hecks 3.5.0 → 3.7.0

data/lib/hecks/projections/site/site_admin.rb

@@ -4,6 +4,8 @@ require "json"
 require_relative "../../projector"
 require_relative "admin"
 require_relative "routes_ts"
+require_relative "site_admin/session"
+require_relative "site_admin/access"
 
 module Hecks
   module Projections
@@ -42,7 +44,7 @@ module Hecks
         # @param extension [String] the extension of the route table module
         # @return [String] the module's text, ending in a newline
         def render(admin, extension)
-          [RoutesTs::BANNER, header, imports(extension), settings(admin), memo, helpers].join("\n\n") << "\n"
+          [RoutesTs::BANNER, header, imports(extension), settings(admin), Session::MEMO, helpers].join("\n\n") << "\n"
         end
 
         def header
@@ -57,234 +59,25 @@ module Hecks
         end
 
         def settings(admin)
+          body = setting_fields(admin).map { |key, value| "  #{key}: #{RoutesTs.literal(value)}," }
+          "/** What the sign-in is built from: the project's Admin row, defaults filled. */\n" \
+            "export const ADMIN = {\n#{body.join("\n")}\n} as const;"
+        end
+
+        def setting_fields(admin)
           setting = admin.setting
-          fields = {
+          {
             sessionCookie: setting.session_cookie, sessionMaxAge: setting.session_max_age,
             hostEnv: setting.host_env, hostDefault: setting.host_default, roles: admin.roles,
             accountPath: setting.account_path, membersPath: setting.members_path,
             ssoTokenPath: setting.sso_token_path, ssoTarget: setting.sso_target, login: setting.login,
             sso: setting.sso, verdictTtlMs: setting.verdict_ttl_ms, timeoutMs: setting.timeout_ms
           }
-          body = fields.map { |key, value| "  #{key}: #{RoutesTs.literal(value)}," }
-          "/** What the sign-in is built from: the project's Admin row, defaults filled. */\n" \
-            "export const ADMIN = {\n#{body.join("\n")}\n} as const;"
-        end
-
-        def memo
-          <<~TS.chomp
-            const MAX_REMEMBERED = 500;
-
-            /** Remembers each key's answer for the verdict TTL; callers that arrive while it loads share it, and a failure is never kept. */
-            function remember<V>(load: (key: string) => Promise<V>) {
-              const values = new Map<string, { at: number; value: V }>();
-              const running = new Map<string, Promise<V>>();
-              return {
-                get(key: string): Promise<V> {
-                  const hit = values.get(key);
-                  if (hit && Date.now() - hit.at < ADMIN.verdictTtlMs) return Promise.resolve(hit.value);
-                  const shared = running.get(key);
-                  if (shared) return shared;
-                  const started: Promise<V> = load(key)
-                    .then((value) => {
-                      if (running.get(key) === started) {
-                        values.delete(key);
-                        values.set(key, { at: Date.now(), value });
-                        if (values.size > MAX_REMEMBERED) values.delete(values.keys().next().value as string);
-                      }
-                      return value;
-                    })
-                    .finally(() => {
-                      if (running.get(key) === started) running.delete(key);
-                    });
-                  running.set(key, started);
-                  return started;
-                },
-                forget(): void {
-                  values.clear();
-                  running.clear();
-                },
-              };
-            }
-          TS
         end
 
         def helpers
-          [configuration, membership, sessions, verdicts, handoff, routing, gate].join("\n\n")
-        end
-
-        def configuration
-          <<~'TS'.chomp
-            export interface AdminSettings {
-              /** The domain host's address, when not read from the environment variable the Admin row names. */
-              host?: string;
-              /** The fetch to use, for tests. */
-              fetch?: typeof fetch;
-            }
-
-            let settings: AdminSettings = {};
-
-            /** Sets the host or the fetch, and forgets every remembered verdict. */
-            export function configureAdmin(next: AdminSettings): void {
-              settings = next;
-              forgetAdminSessions();
-            }
-
-            function hostUrl(): string {
-              const named = settings.host ?? (typeof process !== "undefined" ? process.env[ADMIN.hostEnv] : undefined);
-              return (named || ADMIN.hostDefault).replace(/\/+$/, "");
-            }
-
-            function askHost(path: string, cookieValue: string): Promise<Response> {
-              return (settings.fetch ?? fetch)(`${hostUrl()}${path}`, {
-                headers: { Cookie: `${ADMIN.sessionCookie}=${cookieValue}` },
-                signal: AbortSignal.timeout(ADMIN.timeoutMs),
-              });
-            }
-          TS
-        end
-
-        def membership
-          <<~TS.chomp
-            export interface MemberRow {
-              email?: unknown;
-              role?: unknown;
-              disabled?: unknown;
-            }
-
-            /** True when `email` (any case) is a member holding one of the admin roles and not disabled. */
-            export function isActiveAdmin(members: MemberRow[], email: string): boolean {
-              const wanted = email.trim().toLowerCase();
-              return members.some(
-                (member) =>
-                  typeof member.email === "string" &&
-                  member.email.trim().toLowerCase() === wanted &&
-                  (ADMIN.roles as readonly unknown[]).includes(member.role) &&
-                  member.disabled !== true,
-              );
-            }
-          TS
-        end
-
-        def sessions
-          <<~TS.chomp
-            /** A signed-in admin and the membership list that vouched for them. */
-            export interface AdminSession {
-              email: string;
-              members: unknown[];
-            }
-
-            async function fetchAccountEmail(cookieValue: string): Promise<string | null> {
-              const res = await askHost(ADMIN.accountPath, cookieValue);
-              if (!res.ok) return null;
-              const data = await res.json();
-              return typeof data.email === "string" ? data.email : null;
-            }
-
-            async function fetchAdminSession(cookieValue: string): Promise<AdminSession | null> {
-              const [email, membersRes] = await Promise.all([
-                fetchAccountEmail(cookieValue),
-                askHost(ADMIN.membersPath, cookieValue),
-              ]);
-              if (!email || !membersRes.ok) return null;
-              const members = await membersRes.json();
-              return Array.isArray(members) && isActiveAdmin(members, email) ? { email, members } : null;
-            }
-          TS
-        end
-
-        def verdicts
-          <<~TS.chomp
-            const accountEmails = remember(fetchAccountEmail);
-            const adminSessions = remember(fetchAdminSession);
-
-            /** Drops every remembered verdict, for after this process changes a member. */
-            export function forgetAdminSessions(): void {
-              accountEmails.forget();
-              adminSessions.forget();
-            }
-
-            /** The signed-in person's email, or null when the cookie is absent or the host does not know it. */
-            export async function currentAccountEmail(cookieValue: string | undefined): Promise<string | null> {
-              return cookieValue ? accountEmails.get(cookieValue) : null;
-            }
-
-            /** The signed-in person and the membership list when they hold an admin role, else null. */
-            export async function currentAdminSession(cookieValue: string | undefined): Promise<AdminSession | null> {
-              return cookieValue ? adminSessions.get(cookieValue) : null;
-            }
-
-            /** The signed-in person's email when they may use the admin pages, else null. */
-            export async function currentAdminEmail(cookieValue: string | undefined): Promise<string | null> {
-              return (await currentAdminSession(cookieValue))?.email ?? null;
-            }
-          TS
-        end
-
-        def handoff
-          <<~TS.chomp
-            /**
-             * Where the hand-off to the CMS sends a person: the CMS's own sign-in endpoint with a short-lived
-             * token from the host, or the login page when there is no session or the host refuses the token.
-             * `to` is a path inside the CMS to open once signed in; the CMS checks it.
-             */
-            export async function ssoRedirect(cookieValue: string | undefined, to?: string | null): Promise<string> {
-              if (!cookieValue) return ADMIN.login;
-              const res = await askHost(ADMIN.ssoTokenPath, cookieValue);
-              if (!res.ok) return ADMIN.login;
-              const { token } = await res.json();
-              const params = new URLSearchParams({ token });
-              if (to) params.set("to", to);
-              return `${ADMIN.ssoTarget}?${params}`;
-            }
-          TS
-        end
-
-        def routing
-          <<~'TS'.chomp
-            /**
-             * How specific a route pattern is: the characters that are not a wildcard or a `:name` parameter,
-             * so `/admin-login` outranks `/admin*` and `/admin.html` outranks `/:slug.html`.
-             */
-            function specificity(pattern: string): number {
-              return pattern.replace(/:[A-Za-z_]\w*/g, "").replace(/\*/g, "").length;
-            }
-
-            /**
-             * The route that describes a path: the most specific match. Between routes equally specific the
-             * `admin` one wins, so a tie never lets a visitor through; after that, the first listed.
-             */
-            function routeFor(pathname: string): (typeof ROUTES)[number] | undefined {
-              let best: (typeof ROUTES)[number] | undefined;
-              for (const candidate of ROUTES) {
-                if (!matchesPath(candidate.path, pathname)) continue;
-                if (best === undefined) {
-                  best = candidate;
-                  continue;
-                }
-                const more = specificity(candidate.path) - specificity(best.path);
-                if (more > 0 || (more === 0 && candidate.auth === "admin" && best.auth !== "admin")) best = candidate;
-              }
-              return best;
-            }
-          TS
-        end
-
-        def gate
-          <<~TS.chomp
-            export type AdminGate = { allow: true } | { allow: false; status: 401 } | { allow: false; redirect: string };
-
-            /**
-             * Whether a request may go on. The most specific route that matches the path decides (see `routeFor`): an `admin`
-             * route, or any path under the draft-preview prefix, needs an admin session. A preview without
-             * one is refused with 401 and nothing else; any other admin path is sent to the login page.
-             */
-            export async function adminGate(pathname: string, cookieValue: string | undefined): Promise<AdminGate> {
-              const previewing = pathname.startsWith(MIDDLEWARE.preview.prefix + "/");
-              if (routeFor(pathname)?.auth !== "admin" && !previewing) return { allow: true };
-              if (await currentAdminEmail(cookieValue)) return { allow: true };
-              return previewing ? { allow: false, status: 401 } : { allow: false, redirect: ADMIN.login };
-            }
-          TS
+          [Session::CONFIGURATION, Session::MEMBERSHIP, Session::SESSIONS, Access::VERDICTS, Access::HANDOFF,
+           Access::ROUTING, Access::GATE].join("\n\n")
         end
       end
     end

data/lib/hecks/projections/site/site_cdn.rb

@@ -58,7 +58,17 @@ module Hecks
         end
 
         def listener_rule(setting, rule)
-          paths = rule.fetch(:paths)
+          conditions = listener_conditions(setting, rule.fetch(:paths))
+          [
+            "#{rule.fetch(:rule)}:", "  Type: AWS::ElasticLoadBalancingV2::ListenerRule", "  Properties:",
+            "    ListenerArn: #{setting.listener}", "    Priority: #{rule.fetch(:priority)}",
+            *("    Conditions:" unless conditions.empty?), *conditions,
+            "    Actions:", "      - Type: forward", "        TargetGroupArn: #{rule.fetch(:target_group)}"
+          ].join("\n") << "\n"
+        end
+
+        # The path and secret-header conditions of a listener rule; the website's rule has no path.
+        def listener_conditions(setting, paths)
           conditions = []
           unless paths == ["/*"]
             conditions.push("      - Field: path-pattern", "        Values: #{Deploy::Fargate::Yaml.flow_list(paths)}")
@@ -68,12 +78,7 @@ module Hecks
                             "          HttpHeaderName: #{setting.secret_header}",
                             "          Values: #{Deploy::Fargate::Yaml.flow_list([setting.secret_value])}")
           end
-          [
-            "#{rule.fetch(:rule)}:", "  Type: AWS::ElasticLoadBalancingV2::ListenerRule", "  Properties:",
-            "    ListenerArn: #{setting.listener}", "    Priority: #{rule.fetch(:priority)}",
-            *("    Conditions:" unless conditions.empty?), *conditions,
-            "    Actions:", "      - Type: forward", "        TargetGroupArn: #{rule.fetch(:target_group)}"
-          ].join("\n") << "\n"
+          conditions
         end
       end
     end

data/lib/hecks/projections/site/site_host/dockerfile.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      module SiteHost
+        # The image's build file, as a `format` template.
+        module Dockerfile
+          # The file, with `%<name>s` placeholders for the banner, the Node version, the port and
+          # the heap.
+          TEXT = <<~'DOCKER'
+            # %<banner>s
+            #
+            # The content system (Payload on Next's standalone server) as a container. Build from this
+            # directory. deploy-aws/boot.mjs resolves the secrets named by the *_ARN variables into
+            # DATABASE_URL and PAYLOAD_SECRET before it starts the server, so nothing here is a secret.
+            #
+            # Runtime environment, supplied by the task definition:
+            #   NODE_ENV=production, USE_POSTGRES=true, USE_S3_STORAGE=true, S3_MEDIA_BUCKET
+            #   DB_HOST, DB_NAME, DB_SECRET_ARN, PAYLOAD_SECRET_ARN, CORS_ORIGINS, AWS_REGION
+
+            # ---- build stage ----
+            FROM node:%<node>s-slim AS build
+            WORKDIR /app
+
+            # A lockfile written on macOS omits the Linux entries of optional native packages
+            # (sharp), and `next build` then fails deep inside page-data collection. Write it on the
+            # image's own platform: remove node_modules and package-lock.json and run npm install.
+            COPY package.json package-lock.json ./
+            RUN npm ci
+
+            COPY . .
+            # payload-types.ts is generated and untracked, so a clean checkout has none and the type check
+            # inside `next build` would see untyped results. Generating it only loads the config
+            # (no database); the values are placeholders and the flags are the ones production boots with.
+            RUN USE_POSTGRES=true USE_S3_STORAGE=true PAYLOAD_SECRET=build-only \
+                S3_MEDIA_BUCKET=build-only AWS_REGION=us-east-1 DATABASE_URL=postgres://build-only/build-only \
+                npm run generate:types
+            RUN npm run build
+
+            # ---- runtime stage ----
+            FROM node:%<node>s-slim
+            WORKDIR /app
+            ENV NODE_ENV=production
+            # The task is shared with sibling containers; without a cap Node sizes its heap from the whole task.
+            ENV NODE_OPTIONS=--max-old-space-size=%<heap>d
+
+            # Next's standalone output holds a minimal server.js and its traced node_modules; the static
+            # files are not part of it and are copied separately.
+            COPY --from=build /app/.next/standalone/ ./
+            COPY --from=build /app/.next/static ./.next/static
+
+            COPY deploy-aws/boot.mjs ./
+            # RDS enforces TLS; boot.mjs verifies against Amazon's CA bundle.
+            ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
+
+            # boot.mjs sits outside the Next app, so `next build` does not trace its import of the AWS SDK.
+            COPY --from=build /app/node_modules/@aws-sdk ./node_modules/@aws-sdk
+            COPY --from=build /app/node_modules/@smithy ./node_modules/@smithy
+            COPY --from=build /app/node_modules/tslib ./node_modules/tslib
+
+            # Next's standalone server reads HOSTNAME for its bind address.
+            ENV HOSTNAME=0.0.0.0
+            ENV PORT=%<port>d
+            EXPOSE %<port>d
+
+            # Nothing writes to /app at runtime (media goes to S3), so no root.
+            USER node
+            CMD ["node", "boot.mjs"]
+          DOCKER
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_host/templates.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "json"
+require_relative "dockerfile"
 
 module Hecks
   module Projections
@@ -15,7 +16,7 @@ module Hecks
           # @param cms [Hash{Symbol => Object}] the checked `Cms` row
           # @return [String] the image's build file
           def dockerfile(cms)
-            format(DOCKERFILE, banner: BANNER, node: cms[:node], port: cms[:port], heap: cms[:heap_mb])
+            format(Dockerfile::TEXT, banner: BANNER, node: cms[:node], port: cms[:port], heap: cms[:heap_mb])
           end
 
           # @param secrets [Array<Hash{Symbol => Object}>] the checked `BootSecret` rows
@@ -41,8 +42,12 @@ module Hecks
           end
 
           def whole_secret(secret, from, env)
+            note = "// #{secret[:env]} is the whole of the secret named by #{secret[:from]}. Optional and non-fatal."
+            "#{note}\n#{whole_read(secret, from, env)}"
+          end
+
+          def whole_read(secret, from, env)
             <<~JS.chomp
-              // #{secret[:env]} is the whole of the secret named by #{secret[:from]}. Optional and non-fatal.
               if (process.env[#{from}] && !process.env[#{env}]) {
                 try {
                   const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: process.env[#{from}] }));
@@ -66,9 +71,13 @@ module Hecks
 
             const client = new SecretsManagerClient({});
 
-            async function secretField(arn, field) {
+            async function secretJson(arn) {
               const { SecretString } = await client.send(new GetSecretValueCommand({ SecretId: arn }));
-              const value = JSON.parse(SecretString)[field];
+              return JSON.parse(SecretString);
+            }
+
+            async function secretField(arn, field) {
+              const value = (await secretJson(arn))[field];
               if (!value) throw new Error(`secret ${arn} has no "${field}" field`);
               return value;
             }
@@ -76,12 +85,16 @@ module Hecks
             if (process.env.DB_SECRET_ARN) {
               const { DB_HOST, DB_NAME } = process.env;
               if (!DB_HOST || !DB_NAME) throw new Error("DB_HOST and DB_NAME are required when DB_SECRET_ARN is set");
-              const password = await secretField(process.env.DB_SECRET_ARN, "password");
+              // The user and port come from the secret: RDS's master secret says postgres, and a client that shares
+              // an instance with others has its own role. A secret without them is read as postgres on 5432.
+              const { username = "postgres", password, port = 5432 } = await secretJson(process.env.DB_SECRET_ARN);
+              if (!password) throw new Error(`secret ${process.env.DB_SECRET_ARN} has no "password" field`);
               // The password goes through encodeURIComponent: the generated one can hold characters (@ / #)
               // that would otherwise split the URL. RDS enforces TLS; verify against Amazon's CA bundle,
               // which the image holds beside this file.
               const ssl = "sslmode=verify-full&sslrootcert=" + new URL("./rds-global-bundle.pem", import.meta.url).pathname;
-              process.env.DATABASE_URL = `postgres://postgres:${encodeURIComponent(password)}@${DB_HOST}:5432/${DB_NAME}?${ssl}`;
+              process.env.DATABASE_URL =
+                `postgres://${encodeURIComponent(username)}:${encodeURIComponent(password)}@${DB_HOST}:${port}/${DB_NAME}?${ssl}`;
             } else if (!process.env.DATABASE_URL) {
               throw new Error("either DB_SECRET_ARN (+ DB_HOST/DB_NAME) or DATABASE_URL is required");
             }
@@ -97,67 +110,6 @@ module Hecks
             // Next's standalone server starts listening on import (PORT and HOSTNAME come from the environment).
             await import("./server.js");
           JS
-
-          DOCKERFILE = <<~'DOCKER'
-            # %<banner>s
-            #
-            # The content system (Payload on Next's standalone server) as a container. Build from this
-            # directory. deploy-aws/boot.mjs resolves the secrets named by the *_ARN variables into
-            # DATABASE_URL and PAYLOAD_SECRET before it starts the server, so nothing here is a secret.
-            #
-            # Runtime environment, supplied by the task definition:
-            #   NODE_ENV=production, USE_POSTGRES=true, USE_S3_STORAGE=true, S3_MEDIA_BUCKET
-            #   DB_HOST, DB_NAME, DB_SECRET_ARN, PAYLOAD_SECRET_ARN, CORS_ORIGINS, AWS_REGION
-
-            # ---- build stage ----
-            FROM node:%<node>s-slim AS build
-            WORKDIR /app
-
-            # A lockfile written on macOS omits the Linux entries of optional native packages
-            # (sharp), and `next build` then fails deep inside page-data collection. Write it on the
-            # image's own platform: remove node_modules and package-lock.json and run npm install.
-            COPY package.json package-lock.json ./
-            RUN npm ci
-
-            COPY . .
-            # payload-types.ts is generated and untracked, so a clean checkout has none and the type check
-            # inside `next build` would see untyped results. Generating it only loads the config
-            # (no database); the values are placeholders and the flags are the ones production boots with.
-            RUN USE_POSTGRES=true USE_S3_STORAGE=true PAYLOAD_SECRET=build-only \
-                S3_MEDIA_BUCKET=build-only AWS_REGION=us-east-1 DATABASE_URL=postgres://build-only/build-only \
-                npm run generate:types
-            RUN npm run build
-
-            # ---- runtime stage ----
-            FROM node:%<node>s-slim
-            WORKDIR /app
-            ENV NODE_ENV=production
-            # The task is shared with sibling containers; without a cap Node sizes its heap from the whole task.
-            ENV NODE_OPTIONS=--max-old-space-size=%<heap>d
-
-            # Next's standalone output holds a minimal server.js and its traced node_modules; the static
-            # files are not part of it and are copied separately.
-            COPY --from=build /app/.next/standalone/ ./
-            COPY --from=build /app/.next/static ./.next/static
-
-            COPY deploy-aws/boot.mjs ./
-            # RDS enforces TLS; boot.mjs verifies against Amazon's CA bundle.
-            ADD https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem ./rds-global-bundle.pem
-
-            # boot.mjs sits outside the Next app, so `next build` does not trace its import of the AWS SDK.
-            COPY --from=build /app/node_modules/@aws-sdk ./node_modules/@aws-sdk
-            COPY --from=build /app/node_modules/@smithy ./node_modules/@smithy
-            COPY --from=build /app/node_modules/tslib ./node_modules/tslib
-
-            # Next's standalone server reads HOSTNAME for its bind address.
-            ENV HOSTNAME=0.0.0.0
-            ENV PORT=%<port>d
-            EXPOSE %<port>d
-
-            # Nothing writes to /app at runtime (media goes to S3), so no root.
-            USER node
-            CMD ["node", "boot.mjs"]
-          DOCKER
         end
       end
     end

data/lib/hecks/projections/site/site_root/workflow.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Hecks
+  module Projections
+    module Site
+      module SiteRoot
+        # The workflow that keeps the generated files current, as a `format` template.
+        module Workflow
+          # The file, with `%<name>s` placeholders for the row's values.
+          TEXT = <<~YAML
+            %<banner>s
+            # Two checks, neither needing AWS or a database:
+            #
+            #   1. the generated files are current: `%<script>s --check` regenerates them with the hecks
+            #      gem the Gemfile.lock pins and exits 1, naming each file, if a row was edited without
+            #      regenerating or a generated file was hand-edited;
+            #   2. `%<test>s`, which holds the generated code to what the hand-written code does.
+            name: %<name>s
+
+            on:
+              push:
+                branches: [main]
+                paths:
+            %<paths>s
+              pull_request:
+                paths:
+            %<paths>s
+              # Lets a GitHub merge queue run this check on each queued PR (paths do not apply to merge_group).
+              merge_group:
+              workflow_dispatch: {}
+
+            permissions:
+              contents: read
+
+            jobs:
+              routes-current-and-parity:
+                runs-on: ubuntu-24.04
+                timeout-minutes: 15
+
+                steps:
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+
+                  - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
+                    with:
+                      ruby-version: %<ruby>s
+                      bundler-cache: true
+                      working-directory: %<gem_dir>s
+
+                  - name: The generated files are current
+                    run: %<script>s --check
+
+                  - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+                    with:
+                      node-version: %<node>s
+
+                  %<install_steps>s
+
+                  - name: Parity between the generated code and the hand-written code
+                    run: %<test>s
+          YAML
+        end
+      end
+    end
+  end
+end

data/lib/hecks/projections/site/site_root.rb

@@ -2,6 +2,7 @@
 
 require_relative "../../projector"
 require_relative "root_rows"
+require_relative "site_root/workflow"
 
 module Hecks
   module Projections
@@ -96,14 +97,14 @@ module Hecks
         end
 
         def reference(var, secrets)
-          "op://#{[secrets[:vault], secrets[:item], secrets[:section], var[:name]].compact.join('/')}"
+          "op://#{[secrets[:vault], secrets[:item], secrets[:section], var[:name]].compact.join("/")}"
         end
 
         # @param row [Hash{Symbol => Object}] the checked `Ci` row
         # @return [String] the workflow
         def workflow(row)
           paths = path_list(row).map { |path| "      - #{path.to_s.inspect}" }.join("\n")
-          format(WORKFLOW_TEXT, banner: BANNER, name: row[:name], paths: paths, ruby: row[:ruby].inspect,
+          format(Workflow::TEXT, banner: BANNER, name: row[:name], paths: paths, ruby: row[:ruby].inspect,
                                 node: row[:node].inspect, gem_dir: row[:gem_dir], script: row[:script], test: row[:test],
                                 install_steps: install_steps(row[:install]))
         end
@@ -121,58 +122,6 @@ module Hecks
           listed = row[:paths].split(",").map(&:strip).reject(&:empty?)
           [*listed, row[:script], "#{row[:gem_dir]}/Gemfile.lock", WORKFLOW].uniq
         end
-
-        WORKFLOW_TEXT = <<~YAML
-          %<banner>s
-          # Two checks, neither needing AWS or a database:
-          #
-          #   1. the generated files are current: `%<script>s --check` regenerates them with the hecks
-          #      gem the Gemfile.lock pins and exits 1, naming each file, if a row was edited without
-          #      regenerating or a generated file was hand-edited;
-          #   2. `%<test>s`, which holds the generated code to what the hand-written code does.
-          name: %<name>s
-
-          on:
-            push:
-              branches: [main]
-              paths:
-          %<paths>s
-            pull_request:
-              paths:
-          %<paths>s
-            # Lets a GitHub merge queue run this check on each queued PR (paths do not apply to merge_group).
-            merge_group:
-            workflow_dispatch: {}
-
-          permissions:
-            contents: read
-
-          jobs:
-            routes-current-and-parity:
-              runs-on: ubuntu-24.04
-              timeout-minutes: 15
-
-              steps:
-                - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-
-                - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
-                  with:
-                    ruby-version: %<ruby>s
-                    bundler-cache: true
-                    working-directory: %<gem_dir>s
-
-                - name: The generated files are current
-                  run: %<script>s --check
-
-                - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
-                  with:
-                    node-version: %<node>s
-
-                %<install_steps>s
-
-                - name: Parity between the generated code and the hand-written code
-                  run: %<test>s
-        YAML
       end
     end
   end