@ship.zone/ci-spec 2.0.0 → 2.1.0

package/conformance/runner-job-cases.json

@@ -0,0 +1,703 @@
+{
+  "spec": "2.1.0",
+  "failureCodes": [
+    "spec_incompatible",
+    "job_schema_invalid",
+    "job_secret_incoherent",
+    "job_limit_incoherent",
+    "job_resources_incoherent",
+    "job_environment_incoherent",
+    "job_command_limit_exceeded",
+    "job_secret_inadmissible",
+    "job_digest_mismatch"
+  ],
+  "cases": [
+    {
+      "id": "fixture-valid-candidate-test",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/candidate-test.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-egress",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/egress.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-image-build",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/image-build.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-minimal",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/minimal.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-npm-read",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/npm-read.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-resources",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/resources.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-timeout-retention-defaults",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/timeout-retention-defaults.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-vm-darwin",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/vm-darwin.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-valid-vm",
+      "job": {
+        "fixture": "conformance/runner-jobs/valid/vm.json"
+      },
+      "expected": {
+        "outcome": "coherent"
+      }
+    },
+    {
+      "id": "fixture-invalid-artifacts-feature-missing",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/artifacts-feature-missing.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-artifacts-none-permission",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/artifacts-none-permission.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-bridge-network",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/bridge-network.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-build-darwin-platform",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/build-darwin-platform.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-build-with-steps",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/build-with-steps.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-build-without-microvm",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/build-without-microvm.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-build-without-push-permission",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/build-without-push-permission.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-egress-empty-allowlist",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/egress-empty-allowlist.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-mutable-image",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/mutable-image.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-npm-read-reserved-environment",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/npm-read-reserved-environment.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-oci-darwin-platform",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/oci-darwin-platform.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-push-permission-container",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/push-permission-container.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-read-write-cache-read-permission",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/read-write-cache-read-permission.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-shared-memory-below-minimum",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/shared-memory-below-minimum.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-source-feature-missing",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/source-feature-missing.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-timeout-missing",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/timeout-missing.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-vm-without-microvm",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/vm-without-microvm.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-invalid-vm-without-platform",
+      "job": {
+        "fixture": "conformance/runner-jobs/invalid/vm-without-platform.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    },
+    {
+      "id": "fixture-incoherent-artifact-maximum-above-limit",
+      "description": "An artifact maximumBytes above maximumArtifactArchiveBytes.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/artifact-maximum-above-limit.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_limit_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-build-secret-unknown-target",
+      "description": "A build secret names an environment that is not a key of secrets.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/build-secret-unknown-target.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_secret_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-cache-count-above-limit",
+      "description": "One cache with maximumCaches 0.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/cache-count-above-limit.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_limit_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-environment-above-limit",
+      "description": "128 step environment names and NPM_CONFIG_USERCONFIG of npmRead: 129 names.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/environment-above-limit.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-plan-digest-mismatch",
+      "description": "timeoutMs changed after the digest was computed.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/plan-digest-mismatch.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_digest_mismatch"
+      }
+    },
+    {
+      "id": "fixture-incoherent-precedence-limit-before-digest",
+      "description": "A source above its limit and a stale digest: the earlier row decides.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/precedence-limit-before-digest.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_limit_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-reserved-prefix-environment",
+      "description": "A step environment name with the reserved prefix that the protocol does not reserve.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/reserved-prefix-environment.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-reserved-prefix-secret-target",
+      "description": "A secret target with the reserved prefix.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/reserved-prefix-secret-target.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-reserved-variable-missing",
+      "description": "A step without SHIPZONE_CI_INPUTS_JSON.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/reserved-variable-missing.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-reserved-variable-not-canonical",
+      "description": "SHIPZONE_CI_MATRIX_JSON is a JSON object but not its RFC 8785 serialization.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/reserved-variable-not-canonical.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-secret-target-environment-duplicate",
+      "description": "A secret target equal to a step environment name.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/secret-target-environment-duplicate.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_environment_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-secret-target-without-build-secret",
+      "description": "A key of secrets that no build secret names.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/secret-target-without-build-secret.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_secret_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-secret-value-too-short",
+      "description": "A secret value of 7 UTF-8 bytes.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/secret-value-too-short.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_secret_inadmissible"
+      }
+    },
+    {
+      "id": "fixture-incoherent-shared-memory-above-memory",
+      "description": "sharedMemoryBytes above memoryBytes.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/shared-memory-above-memory.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_resources_incoherent"
+      }
+    },
+    {
+      "id": "fixture-incoherent-source-above-limit",
+      "description": "A source extractedSizeBytes above maximumSourceExtractedBytes.",
+      "job": {
+        "fixture": "conformance/runner-jobs/incoherent/source-above-limit.json"
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_limit_incoherent"
+      }
+    },
+    {
+      "id": "version-newer",
+      "description": "A canonical spec of a later minor version; otherwise the job is minimal.json.",
+      "job": {
+        "document": {
+          "spec": "2.999.0",
+          "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "compiledPlanDigest": "3803b29c9ccb4029f16217883f4d23d15b2ec5fe2052d010cf2ecc533786d887",
+          "requirements": {
+            "executionProfile": "oci",
+            "isolation": "container",
+            "labels": [
+              "linux"
+            ],
+            "features": [
+              "source.tar-gz"
+            ],
+            "limits": {
+              "maximumSourceArchiveBytes": 1048576,
+              "maximumSourceExtractedBytes": 4194304,
+              "maximumSourceEntries": 1000,
+              "maximumArtifactArchiveBytes": 0,
+              "maximumArtifactExtractedBytes": 0,
+              "maximumArtifactEntries": 0,
+              "maximumArtifacts": 0,
+              "maximumCacheArchiveBytes": 0,
+              "maximumCacheExtractedBytes": 0,
+              "maximumCacheEntries": 0,
+              "maximumCaches": 0,
+              "maximumLogChunkBytes": 65536,
+              "maximumTotalLogBytes": 10485760,
+              "maximumWorkspaceBytes": 268435456,
+              "maximumWorkspaceEntries": 100000
+            }
+          },
+          "permissions": {
+            "source": "read",
+            "artifacts": "none",
+            "caches": "none",
+            "images": "none"
+          },
+          "network": {
+            "mode": "none"
+          },
+          "execution": {
+            "profile": "oci",
+            "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+            "workingDirectory": "/workspace"
+          },
+          "steps": [
+            {
+              "name": "Test",
+              "command": [
+                "pnpm",
+                "test"
+              ],
+              "environment": {
+                "CI": "true",
+                "SHIPZONE_CI_INPUTS_JSON": "{}",
+                "SHIPZONE_CI_MATRIX_JSON": "{}"
+              }
+            }
+          ],
+          "source": {
+            "format": "tar.gz",
+            "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+            "sizeBytes": 1024,
+            "extractedSizeBytes": 4096,
+            "entryCount": 4
+          },
+          "secrets": {},
+          "timeoutMs": 60000,
+          "resources": {
+            "memoryBytes": 268435456,
+            "cpus": 1,
+            "pids": 256
+          },
+          "artifacts": [],
+          "caches": []
+        }
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "spec_incompatible"
+      }
+    },
+    {
+      "id": "version-major-mismatch",
+      "description": "A canonical spec of another major version; otherwise the job is minimal.json.",
+      "job": {
+        "document": {
+          "spec": "1.2.0",
+          "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "compiledPlanDigest": "181ac40a57cc67029f4b3d2d723d4fc9b61fe22e54fefbe16ed71fca1f39fb93",
+          "requirements": {
+            "executionProfile": "oci",
+            "isolation": "container",
+            "labels": [
+              "linux"
+            ],
+            "features": [
+              "source.tar-gz"
+            ],
+            "limits": {
+              "maximumSourceArchiveBytes": 1048576,
+              "maximumSourceExtractedBytes": 4194304,
+              "maximumSourceEntries": 1000,
+              "maximumArtifactArchiveBytes": 0,
+              "maximumArtifactExtractedBytes": 0,
+              "maximumArtifactEntries": 0,
+              "maximumArtifacts": 0,
+              "maximumCacheArchiveBytes": 0,
+              "maximumCacheExtractedBytes": 0,
+              "maximumCacheEntries": 0,
+              "maximumCaches": 0,
+              "maximumLogChunkBytes": 65536,
+              "maximumTotalLogBytes": 10485760,
+              "maximumWorkspaceBytes": 268435456,
+              "maximumWorkspaceEntries": 100000
+            }
+          },
+          "permissions": {
+            "source": "read",
+            "artifacts": "none",
+            "caches": "none",
+            "images": "none"
+          },
+          "network": {
+            "mode": "none"
+          },
+          "execution": {
+            "profile": "oci",
+            "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+            "workingDirectory": "/workspace"
+          },
+          "steps": [
+            {
+              "name": "Test",
+              "command": [
+                "pnpm",
+                "test"
+              ],
+              "environment": {
+                "CI": "true",
+                "SHIPZONE_CI_INPUTS_JSON": "{}",
+                "SHIPZONE_CI_MATRIX_JSON": "{}"
+              }
+            }
+          ],
+          "source": {
+            "format": "tar.gz",
+            "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+            "sizeBytes": 1024,
+            "extractedSizeBytes": 4096,
+            "entryCount": 4
+          },
+          "secrets": {},
+          "timeoutMs": 60000,
+          "resources": {
+            "memoryBytes": 268435456,
+            "cpus": 1,
+            "pids": 256
+          },
+          "artifacts": [],
+          "caches": []
+        }
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "spec_incompatible"
+      }
+    },
+    {
+      "id": "version-malformed",
+      "description": "A malformed spec is a schema failure, not a version failure.",
+      "job": {
+        "document": {
+          "spec": "2.1",
+          "sourceObjectId": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+          "workflowDigest": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+          "compiledPlanDigest": "b3388562a9b8a7ec0335dd726c348d50cd397ff3aa8a894ea00ab50676cbdba1",
+          "requirements": {
+            "executionProfile": "oci",
+            "isolation": "container",
+            "labels": [
+              "linux"
+            ],
+            "features": [
+              "source.tar-gz"
+            ],
+            "limits": {
+              "maximumSourceArchiveBytes": 1048576,
+              "maximumSourceExtractedBytes": 4194304,
+              "maximumSourceEntries": 1000,
+              "maximumArtifactArchiveBytes": 0,
+              "maximumArtifactExtractedBytes": 0,
+              "maximumArtifactEntries": 0,
+              "maximumArtifacts": 0,
+              "maximumCacheArchiveBytes": 0,
+              "maximumCacheExtractedBytes": 0,
+              "maximumCacheEntries": 0,
+              "maximumCaches": 0,
+              "maximumLogChunkBytes": 65536,
+              "maximumTotalLogBytes": 10485760,
+              "maximumWorkspaceBytes": 268435456,
+              "maximumWorkspaceEntries": 100000
+            }
+          },
+          "permissions": {
+            "source": "read",
+            "artifacts": "none",
+            "caches": "none",
+            "images": "none"
+          },
+          "network": {
+            "mode": "none"
+          },
+          "execution": {
+            "profile": "oci",
+            "image": "registry.example/ci@sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+            "workingDirectory": "/workspace"
+          },
+          "steps": [
+            {
+              "name": "Test",
+              "command": [
+                "pnpm",
+                "test"
+              ],
+              "environment": {
+                "CI": "true",
+                "SHIPZONE_CI_INPUTS_JSON": "{}",
+                "SHIPZONE_CI_MATRIX_JSON": "{}"
+              }
+            }
+          ],
+          "source": {
+            "format": "tar.gz",
+            "sha256": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+            "sizeBytes": 1024,
+            "extractedSizeBytes": 4096,
+            "entryCount": 4
+          },
+          "secrets": {},
+          "timeoutMs": 60000,
+          "resources": {
+            "memoryBytes": 268435456,
+            "cpus": 1,
+            "pids": 256
+          },
+          "artifacts": [],
+          "caches": []
+        }
+      },
+      "expected": {
+        "outcome": "incoherent",
+        "code": "job_schema_invalid"
+      }
+    }
+  ]
+}