@codyswann/lisa 4.42.1 → 4.42.3

package/dist/migrations/ensure-nightly-e2e-workflow-pins.d.ts

@@ -1,18 +1,18 @@
 import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
 /** Read the installed Lisa package version. */
 type VersionReader = () => string;
-/** Read the release tag stamped into the installed package. */
-type ReleaseTagReader = () => string | null;
 /**
- * Keep an installed nightly E2E caller pinned at the installed Lisa release tag,
- * and keep its bypass gate armed against body-evidence deletion.
+ * Keep an installed nightly E2E caller's bypass gate armed against
+ * body-evidence deletion, and its explanatory version comments current.
  *
- * The tag, never the release commit: the commit the package was built from is
- * not guaranteed to survive, and a caller pinned at an orphaned commit stops
- * loading silently rather than failing.
+ * This used to rewrite the caller's `uses:` ref as well. It no longer does:
+ * `ensure-pinned-reusable-workflow-refs` pins EVERY Lisa reusable caller,
+ * these two included, at the commit the installed version's tag names. Two
+ * migrations rewriting the same line would each undo the other on every apply
+ * — content-stable, endlessly "applied", and pinned at whichever ran last.
  *
- * The second job is here rather than in the template because of where the file
- * lives. The caller ships from `create-only` and is marked "this file is YOURS
+ * The remaining job is here rather than in the template because of where the
+ * file lives. The caller ships from `create-only` and is marked "this file is YOURS
  * — Lisa will not overwrite it", so a template fix reaches new adoptions only
  * and every already-seeded repository keeps its original trigger list forever.
  * The reusable workflow cannot carry the fix either: it is `on: workflow_call`,
@@ -21,49 +21,28 @@ type ReleaseTagReader = () => string | null;
  */
 export declare class EnsureNightlyE2EWorkflowPinsMigration implements Migration {
     private readonly readLisaVersion;
-    private readonly readReleaseTag;
     readonly name = "ensure-nightly-e2e-workflow-pins";
-    readonly description = "Align nightly E2E reusable-workflow pins with installed Lisa and keep the bypass gate armed against body-evidence deletion";
+    readonly description = "Keep the nightly E2E bypass gate armed against body-evidence deletion and its version comments current";
     /**
      * Create the migration.
      *
      * @param readLisaVersion - Version reader, injectable for deterministic tests
-     * @param readReleaseTag - Published release tag reader
      */
-    constructor(readLisaVersion?: VersionReader, readReleaseTag?: ReleaseTagReader);
+    constructor(readLisaVersion?: VersionReader);
     /**
-     * Decide whether an Expo caller still points at another Lisa release.
+     * Decide whether an installed Expo caller still needs arming or refreshing.
      *
      * @param ctx - Migration context
      * @returns True when one supported caller needs a safe literal update
      */
     applies(ctx: MigrationContext): Promise<boolean>;
     /**
-     * Update Lisa's literal release caller pins and their matching comment.
-     *
-     * A host that deliberately uses a branch or different workflow path is left
-     * untouched because Lisa cannot infer that host's release policy. A caller
-     * already pinned at a bare SHA is rewritten to the tag: that pin is the
-     * defect, and rewriting it is the only repair a consumer gets, because this
-     * runs from postinstall and would otherwise re-stamp the SHA over any
-     * hand repin.
+     * Arm the bypass gate and refresh the caller's explanatory version comments.
      *
      * @param ctx - Migration context
      * @returns Applied or no-op result
      */
     apply(ctx: MigrationContext): Promise<MigrationResult>;
-    /**
-     * Resolve the one ref this migration is allowed to pin a caller at.
-     *
-     * A stamped value is honoured only when it is a release tag. The published
-     * package used to stamp its build commit here, and that commit is exactly
-     * what a history rewrite orphans, so a value of any other shape — a bare
-     * SHA above all — is refused in favour of the installed version's tag.
-     *
-     * @param lisaVersion - Installed Lisa version
-     * @returns Release tag ref to pin every supported caller at
-     */
-    private resolveReleaseRef;
     /**
      * Read the contract version shipped into the destination project.
      *
@@ -72,12 +51,13 @@ export declare class EnsureNightlyE2EWorkflowPinsMigration implements Migration
      */
     private readContractVersion;
     /**
-     * Update a supported caller without touching host-selected branch refs.
+     * Arm the bypass gate and refresh the caller's explanatory version comments.
+     *
+     * The `uses:` ref is deliberately not touched here — see the class note.
      *
      * @param source - Workflow source
      * @param file - Supported workflow filename
      * @param lisaVersion - Installed Lisa version
-     * @param releaseRef - Release tag ref every supported caller is pinned at
      * @param contractVersion - Guard contract version, when available
      * @returns Updated or original workflow source
      */

package/dist/migrations/ensure-nightly-e2e-workflow-pins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-nightly-e2e-workflow-pins.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-nightly-e2e-workflow-pins.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAwBlC,+CAA+C;AAC/C,KAAK,aAAa,GAAG,MAAM,MAAM,CAAC;AAClC,+DAA+D;AAC/D,KAAK,gBAAgB,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC;AAE5C;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,qCAAsC,YAAW,SAAS;IAYnE,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAZjC,QAAQ,CAAC,IAAI,sCAAsC;IACnD,QAAQ,CAAC,WAAW,gIAC2G;IAE/H;;;;;OAKG;gBAEgB,eAAe,GAAE,aAAiC,EAClD,cAAc,GAAE,gBAAuC;IAG1E;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAyBtD;;;;;;;;;;;;OAYG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAyC5D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB;IAOzB;;;;;OAKG;YACW,mBAAmB;IAQjC;;;;;;;;;OASG;IACH,OAAO,CAAC,YAAY;CAoCrB"}
+{"version":3,"file":"ensure-nightly-e2e-workflow-pins.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-nightly-e2e-workflow-pins.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAWlC,+CAA+C;AAC/C,KAAK,aAAa,GAAG,MAAM,MAAM,CAAC;AAElC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,qCAAsC,YAAW,SAAS;IAcnE,OAAO,CAAC,QAAQ,CAAC,eAAe;IAVlC,QAAQ,CAAC,IAAI,sCAAsC;IACnD,QAAQ,CAAC,WAAW,4GACuF;IAE3G;;;;OAIG;gBAEgB,eAAe,GAAE,aAAiC;IAGrE;;;;;OAKG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtD;;;;;OAKG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAuC5D;;;;;OAKG;YACW,mBAAmB;IAQjC;;;;;;;;;;OAUG;IACH,OAAO,CAAC,YAAY;CAuBrB"}

package/dist/migrations/ensure-nightly-e2e-workflow-pins.js

@@ -1,7 +1,7 @@
 import { readFile, writeFile } from "node:fs/promises";
 import * as path from "node:path";
 import * as fse from "fs-extra";
-import { getPackageReleaseTag, getPackageVersion } from "../cli/version.js";
+import { getPackageVersion } from "../cli/version.js";
 import { ensureBodyChangeTrigger } from "../core/nightly-e2e-pull-request-triggers.js";
 const WORKFLOW_DIR = path.join(".github", "workflows");
 const WORKFLOW_FILES = [
@@ -11,27 +11,17 @@ const WORKFLOW_FILES = [
 const CONTRACT_SCRIPT = path.join("scripts", "check-nightly-e2e-health.mjs");
 const CONTRACT_PATTERN = /NIGHTLY_E2E_CONTRACT_VERSION\s*=\s*["'](\d+\.\d+\.\d+)["']/;
 /**
- * The only pin spelling this migration will write: a release tag ref.
+ * Keep an installed nightly E2E caller's bypass gate armed against
+ * body-evidence deletion, and its explanatory version comments current.
  *
- * Deliberately excludes a bare commit SHA. A commit is not durable — a history
- * rewrite orphans it while leaving the object present, and a caller pinned at
- * an orphaned SHA does not go red: the workflow never loads, so the run
- * produces zero jobs and therefore zero failures. Checking that a pin is
- * PRESENT and well formed cannot see that, because an orphaned pin is both.
- * Anything that does not match this pattern is discarded in favour of the
- * installed version's tag.
- */
-const RELEASE_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
-/**
- * Keep an installed nightly E2E caller pinned at the installed Lisa release tag,
- * and keep its bypass gate armed against body-evidence deletion.
- *
- * The tag, never the release commit: the commit the package was built from is
- * not guaranteed to survive, and a caller pinned at an orphaned commit stops
- * loading silently rather than failing.
+ * This used to rewrite the caller's `uses:` ref as well. It no longer does:
+ * `ensure-pinned-reusable-workflow-refs` pins EVERY Lisa reusable caller,
+ * these two included, at the commit the installed version's tag names. Two
+ * migrations rewriting the same line would each undo the other on every apply
+ * — content-stable, endlessly "applied", and pinned at whichever ran last.
  *
- * The second job is here rather than in the template because of where the file
- * lives. The caller ships from `create-only` and is marked "this file is YOURS
+ * The remaining job is here rather than in the template because of where the
+ * file lives. The caller ships from `create-only` and is marked "this file is YOURS
  * — Lisa will not overwrite it", so a template fix reaches new adoptions only
  * and every already-seeded repository keeps its original trigger list forever.
  * The reusable workflow cannot carry the fix either: it is `on: workflow_call`,
@@ -40,21 +30,21 @@ const RELEASE_TAG_PATTERN = /^v\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
  */
 export class EnsureNightlyE2EWorkflowPinsMigration {
     readLisaVersion;
-    readReleaseTag;
+    // The name outlived the pin arm. It is kept because it is the identity the
+    // migration registry, its tests, and any apply receipt already record — a
+    // rename would be a bigger change than the one that emptied it of meaning.
     name = "ensure-nightly-e2e-workflow-pins";
-    description = "Align nightly E2E reusable-workflow pins with installed Lisa and keep the bypass gate armed against body-evidence deletion";
+    description = "Keep the nightly E2E bypass gate armed against body-evidence deletion and its version comments current";
     /**
      * Create the migration.
      *
      * @param readLisaVersion - Version reader, injectable for deterministic tests
-     * @param readReleaseTag - Published release tag reader
      */
-    constructor(readLisaVersion = getPackageVersion, readReleaseTag = getPackageReleaseTag) {
+    constructor(readLisaVersion = getPackageVersion) {
         this.readLisaVersion = readLisaVersion;
-        this.readReleaseTag = readReleaseTag;
     }
     /**
-     * Decide whether an Expo caller still points at another Lisa release.
+     * Decide whether an installed Expo caller still needs arming or refreshing.
      *
      * @param ctx - Migration context
      * @returns True when one supported caller needs a safe literal update
@@ -64,34 +54,25 @@ export class EnsureNightlyE2EWorkflowPinsMigration {
             return false;
         const contractVersion = await this.readContractVersion(ctx.projectDir);
         const lisaVersion = this.readLisaVersion();
-        const releaseRef = this.resolveReleaseRef(lisaVersion);
         for (const file of WORKFLOW_FILES) {
             const absolute = path.join(ctx.projectDir, WORKFLOW_DIR, file);
             if (!(await fse.pathExists(absolute)))
                 continue;
             const source = await readFile(absolute, "utf8");
-            if (this.updateSource(source, file, lisaVersion, releaseRef, contractVersion) !== source) {
+            if (this.updateSource(source, file, lisaVersion, contractVersion) !== source) {
                 return true;
             }
         }
         return false;
     }
     /**
-     * Update Lisa's literal release caller pins and their matching comment.
-     *
-     * A host that deliberately uses a branch or different workflow path is left
-     * untouched because Lisa cannot infer that host's release policy. A caller
-     * already pinned at a bare SHA is rewritten to the tag: that pin is the
-     * defect, and rewriting it is the only repair a consumer gets, because this
-     * runs from postinstall and would otherwise re-stamp the SHA over any
-     * hand repin.
+     * Arm the bypass gate and refresh the caller's explanatory version comments.
      *
      * @param ctx - Migration context
      * @returns Applied or no-op result
      */
     async apply(ctx) {
         const lisaVersion = this.readLisaVersion();
-        const releaseRef = this.resolveReleaseRef(lisaVersion);
         const contractVersion = await this.readContractVersion(ctx.projectDir);
         const changedFiles = [];
         const updates = [];
@@ -101,7 +82,7 @@ export class EnsureNightlyE2EWorkflowPinsMigration {
             if (!(await fse.pathExists(absolute)))
                 continue;
             const before = await readFile(absolute, "utf8");
-            const after = this.updateSource(before, file, lisaVersion, releaseRef, contractVersion);
+            const after = this.updateSource(before, file, lisaVersion, contractVersion);
             if (after === before)
                 continue;
             changedFiles.push(relative);
@@ -121,23 +102,6 @@ export class EnsureNightlyE2EWorkflowPinsMigration {
         ctx.logger.success(message);
         return { name: this.name, action: "applied", changedFiles, message };
     }
-    /**
-     * Resolve the one ref this migration is allowed to pin a caller at.
-     *
-     * A stamped value is honoured only when it is a release tag. The published
-     * package used to stamp its build commit here, and that commit is exactly
-     * what a history rewrite orphans, so a value of any other shape — a bare
-     * SHA above all — is refused in favour of the installed version's tag.
-     *
-     * @param lisaVersion - Installed Lisa version
-     * @returns Release tag ref to pin every supported caller at
-     */
-    resolveReleaseRef(lisaVersion) {
-        const stamped = this.readReleaseTag();
-        return stamped !== null && RELEASE_TAG_PATTERN.test(stamped)
-            ? stamped
-            : `v${lisaVersion}`;
-    }
     /**
      * Read the contract version shipped into the destination project.
      *
@@ -151,34 +115,27 @@ export class EnsureNightlyE2EWorkflowPinsMigration {
         return CONTRACT_PATTERN.exec(await readFile(file, "utf8"))?.[1] ?? null;
     }
     /**
-     * Update a supported caller without touching host-selected branch refs.
+     * Arm the bypass gate and refresh the caller's explanatory version comments.
+     *
+     * The `uses:` ref is deliberately not touched here — see the class note.
      *
      * @param source - Workflow source
      * @param file - Supported workflow filename
      * @param lisaVersion - Installed Lisa version
-     * @param releaseRef - Release tag ref every supported caller is pinned at
      * @param contractVersion - Guard contract version, when available
      * @returns Updated or original workflow source
      */
-    updateSource(source, file, lisaVersion, releaseRef, contractVersion) {
-        const reusable = file.replace(/\.yml$/, "");
-        const pinPattern = new RegExp(`(uses:\\s*CodySwannGT/lisa/\\.github/workflows/${reusable}\\.yml@)(?:v\\d+\\.\\d+\\.\\d+|[0-9a-f]{40})`, "g");
-        const pinUpdated = source.replace(pinPattern, `$1${releaseRef}`);
-        const pinChanged = pinUpdated !== source;
-        if (file === "nightly-e2e-health.yml") {
-            // Arm the gate against body-evidence deletion BEFORE the pin edits, and
-            // unconditionally — not only when the pin changed. A consumer already on
-            // the current release has nothing to repin and would otherwise never
-            // receive this, which is the entire installed base a month from now.
-            const armed = ensureBodyChangeTrigger(pinUpdated);
-            if (!pinChanged)
-                return armed;
-            const commentUpdated = armed.replace(/# v\d+\.\d+\.\d+ matches this repo's own installed Lisa/, `# v${lisaVersion} matches this repo's own installed Lisa`);
-            return contractVersion
-                ? commentUpdated.replace(/# the guard reports contract \d+\.\d+\.\d+ and the reusable asserts its MAJOR/, `# the guard reports contract ${contractVersion} and the reusable asserts its MAJOR`)
-                : commentUpdated;
-        }
-        return pinUpdated;
+    updateSource(source, file, lisaVersion, contractVersion) {
+        if (file !== "nightly-e2e-health.yml")
+            return source;
+        // Armed BEFORE the comment edits, and unconditionally. A consumer whose
+        // comments are already current has nothing to refresh and would otherwise
+        // never receive this, which is the entire installed base a month from now.
+        const armed = ensureBodyChangeTrigger(source);
+        const commentUpdated = armed.replace(/# v\d+\.\d+\.\d+ matches this repo's own installed Lisa/, `# v${lisaVersion} matches this repo's own installed Lisa`);
+        return contractVersion
+            ? commentUpdated.replace(/# the guard reports contract \d+\.\d+\.\d+ and the reusable asserts its MAJOR/, `# the guard reports contract ${contractVersion} and the reusable asserts its MAJOR`)
+            : commentUpdated;
     }
 }
 //# sourceMappingURL=ensure-nightly-e2e-workflow-pins.js.map

package/dist/migrations/ensure-nightly-e2e-workflow-pins.js.map

@@ -1 +1 @@
-{"version":3,"file":"ensure-nightly-e2e-workflow-pins.js","sourceRoot":"","sources":["../../src/migrations/ensure-nightly-e2e-workflow-pins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAOvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG;IACrB,wBAAwB;IACxB,wBAAwB;CAChB,CAAC;AACX,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GACpB,4DAA4D,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,mBAAmB,GAAG,yCAAyC,CAAC;AAOtE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,qCAAqC;IAY7B;IACA;IAZV,IAAI,GAAG,kCAAkC,CAAC;IAC1C,WAAW,GAClB,4HAA4H,CAAC;IAE/H;;;;;OAKG;IACH,YACmB,kBAAiC,iBAAiB,EAClD,iBAAmC,oBAAoB;QADvD,oBAAe,GAAf,eAAe,CAAmC;QAClD,mBAAc,GAAd,cAAc,CAAyC;IACvE,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAEvD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,IACE,IAAI,CAAC,YAAY,CACf,MAAM,EACN,IAAI,EACJ,WAAW,EACX,UAAU,EACV,eAAe,CAChB,KAAK,MAAM,EACZ,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAgD,EAAE,CAAC;QAEhE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAC7B,MAAM,EACN,IAAI,EACJ,WAAW,EACX,UAAU,EACV,eAAe,CAChB,CAAC;YACF,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,yCAAyC,WAAW,EAAE,CAAC;QACvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAED;;;;;;;;;;OAUG;IACK,iBAAiB,CAAC,WAAmB;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,OAAO,OAAO,KAAK,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1D,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB;QAElB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC;IAED;;;;;;;;;OASG;IACK,YAAY,CAClB,MAAc,EACd,IAAqC,EACrC,WAAmB,EACnB,UAAkB,EAClB,eAA8B;QAE9B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,kDAAkD,QAAQ,8CAA8C,EACxG,GAAG,CACJ,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,UAAU,EAAE,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,UAAU,KAAK,MAAM,CAAC;QAEzC,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YACtC,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,KAAK,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9B,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAClC,yDAAyD,EACzD,MAAM,WAAW,yCAAyC,CAC3D,CAAC;YACF,OAAO,eAAe;gBACpB,CAAC,CAAC,cAAc,CAAC,OAAO,CACpB,+EAA+E,EAC/E,gCAAgC,eAAe,qCAAqC,CACrF;gBACH,CAAC,CAAC,cAAc,CAAC;QACrB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;CACF"}
+{"version":3,"file":"ensure-nightly-e2e-workflow-pins.js","sourceRoot":"","sources":["../../src/migrations/ensure-nightly-e2e-workflow-pins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAOvF,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACvD,MAAM,cAAc,GAAG;IACrB,wBAAwB;IACxB,wBAAwB;CAChB,CAAC;AACX,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GACpB,4DAA4D,CAAC;AAK/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,qCAAqC;IAc7B;IAbnB,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAClE,IAAI,GAAG,kCAAkC,CAAC;IAC1C,WAAW,GAClB,wGAAwG,CAAC;IAE3G;;;;OAIG;IACH,YACmB,kBAAiC,iBAAiB;QAAlD,oBAAe,GAAf,eAAe,CAAmC;IAClE,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,GAAqB;QACjC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAE3C,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,IACE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,KAAK,MAAM,EACxE,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,GAAqB;QAC/B,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,OAAO,GAAgD,EAAE,CAAC;QAEhE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAAE,SAAS;YAChD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAC7B,MAAM,EACN,IAAI,EACJ,WAAW,EACX,eAAe,CAChB,CAAC;YACF,IAAI,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC/B,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QAED,MAAM,OAAO,GAAG,yCAAyC,WAAW,EAAE,CAAC;QACvE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACvE,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,mBAAmB,CAC/B,UAAkB;QAElB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;OAUG;IACK,YAAY,CAClB,MAAc,EACd,IAAqC,EACrC,WAAmB,EACnB,eAA8B;QAE9B,IAAI,IAAI,KAAK,wBAAwB;YAAE,OAAO,MAAM,CAAC;QAErD,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,KAAK,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAClC,yDAAyD,EACzD,MAAM,WAAW,yCAAyC,CAC3D,CAAC;QACF,OAAO,eAAe;YACpB,CAAC,CAAC,cAAc,CAAC,OAAO,CACpB,+EAA+E,EAC/E,gCAAgC,eAAe,qCAAqC,CACrF;YACH,CAAC,CAAC,cAAc,CAAC;IACrB,CAAC;CACF"}

package/dist/migrations/ensure-pinned-reusable-workflow-refs.d.ts

@@ -0,0 +1,143 @@
+import type { ReleasePinDependencies } from "../core/lisa-release-pin.js";
+import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
+/**
+ * Pin every Lisa reusable-workflow caller in a project at the commit the
+ * installed version's tag names, and keep it pinned as that version moves.
+ *
+ * ## Why this is a migration and not a template change
+ *
+ * A template cannot carry the answer. The SHA a caller must name is the commit
+ * of a tag that does not exist yet when the template is authored, so the
+ * shipped templates track `@main` and this migration rewrites what was copied.
+ * That also makes one mechanism cover three cases that would otherwise need
+ * three: a fresh install (templates land, then get pinned), an already
+ * installed project still on `@main` (rewritten on its next apply — "fixed
+ * upstream" is not "a bump brings it", and every caller workflow is
+ * create-only, so nothing else would ever reach them), and a version change
+ * (repinned in the same pass that rewrites the package pin).
+ *
+ * ## Why it resolves before any file is written
+ *
+ * The abort has to leave the working tree untouched, and by the time
+ * migrations run the copy strategies have already written. So the resolution
+ * happens in `beforeStrategies`, which runs first: an installed Lisa that
+ * cannot name its own release commit stops the apply there, before anything
+ * has changed.
+ *
+ * ## What it refuses to do, and what it only reports
+ *
+ * A Lisa whose DECLARED release identity will not resolve is broken, and it
+ * stops the apply wherever a caller is involved — installed in the project, or
+ * about to arrive from the templates.
+ *
+ * A Lisa that declares NO release identity was never released: a working
+ * checkout, or a template tree copied somewhere without its history. There is
+ * no tag for a caller to name, so the apply continues and says so — refusing
+ * would make every developer checkout unable to apply Lisa at all. The one
+ * exception is a project that ALREADY calls a Lisa reusable workflow: leaving
+ * an existing caller mutable while reporting a successful apply is the
+ * fail-open shape this migration exists to remove, so that case still stops.
+ *
+ * ## Why it declines nothing in postinstall-safe mode
+ *
+ * The version change IS the postinstall moment. A pin that only moved when an
+ * operator happened to run a full apply would spend most of its life naming a
+ * release the project no longer has installed, which is the staleness this
+ * whole change exists to prevent.
+ */
+export declare class EnsurePinnedReusableWorkflowRefsMigration implements Migration {
+    private readonly deps;
+    readonly name = "ensure-pinned-reusable-workflow-refs";
+    readonly description = "Pin every Lisa reusable-workflow caller at the commit the installed version's tag names";
+    /** Resolution captured before the strategies ran, when they ran at all. */
+    private resolution;
+    /**
+     * Whether the project already called a Lisa reusable workflow when this
+     * apply started, or null when nobody looked before the strategies ran.
+     *
+     * Asked before the copy, because afterwards the answer is always yes: the
+     * templates have just seeded callers, and "was already installed" and "was
+     * seeded thirty seconds ago" are the two cases that need opposite answers
+     * from an unreleased Lisa.
+     */
+    private hadCallersBefore;
+    /**
+     * Create the migration.
+     * @param deps - Pin resolution readers, injectable for deterministic tests
+     */
+    constructor(deps?: ReleasePinDependencies);
+    /**
+     * Resolve the pin before any strategy writes, and abort here if it cannot be.
+     * @param ctx - Migration context
+     * @throws {UnresolvableReleasePinError} When a caller is involved and the pin will not resolve
+     */
+    beforeStrategies(ctx: MigrationContext): Promise<void>;
+    /**
+     * Whether any caller in this project still needs rewriting.
+     *
+     * The caller check comes FIRST, and deliberately. A project with no Lisa
+     * reusable callers has nothing to pin, so an installation that cannot name
+     * its release commit is not a problem it has — declining here is what keeps
+     * an unreleased checkout able to apply Lisa to such a project at all. Once a
+     * caller does exist, an unresolved pin returns true so `apply` can abort
+     * loudly rather than reporting a skip that reads like conformance.
+     * @param ctx - Migration context
+     * @returns True when at least one reference is not already at the pin
+     */
+    applies(ctx: MigrationContext): Promise<boolean>;
+    /**
+     * Rewrite every caller to the pin, or abort having written nothing.
+     * @param ctx - Migration context
+     * @returns Applied or no-op result
+     * @throws {UnresolvableReleasePinError} When the installed version's tag resolves to no commit
+     */
+    apply(ctx: MigrationContext): Promise<MigrationResult>;
+    /**
+     * Whether an unresolved pin must stop this apply rather than be reported.
+     *
+     * A DECLARED identity that will not resolve is a broken installation and
+     * stops wherever a caller is involved. No declared identity at all is an
+     * unreleased tree, which has no tag for a caller to name — it stops only
+     * where continuing would leave a caller that was ALREADY there mutable
+     * while the apply reported success.
+     * @param ctx - Migration context
+     * @param error - The resolution failure
+     * @returns True when the apply must abort
+     */
+    private isFatal;
+    /**
+     * The rewrite to perform on every workflow file that needs one.
+     * @param projectDir - Destination project directory
+     * @param pin - The identity every caller must carry
+     * @returns One entry per file whose content changes
+     */
+    private plan;
+    /**
+     * The resolution captured in `beforeStrategies`, resolving now if it was not.
+     *
+     * `runAll` can be invoked without the pre-strategy hook — a caller that only
+     * wants migrations, and every unit test of this class. Resolving lazily there
+     * keeps both paths honest rather than silently treating "never asked" as "no
+     * pin needed".
+     * @param ctx - Migration context
+     * @returns The resolution
+     */
+    private resolved;
+    /**
+     * Attempt resolution, capturing the failure rather than throwing it.
+     * @param ctx - Migration context
+     * @returns The pin, or the error explaining why there is none
+     */
+    private resolve;
+    /**
+     * Whether this apply could put a Lisa reusable-workflow caller in the project.
+     *
+     * Both halves matter. The project's own workflows cover an existing install;
+     * the templates about to be copied cover a fresh one, where the project has
+     * no workflows yet and the callers arrive minutes later.
+     * @param ctx - Migration context
+     * @returns True when a caller exists or is about to
+     */
+    private anyCallerReachable;
+}
+//# sourceMappingURL=ensure-pinned-reusable-workflow-refs.d.ts.map

package/dist/migrations/ensure-pinned-reusable-workflow-refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-pinned-reusable-workflow-refs.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-pinned-reusable-workflow-refs.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAY1E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAelC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,qBAAa,yCAA0C,YAAW,SAAS;IAwBvE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAvBvB,QAAQ,CAAC,IAAI,0CAA0C;IACvD,QAAQ,CAAC,WAAW,6FACwE;IAE5F,2EAA2E;IAC3E,OAAO,CAAC,UAAU,CAA2B;IAE7C;;;;;;;;OAQG;IACH,OAAO,CAAC,gBAAgB,CAAwB;IAEhD;;;OAGG;gBAEgB,IAAI,GAAE,sBAKtB;IAGH;;;;OAIG;IACG,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB5D;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAUtD;;;;;OAKG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAkC5D;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,OAAO;IAYf;;;;;OAKG;YACW,IAAI;IAuBlB;;;;;;;;;OASG;YACW,QAAQ;IAKtB;;;;OAIG;YACW,OAAO;IAWrB;;;;;;;;OAQG;YACW,kBAAkB;CAYjC"}