Upgrading

flowpact is before 1.0: a minor release (0.7 → 0.8) can change what is reported. Each section below lists what to do when you move to that release.

0.11 → 0.12Copy Anchor Link

flowpact moved to the ciatlas organization: the repository is now ciatlas/flowpact and the docs are at ciatlas.github.io/flowpact. The npm package, the VS Code extension and the GitHub Marketplace listing keep their names, and nothing changes in what flowpact reports.

Move to the new versionCopy Anchor Link

• GitHub Action: uses: ciatlas/flowpact@v0.12. GitHub redirects the old name, so rumankazi/flowpact@v0.11 and older references keep working, but use the new one from now on.
• CLI: npx flowpact@0.12, or update the dev dependency.
• VS Code: the extension updates itself.

Regenerate your contractsCopy Anchor Link

Contracts name their schema and docs by URL, and both moved. Until you run flowpact generate once and commit the result, flowpact check reports FP802 for every contract written by 0.11 or earlier. If your .github/flowpact/flowpact.config.yml starts with a # yaml-language-server: $schema= line (for editor completion), point it at https://ciatlas.github.io/flowpact/schemas/config/v1.json: the old docs and schema URLs under rumankazi.github.io/flowpact no longer resolve.

Verifying older releasesCopy Anchor Link

Releases up to 0.11.1 were built before the move, and GitHub keeps their attestations under the old owner: verify them online with --owner rumankazi, or offline against the bundle attached to the release with gh attestation verify <file> --bundle <file>.sigstore.json --repo rumankazi/flowpact. gh release verify no longer finds their release attestations. See verify a release.

0.9 → 0.10Copy Anchor Link

0.10 is for organizations that build on flowpact: a programmatic API with a function per command, the action's base-config and plugin inputs for a copy of the action, and an action about a third of its old size. Nothing changes for workflows that use the action or the CLI as before, except a copy of the CLI's dist/index.js on its own (below).

Move to the new versionCopy Anchor Link

• GitHub Action: uses: rumankazi/flowpact@v0.10. Before 1.0 the floating tag follows a minor release, so @v0.9 stays on 0.9.
• CLI: npx flowpact@0.10, or update the dev dependency.
• VS Code: the extension updates itself.

A vendored CLI is its whole package folderCopy Anchor Link

The npm package's dist/index.js now loads a second file next to it (code it shares with the API), so a copy of dist/index.js alone no longer runs. It fails with exit code 1, the code for findings:

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '…/dist/chunk-<hash>.js' imported from …/dist/index.js

Keep the package's whole package/ folder, as Run the CLI in a step shows: node tools/flowpact/dist/index.js lint …. The second file's name changes with each release, so to update, replace the folder rather than copy the new files into it.

0.8 → 0.9Copy Anchor Link

0.9 is for organizations that run flowpact in their own action or CI template (Build on flowpact): GitHub annotations from the CLI, several reports from one run, --plugin and --no-plugins, and a base config. One change can fail a CI run: options must come after the command.

Move to the new versionCopy Anchor Link

• GitHub Action: uses: rumankazi/flowpact@v0.9. Before 1.0 the floating tag follows a minor release, so @v0.8 stays on 0.8.
• CLI: npx flowpact@0.9, or update the dev dependency.
• VS Code: the extension updates itself.

Put options after the commandCopy Anchor Link

Before 0.9, an option written before the command was dropped without a word: flowpact --no-plugins lint ran with the repository's plugins, and flowpact -q lint was not quiet. 0.9 stops with a usage error (exit 2) instead. Write flowpact lint --no-plugins. flowpact --help and flowpact --version work as before.

Config entries for rules that are not loadedCopy Anchor Link

A rules: or overrides: entry for a rule that no loaded plugin defines used to stop the run with a config error. 0.9 ignores it with a warning, so a repository can configure organization rules that only its organization's wrapper loads. An unknown code with the built-in prefix (FP999), or a typo of a loaded rule (unused-inptu), is still an error; see Rules that are not loaded.

0.7 → 0.8Copy Anchor Link

0.8 removes most false positives found on 28 large public repositories, so most repositories see fewer findings. Two things can still fail a CI run right after the upgrade: contracts written by 0.7, and overrides for findings 0.8 no longer reports.

Move to the new versionCopy Anchor Link

• GitHub Action: uses: rumankazi/flowpact@v0.8. Before 1.0 the floating tag follows a minor release, so @v0.7 stays on 0.7.
• CLI: npx flowpact@0.8, or update the dev dependency.
• VS Code: the extension updates itself.

Regenerate your contractsCopy Anchor Link

If the repository locks its contracts (.github/flowpact/contracts/), run flowpact generate and commit the result. 0.8 records more of each interface:

• A read of a whole outputs object, such as toJSON(needs.build.outputs) or needs.build.outputs[matrix.key], now counts as reading every output in it, and the callee's contract lists them.
• Actions used through a checkout path: or the new $/ syntax now resolve, so their callers appear under uses.

Until then, flowpact check reports those contracts as FP802 (contract-outdated, an error). In mode: check the action attaches the regenerated contracts as an artifact and a patch.

Remove overrides that no longer matchCopy Anchor Link

Overrides written for findings that 0.8 no longer reports match nothing. FP902 (override-unused, a warning) names each one so you can delete it:

• FP606 for actions used through a checkout path:: a step's uses: ./path now resolves against the runner's workspace, as GitHub does.
• FP303 for outputs of published units: reusable workflows whose file name does not start with _, and the root action.yml, or exactly the units in impact.publish when it is set.
• Findings inside generated files (*.lock.yml, or a header such as DO NOT EDIT), for the rules about a file's own internals: FP104, FP105, FP203, FP204, FP303, FP304, FP604, FP605 and FP607.
• FP105, FP205, FP401, FP402 and FP404 where the workflow already handles the empty value: a fallback (matrix.k || 'x'), a comparison, a quoted shell test, or a caller whose inputs skip the step.
• FP302 for a job's own if: that reads a job it depends on indirectly: GitHub makes those visible there.
• FP503 for background steps and cache-mode, which GitHub runs.

New and changed findingsCopy Anchor Link

• FP610 (workspace-unverified, info) marks a step's uses: ./… that flowpact cannot read, such as a path inside another repository's checkout. Write owner/repo/path@ref to have those actions checked, or set FP610: off.
• FP606 can fire where it was silent: an action of this repository used as ./… in a job that checks the repository out only in a subdirectory, or a composite action's ./path that works for one caller and not for another.
• FP105 now also reports published units when every local caller passes the input, because callers in other repositories can still omit it.
• FP401 is a warning when the empty value replaces a non-empty default, and is not reported when the input is optional with an empty default that no condition reads (or reads only through a fallback). FP404 reports a fallback that always applies as info.
• FP503 reports keys GitHub accepts and ignores, such as a top-level env: in action.yml, as warnings.
• If a hand-written file is treated as generated, list it under generated.exclude. If other repositories use an action in a subdirectory, list it under impact.publish; that setting replaces the default list, so include your other published units too.

Code scanning alertsCopy Anchor Link

A finding's fingerprint includes its message. Messages changed for some FP105, FP205, FP302, FP401, FP404 and FP503 findings, so those alerts close and reopen once. If you had dismissed one, dismiss the new alert again.

flowpact generate with pathsCopy Anchor Link

flowpact generate <paths> now writes only the contracts of those workflows and actions, and leaves the others (including orphaned ones) alone. A path that names no workflow or action exits with code 2.