feat(compile)!: add on.push trigger and make on: the complete run declaration

[jamesadevine]

Summary

on: is now the complete declaration of when a pipeline runs. Azure DevOps reads a missing top-level trigger: key as "run CI on every branch" rather than "no CI", so the compiler now always emits both trigger: and pr: explicitly.

This adds on.push — a sibling of on.schedule / on.pr / on.pipeline — mapping onto ADO's trigger: key. It closes a gap where there was no way to say "never start this pipeline on a push": omitting on: selected the implicit CI trigger rather than disabling it.

on:
  push: none                   # never start on a push

on:
  push:                        # start only on pushes to main touching src/
    branches:
      include: [main]
    paths:
      include: ["src/**"]

What gets emitted

Front matter	Top-level trigger:
no on: at all	none — manual / API-queued only
on.schedule or on.pipeline only	none
on.pr (default mode: synthetic)	all branches (include: ['*'])
on.pr.mode: policy	none
on.push: none	none
on.push: {branches, paths}	the authored filter block

An explicit on.push always wins — including over the all-branches trigger that mode: synthetic emits as its delivery mechanism, and over the none that a schedule or mode: policy would otherwise produce. "Run nightly, and also whenever main moves" is a legitimate shape. on.push controls only trigger:; the pr: half stays driven by on.pr.

The all-branches trigger under mode: synthetic is deliberate and load-bearing: synthPr resolves the open PR for Build.SourceBranch at runtime, so it needs CI-triggered builds to react to. It is not auto-narrowed — pr.branches.include lists PR target branches, but trigger: fires on pushes to the listed branches.

Breaking change

A workflow with no on: key now compiles to a manual / API-queued-only pipeline instead of inheriting ADO's implicit "CI on every branch" default.

0006_explicit_push_trigger migrates affected sources automatically, pinning the legacy behaviour as an explicit on.push. Because the shape being migrated is an absence — and that same absence is the valid new spelling of "manual-only" — detection alone is insufficient: a permanent codemod would make manual-only pipelines unreachable, rewriting every newly authored on:-less workflow.

So CodemodContext gains source_compiler_version, read by the caller from the source's committed .lock.yml header (codemods stay pure). The codemod fires only for sources that predate the change, and self-retires once everything has been recompiled.

It is additionally gated on the running binary having reached the cutover release, mirroring 0002_pool_object_form. That second gate keeps compile and check consistent: a pre-cutover binary stamps its own version into the lock file it writes, which the provenance gate alone would read back as "old" on the very next check — reporting a pending migration for a file that had just been compiled. Five existing tests in codemod_tests.rs caught this.

The cutover constant is 0.49.0. v0.48.0 (released 2026-07-31) shipped the old semantics, so sources stamped 0.48.0 are precisely the ones needing migration, and a feat! bumps 0.48.0 → 0.49.0. If release-please lands this under a different version, update INTRODUCED_IN — a too-high value leaves the codemod dormant (safe), a too-low one skips the sources that need it.

Drive-by

semver was only a transitive build-dep of rustc_version. It is now a direct dependency behind a new crate::version module, folding in the three hand-rolled split('.') parsers (update_check.rs, codemod 0002, and the new one). Naive numeric triples mis-order pre-releases — semver puts 1.0.0-alpha before 1.0.0.

Test plan

cargo test — 2779 unit + 221 compiler + 8 codemod tests, 0 failures. cargo clippy --all-targets clean. Rebased onto main @ 0942c61e; the one conflict was a pure append-at-EOF in tests/compiler_tests.rs against #1785's runtime tests, and both sides are retained.

Coverage added for behaviour that previously had none — the earlier silent regression passed the entire suite, which is why the guard below matters most:

• build_triggers truth table (10 tests) — every row above, incl. test_no_on_config_emits_manual_only_pipeline as the regression guard, and each override interaction.
• lower_ci_trigger shapes (3) — filtered / all-branches / never emits invalid trigger: {}.
• Injection validation (7) — reject_pipeline_injection over on.push.branches.* and on.push.paths.*, plus push: none carrying no free-form strings.
• Integration (6, over 3 new fixtures) — assertions parse the compiled YAML rather than substring-matching, and confirm job/stage template targets still emit no top-level trigger:.
• Codemod (16 unit + 3 integration) — both gates independently, idempotency, pre-release ordering, unparseable versions failing closed, and compile_then_reparse_reports_no_pending_migration covering the compile → check bug.
• crate::version (7) — numeric-vs-lexical ordering (0.9.0 < 0.48.0), pre-release precedence, fail-closed parsing.

Docs updated: new "Push (CI) Triggering (on.push)" section in front-matter.md (with the corrected on.pr.mode table and auto-narrowing rationale), and a "Source provenance" section in codemods.md amending invariant 5, which previously stated codemods cannot inspect the lock file.

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[jamesadevine]

/review

[github-actions]

✅ Test Quality Sentinel completed the test quality analysis.

No test review performed: the pre-fetched PR diff, metadata, and review comment files (/tmp/gh-aw/agent/pr-diff.patch, pr-meta.json, pr-review-comments.json) were all empty for PR #1786, so there was no diff content available to assess test quality against.

[jamesadevine]

/review

[github-actions]

✅ Rust Code Quality Reviewer completed the Rust code quality review.

[github-actions]

Security review

Reviewed this diff against main for regressions in the injection, validation, token-scope, and network-boundary areas.

No findings. This PR is security-neutral for those concerns:

• The new on.push branch/path filter strings are validated with reject_pipeline_injection in validate_front_matter_identity, mirroring the existing on.pr checks — covered by dedicated tests for newline injection and $(...) ADO expressions in each of the four new fields.
• PushTriggerConfig is a closed, deserialize-validated enum (Disabled/Filtered); no new raw-String fields bypass src/secure.rs newtypes.
• The new 0006_explicit_push_trigger codemod and src/version.rs semver comparisons fail closed on unparseable/missing version strings, so a malformed or absent lock-file header can never be mistaken for "needs migration" or vice versa.
• No changes to src/compile/ado_bundle.rs token projection, src/allowed_hosts.rs/src/ecosystem_domains.rs network allowlists, or safe-output write paths.
• lower_ci_trigger values are serialized via serde_yaml, not string-concatenated into bash:/##vso[...] sinks.

No merge-blocking issues found.

🔒 Security review by PR Security Reviewer · aut00 · 32.7 AIC · ⌖ 3.79 AIC · ⊞ 11.2K
_{Comment /review to run again}

[github-actions]

Test Quality Sentinel review

Reviewed the test changes for the on.push trigger feature (codemod, compiler, IR, validation).

Overall: strong test coverage, no blocking issues.

Highlights of what's done well:

• build_triggers gets a full truth-table of unit tests (build_triggers_*) covering every combination of on.push/on.pr/on.schedule/on.pipeline, including the "explicit push wins" precedence rules, not just the happy path.
• The new 0006_explicit_push_trigger codemod has dedicated unit tests for both gates (running-binary cutover and source-provenance), idempotency, pre-release version ordering, and the push: none verbatim-preservation case — plus integration tests (codemod_integration_test.rs) exercising the real registry end-to-end, including the important regression test compile_then_reparse_reports_no_pending_migration that guards the exact "just-compiled source looks stale" trap the doc comments warn about.
• Injection validation for the new on.push.branches/on.push.paths fields is tested for all four fields (include/exclude × branches/paths) plus a valid-input and a push: none no-op case — good defense-in-depth coverage that isn't just implied by other tests.
• src/version.rs has solid edge-case coverage: pre-release ordering, unparseable-input fail-closed behavior, and lexical-vs-numeric ordering pitfalls.
• No weakened or removed assertions found anywhere in the diff.

Minor observations (non-blocking):

• tests/compiler_tests.rs's new fixture-based tests (test_push_trigger_emits_native_branch_and_path_filters, etc.) are a reasonable end-to-end complement to the build_triggers_* unit tests rather than duplication — they also verify serialization to YAML, which the unit tests don't.
• I did not find a test where on.push filters combine with on.pr.mode: policy and a schedule simultaneously (three-way precedence), but the pairwise tests already present give good confidence in the precedence logic, so this is a nice-to-have rather than a gap.

No test-quality concerns rise to merge-blocking; commenting only.

🧪 Test quality analysis by Test Quality Sentinel · aut00 · 63.1 AIC · ⌖ 3.87 AIC · ⊞ 10.7K
_{Comment /review to run again}

[github-actions]

Reviewed the on.push trigger contract changes. The compiler/codemod/type/doc/test surfaces are consistently wired: PushTriggerConfig is threaded through types.rs, agentic_pipeline.rs trigger-building, common.rs injection validation, and ir/lower.rs; the new 0006_explicit_push_trigger codemod is registered in codemods/mod.rs's CODEMODS array and gated correctly on both the running-binary and source-provenance versions via the new src/version.rs; parse_markdown_detailed_for_source is properly threaded from all three source-provenance-aware call sites (check_pipeline, build_pipeline_ir, the integration test); docs/codemods.md and docs/front-matter.md are updated; and semver is added to Cargo.toml. No bundle/codegen/lock drift found in the changed-files list.

One documentation-sync gap: the new src/version.rs module isn't listed in AGENTS.md's architecture tree (inline comment).

🏗️ Compiler contract review by Compiler Contract Reviewer · aut00 · 62.4 AIC · ⌖ 3.87 AIC · ⊞ 11.9K
_{Comment /review to run again}

[github-actions]

Rust code quality review

No merge-blocking Rust engineering defects found in the diff scope (src/**, tests/**, Cargo.toml).

Summary of what I checked:

• src/version.rs (new): clean semver wrapper, fail-closed on unparsable input, well-tested including pre-release ordering.
• src/compile/codemods/0006_explicit_push_trigger.rs (new): dual-gate provenance logic (running-binary version + source .lock.yml version) is well-reasoned and thoroughly tested, including idempotency and dormancy-before-cutover cases.
• src/compile/agentic_pipeline.rs / ir/mod.rs / ir/lower.rs: CiTrigger/PrTrigger refactor with constructor helpers (disabled(), all_branches()) is a clean improvement over inline struct literals; defensive trigger: {} guard in lower_ci_trigger is correct and tested.
• src/compile/common.rs: new on.push injection-sweep validation mirrors the existing on.pr pattern; test coverage for newline/ADO-expression injection in branch/path filters is thorough.
• Threaded source_compiler_version: Option<String> through parse_markdown_detailed_with_registry/CodemodContext cleanly; call sites (compile, check, build_pipeline_ir) correctly source it from the existing compiled output, and enable.rs correctly documents why it doesn't need to.
• No unwrap()/expect() on user-input paths introduced; error handling uses anyhow::Context consistently; no lossy casts, no blocking-in-async, no HashMap-ordering nondeterminism introduced.
• cargo build, cargo test (full suite) and cargo fmt --check on the changed files all pass cleanly — the only cargo fmt diffs are in unrelated pre-existing files, not touched by this PR.

Nice work — the version-comparison consolidation into src/version.rs (replacing three ad-hoc parsers) and the codemod's source-provenance gating are good structural improvements.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• spsprodeus21.vssps.visualstudio.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "spsprodeus21.vssps.visualstudio.com"

See Network Configuration for more information.

🦀 Rust code quality review by Rust Code Quality Reviewer · aut00 · 118.3 AIC · ⌖ 3.86 AIC · ⊞ 11K
_{Comment /review to run again}