@avi2dg/checks 0.40.0 → 0.41.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.41.1
+
+Released 2026-10-14.
+
+### Fixes
+
+- **delivery:** refuse workflow references to missing workflows or jobs in ci-wiring [#153](https://github.com/avi2d/checks/pull/153)
+
+## 0.41.0
+
+Released 2026-10-12.
+
+### Features
+
+- **testing:** keep mutation baselines and flake reports out of Actions artifact storage [#150](https://github.com/avi2d/checks/pull/150)
+
 ## 0.40.0
 
 Released 2026-10-11.

package/README.md

@@ -183,7 +183,7 @@ These bins run on their own:
 - [`checks-flake`](docs/gates/checks-flake.md) runs the suite on a schedule and records the seeds a flaky test fails with.
 - [`checks-mutation`](docs/gates/checks-mutation.md) runs Stryker for scoped checks and refuses a full run outside CI.
 - [`checks-mutation-compare`](docs/gates/checks-mutation-compare.md) compares the mutants of two reports and lists each one that regresses.
-- [`checks-mutation-baseline`](docs/gates/checks-mutation-baseline.md) restores the newest mutation baseline from `main`, through a cache on a self-hosted runner, and deletes superseded baselines after a `main` upload.
+- [`checks-mutation-baseline`](docs/gates/checks-mutation-baseline.md) restores the newest mutation baseline from `main`, saves it on a self-hosted runner's disk in place of an artifact, and deletes superseded baselines after a `main` run.
 - [`checks-subsumed-tests`](docs/gates/checks-subsumed-tests.md) lists each test another test subsumes in a mutation run.
 - [`checks-changelog`](docs/gates/checks-changelog.md) writes the pending release into `CHANGELOG.md` from the conventional commits since the last release.
 - [`checks-release-notes`](docs/gates/checks-release-notes.md) writes one `CHANGELOG.md` section to a file for a GitHub release.

package/docs/gates/checks-ci-wiring.md

@@ -21,6 +21,14 @@ The check follows local reusable workflows but not remote reusable workflows.
 It refuses a step or job with `if: false` or `continue-on-error: true`.
 It also refuses a workflow that does not trigger on both `opened` and `synchronize` pull requests to the target branch.
 A path filter cannot cover every pull request and therefore cannot satisfy the check.
+It refuses a reference to a workflow or job the repository does not hold.
+Each literal `checks-release-pr` and `checks-release-tag` argument names a workflow file, so every one must match a file under `.github/workflows/`.
+An argument built from a variable or an expression is known only when the job runs, so the check passes over it.
+Each `on.workflow_run.workflows` entry names a workflow by its `name`, so every one must match a name in the repository.
+A workflow without a `name` answers to its path from the repository root.
+A local reusable `uses` must name a file under `.github/workflows/` that the repository holds.
+Each `needs` entry names a job in the same workflow, so every one must match a job id in that file.
+Each refusal names the file, the line and the missing workflow or job.
 
 ### Runners
 
@@ -57,7 +65,7 @@ It takes no arguments.
 | Code | Result |
 | --- | --- |
 | 0 | Every required command has a reachable step. |
-| 1 | A required command is missing or blocked, or a job runs on the wrong runner. |
+| 1 | A required command is missing or blocked, a job runs on the wrong runner, or a workflow names a missing workflow or job. |
 | 2 | A workflow or `package.json` cannot be decoded. |
 
 ## Sample output
@@ -77,6 +85,13 @@ ci-wiring: 1 job(s) run on the wrong runner:
   .github/workflows/mutation-compare.yml job mutation-compare: a mutation job reads CI_RUNS_ON, so an override moves its full sweeps off winbox; set runs-on: [self-hosted, Linux, X64, winbox]
 ```
 
+A reference to a missing workflow produces a report like this:
+
+```
+ci-wiring: 1 reference(s) name a missing workflow or job:
+  .github/workflows/daily-release.yml line 31: names missing workflow commitlint.yml
+```
+
 ## When it runs
 
 `checks-lint` runs it in every repository.

package/docs/gates/checks-flake.md

@@ -54,7 +54,7 @@ Only a schedule the repository writes runs it.
 
 ## Running it on a schedule
 
-A repository runs it on a schedule and keeps the record as an artifact:
+A repository runs it on a schedule and keeps the record of a failed run as an artifact:
 
 ```yaml
 on:
@@ -70,12 +70,17 @@ jobs:
       - run: bun install --frozen-lockfile
       - run: bunx checks-flake --runs 10 --report flake-report.json
       - uses: actions/upload-artifact@v4
-        if: always()
+        if: failure()
         with:
           name: flake-report
           path: flake-report.json
+          retention-days: 7
 ```
 
+A passing run's job summary holds all its seeds, so a passing run uploads nothing.
+In a private repository every upload counts against the account's Actions storage, and GitHub refuses each one once that storage is used up.
+A run that only uploads on failure stays green through that refusal, and a failing run is red for its tests either way.
+
 A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the job, as [checks-ci-wiring](checks-ci-wiring.md#runners) requires.
 
 ## Related topics

package/docs/gates/checks-mutation-baseline.md

@@ -4,14 +4,16 @@ audience: consumers
 ---
 # checks-mutation-baseline
 
-`checks-mutation-baseline` restores the newest mutation baseline that `main` published, and deletes superseded baselines after a `main` upload.
+`checks-mutation-baseline` restores the newest mutation baseline that `main` published, and deletes superseded baselines after a `main` run.
 On a self-hosted runner it keeps each baseline it downloads, so the next job copies it instead.
+There it also saves a run's baseline on the runner's disk, so the baseline never counts against the account's Actions storage.
 
 ## What it checks
 
 It reads the successful runs of `mutation.yml` on `main`.
 Without `--full` it takes the newest of the 20 newest of those runs that a pull request did not start.
-It restores that run's `mutation-baseline` artifact, and takes the run whether or not it holds one.
+It restores the baseline that run saved on the runner's disk, as [The saved baselines](#the-saved-baselines) says.
+Without one there, it restores that run's `mutation-baseline` artifact, and takes the run whether or not it holds one.
 It tries no older run, so a newest run without the artifact restores nothing.
 An artifact without `stryker-incremental.json` counts as no baseline.
 It copies `stryker-incremental.json` to the first destination, and `mutation/mutation.json` to the second destination when the artifact holds it.
@@ -25,6 +27,7 @@ It creates the directories each destination needs.
 
 With `--prune` it deletes the repository's superseded baselines instead of restoring one.
 It keeps the newest unexpired `mutation-baseline` among the runs the restore reads, and the newest unexpired `mutation-baseline-full` the restore takes first.
+A run whose baseline the runner's disk holds stops that search, and every older `mutation-baseline` goes, since the restore reads that run's saved baseline first.
 It also keeps the unexpired baselines of the run it runs in, which `GITHUB_RUN_ID` names.
 The restore reads only successful runs, so it takes them once that run succeeds.
 A failed artifact lookup while it picks what to keep stops it before it deletes anything.
@@ -39,7 +42,8 @@ It deletes through `gh`, which needs a token that deletes the repository's Actio
 It reads the runs and their artifacts through `gh`, which needs a token that reads the repository's Actions, such as `GH_TOKEN: ${{ github.token }}` with `actions: read`.
 The `mutation-baseline` artifact holds `stryker-incremental.json` and `mutation/mutation.json`, which an upload of `reports/stryker-incremental.json` and `reports/mutation/mutation.json` writes.
 The `mutation-baseline-full` artifact holds `mutation.json` at its root, which an upload of `reports/mutation/mutation.json` alone writes.
-It reads `RUNNER_ENVIRONMENT` and `HOME` to place the runner cache, and `--prune` reads `GITHUB_RUN_ID`.
+It reads `RUNNER_ENVIRONMENT` and `HOME` to place the runner cache, and `GITHUB_REPOSITORY_ID` to find the saved baselines.
+`--save` and `--prune` read `GITHUB_RUN_ID`.
 
 ## The runner cache
 
@@ -58,24 +62,53 @@ A 100 MB baseline zip can unpack to about 500 MB, so a repository restoring both
 When `RUNNER_ENVIRONMENT` is `github-hosted`, it downloads into a temporary directory and writes no cache, since a hosted runner starts every job on a fresh machine.
 When `HOME` is unset it works the same way, and prints to stderr that the runner cache is disabled.
 
+## The saved baselines
+
+`--save` writes the run's baseline to `$HOME/.cache/avi2dg-checks/mutation-baseline/<repository id>/saved/mutation-baseline/<run id>.json`.
+The entry is one JSON file that holds `stryker-incremental.json` and, when given, `mutation/mutation.json`, keyed by those names.
+It writes both files without each mutant's `statusReason`.
+Stryker puts the test runner's failure message there, which no reader of a baseline uses, and which makes up most of a large report.
+A report of about 280 MB comes out at about 5 MB.
+The entry lands through a rename beside it, so a job sharing the runner sees it whole or not at all.
+A re-run attempt keeps its run's id, so its entry replaces the one an earlier attempt saved.
+
+The restore reads only the successful runs, so a run that saves and then fails leaves an entry no restore reads.
+A re-run attempt that succeeds replaces it first.
+A restore reads the entry in one open, so a job that removes or replaces it afterwards changes nothing the restore copies.
+A restore from the disk removes the entries of runs older than the one it read.
+It keeps the entries of newer runs, which may still be running.
+A job that picked one of the removed entries and had not opened it yet finds none, and falls back to the artifact.
+
+Every job that restores the baseline must run on the machine that saved it, as the same user.
+A job on another machine finds no entry and falls back to the artifact, which the prune deletes once a saved baseline supersedes it.
+Losing the disk costs the next `main` run a fresh baseline, since an incremental run with no state tests every mutant.
+
+`--save` refuses on a GitHub-hosted runner, since its disk ends with the job.
+There a repository uploads the baseline as an artifact.
+It also refuses when `HOME`, `GITHUB_REPOSITORY_ID` or `GITHUB_RUN_ID` is unset.
+
 ## Arguments
 
 ```sh
 checks-mutation-baseline <incremental-dest> [mutation-json-dest]
 checks-mutation-baseline --full <mutation-json-dest>
+checks-mutation-baseline --save <incremental-src> [mutation-json-src]
+checks-mutation-baseline --slim <mutation-json-src> <dest>
 checks-mutation-baseline --prune [--dry-run]
 ```
 
 `--full` restores only the report of a run that started with no state.
-`--prune` deletes superseded baselines after an upload.
+`--save` keeps this run's baseline on the runner's disk in place of an upload.
+`--slim` writes a report without `statusReason` to `<dest>`, for a report that still goes up as an artifact.
+`--prune` deletes superseded baselines after a save or an upload.
 `--dry-run` lists what `--prune` would delete, and deletes nothing.
 
 ## Exit codes
 
 | Code | When |
 | --- | --- |
-| 0 | it restored a baseline, or found none to restore |
-| 2 | the arguments do not parse, `gh` cannot list the runs, the cache cannot be written, or another job removed the entry before it was copied |
+| 0 | it restored a baseline, found none to restore, saved the baseline or wrote the slim report |
+| 2 | the arguments do not parse, `gh` cannot list the runs, the cache cannot be written, another job removed the entry before it was copied, a file to save or slim does not parse, or `--save` runs where it refuses |
 
 A failed artifact lookup or download prints the `gh` error and moves on, as a missing artifact does.
 With `--prune`, `0` means it deleted the superseded artifacts, found none, or could not delete some.
@@ -92,6 +125,12 @@ mutation-baseline: restored it from the runner's cache, mutation-baseline artifa
 
 A miss prints `downloaded it into the runner's cache` instead, and a hosted runner prints `downloaded it`.
 
+```
+mutation-baseline: saved the mutation-baseline of run 38058558974 on the runner's disk
+mutation-baseline: restored it from the runner's disk, mutation-baseline saved by run 38058558974
+mutation-baseline: wrote full/mutation.json without statusReason, 4788924 bytes from 272879455
+```
+
 ```
 mutation-baseline: deleted artifacts 11542133901, 11553708473, 11632727585; kept mutation-baseline artifact 11670749656 from run 38055231501
 ```
@@ -110,16 +149,12 @@ A baseline job restores the state the previous `main` run left before an increme
   run: bunx checks-mutation-baseline reports/stryker-incremental.json
 ```
 
-A baseline job uploads the state the incremental run wrote, then on `main` prunes the superseded baselines:
+A baseline job on a self-hosted runner saves the state the incremental run wrote, then on `main` prunes the superseded baselines:
 
 ```yaml
-- uses: actions/upload-artifact@v4
-  with:
-    name: mutation-baseline
-    path: |
-      reports/mutation/mutation.json
-      reports/stryker-incremental.json
-    retention-days: 7
+- name: Save baseline state
+  if: github.ref == 'refs/heads/main'
+  run: bunx checks-mutation-baseline --save reports/stryker-incremental.json reports/mutation/mutation.json
 - name: Prune superseded baselines
   if: github.ref == 'refs/heads/main'
   env:
@@ -127,8 +162,23 @@ A baseline job uploads the state the incremental run wrote, then on `main` prune
   run: bunx checks-mutation-baseline --prune
 ```
 
-The incremental upload keeps 7 days of retention, since the restore reads only the newest `main` run.
-The full upload keeps 30 days, since full runs start weekly.
+The saved baseline uses none of the account's Actions storage, which every private repository's artifacts share.
+That storage accrues by the hour over the month, so an artifact deleted early still counts until the month ends.
+A baseline job on a GitHub-hosted runner uploads the same two files as a `mutation-baseline` artifact with `retention-days: 7` instead, since the restore reads only the newest `main` run.
+
+A full run uploads its report as the `mutation-baseline-full` artifact, which a pull request's scope step reads on any runner.
+It slims the report first, so the artifact holds about 0.5 MB in place of about 100 MB:
+
+```yaml
+- run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/full/mutation.json"
+- uses: actions/upload-artifact@v4
+  with:
+    name: mutation-baseline-full
+    path: ${{ runner.temp }}/full/mutation.json
+    retention-days: 30
+```
+
+The full upload keeps 30 days, so the newest full baseline outlives the gap between full runs.
 A pull request's scope step loses its coverage when no full baseline outlives the gap.
 
 A pull request's scope step restores the full report with `--full`:

package/docs/gates/checks-mutation.md

@@ -97,13 +97,18 @@ jobs:
           bun-version-file: .bun-version
       - run: bun install --frozen-lockfile
       - run: bunx stryker run
+      - if: always()
+        run: bunx checks-mutation-baseline --slim reports/mutation/mutation.json "$RUNNER_TEMP/report/mutation.json"
       - uses: actions/upload-artifact@v4
         if: always()
         with:
           name: mutation-report
-          path: reports/mutation/mutation.json
+          path: ${{ runner.temp }}/report/mutation.json
+          retention-days: 7
 ```
 
+The upload holds the report without each mutant's `statusReason`, as [checks-mutation-baseline](checks-mutation-baseline.md#the-saved-baselines) says, since the full report of a large repository passes 100 MB as an artifact.
+
 The job runs on the fleet's self-hosted Linux runner labelled `winbox`, which is where a repository sends its full sweeps.
 It never reads `CI_RUNS_ON`, so an override that moves a repository's other jobs during a runner outage leaves the sweep waiting for `winbox`.
 [checks-ci-wiring](checks-ci-wiring.md#runners) refuses a mutation job that names it in `runs-on`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.40.0",
+  "version": "0.41.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "license": "MIT",
   "repository": {
@@ -47,9 +47,11 @@
     "src/testing/mutation-guard-plugin.js",
     "src/testing/mutation-compare.ts",
     "src/testing/mutation-baseline.ts",
+    "src/testing/mutation-baseline-saved.ts",
     "src/testing/subsumed-tests.ts",
     "src/delivery/ci-wiring.ts",
     "src/delivery/shell-command.ts",
+    "src/delivery/workflow-references.ts",
     "src/delivery/mutation-job.ts",
     "src/delivery/secrets.ts",
     "src/delivery/gitleaks.ts",

package/src/delivery/ci-wiring.ts

@@ -5,6 +5,7 @@ import { runMain } from "../core/main.ts";
 import { ENTRY_POINT, KIT_GATES, type KitGate } from "../core/gates.ts";
 import { readShellFiles, runsMutation, within, type Run } from "./mutation-job.ts";
 import { invokes, mentions, plainCommand, type Command } from "./shell-command.ts";
+import { findMissingWorkflows, formatMissingReport, isRecord, names, type Workflow } from "./workflow-references.ts";
 
 export type { Command };
 
@@ -20,11 +21,6 @@ export type Declaration = {
   readonly lintGates: readonly KitGate[];
 };
 
-export type Workflow = {
-  readonly path: string;
-  readonly document: unknown;
-};
-
 export type BlockedInvocation = {
   readonly location: string;
   readonly blocker: string;
@@ -84,16 +80,6 @@ const MUTATION_RUNNER = ["self-hosted", "Linux", "X64", "winbox"];
 const HOSTED_DEFAULT = "${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}";
 const EventRepository = Schema.fromJsonString(Schema.Struct({ repository: Schema.Struct({ private: Schema.Boolean }) }));
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-function names(value: unknown): readonly string[] | undefined {
-  if (typeof value === "string") return [value];
-  if (!Array.isArray(value)) return undefined;
-  return value.filter((entry): entry is string => typeof entry === "string");
-}
-
 function constant(value: unknown): boolean | undefined {
   if (typeof value === "boolean") return value;
   if (typeof value !== "string") return undefined;
@@ -333,7 +319,7 @@ export function formatRunnerReport(faults: readonly RunnerFault[]): string {
 
 export const parseWorkflow = (path: string, text: string): Effect.Effect<Workflow, WiringError> =>
   Effect.try({
-    try: () => ({ path, document: Bun.YAML.parse(text) }),
+    try: () => ({ path, document: Bun.YAML.parse(text), text }),
     catch: (error) => new WiringError({ message: `cannot parse ${path}: ${String(error)}` }),
   });
 
@@ -386,11 +372,13 @@ const wiring = Effect.gen(function* () {
   const gaps = findGaps(declaration, workflows);
   const gapReport = formatReport(declaration, gaps);
   yield* gaps.length > 0 ? Console.error(gapReport) : Console.log(gapReport);
+  const missing = findMissingWorkflows(workflows);
+  if (missing.length > 0) yield* Console.error(formatMissingReport(missing));
   const scripts = yield* readScripts(root);
   const runs = workflows.flatMap((workflow) => workflowJobs(workflow).flatMap(([, job]) => jobRuns(workflow, job)));
   const faults = findRunnerFaults({ visibility: yield* readVisibility, scripts, files: yield* readShellFiles(root, scripts, runs) }, workflows);
   if (faults.length > 0) yield* Console.error(formatRunnerReport(faults));
-  return gaps.length === 0 && faults.length === 0;
+  return gaps.length === 0 && faults.length === 0 && missing.length === 0;
 });
 
 if (import.meta.main) runMain("ci-wiring", wiring);

package/src/delivery/workflow-references.ts

@@ -0,0 +1,198 @@
+import { fromProgram, shellCommands, type Command } from "./shell-command.ts";
+
+export type Workflow = {
+  readonly path: string;
+  readonly document: unknown;
+  readonly text: string;
+};
+
+export type MissingReference = {
+  readonly location: string;
+  readonly fault: string;
+};
+
+export function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+export function names(value: unknown): readonly string[] | undefined {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return undefined;
+  return value.filter((entry): entry is string => typeof entry === "string");
+}
+
+type Key = string | number;
+
+type Locator = (keys: readonly Key[], needle: string, fallback: string) => string;
+
+// Lines from..to hold the node, and its child keys start at column.
+type Node = { readonly from: number; readonly to: number; readonly column: number };
+
+const WORKFLOWS = ".github/workflows";
+const RELEASE_BINS = ["checks-release-pr", "checks-release-tag"];
+const RELEASE_SOURCES = ["release-pr.ts", "release-tag.ts"];
+const REUSABLE_PREFIX = "./.github/workflows/";
+// GitHub substitutes an expression into the script before the shell reads it.
+const EXPRESSION = /\$\{\{[\s\S]*?\}\}/g;
+
+function isPathTo(word: string, files: readonly string[]): boolean {
+  return files.some((file) => word.endsWith(`/${file}`));
+}
+
+function releaseArguments(program: Command): readonly string[] {
+  const [head, target] = program;
+  if (head !== undefined && (RELEASE_BINS.includes(head) || isPathTo(head, RELEASE_BINS))) return program.slice(1);
+  if (head === "bun" && target !== undefined && (RELEASE_SOURCES.includes(target) || isPathTo(target, [...RELEASE_SOURCES, ...RELEASE_BINS]))) {
+    return program.slice(2);
+  }
+  return [];
+}
+
+function literalTargets(run: string): readonly string[] {
+  return shellCommands(run.replace(EXPRESSION, "$EXPRESSION"))
+    .flatMap((command) => releaseArguments(fromProgram(command)))
+    .filter((target) => !target.includes("$"));
+}
+
+function escapeRegExp(text: string): string {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function indentOf(line: string): number {
+  return line.length - line.trimStart().length;
+}
+
+function meaningful(line: string): boolean {
+  const text = line.trim();
+  return text !== "" && !text.startsWith("#");
+}
+
+function belongs(line: string, column: number): boolean {
+  return !meaningful(line) || indentOf(line) > column || (indentOf(line) === column && line.trim().startsWith("-"));
+}
+
+function firstBodyLine(lines: readonly string[], from: number, to: number): string | undefined {
+  return lines.slice(from + 1, to).find(meaningful);
+}
+
+function child(lines: readonly string[], node: Node, key: string): Node | undefined {
+  const pattern = new RegExp(`^(\\s*(?:-\\s+)?)["']?${escapeRegExp(key)}["']?\\s*:(\\s|$)`);
+  for (let at = node.from; at < node.to; at += 1) {
+    if (pattern.exec(lines[at] ?? "")?.[1]?.length !== node.column) continue;
+    let to = at + 1;
+    while (to < node.to && belongs(lines[to] ?? "", node.column)) to += 1;
+    const body = firstBodyLine(lines, at, to);
+    return { from: at, to, column: body === undefined ? -1 : indentOf(body) };
+  }
+  return undefined;
+}
+
+function items(lines: readonly string[], node: Node): readonly Node[] {
+  const column = indentOf(firstBodyLine(lines, node.from, node.to) ?? "");
+  const starts: number[] = [];
+  for (let at = node.from + 1; at < node.to; at += 1) {
+    const line = lines[at] ?? "";
+    if (meaningful(line) && indentOf(line) === column && line.trim().startsWith("-")) starts.push(at);
+  }
+  return starts.map((from, index) => {
+    const to = starts[index + 1] ?? node.to;
+    const inline = /^\s*-\s+(?=\S)/.exec(lines[from] ?? "");
+    return { from, to, column: inline === null ? indentOf(firstBodyLine(lines, from, to) ?? "") : inline[0].length };
+  });
+}
+
+function nodeAt(lines: readonly string[], keys: readonly Key[]): Node | undefined {
+  return keys.reduce<Node | undefined>(
+    (node, key) => (node === undefined ? undefined : typeof key === "number" ? items(lines, node)[key] : child(lines, node, key)),
+    { from: 0, to: lines.length, column: 0 },
+  );
+}
+
+function locate(path: string, lines: readonly string[]): Locator {
+  const used = new Map<string, number>();
+  return (keys, needle, fallback) => {
+    const node = nodeAt(lines, keys);
+    if (node === undefined) return `${path} ${fallback}`;
+    const hits = lines.slice(node.from, node.to).flatMap((line, offset) => (line.includes(needle) ? [node.from + offset] : []));
+    const at = hits.find((line) => line > (used.get(needle) ?? -1)) ?? hits[0] ?? node.from;
+    used.set(needle, at);
+    return `${path} line ${at + 1}`;
+  };
+}
+
+function workflowTitle(document: unknown): string | undefined {
+  return isRecord(document) && typeof document["name"] === "string" ? document["name"] : undefined;
+}
+
+function missingNeeds(jobs: Readonly<Record<string, unknown>>, at: Locator): readonly MissingReference[] {
+  return Object.entries(jobs).flatMap(([id, job]) => {
+    if (!isRecord(job)) return [];
+    return (names(job["needs"]) ?? []).flatMap((need) =>
+      need in jobs ? [] : [{ location: at(["jobs", id, "needs"], need, `job ${id}`), fault: `job ${id} needs missing job ${need}` }],
+    );
+  });
+}
+
+function missingTarget(uses: string, paths: ReadonlySet<string>, at: Locator, keys: readonly Key[], fallback: string): MissingReference | undefined {
+  return uses.startsWith(REUSABLE_PREFIX) && !paths.has(uses.slice(2))
+    ? { location: at(keys, uses, fallback), fault: `names missing workflow ${uses.slice(2)}` }
+    : undefined;
+}
+
+function missingJobRefs(id: string, job: unknown, paths: ReadonlySet<string>, at: Locator): readonly MissingReference[] {
+  if (!isRecord(job)) return [];
+  const missing: MissingReference[] = [];
+  if (typeof job["uses"] === "string") {
+    const called = missingTarget(job["uses"], paths, at, ["jobs", id, "uses"], `job ${id}`);
+    if (called !== undefined) missing.push(called);
+  }
+  const steps = job["steps"];
+  if (!Array.isArray(steps)) return missing;
+  steps.forEach((step: unknown, index) => {
+    if (!isRecord(step)) return;
+    const fallback = `job ${id} step ${index + 1}`;
+    if (typeof step["uses"] === "string") {
+      const used = missingTarget(step["uses"], paths, at, ["jobs", id, "steps", index, "uses"], fallback);
+      if (used !== undefined) missing.push(used);
+    }
+    if (typeof step["run"] !== "string") return;
+    for (const target of literalTargets(step["run"])) {
+      if (!paths.has(`${WORKFLOWS}/${target}`)) {
+        missing.push({ location: at(["jobs", id, "steps", index, "run"], target, fallback), fault: `names missing workflow ${target}` });
+      }
+    }
+  });
+  return missing;
+}
+
+// GitHub names a workflow without a name by its path from the repository root.
+export function findMissingWorkflows(workflows: readonly Workflow[]): readonly MissingReference[] {
+  const paths = new Set(workflows.map((workflow) => workflow.path));
+  const titles = new Set(workflows.map((workflow) => workflowTitle(workflow.document) ?? workflow.path));
+  return workflows.flatMap((workflow) => {
+    const missing: MissingReference[] = [];
+    const at = locate(workflow.path, workflow.text.split("\n"));
+    const jobs = isRecord(workflow.document) ? workflow.document["jobs"] : undefined;
+    if (isRecord(jobs)) {
+      missing.push(...missingNeeds(jobs, at));
+      for (const [id, job] of Object.entries(jobs)) missing.push(...missingJobRefs(id, job, paths, at));
+    }
+    const on = isRecord(workflow.document) ? workflow.document["on"] : undefined;
+    const watched = isRecord(on) ? on["workflow_run"] : undefined;
+    if (isRecord(watched)) {
+      for (const entry of names(watched["workflows"]) ?? []) {
+        if (!titles.has(entry)) {
+          missing.push({ location: at(["on", "workflow_run", "workflows"], entry, "on workflow_run"), fault: `names missing workflow ${entry}` });
+        }
+      }
+    }
+    return missing;
+  });
+}
+
+export function formatMissingReport(faults: readonly MissingReference[]): string {
+  return [
+    `ci-wiring: ${faults.length} reference(s) name a missing workflow or job:`,
+    ...faults.map(({ location, fault }) => `  ${location}: ${fault}`),
+  ].join("\n");
+}

package/src/testing/mutation-baseline-saved.ts

@@ -0,0 +1,105 @@
+import { Config, Console, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { cacheRoot } from "../dependencies/cache-root.ts";
+
+export const LATEST_ARTIFACT = "mutation-baseline";
+export const INCREMENTAL = "stryker-incremental.json";
+export const REPORT = "mutation/mutation.json";
+const SAVED = "saved";
+
+class SaveFailure extends Schema.TaggedError<SaveFailure>()("SaveFailure", {
+  message: Schema.String,
+}) {}
+
+const decodeReport = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+
+const SavedFiles = Schema.Struct({ [INCREMENTAL]: Schema.Unknown, [REPORT]: Schema.optionalKey(Schema.Unknown) });
+export type SavedFiles = typeof SavedFiles.Type;
+const decodeSavedFiles = Schema.decodeUnknownEffect(Schema.fromJsonString(SavedFiles));
+
+const isRecord = (value: unknown): value is Readonly<Record<string, unknown>> => typeof value === "object" && value !== null && !Array.isArray(value);
+
+const withoutReason = (mutant: unknown): unknown => (isRecord(mutant) ? Object.fromEntries(Object.entries(mutant).filter(([key]) => key !== "statusReason")) : mutant);
+
+function slimFile(file: unknown): unknown {
+  if (!isRecord(file)) return file;
+  const mutants = file["mutants"];
+  return Array.isArray(mutants) ? { ...file, mutants: mutants.map((mutant: unknown) => withoutReason(mutant)) } : file;
+}
+
+// statusReason holds the test runner's failure message for each mutant, which no reader of a baseline uses and which fills most of a large report.
+export function withoutReasons(report: unknown): unknown {
+  if (!isRecord(report) || !isRecord(report["files"])) return report;
+  return { ...report, files: Object.fromEntries(Object.entries(report["files"]).map(([name, file]) => [name, slimFile(file)])) };
+}
+
+const slimOf = Effect.fn("slimOf")(function* (from: string) {
+  const report = yield* (yield* FileSystem.FileSystem).readFileString(from).pipe(
+    Effect.flatMap(decodeReport),
+    Effect.mapError((cause) => new SaveFailure({ message: `cannot read ${from}: ${cause.message}` })),
+  );
+  return withoutReasons(report);
+});
+
+export const slimmed = Effect.fn("slimmed")(function* (from: string, to: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const report = yield* slimOf(from);
+  yield* fs.makeDirectory((yield* Path.Path).dirname(to), { recursive: true });
+  yield* fs.writeFileString(to, JSON.stringify(report));
+});
+
+const shelfOf = Effect.fn("shelfOf")(function* (root: string, repository: number) {
+  return (yield* Path.Path).join(root, "mutation-baseline", String(repository), SAVED, LATEST_ARTIFACT);
+});
+
+// GitHub sets GITHUB_REPOSITORY_ID on every job, so a run outside Actions has no saved baselines.
+export const savedShelf = Effect.fn("savedShelf")(function* (root: Option.Option<string>) {
+  const repository = yield* Config.Int("GITHUB_REPOSITORY_ID").pipe(Config.option);
+  if (Option.isNone(root) || Option.isNone(repository)) return Option.none<string>();
+  return Option.some(yield* shelfOf(root.value, repository.value));
+});
+
+const savedEntry = Effect.fn("savedEntry")(function* (shelf: string, run: number) {
+  return (yield* Path.Path).join(shelf, `${run}.json`);
+});
+
+// One read opens the entry once, so a job that removes or replaces it afterwards leaves what this job read whole.
+export const savedFiles = Effect.fn("savedFiles")(function* (shelf: string, run: number) {
+  const entry = yield* savedEntry(shelf, run);
+  const text = yield* (yield* FileSystem.FileSystem).readFileString(entry).pipe(
+    Effect.asSome,
+    Effect.catchReason("PlatformError", "NotFound", () => Effect.succeedNone),
+  );
+  if (Option.isNone(text)) return Option.none<SavedFiles>();
+  return Option.some(yield* decodeSavedFiles(text.value).pipe(Effect.mapError((cause) => new SaveFailure({ message: `cannot read ${entry}: ${cause.message}` }))));
+});
+
+// GitHub numbers runs in the order it creates them, so a lower id is an older run the restore never reads again.
+export function outlived(entries: readonly string[], restoring: number): readonly string[] {
+  return entries.filter((entry) => {
+    const run = /^(\d+)\.json$/.exec(entry)?.[1];
+    return run !== undefined && Number(run) < restoring;
+  });
+}
+
+const required = (name: string) =>
+  Config.Int(name).pipe(Effect.mapError(() => new SaveFailure({ message: `${name} is unset, so --save runs only inside a GitHub Actions job` })));
+
+// The entry is one file renamed into place, so a job sharing the runner reads one attempt's entry whole even while a re-run replaces it.
+export const saveBaseline = Effect.fn("saveBaseline")(function* (incremental: string, report: Option.Option<string>) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const environment = yield* Config.String("RUNNER_ENVIRONMENT").pipe(Config.withDefault(""));
+  if (environment === "github-hosted") {
+    return yield* new SaveFailure({ message: "a GitHub-hosted runner discards its disk when the job ends, so upload the baseline as an artifact there" });
+  }
+  const root = yield* cacheRoot().pipe(Effect.mapError((cause) => new SaveFailure({ message: cause.message })));
+  const shelf = yield* shelfOf(root, yield* required("GITHUB_REPOSITORY_ID"));
+  const run = yield* required("GITHUB_RUN_ID");
+  const files: SavedFiles = { [INCREMENTAL]: yield* slimOf(incremental), ...(Option.isSome(report) ? { [REPORT]: yield* slimOf(report.value) } : {}) };
+  yield* fs.makeDirectory(shelf, { recursive: true });
+  const staged = path.join(yield* fs.makeTempDirectoryScoped({ directory: shelf, prefix: ".staging-" }), "entry.json");
+  yield* fs.writeFileString(staged, JSON.stringify(files));
+  yield* fs.rename(staged, yield* savedEntry(shelf, run));
+  yield* Console.log(`mutation-baseline: saved the ${LATEST_ARTIFACT} of run ${run} on the runner's disk`);
+  return true;
+}, Effect.scoped);

package/src/testing/mutation-baseline.ts

@@ -4,20 +4,19 @@ import { ChildProcessSpawner } from "effect/process";
 import { collect } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 import { cacheRoot } from "../dependencies/cache-root.ts";
+import { INCREMENTAL, LATEST_ARTIFACT, outlived, REPORT, saveBaseline, savedFiles, savedShelf, slimmed } from "./mutation-baseline-saved.ts";
 
 class BaselineFailure extends Schema.TaggedError<BaselineFailure>()("BaselineFailure", {
   message: Schema.String,
 }) {}
 
 const NAME = "checks-mutation-baseline";
-const USAGE = "usage: checks-mutation-baseline <incremental-dest> [mutation-json-dest] | --full <mutation-json-dest> | --prune [--dry-run]";
+const USAGE =
+  "usage: checks-mutation-baseline <incremental-dest> [mutation-json-dest] | --full <mutation-json-dest> | --save <incremental-src> [mutation-json-src] | --slim <mutation-json-src> <dest> | --prune [--dry-run]";
 const WORKFLOW = "mutation.yml";
 const BRANCH = "main";
-const INCREMENTAL = "stryker-incremental.json";
-const REPORT = "mutation/mutation.json";
 const REPORT_ALONE = "mutation.json";
 const KEPT_PER_ARTIFACT = 2;
-const LATEST_ARTIFACT = "mutation-baseline";
 const FULL_ARTIFACT = "mutation-baseline-full";
 const LATEST_LIMIT = 20;
 const FULL_LIMIT = 50;
@@ -63,12 +62,12 @@ export function newestFirst(runs: readonly Run[]): readonly number[] {
   return [...runs].sort((one, other) => other.createdAt.localeCompare(one.createdAt)).map((run) => run.databaseId);
 }
 
+// All non-pull-request runs newest first: a newer full run holds no baseline, and the newest baseline must survive it.
 const latestCandidates = Effect.gen(function* () {
   const newest = (yield* listed(undefined, LATEST_LIMIT)).find((run) => run.event !== "pull_request");
   return newest === undefined ? [] : [newest.databaseId];
 });
 
-// All non-pull-request runs newest first: a newer full run holds no baseline, and the newest baseline must survive it.
 const latestRuns = listed(undefined, LATEST_LIMIT).pipe(Effect.map((runs) => newestFirst(runs.filter((run) => run.event !== "pull_request"))));
 
 // Each full event is listed on its own, because one shared window lets push runs crowd out every full run.
@@ -108,12 +107,22 @@ const missedDeletion = Effect.fn("missedDeletion")(function* (artifact: Artifact
   );
 });
 
+// A run whose baseline the runner's disk holds supersedes every older artifact, since the restore reads that run's entry first.
+const keptLatest = Effect.fn("keptLatest")(function* (runs: readonly number[], shelf: Option.Option<string>) {
+  for (const run of runs) {
+    if (Option.isSome(shelf) && Option.isSome(yield* savedFiles(shelf.value, run))) return { saved: Option.some(run), kept: Option.none<Kept>() };
+    const artifact = yield* artifactOf(run, LATEST_ARTIFACT);
+    if (Option.isSome(artifact)) return { saved: Option.none<number>(), kept: Option.some<Kept>({ run, id: artifact.value.id, name: LATEST_ARTIFACT }) };
+  }
+  return { saved: Option.none<number>(), kept: Option.none<Kept>() };
+});
+
 const pruneBaselines = Effect.fn("pruneBaselines")(function* (dryRun: boolean) {
   const running = yield* Config.Int("GITHUB_RUN_ID").pipe(Config.option);
-  const latest = yield* keptArtifact(yield* latestRuns, LATEST_ARTIFACT);
+  const latest = yield* keptLatest(yield* latestRuns, yield* savedShelf(yield* runnerCache));
   const full = yield* keptArtifact(yield* fullCandidates, FULL_ARTIFACT);
   const artifacts = yield* everyArtifact();
-  const keeping = [...Option.toArray(latest), ...Option.toArray(full), ...uploadedBy(artifacts, running)];
+  const keeping = [...Option.toArray(latest.kept), ...Option.toArray(full), ...uploadedBy(artifacts, running)];
   const victims = superseded(artifacts, new Set(keeping.map((keep) => keep.id)));
   const removed: number[] = [];
   const missed: Missed[] = [];
@@ -124,7 +133,7 @@ const pruneBaselines = Effect.fn("pruneBaselines")(function* (dryRun: boolean) {
       else removed.push(victim.id);
     }
   }
-  yield* Console.log(pruneReport(dryRun, dryRun ? victims.map((victim) => victim.id) : removed, missed, keeping));
+  yield* Console.log(pruneReport(dryRun, dryRun ? victims.map((victim) => victim.id) : removed, missed, keeping, latest.saved));
   return true;
 });
 
@@ -175,8 +184,12 @@ export function superseded(artifacts: readonly Artifact[], kept: ReadonlySet<num
 // A workflow command ends at a newline, so the error's own newlines and percent signs are escaped.
 const annotated = (text: string): string => text.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
 
-export function pruneReport(dryRun: boolean, removed: readonly number[], missed: readonly Missed[], keeping: readonly Kept[]): string {
-  const kept = keeping.length === 0 ? "no baseline artifacts" : keeping.map((keep) => `${keep.name} artifact ${keep.id} from run ${keep.run}`).join(", ");
+export function pruneReport(dryRun: boolean, removed: readonly number[], missed: readonly Missed[], keeping: readonly Kept[], saved: Option.Option<number>): string {
+  const holdings = [
+    ...keeping.map((keep) => `${keep.name} artifact ${keep.id} from run ${keep.run}`),
+    ...Option.toArray(saved).map((run) => `the ${LATEST_ARTIFACT} run ${run} saved on the runner's disk`),
+  ];
+  const kept = holdings.length === 0 ? "no baseline artifacts" : holdings.join(", ");
   const deleted = removed.length === 0 ? "nothing to delete" : `deleted artifacts ${removed.join(", ")}`;
   if (dryRun) return `mutation-baseline: dry run, ${removed.length === 0 ? "nothing to delete" : `would delete artifacts ${removed.join(", ")}`}; would keep ${kept}`;
   if (missed.length === 0) return `mutation-baseline: ${deleted}; kept ${kept}`;
@@ -265,36 +278,80 @@ const runnerCache = Effect.gen(function* () {
   );
 });
 
+const restoredFromSaved = Effect.fn("restoredFromSaved")(function* (shelf: string, run: number, request: Request) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const files = yield* savedFiles(shelf, run);
+  if (Option.isNone(files)) return false;
+  const stored = new Map(Object.entries(files.value));
+  for (const copy of [request.needed, ...request.optional]) {
+    const name = copy.from.find((from) => stored.has(from));
+    if (name === undefined) continue;
+    yield* fs.makeDirectory(path.dirname(copy.to), { recursive: true });
+    yield* fs.writeFileString(copy.to, JSON.stringify(stored.get(name)));
+  }
+  for (const older of outlived(yield* fs.readDirectory(shelf), run)) {
+    yield* fs.remove(path.join(shelf, older), { force: true });
+  }
+  yield* Console.log(`mutation-baseline: restored it from the runner's disk, ${LATEST_ARTIFACT} saved by run ${run}`);
+  return true;
+});
+
+const slimReport = Effect.fn("slimReport")(function* (from: string, to: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const before = (yield* fs.stat(from)).size;
+  yield* slimmed(from, to);
+  const after = (yield* fs.stat(to)).size;
+  yield* Console.log(`mutation-baseline: wrote ${to} without statusReason, ${after} bytes from ${before}`);
+  return true;
+});
+
 // An artifact that lacks `needed` counts as no baseline, and `optional` copies only what the artifact holds.
-type Request = { readonly full: boolean; readonly needed: Copy; readonly optional: readonly Copy[] };
+type Request = { readonly kind: "restore"; readonly full: boolean; readonly needed: Copy; readonly optional: readonly Copy[] };
 
-type PruneRequest = { readonly prune: true; readonly dryRun: boolean };
+type Command =
+  | Request
+  | { readonly kind: "prune"; readonly dryRun: boolean }
+  | { readonly kind: "save"; readonly incremental: string; readonly report: Option.Option<string> }
+  | { readonly kind: "slim"; readonly from: string; readonly to: string };
 
 const isDestination = (arg: string | undefined): arg is string => arg !== undefined && !arg.startsWith("-");
 
-function parsed(args: readonly string[]): Request | PruneRequest | undefined {
-  if (args[0] === "--prune") {
-    const [flag, ...extra] = args.slice(1);
-    if ((flag === undefined || flag === "--dry-run") && extra.length === 0) return { prune: true, dryRun: flag !== undefined };
-    return undefined;
-  }
-  if (args[0] === "--full") {
-    const [report, ...extra] = args.slice(1);
-    if (!isDestination(report) || extra.length > 0) return undefined;
-    return { full: true, needed: { from: [REPORT_ALONE, REPORT], to: report }, optional: [] };
-  }
-  const [incremental, report, ...extra] = args;
+function restoreRequest(incremental: string | undefined, report: string | undefined, extra: readonly string[]): Command | undefined {
   if (!isDestination(incremental) || extra.length > 0) return undefined;
-  return { full: false, needed: { from: [INCREMENTAL], to: incremental }, optional: report === undefined ? [] : [{ from: [REPORT], to: report }] };
+  return { kind: "restore", full: false, needed: { from: [INCREMENTAL], to: incremental }, optional: report === undefined ? [] : [{ from: [REPORT], to: report }] };
 }
 
-const mutationBaseline = Effect.gen(function* () {
-  const request = parsed(process.argv.slice(2));
-  if (request === undefined) return yield* new Usage({ message: USAGE });
-  if ("prune" in request) return yield* pruneBaselines(request.dryRun);
+const FLAGS = new Map<string, (rest: readonly string[]) => Command | undefined>([
+  ["--prune", ([flag, ...extra]) => ((flag === undefined || flag === "--dry-run") && extra.length === 0 ? { kind: "prune", dryRun: flag !== undefined } : undefined)],
+  [
+    "--save",
+    ([incremental, report, ...extra]) =>
+      isDestination(incremental) && (report === undefined || isDestination(report)) && extra.length === 0
+        ? { kind: "save", incremental, report: Option.fromNullishOr(report) }
+        : undefined,
+  ],
+  ["--slim", ([from, to, ...extra]) => (isDestination(from) && isDestination(to) && extra.length === 0 ? { kind: "slim", from, to } : undefined)],
+  [
+    "--full",
+    ([report, ...extra]) =>
+      isDestination(report) && extra.length === 0 ? { kind: "restore", full: true, needed: { from: [REPORT_ALONE, REPORT], to: report }, optional: [] } : undefined,
+  ],
+]);
+
+function parsed([first, ...rest]: readonly string[]): Command | undefined {
+  const flag = first === undefined ? undefined : FLAGS.get(first);
+  if (flag !== undefined) return flag(rest);
+  const [report, ...extra] = rest;
+  return restoreRequest(first, report, extra);
+}
+
+const restoreBaseline = Effect.fn("restoreBaseline")(function* (request: Request) {
   const name = request.full ? FULL_ARTIFACT : LATEST_ARTIFACT;
   const root = yield* runnerCache;
+  const shelf = request.full ? Option.none<string>() : yield* savedShelf(root);
   for (const run of yield* request.full ? fullCandidates : latestCandidates) {
+    if (Option.isSome(shelf) && (yield* restoredFromSaved(shelf.value, run, request))) return true;
     const artifact = yield* artifactOf(run, name).pipe(Effect.catch(warned(Option.none<Artifact>())));
     if (Option.isSome(artifact) && (yield* restoredFrom(run, artifact.value, root, request))) return true;
   }
@@ -302,4 +359,13 @@ const mutationBaseline = Effect.gen(function* () {
   return true;
 });
 
+const mutationBaseline = Effect.gen(function* () {
+  const command = parsed(process.argv.slice(2));
+  if (command === undefined) return yield* new Usage({ message: USAGE });
+  if (command.kind === "prune") return yield* pruneBaselines(command.dryRun);
+  if (command.kind === "save") return yield* saveBaseline(command.incremental, command.report);
+  if (command.kind === "slim") return yield* slimReport(command.from, command.to);
+  return yield* restoreBaseline(command);
+});
+
 if (import.meta.main) runMain(NAME, mutationBaseline);