@ship.zone/ci-spec 2.0.0

package/schemas/ci_actions.schema.json

@@ -0,0 +1,1664 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ship.zone/spec/ci/schemas/ci_actions.schema.json",
+  "title": "ship.zone ci_actions.yml",
+  "description": "Source-controlled CI workflow compiled by a coordinator from an exact repository commit.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["spec", "on", "permissions", "jobs"],
+  "properties": {
+    "spec": {
+      "$ref": "#/$defs/specVersion"
+    },
+    "on": {
+      "$ref": "#/$defs/triggers"
+    },
+    "permissions": {
+      "$ref": "#/$defs/workflowPermissions"
+    },
+    "concurrency": {
+      "$ref": "#/$defs/concurrency"
+    },
+    "environment": {
+      "$ref": "#/$defs/environment"
+    },
+    "jobs": {
+      "type": "object",
+      "minProperties": 1,
+      "maxProperties": 128,
+      "propertyNames": {
+        "$ref": "#/$defs/identifier"
+      },
+      "additionalProperties": {
+        "$ref": "#/$defs/job"
+      }
+    },
+    "publish": {
+      "$ref": "#/$defs/publish"
+    }
+  },
+  "allOf": [
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "publish": {}
+        },
+        "required": ["publish"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "on": {
+            "type": "object",
+            "properties": {
+              "tag": {}
+            },
+            "required": ["tag"]
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "permissions": {
+            "type": "object",
+            "properties": {
+              "images": {
+                "const": "publish"
+              }
+            },
+            "required": ["images"]
+          }
+        },
+        "required": ["permissions"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "images": {}
+            },
+            "required": ["images"]
+          }
+        },
+        "required": ["publish"]
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "images": false
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "permissions": {
+            "type": "object",
+            "properties": {
+              "npm": {
+                "const": "publish"
+              }
+            },
+            "required": ["npm"]
+          }
+        },
+        "required": ["permissions"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "npm": {}
+            },
+            "required": ["npm"]
+          }
+        },
+        "required": ["publish"]
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "npm": false
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "permissions": {
+            "type": "object",
+            "properties": {
+              "releaseAssets": {
+                "const": "publish"
+              }
+            },
+            "required": ["releaseAssets"]
+          }
+        },
+        "required": ["permissions"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "releaseAssets": {}
+            },
+            "required": ["releaseAssets"]
+          }
+        },
+        "required": ["publish"]
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "publish": {
+            "type": "object",
+            "properties": {
+              "releaseAssets": false
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "on": {
+            "type": "object",
+            "not": {
+              "type": "object",
+              "properties": {
+                "push": {}
+              },
+              "required": ["push"]
+            }
+          }
+        },
+        "required": ["on"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "jobs": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "triggers": {
+                  "type": "array",
+                  "not": {
+                    "contains": {
+                      "const": "push"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "on": {
+            "type": "object",
+            "not": {
+              "type": "object",
+              "properties": {
+                "tag": {}
+              },
+              "required": ["tag"]
+            }
+          }
+        },
+        "required": ["on"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "jobs": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "triggers": {
+                  "type": "array",
+                  "not": {
+                    "contains": {
+                      "const": "tag"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "on": {
+            "type": "object",
+            "not": {
+              "type": "object",
+              "properties": {
+                "pullRequest": {}
+              },
+              "required": ["pullRequest"]
+            }
+          }
+        },
+        "required": ["on"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "jobs": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "triggers": {
+                  "type": "array",
+                  "not": {
+                    "contains": {
+                      "const": "pullRequest"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    {
+      "if": {
+        "type": "object",
+        "properties": {
+          "on": {
+            "type": "object",
+            "not": {
+              "type": "object",
+              "properties": {
+                "manual": {}
+              },
+              "required": ["manual"]
+            }
+          }
+        },
+        "required": ["on"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "jobs": {
+            "type": "object",
+            "additionalProperties": {
+              "type": "object",
+              "properties": {
+                "triggers": {
+                  "type": "array",
+                  "not": {
+                    "contains": {
+                      "const": "manual"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "$defs": {
+    "specVersion": {
+      "description": "A released @ship.zone/ci-spec package version in canonical MAJOR.MINOR.PATCH form without prerelease or build metadata. Each component has at most 15 digits, so every component is a safe integer.",
+      "type": "string",
+      "pattern": "^(?:0|[1-9][0-9]{0,14})\\.(?:0|[1-9][0-9]{0,14})\\.(?:0|[1-9][0-9]{0,14})$"
+    },
+    "containerProfile": {
+      "const": "oci"
+    },
+    "imageBuildProfile": {
+      "const": "oci-image"
+    },
+    "vmProfile": {
+      "const": "vm"
+    },
+    "executionProfile": {
+      "anyOf": [
+        {
+          "$ref": "#/$defs/containerProfile"
+        },
+        {
+          "$ref": "#/$defs/imageBuildProfile"
+        },
+        {
+          "$ref": "#/$defs/vmProfile"
+        }
+      ]
+    },
+    "triggerKind": {
+      "enum": ["push", "tag", "pullRequest", "manual"]
+    },
+    "identifier": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$"
+    },
+    "objectId": {
+      "type": "string",
+      "minLength": 40,
+      "maxLength": 64,
+      "pattern": "^[a-f0-9]+$"
+    },
+    "branchPatterns": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 256
+      }
+    },
+    "triggers": {
+      "type": "object",
+      "additionalProperties": false,
+      "minProperties": 1,
+      "properties": {
+        "push": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "branches": {
+              "$ref": "#/$defs/branchPatterns"
+            }
+          }
+        },
+        "tag": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "tags": {
+              "$ref": "#/$defs/branchPatterns"
+            }
+          }
+        },
+        "pullRequest": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "targetBranches": {
+              "$ref": "#/$defs/branchPatterns"
+            }
+          }
+        },
+        "manual": {
+          "$ref": "#/$defs/manualTrigger"
+        }
+      }
+    },
+    "manualTrigger": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "inputs": {
+          "type": "object",
+          "maxProperties": 32,
+          "propertyNames": {
+            "$ref": "#/$defs/identifier"
+          },
+          "additionalProperties": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": ["type", "required"],
+            "properties": {
+              "type": {
+                "enum": ["string", "boolean", "choice"]
+              },
+              "required": {
+                "type": "boolean"
+              },
+              "description": {
+                "type": "string",
+                "maxLength": 512
+              },
+              "options": {
+                "type": "array",
+                "minItems": 1,
+                "maxItems": 64,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string",
+                  "maxLength": 256
+                }
+              }
+            },
+            "allOf": [
+              {
+                "if": {
+                  "properties": {
+                    "type": {
+                      "const": "choice"
+                    }
+                  },
+                  "required": ["type"]
+                },
+                "then": {
+                  "properties": {
+                    "options": {}
+                  },
+                  "required": ["options"]
+                },
+                "else": {
+                  "not": {
+                    "required": ["options"]
+                  }
+                }
+              }
+            ]
+          }
+        }
+      }
+    },
+    "workflowPermissions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "artifacts", "caches", "images", "npm", "releaseAssets"],
+      "properties": {
+        "source": {
+          "const": "read"
+        },
+        "artifacts": {
+          "enum": ["none", "write"]
+        },
+        "caches": {
+          "enum": ["none", "read", "read-write"]
+        },
+        "images": {
+          "enum": ["none", "candidate", "publish"]
+        },
+        "npm": {
+          "enum": ["none", "publish"]
+        },
+        "releaseAssets": {
+          "enum": ["none", "publish"]
+        }
+      }
+    },
+    "jobPermissions": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["source", "artifacts", "caches", "images"],
+      "properties": {
+        "source": {
+          "const": "read"
+        },
+        "artifacts": {
+          "enum": ["none", "write"]
+        },
+        "caches": {
+          "enum": ["none", "read", "read-write"]
+        },
+        "images": {
+          "enum": ["none", "candidate"]
+        }
+      }
+    },
+    "concurrency": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["group", "cancelInProgress"],
+      "properties": {
+        "group": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "cancelInProgress": {
+          "type": "boolean"
+        }
+      }
+    },
+    "job": {
+      "type": "object",
+      "unevaluatedProperties": false,
+      "required": ["runner"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "needs": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/identifier"
+          }
+        },
+        "triggers": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 4,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/triggerKind"
+          }
+        },
+        "runner": {
+          "$ref": "#/$defs/runner"
+        },
+        "permissions": {
+          "$ref": "#/$defs/jobPermissions"
+        },
+        "secrets": {
+          "type": "array",
+          "maxItems": 128,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/secretReference"
+          }
+        },
+        "network": {
+          "$ref": "#/$defs/network"
+        },
+        "timeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 86400000
+        },
+        "resources": {
+          "$ref": "#/$defs/resources"
+        },
+        "npmRead": {
+          "$ref": "#/$defs/npmRead"
+        }
+      },
+      "oneOf": [
+        {
+          "$ref": "#/$defs/containerJob"
+        },
+        {
+          "$ref": "#/$defs/imageBuildJob"
+        },
+        {
+          "$ref": "#/$defs/vmJob"
+        }
+      ]
+    },
+    "containerJob": {
+      "type": "object",
+      "required": ["execution", "steps"],
+      "properties": {
+        "runner": {
+          "type": "object",
+          "properties": {
+            "profile": {
+              "$ref": "#/$defs/containerProfile"
+            },
+            "platform": {
+              "$ref": "#/$defs/linuxPlatform"
+            }
+          }
+        },
+        "matrix": {
+          "$ref": "#/$defs/matrix"
+        },
+        "execution": {
+          "$ref": "#/$defs/ociExecution"
+        },
+        "environment": {
+          "$ref": "#/$defs/environment"
+        },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/step"
+          }
+        },
+        "artifacts": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/artifact"
+          }
+        },
+        "caches": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "$ref": "#/$defs/cache"
+          }
+        }
+      }
+    },
+    "imageBuildJob": {
+      "type": "object",
+      "required": ["build"],
+      "properties": {
+        "runner": {
+          "type": "object",
+          "properties": {
+            "profile": {
+              "$ref": "#/$defs/imageBuildProfile"
+            },
+            "platform": false
+          }
+        },
+        "build": {
+          "$ref": "#/$defs/imageBuild"
+        },
+        "caches": {
+          "type": "array",
+          "maxItems": 1,
+          "items": {
+            "$ref": "#/$defs/buildCache"
+          }
+        }
+      }
+    },
+    "vmJob": {
+      "type": "object",
+      "required": ["execution", "steps"],
+      "properties": {
+        "runner": {
+          "type": "object",
+          "required": ["platform"],
+          "properties": {
+            "profile": {
+              "$ref": "#/$defs/vmProfile"
+            },
+            "platform": {
+              "$ref": "#/$defs/vmPlatform"
+            }
+          }
+        },
+        "matrix": {
+          "$ref": "#/$defs/matrix"
+        },
+        "execution": {
+          "$ref": "#/$defs/vmExecution"
+        },
+        "environment": {
+          "$ref": "#/$defs/environment"
+        },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 128,
+          "items": {
+            "$ref": "#/$defs/step"
+          }
+        },
+        "artifacts": {
+          "type": "array",
+          "maxItems": 64,
+          "items": {
+            "$ref": "#/$defs/artifact"
+          }
+        },
+        "caches": {
+          "type": "array",
+          "maxItems": 32,
+          "items": {
+            "$ref": "#/$defs/cache"
+          }
+        }
+      },
+      "allOf": [
+        {
+          "$ref": "#/$defs/darwinGuestRestrictions"
+        }
+      ]
+    },
+    "darwinGuestRestrictions": {
+      "description": "A darwin guest boots a digest-pinned VM image and has no /dev/shm.",
+      "if": {
+        "type": "object",
+        "properties": {
+          "runner": {
+            "type": "object",
+            "properties": {
+              "platform": {
+                "const": "darwin/arm64"
+              }
+            },
+            "required": ["platform"]
+          }
+        },
+        "required": ["runner"]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "execution": {
+            "type": "object",
+            "properties": {
+              "image": {
+                "$ref": "#/$defs/pinnedImage"
+              }
+            }
+          },
+          "resources": {
+            "type": "object",
+            "properties": {
+              "sharedMemoryBytes": false
+            }
+          }
+        }
+      }
+    },
+    "runner": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["profile", "labels"],
+      "properties": {
+        "profile": {
+          "$ref": "#/$defs/executionProfile"
+        },
+        "labels": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/identifier"
+          }
+        },
+        "platform": {
+          "$ref": "#/$defs/platform"
+        }
+      }
+    },
+    "platform": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 64,
+      "pattern": "^[a-z0-9]+/[a-z0-9_]+(?:/[a-z0-9]+)?$"
+    },
+    "network": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode"],
+          "properties": {
+            "mode": {
+              "const": "none"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["mode", "allow"],
+          "properties": {
+            "mode": {
+              "const": "egress"
+            },
+            "allow": {
+              "type": "array",
+              "minItems": 1,
+              "maxItems": 64,
+              "uniqueItems": true,
+              "items": {
+                "$ref": "#/$defs/egressRule"
+              }
+            }
+          }
+        }
+      ]
+    },
+    "egressRule": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["host"],
+      "properties": {
+        "host": {
+          "$ref": "#/$defs/egressHost"
+        },
+        "ports": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {
+            "type": "integer",
+            "minimum": 1,
+            "maximum": 65535
+          }
+        }
+      }
+    },
+    "egressHost": {
+      "type": "string",
+      "minLength": 3,
+      "maxLength": 253,
+      "pattern": "^(?:\\*\\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?$"
+    },
+    "pinnedImage": {
+      "type": "string",
+      "minLength": 73,
+      "maxLength": 1024,
+      "pattern": "^[^\\s@]+@sha256:[a-f0-9]{64}$"
+    },
+    "candidateReference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidate"],
+      "properties": {
+        "candidate": {
+          "$ref": "#/$defs/identifier"
+        }
+      }
+    },
+    "imageReference": {
+      "oneOf": [
+        {
+          "$ref": "#/$defs/pinnedImage"
+        },
+        {
+          "$ref": "#/$defs/candidateReference"
+        }
+      ]
+    },
+    "ociExecution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["profile", "image"],
+      "properties": {
+        "profile": {
+          "$ref": "#/$defs/containerProfile"
+        },
+        "image": {
+          "$ref": "#/$defs/imageReference"
+        },
+        "workingDirectory": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^/[A-Za-z0-9._/-]+$"
+        }
+      }
+    },
+    "vmExecution": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["profile", "image"],
+      "properties": {
+        "profile": {
+          "$ref": "#/$defs/vmProfile"
+        },
+        "image": {
+          "$ref": "#/$defs/imageReference"
+        },
+        "workingDirectory": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256,
+          "pattern": "^/[A-Za-z0-9._/-]+$"
+        }
+      }
+    },
+    "linuxPlatform": {
+      "description": "Platforms of the oci and oci-image profiles, which execute only linux.",
+      "type": "string",
+      "allOf": [
+        {
+          "$ref": "#/$defs/platform"
+        }
+      ],
+      "pattern": "^linux/"
+    },
+    "vmPlatform": {
+      "description": "Guest platforms of the vm profile: every linux platform, and darwin/arm64.",
+      "anyOf": [
+        {
+          "$ref": "#/$defs/linuxPlatform"
+        },
+        {
+          "const": "darwin/arm64"
+        }
+      ]
+    },
+    "imageBuild": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["context", "dockerfile", "platforms"],
+      "properties": {
+        "context": {
+          "$ref": "#/$defs/relativePath"
+        },
+        "dockerfile": {
+          "$ref": "#/$defs/relativePath"
+        },
+        "target": {
+          "$ref": "#/$defs/identifier"
+        },
+        "platforms": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/linuxPlatform"
+          }
+        },
+        "buildArgs": {
+          "$ref": "#/$defs/buildArgs"
+        },
+        "secrets": {
+          "type": "array",
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/buildSecret"
+          }
+        },
+        "labels": {
+          "type": "object",
+          "maxProperties": 60,
+          "propertyNames": {
+            "maxLength": 128,
+            "pattern": "^[a-z0-9]+(?:[._-][a-z0-9]+)*$",
+            "not": {
+              "anyOf": [
+                {
+                  "enum": ["org.opencontainers.image.revision", "org.opencontainers.image.source", "org.opencontainers.image.version"]
+                },
+                {
+                  "pattern": "^zone\\.ship\\.ci\\."
+                }
+              ]
+            }
+          },
+          "additionalProperties": {
+            "type": "string",
+            "maxLength": 4096
+          }
+        },
+        "baseImages": {
+          "type": "array",
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/baseImage"
+          }
+        }
+      }
+    },
+    "buildArgs": {
+      "type": "object",
+      "maxProperties": 64,
+      "propertyNames": {
+        "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,127}$",
+        "not": {
+          "pattern": "^BUILDKIT_"
+        }
+      },
+      "additionalProperties": {
+        "type": "string",
+        "maxLength": 65536
+      }
+    },
+    "buildSecret": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "environment"],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/identifier"
+        },
+        "environment": {
+          "type": "string",
+          "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+        }
+      }
+    },
+    "baseImage": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "image"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[a-z0-9][a-z0-9._-]{0,63}$"
+        },
+        "image": {
+          "$ref": "#/$defs/imageReference"
+        }
+      }
+    },
+    "matrix": {
+      "type": "object",
+      "minProperties": 1,
+      "maxProperties": 8,
+      "propertyNames": {
+        "$ref": "#/$defs/identifier"
+      },
+      "additionalProperties": {
+        "type": "array",
+        "minItems": 1,
+        "maxItems": 32,
+        "uniqueItems": true,
+        "items": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "number",
+              "minimum": -9007199254740991,
+              "maximum": 9007199254740991
+            },
+            {
+              "type": "boolean"
+            }
+          ]
+        }
+      }
+    },
+    "step": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["run"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "run": {
+          "$ref": "#/$defs/command"
+        },
+        "environment": {
+          "$ref": "#/$defs/environment"
+        }
+      }
+    },
+    "command": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 128,
+      "items": {
+        "type": "string",
+        "minLength": 1,
+        "maxLength": 16384
+      }
+    },
+    "environment": {
+      "type": "object",
+      "maxProperties": 128,
+      "propertyNames": {
+        "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+      },
+      "additionalProperties": {
+        "type": "string",
+        "maxLength": 65536
+      }
+    },
+    "secretReference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "environment"],
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/identifier"
+        },
+        "environment": {
+          "type": "string",
+          "pattern": "^[A-Z_][A-Z0-9_]{0,127}$"
+        }
+      }
+    },
+    "resources": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "memoryBytes": {
+          "type": "integer",
+          "minimum": 16777216,
+          "maximum": 1099511627776
+        },
+        "cpus": {
+          "type": "number",
+          "exclusiveMinimum": 0,
+          "maximum": 1024
+        },
+        "pids": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1048576
+        },
+        "sharedMemoryBytes": {
+          "type": "integer",
+          "minimum": 1048576,
+          "maximum": 1099511627776
+        },
+        "workspaceBytes": {
+          "type": "integer",
+          "minimum": 16777216,
+          "maximum": 1099511627776
+        },
+        "workspaceEntries": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 2000000
+        }
+      }
+    },
+    "artifact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "path", "when", "required", "maximumBytes", "maximumExtractedBytes", "maximumEntries"],
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/identifier"
+        },
+        "path": {
+          "$ref": "#/$defs/relativePath"
+        },
+        "when": {
+          "enum": ["always", "success", "failure"]
+        },
+        "required": {
+          "type": "boolean"
+        },
+        "maximumBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 17179869184
+        },
+        "maximumExtractedBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 137438953472
+        },
+        "maximumEntries": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000000
+        },
+        "retentionDays": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 3650
+        }
+      }
+    },
+    "cacheDeclaration": {
+      "type": "object",
+      "required": ["name", "key", "access", "maximumBytes", "maximumExtractedBytes", "maximumEntries"],
+      "properties": {
+        "name": {
+          "$ref": "#/$defs/identifier"
+        },
+        "key": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "access": {
+          "enum": ["read", "read-write"]
+        },
+        "maximumBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 17179869184
+        },
+        "maximumExtractedBytes": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 137438953472
+        },
+        "maximumEntries": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 1000000
+        },
+        "retentionDays": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 3650
+        }
+      }
+    },
+    "cache": {
+      "$ref": "#/$defs/cacheDeclaration",
+      "type": "object",
+      "unevaluatedProperties": false,
+      "required": ["paths"],
+      "properties": {
+        "paths": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 32,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/relativePath"
+          }
+        }
+      }
+    },
+    "buildCache": {
+      "$ref": "#/$defs/cacheDeclaration",
+      "type": "object",
+      "unevaluatedProperties": false
+    },
+    "publicationKind": {
+      "enum": ["images", "npm", "releaseAssets"]
+    },
+    "publish": {
+      "type": "object",
+      "additionalProperties": false,
+      "minProperties": 1,
+      "dependentRequired": {
+        "releaseNotes": ["releaseAssets"]
+      },
+      "allOf": [
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {},
+              "images": {}
+            },
+            "required": ["order", "images"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "images"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {},
+              "npm": {}
+            },
+            "required": ["order", "npm"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "npm"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {},
+              "releaseAssets": {}
+            },
+            "required": ["order", "releaseAssets"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "releaseAssets"
+                }
+              }
+            }
+          }
+        },
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "images"
+                }
+              }
+            },
+            "required": ["order"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "images": {}
+            },
+            "required": ["images"]
+          }
+        },
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "npm"
+                }
+              }
+            },
+            "required": ["order"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "npm": {}
+            },
+            "required": ["npm"]
+          }
+        },
+        {
+          "if": {
+            "type": "object",
+            "properties": {
+              "order": {
+                "type": "array",
+                "contains": {
+                  "const": "releaseAssets"
+                }
+              }
+            },
+            "required": ["order"]
+          },
+          "then": {
+            "type": "object",
+            "properties": {
+              "releaseAssets": {}
+            },
+            "required": ["releaseAssets"]
+          }
+        }
+      ],
+      "properties": {
+        "order": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 3,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/publicationKind"
+          }
+        },
+        "releaseNotes": {
+          "$ref": "#/$defs/releaseNotesPublication"
+        },
+        "images": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {
+            "$ref": "#/$defs/imagePublication"
+          }
+        },
+        "npm": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "items": {
+            "$ref": "#/$defs/npmPublication"
+          }
+        },
+        "releaseAssets": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 64,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/releaseAssetPublication"
+          }
+        }
+      }
+    },
+    "imagePublication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["candidate", "destinations"],
+      "properties": {
+        "candidate": {
+          "$ref": "#/$defs/identifier"
+        },
+        "destinations": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/imageDestination"
+          }
+        }
+      }
+    },
+    "imageDestination": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["registry", "repository", "aliases"],
+      "properties": {
+        "registry": {
+          "$ref": "#/$defs/registryHost"
+        },
+        "repository": {
+          "$ref": "#/$defs/ociRepository"
+        },
+        "aliases": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/imageAlias"
+          }
+        }
+      }
+    },
+    "imageAlias": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind"],
+          "properties": {
+            "kind": {
+              "const": "version"
+            },
+            "prefix": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,63}$"
+            },
+            "suffix": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 64,
+              "pattern": "^[A-Za-z0-9._-]{1,64}$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["kind", "value"],
+          "properties": {
+            "kind": {
+              "const": "literal"
+            },
+            "value": {
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 128,
+              "pattern": "^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$"
+            }
+          }
+        }
+      ]
+    },
+    "npmPublication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["artifact", "registries", "access", "distTag"],
+      "properties": {
+        "artifact": {
+          "$ref": "#/$defs/artifactReference"
+        },
+        "registries": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 8,
+          "uniqueItems": true,
+          "items": {
+            "$ref": "#/$defs/npmRegistry"
+          }
+        },
+        "access": {
+          "enum": ["public", "restricted"]
+        },
+        "distTag": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 64,
+          "pattern": "^[a-z][a-z0-9._-]{0,63}$"
+        }
+      }
+    },
+    "npmRegistry": {
+      "type": "string",
+      "minLength": 9,
+      "maxLength": 1024,
+      "pattern": "^https://[a-z0-9.-]+(?::[0-9]{1,5})?(?:/[^\\s?#]*)?$"
+    },
+    "npmScope": {
+      "type": "string",
+      "minLength": 2,
+      "maxLength": 129,
+      "pattern": "^@[a-z0-9~-][a-z0-9_.~-]{0,127}$"
+    },
+    "npmRead": {
+      "description": "Attempt-scoped read access to npm packages of the listed scopes on the listed registries.",
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 8,
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["registry", "scopes"],
+        "properties": {
+          "registry": {
+            "$ref": "#/$defs/npmRegistry"
+          },
+          "scopes": {
+            "type": "array",
+            "minItems": 1,
+            "maxItems": 16,
+            "uniqueItems": true,
+            "items": {
+              "$ref": "#/$defs/npmScope"
+            }
+          }
+        }
+      }
+    },
+    "releaseNotesPublication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["artifact"],
+      "properties": {
+        "artifact": {
+          "$ref": "#/$defs/artifactReference"
+        }
+      }
+    },
+    "releaseAssetPublication": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["artifact"],
+      "properties": {
+        "artifact": {
+          "$ref": "#/$defs/artifactReference"
+        }
+      }
+    },
+    "artifactReference": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["job", "name"],
+      "properties": {
+        "job": {
+          "$ref": "#/$defs/identifier"
+        },
+        "name": {
+          "$ref": "#/$defs/identifier"
+        }
+      }
+    },
+    "registryHost": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 253,
+      "pattern": "^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$"
+    },
+    "ociRepository": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 255,
+      "pattern": "^[a-z0-9]+(?:(?:\\.|_|__|-+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:\\.|_|__|-+)[a-z0-9]+)*)*$"
+    },
+    "relativePath": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 1024,
+      "pattern": "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$))(?!.*\\u0000).+$"
+    }
+  }
+}