@avi2dg/checks 0.67.0 → 0.68.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.68.0
+
+Released 2026-11-06.
+
+### Features
+
+- **ci-wiring:** accept short shared refs for runner pick and setup [#49](https://github.com/avi2d/checks/pull/49)
+
 ## 0.67.0
 
 Released 2026-11-06.

package/docs/gates/checks-ci-wiring.md

@@ -69,7 +69,8 @@ A job on `push` or another trigger no fork reaches may still name self-hosted la
 In a private repository each mutation job carries exactly the labels the consumer declares in `package.json` under `checks.mutationRunner`.
 Every other job there carries exactly the hosted-default expression, or exactly one of the label sets the consumer declares under `checks.selfHostedRunners`.
 A job there also carries `runs-on: ${{ needs.<job>.outputs.runs-on }}` when the same workflow needs that job and that job calls the runner pick.
-The pick is the repository file `runner.yml` under `.github/workflows/` or `avi2d/workflows/.github/workflows/runner.yml` at a pinned full SHA.
+The pick is the repository file `runner.yml` under `.github/workflows/` or `avi2d/workflows/.github/workflows/runner.yml` at a full SHA or at a version tag, `v<major>` or `v<major>.<minor>.<patch>`.
+A branch name or a missing ref is not the pick.
 A public repository still refuses that expression on a job a fork can reach.
 The resolved label cannot be shown to be a hosted runner before the run.
 A repository without those declarations fails each job they would pin until it declares them.
@@ -94,7 +95,7 @@ The fleet version is the version the kit ships in its own `.bun-version`.
 The step fails the check when the version is missing or differs from the fleet bun version.
 A range fails because it differs from the fleet version.
 A version built from an expression fails because it cannot be shown equal before the run.
-A step that uses `avi2d/workflows/actions/setup` reads `.bun-version`.
+A step that uses `avi2d/workflows/setup` or `avi2d/workflows/actions/setup`, at any ref or none, reads `.bun-version`.
 The step fails the check when `.bun-version` is missing or differs from the fleet bun version.
 This rule skips a repository with no setup-bun step and no shared setup step.
 A kit release that moves the fleet version turns each consumer red until its pin follows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",

package/src/delivery/bun-pin.ts

@@ -17,7 +17,7 @@ export type BunPinFault = {
 
 const SETUP_BUN = /^oven-sh\/setup-bun(?:@(?<ref>.*))?$/i;
 const V2_REF = /^v2(?:\.\d+){0,2}$/;
-const SHARED_SETUP = /^avi2d\/workflows\/actions\/setup(?:@(?<ref>.*))?$/i;
+const SHARED_SETUP = /^avi2d\/workflows\/(?:actions\/)?setup(?:@.*)?$/i;
 const SETUP_VERSION_FILE = ".bun-version";
 
 function setupBunRef(uses: unknown): string | undefined {
@@ -25,9 +25,9 @@ function setupBunRef(uses: unknown): string | undefined {
   return match === null ? undefined : (match.groups?.["ref"] ?? "");
 }
 
-function sharedSetupRef(uses: unknown): string | undefined {
-  const match = typeof uses === "string" ? SHARED_SETUP.exec(uses.trim()) : null;
-  return match === null ? undefined : (match.groups?.["ref"] ?? "");
+function sharedSetupUses(uses: unknown): string | undefined {
+  const text = typeof uses === "string" ? uses.trim() : "";
+  return SHARED_SETUP.test(text) ? text : undefined;
 }
 
 function isExpression(value: string): boolean {
@@ -113,9 +113,8 @@ function unknownRefFault(ref: string): string {
   return `uses oven-sh/setup-bun at ${ref === "" ? "no ref" : ref}, but the check knows only setup-bun v2's version resolution, so the step must use oven-sh/setup-bun@v2`;
 }
 
-function sharedSetupFault(policy: BunPinPolicy, ref: string): string | undefined {
+function sharedSetupFault(policy: BunPinPolicy, uses: string): string | undefined {
   const version = nonEmpty(policy.files.get(SETUP_VERSION_FILE));
-  const uses = ref === "" ? "avi2d/workflows/actions/setup" : `avi2d/workflows/actions/setup@${ref}`;
   if (version === undefined) {
     return `uses ${uses}, which reads ${SETUP_VERSION_FILE}, but the repository holds no ${SETUP_VERSION_FILE} file, want ${policy.fleet}`;
   }
@@ -137,9 +136,9 @@ export function findBunPinFaults(policy: BunPinPolicy, workflows: readonly Workf
           const fault = V2_REF.test(ref) ? bunPinFault(policy, step) : unknownRefFault(ref);
           return fault === undefined ? [] : atStep(fault);
         }
-        const sharedRef = sharedSetupRef(step["uses"]);
-        if (sharedRef === undefined) return [];
-        const fault = sharedSetupFault(policy, sharedRef);
+        const sharedUses = sharedSetupUses(step["uses"]);
+        if (sharedUses === undefined) return [];
+        const fault = sharedSetupFault(policy, sharedUses);
         return fault === undefined ? [] : atStep(fault);
       });
     });
@@ -165,7 +164,7 @@ function versionFileKeys(job: Readonly<Record<string, unknown>>): readonly strin
 
 function usesSharedSetup(job: Readonly<Record<string, unknown>>): boolean {
   const steps = Array.isArray(job["steps"]) ? job["steps"] : [];
-  return steps.some((step) => isRecord(step) && sharedSetupRef(step["uses"]) !== undefined);
+  return steps.some((step) => isRecord(step) && sharedSetupUses(step["uses"]) !== undefined);
 }
 
 function wantedBunPinFiles(workflows: readonly Workflow[]): ReadonlySet<string> {

package/src/delivery/runner-pick.ts

@@ -1,7 +1,7 @@
 import { names, type Workflow } from "./workflow-references.ts";
 
 const NEEDS_RUNS_ON = /^\$\{\{\s*needs\.([\w-]+)\.outputs\.runs-on\s*\}\}$/i;
-const SHARED_RUNNER = /^avi2d\/workflows\/\.github\/workflows\/runner\.yml@[0-9a-f]{40}$/i;
+const SHARED_RUNNER = /^[Aa][Vv][Ii]2[Dd]\/[Ww][Oo][Rr][Kk][Ff][Ll][Oo][Ww][Ss]\/\.github\/workflows\/runner\.yml@(?:[0-9a-fA-F]{40}|v\d+(?:\.\d+\.\d+)?)$/;
 const LOCAL_RUNNER = ".github/workflows/runner.yml";
 
 function callsRunnerPick(uses: unknown, workflows: readonly Workflow[]): boolean {