@oisincoveney/pipeline 3.19.6 → 3.20.0

package/dist/argo-submit.d.ts

@@ -34,6 +34,7 @@ declare const submitRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   scheduleYaml: z.ZodString;
@@ -68,6 +69,7 @@ declare const submitDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadJson: z.ZodString;
   serviceAccountName: z.ZodOptional<z.ZodString>;
   workflowId: z.ZodString;

package/dist/argo-submit.js

@@ -48,6 +48,7 @@ const submitRunnerArgoWorkflowBaseOptionShape = {
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	payloadJson: z.string().min(1),
 	serviceAccountName: z.string().min(1).optional()
 };
@@ -113,6 +114,7 @@ function submitRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		plan: compiled.plan,
 		scheduleConfigMapName: scheduleArtifactConfigMapName,
@@ -215,6 +217,7 @@ function submitDynamicRunnerArgoWorkflowEffect(rawOptions, dependencies) {
 		labels,
 		name: options.name,
 		namespace: options.namespace,
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		payloadConfigMapName,
 		serviceAccountName: options.serviceAccountName,
 		workflowId: options.workflowId

package/dist/cli/submit-options.js

@@ -12,8 +12,12 @@ function resolveOptionalSecretRef(flags, fromGlobalConfig) {
 	};
 	return fromGlobalConfig;
 }
+function resolveOptionalSecretName(flags, fromGlobalConfig) {
+	if (flags.skip) return;
+	return flags.secretName ?? fromGlobalConfig;
+}
 function addMokaSubmitOptions(command) {
-	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config"), { kubeconfig: true });
+	return addRunnerArgoOptions(command.option("--quick", "submit the compact graph").option("--command", "treat input after -- as explicit argv").option("--schedule <path>", "approved schedule YAML to submit").option("--event-url <url>", "runner event sink URL").option("--open-pr", "append an open-pull-request delivery node (preview-labelled PR)").option("--task <text>", "task description for command-mode metadata").option("--db-auth-secret-name <name>", "override momokaya.submit.dbAuth secret name").option("--db-auth-secret-key <key>", "override momokaya.submit.dbAuth secret key").option("--skip-db-auth", "omit MOKA_DB_URL injection regardless of global config").option("--mcp-gateway-auth-secret-name <name>", "override momokaya.submit.mcpGatewayAuth secret name").option("--mcp-gateway-auth-secret-key <key>", "override momokaya.submit.mcpGatewayAuth secret key").option("--skip-mcp-gateway-auth", "omit PIPELINE_MCP_GATEWAY_AUTHORIZATION injection regardless of global config").option("--npm-registry-auth-secret-name <name>", "override momokaya.submit.npmRegistryAuthSecretName").option("--skip-npm-registry-auth", "omit the /root/.npmrc mount regardless of global config"), { kubeconfig: true });
 }
 function runMokaSubmitFromCli(input, flags) {
 	const cwd = process.env.PIPELINE_TARGET_PATH ?? process.cwd();
@@ -68,6 +72,10 @@ function mokaCommonSubmitOptions(input) {
 		kubeconfigPath: input.flags.kubeconfig ?? momokaya?.kubernetes.kubeconfig,
 		name: input.flags.name,
 		namespace: input.flags.namespace ?? momokaya?.kubernetes.namespace,
+		npmRegistryAuthSecretName: resolveOptionalSecretName({
+			secretName: input.flags.npmRegistryAuthSecretName,
+			skip: input.flags.skipNpmRegistryAuth
+		}, momokaya?.submit.npmRegistryAuthSecretName),
 		serviceAccountName: input.flags.serviceAccount ?? momokaya?.submit.serviceAccountName,
 		worktreePath: input.cwd
 	};

package/dist/moka-global-config.d.ts

@@ -33,6 +33,7 @@ declare const mokaGlobalConfigSchema: z.ZodObject<{
       gitCredentialsSecretName: z.ZodString;
       githubAuthSecretName: z.ZodString;
       imagePullSecretName: z.ZodString;
+      npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
       serviceAccountName: z.ZodString;
     }, z.core.$strict>;
   }, z.core.$strict>;

package/dist/moka-global-config.js

@@ -26,6 +26,7 @@ const mokaSubmitGlobalConfigSchema = z.object({
 	gitCredentialsSecretName: z.string().min(1),
 	githubAuthSecretName: z.string().min(1),
 	imagePullSecretName: z.string().min(1),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	serviceAccountName: z.string().min(1)
 }).strict();
 const mokaKubernetesGlobalConfigSchema = z.object({

package/dist/moka-submit.d.ts

@@ -201,6 +201,7 @@ declare const mokaSubmitBaseOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -315,6 +316,7 @@ declare const mokaGraphSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -446,6 +448,7 @@ declare const mokaCommandSubmitOptionsSchema: z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -572,6 +575,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;
@@ -702,6 +706,7 @@ declare const mokaSubmitOptionsSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   kubeconfigPath: z.ZodOptional<z.ZodString>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodOptional<z.ZodString>;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   repository: z.ZodOptional<z.ZodObject<{
     baseBranch: z.ZodString;
     headBranch: z.ZodOptional<z.ZodString>;

package/dist/moka-submit.js

@@ -70,6 +70,7 @@ const mokaSubmitBaseOptionsSchema = z.object({
 	kubeconfigPath: z.string().min(1).optional(),
 	name: z.string().min(1).optional(),
 	namespace: z.string().min(1).optional(),
+	npmRegistryAuthSecretName: z.string().min(1).optional(),
 	repository: runnerRepositoryContextSchema.optional(),
 	run: runnerRunIdentitySchema.optional(),
 	serviceAccountName: z.string().min(1).optional()

package/dist/remote/argo/model.d.ts

@@ -32,6 +32,7 @@ declare const buildRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{
@@ -79,6 +80,7 @@ declare const buildDynamicRunnerArgoWorkflowOptionsSchema: z.ZodObject<{
   }, z.core.$strict>>;
   name: z.ZodOptional<z.ZodString>;
   namespace: z.ZodString;
+  npmRegistryAuthSecretName: z.ZodOptional<z.ZodString>;
   payloadConfigMapKey: z.ZodDefault<z.ZodString>;
   payloadConfigMapName: z.ZodString;
   resources: z.ZodOptional<z.ZodObject<{

package/dist/remote/argo/model.js

@@ -198,6 +198,7 @@ const runnerArgoWorkflowBaseOptionsSchema = z.object({
 	mcpGatewayAuth: mcpGatewayAuthOptionSchema.optional(),
 	name: z.string().min(1).optional(),
 	namespace: kubernetesNameSchema,
+	npmRegistryAuthSecretName: kubernetesNameSchema.optional(),
 	payloadConfigMapKey: z.string().min(1).default("payload.json"),
 	payloadConfigMapName: kubernetesNameSchema,
 	resources: argoWorkflowResourceRequirementsSchema.optional(),

package/dist/remote/argo/storage.js

@@ -32,9 +32,7 @@ function runnerWorkflowStorage(options, tasks) {
 		readOnly: true,
 		subPath: "schedule.yaml"
 	}];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
@@ -43,14 +41,18 @@ function runnerWorkflowStorage(options, tasks) {
 function dynamicRunnerWorkflowStorage(options) {
 	const volumes = [runnerPayloadVolume(options)];
 	const volumeMounts = [runnerPayloadVolumeMount()];
-	appendEventAuthStorage(options, volumes, volumeMounts);
-	appendGitCredentialsStorage(options, volumes, volumeMounts);
-	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendSharedSecretStorage(options, volumes, volumeMounts);
 	return {
 		volumeMounts: z.array(argoWorkflowVolumeMountSchema).parse(volumeMounts),
 		volumes: z.array(argoWorkflowVolumeSchema).parse(volumes)
 	};
 }
+function appendSharedSecretStorage(options, volumes, volumeMounts) {
+	appendEventAuthStorage(options, volumes, volumeMounts);
+	appendGitCredentialsStorage(options, volumes, volumeMounts);
+	appendGithubAuthStorage(options, volumes, volumeMounts);
+	appendNpmRegistryAuthStorage(options, volumes, volumeMounts);
+}
 function runnerPayloadVolume(options) {
 	return {
 		configMap: {
@@ -123,5 +125,24 @@ function appendGithubAuthStorage(options, volumes, volumeMounts) {
 		subPath: "hosts.yml"
 	});
 }
+function appendNpmRegistryAuthStorage(options, volumes, volumeMounts) {
+	if (!options.npmRegistryAuthSecretName) return;
+	volumes.push({
+		name: "npm-registry-auth",
+		secret: {
+			items: [{
+				key: "npmrc",
+				path: "npmrc"
+			}],
+			secretName: options.npmRegistryAuthSecretName
+		}
+	});
+	volumeMounts.push({
+		mountPath: "/root/.npmrc",
+		name: "npm-registry-auth",
+		readOnly: true,
+		subPath: "npmrc"
+	});
+}
 //#endregion
 export { dynamicRunnerWorkflowStorage, runnerWorkflowStorage };

package/dist/remote/submit/argo-submission.d.ts

@@ -26,6 +26,7 @@ interface MokaWorkflowSubmitOptions {
   };
   name?: string;
   namespace: string;
+  npmRegistryAuthSecretName?: string;
   payloadJson: string;
   scheduleYaml?: string;
   serviceAccountName?: string;

package/dist/remote/submit/argo-submission.js

@@ -54,6 +54,7 @@ function workflowSubmitOptions(options) {
 		kubeconfigPath: options.kubeconfigPath,
 		name: options.name,
 		namespace: requireSubmitOption(options.namespace, "namespace"),
+		npmRegistryAuthSecretName: options.npmRegistryAuthSecretName,
 		serviceAccountName: options.serviceAccountName
 	};
 }

package/docs/operator-guide.md

@@ -236,6 +236,7 @@ momokaya:
     gitCredentialsSecretName: <git-credentials-secret-name>
     githubAuthSecretName: <github-auth-secret-name>
     imagePullSecretName: <image-pull-secret-name>
+    npmRegistryAuthSecretName: <npm-registry-auth-secret-name>  # optional
     brokerAuth:
       secretName: <broker-api-key-secret-name>
       secretKey: api-key
@@ -334,6 +335,12 @@ Expected namespace resources:
 - The GitHub CLI auth Secret named by `submit.githubAuthSecretName` with key
   `hosts.yml`; this Secret is for `gh` and pull request delivery, not git
   clone/fetch/push authentication
+- Optional: the private-registry auth Secret named by
+  `submit.npmRegistryAuthSecretName` with key `npmrc`, mounted at
+  `/root/.npmrc`; lets `.moka/bootstrap.sh`'s dependency install step (e.g.
+  `nub ci`) authenticate to private-scoped package registries, e.g. GitHub
+  Packages. Absent by default — bootstrap then only has public-registry
+  access, matching current behavior
 - A pipeline-console event sink reachable from the pod
 
 Credential issuance and rotation are owned by the cluster/infra layer, not by

package/package.json

@@ -130,6 +130,7 @@
     "test:image": "mkdir -p /tmp/pipeline-test && printf '{}' > /tmp/pipeline-test/payload.json && printf 'kind: pipeline-schedule\\nversion: 1\\nschedule_id: smoke\\ngenerated_at: 2026-06-10T00:00:00.000Z\\nsource_entrypoint: custom\\ntask: smoke\\nroot_workflow: root\\nworkflows:\\n  root:\\n    nodes:\\n      - id: smoke\\n        kind: command\\n        command: [true]\\n' > /tmp/pipeline-test/schedule.yaml && printf '{\"nodeId\":\"smoke\"}' > /tmp/pipeline-test/task.json && printf 'test-token' > /tmp/pipeline-test/event-token && docker build -t pipeline-runner:test . && docker run --rm -v /tmp/pipeline-test/payload.json:/etc/pipeline/payload.json:ro -v /tmp/pipeline-test/schedule.yaml:/etc/pipeline/schedule.yaml:ro -v /tmp/pipeline-test/task.json:/etc/pipeline/task.json:ro -v /tmp/pipeline-test/event-token:/etc/pipeline/event-auth/token:ro pipeline-runner:test runner-command --payload-file /etc/pipeline/payload.json --schedule-file /etc/pipeline/schedule.yaml; test $? -eq 64",
     "test:dogfood": "vitest run tests/dogfood-installed.test.ts",
     "test:live-runners": "PIPELINE_LIVE_RUNNERS=1 vitest run tests/dogfood-live-runners.test.ts",
+    "local-orbstack:migrate": "nub scripts/local-orbstack/migrate-postgres.ts",
     "typecheck": "tsc --noEmit",
     "build": "nub run build:cli",
     "check": "ultracite check",
@@ -137,7 +138,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.19.6",
+  "version": "3.20.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",