@foss.global/ci-spec defines the language-neutral workflow and runner contracts for foss.global continuous integration. The normative artifacts are OpenAPI, JSON Schema, protocol prose, and conformance cases. TypeScript exports provide only draft metadata and asset locations.

The current specification is a draft. It is intentionally incompatible with the existing internal foss.global runner v1 protocol and must not be treated as stable until independent implementations pass the conformance suite.

Issue Reporting and Security

For reporting bugs, issues, or security vulnerabilities, please visit community.foss.global/. This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a code.foss.global/ account to submit Pull Requests directly.

Install

pnpm add @foss.global/ci-spec

Normative Artifacts

spec/runner-protocol.md: runner protocol semantics, security, lifecycle, and limits.
spec/runner.openapi.json: runner-facing HTTP and streaming API.
spec/ci-actions.md: repository workflow parsing and compilation rules.
schemas/runner-job.schema.json: compiled job wire schema.
schemas/ci_actions.schema.json: repository-root ci_actions.yml schema.
conformance/runner-cases.json: implementation-independent behavior cases.
conformance/runner-messages.json: schema-bound runner wire-message fixtures.
conformance/digest-cases.json: canonical JSON and digest fixtures.
conformance/archive-cases.json: byte-identical gzip/tar acceptance and rejection vectors.
conformance/ci-actions/ and conformance/runner-jobs/: valid and invalid data fixtures.

The package exports these raw asset subpaths:

@foss.global/ci-spec/runner.openapi.json
@foss.global/ci-spec/runner-protocol.md
@foss.global/ci-spec/ci-actions.md
@foss.global/ci-spec/runner-job.schema.json
@foss.global/ci-spec/ci_actions.schema.json
@foss.global/ci-spec/runner-cases.json
@foss.global/ci-spec/runner-messages.json
@foss.global/ci-spec/digest-cases.json
@foss.global/ci-spec/archive-cases.json
@foss.global/ci-spec/conformance/ci-actions/*
@foss.global/ci-spec/conformance/runner-jobs/*

TypeScript metadata exposes package-root-relative asset locations separately:

import {
  ciActionsSchemaVersion,
  ciSpecAssetPaths,
  maximumArchivePathMetadataBytes,
  runnerProtocolIdentifier,
} from '@foss.global/ci-spec';

console.log(ciActionsSchemaVersion); // 1
console.log(runnerProtocolIdentifier); // foss-ci-runner/2.0-draft.2
console.log(maximumArchivePathMetadataBytes); // 134217728
console.log(ciSpecAssetPaths.runnerOpenApi);

Generated language bindings are deliberately not normative. Implementations must follow the published OpenAPI, JSON Schemas, prose rules, and conformance cases.

Design Boundary

Coordinators read ci_actions.yml from the exact repository commit, validate and compile it, resolve policy and trust, and issue immutable jobs. Runners never parse repository workflow files and never receive Git repository credentials.

The first execution profile is oci.v1. Additional execution profiles require explicit versioned schemas and capabilities.

Verification

pnpm run lint:openapi
pnpm run test:types
pnpm test
pnpm run build

License and Legal Information

This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the repository license file.

Please note: The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.

Trademarks

This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.

Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.

readme.md

@foss.global/ci-spec