Imagine

ci.cue

// .github/workflows/ci.cue (sketch)

// --- Imports: typed reusable modules ---
import {
  lint:   "gh://org/ci/lint@v3"
  docker: "gh://org/ci/docker@v2"
  node:   "gh://org/ci/node@v4"
}

// --- Inputs: strongly typed ---
inputs: {
  deploy?: bool | *false
}

// --- Triggers: typed and explicit ---
on: {
  push: {
    branches: [...string] | *["main"]
  }
  pull_request: {}
  workflow_dispatch: {
    inputs: inputs
  }
}

// --- Global env: explicit types ---
env: {
  CI: "true"
  NODE_OPTIONS?: string
}

// --- Permissions: schema-validated ---
permissions: {
  contents: "read"
  id_token: "write"   // for OIDC to cloud
}

// --- Jobs: a graph with typed fields ---
jobs: {

  // Lint job via module (reusable composite)
  lint: lint.Job & {
    runs_on: "ubuntu-latest"
    with: {
      languages: ["ts", "go"]
    }
  }

  // Build + test matrix
  test: {
    runs_on: "ubuntu-latest"

    // Matrix is compile-time expanded (deterministic)
    strategy: {
      matrix: {
        node: ["18", "20", "22"]
        os:   ["ubuntu-latest", "macos-latest"]
        exclude: [
          { os: "macos-latest", node: "18" },
        ]
      }
    }

    // runs_on can reference matrix values (compile-time templated)
    runs_on: "${{ matrix.os }}"

    // Strongly typed dependency edges
    needs: ["lint"]

    // CEL-like conditions (safe, no IO)
    if: expr`github.event_name != "pull_request" || github.head_ref != "wip"`

    steps: [
      { uses: "actions/checkout@v4" },

      node.Setup & {
        with: { version: "${{ matrix.node }}" }
      },

      {
        name: "Install"
        run:  "pnpm install --frozen-lockfile"
      },
      {
        name: "Test"
        run:  "pnpm test"
      },

      // Typed “artifact” interface (no stringly random keys)
      {
        name: "Upload coverage"
        uses: "gh:artifacts/upload@v1"
        with: {
          name: "coverage-${{ matrix.os }}-node${{ matrix.node }}"
          path: "coverage/"
        }
      },
    ]
  }

  // Docker image build job via module
  image: docker.BuildJob & {
    runs_on: "ubuntu-latest"
    needs: ["test"]

    if: expr`github.ref == "refs/heads/main"`

    with: {
      context: "."
      tags: [
        "ghcr.io/acme/app:${{ github.sha }}",
        "ghcr.io/acme/app:latest",
      ]
    }

    // Module declares outputs in a typed way
    // outputs: { digest: string }
  }

  // Deploy job: explicit “environment” and secret contracts
  deploy: {
    runs_on: "ubuntu-latest"
    needs: ["image"]

    environment: "prod"

    // Two conditions:
    // 1) main branch
    // 2) manual toggle OR release event
    if: expr`
      github.ref == "refs/heads/main" &&
      (inputs.deploy == true || github.event_name == "release")
    `

    // Secrets are declared as required inputs (compile-time check)
    secrets: {
      AWS_ROLE_ARN: secret
      AWS_REGION:   secret
    }

    steps: [
      { uses: "actions/checkout@v4" },

      {
        name: "Configure cloud auth (OIDC)"
        uses: "gh:cloud/oidc@v1"
        with: {
          role_arn: "${{ secrets.AWS_ROLE_ARN }}"
          region:   "${{ secrets.AWS_REGION }}"
        }
      },

      {
        name: "Deploy"
        run: """
          ./scripts/deploy \
            --image-digest '${{ needs.image.outputs.digest }}' \
            --sha '${{ github.sha }}'
        """
      },
    ]
  }
}