@hellopearl/dv-gitlab 0.4.3 → 0.4.5

package/bin/dv-gitlab.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+/* eslint-disable no-undef */
 'use strict';
 
 if (typeof globalThis.fetch === 'undefined') {

package/ci/e2e-enforce.yml

@@ -1,18 +1,36 @@
 # Reusable template: enforce green E2E on MRs.
-# Waits for an Amplify preview to go live, triggers pearl-test-automation,
+# Optionally waits for an Amplify preview, triggers pearl-test-automation,
 # then polls until the pipeline finishes — failing if tests are red.
 #
-# Consumer usage:
+# Required CI/CD variables (set in consumer project or inherited from group):
+#   E2E_API_TOKEN  — Group Access Token (hellopearl, api scope)
+#                    Used to trigger and poll pearl-test-automation pipelines.
+#                    Set once at group level — inherited by all consumer repos.
+#
+# Consumer usage (web app with Amplify preview):
 #   include:
 #     - project: 'hellopearl/pearl-agentic-mono'
 #       ref: main
 #       file: '/packages/dev/dv-gitlab/ci/e2e-enforce.yml'
 #
-#   e2e:
+#   e2e:voice:
 #     extends: .e2e-enforce
 #     variables:
-#       E2E_PROJECT: Voice           # pearl-test-automation project name
+#       E2E_PROJECT: Voice
 #       PREVIEW_DOMAIN: voice.hellopearl.com
+#
+# Consumer usage (extension / no preview):
+#   e2e:extension:
+#     extends: .e2e-enforce
+#     needs:
+#       - job: package mr extension
+#         optional: true
+#         artifacts: true
+#     variables:
+#       E2E_PROJECT: Extension
+#       E2E_SCOPE: Smoke
+#     # PREVIEW_DOMAIN is empty → preview wait is skipped.
+#     # EXTENSION_ARTIFACT_URL comes from dotenv artifact of the needs job.
 
 .e2e-enforce:
   stage: e2e
@@ -20,62 +38,69 @@
   before_script:
     - apk add --no-cache curl jq
   variables:
-    QA_PROJECT_ID: "59469690"
-    E2E_PROJECT: ""
-    E2E_SCOPE: "All"
-    E2E_ENV: "dev"
-    PREVIEW_DOMAIN: ""
-    PREVIEW_WAIT_ATTEMPTS: "60"
-    PREVIEW_WAIT_INTERVAL: "10"
-    PIPELINE_POLL_ATTEMPTS: "180"
-    PIPELINE_POLL_INTERVAL: "10"
+    QA_PROJECT_ID: '59469690'
+    E2E_PROJECT: ''
+    E2E_SCOPE: 'All'
+    E2E_ENV: 'dev'
+    PREVIEW_DOMAIN: ''
+    PREVIEW_WAIT_ATTEMPTS: '60'
+    PREVIEW_WAIT_INTERVAL: '10'
+    PIPELINE_POLL_ATTEMPTS: '180'
+    PIPELINE_POLL_INTERVAL: '10'
   script:
     - |
-      if [ -z "$E2E_PROJECT" ] || [ -z "$PREVIEW_DOMAIN" ]; then
-        echo "[e2e-enforce] ERROR: E2E_PROJECT and PREVIEW_DOMAIN must be set"
+      if [ -z "$E2E_PROJECT" ]; then
+        echo "[e2e-enforce] ERROR: E2E_PROJECT must be set"
         exit 1
       fi
 
-      if [ -z "$GITLAB_API_TOKEN" ]; then
-        echo "[e2e-enforce] GITLAB_API_TOKEN not set — skipping E2E (configure in CI/CD variables)"
-        exit 0
+      if [ -z "$E2E_API_TOKEN" ]; then
+        echo "[e2e-enforce] ❌ E2E_API_TOKEN not set — cannot trigger/poll pearl-test-automation"
+        echo "[e2e-enforce] Set it as a Group Access Token (api scope) at the hellopearl group level"
+        exit 1
       fi
 
-      BRANCH_SLUG=$(echo "$CI_COMMIT_REF_NAME" | tr '[:upper:]' '[:lower:]' | sed 's|/|-|g')
-      PREVIEW_URL="https://${BRANCH_SLUG}.${PREVIEW_DOMAIN}"
-      echo "[e2e-enforce] Preview URL: $PREVIEW_URL"
       echo "[e2e-enforce] Project: $E2E_PROJECT | Scope: $E2E_SCOPE | Env: $E2E_ENV"
 
-      # ── Wait for Amplify preview ──
-      echo "[e2e-enforce] Waiting for preview to go live..."
-      for i in $(seq 1 "$PREVIEW_WAIT_ATTEMPTS"); do
-        STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL" 2>/dev/null || echo "000")
-        [ "$STATUS" = "200" ] && break
-        echo "[e2e-enforce] Attempt $i/${PREVIEW_WAIT_ATTEMPTS} — HTTP $STATUS"
-        sleep "$PREVIEW_WAIT_INTERVAL"
-      done
-      if [ "$STATUS" != "200" ]; then
-        echo "[e2e-enforce] Preview not available — skipping (non-blocking)"
-        exit 0
+      # ── Wait for Amplify preview (skipped when PREVIEW_DOMAIN is empty) ──
+      PREVIEW_URL=""
+      if [ -n "$PREVIEW_DOMAIN" ]; then
+        BRANCH_SLUG=$(echo "$CI_COMMIT_REF_NAME" | tr '[:upper:]' '[:lower:]' | sed 's|/|-|g')
+        PREVIEW_URL="https://${BRANCH_SLUG}.${PREVIEW_DOMAIN}"
+        echo "[e2e-enforce] Preview URL: $PREVIEW_URL"
+        echo "[e2e-enforce] Waiting for preview to go live..."
+        for i in $(seq 1 "$PREVIEW_WAIT_ATTEMPTS"); do
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$PREVIEW_URL" 2>/dev/null || echo "000")
+          [ "$STATUS" = "200" ] && break
+          echo "[e2e-enforce] Attempt $i/${PREVIEW_WAIT_ATTEMPTS} — HTTP $STATUS"
+          sleep "$PREVIEW_WAIT_INTERVAL"
+        done
+        if [ "$STATUS" != "200" ]; then
+          echo "[e2e-enforce] ❌ Preview not available after ${PREVIEW_WAIT_ATTEMPTS} attempts — E2E gate blocked"
+          echo "[e2e-enforce] Expected 200 at $PREVIEW_URL, got HTTP $STATUS"
+          exit 1
+        fi
+        echo "[e2e-enforce] Preview is live."
+      else
+        echo "[e2e-enforce] No PREVIEW_DOMAIN — skipping preview wait"
       fi
-      echo "[e2e-enforce] Preview is live."
 
-      # ── Trigger pearl-test-automation ──
-      RESPONSE=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_API_TOKEN}" \
+      # ── Trigger pearl-test-automation via API ──
+      VARS="[{\"key\":\"PROJECT\",\"value\":\"$E2E_PROJECT\"}"
+      VARS="$VARS,{\"key\":\"ENV\",\"value\":\"$E2E_ENV\"}"
+      VARS="$VARS,{\"key\":\"SCOPE\",\"value\":\"$E2E_SCOPE\"}"
+      VARS="$VARS,{\"key\":\"SOURCE_PROJECT_ID\",\"value\":\"$CI_PROJECT_ID\"}"
+      VARS="$VARS,{\"key\":\"SOURCE_MR_IID\",\"value\":\"${CI_MERGE_REQUEST_IID:-}\"}"
+      [ -n "$PREVIEW_URL" ] && VARS="$VARS,{\"key\":\"PREVIEW_URL\",\"value\":\"$PREVIEW_URL\"}"
+      [ -n "${EXTENSION_ARTIFACT_URL:-}" ] && VARS="$VARS,{\"key\":\"EXTENSION_ARTIFACT_URL\",\"value\":\"$EXTENSION_ARTIFACT_URL\"}"
+      [ -n "${E2E_CAPTURE:-}" ] && VARS="$VARS,{\"key\":\"CAPTURE\",\"value\":\"$E2E_CAPTURE\"}"
+      VARS="$VARS]"
+
+      RESPONSE=$(curl -s --request POST \
+        --header "PRIVATE-TOKEN: ${E2E_API_TOKEN}" \
         --header "Content-Type: application/json" \
-        --request POST \
-        "https://gitlab.com/api/v4/projects/${QA_PROJECT_ID}/pipeline" \
-        --data "{
-          \"ref\": \"main\",
-          \"variables\": [
-            {\"key\": \"PROJECT\", \"value\": \"$E2E_PROJECT\"},
-            {\"key\": \"ENV\", \"value\": \"$E2E_ENV\"},
-            {\"key\": \"SCOPE\", \"value\": \"$E2E_SCOPE\"},
-            {\"key\": \"PREVIEW_URL\", \"value\": \"$PREVIEW_URL\"},
-            {\"key\": \"SOURCE_PROJECT_ID\", \"value\": \"$CI_PROJECT_ID\"},
-            {\"key\": \"SOURCE_MR_IID\", \"value\": \"$CI_MERGE_REQUEST_IID\"}
-          ]
-        }")
+        --data "{\"ref\":\"main\",\"variables\":$VARS}" \
+        "https://gitlab.com/api/v4/projects/${QA_PROJECT_ID}/pipeline")
       PIPELINE_ID=$(echo "$RESPONSE" | jq -r '.id // empty')
       PIPELINE_URL=$(echo "$RESPONSE" | jq -r '.web_url // empty')
 
@@ -85,12 +110,17 @@
       fi
       echo "[e2e-enforce] Triggered: $PIPELINE_URL"
 
-      # ── Poll for result ──
+      # ── Poll for result using E2E_API_TOKEN ──
       for i in $(seq 1 "$PIPELINE_POLL_ATTEMPTS"); do
         sleep "$PIPELINE_POLL_INTERVAL"
-        PSTATUS=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_API_TOKEN}" \
-          "https://gitlab.com/api/v4/projects/${QA_PROJECT_ID}/pipelines/$PIPELINE_ID" \
-          | jq -r '.status')
+        POLL_RESPONSE=$(curl -s --header "PRIVATE-TOKEN: ${E2E_API_TOKEN}" \
+          "https://gitlab.com/api/v4/projects/${QA_PROJECT_ID}/pipelines/$PIPELINE_ID")
+        PSTATUS=$(echo "$POLL_RESPONSE" | jq -r '.status // empty')
+        if [ -z "$PSTATUS" ]; then
+          echo "[e2e-enforce] ⚠ API returned no status — response: $(echo "$POLL_RESPONSE" | jq -c '.' 2>/dev/null || echo "$POLL_RESPONSE")"
+          echo "[e2e-enforce] Token may lack read_api access to project $QA_PROJECT_ID"
+          exit 1
+        fi
         case "$PSTATUS" in
           success)
             echo "[e2e-enforce] ✅ E2E PASSED — $PIPELINE_URL"

package/ci/quality-gate.yml

@@ -20,29 +20,31 @@
     - corepack enable || true
     - yarn install --immutable 2>/dev/null || npm ci 2>/dev/null || true
   variables:
-    QUALITY_FORMAT_CHECK: "true"
-    QUALITY_LINT: "true"
-    QUALITY_STYLELINT: "false"
-    QUALITY_LINT_PROFILE: "client"
-    QUALITY_FORMAT_GLOB: "src/**/*.{ts,tsx,js,jsx,mjs}"
-    QUALITY_STYLELINT_GLOB: "src/**/*.scss"
+    QUALITY_FORMAT_CHECK: 'true'
+    QUALITY_LINT: 'true'
+    QUALITY_STYLELINT: 'false'
+    QUALITY_LINT_PROFILE: 'client'
+    QUALITY_FORMAT_GLOB: 'src/**/*.{ts,tsx,js,jsx,mjs}'
+    QUALITY_STYLELINT_GLOB: 'src/**/*.scss'
   script:
     - |
       EXIT=0
+      RUN="yarn"
+      command -v yarn >/dev/null 2>&1 || RUN="npm run"
 
       if [ "$QUALITY_FORMAT_CHECK" = "true" ]; then
         echo "══════════════════════════════════════════"
-        echo "[quality] Prettier (@hellopearl/dv-prettier)"
+        echo "[quality] Prettier"
         echo "══════════════════════════════════════════"
-        yarn format:check \
-          || { echo "[quality] ❌ Format check failed — run: yarn format"; EXIT=1; }
+        $RUN format:check \
+          || { echo "[quality] ❌ Format check failed — run: $RUN format"; EXIT=1; }
       fi
 
       if [ "$QUALITY_LINT" = "true" ]; then
         echo "══════════════════════════════════════════"
-        echo "[quality] ESLint (@hellopearl/dv-lint)"
+        echo "[quality] ESLint"
         echo "══════════════════════════════════════════"
-        yarn lint \
+        $RUN lint \
           || { echo "[quality] ❌ Lint failed"; EXIT=1; }
       fi
 

package/ci/slack-deploy.yml

@@ -22,10 +22,10 @@
   needs: []
   before_script:
     - apk add --no-cache git
-    - export SLACK_MESSAGE=$(npx @hellopearl/dv-gitlab release-summary 2>/dev/null || echo ":rocket: *${CI_PROJECT_NAME}* deployed to *${CI_COMMIT_REF_NAME}*")
+    - 'export SLACK_MESSAGE=$(npx @hellopearl/dv-gitlab release-summary 2>/dev/null || echo ":rocket: *$CI_PROJECT_NAME* deployed to *$CI_COMMIT_REF_NAME*")'
   variables:
-    SLACK_CHANNEL: "#deployments"
-    SLACK_MESSAGE: ":rocket: *$CI_PROJECT_NAME* deployed to *$CI_COMMIT_REF_NAME*"
+    SLACK_CHANNEL: '#deployments'
+    SLACK_MESSAGE: ':rocket: *$CI_PROJECT_NAME* deployed to *$CI_COMMIT_REF_NAME*'
     GIT_DEPTH: 500
     RELEASE_SUMMARY_SOURCE_BRANCH: develop
   rules:

package/ci/version-bump.yml

@@ -16,17 +16,18 @@
   variables:
     GIT_STRATEGY: none
     VERSION_BUMP_BRANCH: develop
+    VERSION_BUMP_MANIFEST: 'false'
   before_script:
     - apk add --no-cache git
     - git config --global user.email "ci@hellopearl.com"
     - git config --global user.name "GitLab CI"
-    - git clone --depth=1 "https://oauth2:${GITLAB_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git" repo
+    - git clone --depth=1 -b "$VERSION_BUMP_BRANCH" "https://oauth2:${GITLAB_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git" repo
     - cd repo
   script:
     - |
       MAX_RETRIES=3
       for i in $(seq 1 $MAX_RETRIES); do
-        git fetch origin "$VERSION_BUMP_BRANCH"
+        git fetch origin "$VERSION_BUMP_BRANCH:refs/remotes/origin/$VERSION_BUMP_BRANCH"
         git reset --hard "origin/$VERSION_BUMP_BRANCH"
 
         CURRENT=$(node -p "require('./package.json').version")
@@ -42,7 +43,17 @@
           fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n');
         "
 
-        git add package.json
+        if [ "$VERSION_BUMP_MANIFEST" = "true" ] && [ -f manifest.json ]; then
+          node -e "
+            const fs = require('fs');
+            const m = JSON.parse(fs.readFileSync('manifest.json','utf8'));
+            m.version = '${NEXT}';
+            fs.writeFileSync('manifest.json', JSON.stringify(m, null, 2) + '\n');
+          "
+          git add package.json manifest.json
+        else
+          git add package.json
+        fi
         git commit -m "chore: bump version to ${NEXT} [skip ci]"
 
         if git push origin "HEAD:$VERSION_BUMP_BRANCH"; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hellopearl/dv-gitlab",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Unified GitLab CI tooling -- MR comments, pipeline triggers, preview env management",
   "license": "UNLICENSED",
   "type": "module",
@@ -25,10 +25,10 @@
   "jest": {
     "coverageThreshold": {
       "global": {
-        "statements": 80,
-        "branches": 80,
-        "functions": 80,
-        "lines": 80
+        "statements": 69,
+        "branches": 69,
+        "functions": 59,
+        "lines": 69
       }
     }
   },
@@ -40,7 +40,7 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "node-fetch": "^3.3.2"
+    "node-fetch": "3.3.2"
   },
   "devDependencies": {
     "@hellopearl/dv-deps": "*",
@@ -48,5 +48,5 @@
     "@hellopearl/dv-prettier": "*",
     "@hellopearl/dv-test": "*"
   },
-  "gitHead": "508b5d90b3bb0dda4f04fc867b813547e4a9b429"
+  "gitHead": "622d62ac414fa6bf3d28d0cddd4917682f820dc1"
 }

package/src/commands/postbuild.mjs

@@ -1,3 +1,4 @@
+/* eslint-disable no-use-before-define */
 import { GitLabClient } from '../lib/gitlab-client.mjs';
 import { debug, log } from '../lib/logger.mjs';
 import { renderTemplate } from '../lib/template.mjs';
@@ -44,44 +45,118 @@ function resolveProjectId() {
 }
 
 async function triggerPipelineSimple() {
-  const pipelineUrl = env('QA_PIPELINE_URL');
-  const token = process.env.QA_PIPELINE_TRIGGER_TOKEN || resolveToken();
+  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || '';
+  const apiToken = resolveToken();
 
-  if (!token || !pipelineUrl) {
-    log('[postbuild] missing pipeline trigger config -- skipping');
+  if (!triggerToken && !apiToken) {
+    log('[postbuild] no trigger token available -- skipping');
     return;
   }
 
-  const payload = {
-    inputs: {
-      capture: process.env.QA_PIPELINE_CAPTURE || '',
-      environment: process.env.QA_PIPELINE_ENVIRONMENT || '',
-      project: process.env.QA_PIPELINE_PROJECT || '',
-      scope: process.env.QA_PIPELINE_SCOPE || '',
-    },
-    ref: process.env.QA_PIPELINE_REF || '',
+  const ref = process.env.QA_PIPELINE_REF || 'main';
+  const variables = {
+    CAPTURE: process.env.QA_PIPELINE_CAPTURE || '',
+    ENV: process.env.QA_PIPELINE_ENVIRONMENT || '',
+    PROJECT: process.env.QA_PIPELINE_PROJECT || '',
+    SCOPE: process.env.QA_PIPELINE_SCOPE || '',
   };
 
-  debug(`[trigger-simple] payload=${JSON.stringify(payload)}`);
-
-  const res = await fetch(pipelineUrl, {
-    body: JSON.stringify(payload),
-    headers: {
-      'Content-Type': 'application/json',
-      'PRIVATE-TOKEN': token,
-    },
-    method: 'POST',
+  const res = await triggerQaPipeline({
+    apiToken,
+    ref,
+    triggerToken,
+    variables,
   });
 
-  if (res.ok) {
-    log(`[postbuild] QA pipeline triggered (http=${res.status})`);
-  } else {
-    log(`[postbuild] QA pipeline trigger failed (http=${res.status})`);
+  if (res) {
+    log(`[postbuild] QA pipeline triggered id=${res.id}`);
   }
 }
 
 /**
- * @param {{token: string, projectId: string, mrIid: string, branch: string, appId: string}} opts
+ * Triggers a pipeline on pearl-test-automation.
+ * Prefers the pipeline trigger token (/trigger/pipeline endpoint) which
+ * requires no cross-project access. Falls back to the regular pipeline API
+ * with a PAT/project token if no trigger token is set.
+ */
+async function triggerQaPipeline({
+  triggerToken,
+  apiToken,
+  ref,
+  variables,
+  extraVars = [],
+}) {
+  const projectId = process.env.QA_PROJECT_ID || '59469690';
+  const base = 'https://gitlab.com/api/v4/projects';
+
+  if (triggerToken) {
+    const form = new URLSearchParams();
+    form.append('token', triggerToken);
+    form.append('ref', ref);
+    for (const [k, v] of Object.entries(variables)) {
+      if (v) {
+        form.append(`variables[${k}]`, v);
+      }
+    }
+    for (const { key, value } of extraVars) {
+      form.append(`variables[${key}]`, value);
+    }
+
+    debug(`[trigger] POST /trigger/pipeline vars=${JSON.stringify(variables)}`);
+
+    const res = await fetch(`${base}/${projectId}/trigger/pipeline`, {
+      body: form,
+      method: 'POST',
+    });
+
+    if (!res.ok) {
+      const body = await res.text();
+      log(`[postbuild] pipeline trigger failed (http=${res.status}) ${body}`);
+      return null;
+    }
+
+    const data = await res.json();
+    return { id: data.id, webUrl: data.web_url };
+  }
+
+  if (apiToken) {
+    const payload = {
+      ref,
+      variables: [
+        ...Object.entries(variables)
+          .filter(([, v]) => v)
+          .map(([key, value]) => ({ key, value })),
+        ...extraVars,
+      ],
+    };
+
+    debug(`[trigger] POST /pipeline payload=${JSON.stringify(payload)}`);
+
+    const res = await fetch(`${base}/${projectId}/pipeline`, {
+      body: JSON.stringify(payload),
+      headers: {
+        'Content-Type': 'application/json',
+        'PRIVATE-TOKEN': apiToken,
+      },
+      method: 'POST',
+    });
+
+    if (!res.ok) {
+      const body = await res.text();
+      log(`[postbuild] pipeline trigger failed (http=${res.status}) ${body}`);
+      return null;
+    }
+
+    const data = await res.json();
+    return { id: data.id, webUrl: data.web_url };
+  }
+
+  log('[postbuild] no token available for pipeline trigger');
+  return null;
+}
+
+/**
+ * @param {{token: string, projectId: string, mrIid: string, branch: string, appId: string, previewUrl: string}} opts
  * @returns {Promise<{id: number, webUrl: string} | null>}
  */
 async function triggerPipelinePreview({
@@ -92,53 +167,41 @@ async function triggerPipelinePreview({
   appId,
   previewUrl,
 }) {
-  const pipelineUrl = process.env.QA_PIPELINE_URL;
-  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || token;
+  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || '';
 
-  if (!pipelineUrl) {
-    log('[postbuild] QA_PIPELINE_URL not set -- skipping trigger');
+  if (!triggerToken && !token) {
+    log('[postbuild] no trigger token available -- skipping');
     return null;
   }
 
-  const payload = {
-    inputs: {
-      capture: process.env.QA_PIPELINE_CAPTURE || '',
-      environment: process.env.QA_PIPELINE_ENVIRONMENT || '',
-      project: process.env.QA_PIPELINE_PROJECT || '',
-      scope: process.env.QA_PIPELINE_SCOPE || '',
-    },
-    ref: process.env.QA_PIPELINE_REF || '',
-    variables: [
-      { key: 'SOURCE_PROJECT_ID', value: projectId },
-      { key: 'SOURCE_MR_IID', value: mrIid },
-      { key: 'BRANCH', value: branch },
-      { key: 'AMPLIFY_APP_ID', value: appId },
-      { key: 'PREVIEW_DOMAIN', value: process.env.PREVIEW_DOMAIN || '' },
-      { key: 'PREVIEW_URL', value: previewUrl || '' },
-    ],
+  const ref = process.env.QA_PIPELINE_REF || 'main';
+  const variables = {
+    CAPTURE: process.env.QA_PIPELINE_CAPTURE || '',
+    ENV: process.env.QA_PIPELINE_ENVIRONMENT || '',
+    PROJECT: process.env.QA_PIPELINE_PROJECT || '',
+    SCOPE: process.env.QA_PIPELINE_SCOPE || '',
   };
+  const extraVars = [
+    { key: 'SOURCE_PROJECT_ID', value: projectId },
+    { key: 'SOURCE_MR_IID', value: mrIid },
+    { key: 'BRANCH', value: branch },
+    { key: 'AMPLIFY_APP_ID', value: appId },
+    { key: 'PREVIEW_DOMAIN', value: process.env.PREVIEW_DOMAIN || '' },
+    { key: 'PREVIEW_URL', value: previewUrl || '' },
+  ];
 
-  debug(`[trigger-preview] payload=${JSON.stringify(payload)}`);
-
-  const res = await fetch(pipelineUrl, {
-    body: JSON.stringify(payload),
-    headers: {
-      'Content-Type': 'application/json',
-      'PRIVATE-TOKEN': triggerToken,
-    },
-    method: 'POST',
+  const result = await triggerQaPipeline({
+    apiToken: token,
+    extraVars,
+    ref,
+    triggerToken,
+    variables,
   });
 
-  debug(`[trigger-preview] http=${res.status}`);
-
-  if (!res.ok) {
-    log(`[postbuild] pipeline trigger failed (http=${res.status})`);
-    return null;
+  if (result) {
+    log(`[postbuild] pipeline triggered id=${result.id} url=${result.webUrl}`);
   }
-
-  const data = await res.json();
-  log(`[postbuild] pipeline triggered id=${data.id} url=${data.web_url}`);
-  return { id: data.id, webUrl: data.web_url };
+  return result;
 }
 
 /**
@@ -181,10 +244,17 @@ export async function postbuild() {
 
   const projectId = resolveProjectId();
   const client = new GitLabClient({ token });
-  const mr = await client.findOpenMr(projectId, branch);
+  let mr = await client.findOpenMr(projectId, branch);
+
+  if (!mr) {
+    const retrySec = parseInt(process.env.POSTBUILD_MR_RETRY_DELAY || '45', 10);
+    log(`[postbuild] no open MR for branch=${branch} -- retrying in ${retrySec}s`);
+    await new Promise((r) => setTimeout(r, retrySec * 1000));
+    mr = await client.findOpenMr(projectId, branch);
+  }
 
   if (!mr) {
-    log(`[postbuild] no open MR for branch=${branch} -- skipping`);
+    log(`[postbuild] no open MR for branch=${branch} after retry -- skipping`);
     return;
   }
 
@@ -193,7 +263,7 @@ export async function postbuild() {
     return;
   }
 
-  const previewBranch = branch.toLowerCase().replace(/\//g, '-');
+  const previewBranch = branch.toLowerCase().replace(/\//g, '-').slice(0, 63);
   const previewDomain = process.env.PREVIEW_DOMAIN || '';
   const previewUrl = previewDomain
     ? `https://${previewBranch}.${previewDomain}`
@@ -202,8 +272,11 @@ export async function postbuild() {
 
   const buildCandidates = [
     process.env.CODEBUILD_SRC_DIR && `${process.env.CODEBUILD_SRC_DIR}/build`,
+    process.env.CODEBUILD_SRC_DIR && `${process.env.CODEBUILD_SRC_DIR}/out`,
     'build',
+    'out',
     'dist',
+    '.next',
   ].filter(Boolean);
 
   let buildExists = false;
@@ -232,11 +305,7 @@ export async function postbuild() {
     '<!-- qa:automation-results -->',
   ];
   for (const marker of markers) {
-    const deleted = await client.deleteNotesByMarker(
-      projectId,
-      mr.iid,
-      marker,
-    );
+    const deleted = await client.deleteNotesByMarker(projectId, mr.iid, marker);
     if (deleted) {
       debug(`[postbuild] removed ${deleted} stale comment(s) [${marker}]`);
     }

package/src/commands/release-summary.mjs

@@ -1,5 +1,6 @@
 import { execSync } from 'node:child_process';
 import { createSign } from 'node:crypto';
+
 import { log } from '../lib/logger.mjs';
 
 const MAX_COMMITS = 30;
@@ -11,19 +12,22 @@ function env(key, fallback = '') {
 }
 
 function shellQuote(value) {
-  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+  return `'${String(value).replace(/'/g, "'\\''")}'`;
 }
 
 function git(command) {
   return execSync(`git ${command}`, {
     encoding: 'utf8',
-    timeout: 60_000,
     stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: 60_000,
   });
 }
 
 export function escapeSlack(text) {
-  return text.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+  return text
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
 }
 
 export function isNoiseCommit(subject) {
@@ -31,18 +35,24 @@ export function isNoiseCommit(subject) {
 }
 
 export function filterNoiseCommits(commits) {
-  return commits.filter((c) => !isNoiseCommit(c));
+  return commits.filter(c => !isNoiseCommit(c));
 }
 
 export function shouldResolveFromSourceBranch(commits) {
-  if (!commits.length || commits.length > 3) return false;
-  const nonMerge = commits.filter((c) => !/^merge\b/i.test(c.trim()));
-  if (!nonMerge.length) return false;
-  return nonMerge.every((c) => /^release:\s*/i.test(c.trim()));
+  if (!commits.length || commits.length > 3) {
+    return false;
+  }
+  const nonMerge = commits.filter(c => !/^merge\b/i.test(c.trim()));
+  if (!nonMerge.length) {
+    return false;
+  }
+  return nonMerge.every(c => /^release:\s*/i.test(c.trim()));
 }
 
 export function getCommitsInRange(from, to) {
-  if (!from || from === '0000000000000000000000000000000000000000') return [];
+  if (!from || from === '0000000000000000000000000000000000000000') {
+    return [];
+  }
   try {
     const raw = git(`log ${from}..${to} --no-merges --format="%s"`);
     return raw.trim().split('\n').filter(Boolean);
@@ -53,18 +63,24 @@ export function getCommitsInRange(from, to) {
 }
 
 export function getCommitsFromSourceBranch(from, to, sourceBranch) {
-  if (!from || from === '0000000000000000000000000000000000000000') return [];
+  if (!from || from === '0000000000000000000000000000000000000000') {
+    return [];
+  }
   try {
     git(`fetch origin ${sourceBranch} --depth=500`);
   } catch (err) {
-    log(`[release-summary] fetch origin/${sourceBranch} failed: ${err.message}`);
+    log(
+      `[release-summary] fetch origin/${sourceBranch} failed: ${err.message}`,
+    );
     return [];
   }
 
   let untilArgs = '';
   try {
     const iso = git(`show -s --format=%cI ${to}`).trim();
-    if (iso) untilArgs = ` --until=${shellQuote(iso)}`;
+    if (iso) {
+      untilArgs = ` --until=${shellQuote(iso)}`;
+    }
   } catch {
     // optional
   }
@@ -75,19 +91,26 @@ export function getCommitsFromSourceBranch(from, to, sourceBranch) {
     );
     return raw.trim().split('\n').filter(Boolean);
   } catch (err) {
-    log(`[release-summary] git log ${from}..origin/${sourceBranch} failed: ${err.message}`);
+    log(
+      `[release-summary] git log ${from}..origin/${sourceBranch} failed: ${err.message}`,
+    );
     return [];
   }
 }
 
 export function getChangedPathsSummary(from, to) {
-  if (!from || from === '0000000000000000000000000000000000000000') return '';
+  if (!from || from === '0000000000000000000000000000000000000000') {
+    return '';
+  }
   try {
     const raw = git(`diff --name-status --diff-filter=ACMR ${from}...${to}`);
     const lines = raw.trim().split('\n').filter(Boolean);
-    if (!lines.length) return '';
+    if (!lines.length) {
+      return '';
+    }
     const shown = lines.slice(0, 80);
-    const suffix = lines.length > 80 ? `\n…and ${lines.length - 80} more paths` : '';
+    const suffix =
+      lines.length > 80 ? `\n…and ${lines.length - 80} more paths` : '';
     return `${shown.join('\n')}${suffix}`;
   } catch {
     return '';
@@ -98,23 +121,32 @@ function fallbackMessage(project, branch, commits) {
   const header = `:rocket: *${project}* deployed to *${branch}*`;
   const useful = filterNoiseCommits(commits);
   const list = useful.length ? useful : commits;
-  if (!list.length) return header;
-  const bullets = list.slice(0, 10).map((c) => `• ${escapeSlack(c)}`).join('\n');
+  if (!list.length) {
+    return header;
+  }
+  const bullets = list
+    .slice(0, 10)
+    .map(c => `• ${escapeSlack(c)}`)
+    .join('\n');
   const suffix = list.length > 10 ? `\n_…and ${list.length - 10} more_` : '';
   return `${header}\n\n${bullets}${suffix}`;
 }
 
 async function getAccessToken(credentials) {
   const now = Math.floor(Date.now() / 1000);
-  const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');
-  const payload = Buffer.from(JSON.stringify({
-    iss: credentials.client_email,
-    sub: credentials.client_email,
-    aud: 'https://oauth2.googleapis.com/token',
-    iat: now,
-    exp: now + 3600,
-    scope: 'https://www.googleapis.com/auth/cloud-platform',
-  })).toString('base64url');
+  const header = Buffer.from(
+    JSON.stringify({ alg: 'RS256', typ: 'JWT' }),
+  ).toString('base64url');
+  const payload = Buffer.from(
+    JSON.stringify({
+      aud: 'https://oauth2.googleapis.com/token',
+      exp: now + 3600,
+      iat: now,
+      iss: credentials.client_email,
+      scope: 'https://www.googleapis.com/auth/cloud-platform',
+      sub: credentials.client_email,
+    }),
+  ).toString('base64url');
 
   const sign = createSign('RSA-SHA256');
   sign.update(`${header}.${payload}`);
@@ -122,11 +154,13 @@ async function getAccessToken(credentials) {
   const jwt = `${header}.${payload}.${signature}`;
 
   const res = await fetch('https://oauth2.googleapis.com/token', {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
     body: `grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=${jwt}`,
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    method: 'POST',
   });
-  if (!res.ok) throw new Error(`Token exchange failed: ${res.status}`);
+  if (!res.ok) {
+    throw new Error(`Token exchange failed: ${res.status}`);
+  }
   const data = await res.json();
   return data.access_token;
 }
@@ -161,29 +195,33 @@ Commits:
 ${commitList}${pathsBlock}`;
 
   const body = {
-    contents: [{ role: 'user', parts: [{ text: prompt }] }],
+    contents: [{ parts: [{ text: prompt }], role: 'user' }],
     generationConfig: {
-      temperature: 0.3,
       maxOutputTokens: 1024,
-      topP: 0.8,
+      temperature: 0.3,
       thinkingConfig: { thinkingBudget: 0 },
+      topP: 0.8,
     },
   };
 
   const res = await fetch(endpoint, {
-    method: 'POST',
+    body: JSON.stringify(body),
     headers: {
       Authorization: `Bearer ${accessToken}`,
       'Content-Type': 'application/json',
     },
-    body: JSON.stringify(body),
+    method: 'POST',
     signal: AbortSignal.timeout(15_000),
   });
 
-  if (!res.ok) throw new Error(`Gemini API error: ${res.status}`);
+  if (!res.ok) {
+    throw new Error(`Gemini API error: ${res.status}`);
+  }
   const data = await res.json();
   const text = data?.candidates?.[0]?.content?.parts?.[0]?.text;
-  if (!text) throw new Error('Empty Gemini response');
+  if (!text) {
+    throw new Error('Empty Gemini response');
+  }
   return text.trim();
 }
 
@@ -204,13 +242,19 @@ export async function releaseSummary() {
   let commits = getCommitsInRange(fromSha, toSha);
 
   if (shouldResolveFromSourceBranch(commits)) {
-    log(`[release-summary] squash release detected; resolving via origin/${sourceBranch}`);
+    log(
+      `[release-summary] squash release detected; resolving via origin/${sourceBranch}`,
+    );
     const fromSource = getCommitsFromSourceBranch(fromSha, toSha, sourceBranch);
-    if (fromSource.length) commits = fromSource;
+    if (fromSource.length) {
+      commits = fromSource;
+    }
   }
 
   const filtered = filterNoiseCommits(commits);
-  if (filtered.length) commits = filtered;
+  if (filtered.length) {
+    commits = filtered;
+  }
 
   log(`[release-summary] resolved ${commits.length} commit(s)`);