@ship.zone/ci-spec 2.0.0

package/conformance/ci-actions/invalid/unknown-alias-kind.yml

@@ -0,0 +1,31 @@
+spec: 2.0.0
+on:
+  tag:
+    tags:
+      - v*
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: publish
+  npm: none
+  releaseAssets: none
+jobs:
+  image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    build:
+      context: .
+      dockerfile: Dockerfile
+      platforms:
+        - linux/amd64
+publish:
+  images:
+    - candidate: image
+      destinations:
+        - registry: code.foss.global
+          repository: example/app
+          aliases:
+            - kind: branch

package/conformance/ci-actions/invalid/unknown-key.yml

@@ -0,0 +1,24 @@
+spec: 2.0.0
+on:
+  push: {}
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - pnpm
+          - test
+    privileged: true

package/conformance/ci-actions/invalid/vm-darwin-candidate.yml

@@ -0,0 +1,38 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: candidate
+  npm: none
+  releaseAssets: none
+jobs:
+  image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    build:
+      context: .
+      dockerfile: Dockerfile
+      platforms:
+        - linux/arm64
+  test:
+    needs:
+      - image
+    runner:
+      profile: vm
+      labels:
+        - macos
+      platform: darwin/arm64
+    execution:
+      profile: vm
+      image:
+        candidate: image
+    steps:
+      - run:
+          - ./scripts/test.sh

package/conformance/ci-actions/invalid/vm-darwin-shared-memory.yml

@@ -0,0 +1,28 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: vm
+      labels:
+        - linux
+      platform: darwin/arm64
+    execution:
+      profile: vm
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    resources:
+      memoryBytes: 8589934592
+      sharedMemoryBytes: 1073741824
+    steps:
+      - run:
+          - ./scripts/test.sh

package/conformance/ci-actions/invalid/vm-oci-execution.yml

@@ -0,0 +1,25 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: vm
+      labels:
+        - linux
+      platform: linux/amd64
+    execution:
+      profile: oci
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - ./scripts/test.sh

package/conformance/ci-actions/invalid/vm-unsupported-platform.yml

@@ -0,0 +1,25 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: vm
+      labels:
+        - linux
+      platform: darwin/amd64
+    execution:
+      profile: vm
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - ./scripts/test.sh

package/conformance/ci-actions/invalid/vm-without-platform.yml

@@ -0,0 +1,24 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: vm
+      labels:
+        - linux
+    execution:
+      profile: vm
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - ./scripts/test.sh

package/conformance/ci-actions/valid/concurrency.yml

@@ -0,0 +1,83 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+  pullRequest:
+    targetBranches:
+      - main
+  manual: {}
+permissions:
+  source: read
+  artifacts: write
+  caches: read-write
+  images: none
+  npm: none
+  releaseAssets: none
+concurrency:
+  group: test
+  cancelInProgress: false
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - pnpm
+          - test
+    artifacts:
+      - name: test-results
+        path: .nogit/testlogs
+        when: failure
+        required: false
+        maximumBytes: 104857600
+        maximumExtractedBytes: 524288000
+        maximumEntries: 10000
+    caches:
+      - name: pnpm
+        key: pnpm-store
+        paths:
+          - .pnpm-store
+        access: read-write
+        maximumBytes: 1073741824
+        maximumExtractedBytes: 4294967296
+        maximumEntries: 100000
+  build:
+    needs:
+      - test
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    timeoutMs: 86400000
+    steps:
+      - run:
+          - pnpm
+          - build
+    artifacts:
+      - name: dist
+        path: dist
+        when: success
+        required: true
+        maximumBytes: 104857600
+        maximumExtractedBytes: 524288000
+        maximumEntries: 10000
+        retentionDays: 3650
+    caches:
+      - name: pnpm
+        key: pnpm-store
+        paths:
+          - .pnpm-store
+        access: read
+        maximumBytes: 1073741824
+        maximumExtractedBytes: 4294967296
+        maximumEntries: 100000
+        retentionDays: 1

package/conformance/ci-actions/valid/egress.yml

@@ -0,0 +1,40 @@
+spec: 2.0.0
+on:
+  pullRequest:
+    targetBranches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+        - host: '*.githubusercontent.com'
+          ports:
+            - 443
+        - host: mirror.example.org
+          ports:
+            - 80
+            - 443
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - run:
+          - pnpm
+          - test

package/conformance/ci-actions/valid/image-build.yml

@@ -0,0 +1,80 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: read-write
+  images: candidate
+  npm: none
+  releaseAssets: none
+jobs:
+  base-image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    build:
+      context: .
+      dockerfile: base.Dockerfile
+      platforms:
+        - linux/amd64
+        - linux/arm64
+  image:
+    needs:
+      - base-image
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    secrets:
+      - name: npm-token
+        environment: NPM_TOKEN
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: production
+      platforms:
+        - linux/amd64
+        - linux/arm64
+      buildArgs:
+        NODE_ENV: production
+      secrets:
+        - id: npmrc
+          environment: NPM_TOKEN
+      labels:
+        org.opencontainers.image.title: app
+      baseImages:
+        - name: base
+          image:
+            candidate: base-image
+    caches:
+      - name: buildkit
+        key: buildkit
+        access: read-write
+        maximumBytes: 4294967296
+        maximumExtractedBytes: 17179869184
+        maximumEntries: 1000000
+        retentionDays: 14
+  smoke:
+    needs:
+      - image
+    runner:
+      profile: oci
+      labels:
+        - linux
+      platform: linux/arm64
+    execution:
+      profile: oci
+      image:
+        candidate: image
+    steps:
+      - run:
+          - /usr/local/bin/app
+          - --self-test

package/conformance/ci-actions/valid/matrix.yml

@@ -0,0 +1,45 @@
+spec: 2.0.0
+on:
+  manual:
+    inputs:
+      mode:
+        type: choice
+        required: true
+        options:
+          - quick
+          - full
+permissions:
+  source: read
+  artifacts: write
+  caches: read
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    matrix:
+      node:
+        - 22
+        - 24
+      platform:
+        - amd64
+        - arm64
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb
+    steps:
+      - run:
+          - pnpm
+          - test
+    artifacts:
+      - name: results
+        path: .nogit/testlogs
+        when: always
+        required: false
+        maximumBytes: 10485760
+        maximumExtractedBytes: 52428800
+        maximumEntries: 1000

package/conformance/ci-actions/valid/minimal.yml

@@ -0,0 +1,25 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: none
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/test@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    steps:
+      - run:
+          - pnpm
+          - test

package/conformance/ci-actions/valid/npm-read.yml

@@ -0,0 +1,60 @@
+spec: 2.0.0
+on:
+  push:
+    branches:
+      - main
+  tag:
+    tags:
+      - v*
+permissions:
+  source: read
+  artifacts: none
+  caches: none
+  images: candidate
+  npm: none
+  releaseAssets: none
+jobs:
+  test:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+        - host: npm.example.com
+    npmRead:
+      - registry: https://npm.example.com
+        scopes:
+          - '@example_private'
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - run:
+          - pnpm
+          - test
+  image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+        - host: npm.example.com
+    npmRead:
+      - registry: https://npm.example.com
+        scopes:
+          - '@example_private'
+    build:
+      context: .
+      dockerfile: Dockerfile
+      platforms:
+        - linux/amd64

package/conformance/ci-actions/valid/release-assets.yml

@@ -0,0 +1,114 @@
+spec: 2.0.0
+on:
+  tag:
+    tags:
+      - v*
+permissions:
+  source: read
+  artifacts: write
+  caches: none
+  images: publish
+  npm: publish
+  releaseAssets: publish
+jobs:
+  image:
+    runner:
+      profile: oci-image
+      labels:
+        - builder
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    build:
+      context: .
+      dockerfile: Dockerfile_v##version##
+      platforms:
+        - linux/amd64
+  release:
+    runner:
+      profile: oci
+      labels:
+        - linux
+    execution:
+      profile: oci
+      image: registry.example/ci/node@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+    network:
+      mode: egress
+      allow:
+        - host: registry.npmjs.org
+    steps:
+      - run:
+          - pnpm
+          - install
+          - --frozen-lockfile
+      - run:
+          - pnpm
+          - run
+          - release:prepare
+    artifacts:
+      - name: source
+        path: .nogit/release/source
+        when: success
+        required: true
+        maximumBytes: 1073741824
+        maximumExtractedBytes: 1073741824
+        maximumEntries: 16
+      - name: binaries
+        path: .nogit/release/binaries
+        when: success
+        required: true
+        maximumBytes: 1073741824
+        maximumExtractedBytes: 4294967296
+        maximumEntries: 16
+      - name: notes
+        path: .nogit/release/notes
+        when: success
+        required: true
+        maximumBytes: 1048576
+        maximumExtractedBytes: 1048576
+        maximumEntries: 1
+      - name: package
+        path: .nogit/release/package
+        when: success
+        required: true
+        maximumBytes: 104857600
+        maximumExtractedBytes: 104857600
+        maximumEntries: 1
+publish:
+  order:
+    - releaseAssets
+    - npm
+    - images
+  releaseNotes:
+    artifact:
+      job: release
+      name: notes
+  images:
+    - candidate: image
+      destinations:
+        - registry: code.foss.global
+          repository: example/app
+          aliases:
+            - kind: version
+              prefix: v
+            - kind: version
+              prefix: base_
+              suffix: -alpine
+            - kind: literal
+              value: latest
+  npm:
+    - artifact:
+        job: release
+        name: package
+      registries:
+        - https://registry.npmjs.org
+      access: public
+      distTag: latest
+  releaseAssets:
+    - artifact:
+        job: release
+        name: source
+    - artifact:
+        job: release
+        name: binaries