fix(ci): accept map-form dependencies in iii.worker.yaml

[ytallo]

Summary

_publish-registry.yml previously forwarded meta.get("dependencies", []) verbatim, assuming the yaml was already in the array-of-objects shape the registry's /publish endpoint expects. The in-flight iii CLI (iii-hq/iii) plan parses dependencies: as a map in iii.worker.yaml — the natural, npm/cargo-style shape for authors:

dependencies:
  math-worker: "^0.1.0"
  iii-http: "~1.0.0"

Without this patch, any worker written in the map form publishes a JSON object where the registry expects a JSON array and fails with 422. This blocks the end-to-end "author declares deps in yaml" feature.

Change

Normalize before building the payload:

• Map → translated to [{name, version}, ...].
• List → passed through (backward-compat with any existing fixture using the explicit shape).
• Null / absent → [].
• Anything else (string, number, etc.) → fail the workflow step with a clear ::error:: pointing at the bad shape.

Compatibility

No worker in this repo currently declares dependencies in its iii.worker.yaml, so this patch changes nothing for the 20 existing publish paths. It unblocks the new ones.

Test Plan

• Local dry-run of the Python transform against map, list, empty, null, and bogus-string inputs. Map and list both produce the expected array-of-objects shape; bogus input fails fast with a workflow error.
• Next publish of any worker in this repo goes through the updated payload builder. No existing workers declare deps, so behavior is unchanged.
• Once a worker here adds a map-form dependencies: block and publishes, the registry row should contain the translated array. Verify via GET /w/<name> or directly in workerVersion.dependencies.

Paired with

• iii-hq/registry#8 — registry-side Zod hardening that rejects invalid dep names/ranges at /publish. The two PRs are independent but both need to land for the yaml → registry feature to work end-to-end.

Summary by CodeRabbit

• Chores
  • Improved the publishing workflow to properly normalize and validate dependency formats before registry submission. The system now consistently handles dependencies in both map and list formats, with enhanced error reporting for invalid specifications, ensuring more reliable deployments.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflow step that publishes to the registry now normalizes the dependencies field from iii.worker.yaml into a standardized array-of-objects format required by the /publish endpoint. It handles both map and list input shapes, converting maps to [{name, version}, ...] and validating input types, with early termination on unexpected formats.

Changes

Cohort / File(s)	Summary
Workflow Registry Publishing .github/workflows/_publish-registry.yml	Added logic to normalize dependencies field by supporting two authoring shapes (map and list), converting maps to array-of-objects format, validating input types, and updating the publish payload to use the transformed deps value instead of raw input.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Poem

🐰 A rabbit's ode to normalized deps:

Hops through maps and lists so fine,
Shapes and formats all align,
Transforms chaos into grace,
Dependencies in their rightful place! 🎉

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: accepting map-form dependencies in iii.worker.yaml, which directly addresses the primary fix in the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/publish-dependencies-map-to-array

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/_publish-registry.yml (1)

90-99: Consider coercing version values to strings.

YAML parses unquoted version-like scalars as numbers, e.g. math-worker: 1.0 → float(1.0) and math-worker: 1 → int(1). Both the map and list paths forward these as-is, so they'll be JSON-encoded as numbers and likely rejected by the registry (or worse, stored in a surprising shape). The PR's example uses quoted "^0.1.0", which sidesteps this, but a missing quote is an easy author mistake with a confusing 422 as the only signal.

Low-risk fix — cast version to str in both normalization branches:

♻️ Proposed refactor

           raw_deps = meta.get("dependencies") or []
           if isinstance(raw_deps, dict):
-              deps = [{"name": k, "version": v} for k, v in raw_deps.items()]
+              deps = [{"name": str(k), "version": str(v)} for k, v in raw_deps.items()]
           elif isinstance(raw_deps, list):
-              deps = raw_deps
+              deps = [
+                  {**d, "version": str(d["version"])}
+                  if isinstance(d, dict) and "version" in d
+                  else d
+                  for d in raw_deps
+              ]
           else:
               print(
                   f"::error::`dependencies` must be a map or list, got {type(raw_deps).__name__}"
               )
               sys.exit(1)

Also note: meta.get("dependencies") or [] intentionally collapses {}, [], and None to [], which matches the PR's stated "null/absent → []" behavior — leaving as-is.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/_publish-registry.yml around lines 90 - 99, Normalize
dependency versions to strings before building deps: when converting raw_deps
from a dict (the dict comprehension that produces deps) coerce each v to str
(e.g. {"name": k, "version": str(v)}), and when handling the list branch, ensure
each list element's "version" field is converted to str (or wrap scalar list
entries accordingly) so deps always contains string versions; operate on the
existing raw_deps/deps normalization logic shown in the diff.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/_publish-registry.yml:
- Around line 90-99: Normalize dependency versions to strings before building
deps: when converting raw_deps from a dict (the dict comprehension that produces
deps) coerce each v to str (e.g. {"name": k, "version": str(v)}), and when
handling the list branch, ensure each list element's "version" field is
converted to str (or wrap scalar list entries accordingly) so deps always
contains string versions; operate on the existing raw_deps/deps normalization
logic shown in the diff.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c3acfb9b-097e-4dc8-b483-e1c286daea3f

📥 Commits

Reviewing files that changed from the base of the PR and between d32ae7a and 435f889.

📒 Files selected for processing (1)

• .github/workflows/_publish-registry.yml