@ship.zone/ci-spec 2.0.0

package/conformance/compile-cases.schema.json

@@ -0,0 +1,766 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://ship.zone/spec/ci/conformance/compile-cases.schema.json",
+  "title": "ship.zone ci_actions.yml compile vectors",
+  "description": "Conformance vectors for ci_actions.yml compilation: the ordered failure codes, trigger pattern and tag version vectors, and cases that bind a workflow, a run context, and a deployment policy to the expected failure code, to not-triggered, or to the compiled nodes and plan digests.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "spec",
+    "failureCodes",
+    "patternCases",
+    "tagVersionCases",
+    "cases"
+  ],
+  "properties": {
+    "spec": {
+      "$ref": "../schemas/runner-job.schema.json#/$defs/specVersion"
+    },
+    "failureCodes": {
+      "description": "Every compilation failure code in the precedence order of spec/ci-actions.md, Compilation Failures.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "code",
+          "layer"
+        ],
+        "properties": {
+          "code": {
+            "$ref": "#/$defs/failureCode"
+          },
+          "layer": {
+            "$ref": "#/$defs/failureLayer"
+          }
+        }
+      }
+    },
+    "patternCases": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/patternCase"
+      }
+    },
+    "tagVersionCases": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/tagVersionCase"
+      }
+    },
+    "cases": {
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/compileCase"
+      }
+    }
+  },
+  "$defs": {
+    "identifier": {
+      "$ref": "../schemas/runner-job.schema.json#/$defs/identifier"
+    },
+    "failureLayer": {
+      "enum": [
+        "source",
+        "yaml",
+        "version",
+        "schema",
+        "workflow",
+        "policy",
+        "run"
+      ]
+    },
+    "failureCode": {
+      "enum": [
+        "workflow_too_large",
+        "workflow_encoding_invalid",
+        "workflow_yaml_syntax",
+        "workflow_yaml_document_count",
+        "workflow_yaml_directive",
+        "workflow_yaml_duplicate_key",
+        "workflow_yaml_key_type",
+        "workflow_yaml_anchor",
+        "workflow_yaml_merge_key",
+        "workflow_yaml_tag",
+        "workflow_number_invalid",
+        "spec_incompatible",
+        "workflow_schema_invalid",
+        "trigger_pattern_invalid",
+        "needs_unknown",
+        "needs_cycle",
+        "expansion_limit_exceeded",
+        "needs_trigger_wider",
+        "trigger_kind_unused",
+        "permission_escalation",
+        "permission_insufficient",
+        "environment_conflict",
+        "environment_limit_exceeded",
+        "command_limit_exceeded",
+        "transfer_name_duplicate",
+        "cache_path_overlap",
+        "resources_invalid",
+        "network_host_duplicate",
+        "npm_read_invalid",
+        "build_input_conflict",
+        "candidate_reference_invalid",
+        "candidate_platform_missing",
+        "publish_reference_invalid",
+        "policy_limit_exceeded",
+        "policy_timeout_exceeded",
+        "policy_retention_exceeded",
+        "policy_egress_denied",
+        "policy_npm_registry_denied",
+        "policy_denied",
+        "manual_input_invalid",
+        "tag_version_required",
+        "alias_invalid",
+        "alias_duplicate",
+        "secret_untrusted",
+        "npm_read_untrusted",
+        "secret_unknown",
+        "protected_secret_denied",
+        "secret_too_short"
+      ]
+    },
+    "patternCase": {
+      "description": "A branch or tag filter pattern. A valid pattern matches every name in matches and none in nonMatches; an invalid pattern lists neither.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "pattern",
+        "valid"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/identifier"
+        },
+        "pattern": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "valid": {
+          "type": "boolean"
+        },
+        "matches": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "nonMatches": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      },
+      "if": {
+        "type": "object",
+        "properties": {
+          "valid": {
+            "const": false
+          }
+        },
+        "required": [
+          "valid"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "matches": false,
+          "nonMatches": false
+        }
+      },
+      "else": {
+        "type": "object",
+        "properties": {
+          "matches": {},
+          "nonMatches": {}
+        },
+        "required": [
+          "matches",
+          "nonMatches"
+        ]
+      }
+    },
+    "tagVersionCase": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "tag",
+        "tagVersion"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/identifier"
+        },
+        "tag": {
+          "type": "string",
+          "minLength": 1
+        },
+        "tagVersion": {
+          "anyOf": [
+            {
+              "type": "string",
+              "minLength": 1
+            },
+            {
+              "type": "null"
+            }
+          ]
+        }
+      }
+    },
+    "workflowSource": {
+      "description": "The raw workflow bytes: a packaged fixture, UTF-8 text, or base64 for bytes that are not UTF-8.",
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "fixture"
+          ],
+          "properties": {
+            "fixture": {
+              "type": "string",
+              "pattern": "^(?:conformance/ci-actions/(?:valid|invalid|compile-invalid)/[a-z0-9-]+\\.(?:yml|txt)|examples/ci_actions\\.yml)$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "source"
+          ],
+          "properties": {
+            "source": {
+              "type": "string"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "sourceBase64"
+          ],
+          "properties": {
+            "sourceBase64": {
+              "type": "string",
+              "contentEncoding": "base64"
+            }
+          }
+        }
+      ]
+    },
+    "trigger": {
+      "oneOf": [
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "ref"
+          ],
+          "properties": {
+            "kind": {
+              "const": "push"
+            },
+            "ref": {
+              "type": "string",
+              "pattern": "^refs/heads/.+$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "ref"
+          ],
+          "properties": {
+            "kind": {
+              "const": "tag"
+            },
+            "ref": {
+              "type": "string",
+              "pattern": "^refs/tags/.+$"
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "pullRequest",
+            "targetBranch"
+          ],
+          "properties": {
+            "kind": {
+              "const": "pullRequest"
+            },
+            "pullRequest": {
+              "type": "string",
+              "minLength": 1
+            },
+            "targetBranch": {
+              "type": "string",
+              "minLength": 1
+            }
+          }
+        },
+        {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "kind",
+            "ref",
+            "inputs"
+          ],
+          "properties": {
+            "kind": {
+              "const": "manual"
+            },
+            "ref": {
+              "type": "string",
+              "pattern": "^refs/.+$"
+            },
+            "inputs": {
+              "type": "object",
+              "additionalProperties": {
+                "anyOf": [
+                  {
+                    "type": "string"
+                  },
+                  {
+                    "type": "boolean"
+                  },
+                  {
+                    "type": "number"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ]
+              }
+            }
+          }
+        }
+      ]
+    },
+    "context": {
+      "description": "The run a case compiles. trustClass and protectedTagRun are derived by the coordinator as defined in Trust and Triggers; secrets lists the repository secrets by name, protected mark, and value length in UTF-8 bytes, never by value.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "repository",
+        "sourceObjectId",
+        "source",
+        "trigger",
+        "trustClass",
+        "protectedTagRun",
+        "secrets"
+      ],
+      "properties": {
+        "repository": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "tenantId",
+            "repositoryId",
+            "url"
+          ],
+          "properties": {
+            "tenantId": {
+              "type": "string",
+              "minLength": 1
+            },
+            "repositoryId": {
+              "type": "string",
+              "minLength": 1
+            },
+            "url": {
+              "type": "string",
+              "pattern": "^https://"
+            }
+          }
+        },
+        "sourceObjectId": {
+          "$ref": "../schemas/runner-job.schema.json#/$defs/objectId"
+        },
+        "source": {
+          "$ref": "../schemas/runner-job.schema.json#/$defs/source"
+        },
+        "trigger": {
+          "$ref": "#/$defs/trigger"
+        },
+        "trustClass": {
+          "enum": [
+            "trusted",
+            "untrusted"
+          ]
+        },
+        "protectedTagRun": {
+          "type": "boolean"
+        },
+        "secrets": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "name",
+              "protected",
+              "valueBytes"
+            ],
+            "properties": {
+              "name": {
+                "$ref": "#/$defs/identifier"
+              },
+              "protected": {
+                "type": "boolean"
+              },
+              "valueBytes": {
+                "type": "integer",
+                "minimum": 0
+              }
+            }
+          }
+        }
+      }
+    },
+    "policy": {
+      "description": "A vector representation of the deployment policy; deployments configure policy in their own format. Omitted maxima impose no maximum, and only the listed egress hosts and npm registries are rejected.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "limits",
+        "ociIsolation"
+      ],
+      "properties": {
+        "limits": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "maximumSourceArchiveBytes",
+            "maximumSourceExtractedBytes",
+            "maximumSourceEntries",
+            "maximumLogChunkBytes",
+            "maximumTotalLogBytes",
+            "maximumWorkspaceBytes",
+            "maximumWorkspaceEntries"
+          ],
+          "properties": {
+            "maximumSourceArchiveBytes": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumSourceArchiveBytes"
+            },
+            "maximumSourceExtractedBytes": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumSourceExtractedBytes"
+            },
+            "maximumSourceEntries": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumSourceEntries"
+            },
+            "maximumLogChunkBytes": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumLogChunkBytes"
+            },
+            "maximumTotalLogBytes": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumTotalLogBytes"
+            },
+            "maximumWorkspaceBytes": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumWorkspaceBytes"
+            },
+            "maximumWorkspaceEntries": {
+              "$ref": "../schemas/runner-job.schema.json#/$defs/limits/properties/maximumWorkspaceEntries"
+            }
+          }
+        },
+        "ociIsolation": {
+          "$ref": "../schemas/runner-job.schema.json#/$defs/isolation"
+        },
+        "maximumTimeoutMs": {
+          "type": "integer",
+          "minimum": 1000,
+          "maximum": 86400000
+        },
+        "maximumRetentionDays": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 3650
+        },
+        "deniedEgressHosts": {
+          "type": "array",
+          "items": {
+            "$ref": "../schemas/runner-job.schema.json#/$defs/egressHost"
+          }
+        },
+        "deniedNpmRegistries": {
+          "type": "array",
+          "items": {
+            "$ref": "../schemas/runner-job.schema.json#/$defs/npmRegistry"
+          }
+        }
+      }
+    },
+    "jobNode": {
+      "description": "A job node. job is the compiled job with every secrets value replaced by true, as in the compiled plan digest projection, and with its compiledPlanDigest; secretBindings maps every secrets member to the name of the repository secret whose value the lease inserts.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "needs",
+        "job",
+        "secretBindings"
+      ],
+      "properties": {
+        "id": {
+          "type": "string",
+          "minLength": 1
+        },
+        "kind": {
+          "const": "job"
+        },
+        "needs": {
+          "type": "array",
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        },
+        "job": {
+          "type": "object"
+        },
+        "secretBindings": {
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/$defs/identifier"
+          }
+        }
+      }
+    },
+    "assemblyNode": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "kind",
+        "needs"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/identifier"
+        },
+        "kind": {
+          "const": "assembly"
+        },
+        "needs": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "failedExpectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "outcome",
+        "code"
+      ],
+      "properties": {
+        "outcome": {
+          "const": "failed"
+        },
+        "code": {
+          "$ref": "#/$defs/failureCode"
+        }
+      }
+    },
+    "notTriggeredExpectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "outcome"
+      ],
+      "properties": {
+        "outcome": {
+          "const": "not-triggered"
+        }
+      }
+    },
+    "compiledExpectation": {
+      "description": "The run's nodes in plan order. tagVersion is present exactly on a tag run with a tag version; images lists the expanded aliases of every image publication destination exactly on a protected tag run whose workflow publishes images.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "outcome",
+        "workflowDigest",
+        "nodes"
+      ],
+      "properties": {
+        "outcome": {
+          "const": "compiled"
+        },
+        "workflowDigest": {
+          "$ref": "../schemas/runner-job.schema.json#/$defs/sha256"
+        },
+        "nodes": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "oneOf": [
+              {
+                "$ref": "#/$defs/jobNode"
+              },
+              {
+                "$ref": "#/$defs/assemblyNode"
+              }
+            ]
+          }
+        },
+        "tagVersion": {
+          "type": "string",
+          "minLength": 1
+        },
+        "images": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "candidate",
+              "registry",
+              "repository",
+              "tags"
+            ],
+            "properties": {
+              "candidate": {
+                "$ref": "#/$defs/identifier"
+              },
+              "registry": {
+                "type": "string",
+                "minLength": 1
+              },
+              "repository": {
+                "type": "string",
+                "minLength": 1
+              },
+              "tags": {
+                "type": "array",
+                "minItems": 1,
+                "uniqueItems": true,
+                "items": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "compileCase": {
+      "description": "One compilation. A case without context and policy expects a failure of the source, yaml, version, schema, or workflow layer, which no run or policy can change. isolated marks a yaml-layer case whose workflow is schema-valid once the violated YAML rule alone is lifted.",
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "workflow",
+        "expected"
+      ],
+      "properties": {
+        "id": {
+          "$ref": "#/$defs/identifier"
+        },
+        "description": {
+          "type": "string",
+          "minLength": 1
+        },
+        "workflow": {
+          "$ref": "#/$defs/workflowSource"
+        },
+        "context": {
+          "$ref": "#/$defs/context"
+        },
+        "policy": {
+          "$ref": "#/$defs/policy"
+        },
+        "isolated": {
+          "const": true
+        },
+        "expected": {
+          "oneOf": [
+            {
+              "$ref": "#/$defs/failedExpectation"
+            },
+            {
+              "$ref": "#/$defs/notTriggeredExpectation"
+            },
+            {
+              "$ref": "#/$defs/compiledExpectation"
+            }
+          ]
+        }
+      },
+      "dependentRequired": {
+        "context": [
+          "policy"
+        ],
+        "policy": [
+          "context"
+        ]
+      },
+      "if": {
+        "type": "object",
+        "properties": {
+          "expected": {
+            "type": "object",
+            "properties": {
+              "outcome": {
+                "enum": [
+                  "compiled",
+                  "not-triggered"
+                ]
+              }
+            },
+            "required": [
+              "outcome"
+            ]
+          }
+        },
+        "required": [
+          "expected"
+        ]
+      },
+      "then": {
+        "type": "object",
+        "properties": {
+          "context": {},
+          "policy": {}
+        },
+        "required": [
+          "context",
+          "policy"
+        ]
+      }
+    }
+  }
+}