@ship.zone/ci-spec 2.0.0 → 2.1.0

package/changelog.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 2026-09-27 - 2.1.0
+
+### Features
+
+- export the reserved names of the standard (ci-actions, runner-protocol)
+  - The package exports `reservedEnvironmentPrefix` (`SHIPZONE_CI_`), `matrixEnvironmentName` (`SHIPZONE_CI_MATRIX_JSON`), `inputsEnvironmentName` (`SHIPZONE_CI_INPUTS_JSON`), `reservedStepEnvironmentNames`, `npmUserConfigEnvironmentName` (`NPM_CONFIG_USERCONFIG`), `npmBuildSecretId` (`npmrc`), `reservedImageLabelPrefix` (`zone.ship.ci.`), and `reservedImageLabelKeys` (`org.opencontainers.image.revision`, `org.opencontainers.image.source`, `org.opencontainers.image.version`). The tests check every value against the schemas and the prose.
+- define job failure codes for compiled jobs that are not coherent (runner-protocol)
+  - The new Job Coherence section lists every coherence rule of a compiled job in one table, with exactly one code per rule: `spec_incompatible`, `job_schema_invalid`, `job_secret_incoherent`, `job_limit_incoherent`, `job_resources_incoherent`, `job_environment_incoherent`, `job_command_limit_exceeded`, `job_secret_inadmissible`, and `job_digest_mismatch`, in precedence order; a job that is not coherent carries the code of the first rule it violates. The coordinator and the runner check a job with its secret values inserted. The rules are unchanged: the table gathers the coherence rules of Capabilities and Matching, the environment rules of the OCI Container Profile, the command limit, secret value admissibility, and the plan digest, and marks the rules the compiled job schema enforces. A runner still abandons such a lease as `runner_error`; `AbandonJobRequest` carries no code.
+  - `conformance/runner-job-cases.json` with `conformance/runner-job-cases.schema.json` (exported as `runner-job-cases.json` and `runner-job-cases.schema.json`) lists the codes and 45 cases: every runner job fixture with its outcome, and inline jobs for the version rule. The new `conformance/runner-jobs/incoherent/` holds 15 schema-valid jobs that fail a later rule, and `conformance/runner-jobs/invalid/` gains 6 jobs for the schema-enforced rules that had none. Every code but `job_command_limit_exceeded` has a case that breaks its rule alone.
+  - The package exports `runnerJobFailureCodes`, and `ciSpecAssetPaths` gains `runnerJobCases` and `runnerJobCasesSchema`.
+
+### Fixes
+
+- type-check every test file (package)
+  - The `test:types` script quotes its glob, so `tsbuild check` expands `test/**/*` itself instead of the shell.
+- keep the newer-version compile vectors newer (ci-actions)
+  - `version-newer-before-schema` and `layer-yaml-before-version` declare `spec: 2.999.0` instead of `2.1.0`, which this release accepts.
+
 ## 2026-09-27 - 2.0.0
 
 ### Breaking Changes

package/conformance/compile-cases.json

@@ -1169,7 +1169,7 @@
       "id": "layer-yaml-before-version",
       "description": "An alias and a newer spec: the YAML layer decides.",
       "workflow": {
-        "source": "spec: 2.1.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: &image registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+        "source": "spec: 2.999.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\njobs:\n  test:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: &image registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
       },
       "expected": {
         "outcome": "failed",
@@ -1180,7 +1180,7 @@
       "id": "version-newer-before-schema",
       "description": "A newer minor spec with a property this version does not define fails with spec_incompatible, not a schema error.",
       "workflow": {
-        "source": "spec: 2.1.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\nfutureField: true\njobs:\n  test:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
+        "source": "spec: 2.999.0\non:\n  push: {}\npermissions:\n  source: read\n  artifacts: none\n  caches: none\n  images: none\n  npm: none\n  releaseAssets: none\nfutureField: true\njobs:\n  test:\n    runner:\n      profile: oci\n      labels:\n        - linux\n    execution:\n      profile: oci\n      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n    steps:\n      - run:\n          - pnpm\n          - test\n"
       },
       "expected": {
         "outcome": "failed",