ci: guard shared TypeScript extension versions

[Jess Sullivan (Jesssullivan)]

Summary

• select each module's greatest non-yanked version with the existing Bazel-compatible relaxed-version comparator, independent of metadata.json ordering and yanks
• validate the complete aspect_rules_ts 3.8.4 deps tag identity: name, ts_version, ts_version_from, and ts_integrity
• track canonical extension proxies and fail closed on dynamic, container-carried, composite, included, or otherwise ambiguous proxy use instead of silently missing tags
• preserve dev_dependency = True and isolate = True semantics outside the shared extension graph
• report conflicts and parser failures with module, version, line, and column context
• run the guard through the existing npm run validate entrypoint

Corrective scope

This closes the adversarial-review findings on hidden valid Starlark and incomplete tag identity. Coverage includes getattr(proxy, "deps"), assigned methods, list/tuple/dict-carried proxies, dev-first composite concealment, simple proxy aliases, repository-management builtins, multiline/comments, strings containing call-shaped text, same-version/different-integrity conflicts, ts_version_from identity, tag-name grouping, defaults, unsorted versions, greatest-version yanks, and all-yanked modules.

Canonical Bazel 8 @@aspect_rules_ts+ and Bazel 7 @@aspect_rules_ts~<version> repository names are supported. Unknown future aspect_rules_ts canonical naming schemes fail closed.

Validation

• npm run validate
  • 30/30 focused guard tests pass
  • 169 active registry source entries validate
  • 48 aspect_rules_ts tag identities across one repository name validate
• npm run smoke:resolve
• npm run smoke:stage1-consumer
  • Bazel 8.1.1 built all five Stage-1 consumer package targets
• git diff --check and git diff --cached --check
• signed commit verified with git verify-commit HEAD
• independent adversarial review: SHIP, no findings

Supported syntax and residual limits

The guard deliberately does not evaluate arbitrary Starlark. It accepts direct canonical use_extension assignments, direct .deps(...) tags, simple identifier aliases, literal/simple-string values, and direct use_repo/inject_repo/override_repo calls.

Dynamic or embedded proxies, container carriage, include() fragments, augmented/destructuring assignments, and unknown extension/tag options fail closed. ts_version_from accepts local labels and exact @@ canonical labels; apparent external labels and @// labels fail closed because their canonical identity is ambiguous under Bzlmod selection.

Scope

This remains a draft. It changes only the static registry guard, its fixtures, and validation wording. It does not modify module entries, release metadata, or registry publication state.