@theholocron/astromech 5.0.0-alpha.161 → 5.0.0-alpha.163

package/dist/config/index.d.mts

@@ -1,4 +1,4 @@
-import { n as TaskEntry, r as TasksConfig, t as TaskConfigItem } from "../schema.type-B9k8EoOb.mjs";
+import { n as TaskEntry, r as TasksConfig, t as TaskConfigItem } from "../schema.type-BJmfOafW.mjs";
 import { Loaded } from "@theholocron/datapad";
 //#region src/config/schema/schema.d.ts
 /**

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { r as TasksConfig } from "./schema.type-B9k8EoOb.mjs";
+import { r as TasksConfig } from "./schema.type-BJmfOafW.mjs";
 //#region src/generators/codecov/codecov.type.d.ts
 interface WorkspacePackage {
   slug: string;

package/dist/index.mjs

@@ -239,7 +239,7 @@ const WORKFLOW_TEMPLATES = {
 	"delivery.publish": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches:\n      - main\n      - alpha\n  workflow_dispatch:\n    inputs:\n      dry_run:\n        description: >\n          Dry run — analyze commits and preview the release without git writes\n          or publish. Push-triggered runs always run fully; this only applies\n          to manual workflow_dispatch triggers.\n        required: false\n        default: true\n        type: boolean\n\npermissions:\n  contents: write\n  id-token: write\n  issues: write\n  pull-requests: write\n\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.ref }}\n  cancel-in-progress: false\n\njobs:\n  release:\n    name: Release\n    uses: theholocron/.github/.github/workflows/delivery.publish.yml@main\n    with:\n      dry-run: ${{ inputs.dry_run == true }}\n    secrets: inherit\n",
 	"delivery.deploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n  workflow_dispatch:\n\nconcurrency:\n  group: pages\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  pages: write\n  id-token: write\n\njobs:\n  deploy:\n    name: Deploy\n    uses: theholocron/.github/.github/workflows/delivery.deploy.yml@main\n    secrets: inherit\n",
 	"delivery.bundleSize": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main, alpha]\n  pull_request:\n\npermissions:\n  contents: read\n\njobs:\n  bundle-size:\n    name: Audit the Bundle Size\n    uses: theholocron/.github/.github/workflows/delivery.bundleSize.yml@main\n    secrets: inherit\n",
-	"delivery.previewCheck": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  deployment_status:\n\npermissions:\n  contents: read\n\njobs:\n  preview-check:\n    name: Preview Check\n    # environment_url is the only field documented to point at the live\n    # app — target_url can point at a deployment-details page instead,\n    # so there's no safe fallback to it. No environment_url means\n    # nothing to check; skip the job entirely rather than hit the wrong\n    # page.\n    if: >-\n      github.event.deployment_status.state == 'success' &&\n      github.event.deployment.environment == 'Preview' &&\n      github.event.deployment_status.environment_url != ''\n    uses: theholocron/.github/.github/workflows/delivery.previewCheck.yml@main\n    with:\n      preview-url: ${{ github.event.deployment_status.environment_url }}\n      # GitHub evaluates which version of this workflow file to run\n      # from the default branch for a deployment_status event (unlike\n      # push/pull_request) -- without this, the reusable workflow's\n      # checkout would default to that same ref instead of the PR's\n      # actual deployed commit.\n      sha: ${{ github.event.deployment.sha }}\n    secrets:\n      # Named explicitly, not `secrets: inherit` -- this job needs only\n      # these two secrets (holocron#1030/#1032), not every secret this\n      # workflow's caller context has access to (e.g.\n      # HOLOCRON_DEPLOYMENTS_TOKEN). VERCEL_TOKEN here is read-only use\n      # (verifying deployment ownership), never a write/deploy\n      # credential.\n      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n      VERCEL_PROTECTION_BYPASS_SECRET: ${{ secrets.VERCEL_PROTECTION_BYPASS_SECRET }}\n",
+	"delivery.previewCheck": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  deployment_status:\n\npermissions:\n  contents: read\n  # Must be a superset of what the reusable workflow's own job\n  # requests (holocron#1058) -- GitHub hard-fails the whole run at\n  # startup, zero jobs dispatched, if the callee asks for more than\n  # the caller grants. Needed for the author-trust step's\n  # commits/{sha}/pulls lookup.\n  pull-requests: read\n\njobs:\n  preview-check:\n    name: Preview Check\n    # environment_url is the only field documented to point at the live\n    # app — target_url can point at a deployment-details page instead,\n    # so there's no safe fallback to it. No environment_url means\n    # nothing to check; skip the job entirely rather than hit the wrong\n    # page.\n    if: >-\n      github.event.deployment_status.state == 'success' &&\n      github.event.deployment.environment == 'Preview' &&\n      github.event.deployment_status.environment_url != ''\n    uses: theholocron/.github/.github/workflows/delivery.previewCheck.yml@main\n    with:\n      preview-url: ${{ github.event.deployment_status.environment_url }}\n      # GitHub evaluates which version of this workflow file to run\n      # from the default branch for a deployment_status event (unlike\n      # push/pull_request) -- without this, the reusable workflow's\n      # checkout would default to that same ref instead of the PR's\n      # actual deployed commit.\n      sha: ${{ github.event.deployment.sha }}\n    secrets:\n      # Named explicitly, not `secrets: inherit` -- this job needs only\n      # these two secrets (holocron#1030/#1032), not every secret this\n      # workflow's caller context has access to (e.g.\n      # HOLOCRON_DEPLOYMENTS_TOKEN). VERCEL_TOKEN here is read-only use\n      # (verifying deployment ownership), never a write/deploy\n      # credential.\n      VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}\n      VERCEL_PROTECTION_BYPASS_SECRET: ${{ secrets.VERCEL_PROTECTION_BYPASS_SECRET }}\n",
 	"delivery.previewDeploy": "name: Delivery\n\non: # yamllint disable-line rule:truthy\n  pull_request: {}\n\nconcurrency:\n  group: preview-deploy-${{ github.event.pull_request.number }}\n  # Not true: a cancelled run could land between Vercel accepting the\n  # upload and the report job posting a status, leaving a real preview\n  # deployment with no corresponding GitHub check — worse than letting an\n  # overlapping run for the same PR simply queue.\n  cancel-in-progress: false\n\npermissions:\n  contents: read\n  deployments: write\n\njobs:\n  preview-deploy:\n    name: Preview Deploy\n    uses: theholocron/.github/.github/workflows/delivery.previewDeploy.yml@main\n    with:\n      cwd: \".\"\n    secrets: inherit\n",
 	"platform.repoSync": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  push:\n    branches: [main]\n    paths:\n      - holocron.config.ts\n      - package.json\n      - pnpm-workspace.yaml\n  workflow_dispatch:\n    inputs:\n      steps:\n        description: \"Sync steps to run (default: all)\"\n        type: string\n        required: false\n\nconcurrency:\n  group: sync-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: write\n  pull-requests: write\n\njobs:\n  sync:\n    name: Sync\n    uses: theholocron/.github/.github/workflows/platform.repoSync.yml@main\n    with:\n      steps: ${{ inputs.steps }}\n    secrets: inherit\n",
 	"platform.commitStandards": "name: Platform\n\non: # yamllint disable-line rule:truthy\n  pull_request:\n\nconcurrency:\n  group: platform-commit-standards-${{ github.ref }}\n  cancel-in-progress: true\n\npermissions:\n  contents: read\n\njobs:\n  commit-standards:\n    name: Commit Standards\n    uses: theholocron/.github/.github/workflows/platform.commitStandards.yml@main\n    secrets: inherit\n",
@@ -928,10 +928,29 @@ function createTsconfig(options) {
 * vars to the registry default's cache-key hashing — the one thing that's
 * genuinely per-repo (e.g. a package tagging Sentry releases during its own
 * build needs `SENTRY_AUTH_TOKEN` in its cache key; most repos don't).
+* `turbo.inputs` (holocron#845) appends extra input globs the same way —
+* for a package whose layout the registry default doesn't cover (e.g. a
+* flat-layout package with no `src/` directory at all).
 */
 /** Filed once per repo, unconditionally — every generated turbo.json's root. */
 const GLOBAL_DEPENDENCIES = ["pnpm-workspace.yaml", "tsconfig.json"];
 /**
+* Guards against a malformed `turbo.inputs`/`turbo.passThroughEnv` override
+* (review on holocron#845): a bare string instead of an array would
+* otherwise spread into individual characters
+* (`[..."**\/*.ts"]` → `["*", "*", "/", "*", ".", "t", "s"]`), silently
+* emitting garbage entries instead of the intended single glob/env-var —
+* the generated `turbo.json` would still be valid JSON, just wrong, with
+* nothing surfacing the mistake. Only a config loaded from JSON or plain JS
+* reaches this unchecked; a typed `holocron.config.ts` via `defineConfig`
+* already rejects the wrong shape at compile time.
+*/
+function validatedGlobList(value, taskName, field) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value) || !value.every((item) => typeof item === "string")) throw new Error(`task "${taskName}": turbo.${field} must be an array of strings, got ${JSON.stringify(value)}`);
+	return value;
+}
+/**
 * `turbo.json` content for this manifest, pretty-printed — write it
 * directly, no merge (matches `thinCallers()` / `reusableTemplates()`: this
 * file is generated, not hand-edited). `null` when no task in the manifest
@@ -944,11 +963,16 @@ function turboConfig(config) {
 		if (entry.local === false) continue;
 		const turbo = TASKS[entry.name]?.turbo;
 		if (!turbo) continue;
-		const extraEnv = entry.turbo?.passThroughEnv;
-		tasks[entry.name] = extraEnv && extraEnv.length > 0 ? {
+		const extraEnv = validatedGlobList(entry.turbo?.passThroughEnv, entry.name, "passThroughEnv");
+		const extraInputs = validatedGlobList(entry.turbo?.inputs, entry.name, "inputs");
+		const current = tasks[entry.name] ?? turbo;
+		const passThroughEnv = extraEnv.length > 0 ? [...current.passThroughEnv ?? [], ...extraEnv] : current.passThroughEnv;
+		const inputs = extraInputs.length > 0 ? [...current.inputs, ...extraInputs] : current.inputs;
+		tasks[entry.name] = {
 			...turbo,
-			passThroughEnv: extraEnv
-		} : turbo;
+			inputs,
+			...passThroughEnv && passThroughEnv.length > 0 ? { passThroughEnv } : {}
+		};
 	}
 	if (Object.keys(tasks).length === 0) return null;
 	return stringifyJson({

package/dist/{schema.type-B9k8EoOb.d.mts → schema.type-BJmfOafW.d.mts}

@@ -32,6 +32,15 @@ interface TaskEntry {
   turbo?: {
     /** Extra env vars turbo hashes into this task's cache key, appended to the registry default (empty when the task has none). */
     passThroughEnv?: string[];
+    /**
+     * Extra input globs appended to the registry default's `inputs`
+     * (holocron#845) — for a package whose layout the registry's
+     * `"src/**"` default doesn't cover (e.g. a flat-layout package with
+     * no `src/` directory at all). Appended, not replaced: the
+     * registry's other inputs (`package.json`, `tsdown.config.ts`, …)
+     * stay tracked without needing to be repeated here.
+     */
+    inputs?: string[];
   };
 }
 /** A task is either its bare name (all defaults) or an entry object. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theholocron/astromech",
-  "version": "5.0.0-alpha.161",
+  "version": "5.0.0-alpha.163",
   "description": "The Holocron task runner — one task manifest drives `holocron run`, `holocron run ci`, the CI workflows, package.json scripts, linters, and required checks.",
   "keywords": [
     "ci",
@@ -48,7 +48,7 @@
     "@theholocron/fs-utils": "^1.15.1",
     "@theholocron/json-utils": "^1.15.1",
     "@theholocron/pkg-utils": "^1.15.1",
-    "@theholocron/datapad": "5.0.0-alpha.161"
+    "@theholocron/datapad": "5.0.0-alpha.163"
   },
   "devDependencies": {
     "@commitlint/config-conventional": "^21.2.3",