@avi2dg/checks 0.52.1 → 0.54.0

package/src/delivery/release-commit.ts

@@ -0,0 +1,152 @@
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import * as Base64 from "effect/encoding/Base64";
+import { gitHubJson, REPOSITORY } from "./github.ts";
+import { nextVersion, type Pending, readPending, releaseTitle, runBuild, withVersion } from "./release.ts";
+import { git } from "../core/git.ts";
+
+export class ReleaseRefused extends Schema.TaggedError<ReleaseRefused>()("ReleaseRefused", {
+  message: Schema.String,
+}) {}
+
+type Staged =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Read =
+  | { readonly kind: "written"; readonly path: string; readonly mode: string; readonly content: string }
+  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
+
+type Built = {
+  readonly tree: string;
+  readonly files: readonly Read[];
+};
+
+export const MANIFEST = "package.json";
+const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
+const RAW_ENTRY = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])/;
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+const decodeSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ sha: Schema.String })));
+export const decodeRef = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ ref: Schema.String })));
+
+export function releaseBranchOf(base: string): string {
+  return `release/${base}`;
+}
+
+export function stagedOf(raw: string): readonly Staged[] {
+  const fields = raw.split("\0");
+  const staged: Staged[] = [];
+  for (let index = 0; index + 1 < fields.length; index += 2) {
+    const [, from = "", to = "", status] = RAW_ENTRY.exec(fields[index] ?? "") ?? [];
+    const path = fields[index + 1] ?? "";
+    staged.push(status === "D" ? { kind: "deleted", path, mode: from } : { kind: "written", path, mode: to });
+  }
+  return staged;
+}
+
+export function refused(message: string): ReleaseRefused {
+  return new ReleaseRefused({ message });
+}
+
+export const versionIn = (manifest: string): Effect.Effect<string | undefined> =>
+  decodeVersion(manifest).pipe(
+    Effect.map(({ version }) => version),
+    Effect.orElseSucceed(() => undefined),
+  );
+
+const releaseVersion = Effect.fn("releaseVersion")(function* (manifest: string, { since, unreleased }: Pending, untagged: string) {
+  const { version } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)));
+  if (since !== undefined && since !== `v${version}`) {
+    return yield* refused(
+      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; ${untagged}, or return its version to ${since.slice(1)}`,
+    );
+  }
+  const next = nextVersion(version, unreleased);
+  if (next === undefined) return yield* refused(`${MANIFEST} holds ${version}, which is no plain major.minor.patch version`);
+  const bumped = withVersion(manifest, version, next);
+  if (bumped === undefined || (yield* versionIn(bumped)) !== next) {
+    return yield* refused(`cannot rewrite the version ${version} in ${MANIFEST} as ${next}`);
+  }
+  return { next, bumped };
+});
+
+const currentBranch = Effect.fn("currentBranch")(function* (root: string) {
+  const branch = yield* git(["symbolic-ref", "--quiet", "--short", "HEAD"], root).pipe(
+    Effect.map((name) => name.trim()),
+    Effect.catchTag("GitFailure", () => Effect.succeed("")),
+  );
+  if (branch === "") return yield* refused("HEAD is detached; check out the branch the release goes to");
+  return branch;
+});
+
+export const hasBranch = Effect.fn("hasBranch")(function* (root: string, branch: string) {
+  return (yield* git(["ls-remote", "origin", `refs/heads/${branch}`], root)).trim() !== "";
+});
+
+type Plan = {
+  readonly base: string;
+  readonly branch: string;
+  readonly head: string;
+  readonly next: string;
+  readonly bumped: string;
+};
+
+// Undefined means nothing is unreleased, which it has already said.
+export const planRelease = Effect.fn("planRelease")(function* (label: string, root: string, untagged: string) {
+  const pending = yield* readPending(root);
+  if (pending.unreleased.length === 0) {
+    yield* Console.log(`${label}: no unreleased changes ${pending.since === undefined ? "with no tag yet" : `since ${pending.since}`}`);
+    return undefined;
+  }
+  const base = yield* currentBranch(root);
+  const head = (yield* git(["rev-parse", "HEAD"], root)).trim();
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { next, bumped } = yield* releaseVersion(manifest, pending, untagged);
+  return { base, branch: releaseBranchOf(base), head, next, bumped } satisfies Plan;
+});
+
+const readStaged = Effect.fn("readStaged")(function* (root: string, staged: Staged) {
+  if (staged.kind === "deleted") return staged;
+  if (!REGULAR_FILE_MODES.has(staged.mode)) return yield* refused(`the build wrote ${staged.path} with mode ${staged.mode}, which is no regular file`);
+  const bytes = yield* (yield* FileSystem.FileSystem).readFile((yield* Path.Path).join(root, staged.path));
+  return { ...staged, content: Base64.encode(bytes) };
+});
+
+// The build writes into the working tree, so the tree it starts from has to hold nothing a release would sweep in.
+export const buildRelease = Effect.fn("buildRelease")(function* (name: string, root: string, bumped: string) {
+  if ((yield* git(["status", "--porcelain", "--untracked-files=no"], root)).trim() !== "") {
+    return yield* refused("the working tree has changes to tracked files; the release commits only what the build writes");
+  }
+  const restore = git(["reset", "--quiet", "--hard", "HEAD"], root).pipe(
+    Effect.catchTag("GitFailure", (failure) => Console.error(`${name}: cannot restore the working tree: ${failure.message}`)),
+  );
+  return yield* Effect.gen(function* () {
+    yield* (yield* FileSystem.FileSystem).writeFileString((yield* Path.Path).join(root, MANIFEST), bumped);
+    yield* runBuild(root);
+    yield* git(["add", "--update"], root);
+    const tree = (yield* git(["write-tree"], root)).trim();
+    const staged = stagedOf(yield* git(["diff", "--cached", "--raw", "-z", "--no-renames", "HEAD"], root));
+    return { tree, files: yield* Effect.forEach(staged, (one) => readStaged(root, one)) } satisfies Built;
+  }).pipe(Effect.ensuring(restore));
+});
+
+const treeEntry = Effect.fn("treeEntry")(function* (file: Read) {
+  if (file.kind === "deleted") return { path: file.path, mode: file.mode, type: "blob", sha: null };
+  const { sha } = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/blobs`, { content: file.content, encoding: "base64" });
+  return { path: file.path, mode: file.mode, type: "blob", sha };
+});
+
+export const commitRelease = Effect.fn("commitRelease")(function* (root: string, head: string, built: Built, version: string) {
+  const tree = yield* Effect.forEach(built.files, treeEntry);
+  const baseTree = (yield* git(["rev-parse", `${head}^{tree}`], root)).trim();
+  const made = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/trees`, { base_tree: baseTree, tree });
+  if (made.sha !== built.tree) return yield* refused(`GitHub built the tree ${made.sha}, but the build wrote ${built.tree}`);
+  const commit = { message: releaseTitle(version), tree: made.sha, parents: [head] };
+  return (yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/commits`, commit)).sha;
+});
+
+export const pointBranch = Effect.fn("pointBranch")(function* (branch: string, sha: string, exists: boolean) {
+  yield* exists
+    ? gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${branch}`, { sha, force: true })
+    : gitHubJson(decodeRef, "POST", `${REPOSITORY}/git/refs`, { ref: `refs/heads/${branch}`, sha });
+});

package/src/delivery/release-pr.ts

@@ -1,28 +1,11 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
-import * as Base64 from "effect/encoding/Base64";
+import { Console, Effect, Schema } from "effect";
 import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
-import { nextVersion, type Pending, readPending, releaseTitle, runBuild, withVersion } from "./release.ts";
+import { releaseTitle } from "./release.ts";
+import { buildRelease, commitRelease, hasBranch, MANIFEST, planRelease, pointBranch, versionIn } from "./release-commit.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-class ReleaseRefused extends Schema.TaggedError<ReleaseRefused>()("ReleaseRefused", {
-  message: Schema.String,
-}) {}
-
-type Staged =
-  | { readonly kind: "written"; readonly path: string; readonly mode: string }
-  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
-
-type Read =
-  | { readonly kind: "written"; readonly path: string; readonly mode: string; readonly content: string }
-  | { readonly kind: "deleted"; readonly path: string; readonly mode: string };
-
-type Built = {
-  readonly tree: string;
-  readonly files: readonly Read[];
-};
-
 type Remote = {
   readonly parents: readonly string[];
   readonly version: string | undefined;
@@ -30,68 +13,15 @@ type Remote = {
 
 const NAME = "checks-release-pr";
 const USAGE = "usage: release-pr.ts <workflow>...";
-const MANIFEST = "package.json";
-const REGULAR_FILE_MODES = new Set(["100644", "100755"]);
-const RAW_ENTRY = /^:(\d{6}) (\d{6}) [0-9a-f]+ [0-9a-f]+ ([A-Z])/;
+const UNTAGGED = "rerun the tag job of daily-release on the release commit, whose refusal says what to fix";
 
-const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
-const decodeSha = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ sha: Schema.String })));
-const decodeRef = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ ref: Schema.String })));
 const PullRequest = Schema.Struct({ number: Schema.Int, title: Schema.String, html_url: Schema.String });
 type PullRequest = typeof PullRequest.Type;
 const decodePullRequest = Schema.decodeUnknownEffect(Schema.fromJsonString(PullRequest));
 const decodePullRequests = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Array(PullRequest)));
 
-export function releaseBranchOf(base: string): string {
-  return `release/${base}`;
-}
-
-export function stagedOf(raw: string): readonly Staged[] {
-  const fields = raw.split("\0");
-  const staged: Staged[] = [];
-  for (let index = 0; index + 1 < fields.length; index += 2) {
-    const [, from = "", to = "", status] = RAW_ENTRY.exec(fields[index] ?? "") ?? [];
-    const path = fields[index + 1] ?? "";
-    staged.push(status === "D" ? { kind: "deleted", path, mode: from } : { kind: "written", path, mode: to });
-  }
-  return staged;
-}
-
-const refused = (message: string) => new ReleaseRefused({ message });
-
-const versionIn = (manifest: string) =>
-  decodeVersion(manifest).pipe(
-    Effect.map(({ version }) => version),
-    Effect.orElseSucceed(() => undefined),
-  );
-
-const releaseVersion = Effect.fn("releaseVersion")(function* (manifest: string, { since, unreleased }: Pending) {
-  const { version } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)));
-  if (since !== undefined && since !== `v${version}`) {
-    return yield* refused(
-      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; rerun the tag job of daily-release on the release commit, whose refusal says what to fix, or return its version to ${since.slice(1)}`,
-    );
-  }
-  const next = nextVersion(version, unreleased);
-  if (next === undefined) return yield* refused(`${MANIFEST} holds ${version}, which is no plain major.minor.patch version`);
-  const bumped = withVersion(manifest, version, next);
-  if (bumped === undefined || (yield* versionIn(bumped)) !== next) {
-    return yield* refused(`cannot rewrite the version ${version} in ${MANIFEST} as ${next}`);
-  }
-  return { next, bumped };
-});
-
-const currentBranch = Effect.fn("currentBranch")(function* (root: string) {
-  const branch = yield* git(["symbolic-ref", "--quiet", "--short", "HEAD"], root).pipe(
-    Effect.map((name) => name.trim()),
-    Effect.catchTag("GitFailure", () => Effect.succeed("")),
-  );
-  if (branch === "") return yield* refused("HEAD is detached; check out the branch the release goes to");
-  return branch;
-});
-
 const readRemote = Effect.fn("readRemote")(function* (root: string, branch: string) {
-  if ((yield* git(["ls-remote", "origin", `refs/heads/${branch}`], root)).trim() === "") return undefined;
+  if (!(yield* hasBranch(root, branch))) return undefined;
   const tracking = `refs/remotes/origin/${branch}`;
   yield* git(["fetch", "--quiet", "--no-tags", "origin", `+refs/heads/${branch}:${tracking}`], root);
   const [, ...parents] = (yield* git(["rev-list", "--parents", "-n", "1", tracking], root)).trim().split(" ");
@@ -102,52 +32,6 @@ const readRemote = Effect.fn("readRemote")(function* (root: string, branch: stri
   return { parents, version } satisfies Remote;
 });
 
-const readStaged = Effect.fn("readStaged")(function* (root: string, staged: Staged) {
-  if (staged.kind === "deleted") return staged;
-  if (!REGULAR_FILE_MODES.has(staged.mode)) return yield* refused(`the build wrote ${staged.path} with mode ${staged.mode}, which is no regular file`);
-  const bytes = yield* (yield* FileSystem.FileSystem).readFile((yield* Path.Path).join(root, staged.path));
-  return { ...staged, content: Base64.encode(bytes) };
-});
-
-// The build writes into the working tree, so the tree it starts from has to hold nothing a release would sweep in.
-const buildRelease = Effect.fn("buildRelease")(function* (root: string, bumped: string) {
-  if ((yield* git(["status", "--porcelain", "--untracked-files=no"], root)).trim() !== "") {
-    return yield* refused("the working tree has changes to tracked files; the release commits only what the build writes");
-  }
-  const restore = git(["reset", "--quiet", "--hard", "HEAD"], root).pipe(
-    Effect.catchTag("GitFailure", (failure) => Console.error(`${NAME}: cannot restore the working tree: ${failure.message}`)),
-  );
-  return yield* Effect.gen(function* () {
-    yield* (yield* FileSystem.FileSystem).writeFileString((yield* Path.Path).join(root, MANIFEST), bumped);
-    yield* runBuild(root);
-    yield* git(["add", "--update"], root);
-    const tree = (yield* git(["write-tree"], root)).trim();
-    const staged = stagedOf(yield* git(["diff", "--cached", "--raw", "-z", "--no-renames", "HEAD"], root));
-    return { tree, files: yield* Effect.forEach(staged, (one) => readStaged(root, one)) } satisfies Built;
-  }).pipe(Effect.ensuring(restore));
-});
-
-const treeEntry = Effect.fn("treeEntry")(function* (file: Read) {
-  if (file.kind === "deleted") return { path: file.path, mode: file.mode, type: "blob", sha: null };
-  const { sha } = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/blobs`, { content: file.content, encoding: "base64" });
-  return { path: file.path, mode: file.mode, type: "blob", sha };
-});
-
-const commitRelease = Effect.fn("commitRelease")(function* (root: string, head: string, built: Built, version: string) {
-  const tree = yield* Effect.forEach(built.files, treeEntry);
-  const baseTree = (yield* git(["rev-parse", `${head}^{tree}`], root)).trim();
-  const made = yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/trees`, { base_tree: baseTree, tree });
-  if (made.sha !== built.tree) return yield* refused(`GitHub built the tree ${made.sha}, but the build wrote ${built.tree}`);
-  const commit = { message: releaseTitle(version), tree: made.sha, parents: [head] };
-  return (yield* gitHubJson(decodeSha, "POST", `${REPOSITORY}/git/commits`, commit)).sha;
-});
-
-const pointBranch = Effect.fn("pointBranch")(function* (branch: string, sha: string, exists: boolean) {
-  yield* exists
-    ? gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${branch}`, { sha, force: true })
-    : gitHubJson(decodeRef, "POST", `${REPOSITORY}/git/refs`, { ref: `refs/heads/${branch}`, sha });
-});
-
 const findOpen = Effect.fn("findOpen")(function* (base: string, branch: string) {
   const query = `head={owner}:${encodeURIComponent(branch)}&base=${encodeURIComponent(base)}&state=open`;
   const [open] = yield* gitHubJson(decodePullRequests, "GET", `${REPOSITORY}/pulls?${query}`);
@@ -169,16 +53,9 @@ const releasePullRequest = Effect.gen(function* () {
   const workflows = process.argv.slice(2);
   if (workflows.length === 0) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const pending = yield* readPending(root);
-  if (pending.unreleased.length === 0) {
-    yield* Console.log(`release-pr: no unreleased changes ${pending.since === undefined ? "with no tag yet" : `since ${pending.since}`}`);
-    return true;
-  }
-  const base = yield* currentBranch(root);
-  const branch = releaseBranchOf(base);
-  const head = (yield* git(["rev-parse", "HEAD"], root)).trim();
-  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
-  const { next, bumped } = yield* releaseVersion(manifest, pending);
+  const plan = yield* planRelease("release-pr", root, UNTAGGED);
+  if (plan === undefined) return true;
+  const { base, branch, head, next, bumped } = plan;
   const remote = yield* readRemote(root, branch);
   const current = remote?.version === next && remote.parents.length === 1 && remote.parents[0] === head;
   const open = yield* findOpen(base, branch);
@@ -186,7 +63,7 @@ const releasePullRequest = Effect.gen(function* () {
     yield* Console.log(`release-pr: ${open.html_url} releases ${next} from ${head.slice(0, 12)} and is current`);
     return true;
   }
-  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(root, bumped), next), remote !== undefined);
+  if (!current) yield* pointBranch(branch, yield* commitRelease(root, head, yield* buildRelease(NAME, root, bumped), next), remote !== undefined);
   const { verb, url } = yield* titlePullRequest(open, base, branch, next);
   yield* Effect.forEach(workflows, (workflow) => dispatch(workflow, branch));
   yield* Console.log(`release-pr: ${verb} ${url} to release ${next}, and dispatched ${workflows.join(", ")} on ${branch}`);

package/src/delivery/release-preflight.ts

@@ -0,0 +1,177 @@
+#!/usr/bin/env bun
+import { Config, Console, Effect, FileSystem, Option, Path, Schema } from "effect";
+import { lastTag } from "./release.ts";
+import { refused } from "./release-commit.ts";
+import { fromProgram, shellWords, type Command } from "./shell-command.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+const LABEL = "release-preflight";
+const USAGE = "usage: release-preflight.ts <release-workflow>";
+const MANIFEST = "package.json";
+const WORKFLOWS = ".github/workflows";
+
+const Manifest = Schema.Struct({
+  name: Schema.String,
+  version: Schema.String,
+  repository: Schema.optional(Schema.Union([Schema.String, Schema.Struct({ url: Schema.optional(Schema.String) })])),
+});
+
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Manifest));
+
+const GITHUB_HTTPS = /^(?:git\+)?https:\/\/github\.com\/([^/]+?)\/([^/]+?)(?:\.git)?\/?$/;
+const GITHUB_SCP = /^git@github\.com:([^/]+?)\/([^/]+?)(?:\.git)?\/?$/;
+
+export function ownerRepoOf(url: string): string | undefined {
+  const match = GITHUB_HTTPS.exec(url) ?? GITHUB_SCP.exec(url);
+  return match === null ? undefined : `${match[1]}/${match[2]}`;
+}
+
+const PUBLISH_BINS = ["checks-release-publish"];
+const PUBLISH_SOURCES = ["release-publish.ts"];
+
+function isPublishPath(word: string, files: readonly string[]): boolean {
+  return files.some((file) => word === file || word.endsWith(`/${file}`));
+}
+
+function publishesInvocation(words: Command): boolean {
+  const [head = "", ...rest] = fromProgram(words);
+  if (head === "npm" && rest[0] === "publish") return true;
+  if (isPublishPath(head, PUBLISH_BINS)) return true;
+  return head === "bun" && rest.some((word) => isPublishPath(word, PUBLISH_SOURCES));
+}
+
+export function publishesToNpm(command: string): boolean {
+  return shellWords(command).some((words) => publishesInvocation(words.map(({ text }) => text)));
+}
+
+const FlexiblePermissions = Schema.Union([Schema.String, Schema.Record(Schema.String, Schema.Unknown)]);
+type FlexiblePermissions = typeof FlexiblePermissions.Type;
+
+const WorkflowDocument = Schema.Struct({
+  permissions: Schema.optional(FlexiblePermissions),
+  jobs: Schema.optional(Schema.Record(Schema.String, Schema.Unknown)),
+});
+const StepDocument = Schema.Struct({ run: Schema.optional(Schema.String) });
+const JobDocument = Schema.Struct({
+  permissions: Schema.optional(FlexiblePermissions),
+  steps: Schema.optional(Schema.Array(Schema.Unknown)),
+});
+
+const decodeDocument = Schema.decodeUnknownOption(WorkflowDocument);
+const decodeJob = Schema.decodeUnknownOption(JobDocument);
+const decodeStep = Schema.decodeUnknownOption(StepDocument);
+
+function grantsOidcValue(permissions: FlexiblePermissions | undefined): boolean {
+  return permissions === "write-all" || (typeof permissions === "object" && permissions["id-token"] === "write");
+}
+
+function runsOf(job: unknown): string[] {
+  const decoded = decodeJob(job);
+  if (Option.isNone(decoded) || decoded.value.steps === undefined) return [];
+  return decoded.value.steps.flatMap((step) => {
+    const decodedStep = decodeStep(step);
+    return Option.isNone(decodedStep) || decodedStep.value.run === undefined ? [] : [decodedStep.value.run];
+  });
+}
+
+function jobPublishes(job: unknown): boolean {
+  return runsOf(job).some(publishesToNpm);
+}
+
+function documentPublishes(document: unknown): boolean {
+  const decoded = decodeDocument(document);
+  if (Option.isNone(decoded) || decoded.value.jobs === undefined) return false;
+  return Object.values(decoded.value.jobs).some(jobPublishes);
+}
+
+export function grantsOidc(document: unknown): boolean {
+  const decoded = decodeDocument(document);
+  if (Option.isNone(decoded)) return false;
+  const jobs = decoded.value.jobs;
+  if (jobs === undefined) return false;
+  const publishing = Object.values(jobs).filter(jobPublishes);
+  if (publishing.length === 0) return false;
+  return publishing.every((job) => {
+    const decodedJob = decodeJob(job);
+    if (Option.isNone(decodedJob)) return false;
+    const own = decodedJob.value.permissions;
+    return grantsOidcValue(own === undefined ? decoded.value.permissions : own);
+  });
+}
+
+const readManifest = Effect.fn("readManifest")(function* (root: string) {
+  const file = (yield* Path.Path).join(root, MANIFEST);
+  return yield* (yield* FileSystem.FileSystem).readFileString(file).pipe(
+    Effect.flatMap(decodeManifest),
+    Effect.mapError((cause) => refused(`${MANIFEST}: ${cause.message}`)),
+  );
+});
+
+const checkTag = Effect.fn("checkTag")(function* (root: string) {
+  if ((yield* git(["rev-parse", "--is-shallow-repository"], root)).trim() === "true") {
+    return yield* refused("the checkout is shallow, so the tag it sees may not be the last one; fetch all of it");
+  }
+  const { version } = yield* readManifest(root);
+  const since = yield* lastTag(root);
+  if (since !== undefined && since !== `v${version}`) {
+    return yield* refused(
+      `${MANIFEST} holds ${version}, but the last release tag is ${since}, so v${version} is untagged; rerun the release that bumped it, whose refusal says what to fix, or return ${MANIFEST} to ${since.slice(1)}`,
+    );
+  }
+  yield* Console.log(`${LABEL}: ${MANIFEST} holds ${version}, which ${since === undefined ? "has no release tag yet" : `matches ${since}`}`);
+});
+
+const checkPublisher = Effect.fn("checkPublisher")(function* (root: string, workflow: string) {
+  const path = (yield* Path.Path).join(root, WORKFLOWS, workflow);
+  const text = yield* (yield* FileSystem.FileSystem).readFileString(path).pipe(
+    Effect.mapError(() => refused(`${WORKFLOWS}/${workflow} is missing, so the run cannot show the prerequisites npm's trusted publisher needs`)),
+  );
+  const document = yield* Effect.try({
+    try: () => Bun.YAML.parse(text),
+    catch: () => refused(`${WORKFLOWS}/${workflow} does not parse, so the run cannot show the prerequisites npm's trusted publisher needs`),
+  });
+  if (!documentPublishes(document)) {
+    yield* Console.log(`${LABEL}: ${workflow} publishes nothing to npm, so no trusted publisher has to match`);
+    return;
+  }
+  const repository = yield* Config.String("GITHUB_REPOSITORY").pipe(Config.withDefault(""));
+  if (repository === "") return yield* refused("GITHUB_REPOSITORY is not set, so the run has no repository to match; run this in the release workflow");
+  const { name, repository: field } = yield* readManifest(root);
+  const raw = typeof field === "string" ? field : field?.url;
+  if (raw === undefined) {
+    return yield* refused(
+      `${MANIFEST} has no repository, so the run holds no repository for npm's trusted publisher to allow; point repository.url at ${repository}`,
+    );
+  }
+  const held = ownerRepoOf(raw);
+  if (held === undefined) {
+    return yield* refused(
+      `${MANIFEST} names the repository ${raw}, which is no GitHub owner and name, so the run holds no repository for npm's trusted publisher to allow; point repository.url at ${repository}`,
+    );
+  }
+  if (held.toLowerCase() !== repository.toLowerCase()) {
+    return yield* refused(
+      `${MANIFEST} names the repository ${held}, but the run is in ${repository}, so the run cannot present npm's trusted publisher for ${name}; point repository.url at ${repository}, the repository the run publishes from`,
+    );
+  }
+  if (!grantsOidc(document)) {
+    return yield* refused(
+      `${WORKFLOWS}/${workflow} grants the publishing job no id-token: write, so the run mints no OIDC token for npm's trusted publisher; grant id-token: write where the release job runs`,
+    );
+  }
+  yield* Console.log(
+    `${LABEL}: ${MANIFEST} names ${repository} and ${workflow} grants the publishing job id-token: write, so the run holds the prerequisites for npm's trusted publisher for ${name}`,
+  );
+});
+
+const releasePreflight = Effect.gen(function* () {
+  const [workflow, ...extra] = process.argv.slice(2);
+  if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  yield* checkTag(root);
+  yield* checkPublisher(root, workflow);
+  return true;
+});
+
+if (import.meta.main) runMain("checks-release-preflight", releasePreflight);

package/src/delivery/release-publish.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env bun
+import { Console, Effect, FileSystem, Option, Schema } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+import { collect } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+const NAME = "checks-release-publish";
+const LABEL = "release-publish";
+const USAGE = "usage: release-publish.ts";
+const MANIFEST = "package.json";
+
+class PublishFailed extends Schema.TaggedError<PublishFailed>()("PublishFailed", {
+  message: Schema.String,
+}) {}
+
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ name: Schema.String, version: Schema.String })));
+const decodeTags = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ latest: Schema.String })));
+const decodeMissing = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Struct({ error: Schema.Struct({ code: Schema.Literal("E404") }) })));
+
+type Standing = "unpublished" | "published" | "superseded";
+
+// npm refuses to move `latest` back to a lower version, so a version below it can only stay off npm.
+function standingOf(version: string, latest: string | undefined): Standing {
+  if (latest === undefined) return "unpublished";
+  const order = Bun.semver.order(version, latest);
+  if (order === 0) return "published";
+  return order < 0 ? "superseded" : "unpublished";
+}
+
+const latestOnNpm = Effect.fn("latestOnNpm")(function* (name: string) {
+  const failed = (reason: string) => new PublishFailed({ message: `npm view ${name} dist-tags: ${reason.trim()}` });
+  const { stdout, stderr, exitCode } = yield* collect("npm", ["view", name, "dist-tags", "--json"]).pipe(Effect.mapError((cause) => failed(cause.message)));
+  if (exitCode !== ChildProcessSpawner.ExitCode(0)) return Option.isSome(decodeMissing(stdout)) ? undefined : yield* failed(stderr);
+  return (yield* decodeTags(stdout).pipe(Effect.mapError((cause) => failed(cause.message)))).latest;
+});
+
+const npmPublish = Effect.fn("npmPublish")(
+  function* () {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const handle = yield* spawner.spawn(ChildProcess.make("npm", ["publish"], { stdin: "ignore", stdout: "inherit", stderr: "inherit" }));
+    return (yield* handle.exitCode) === ChildProcessSpawner.ExitCode(0);
+  },
+  Effect.scoped,
+);
+
+const settled = (name: string, version: string, standing: Standing, latest: string | undefined): string =>
+  standing === "published"
+    ? `${LABEL}: npm already holds ${name}@${version}`
+    : `${LABEL}: npm already holds ${name}@${latest ?? ""}, which carries every change in ${version}, so ${version} stays off npm`;
+
+const releasePublish = Effect.gen(function* () {
+  if (process.argv.length > 2) return yield* new Usage({ message: USAGE });
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString(MANIFEST);
+  const { name, version } = yield* decodeManifest(manifest).pipe(Effect.mapError((cause) => new PublishFailed({ message: `${MANIFEST}: ${cause.message}` })));
+  const before = yield* latestOnNpm(name);
+  const standing = standingOf(version, before);
+  if (standing !== "unpublished") {
+    yield* Console.log(settled(name, version, standing, before));
+    return true;
+  }
+  if (yield* npmPublish()) {
+    yield* Console.log(`${LABEL}: published ${name}@${version}`);
+    return true;
+  }
+  // A release that published while this one ran makes npm refuse it, which leaves nothing to publish.
+  const after = yield* latestOnNpm(name);
+  const now = standingOf(version, after);
+  if (now === "unpublished") return yield* new PublishFailed({ message: `npm publish refused ${name}@${version}` });
+  yield* Console.log(settled(name, version, now, after));
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePublish);