@avi2dg/checks 0.52.1 → 0.53.0

package/src/delivery/release-pr.ts

@@ -1,28 +1,11 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
-import * as Base64 from "effect/encoding/Base64";
+import { Console, Effect, Schema } from "effect";
 import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
-import { nextVersion, type Pending, readPending, releaseTitle, runBuild, withVersion } from "./release.ts";
+import { releaseTitle } from "./release.ts";
+import { buildRelease, commitRelease, hasBranch, MANIFEST, planRelease, pointBranch, versionIn } from "./release-commit.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-class ReleaseRefused extends Schema.TaggedError<ReleaseRefused>()("ReleaseRefused", {
-  message: Schema.String,
-}) {}
-
-type Staged =
-  | { readonly kind: "written"; readonly path: string; readonly mode: string }
-  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
-
-type Read =
-  | { readonly kind: "written"; readonly path: string; readonly mode: string; readonly content: string }
-  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
-
-type Built = {
-  readonly tree: string;
-  readonly files: readonly Read[];
-};
-
 type Remote = {
   readonly parents: readonly string[];
   readonly version: string | undefined;
@@ -30,68 +13,15 @@ type Remote = {
 
 const NAME = "checks-release-pr";
 const USAGE = "usage: release-pr.ts <workflow>...";
-const MANIFEST = "package.json";
-const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
-const RAW_ENTRY = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])/;
+const UNTAGGED = "rerun the tag job of daily-release on the release commit, whose refusal says what to fix";
 
-const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
-const decodeSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ sha: Schema.String })));
-const decodeRef = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ ref: Schema.String })));
 const PullRequest = Schema.Struct({ number: Schema.Int, title: Schema.String, html_url: Schema.String });
 type PullRequest = typeof PullRequest.Type;
 const decodePullRequest = Schema.decodeUnknownEffect(Schema.fromJsonString(PullRequest));
 const decodePullRequests = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(PullRequest)));
 
-export function releaseBranchOf(base: string): string {
-  return `release/${base}`;
-}
-
-export function stagedOf(raw: string): readonly Staged[] {
-  const fields = raw.split("\0");
-  const staged: Staged[] = [];
-  for (let index = 0; index + 1 < fields.length; index += 2) {
-    const [, from = "", to = "", status] = RAW_ENTRY.exec(fields[index] ?? "") ?? [];
-    const path = fields[index + 1] ?? "";
-    staged.push(status === "D" ? { kind: "deleted", path, mode: from } : { kind: "written", path, mode: to });
-  }
-  return staged;
-}
-
-const refused = (message: string) => new ReleaseRefused({ message });
-
-const versionIn = (manifest: string) =>
-  decodeVersion(manifest).pipe(
-    Effect.map(({ version }) => version),
-    Effect.orElseSucceed(() => undefined),
-  );
-
-const releaseVersion = Effect.fn("releaseVersion")(function* (manifest: string, { since, unreleased }: Pending) {
-  const { version } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)));
-  if (since !== undefined && since !== `v${version}`) {
-    return yield* refused(
-      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; rerun the tag job of daily-release on the release commit, whose refusal says what to fix, or return its version to ${since.slice(1)}`,
-    );
-  }
-  const next = nextVersion(version, unreleased);
-  if (next === undefined) return yield* refused(`${MANIFEST} holds ${version}, which is no plain major.minor.patch version`);
-  const bumped = withVersion(manifest, version, next);
-  if (bumped === undefined || (yield* versionIn(bumped)) !== next) {
-    return yield* refused(`cannot rewrite the version ${version} in ${MANIFEST} as ${next}`);
-  }
-  return { next, bumped };
-});
-
-const currentBranch = Effect.fn("currentBranch")(function* (root: string) {
-  const branch = yield* git(["symbolic-ref", "--quiet", "--short", "HEAD"], root).pipe(
-    Effect.map((name) => name.trim()),
-    Effect.catchTag("GitFailure", () => Effect.succeed("")),
-  );
-  if (branch === "") return yield* refused("HEAD is detached; check out the branch the release goes to");
-  return branch;
-});
-
 const readRemote = Effect.fn("readRemote")(function* (root: string, branch: string) {
-  if ((yield* git(["ls-remote", "origin", `refs/heads/${branch}`], root)).trim() === "") return undefined;
+  if (!(yield* hasBranch(root, branch))) return undefined;
   const tracking = `refs/remotes/origin/${branch}`;
   yield* git(["fetch", "--quiet", "--no-tags", "origin", `+refs/heads/${branch}:${tracking}`], root);
   const [, ...parents] = (yield* git(["rev-list", "--parents", "-n", "1", tracking], root)).trim().split(" ");
@@ -102,52 +32,6 @@ const readRemote = Effect.fn("readRemote")(function* (root: string, branch: stri
   return { parents, version } satisfies Remote;
 });
 
-const readStaged = Effect.fn("readStaged")(function* (root: string, staged: Staged) {
-  if (staged.kind === "deleted") return staged;
-  if (!REGULAR_FILE_MODES.has(staged.mode)) return yield* refused(`the build wrote ${staged.path} with mode ${staged.mode}, which is no regular file`);
-  const bytes = yield* (yield* FileSystem.FileSystem).readFile((yield* Path.Path).join(root, staged.path));
-  return { ...staged, content: Base64.encode(bytes) };
-});
-
-// The build writes into the working tree, so the tree it starts from has to hold nothing a release would sweep in.
-const buildRelease = Effect.fn("buildRelease")(function* (root: string, bumped: string) {
-  if ((yield* git(["status", "--porcelain", "--untracked-files=no"], root)).trim() !== "") {
-    return yield* refused("the working tree has changes to tracked files; the release commits only what the build writes");
-  }
-  const restore = git(["reset", "--quiet", "--hard", "HEAD"], root).pipe(
-    Effect.catchTag("GitFailure", (failure) => Console.error(`${NAME}: cannot restore the working tree: ${failure.message}`)),
-  );
-  return yield* Effect.gen(function* () {
-    yield* (yield* FileSystem.FileSystem).writeFileString((yield* Path.Path).join(root, MANIFEST), bumped);
-    yield* runBuild(root);
-    yield* git(["add", "--update"], root);
-    const tree = (yield* git(["write-tree"], root)).trim();
-    const staged = stagedOf(yield* git(["diff", "--cached", "--raw", "-z", "--no-renames", "HEAD"], root));
-    return { tree, files: yield* Effect.forEach(staged, (one) => readStaged(root, one)) } satisfies Built;
-  }).pipe(Effect.ensuring(restore));
-});
-
-const treeEntry = Effect.fn("treeEntry")(function* (file: Read) {
-  if (file.kind === "deleted") return { path: file.path, mode: file.mode, type: "blob", sha: null };
-  const { sha } = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/blobs`, { content: file.content, encoding: "base64" });
-  return { path: file.path, mode: file.mode, type: "blob", sha };
-});
-
-const commitRelease = Effect.fn("commitRelease")(function* (root: string, head: string, built: Built, version: string) {
-  const tree = yield* Effect.forEach(built.files, treeEntry);
-  const baseTree = (yield* git(["rev-parse", `${head}^{tree}`], root)).trim();
-  const made = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/trees`, { base_tree: baseTree, tree });
-  if (made.sha !== built.tree) return yield* refused(`GitHub built the tree ${made.sha}, but the build wrote ${built.tree}`);
-  const commit = { message: releaseTitle(version), tree: made.sha, parents: [head] };
-  return (yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/commits`, commit)).sha;
-});
-
-const pointBranch = Effect.fn("pointBranch")(function* (branch: string, sha: string, exists: boolean) {
-  yield* exists
-    ? gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${branch}`, { sha, force: true })
-    : gitHubJson(decodeRef, "POST", `${REPOSITORY}/git/refs`, { ref: `refs/heads/${branch}`, sha });
-});
-
 const findOpen = Effect.fn("findOpen")(function* (base: string, branch: string) {
   const query = `head={owner}:${encodeURIComponent(branch)}&base=${encodeURIComponent(base)}&state=open`;
   const [open] = yield* gitHubJson(decodePullRequests, "GET", `${REPOSITORY}/pulls?${query}`);
@@ -169,16 +53,9 @@ const releasePullRequest = Effect.gen(function* () {
   const workflows = process.argv.slice(2);
   if (workflows.length === 0) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const pending = yield* readPending(root);
-  if (pending.unreleased.length === 0) {
-    yield* Console.log(`release-pr: no unreleased changes ${pending.since === undefined ? "with no tag yet" : `since ${pending.since}`}`);
-    return true;
-  }
-  const base = yield* currentBranch(root);
-  const branch = releaseBranchOf(base);
-  const head = (yield* git(["rev-parse", "HEAD"], root)).trim();
-  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
-  const { next, bumped } = yield* releaseVersion(manifest, pending);
+  const plan = yield* planRelease("release-pr", root, UNTAGGED);
+  if (plan === undefined) return true;
+  const { base, branch, head, next, bumped } = plan;
   const remote = yield* readRemote(root, branch);
   const current = remote?.version === next && remote.parents.length === 1 && remote.parents[0] === head;
   const open = yield* findOpen(base, branch);
@@ -186,7 +63,7 @@ const releasePullRequest = Effect.gen(function* () {
     yield* Console.log(`release-pr: ${open.html_url} releases ${next} from ${head.slice(0, 12)} and is current`);
     return true;
   }
-  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(root, bumped), next), remote !== undefined);
+  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(NAME, root, bumped), next), remote !== undefined);
   const { verb, url } = yield* titlePullRequest(open, base, branch, next);
   yield* Effect.forEach(workflows, (workflow) => dispatch(workflow, branch));
   yield* Console.log(`release-pr: ${verb} ${url} to release ${next}, and dispatched ${workflows.join(", ")} on ${branch}`);

package/src/delivery/release-publish.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem, Option, Schema } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { collect } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+const NAME = "checks-release-publish";
+const LABEL = "release-publish";
+const USAGE = "usage: release-publish.ts";
+const MANIFEST = "package.json";
+
+class PublishFailed extends Schema.TaggedError<PublishFailed>()("PublishFailed", {
+  message: Schema.String,
+}) {}
+
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ name: Schema.String, version: Schema.String })));
+const decodeTags = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ latest: Schema.String })));
+const decodeMissing = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ error: Schema.Struct({ code: Schema.Literal("E404") }) })));
+
+type Standing = "unpublished" | "published" | "superseded";
+
+// npm refuses to move `latest` back to a lower version, so a version below it can only stay off npm.
+function standingOf(version: string, latest: string | undefined): Standing {
+  if (latest === undefined) return "unpublished";
+  const order = Bun.semver.order(version, latest);
+  if (order === 0) return "published";
+  return order < 0 ? "superseded" : "unpublished";
+}
+
+const latestOnNpm = Effect.fn("latestOnNpm")(function* (name: string) {
+  const failed = (reason: string) => new PublishFailed({ message: `npm view ${name} dist-tags: ${reason.trim()}` });
+  const { stdout, stderr, exitCode } = yield* collect("npm", ["view", name, "dist-tags", "--json"]).pipe(Effect.mapError((cause) => failed(cause.message)));
+  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return Option.isSome(decodeMissing(stdout)) ? undefined : yield* failed(stderr);
+  return (yield* decodeTags(stdout).pipe(Effect.mapError((cause) => failed(cause.message)))).latest;
+});
+
+const npmPublish = Effect.fn("npmPublish")(
+  function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const handle = yield* spawner.spawn(ChildProcess.make("npm", ["publish"], { stdin: "ignore", stdout: "inherit", stderr: "inherit" }));
+    return (yield* handle.exitCode) === ChildProcessSpawner.ExitCode(0);
+  },
+  Effect.scoped,
+);
+
+const settled = (name: string, version: string, standing: Standing, latest: string | undefined): string =>
+  standing === "published"
+    ? `${LABEL}: npm already holds ${name}@${version}`
+    : `${LABEL}: npm already holds ${name}@${latest ?? ""}, which carries every change in ${version}, so ${version} stays off npm`;
+
+const releasePublish = Effect.gen(function* () {
+  if (process.argv.length > 2) return yield* new Usage({ message: USAGE });
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString(MANIFEST);
+  const { name, version } = yield* decodeManifest(manifest).pipe(Effect.mapError((cause) => new PublishFailed({ message: `${MANIFEST}: ${cause.message}` })));
+  const before = yield* latestOnNpm(name);
+  const standing = standingOf(version, before);
+  if (standing !== "unpublished") {
+    yield* Console.log(settled(name, version, standing, before));
+    return true;
+  }
+  if (yield* npmPublish()) {
+    yield* Console.log(`${LABEL}: published ${name}@${version}`);
+    return true;
+  }
+  // A release that published while this one ran makes npm refuse it, which leaves nothing to publish.
+  const after = yield* latestOnNpm(name);
+  const now = standingOf(version, after);
+  if (now === "unpublished") return yield* new PublishFailed({ message: `npm publish refused ${name}@${version}` });
+  yield* Console.log(settled(name, version, now, after));
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePublish);

package/src/delivery/release-push.ts

@@ -0,0 +1,148 @@
+#!/usr/bin/env bun
+import { Console, Duration, Effect, Schema } from "effect";
+import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
+import { releasedVersionOf } from "./release.ts";
+import { buildRelease, commitRelease, decodeRef, hasBranch, planRelease, pointBranch, refused } from "./release-commit.ts";
+import { pushTag, tagHead, taggedOn } from "./release-tagging.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+const NAME = "checks-release-push";
+const LABEL = "release-push";
+const USAGE = "usage: release-push.ts <release-workflow> <workflow>...";
+const UNTAGGED = "tag the release commit with checks-release-tag, whose refusal says what to fix";
+const POLL = Duration.seconds(15);
+const POLLS = 180;
+
+const Run = Schema.Struct({ path: Schema.String, status: Schema.String, conclusion: Schema.NullOr(Schema.String), html_url: Schema.String });
+type Run = typeof Run.Type;
+const decodeRuns = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ workflow_runs: Schema.Array(Run) })));
+
+export type Verdict =
+  | { readonly kind: "pending"; readonly waiting: readonly string[] }
+  | { readonly kind: "passed" }
+  | { readonly kind: "failed"; readonly failed: readonly string[] };
+
+// GitHub lists the newest run first, so a rerun stands in for the run it repeats.
+export function verdictOf(workflows: readonly string[], runs: readonly Run[]): Verdict {
+  const latest = workflows.map((workflow) => {
+    const path = `.github/workflows/${workflow}`;
+    return { workflow, run: runs.find((run) => run.path === path || run.path.startsWith(`${path}@`)) };
+  });
+  const failed = latest.flatMap(({ workflow, run }) =>
+    run?.status === "completed" && run.conclusion !== "success" ? [`${workflow} concluded ${run.conclusion ?? "with no conclusion"} at ${run.html_url}`] : [],
+  );
+  if (failed.length > 0) return { kind: "failed", failed };
+  const waiting = latest.flatMap(({ workflow, run }) => (run?.status === "completed" ? [] : [workflow]));
+  return waiting.length > 0 ? { kind: "pending", waiting } : { kind: "passed" };
+}
+
+const POLL_FAILURES = 4;
+
+const awaitWorkflows = Effect.fn("awaitWorkflows")(function* (
+  workflows: readonly string[],
+  sha: string,
+  failed: (failed: readonly string[]) => string,
+  unfinished: (waiting: readonly string[]) => string,
+) {
+  const runs = `${REPOSITORY}/actions/runs?head_sha=${sha}&event=workflow_dispatch&per_page=100`;
+  let waiting = workflows;
+  let failures = 0;
+  for (let poll = 1; poll <= POLLS; poll += 1) {
+    const read = yield* gitHubJson(decodeRuns, "GET", runs).pipe(
+      Effect.map((decoded) => ({ done: true as const, runs: decoded.workflow_runs })),
+      Effect.catchTag("GitHubFailure", (failure) =>
+        failures + 1 >= POLL_FAILURES ? Effect.fail(failure) : Effect.succeed({ done: false as const }),
+      ),
+    );
+    if (!read.done) {
+      failures += 1;
+      yield* Effect.sleep(POLL);
+      continue;
+    }
+    failures = 0;
+    const verdict = verdictOf(workflows, read.runs);
+    if (verdict.kind === "passed") return;
+    if (verdict.kind === "failed") return yield* refused(failed(verdict.failed));
+    waiting = verdict.waiting;
+    yield* Effect.sleep(POLL);
+  }
+  return yield* refused(unfinished(waiting));
+});
+
+const awaitChecks = Effect.fn("awaitChecks")(function* (workflows: readonly string[], sha: string) {
+  return yield* awaitWorkflows(
+    workflows,
+    sha,
+    (failed) => `the checks failed on ${sha.slice(0, 12)}, so the release stays off the branch: ${failed.join(", ")}`,
+    (waiting) => `${waiting.join(", ")} did not finish on ${sha.slice(0, 12)} within ${Duration.format(Duration.times(POLL, POLLS))}, so the release stays off the branch`,
+  );
+});
+
+const awaitReleaseWorkflow = Effect.fn("awaitReleaseWorkflow")(function* (workflow: string, sha: string) {
+  return yield* awaitWorkflows(
+    [workflow],
+    sha,
+    (failed) => `the release workflow failed on ${sha.slice(0, 12)}: ${failed.join(", ")}`,
+    () => `${workflow} did not finish on ${sha.slice(0, 12)} within ${Duration.format(Duration.times(POLL, POLLS))}, though the branch already holds the release and the tag exists`,
+  );
+});
+
+type Landing = "landed" | "moved";
+
+// GitHub refuses a branch update that is no fast-forward, which is how a branch that moved during the checks shows.
+// A failed call may still have applied the update, so the branch's head decides what happened.
+const land = Effect.fn("land")(function* (root: string, base: string, head: string, release: string) {
+  return yield* gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${base}`, { sha: release, force: false }).pipe(
+    Effect.as<Landing>("landed"),
+    Effect.catchTag("GitHubFailure", (failure) =>
+      git(["ls-remote", "origin", `refs/heads/${base}`], root).pipe(
+        Effect.flatMap((listed) =>
+          Effect.gen(function* () {
+            const now = listed.split("\t")[0];
+            if (now === release) return "landed";
+            if (now === head) return yield* Effect.fail(failure);
+            yield* git(["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${base}`], root);
+            const ancestor = yield* git(["merge-base", "--is-ancestor", release, "FETCH_HEAD"], root).pipe(
+              Effect.as(true),
+              Effect.catchTag("GitFailure", () => Effect.succeed(false)),
+            );
+            return ancestor ? "landed" : "moved";
+          }),
+        ),
+      ),
+    ),
+  );
+});
+
+const releasePush = Effect.gen(function* () {
+  const [publish, ...checks] = process.argv.slice(2);
+  if (publish === undefined || checks.length === 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  if (releasedVersionOf((yield* git(["log", "-1", "--format=%s", "HEAD"], root)).trim()) !== undefined)
+    return yield* tagHead(LABEL, root, publish, LABEL, awaitReleaseWorkflow);
+  const plan = yield* planRelease(LABEL, root, UNTAGGED);
+  if (plan === undefined) return true;
+  const { base, branch, head, next, bumped } = plan;
+  const tag = `v${next}`;
+  const taken = yield* taggedOn(root, tag);
+  if (taken !== undefined) return yield* refused(`${tag} already tags ${taken.slice(0, 12)}, so ${next} cannot be released again`);
+  const release = yield* commitRelease(root, head, yield* buildRelease(NAME, root, bumped), next);
+  yield* pointBranch(branch, release, yield* hasBranch(root, branch));
+  yield* Effect.forEach(checks, (workflow) => dispatch(workflow, branch));
+  yield* Console.log(`${LABEL}: dispatched ${checks.join(", ")} on ${branch} to check ${next} at ${release.slice(0, 12)}`);
+  yield* awaitChecks(checks, release);
+  if ((yield* land(root, base, head, release)) === "moved") {
+    yield* Console.log(`${LABEL}: ${base} moved past ${head.slice(0, 12)} while the checks ran, so the run on its new head releases it`);
+    return true;
+  }
+  // The release commit exists only on GitHub, and pushing the tag needs it in the checkout.
+  yield* git(["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${base}`], root);
+  yield* pushTag(root, release, tag, publish);
+  yield* Console.log(`${LABEL}: released ${next} as ${release.slice(0, 12)} on ${base}, tagged it ${tag}, and dispatched ${publish} on it`);
+  yield* awaitReleaseWorkflow(publish, release);
+  yield* Console.log(`${LABEL}: ${publish} finished on ${tag}`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePush);

package/src/delivery/release-tag.ts

@@ -1,64 +1,15 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
-import { dispatch, GitHubFailure } from "./github.ts";
-import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { Effect } from "effect";
+import { tagHead } from "./release-tagging.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
-  message: Schema.String,
-}) {}
-
-const NAME = "checks-release-tag";
 const USAGE = "usage: release-tag.ts <workflow>";
-const MANIFEST = "package.json";
-
-const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
-
-// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
-export function taggedCommitOf(listed: string): string | undefined {
-  const lines = listed.split("\n").filter((line) => line !== "");
-  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
-  return peeled?.split("\t")[0];
-}
 
 const releaseTag = Effect.gen(function* () {
   const [workflow, ...extra] = process.argv.slice(2);
   if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
-  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
-  const version = releasedVersionOf(subject);
-  if (version === undefined) {
-    yield* Console.log(`release-tag: ${head.slice(0, 12)} is no release commit`);
-    return true;
-  }
-  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
-  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
-  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
-  const tag = `v${version}`;
-  const tagged = taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
-  if (tagged === head) {
-    yield* Console.log(`release-tag: ${tag} already tags ${head.slice(0, 12)}`);
-    return true;
-  }
-  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
-  yield* runBuild(root);
-  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
-  if (rebuilt.length > 0) {
-    const since = yield* lastTag(root);
-    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
-    return yield* new TagRefused({
-      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next daily-release run cuts the release again with every change since ${since ?? "the first commit"}`,
-    });
-  }
-  yield* git(["push", "--quiet", "origin", `${head}:refs/tags/${tag}`], root);
-  yield* dispatch(workflow, tag).pipe(
-    Effect.mapError(
-      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
-    ),
-  );
-  yield* Console.log(`release-tag: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
-  return true;
+  return yield* tagHead("release-tag", (yield* git(["rev-parse", "--show-toplevel"])).trim(), workflow, "daily-release");
 });
 
-if (import.meta.main) runMain(NAME, releaseTag);
+if (import.meta.main) runMain("checks-release-tag", releaseTag);

package/src/delivery/release-tagging.ts

@@ -0,0 +1,74 @@
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { dispatch, GitHubFailure } from "./github.ts";
+import { ChildProcessSpawner } from "effect/process";
+import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { git } from "../core/git.ts";
+
+class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
+  message: Schema.String,
+}) {}
+
+const MANIFEST = "package.json";
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+
+// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
+export function taggedCommitOf(listed: string): string | undefined {
+  const lines = listed.split("\n").filter((line) => line !== "");
+  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
+  return peeled?.split("\t")[0];
+}
+
+export const taggedOn = Effect.fn("taggedOn")(function* (root: string, tag: string) {
+  return taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
+});
+
+export const pushTag = Effect.fn("pushTag")(function* (root: string, sha: string, tag: string, workflow: string) {
+  yield* git(["push", "--quiet", "origin", `${sha}:refs/tags/${tag}`], root);
+  yield* dispatch(workflow, tag).pipe(
+    Effect.mapError(
+      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
+    ),
+  );
+});
+
+export const tagHead = Effect.fn("tagHead")(function* (
+  label: string,
+  root: string,
+  workflow: string,
+  cuttingWorkflow: string,
+  awaitRelease?: (workflow: string, sha: string) => Effect.Effect<void, { readonly message: string }, ChildProcessSpawner.ChildProcessSpawner>,
+) {
+  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
+  const version = releasedVersionOf(subject);
+  if (version === undefined) {
+    yield* Console.log(`${label}: ${head.slice(0, 12)} is no release commit`);
+    return true;
+  }
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
+  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
+  const tag = `v${version}`;
+  const tagged = yield* taggedOn(root, tag);
+  if (tagged === head) {
+    yield* Console.log(`${label}: ${tag} already tags ${head.slice(0, 12)}`);
+    return true;
+  }
+  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
+  yield* runBuild(root);
+  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
+  if (rebuilt.length > 0) {
+    const since = yield* lastTag(root);
+    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
+    return yield* new TagRefused({
+      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next ${cuttingWorkflow} run cuts the release again with every change since ${since ?? "the first commit"}`,
+    });
+  }
+  yield* pushTag(root, head, tag, workflow);
+  yield* Console.log(`${label}: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
+  if (awaitRelease !== undefined) {
+    yield* awaitRelease(workflow, head);
+    yield* Console.log(`${label}: ${workflow} finished on ${tag}`);
+  }
+  return true;
+});