@sverka/compiler 0.1.1 → 0.1.3

package/dist/index.d.mts

@@ -186,6 +186,18 @@ export declare function pinActionRef(ref: string, registry: PinRegistry): string
 export declare function loadBundledRegistry(): PinRegistry;
 //#endregion
 //#region src/github/types.d.ts
+interface GithubStep {
+  readonly id?: string;
+  readonly name?: string;
+  readonly run?: string;
+  readonly uses?: string;
+  readonly with?: Record<string, unknown>;
+  readonly env?: Record<string, string>;
+  readonly if?: string;
+  readonly continueOnError?: boolean;
+  readonly workingDirectory?: string;
+  readonly shell?: string;
+}
 interface GeneratedArtifact {
   readonly path: string;
   readonly content: string;
@@ -201,12 +213,27 @@ interface CompilationResult {
   readonly artifacts: readonly GeneratedArtifact[];
   readonly diagnostics: readonly TargetDiagnostic[];
 }
+/**
+ * Optional {@link GithubTarget} constructor config. Spec 22.
+ */
+interface GithubTargetConfig {
+  /** Action SHA pinning policy; defaults to `{ mode: "off" }` with the bundled registry. */
+  readonly pinning?: PinningConfig;
+  /**
+   * Steps injected into every job after Checkout and before the step's own
+   * operations — toolchain setup (`uses:` actions) and dependency installs
+   * (`run:` commands) the target runner does not provide.
+   */
+  readonly setup?: readonly GithubStep[];
+  /** Extra `with:` inputs merged into the Checkout step of every job. */
+  readonly checkoutWith?: Record<string, unknown>;
+}
 //#endregion
 //#region src/github/target.d.ts
 /**
  * Convenience function: analyze → lower → emit in one call.
  */
-export declare function compileGithub(graph: DefinitionGraph): CompilationResult;
+export declare function compileGithub(graph: DefinitionGraph, config?: GithubTargetConfig): CompilationResult;
 //#endregion
 //#region src/gitlab/types.d.ts
 interface GeneratedArtifact$1 {
@@ -231,5 +258,5 @@ interface CompilationResult$1 {
  */
 export declare function compileGitlab(graph: DefinitionGraph): CompilationResult$1;
 //#endregion
-export type { CapabilityDetail, CapabilityDiagnostic, CapabilityManifest, CapabilitySupport, CompilationResult, ConnectorFactory, Engine, GeneratedArtifact, GraphTransform, GraphValidator, Importer, ModelContribution, NativeExtension, PinRegistry, PinningConfig, PluginErrorCode, PluginMeta, PluginOptions, PluginRegistry, SverkaPlugin, Target, TargetDiagnostic, ToolDefinition, ToolProvider, ToolResult, ToolResultContent };
+export type { CapabilityDetail, CapabilityDiagnostic, CapabilityManifest, CapabilitySupport, CompilationResult, ConnectorFactory, Engine, GeneratedArtifact, GithubStep, GithubTargetConfig, GraphTransform, GraphValidator, Importer, ModelContribution, NativeExtension, PinRegistry, PinningConfig, PluginErrorCode, PluginMeta, PluginOptions, PluginRegistry, SverkaPlugin, Target, TargetDiagnostic, ToolDefinition, ToolProvider, ToolResult, ToolResultContent };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/plugin/types.ts","../src/plugin/factory.ts","../src/plugin/capabilities.ts","../src/plugin/errors.ts","../src/github/pinning.ts","../src/github/types.ts","../src/github/target.ts","../src/gitlab/types.ts","../src/gitlab/target.ts"],"mappings":";;KAQY;UAQK;WACN,SAAS;WACT;WACA;;KAGC,qBAAqB,eAAe,oBAAoB;UAEnD;WACN;WACA,SAAS;WACT;WACA;WACA;;UAOM;WACN;WACA;;UAGM;WACN;EACT,UAAU,OAAO,kBAAkB;;UAGpB;WACN;EACT,SAAS,OAAO,2BAA2B;;UAG5B;WACN;EACT,QAAQ,OAAO,kBAAkB;;UAGlB;WACN;aAA+B;aAAuB;;WACtD,sBAAsB;;UAGhB;WACN;EACT,MAAM,gBAAgB;;UAGP;WACN;EACT,QAAQ;;UAGO;WACN;EACT,OAAO;;UAGQ;WACN;WACA;WACA;WACA;;UAOM;;WAEN;WACA;;WAEA,cAAc,SAAS;;KAGtB;WACG;WAAuB;;WACvB;WAAwB;WAAuB;;WAE/C;WACA;aAAqB;aAAsB;;;UAGzC;WACN,kBAAkB;WAClB;;;;;;;UAQM;EACf,aAAa,iBAAiB;EAC9B,SACE,cACA,OAAO,SAAS,2BACf,QAAQ;EACX,YAAY;;UAOG;WACN;WACA;WACA,eAAe;WACf,iBAAiB;WACjB,sBAAsB;WACtB,sBAAsB;WACtB,mBAAmB;WACnB,qBAAqB;WACrB,mBAAmB;WACnB,sBAAsB;WACtB,sBAAsB;;WAEtB,QAAQ;;UAGF;YACL;;UAGK;WACN;;UAOM;EACf,SAAS,QAAQ;WACR,kBAAkB;EAC3B,mBAAmB;;;;;;;;;;;;;;;wBC5IL,mBACd,UAAU,UAAU,eAAe,OAAO,eAAe,cACzD,UAAU,gBACT;;;;wBA+Da,wBAAwB;;;;;;;wBCqUxB,mBAAmB,OAAO,kBAAkB;;;;;;wBA6D5C,oBACd,OAAO,iBACP,oBAAoB,gCACV;;;KCtdA;qBAKC,oBAAoB;WACtB,MAAM;WACG;EAEN,YAAA,iBAAiB,MAAM,iBAAiB;;;;;UCDrC;YACL;;;UAIK;;WAEN;;WAEA,WAAW;;;;;;;;;;;;;wBAgBN,aAAa,aAAa,UAAU;;;;wBAwBpC,uBAAuB;;;UCoDtB;WACN;WACA;;UAGM;WACN;WACA,SAAS;WACT;WACA;WACA;;UAGM;WACN,oBAAoB;WACpB,sBAAsB;;;;;;;wBC8BjB,cAAc,OAAO,kBAAkB;;;UCLtC;WACN;WACA;;UAGM;WACN;WACA,SAAS;WACT;WACA;WACA;;UAGM;WACN,oBAAoB;WACpB,sBAAsB;;;;;;;wBCvGjB,cAAc,OAAO,kBAAkB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/plugin/types.ts","../src/plugin/factory.ts","../src/plugin/capabilities.ts","../src/plugin/errors.ts","../src/github/pinning.ts","../src/github/types.ts","../src/github/target.ts","../src/gitlab/types.ts","../src/gitlab/target.ts"],"mappings":";;KAQY;UAQK;WACN,SAAS;WACT;WACA;;KAGC,qBAAqB,eAAe,oBAAoB;UAEnD;WACN;WACA,SAAS;WACT;WACA;WACA;;UAOM;WACN;WACA;;UAGM;WACN;EACT,UAAU,OAAO,kBAAkB;;UAGpB;WACN;EACT,SAAS,OAAO,2BAA2B;;UAG5B;WACN;EACT,QAAQ,OAAO,kBAAkB;;UAGlB;WACN;aAA+B;aAAuB;;WACtD,sBAAsB;;UAGhB;WACN;EACT,MAAM,gBAAgB;;UAGP;WACN;EACT,QAAQ;;UAGO;WACN;EACT,OAAO;;UAGQ;WACN;WACA;WACA;WACA;;UAOM;;WAEN;WACA;;WAEA,cAAc,SAAS;;KAGtB;WACG;WAAuB;;WACvB;WAAwB;WAAuB;;WAE/C;WACA;aAAqB;aAAsB;;;UAGzC;WACN,kBAAkB;WAClB;;;;;;;UAQM;EACf,aAAa,iBAAiB;EAC9B,SACE,cACA,OAAO,SAAS,2BACf,QAAQ;EACX,YAAY;;UAOG;WACN;WACA;WACA,eAAe;WACf,iBAAiB;WACjB,sBAAsB;WACtB,sBAAsB;WACtB,mBAAmB;WACnB,qBAAqB;WACrB,mBAAmB;WACnB,sBAAsB;WACtB,sBAAsB;;WAEtB,QAAQ;;UAGF;YACL;;UAGK;WACN;;UAOM;EACf,SAAS,QAAQ;WACR,kBAAkB;EAC3B,mBAAmB;;;;;;;;;;;;;;;wBC5IL,mBACd,UAAU,UAAU,eAAe,OAAO,eAAe,cACzD,UAAU,gBACT;;;;wBA+Da,wBAAwB;;;;;;;wBCqUxB,mBAAmB,OAAO,kBAAkB;;;;;;wBA6D5C,oBACd,OAAO,iBACP,oBAAoB,gCACV;;;KCtdA;qBAKC,oBAAoB;WACtB,MAAM;WACG;EAEN,YAAA,iBAAiB,MAAM,iBAAiB;;;;;UCDrC;YACL;;;UAIK;;WAEN;;WAEA,WAAW;;;;;;;;;;;;;wBAgBN,aAAa,aAAa,UAAU;;;;wBAwBpC,uBAAuB;;;UC1BtB;WACN;WACA;WACA;WACA;WACA,OAAO;WACP,MAAM;WACN;WACA;WACA;WACA;;UAoEM;WACN;WACA;;UAGM;WACN;WACA,SAAS;WACT;WACA;WACA;;UAGM;WACN,oBAAoB;WACpB,sBAAsB;;;;;UAMhB;;WAEN,UAAU;;;;;;WAMV,iBAAiB;;WAEjB,eAAe;;;;;;;wBCgBV,cACd,OAAO,iBACP,SAAS,qBACR;;;UCVc;WACN;WACA;;UAGM;WACN;WACA,SAAS;WACT;WACA;WACA;;UAGM;WACN,oBAAoB;WACpB,sBAAsB;;;;;;;wBCvGjB,cAAc,OAAO,kBAAkB"}

package/dist/index.mjs

@@ -522,33 +522,63 @@ function wrapStdoutCaptureLine(command, names) {
 * - Call steps become `uses:` jobs.
 * Single-pipeline graphs (no calls) are unchanged (backward compat).
 */
-function lowerGithub(graph) {
+function lowerGithub(graph, config) {
 	if (graph.project.pipelines.length === 0) throw new GithubTargetError("graph has no pipelines", "INVALID_GRAPH");
 	if (graph.project.pipelines.length === 1) {
 		const pipeline = graph.project.pipelines[0];
-		if (!pipeline.steps.some((s) => s.call || s.component || s.childPipeline || s.downstream)) return lowerSinglePipeline(pipeline);
+		if (!pipeline.steps.some((s) => s.call || s.component || s.childPipeline || s.downstream)) return lowerSinglePipeline(pipeline, config);
 	}
-	return lowerMultiPipeline(graph);
+	return lowerMultiPipeline(graph, config);
+}
+/**
+* The Checkout step shared by every job, with optional `with:` inputs
+* (e.g. `submodules: recursive`) from {@link GithubTargetConfig.checkoutWith}.
+*/
+function checkoutStep(config) {
+	return {
+		name: "Checkout",
+		uses: "actions/checkout@v4",
+		...config?.checkoutWith ? { with: config.checkoutWith } : {}
+	};
+}
+/**
+* Toolchain/dependency setup steps injected after Checkout in every job
+* that executes user commands (shell and component steps).
+*/
+function setupSteps(config) {
+	return config?.setup ?? [];
 }
 /**
 * Lower a single pipeline (no calls) — original v0 behavior.
 */
-function lowerSinglePipeline(pipeline) {
+function lowerSinglePipeline(pipeline, config) {
 	const reachableSteps = filterReachableSteps$1(pipeline);
 	const jobIdMap = buildJobIdMap$1(reachableSteps);
-	return assemblePipelineTarget(pipeline, lowerTriggers$1(pipeline.entries, pipeline.inputs), lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id));
+	return assemblePipelineTarget(pipeline, lowerTriggers$1(pipeline.entries, pipeline.inputs), lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id, config));
 }
 /**
 * Assemble a GithubTargetGraph from a pipeline, its triggers, and jobs.
 * Shared by lowerSinglePipeline and lowerMultiPipeline.
 */
 function assemblePipelineTarget(pipeline, triggers, jobs) {
+	const grants = pipeline.permissions;
+	const jobsWithPermissions = grants === void 0 ? jobs : jobs.map((job) => {
+		if (job.permissions !== void 0) return job;
+		const permissions = job.steps.some((s) => s.uses?.startsWith("github/codeql-action/upload-sarif@")) ? {
+			...grants,
+			"security-events": "write"
+		} : grants;
+		return {
+			...job,
+			permissions
+		};
+	});
 	return {
 		name: pipeline.id,
 		on: triggers,
-		jobs,
+		jobs: jobsWithPermissions,
 		env: collectEnv(pipeline),
-		...pipeline.permissions !== void 0 ? { permissions: pipeline.permissions } : {},
+		...pipeline.permissions !== void 0 ? { permissions: {} } : {},
 		...pipeline.defaults !== void 0 ? { defaults: lowerDefaults(pipeline.defaults) } : {},
 		...pipeline.concurrency !== void 0 ? { concurrency: pipeline.concurrency } : {}
 	};
@@ -566,12 +596,12 @@ function lowerDefaults(defaults) {
 * Lower a multi-pipeline graph. Each pipeline that has entries OR is referenced
 * by a call step gets its own workflow file.
 */
-function lowerMultiPipeline(graph) {
+function lowerMultiPipeline(graph, config) {
 	const pipelines = graph.project.pipelines;
 	const calledPipelineIds = collectCalledPipelineIds(pipelines);
 	const result = [];
 	for (const pipeline of pipelines) {
-		const target = lowerPipelineInGraph(pipeline, calledPipelineIds.has(pipeline.id));
+		const target = lowerPipelineInGraph(pipeline, calledPipelineIds.has(pipeline.id), config);
 		if (target !== void 0) result.push(target);
 	}
 	return result;
@@ -588,14 +618,14 @@ function collectCalledPipelineIds(pipelines) {
 * Lower a single pipeline within a multi-pipeline graph.
 * Returns undefined if the pipeline is neither a root nor a callee.
 */
-function lowerPipelineInGraph(pipeline, isCalled) {
+function lowerPipelineInGraph(pipeline, isCalled, config) {
 	const hasEntries = pipeline.entries.length > 0;
 	if (!hasEntries && !isCalled) return void 0;
 	const reachableSteps = hasEntries ? filterReachableSteps$1(pipeline) : pipeline.steps;
 	const jobIdMap = buildJobIdMap$1(reachableSteps);
 	let triggers = lowerTriggers$1(pipeline.entries, pipeline.inputs);
 	if (isCalled) triggers = addWorkflowCall(triggers, pipeline.inputs);
-	const jobs = lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id);
+	const jobs = lowerStepsWithCalls(reachableSteps, jobIdMap, pipeline.id, config);
 	return assemblePipelineTarget(pipeline, triggers, jobs);
 }
 /**
@@ -805,13 +835,13 @@ function lowerInputs(inputs) {
 * Call steps become `uses:` jobs (reusable workflow calls).
 * Component steps become `uses:` jobs (composite action calls).
 */
-function lowerStepsWithCalls(steps, jobIdMap, pipelineId) {
+function lowerStepsWithCalls(steps, jobIdMap, pipelineId, config) {
 	return steps.map((step) => {
 		if (step.call) return lowerCallStep(step, jobIdMap, pipelineId);
-		if (step.component) return lowerComponentStep(step, jobIdMap);
+		if (step.component) return lowerComponentStep(step, jobIdMap, config);
 		if (step.childPipeline) return lowerChildPipelineStep$1(step, jobIdMap);
 		if (step.downstream) return lowerDownstreamStep$1(step, jobIdMap);
-		return lowerStep$1(step, jobIdMap);
+		return lowerStep$1(step, jobIdMap, config);
 	});
 }
 /**
@@ -862,7 +892,7 @@ function lowerCallStep(step, jobIdMap, pipelineId) {
 * Lower a component step to a GitHub composite action call job.
 * F-32: component → uses: org/component@version with `with:` inputs.
 */
-function lowerComponentStep(step, jobIdMap) {
+function lowerComponentStep(step, jobIdMap, config) {
 	const jobId = jobIdMap.get(step.id) ?? step.id;
 	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
 	const comp = step.component;
@@ -873,14 +903,15 @@ function lowerComponentStep(step, jobIdMap) {
 		name: jobId,
 		runsOn: resolveRunsOn(step),
 		needs,
-		steps: [{
-			name: "Checkout",
-			uses: "actions/checkout@v4"
-		}, {
-			name: `Component ${comp.name}`,
-			uses: `${comp.name}@${comp.version}`,
-			...Object.keys(withMap).length > 0 ? { with: withMap } : {}
-		}]
+		steps: [
+			checkoutStep(config),
+			...setupSteps(config),
+			{
+				name: `Component ${comp.name}`,
+				uses: `${comp.name}@${comp.version}`,
+				...Object.keys(withMap).length > 0 ? { with: withMap } : {}
+			}
+		]
 	};
 	return {
 		id: jobId,
@@ -940,16 +971,12 @@ function lowerDownstreamStep$1(step, jobIdMap) {
 /**
 * Lower a single Step to a GitHub job.
 */
-function lowerStep$1(step, jobIdMap) {
+function lowerStep$1(step, jobIdMap, config) {
 	const needs = lowerDependencies$1(step.dependencies, jobIdMap);
-	const rawSteps = lowerOperations$1(step, jobIdMap);
+	const rawSteps = lowerOperations$1(step, jobIdMap, config);
 	if (step.continueOnError !== void 0 && typeof step.continueOnError !== "boolean") throw new GithubTargetError("GitHub does not support exit-code continueOnError; use a boolean value", "UNSUPPORTED_FEATURE");
-	const steps = step.continueOnError !== void 0 ? rawSteps.map((s) => s.run !== void 0 ? {
-		...s,
-		continueOnError: typeof step.continueOnError === "boolean" ? step.continueOnError : true
-	} : s) : [...rawSteps];
+	const steps = applyContinueOnError(rawSteps, step, config);
 	const jobId = jobIdMap.get(step.id) ?? step.id;
-	applyDelay(steps, step);
 	const runtime = step.runtime;
 	const mode = runtime.mode ?? "host";
 	return assembleGithubJob({
@@ -964,12 +991,25 @@ function lowerStep$1(step, jobIdMap) {
 	});
 }
 /**
+* Apply continueOnError to the step's own run commands. Injected setup
+* stays fail-fast — a failed dependency install must not be ignored.
+*/
+function applyContinueOnError(rawSteps, step, config) {
+	const infraSteps = new Set(setupSteps(config));
+	return rawSteps.map((s) => step.continueOnError !== void 0 && s.run !== void 0 && !infraSteps.has(s) ? {
+		...s,
+		continueOnError: typeof step.continueOnError === "boolean" ? step.continueOnError : true
+	} : s);
+}
+/**
 * Insert a sleep step to emulate delay (GitHub has no native delayed execution).
+* Called after checkout + setup steps are pushed, so the delay precedes the
+* step's own work but does not postpone toolchain setup.
 */
 function applyDelay(steps, step) {
 	if (!step.delay) return;
 	const sleepSeconds = parseDurationToSeconds(step.delay);
-	if (steps.length > 0) steps.splice(1, 0, {
+	steps.push({
 		name: `Delay (${step.delay})`,
 		run: `sleep ${sleepSeconds}`
 	});
@@ -1181,13 +1221,11 @@ function lowerDependencies$1(deps, jobIdMap) {
 * Map operations to GitHub steps in original order.
 * Consecutive shell/exportOutput operations are combined into one run step.
 */
-function lowerOperations$1(step, jobIdMap) {
+function lowerOperations$1(step, jobIdMap, config) {
 	const steps = [];
 	const shortStepId = step.id.includes("/") ? step.id.split("/").pop() : step.id;
-	steps.push({
-		name: "Checkout",
-		uses: "actions/checkout@v4"
-	});
+	steps.push(checkoutStep(config), ...setupSteps(config));
+	applyDelay(steps, step);
 	if (step.runtime.network && step.runtime.network.allowed.length > 0) steps.push({
 		name: "Sverka network allowlist",
 		run: `echo "# sverka:network-allowlist: ${step.runtime.network.allowed.join(",")}"`
@@ -1583,7 +1621,12 @@ function stringifyTargetGraph$1(graph, options) {
 	const jobs = {};
 	for (const job of graph.jobs) jobs[job.id] = jobToYaml$1(job, options);
 	doc.jobs = jobs;
-	return stringify(doc, { sortMapEntries: false });
+	let yaml = stringify(doc, {
+		sortMapEntries: false,
+		aliasDuplicateObjects: false
+	});
+	yaml = yaml.replaceAll(/^(\s*uses:\s*)["']([^"']+@[0-9a-f]{40}) # ([^"']+)["']$/gm, "$1$2 # $3");
+	return yaml;
 }
 /**
 * Convert a GithubJob to a YAML-compatible object.
@@ -1661,6 +1704,7 @@ var pinned_actions_default = {
 	"actions/cache/restore@v4": "0057852bfaa89a56745cba8c7296529d2fc39830",
 	"actions/cache/save@v4": "0057852bfaa89a56745cba8c7296529d2fc39830",
 	"oven-sh/setup-bun@v2": "0c5077e51419868618aeaa5fe8019c62421857d6",
+	"pnpm/action-setup@v4": "b906affcce14559ad1aafd4ab0e942779e9f58b1",
 	"softprops/action-gh-release@v2": "3bb12739c298aeb8a4eeaf626c5b8d85266b0e65",
 	"actions/upload-pages-artifact@v3": "56afc609e74202658d3ffba0e8f6dda462b719fa",
 	"actions/deploy-pages@v4": "d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e",
@@ -1710,10 +1754,12 @@ var GithubTarget = class {
 	capabilities = githubCapabilities;
 	pinningMode;
 	pinningRegistry;
+	config;
 	constructor(config) {
 		const pinning = config?.pinning;
 		this.pinningMode = pinning?.mode ?? "off";
 		this.pinningRegistry = pinning?.registry ?? loadBundledRegistry();
+		this.config = config;
 	}
 	/**
 	* Analyze a Definition Graph against the GitHub capability manifest.
@@ -1733,7 +1779,7 @@ var GithubTarget = class {
 	* with reusable workflow calls return one per pipeline.
 	*/
 	lower(graph) {
-		return lowerGithub(graph);
+		return lowerGithub(graph, this.config);
 	}
 	/**
 	* Emit one or more GithubTargetGraphs as YAML artifacts.
@@ -1809,8 +1855,8 @@ function collectUsesRefs(job) {
 /**
 * Convenience function: analyze → lower → emit in one call.
 */
-function compileGithub(graph) {
-	return new GithubTarget().compile(graph);
+function compileGithub(graph, config) {
+	return new GithubTarget(config).compile(graph);
 }
 //#endregion
 //#region src/gitlab/capabilities.ts