@async/pipeline 0.9.1 → 0.9.3

package/dist/internal/node/github.js

@@ -5,20 +5,58 @@ import { dirname, join, relative, resolve } from "node:path";
 import { githubConfigForJob, pipelineError } from "../core/index.js";
 export const GITHUB_WORKFLOW_PATH = ".github/workflows/async-pipeline.yml";
 export const GITHUB_LOCK_PATH = ".github/async-pipeline.lock.json";
-const GENERATOR_VERSION = 12;
+const GENERATOR_VERSION = 14;
 const DEFAULT_NODE_VERSION = "24";
 const DEFAULT_DENO_VERSION = "2";
-const ASYNC_SETUP_ACTION = "async/actions/setup@v0";
-const ASYNC_RUN_ACTION = "async/actions/run@v0";
-const ASYNC_PAGES_ACTION = "async/actions/pages@v0";
-const ASYNC_PREVIEW_ACTION = "async/actions/preview@v0";
-const ASYNC_PUBLISH_ACTION = "async/actions/publish@v0";
-const ASYNC_DEPENDABOT_MERGE_ACTION = "async/actions/dependabot-merge@v0";
-const PNPM_SETUP_ACTION = "pnpm/setup@cf03a9b516e09bc5a90f041fc26fc930c9dc631b # v1.0.0";
-const DENO_SETUP_ACTION = "denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4";
-const SETUP_NODE_ACTION = "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6";
 const DEFAULT_PNPM_VERSION = "11.1.0";
 const DEFAULT_DENO_PIPELINE_COMMAND = "deno run -A npm:@async/pipeline/cli";
+function defineActionRef(id, uses, sha, label) {
+    return {
+        id,
+        uses,
+        sha,
+        label,
+        ref: `${uses}@${sha} # ${label}`
+    };
+}
+const ASYNC_ACTIONS_SHA = "313494352cd10207bf0331c83e83364eb45c8e02";
+const ASYNC_ACTIONS_LABEL = "v0.1.5";
+const GENERATED_ACTIONS = [
+    defineActionRef("async.actions.setup", "async/actions/setup", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("async.actions.run", "async/actions/run", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("async.actions.pages", "async/actions/pages", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("async.actions.preview", "async/actions/preview", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("async.actions.publish", "async/actions/publish", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("async.actions.dependabot-merge", "async/actions/dependabot-merge", ASYNC_ACTIONS_SHA, ASYNC_ACTIONS_LABEL),
+    defineActionRef("actions.checkout", "actions/checkout", "de0fac2e4500dabe0009e67214ff5f5447ce83dd", "v6.0.2"),
+    defineActionRef("actions.cache", "actions/cache", "0057852bfaa89a56745cba8c7296529d2fc39830", "v4"),
+    defineActionRef("pnpm.setup", "pnpm/setup", "cf03a9b516e09bc5a90f041fc26fc930c9dc631b", "v1.0.0"),
+    defineActionRef("deno.setup", "denoland/setup-deno", "667a34cdef165d8d2b2e98dde39547c9daac7282", "v2.0.4"),
+    defineActionRef("actions.setup-node", "actions/setup-node", "48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e", "v6"),
+    defineActionRef("dependabot.fetch-metadata", "dependabot/fetch-metadata", "25dd0e34f4fe68f24cc83900b1fe3fe149efef98", "v3.1.0")
+];
+const ACTION_LOCKS = GENERATED_ACTIONS.map(({ id, uses, sha, label, ref }) => ({ id, uses, sha, label, ref }))
+    .sort((left, right) => left.id.localeCompare(right.id));
+const ACTION_BY_ID = Object.fromEntries(GENERATED_ACTIONS.map((action) => [action.id, action]));
+const ASYNC_SETUP_ACTION = actionRef("async.actions.setup");
+const ASYNC_RUN_ACTION = actionRef("async.actions.run");
+const ASYNC_PAGES_ACTION = actionRef("async.actions.pages");
+const ASYNC_PREVIEW_ACTION = actionRef("async.actions.preview");
+const ASYNC_PUBLISH_ACTION = actionRef("async.actions.publish");
+const ASYNC_DEPENDABOT_MERGE_ACTION = actionRef("async.actions.dependabot-merge");
+const CHECKOUT_ACTION = actionRef("actions.checkout");
+const CACHE_ACTION = actionRef("actions.cache");
+const PNPM_SETUP_ACTION = actionRef("pnpm.setup");
+const DENO_SETUP_ACTION = actionRef("deno.setup");
+const SETUP_NODE_ACTION = actionRef("actions.setup-node");
+const DEPENDABOT_FETCH_METADATA_ACTION = actionRef("dependabot.fetch-metadata");
+function actionRef(id) {
+    const action = ACTION_BY_ID[id];
+    if (!action) {
+        throw new Error(`Missing generated GitHub action manifest entry ${id}.`);
+    }
+    return action.ref;
+}
 export async function renderGitHubWorkflow(pipeline, options) {
     const workflowPath = options.workflowPath ?? pipeline.sync.github.workflow ?? GITHUB_WORKFLOW_PATH;
     const lockPath = options.lockPath ?? pipeline.sync.github.lock ?? GITHUB_LOCK_PATH;
@@ -47,8 +85,10 @@ export async function renderGitHubWorkflow(pipeline, options) {
         dependencyCachePath: renderModel.dependencyCachePath,
         dependabotAutoMerge: renderModel.dependabotAutoMerge,
         packagePreviews: renderModel.packagePreviews,
+        bridge: renderModel.bridge,
         pages: renderModel.pages,
-        manualDispatchJobs: renderModel.manualDispatchJobs
+        manualDispatchJobs: renderModel.manualDispatchJobs,
+        actions: ACTION_LOCKS
     });
     const lock = {
         version: GENERATOR_VERSION,
@@ -57,6 +97,7 @@ export async function renderGitHubWorkflow(pipeline, options) {
         workflow: renderModel.workflowPath,
         hash,
         generatedAt: new Date().toISOString(),
+        actions: ACTION_LOCKS,
         triggers: renderModel.triggers,
         jobs: renderModel.jobs,
         packageManager: renderModel.packageManager,
@@ -71,6 +112,7 @@ export async function renderGitHubWorkflow(pipeline, options) {
         dependencyCachePath: renderModel.dependencyCachePath,
         dependabotAutoMerge: renderModel.dependabotAutoMerge,
         packagePreviews: renderModel.packagePreviews,
+        bridge: renderModel.bridge,
         pages: renderModel.pages,
         manualDispatchJobs: renderModel.manualDispatchJobs
     };
@@ -93,11 +135,19 @@ export async function checkGitHubWorkflow(result, cwd) {
     const issues = [];
     const workflowFile = resolve(cwd, result.workflowPath);
     const lockFile = resolve(cwd, result.lockPath);
+    const renderedMutableRefs = findMutableRemoteActionRefs(result.workflow);
+    if (renderedMutableRefs.length > 0) {
+        issues.push(`Generated workflow renderer produced mutable action refs: ${renderedMutableRefs.join(", ")}.`);
+    }
     if (!existsSync(workflowFile)) {
         issues.push(`Missing generated workflow ${result.workflowPath}. Run async-pipeline github generate.`);
     }
     else {
         const existingWorkflow = await readFile(workflowFile, "utf8");
+        const existingMutableRefs = findMutableRemoteActionRefs(existingWorkflow);
+        if (existingMutableRefs.length > 0) {
+            issues.push(`Generated workflow ${result.workflowPath} contains mutable action refs (${existingMutableRefs.join(", ")}). Run async-pipeline github generate.`);
+        }
         if (existingWorkflow !== result.workflow) {
             issues.push(`Generated workflow ${result.workflowPath} is stale. Run async-pipeline github generate.`);
         }
@@ -113,6 +163,22 @@ export async function checkGitHubWorkflow(result, cwd) {
     }
     return issues;
 }
+function findMutableRemoteActionRefs(workflow) {
+    const refs = new Set();
+    for (const line of workflow.split("\n")) {
+        const match = /^\s*uses:\s*([^#\s]+)/u.exec(line);
+        if (!match)
+            continue;
+        const value = (match[1] ?? "").replace(/^["']|["']$/gu, "");
+        if (value.startsWith("./") || value.startsWith("../") || value.startsWith("docker://"))
+            continue;
+        const atIndex = value.lastIndexOf("@");
+        if (atIndex < 0 || !/^[0-9a-f]{40}$/iu.test(value.slice(atIndex + 1))) {
+            refs.add(value);
+        }
+    }
+    return [...refs].sort((left, right) => left.localeCompare(right));
+}
 export async function readGitHubEventContext(env) {
     const eventName = env.ASYNC_PIPELINE_GITHUB_EVENT_NAME ?? env.GITHUB_EVENT_NAME ?? "workflow_dispatch";
     const eventPath = env.GITHUB_EVENT_PATH;
@@ -166,6 +232,7 @@ function buildRenderModel(pipeline, options) {
         addPullRequestTrigger(triggers, "pull_request");
     }
     const pages = resolveGitHubPages(pipeline);
+    const bridge = resolveGitHubBridge(pipeline);
     if (pages.enabled) {
         if (pages.triggers.pullRequest) {
             addGitHubEventTrigger(triggers, "pull_request");
@@ -174,6 +241,9 @@ function buildRenderModel(pipeline, options) {
             addPushBranchTrigger(triggers, pages.triggers.main.branch);
         }
     }
+    if (bridge.actionsJob.scheduled && bridge.schedule) {
+        addScheduleTrigger(triggers, bridge.schedule, "async-bridge");
+    }
     const manualDispatchJobs = Object.values(pipeline.jobs)
         .filter((job) => job.trigger.some((triggerId) => pipeline.triggers[triggerId]?.type === "manual"))
         .map((job) => job.id)
@@ -182,6 +252,10 @@ function buildRenderModel(pipeline, options) {
         manualDispatchJobs.push(pages.job);
         manualDispatchJobs.sort((left, right) => left.localeCompare(right));
     }
+    if (bridge.actionsJob.manual) {
+        manualDispatchJobs.push(bridge.job);
+        manualDispatchJobs.sort((left, right) => left.localeCompare(right));
+    }
     const nodeVersion = pipeline.sync.github.nodeVersion ?? DEFAULT_NODE_VERSION;
     const runtime = resolveRuntimeSpecs(pipeline.sync.github.runtime, options.projectKind, nodeVersion);
     const setup = resolveGitHubSetup(pipeline.sync.github.setup, options.packageManager, options.packageManagerVersion);
@@ -217,10 +291,31 @@ function buildRenderModel(pipeline, options) {
         dependencyCachePath: pipeline.sync.github.dependencyCache === false ? undefined : options.dependencyCachePath,
         dependabotAutoMerge: pipeline.sync.github.dependabotAutoMerge,
         packagePreviews,
+        bridge,
         pages,
         manualDispatchJobs
     };
 }
+function resolveGitHubBridge(pipeline) {
+    const config = pipeline.sync.github.bridge;
+    const actionsJobEnabled = gitHubBridgeActionsEnabled(config);
+    const scheduled = actionsJobEnabled && config.schedule !== false;
+    const manual = actionsJobEnabled;
+    return {
+        ...config,
+        job: "async-bridge",
+        actionsJob: {
+            enabled: actionsJobEnabled,
+            scheduled,
+            manual
+        }
+    };
+}
+function gitHubBridgeActionsEnabled(bridge) {
+    if (!bridge.enabled)
+        return false;
+    return bridge.mode === "actions";
+}
 function resolveGitHubPages(pipeline) {
     const config = pipeline.sync.github.pages;
     if (!config.enabled)
@@ -269,6 +364,17 @@ function addPushBranchTrigger(triggers, branch) {
         branches: [...new Set([...existingBranches, branch])].sort()
     });
 }
+function addScheduleTrigger(triggers, cron, id) {
+    const existing = Array.isArray(triggers.schedule)
+        ? triggers.schedule.filter((value) => {
+            return Boolean(value) && typeof value === "object" && typeof value.cron === "string";
+        })
+        : [];
+    if (!existing.some((schedule) => schedule.cron === cron)) {
+        existing.push({ cron, id });
+    }
+    triggers.schedule = existing.sort((left, right) => left.cron.localeCompare(right.cron));
+}
 function resolvePackagePreviews(pipeline, packageInfo) {
     const config = pipeline.sync.github.packagePreviews;
     if (!config.enabled)
@@ -360,6 +466,9 @@ function renderWorkflow(model) {
     if (model.packagePreviews.enabled) {
         renderPackagePreviewJob(lines, model);
     }
+    if (model.bridge.actionsJob.enabled) {
+        renderBridgeJob(lines, model);
+    }
     return `${lines.join("\n").replace(/\n+$/u, "")}\n`;
 }
 function renderJob(lines, model, job) {
@@ -407,10 +516,10 @@ function renderJob(lines, model, job) {
         if (pullRequests)
             lines.push(`      pull-requests: ${pullRequests}`);
     }
-    lines.push("    steps:", "      - name: Checkout", "        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2", "", ...(model.taskCache
+    lines.push("    steps:", "      - name: Checkout", `        uses: ${CHECKOUT_ACTION}`, "", ...(model.taskCache
         ? [
             "      - name: Restore task cache",
-            "        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4",
+            `        uses: ${CACHE_ACTION}`,
             "        with:",
             "          path: .async/cache",
             "          key: async-pipeline-${{ runner.os }}-${{ github.sha }}",
@@ -445,10 +554,10 @@ function renderGeneratedPagesJob(lines, model) {
     const pages = model.pages;
     if (!pages.target)
         return;
-    lines.push(`  ${yamlKey(pages.job)}:`, `    name: ${pages.job}`, `    if: ${renderGeneratedPagesCondition(pages)}`, "    runs-on: ubuntu-latest", "    steps:", "      - name: Checkout", "        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2", "", ...(model.taskCache
+    lines.push(`  ${yamlKey(pages.job)}:`, `    name: ${pages.job}`, `    if: ${renderGeneratedPagesCondition(pages)}`, "    runs-on: ubuntu-latest", "    steps:", "      - name: Checkout", `        uses: ${CHECKOUT_ACTION}`, "", ...(model.taskCache
         ? [
             "      - name: Restore task cache",
-            "        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4",
+            `        uses: ${CACHE_ACTION}`,
             "        with:",
             "          path: .async/cache",
             "          key: async-pipeline-${{ runner.os }}-${{ github.sha }}",
@@ -511,6 +620,9 @@ function appendLifecycleTaskPlan(tasks, taskId, plan, visited) {
     const task = tasks[taskId];
     if (!task)
         return false;
+    if (task.retry.attempts !== 1 || task.retry.delayMs || task.timeoutMs !== undefined) {
+        return false;
+    }
     const lifecycleSteps = task.steps.map((step) => {
         if (typeof step === "object" && step && "kind" in step && step.kind === "shell") {
             return parseLifecycleCommand(step.command);
@@ -532,24 +644,32 @@ function appendLifecycleTaskPlan(tasks, taskId, plan, visited) {
     return true;
 }
 function parseLifecycleCommand(command) {
+    if (containsUnsupportedShellSyntax(command))
+        return undefined;
     const argv = splitShellWords(command);
     const cliIndex = argv.findIndex(isPipelineCliToken);
     if (cliIndex < 0)
         return undefined;
+    if (!isAllowedCliPrefix(argv.slice(0, cliIndex)))
+        return undefined;
     const args = argv.slice(cliIndex + 1);
     const packagePath = flagValue(args, "--package") ?? ".";
     if (args[0] === "publish" && args[1] === "github" && (args[2] === "main" || args[2] === "pr")) {
+        if (!hasOnlyAllowedOptions(args, 3, new Set(["--package", "--registry", "--namespace", "--token-env-name"]), new Set(["--no-comment"])))
+            return undefined;
         return {
             kind: "preview",
             mode: args[2],
             packagePath,
             registry: flagValue(args, "--registry") ?? "https://npm.pkg.github.com",
             namespace: flagValue(args, "--namespace"),
-            comment: args[2] === "pr",
+            comment: args[2] === "pr" && !args.includes("--no-comment"),
             tokenEnv: flagValue(args, "--token-env-name") ?? "GITHUB_TOKEN"
         };
     }
     if (args[0] === "publish" && args[1] === "github" && args[2] === "release") {
+        if (!hasOnlyAllowedOptions(args, 3, new Set(["--package", "--registry", "--tag", "--dist-tag"]), new Set()))
+            return undefined;
         return {
             kind: "publish",
             mode: "github-packages",
@@ -559,6 +679,8 @@ function parseLifecycleCommand(command) {
         };
     }
     if (args[0] === "publish" && args[1] === "npm") {
+        if (!hasOnlyAllowedOptions(args, 2, new Set(["--package", "--registry", "--tag", "--dist-tag"]), new Set()))
+            return undefined;
         return {
             kind: "publish",
             mode: "npm",
@@ -568,6 +690,8 @@ function parseLifecycleCommand(command) {
         };
     }
     if (args[0] === "release" && args[1] === "ensure") {
+        if (!hasOnlyAllowedOptions(args, 2, new Set(["--package"]), new Set()))
+            return undefined;
         return {
             kind: "publish",
             mode: "github-release",
@@ -577,6 +701,8 @@ function parseLifecycleCommand(command) {
         };
     }
     if (args[0] === "release" && args[1] === "doctor") {
+        if (!hasOnlyAllowedOptions(args, 2, new Set(["--package"]), new Set()))
+            return undefined;
         return {
             kind: "publish",
             mode: "doctor",
@@ -590,7 +716,7 @@ function parseLifecycleCommand(command) {
 function renderLifecycleJobPlan(lines, model, job, plan) {
     for (const item of plan) {
         if (item.kind === "run-task") {
-            renderRunActionStep(lines, `Run pipeline task ${item.taskId}`, `${model.command} github check && ${model.command} run-task ${shellWord(item.taskId)}`, job.env, { artifactName: `async-pipeline-\${{ github.job }}-${safeArtifactPart(item.taskId)}-runs` });
+            renderRunActionStep(lines, `Run pipeline task ${item.taskId}`, `${model.command} github check && ${model.command} run-task ${shellWord(item.taskId)}`, scopeTaskRunEnv(job.env, model.tasks[item.taskId]), { artifactName: `async-pipeline-\${{ github.job }}-${safeArtifactPart(item.taskId)}-runs` });
             continue;
         }
         if (item.kind === "preview") {
@@ -602,7 +728,7 @@ function renderLifecycleJobPlan(lines, model, job, plan) {
 }
 function renderPreviewActionStep(lines, preview, env) {
     lines.push("", `      - name: Publish ${preview.mode === "main" ? "main" : "PR"} package preview`, `        uses: ${ASYNC_PREVIEW_ACTION}`, "        with:", `          package-path: ${JSON.stringify(preview.packagePath)}`, `          target-registry: ${JSON.stringify(preview.registry)}`, ...(preview.namespace ? [`          namespace: ${JSON.stringify(preview.namespace)}`] : []), `          mode: ${preview.mode}`, `          comment: ${preview.comment ? "true" : "false"}`, `          token-env-name: ${JSON.stringify(preview.tokenEnv)}`);
-    renderActionEnv(lines, env);
+    renderActionEnv(lines, scopeActionEnv(env, new Set([preview.tokenEnv])));
 }
 function renderPublishActionStep(lines, publish, env, provenance) {
     const label = publish.mode === "github-release"
@@ -612,8 +738,25 @@ function renderPublishActionStep(lines, publish, env, provenance) {
             : publish.mode === "doctor"
                 ? "Run release doctor"
                 : "Publish npm package";
-    lines.push("", `      - name: ${label}`, `        uses: ${ASYNC_PUBLISH_ACTION}`, "        with:", `          package-path: ${JSON.stringify(publish.packagePath)}`, `          mode: ${publish.mode}`, `          registry: ${JSON.stringify(publish.registry)}`, `          dist-tag: ${JSON.stringify(publish.distTag)}`, ...(publish.mode === "npm" ? [`          provenance: ${provenance ? "true" : "false"}`] : []));
-    renderActionEnv(lines, env);
+    lines.push("", `      - name: ${label}`, `        uses: ${ASYNC_PUBLISH_ACTION}`, "        with:", `          package-path: ${JSON.stringify(publish.packagePath)}`, `          mode: ${publish.mode}`, `          registry: ${JSON.stringify(publish.registry)}`, `          dist-tag: ${JSON.stringify(publish.distTag)}`, ...(publish.mode === "npm" ? ["          token-env-name: NODE_AUTH_TOKEN"] : []), ...(publish.mode === "github-packages" ? ["          token-env-name: GITHUB_TOKEN"] : []), ...(publish.mode === "npm" ? [`          provenance: ${provenance ? "true" : "false"}`] : []));
+    renderActionEnv(lines, scopeActionEnv(env, publish.mode === "npm" ? new Set(["NODE_AUTH_TOKEN"]) : new Set(["GITHUB_TOKEN"])));
+}
+function scopeActionEnv(env, allowedSecretNames) {
+    return Object.fromEntries(Object.entries(env).filter(([name, value]) => !isSecretEnvValue(value) || isAllowedSecretEnv(name, value, allowedSecretNames)));
+}
+function isSecretEnvValue(value) {
+    return typeof value === "object" && value !== null && "kind" in value && value.kind === "async-pipeline.env.secret";
+}
+function isAllowedSecretEnv(name, value, allowedSecretNames) {
+    if (allowedSecretNames.has(name))
+        return true;
+    if (typeof value === "object" && value !== null && "name" in value && typeof value.name === "string") {
+        return allowedSecretNames.has(value.name);
+    }
+    return false;
+}
+function scopeTaskRunEnv(env, task) {
+    return scopeActionEnv(env, new Set(task?.requires?.secrets ?? []));
 }
 function renderActionEnv(lines, env) {
     lines.push("        env:", "          CI: true");
@@ -627,6 +770,37 @@ function renderActionEnv(lines, env) {
 function isPipelineCliToken(token) {
     return token === "async-pipeline" || token.includes("@async/pipeline/cli");
 }
+function containsUnsupportedShellSyntax(command) {
+    return /(?:^|\s)(?:&&|\|\||;|\||&|>|<)(?:\s|$)|[`]|\$\(/u.test(command);
+}
+function isAllowedCliPrefix(prefix) {
+    const rendered = prefix.join(" ");
+    return [
+        "",
+        "pnpm",
+        "pnpm exec",
+        "npx",
+        "npm exec",
+        "npm exec --",
+        "deno run -A"
+    ].includes(rendered);
+}
+function hasOnlyAllowedOptions(args, startIndex, valueFlags, booleanFlags) {
+    for (let index = startIndex; index < args.length; index += 1) {
+        const arg = args[index];
+        if (!arg)
+            return false;
+        if (booleanFlags.has(arg))
+            continue;
+        if (!valueFlags.has(arg))
+            return false;
+        const value = args[index + 1];
+        if (!value || value.startsWith("--"))
+            return false;
+        index += 1;
+    }
+    return true;
+}
 function flagValue(args, name) {
     const index = args.indexOf(name);
     if (index < 0)
@@ -682,10 +856,10 @@ function renderPackagePreviewJob(lines, model) {
     const preview = model.packagePreviews;
     if (!preview.package || !preview.target)
         return;
-    lines.push("  package-preview:", "    name: package-preview", "    if: github.event_name == 'pull_request' && github.event.pull_request.draft == false", "    runs-on: ubuntu-latest", "    permissions:", "      contents: read", "      issues: write", "      packages: write", "      pull-requests: write", "    steps:", "      - name: Checkout", "        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2", "        with:", "          persist-credentials: false", "", ...(model.taskCache
+    lines.push("  package-preview:", "    name: package-preview", "    if: github.event_name == 'pull_request' && github.event.pull_request.draft == false", "    runs-on: ubuntu-latest", "    permissions:", "      contents: read", "      issues: write", "      packages: write", "      pull-requests: write", "    steps:", "      - name: Checkout", `        uses: ${CHECKOUT_ACTION}`, "        with:", "          persist-credentials: false", "", ...(model.taskCache
         ? [
             "      - name: Restore task cache",
-            "        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4",
+            `        uses: ${CACHE_ACTION}`,
             "        with:",
             "          path: .async/cache",
             "          key: async-pipeline-${{ runner.os }}-${{ github.sha }}",
@@ -701,8 +875,54 @@ function renderPackagePreviewJob(lines, model) {
     lines.push("", "      - name: Publish package preview", `        uses: ${ASYNC_PREVIEW_ACTION}`, "        with:", `          package-path: ${JSON.stringify(preview.package)}`, `          target-registry: ${JSON.stringify(preview.registry)}`, ...(preview.namespace ? [`          namespace: ${JSON.stringify(preview.namespace)}`] : []), "          mode: pr", `          comment: ${preview.comment ? "true" : "false"}`, `          token-env-name: ${JSON.stringify(preview.tokenEnv)}`, "        env:", "          CI: true", `          ${preview.tokenEnv}: \${{ secrets.${preview.tokenEnv} }}`, "");
     lines.push("");
 }
+function renderBridgeJob(lines, model) {
+    const bridge = model.bridge;
+    lines.push(`  ${bridge.job}:`, `    name: ${bridge.job}`, `    if: ${renderBridgeCondition(bridge)}`, "    runs-on: ubuntu-latest", "    permissions:", "      contents: write", "      pull-requests: write", "    concurrency:", "      group: async-bridge-${{ github.repository }}", "      cancel-in-progress: false", "    steps:", "      - name: Checkout", `        uses: ${CHECKOUT_ACTION}`, "        with:", "          persist-credentials: false", "", ...(model.taskCache
+        ? [
+            "      - name: Restore task cache",
+            `        uses: ${CACHE_ACTION}`,
+            "        with:",
+            "          path: .async/cache",
+            "          key: async-pipeline-${{ runner.os }}-${{ github.sha }}",
+            "          restore-keys: |",
+            "            async-pipeline-${{ runner.os }}-",
+            ""
+        ]
+        : []), ...renderSetupSteps(model), ...renderDependencyInstallSteps(model));
+    if (model.buildCommand) {
+        lines.push("", "      - name: Build pipeline CLI", `        run: ${model.buildCommand}`);
+    }
+    renderRunActionStep(lines, "Check generated workflow", `${model.command} github check`, {});
+    renderBridgePullStep(lines, bridge);
+    lines.push("");
+}
+function renderBridgeCondition(bridge) {
+    const conditions = [];
+    if (bridge.actionsJob.scheduled && bridge.schedule) {
+        conditions.push(`github.event_name == 'schedule' && github.event.schedule == '${escapeExpressionString(bridge.schedule)}'`);
+    }
+    if (bridge.actionsJob.manual) {
+        conditions.push(`github.event_name == 'workflow_dispatch' && github.event.inputs.job == '${bridge.job}'`);
+    }
+    return conditions.length > 0 ? conditions.join(" || ") : "false";
+}
+function renderBridgePullStep(lines, bridge) {
+    const command = [
+        "npx",
+        "--yes",
+        `@async/github-app@${bridge.packageVersion}`,
+        "actions",
+        "pull",
+        "--branch-prefix",
+        bridge.branchPrefix,
+        "--pull-request",
+        String(bridge.pullRequest),
+        ...bridge.allowedPaths.flatMap((path) => ["--allowed-path", path])
+    ].map(shellWord).join(" ");
+    lines.push("", "      - name: Pull and apply Async bridge change sets", `        uses: ${ASYNC_RUN_ACTION}`, "        with:", `          command: ${JSON.stringify(command)}`, "          check-generated: false", "          artifact-name: async-bridge-${{ github.run_id }}", "        env:", "          CI: true", `          ASYNC_PROJECT_URL: \${{ vars.${bridge.endpointVar} }}`, `          ASYNC_PROJECT_TOKEN: \${{ secrets.${bridge.tokenEnv} }}`, "          GITHUB_REPOSITORY: ${{ github.repository }}", "          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}");
+}
 function renderDependabotAutoMergeJob(lines, ecosystems) {
-    lines.push("  dependabot-auto-merge:", "    name: dependabot-auto-merge", "    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.draft == false", "    runs-on: ubuntu-latest", "    permissions:", "      contents: write", "      pull-requests: write", "    steps:", "      - name: Fetch Dependabot metadata", "        id: dependabot-metadata", "        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0", "        with:", "          github-token: ${{ secrets.GITHUB_TOKEN }}", "", "      - name: Merge validated Dependabot PR", `        uses: ${ASYNC_DEPENDABOT_MERGE_ACTION}`, "        with:", "          pull-request-number: ${{ github.event.pull_request.number }}", "          actor: ${{ github.event.pull_request.user.login }}", "          dependency-ecosystem: ${{ steps.dependabot-metadata.outputs.package-ecosystem }}", "          allowed-ecosystems: |", ...ecosystems.map((ecosystem) => `            ${ecosystem}`), "        env:", "          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}", "");
+    lines.push("  dependabot-auto-merge:", "    name: dependabot-auto-merge", "    if: github.event.pull_request.user.login == 'dependabot[bot]' && github.event.pull_request.draft == false", "    runs-on: ubuntu-latest", "    permissions:", "      contents: write", "      pull-requests: write", "    steps:", "      - name: Fetch Dependabot metadata", "        id: dependabot-metadata", `        uses: ${DEPENDABOT_FETCH_METADATA_ACTION}`, "        with:", "          github-token: ${{ secrets.GITHUB_TOKEN }}", "", "      - name: Merge validated Dependabot PR", `        uses: ${ASYNC_DEPENDABOT_MERGE_ACTION}`, "        with:", "          pull-request-number: ${{ github.event.pull_request.number }}", "          actor: ${{ github.event.pull_request.user.login }}", "          dependency-ecosystem: ${{ steps.dependabot-metadata.outputs.package-ecosystem }}", "          allowed-ecosystems: |", ...ecosystems.map((ecosystem) => `            ${ecosystem}`), "        env:", "          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}", "");
 }
 function renderSetupSteps(model) {
     const pnpmVersion = pnpmSetupVersion(model.packageManager, model.packageManagerVersion);