@starci/hfs 4.4.1 → 4.5.0

package/runtime/knowledge/hfs/rules.yaml

@@ -3503,12 +3503,13 @@ rules:
       - {path: packages/hfs/templates/app/skeleton-lite/supabase/config.toml, edition: lite}
     templateNa: "Database types are generated from each app migration set, not static templates; full-edition Supabase configuration is app-owned."
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations."
+    law: "The database configuration and its types are checked facts: `supabase/config.toml` carries no literal value under a credential key (the value is `env(NAME)`), `auth.jwt_expiry` is at most 3600, and signup, site url and redirect urls equal the Supabase block of hfs.json where it declares them; `supabase/types/database.types.ts` is committed and equals the text `contract:emit` regenerates from the migrations. Type emission refuses HFS_EMIT_DB_TYPES_STALE unless the complete applied migration version set equals the SQL filename stamps; lint and check report drift without writing types."
     kinds: [check]
     gates: [land, ci]
-    failureCodes: ["DB_CONFIG_POLICY", "DB_TYPES_DRIFT"]
+    failureCodes: ["DB_CONFIG_POLICY", "DB_TYPES_DRIFT", "HFS_EMIT_DB_TYPES_STALE"]
     enforcers:
       - {kind: hfs, id: db-config-types, at: scripts/hfs/rules/database.mjs}
+      - {kind: hfs, id: db-types-emit, at: packages/hfs/emit/db-types.mjs}
   - id: R217
     code: "FE_SUPABASE_CLIENT_OWNER"
     editions: [lite, full]
@@ -4025,12 +4026,13 @@ rules:
       - {path: packages/hfs/templates/app/ci-workflows-lite/github/workflows/db-deploy.yml, edition: lite}
       - {path: packages/hfs/templates/app/ci-workflows/github/workflows/ci.yml, edition: full}
     witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
-    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*] or workflow_dispatch, never on a branch push."
+    law: "In lite and full apps, deployment jobs declare a protected environment, explicit permissions and concurrency, materialize sealed secrets through SOPS_AGE_KEY or starci app secret materialize, and reference only the age key and transport SSH key/known_hosts secrets. They never embed a dotenv blob or write a dotenv file. Every remote workflow action uses a 40-hex commit SHA (local actions are allowed and container actions require a full sha256 digest); supply-chain reports each unpinned uses reference at its source line, including disabled jobs and steps; installed tools are checksum or digest verified, or supplied by a pinned action. App workflows start only on release tags [v*] or workflow_dispatch, never on a branch push."
     kinds: [check]
     gates: [settle, land, ci]
     failureCodes: ["HFS_DEPLOY_WORKFLOW", "HFS_WORKFLOW_PIN", "HFS_CI_TOOL_INSTALL", "HFS_APP_WORKFLOW_TRIGGER"]
     enforcers:
       - {kind: hfs, id: deploy-workflow, at: scripts/hfs/rules/deploy-workflow.mjs}
+      - {kind: hfs, id: supply-chain, at: scripts/hfs/rules/supply-chain.mjs}
     exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R252
     code: "HFS_SCRIPT_PLAINTEXT_LOAD"
@@ -4359,7 +4361,7 @@ rules:
     exampleNa: "owner:no-runtime-specs (2026-10-17): the only example was a deleted runtime spec or fixture; the rule judges the runtime or the scaffold, which the scaffold e2e exercises"
   - id: R269
     code: "HFS_DEPENDABOT_MISSING"
-    law: "In lite and full apps, .github/dependabot.yml declares scheduled npm, github-actions and docker updates. The CI workflow runs npm audit --omit=dev as an enabled gate whose failure stops the job. The images workflow generates an SBOM and provenance for release images; a disabled step, comment or label is not evidence."
+    law: "In lite and full apps, .github/dependabot.yml declares scheduled npm, github-actions and docker updates. Every npm entry declares a minor-and-patch version group and a security-updates group; every group explicitly restricts update-types to minor and patch, leaving majors per package, and npm entries ignore @starci/* without version or update-type restrictions. The CI workflow runs npm audit --omit=dev as an enabled gate whose failure stops the job. The images workflow generates an SBOM and provenance for release images; a disabled step, comment or label is not evidence."
     kinds: [check]
     gates: ["settle","land","ci"]
     failureCodes: ["HFS_DEPENDABOT_MISSING", "HFS_AUDIT_STEP_MISSING", "HFS_SBOM_MISSING"]
@@ -4876,3 +4878,92 @@ rules:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
     witness:
       - {path: packages/eslint/be/module-shape.spec.mjs, editions: [lite, full], codes: [BE_MODULE_DEFINITION_MISSING]}
+  - id: R296
+    code: "CI_SECRET_SEALED"
+    law: "A name declared in ci.secrets or ci.dependabot.secrets never names a key stored inside an app sealed .starcistacks/<env>/secrets/<member>.enc member. App runtime and CI custody are separate; checks inspect key names without decrypting or printing values."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["CI_SECRET_SEALED"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r296, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R297
+    code: "APP_SECRET_IN_CI"
+    law: "A sealed member key granted to an app container by a deploy grant never appears in ci.secrets or ci.vars. The grant environment, member and selected key determine app custody; online GitHub custody is verified by starci app ci verify."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["APP_SECRET_IN_CI"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r297, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R298
+    code: "CI_DECLARATION_DRIFT"
+    law: "Workflow secrets and vars references are declared in their matching top-level ci class, except automatic GITHUB_TOKEN. Non-optional Actions declarations are consumed by a workflow; Dependabot secrets need no Actions read. Service token and variable bindings name declarations in the matching class. Missing declarations produce migration findings; a tree with neither ci declarations nor references stays quiet."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["CI_DECLARATION_DRIFT"]
+    enforcers:
+      - {kind: hfs, id: ci-custody, at: scripts/hfs/rules/ci-custody.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r298, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: examples/lite-app/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: examples/ecommerce-app/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: examples/shape-slot/.starcistacks/application-stacks.yaml, edition: full}
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks/application-stacks.yaml, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks/application-stacks.yaml, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): the mutation witness was a deleted runtime spec or fixture", date: "2026-10-17"}
+  - id: R299
+    code: "HFS_WORKFLOW_CONTEXT"
+    law: "GitHub Actions expressions use only contexts available at their workflow key. Job env cannot read runner, job, steps or env; runner-local data paths belong to step env or shell RUNNER_TEMP. Every tracked workflow is checked in both app editions."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["HFS_WORKFLOW_CONTEXT"]
+    enforcers:
+      - {kind: hfs, id: workflow-contexts, at: scripts/hfs/rules/workflow-contexts.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r299, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): no runtime spec retained", date: "2026-10-17"}
+  - id: R300
+    code: "FE_PUBLIC_BUILD_ARG_MISSING"
+    law: "Every front-end app with a Dockerfile supplies each required NEXT_PUBLIC_* source/config/schema name through a Dockerfile ARG default or through that image's buildArgs.values/buildArgs.sealed.keys in every environment deploying the image. Source reads with literal string ?? or || fallbacks are optional. The finding names missing keys and environments at the Dockerfile; sealed values are never opened. CI release images use the same starci app stack build-args verb and environment as deployment."
+    kinds: [check]
+    gates: [settle, land, ci]
+    failureCodes: ["FE_PUBLIC_BUILD_ARG_MISSING"]
+    enforcers:
+      - {kind: hfs, id: fe-build-args, at: scripts/hfs/rules/fe-build-args.mjs}
+    editions: [lite, full]
+    docs:
+      - {path: docs/application-stacks.md#r300, editions: [lite, full]}
+    exemplifiedBy:
+      - {path: packages/hfs/templates/app/skeleton-lite/.starcistacks, edition: lite}
+      - {path: packages/hfs/templates/app/skeleton/.starcistacks, edition: full}
+    specNa: "owner:no-runtime-specs (2026-10-17): the runtime has no specs of its own; this code is enforced by runtime code and its spec proof was a deleted runtime spec"
+    witness: {status: unreachable, reason: "owner:no-runtime-specs (2026-10-17): external smoke fixtures", date: "2026-10-17"}

package/runtime/modules/kernel/failure-codes.yaml

@@ -1,3 +1,13 @@
+APP_SECRET_IN_CI:
+  title: "App runtime secret appears in CI custody"
+  title_vi: "Bí mật ứng dụng xuất hiện trong CI"
+  meaning_vi: "Khóa cấp cho container ứng dụng cũng được khai báo hoặc tìm thấy trong kho CI."
+  causes_vi:
+    - "Khóa cấp cho container ứng dụng cũng được khai báo hoặc tìm thấy trong kho CI."
+  nextStep_vi: "Giữ khóa ứng dụng trong .enc và xóa khai báo hoặc bản sao CI sau khi kiểm tra nơi dùng."
+  owner: op-retry
+  kind: check-finding
+
 ARCH_COMPILER_FAILURE:
   title: "Compiler failed during architecture check"
   title_vi: "Trình biên dịch lỗi khi kiểm kiến trúc"
@@ -1671,6 +1681,26 @@ BE_WEBHOOK_UNVERIFIED:
   owner: op-retry
   kind: check-finding
 
+CI_DECLARATION_DRIFT:
+  title: "Workflow references drift from CI declarations"
+  title_vi: "Workflow lệch khai báo CI"
+  meaning_vi: "Workflow hoặc liên kết dịch vụ thiếu khai báo đúng lớp, hoặc khai báo bắt buộc không được dùng."
+  causes_vi:
+    - "Workflow hoặc liên kết dịch vụ thiếu khai báo đúng lớp, hoặc khai báo bắt buộc không được dùng."
+  nextStep_vi: "Đối chiếu secrets và vars trong workflow với ci và liên kết dịch vụ; chỉ đánh dấu optional khi phù hợp."
+  owner: op-retry
+  kind: check-finding
+
+CI_SECRET_SEALED:
+  title: "CI name overlaps sealed app custody"
+  title_vi: "Tên CI trùng khóa bí mật đã niêm phong"
+  meaning_vi: "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
+  causes_vi:
+    - "Tên CI hoặc Dependabot cũng là khóa trong thành viên .enc của ứng dụng."
+  nextStep_vi: "Bỏ khóa ứng dụng khỏi khai báo CI; đưa bí mật CI vào kho GitHub tương ứng."
+  owner: op-retry
+  kind: check-finding
+
 CI_TRIGGERS_RELEASE_ONLY:
   title: "Workflow trigger other than a release tag, a person or the runtime's main"
   title_vi: "Workflow có trigger không phải tag phát hành, người chạy tay hay main của runtime"
@@ -2470,6 +2500,16 @@ FE_PROPS_MUTABLE:
   owner: op-retry
   kind: check-finding
 
+FE_PUBLIC_BUILD_ARG_MISSING:
+  title: "Required public front-end build arguments are missing"
+  title_vi: "Thiếu tham số build công khai bắt buộc của front end"
+  meaning_vi: "Dockerfile thiếu giá trị mặc định ARG và ảnh triển khai thiếu tên NEXT_PUBLIC bắt buộc trong môi trường được báo."
+  causes_vi:
+    - "Vi phạm R300: mã nguồn, cấu hình hoặc schema yêu cầu giá trị công khai nhưng ảnh triển khai không cung cấp tên đó."
+  nextStep_vi: "Thêm giá trị mặc định ARG trong Dockerfile hoặc buildArgs.values hay buildArgs.sealed.keys cho ảnh trong mọi môi trường triển khai; chỉ kiểm tra tên, không mở giá trị mã hóa."
+  owner: op-retry
+  kind: check-finding
+
 FE_PURE_REACHES_DATA:
   title: "Pure component reaches hooks or API"
   title_vi: "Thành phần thuần chạm tới hook hoặc API"
@@ -3308,6 +3348,16 @@ HFS_EDITION_INVALID:
   owner: op-retry
   kind: check-finding
 
+HFS_EMIT_DB_TYPES_STALE:
+  title: "Database types require current migration history"
+  title_vi: "Lịch sử migration chưa khớp để sinh kiểu"
+  meaning_vi: "Tập phiên bản đã áp dụng trong DB cục bộ khác dấu thời gian tệp supabase/migrations."
+  causes_vi:
+    - "Tập phiên bản đã áp dụng trong DB cục bộ khác dấu thời gian tệp supabase/migrations."
+  nextStep_vi: "Chạy npm run db:reset rồi starci app emit; kiểm tra cả phiên bản thiếu và phiên bản thừa."
+  owner: op-retry
+  kind: verb-refusal
+
 HFS_EMPTY_DIR:
   title: "No empty directory outside an `ignored` slot"
   title_vi: "Thư mục rỗng còn sót lại"
@@ -4109,6 +4159,16 @@ HFS_UNUSED_SYMBOL:
   owner: op-retry
   kind: check-finding
 
+HFS_WORKFLOW_CONTEXT:
+  title: "Workflow expressions use contexts available at their key"
+  title_vi: "Biểu thức workflow dùng ngữ cảnh không được phép"
+  meaning_vi: "Biểu thức tại file:line và đường dẫn khóa dùng ngữ cảnh chưa có tại khóa đó."
+  causes_vi:
+    - "Vi phạm R299: env cấp job đọc runner, job, steps hoặc env trước khi ngữ cảnh sẵn sàng."
+  nextStep_vi: "Chuyển env phụ thuộc runner vào env của bước sử dụng, hoặc dùng RUNNER_TEMP trong shell; kiểm tra file:line và đường dẫn khóa được báo."
+  owner: op-retry
+  kind: check-finding
+
 HFS_WORKFLOW_PIN:
   title: "Remote workflow actions use immutable commit SHAs"
   title_vi: "Action của workflow chưa được ghim SHA"

package/runtime/modules/schemas/application-stacks.schema.yaml

@@ -70,7 +70,7 @@ properties:
     description: Release gates of the app (starci app release gate and push); packages/hfs/release/gate.mjs is the authority for the fields.
     type: object
   database:
-    description: Database cutover data (starci app db migrate and post-cutover); packages/hfs/db/migrate.mjs is the authority for the fields.
+    description: 'Database cutover data (starci app db migrate and post-cutover); packages/hfs/db/migrate.mjs is the authority for the fields. reset: optional mapping with only backupMaxAgeHours (finite positive number; default 24 hours).'
     type: object
   jobs:
     description: Application-owned schedules, bound to their back-end CLI commands.
@@ -104,6 +104,7 @@ properties:
     properties:
       status: {enum: [deferred, supported]}
       reason: {type: string, minLength: 1}
+  ci: {$ref: '#/$defs/ciDeclaration'}
   services:
     description: >-
       The delivery, quality and platform services this repository's code and CI use - NOT Compose
@@ -119,6 +120,9 @@ properties:
     additionalProperties: false
     properties:
       sonar: {$ref: '#/$defs/service'}
+      codecov: {$ref: '#/$defs/service'}
+      dependabot: {$ref: '#/$defs/serviceOptionalCi'}
+      audit: {$ref: '#/$defs/serviceOptionalCi'}
       container-registry: {$ref: '#/$defs/service'}
       analytics: {$ref: '#/$defs/service'}
       error-tracking: {$ref: '#/$defs/service'}
@@ -140,6 +144,31 @@ $defs:
           local - a server a stack runs (stack and host.local required); hosted - a SaaS or remote
           server (host.public required); disabled - not used (reason required, CI must not call it).
         enum: [local, hosted, disabled]
+      organization: {type: string, minLength: 1}
+      flag: {type: string, minLength: 1}
+      target: {type: number, minimum: 0, maximum: 100}
+      components: {enum: [auto]}
+      required: {type: boolean}
+      ecosystems: {type: array, items: {enum: [npm, docker, github-actions]}}
+      schedule:
+        type: object
+        additionalProperties: false
+        required: [interval]
+        properties:
+          interval: {enum: [daily, weekly, monthly]}
+          day: {enum: [monday, tuesday, wednesday, thursday, friday, saturday, sunday]}
+          time: {type: string, pattern: '^(?:[01][0-9]|2[0-3]):[0-5][0-9]$'}
+      groups:
+        type: object
+        additionalProperties: false
+        properties:
+          minorPatch: {enum: [grouped]}
+          major: {enum: [per-package]}
+      ignore: {type: array, items: {type: string}}
+      security: {enum: [immediate]}
+      level: {enum: [low, moderate, high, critical]}
+      omitDev: {type: boolean}
+      in: {type: array, items: {enum: [release-gate, ci]}}
       purpose: {type: string, minLength: 1}
       reason: {type: string, minLength: 1}
       qualityGate:
@@ -200,6 +229,104 @@ $defs:
             properties:
               needed: {type: string, minLength: 1}
               reason: {type: string, minLength: 1}
+  serviceOptionalCi:
+    type: object
+    additionalProperties: false
+    required: [provider, mode, ownerAction]
+    properties:
+      provider: {$ref: '#/$defs/service/properties/provider'}
+      mode: {$ref: '#/$defs/service/properties/mode'}
+      organization: {$ref: '#/$defs/service/properties/organization'}
+      target: {$ref: '#/$defs/service/properties/target'}
+      components: {$ref: '#/$defs/service/properties/components'}
+      required: {$ref: '#/$defs/service/properties/required'}
+      ecosystems: {$ref: '#/$defs/service/properties/ecosystems'}
+      schedule: {$ref: '#/$defs/service/properties/schedule'}
+      groups: {$ref: '#/$defs/service/properties/groups'}
+      ignore: {$ref: '#/$defs/service/properties/ignore'}
+      security: {$ref: '#/$defs/service/properties/security'}
+      level: {$ref: '#/$defs/service/properties/level'}
+      omitDev: {$ref: '#/$defs/service/properties/omitDev'}
+      in: {$ref: '#/$defs/service/properties/in'}
+      purpose: {$ref: '#/$defs/service/properties/purpose'}
+      reason: {$ref: '#/$defs/service/properties/reason'}
+      qualityGate: {$ref: '#/$defs/service/properties/qualityGate'}
+      host: {$ref: '#/$defs/service/properties/host'}
+      stack: {$ref: '#/$defs/service/properties/stack'}
+      auth: {$ref: '#/$defs/service/properties/auth'}
+      projects: {$ref: '#/$defs/service/properties/projects'}
+      credentials: {$ref: '#/$defs/service/properties/credentials'}
+      runtimeSecrets: {$ref: '#/$defs/service/properties/runtimeSecrets'}
+      ci: {$ref: '#/$defs/service/properties/ci'}
+      ownerAction: {$ref: '#/$defs/service/properties/ownerAction'}
+  ciName: {type: string, pattern: '^[A-Z][A-Z0-9_]*$'}
+  ciDeclaration:
+    type: object
+    additionalProperties: false
+    properties:
+      github:
+        type: object
+        additionalProperties: false
+        required: [repository]
+        properties:
+          repository: {type: string, pattern: '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$'}
+          defaultBranch: {type: string, minLength: 1, default: main}
+          workflow: {type: string, pattern: '^[A-Za-z0-9_.-]+\.ya?ml$', default: ci.yml}
+      secrets: {type: array, items: {$ref: '#/$defs/ciSecret'}}
+      vars: {type: array, items: {$ref: '#/$defs/ciVariable'}}
+      dependabot:
+        type: object
+        additionalProperties: false
+        properties:
+          secrets:
+            type: array
+            items:
+              type: object
+              additionalProperties: false
+              required: [name]
+              properties:
+                name: {$ref: '#/$defs/ciName'}
+                purpose: {type: string}
+  ciSecret:
+    anyOf:
+      - type: object
+        additionalProperties: false
+        required: [name, scope]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: repository}
+          purpose: {type: string}
+          optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, environment]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: environment}
+          environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+          purpose: {type: string}
+          optional: {type: boolean}
+  ciVariable:
+    anyOf:
+      - type: object
+        additionalProperties: false
+        required: [name, scope, value]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: repository}
+          value: {type: string}
+          purpose: {type: string}
+          optional: {type: boolean}
+      - type: object
+        additionalProperties: false
+        required: [name, scope, value, environment]
+        properties:
+          name: {$ref: '#/$defs/ciName'}
+          scope: {const: environment}
+          environment: {type: string, pattern: '^[a-z][a-z0-9-]*$'}
+          value: {type: string}
+          purpose: {type: string}
+          optional: {type: boolean}
   serviceStack:
     description: >-
       Which stack defines a local service - either a project-owned .starcistacks stack
@@ -269,6 +396,9 @@ $defs:
     additionalProperties: false
     required: [wiring]
     properties:
+      token: {$ref: '#/$defs/ciName'}
+      hostVar: {$ref: '#/$defs/ciName'}
+      organizationVar: {$ref: '#/$defs/ciName'}
       wiring: {enum: [required, optional-follow-up, not-used]}
       workflow: {type: string, minLength: 1}
       permissions: {type: array, items: {type: string, minLength: 1}}