@avi2dg/checks 0.30.0 → 0.32.0

package/src/delivery/gitleaks.ts

@@ -0,0 +1,111 @@
+import { Effect, Option, Path, Schema } from "effect";
+import { collect } from "../core/git.ts";
+import { installPinned } from "../dependencies/pinned-binary.ts";
+
+const GITLEAKS_VERSION = "8.30.1";
+const RELEASES = `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}`;
+const MEMBER = "gitleaks";
+
+type Build = { readonly archive: string; readonly sha256: string; readonly binarySha256: string };
+
+// The archive's SHA-256 as gitleaks_<version>_checksums.txt of the release lists it, and the SHA-256 of the binary inside.
+const BUILDS: Readonly<Record<string, Build>> = {
+  "darwin-arm64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_darwin_arm64.tar.gz`,
+    sha256: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
+    binarySha256: "ba52fb1bfabbcde42f032afad3d6e0b19dff8ed105229a16e7caa338bbc0e84f",
+  },
+  "darwin-x64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_darwin_x64.tar.gz`,
+    sha256: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
+    binarySha256: "cee01fea7173f1b779dff188e1c26ecbcb4027d394acc573b23aaf0be260e291",
+  },
+  "linux-arm64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz`,
+    sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+    binarySha256: "00e91bbe655bd7c47753e8cfe61cb76ea1a5d7e7702fe161ee40102b46b3823b",
+  },
+  "linux-x64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz`,
+    sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+    binarySha256: "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+  },
+};
+
+class GitleaksError extends Schema.TaggedError<GitleaksError>()("GitleaksError", {
+  message: Schema.String,
+}) {}
+
+export function gitleaksBuildFor(platform: string, arch: string): Option.Option<Build> {
+  return Option.fromNullishOr(BUILDS[`${platform}-${arch}`]);
+}
+
+export const pinnedGitleaks = Effect.fn("pinnedGitleaks")(function* (cache: string) {
+  const build = gitleaksBuildFor(process.platform, process.arch);
+  if (Option.isNone(build)) {
+    return yield* new GitleaksError({ message: `no pinned gitleaks build runs on ${process.platform}-${process.arch}` });
+  }
+  const path = yield* Path.Path;
+  const { archive, sha256, binarySha256 } = build.value;
+  return yield* installPinned(
+    { kind: "tar.gz", url: `${RELEASES}/${archive}`, sha256, member: MEMBER, memberSha256: binarySha256 },
+    path.join(cache, "gitleaks", GITLEAKS_VERSION, MEMBER),
+  );
+});
+
+const Leak = Schema.Struct({
+  RuleID: Schema.String,
+  Description: Schema.String,
+  File: Schema.String,
+  StartLine: Schema.Int,
+  Commit: Schema.String,
+});
+
+export type Leak = typeof Leak.Type;
+
+const decodeGitleaksReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(Leak)));
+
+export type Scan = {
+  readonly binary: string;
+  readonly gitDir: string;
+  readonly logOptions: string;
+  readonly config: string;
+  readonly ignoreDir: string;
+};
+
+// gitleaks exits 1 both on a leak and on a fatal error, so it exits 0 on a leak here and the report alone tells them apart.
+// It exits 0 with an empty report when git log fails, and logs only errors here, so any line it logs fails the scan.
+// It reads a .gitleaksignore at its source whatever --gitleaks-ignore-path says, so the source is the git directory, where no tracked file lands.
+export const scanCommits = Effect.fn("scanCommits")(function* ({ binary, gitDir, logOptions, config, ignoreDir }: Scan) {
+  const args = [
+    "git",
+    gitDir,
+    "--log-opts",
+    logOptions,
+    "--config",
+    config,
+    "--gitleaks-ignore-path",
+    ignoreDir,
+    "--ignore-gitleaks-allow",
+    "--redact",
+    "--no-banner",
+    "--no-color",
+    "--log-level",
+    "error",
+    "--exit-code",
+    "0",
+    "--report-format",
+    "json",
+    "--report-path",
+    "-",
+  ];
+  const { stdout, stderr, exitCode } = yield* collect(binary, args, ignoreDir).pipe(
+    Effect.mapError((cause) => new GitleaksError({ message: `cannot run ${binary}: ${cause.message}` })),
+  );
+  if (exitCode !== 0 || stderr.trim() !== "") {
+    return yield* new GitleaksError({ message: `${binary} failed: ${stderr.trim() || `exit code ${exitCode}`}` });
+  }
+  return yield* decodeGitleaksReport(stdout).pipe(
+    Effect.mapError((cause) => new GitleaksError({ message: `cannot read the report gitleaks wrote: ${cause.message}` })),
+  );
+});

package/src/delivery/release-pr.ts

@@ -0,0 +1,195 @@
+#!/usr/bin/env bun
+import { Console, Effect, Encoding, FileSystem, Path, Schema } from "effect";
+import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
+import { nextVersion, type Pending, readPending, releaseTitle, runBuild, withVersion } from "./release.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+class ReleaseRefused extends Schema.TaggedError<ReleaseRefused>()("ReleaseRefused", {
+  message: Schema.String,
+}) {}
+
+type Staged =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Read =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string; readonly content: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Built = {
+  readonly tree: string;
+  readonly files: readonly Read[];
+};
+
+type Remote = {
+  readonly parents: readonly string[];
+  readonly version: string | undefined;
+};
+
+const NAME = "checks-release-pr";
+const USAGE = "usage: release-pr.ts <workflow>...";
+const MANIFEST = "package.json";
+const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
+const RAW_ENTRY = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])/;
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+const decodeSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ sha: Schema.String })));
+const decodeRef = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ ref: Schema.String })));
+const PullRequest = Schema.Struct({ number: Schema.Int, title: Schema.String, html_url: Schema.String });
+type PullRequest = typeof PullRequest.Type;
+const decodePullRequest = Schema.decodeUnknownEffect(Schema.fromJsonString(PullRequest));
+const decodePullRequests = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(PullRequest)));
+
+export function releaseBranchOf(base: string): string {
+  return `release/${base}`;
+}
+
+export function stagedOf(raw: string): readonly Staged[] {
+  const fields = raw.split("\0");
+  const staged: Staged[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) {
+    const [, from = "", to = "", status] = RAW_ENTRY.exec(fields[index] ?? "") ?? [];
+    const path = fields[index + 1] ?? "";
+    staged.push(status === "D" ? { kind: "deleted", path, mode: from } : { kind: "written", path, mode: to });
+  }
+  return staged;
+}
+
+const refused = (message: string) => new ReleaseRefused({ message });
+
+const versionIn = (manifest: string) =>
+  decodeVersion(manifest).pipe(
+    Effect.map(({ version }) => version),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+const releaseVersion = Effect.fn("releaseVersion")(function* (manifest: string, { since, unreleased }: Pending) {
+  const { version } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)));
+  if (since !== undefined && since !== `v${version}`) {
+    return yield* refused(
+      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; rerun the tag job of daily-release on the release commit, whose refusal says what to fix, or return its version to ${since.slice(1)}`,
+    );
+  }
+  const next = nextVersion(version, unreleased);
+  if (next === undefined) return yield* refused(`${MANIFEST} holds ${version}, which is no plain major.minor.patch version`);
+  const bumped = withVersion(manifest, version, next);
+  if (bumped === undefined || (yield* versionIn(bumped)) !== next) {
+    return yield* refused(`cannot rewrite the version ${version} in ${MANIFEST} as ${next}`);
+  }
+  return { next, bumped };
+});
+
+const currentBranch = Effect.fn("currentBranch")(function* (root: string) {
+  const branch = yield* git(["symbolic-ref", "--quiet", "--short", "HEAD"], root).pipe(
+    Effect.map((name) => name.trim()),
+    Effect.catchTag("GitFailure", () => Effect.succeed("")),
+  );
+  if (branch === "") return yield* refused("HEAD is detached; check out the branch the release goes to");
+  return branch;
+});
+
+const readRemote = Effect.fn("readRemote")(function* (root: string, branch: string) {
+  if ((yield* git(["ls-remote", "origin", `refs/heads/${branch}`], root)).trim() === "") return undefined;
+  const tracking = `refs/remotes/origin/${branch}`;
+  yield* git(["fetch", "--quiet", "--no-tags", "origin", `+refs/heads/${branch}:${tracking}`], root);
+  const [, ...parents] = (yield* git(["rev-list", "--parents", "-n", "1", tracking], root)).trim().split(" ");
+  const version = yield* git(["show", `${tracking}:${MANIFEST}`], root).pipe(
+    Effect.flatMap(versionIn),
+    Effect.orElseSucceed(() => undefined),
+  );
+  return { parents, version } satisfies Remote;
+});
+
+const readStaged = Effect.fn("readStaged")(function* (root: string, staged: Staged) {
+  if (staged.kind === "deleted") return staged;
+  if (!REGULAR_FILE_MODES.has(staged.mode)) return yield* refused(`the build wrote ${staged.path} with mode ${staged.mode}, which is no regular file`);
+  const bytes = yield* (yield* FileSystem.FileSystem).readFile((yield* Path.Path).join(root, staged.path));
+  return { ...staged, content: Encoding.encodeBase64(bytes) };
+});
+
+// The build writes into the working tree, so the tree it starts from has to hold nothing a release would sweep in.
+const buildRelease = Effect.fn("buildRelease")(function* (root: string, bumped: string) {
+  if ((yield* git(["status", "--porcelain", "--untracked-files=no"], root)).trim() !== "") {
+    return yield* refused("the working tree has changes to tracked files; the release commits only what the build writes");
+  }
+  const restore = git(["reset", "--quiet", "--hard", "HEAD"], root).pipe(
+    Effect.catchTag("GitFailure", (failure) => Console.error(`${NAME}: cannot restore the working tree: ${failure.message}`)),
+  );
+  return yield* Effect.gen(function* () {
+    yield* (yield* FileSystem.FileSystem).writeFileString((yield* Path.Path).join(root, MANIFEST), bumped);
+    yield* runBuild(root);
+    yield* git(["add", "--update"], root);
+    const tree = (yield* git(["write-tree"], root)).trim();
+    const staged = stagedOf(yield* git(["diff", "--cached", "--raw", "-z", "--no-renames", "HEAD"], root));
+    return { tree, files: yield* Effect.forEach(staged, (one) => readStaged(root, one)) } satisfies Built;
+  }).pipe(Effect.ensuring(restore));
+});
+
+const treeEntry = Effect.fn("treeEntry")(function* (file: Read) {
+  if (file.kind === "deleted") return { path: file.path, mode: file.mode, type: "blob", sha: null };
+  const { sha } = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/blobs`, { content: file.content, encoding: "base64" });
+  return { path: file.path, mode: file.mode, type: "blob", sha };
+});
+
+const commitRelease = Effect.fn("commitRelease")(function* (root: string, head: string, built: Built, version: string) {
+  const tree = yield* Effect.forEach(built.files, treeEntry);
+  const baseTree = (yield* git(["rev-parse", `${head}^{tree}`], root)).trim();
+  const made = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/trees`, { base_tree: baseTree, tree });
+  if (made.sha !== built.tree) return yield* refused(`GitHub built the tree ${made.sha}, but the build wrote ${built.tree}`);
+  const commit = { message: releaseTitle(version), tree: made.sha, parents: [head] };
+  return (yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/commits`, commit)).sha;
+});
+
+const pointBranch = Effect.fn("pointBranch")(function* (branch: string, sha: string, exists: boolean) {
+  yield* exists
+    ? gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${branch}`, { sha, force: true })
+    : gitHubJson(decodeRef, "POST", `${REPOSITORY}/git/refs`, { ref: `refs/heads/${branch}`, sha });
+});
+
+const findOpen = Effect.fn("findOpen")(function* (base: string, branch: string) {
+  const query = `head={owner}:${encodeURIComponent(branch)}&base=${encodeURIComponent(base)}&state=open`;
+  const [open] = yield* gitHubJson(decodePullRequests, "GET", `${REPOSITORY}/pulls?${query}`);
+  return open;
+});
+
+const titlePullRequest = Effect.fn("titlePullRequest")(function* (open: PullRequest | undefined, base: string, branch: string, version: string) {
+  const title = releaseTitle(version);
+  const body = `Release ${version}.`;
+  if (open === undefined) {
+    const created = yield* gitHubJson(decodePullRequest, "POST", `${REPOSITORY}/pulls`, { title, head: branch, base, body });
+    return { verb: "opened", url: created.html_url };
+  }
+  if (open.title !== title) yield* gitHubJson(decodePullRequest, "PATCH", `${REPOSITORY}/pulls/${open.number}`, { title, body });
+  return { verb: "refreshed", url: open.html_url };
+});
+
+const releasePullRequest = Effect.gen(function* () {
+  const workflows = process.argv.slice(2);
+  if (workflows.length === 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const pending = yield* readPending(root);
+  if (pending.unreleased.length === 0) {
+    yield* Console.log(`release-pr: no unreleased changes ${pending.since === undefined ? "with no tag yet" : `since ${pending.since}`}`);
+    return true;
+  }
+  const base = yield* currentBranch(root);
+  const branch = releaseBranchOf(base);
+  const head = (yield* git(["rev-parse", "HEAD"], root)).trim();
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { next, bumped } = yield* releaseVersion(manifest, pending);
+  const remote = yield* readRemote(root, branch);
+  const current = remote?.version === next && remote.parents.length === 1 && remote.parents[0] === head;
+  const open = yield* findOpen(base, branch);
+  if (current && open?.title === releaseTitle(next)) {
+    yield* Console.log(`release-pr: ${open.html_url} releases ${next} from ${head.slice(0, 12)} and is current`);
+    return true;
+  }
+  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(root, bumped), next), remote !== undefined);
+  const { verb, url } = yield* titlePullRequest(open, base, branch, next);
+  yield* Effect.forEach(workflows, (workflow) => dispatch(workflow, branch));
+  yield* Console.log(`release-pr: ${verb} ${url} to release ${next}, and dispatched ${workflows.join(", ")} on ${branch}`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePullRequest);

package/src/delivery/release-report.ts

@@ -1,19 +1,10 @@
 #!/usr/bin/env bun
-import { Console, Effect, Schema } from "effect";
-import { groupOf } from "./changelog.ts";
+import { Console, Effect } from "effect";
+import { readPending } from "./release.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-export class ReleaseReportUnreadable extends Schema.TaggedError<ReleaseReportUnreadable>()("ReleaseReportUnreadable", {
-  message: Schema.String,
-}) {}
-
 const USAGE = "usage: release-report.ts";
-const RELEASE_TAG = "v[0-9]*.[0-9]*.[0-9]*";
-
-export function unreleasedOf(subjects: readonly string[]): readonly string[] {
-  return subjects.filter((subject) => groupOf(subject) !== undefined);
-}
 
 export function formatReport(unreleased: readonly string[], since: string | undefined): string {
   const where = since === undefined ? "with no tag yet" : `since ${since}`;
@@ -21,28 +12,10 @@ export function formatReport(unreleased: readonly string[], since: string | unde
   return [`release-report: ${unreleased.length} unreleased change(s) ${where}:`, ...unreleased.map((subject) => `  ${subject}`)].join("\n");
 }
 
-const lastTag = Effect.fn("lastTag")(function* (root: string) {
-  const described = yield* git(["describe", "--tags", "--abbrev=0", `--match=${RELEASE_TAG}`, "HEAD"], root).pipe(
-    Effect.map((tag) => tag.trim()),
-    Effect.catchTag("GitFailure", () => Effect.succeed("")),
-  );
-  return described === "" ? undefined : described;
-});
-
-const subjectsSince = Effect.fn("subjectsSince")(function* (root: string, since: string | undefined) {
-  const range = since === undefined ? "HEAD" : `${since}..HEAD`;
-  const log = yield* git(["log", "--topo-order", "--no-merges", "--format=%s", range], root);
-  return log.split("\n").filter((subject) => subject !== "");
-});
-
 const report = Effect.gen(function* () {
   if (process.argv.slice(2).length > 0) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  if ((yield* git(["rev-parse", "--is-shallow-repository"], root)).trim() === "true") {
-    return yield* new ReleaseReportUnreadable({ message: "the checkout is shallow, so the tag it sees may not be the last one; fetch all of it" });
-  }
-  const since = yield* lastTag(root);
-  const unreleased = unreleasedOf(yield* subjectsSince(root, since));
+  const { since, unreleased } = yield* readPending(root);
   yield* Console.log(formatReport(unreleased, since));
   return unreleased.length === 0;
 });

package/src/delivery/release-tag.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { dispatch, GitHubFailure } from "./github.ts";
+import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
+  message: Schema.String,
+}) {}
+
+const NAME = "checks-release-tag";
+const USAGE = "usage: release-tag.ts <workflow>";
+const MANIFEST = "package.json";
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+
+// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
+export function taggedCommitOf(listed: string): string | undefined {
+  const lines = listed.split("\n").filter((line) => line !== "");
+  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
+  return peeled?.split("\t")[0];
+}
+
+const releaseTag = Effect.gen(function* () {
+  const [workflow, ...extra] = process.argv.slice(2);
+  if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
+  const version = releasedVersionOf(subject);
+  if (version === undefined) {
+    yield* Console.log(`release-tag: ${head.slice(0, 12)} is no release commit`);
+    return true;
+  }
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
+  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
+  const tag = `v${version}`;
+  const tagged = taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
+  if (tagged === head) {
+    yield* Console.log(`release-tag: ${tag} already tags ${head.slice(0, 12)}`);
+    return true;
+  }
+  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
+  yield* runBuild(root);
+  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
+  if (rebuilt.length > 0) {
+    const since = yield* lastTag(root);
+    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
+    return yield* new TagRefused({
+      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next daily-release run cuts the release again with every change since ${since ?? "the first commit"}`,
+    });
+  }
+  yield* git(["push", "--quiet", "origin", `${head}:refs/tags/${tag}`], root);
+  yield* dispatch(workflow, tag).pipe(
+    Effect.mapError(
+      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
+    ),
+  );
+  yield* Console.log(`release-tag: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releaseTag);

package/src/delivery/release.ts

@@ -0,0 +1,79 @@
+import { Effect, Schema } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+import { groupOf } from "./changelog.ts";
+import { git } from "../core/git.ts";
+
+class ReleaseUnreadable extends Schema.TaggedError<ReleaseUnreadable>()("ReleaseUnreadable", {
+  message: Schema.String,
+}) {}
+
+class BuildFailed extends Schema.TaggedError<BuildFailed>()("BuildFailed", {
+  message: Schema.String,
+}) {}
+
+export type Pending = {
+  readonly since: string | undefined;
+  readonly unreleased: readonly string[];
+};
+
+const RELEASE_TAG = "v[0-9]*.[0-9]*.[0-9]*";
+const PLAIN_VERSION = /^(\d+)\.(\d+)\.(\d+)$/;
+const RELEASE_SUBJECT = /^chore: release (\d+\.\d+\.\d+)(?: \(#\d+\))?$/;
+
+export function unreleasedOf(subjects: readonly string[]): readonly string[] {
+  return subjects.filter((subject) => groupOf(subject) !== undefined);
+}
+
+// Under 0.x a breaking change moves the minor, as semver leaves a 0.x version free to break.
+export function nextVersion(version: string, unreleased: readonly string[]): string | undefined {
+  const [, major, minor, patch] = PLAIN_VERSION.exec(version)?.map(Number) ?? [];
+  if (major === undefined || minor === undefined || patch === undefined) return undefined;
+  const groups = new Set(unreleased.map(groupOf));
+  if (groups.has("Breaking changes") && major > 0) return `${major + 1}.0.0`;
+  if (groups.has("Breaking changes") || groups.has("Features")) return `${major}.${minor + 1}.0`;
+  return `${major}.${minor}.${patch + 1}`;
+}
+
+// Rewrites only the version's own text, so the rest of the manifest keeps the formatting its repository gave it.
+export function withVersion(manifest: string, from: string, to: string): string | undefined {
+  const field = new RegExp(`("version"\\s*:\\s*")${from.replaceAll(".", "\\.")}(")`);
+  return field.test(manifest) ? manifest.replace(field, `$1${to}$2`) : undefined;
+}
+
+export function releaseTitle(version: string): string {
+  return `chore: release ${version}`;
+}
+
+export function releasedVersionOf(subject: string): string | undefined {
+  return RELEASE_SUBJECT.exec(subject)?.[1];
+}
+
+export const runBuild = Effect.fn("runBuild")(function* (root: string) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const exitCode = yield* spawner.exitCode(
+    ChildProcess.make(process.execPath, ["run", "build"], { cwd: root, stdin: "ignore", stdout: "inherit", stderr: "inherit" }),
+  );
+  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return yield* new BuildFailed({ message: `bun run build exited ${exitCode}` });
+});
+
+export const lastTag = Effect.fn("lastTag")(function* (root: string) {
+  const described = yield* git(["describe", "--tags", "--abbrev=0", `--match=${RELEASE_TAG}`, "HEAD"], root).pipe(
+    Effect.map((tag) => tag.trim()),
+    Effect.catchTag("GitFailure", () => Effect.succeed("")),
+  );
+  return described === "" ? undefined : described;
+});
+
+const subjectsSince = Effect.fn("subjectsSince")(function* (root: string, since: string | undefined) {
+  const range = since === undefined ? "HEAD" : `${since}..HEAD`;
+  const log = yield* git(["log", "--topo-order", "--no-merges", "--format=%s", range], root);
+  return log.split("\n").filter((subject) => subject !== "");
+});
+
+export const readPending = Effect.fn("readPending")(function* (root: string) {
+  if ((yield* git(["rev-parse", "--is-shallow-repository"], root)).trim() === "true") {
+    return yield* new ReleaseUnreadable({ message: "the checkout is shallow, so the tag it sees may not be the last one; fetch all of it" });
+  }
+  const since = yield* lastTag(root);
+  return { since, unreleased: unreleasedOf(yield* subjectsSince(root, since)) } satisfies Pending;
+});

package/src/delivery/secrets.ts

@@ -0,0 +1,86 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { commitOf, git, refArgs } from "../core/git.ts";
+import { runMain } from "../core/main.ts";
+import { cacheRoot } from "../dependencies/cache-root.ts";
+import { pinnedGitleaks, scanCommits, type Leak } from "./gitleaks.ts";
+
+const NAME = "secrets";
+const USAGE = "usage: secrets.ts <ref> | <base-ref> <head-ref>";
+const SHORT_SHA = 8;
+const NEW_SIDE_PREFIX = "b/";
+const OCTOPUS_PARENTS = 3;
+
+class OctopusMerge extends Schema.TaggedError<OctopusMerge>()("OctopusMerge", {
+  message: Schema.String,
+}) {}
+
+// git reads a lone commit as its whole ancestry, and -1 limits only what a walk prints, so a single ref is bounded with --no-walk.
+const revisionsOf = Effect.fn("revisionsOf")(function* (args: readonly string[], root: string) {
+  const { first, second } = yield* refArgs(args, USAGE);
+  if (second === undefined) return ["--no-walk", yield* commitOf(first, root)];
+  const head = yield* commitOf(second, root);
+  const base = (yield* git(["merge-base", yield* commitOf(first, root), head], root)).trim();
+  return [`${base}..${head}`];
+});
+
+// Without --remerge-diff git log prints no diff for a merge, and a first-parent diff would rescan what the merge brings in.
+// git skips --remerge-diff for an octopus merge with only a warning, so the scan would pass a commit it never read.
+const logOptionsOf = Effect.fn("logOptionsOf")(function* (args: readonly string[], root: string) {
+  const revisions = yield* revisionsOf(args, root);
+  const [octopus] = (yield* git(["rev-list", `--min-parents=${OCTOPUS_PARENTS}`, ...revisions], root)).split("\n");
+  if (octopus !== undefined && octopus !== "") {
+    return yield* new OctopusMerge({
+      message: `git gives no resolution diff for the octopus merge ${octopus}, so the gate cannot scan it`,
+    });
+  }
+  return ["--remerge-diff", ...revisions].join(" ");
+});
+
+// gitleaks names a file under a remerge conflict header by its `+++ b/` line, so a path the commit does not hold carries that prefix.
+const atRepositoryPath = Effect.fn("atRepositoryPath")(function* (leak: Leak, root: string) {
+  if (!leak.File.startsWith(NEW_SIDE_PREFIX)) return leak;
+  const held = yield* git(["cat-file", "-e", `${leak.Commit}:${leak.File}`], root).pipe(
+    Effect.as(true),
+    Effect.catchTag("GitFailure", () => Effect.succeed(false)),
+  );
+  return held ? leak : { ...leak, File: leak.File.slice(NEW_SIDE_PREFIX.length) };
+});
+
+function leakLine({ File, StartLine, RuleID, Commit, Description }: Leak): string {
+  return `  ${File}:${StartLine} ${RuleID} in ${Commit.slice(0, SHORT_SHA)}: ${Description}`;
+}
+
+function byPlace(left: Leak, right: Leak): number {
+  return (
+    left.File.localeCompare(right.File) ||
+    left.StartLine - right.StartLine ||
+    left.RuleID.localeCompare(right.RuleID) ||
+    left.Commit.localeCompare(right.Commit)
+  );
+}
+
+export function report(leaks: readonly Leak[]): string {
+  if (leaks.length === 0) return `${NAME}: the range adds no secret`;
+  return [
+    `${NAME}: the range adds ${leaks.length} secret(s); put a placeholder such as <private-key> in its place in the commit that added it, and rotate any secret that left this machine:`,
+    ...leaks.toSorted(byPlace).map(leakLine),
+  ].join("\n");
+}
+
+const secrets = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const logOptions = yield* logOptionsOf(process.argv.slice(2), root);
+  const binary = yield* pinnedGitleaks(yield* cacheRoot());
+  const config = path.join(import.meta.dir, "gitleaks.toml");
+  const ignoreDir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-" });
+  const gitDir = (yield* git(["rev-parse", "--absolute-git-dir"], root)).trim();
+  const reported = yield* scanCommits({ binary, gitDir, logOptions, config, ignoreDir });
+  const leaks = yield* Effect.forEach(reported, (leak) => atRepositoryPath(leak, root));
+  yield* Console.log(report(leaks));
+  return leaks.length === 0;
+}).pipe(Effect.scoped);
+
+if (import.meta.main) runMain(NAME, secrets);

package/src/dependencies/osv-scanner.ts

@@ -1,11 +1,9 @@
-import { Clock, Context, Crypto, Effect, Encoding, FileSystem, Layer, Option, Path, Schema } from "effect";
-import { HttpClient, HttpClientResponse } from "effect/unstable/http";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { Clock, Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { collect } from "../core/git.ts";
+import { installPinned } from "./pinned-binary.ts";
 
 export const OSV_SCANNER_VERSION = "2.6.0";
 const RELEASES = `https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}`;
-const EXECUTABLE_MODE = 0o755;
 const HOUR_MS = 3_600_000;
 const DAY_MS = 24 * HOUR_MS;
 export const REFRESH_HOURS = 24;
@@ -33,46 +31,6 @@ export function buildFor(platform: string, arch: string): Option.Option<Build> {
   return Option.fromNullishOr(BUILDS[`${platform}-${arch}`]);
 }
 
-const sha256Of = Effect.fn("sha256Of")(function* (bytes: Uint8Array) {
-  const crypto = yield* Crypto.Crypto;
-  return Encoding.encodeHex(yield* crypto.digest("SHA-256", bytes));
-});
-
-const verified = Effect.fn("verified")(function* (binary: string, sha256: string) {
-  const fs = yield* FileSystem.FileSystem;
-  const found = yield* sha256Of(yield* fs.readFile(binary));
-  if (found !== sha256) {
-    return yield* new OsvScannerError({ message: `${binary} has SHA-256 ${found}, not the pinned ${sha256}; delete it and rerun` });
-  }
-  return binary;
-});
-
-const download = Effect.fn("download")(function* (url: string) {
-  const response = yield* HttpClient.get(url).pipe(Effect.flatMap(HttpClientResponse.filterStatusOk));
-  return new Uint8Array(yield* response.arrayBuffer);
-}, Effect.provide(FetchHttpClient.layer));
-
-// The binary lands through a rename in its own directory, so a concurrent run sees it whole or not at all.
-export const installPinned = Effect.fn("installPinned")(function* (url: string, sha256: string, binary: string) {
-  const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
-  if (yield* fs.exists(binary)) return yield* verified(binary, sha256);
-  const bytes = yield* download(url).pipe(
-    Effect.mapError((cause) => new OsvScannerError({ message: `cannot download ${url}: ${cause.message}` })),
-  );
-  const found = yield* sha256Of(bytes);
-  if (found !== sha256) {
-    return yield* new OsvScannerError({ message: `${url} has SHA-256 ${found}, not the pinned ${sha256}, so nothing was installed` });
-  }
-  yield* fs.makeDirectory(path.dirname(binary), { recursive: true });
-  const staging = yield* fs.makeTempDirectoryScoped({ directory: path.dirname(binary), prefix: `.${path.basename(binary)}-` });
-  const staged = path.join(staging, path.basename(binary));
-  yield* fs.writeFile(staged, bytes);
-  yield* fs.chmod(staged, EXECUTABLE_MODE);
-  yield* fs.rename(staged, binary);
-  return binary;
-}, Effect.scoped);
-
 const pinnedBinary = Effect.fn("pinnedBinary")(function* (cache: string) {
   const build = buildFor(process.platform, process.arch);
   if (Option.isNone(build)) {
@@ -80,7 +38,7 @@ const pinnedBinary = Effect.fn("pinnedBinary")(function* (cache: string) {
   }
   const path = yield* Path.Path;
   const { asset, sha256 } = build.value;
-  return yield* installPinned(`${RELEASES}/${asset}`, sha256, path.join(cache, "osv-scanner", OSV_SCANNER_VERSION, asset));
+  return yield* installPinned({ kind: "binary", url: `${RELEASES}/${asset}`, sha256 }, path.join(cache, "osv-scanner", OSV_SCANNER_VERSION, asset));
 });
 
 type PinnedBinary = ReturnType<typeof pinnedBinary>;