@oisincoveney/pipeline 3.21.0 → 3.22.0

package/dist/cli/factory-commands.js

@@ -0,0 +1,33 @@
+import { runCreateExperiment } from "../factory/create-experiment.js";
+import { runTemplateUpdate, summarizeTemplateUpdate } from "../factory/template-update.js";
+import { Option } from "commander";
+//#region src/cli/factory-commands.ts
+function registerFactoryCommands(program) {
+	program.command("create-experiment").description("Birth a fleet experiment: copier-stamp momokaya-template, create+push the org repo, register it in infra's fleet registry").requiredOption("--name <name>", "app name (kebab-case)").addOption(new Option("--flavor <flavor>", "app flavor").choices(["web", "expo-web"]).default("web")).option("--no-db", "skip the database surface").option("--no-previews", "skip per-PR preview environments").option("--org <org>", "GitHub org for the new repo").option("--template-src <source>", "copier template source").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo the registry entry lands in").action(async (flags) => {
+		const result = await runCreateExperiment({
+			db: flags.db,
+			flavor: flags.flavor,
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			name: flags.name,
+			...flags.org ? { org: flags.org } : {},
+			previews: flags.previews,
+			...flags.templateRef ? { templateRef: flags.templateRef } : {},
+			...flags.templateSrc ? { templateSource: flags.templateSrc } : {}
+		});
+		console.log(`Experiment born: ${result.repoUrl} (registry ${result.registryPath} @ infra ${result.infraCommitSha})`);
+	});
+	program.command("template-update").description("Fan copier-update PRs out across repos stamped from momokaya-template").option("--repos <repos>", "comma-separated repo list (skips fleet-registry discovery)").option("--org <org>", "GitHub org the stamped repos live in").option("--template-match <substring>", "answers-file _src_path filter for stamp detection").option("--template-ref <ref>", "template tag/ref (default: latest tag)").option("--infra-repo-url <url>", "infra repo used for discovery").action(async (flags) => {
+		const { results } = await runTemplateUpdate({
+			...flags.infraRepoUrl ? { infraRepoUrl: flags.infraRepoUrl } : {},
+			...flags.org ? { org: flags.org } : {},
+			...flags.repos ? { repos: flags.repos.split(",").map((repo) => repo.trim()).filter((repo) => repo.length > 0) } : {},
+			...flags.templateMatch ? { templateMatch: flags.templateMatch } : {},
+			...flags.templateRef ? { templateRef: flags.templateRef } : {}
+		});
+		const { failed, opened } = summarizeTemplateUpdate(results);
+		console.log(`template-update: ${opened} PR(s) opened, ${failed} error(s)`);
+		if (failed > 0) process.exitCode = 1;
+	});
+}
+//#endregion
+export { registerFactoryCommands };

package/dist/cli/program.js

@@ -7,6 +7,7 @@ import { registerTicketCommand } from "../commands/ticket-command.js";
 import { addMokaSubmitOptions, runMokaSubmitFromCli } from "./submit-options.js";
 import { registerRunControlCommands } from "../run-control/commands.js";
 import { registerBootstrapCommands } from "./bootstrap-commands.js";
+import { registerFactoryCommands } from "./factory-commands.js";
 import { registerLoopCommand } from "./loop-commands.js";
 import { registerMcpGatewayCommands } from "./mcp-gateway-commands.js";
 import { registerPlanCommands } from "./plan-commands.js";
@@ -34,6 +35,7 @@ function registerApplicationCommands(program, options) {
 	registerMcpGatewayCommands(program);
 	registerSubmitCommand(program);
 	registerLoopCommand(program);
+	registerFactoryCommands(program);
 	registerRunnerCommandCommand(program);
 	registerBenchCommand(program);
 	registerTicketCommand(program, {

package/dist/commands/pipeline-command.js

@@ -10,7 +10,9 @@ const BUILTIN_PIPE_COMMANDS = /* @__PURE__ */ new Set([
 	"submit",
 	"argo",
 	"runner-command",
-	"ticket"
+	"ticket",
+	"create-experiment",
+	"template-update"
 ]);
 var EntrypointCommandService = class extends Context.Service()("EntrypointCommandService") {};
 const createEntrypointCommandServiceLive = (runEntrypoint) => Layer.succeed(EntrypointCommandService, { runEntrypoint: (entrypoint, task, opts) => Effect.tryPromise({

package/dist/factory/create-experiment.js

@@ -0,0 +1,163 @@
+import { DEFAULT_RUNNER_COMMAND_GIT_COMMITTER } from "../config/schema/catalog.js";
+import { resolveFactorySeams } from "./exec.js";
+import { existsSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { copyFile, mkdir } from "node:fs/promises";
+//#region src/factory/create-experiment.ts
+/**
+* create-experiment lane (INFRA-087.12): one deterministic run births a
+* deployable fleet experiment.
+*
+*   1. headless `copier copy` stamps the app tree from momokaya-template;
+*   2. `gh repo create <org>/<name> --private` + authenticated push publish it;
+*   3. the stamped `infra-registry/config/<name>.yaml` is committed to the
+*      infra repo's fleet registry (`k8s/apps/platform-fleet/config/`), where
+*      the platform-fleet chart renders its previews ApplicationSet
+*      (`lifecycle: experiment` renders previews only, no prod Application).
+*
+* Ordered data-driven steps; each failure surfaces with the step name. No
+* automatic rollback: a partially-born experiment is reported, and retirement
+* (registry `lifecycle: retired` + repo deletion) is the documented cleanup.
+*/
+const EXPERIMENT_NAME_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+const DEFAULT_ORG = "oisin-ee";
+const DEFAULT_TEMPLATE_SOURCE = "gh:oisin-ee/momokaya-template";
+const DEFAULT_INFRA_REPO_URL = "https://github.com/oisin-ee/infra.git";
+const FLEET_REGISTRY_DIR = "k8s/apps/platform-fleet/config";
+const STAMPED_REGISTRY_DIR = "infra-registry/config";
+function buildCopierCopyArgs(options) {
+	return [
+		"copy",
+		"--trust",
+		"--defaults",
+		...options.templateRef ? ["--vcs-ref", options.templateRef] : [],
+		"--data",
+		`name=${options.name}`,
+		"--data",
+		`flavor=${options.flavor}`,
+		"--data",
+		`db=${options.db}`,
+		"--data",
+		`previews=${options.previews}`,
+		options.templateSource,
+		options.destination
+	];
+}
+function committerConfigArgs() {
+	return [
+		"-c",
+		`user.name=${DEFAULT_RUNNER_COMMAND_GIT_COMMITTER.name}`,
+		"-c",
+		`user.email=${DEFAULT_RUNNER_COMMAND_GIT_COMMITTER.email}`
+	];
+}
+async function runCreateExperiment(options) {
+	const { exec, git, log } = resolveFactorySeams(options);
+	const name = options.name;
+	if (!EXPERIMENT_NAME_PATTERN.test(name)) throw new Error(`create-experiment: name must be kebab-case (got ${JSON.stringify(name)})`);
+	const org = options.org ?? DEFAULT_ORG;
+	const flavor = options.flavor ?? "web";
+	const db = options.db ?? true;
+	const previews = options.previews ?? true;
+	const templateSource = options.templateSource ?? DEFAULT_TEMPLATE_SOURCE;
+	const infraRepoUrl = options.infraRepoUrl ?? DEFAULT_INFRA_REPO_URL;
+	const workRoot = options.workRoot ?? mkdtempSync(join(tmpdir(), "create-experiment-"));
+	const stampDir = resolve(workRoot, name);
+	const repoUrl = `https://github.com/${org}/${name}`;
+	log(`create-experiment: birthing ${org}/${name} (flavor=${flavor} db=${db} previews=${previews})`);
+	await assertRepoAbsent({
+		exec,
+		name,
+		org
+	});
+	log(`create-experiment: stamping ${templateSource} -> ${stampDir}`);
+	await exec("copier", buildCopierCopyArgs({
+		db,
+		destination: stampDir,
+		flavor,
+		name,
+		previews,
+		...options.templateRef ? { templateRef: options.templateRef } : {},
+		templateSource
+	}));
+	const stampedRegistryEntry = join(stampDir, STAMPED_REGISTRY_DIR, `${name}.yaml`);
+	if (!existsSync(stampedRegistryEntry)) throw new Error(`create-experiment: stamp is missing the registry entry ${STAMPED_REGISTRY_DIR}/${name}.yaml — template contract changed?`);
+	log("create-experiment: committing the stamped tree");
+	await git(stampDir, ["init", "--initial-branch=main"]);
+	await git(stampDir, ["add", "--all"]);
+	await git(stampDir, [
+		...committerConfigArgs(),
+		"commit",
+		"-m",
+		`feat: initial stamp from ${templateSource}`
+	]);
+	log(`create-experiment: creating ${repoUrl} (private)`);
+	await exec("gh", [
+		"repo",
+		"create",
+		`${org}/${name}`,
+		"--private"
+	]);
+	await git(stampDir, [
+		"remote",
+		"add",
+		"origin",
+		`${repoUrl}.git`
+	]);
+	await git(stampDir, [
+		"push",
+		"-u",
+		"origin",
+		"main"
+	]);
+	log(`create-experiment: registering ${name} in the fleet registry`);
+	const infraDir = resolve(workRoot, "infra");
+	await git(workRoot, [
+		"clone",
+		"--depth",
+		"1",
+		"--single-branch",
+		infraRepoUrl,
+		infraDir
+	]);
+	const registryPath = `${FLEET_REGISTRY_DIR}/${name}.yaml`;
+	await mkdir(join(infraDir, FLEET_REGISTRY_DIR), { recursive: true });
+	await copyFile(stampedRegistryEntry, join(infraDir, registryPath));
+	await git(infraDir, [
+		"add",
+		"--",
+		registryPath
+	]);
+	await git(infraDir, [
+		...committerConfigArgs(),
+		"commit",
+		"-m",
+		`feat(fleet): register experiment ${name} (create-experiment lane)`
+	]);
+	await git(infraDir, [
+		"push",
+		"origin",
+		"HEAD:main"
+	]);
+	const infraCommitSha = (await git(infraDir, ["rev-parse", "HEAD"])).trim();
+	log(`create-experiment: done — repo=${repoUrl} registry=${registryPath} infraCommit=${infraCommitSha}`);
+	return {
+		infraCommitSha,
+		registryPath,
+		repoUrl,
+		stampDir
+	};
+}
+async function assertRepoAbsent(input) {
+	const slug = `${input.org}/${input.name}`;
+	if (await input.exec("gh", [
+		"repo",
+		"view",
+		slug,
+		"--json",
+		"name"
+	]).then(() => true).catch(() => false)) throw new Error(`create-experiment: repo ${slug} already exists — pick another name or retire the old experiment first`);
+}
+//#endregion
+export { EXPERIMENT_NAME_PATTERN, buildCopierCopyArgs, committerConfigArgs, runCreateExperiment };

package/dist/factory/exec.js

@@ -0,0 +1,17 @@
+import { runAuthenticatedGit } from "../run-state/git-refs.js";
+import { execa } from "execa";
+//#region src/factory/exec.ts
+const defaultFactoryExec = (command, args, options) => execa(command, [...args], {
+	...options?.cwd ? { cwd: options.cwd } : {},
+	stdin: "ignore"
+});
+const defaultFactoryGit = (cwd, args) => runAuthenticatedGit(cwd, args);
+function resolveFactorySeams(seams = {}) {
+	return {
+		exec: seams.exec ?? defaultFactoryExec,
+		git: seams.git ?? defaultFactoryGit,
+		log: seams.log ?? ((line) => console.log(line))
+	};
+}
+//#endregion
+export { defaultFactoryExec, defaultFactoryGit, resolveFactorySeams };

package/dist/factory/stamp-answers.js

@@ -0,0 +1,28 @@
+import { parse } from "yaml";
+import { z } from "zod";
+//#region src/factory/stamp-answers.ts
+/**
+* `.copier-answers.yml` is copier's stamp receipt: `_src_path` records the
+* template a repo was generated from and `_commit` the template version.
+*
+* The org has MULTIPLE copier templates (e.g. the @oisincoveney/dev scaffold
+* also writes `.copier-answers.yml`), so the marker file alone does NOT mean
+* "momokaya-template stamp" — template-update must filter on `_src_path`
+* before fanning a `copier update` PR out to a repo.
+*/
+const copierAnswersSchema = z.object({
+	_commit: z.string().optional(),
+	_src_path: z.string().optional()
+}).passthrough();
+function parseCopierAnswers(source) {
+	const parsed = copierAnswersSchema.parse(parse(source));
+	return {
+		...parsed._commit === void 0 ? {} : { commit: parsed._commit },
+		...parsed._src_path === void 0 ? {} : { srcPath: parsed._src_path }
+	};
+}
+function isStampOf(receipt, templateMatch) {
+	return receipt.srcPath?.includes(templateMatch) ?? false;
+}
+//#endregion
+export { isStampOf, parseCopierAnswers };

package/dist/factory/template-update.js

@@ -0,0 +1,167 @@
+import { resolveFactorySeams } from "./exec.js";
+import { committerConfigArgs } from "./create-experiment.js";
+import { isStampOf, parseCopierAnswers } from "./stamp-answers.js";
+import { parse } from "yaml";
+import { z } from "zod";
+import { existsSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { basename, join, resolve } from "node:path";
+//#region src/factory/template-update.ts
+/**
+* template-update lane (INFRA-087.12): when momokaya-template ships a new tag,
+* fan `copier update` PRs out across every repo stamped from it — one PR per
+* repo, never a direct push to an app repo's default branch.
+*
+* Discovery = fleet registry entries (the infra repo's
+* `k8s/apps/platform-fleet/config/*.yaml` → `repo:`) probed for a
+* `.copier-answers.yml` whose `_src_path` matches the template (the marker
+* alone is ambiguous across the org's copier templates — see
+* stamp-answers.ts).
+*/
+const DEFAULT_ORG = "oisin-ee";
+const DEFAULT_TEMPLATE_MATCH = "momokaya-template";
+const DEFAULT_INFRA_REPO_URL = "https://github.com/oisin-ee/infra.git";
+const FLEET_REGISTRY_DIR = "k8s/apps/platform-fleet/config";
+const ANSWERS_FILE = ".copier-answers.yml";
+const registryEntryRepoSchema = z.object({ repo: z.string() }).passthrough();
+function summarizeTemplateUpdate(results) {
+	return {
+		failed: results.filter((entry) => entry.status === "error").length,
+		opened: results.filter((entry) => entry.status === "pr-opened").length
+	};
+}
+async function runTemplateUpdate(options) {
+	const seams = resolveFactorySeams(options);
+	const { log } = seams;
+	const org = options.org ?? DEFAULT_ORG;
+	const templateMatch = options.templateMatch ?? DEFAULT_TEMPLATE_MATCH;
+	const workRoot = options.workRoot ?? mkdtempSync(join(tmpdir(), "template-update-"));
+	const repos = options.repos && options.repos.length > 0 ? [...options.repos] : await discoverRegistryRepos({
+		git: seams.git,
+		infraRepoUrl: options.infraRepoUrl ?? DEFAULT_INFRA_REPO_URL,
+		workRoot
+	});
+	log(`template-update: candidates [${repos.join(", ")}]`);
+	const results = [];
+	for (const repo of repos) results.push(await updateRepo({
+		org,
+		repo,
+		seams,
+		...options.templateRef ? { templateRef: options.templateRef } : {},
+		templateMatch,
+		workRoot
+	}));
+	for (const entry of results) log(`template-update: ${entry.repo} -> ${entry.status}${entry.prUrl ? ` ${entry.prUrl}` : ""}${entry.message ? ` (${entry.message})` : ""}`);
+	return { results };
+}
+async function discoverRegistryRepos(input) {
+	const infraDir = resolve(input.workRoot, "infra-discovery");
+	await input.git(input.workRoot, [
+		"clone",
+		"--depth",
+		"1",
+		"--single-branch",
+		input.infraRepoUrl,
+		infraDir
+	]);
+	const registryDir = join(infraDir, FLEET_REGISTRY_DIR);
+	const repos = readdirSync(registryDir).filter((file) => file.endsWith(".yaml")).map((file) => {
+		return registryEntryRepoSchema.parse(parse(readFileSync(join(registryDir, file), "utf8"))).repo;
+	});
+	return [...new Set(repos)].sort((left, right) => left.localeCompare(right));
+}
+async function updateRepo(input) {
+	const { exec, git } = input.seams;
+	const { repo } = input;
+	try {
+		const cloneDir = resolve(input.workRoot, `update-${repo}`);
+		await git(input.workRoot, [
+			"clone",
+			`https://github.com/${input.org}/${repo}.git`,
+			cloneDir
+		]);
+		const answersPath = join(cloneDir, ANSWERS_FILE);
+		if (!existsSync(answersPath)) return {
+			repo,
+			status: "not-stamped"
+		};
+		const receipt = parseCopierAnswers(readFileSync(answersPath, "utf8"));
+		if (!isStampOf(receipt, input.templateMatch)) return {
+			message: `stamped from ${receipt.srcPath ?? "unknown"}, not ${input.templateMatch}`,
+			repo,
+			status: "not-stamped"
+		};
+		await git(cloneDir, [
+			"checkout",
+			"-b",
+			"template-update/pending"
+		]);
+		await exec("copier", [
+			"update",
+			"--trust",
+			"--defaults",
+			...input.templateRef ? ["--vcs-ref", input.templateRef] : []
+		], { cwd: cloneDir });
+		const status = await git(cloneDir, ["status", "--porcelain"]);
+		if (status.trim().length === 0) return {
+			repo,
+			status: "up-to-date",
+			...receipt.commit === void 0 ? {} : { version: receipt.commit }
+		};
+		const version = parseCopierAnswers(readFileSync(answersPath, "utf8")).commit ?? "unknown";
+		const branch = `chore/template-update-${version}`;
+		const rejects = listRejectFiles(cloneDir, status);
+		await git(cloneDir, [
+			"branch",
+			"-m",
+			branch
+		]);
+		await git(cloneDir, ["add", "--all"]);
+		await git(cloneDir, [
+			...committerConfigArgs(),
+			"commit",
+			"-m",
+			`chore: copier update to ${version}`
+		]);
+		await git(cloneDir, [
+			"push",
+			"-u",
+			"origin",
+			branch
+		]);
+		const prBody = [`Automated \`copier update\` to momokaya-template ${version} (template-update lane).`, ...rejects.length > 0 ? [
+			"",
+			"WARNING — conflict rejects need manual resolution:",
+			...rejects.map((file) => `- \`${file}\``)
+		] : []].join("\n");
+		const { stdout } = await exec("gh", [
+			"pr",
+			"create",
+			"--repo",
+			`${input.org}/${repo}`,
+			"--head",
+			branch,
+			"--title",
+			`chore: copier update to ${version}`,
+			"--body",
+			prBody
+		], { cwd: cloneDir });
+		return {
+			prUrl: stdout.trim(),
+			repo,
+			status: "pr-opened",
+			version
+		};
+	} catch (error) {
+		return {
+			message: error instanceof Error ? error.message : String(error),
+			repo,
+			status: "error"
+		};
+	}
+}
+function listRejectFiles(cloneDir, porcelainStatus) {
+	return porcelainStatus.split("\n").map((line) => line.slice(3).trim()).filter((file) => file.endsWith(".rej") && existsSync(join(cloneDir, file))).map((file) => basename(file));
+}
+//#endregion
+export { runTemplateUpdate, summarizeTemplateUpdate };

package/dist/factory-lane.d.ts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+
+//#region src/factory/factory-lane.d.ts
+/**
+ * Kubernetes Job manifest builder for factory lanes (create-experiment /
+ * template-update). The console front door creates these Jobs directly
+ * (batch/v1, NOT an Argo Workflow): a lane is a single deterministic `moka`
+ * subcommand with no payload repo, no schedule and no node graph, so the
+ * runner-command DAG machinery does not apply. The runner image ENTRYPOINT is
+ * `entrypoint-preflight.sh moka`; the Job overrides only the container args,
+ * so `args: ["create-experiment", ...]` runs `moka create-experiment ...`.
+ *
+ * Credential mounts replicate the runner workflow's secret storage shapes
+ * (src/remote/argo/storage.ts): the git credential store dir at
+ * /etc/pipeline/git-credentials (consumed by runAuthenticatedGit) and the gh
+ * hosts.yml at /root/.config/gh/hosts.yml.
+ */
+declare const factoryLaneJobOptionsSchema: z.ZodObject<{
+  activeDeadlineSeconds: z.ZodDefault<z.ZodNumber>;
+  argv: z.ZodArray<z.ZodString>;
+  generateName: z.ZodDefault<z.ZodString>;
+  gitCredentialsSecretName: z.ZodString;
+  githubAuthSecretName: z.ZodString;
+  image: z.ZodString;
+  imagePullPolicy: z.ZodOptional<z.ZodString>;
+  imagePullSecretName: z.ZodOptional<z.ZodString>;
+  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+  namespace: z.ZodString;
+  resources: z.ZodOptional<z.ZodObject<{
+    limits: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    requests: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  }, z.core.$strip>>;
+  serviceAccountName: z.ZodOptional<z.ZodString>;
+  ttlSecondsAfterFinished: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type FactoryLaneJobOptionsInput = z.input<typeof factoryLaneJobOptionsSchema>;
+type FactoryLaneJobOptions = z.output<typeof factoryLaneJobOptionsSchema>;
+declare const FACTORY_LANE_LABEL = "pipeline.oisin.dev/factory-lane";
+declare function buildFactoryLaneJob(input: FactoryLaneJobOptionsInput): {
+  apiVersion: string;
+  kind: string;
+  metadata: {
+    generateName: string;
+    labels: {
+      "pipeline.oisin.dev/factory-lane": string;
+    };
+    namespace: string;
+  };
+  spec: {
+    activeDeadlineSeconds: number;
+    backoffLimit: number;
+    template: {
+      metadata: {
+        labels: {
+          "pipeline.oisin.dev/factory-lane": string;
+        };
+      };
+      spec: {
+        containers: {
+          args: string[];
+          image: string;
+          imagePullPolicy?: string | undefined;
+          name: string;
+          resources?: {
+            limits?: Record<string, string> | undefined;
+            requests?: Record<string, string> | undefined;
+          } | undefined;
+          volumeMounts: ({
+            mountPath: string;
+            name: string;
+            readOnly: boolean;
+            subPath?: undefined;
+          } | {
+            mountPath: string;
+            name: string;
+            readOnly: boolean;
+            subPath: string;
+          })[];
+        }[];
+        imagePullSecrets?: {
+          name: string;
+        }[] | undefined;
+        restartPolicy: string;
+        serviceAccountName?: string | undefined;
+        volumes: ({
+          name: string;
+          secret: {
+            defaultMode: number;
+            secretName: string;
+            items?: undefined;
+          };
+        } | {
+          name: string;
+          secret: {
+            defaultMode?: undefined;
+            items: {
+              key: string;
+              path: string;
+            }[];
+            secretName: string;
+          };
+        })[];
+      };
+    };
+  };
+};
+//#endregion
+export { FACTORY_LANE_LABEL, FactoryLaneJobOptions, FactoryLaneJobOptionsInput, buildFactoryLaneJob, factoryLaneJobOptionsSchema };

package/dist/factory-lane.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+//#region src/factory/factory-lane.ts
+/**
+* Kubernetes Job manifest builder for factory lanes (create-experiment /
+* template-update). The console front door creates these Jobs directly
+* (batch/v1, NOT an Argo Workflow): a lane is a single deterministic `moka`
+* subcommand with no payload repo, no schedule and no node graph, so the
+* runner-command DAG machinery does not apply. The runner image ENTRYPOINT is
+* `entrypoint-preflight.sh moka`; the Job overrides only the container args,
+* so `args: ["create-experiment", ...]` runs `moka create-experiment ...`.
+*
+* Credential mounts replicate the runner workflow's secret storage shapes
+* (src/remote/argo/storage.ts): the git credential store dir at
+* /etc/pipeline/git-credentials (consumed by runAuthenticatedGit) and the gh
+* hosts.yml at /root/.config/gh/hosts.yml.
+*/
+const factoryLaneJobOptionsSchema = z.object({
+	activeDeadlineSeconds: z.number().int().positive().default(1800),
+	argv: z.array(z.string().min(1)).min(1),
+	generateName: z.string().min(1).default("moka-factory-"),
+	gitCredentialsSecretName: z.string().min(1),
+	githubAuthSecretName: z.string().min(1),
+	image: z.string().min(1),
+	imagePullPolicy: z.string().min(1).optional(),
+	imagePullSecretName: z.string().min(1).optional(),
+	labels: z.record(z.string(), z.string()).default({}),
+	namespace: z.string().min(1),
+	resources: z.object({
+		limits: z.record(z.string(), z.string()).optional(),
+		requests: z.record(z.string(), z.string()).optional()
+	}).optional(),
+	serviceAccountName: z.string().min(1).optional(),
+	ttlSecondsAfterFinished: z.number().int().positive().default(86400)
+});
+const FACTORY_LANE_LABEL = "pipeline.oisin.dev/factory-lane";
+function buildFactoryLaneJob(input) {
+	const options = factoryLaneJobOptionsSchema.parse(input);
+	const lane = options.argv[0] ?? "unknown";
+	return {
+		apiVersion: "batch/v1",
+		kind: "Job",
+		metadata: {
+			generateName: options.generateName,
+			labels: {
+				[FACTORY_LANE_LABEL]: lane,
+				...options.labels
+			},
+			namespace: options.namespace
+		},
+		spec: {
+			activeDeadlineSeconds: options.activeDeadlineSeconds,
+			backoffLimit: 0,
+			template: {
+				metadata: { labels: {
+					[FACTORY_LANE_LABEL]: lane,
+					...options.labels
+				} },
+				spec: {
+					containers: [{
+						args: [...options.argv],
+						image: options.image,
+						...options.imagePullPolicy ? { imagePullPolicy: options.imagePullPolicy } : {},
+						name: "lane",
+						...options.resources ? { resources: options.resources } : {},
+						volumeMounts: [{
+							mountPath: "/etc/pipeline/git-credentials",
+							name: "runner-git-credentials",
+							readOnly: true
+						}, {
+							mountPath: "/root/.config/gh/hosts.yml",
+							name: "github-auth",
+							readOnly: true,
+							subPath: "hosts.yml"
+						}]
+					}],
+					...options.imagePullSecretName ? { imagePullSecrets: [{ name: options.imagePullSecretName }] } : {},
+					restartPolicy: "Never",
+					...options.serviceAccountName ? { serviceAccountName: options.serviceAccountName } : {},
+					volumes: [{
+						name: "runner-git-credentials",
+						secret: {
+							defaultMode: 256,
+							secretName: options.gitCredentialsSecretName
+						}
+					}, {
+						name: "github-auth",
+						secret: {
+							items: [{
+								key: "hosts.yml",
+								path: "hosts.yml"
+							}],
+							secretName: options.githubAuthSecretName
+						}
+					}]
+				}
+			}
+		}
+	};
+}
+//#endregion
+export { FACTORY_LANE_LABEL, buildFactoryLaneJob, factoryLaneJobOptionsSchema };

package/package.json

@@ -81,6 +81,10 @@
       "types": "./dist/config.d.ts",
       "import": "./dist/config.js"
     },
+    "./factory-lane": {
+      "types": "./dist/factory-lane.d.ts",
+      "import": "./dist/factory-lane.js"
+    },
     "./events": {
       "types": "./dist/runner-event-schema.d.ts",
       "import": "./dist/runner-event-schema.js"
@@ -138,7 +142,7 @@
     "prepack": "nub run build:cli"
   },
   "type": "module",
-  "version": "3.21.0",
+  "version": "3.22.0",
   "description": "Config-driven multi-agent pipeline runner for repository work",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",