@ship.zone/ci-spec 2.0.0 → 2.1.1

package/changelog.md

@@ -1,5 +1,38 @@
 # Changelog
 
+## 2026-09-27 - 2.1.1
+
+### Fixes
+
+- state the YAML 1.2 character, byte order mark, escape, and document rules, and bound nesting depth (ci-actions)
+  - A C0 control character other than tab, line feed, and carriage return fails with `workflow_yaml_syntax` anywhere, including in a quoted scalar. DEL, C1 control characters other than NEL, U+FFFE, U+FFFF, and U+FEFF are content inside a quoted scalar, as YAML 1.2 requires for JSON compatibility, and fail with `workflow_yaml_syntax` anywhere else.
+  - Runs of U+FEFF at the start of a line are byte order marks, not content, before the line on which the document begins, on that line, after a document end marker `...`, and after the document's content when only blank and comment lines follow up to the end of the file or the next `---` or `...` marker, as YAML 1.2 allows a document prefix after a document; the file's own leading byte order mark is the first of them. Any other U+FEFF outside a quoted scalar fails with `workflow_yaml_syntax`.
+  - A `\u` high surrogate escape directly followed by a `\u` low surrogate escape denotes one supplementary character, as in JSON; every other escape of a surrogate code point, which RFC 8785 cannot serialize, fails with `workflow_yaml_syntax`.
+  - Collections nest at most 64 deep, eight times the depth of the deepest collection a schema-valid workflow holds; a collection of depth 65 fails with `workflow_yaml_syntax`, so a parser can stop there instead of exhausting its stack. Only workflows that fail schema validation are affected.
+  - Documents are counted as YAML 1.2 counts them: a `---` marker or content begins a document, and `...` markers, comments, blank lines, and byte order marks begin none. A file of only `...` fails with `workflow_yaml_document_count`, a document followed by several `...` markers is one document, and `--- # comment` is one empty document that fails schema validation.
+  - Adds 22 compile vectors: 15 YAML-layer failures, 2 workflows that pass the YAML layer and fail schema validation (depth 64 and an empty explicit document), and 5 compiled workflows that fix byte order mark lines before and after the document, `...` markers, and quoted-scalar content. The test's reference YAML layer decides them.
+- apply the 16 KiB command argument limit to UTF-8 bytes (ci-actions, runner-protocol)
+  - Protocol Limits already counted the argument limit after UTF-8 encoding. A command argument of more than 16,384 UTF-8 bytes now has its codes: compilation fails with `command_limit_exceeded`, and Job Coherence lists the rule under `job_command_limit_exceeded`. The schemas keep `maxLength` 16,384, which counts characters.
+  - Adds the compile vector `workflow-command-argument-above-limit` and the runner job fixture `conformance/runner-jobs/incoherent/command-argument-above-limit.json`, an argument of 8,193 characters and 16,385 bytes, so every job failure code now has a case.
+
+## 2026-09-27 - 2.1.0
+
+### Features
+
+- export the reserved names of the standard (ci-actions, runner-protocol)
+  - The package exports `reservedEnvironmentPrefix` (`SHIPZONE_CI_`), `matrixEnvironmentName` (`SHIPZONE_CI_MATRIX_JSON`), `inputsEnvironmentName` (`SHIPZONE_CI_INPUTS_JSON`), `reservedStepEnvironmentNames`, `npmUserConfigEnvironmentName` (`NPM_CONFIG_USERCONFIG`), `npmBuildSecretId` (`npmrc`), `reservedImageLabelPrefix` (`zone.ship.ci.`), and `reservedImageLabelKeys` (`org.opencontainers.image.revision`, `org.opencontainers.image.source`, `org.opencontainers.image.version`). The tests check every value against the schemas and the prose.
+- define job failure codes for compiled jobs that are not coherent (runner-protocol)
+  - The new Job Coherence section lists every coherence rule of a compiled job in one table, with exactly one code per rule: `spec_incompatible`, `job_schema_invalid`, `job_secret_incoherent`, `job_limit_incoherent`, `job_resources_incoherent`, `job_environment_incoherent`, `job_command_limit_exceeded`, `job_secret_inadmissible`, and `job_digest_mismatch`, in precedence order; a job that is not coherent carries the code of the first rule it violates. The coordinator and the runner check a job with its secret values inserted. The rules are unchanged: the table gathers the coherence rules of Capabilities and Matching, the environment rules of the OCI Container Profile, the command limit, secret value admissibility, and the plan digest, and marks the rules the compiled job schema enforces. A runner still abandons such a lease as `runner_error`; `AbandonJobRequest` carries no code.
+  - `conformance/runner-job-cases.json` with `conformance/runner-job-cases.schema.json` (exported as `runner-job-cases.json` and `runner-job-cases.schema.json`) lists the codes and 45 cases: every runner job fixture with its outcome, and inline jobs for the version rule. The new `conformance/runner-jobs/incoherent/` holds 15 schema-valid jobs that fail a later rule, and `conformance/runner-jobs/invalid/` gains 6 jobs for the schema-enforced rules that had none. Every code but `job_command_limit_exceeded` has a case that breaks its rule alone.
+  - The package exports `runnerJobFailureCodes`, and `ciSpecAssetPaths` gains `runnerJobCases` and `runnerJobCasesSchema`.
+
+### Fixes
+
+- type-check every test file (package)
+  - The `test:types` script quotes its glob, so `tsbuild check` expands `test/**/*` itself instead of the shell.
+- keep the newer-version compile vectors newer (ci-actions)
+  - `version-newer-before-schema` and `layer-yaml-before-version` declare `spec: 2.999.0` instead of `2.1.0`, which this release accepts.
+
 ## 2026-09-27 - 2.0.0
 
 ### Breaking Changes