Retire CI-059 terminal caller policy

Author: coenttb

Sources/GitHub Continuous Integration Validation/GitHub.ContinuousIntegration.Validation.ThinCallers.Job.swift

@@ -4,11 +4,8 @@ import GitHub_Standard
 extension GitHub.ContinuousIntegration.Validation.ThinCallers {
     /// One top-level job under `jobs:`, with its body lines.
     ///
-    /// `[CI-059]` is the reason this exists rather than the typed
-    /// document's `jobs`: the rule needs *same-job co-presence* of a
-    /// `uses:` and a `secrets:` declaration, and it must still answer on
-    /// a workflow the parser refuses. So the job set is recovered by the
-    /// same indentation walk the retired validator used.
+    /// Job boundaries support diagnostic precedence and the deleted-input
+    /// check even when the typed parser refuses a malformed caller.
     public struct Job: Sendable, Equatable {
         public let name: String
         public let lines: [Line]
@@ -52,29 +49,6 @@ extension GitHub.ContinuousIntegration.Validation.ThinCallers {
 }
 
 extension GitHub.ContinuousIntegration.Validation.ThinCallers.Job {
-    /// The keys of the job's block-form `secrets:` mapping, in order.
-    ///
-    /// Indentation-tracked: the children are the contiguous run of
-    /// more-indented `NAME:` lines after a bare `secrets:` opener, and the
-    /// first line at or below the opener's indent closes the block. Blank
-    /// and comment lines inside it are skipped rather than ending it.
-    public var forwardedSecretNames: [String] {
-        var names: [String] = []
-        var openerIndent: Int?
-        for line in lines {
-            if let indent = openerIndent {
-                if line.isBlankOrComment { continue }
-                if line.indent > indent {
-                    if let key = line.mappingKey { names.append(key) }
-                    continue
-                }
-                openerIndent = nil
-            }
-            if line.isSecretsBlock { openerIndent = line.indent }
-        }
-        return names
-    }
-
     /// The value of `key` inside the job's block-form `with:` mapping, as
     /// raw text with any trailing comment removed, or `nil` when `with:`
     /// or the key is absent.

Sources/GitHub Continuous Integration Validation/GitHub.ContinuousIntegration.Validation.ThinCallers.Line.swift

@@ -110,20 +110,6 @@ extension GitHub.ContinuousIntegration.Validation.ThinCallers {
         /// `^\s*workflow_call:` — at any indent, including column 0.
         var declaresWorkflowCall: Bool { trimmed.hasPrefix("workflow_call:") }
 
-        /// `^\s+secrets:\s+inherit\s*(#.*)?$`
-        var isSecretsInherit: Bool {
-            guard indent > 0, trimmed.hasPrefix("secrets:") else { return false }
-            return value(after: "secrets:")?.beforeComment.trimmed == "inherit"
-        }
-
-        /// `^\s+secrets:\s*(#.*)?$` — the block-form opener.
-        var isSecretsBlock: Bool { indent > 0 && keyWithNoValue == "secrets" }
-
-        /// `^\s+secrets:\s*\{` — the inline-map form.
-        var isSecretsInlineMap: Bool {
-            indent > 0 && (value(after: "secrets:")?.hasPrefix("{") ?? false)
-        }
-
         /// The `uses:` target, when the line declares one with a
         /// non-empty value.
         var usesValue: String? {
@@ -156,27 +142,6 @@ extension GitHub.ContinuousIntegration.Validation.ThinCallers {
             return Reference(path: path, ref: ref)
         }
 
-        /// `^\s+NAME:\s*\$\{\{\s*secrets\.NAME\s*\}\}\s*(#.*)?$` — the
-        /// exact forwarding line a cross-org caller must carry per name.
-        func forwards(_ name: String) -> Bool {
-            guard indent > 0, trimmed.hasPrefix("\(name):"),
-                let value = value(after: "\(name):")?.beforeComment.trimmed,
-                value.hasPrefix("${{"), value.hasSuffix("}}")
-            else { return false }
-            let inner = value.dropFirst(3).dropLast(2).trimmed
-            return inner == "secrets.\(name)"
-        }
-
-        /// The `NAME` of a mapping entry, when the line is one.
-        var mappingKey: String? {
-            guard let separator = trimmed.firstIndex(of: ":") else { return nil }
-            let key = String(trimmed[..<separator])
-            guard !key.isEmpty,
-                key.allSatisfy({ $0.isLetter || $0.isNumber || $0 == "_" || $0 == "-" })
-            else { return nil }
-            return key
-        }
-
         /// The text after `key`, trimmed. `nil` when the line does not
         /// open with it.
         func value(after key: String) -> String? {
@@ -203,17 +168,4 @@ extension StringProtocol {
         while let last = value.last, last == " " || last == "\t" { value = value.dropLast() }
         return String(value)
     }
-
-    /// Everything before a `#` that opens the string or follows
-    /// whitespace, which is YAML's own comment rule.
-    fileprivate var beforeComment: String {
-        var kept = ""
-        var previous: Character?
-        for character in self {
-            if character == "#", previous == nil || previous == " " || previous == "\t" { break }
-            kept.append(character)
-            previous = character
-        }
-        return kept
-    }
 }

Sources/GitHub Continuous Integration Validation/GitHub.ContinuousIntegration.Validation.ThinCallers.Message.swift

@@ -54,63 +54,6 @@ extension GitHub.ContinuousIntegration.Validation.ThinCallers {
             """
         }
 
-        public static func sameOrganizationExplicit(job: String) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` invokes an intra-Institute \
-            reusable with explicit `secrets:` forwarding — per the #92 ruling \
-            same-org callers MUST use `secrets: inherit`; explicit per-secret \
-            sets are forbidden. Org-level secrets per [CI-060] obviate explicit \
-            forwarding, which drifts at every new secret addition.
-            """
-        }
-
-        public static func sameOrganizationOmitted(job: String) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` invokes an intra-Institute \
-            reusable without `secrets: inherit` — per [CI-059] and the #92 ruling \
-            every same-org `uses:` invocation of an intra-Institute reusable MUST \
-            include `secrets: inherit` (single canonical shape per [CI-031], \
-            universal across consumers regardless of dependency-graph visibility).
-            """
-        }
-
-        public static func crossOrganizationInherit(job: String) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` is sub-org-hosted and uses \
-            `secrets: inherit` — per the #92 ruling this hop is cross-org and \
-            inherit silently delivers no org secrets ([CI-109]). Replace with the \
-            explicit `secrets:` block forwarding \(closedSet) as \
-            `NAME: ${{ secrets.NAME }}` lines.
-            """
-        }
-
-        public static func crossOrganizationMissing(job: String, names: [String]) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` is sub-org-hosted and \
-            explicit-forwards secrets but is missing \(names.joined(separator: ", ")) — \
-            per the #92 ruling the closed credential set MUST be forwarded in full \
-            (`NAME: ${{ secrets.NAME }}` per name; [CI-109]).
-            """
-        }
-
-        public static func crossOrganizationExtra(job: String, names: [String]) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` is sub-org-hosted and forwards \
-            \(names.joined(separator: ", ")) beyond the closed set — per the #92 \
-            ruling the cross-org transport is exactly \(closedSet); widening it is \
-            a ruling, not a caller edit.
-            """
-        }
-
-        public static func crossOrganizationOmitted(job: String) -> String {
-            """
-            .github/workflows/ci.yml job `\(job)` is sub-org-hosted and invokes an \
-            intra-Institute reusable without any `secrets:` — per the #92 ruling \
-            it MUST explicit-forward \(closedSet) ([CI-109]; inherit is \
-            same-org-only and omission leaves resolve uncredentialed).
-            """
-        }
-
         /// The message deliberately still names `generate-caller.py`, the
         /// script this port deletes. Byte-identity with the retired output
         /// is the unwaived floor of the single measured comparison, and
@@ -126,11 +69,5 @@ extension GitHub.ContinuousIntegration.Validation.ThinCallers {
             Regenerate it with generate-caller.py.
             """
         }
-
-        static var closedSet: String {
-            GitHub.ContinuousIntegration.Validation.ThinCallers.crossOrganizationSecrets.joined(
-                separator: ", "
-            )
-        }
     }
 }