fixed CI, updated Dockerfile

Author: ndbroadbent

CLAUDE.md

@@ -36,15 +36,15 @@ Using `--no-verify` is a sign of poor craftsmanship and will not be tolerated.
 **The `.github/workflows/` directory is GENERATED by cigen itself. NEVER manually edit files in that directory.**
 
 - CI configuration is defined in `.cigen/` directory
-- Workflows are generated by running: `cargo run -- generate --file .cigen/config.yml`
+- Workflows are generated by running: `cargo run -- --config .cigen generate`
 - All changes to CI must be made in `.cigen/workflows/` YAML files
 - The generated files contain "DO NOT EDIT" warnings at the top
 - To test CI locally: `act -j <job-name> --container-architecture linux/amd64`
 
 If you need to modify CI behavior:
 
 1. Edit files in `.cigen/workflows/ci/jobs/`
-2. Regenerate with `cargo run -- generate --file .cigen/config.yml`
+2. Regenerate with `cargo run -- --config .cigen generate`
 3. Test with `act` before committing
 4. Commit both the source `.cigen/` files AND generated `.github/` files together
 

Cargo.lock

@@ -49,13 +49,14 @@ tokio = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
 which = "8.0.0"
-yaml-spanned = "0.0.2"
+yaml-spanned = "0.0.3"
 globwalk = "0.9.1"
 walkdir = "2.5.0"
 tonic = { workspace = true }
 prost = { workspace = true }
 tonic-prost = { workspace = true }
 hex = "0.4.3"
+libyaml-safer = "0.3.0"
 
 [dev-dependencies]
 assert_cmd = "2.0.17"

Cargo.toml

@@ -2,7 +2,7 @@
 
 CIGen generates CI configuration from reusable, provider-agnostic files. The project is undergoing a major migration to a Terraform-style plugin architecture: the new Rust core spawns provider binaries over a length-prefixed stdio transport, and those plugins emit provider-specific YAML.
 
-Today the GitHub Actions provider plugin powers our own CI (`cargo run -- generate --file .cigen`), while the legacy CircleCI emitter is being rebuilt on top of the same plugin system. The CLI still provides the templating, schema validation, and hashing utilities that powered the earlier monolithic implementation.
+Today the GitHub Actions provider plugin powers our own CI (`cargo run -- --config .cigen generate`), while the legacy CircleCI emitter is being rebuilt on top of the same plugin system. The CLI still provides the templating, schema validation, and hashing utilities that powered the earlier monolithic implementation.
 
 ## Features (Current)
 

README.md

@@ -13,6 +13,8 @@ RUN set -euxo pipefail \
         ca-certificates \
         curl \
         git \
+        openssh-client \
+        sudo \
         jq \
         tar \
         unzip \

docker/cigen-bootstrap/Dockerfile

@@ -15,7 +15,7 @@ This document outlines the complete plan to:
 - **Workflow generation**: `.cigen/` split config rendered through the GitHub provider plugin — the old workspace-specific scaffolding has been removed
 - **Caching**: Uses the skip-cache flow (via `actions/cache@v4`) plus a small build artifact for the `cigen` binary
 - **Package management**: Rust toolchain managed through rustup inside the `rust:latest` container; Node/pnpm steps only run when `act` needs them
-- **Plugin architecture**: Core spawns `cigen-provider-github` during `cargo run -- generate --file .cigen`
+- **Plugin architecture**: Core spawns `cigen-provider-github` during `cargo run -- --config .cigen generate`
 
 ## Goals
 

internal_docs/SELF_HOSTING_ON_GITHUB_ACTIONS.md

@@ -18,7 +18,7 @@ tracing = { workspace = true }
 tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
 serde_json = { workspace = true }
 thiserror = "2.0.12"
-yaml-spanned = "0.0.2"
+yaml-spanned = "0.0.3"
 
 [dependencies.cigen]
 path = "../../"

plugins/provider-circleci/Cargo.toml

@@ -2,12 +2,11 @@
 
 use anyhow::{Context, Result, anyhow, bail};
 use cigen::plugin::protocol::{
-    self, CigenSchema, CommandDefinition, CommandParameter, CustomStep, Fragment, GenerateRequest,
+    CigenSchema, CommandDefinition, CommandParameter, CustomStep, Fragment, GenerateRequest,
     GenerateResult, Hello, JobDefinition, PlanRequest, PlanResult, PluginInfo, RunStep, Step,
     UsesStep, WorkflowCondition as ProtoWorkflowCondition,
     WorkflowConditionKind as ProtoWorkflowConditionKind,
 };
-use cigen::schema::WorkflowConfig;
 use serde_yaml::{Mapping, Value};
 use std::collections::HashMap;
 use std::convert::TryFrom;
@@ -334,7 +333,7 @@ fn generate_setup_config(context: &CircleciContext) -> Result<Value> {
         grouped_jobs.entry(wf.to_string()).or_default().push(job);
     }
 
-    for (wf_id, _) in &grouped_jobs {
+    for wf_id in grouped_jobs.keys() {
         let variants = collect_job_variants_for_workflow(context, wf_id)?;
         all_variants.extend(variants);
     }
@@ -399,7 +398,7 @@ fn generate_main_config(context: &CircleciContext) -> Result<Value> {
     let mut all_variants = Vec::new();
     let mut workflow_variants_map: HashMap<String, Vec<JobVariant>> = HashMap::new();
 
-    for (wf_id, _) in &grouped_jobs {
+    for wf_id in grouped_jobs.keys() {
         let variants = collect_job_variants_for_workflow(context, wf_id)?;
         workflow_variants_map.insert(wf_id.clone(), variants.clone());
         all_variants.extend(variants);
@@ -465,10 +464,10 @@ fn build_workflow_def(
 ) -> Result<Value> {
     let mut workflow_map = Mapping::new();
 
-    if let Some(conditions) = context.workflow_conditions.get(workflow_id) {
-        if let Some(when_value) = build_circleci_when(conditions)? {
-            workflow_map.insert(Value::String("when".into()), when_value);
-        }
+    if let Some(conditions) = context.workflow_conditions.get(workflow_id)
+        && let Some(when_value) = build_circleci_when(conditions)?
+    {
+        workflow_map.insert(Value::String("when".into()), when_value);
     }
 
     workflow_map.insert(
@@ -543,12 +542,11 @@ fn convert_job(variant: &JobVariant, context: &CircleciContext) -> Result<Option
     let job = variant.job;
 
     // Skip approval jobs in definition list (they only appear in workflows)
-    if let Some(extra_type) = job.extra.get("type") {
-        if let Ok(val) = parse_yaml_value(extra_type) {
-            if val.as_str() == Some("approval") {
-                return Ok(None);
-            }
-        }
+    if let Some(extra_type) = job.extra.get("type")
+        && let Ok(val) = parse_yaml_value(extra_type)
+        && val.as_str() == Some("approval")
+    {
+        return Ok(None);
     }
 
     let mut map = Mapping::new();
@@ -638,12 +636,6 @@ fn convert_job(variant: &JobVariant, context: &CircleciContext) -> Result<Option
     Ok(Some(Value::Mapping(map)))
 }
 
-// ... (rest of the file: helper functions build_checkout_invocation, etc. - copied from original, no substitution logic)
-
-fn sanitize_job_name(name: &str) -> String {
-    name.replace(['/', '\\'], "_")
-}
-
 fn convert_steps_list(steps: &[Step]) -> Result<Vec<Value>> {
     let mut converted = Vec::new();
     for step in steps {
@@ -1579,14 +1571,6 @@ fn extract_checkout_config(raw_config: &Value) -> CheckoutConfig {
     config
 }
 
-fn extract_mapping(raw_config: &Value, key: &str) -> Option<Mapping> {
-    raw_config
-        .as_mapping()
-        .and_then(|map| map.get(&Value::String(key.into())))
-        .and_then(Value::as_mapping)
-        .cloned()
-}
-
 fn build_circleci_when(conditions: &[WorkflowRunCondition]) -> Result<Option<Value>> {
     let mut clauses = Vec::new();
 

plugins/provider-circleci/src/main.rs

@@ -376,7 +376,7 @@ fn render_workflow_file(
 
     let mut yaml = String::from("# DO NOT EDIT - This file is generated by cigen\n");
     yaml.push_str("# Source: .cigen/workflows/\n");
-    yaml.push_str("# Regenerate with: cargo run -- generate --file .cigen\n");
+    yaml.push_str("# Regenerate with: cargo run -- --config .cigen generate\n");
     yaml.push_str("#\n");
 
     let rendered = serde_yaml::to_string(&workflow_map)

plugins/provider-github/src/main.rs

@@ -32,11 +32,11 @@ fn jobs_with_sources(config_dir: &Path, workflow: &str) -> (HashSet<String>, Has
     (with_sources, without_sources)
 }
 
-fn run_generate(file: &Path, output_dir: &Path) {
+fn run_generate(config_dir: &Path, output_dir: &Path) {
     let mut cmd = Command::cargo_bin("cigen").expect("cigen binary not found");
     cmd.arg("generate")
         .arg("--file")
-        .arg(file)
+        .arg(config_dir)
         .arg("--output")
         .arg(output_dir)
         .current_dir(repo_root())