deps

package
v0.74.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 2, 2026 License: MIT Imports: 32 Imported by: 0

Documentation

Overview

Package deps coordinates exact dependency updates across isolated repository worktrees. Ecosystem adapters own discovery and mutation; the runner owns Git, verification, publication, and deterministic reports.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func BumpOperationID

func BumpOperationID(events []ReleaseEvent) string

BumpOperationID returns the stable Go campaign identity for a sorted seed set. Kept for backward compatibility with every caller that predates npm support; new callers that also know the ecosystem should use BumpOperationIDFor.

func BumpOperationIDFor added in v0.20.0

func BumpOperationIDFor(ecosystem Ecosystem, events []ReleaseEvent) string

BumpOperationIDFor returns the stable campaign identity for a sorted seed set of release events in the given ecosystem.

func DriftFailed added in v0.35.0

func DriftFailed(report DriftReport, failOnDrift bool) bool

DriftFailed reports whether the complete report should exit non-zero.

func ValidateBumpOptions added in v0.48.0

func ValidateBumpOptions(options BumpOptions, events []ReleaseEvent) error

ValidateBumpOptions applies the exact no-I/O normalization used by RunBump. Composite commands call it before an irreversible provider action so an invalid downstream checks/filter/retry/timeout/merge contract cannot leave a provider published but unable to enter the shared wave engine.

func ValidateNpmPackageName added in v0.48.0

func ValidateNpmPackageName(name string) error

validateNpmPackageName performs the same light structural validation for a `deps bump npm --changed` event that ParseTarget already relies on being well-formed for `deps set npm`. ValidateNpmPackageName validates one exact npm package identity. Commands outside the dependency adapter (for example workflow-owned publication) must use this same validator before contacting a registry or GitHub.

func WriteBumpReports

func WriteBumpReports(directory string, report BumpReport) error

WriteBumpReports atomically replaces the human and machine campaign indexes.

func WriteDriftReports added in v0.35.0

func WriteDriftReports(directory string, report DriftReport) error

WriteDriftReports writes markdown, yaml, and json drift artifacts.

func WriteReports

func WriteReports(directory string, report Report) error

WriteReports writes deps-set.md and deps-set.yaml to the requested directory.

Types

type BumpOptions

type BumpOptions struct {
	Options
	// Ecosystem selects which fleet graph and adapter the wave engine uses.
	// The zero value defaults to EcosystemGo for backward compatibility with
	// every caller that predates npm support.
	Ecosystem    Ecosystem
	MaxWaves     int
	PollInterval time.Duration
	RefreshAfter time.Duration
	Previous     *BumpReport
	Persist      func(BumpReport) error
	// NoRegistry forbids every registry lookup while retaining the shared
	// fleet-graph and wave-planning algorithm. Composite publication plans use
	// it before a provider workflow has published the proposed version.
	NoRegistry bool
	// FetchCache (the opt-in --fetch-cache flag) shares one process-local
	// orchestrate.FetchMemo across every graph-discovery and wave lifecycle of
	// this invocation. Only read-only DISCOVERY passes consume it: a
	// repository fetched during one wave's discovery is not re-fetched by
	// later waves' discovery while the memoized fetch is younger than
	// orchestrate.FetchMemoMaxAge, UNLESS this run has ever pushed to, opened
	// a PR for, or merged into it — such a repository is permanently
	// un-memoizable for the rest of the run, because WB merges server-side
	// and the resulting default-branch commits are invisible to any
	// local-push accounting. The wave engine's own pre-mutation fetch is
	// never skipped, so branch bases are always freshly fetched. Nothing is
	// persisted: a fresh invocation (including --resume) always starts with
	// an empty memo.
	FetchCache bool

	// Now is injectable for deterministic event-refresh tests.
	Now func() time.Time
	// LatestGoVersion is injectable for deterministic wave tests.
	LatestGoVersion func(context.Context, string) (string, error)
	// LatestGoRelease is injectable for graph traversal through modules that
	// were updated and published before this campaign started.
	LatestGoRelease func(context.Context, string) (PublishedGoRelease, error)
	// LatestNpmVersion is the npm-ecosystem analogue of LatestGoVersion.
	LatestNpmVersion func(context.Context, string) (string, error)
	// LatestNpmRelease is the npm-ecosystem analogue of LatestGoRelease. It
	// reuses PublishedGoRelease's shape (version, requirements, source) since
	// nothing about that shape is actually Go-specific.
	LatestNpmRelease func(context.Context, string) (PublishedGoRelease, error)
}

BumpOptions adds wave and release discovery policy to shared lifecycle options.

type BumpPhase added in v0.12.0

type BumpPhase string

BumpPhase identifies the operation currently represented by a persisted report. It makes an interrupted campaign distinguish graph discovery from a wave that is waiting on local or remote work.

const (
	BumpPhasePreparing        BumpPhase = "preparing"
	BumpPhaseDiscoveringGraph BumpPhase = "discovering_graph"
	BumpPhasePlanningWave     BumpPhase = "planning_wave"
	BumpPhaseProcessingWave   BumpPhase = "processing_wave"
	BumpPhasePlanned          BumpPhase = "planned"
	BumpPhaseAwaitingMerge    BumpPhase = "awaiting_merge"
	BumpPhaseAwaitingRelease  BumpPhase = "awaiting_release"
	BumpPhaseCompleted        BumpPhase = "completed"
)

type BumpProgress added in v0.12.0

type BumpProgress struct {
	Wave                  int    `yaml:"wave,omitempty"`
	RepositoriesTotal     int    `yaml:"repositories_total,omitempty"`
	RepositoriesCompleted int    `yaml:"repositories_completed,omitempty"`
	LastRepository        string `yaml:"last_repository,omitempty"`
}

BumpProgress records the bounded unit of work for Phase. During graph discovery it advances once per selected repository; during wave processing it identifies the selected wave repositories.

type BumpReport

type BumpReport struct {
	SchemaVersion  int             `yaml:"schema_version"`
	Operation      string          `yaml:"operation"`
	Status         string          `yaml:"status"`
	Phase          BumpPhase       `yaml:"phase"`
	Progress       BumpProgress    `yaml:"progress"`
	Ecosystem      Ecosystem       `yaml:"ecosystem"`
	SeedEvents     []ReleaseEvent  `yaml:"seed_events"`
	GitHubDir      string          `yaml:"github_dir"`
	BaseRef        string          `yaml:"base_ref"`
	ValidationMode ValidationMode  `yaml:"validation_mode,omitempty"`
	Verification   []quality.Check `yaml:"verification,omitempty"`
	Parallel       int             `yaml:"parallel"`
	// ParallelExplicit records whether the operator set --parallel themselves
	// when this campaign ran. A resume without its own explicit --parallel
	// restores it, so "an explicit --parallel bounds every pool in both
	// directions" — including the read-only worker floor staying off for an
	// explicit --parallel 1 — survives interruption and resume.
	ParallelExplicit bool `yaml:"parallel_explicit,omitempty"`
	// RegistryLookupsSkipped records that this plan intentionally omitted
	// registry-derived carrier and stale-event evidence.
	RegistryLookupsSkipped bool `yaml:"registry_lookups_skipped,omitempty"`
	// FetchCacheEnabled records whether THIS invocation ran with the opt-in
	// --fetch-cache discovery memo, so a post-mortem (duplicate PR, stale
	// base, spun waves) can attribute or rule out memoized discovery reads.
	// It always reflects the live invocation, never a resumed report's past.
	FetchCacheEnabled      bool                          `yaml:"fetch_cache_enabled,omitempty"`
	DiscoverySkips         []GraphDiscoverySkip          `yaml:"discovery_skips,omitempty"`
	DefaultBranchFallbacks []GraphDefaultBranchFallback  `yaml:"default_branch_fallbacks,omitempty"`
	ManifestWarnings       []GraphManifestWarning        `yaml:"manifest_warnings,omitempty"`
	AmbiguousModules       []GraphAmbiguousModuleWarning `yaml:"ambiguous_modules,omitempty"`
	Waves                  []BumpWaveReport              `yaml:"waves"`
}

BumpReport is the persistent Markdown/YAML state of a wave campaign.

func LoadBumpReport

func LoadBumpReport(directory string) (BumpReport, error)

LoadBumpReport loads persisted resume state.

func RunBump

func RunBump(ctx context.Context, events []ReleaseEvent, repositories []Repository, options BumpOptions) (BumpReport, error)

RunBump propagates explicit Go release events through recalculated direct consumer waves. Each newly observed provider release becomes the next wave.

func (BumpReport) JSON added in v0.14.0

func (report BumpReport) JSON() ([]byte, error)

JSON renders the same wave state with the field names YAML uses.

func (BumpReport) Markdown

func (report BumpReport) Markdown() string

Markdown renders the wave, repository, and release-evidence index.

func (BumpReport) YAML

func (report BumpReport) YAML() ([]byte, error)

YAML renders deterministic machine-readable wave state.

type BumpWaveReport

type BumpWaveReport struct {
	Index                int                   `yaml:"index"`
	Status               string                `yaml:"status"`
	ValidationMode       ValidationMode        `yaml:"validation_mode,omitempty"`
	Events               []ReleaseEvent        `yaml:"events"`
	Refreshes            []ReleaseEventRefresh `yaml:"refreshes,omitempty"`
	DeferredRepositories []string              `yaml:"deferred_repositories,omitempty"`
	Repositories         []RepositoryReport    `yaml:"repositories"`
	Releases             []ReleaseObservation  `yaml:"releases,omitempty"`
	// DiscoveryFetchesSkipped counts the origin fetches this wave's graph
	// discovery reused from the run's fetch memo (always zero without
	// --fetch-cache), attributing exactly how much the cache saved per wave.
	DiscoveryFetchesSkipped int `yaml:"discovery_fetches_skipped,omitempty"`
}

BumpWaveReport records one recalculated direct-consumer layer.

type Decision

type Decision struct {
	Dependency    string    `yaml:"dependency,omitempty"`
	Ecosystem     Ecosystem `yaml:"ecosystem,omitempty"`
	File          string    `yaml:"file"`
	Selector      string    `yaml:"selector,omitempty"`
	BeforeRef     string    `yaml:"before_ref,omitempty"`
	BeforeVersion string    `yaml:"before_version,omitempty"`
	TargetVersion string    `yaml:"target_version"`
	ResolvedRef   string    `yaml:"resolved_ref,omitempty"`
	AfterRef      string    `yaml:"after_ref,omitempty"`
	AfterVersion  string    `yaml:"after_version,omitempty"`
	Action        string    `yaml:"action"`
	Reason        string    `yaml:"reason"`
}

Decision explains one existing dependency reference before and after update.

type DependencyDelta added in v0.67.10

type DependencyDelta struct {
	SourcePR         string    `yaml:"source_pr,omitempty"`
	SourceHead       string    `yaml:"source_head,omitempty"`
	Consumer         string    `yaml:"consumer"`
	Ecosystem        Ecosystem `yaml:"ecosystem"`
	Package          string    `yaml:"package"`
	Manifest         string    `yaml:"manifest"`
	Selector         string    `yaml:"selector"`
	Before           string    `yaml:"before"`
	RequestedAfter   string    `yaml:"requested_after"`
	CandidateAfter   string    `yaml:"candidate_after"`
	Lockfile         string    `yaml:"lockfile,omitempty"`
	LockfileSelector string    `yaml:"lockfile_selector,omitempty"`
	LockfileVersion  string    `yaml:"lockfile_version,omitempty"`
	Reviewed         bool      `yaml:"reviewed"`
}

DependencyDelta records one exact direct manifest/importer requirement from a campaign PR. CandidateAfter is the value observed after the adapter's apply/selection verification; it is never inferred from package families.

type DirectiveAssessment added in v0.62.1

type DirectiveAssessment struct {
	ModuleDir        string
	ModulePath       string
	CurrentGoVersion string
	CurrentToolchain string
	// TargetGoVersion is the exact `go` directive value the command would
	// write for a would-change or (after apply) compliant module. It may be
	// higher than the policy's baseline GoVersion when a dependency's ceiling
	// still falls within the same language version (e.g. policy 1.26.0 but a
	// dependency requires 1.26.4 exactly).
	TargetGoVersion string
	// Ceiling is the highest `go` directive found among this module's
	// dependencies in its resolved build list, independent of policy — empty
	// when the graph was not resolved (below-floor, error) or no dependency
	// declares one. It is the value Go's own MVS would require regardless of
	// what this module's own `go` line says.
	Ceiling string
	Verdict DirectiveVerdict
	Forcing []ForcingDependency
	Detail  string
}

DirectiveAssessment is one Go module's achievability verdict against a DirectivePolicy.

func ApplyDirective added in v0.62.1

func ApplyDirective(ctx context.Context, moduleDir string, policy DirectivePolicy, options Options) (DirectiveAssessment, error)

ApplyDirective assesses moduleDir and, only when the verdict is would-change, writes the policy's `go` and `toolchain` directives with `go mod edit`, then runs `go mod tidy` and re-assesses to prove the edit was not silently reverted by a forcing dependency that assessment missed.

func AssessDirective added in v0.62.1

func AssessDirective(ctx context.Context, moduleDir string, policy DirectivePolicy, options Options) (DirectiveAssessment, error)

AssessDirective resolves moduleDir's actual build list with `go` tooling and determines whether policy is achievable there, without writing anything to moduleDir.

func (DirectiveAssessment) EffectiveGoVersion added in v0.62.1

func (a DirectiveAssessment) EffectiveGoVersion() string

EffectiveGoVersion is the `go` language version this module actually needs today, as committed — the value `go build`/`go list` would require right now, regardless of the fleet policy this assessment was run against. It is the higher of the module's own current `go` directive and its dependency ceiling: MVS never lets a module's effective requirement fall below either. A caller comparing against what a fixed local toolchain can run (for example GitHub CodeQL's default-setup, which pins GOTOOLCHAIN=local) should use this value, not TargetGoVersion — that field is what the fleet policy would set, not what the repository requires as committed.

type DirectivePolicy added in v0.62.1

type DirectivePolicy struct {
	GoVersion string
	Toolchain string
}

DirectivePolicy is the fleet's target `go`/`toolchain` declaration: a `go` language directive low enough that MVS does not impose it on consumers, paired with the `toolchain` directive that actually builds the module. GoVersion is written without a "go" prefix ("1.26.0"), matching the go.mod directive syntax; Toolchain carries the prefix ("go1.27.0"), matching the toolchain directive syntax.

type DirectiveVerdict added in v0.62.1

type DirectiveVerdict string

DirectiveVerdict is the one category a module's directive assessment lands in. Exactly one applies per module.

const (
	// DirectiveCompliant means the module already declares the policy's `go`
	// language version and `toolchain`.
	DirectiveCompliant DirectiveVerdict = "compliant"
	// DirectiveWouldChange means the policy is achievable but not yet
	// declared; --apply would write it.
	DirectiveWouldChange DirectiveVerdict = "would-change"
	// DirectiveCannotComply means a dependency's own `go` directive sets a
	// ceiling above the policy's target language version.
	DirectiveCannotComply DirectiveVerdict = "cannot-comply"
	// DirectiveBelowFloor means the module's current `go` directive language
	// version is already below the policy's target; raising it is a separate
	// decision this command never makes silently.
	DirectiveBelowFloor DirectiveVerdict = "below-floor"
	// DirectiveError means the module graph could not be safely or reliably
	// resolved (for example, an unpublishable local `replace` directive, or a
	// `go list` failure).
	DirectiveError DirectiveVerdict = "error"
)

type DriftClassification added in v0.35.0

type DriftClassification string

DriftClassification is the fleet-level state for one canonical dependency path.

const (
	DriftConverged      DriftClassification = "converged"
	DriftDivergent      DriftClassification = "divergent"
	DriftReplaced       DriftClassification = "replaced"
	DriftMajorPathSplit DriftClassification = "major_path_split"
	DriftUnavailable    DriftClassification = "unavailable"
	DriftError          DriftClassification = "error"
)

type DriftDependency added in v0.35.0

type DriftDependency struct {
	Dependency  string           `json:"dependency" yaml:"dependency"`
	Manifest    string           `json:"manifest" yaml:"manifest"`
	Declared    VersionEvidence  `json:"declared" yaml:"declared"`
	Selected    VersionEvidence  `json:"selected" yaml:"selected"`
	Replacement *ReplaceEvidence `json:"replacement,omitempty" yaml:"replacement,omitempty"`
	Latest      *VersionEvidence `json:"latest,omitempty" yaml:"latest,omitempty"`
	Edges       []DriftEdge      `json:"edges,omitempty" yaml:"edges,omitempty"`
}

DriftDependency is one module-path observation inside a repository.

type DriftEdge added in v0.35.0

type DriftEdge struct {
	ConsumerModule string `json:"consumer_module" yaml:"consumer_module"`
	Dependency     string `json:"dependency" yaml:"dependency"`
	Version        string `json:"version" yaml:"version"`
	Manifest       string `json:"manifest" yaml:"manifest"`
	Indirect       bool   `json:"indirect,omitempty" yaml:"indirect,omitempty"`
}

DriftEdge is a direct manifest requirement edge (not a full MVS forcing path).

type DriftOptions added in v0.35.0

type DriftOptions struct {
	GitHubDir    string
	Ref          string
	Parallel     int
	Timeout      time.Duration
	Retry        int
	GoPrivate    []string
	Dependencies []string
	Online       bool
	FailOnDrift  bool
	Now          func() time.Time
	Progress     progress.Reporter
}

DriftOptions controls read-only drift analysis.

type DriftReport added in v0.35.0

type DriftReport struct {
	SchemaVersion  int                  `json:"schema_version" yaml:"schema_version"`
	Ecosystem      Ecosystem            `json:"ecosystem" yaml:"ecosystem"`
	Mode           string               `json:"mode" yaml:"mode"`
	BaseRef        string               `json:"base_ref" yaml:"base_ref"`
	ObservedAt     time.Time            `json:"observed_at" yaml:"observed_at"`
	Summary        DriftSummary         `json:"summary" yaml:"summary"`
	Groups         []DriftVersionGroup  `json:"groups" yaml:"groups"`
	Repositories   []DriftRepository    `json:"repositories" yaml:"repositories"`
	DiscoverySkips []GraphDiscoverySkip `json:"discovery_skips,omitempty" yaml:"discovery_skips,omitempty"`
}

DriftReport is the deterministic convergence index for one repository or a fleet.

func AnalyzeDrift added in v0.35.0

func AnalyzeDrift(ctx context.Context, repositories []Repository, options DriftOptions) (DriftReport, error)

AnalyzeDrift builds a read-only Go dependency convergence report for the selected repositories. It never mutates manifests or contacts a registry unless options.Online is set.

func (DriftReport) JSON added in v0.35.0

func (report DriftReport) JSON() ([]byte, error)

JSON renders the drift report.

func (DriftReport) Markdown added in v0.35.0

func (report DriftReport) Markdown() string

Markdown renders a linked drift index for people and agents.

func (DriftReport) YAML added in v0.35.0

func (report DriftReport) YAML() ([]byte, error)

YAML renders the drift report.

type DriftRepository added in v0.35.0

type DriftRepository struct {
	Repository   string            `json:"repository" yaml:"repository"`
	Path         string            `json:"path" yaml:"path"`
	Status       string            `json:"status" yaml:"status"`
	Reason       string            `json:"reason,omitempty" yaml:"reason,omitempty"`
	Dependencies []DriftDependency `json:"dependencies,omitempty" yaml:"dependencies,omitempty"`
}

DriftRepository is one inspected checkout.

type DriftSummary added in v0.35.0

type DriftSummary struct {
	Repositories int `json:"repositories" yaml:"repositories"`
	Dependencies int `json:"dependencies" yaml:"dependencies"`
	Converged    int `json:"converged" yaml:"converged"`
	Divergent    int `json:"divergent" yaml:"divergent"`
	Replaced     int `json:"replaced" yaml:"replaced"`
	MajorSplit   int `json:"major_path_split" yaml:"major_path_split"`
	Unavailable  int `json:"unavailable" yaml:"unavailable"`
	Error        int `json:"error" yaml:"error"`
}

DriftSummary counts fleet-level classifications.

type DriftVersionGroup added in v0.35.0

type DriftVersionGroup struct {
	Dependency     string              `json:"dependency" yaml:"dependency"`
	Family         string              `json:"family,omitempty" yaml:"family,omitempty"`
	Classification DriftClassification `json:"classification" yaml:"classification"`
	Versions       []DriftVersionUse   `json:"versions" yaml:"versions"`
	MajorPaths     []string            `json:"major_paths,omitempty" yaml:"major_paths,omitempty"`
	Latest         *VersionEvidence    `json:"latest,omitempty" yaml:"latest,omitempty"`
	Reason         string              `json:"reason,omitempty" yaml:"reason,omitempty"`
}

DriftVersionGroup aggregates one canonical dependency across repositories.

type DriftVersionUse added in v0.35.0

type DriftVersionUse struct {
	Version      string   `json:"version" yaml:"version"`
	Kind         string   `json:"kind" yaml:"kind"` // selected or declared
	Repositories []string `json:"repositories" yaml:"repositories"`
}

DriftVersionUse links one observed version to the repositories that use it.

type Ecosystem

type Ecosystem string

Ecosystem identifies a dependency manifest or reference format.

const (
	EcosystemGitHubActions Ecosystem = "github-actions"
	EcosystemGo            Ecosystem = "go"
	EcosystemNPM           Ecosystem = "npm"
)

type ForcingDependency added in v0.62.1

type ForcingDependency struct {
	Path      string `json:"path"`
	Version   string `json:"version"`
	GoVersion string `json:"goVersion"`
}

ForcingDependency names one module in the resolved build list whose own `go` directive sets (or ties) the ceiling that blocks compliance.

type Graph added in v0.9.0

type Graph struct {
	SchemaVersion int                `json:"schema_version" yaml:"schema_version"`
	Ecosystem     Ecosystem          `json:"ecosystem" yaml:"ecosystem"`
	BaseRef       string             `json:"base_ref" yaml:"base_ref"`
	Filters       GraphFilters       `json:"filters" yaml:"filters"`
	Summary       GraphSummary       `json:"summary" yaml:"summary"`
	Order         GraphOrder         `json:"order" yaml:"order"`
	Repositories  []GraphRepository  `json:"repositories" yaml:"repositories"`
	Modules       []GraphModule      `json:"modules" yaml:"modules"`
	Requirements  []GraphRequirement `json:"requirements" yaml:"requirements"`
	// DiscoverySkips lists repositories excluded from the walk rather than
	// inspected. It belongs to the graph rather than to a log line so that no
	// output format can present a partial fleet as a complete one.
	DiscoverySkips []GraphDiscoverySkip `json:"discovery_skips,omitempty" yaml:"discovery_skips,omitempty"`
	// DefaultBranchFallbacks lists repositories fully discovered using their
	// actual default branch because the configured base ref did not exist.
	DefaultBranchFallbacks []GraphDefaultBranchFallback `json:"default_branch_fallbacks,omitempty" yaml:"default_branch_fallbacks,omitempty"`
	// ManifestWarnings lists non-root manifest files skipped for failing to
	// parse instead of aborting discovery.
	ManifestWarnings []GraphManifestWarning `json:"manifest_warnings,omitempty" yaml:"manifest_warnings,omitempty"`
	// AmbiguousModules lists modules declared by more than one repository
	// whose conflict was deterministically resolved instead of aborting the
	// fleet (Go only; see GraphAmbiguousModuleWarning).
	AmbiguousModules []GraphAmbiguousModuleWarning `json:"ambiguous_modules,omitempty" yaml:"ambiguous_modules,omitempty"`
}

Graph is the canonical, deterministic evidence model shared by every view.

func BuildGraph added in v0.9.0

func BuildGraph(ctx context.Context, repositories []Repository, options GraphOptions) (Graph, error)

BuildGraph scans selected repositories once and returns canonical evidence.

func (Graph) HTML added in v0.9.0

func (graph Graph) HTML(defaultView GraphView) ([]byte, error)

HTML renders all projections into one self-contained interactive document.

func (Graph) JSON added in v0.9.0

func (graph Graph) JSON() ([]byte, error)

JSON serializes the deterministic canonical evidence model.

func (Graph) Markdown added in v0.9.0

func (graph Graph) Markdown() string

Markdown renders canonical counts and every manifest evidence row.

func (Graph) Output added in v0.9.0

func (graph Graph) Output(format string, view GraphView) ([]byte, error)

Output renders the requested stdout format.

func (Graph) Project added in v0.9.0

func (graph Graph) Project(view GraphView) (GraphProjection, error)

Project derives one visual view without rescanning canonical evidence.

func (Graph) RepositoryOrder added in v0.13.0

func (graph Graph) RepositoryOrder() GraphOrder

RepositoryOrder derives the provider-first layering of the selected repositories from canonical requirement evidence alone. Layer 0 requires no other selected repository; every later layer requires only earlier layers, so one layer can be released before the next one starts.

Repositories that require each other cannot be separated by any order. They share one strongly connected component, are placed in one layer, and are reported as a cycle instead of being dropped or making layering fail.

func (Graph) SVG added in v0.9.0

func (graph Graph) SVG(view GraphView) ([]byte, error)

SVG renders one deterministic projection as an accessible standalone SVG.

func (Graph) YAML added in v0.9.0

func (graph Graph) YAML() ([]byte, error)

YAML serializes the deterministic canonical evidence model.

type GraphAmbiguousModuleWarning added in v0.59.3

type GraphAmbiguousModuleWarning struct {
	Module     string   `json:"module" yaml:"module"`
	Repository string   `json:"repository" yaml:"repository"`
	Manifest   string   `json:"manifest" yaml:"manifest"`
	Duplicates []string `json:"duplicates" yaml:"duplicates"`
	Reason     string   `json:"reason" yaml:"reason"`
}

GraphAmbiguousModuleWarning records a Go module declared by more than one repository whose conflict was NOT treated as fatal because WB could deterministically pick a canonical declaration: either the module's own declared path names that repository (a legitimate fork keeps the upstream's module path, and the repository matching it is preferred), or the repository's own origin remote matches the {org}/{repo} its directory name claims while the others do not (a stale duplicate local clone left behind by an org move or rename, still declaring the module under its now-wrong directory-derived slug). Every other declaration is named as a duplicate so the substitution stays visible rather than silent. A module where no declaration can be preferred this way remains a fatal conflict (see goFleetGraph.validateUniqueModuleDeclarations).

type GraphDefaultBranchFallback added in v0.59.2

type GraphDefaultBranchFallback struct {
	Repository string `json:"repository" yaml:"repository"`
	Ref        string `json:"ref" yaml:"ref"`
}

GraphDefaultBranchFallback records a repository whose canonical clone did not contain the operation's configured base ref (`origin/<ref>`, "main" by default). Discovery did not fail or skip the repository: it fell back to the repository's actual origin/HEAD default branch and used that ref for both graph inspection and any downstream wave operation on this repository (see orchestrate.EnsureCanonical). Recording it here keeps the substitution visible in the report — the whole point of the skip/fallback model this package uses is that nothing is silently dropped or silently rewritten.

type GraphDiscoverySkip added in v0.16.0

type GraphDiscoverySkip struct {
	Repository string `json:"repository" yaml:"repository"`
	Reason     string `json:"reason" yaml:"reason"`
}

GraphDiscoverySkip records a repository whose discovery failed but was not treated as a fatal error: either its configured remote ref was unavailable and a local scan proved it irrelevant to the ecosystem being propagated (no go.mod / no package.json), or its local clone itself was unreadable (no usable git remote) and needs manual repair before WB can act on it — in that second case the repository may still be relevant, but continuing to hard-fail an otherwise healthy fleet campaign over one broken clone helps no one, so it is skipped and reported here instead.

type GraphFilters added in v0.9.0

type GraphFilters struct {
	Dependencies []string `json:"dependencies,omitempty" yaml:"dependencies,omitempty"`
}

GraphFilters records evidence filters applied after repository discovery.

type GraphManifestWarning added in v0.59.2

type GraphManifestWarning struct {
	Repository string `json:"repository" yaml:"repository"`
	Manifest   string `json:"manifest" yaml:"manifest"`
	Reason     string `json:"reason" yaml:"reason"`
}

GraphManifestWarning records one manifest file that could not be parsed but did not abort discovery because it is not the repository's root manifest — most commonly a nested code-generator template rather than a real declaration WB should propagate dependencies through. A repository's ROOT manifest remains a fatal parse failure: WB cannot safely assume relevance there.

type GraphModule added in v0.9.0

type GraphModule struct {
	Path       string `json:"path" yaml:"path"`
	Repository string `json:"repository" yaml:"repository"`
	Manifest   string `json:"manifest" yaml:"manifest"`
}

GraphModule is a module declaration and its source manifest.

type GraphOptions added in v0.9.0

type GraphOptions struct {
	Ecosystem    Ecosystem
	GitHubDir    string
	Ref          string
	Parallel     int
	Timeout      time.Duration
	Retry        int
	Dependencies []string
	Progress     progress.Reporter
}

GraphOptions controls read-only dependency discovery and evidence filtering.

type GraphOrder added in v0.13.0

type GraphOrder struct {
	Layers []GraphOrderLayer `json:"layers,omitempty" yaml:"layers,omitempty"`
	Cycles []GraphOrderCycle `json:"cycles,omitempty" yaml:"cycles,omitempty"`
}

GraphOrder is the provider-first layering of the selected repositories. It answers "which repositories must be released first" from the same canonical evidence as every projection, without a second manifest scan.

func (GraphOrder) Markdown added in v0.13.0

func (order GraphOrder) Markdown() string

Markdown renders the provider-first layering, or nothing when the selection contains no repository. Cycles are named explicitly so an operator never has to infer why two repositories share a layer.

func (GraphOrder) Repositories added in v0.13.0

func (order GraphOrder) Repositories() []string

Repositories lists every repository of the layering in provider-first order.

type GraphOrderCycle added in v0.13.0

type GraphOrderCycle struct {
	Layer        int      `json:"layer" yaml:"layer"`
	Repositories []string `json:"repositories" yaml:"repositories"`
	Path         string   `json:"path" yaml:"path"`
}

GraphOrderCycle records repositories that require each other and therefore share one layer, because no release order can separate them.

type GraphOrderLayer added in v0.13.0

type GraphOrderLayer struct {
	Index        int      `json:"index" yaml:"index"`
	Repositories []string `json:"repositories" yaml:"repositories"`
}

GraphOrderLayer lists repositories whose selected internal providers all sit in earlier layers, so the whole layer may be processed as one batch.

type GraphProjection added in v0.9.0

type GraphProjection struct {
	View  GraphView
	Nodes []GraphProjectionNode
	Edges []GraphProjectionEdge
}

GraphProjection is a deterministic view derived only from Graph.

type GraphProjectionEdge added in v0.9.0

type GraphProjectionEdge struct {
	ID            string
	From          string
	To            string
	DirectCount   int
	IndirectCount int
	Status        string
	Evidence      []string
}

GraphProjectionEdge aggregates canonical evidence for a visual relation.

type GraphProjectionNode added in v0.9.0

type GraphProjectionNode struct {
	ID             string
	Kind           string
	Label          string
	Subtitle       string
	Status         string
	Repository     string
	Dependency     string
	Version        string
	GitHubURL      string
	CodeGrapherURL string
	Organization   string
}

GraphProjectionNode is a visual entity with stable identity.

type GraphReportPaths added in v0.9.0

type GraphReportPaths struct {
	Markdown string
	YAML     string
	JSON     string
	SVG      string
	HTML     string
}

GraphReportPaths identifies every artifact written for one graph scan.

func WriteGraphReports added in v0.9.0

func WriteGraphReports(directory string, graph Graph, view GraphView) (GraphReportPaths, error)

WriteGraphReports atomically writes every human, machine, and visual artifact.

type GraphRepository added in v0.9.0

type GraphRepository struct {
	Slug         string   `json:"slug" yaml:"slug"`
	Organization string   `json:"organization" yaml:"organization"`
	Modules      []string `json:"modules,omitempty" yaml:"modules,omitempty"`
}

GraphRepository is a selected repository retained by the filtered graph.

type GraphRequirement added in v0.9.0

type GraphRequirement struct {
	Dependency         string   `json:"dependency" yaml:"dependency"`
	Version            string   `json:"version" yaml:"version"`
	ConsumerModule     string   `json:"consumer_module" yaml:"consumer_module"`
	ConsumerRepository string   `json:"consumer_repository" yaml:"consumer_repository"`
	Manifest           string   `json:"manifest" yaml:"manifest"`
	Indirect           bool     `json:"indirect,omitempty" yaml:"indirect,omitempty"`
	ProviderModule     string   `json:"provider_module,omitempty" yaml:"provider_module,omitempty"`
	ProviderRepository string   `json:"provider_repository,omitempty" yaml:"provider_repository,omitempty"`
	ProviderCandidates []string `json:"provider_candidates,omitempty" yaml:"provider_candidates,omitempty"`
}

GraphRequirement is one manifest-owned dependency selection.

type GraphSummary added in v0.9.0

type GraphSummary struct {
	Repositories         int `json:"repositories" yaml:"repositories"`
	Modules              int `json:"modules" yaml:"modules"`
	Requirements         int `json:"requirements" yaml:"requirements"`
	InternalRequirements int `json:"internal_requirements" yaml:"internal_requirements"`
	ExternalDependencies int `json:"external_dependencies" yaml:"external_dependencies"`
	Selections           int `json:"selections" yaml:"selections"`
	AmbiguousProviders   int `json:"ambiguous_providers" yaml:"ambiguous_providers"`
}

GraphSummary provides view-independent canonical counts.

type GraphView added in v0.9.0

type GraphView string

GraphView selects one visual projection of canonical dependency evidence.

const (
	GraphViewRepositories GraphView = "repos"
	GraphViewDependencies GraphView = "dependencies"
	GraphViewSelections   GraphView = "selections"
)

func ParseGraphView added in v0.9.0

func ParseGraphView(value string) (GraphView, error)

ParseGraphView validates a CLI or report projection name.

type LayerSelection added in v0.13.0

type LayerSelection struct {
	// contains filtered or unexported fields
}

LayerSelection restricts an ordered run to one layer or a contiguous range of layers. The zero value selects every layer.

func ParseLayerSelection added in v0.13.0

func ParseLayerSelection(value string) (LayerSelection, error)

ParseLayerSelection accepts an empty value for every layer, `N` for one layer, `N-M` for a closed range, and `N-` for every layer from N onwards.

func (LayerSelection) Contains added in v0.13.0

func (selection LayerSelection) Contains(index int) bool

Contains reports whether one layer index belongs to the selection.

func (LayerSelection) String added in v0.13.0

func (selection LayerSelection) String() string

String renders the requested selection for reports and reasons.

type Options

type Options struct {
	GitHubDir string
	Ref       string
	Parallel  int
	// ParallelExplicit records that the operator set --parallel themselves.
	// An explicit value bounds every pool, including the read-only graph
	// discovery and release-observation pools; when it is left at its default
	// those read-only pools get the wider readOnlyWorkerCount floor instead
	// (mutating lifecycle stages always keep the Parallel bound).
	ParallelExplicit bool
	DryRun           bool
	Resume           bool
	AllowDowngrade   bool
	ValidationMode   ValidationMode
	Verify           bool
	Checks           []quality.Check
	Timeout          time.Duration
	Retry            int
	// CheckPollInterval overrides the GitHub-check polling delay of orchestrated
	// CI waits. A zero value uses the production default. It is primarily
	// useful for deterministic lifecycle tests (see
	// orchestrate.Options.CheckPollInterval).
	CheckPollInterval time.Duration
	// GoPrivate supplies comma-separated Go module path patterns that must not
	// be looked up through a public module proxy or checksum database. The
	// patterns are merged with the caller's GOPRIVATE/GONOPROXY/GONOSUMDB only
	// for Go subprocesses; WB never writes Go's global environment.
	GoPrivate []string
	Commit    bool
	Push      bool
	PR        bool
	Merge     bool
	ReportDir string
	// Order sequences repositories in provider-first dependency layers derived
	// from the selected repositories' own module declarations and requirements,
	// instead of processing the whole selection as one batch.
	Order bool
	// Layers restricts an ordered run to one layer or a contiguous range so an
	// operator can land one layer before starting the next.
	Layers   LayerSelection
	Progress progress.Reporter

	// ResolveGitHubRef is injectable for hermetic adapter tests.
	ResolveGitHubRef func(context.Context, string, string) (string, error)
}

Options controls repository isolation, verification, and optional publishing.

type OrderLayerReport added in v0.13.0

type OrderLayerReport struct {
	Index        int      `yaml:"index"`
	Repositories []string `yaml:"repositories"`
	Status       string   `yaml:"status"`
}

OrderLayerReport records one layer and how this run treated it: `completed`, `failed`, `blocked` by an earlier failed layer, or `not_selected`.

type OrderReport added in v0.13.0

type OrderReport struct {
	Selection string             `yaml:"selection"`
	Layers    []OrderLayerReport `yaml:"layers"`
	Cycles    []GraphOrderCycle  `yaml:"cycles,omitempty"`
}

OrderReport records the provider-first layer plan an ordered run followed.

func (*OrderReport) Markdown added in v0.13.0

func (report *OrderReport) Markdown() string

Markdown renders the layer plan and each layer's outcome, or nothing when the run was not ordered. It is the per-layer boundary an operator reads to decide whether the next layer may start.

type PublishedGoRelease

type PublishedGoRelease struct {
	Version      string
	Requirements map[string]string
	Source       string
}

PublishedGoRelease is immutable registry evidence used to carry an event through an already-current consumer without manufacturing another release.

type ReleaseEvent

type ReleaseEvent struct {
	Dependency string `yaml:"dependency"`
	Version    string `yaml:"version"`
	Source     string `yaml:"source"`
	// CheckedAt is when WB accepted this version from the operator or last
	// confirmed it against the registry. Persisting it lets a resumed or
	// long-running campaign refresh stale events before spending another CI
	// build on a downstream PR.
	CheckedAt time.Time `yaml:"checked_at,omitempty"`
}

ReleaseEvent is version evidence that starts or advances a dependency wave.

type ReleaseEventRefresh added in v0.16.0

type ReleaseEventRefresh struct {
	Dependency string    `yaml:"dependency"`
	Before     string    `yaml:"before"`
	After      string    `yaml:"after"`
	CheckedAt  time.Time `yaml:"checked_at"`
	Reason     string    `yaml:"reason"`
}

ReleaseEventRefresh records the inexpensive registry check WB performs before a stale event is allowed to trigger another downstream build.

type ReleaseObservation

type ReleaseObservation struct {
	Module               string            `yaml:"module"`
	Repository           string            `yaml:"repository"`
	Before               string            `yaml:"before,omitempty"`
	After                string            `yaml:"after,omitempty"`
	Source               string            `yaml:"source"`
	Status               string            `yaml:"status"`
	Reason               string            `yaml:"reason"`
	ExpectedRequirements map[string]string `yaml:"expected_requirements,omitempty"`
	RequireNewer         bool              `yaml:"require_newer,omitempty"`
	CheckedAt            time.Time         `yaml:"checked_at,omitempty"`
}

ReleaseObservation prevents the wave engine from inventing provider versions.

type RemoteCheck

type RemoteCheck = orchestrate.RemoteCheck

RemoteCheck is the normalized GitHub check state observed before merge.

type ReplaceEvidence added in v0.35.0

type ReplaceEvidence struct {
	OldPath    string    `json:"old_path" yaml:"old_path"`
	OldVersion string    `json:"old_version,omitempty" yaml:"old_version,omitempty"`
	NewPath    string    `json:"new_path" yaml:"new_path"`
	NewVersion string    `json:"new_version,omitempty" yaml:"new_version,omitempty"`
	Local      bool      `json:"local" yaml:"local"`
	ObservedAt time.Time `json:"observed_at" yaml:"observed_at"`
	Source     string    `json:"source" yaml:"source"`
}

ReplaceEvidence records a go.mod replace directive.

type Report

type Report struct {
	SchemaVersion  int                `yaml:"schema_version"`
	Operation      string             `yaml:"operation"`
	Status         string             `yaml:"status"`
	Target         Target             `yaml:"target"`
	GitHubDir      string             `yaml:"github_dir"`
	BaseRef        string             `yaml:"base_ref"`
	ValidationMode ValidationMode     `yaml:"validation_mode,omitempty"`
	Verification   []quality.Check    `yaml:"verification,omitempty"`
	Parallel       int                `yaml:"parallel"`
	Order          *OrderReport       `yaml:"order,omitempty"`
	Repositories   []RepositoryReport `yaml:"repositories"`
}

Report is the stable Markdown/YAML index for one exact-set operation.

func Run

func Run(ctx context.Context, target Target, repositories []Repository, options Options) (Report, error)

Run resolves one exact target and delegates repository lifecycle to the shared typed orchestration engine. The adapter owns dependency decisions.

func (Report) JSON added in v0.14.0

func (report Report) JSON() ([]byte, error)

JSON renders the report with the same field names and shape as YAML.

func (Report) Markdown

func (report Report) Markdown() string

Markdown renders a linked index suitable for human or AI review.

func (Report) YAML

func (report Report) YAML() ([]byte, error)

YAML renders the same deterministic report for tooling.

type Repository

type Repository = orchestrate.Repository

Repository identifies a canonical clone selected by command-level discovery.

type RepositoryReport

type RepositoryReport struct {
	Repository   string     `yaml:"repository"`
	CanonicalDir string     `yaml:"canonical_dir,omitempty"`
	WorktreeDir  string     `yaml:"worktree_dir,omitempty"`
	Branch       string     `yaml:"branch,omitempty"`
	Ref          string     `yaml:"ref"`
	Status       string     `yaml:"status"`
	Reason       string     `yaml:"reason"`
	Decisions    []Decision `yaml:"decisions,omitempty"`
	// DependencyDeltas is the exact per-reference evidence emitted for each
	// generated pull request. It is the campaign-side source for a later
	// supersession receipt, not a family-level inference.
	DependencyDeltas []DependencyDelta           `yaml:"dependency_deltas,omitempty"`
	ChangedFiles     []string                    `yaml:"changed_files,omitempty"`
	Verifications    []quality.VerificationEntry `yaml:"verifications,omitempty"`
	Commit           string                      `yaml:"commit,omitempty"`
	Pushed           bool                        `yaml:"pushed,omitempty"`
	PR               string                      `yaml:"pr,omitempty"`
	Checks           []RemoteCheck               `yaml:"checks,omitempty"`
	Merged           bool                        `yaml:"merged,omitempty"`
}

RepositoryReport records one selected repository and every external stage.

func RepositoryReportFromResult added in v0.67.10

func RepositoryReportFromResult(result orchestrate.Result[[]Decision]) RepositoryReport

RepositoryReportFromResult preserves the production report projection for integrations that need to carry exact dependency evidence into a later supersession review.

type Target

type Target struct {
	Ecosystem  Ecosystem `yaml:"ecosystem"`
	Dependency string    `yaml:"dependency"`
	Version    string    `yaml:"version"`
	Resolved   string    `yaml:"resolved,omitempty"`
}

Target is the exact dependency identity and version requested by the user.

func ParseTarget

func ParseTarget(ecosystem, value string) (Target, error)

ParseTarget validates a command target such as strongo/cicd@v1.10.5.

type ValidationMode added in v0.68.0

type ValidationMode string

ValidationMode names the local validation policy for dependency mutations. Remote PR-head checks remain a separate merge authority.

const (
	// ValidationModeFull runs the configured local lint, test, and build checks.
	ValidationModeFull ValidationMode = "full"
	// ValidationModeFast relies on repository push hooks locally and requires
	// exact PR-head GitHub checks before WB may merge the change.
	ValidationModeFast ValidationMode = "fast"
	// ValidationModeNone is the legacy explicit --no-verify escape hatch.
	ValidationModeNone ValidationMode = "none"
)

func ParseValidationMode added in v0.68.0

func ParseValidationMode(value string) (ValidationMode, error)

ParseValidationMode validates the public fast/full policy names.

type VersionEvidence added in v0.35.0

type VersionEvidence struct {
	Value      string    `json:"value,omitempty" yaml:"value,omitempty"`
	ObservedAt time.Time `json:"observed_at" yaml:"observed_at"`
	Source     string    `json:"source" yaml:"source"`
	Reason     string    `json:"reason,omitempty" yaml:"reason,omitempty"`
}

VersionEvidence records one observed version value and how it was obtained.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL