MONGODB_ROOT_PASSWORD
-    replicaSetKey: |-
-      $CL_prod_web_MONGODB_REPLICASET_KEY
-  persistence:
-    storageClass: |-
-      premium-rwo
-    size: |-
-      50Gi
-  backup:
-    enabled: true
-    hostToBackup: |-
-      web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017
-    pvcToBackup: |-
-      datadir-web-mongodb-1
-    image: |-
-      mrelite/kubectlmongoshell:v1.0
-    schedule: |-
-      0 4 * * *
-    volumeSnapshotClass: |-
-      snapshotclass
-  architecture: |-
-    replicaset
-  replicaCount: 2
-  resources:
-    limits:
-      memory: |-
-        8Gi
-    requests:
-      memory: |-
-        8Gi
+      EOF
+    - echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"
+    - kubernetesCreateSecret
+    - kubernetesDeploy
+    - echo 'Uploading SBOM to Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" "__sbom.json" vex.json || true
+    - echo deployment successful 😻
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: review/$CI_COMMIT_REF_NAME/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    on_stop: 'web 🛑 Stop ⚠️ | review '
+    auto_stop_in: 1 week
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: on_success
+      if: $CI_MERGE_REQUEST_ID
+  needs:
+    - job: web 👮 lint
+      artifacts: false
+    - job: 'web 🔨 app | review '
+      artifacts: false
+    - job: 'web 🔨 docker | review '
+      artifacts: false
+    - job: web 🧪 test
+      artifacts: false
+    - job: 'web 🧾 sbom | review '
+      artifacts: true
+    - job: web 🛡 audit
+      artifacts: false
+  retry: *a1
+  interruptible: true
+  allow_failure: false
+'web 🛑 Stop ⚠️ | review ':
+  stage: stop review
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="review"
+    - export APP_DIR="app"
+    - export ENV_TYPE="review"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-review"
+    - export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"
+    - export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"
+    - kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - kubernetesDelete
+    - echo 'Disabling component in Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" || true
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: review/$CI_COMMIT_REF_NAME/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: stop
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/
+      when: on_success
+    - when: manual
+      if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web ↩️ Rollback ⚠️ | review ':
+  stage: rollback review
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="review"
+    - export APP_DIR="app"
+    - export ENV_TYPE="review"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-review"
+    - export KUBE_APP_NAME="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export KUBE_APP_NAME_PREFIX="$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-"
+    - export MONGODB_ROOT_PASSWORD="$CL_review_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --server="$CL_review_web_KUBE_URL" --certificate-authority <(echo $CL_review_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --token="$CL_review_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --cluster="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --user="kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web" --namespace="pan-my-app-review"
+    - kubectl config use-context "kube-pan-my-app-review-$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; })-web"
+    - kubernetesRollback
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.$([ -n "$CI_MERGE_REQUEST_IID" ] && echo "mr$CI_MERGE_REQUEST_IID" || { [ -n "$CI_COMMIT_REF_SLUG" ] && echo "$CI_COMMIT_REF_SLUG" || echo "unknown"; }).review.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: review/$CI_COMMIT_REF_NAME/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: access
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: manual
+      if: $CI_MERGE_REQUEST_ID
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🔨 app | stage ':
+  stage: build
+  image: path/to/docker/jobs-meteor:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export METEOR_DISABLE_OPTIMISTIC_CACHING="1"
+    - export ENV_SHORT="stage"
+    - export APP_DIR="app"
+    - export ENV_TYPE="stage"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-stage"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - echo "add healthcheck package"
+    - meteor add panter:healthroute --allow-superuser
+    - meteor add qualia:prod-shell --allow-superuser
+    - TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory
+    - cp ./__build_info.json ./dist/bundle/programs/server
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+    - key: webmeteor-build-cache
+      policy: pull-push
+      paths:
+        - app/.meteor/local/resolver-result-cache.json
+        - app/.meteor/local/plugin-cache
+        - app/.meteor/local/isopacks
+        - app/.meteor/local/bundler-cache/scanner
+  artifacts:
+    paths:
+      - app/__build_info.json
+      - app/dist
+    expire_in: 1 day
+    when: always
+    reports: {}
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+'web 🔨 docker | stage ':
+  stage: build
+  image: path/to/docker/docker-build:the-version
+  services:
+    - name: docker:24.0.6-dind
+      command:
+        - --tls=false
+  variables:
+    DOCKER_HOST: tcp://0.0.0.0:2375
+    DOCKER_TLS_CERTDIR: ''
+    DOCKER_DRIVER: overlay2
+    DOCKER_BUILDKIT: '1'
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 2Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_DIR="app"
+    - export DOCKER_BUILD_CONTEXT="."
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="stage/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export METEOR_INSTALL_SCRIPTS=""
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - ensureMeteorDockerfile
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"
+    - docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"
+    - docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"
+    - docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG
+    - docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE
+    - docker push $DOCKER_CACHE_IMAGE
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs:
+    - 'web 🔨 app | stage '
+  retry: *a1
+  interruptible: true
+'web 🧾 sbom | stage ':
+  stage: build
+  image: aquasec/trivy:0.38.3
+  variables: {}
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - trivy fs --quiet --format cyclonedx --output "__sbom.json" app
+  artifacts:
+    paths:
+      - __sbom.json
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🚀 Deploy | stage ':
+  stage: deploy stage
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="stage"
+    - export APP_DIR="app"
+    - export ENV_TYPE="stage"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-stage"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="stage/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export RELEASE_NAME="pan-my-app-stage-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"
+    - kubectl config use-context "kube-pan-my-app-stage-web"
+    - echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"
+    - |
+      cat > __all_values.yml <<EOF
+      env:
+        secret:
+          MONGODB_ROOT_PASSWORD: |-
+      $(printf %s "$CL_stage_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
+          MONGO_URL: |-
+            mongodb://root:$CL_stage_web_MONGODB_ROOT_PASSWORD@web-mongodb.pan-my-app-stage.svc.cluster.local:27017/app?authSource=admin
+        public:
+          ENV_SHORT: |-
+            stage
+          APP_DIR: |-
+            app
+          ENV_TYPE: |-
+            stage
+          BUILD_INFO_BUILD_ID: |-
+      $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
+          BUILD_INFO_BUILD_TIME: |-
+      $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
+          BUILD_INFO_CURRENT_VERSION: |-
+      $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
+          HOST: |-
+            web.stage.my-app.pan.panter.cloud
+          ROOT_URL: |-
+            https://web.stage.my-app.pan.panter.cloud
+          HOST_INTERNAL: |-
+            web.stage.my-app.pan.panter.cloud
+          HOST_CANONICAL: |-
+            web.stage.my-app.pan.panter.cloud
+          ROOT_URL_INTERNAL: |-
+            https://web.stage.my-app.pan.panter.cloud
+          KUBE_NAMESPACE: |-
+            pan-my-app-stage
+          KUBE_APP_NAME: |-
+            web
+          KUBE_APP_NAME_PREFIX: ""
+          _ALL_ENV_VAR_KEYS: |-
+            ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
+      application:
+        host: |-
+          web.stage.my-app.pan.panter.cloud
+        command: |-
+          node main.js
+        livenessProbe:
+          httpGet:
+            path: |-
+              __health
+        readinessProbe:
+          httpGet:
+            path: |-
+              __health
+        startupProbe:
+          httpGet:
+            path: |-
+              __health
+        worker:
+          enabled: true
+      mongodb:
+        enabled: true
+        auth:
+          enabled: true
+          rootPassword: |-
+            $CL_stage_web_MONGODB_ROOT_PASSWORD
+          replicaSetKey: |-
+            $CL_stage_web_MONGODB_REPLICASET_KEY
+        persistence:
+          storageClass: |-
+            standard-rwo
+        backup:
+          enabled: true
+          hostToBackup: |-
+            web-mongodb.pan-my-app-stage.svc.cluster.local:27017
+          pvcToBackup: |-
+            web-mongodb
+          image: |-
+            mrelite/kubectlmongoshell:v1.0
+          schedule: |-
+            0 4 * * *
+          volumeSnapshotClass: |-
+            snapshotclass
+        architecture: |-
+          standalone
 
-EOF
-",
-          "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
-          "kubernetesCreateSecret",
-          "kubernetesDeploy",
-          "echo 'Uploading SBOM to Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://www.example.com" "__sbom.json" vex.json || true",
-          "echo deployment successful 😻",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env",
-        ],
-        "stage": "deploy prod",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🚀 Deploy | stage ": {
-        "allow_failure": false,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "auto_stop_in": undefined,
-          "name": "stage/web",
-          "on_stop": "web 🛑 Stop ⚠️ | stage ",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [
-          {
-            "artifacts": false,
-            "job": "web 🔨 app | stage ",
-          },
-          {
-            "artifacts": false,
-            "job": "web 🔨 docker | stage ",
-          },
-          {
-            "artifacts": true,
-            "job": "web 🧾 sbom | stage ",
-          },
-        ],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "when": "on_success",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="stage"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="stage"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-stage"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export DOCKER_REGISTRY="$CI_REGISTRY"",
-          "export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"",
-          "export DOCKER_IMAGE_NAME="stage/web"",
-          "export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"",
-          "export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"",
-          "export RELEASE_NAME="pan-my-app-stage-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"",
-          "kubectl config use-context "kube-pan-my-app-stage-web"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"",
-          "cat > __all_values.yml <<EOF
-env:
-  secret:
-    MONGODB_ROOT_PASSWORD: |-
-$(printf %s "$CL_stage_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
-    MONGO_URL: |-
-      mongodb://root:$CL_stage_web_MONGODB_ROOT_PASSWORD@web-mongodb.pan-my-app-stage.svc.cluster.local:27017/app?authSource=admin
-  public:
-    ENV_SHORT: |-
-      stage
-    APP_DIR: |-
-      app
-    ENV_TYPE: |-
-      stage
-    BUILD_INFO_BUILD_ID: |-
-$(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
-    BUILD_INFO_BUILD_TIME: |-
-$(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
-    BUILD_INFO_CURRENT_VERSION: |-
-$(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
-    HOST: |-
-      web.stage.my-app.pan.panter.cloud
-    ROOT_URL: |-
-      https://web.stage.my-app.pan.panter.cloud
-    HOST_INTERNAL: |-
-      web.stage.my-app.pan.panter.cloud
-    HOST_CANONICAL: |-
-      web.stage.my-app.pan.panter.cloud
-    ROOT_URL_INTERNAL: |-
-      https://web.stage.my-app.pan.panter.cloud
-    KUBE_NAMESPACE: |-
-      pan-my-app-stage
-    KUBE_APP_NAME: |-
-      web
-    KUBE_APP_NAME_PREFIX: ""
-    _ALL_ENV_VAR_KEYS: |-
-      ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD"]
-application:
-  host: |-
-    web.stage.my-app.pan.panter.cloud
-  command: |-
-    node main.js
-  livenessProbe:
-    httpGet:
-      path: |-
-        __health
-  readinessProbe:
-    httpGet:
-      path: |-
-        __health
-  startupProbe:
-    httpGet:
-      path: |-
-        __health
-  worker:
-    enabled: true
-mongodb:
-  enabled: true
-  auth:
-    enabled: true
-    rootPassword: |-
-      $CL_stage_web_MONGODB_ROOT_PASSWORD
-    replicaSetKey: |-
-      $CL_stage_web_MONGODB_REPLICASET_KEY
-  persistence:
-    storageClass: |-
-      standard-rwo
-  backup:
-    enabled: true
-    hostToBackup: |-
-      web-mongodb.pan-my-app-stage.svc.cluster.local:27017
-    pvcToBackup: |-
-      web-mongodb
-    image: |-
-      mrelite/kubectlmongoshell:v1.0
-    schedule: |-
-      0 4 * * *
-    volumeSnapshotClass: |-
-      snapshotclass
-  architecture: |-
-    standalone
+      EOF
+    - echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"
+    - kubernetesCreateSecret
+    - kubernetesDeploy
+    - echo 'Uploading SBOM to Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.stage.my-app.pan.panter.cloud" "__sbom.json" vex.json || true
+    - echo deployment successful 😻
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: stage/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    on_stop: 'web 🛑 Stop ⚠️ | stage '
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: on_success
+      if: $CI_COMMIT_TAG
+  needs:
+    - job: 'web 🔨 app | stage '
+      artifacts: false
+    - job: 'web 🔨 docker | stage '
+      artifacts: false
+    - job: 'web 🧾 sbom | stage '
+      artifacts: true
+  retry: *a1
+  interruptible: true
+  allow_failure: false
+'web 🛑 Stop ⚠️ | stage ':
+  stage: stop stage
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="stage"
+    - export APP_DIR="app"
+    - export ENV_TYPE="stage"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-stage"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-stage-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"
+    - kubectl config use-context "kube-pan-my-app-stage-web"
+    - kubernetesDelete
+    - echo 'Disabling component in Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.stage.my-app.pan.panter.cloud" || true
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: stage/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: stop
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/
+      when: on_success
+    - when: manual
+      if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web ↩️ Rollback ⚠️ | stage ':
+  stage: rollback stage
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="stage"
+    - export APP_DIR="app"
+    - export ENV_TYPE="stage"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"
+    - export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-stage"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"
+    - export RELEASE_NAME="pan-my-app-stage-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"
+    - kubectl config use-context "kube-pan-my-app-stage-web"
+    - kubernetesRollback
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env
+  environment:
+    name: stage/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: access
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: manual
+      if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🔨 app | prod ':
+  stage: build
+  image: path/to/docker/jobs-meteor:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 4Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export METEOR_DISABLE_OPTIMISTIC_CACHING="1"
+    - export ENV_SHORT="prod"
+    - export APP_DIR="app"
+    - export ENV_TYPE="prod"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="www.example.com"
+    - export ROOT_URL="https://www.example.com"
+    - export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-prod"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"
+    - export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - echo '{"id":"$(git describe --tags 2>/dev/null || git rev-parse HEAD)","time":"$CI_JOB_STARTED_AT"}' > app/__build_info.json
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - cd app
+    - echo -e "\\e[0Ksection_start:$(date +%s):nodeinstall[collapsed=true]\\r\\e[0KEnsure node version"
+    - if [ -f ~/.nvm/nvm.sh ];  then source ~/.nvm/nvm.sh; fi
+    - if command -v nvm &> /dev/null && [ -f ./.nvmrc ]; then nvm install; fi
+    - echo -e "\\e[0Ksection_end:$(date +%s):nodeinstall\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):yarninstall[collapsed=true]\\r\\e[0KYarn install"
+    - yarn install --immutable
+    - echo -e "\\e[0Ksection_end:$(date +%s):yarninstall\\r\\e[0K"
+    - echo "add healthcheck package"
+    - meteor add panter:healthroute --allow-superuser
+    - meteor add qualia:prod-shell --allow-superuser
+    - TOOL_NODE_FLAGS="--max_old_space_size=3584 --min_semi_space_size=8 --max_semi_space_size=256 --optimize_for_size" meteor build ./dist --architecture os.linux.x86_64 --allow-superuser --server-only --directory
+    - cp ./__build_info.json ./dist/bundle/programs/server
+  cache:
+    - key: app-yarn
+      policy: pull-push
+      paths:
+        - app/.yarn
+    - key: app-node-modules
+      policy: pull-push
+      paths:
+        - app/node_modules
+    - key: webmeteor-build-cache
+      policy: pull-push
+      paths:
+        - app/.meteor/local/resolver-result-cache.json
+        - app/.meteor/local/plugin-cache
+        - app/.meteor/local/isopacks
+        - app/.meteor/local/bundler-cache/scanner
+  artifacts:
+    paths:
+      - app/__build_info.json
+      - app/dist
+    expire_in: 1 day
+    when: always
+    reports: {}
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+'web 🔨 docker | prod ':
+  stage: build
+  image: path/to/docker/docker-build:the-version
+  services:
+    - name: docker:24.0.6-dind
+      command:
+        - --tls=false
+  variables:
+    DOCKER_HOST: tcp://0.0.0.0:2375
+    DOCKER_TLS_CERTDIR: ''
+    DOCKER_DRIVER: overlay2
+    DOCKER_BUILDKIT: '1'
+    KUBERNETES_CPU_REQUEST: '0.45'
+    KUBERNETES_MEMORY_REQUEST: 1Gi
+    KUBERNETES_MEMORY_LIMIT: 2Gi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export APP_DIR="app"
+    - export DOCKER_BUILD_CONTEXT="."
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="prod/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export METEOR_INSTALL_SCRIPTS=""
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - ensureMeteorDockerfile
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-login[collapsed=true]\\r\\e[0KDocker Login"
+    - docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-login\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-build[collapsed=true]\\r\\e[0KDocker build"
+    - docker build --network host --cache-from $DOCKER_CACHE_IMAGE --tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG -f $APP_DIR/Dockerfile $DOCKER_BUILD_CONTEXT --build-arg BUILDKIT_INLINE_CACHE=1
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-build\\r\\e[0K"
+    - echo -e "\\e[0Ksection_start:$(date +%s):docker-push[collapsed=true]\\r\\e[0KDocker push and tag"
+    - docker push $DOCKER_IMAGE:$DOCKER_IMAGE_TAG
+    - docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG $DOCKER_CACHE_IMAGE
+    - docker push $DOCKER_CACHE_IMAGE
+    - echo -e "\\e[0Ksection_end:$(date +%s):docker-push\\r\\e[0K"
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs:
+    - 'web 🔨 app | prod '
+  retry: *a1
+  interruptible: true
+'web 🧾 sbom | prod ':
+  stage: build
+  image: aquasec/trivy:0.38.3
+  variables: {}
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - trivy fs --quiet --format cyclonedx --output "__sbom.json" app
+  artifacts:
+    paths:
+      - __sbom.json
+  rules:
+    - if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🚀 Deploy | prod ':
+  stage: deploy prod
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="prod"
+    - export APP_DIR="app"
+    - export ENV_TYPE="prod"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="www.example.com"
+    - export ROOT_URL="https://www.example.com"
+    - export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-prod"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"
+    - export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"
+    - export DOCKER_REGISTRY="$CI_REGISTRY"
+    - export DOCKER_CACHE_IMAGE="$CI_REGISTRY_IMAGE/caches/web"
+    - export DOCKER_IMAGE_NAME="prod/web"
+    - export DOCKER_IMAGE="$CI_REGISTRY_IMAGE/$DOCKER_IMAGE_NAME"
+    - export DOCKER_IMAGE_TAG="$CI_COMMIT_SHA"
+    - export RELEASE_NAME="pan-my-app-prod-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"
+    - kubectl config use-context "kube-pan-my-app-prod-web"
+    - echo -e "\\e[0Ksection_start:$(date +%s):writeallvalues[collapsed=true]\\r\\e[0KWrite __all_values.yml for helm deployment"
+    - |
+      cat > __all_values.yml <<EOF
+      env:
+        secret:
+          MONGODB_ROOT_PASSWORD: |-
+      $(printf %s "$CL_prod_web_MONGODB_ROOT_PASSWORD" | sed 's/^/      /')
+          MONGODB_REPLICASET_KEY: |-
+      $(printf %s "$CL_prod_web_MONGODB_REPLICASET_KEY" | sed 's/^/      /')
+          MONGO_URL: |-
+            mongodb://root:$CL_prod_web_MONGODB_ROOT_PASSWORD@web-mongodb-0.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017,web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017/app?replicaSet=rs0&authSource=admin
+          MONGO_OPLOG_URL: |-
+            mongodb://root:$CL_prod_web_MONGODB_ROOT_PASSWORD@web-mongodb-0.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017,web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017/local?replicaSet=rs0&authSource=admin
+        public:
+          ENV_SHORT: |-
+            prod
+          APP_DIR: |-
+            app
+          ENV_TYPE: |-
+            prod
+          BUILD_INFO_BUILD_ID: |-
+      $(printf %s "$(git describe --tags 2>/dev/null || git rev-parse HEAD)" | sed 's/^/      /')
+          BUILD_INFO_BUILD_TIME: |-
+      $(printf %s "$CI_JOB_STARTED_AT" | sed 's/^/      /')
+          BUILD_INFO_CURRENT_VERSION: |-
+      $(printf %s "$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")" | sed 's/^/      /')
+          HOST: |-
+            www.example.com
+          ROOT_URL: |-
+            https://www.example.com
+          HOST_INTERNAL: |-
+            web.prod.my-app.pan.panter.cloud
+          HOST_CANONICAL: |-
+            web.prod.my-app.pan.panter.cloud
+          ROOT_URL_INTERNAL: |-
+            https://web.prod.my-app.pan.panter.cloud
+          KUBE_NAMESPACE: |-
+            pan-my-app-prod
+          KUBE_APP_NAME: |-
+            web
+          KUBE_APP_NAME_PREFIX: ""
+          _ALL_ENV_VAR_KEYS: |-
+            ["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_BUILD_ID","BUILD_INFO_BUILD_TIME","BUILD_INFO_CURRENT_VERSION","HOST","ROOT_URL","HOST_INTERNAL","HOST_CANONICAL","ROOT_URL_INTERNAL","KUBE_NAMESPACE","KUBE_APP_NAME","KUBE_APP_NAME_PREFIX","MONGODB_ROOT_PASSWORD","MONGODB_REPLICASET_KEY"]
+      application:
+        host: |-
+          www.example.com
+        command: |-
+          node main.js
+        livenessProbe:
+          httpGet:
+            path: |-
+              __health
+        readinessProbe:
+          httpGet:
+            path: |-
+              __health
+        startupProbe:
+          httpGet:
+            path: |-
+              __health
+        worker:
+          enabled: true
+        redirects:
+          - host: |-
+              example.com
+      mongodb:
+        enabled: true
+        auth:
+          enabled: true
+          rootPassword: |-
+            $CL_prod_web_MONGODB_ROOT_PASSWORD
+          replicaSetKey: |-
+            $CL_prod_web_MONGODB_REPLICASET_KEY
+        persistence:
+          storageClass: |-
+            premium-rwo
+          size: |-
+            50Gi
+        backup:
+          enabled: true
+          hostToBackup: |-
+            web-mongodb-1.web-mongodb-headless.pan-my-app-prod.svc.cluster.local:27017
+          pvcToBackup: |-
+            datadir-web-mongodb-1
+          image: |-
+            mrelite/kubectlmongoshell:v1.0
+          schedule: |-
+            0 4 * * *
+          volumeSnapshotClass: |-
+            snapshotclass
+        architecture: |-
+          replicaset
+        replicaCount: 2
+        resources:
+          limits:
+            memory: |-
+              8Gi
+          requests:
+            memory: |-
+              8Gi
 
-EOF
-",
-          "echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"",
-          "kubernetesCreateSecret",
-          "kubernetesDeploy",
-          "echo 'Uploading SBOM to Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://web.stage.my-app.pan.panter.cloud" "__sbom.json" vex.json || true",
-          "echo deployment successful 😻",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "deploy stage",
-        "variables": {
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛑 Stop ⚠️ | prod ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "stop",
-          "name": "prod/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
-            "when": "on_success",
-          },
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="prod"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="prod"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="www.example.com"",
-          "export ROOT_URL="https://www.example.com"",
-          "export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-prod"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"",
-          "export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"",
-          "export RELEASE_NAME="pan-my-app-prod-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"",
-          "kubectl config use-context "kube-pan-my-app-prod-web"",
-          "kubernetesDelete",
-          "echo 'Disabling component in Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://www.example.com" || true",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env",
-        ],
-        "stage": "stop prod",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🛑 Stop ⚠️ | stage ": {
-        "allow_failure": true,
-        "artifacts": {
-          "reports": {
-            "dotenv": "gitlab_environment.env",
-          },
-        },
-        "environment": {
-          "action": "stop",
-          "name": "stage/web",
-          "url": "$CL_GITLAB_ENVIRONMENT_URL",
-        },
-        "image": "path/to/docker/kubernetes:the-version",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "rules": [
-          {
-            "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/",
-            "when": "on_success",
-          },
-          {
-            "when": "manual",
-          },
-        ],
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "export ENV_SHORT="stage"",
-          "export APP_DIR="app"",
-          "export ENV_TYPE="stage"",
-          "export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"",
-          "export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"",
-          "export HOST="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL="https://web.stage.my-app.pan.panter.cloud"",
-          "export HOST_INTERNAL="web.stage.my-app.pan.panter.cloud"",
-          "export HOST_CANONICAL="web.stage.my-app.pan.panter.cloud"",
-          "export ROOT_URL_INTERNAL="https://web.stage.my-app.pan.panter.cloud"",
-          "export KUBE_NAMESPACE="pan-my-app-stage"",
-          "export KUBE_APP_NAME="web"",
-          "export KUBE_APP_NAME_PREFIX=""",
-          "export MONGODB_ROOT_PASSWORD="$CL_stage_web_MONGODB_ROOT_PASSWORD"",
-          "export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\"]"",
-          "export RELEASE_NAME="pan-my-app-stage-web"",
-          "export HELM_EXPERIMENTAL_OCI="1"",
-          "export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"",
-          "export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"",
-          "export HELM_ARGS=""",
-          "export COMPONENT_NAME="web"",
-          "export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "kubectl config set-cluster "kube-pan-my-app-stage-web" --server="$CL_stage_web_KUBE_URL" --certificate-authority <(echo $CL_stage_web_KUBE_CA_PEM | base64 -d) --embed-certs=true",
-          "kubectl config set-credentials "kube-pan-my-app-stage-web" --token="$CL_stage_web_KUBE_TOKEN"",
-          "kubectl config set-context "kube-pan-my-app-stage-web" --cluster="kube-pan-my-app-stage-web" --user="kube-pan-my-app-stage-web" --namespace="pan-my-app-stage"",
-          "kubectl config use-context "kube-pan-my-app-stage-web"",
-          "kubernetesDelete",
-          "echo 'Disabling component in Dependency Track'",
-          "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://web.stage.my-app.pan.panter.cloud" || true",
-          "echo "CL_GITLAB_ENVIRONMENT_URL=https://web.stage.my-app.pan.panter.cloud" >> gitlab_environment.env",
-        ],
-        "stage": "stop stage",
-        "variables": {
-          "GIT_STRATEGY": "none",
-          "KUBERNETES_CPU_REQUEST": "0.22",
-          "KUBERNETES_MEMORY_LIMIT": "400Mi",
-          "KUBERNETES_MEMORY_REQUEST": "200Mi",
-        },
-      },
-      "web 🧾 sbom | prod ": {
-        "allow_failure": true,
-        "artifacts": {
-          "paths": [
-            "__sbom.json",
-          ],
-        },
-        "image": "aquasec/trivy:0.38.3",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "trivy fs --quiet --format cyclonedx --output "__sbom.json" app",
-        ],
-        "stage": "build",
-        "variables": {},
-      },
-      "web 🧾 sbom | stage ": {
-        "allow_failure": true,
-        "artifacts": {
-          "paths": [
-            "__sbom.json",
-          ],
-        },
-        "image": "aquasec/trivy:0.38.3",
-        "interruptible": true,
-        "needs": [],
-        "retry": {
-          "max": 2,
-          "when": [
-            "runner_system_failure",
-            "stuck_or_timeout_failure",
-          ],
-        },
-        "script": [
-          "echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"",
-          "echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"",
-          "trivy fs --quiet --format cyclonedx --output "__sbom.json" app",
-        ],
-        "stage": "build",
-        "variables": {},
-      },
-    },
-    "stages": [
-      "setup",
-      "setup dev",
-      "setup review",
-      "setup stage",
-      "setup prod",
-      "test",
-      "test dev",
-      "test review",
-      "test stage",
-      "test prod",
-      "build",
-      "build dev",
-      "build review",
-      "build stage",
-      "build prod",
-      "deploy",
-      "deploy dev",
-      "deploy review",
-      "deploy stage",
-      "deploy prod",
-      "verify",
-      "verify dev",
-      "verify review",
-      "verify stage",
-      "verify prod",
-      "rollback",
-      "rollback dev",
-      "rollback review",
-      "rollback stage",
-      "rollback prod",
-      "stop",
-      "stop dev",
-      "stop review",
-      "stop stage",
-      "stop prod",
-    ],
-    "variables": {
-      "ARTIFACT_COMPRESSION_LEVEL": "fast",
-      "CACHE_COMPRESSION_LEVEL": "fast",
-      "FF_USE_FASTZIP": "true",
-      "GIT_DEPTH": "1",
-      "TRANSFER_METER_FREQUENCY": "5s",
-    },
-    "workflow": {
-      "rules": [
-        {
-          "if": "$CI_COMMIT_TAG",
-        },
-        {
-          "if": "$CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/",
-          "when": "never",
-        },
-        {
-          "if": "$CI_PIPELINE_SOURCE  == "schedule"",
-          "when": "never",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/",
-        },
-        {
-          "if": "$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH",
-        },
-        {
-          "if": "$CI_MERGE_REQUEST_ID",
-        },
-      ],
-    },
-  },
-}
+      EOF
+    - echo -e "\\e[0Ksection_end:$(date +%s):writeallvalues\\r\\e[0K"
+    - kubernetesCreateSecret
+    - kubernetesDeploy
+    - echo 'Uploading SBOM to Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-my-app/web" "https://www.example.com" "__sbom.json" vex.json || true
+    - echo deployment successful 😻
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env
+  environment:
+    name: prod/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    on_stop: 'web 🛑 Stop ⚠️ | prod '
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: manual
+      if: $CI_COMMIT_TAG
+  needs:
+    - job: 'web 🔨 app | prod '
+      artifacts: false
+    - job: 'web 🔨 docker | prod '
+      artifacts: false
+    - job: 'web 🧾 sbom | prod '
+      artifacts: true
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web 🛑 Stop ⚠️ | prod ':
+  stage: stop prod
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="prod"
+    - export APP_DIR="app"
+    - export ENV_TYPE="prod"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="www.example.com"
+    - export ROOT_URL="https://www.example.com"
+    - export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-prod"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"
+    - export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"
+    - export RELEASE_NAME="pan-my-app-prod-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"
+    - kubectl config use-context "kube-pan-my-app-prod-web"
+    - kubernetesDelete
+    - echo 'Disabling component in Dependency Track'
+    - /dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-my-app/web" "https://www.example.com" || true
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env
+  environment:
+    name: prod/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: stop
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+\\.([0-9]+|x)\\.x$/
+      when: on_success
+    - when: manual
+      if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+'web ↩️ Rollback ⚠️ | prod ':
+  stage: rollback prod
+  image: path/to/docker/kubernetes:the-version
+  variables:
+    KUBERNETES_CPU_REQUEST: '0.22'
+    KUBERNETES_MEMORY_REQUEST: 200Mi
+    KUBERNETES_MEMORY_LIMIT: 400Mi
+    GIT_STRATEGY: none
+  script:
+    - echo -e "\\e[0Ksection_start:$(date +%s):injectvars[collapsed=true]\\r\\e[0KInjecting variables"
+    - export ENV_SHORT="prod"
+    - export APP_DIR="app"
+    - export ENV_TYPE="prod"
+    - export BUILD_INFO_BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - export BUILD_INFO_BUILD_TIME="$CI_JOB_STARTED_AT"
+    - export BUILD_INFO_CURRENT_VERSION="$(tag=$(git ls-remote origin "refs/tags/v*[0-9]" 2>/dev/null | cut -f 2- | sort -V | tail -1 | sed 's/refs\\/tags\\/v//'); [ -z "$tag" ] && echo "0.0.0" || echo "$tag")"
+    - export HOST="www.example.com"
+    - export ROOT_URL="https://www.example.com"
+    - export HOST_INTERNAL="web.prod.my-app.pan.panter.cloud"
+    - export HOST_CANONICAL="web.prod.my-app.pan.panter.cloud"
+    - export ROOT_URL_INTERNAL="https://web.prod.my-app.pan.panter.cloud"
+    - export KUBE_NAMESPACE="pan-my-app-prod"
+    - export KUBE_APP_NAME="web"
+    - export KUBE_APP_NAME_PREFIX=""
+    - export MONGODB_ROOT_PASSWORD="$CL_prod_web_MONGODB_ROOT_PASSWORD"
+    - export MONGODB_REPLICASET_KEY="$CL_prod_web_MONGODB_REPLICASET_KEY"
+    - export _ALL_ENV_VAR_KEYS="[\\"ENV_SHORT\\",\\"APP_DIR\\",\\"ENV_TYPE\\",\\"BUILD_INFO_BUILD_ID\\",\\"BUILD_INFO_BUILD_TIME\\",\\"BUILD_INFO_CURRENT_VERSION\\",\\"HOST\\",\\"ROOT_URL\\",\\"HOST_INTERNAL\\",\\"HOST_CANONICAL\\",\\"ROOT_URL_INTERNAL\\",\\"KUBE_NAMESPACE\\",\\"KUBE_APP_NAME\\",\\"KUBE_APP_NAME_PREFIX\\",\\"MONGODB_ROOT_PASSWORD\\",\\"MONGODB_REPLICASET_KEY\\"]"
+    - export RELEASE_NAME="pan-my-app-prod-web"
+    - export HELM_EXPERIMENTAL_OCI="1"
+    - export KUBE_DOCKER_IMAGE_PULL_SECRET="gitlab-registry-web"
+    - export HELM_GITLAB_CHART_NAME="/helm-charts/the-panter-chart"
+    - export HELM_ARGS=""
+    - export COMPONENT_NAME="web"
+    - export BUILD_ID="$(git describe --tags 2>/dev/null || git rev-parse HEAD)"
+    - echo -e "\\e[0Ksection_end:$(date +%s):injectvars\\r\\e[0K"
+    - kubectl config set-cluster "kube-pan-my-app-prod-web" --server="$CL_prod_web_KUBE_URL" --certificate-authority <(echo $CL_prod_web_KUBE_CA_PEM | base64 -d) --embed-certs=true
+    - kubectl config set-credentials "kube-pan-my-app-prod-web" --token="$CL_prod_web_KUBE_TOKEN"
+    - kubectl config set-context "kube-pan-my-app-prod-web" --cluster="kube-pan-my-app-prod-web" --user="kube-pan-my-app-prod-web" --namespace="pan-my-app-prod"
+    - kubectl config use-context "kube-pan-my-app-prod-web"
+    - kubernetesRollback
+    - echo "CL_GITLAB_ENVIRONMENT_URL=https://www.example.com" >> gitlab_environment.env
+  environment:
+    name: prod/web
+    url: $CL_GITLAB_ENVIRONMENT_URL
+    action: access
+  artifacts:
+    reports:
+      dotenv: gitlab_environment.env
+  rules:
+    - when: manual
+      if: $CI_COMMIT_TAG
+  needs: []
+  retry: *a1
+  interruptible: true
+  allow_failure: true
+create release:
+  stage: release
+  image: path/to/docker/semantic-release:the-version
+  script:
+    - semanticRelease
+  after_script:
+    - echo '👉 The project access token might be invald - run \`project-renew-token\` in catladder CLI to fix.'
+  rules:
+    - &a2
+      if: $CI_COMMIT_MESSAGE =~ /^chore\\(release\\).*/
+      when: never
+    - &a3
+      if: $CI_PIPELINE_SOURCE  == "schedule"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $AUTO_RELEASE == "true"
+      when: on_success
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      when: manual
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/
+      when: manual
+⚠️ force create release:
+  stage: release
+  image: path/to/docker/semantic-release:the-version
+  script:
+    - semanticRelease
+  after_script:
+    - echo '👉 The project access token might be invald - run \`project-renew-token\` in catladder CLI to fix.'
+  rules:
+    - *a2
+    - *a3
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      when: manual
+    - if: $CI_COMMIT_BRANCH =~ /^[0-9]+.([0-9]+|x).x$/
+      when: manual
+  needs: []
+"
 `;