@avi2dg/checks 0.31.0 → 0.32.0

package/src/delivery/commit-identity.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { releasedVersionOf } from "./release.ts";
 import { git, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
 
@@ -20,6 +21,17 @@ const DEFAULT_AUTHORS: readonly Identity[] = [{ name: "avi2d", email: "avi2dg@gm
 // GitHub writes the squash commit, so it commits what the owner authored and never authors.
 const SQUASH_COMMITTER: Identity = { name: "GitHub", email: "noreply@github.com" };
 
+// checks-release-pr commits through the workflow token, which GitHub attributes to its Actions bot.
+// GitHub may also name that bot as co-author when it squashes the pull request the bot opened.
+const RELEASE_AUTHOR: Identity = { name: "github-actions[bot]", email: "41898282+github-actions[bot]@users.noreply.github.com" };
+
+const CO_AUTHOR = /^co-authored-by:\s*(.*?)\s*<([^<>]*)>\s*$/i;
+
+function namesReleaseAuthor(trailer: string): boolean {
+  const [, name, email = ""] = CO_AUTHOR.exec(trailer) ?? [];
+  return name !== undefined && allows([RELEASE_AUTHOR], { name, email });
+}
+
 // git's own trailer parser, so only the trailer block counts and prose never does.
 const CO_AUTHORED_BY_FORMAT = "%(trailers:key=Co-authored-by)";
 
@@ -113,13 +125,16 @@ function allows(allowed: readonly Identity[], identity: Identity): boolean {
 
 function inspect(commit: Commit, allowed: readonly Identity[]): Offence | undefined {
   const reasons: string[] = [];
-  if (!allows(allowed, commit.author)) {
+  const release = releasedVersionOf(commit.subject) !== undefined;
+  const authors = release ? [...allowed, RELEASE_AUTHOR] : allowed;
+  if (!allows(authors, commit.author)) {
     reasons.push(`author ${render(commit.author)}`);
   }
   if (!allows([...allowed, SQUASH_COMMITTER], commit.committer)) {
     reasons.push(`committer ${render(commit.committer)}`);
   }
   for (const trailer of commit.coAuthoredBy) {
+    if (release && namesReleaseAuthor(trailer)) continue;
     reasons.push(`trailer ${trailer}`);
   }
   return reasons.length === 0 ? undefined : { commit, reasons };
@@ -144,6 +159,7 @@ const check = Effect.gen(function* () {
     }
     lines.push(`  allowed: ${allowed.map(render).join(", ")}`);
     lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}`);
+    lines.push(`  allowed as release author only: ${render(RELEASE_AUTHOR)}`);
     yield* Console.error(lines.join("\n"));
     return false;
   }

package/src/delivery/github.ts

@@ -0,0 +1,38 @@
+import { Effect, Schema } from "effect";
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { collect } from "../core/git.ts";
+
+export class GitHubFailure extends Schema.TaggedError<GitHubFailure>()("GitHubFailure", {
+  message: Schema.String,
+}) {}
+
+type Method = "GET" | "POST" | "PATCH";
+
+type Decode<A> = (text: string) => Effect.Effect<A, Schema.SchemaError>;
+
+// gh fills {owner} and {repo} from the checkout's remote, so a workflow names no repository.
+export const REPOSITORY = "repos/{owner}/{repo}";
+
+const gitHub = Effect.fn("gitHub")(function* (method: Method, path: string, body?: unknown) {
+  const failed = (reason: string): GitHubFailure => new GitHubFailure({ message: `gh api ${method} ${path}: ${reason.trim()}` });
+  const input = body === undefined ? [] : ["--input", "-"];
+  const feed = body === undefined ? {} : { input: JSON.stringify(body) };
+  const { stdout, stderr, exitCode } = yield* collect("gh", ["api", "--method", method, path, ...input], undefined, feed).pipe(
+    Effect.mapError((cause) => failed(cause.message)),
+  );
+  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return yield* failed(stderr);
+  return stdout;
+});
+
+export function gitHubJson<A>(decode: Decode<A>, method: Method, path: string, body?: unknown): Effect.Effect<A, GitHubFailure, ChildProcessSpawner.ChildProcessSpawner> {
+  return gitHub(method, path, body).pipe(
+    Effect.flatMap((text) =>
+      decode(text).pipe(Effect.mapError((cause) => new GitHubFailure({ message: `gh api ${method} ${path} answered ${cause.message}` }))),
+    ),
+  );
+}
+
+// A dispatch is the one run a workflow token starts at once: GitHub starts none for the token's push, and holds its pull request's runs for approval.
+export const dispatch = Effect.fn("dispatch")(function* (workflow: string, ref: string) {
+  yield* gitHub("POST", `${REPOSITORY}/actions/workflows/${workflow}/dispatches`, { ref });
+});

package/src/delivery/gitleaks.toml

@@ -0,0 +1,113 @@
+title = "checks-secrets"
+
+[extend]
+useDefault = true
+
+[[rules]]
+id = "wireguard-key"
+description = "A WireGuard or AmneziaWG private or pre-shared key"
+regex = '''(?i)(?:private[_-]?key|pre[_-]?shared[_-]?key|psk)["']?[ \t]*[:=][ \t]*["']?([A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=)'''
+secretGroup = 1
+entropy = 3.0
+keywords = ["private", "preshared", "pre_shared", "pre-shared", "psk"]
+
+[[rules]]
+id = "wireguard-key-file"
+description = "A WireGuard or AmneziaWG key alone on a line of a file whose name says private, priv, pre-shared or psk"
+path = '''(?i)(?:^|/)[^/]*(?:priv|pre[_-]?shared|psk)[^/]*$'''
+regex = '''(?m)^[ \t]*([A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=)[ \t]*\r?$'''
+secretGroup = 1
+entropy = 3.0
+
+[[rules]]
+id = "wireguard-dot-key-file"
+description = "A WireGuard or AmneziaWG key alone on a line of a .key file not named for a public key"
+path = '''(?i)\.key$'''
+regex = '''(?m)^[ \t]*([A-Za-z0-9+/]{42}[AEIMQUYcgkosw048]=)[ \t]*\r?$'''
+secretGroup = 1
+entropy = 3.0
+
+[[rules.allowlists]]
+description = "A .key file named for a public key"
+paths = ['''(?i)pub(?:lic)?\.key$''']
+
+[[rules]]
+id = "proxy-userinfo-link"
+description = "A proxy share link that carries its credential before the @, such as vless://, trojan://, socks5:// or wireguard://"
+regex = '''(?i)\b(?:vless|vmess|ss|trojan|hysteria2?|hy2|tuic|socks5?h?|wireguard|wg)://([^\s"'`<>@?#]+)@[^\s"'`<>]+'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["vless://", "vmess://", "ss://", "trojan://", "hysteria://", "hysteria2://", "hy2://", "tuic://", "socks://", "socksh://", "socks5://", "socks5h://", "wireguard://", "wg://"]
+
+[[rules.allowlists]]
+description = "A link to a reserved example or test host"
+regexTarget = "match"
+regexes = ['''^(?i)[a-z0-9]+://(?:[^\s"'`@?#]*@)?(?:[\w-]+\.)*(?:example\.(?:com|net|org)|[\w-]+\.(?:example|invalid|test)|localhost)(?::\d+)?(?:[/?#]|$)''']
+
+[[rules]]
+id = "proxy-base64-link"
+description = "A proxy share link whose whole payload is base64, such as vmess://, ss:// or ssr://"
+regex = '''(?i)\b(?:vmess|ssr?)://([A-Za-z0-9+/_-]{16,}={0,2})@?'''
+secretGroup = 1
+entropy = 4.2
+keywords = ["vmess://", "ss://", "ssr://"]
+
+[[rules.allowlists]]
+description = "A payload an @ follows, which proxy-userinfo-link judges"
+regexTarget = "match"
+regexes = ['''@$''']
+
+[[rules]]
+id = "proxy-query-credential-first"
+description = "The first auth, auth_str, obfsParam, obfs-password, password or pk query parameter of a proxy share link, such as hysteria://host?auth="
+regex = '''(?i)\b(?:vless|vmess|ssr?|trojan|hysteria2?|hy2|tuic|socks5?h?|wireguard|wg)://[^\s"'`?#]*\?(?:[^\s"'`#]*?&)??(?:auth|auth_str|obfsParam|obfs-password|password|pk)=([^\s"'`<>&#]+)'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["vless://", "vmess://", "ss://", "ssr://", "trojan://", "hysteria://", "hysteria2://", "hy2://", "tuic://", "socks://", "socksh://", "socks5://", "socks5h://", "wireguard://", "wg://"]
+
+[[rules.allowlists]]
+description = "A link to a reserved example or test host"
+regexTarget = "match"
+regexes = ['''^(?i)[a-z0-9]+://(?:[^\s"'`@?#]*@)?(?:[\w-]+\.)*(?:example\.(?:com|net|org)|[\w-]+\.(?:example|invalid|test)|localhost)(?::\d+)?(?:[/?#]|$)''']
+
+[[rules]]
+id = "proxy-query-credential-last"
+description = "The last auth, auth_str, obfsParam, obfs-password, password or pk query parameter of a proxy share link, such as hysteria://host?auth="
+regex = '''(?i)\b(?:vless|vmess|ssr?|trojan|hysteria2?|hy2|tuic|socks5?h?|wireguard|wg)://[^\s"'`?#]*\?(?:[^\s"'`#]*&)?(?:auth|auth_str|obfsParam|obfs-password|password|pk)=([^\s"'`<>&#]+)'''
+secretGroup = 1
+entropy = 2.5
+keywords = ["vless://", "vmess://", "ss://", "ssr://", "trojan://", "hysteria://", "hysteria2://", "hy2://", "tuic://", "socks://", "socksh://", "socks5://", "socks5h://", "wireguard://", "wg://"]
+
+[[rules.allowlists]]
+description = "A link to a reserved example or test host"
+regexTarget = "match"
+regexes = ['''^(?i)[a-z0-9]+://(?:[^\s"'`@?#]*@)?(?:[\w-]+\.)*(?:example\.(?:com|net|org)|[\w-]+\.(?:example|invalid|test)|localhost)(?::\d+)?(?:[/?#]|$)''']
+
+[[rules]]
+id = "proxy-subscription-url"
+description = "A proxy subscription URL whose path or query carries its token"
+regex = '''(?i)(?:\bhttps?://[^\s"'`<>/]+/(?:[^\s"'`<>?]*/)?(?:sub|subs|subscribe|subscription|link)/|[?&](?:token|key|uuid|id)=)([A-Za-z0-9_-]{16,})'''
+secretGroup = 1
+entropy = 3.0
+keywords = ["sub", "link"]
+
+[[rules.required]]
+id = "proxy-subscription-path"
+withinLines = 0
+
+[[rules]]
+id = "proxy-subscription-path"
+description = "An http or https URL whose last path segment before its token or query is sub, subs, subscribe, subscription or link"
+regex = '''(?i)\bhttps?://[^\s"'`<>/]+/(?:[^\s"'`<>?]*/)?(?:sub|subs|subscribe|subscription|link)[/?]'''
+keywords = ["sub", "link"]
+skipReport = true
+
+[[rules.allowlists]]
+description = "A link to a reserved example or test host"
+regexTarget = "match"
+regexes = ['''^(?i)https?://(?:[\w-]+\.)*(?:example\.(?:com|net|org)|[\w-]+\.(?:example|invalid|test)|localhost)(?:[:/?#]|$)''']
+
+[[allowlists]]
+description = "A link credential that is only template references, such as {password}, ${pass}, ${encodeURIComponent(pass)}, ${pass:-}, ${pass:?message}, $PASS, {{ password }} or %(password)s, with a user part that is one too; a last ${...} may be cut short, and one that gives a default or alternative value, such as ${pass:-value}, is not a reference"
+targetRules = ["proxy-userinfo-link", "proxy-query-credential-first", "proxy-query-credential-last"]
+regexes = ['''^(?:(?:\$\{(?:[^A-Za-z_}][^}]*|[A-Za-z_][\w.]*(?:[^\w.:=+}-][^}]*|:(?:[^-=+}][^}]*)?|:?[-=+])?)?\}|\$[A-Za-z_]\w*|\{\{\s*[A-Za-z_][\w.]*\s*\}\}|\{[A-Za-z_][\w.]*\}|%\([A-Za-z_][\w.]*\)s):)?(?:\$\{(?:[^A-Za-z_}][^}]*|[A-Za-z_][\w.]*(?:[^\w.:=+}-][^}]*|:(?:[^-=+}][^}]*)?|:?[-=+])?)?\}?|\$[A-Za-z_]\w*|\{\{\s*[A-Za-z_][\w.]*\s*\}\}|\{[A-Za-z_][\w.]*\}|%\([A-Za-z_][\w.]*\)s)$''']

package/src/delivery/gitleaks.ts

@@ -0,0 +1,111 @@
+import { Effect, Option, Path, Schema } from "effect";
+import { collect } from "../core/git.ts";
+import { installPinned } from "../dependencies/pinned-binary.ts";
+
+const GITLEAKS_VERSION = "8.30.1";
+const RELEASES = `https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}`;
+const MEMBER = "gitleaks";
+
+type Build = { readonly archive: string; readonly sha256: string; readonly binarySha256: string };
+
+// The archive's SHA-256 as gitleaks_<version>_checksums.txt of the release lists it, and the SHA-256 of the binary inside.
+const BUILDS: Readonly<Record<string, Build>> = {
+  "darwin-arm64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_darwin_arm64.tar.gz`,
+    sha256: "b40ab0ae55c505963e365f271a8d3846efbc170aa17f2607f13df610a9aeb6a5",
+    binarySha256: "ba52fb1bfabbcde42f032afad3d6e0b19dff8ed105229a16e7caa338bbc0e84f",
+  },
+  "darwin-x64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_darwin_x64.tar.gz`,
+    sha256: "dfe101a4db2255fc85120ac7f3d25e4342c3c20cf749f2c20a18081af1952709",
+    binarySha256: "cee01fea7173f1b779dff188e1c26ecbcb4027d394acc573b23aaf0be260e291",
+  },
+  "linux-arm64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_linux_arm64.tar.gz`,
+    sha256: "e4a487ee7ccd7d3a7f7ec08657610aa3606637dab924210b3aee62570fb4b080",
+    binarySha256: "00e91bbe655bd7c47753e8cfe61cb76ea1a5d7e7702fe161ee40102b46b3823b",
+  },
+  "linux-x64": {
+    archive: `gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz`,
+    sha256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb",
+    binarySha256: "88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509",
+  },
+};
+
+class GitleaksError extends Schema.TaggedError<GitleaksError>()("GitleaksError", {
+  message: Schema.String,
+}) {}
+
+export function gitleaksBuildFor(platform: string, arch: string): Option.Option<Build> {
+  return Option.fromNullishOr(BUILDS[`${platform}-${arch}`]);
+}
+
+export const pinnedGitleaks = Effect.fn("pinnedGitleaks")(function* (cache: string) {
+  const build = gitleaksBuildFor(process.platform, process.arch);
+  if (Option.isNone(build)) {
+    return yield* new GitleaksError({ message: `no pinned gitleaks build runs on ${process.platform}-${process.arch}` });
+  }
+  const path = yield* Path.Path;
+  const { archive, sha256, binarySha256 } = build.value;
+  return yield* installPinned(
+    { kind: "tar.gz", url: `${RELEASES}/${archive}`, sha256, member: MEMBER, memberSha256: binarySha256 },
+    path.join(cache, "gitleaks", GITLEAKS_VERSION, MEMBER),
+  );
+});
+
+const Leak = Schema.Struct({
+  RuleID: Schema.String,
+  Description: Schema.String,
+  File: Schema.String,
+  StartLine: Schema.Int,
+  Commit: Schema.String,
+});
+
+export type Leak = typeof Leak.Type;
+
+const decodeGitleaksReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(Leak)));
+
+export type Scan = {
+  readonly binary: string;
+  readonly gitDir: string;
+  readonly logOptions: string;
+  readonly config: string;
+  readonly ignoreDir: string;
+};
+
+// gitleaks exits 1 both on a leak and on a fatal error, so it exits 0 on a leak here and the report alone tells them apart.
+// It exits 0 with an empty report when git log fails, and logs only errors here, so any line it logs fails the scan.
+// It reads a .gitleaksignore at its source whatever --gitleaks-ignore-path says, so the source is the git directory, where no tracked file lands.
+export const scanCommits = Effect.fn("scanCommits")(function* ({ binary, gitDir, logOptions, config, ignoreDir }: Scan) {
+  const args = [
+    "git",
+    gitDir,
+    "--log-opts",
+    logOptions,
+    "--config",
+    config,
+    "--gitleaks-ignore-path",
+    ignoreDir,
+    "--ignore-gitleaks-allow",
+    "--redact",
+    "--no-banner",
+    "--no-color",
+    "--log-level",
+    "error",
+    "--exit-code",
+    "0",
+    "--report-format",
+    "json",
+    "--report-path",
+    "-",
+  ];
+  const { stdout, stderr, exitCode } = yield* collect(binary, args, ignoreDir).pipe(
+    Effect.mapError((cause) => new GitleaksError({ message: `cannot run ${binary}: ${cause.message}` })),
+  );
+  if (exitCode !== 0 || stderr.trim() !== "") {
+    return yield* new GitleaksError({ message: `${binary} failed: ${stderr.trim() || `exit code ${exitCode}`}` });
+  }
+  return yield* decodeGitleaksReport(stdout).pipe(
+    Effect.mapError((cause) => new GitleaksError({ message: `cannot read the report gitleaks wrote: ${cause.message}` })),
+  );
+});

package/src/delivery/release-pr.ts

@@ -0,0 +1,195 @@
+#!/usr/bin/env bun
+import { Console, Effect, Encoding, FileSystem, Path, Schema } from "effect";
+import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
+import { nextVersion, type Pending, readPending, releaseTitle, runBuild, withVersion } from "./release.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+class ReleaseRefused extends Schema.TaggedError<ReleaseRefused>()("ReleaseRefused", {
+  message: Schema.String,
+}) {}
+
+type Staged =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Read =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string; readonly content: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Built = {
+  readonly tree: string;
+  readonly files: readonly Read[];
+};
+
+type Remote = {
+  readonly parents: readonly string[];
+  readonly version: string | undefined;
+};
+
+const NAME = "checks-release-pr";
+const USAGE = "usage: release-pr.ts <workflow>...";
+const MANIFEST = "package.json";
+const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
+const RAW_ENTRY = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])/;
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+const decodeSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ sha: Schema.String })));
+const decodeRef = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ ref: Schema.String })));
+const PullRequest = Schema.Struct({ number: Schema.Int, title: Schema.String, html_url: Schema.String });
+type PullRequest = typeof PullRequest.Type;
+const decodePullRequest = Schema.decodeUnknownEffect(Schema.fromJsonString(PullRequest));
+const decodePullRequests = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(PullRequest)));
+
+export function releaseBranchOf(base: string): string {
+  return `release/${base}`;
+}
+
+export function stagedOf(raw: string): readonly Staged[] {
+  const fields = raw.split("\0");
+  const staged: Staged[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) {
+    const [, from = "", to = "", status] = RAW_ENTRY.exec(fields[index] ?? "") ?? [];
+    const path = fields[index + 1] ?? "";
+    staged.push(status === "D" ? { kind: "deleted", path, mode: from } : { kind: "written", path, mode: to });
+  }
+  return staged;
+}
+
+const refused = (message: string) => new ReleaseRefused({ message });
+
+const versionIn = (manifest: string) =>
+  decodeVersion(manifest).pipe(
+    Effect.map(({ version }) => version),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+const releaseVersion = Effect.fn("releaseVersion")(function* (manifest: string, { since, unreleased }: Pending) {
+  const { version } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)));
+  if (since !== undefined && since !== `v${version}`) {
+    return yield* refused(
+      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; rerun the tag job of daily-release on the release commit, whose refusal says what to fix, or return its version to ${since.slice(1)}`,
+    );
+  }
+  const next = nextVersion(version, unreleased);
+  if (next === undefined) return yield* refused(`${MANIFEST} holds ${version}, which is no plain major.minor.patch version`);
+  const bumped = withVersion(manifest, version, next);
+  if (bumped === undefined || (yield* versionIn(bumped)) !== next) {
+    return yield* refused(`cannot rewrite the version ${version} in ${MANIFEST} as ${next}`);
+  }
+  return { next, bumped };
+});
+
+const currentBranch = Effect.fn("currentBranch")(function* (root: string) {
+  const branch = yield* git(["symbolic-ref", "--quiet", "--short", "HEAD"], root).pipe(
+    Effect.map((name) => name.trim()),
+    Effect.catchTag("GitFailure", () => Effect.succeed("")),
+  );
+  if (branch === "") return yield* refused("HEAD is detached; check out the branch the release goes to");
+  return branch;
+});
+
+const readRemote = Effect.fn("readRemote")(function* (root: string, branch: string) {
+  if ((yield* git(["ls-remote", "origin", `refs/heads/${branch}`], root)).trim() === "") return undefined;
+  const tracking = `refs/remotes/origin/${branch}`;
+  yield* git(["fetch", "--quiet", "--no-tags", "origin", `+refs/heads/${branch}:${tracking}`], root);
+  const [, ...parents] = (yield* git(["rev-list", "--parents", "-n", "1", tracking], root)).trim().split(" ");
+  const version = yield* git(["show", `${tracking}:${MANIFEST}`], root).pipe(
+    Effect.flatMap(versionIn),
+    Effect.orElseSucceed(() => undefined),
+  );
+  return { parents, version } satisfies Remote;
+});
+
+const readStaged = Effect.fn("readStaged")(function* (root: string, staged: Staged) {
+  if (staged.kind === "deleted") return staged;
+  if (!REGULAR_FILE_MODES.has(staged.mode)) return yield* refused(`the build wrote ${staged.path} with mode ${staged.mode}, which is no regular file`);
+  const bytes = yield* (yield* FileSystem.FileSystem).readFile((yield* Path.Path).join(root, staged.path));
+  return { ...staged, content: Encoding.encodeBase64(bytes) };
+});
+
+// The build writes into the working tree, so the tree it starts from has to hold nothing a release would sweep in.
+const buildRelease = Effect.fn("buildRelease")(function* (root: string, bumped: string) {
+  if ((yield* git(["status", "--porcelain", "--untracked-files=no"], root)).trim() !== "") {
+    return yield* refused("the working tree has changes to tracked files; the release commits only what the build writes");
+  }
+  const restore = git(["reset", "--quiet", "--hard", "HEAD"], root).pipe(
+    Effect.catchTag("GitFailure", (failure) => Console.error(`${NAME}: cannot restore the working tree: ${failure.message}`)),
+  );
+  return yield* Effect.gen(function* () {
+    yield* (yield* FileSystem.FileSystem).writeFileString((yield* Path.Path).join(root, MANIFEST), bumped);
+    yield* runBuild(root);
+    yield* git(["add", "--update"], root);
+    const tree = (yield* git(["write-tree"], root)).trim();
+    const staged = stagedOf(yield* git(["diff", "--cached", "--raw", "-z", "--no-renames", "HEAD"], root));
+    return { tree, files: yield* Effect.forEach(staged, (one) => readStaged(root, one)) } satisfies Built;
+  }).pipe(Effect.ensuring(restore));
+});
+
+const treeEntry = Effect.fn("treeEntry")(function* (file: Read) {
+  if (file.kind === "deleted") return { path: file.path, mode: file.mode, type: "blob", sha: null };
+  const { sha } = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/blobs`, { content: file.content, encoding: "base64" });
+  return { path: file.path, mode: file.mode, type: "blob", sha };
+});
+
+const commitRelease = Effect.fn("commitRelease")(function* (root: string, head: string, built: Built, version: string) {
+  const tree = yield* Effect.forEach(built.files, treeEntry);
+  const baseTree = (yield* git(["rev-parse", `${head}^{tree}`], root)).trim();
+  const made = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/trees`, { base_tree: baseTree, tree });
+  if (made.sha !== built.tree) return yield* refused(`GitHub built the tree ${made.sha}, but the build wrote ${built.tree}`);
+  const commit = { message: releaseTitle(version), tree: made.sha, parents: [head] };
+  return (yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/commits`, commit)).sha;
+});
+
+const pointBranch = Effect.fn("pointBranch")(function* (branch: string, sha: string, exists: boolean) {
+  yield* exists
+    ? gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${branch}`, { sha, force: true })
+    : gitHubJson(decodeRef, "POST", `${REPOSITORY}/git/refs`, { ref: `refs/heads/${branch}`, sha });
+});
+
+const findOpen = Effect.fn("findOpen")(function* (base: string, branch: string) {
+  const query = `head={owner}:${encodeURIComponent(branch)}&base=${encodeURIComponent(base)}&state=open`;
+  const [open] = yield* gitHubJson(decodePullRequests, "GET", `${REPOSITORY}/pulls?${query}`);
+  return open;
+});
+
+const titlePullRequest = Effect.fn("titlePullRequest")(function* (open: PullRequest | undefined, base: string, branch: string, version: string) {
+  const title = releaseTitle(version);
+  const body = `Release ${version}.`;
+  if (open === undefined) {
+    const created = yield* gitHubJson(decodePullRequest, "POST", `${REPOSITORY}/pulls`, { title, head: branch, base, body });
+    return { verb: "opened", url: created.html_url };
+  }
+  if (open.title !== title) yield* gitHubJson(decodePullRequest, "PATCH", `${REPOSITORY}/pulls/${open.number}`, { title, body });
+  return { verb: "refreshed", url: open.html_url };
+});
+
+const releasePullRequest = Effect.gen(function* () {
+  const workflows = process.argv.slice(2);
+  if (workflows.length === 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const pending = yield* readPending(root);
+  if (pending.unreleased.length === 0) {
+    yield* Console.log(`release-pr: no unreleased changes ${pending.since === undefined ? "with no tag yet" : `since ${pending.since}`}`);
+    return true;
+  }
+  const base = yield* currentBranch(root);
+  const branch = releaseBranchOf(base);
+  const head = (yield* git(["rev-parse", "HEAD"], root)).trim();
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { next, bumped } = yield* releaseVersion(manifest, pending);
+  const remote = yield* readRemote(root, branch);
+  const current = remote?.version === next && remote.parents.length === 1 && remote.parents[0] === head;
+  const open = yield* findOpen(base, branch);
+  if (current && open?.title === releaseTitle(next)) {
+    yield* Console.log(`release-pr: ${open.html_url} releases ${next} from ${head.slice(0, 12)} and is current`);
+    return true;
+  }
+  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(root, bumped), next), remote !== undefined);
+  const { verb, url } = yield* titlePullRequest(open, base, branch, next);
+  yield* Effect.forEach(workflows, (workflow) => dispatch(workflow, branch));
+  yield* Console.log(`release-pr: ${verb} ${url} to release ${next}, and dispatched ${workflows.join(", ")} on ${branch}`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePullRequest);

package/src/delivery/release-report.ts

@@ -1,19 +1,10 @@
 #!/usr/bin/env bun
-import { Console, Effect, Schema } from "effect";
-import { groupOf } from "./changelog.ts";
+import { Console, Effect } from "effect";
+import { readPending } from "./release.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-export class ReleaseReportUnreadable extends Schema.TaggedError<ReleaseReportUnreadable>()("ReleaseReportUnreadable", {
-  message: Schema.String,
-}) {}
-
 const USAGE = "usage: release-report.ts";
-const RELEASE_TAG = "v[0-9]*.[0-9]*.[0-9]*";
-
-export function unreleasedOf(subjects: readonly string[]): readonly string[] {
-  return subjects.filter((subject) => groupOf(subject) !== undefined);
-}
 
 export function formatReport(unreleased: readonly string[], since: string | undefined): string {
   const where = since === undefined ? "with no tag yet" : `since ${since}`;
@@ -21,28 +12,10 @@ export function formatReport(unreleased: readonly string[], since: string | unde
   return [`release-report: ${unreleased.length} unreleased change(s) ${where}:`, ...unreleased.map((subject) => `  ${subject}`)].join("\n");
 }
 
-const lastTag = Effect.fn("lastTag")(function* (root: string) {
-  const described = yield* git(["describe", "--tags", "--abbrev=0", `--match=${RELEASE_TAG}`, "HEAD"], root).pipe(
-    Effect.map((tag) => tag.trim()),
-    Effect.catchTag("GitFailure", () => Effect.succeed("")),
-  );
-  return described === "" ? undefined : described;
-});
-
-const subjectsSince = Effect.fn("subjectsSince")(function* (root: string, since: string | undefined) {
-  const range = since === undefined ? "HEAD" : `${since}..HEAD`;
-  const log = yield* git(["log", "--topo-order", "--no-merges", "--format=%s", range], root);
-  return log.split("\n").filter((subject) => subject !== "");
-});
-
 const report = Effect.gen(function* () {
   if (process.argv.slice(2).length > 0) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  if ((yield* git(["rev-parse", "--is-shallow-repository"], root)).trim() === "true") {
-    return yield* new ReleaseReportUnreadable({ message: "the checkout is shallow, so the tag it sees may not be the last one; fetch all of it" });
-  }
-  const since = yield* lastTag(root);
-  const unreleased = unreleasedOf(yield* subjectsSince(root, since));
+  const { since, unreleased } = yield* readPending(root);
   yield* Console.log(formatReport(unreleased, since));
   return unreleased.length === 0;
 });

package/src/delivery/release-tag.ts

@@ -0,0 +1,64 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { dispatch, GitHubFailure } from "./github.ts";
+import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
+  message: Schema.String,
+}) {}
+
+const NAME = "checks-release-tag";
+const USAGE = "usage: release-tag.ts <workflow>";
+const MANIFEST = "package.json";
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+
+// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
+export function taggedCommitOf(listed: string): string | undefined {
+  const lines = listed.split("\n").filter((line) => line !== "");
+  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
+  return peeled?.split("\t")[0];
+}
+
+const releaseTag = Effect.gen(function* () {
+  const [workflow, ...extra] = process.argv.slice(2);
+  if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
+  const version = releasedVersionOf(subject);
+  if (version === undefined) {
+    yield* Console.log(`release-tag: ${head.slice(0, 12)} is no release commit`);
+    return true;
+  }
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
+  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
+  const tag = `v${version}`;
+  const tagged = taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
+  if (tagged === head) {
+    yield* Console.log(`release-tag: ${tag} already tags ${head.slice(0, 12)}`);
+    return true;
+  }
+  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
+  yield* runBuild(root);
+  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
+  if (rebuilt.length > 0) {
+    const since = yield* lastTag(root);
+    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
+    return yield* new TagRefused({
+      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next daily-release run cuts the release again with every change since ${since ?? "the first commit"}`,
+    });
+  }
+  yield* git(["push", "--quiet", "origin", `${head}:refs/tags/${tag}`], root);
+  yield* dispatch(workflow, tag).pipe(
+    Effect.mapError(
+      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
+    ),
+  );
+  yield* Console.log(`release-tag: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releaseTag);