@codyswann/lisa 4.42.7 → 4.43.0

package/dist/migrations/deploy-outcome-guard-edit.d.ts

@@ -0,0 +1,11 @@
+import { type DependenceJob } from "../core/deploy-release-dependence.js";
+/** The guard step's `name:`, identical in every shipped deploy workflow. */
+export declare const GUARD_STEP_NAME = "\uD83D\uDEA8 Confirm the release shipped";
+/**
+ * Rewrite one job's condition so a failed release no longer skips it.
+ * @param job - The deploy job as parsed
+ * @param release - The upstream release job's id
+ * @returns The new condition text, or null when it must be left to a human
+ */
+export declare function rewrittenCondition(job: DependenceJob, release: string): string | null;
+//# sourceMappingURL=deploy-outcome-guard-edit.d.ts.map

package/dist/migrations/deploy-outcome-guard-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-outcome-guard-edit.d.ts","sourceRoot":"","sources":["../../src/migrations/deploy-outcome-guard-edit.ts"],"names":[],"mappings":"AAgDA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,sCAAsC,CAAC;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,eAAe,6CAAmC,CAAC;AAqGhE;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,aAAa,EAClB,OAAO,EAAE,MAAM,GACd,MAAM,GAAG,IAAI,CASf"}

package/dist/migrations/deploy-outcome-guard-edit.js

@@ -0,0 +1,184 @@
+/**
+ * The text surgery behind `ensure-deploy-outcome-guard` (CodySwannGT/lisa#3740).
+ *
+ * Separated from the migration class so the editing rules can be driven
+ * directly by tests: what this decides is which host workflows it is willing to
+ * touch, and that judgement is the risky half of the migration, not the file
+ * I/O around it.
+ *
+ * ## Two edits, or neither
+ *
+ * Repairing this defect means suppressing GitHub's implicit `success()` so the
+ * deploy job RUNS when the release failed, and adding a first step that fails
+ * it loudly. Doing only the first would be **worse than the bug**: a deploy job
+ * that runs on a failed release with nothing checking the release result would
+ * attempt to ship. So the two edits are produced together or the file is left
+ * alone, and a caller cannot obtain one without the other.
+ *
+ * ## The guard body is read, never written
+ *
+ * The step this inserts is lifted verbatim out of Lisa's own shipped deploy
+ * template. Hardcoding it here would create a fourth copy of a body that
+ * `tests/integration/deploy-outcome-guard.test.ts` exists to keep identical
+ * across three — and a copy that test cannot see, which is the shape this
+ * repository keeps paying for. If the template cannot be read, the migration
+ * declines rather than writing something it made up.
+ *
+ * ## What it refuses
+ *
+ * A condition it cannot rewrite without guessing is declined, and the doctor
+ * finding reports it instead. Two rewrites are accepted and no others:
+ *
+ * 1. A condition that never mentions the release result — safe to wrap, since
+ *    `!cancelled() && (original)` cannot change what the original decides.
+ * 2. A flat top-level `&&` chain containing `needs.<release>.result ==
+ *    'success'` — the conjunct is dropped and `!cancelled()` prepended.
+ *
+ * Anything else, including that conjunct nested inside an `||`, is left to a
+ * human. Dropping a term from inside a disjunction changes what the condition
+ * means in ways this cannot check.
+ *
+ * ## The self-check
+ *
+ * Every rewrite is fed back through the same analysis that found the defect,
+ * and a rewrite that does not come back `independent` is discarded. A repair
+ * that does not repair is refused rather than written.
+ * @module migrations/deploy-outcome-guard-edit
+ */
+import { tokenize } from "../core/github-actions-condition.js";
+import { releaseDependence, } from "../core/deploy-release-dependence.js";
+/** The guard step's `name:`, identical in every shipped deploy workflow. */
+export const GUARD_STEP_NAME = "🚨 Confirm the release shipped";
+/** The status function that suppresses GitHub's implicit `success()`. */
+const SUPPRESSOR = "!cancelled()";
+/** Tokens that take no space before them when a condition is re-rendered. */
+const NO_SPACE_BEFORE = new Set([")", ",", "=="]);
+/** Tokens that take no space after them when a condition is re-rendered. */
+const NO_SPACE_AFTER = new Set(["(", "!", "=="]);
+/**
+ * Strip a `${{ }}` wrapper and surrounding whitespace from a condition.
+ * @param condition - The raw `if:` text
+ * @returns The bare expression
+ */
+function bareExpression(condition) {
+    return condition
+        .trim()
+        .replace(/^\$\{\{/, "")
+        .replace(/\}\}$/, "")
+        .trim();
+}
+/**
+ * Re-render a token run as expression text.
+ * @param tokens - The tokens, in order
+ * @returns Readable expression text
+ */
+function render(tokens) {
+    return tokens
+        .reduce((text, token, index) => {
+        const previous = tokens[index - 1];
+        const glued = index === 0 ||
+            NO_SPACE_BEFORE.has(token) ||
+            (previous !== undefined && NO_SPACE_AFTER.has(previous));
+        return glued ? text + token : `${text} ${token}`;
+    }, "")
+        .replace(/ == /g, " == ")
+        .trim();
+}
+/**
+ * Split a condition into its top-level `&&` conjuncts.
+ * @param tokens - The tokenized condition
+ * @returns The conjuncts, or null when the expression is not a flat `&&` chain
+ */
+function topLevelConjuncts(tokens) {
+    const split = tokens.reduce((state, token) => {
+        const depth = token === "("
+            ? state.depth + 1
+            : token === ")"
+                ? state.depth - 1
+                : state.depth;
+        if (state.depth === 0 && token === "||") {
+            return { ...state, depth, flat: false };
+        }
+        if (state.depth === 0 && token === "&&") {
+            return {
+                depth,
+                parts: [...state.parts, state.current],
+                current: [],
+                flat: state.flat,
+            };
+        }
+        return { ...state, depth, current: [...state.current, token] };
+    }, { depth: 0, parts: [], current: [], flat: true });
+    if (!split.flat)
+        return null;
+    return [...split.parts, split.current].filter(part => part.length > 0);
+}
+/**
+ * Whether a conjunct is exactly `needs.<release>.result == 'success'`.
+ * @param conjunct - One top-level conjunct's tokens
+ * @param release - The upstream release job's id
+ * @returns True when the conjunct is the hand-written success gate
+ */
+function isReleaseSuccessGate(conjunct, release) {
+    return (conjunct.length === 3 &&
+        conjunct[0] === `needs.${release}.result` &&
+        conjunct[1] === "==" &&
+        conjunct[2] === "'success'");
+}
+/**
+ * Rewrite one job's condition so a failed release no longer skips it.
+ * @param job - The deploy job as parsed
+ * @param release - The upstream release job's id
+ * @returns The new condition text, or null when it must be left to a human
+ */
+export function rewrittenCondition(job, release) {
+    const rewritten = proposedCondition(job, release);
+    if (rewritten === null)
+        return null;
+    // The self-check: a rewrite that does not actually make the job independent
+    // of the release result is discarded rather than written.
+    return releaseDependence({ ...job, ifCondition: rewritten }, release).kind ===
+        "independent"
+        ? rewritten
+        : null;
+}
+/**
+ * Propose a rewrite, before the self-check decides whether to keep it.
+ * @param job - The deploy job as parsed
+ * @param release - The upstream release job's id
+ * @returns The candidate condition, or null when no rule applies
+ */
+function proposedCondition(job, release) {
+    const original = bareExpression(job.ifCondition);
+    if (original === "")
+        return SUPPRESSOR;
+    const gate = `needs.${release}.result`;
+    if (!original.includes(gate)) {
+        return `${SUPPRESSOR} && (${original})`;
+    }
+    const conjuncts = topLevelConjuncts(tryTokenize(original) ?? []);
+    if (conjuncts === null || conjuncts.length === 0)
+        return null;
+    const kept = conjuncts.filter(conjunct => !isReleaseSuccessGate(conjunct, release));
+    // Every remaining conjunct must be free of the release result: one nested
+    // inside parentheses is exactly the case this refuses to reason about.
+    if (kept.length === conjuncts.length)
+        return null;
+    if (kept.some(conjunct => conjunct.some(token => token === gate)))
+        return null;
+    return [SUPPRESSOR, ...kept.map(render)].join(" && ");
+}
+/**
+ * Tokenize, returning null instead of throwing on an unsupported expression.
+ * @param expression - The bare expression text
+ * @returns The tokens, or null when the expression cannot be read
+ */
+function tryTokenize(expression) {
+    try {
+        return tokenize(expression);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=deploy-outcome-guard-edit.js.map

package/dist/migrations/deploy-outcome-guard-edit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-outcome-guard-edit.js","sourceRoot":"","sources":["../../src/migrations/deploy-outcome-guard-edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAC/D,OAAO,EAEL,iBAAiB,GAClB,MAAM,sCAAsC,CAAC;AAE9C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,gCAAgC,CAAC;AAEhE,yEAAyE;AACzE,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,6EAA6E;AAC7E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAElD,4EAA4E;AAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjD;;;;GAIG;AACH,SAAS,cAAc,CAAC,SAAiB;IACvC,OAAO,SAAS;SACb,IAAI,EAAE;SACN,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,MAAM,CAAC,MAAyB;IACvC,OAAO,MAAM;SACV,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,KAAK,GACT,KAAK,KAAK,CAAC;YACX,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAC1B,CAAC,QAAQ,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;IACnD,CAAC,EAAE,EAAE,CAAC;SACL,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;SACxB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,MAAyB;IAEzB,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAMzB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACf,MAAM,KAAK,GACT,KAAK,KAAK,GAAG;YACX,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;YACjB,CAAC,CAAC,KAAK,KAAK,GAAG;gBACb,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC;gBACjB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QACpB,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACxC,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;gBACtC,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;IACjE,CAAC,EACD,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CACjD,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,SAAS,oBAAoB,CAC3B,QAA2B,EAC3B,OAAe;IAEf,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,CAAC;QACrB,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS,OAAO,SAAS;QACzC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI;QACpB,QAAQ,CAAC,CAAC,CAAC,KAAK,WAAW,CAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAkB,EAClB,OAAe;IAEf,MAAM,SAAS,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,4EAA4E;IAC5E,0DAA0D;IAC1D,OAAO,iBAAiB,CAAC,EAAE,GAAG,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI;QACxE,aAAa;QACb,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAkB,EAAE,OAAe;IAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjD,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,UAAU,CAAC;IACvC,MAAM,IAAI,GAAG,SAAS,OAAO,SAAS,CAAC;IACvC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,UAAU,QAAQ,QAAQ,GAAG,CAAC;IAC1C,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAC3B,QAAQ,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,CACrD,CAAC;IACF,0EAA0E;IAC1E,uEAAuE;IACvE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,UAAkB;IACrC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/migrations/deploy-outcome-guard-yaml.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Line-level editing of a host's `deploy.yml` for `ensure-deploy-outcome-guard`
+ * (CodySwannGT/lisa#3740).
+ *
+ * The file being edited is one the host OWNS — Lisa seeded it once and has
+ * never overwritten it since — so the discipline here is the opposite of a
+ * template copy: touch the two constructs that carry the defect and leave every
+ * other byte, including comments and formatting, exactly as the host left it.
+ * That is why this works on lines rather than by re-serializing a parsed
+ * document; a YAML round-trip would silently reformat a file somebody reviewed.
+ *
+ * Every locator returns null rather than a best guess. A workflow whose shape
+ * this cannot resolve unambiguously is not edited, and the doctor finding
+ * reports it instead — a migration that half-recognises a file and edits it
+ * anyway is worse than one that declines.
+ * @module migrations/deploy-outcome-guard-yaml
+ */
+/** Where one job's block sits in the file, and how its keys are indented. */
+export interface JobBlock {
+    /** Index of the `<job-id>:` line. */
+    readonly start: number;
+    /** Index one past the job's last line. */
+    readonly end: number;
+    /** Column the job's own keys (`if:`, `steps:`) begin at. */
+    readonly keyIndent: number;
+}
+/**
+ * Locate one job's block by its id.
+ * @param lines - The workflow file's lines
+ * @param jobId - The job's key in the `jobs:` map
+ * @returns Where the job sits, or null when it cannot be located exactly once
+ */
+export declare function locateJob(lines: readonly string[], jobId: string): JobBlock | null;
+/** A span of lines to replace, and the indentation its replacement takes. */
+export interface KeySpan {
+    /** Index of the key's first line. */
+    readonly start: number;
+    /** Index one past the key's last line. */
+    readonly end: number;
+}
+/**
+ * Locate one top-level key of a job, including any continuation lines.
+ * @param lines - The workflow file's lines
+ * @param block - The job's block
+ * @param key - The key name, e.g. `if` or `steps`
+ * @returns The key's span, or null when the job does not declare it
+ */
+export declare function locateKey(lines: readonly string[], block: JobBlock, key: string): KeySpan | null;
+/**
+ * Locate the first entry of a job's `steps:` list.
+ * @param lines - The workflow file's lines
+ * @param block - The job's block
+ * @returns The first step's line index and indentation, or null when absent
+ */
+export declare function locateFirstStep(lines: readonly string[], block: JobBlock): {
+    readonly index: number;
+    readonly indent: number;
+} | null;
+/**
+ * Extract the guard step from a shipped Lisa deploy template.
+ *
+ * Read rather than reproduced: the body is kept byte-identical across the
+ * shipped templates by a test, and a copy inside this module would be a fourth
+ * one that test cannot see.
+ * @param template - The template workflow's source
+ * @param stepName - The guard step's `name:` value
+ * @returns The step's lines, de-indented to column zero, or null when absent
+ */
+export declare function extractGuardStep(template: string, stepName: string): readonly string[] | null;
+/**
+ * Render the replacement `if:` block for a job.
+ * @param condition - The rewritten condition text
+ * @param keyIndent - Column the job's keys begin at
+ * @returns The lines to write in place of the job's old `if:`
+ */
+export declare function renderCondition(condition: string, keyIndent: number): readonly string[];
+/**
+ * Apply both edits to one workflow's source, or return null.
+ *
+ * The two are produced together on purpose. Suppressing the implicit
+ * `success()` without inserting the guard would leave a deploy job that RUNS on
+ * a failed release with nothing checking the release result — it would attempt
+ * to ship, which is worse than the silence this repairs.
+ * @param source - The host workflow's source
+ * @param jobId - The deploy job to repair
+ * @param condition - The rewritten condition text
+ * @param guardStep - The guard step's lines, de-indented to column zero
+ * @returns The edited source, or null when the file could not be edited safely
+ */
+export declare function applyGuardEdits(source: string, jobId: string, condition: string, guardStep: readonly string[]): string | null;
+//# sourceMappingURL=deploy-outcome-guard-yaml.d.ts.map

package/dist/migrations/deploy-outcome-guard-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-outcome-guard-yaml.d.ts","sourceRoot":"","sources":["../../src/migrations/deploy-outcome-guard-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,QAAQ;IACvB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAYD;;;;;GAKG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,MAAM,GACZ,QAAQ,GAAG,IAAI,CAiBjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,OAAO;IACtB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,QAAQ,EACf,GAAG,EAAE,MAAM,GACV,OAAO,GAAG,IAAI,CAahB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,KAAK,EAAE,QAAQ,GACd;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAS5D;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,SAAS,MAAM,EAAE,GAAG,IAAI,CAc1B;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,SAAS,MAAM,EAAE,CAkBnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,SAAS,MAAM,EAAE,GAC3B,MAAM,GAAG,IAAI,CA8Bf"}

package/dist/migrations/deploy-outcome-guard-yaml.js

@@ -0,0 +1,180 @@
+/**
+ * Line-level editing of a host's `deploy.yml` for `ensure-deploy-outcome-guard`
+ * (CodySwannGT/lisa#3740).
+ *
+ * The file being edited is one the host OWNS — Lisa seeded it once and has
+ * never overwritten it since — so the discipline here is the opposite of a
+ * template copy: touch the two constructs that carry the defect and leave every
+ * other byte, including comments and formatting, exactly as the host left it.
+ * That is why this works on lines rather than by re-serializing a parsed
+ * document; a YAML round-trip would silently reformat a file somebody reviewed.
+ *
+ * Every locator returns null rather than a best guess. A workflow whose shape
+ * this cannot resolve unambiguously is not edited, and the doctor finding
+ * reports it instead — a migration that half-recognises a file and edits it
+ * anyway is worse than one that declines.
+ * @module migrations/deploy-outcome-guard-yaml
+ */
+/**
+ * Indentation width of one line, or null when the line carries no content.
+ * @param line - The raw line
+ * @returns Number of leading spaces, or null for a blank or comment-only line
+ */
+function indentOf(line) {
+    if (line.trim() === "")
+        return null;
+    return line.length - line.trimStart().length;
+}
+/**
+ * Locate one job's block by its id.
+ * @param lines - The workflow file's lines
+ * @param jobId - The job's key in the `jobs:` map
+ * @returns Where the job sits, or null when it cannot be located exactly once
+ */
+export function locateJob(lines, jobId) {
+    const pattern = new RegExp(`^(\\s+)${jobId}:\\s*$`);
+    const starts = lines.flatMap((line, index) => pattern.test(line) ? [index] : []);
+    if (starts.length !== 1)
+        return null;
+    const start = starts[0] ?? 0;
+    const jobIndent = indentOf(lines[start] ?? "") ?? 0;
+    const body = lines
+        .slice(start + 1)
+        .findIndex(line => (indentOf(line) ?? jobIndent + 1) <= jobIndent);
+    const end = body === -1 ? lines.length : start + 1 + body;
+    const keyIndent = lines
+        .slice(start + 1, end)
+        .map(indentOf)
+        .find((indent) => indent !== null);
+    return keyIndent === undefined ? null : { start, end, keyIndent };
+}
+/**
+ * Locate one top-level key of a job, including any continuation lines.
+ * @param lines - The workflow file's lines
+ * @param block - The job's block
+ * @param key - The key name, e.g. `if` or `steps`
+ * @returns The key's span, or null when the job does not declare it
+ */
+export function locateKey(lines, block, key) {
+    const pattern = new RegExp(`^\\s{${block.keyIndent}}${key}:`);
+    const found = lines
+        .slice(block.start, block.end)
+        .findIndex(line => pattern.test(line));
+    if (found === -1)
+        return null;
+    const start = block.start + found;
+    const rest = lines
+        .slice(start + 1, block.end)
+        .findIndex(line => (indentOf(line) ?? block.keyIndent + 1) <= block.keyIndent);
+    return { start, end: rest === -1 ? block.end : start + 1 + rest };
+}
+/**
+ * Locate the first entry of a job's `steps:` list.
+ * @param lines - The workflow file's lines
+ * @param block - The job's block
+ * @returns The first step's line index and indentation, or null when absent
+ */
+export function locateFirstStep(lines, block) {
+    const steps = locateKey(lines, block, "steps");
+    if (steps === null)
+        return null;
+    const offset = lines
+        .slice(steps.start + 1, steps.end)
+        .findIndex(line => line.trimStart().startsWith("- "));
+    if (offset === -1)
+        return null;
+    const index = steps.start + 1 + offset;
+    return { index, indent: indentOf(lines[index] ?? "") ?? 0 };
+}
+/**
+ * Extract the guard step from a shipped Lisa deploy template.
+ *
+ * Read rather than reproduced: the body is kept byte-identical across the
+ * shipped templates by a test, and a copy inside this module would be a fourth
+ * one that test cannot see.
+ * @param template - The template workflow's source
+ * @param stepName - The guard step's `name:` value
+ * @returns The step's lines, de-indented to column zero, or null when absent
+ */
+export function extractGuardStep(template, stepName) {
+    const lines = template.split("\n");
+    const start = lines.findIndex(line => line.trimStart().startsWith(`- name: ${stepName}`));
+    if (start === -1)
+        return null;
+    const indent = indentOf(lines[start] ?? "") ?? 0;
+    const after = lines
+        .slice(start + 1)
+        .findIndex(line => (indentOf(line) ?? indent + 1) <= indent);
+    const end = after === -1 ? lines.length : start + 1 + after;
+    return lines
+        .slice(start, end)
+        .map(line => (line.trim() === "" ? "" : line.slice(indent)));
+}
+/**
+ * Render the replacement `if:` block for a job.
+ * @param condition - The rewritten condition text
+ * @param keyIndent - Column the job's keys begin at
+ * @returns The lines to write in place of the job's old `if:`
+ */
+export function renderCondition(condition, keyIndent) {
+    const pad = " ".repeat(keyIndent);
+    const inner = " ".repeat(keyIndent + 2);
+    return [
+        `${pad}# \`!cancelled()\` suppresses the implicit \`success()\` GitHub would`,
+        `${pad}# otherwise AND onto this condition. Without it a failed release`,
+        `${pad}# SKIPPED this job, and a skipped job renders as neutral and counts`,
+        `${pad}# as a satisfied required check — so a deploy that never happened`,
+        `${pad}# left no signal at all. The release result is read by the guard STEP`,
+        `${pad}# below, which fails this job loudly instead (#3467, applied by`,
+        `${pad}# Lisa's ensure-deploy-outcome-guard migration for #3740).`,
+        `${pad}if: >-`,
+        ...condition
+            .split(" && ")
+            .map((part, index, parts) => index === parts.length - 1 ? `${inner}${part}` : `${inner}${part} &&`),
+    ];
+}
+/**
+ * Apply both edits to one workflow's source, or return null.
+ *
+ * The two are produced together on purpose. Suppressing the implicit
+ * `success()` without inserting the guard would leave a deploy job that RUNS on
+ * a failed release with nothing checking the release result — it would attempt
+ * to ship, which is worse than the silence this repairs.
+ * @param source - The host workflow's source
+ * @param jobId - The deploy job to repair
+ * @param condition - The rewritten condition text
+ * @param guardStep - The guard step's lines, de-indented to column zero
+ * @returns The edited source, or null when the file could not be edited safely
+ */
+export function applyGuardEdits(source, jobId, condition, guardStep) {
+    const lines = source.split("\n");
+    const block = locateJob(lines, jobId);
+    if (block === null)
+        return null;
+    const step = locateFirstStep(lines, block);
+    if (step === null)
+        return null;
+    const existing = locateKey(lines, block, "if");
+    const guardLines = guardStep.map(line => line === "" ? "" : `${" ".repeat(step.indent)}${line}`);
+    const conditionLines = renderCondition(condition, block.keyIndent);
+    const declared = existing ?? {
+        start: block.start + 1,
+        end: block.start + 1,
+    };
+    const withGuard = [
+        ...lines.slice(0, step.index),
+        ...guardLines,
+        ...lines.slice(step.index),
+    ];
+    // Inserting the guard shifts every index at or after it. `steps:` normally
+    // follows `if:`, so the span is usually untouched — but YAML mapping keys
+    // carry no required order, and a host that wrote them the other way round
+    // would otherwise have its file corrupted rather than declined.
+    const shift = step.index <= declared.start ? guardLines.length : 0;
+    return [
+        ...withGuard.slice(0, declared.start + shift),
+        ...conditionLines,
+        ...withGuard.slice(declared.end + shift),
+    ].join("\n");
+}
+//# sourceMappingURL=deploy-outcome-guard-yaml.js.map

package/dist/migrations/deploy-outcome-guard-yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-outcome-guard-yaml.js","sourceRoot":"","sources":["../../src/migrations/deploy-outcome-guard-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CACvB,KAAwB,EACxB,KAAa;IAEb,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC3C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAClC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAChB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC;IAC1D,MAAM,SAAS,GAAG,KAAK;SACpB,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,GAAG,CAAC;SACrB,GAAG,CAAC,QAAQ,CAAC;SACb,IAAI,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IACvD,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACpE,CAAC;AAUD;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CACvB,KAAwB,EACxB,KAAe,EACf,GAAW;IAEX,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;SAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK;SACf,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC;SAC3B,SAAS,CACR,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,CACnE,CAAC;IACJ,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAwB,EACxB,KAAe;IAEf,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK;SACjB,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC;SACjC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CACnC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,WAAW,QAAQ,EAAE,CAAC,CACnD,CAAC;IACF,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK;SAChB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;SAChB,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC;IAC5D,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;SACjB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,SAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IACxC,OAAO;QACL,GAAG,GAAG,uEAAuE;QAC7E,GAAG,GAAG,kEAAkE;QACxE,GAAG,GAAG,qEAAqE;QAC3E,GAAG,GAAG,mEAAmE;QACzE,GAAG,GAAG,uEAAuE;QAC7E,GAAG,GAAG,iEAAiE;QACvE,GAAG,GAAG,4DAA4D;QAClE,GAAG,GAAG,QAAQ;QACd,GAAG,SAAS;aACT,KAAK,CAAC,MAAM,CAAC;aACb,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAC1B,KAAK,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,KAAK,CACtE;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,KAAa,EACb,SAAiB,EACjB,SAA4B;IAE5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACtC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CACvD,CAAC;IACF,MAAM,cAAc,GAAG,eAAe,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,QAAQ,IAAI;QAC3B,KAAK,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;QACtB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC;KACrB,CAAC;IACF,MAAM,SAAS,GAAG;QAChB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC7B,GAAG,UAAU;QACb,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;KAC3B,CAAC;IACF,2EAA2E;IAC3E,0EAA0E;IAC1E,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO;QACL,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,KAAK,CAAC;QAC7C,GAAG,cAAc;QACjB,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,GAAG,KAAK,CAAC;KACzC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/migrations/ensure-deploy-outcome-guard.d.ts

@@ -0,0 +1,41 @@
+import type { Migration, MigrationContext, MigrationResult } from "./migration.interface.js";
+/**
+ * Bring an already-seeded deploy workflow up to the #3467 outcome contract.
+ */
+export declare class EnsureDeployOutcomeGuardMigration implements Migration {
+    readonly name = "ensure-deploy-outcome-guard";
+    readonly description = "Make an already-seeded deploy job fail loudly instead of skipping silently when its release does not succeed";
+    /**
+     * Whether any host deploy workflow can be repaired.
+     * @param ctx - Migration context
+     * @returns True when at least one workflow would change
+     */
+    applies(ctx: MigrationContext): Promise<boolean>;
+    /**
+     * Rewrite every repairable deploy workflow.
+     * @param ctx - Migration context
+     * @returns Applied or no-op result
+     */
+    apply(ctx: MigrationContext): Promise<MigrationResult>;
+    /**
+     * Work out which host workflows this run would rewrite.
+     * @param ctx - Migration context
+     * @returns One entry per workflow that can be repaired
+     */
+    private plan;
+    /**
+     * Plan the repair of one workflow.
+     * @param ctx - Migration context
+     * @param workflow - The parsed workflow
+     * @param guardStep - The guard step's lines
+     * @returns The planned edit, or null when nothing here can be repaired
+     */
+    private planOne;
+    /**
+     * Read the guard step out of Lisa's own shipped deploy template.
+     * @param lisaDir - Lisa installation directory
+     * @returns The step's lines, or null when the template cannot be read
+     */
+    private readGuardStep;
+}
+//# sourceMappingURL=ensure-deploy-outcome-guard.d.ts.map

package/dist/migrations/ensure-deploy-outcome-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-deploy-outcome-guard.d.ts","sourceRoot":"","sources":["../../src/migrations/ensure-deploy-outcome-guard.ts"],"names":[],"mappings":"AAgEA,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAChB,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAiJlC;;GAEG;AACH,qBAAa,iCAAkC,YAAW,SAAS;IACjE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,WAAW,kHAC6F;IAEjH;;;;OAIG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;IAItD;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAoB5D;;;;OAIG;YACW,IAAI;IAelB;;;;;;OAMG;YACW,OAAO;IAsBrB;;;;OAIG;YACW,aAAa;CAa5B"}