deps

package
v0.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 26, 2026 License: MIT Imports: 29 Imported by: 0

Documentation

Overview

Package deps coordinates exact dependency updates across isolated repository worktrees. Ecosystem adapters own discovery and mutation; the runner owns Git, verification, publication, and deterministic reports.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BumpOperationID

func BumpOperationID(events []ReleaseEvent) string

BumpOperationID returns the stable campaign identity for a sorted seed set.

func WriteBumpReports

func WriteBumpReports(directory string, report BumpReport) error

WriteBumpReports atomically replaces the human and machine campaign indexes.

func WriteReports

func WriteReports(directory string, report Report) error

WriteReports writes deps-set.md and deps-set.yaml to the requested directory.

Types

type BumpOptions

type BumpOptions struct {
	Options
	MaxWaves     int
	PollInterval time.Duration
	RefreshAfter time.Duration
	Previous     *BumpReport
	Persist      func(BumpReport) error

	// Now is injectable for deterministic event-refresh tests.
	Now func() time.Time
	// LatestGoVersion is injectable for deterministic wave tests.
	LatestGoVersion func(context.Context, string) (string, error)
	// LatestGoRelease is injectable for graph traversal through modules that
	// were updated and published before this campaign started.
	LatestGoRelease func(context.Context, string) (PublishedGoRelease, error)
}

BumpOptions adds wave and release discovery policy to shared lifecycle options.

type BumpPhase added in v0.12.0

type BumpPhase string

BumpPhase identifies the operation currently represented by a persisted report. It makes an interrupted campaign distinguish graph discovery from a wave that is waiting on local or remote work.

const (
	BumpPhasePreparing        BumpPhase = "preparing"
	BumpPhaseDiscoveringGraph BumpPhase = "discovering_graph"
	BumpPhasePlanningWave     BumpPhase = "planning_wave"
	BumpPhaseProcessingWave   BumpPhase = "processing_wave"
	BumpPhasePlanned          BumpPhase = "planned"
	BumpPhaseAwaitingMerge    BumpPhase = "awaiting_merge"
	BumpPhaseAwaitingRelease  BumpPhase = "awaiting_release"
	BumpPhaseCompleted        BumpPhase = "completed"
)

type BumpProgress added in v0.12.0

type BumpProgress struct {
	Wave                  int    `yaml:"wave,omitempty"`
	RepositoriesTotal     int    `yaml:"repositories_total,omitempty"`
	RepositoriesCompleted int    `yaml:"repositories_completed,omitempty"`
	LastRepository        string `yaml:"last_repository,omitempty"`
}

BumpProgress records the bounded unit of work for Phase. During graph discovery it advances once per selected repository; during wave processing it identifies the selected wave repositories.

type BumpReport

type BumpReport struct {
	SchemaVersion  int                  `yaml:"schema_version"`
	Operation      string               `yaml:"operation"`
	Status         string               `yaml:"status"`
	Phase          BumpPhase            `yaml:"phase"`
	Progress       BumpProgress         `yaml:"progress"`
	Ecosystem      Ecosystem            `yaml:"ecosystem"`
	SeedEvents     []ReleaseEvent       `yaml:"seed_events"`
	GitHubDir      string               `yaml:"github_dir"`
	BaseRef        string               `yaml:"base_ref"`
	Verification   []quality.Check      `yaml:"verification,omitempty"`
	Parallel       int                  `yaml:"parallel"`
	DiscoverySkips []GraphDiscoverySkip `yaml:"discovery_skips,omitempty"`
	Waves          []BumpWaveReport     `yaml:"waves"`
}

BumpReport is the persistent Markdown/YAML state of a wave campaign.

func LoadBumpReport

func LoadBumpReport(directory string) (BumpReport, error)

LoadBumpReport loads persisted resume state.

func RunBump

func RunBump(ctx context.Context, events []ReleaseEvent, repositories []Repository, options BumpOptions) (BumpReport, error)

RunBump propagates explicit Go release events through recalculated direct consumer waves. Each newly observed provider release becomes the next wave.

func (BumpReport) JSON added in v0.14.0

func (report BumpReport) JSON() ([]byte, error)

JSON renders the same wave state with the field names YAML uses.

func (BumpReport) Markdown

func (report BumpReport) Markdown() string

Markdown renders the wave, repository, and release-evidence index.

func (BumpReport) YAML

func (report BumpReport) YAML() ([]byte, error)

YAML renders deterministic machine-readable wave state.

type BumpWaveReport

type BumpWaveReport struct {
	Index                int                   `yaml:"index"`
	Status               string                `yaml:"status"`
	Events               []ReleaseEvent        `yaml:"events"`
	Refreshes            []ReleaseEventRefresh `yaml:"refreshes,omitempty"`
	DeferredRepositories []string              `yaml:"deferred_repositories,omitempty"`
	Repositories         []RepositoryReport    `yaml:"repositories"`
	Releases             []ReleaseObservation  `yaml:"releases,omitempty"`
}

BumpWaveReport records one recalculated direct-consumer layer.

type Decision

type Decision struct {
	Dependency    string `yaml:"dependency,omitempty"`
	File          string `yaml:"file"`
	BeforeRef     string `yaml:"before_ref,omitempty"`
	BeforeVersion string `yaml:"before_version,omitempty"`
	TargetVersion string `yaml:"target_version"`
	ResolvedRef   string `yaml:"resolved_ref,omitempty"`
	AfterRef      string `yaml:"after_ref,omitempty"`
	AfterVersion  string `yaml:"after_version,omitempty"`
	Action        string `yaml:"action"`
	Reason        string `yaml:"reason"`
}

Decision explains one existing dependency reference before and after update.

type Ecosystem

type Ecosystem string

Ecosystem identifies a dependency manifest or reference format.

const (
	EcosystemGitHubActions Ecosystem = "github-actions"
	EcosystemGo            Ecosystem = "go"
)

type Graph added in v0.9.0

type Graph struct {
	SchemaVersion int                `json:"schema_version" yaml:"schema_version"`
	Ecosystem     Ecosystem          `json:"ecosystem" yaml:"ecosystem"`
	BaseRef       string             `json:"base_ref" yaml:"base_ref"`
	Filters       GraphFilters       `json:"filters" yaml:"filters"`
	Summary       GraphSummary       `json:"summary" yaml:"summary"`
	Order         GraphOrder         `json:"order" yaml:"order"`
	Repositories  []GraphRepository  `json:"repositories" yaml:"repositories"`
	Modules       []GraphModule      `json:"modules" yaml:"modules"`
	Requirements  []GraphRequirement `json:"requirements" yaml:"requirements"`
	// DiscoverySkips lists repositories excluded from the walk rather than
	// inspected. It belongs to the graph rather than to a log line so that no
	// output format can present a partial fleet as a complete one.
	DiscoverySkips []GraphDiscoverySkip `json:"discovery_skips,omitempty" yaml:"discovery_skips,omitempty"`
}

Graph is the canonical, deterministic evidence model shared by every view.

func BuildGraph added in v0.9.0

func BuildGraph(ctx context.Context, repositories []Repository, options GraphOptions) (Graph, error)

BuildGraph scans selected repositories once and returns canonical evidence.

func (Graph) HTML added in v0.9.0

func (graph Graph) HTML(defaultView GraphView) ([]byte, error)

HTML renders all projections into one self-contained interactive document.

func (Graph) JSON added in v0.9.0

func (graph Graph) JSON() ([]byte, error)

JSON serializes the deterministic canonical evidence model.

func (Graph) Markdown added in v0.9.0

func (graph Graph) Markdown() string

Markdown renders canonical counts and every manifest evidence row.

func (Graph) Output added in v0.9.0

func (graph Graph) Output(format string, view GraphView) ([]byte, error)

Output renders the requested stdout format.

func (Graph) Project added in v0.9.0

func (graph Graph) Project(view GraphView) (GraphProjection, error)

Project derives one visual view without rescanning canonical evidence.

func (Graph) RepositoryOrder added in v0.13.0

func (graph Graph) RepositoryOrder() GraphOrder

RepositoryOrder derives the provider-first layering of the selected repositories from canonical requirement evidence alone. Layer 0 requires no other selected repository; every later layer requires only earlier layers, so one layer can be released before the next one starts.

Repositories that require each other cannot be separated by any order. They share one strongly connected component, are placed in one layer, and are reported as a cycle instead of being dropped or making layering fail.

func (Graph) SVG added in v0.9.0

func (graph Graph) SVG(view GraphView) ([]byte, error)

SVG renders one deterministic projection as an accessible standalone SVG.

func (Graph) YAML added in v0.9.0

func (graph Graph) YAML() ([]byte, error)

YAML serializes the deterministic canonical evidence model.

type GraphDiscoverySkip added in v0.16.0

type GraphDiscoverySkip struct {
	Repository string `json:"repository" yaml:"repository"`
	Reason     string `json:"reason" yaml:"reason"`
}

GraphDiscoverySkip records a repository that could be proven irrelevant to a Go propagation campaign even though its configured remote ref was unavailable. Repositories containing any local go.mod remain hard blockers.

type GraphFilters added in v0.9.0

type GraphFilters struct {
	Dependencies []string `json:"dependencies,omitempty" yaml:"dependencies,omitempty"`
}

GraphFilters records evidence filters applied after repository discovery.

type GraphModule added in v0.9.0

type GraphModule struct {
	Path       string `json:"path" yaml:"path"`
	Repository string `json:"repository" yaml:"repository"`
	Manifest   string `json:"manifest" yaml:"manifest"`
}

GraphModule is a module declaration and its source manifest.

type GraphOptions added in v0.9.0

type GraphOptions struct {
	Ecosystem    Ecosystem
	GitHubDir    string
	Ref          string
	Parallel     int
	Timeout      time.Duration
	Retry        int
	Dependencies []string
}

GraphOptions controls read-only dependency discovery and evidence filtering.

type GraphOrder added in v0.13.0

type GraphOrder struct {
	Layers []GraphOrderLayer `json:"layers,omitempty" yaml:"layers,omitempty"`
	Cycles []GraphOrderCycle `json:"cycles,omitempty" yaml:"cycles,omitempty"`
}

GraphOrder is the provider-first layering of the selected repositories. It answers "which repositories must be released first" from the same canonical evidence as every projection, without a second manifest scan.

func (GraphOrder) Markdown added in v0.13.0

func (order GraphOrder) Markdown() string

Markdown renders the provider-first layering, or nothing when the selection contains no repository. Cycles are named explicitly so an operator never has to infer why two repositories share a layer.

func (GraphOrder) Repositories added in v0.13.0

func (order GraphOrder) Repositories() []string

Repositories lists every repository of the layering in provider-first order.

type GraphOrderCycle added in v0.13.0

type GraphOrderCycle struct {
	Layer        int      `json:"layer" yaml:"layer"`
	Repositories []string `json:"repositories" yaml:"repositories"`
	Path         string   `json:"path" yaml:"path"`
}

GraphOrderCycle records repositories that require each other and therefore share one layer, because no release order can separate them.

type GraphOrderLayer added in v0.13.0

type GraphOrderLayer struct {
	Index        int      `json:"index" yaml:"index"`
	Repositories []string `json:"repositories" yaml:"repositories"`
}

GraphOrderLayer lists repositories whose selected internal providers all sit in earlier layers, so the whole layer may be processed as one batch.

type GraphProjection added in v0.9.0

type GraphProjection struct {
	View  GraphView
	Nodes []GraphProjectionNode
	Edges []GraphProjectionEdge
}

GraphProjection is a deterministic view derived only from Graph.

type GraphProjectionEdge added in v0.9.0

type GraphProjectionEdge struct {
	ID            string
	From          string
	To            string
	DirectCount   int
	IndirectCount int
	Status        string
	Evidence      []string
}

GraphProjectionEdge aggregates canonical evidence for a visual relation.

type GraphProjectionNode added in v0.9.0

type GraphProjectionNode struct {
	ID             string
	Kind           string
	Label          string
	Subtitle       string
	Status         string
	Repository     string
	Dependency     string
	Version        string
	GitHubURL      string
	CodeGrapherURL string
	Organization   string
}

GraphProjectionNode is a visual entity with stable identity.

type GraphReportPaths added in v0.9.0

type GraphReportPaths struct {
	Markdown string
	YAML     string
	JSON     string
	SVG      string
	HTML     string
}

GraphReportPaths identifies every artifact written for one graph scan.

func WriteGraphReports added in v0.9.0

func WriteGraphReports(directory string, graph Graph, view GraphView) (GraphReportPaths, error)

WriteGraphReports atomically writes every human, machine, and visual artifact.

type GraphRepository added in v0.9.0

type GraphRepository struct {
	Slug         string   `json:"slug" yaml:"slug"`
	Organization string   `json:"organization" yaml:"organization"`
	Modules      []string `json:"modules,omitempty" yaml:"modules,omitempty"`
}

GraphRepository is a selected repository retained by the filtered graph.

type GraphRequirement added in v0.9.0

type GraphRequirement struct {
	Dependency         string   `json:"dependency" yaml:"dependency"`
	Version            string   `json:"version" yaml:"version"`
	ConsumerModule     string   `json:"consumer_module" yaml:"consumer_module"`
	ConsumerRepository string   `json:"consumer_repository" yaml:"consumer_repository"`
	Manifest           string   `json:"manifest" yaml:"manifest"`
	Indirect           bool     `json:"indirect,omitempty" yaml:"indirect,omitempty"`
	ProviderModule     string   `json:"provider_module,omitempty" yaml:"provider_module,omitempty"`
	ProviderRepository string   `json:"provider_repository,omitempty" yaml:"provider_repository,omitempty"`
	ProviderCandidates []string `json:"provider_candidates,omitempty" yaml:"provider_candidates,omitempty"`
}

GraphRequirement is one manifest-owned dependency selection.

type GraphSummary added in v0.9.0

type GraphSummary struct {
	Repositories         int `json:"repositories" yaml:"repositories"`
	Modules              int `json:"modules" yaml:"modules"`
	Requirements         int `json:"requirements" yaml:"requirements"`
	InternalRequirements int `json:"internal_requirements" yaml:"internal_requirements"`
	ExternalDependencies int `json:"external_dependencies" yaml:"external_dependencies"`
	Selections           int `json:"selections" yaml:"selections"`
	AmbiguousProviders   int `json:"ambiguous_providers" yaml:"ambiguous_providers"`
}

GraphSummary provides view-independent canonical counts.

type GraphView added in v0.9.0

type GraphView string

GraphView selects one visual projection of canonical dependency evidence.

const (
	GraphViewRepositories GraphView = "repos"
	GraphViewDependencies GraphView = "dependencies"
	GraphViewSelections   GraphView = "selections"
)

func ParseGraphView added in v0.9.0

func ParseGraphView(value string) (GraphView, error)

ParseGraphView validates a CLI or report projection name.

type LayerSelection added in v0.13.0

type LayerSelection struct {
	// contains filtered or unexported fields
}

LayerSelection restricts an ordered run to one layer or a contiguous range of layers. The zero value selects every layer.

func ParseLayerSelection added in v0.13.0

func ParseLayerSelection(value string) (LayerSelection, error)

ParseLayerSelection accepts an empty value for every layer, `N` for one layer, `N-M` for a closed range, and `N-` for every layer from N onwards.

func (LayerSelection) Contains added in v0.13.0

func (selection LayerSelection) Contains(index int) bool

Contains reports whether one layer index belongs to the selection.

func (LayerSelection) String added in v0.13.0

func (selection LayerSelection) String() string

String renders the requested selection for reports and reasons.

type Options

type Options struct {
	GitHubDir      string
	Ref            string
	Parallel       int
	DryRun         bool
	Resume         bool
	AllowDowngrade bool
	Verify         bool
	Checks         []quality.Check
	Timeout        time.Duration
	Retry          int
	// GoPrivate supplies comma-separated Go module path patterns that must not
	// be looked up through a public module proxy or checksum database. The
	// patterns are merged with the caller's GOPRIVATE/GONOPROXY/GONOSUMDB only
	// for Go subprocesses; WB never writes Go's global environment.
	GoPrivate []string
	Commit    bool
	Push      bool
	PR        bool
	Merge     bool
	ReportDir string
	// Order sequences repositories in provider-first dependency layers derived
	// from the selected repositories' own module declarations and requirements,
	// instead of processing the whole selection as one batch.
	Order bool
	// Layers restricts an ordered run to one layer or a contiguous range so an
	// operator can land one layer before starting the next.
	Layers LayerSelection

	// ResolveGitHubRef is injectable for hermetic adapter tests.
	ResolveGitHubRef func(context.Context, string, string) (string, error)
}

Options controls repository isolation, verification, and optional publishing.

type OrderLayerReport added in v0.13.0

type OrderLayerReport struct {
	Index        int      `yaml:"index"`
	Repositories []string `yaml:"repositories"`
	Status       string   `yaml:"status"`
}

OrderLayerReport records one layer and how this run treated it: `completed`, `failed`, `blocked` by an earlier failed layer, or `not_selected`.

type OrderReport added in v0.13.0

type OrderReport struct {
	Selection string             `yaml:"selection"`
	Layers    []OrderLayerReport `yaml:"layers"`
	Cycles    []GraphOrderCycle  `yaml:"cycles,omitempty"`
}

OrderReport records the provider-first layer plan an ordered run followed.

func (*OrderReport) Markdown added in v0.13.0

func (report *OrderReport) Markdown() string

Markdown renders the layer plan and each layer's outcome, or nothing when the run was not ordered. It is the per-layer boundary an operator reads to decide whether the next layer may start.

type PublishedGoRelease

type PublishedGoRelease struct {
	Version      string
	Requirements map[string]string
	Source       string
}

PublishedGoRelease is immutable registry evidence used to carry an event through an already-current consumer without manufacturing another release.

type ReleaseEvent

type ReleaseEvent struct {
	Dependency string `yaml:"dependency"`
	Version    string `yaml:"version"`
	Source     string `yaml:"source"`
	// CheckedAt is when WB accepted this version from the operator or last
	// confirmed it against the registry. Persisting it lets a resumed or
	// long-running campaign refresh stale events before spending another CI
	// build on a downstream PR.
	CheckedAt time.Time `yaml:"checked_at,omitempty"`
}

ReleaseEvent is version evidence that starts or advances a dependency wave.

type ReleaseEventRefresh added in v0.16.0

type ReleaseEventRefresh struct {
	Dependency string    `yaml:"dependency"`
	Before     string    `yaml:"before"`
	After      string    `yaml:"after"`
	CheckedAt  time.Time `yaml:"checked_at"`
	Reason     string    `yaml:"reason"`
}

ReleaseEventRefresh records the inexpensive registry check WB performs before a stale event is allowed to trigger another downstream build.

type ReleaseObservation

type ReleaseObservation struct {
	Module               string            `yaml:"module"`
	Repository           string            `yaml:"repository"`
	Before               string            `yaml:"before,omitempty"`
	After                string            `yaml:"after,omitempty"`
	Source               string            `yaml:"source"`
	Status               string            `yaml:"status"`
	Reason               string            `yaml:"reason"`
	ExpectedRequirements map[string]string `yaml:"expected_requirements,omitempty"`
	RequireNewer         bool              `yaml:"require_newer,omitempty"`
	CheckedAt            time.Time         `yaml:"checked_at,omitempty"`
}

ReleaseObservation prevents the wave engine from inventing provider versions.

type RemoteCheck

type RemoteCheck = orchestrate.RemoteCheck

RemoteCheck is the normalized GitHub check state observed before merge.

type Report

type Report struct {
	SchemaVersion int                `yaml:"schema_version"`
	Operation     string             `yaml:"operation"`
	Status        string             `yaml:"status"`
	Target        Target             `yaml:"target"`
	GitHubDir     string             `yaml:"github_dir"`
	BaseRef       string             `yaml:"base_ref"`
	Verification  []quality.Check    `yaml:"verification,omitempty"`
	Parallel      int                `yaml:"parallel"`
	Order         *OrderReport       `yaml:"order,omitempty"`
	Repositories  []RepositoryReport `yaml:"repositories"`
}

Report is the stable Markdown/YAML index for one exact-set operation.

func Run

func Run(ctx context.Context, target Target, repositories []Repository, options Options) (Report, error)

Run resolves one exact target and delegates repository lifecycle to the shared typed orchestration engine. The adapter owns dependency decisions.

func (Report) JSON added in v0.14.0

func (report Report) JSON() ([]byte, error)

JSON renders the report with the same field names and shape as YAML.

func (Report) Markdown

func (report Report) Markdown() string

Markdown renders a linked index suitable for human or AI review.

func (Report) YAML

func (report Report) YAML() ([]byte, error)

YAML renders the same deterministic report for tooling.

type Repository

type Repository = orchestrate.Repository

Repository identifies a canonical clone selected by command-level discovery.

type RepositoryReport

type RepositoryReport struct {
	Repository    string                      `yaml:"repository"`
	CanonicalDir  string                      `yaml:"canonical_dir,omitempty"`
	WorktreeDir   string                      `yaml:"worktree_dir,omitempty"`
	Branch        string                      `yaml:"branch,omitempty"`
	Ref           string                      `yaml:"ref"`
	Status        string                      `yaml:"status"`
	Reason        string                      `yaml:"reason"`
	Decisions     []Decision                  `yaml:"decisions,omitempty"`
	ChangedFiles  []string                    `yaml:"changed_files,omitempty"`
	Verifications []quality.VerificationEntry `yaml:"verifications,omitempty"`
	Commit        string                      `yaml:"commit,omitempty"`
	Pushed        bool                        `yaml:"pushed,omitempty"`
	PR            string                      `yaml:"pr,omitempty"`
	Checks        []RemoteCheck               `yaml:"checks,omitempty"`
	Merged        bool                        `yaml:"merged,omitempty"`
}

RepositoryReport records one selected repository and every external stage.

type Target

type Target struct {
	Ecosystem  Ecosystem `yaml:"ecosystem"`
	Dependency string    `yaml:"dependency"`
	Version    string    `yaml:"version"`
	Resolved   string    `yaml:"resolved,omitempty"`
}

Target is the exact dependency identity and version requested by the user.

func ParseTarget

func ParseTarget(ecosystem, value string) (Target, error)

ParseTarget validates a command target such as strongo/cicd@v1.10.5.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL