@shipfox/api-definitions 10.2.0 → 12.0.0

package/src/core/workflow-model/validate-predicate-expression.ts

@@ -1,17 +1,16 @@
 import {
   type AvailabilitySite,
-  analyzeContextRootKeyAccess,
-  availabilitySites,
   createWorkflowExpression,
+  type ExpressionType,
   type ExpressionTypeEnvironment,
   extractExactContextRoots,
   getWorkflowContextDefinition,
-  getWorkflowContextTypeEnvironment,
+  getWorkflowPredicateContextRoots,
+  getWorkflowPredicateFieldMinimumFillTarget,
+  getWorkflowPredicateFieldTypeEnvironment,
   InvalidWorkflowExpressionError,
   predicateSourceIsBooleanShaped,
-  resolveContextRootAvailability,
   resolveContextRootHost,
-  routeExpression,
   validateServerEvaluable,
   type WorkflowContextName,
   type WorkflowExpression,
@@ -30,7 +29,6 @@ import {workflowFieldLabel} from './workflow-field-label.js';
 export function validatePredicateExpression(params: {
   field: WorkflowPredicateField;
   source: string;
-  site: AvailabilitySite;
   path: readonly WorkflowModelValidationIssuePathSegment[];
   invalidCode: WorkflowModelValidationIssueCode;
   invalidMessage: string;
@@ -38,6 +36,7 @@ export function validatePredicateExpression(params: {
   allowedJobReferences?: ReadonlySet<string>;
   typeOverlay?: ExpressionTypeEnvironment | undefined;
 }): WorkflowExpression | undefined {
+  const site = getWorkflowPredicateFieldMinimumFillTarget(params.field);
   const syntaxExpression = createSyntaxExpression(params);
   if (syntaxExpression === undefined) return undefined;
 
@@ -56,6 +55,7 @@ export function validatePredicateExpression(params: {
       ...serverEvaluability.violations.map((violation) =>
         runnerContextInServerPredicateIssue({
           ...params,
+          site,
           contextRoots,
           runnerRoots: violation.runnerRoots,
         }),
@@ -64,35 +64,18 @@ export function validatePredicateExpression(params: {
     return undefined;
   }
 
-  const varsRoots = knownRoots.filter((root) => root === 'vars');
-  if (varsRoots.length > 0) {
-    params.issues.push(varsContextInServerPredicateIssue({...params, contextRoots}));
-    return undefined;
-  }
-
-  const unavailableRoots = knownRoots.filter((root) => !isRootAvailableAt(root, params.site));
+  const predicateContextRoots = getWorkflowPredicateContextRoots(params.field);
+  const unavailableRoots = knownRoots.filter(
+    (root) => !predicateContextRoots.includes(root as (typeof predicateContextRoots)[number]),
+  );
   if (unavailableRoots.length > 0) {
     params.issues.push(
-      unavailablePredicateContextIssue({...params, contextRoots, unavailableRoots}),
-    );
-    return undefined;
-  }
-
-  const route = routeExpression(syntaxExpression);
-  if (route.fillTarget !== 'runner-fill' && !isSiteAtOrAfter(params.site, route.fillTarget)) {
-    const unavailableRoots = unavailableRouteReferences(syntaxExpression);
-    params.issues.push(
-      unavailableRoots.length > 0
-        ? unavailablePredicateContextIssue({
-            ...params,
-            contextRoots,
-            unavailableRoots,
-          })
-        : routeUnavailablePredicateContextIssue({
-            ...params,
-            contextRoots,
-            fillTarget: route.fillTarget,
-          }),
+      unavailablePredicateContextIssue({
+        ...params,
+        site,
+        contextRoots,
+        unavailableRoots,
+      }),
     );
     return undefined;
   }
@@ -112,7 +95,11 @@ export function validatePredicateExpression(params: {
     return undefined;
   }
 
-  if (params.typeOverlay === undefined && knownRoots.some((root) => hasSyntaxOnlyCheckMode(root))) {
+  if (
+    params.typeOverlay === undefined &&
+    knownRoots.length > 0 &&
+    knownRoots.every((root) => hasSyntaxOnlyCheckMode(root))
+  ) {
     if (
       isWorkflowFilterPredicateField(params.field) &&
       !predicateSourceIsBooleanShaped(syntaxExpression.source)
@@ -137,7 +124,7 @@ export function validatePredicateExpression(params: {
         mode: 'typed',
         // `undefined` preserves the legacy syntax-only path above. `{}` means
         // callers intentionally requested typed checking with the standard roots.
-        typeEnvironment: mergeTypeEnvironments(knownRoots, params.typeOverlay),
+        typeEnvironment: mergeTypeEnvironments(params.field, knownRoots, params.typeOverlay),
         expectedResultType: 'bool',
       },
     });
@@ -241,27 +228,6 @@ function runnerContextInServerPredicateIssue(params: {
   });
 }
 
-function varsContextInServerPredicateIssue(params: {
-  field: WorkflowPredicateField;
-  source: string;
-  site: AvailabilitySite;
-  path: readonly WorkflowModelValidationIssuePathSegment[];
-  contextRoots: readonly string[];
-}): WorkflowModelValidationIssue {
-  return issue({
-    code: 'vars-context-in-server-predicate',
-    message: `${fieldLabel(params.field)} cannot reference vars because predicate evaluation does not include workflow variables.`,
-    path: params.path,
-    details: {
-      field: params.field,
-      source: params.source,
-      contextRoots: params.contextRoots,
-      rejectedRoots: ['vars'],
-      site: params.site,
-    },
-  });
-}
-
 function unavailablePredicateContextIssue(params: {
   field: WorkflowPredicateField;
   source: string;
@@ -276,9 +242,9 @@ function unavailablePredicateContextIssue(params: {
       params.unavailableRoots,
     )} ${formatList(params.unavailableRoots)} that ${availabilityVerb(
       params.unavailableRoots,
-    )} not available at ${describeAvailabilitySite(params.site)}. ${params.unavailableRoots
-      .map(unavailableRootAvailabilityMessage)
-      .join(' ')}`,
+    )} not supplied when ${fieldLabel(params.field)} is evaluated at ${describeAvailabilitySite(
+      params.site,
+    )}.`,
     path: params.path,
     details: {
       field: params.field,
@@ -290,60 +256,13 @@ function unavailablePredicateContextIssue(params: {
   });
 }
 
-function routeUnavailablePredicateContextIssue(params: {
-  field: WorkflowPredicateField;
-  source: string;
-  site: AvailabilitySite;
-  path: readonly WorkflowModelValidationIssuePathSegment[];
-  contextRoots: readonly string[];
-  fillTarget: AvailabilitySite;
-}): WorkflowModelValidationIssue {
-  return issue({
-    code: 'context-unavailable-at-predicate-site',
-    message: `${fieldLabel(params.field)} requires context filled at ${describeAvailabilitySite(
-      params.fillTarget,
-    )}, but it is evaluated at ${describeAvailabilitySite(params.site)}.`,
-    path: params.path,
-    details: {
-      field: params.field,
-      source: params.source,
-      contextRoots: params.contextRoots,
-      fillTarget: params.fillTarget,
-      site: params.site,
-    },
-  });
-}
-
-function isRootAvailableAt(root: string, site: AvailabilitySite): boolean {
-  const availability = resolveContextRootAvailability(root);
-  if (availability === undefined) return false;
-
-  return availabilitySites.indexOf(availability) <= availabilitySites.indexOf(site);
-}
-
-function unavailableRootAvailabilityMessage(root: string): string {
-  if (root === 'execution.failed') {
-    return '"execution.failed" becomes available at step dispatch.';
-  }
-
-  const availability = resolveContextRootAvailability(root);
-  if (availability === undefined) return `"${root}" is not available at any server site.`;
-  return `"${root}" becomes available at ${describeAvailabilitySite(availability)}.`;
-}
-
-function unavailableRouteReferences(expression: WorkflowExpression): readonly string[] {
-  const access = analyzeContextRootKeyAccess(expression, ['execution']);
-  return access.references.some((reference) => reference.key === 'failed')
-    ? ['execution.failed']
-    : [];
-}
-
 function hasSyntaxOnlyCheckMode(root: string): boolean {
   if (!isWorkflowContextName(root)) return resolveContextRootHost(root) === 'server';
   return isWorkflowContextName(root) && getWorkflowContextDefinition(root).checkMode === 'syntax';
 }
 
 function mergeTypeEnvironments(
+  field: WorkflowPredicateField,
   roots: readonly string[],
   typeOverlay?: ExpressionTypeEnvironment,
 ): ExpressionTypeEnvironment {
@@ -351,28 +270,45 @@ function mergeTypeEnvironments(
 
   for (const root of roots) {
     const overlayType = typeOverlay?.[root];
-    if (overlayType !== undefined) {
-      typeEnvironment[root] = overlayType;
-      continue;
-    }
-
     if (!isWorkflowContextName(root)) {
-      if (typeOverlay !== undefined) typeEnvironment[root] = {kind: 'map'};
+      if (overlayType !== undefined) typeEnvironment[root] = overlayType;
+      else typeEnvironment[root] = {kind: 'map'};
       continue;
     }
 
-    const contextTypeEnvironment = getWorkflowContextTypeEnvironment(root);
+    const contextTypeEnvironment = getWorkflowPredicateFieldTypeEnvironment(field, root);
     if (contextTypeEnvironment === undefined) {
-      if (typeOverlay !== undefined) typeEnvironment[root] = {kind: 'map'};
+      if (overlayType !== undefined) typeEnvironment[root] = overlayType;
+      else typeEnvironment[root] = {kind: 'map'};
       continue;
     }
 
-    Object.assign(typeEnvironment, contextTypeEnvironment);
+    const contextType = contextTypeEnvironment[root];
+    if (contextType === undefined) continue;
+    typeEnvironment[root] =
+      overlayType === undefined ? contextType : overlayKnownFields(contextType, overlayType);
   }
 
   return typeEnvironment;
 }
 
+function overlayKnownFields(base: ExpressionType, overlay: ExpressionType): ExpressionType {
+  if (typeof base === 'string' || typeof overlay === 'string') return overlay;
+  if (base.kind !== 'object' || overlay.kind !== 'object') return overlay;
+
+  // Preserve output specialization without reintroducing properties absent from this field's
+  // runtime shape.
+  return {
+    kind: 'object',
+    fields: Object.fromEntries(
+      Object.entries(base.fields).map(([key, fieldType]) => [
+        key,
+        overlay.fields[key] ?? fieldType,
+      ]),
+    ),
+  };
+}
+
 function isWorkflowContextName(root: string): root is WorkflowContextName {
   return (workflowContextNames as readonly string[]).includes(root);
 }
@@ -397,10 +333,6 @@ function describeAvailabilitySite(site: AvailabilitySite): string {
   return availabilitySiteLabels[site];
 }
 
-function isSiteAtOrAfter(site: AvailabilitySite, fillTarget: AvailabilitySite): boolean {
-  return availabilitySites.indexOf(site) >= availabilitySites.indexOf(fillTarget);
-}
-
 function formatList(values: readonly string[]): string {
   return values.map((value) => `"${value}"`).join(', ');
 }

package/src/core/workflow-model/validation-issue.ts

@@ -2,6 +2,7 @@ import type {
   WorkflowModelValidationIssue,
   WorkflowModelValidationIssueCode,
   WorkflowModelValidationIssuePathSegment,
+  WorkflowModelValidationIssueSeverity,
 } from './invalid-workflow-model-error.js';
 
 export function issue(params: {
@@ -9,12 +10,14 @@ export function issue(params: {
   message: string;
   path: readonly WorkflowModelValidationIssuePathSegment[];
   details?: Readonly<Record<string, unknown>>;
+  severity?: WorkflowModelValidationIssueSeverity;
 }): WorkflowModelValidationIssue {
   if (params.details === undefined) {
     return {
       code: params.code,
       message: params.message,
       path: params.path,
+      ...(params.severity === undefined ? {} : {severity: params.severity}),
     };
   }
 
@@ -23,5 +26,6 @@ export function issue(params: {
     message: params.message,
     path: params.path,
     details: params.details,
+    ...(params.severity === undefined ? {} : {severity: params.severity}),
   };
 }

package/src/core/workflow-model/workflow-field-label.ts

@@ -20,10 +20,24 @@ export function workflowFieldLabel(
       return 'Job runner interpolation';
     case 'job.outputs':
       return 'Job outputs mapping';
-    case 'job.name':
-      return 'Job name interpolation';
+    case 'workflow.run_name':
+      return 'Workflow run name interpolation';
+    case 'job.execution_name':
+      return 'Job execution name interpolation';
     case 'step.name':
       return 'Step name interpolation';
+    case 'step.working_directory':
+      return 'Step working directory interpolation';
+    case 'checkout.project':
+      return 'Checkout project interpolation';
+    case 'checkout.connection':
+      return 'Checkout connection interpolation';
+    case 'checkout.repository':
+      return 'Checkout repository interpolation';
+    case 'checkout.ref':
+      return 'Checkout ref interpolation';
+    case 'checkout.path':
+      return 'Checkout path interpolation';
     case 'step.success':
       return 'Step gate success';
     case 'step.feedback':

package/src/core/workflow-yaml/README.md

@@ -29,7 +29,7 @@ to read and easy to change.
 
 That keeps the next part clear too.
 
-## Installation / Setup
+## Installation and setup
 
 This code is part of `@shipfox/api-definitions`. It is not a standalone package.
 
@@ -59,7 +59,7 @@ jobs:
 console.log(document.jobs.build.steps[0]?.run);
 ```
 
-## Behavior Notes
+## Behavior notes
 
 The parser owns only YAML concerns. It does not set defaults. It does not change
 job ids. It does not build job graphs. It does not check expressions.

package/src/db/schema/sync-states.ts

@@ -1,10 +1,11 @@
 import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';
 import {sql} from 'drizzle-orm';
-import {index, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
+import {index, jsonb, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';
 import type {
   DefinitionSyncErrorCode,
   DefinitionSyncState,
   DefinitionSyncStatus,
+  DefinitionSyncWarning,
 } from '#core/entities/sync-state.js';
 import {pgTable} from './common.js';
 
@@ -42,6 +43,7 @@ export const definitionSyncStates = pgTable(
     status: definitionSyncStatusEnum('status').notNull().default('pending'),
     lastErrorCode: definitionSyncErrorCodeEnum('last_error_code'),
     lastErrorMessage: text('last_error_message'),
+    warnings: jsonb('warnings').notNull().default([]).$type<DefinitionSyncWarning[]>(),
     startedAt: timestamp('started_at', {withTimezone: true}),
     finishedAt: timestamp('finished_at', {withTimezone: true}),
     createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),
@@ -71,6 +73,7 @@ export function toDefinitionSyncState(row: DefinitionSyncStateDb): DefinitionSyn
     status: row.status as DefinitionSyncStatus,
     lastErrorCode: row.lastErrorCode as DefinitionSyncErrorCode | null,
     lastErrorMessage: row.lastErrorMessage,
+    warnings: row.warnings ?? [],
     startedAt: row.startedAt,
     finishedAt: row.finishedAt,
     createdAt: row.createdAt,

package/src/db/sync-states.test.ts

@@ -1,3 +1,9 @@
+import {
+  DEFINITION_SYNC_WARNING_CODE_MAX_LENGTH,
+  DEFINITION_SYNC_WARNING_MESSAGE_MAX_LENGTH,
+  DEFINITION_SYNC_WARNING_PATH_MAX_LENGTH,
+  DEFINITION_SYNC_WARNINGS_MAX_COUNT,
+} from '@shipfox/api-definitions-dto';
 import {eq} from 'drizzle-orm';
 import {db} from './db.js';
 import {definitionSyncStates} from './schema/sync-states.js';
@@ -59,6 +65,57 @@ describe('definition sync state queries', () => {
     expect(second.startedAt?.getTime()).toBe(first.startedAt?.getTime());
   });
 
+  it('persists warnings and clears them on a subsequent sync', async () => {
+    const warnings = [
+      {
+        code: 're-evaluating-command',
+        message: 'Workflow data is re-executed as shell code.',
+        path: 'jobs.build.steps.0.run',
+      },
+    ];
+
+    const succeeded = await markDefinitionSyncState({
+      projectId,
+      sourceConnectionId,
+      sourceExternalRepositoryId: 'gitea-owner/platform',
+      ref: 'main',
+      status: 'succeeded',
+      warnings,
+    });
+
+    expect(succeeded.warnings).toEqual(warnings);
+
+    const syncing = await markDefinitionSyncState({
+      projectId,
+      sourceConnectionId,
+      sourceExternalRepositoryId: 'gitea-owner/platform',
+      ref: 'main',
+      status: 'syncing',
+    });
+
+    expect(syncing.warnings).toEqual([]);
+  });
+
+  it('bounds warning payloads before persisting them', async () => {
+    const state = await markDefinitionSyncState({
+      projectId,
+      sourceConnectionId,
+      sourceExternalRepositoryId: 'gitea-owner/platform',
+      ref: 'main',
+      status: 'succeeded',
+      warnings: Array.from({length: DEFINITION_SYNC_WARNINGS_MAX_COUNT + 1}, (_, index) => ({
+        code: `${index}-${'c'.repeat(DEFINITION_SYNC_WARNING_CODE_MAX_LENGTH)}`,
+        message: `${index}-${'m'.repeat(DEFINITION_SYNC_WARNING_MESSAGE_MAX_LENGTH)}`,
+        path: `${index}-${'p'.repeat(DEFINITION_SYNC_WARNING_PATH_MAX_LENGTH)}`,
+      })),
+    });
+
+    expect(state.warnings).toHaveLength(DEFINITION_SYNC_WARNINGS_MAX_COUNT);
+    expect(state.warnings[0]?.code).toHaveLength(DEFINITION_SYNC_WARNING_CODE_MAX_LENGTH);
+    expect(state.warnings[0]?.message).toHaveLength(DEFINITION_SYNC_WARNING_MESSAGE_MAX_LENGTH);
+    expect(state.warnings[0]?.path).toHaveLength(DEFINITION_SYNC_WARNING_PATH_MAX_LENGTH);
+  });
+
   it('clears stale finish data when a sync starts again', async () => {
     await markDefinitionSyncState({
       projectId,

package/src/db/sync-states.ts

@@ -3,7 +3,9 @@ import type {
   DefinitionSyncErrorCode,
   DefinitionSyncState,
   DefinitionSyncStatus,
+  DefinitionSyncWarning,
 } from '#core/entities/sync-state.js';
+import {limitDefinitionSyncWarnings} from '#core/entities/sync-state.js';
 import {db} from './db.js';
 import {definitionSyncStates, toDefinitionSyncState} from './schema/sync-states.js';
 
@@ -18,6 +20,7 @@ export interface MarkDefinitionSyncParams extends DefinitionSyncStateKey {
   status: DefinitionSyncStatus;
   lastErrorCode?: DefinitionSyncErrorCode | null | undefined;
   lastErrorMessage?: string | null | undefined;
+  warnings?: readonly DefinitionSyncWarning[] | null | undefined;
   startedAt?: Date | null | undefined;
   finishedAt?: Date | null | undefined;
 }
@@ -26,6 +29,7 @@ export async function markDefinitionSyncState(
   params: MarkDefinitionSyncParams,
 ): Promise<DefinitionSyncState> {
   const now = new Date();
+  const warnings = limitDefinitionSyncWarnings(params.warnings ?? []);
   const [row] = await db()
     .insert(definitionSyncStates)
     .values({
@@ -36,6 +40,7 @@ export async function markDefinitionSyncState(
       status: params.status,
       lastErrorCode: params.lastErrorCode ?? null,
       lastErrorMessage: params.lastErrorMessage ?? null,
+      warnings,
       startedAt: params.startedAt ?? null,
       finishedAt: params.finishedAt ?? null,
       updatedAt: now,
@@ -51,6 +56,7 @@ export async function markDefinitionSyncState(
         status: params.status,
         lastErrorCode: params.lastErrorCode ?? null,
         lastErrorMessage: params.lastErrorMessage ?? null,
+        warnings,
         ...(params.startedAt !== undefined ? {startedAt: params.startedAt} : {}),
         ...(params.finishedAt !== undefined ? {finishedAt: params.finishedAt} : {}),
         updatedAt: now,

package/src/presentation/dto/definition.ts

@@ -37,5 +37,6 @@ export function toDefinitionSyncSummaryDto(
     finished_at: syncState.finishedAt?.toISOString() ?? null,
     last_error_code: syncState.lastErrorCode,
     last_error_message: syncState.lastErrorMessage,
+    warnings: syncState.warnings,
   };
 }

package/src/presentation/routes/create-definition.test.ts

@@ -27,7 +27,7 @@ describe('POST /api/definitions', () => {
         buildUserContext({
           userId: crypto.randomUUID(),
           email: 'user@example.com',
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
         }),
       );
       done();
@@ -92,7 +92,7 @@ jobs:
         buildUserContext({
           userId: crypto.randomUUID(),
           email: 'user@example.com',
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
         }),
       );
       done();
@@ -165,7 +165,7 @@ jobs:
         buildUserContext({
           userId: crypto.randomUUID(),
           email: 'user@example.com',
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
         }),
       );
       done();

package/src/presentation/routes/get-definition.test.ts

@@ -37,7 +37,7 @@ describe('GET /api/definitions/:id', () => {
         buildUserContext({
           userId: crypto.randomUUID(),
           email: 'user@example.com',
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
         }),
       );
       done();

package/src/presentation/routes/list-definitions.test.ts

@@ -46,7 +46,7 @@ describe('GET /api/definitions', () => {
         buildUserContext({
           userId: crypto.randomUUID(),
           email: 'user@example.com',
-          memberships: [{workspaceId, role: 'admin'}],
+          memberships: [{workspaceId, role: 'admin', workspaceStatus: 'active'}],
         }),
       );
       done();
@@ -99,6 +99,7 @@ describe('GET /api/definitions', () => {
       finished_at: finishedAt.toISOString(),
       last_error_code: null,
       last_error_message: null,
+      warnings: [],
     });
   });
 

package/src/presentation/routes/validate-definition.test.ts

@@ -39,6 +39,7 @@ jobs:
     expect(res.statusCode).toBe(200);
     const body = res.json();
     expect(body.valid).toBe(true);
+    expect(body.warnings).toEqual([]);
     expect(body.workflow_document.name).toBe('Test');
     expect(body.workflow_model.kind).toBe('workflow');
   });

package/src/presentation/routes/validate-definition.ts

@@ -1,5 +1,9 @@
 import type {AgentInterModuleClient} from '@shipfox/api-agent-dto/inter-module';
-import {definitionDtoSchema, definitionValidationErrorSchema} from '@shipfox/api-definitions-dto';
+import {
+  definitionDtoSchema,
+  definitionValidationErrorSchema,
+  definitionValidationWarningSchema,
+} from '@shipfox/api-definitions-dto';
 import {defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
 import {validateDefinition} from '#core/validate-definition.js';
@@ -13,6 +17,7 @@ const validationResultSchema = z.union([
     valid: z.literal(true),
     workflow_document: definitionDtoSchema.shape.workflow_document,
     workflow_model: definitionDtoSchema.shape.workflow_model,
+    warnings: z.array(definitionValidationWarningSchema),
   }),
   z.object({
     valid: z.literal(false),
@@ -42,6 +47,7 @@ export function buildValidateDefinitionRoute(agent: AgentInterModuleClient) {
           valid: true as const,
           workflow_document: result.definition.document,
           workflow_model: result.definition.model,
+          warnings: result.warnings,
         };
       }
 

package/src/temporal/activities/sync-activities.test.ts

@@ -224,6 +224,7 @@ describe('definition sync activities', () => {
 
       expect(result.appliedCount).toBe(1);
       expect(result.deletedCount).toBe(0);
+      expect(result.warnings).toEqual([]);
     });
 
     it('translates DefinitionSyncPermanentError into a non-retryable ApplicationFailure', async () => {
@@ -308,6 +309,7 @@ describe('definition sync activities', () => {
       expect(rows[0]?.status).toBe('failed');
       expect(rows[0]?.lastErrorCode).toBe('invalid-definition');
       expect(rows[0]?.lastErrorMessage).toBe('Invalid workflow at .shipfox/workflows/bad.yml');
+      expect(rows[0]?.warnings).toEqual([]);
       expect(rows[0]?.finishedAt).not.toBeNull();
     });
 
@@ -362,6 +364,13 @@ describe('definition sync activities', () => {
         sourceConnectionId,
         sourceExternalRepositoryId: 'gitea:gitea-owner/platform',
         sourceRef: 'main',
+        warnings: [
+          {
+            code: 're-evaluating-command',
+            message: 'Workflow data is re-executed as shell code.',
+            path: 'jobs.build.steps.0.run',
+          },
+        ],
       });
       await result;
 
@@ -372,6 +381,13 @@ describe('definition sync activities', () => {
       expect(rows[0]?.status).toBe('succeeded');
       expect(rows[0]?.lastErrorCode).toBeNull();
       expect(rows[0]?.lastErrorMessage).toBeNull();
+      expect(rows[0]?.warnings).toEqual([
+        {
+          code: 're-evaluating-command',
+          message: 'Workflow data is re-executed as shell code.',
+          path: 'jobs.build.steps.0.run',
+        },
+      ]);
     });
   });
 });