@shipfox/api-definitions 11.0.0 → 12.0.0

package/src/core/parse-definition.test.ts

@@ -65,7 +65,13 @@ describe('parseDefinition', () => {
         onResolve: 'cancel',
       },
     });
-    expect(definition.model.jobs[0]?.name).toBeDefined();
+    expect(definition.model.jobs[0]).toMatchObject({
+      name: 'Review batch',
+      executionName: [
+        {kind: 'literal', value: 'Review batch '},
+        {kind: 'deferred', roots: ['execution'], fillTarget: 'execution-creation'},
+      ],
+    });
   });
 
   test('attaches source line locations to workflow model steps', () => {

package/src/core/parse-definition.ts

@@ -1,17 +1,18 @@
-import type {AgentValidationCatalog} from '@shipfox/api-agent-dto/inter-module';
-import type {IntegrationValidationContext} from './entities/integration-context.js';
+import type {ValidationWarning} from './entities/validation-warning.js';
 import type {WorkflowDefinitionPayload} from './entities/workflow-definition.js';
 import {DefinitionParseError} from './errors.js';
-import {validateDefinition} from './validate-definition.js';
+import {type DefinitionValidationOptions, validateDefinition} from './validate-definition.js';
 
-export function parseDefinition(
+export interface ParsedDefinition extends WorkflowDefinitionPayload {
+  warnings: ValidationWarning[];
+}
+
+export type ParseDefinitionOptions = DefinitionValidationOptions;
+
+export function parseDefinitionWithWarnings(
   yamlString: string,
-  options: {
-    defaultRunnerLabels?: readonly string[];
-    agentValidationCatalog: AgentValidationCatalog;
-    integrationValidationContext?: IntegrationValidationContext;
-  },
-): WorkflowDefinitionPayload {
+  options: ParseDefinitionOptions,
+): ParsedDefinition {
   const result = validateDefinition(yamlString, options);
 
   if (!result.valid) {
@@ -24,5 +25,22 @@ export function parseDefinition(
   return {
     ...result.definition,
     sourceSnapshot: {content: yamlString, format: 'yaml'},
+    warnings: result.warnings,
+  };
+}
+
+export function parseDefinition(
+  yamlString: string,
+  options: ParseDefinitionOptions,
+): WorkflowDefinitionPayload {
+  const parsed = parseDefinitionWithWarnings(yamlString, options);
+  return stripDefinitionWarnings(parsed);
+}
+
+export function stripDefinitionWarnings(parsed: ParsedDefinition): WorkflowDefinitionPayload {
+  return {
+    document: parsed.document,
+    model: parsed.model,
+    sourceSnapshot: parsed.sourceSnapshot ?? null,
   };
 }

package/src/core/sync-definitions.test.ts

@@ -27,6 +27,19 @@ jobs:
       - run: pnpm test
 `;
 
+const eventInterpolation = '$'.concat('{{ event.x }}');
+
+const warningYaml = `
+name: Warning only
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - env:
+          MSG: '${eventInterpolation}'
+        run: eval "$MSG"
+`;
+
 const validIntegrationYaml = `
 name: Agent CI
 runner: ubuntu-latest
@@ -230,6 +243,32 @@ describe('fetchAndParseWorkflows', () => {
     expect(result[0]?.name).toBe('CI');
     expect(result[0]?.path).toBe('.shipfox/workflows/ci.yml');
     expect(result[0]?.contentHash).toMatch(LOWERCASE_SHA256_HEX_RE);
+    expect(result[0]?.warnings).toEqual([]);
+  });
+
+  it('keeps warning-only definitions available to the sync path', async () => {
+    const result = await fetchAndParseWorkflows({
+      ...baseContext,
+      ref: 'main',
+      paths: ['.shipfox/workflows/warning.yml'],
+      sourceControl: sourceControl({
+        fetchFile: vi.fn(() =>
+          Promise.resolve({
+            path: '.shipfox/workflows/warning.yml',
+            ref: 'main',
+            content: warningYaml,
+          }),
+        ),
+      }),
+    });
+
+    expect(result[0]?.warnings).toMatchObject([
+      {
+        code: 're-evaluating-command',
+        path: 'jobs.build.steps.0.run',
+      },
+    ]);
+    expect(result[0]?.definition.model.jobs[0]?.steps).toHaveLength(1);
   });
 
   it('produces stable content hashes for identical content', async () => {

package/src/core/sync-definitions.ts

@@ -5,11 +5,12 @@ import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {boundedMap} from '@shipfox/node-module';
 import type {IntegrationValidationContext} from './entities/integration-context.js';
 import type {DefinitionSyncErrorCode} from './entities/sync-state.js';
+import type {ValidationWarning} from './entities/validation-warning.js';
 import type {WorkflowDefinitionPayload} from './entities/workflow-definition.js';
 import {DefinitionParseError, DefinitionSyncPermanentError} from './errors.js';
 import {hasAgentStepIntegrations} from './has-agent-step-integrations.js';
 import type {DefinitionsSourceControl} from './integrations.js';
-import {parseDefinition} from './parse-definition.js';
+import {parseDefinitionWithWarnings, stripDefinitionWarnings} from './parse-definition.js';
 
 export const DEFAULT_WORKFLOW_PATH = '.shipfox/workflows/';
 export const MAX_WORKFLOW_FILES = 100;
@@ -79,6 +80,7 @@ export interface ParsedWorkflow {
   name: string;
   definition: WorkflowDefinitionPayload;
   contentHash: string;
+  warnings: ValidationWarning[];
 }
 
 export interface FetchAndParseWorkflowsParams extends SyncSourceContext {
@@ -152,13 +154,21 @@ function parseWorkflowSnapshot(params: {
   try {
     const definition =
       params.integrationValidationContext === undefined
-        ? parseDefinition(params.content, {agentValidationCatalog: params.agentValidationCatalog})
-        : parseDefinition(params.content, {
+        ? parseDefinitionWithWarnings(params.content, {
+            agentValidationCatalog: params.agentValidationCatalog,
+          })
+        : parseDefinitionWithWarnings(params.content, {
             agentValidationCatalog: params.agentValidationCatalog,
             integrationValidationContext: params.integrationValidationContext,
           });
     const contentHash = sha256Hex(params.content);
-    return {path: params.path, name: definition.document.name, definition, contentHash};
+    return {
+      path: params.path,
+      name: definition.document.name,
+      definition: stripDefinitionWarnings(definition),
+      contentHash,
+      warnings: definition.warnings,
+    };
   } catch (error) {
     if (error instanceof DefinitionParseError) {
       throw new DefinitionSyncPermanentError(

package/src/core/validate-definition.test.ts

@@ -5,6 +5,10 @@ function validateDefinition(yaml: string, options = {}) {
   return validateDefinitionBase(yaml, {agentValidationCatalog, ...options});
 }
 
+function interpolation(source: string): string {
+  return '$'.concat('{{ ', source, ' }}');
+}
+
 describe('validateDefinition', () => {
   test('valid YAML returns { valid: true, definition }', () => {
     const yaml = `
@@ -20,6 +24,7 @@ jobs:
 
     expect(result.valid).toBe(true);
     if (result.valid) {
+      expect(result.warnings).toEqual([]);
       expect(result.definition.document.name).toBe('Test');
       expect(result.definition.document.jobs.build?.steps).toHaveLength(1);
       expect(result.definition.model.jobs[0]?.id).toBe('build');
@@ -31,6 +36,7 @@ jobs:
 
     expect(result.valid).toBe(false);
     if (!result.valid) {
+      expect(result).not.toHaveProperty('warnings');
       expect(result.errors).toHaveLength(1);
       expect(result.errors[0]?.message).toContain('Invalid workflow YAML syntax');
     }
@@ -121,6 +127,128 @@ jobs:
     }
   });
 
+  test.each([
+    [
+      'an env binding',
+      'MSG',
+      `
+name: Re-evaluating command
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - env:
+          MSG: '${interpolation('event.x')}'
+        run: eval "$MSG"
+`,
+    ],
+    [
+      'a hoisted interpolation',
+      '__sf_0',
+      `
+name: Re-evaluating command
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - run: 'eval "${interpolation('event.x')}"'
+`,
+    ],
+  ] as const)('returns one non-fatal warning for %s', (_description, valueName, yaml) => {
+    const result = validateDefinition(yaml);
+
+    expect(result.valid).toBe(true);
+    if (result.valid) {
+      expect(result.warnings).toHaveLength(1);
+      expect(result.warnings[0]).toMatchObject({
+        code: 're-evaluating-command',
+        path: 'jobs.build.steps.0.run',
+      });
+      expect(result.warnings[0]?.message).toContain(`$${valueName}`);
+      expect(result.warnings[0]?.message).toContain('eval');
+      expect(result.warnings[0]?.message).toContain('re-executed as code');
+      expect(result.definition.model.jobs[0]?.steps).toHaveLength(1);
+    }
+  });
+
+  test.each([
+    'eval "$(cat script.sh)"',
+    "sh -c 'echo fixed'",
+    'source ./scripts/setup.sh',
+    'xargs cmd "$MSG"',
+  ])('does not warn for the common data-safe form %s', (run) => {
+    const result = validateDefinition(`
+name: Safe command
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - env:
+          MSG: fixed
+        run: |
+          ${run}
+`);
+
+    expect(result).toMatchObject({valid: true, warnings: []});
+  });
+
+  test.each([
+    ['command substitution', `echo $(${interpolation('event.ref')})`, 'command substitution'],
+    ['backtick substitution', `echo \`${interpolation('event.ref')}\``, 'backtick substitution'],
+    ['arithmetic expansion', `echo $(( ${interpolation('event.ref')} + 1 ))`, 'shell arithmetic'],
+  ])('warns for interpolation inside %s', (_description, run, construct) => {
+    const result = validateDefinition(`
+name: Unsafe interpolation
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - run: |
+          ${run}
+`);
+
+    expect(result.valid).toBe(true);
+    if (result.valid) {
+      expect(result.warnings).toHaveLength(1);
+      expect(result.warnings[0]).toMatchObject({
+        code: 're-evaluating-command',
+        path: 'jobs.build.steps.0.run',
+      });
+      expect(result.warnings[0]?.message).toContain('event.ref');
+      expect(result.warnings[0]?.message).toContain(construct);
+    }
+  });
+
+  test('warns for every repeated and unsafe flagged position', () => {
+    const result = validateDefinition(`
+name: Multiple re-evaluating commands
+runner: ubuntu-latest
+jobs:
+  build:
+    steps:
+      - env:
+          MSG: fixed
+        run: |
+          eval "$MSG" "$MSG"; echo $(${interpolation('event.first')}); eval "$MSG"; echo $((1 + ${interpolation('event.second')}))
+`);
+
+    expect(result.valid).toBe(true);
+    if (result.valid) {
+      expect(result.warnings).toHaveLength(5);
+      expect(result.warnings.every((warning) => warning.code === 're-evaluating-command')).toBe(
+        true,
+      );
+      expect(result.warnings.every((warning) => warning.path === 'jobs.build.steps.0.run')).toBe(
+        true,
+      );
+      expect(result.warnings.filter((warning) => warning.message.includes('eval'))).toHaveLength(3);
+      expect(result.warnings.some((warning) => warning.message.includes('event.first'))).toBe(true);
+      expect(result.warnings.some((warning) => warning.message.includes('event.second'))).toBe(
+        true,
+      );
+    }
+  });
+
   test('disabled Pi search tools return precise definition validation paths', () => {
     const yaml = `
 name: Pi tools

package/src/core/validate-definition.ts

@@ -2,38 +2,60 @@ import type {AgentValidationCatalog} from '@shipfox/api-agent-dto/inter-module';
 import {InvalidWorkflowDocumentError} from '@shipfox/workflow-document';
 import {definitionDefaultRunnerLabels} from '../config.js';
 import type {IntegrationValidationContext} from './entities/integration-context.js';
+import type {ValidationWarning} from './entities/validation-warning.js';
 import type {WorkflowDefinitionPayload} from './entities/workflow-definition.js';
-import {InvalidWorkflowModelError, normalizeWorkflowDocument} from './workflow-model/index.js';
+import {
+  InvalidWorkflowModelError,
+  normalizeWorkflowDocument,
+  type WorkflowModelValidationIssue,
+} from './workflow-model/index.js';
 import {InvalidWorkflowYamlError, parseWorkflowYamlWithLocations} from './workflow-yaml/index.js';
 
 export type ValidationError = {message: string; path?: string | undefined};
+export type {ValidationWarning} from './entities/validation-warning.js';
+
+export interface DefinitionValidationOptions {
+  defaultRunnerLabels?: readonly string[];
+  agentValidationCatalog: AgentValidationCatalog;
+  integrationValidationContext?: IntegrationValidationContext;
+}
 
 export type ValidationResult =
-  | {valid: true; definition: WorkflowDefinitionPayload}
+  | {valid: true; definition: WorkflowDefinitionPayload; warnings: ValidationWarning[]}
   | {valid: false; errors: ValidationError[]};
 
 export function validateDefinition(
   yamlContent: string,
-  options: {
-    defaultRunnerLabels?: readonly string[];
-    agentValidationCatalog: AgentValidationCatalog;
-    integrationValidationContext?: IntegrationValidationContext;
-  },
+  options: DefinitionValidationOptions,
 ): ValidationResult {
   try {
     const {document, stepSourceLocations} = parseWorkflowYamlWithLocations(yamlContent);
+    const warnings: WorkflowModelValidationIssue[] = [];
     const model = normalizeWorkflowDocument(document, {
       defaultRunnerLabels: options.defaultRunnerLabels ?? definitionDefaultRunnerLabels,
       agentValidationCatalog: options.agentValidationCatalog,
       integrationValidationContext: options.integrationValidationContext,
       stepSourceLocations,
+      warnings,
     });
-    return {valid: true, definition: {document, model}};
+    return {valid: true, definition: {document, model}, warnings: validationWarningsFor(warnings)};
   } catch (error) {
     return {valid: false, errors: validationErrorsFor(error)};
   }
 }
 
+function validationWarningsFor(
+  issues: readonly WorkflowModelValidationIssue[],
+): ValidationWarning[] {
+  return issues.map((issue) =>
+    validationWarning({
+      code: issue.code,
+      message: issue.message,
+      path: issue.path.join('.') || undefined,
+    }),
+  );
+}
+
 function validationErrorsFor(error: unknown): ValidationError[] {
   if (error instanceof InvalidWorkflowYamlError) {
     return [
@@ -69,3 +91,12 @@ function validationError(params: {message: string; path?: string | undefined}):
   if (params.path === undefined) return {message: params.message};
   return {message: params.message, path: params.path};
 }
+
+function validationWarning(params: {
+  code: string;
+  message: string;
+  path?: string | undefined;
+}): ValidationWarning {
+  if (params.path === undefined) return {code: params.code, message: params.message};
+  return {code: params.code, message: params.message, path: params.path};
+}

package/src/core/workflow-model/README.md

@@ -33,7 +33,7 @@ its work. A test can set up one case, call one thing, and check what comes back.
 That keeps the next step easy to read.
 It is small.
 
-## Installation / Setup
+## Installation and setup
 
 This code is part of `@shipfox/api-definitions`. It is not a standalone package.
 
@@ -64,7 +64,7 @@ const model = normalizeWorkflowDocument({
 console.log(model.jobs[0]?.steps[0]?.command.value);
 ```
 
-## Behavior Notes
+## Behavior notes
 
 The model does not own project ids, commit shas, refs, dates, database rows, or
 file paths. Those fields belong to `WorkflowDefinition`.

package/src/core/workflow-model/index.ts

@@ -5,5 +5,6 @@ export {
   type WorkflowModelValidationIssue,
   type WorkflowModelValidationIssueCode,
   type WorkflowModelValidationIssuePathSegment,
+  type WorkflowModelValidationIssueSeverity,
 } from './invalid-workflow-model-error.js';
 export {normalizeWorkflowDocument} from './normalize-workflow-document.js';

package/src/core/workflow-model/invalid-workflow-model-error.ts

@@ -2,8 +2,10 @@ export const invalidWorkflowModelErrorCode = 'invalid-workflow-model';
 
 export type WorkflowModelValidationIssueCode =
   | 'context-unavailable-at-fill-site'
+  | 'dynamic-name-self-reference'
   | 'context-unavailable-at-predicate-site'
   | 'computed-context-key'
+  | 'checkout-target-invalid'
   | 'duplicate-job-id'
   | 'duplicate-step-id'
   | 'duplicate-trigger-id'
@@ -22,6 +24,7 @@ export type WorkflowModelValidationIssueCode =
   | 'invalid-interpolation-template'
   | 'invalid-duration'
   | 'invalid-listener-filter'
+  | 'invalid-model'
   | 'invalid-job-if'
   | 'invalid-job-output'
   | 'invalid-job-success'
@@ -42,6 +45,7 @@ export type WorkflowModelValidationIssueCode =
   | 'runner-context-not-bare'
   | 'runner-context-in-field'
   | 'runner-context-in-server-predicate'
+  | 're-evaluating-command'
   | 'self-job-dependency'
   | 'too-many-runner-labels'
   | 'unknown-secret-store'
@@ -49,16 +53,18 @@ export type WorkflowModelValidationIssueCode =
   | 'unknown-integration-method'
   | 'unknown-integration-tool'
   | 'unknown-job-dependency'
-  | 'untrusted-context-in-field'
-  | 'vars-context-in-server-predicate';
+  | 'untrusted-agent-selection-context';
 
 export type WorkflowModelValidationIssuePathSegment = string | number;
 
+export type WorkflowModelValidationIssueSeverity = 'error' | 'warning';
+
 export interface WorkflowModelValidationIssue {
   readonly code: WorkflowModelValidationIssueCode;
   readonly message: string;
   readonly path: readonly WorkflowModelValidationIssuePathSegment[];
   readonly details?: Readonly<Record<string, unknown>>;
+  readonly severity?: WorkflowModelValidationIssueSeverity;
 }
 
 export class InvalidWorkflowModelError extends Error {

package/src/core/workflow-model/normalize-if-condition.ts

@@ -21,7 +21,6 @@ const ifExpressionSyntax = `\${{ }}`;
 export function normalizeIfCondition(params: {
   readonly field: Extract<WorkflowPredicateField, 'job.if' | 'step.if'>;
   readonly source: string | undefined;
-  readonly site: 'job-activation' | 'step-dispatch';
   readonly path: readonly WorkflowModelValidationIssuePathSegment[];
   readonly invalidCode: Extract<
     WorkflowModelValidationIssueCode,
@@ -59,7 +58,6 @@ export function normalizeIfCondition(params: {
   return validatePredicateExpression({
     field: params.field,
     source: expressionSegment.expression.source,
-    site: params.site,
     path: params.path,
     invalidCode: params.invalidCode,
     invalidMessage: params.invalidMessage,

package/src/core/workflow-model/normalize-job-checkout.ts

@@ -1,16 +1,113 @@
-import {DEFAULT_JOB_CHECKOUT, type WorkflowModelJobCheckout} from '@shipfox/api-definitions-dto';
-import type {WorkflowDocumentJobCheckout} from '@shipfox/workflow-document';
+import {
+  DEFAULT_JOB_CHECKOUT,
+  WORKFLOW_MODEL_CHECKOUT_TARGET_FIELDS,
+  type WorkflowFieldTemplate,
+  type WorkflowModelCheckout,
+  type WorkflowModelCheckoutTargetKey,
+  type WorkflowModelJobCheckout,
+} from '@shipfox/api-definitions-dto';
+import type {AvailabilitySite, ExpressionTypeEnvironment} from '@shipfox/expression';
+import {
+  checkoutTargetValidationIssues,
+  type WorkflowDocumentCheckout,
+  type WorkflowDocumentJob,
+} from '@shipfox/workflow-document';
+import type {
+  WorkflowModelValidationIssue,
+  WorkflowModelValidationIssuePathSegment,
+} from './invalid-workflow-model-error.js';
+import {parseInterpolationField} from './parse-interpolation-field.js';
+import {issue} from './validation-issue.js';
 
 export {DEFAULT_JOB_CHECKOUT};
 
-export function normalizeJobCheckout(
-  checkout: WorkflowDocumentJobCheckout | undefined,
-): WorkflowModelJobCheckout {
+const DEFAULT_CHECKOUT_FETCH_DEPTH = 1;
+
+export function normalizeJobCheckout(params: {
+  checkout: WorkflowDocumentJob['checkout'];
+}): WorkflowModelJobCheckout | false {
+  if (params.checkout === false) {
+    return false;
+  }
+
+  const checkout = params.checkout ?? {};
   return {
     permissions: {
-      contents: checkout?.permissions?.contents ?? DEFAULT_JOB_CHECKOUT.permissions.contents,
+      contents: checkout.permissions?.contents ?? DEFAULT_JOB_CHECKOUT.permissions.contents,
     },
-    persistCredentials:
-      checkout?.['persist-credentials'] ?? DEFAULT_JOB_CHECKOUT.persistCredentials,
+    persistCredentials: checkout['persist-credentials'] ?? DEFAULT_JOB_CHECKOUT.persistCredentials,
   };
 }
+
+export function normalizeCheckout(params: {
+  checkout: WorkflowDocumentCheckout;
+  issues: WorkflowModelValidationIssue[];
+  path: readonly WorkflowModelValidationIssuePathSegment[];
+  fillSite: AvailabilitySite;
+  allowedJobReferences?: ReadonlySet<string>;
+  typeOverlay?: ExpressionTypeEnvironment | undefined;
+}): WorkflowModelCheckout {
+  validateCheckoutTargetShape(params);
+
+  const templates: Partial<Record<WorkflowModelCheckoutTargetKey, WorkflowFieldTemplate>> = {};
+  for (const [key, field] of WORKFLOW_MODEL_CHECKOUT_TARGET_FIELDS) {
+    const source = params.checkout[key];
+    if (source === undefined) continue;
+
+    const template = parseInterpolationField({
+      field,
+      source,
+      path: [...params.path, key],
+      issues: params.issues,
+      fillSite: params.fillSite,
+      ...(params.allowedJobReferences === undefined
+        ? {}
+        : {allowedJobReferences: params.allowedJobReferences}),
+      ...(params.typeOverlay === undefined ? {} : {typeOverlay: params.typeOverlay}),
+    });
+    if (template === undefined) continue;
+
+    templates[key] = template;
+  }
+
+  const normalized = {
+    ...(params.checkout.project === undefined ? {} : {project: params.checkout.project}),
+    ...(params.checkout.connection === undefined ? {} : {connection: params.checkout.connection}),
+    ...(params.checkout.repository === undefined ? {} : {repository: params.checkout.repository}),
+    ...(params.checkout.ref === undefined ? {} : {ref: params.checkout.ref}),
+    fetchDepth: params.checkout['fetch-depth'] ?? DEFAULT_CHECKOUT_FETCH_DEPTH,
+    ...(params.checkout.path === undefined ? {} : {path: params.checkout.path}),
+    permissions: {
+      contents: params.checkout.permissions?.contents ?? DEFAULT_JOB_CHECKOUT.permissions.contents,
+    },
+    persistCredentials:
+      params.checkout['persist-credentials'] ?? DEFAULT_JOB_CHECKOUT.persistCredentials,
+    ...(params.checkout.force === undefined ? {} : {force: params.checkout.force}),
+    ...(Object.keys(templates).length === 0 ? {} : {templates}),
+  } satisfies WorkflowModelCheckout;
+
+  return normalized;
+}
+
+function validateCheckoutTargetShape(params: {
+  checkout: WorkflowDocumentCheckout;
+  issues: WorkflowModelValidationIssue[];
+  path: readonly WorkflowModelValidationIssuePathSegment[];
+}): void {
+  for (const validationIssue of checkoutTargetValidationIssues(params.checkout)) {
+    const message =
+      validationIssue.kind === 'project-with-connection'
+        ? 'Checkout target "connection" cannot be combined with "project".'
+        : validationIssue.kind === 'project-with-repository'
+          ? 'Checkout target "repository" cannot be combined with "project".'
+          : 'Checkout target "connection" requires "repository".';
+    params.issues.push(
+      issue({
+        code: 'checkout-target-invalid',
+        message,
+        path: [...params.path, validationIssue.path],
+        details: {fields: validationIssue.fields},
+      }),
+    );
+  }
+}

package/src/core/workflow-model/normalize-job-listening.ts

@@ -108,7 +108,6 @@ function normalizeListeningTrigger(params: {
     validatePredicateExpression({
       field: params.field,
       source: params.trigger.filter,
-      site: 'job-activation',
       path: params.path,
       invalidCode: 'invalid-listener-filter',
       invalidMessage: `${params.field === 'listener.on' ? 'Listener on' : 'Listener until'} filter must be a valid CEL boolean expression.`,

package/src/core/workflow-model/normalize-job-success.ts

@@ -17,7 +17,6 @@ export function normalizeJobSuccess(params: {
   const expression = validatePredicateExpression({
     field: 'job.success',
     source: params.source,
-    site: 'job-resolution',
     path: ['jobs', params.sourceName, 'success'],
     invalidCode: 'invalid-job-success',
     invalidMessage: 'Job success must be a valid CEL boolean expression.',