@ship.zone/ci-spec 2.1.0 → 2.1.2

package/changelog.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 2026-09-27 - 2.1.2
+
+### Fixes
+
+- settle the compilation readings the text left open (ci-actions, runner-protocol)
+  - Artifact names are unique among a job's artifacts and cache names among its caches: a transfer is identified by its kind and name, so an artifact and a cache of one job may share a name without failing `transfer_name_duplicate`.
+  - The expanded-job ceiling of 256 counts the job nodes of the expanded DAG: every per-platform build job counts, and a candidate assembly node, which is a coordinator node and not a job, does not.
+  - The 128 names of a step are the union of its merged environment, its job's secret targets, `SHIPZONE_CI_MATRIX_JSON`, `SHIPZONE_CI_INPUTS_JSON`, and, with `npmRead`, `NPM_CONFIG_USERCONFIG`, each counted once; a declared `NPM_CONFIG_USERCONFIG` in a job with `npmRead` therefore fails with `npm_read_invalid`, not `environment_limit_exceeded`.
+  - An `npmRead` registry listed twice is compared as an exact string, without normalizing a trailing `/` or an explicit port 443, as each entry receives a grant that carries its registry as written.
+  - An egress entry `*.example.com` matches every name below `example.com` at any depth, and not `example.com` itself; npm registry hosts are checked against the allowlist the same way.
+  - `NPM_CONFIG_USERCONFIG` and `npmrc` are reserved in a job with `npmRead` of every profile: a build job with the secret target `NPM_CONFIG_USERCONFIG` fails with `npm_read_invalid`, and so does an `oci` or `vm` job whose steps receive the name from the workflow environment, which does not apply to build jobs.
+  - `resources_invalid` compares only a declared `sharedMemoryBytes` with a declared `memoryBytes`; a shared memory size above the deployment's default memory is not a `workflow` layer failure.
+  - A compilation failure is normative only in its code; a location or message reported with it is informative.
+  - Lines end as in YAML 1.2, in a line feed, a carriage return and a line feed, or a carriage return alone, and line breaks in scalar content read as line feeds, so a file with carriage return line breaks holds the same document as the file with line feeds.
+  - A line that begins with U+FEFF ends a block scalar: after a keep-chomped `|+` or `>+` scalar, the empty lines before it are content of the scalar, and the line and the lines after it are not.
+  - Adds 14 compile vectors: 6 workflow-layer failures, 6 workflows that pass the workflow layer and fail the deployment's timeout maximum, and 2 compiled workflows with carriage return line breaks and a byte order mark line after a keep-chomped block scalar. The test's reference YAML layer reads carriage return line breaks and ends a block scalar at a byte order mark line.
+
+## 2026-09-27 - 2.1.1
+
+### Fixes
+
+- state the YAML 1.2 character, byte order mark, escape, and document rules, and bound nesting depth (ci-actions)
+  - A C0 control character other than tab, line feed, and carriage return fails with `workflow_yaml_syntax` anywhere, including in a quoted scalar. DEL, C1 control characters other than NEL, U+FFFE, U+FFFF, and U+FEFF are content inside a quoted scalar, as YAML 1.2 requires for JSON compatibility, and fail with `workflow_yaml_syntax` anywhere else.
+  - Runs of U+FEFF at the start of a line are byte order marks, not content, before the line on which the document begins, on that line, after a document end marker `...`, and after the document's content when only blank and comment lines follow up to the end of the file or the next `---` or `...` marker, as YAML 1.2 allows a document prefix after a document; the file's own leading byte order mark is the first of them. Any other U+FEFF outside a quoted scalar fails with `workflow_yaml_syntax`.
+  - A `\u` high surrogate escape directly followed by a `\u` low surrogate escape denotes one supplementary character, as in JSON; every other escape of a surrogate code point, which RFC 8785 cannot serialize, fails with `workflow_yaml_syntax`.
+  - Collections nest at most 64 deep, eight times the depth of the deepest collection a schema-valid workflow holds; a collection of depth 65 fails with `workflow_yaml_syntax`, so a parser can stop there instead of exhausting its stack. Only workflows that fail schema validation are affected.
+  - Documents are counted as YAML 1.2 counts them: a `---` marker or content begins a document, and `...` markers, comments, blank lines, and byte order marks begin none. A file of only `...` fails with `workflow_yaml_document_count`, a document followed by several `...` markers is one document, and `--- # comment` is one empty document that fails schema validation.
+  - Adds 22 compile vectors: 15 YAML-layer failures, 2 workflows that pass the YAML layer and fail schema validation (depth 64 and an empty explicit document), and 5 compiled workflows that fix byte order mark lines before and after the document, `...` markers, and quoted-scalar content. The test's reference YAML layer decides them.
+- apply the 16 KiB command argument limit to UTF-8 bytes (ci-actions, runner-protocol)
+  - Protocol Limits already counted the argument limit after UTF-8 encoding. A command argument of more than 16,384 UTF-8 bytes now has its codes: compilation fails with `command_limit_exceeded`, and Job Coherence lists the rule under `job_command_limit_exceeded`. The schemas keep `maxLength` 16,384, which counts characters.
+  - Adds the compile vector `workflow-command-argument-above-limit` and the runner job fixture `conformance/runner-jobs/incoherent/command-argument-above-limit.json`, an argument of 8,193 characters and 16,385 bytes, so every job failure code now has a case.
+
 ## 2026-09-27 - 2.1.0
 
 ### Features