javi-forge 1.17.0 → 1.18.0

package/dist/commands/ci.js

@@ -316,6 +316,18 @@ function describeRunners(resolved) {
 }
 export async function runCI(options, onStep, onGateOutcome) {
     const { projectDir = process.cwd(), mode = "full", noDocker = false, noGhagga = false, noSecurity = false, timeout = 600, } = options;
+    // ── Run-scoped Docker availability (lazy-memoized) ─────────────────────────
+    // Computed at most ONCE per run and only when an image gate needs it. The
+    // full/quick prologue below assigns its own `isDockerAvailable()` result back
+    // into this cache so `runGates` never re-probes; the gates-only path leaves it
+    // undefined until an image gate lazily triggers the probe (a native-only
+    // gates-only repo never touches Docker — behaves exactly as before slice 3).
+    let dockerAvailableCache;
+    const dockerAvailable = async () => (dockerAvailableCache ??= await isDockerAvailable());
+    const dockerGate = {
+        noDocker,
+        isAvailable: dockerAvailable,
+    };
     // ── Resolve runners (once — nothing downstream re-detects) ─────────────────
     const stepDetect = "detect";
     report(onStep, stepDetect, "Detecting stack", "running");
@@ -343,7 +355,7 @@ export async function runCI(options, onStep, onGateOutcome) {
             report(onStep, mode, `${mode} mode`, "error", detail);
             throw new Error(`no runners resolved — ${mode} mode requires at least one runner`);
         }
-        await runGates(resolved.gates, projectDir, onStep, onGateOutcome);
+        await runGates(resolved.gates, projectDir, onStep, dockerGate, onGateOutcome);
         return;
     }
     // Legacy single-runner view for the zero-config auto path. Keeping this
@@ -409,6 +421,9 @@ export async function runCI(options, onStep, onGateOutcome) {
         const stepDocker = "docker-check";
         report(onStep, stepDocker, "Checking Docker", "running");
         const dockerOk = await isDockerAvailable();
+        // Reuse this result for the gate fail-closed check — `runGates` must not
+        // run a second `docker info` (memoization seam).
+        dockerAvailableCache = dockerOk;
         if (!dockerOk) {
             report(onStep, stepDocker, "Docker not available", "error", "Start Docker or use --no-docker");
             throw new Error("Docker is not available");
@@ -515,7 +530,7 @@ export async function runCI(options, onStep, onGateOutcome) {
     // already `full` or `quick` here; the guard makes the contract explicit.
     // `runGates` no-ops on an empty gate list (a v1 repo carries none).
     if (mode === "full" || mode === "quick") {
-        await runGates(resolved.gates, projectDir, onStep, onGateOutcome);
+        await runGates(resolved.gates, projectDir, onStep, dockerGate, onGateOutcome);
     }
 }
 // =============================================================================
@@ -938,7 +953,10 @@ async function runGateCommand(gate, cmd, projectDir, nativeEnv, containerEnv) {
         timedOut: result.timedOut,
     };
 }
-async function runGates(gates, projectDir, onStep, onOutcome) {
+async function runGates(gates, projectDir, onStep, 
+// REQUIRED, so it MUST precede the optional `onOutcome` (TS1016: a required
+// parameter cannot follow an optional one). Both call sites pass it positionally.
+docker, onOutcome) {
     if (gates.length === 0)
         return;
     const blockingFailures = [];
@@ -989,6 +1007,33 @@ async function runGates(gates, projectDir, onStep, onOutcome) {
             ...extra,
         });
         report(onStep, stepId, label, "running");
+        // Fail-closed matrix (slice 3): an image gate that cannot reach Docker is
+        // REFUSED — it MUST NOT fall through to native/unpinned execution and MUST
+        // NOT be silently skipped/passed. Blocking → build failure (feeds the
+        // aggregate throw); informative → `warning` (never a false-green). A gate
+        // WITHOUT `image` is unaffected and runs native regardless of --no-docker.
+        //
+        // `isAvailable()` is touched ONLY for an image gate under Docker: the
+        // `noDocker` short-circuit means an image-less set (or a --no-docker run)
+        // never shells out to `docker info`, keeping the native path zero-cost.
+        if (gate.image !== undefined) {
+            if (docker.noDocker || !(await docker.isAvailable())) {
+                const why = docker.noDocker
+                    ? "--no-docker set"
+                    : "Docker not available";
+                const reason = `gate "${gate.id}" requires image "${gate.image}" but ${why} — refusing (never runs native/unpinned)`;
+                if (blocking) {
+                    blockingFailures.push(gate.id);
+                    report(onStep, stepId, `${label} failed`, "error", reason);
+                    emit("error", { reason });
+                }
+                else {
+                    report(onStep, stepId, `${label} failed (informative)`, "warning", reason);
+                    emit("warning", { reason });
+                }
+                continue; // NEVER falls through to native execution.
+            }
+        }
         // Per-gate env: build the INJECTED allowlist (engine keys + baseline) once,
         // then split into two maps (JDB-001):
         //   - nativeEnv: full host env + injected + gate.env — a spawn env MAP (never

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "javi-forge",
-	"version": "1.17.0",
+	"version": "1.18.0",
 	"description": "Project scaffolding and AI-ready CI bootstrap",
 	"type": "module",
 	"bin": {