hecks 5.0.0 → 7.0.0

data/lib/hecks/tools/regeneration_run/pool.rb

@@ -0,0 +1,148 @@
+# frozen_string_literal: true
+
+require "tempfile"
+
+module Hecks
+  module Tools
+    module RegenerationRun
+      # Forks one `hecks project_rust` child per domain, up to `workers` at a time, and prints each
+      # child's output whole, in domain order, as soon as every domain before it has been printed.
+      #
+      # A child inherits the parent's memoized grammar registry through the fork. Its output goes to
+      # a temporary file, so a child that writes a lot never waits on a reader. A child that fails
+      # stops the pool from starting more; the ones already running are left to finish, so no
+      # child is cut off in the middle of a write. The run then aborts, naming the failed domains.
+      class Pool
+        # What a child runs: `hecks project_rust` with the domain and the declared-domain flags,
+        # writing to the streams it was given.
+        PROJECT_RUST = lambda do |argv|
+          Hecks::RustBuild.run("project_rust", argv, out: STDOUT, err: STDERR)
+        end
+
+        # @param domains [Array<String>] the domains, in the order their output is printed
+        # @param flags [Array<String>] the declared-domain flags every child is given
+        # @param workers [Integer] how many children may run at once
+        # @param runner [#call] what a child does with its argument list, answering an exit status
+        def initialize(domains, flags, workers, runner: PROJECT_RUST)
+          @domains = domains
+          @flags = flags
+          @workers = workers
+          @runner = runner
+          @pending = domains.each_index.to_a
+          @running = {}
+          @results = {}
+          @shown = Set.new
+          @finished = Queue.new
+        end
+
+        # Runs every domain, or until one fails and the children already running are done.
+        #
+        # @return [void]
+        # @raise [SystemExit] when a child fails: the message names every domain that did
+        def call
+          start_children
+          until @running.empty?
+            finish(*@finished.pop)
+            start_children
+          end
+          print_rest
+          abort_on_failure
+        ensure
+          stop_children
+        end
+
+        private
+
+        def start_children
+          while @running.size < @workers && failed.empty? && (index = @pending.shift)
+            @running[index] = start(index)
+          end
+        end
+
+        # @return [Array<Integer>] the indexes of the children that ended badly, in domain order
+        def failed = @results.reject { |_, (_, status)| status.success? }.keys.sort
+
+        # @return [Array(Integer, Tempfile)] the child's process id and its output file
+        def start(index)
+          out = Tempfile.new("regen-project-rust")
+          pid = fork { run_child(out, [@domains[index], *@flags]) }
+          Thread.new { @finished << [index, Process.wait2(pid).last] }
+          [pid, out]
+        end
+
+        def finish(index, status)
+          _, out = @running.delete(index)
+          @results[index] = [out, status]
+          print_ready
+        end
+
+        # Prints the finished children in domain order, each once every domain before it is shown.
+        def print_ready
+          next_up = (0...@domains.size).find { |index| !@shown.include?(index) }
+          while next_up && @results.key?(next_up)
+            show(next_up)
+            next_up += 1
+          end
+        end
+
+        # After a failure some domains were never started: shows the ones that ran, in order.
+        def print_rest
+          @results.keys.sort.each { |index| show(index) unless @shown.include?(index) }
+        end
+
+        def show(index)
+          @shown << index
+          out, = @results.fetch(index)
+          puts "== hecks project_rust #{@domains[index]} =="
+          out.rewind
+          $stdout.write(out.read)
+          out.close!
+          puts
+        end
+
+        def abort_on_failure
+          names = failed
+          return if names.empty?
+
+          first, *others = names
+          also = others.empty? ? "" : " (also failed: #{others.map { |index| @domains[index] }.join(", ")})"
+          abort "hecks regenerate_corpus: hecks project_rust #{@domains[first]} failed " \
+                "(#{@results.fetch(first).last.inspect})#{also}"
+        end
+
+        # Ends the children still running when the parent leaves early (an interrupt, say).
+        def stop_children
+          @running.each_value do |pid, _|
+            Process.kill("TERM", pid)
+          rescue Errno::ESRCH
+            next
+          end
+        end
+
+        # @param out [Tempfile] the child's end, which becomes its stdout and stderr
+        # @param argv [Array<String>] the arguments of `hecks project_rust`
+        # @return [void] never returns: the child leaves without the parent's exit handlers
+        def run_child(out, argv)
+          # The real descriptors, not the globals: a caller may have swapped those for a buffer.
+          STDOUT.reopen(out)
+          STDERR.reopen(out)
+          $stdout = STDOUT
+          $stderr = STDERR
+          status = child_status(argv)
+          $stdout.flush
+          exit!(status)
+        end
+
+        # @return [Integer] the exit status of the runner with the arguments
+        def child_status(argv)
+          @runner.call(argv)
+        rescue SystemExit => e
+          e.status
+        rescue StandardError => e
+          warn "#{e.class}: #{e.message}"
+          1
+        end
+      end
+    end
+  end
+end

data/lib/hecks/tools/regeneration_run/scratch.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "open3"
+require "tmpdir"
+
+module Hecks
+  module Tools
+    module RegenerationRun
+      # The scratch crate of a `--check`: copies of the generated tree and Cargo.toml that a
+      # projection writes into, and the comparison of what it wrote with the tree on disk. The
+      # working tree is never written.
+      module Scratch
+        # The refusal when a check finds nothing generated to compare.
+        NOT_MATERIALIZED = "hecks regeneration_run.regenerate_corpus! --check: rust/src/generated has no generated output to " \
+                           "compare. It is committed: restore it from git, or run " \
+                           "`hecks regeneration_run.regenerate_corpus! --confirm`, then the check."
+
+        # A scratch crate: copies of the generated tree and Cargo.toml, all `hecks build.project_rust!`
+        # writes.
+        #
+        # @param root [String] the checkout
+        # @return [String] the scratch directory
+        def scratch_crate(root)
+          abort NOT_MATERIALIZED unless File.directory?(File.join(root, "rust/src/generated/meta"))
+
+          scratch = Dir.mktmpdir("regen-codegen-check")
+          FileUtils.mkdir_p(File.join(scratch, "src"))
+          FileUtils.cp_r(File.join(root, "rust/src/generated"), File.join(scratch, "src/generated"))
+          FileUtils.cp(File.join(root, "rust/Cargo.toml"), scratch)
+          scratch
+        end
+
+        # Puts back, in the scratch crate, every module the named domains do not own, as the tree
+        # has it: a run of some domains rewrites the shared bluebooks and the grammar as its own last
+        # writer would, which is not what the whole corpus's last writer left in the tree.
+        #
+        # @param scratch [String] the scratch crate
+        # @param root [String] the checkout
+        # @param owned [Array<String>] the features of the domains that ran
+        # @return [void]
+        def restore_shared(scratch, root, owned)
+          source = File.join(root, "rust/src/generated")
+          Dir.children(source).each do |entry|
+            next if owned.include?(entry) || !File.directory?(File.join(source, entry))
+
+            FileUtils.rm_rf(File.join(scratch, "src/generated", entry))
+            FileUtils.cp_r(File.join(source, entry), File.join(scratch, "src/generated"))
+          end
+        end
+
+        # The gate: the scratch projection must match the generated sources and Cargo.toml on disk.
+        #
+        # @param scratch [String] the scratch crate, removed here
+        # @return [Integer] 0 when it matches, 1 after printing the difference
+        def verdict(scratch)
+          same = matches_scratch?(scratch)
+          FileUtils.rm_rf(scratch)
+          same ? 0 : 1
+        end
+
+        # @param scratch [String] the scratch crate
+        # @return [Boolean] whether it matches the tree, printing `git diff` output when it does not
+        def matches_scratch?(scratch)
+          pairs = [["rust/src/generated", File.join(scratch, "src/generated")],
+                   ["rust/Cargo.toml", File.join(scratch, "Cargo.toml")]]
+          pairs.map do |on_disk, projected|
+            out, status = Open3.capture2e("git", "diff", "--no-index", "--exit-code", "--", on_disk, projected)
+            print out
+            status.success?
+          end.all?
+        end
+      end
+    end
+  end
+end

data/lib/hecks/tools/regeneration_run.rb

@@ -1,25 +1,26 @@
 # frozen_string_literal: true
 
+require "etc"
 require "fileutils"
-require "open3"
-require "tmpdir"
 require_relative "../tools"
 require_relative "../corpus"
+require_relative "regeneration_run/scratch"
+require_relative "regeneration_run/pool"
 
 module Hecks
   module Tools
     # Regenerates every corpus domain's Rust output with `hecks project_rust`, or checks that the
-    # output on disk is what that would write. Only pizzas, `mod.rs` and `Cargo.toml` are committed.
+    # output on disk is what that would write. The whole tree and `Cargo.toml` are committed.
     #
-    # The domain list comes from `Hecks::Corpus.rust_regen_order`, never a hand-kept list. The
-    # order is fixed (sorted by relative path): domains that share governance/, identity/,
-    # Cargo.toml and generated/mod.rs stamp them with whichever ran last, so it must not flap.
-    # If the domain set or the sort rule changes, re-run and commit what changed.
+    # The domain list comes from `Hecks::Corpus.rust_regen_order`, never a hand-kept list, and is
+    # handed to every run as the declared domains: a domain's files, `generated/mod.rs` and
+    # Cargo's features come out the same in whatever order the domains run. The domains run side
+    # by side, one child per core unless `workers=` says otherwise (see `Pool`).
     #
     #   hecks regenerate_corpus         # discover, regenerate, print the plan
-    #   hecks regenerate_corpus --check # regenerate into a scratch crate; fail on any difference
-    #
-    # `--check` never writes the working tree: it runs beside the parallel suite.
+    #   hecks regenerate_corpus --check # a scratch crate, never the tree; fail on any difference
+    #   hecks regenerate_corpus domains=a,b # only those; `mod.rs` and Cargo's features stay put
+    #   hecks regenerate_corpus workers=1   # one domain at a time
     module RegenerationRun
       # The refusal when no domain is found.
       NO_DOMAINS = "hecks regenerate_corpus: discovered ZERO domains with committed rust/src/generated/ " \
@@ -27,58 +28,110 @@ module Hecks
                    "wrong directory, or something upstream deleted rust/src/generated/ entirely. Refusing " \
                    "to silently treat that as \"nothing to regenerate.\""
 
-      # The refusal when a check finds nothing generated to compare.
-      NOT_MATERIALIZED = "hecks regenerate_corpus --check: rust/src/generated has no generated output to compare. " \
-                         "Only pizzas, mod.rs and Cargo.toml are committed; run " \
-                         "`hecks regenerate_corpus --confirm` first, then the check."
+      # The argument naming the domains to regenerate, comma-separated, as the launcher passes it.
+      DOMAINS_ARG = "domains="
+
+      # The argument saying how many domains are generated at once, as the launcher passes it.
+      WORKERS_ARG = "workers="
+
+      # What a count of workers looks like: a whole number above zero.
+      POSITIVE_WHOLE_NUMBER = /\A[1-9][0-9]*\z/
+
+      # The job that generates `meta`, the self-hosted language's Rust. It is the same whichever
+      # domain is projected, so a run does it once, first and beside the first domains, and tells
+      # every domain to skip it. A run of some domains does it too: a fresh workspace needs it.
+      META_JOB = "meta"
+
+      # What a child of the pool does with its arguments: generate `meta` for the `META_JOB`, and
+      # otherwise run `hecks project_rust` on the domain. Runs in the child, whose output streams
+      # are real descriptors.
+      CORPUS_JOB = lambda do |argv|
+        next Pool::PROJECT_RUST.call(argv) unless argv.first == META_JOB
+
+        Hecks::RustBuild::ProjectRust::Meta.generate
+        0
+      end
+
+      # The scratch crate of a check: `scratch_crate`, `verdict` and `matches_scratch?`.
+      extend Scratch
 
       module_function
 
       # Regenerates the corpus, or checks it.
       #
-      # @param argv [Array<String>] `--check` to project into a scratch crate and compare
+      # @param argv [Array<String>] `--check` to project into a scratch crate and compare, and
+      #   `domains=a,b` to run only those domains, `workers=n` to generate n at once
       # @param root [String] the checkout
       # @return [Integer] 0, or 1 when a check finds a difference
-      # @raise [SystemExit] when no corpus domain is found or a domain fails to regenerate
+      # @raise [SystemExit] when no corpus domain is found, a named domain is not one, the workers
+      #   are not a positive number, or a domain fails to regenerate
       def main(argv, root: Tools::ROOT)
         Dir.chdir(root) do
-          domains = plan(root)
-          # A check projects into a scratch copy of the crate; the forked children inherit
-          # HECKS_RUST_DIR.
+          names = named(argv)
+          workers = workers_in(argv)
+          domains = plan(root, names)
+          # A check projects into a scratch copy of the crate; the forked children inherit the
+          # workspace with the process.
           scratch = argv.include?("--check") && scratch_crate(root)
-          run_plan(domains, scratch)
+          run_plan(domains, scratch, names, workers, root)
         end
       end
 
-      # Regenerates the domains, then judges the scratch crate when there is one.
+      # Regenerates the domains, then judges the scratch crate when there is one. A check of some
+      # domains judges only the modules those domains own: the rest, shared bluebooks and the
+      # grammar, are what the corpus's last writer left, so they are put back as the tree has them.
       #
       # @param domains [Array<String>] the domains, in run order
       # @param scratch [String, false] the scratch crate of a check, removed here
+      # @param names [Array<String>, nil] the features of some of the corpus's domains, nil for all
+      # @param workers [Integer] how many domains are generated at once
+      # @param root [String] the checkout
       # @return [Integer] 0, or 1 when a check finds a difference
-      def run_plan(domains, scratch)
-        with_rust_dir(scratch) { regenerate(domains) }
+      def run_plan(domains, scratch, names, workers, root)
+        with_rust_dir(scratch) { regenerate(domains, partial: !names.nil?, workers: workers) }
+        restore_shared(scratch, root, names) if scratch && names
         scratch ? verdict(scratch) : 0
       ensure
         FileUtils.rm_rf(scratch) if scratch
       end
 
-      # Points `HECKS_RUST_DIR` at `scratch` while the block runs, then puts it back.
-      def with_rust_dir(scratch)
-        saved = ENV.fetch("HECKS_RUST_DIR", nil)
-        ENV["HECKS_RUST_DIR"] = scratch if scratch
-        yield
-      ensure
-        saved ? ENV["HECKS_RUST_DIR"] = saved : ENV.delete("HECKS_RUST_DIR")
+      # @param argv [Array<String>] the arguments of the run
+      # @return [Integer] what `workers=` gives, one child per core when it is not given
+      # @raise [SystemExit] when it is not a positive whole number
+      def workers_in(argv)
+        given = argv.find { |arg| arg.start_with?(WORKERS_ARG) }&.delete_prefix(WORKERS_ARG)
+        return default_workers unless given
+        return Integer(given) if given.match?(POSITIVE_WHOLE_NUMBER)
+
+        abort "hecks regenerate_corpus: workers=#{given} is not a positive whole number"
+      end
+
+      # Builds in `scratch` while the block runs; with none, in the workspace already chosen.
+      def with_rust_dir(scratch, &)
+        require "hecks/rust_build"
+        return yield unless scratch
+
+        Hecks::RustBuild.in_workspace(scratch, &)
+      end
+
+      # @param argv [Array<String>] the arguments of the run
+      # @return [Array<String>, nil] the feature names `domains=` lists, nil when it is not given
+      def named(argv)
+        list = argv.find { |arg| arg.start_with?(DOMAINS_ARG) }
+        list&.delete_prefix(DOMAINS_ARG)&.split(",")
       end
 
       # `meta` is never in the list: `Hecks::Corpus::RUST_ELSEWHERE` routes it to the check that
       # owns it instead.
       #
       # @param root [String] the checkout
+      # @param names [Array<String>, nil] the features to regenerate; nil for every domain
       # @return [Array<String>] the domains to regenerate, relative to `root`, in run order
-      # @raise [SystemExit] when there are none
-      def plan(root)
-        domains = Hecks::Corpus.rust_regen_order.map { |domain| domain.dir.delete_prefix("#{root}/") }
+      # @raise [SystemExit] when there are none, or a name is not a domain: the message lists the
+      #   valid ones
+      def plan(root, names = nil)
+        chosen = Hecks::Corpus.rust_domains_named(names, root: root)
+        domains = chosen.map { |domain| domain.dir.delete_prefix("#{root}/") }
 
         abort NO_DOMAINS if domains.empty?
 
@@ -86,101 +139,75 @@ module Hecks
         domains.each { |d| puts "  #{d}" }
         puts
         domains
+      rescue Hecks::Corpus::UnknownDomain => e
+        abort "hecks regenerate_corpus: #{e.message}"
       end
 
-      # Builds the memoized grammar registry once and forks for each domain, one at a time and in
-      # order, because the shared outputs depend on which domain ran last.
+      # Builds the memoized grammar registry once, then forks `hecks project_rust` for each domain,
+      # `workers` at a time (see `Pool`). Every child is told the declared domains and that it is
+      # partial, so none of them writes `mod.rs` or Cargo's features: a whole run writes them once
+      # here, after the last domain, from the declared list, so they come out the same however the
+      # children interleave. A run of some of the domains leaves them alone. `meta` is generated by
+      # the pool's first job, beside the first domains, and every child is told to skip it.
       #
       # @param domains [Array<String>] the domains, in run order
+      # @param partial [Boolean] whether these are some of the corpus's domains, not all
+      # @param workers [Integer] how many domains are generated at once
       # @return [void]
-      def regenerate(domains)
+      # @raise [SystemExit] when a domain fails
+      def regenerate(domains, partial: false, workers: default_workers)
         require "hecks"
         require "hecks/bluebook/meta_validator"
         require "hecks/rust_build"
+        require "hecks/rust_build/project_rust"
         Hecks::Bluebook::MetaValidator.grammar_registry
-        domains.each { |domain| project_rust_in_fork(domain) }
+        run_pool(domains, workers)
+        write_manifest unless partial
       end
 
-      # Forks so the child inherits the memoized grammar registry instead of rebuilding it. The
-      # child's output goes through a pipe and is printed here, so it reaches whoever captures this
-      # process's stdout.
+      # Runs the pool with the generator already built, so no child runs Cargo (see
+      # `CodegenRun.prebuilt`).
       #
-      # @param domain [String] the domain, relative to the checkout
+      # @param domains [Array<String>] the domains, in run order
+      # @param workers [Integer] how many domains are generated at once
       # @return [void]
-      # @raise [SystemExit] when the child fails
-      def project_rust_in_fork(domain)
-        puts "== hecks project_rust #{domain} =="
-        reader, writer = IO.pipe
-        pid = fork { run_child(reader, writer, domain) }
-        writer.close
-        $stdout.write(reader.read)
-        reader.close
-        _, status = Process.wait2(pid)
-        abort "hecks regenerate_corpus: hecks project_rust #{domain} failed (#{status.inspect})" unless status.success?
-        puts
+      def run_pool(domains, workers)
+        Hecks::RustBuild::ProjectRust::CodegenRun.prebuilt(Hecks::RustBuild.rust_dir) do
+          Pool.new([META_JOB, *domains], child_flags, workers, runner: CORPUS_JOB).call
+        end
       end
 
-      # @param reader [IO] the parent's end of the pipe, closed here
-      # @param writer [IO] the child's end, which becomes its stdout and stderr
-      # @param domain [String] the domain
-      # @return [void] never returns: the child leaves without the parent's exit handlers
-      def run_child(reader, writer, domain)
-        reader.close
-        # The real descriptors, not the globals: a caller may have swapped those for a buffer.
-        STDOUT.reopen(writer) # rubocop:disable Style/GlobalStdStream
-        STDERR.reopen(writer) # rubocop:disable Style/GlobalStdStream
-        $stdout = STDOUT
-        $stderr = STDERR
-        status = child_status(domain)
-        $stdout.flush
-        exit!(status)
-      end
+      # @return [Array<String>] what every child is told: the declared domains, that it is partial,
+      #   and that `meta` is already generated
+      def child_flags = declared(partial: true).flags + [Hecks::RustBuild::ProjectRust::Meta::SKIP_FLAG]
 
-      # @return [Integer] the exit status of `hecks project_rust` for the domain
-      def child_status(domain)
-        Hecks::RustBuild.run("project_rust", [domain], out: STDOUT, err: STDERR) # rubocop:disable Style/GlobalStdStream
-      rescue SystemExit => e
-        e.status
-      rescue StandardError => e
-        warn "#{e.class}: #{e.message}"
-        1
-      end
+      # @return [Integer] how many domains a run generates at once unless told: one per core
+      def default_workers = Etc.nprocessors
 
-      # A scratch crate: copies of the generated tree and Cargo.toml, all `hecks project_rust`
-      # writes.
+      # `mod.rs` and Cargo's features for the whole corpus, written once in the workspace.
       #
-      # @param root [String] the checkout
-      # @return [String] the scratch directory
-      def scratch_crate(root)
-        abort NOT_MATERIALIZED unless File.directory?(File.join(root, "rust/src/generated/meta"))
-
-        scratch = Dir.mktmpdir("regen-codegen-check")
-        FileUtils.mkdir_p(File.join(scratch, "src"))
-        FileUtils.cp_r(File.join(root, "rust/src/generated"), File.join(scratch, "src/generated"))
-        FileUtils.cp(File.join(root, "rust/Cargo.toml"), scratch)
-        scratch
+      # @return [void]
+      def write_manifest
+        declared = declared(partial: false)
+        Hecks::RustBuild::ProjectRust::Manifest.new(Hecks::RustBuild.rust_dir, declared, declared.default).call
       end
 
-      # The gate: the scratch projection must match the generated sources and Cargo.toml on disk.
+      # The corpus's declared domains as `hecks project_rust` flags: the domains of the regeneration
+      # order, and the features the corpus routes elsewhere (`meta`, which every run generates).
+      # Cargo's `default` stays on the feature the tracked `rust/Cargo.toml` names, or on the last
+      # declared domain when it names none.
       #
-      # @param scratch [String] the scratch crate, removed here
-      # @return [Integer] 0 when it matches, 1 after printing the difference
-      def verdict(scratch)
-        same = matches_scratch?(scratch)
-        FileUtils.rm_rf(scratch)
-        same ? 0 : 1
-      end
-
-      # @param scratch [String] the scratch crate
-      # @return [Boolean] whether it matches the tree, printing `git diff` output when it does not
-      def matches_scratch?(scratch)
-        pairs = [["rust/src/generated", File.join(scratch, "src/generated")],
-                 ["rust/Cargo.toml", File.join(scratch, "Cargo.toml")]]
-        pairs.map do |on_disk, projected|
-          out, status = Open3.capture2e("git", "diff", "--no-index", "--exit-code", "--", on_disk, projected)
-          print out
-          status.success?
-        end.all?
+      # @param partial [Boolean] whether the run is of some domains: it is told so
+      # @return [Array<String>] the flags
+      def declared_flags(partial: false) = declared(partial: partial).flags
+
+      # @param partial [Boolean] whether the run is of some domains
+      # @return [Hecks::RustBuild::ProjectRust::Declared] the corpus's declared domains
+      def declared(partial: false)
+        require "hecks/rust_build/project_rust"
+        features = Hecks::Corpus.rust_regen_order.map(&:feature)
+        default = Hecks::Corpus.cargo_default || features.last
+        Hecks::RustBuild::ProjectRust::Declared.new(features + Hecks::Corpus::RUST_ELSEWHERE.keys, default, partial: partial)
       end
     end
   end

data/lib/hecks/{cli → tools}/release.rb

@@ -4,7 +4,7 @@ require "optparse"
 require_relative "../release/runner"
 
 module Hecks
-  module CLI
+  module Tools
     # The command behind `hecks publish`: tags the merged release commit, publishes the gem, and
     # gets `@hecks/client` published to npm. See "Releasing" in CONTRIBUTING.md for the release PR.
     #

data/lib/hecks/{cli → tools}/release_gem.rb

@@ -6,7 +6,7 @@ require_relative "../hecks/adapters/codebase/gem_registry"
 require_relative "../version"
 
 module Hecks
-  module CLI
+  module Tools
     # The command behind `hecks publish_gem` and the release runner's gem step: builds the hecks
     # gem and pushes it to rubygems.org, using a push-scoped API key from 1Password instead of
     # `~/.gem/credentials`. It pushes the version it is given, `Hecks::VERSION` by default.

data/lib/hecks/tools/release_only.rb

@@ -11,7 +11,7 @@ module Hecks
     # inherit the base's certification instead of running the suite again.
     #
     # The files a bump edits, and which of their lines it may change, are the `ReleaseFile` rows of
-    # the Vocabulary chapter. A change is a release bump when it touches at least one file, every
+    # the Vocabulary bluebook. A change is a release bump when it touches at least one file, every
     # file it touches is a row, and every line it adds or removes in a file matches that row's
     # `lines` pattern (an empty pattern admits any line). Whether the base is certified is read
     # from the base commit's own check runs: every `RequiredCheck` row that is not marked
@@ -21,6 +21,9 @@ module Hecks
     module ReleaseOnly
       GREEN = %w[success skipped].freeze
 
+      # The `+` or `-` that opens an added or removed line of a diff.
+      CHANGE_MARK = /\A[+-]/
+
       module_function
 
       # @param changes [Hash{String => Array<String>}] each changed path to the lines it adds or
@@ -91,7 +94,7 @@ module Hecks
 
       # @return [Boolean] whether the line is an added or removed line, not a header
       def content_line?(line)
-        line.match?(/\A[+-]/) && !line.start_with?("+++ ", "--- ")
+        line.match?(CHANGE_MARK) && !line.start_with?("+++ ", "--- ")
       end
 
       # @param repository [String] `owner/name`

data/lib/hecks/{cli → tools}/rspec_io_parallel_files.rb

@@ -4,7 +4,7 @@ require "json"
 require "open3"
 
 module Hecks
-  module CLI
+  module Tools
     # The command behind `hecks list_io_parallel_specs`: prints, one per line, the spec files with
     # at least one example matching an RSpec tag filter. ci.yml hands the list to `parallel_rspec`
     # instead of the whole `spec` directory.

data/lib/hecks/{cli → tools}/rspec_shard_files.rb

@@ -3,7 +3,7 @@
 require "parallel_tests/test/runner"
 
 module Hecks
-  module CLI
+  module Tools
     # The command behind `hecks shard_specs`: prints the spec files assigned to one group
     # (1-indexed) of a runtime-balanced N-way split. `rspec_shard` in ci-rspec.yml passes the
     # committed runtime baseline so every leg agrees.