@avi2dg/checks 0.52.1 → 0.54.0

package/src/delivery/release-push.ts

@@ -0,0 +1,148 @@
+#!/usr/bin/env bun
+import { Console, Duration, Effect, Schema } from "effect";
+import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
+import { releasedVersionOf } from "./release.ts";
+import { buildRelease, commitRelease, decodeRef, hasBranch, planRelease, pointBranch, refused } from "./release-commit.ts";
+import { pushTag, tagHead, taggedOn } from "./release-tagging.ts";
+import { git } from "../core/git.ts";
+import { runMain, Usage } from "../core/main.ts";
+
+const NAME = "checks-release-push";
+const LABEL = "release-push";
+const USAGE = "usage: release-push.ts <release-workflow> <workflow>...";
+const UNTAGGED = "tag the release commit with checks-release-tag, whose refusal says what to fix";
+const POLL = Duration.seconds(15);
+const POLLS = 180;
+
+const Run = Schema.Struct({ path: Schema.String, status: Schema.String, conclusion: Schema.NullOr(Schema.String), html_url: Schema.String });
+type Run = typeof Run.Type;
+const decodeRuns = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ workflow_runs: Schema.Array(Run) })));
+
+export type Verdict =
+  | { readonly kind: "pending"; readonly waiting: readonly string[] }
+  | { readonly kind: "passed" }
+  | { readonly kind: "failed"; readonly failed: readonly string[] };
+
+// GitHub lists the newest run first, so a rerun stands in for the run it repeats.
+export function verdictOf(workflows: readonly string[], runs: readonly Run[]): Verdict {
+  const latest = workflows.map((workflow) => {
+    const path = `.github/workflows/${workflow}`;
+    return { workflow, run: runs.find((run) => run.path === path || run.path.startsWith(`${path}@`)) };
+  });
+  const failed = latest.flatMap(({ workflow, run }) =>
+    run?.status === "completed" && run.conclusion !== "success" ? [`${workflow} concluded ${run.conclusion ?? "with no conclusion"} at ${run.html_url}`] : [],
+  );
+  if (failed.length > 0) return { kind: "failed", failed };
+  const waiting = latest.flatMap(({ workflow, run }) => (run?.status === "completed" ? [] : [workflow]));
+  return waiting.length > 0 ? { kind: "pending", waiting } : { kind: "passed" };
+}
+
+const POLL_FAILURES = 4;
+
+const awaitWorkflows = Effect.fn("awaitWorkflows")(function* (
+  workflows: readonly string[],
+  sha: string,
+  failed: (failed: readonly string[]) => string,
+  unfinished: (waiting: readonly string[]) => string,
+) {
+  const runs = `${REPOSITORY}/actions/runs?head_sha=${sha}&event=workflow_dispatch&per_page=100`;
+  let waiting = workflows;
+  let failures = 0;
+  for (let poll = 1; poll <= POLLS; poll += 1) {
+    const read = yield* gitHubJson(decodeRuns, "GET", runs).pipe(
+      Effect.map((decoded) => ({ done: true as const, runs: decoded.workflow_runs })),
+      Effect.catchTag("GitHubFailure", (failure) =>
+        failures + 1 >= POLL_FAILURES ? Effect.fail(failure) : Effect.succeed({ done: false as const }),
+      ),
+    );
+    if (!read.done) {
+      failures += 1;
+      yield* Effect.sleep(POLL);
+      continue;
+    }
+    failures = 0;
+    const verdict = verdictOf(workflows, read.runs);
+    if (verdict.kind === "passed") return;
+    if (verdict.kind === "failed") return yield* refused(failed(verdict.failed));
+    waiting = verdict.waiting;
+    yield* Effect.sleep(POLL);
+  }
+  return yield* refused(unfinished(waiting));
+});
+
+const awaitChecks = Effect.fn("awaitChecks")(function* (workflows: readonly string[], sha: string) {
+  return yield* awaitWorkflows(
+    workflows,
+    sha,
+    (failed) => `the checks failed on ${sha.slice(0, 12)}, so the release stays off the branch: ${failed.join(", ")}`,
+    (waiting) => `${waiting.join(", ")} did not finish on ${sha.slice(0, 12)} within ${Duration.format(Duration.times(POLL, POLLS))}, so the release stays off the branch`,
+  );
+});
+
+const awaitReleaseWorkflow = Effect.fn("awaitReleaseWorkflow")(function* (workflow: string, sha: string) {
+  return yield* awaitWorkflows(
+    [workflow],
+    sha,
+    (failed) => `the release workflow failed on ${sha.slice(0, 12)}: ${failed.join(", ")}`,
+    () => `${workflow} did not finish on ${sha.slice(0, 12)} within ${Duration.format(Duration.times(POLL, POLLS))}, though the branch already holds the release and the tag exists`,
+  );
+});
+
+type Landing = "landed" | "moved";
+
+// GitHub refuses a branch update that is no fast-forward, which is how a branch that moved during the checks shows.
+// A failed call may still have applied the update, so the branch's head decides what happened.
+const land = Effect.fn("land")(function* (root: string, base: string, head: string, release: string) {
+  return yield* gitHubJson(decodeRef, "PATCH", `${REPOSITORY}/git/refs/heads/${base}`, { sha: release, force: false }).pipe(
+    Effect.as<Landing>("landed"),
+    Effect.catchTag("GitHubFailure", (failure) =>
+      git(["ls-remote", "origin", `refs/heads/${base}`], root).pipe(
+        Effect.flatMap((listed) =>
+          Effect.gen(function* () {
+            const now = listed.split("\t")[0];
+            if (now === release) return "landed";
+            if (now === head) return yield* Effect.fail(failure);
+            yield* git(["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${base}`], root);
+            const ancestor = yield* git(["merge-base", "--is-ancestor", release, "FETCH_HEAD"], root).pipe(
+              Effect.as(true),
+              Effect.catchTag("GitFailure", () => Effect.succeed(false)),
+            );
+            return ancestor ? "landed" : "moved";
+          }),
+        ),
+      ),
+    ),
+  );
+});
+
+const releasePush = Effect.gen(function* () {
+  const [publish, ...checks] = process.argv.slice(2);
+  if (publish === undefined || checks.length === 0) return yield* new Usage({ message: USAGE });
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  if (releasedVersionOf((yield* git(["log", "-1", "--format=%s", "HEAD"], root)).trim()) !== undefined)
+    return yield* tagHead(LABEL, root, publish, LABEL, awaitReleaseWorkflow);
+  const plan = yield* planRelease(LABEL, root, UNTAGGED);
+  if (plan === undefined) return true;
+  const { base, branch, head, next, bumped } = plan;
+  const tag = `v${next}`;
+  const taken = yield* taggedOn(root, tag);
+  if (taken !== undefined) return yield* refused(`${tag} already tags ${taken.slice(0, 12)}, so ${next} cannot be released again`);
+  const release = yield* commitRelease(root, head, yield* buildRelease(NAME, root, bumped), next);
+  yield* pointBranch(branch, release, yield* hasBranch(root, branch));
+  yield* Effect.forEach(checks, (workflow) => dispatch(workflow, branch));
+  yield* Console.log(`${LABEL}: dispatched ${checks.join(", ")} on ${branch} to check ${next} at ${release.slice(0, 12)}`);
+  yield* awaitChecks(checks, release);
+  if ((yield* land(root, base, head, release)) === "moved") {
+    yield* Console.log(`${LABEL}: ${base} moved past ${head.slice(0, 12)} while the checks ran, so the run on its new head releases it`);
+    return true;
+  }
+  // The release commit exists only on GitHub, and pushing the tag needs it in the checkout.
+  yield* git(["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${base}`], root);
+  yield* pushTag(root, release, tag, publish);
+  yield* Console.log(`${LABEL}: released ${next} as ${release.slice(0, 12)} on ${base}, tagged it ${tag}, and dispatched ${publish} on it`);
+  yield* awaitReleaseWorkflow(publish, release);
+  yield* Console.log(`${LABEL}: ${publish} finished on ${tag}`);
+  return true;
+});
+
+if (import.meta.main) runMain(NAME, releasePush);

package/src/delivery/release-tag.ts

@@ -1,64 +1,15 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
-import { dispatch, GitHubFailure } from "./github.ts";
-import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { Effect } from "effect";
+import { tagHead } from "./release-tagging.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
 
-class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
-  message: Schema.String,
-}) {}
-
-const NAME = "checks-release-tag";
 const USAGE = "usage: release-tag.ts <workflow>";
-const MANIFEST = "package.json";
-
-const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
-
-// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
-export function taggedCommitOf(listed: string): string | undefined {
-  const lines = listed.split("\n").filter((line) => line !== "");
-  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
-  return peeled?.split("\t")[0];
-}
 
 const releaseTag = Effect.gen(function* () {
   const [workflow, ...extra] = process.argv.slice(2);
   if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
-  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
-  const version = releasedVersionOf(subject);
-  if (version === undefined) {
-    yield* Console.log(`release-tag: ${head.slice(0, 12)} is no release commit`);
-    return true;
-  }
-  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
-  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
-  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
-  const tag = `v${version}`;
-  const tagged = taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
-  if (tagged === head) {
-    yield* Console.log(`release-tag: ${tag} already tags ${head.slice(0, 12)}`);
-    return true;
-  }
-  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
-  yield* runBuild(root);
-  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
-  if (rebuilt.length > 0) {
-    const since = yield* lastTag(root);
-    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
-    return yield* new TagRefused({
-      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next daily-release run cuts the release again with every change since ${since ?? "the first commit"}`,
-    });
-  }
-  yield* git(["push", "--quiet", "origin", `${head}:refs/tags/${tag}`], root);
-  yield* dispatch(workflow, tag).pipe(
-    Effect.mapError(
-      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
-    ),
-  );
-  yield* Console.log(`release-tag: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
-  return true;
+  return yield* tagHead("release-tag", (yield* git(["rev-parse", "--show-toplevel"])).trim(), workflow, "daily-release");
 });
 
-if (import.meta.main) runMain(NAME, releaseTag);
+if (import.meta.main) runMain("checks-release-tag", releaseTag);

package/src/delivery/release-tagging.ts

@@ -0,0 +1,74 @@
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { dispatch, GitHubFailure } from "./github.ts";
+import { ChildProcessSpawner } from "effect/process";
+import { lastTag, releasedVersionOf, runBuild } from "./release.ts";
+import { git } from "../core/git.ts";
+
+class TagRefused extends Schema.TaggedError<TagRefused>()("TagRefused", {
+  message: Schema.String,
+}) {}
+
+const MANIFEST = "package.json";
+
+const decodeVersion = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ version: Schema.String })));
+
+// An annotated tag lists its own object first and the commit it tags on a `^{}` line after it.
+export function taggedCommitOf(listed: string): string | undefined {
+  const lines = listed.split("\n").filter((line) => line !== "");
+  const peeled = lines.find((line) => line.endsWith("^{}")) ?? lines[0];
+  return peeled?.split("\t")[0];
+}
+
+export const taggedOn = Effect.fn("taggedOn")(function* (root: string, tag: string) {
+  return taggedCommitOf(yield* git(["ls-remote", "--tags", "origin", `refs/tags/${tag}`, `refs/tags/${tag}^{}`], root));
+});
+
+export const pushTag = Effect.fn("pushTag")(function* (root: string, sha: string, tag: string, workflow: string) {
+  yield* git(["push", "--quiet", "origin", `${sha}:refs/tags/${tag}`], root);
+  yield* dispatch(workflow, tag).pipe(
+    Effect.mapError(
+      (failure) => new GitHubFailure({ message: `${failure.message}; ${tag} is pushed, so dispatch the release by hand with \`gh workflow run ${workflow} --ref ${tag}\`` }),
+    ),
+  );
+});
+
+export const tagHead = Effect.fn("tagHead")(function* (
+  label: string,
+  root: string,
+  workflow: string,
+  cuttingWorkflow: string,
+  awaitRelease?: (workflow: string, sha: string) => Effect.Effect<void, { readonly message: string }, ChildProcessSpawner.ChildProcessSpawner>,
+) {
+  const [head = "", subject = ""] = (yield* git(["log", "-1", "--format=%H%n%s", "HEAD"], root)).split("\n");
+  const version = releasedVersionOf(subject);
+  if (version === undefined) {
+    yield* Console.log(`${label}: ${head.slice(0, 12)} is no release commit`);
+    return true;
+  }
+  const manifest = yield* (yield* FileSystem.FileSystem).readFileString((yield* Path.Path).join(root, MANIFEST));
+  const { version: held } = yield* decodeVersion(manifest).pipe(Effect.mapError((cause) => new TagRefused({ message: `${MANIFEST}: ${cause.message}` })));
+  if (held !== version) return yield* new TagRefused({ message: `${head.slice(0, 12)} releases ${version}, but ${MANIFEST} holds ${held}` });
+  const tag = `v${version}`;
+  const tagged = yield* taggedOn(root, tag);
+  if (tagged === head) {
+    yield* Console.log(`${label}: ${tag} already tags ${head.slice(0, 12)}`);
+    return true;
+  }
+  if (tagged !== undefined) return yield* new TagRefused({ message: `${tag} already tags ${tagged.slice(0, 12)}, not ${head.slice(0, 12)}` });
+  yield* runBuild(root);
+  const rebuilt = (yield* git(["diff", "--name-only"], root)).trim().split("\n").filter((file) => file !== "");
+  if (rebuilt.length > 0) {
+    const since = yield* lastTag(root);
+    const returned = since === undefined ? "the version it held before this release" : since.slice(1);
+    return yield* new TagRefused({
+      message: `the build rewrites ${rebuilt.join(", ")} at ${head.slice(0, 12)}, which the release workflow's build check refuses; open a \`chore: cancel the unpublished ${version}\` pull request that returns ${MANIFEST} to ${returned} and commits what \`bun run build\` then writes to CHANGELOG.md, and the next ${cuttingWorkflow} run cuts the release again with every change since ${since ?? "the first commit"}`,
+    });
+  }
+  yield* pushTag(root, head, tag, workflow);
+  yield* Console.log(`${label}: tagged ${head.slice(0, 12)} as ${tag}, and dispatched ${workflow} on it`);
+  if (awaitRelease !== undefined) {
+    yield* awaitRelease(workflow, head);
+    yield* Console.log(`${label}: ${workflow} finished on ${tag}`);
+  }
+  return true;
+});

package/src/delivery/secrets-pack.ts

@@ -0,0 +1,133 @@
+import { Config, ConfigProvider, Effect, FileSystem, Option, Path, Predicate, Schema } from "effect";
+
+const PACK_VARIABLE = "CHECKS_SECRETS_PACK";
+
+const OCTET_BITS = 8;
+const OCTET_VALUES = 256;
+const ADDRESS_BITS = 32;
+const ANY_OCTET = "(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])";
+const IPV4_RANGE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,2}))?$/;
+
+class PackUnreadable extends Schema.TaggedError<PackUnreadable>()("PackUnreadable", {
+  message: Schema.String,
+}) {}
+
+type Ipv4Range = { readonly octets: readonly number[]; readonly prefix: number };
+
+function ipv4RangeOf(text: string): Option.Option<Ipv4Range> {
+  const match = IPV4_RANGE.exec(text);
+  if (match === null) return Option.none();
+  const [, ...groups] = match;
+  const octets = groups.slice(0, 4).map(Number);
+  const prefix = groups[4] === undefined ? ADDRESS_BITS : Number(groups[4]);
+  if (octets.some((octet) => octet >= OCTET_VALUES) || prefix > ADDRESS_BITS) return Option.none();
+  return Option.some({ octets, prefix });
+}
+
+// A term reaches gitleaks inside a TOML string, which refuses a raw control character.
+const Term = Schema.String.check(Schema.makeFilter((term: string) => (/\S/.test(term) && !/\p{Cc}/u.test(term)) || "is blank or holds a control character"));
+
+const IpRange = Schema.String.check(Schema.makeFilter((text: string) => Option.isSome(ipv4RangeOf(text)) || "is not an IPv4 address or CIDR range"));
+
+const Terms = Schema.optionalKey(Schema.Array(Term));
+
+const Pack = Schema.Struct({
+  names: Terms,
+  domains: Terms,
+  hosts: Terms,
+  runners: Terms,
+  ipRanges: Schema.optionalKey(Schema.Array(IpRange)),
+});
+
+type Pack = typeof Pack.Type;
+
+const decodePack = Schema.decodeUnknownEffect(Schema.fromJsonString(Pack));
+
+type Rule = { readonly id: string; readonly description: string };
+
+const TERM_RULES = [
+  ["names", { id: "private-name", description: "A name form the private pack lists" }],
+  ["domains", { id: "private-domain", description: "A domain the private pack lists" }],
+  ["hosts", { id: "private-host", description: "A host name the private pack lists" }],
+  ["runners", { id: "private-runner", description: "A runner name the private pack lists" }],
+] as const satisfies readonly (readonly [Exclude<keyof Pack, "ipRanges">, Rule])[];
+
+const IP_RANGE_RULE: Rule = { id: "private-ip-range", description: "An address in an IP range the private pack lists" };
+
+function escaped(text: string): string {
+  return text.replace(/[\\^$.*+?()[\]{}|/]/g, "\\$&");
+}
+
+// RE2's \b is an ASCII word boundary, so it never holds beside a non-ASCII letter or a symbol.
+function boundaryAt(character: string | undefined): string {
+  return character !== undefined && /\w/.test(character) ? "\\b" : "";
+}
+
+function termPattern(term: string): string {
+  const trimmed = term.trim();
+  return `${boundaryAt(trimmed[0])}${trimmed.split(/[\s\p{Zs}]+/u).map(escaped).join("[\\s\\p{Zs}]+")}${boundaryAt(trimmed.at(-1))}`;
+}
+
+function octetPattern(octet: number, fixedBits: number): string {
+  if (fixedBits === OCTET_BITS) return String(octet);
+  if (fixedBits === 0) return ANY_OCTET;
+  const span = 2 ** (OCTET_BITS - fixedBits);
+  const low = octet - (octet % span);
+  return `(?:${Array.from({ length: span }, (_, step) => String(low + step)).join("|")})`;
+}
+
+function ipRangePattern({ octets, prefix }: Ipv4Range): string {
+  const fixedBits = (index: number) => Math.max(0, Math.min(OCTET_BITS, prefix - index * OCTET_BITS));
+  return `\\b${octets.map((octet, index) => octetPattern(octet, fixedBits(index))).join("\\.")}\\b`;
+}
+
+// JSON writes each string as a TOML basic string reads it, escapes included.
+function ruleToml({ id, description }: Rule, patterns: readonly string[]): readonly string[] {
+  if (patterns.length === 0) return [];
+  const regex = `(?i)(?:${patterns.join("|")})`;
+  return [["[[rules]]", `id = ${JSON.stringify(id)}`, `description = ${JSON.stringify(description)}`, `regex = ${JSON.stringify(regex)}`].join("\n")];
+}
+
+function packRules(pack: Pack): string {
+  const ranges = (pack.ipRanges ?? []).flatMap((text) => Option.toArray(ipv4RangeOf(text)));
+  return [
+    ...TERM_RULES.flatMap(([kind, rule]) => ruleToml(rule, (pack[kind] ?? []).map(termPattern))),
+    ...ruleToml(IP_RANGE_RULE, ranges.map(ipRangePattern)),
+  ].join("\n\n");
+}
+
+// The path can carry a user name and the pack carries the terms, so no message here names either.
+const packRulesAt = Effect.fn("packRulesAt")(function* (file: string) {
+  const unreadable = (why: string) => new PackUnreadable({ message: `the private pack ${PACK_VARIABLE} names ${why}, so the gate cannot scan for its terms` });
+  if (file === "") return yield* new PackUnreadable({ message: `${PACK_VARIABLE} is set but empty, so it names no private pack and the gate cannot scan for its terms` });
+  const read = yield* (yield* FileSystem.FileSystem).readFileString(file).pipe(
+    Effect.mapError((cause) => unreadable(Predicate.isTagged(cause.reason, "NotFound") ? "no file that exists" : "a file the gate cannot read")),
+  );
+  const pack = yield* decodePack(read, { onExcessProperty: "error" }).pipe(
+    Effect.mapError(() => unreadable("is not the JSON object docs/gates/checks-secrets.md describes")),
+  );
+  const rules = packRules(pack);
+  if (rules === "") return yield* unreadable("lists no term");
+  return rules;
+});
+
+type ScanConfig = { readonly config: string; readonly notice: string };
+
+export const packConfig = Effect.fn("packConfig")(function* (name: string, scratch: string, file: Option.Option<string>) {
+  const path = yield* Path.Path;
+  const kitConfig = path.join(import.meta.dir, "gitleaks.toml");
+  if (Option.isNone(file)) {
+    return { config: kitConfig, notice: `${name}: ${PACK_VARIABLE} is unset, so the kit's rules ran without a private pack` } satisfies ScanConfig;
+  }
+  const rules = yield* packRulesAt(file.value);
+  const fs = yield* FileSystem.FileSystem;
+  const config = path.join(scratch, "gitleaks.toml");
+  yield* fs.writeFileString(config, `${yield* fs.readFileString(kitConfig)}\n${rules}\n`);
+  return { config, notice: `${name}: the kit's rules and the private pack ${PACK_VARIABLE} names ran` } satisfies ScanConfig;
+});
+
+export const scanConfig = Effect.fn("scanConfig")(function* (name: string, scratch: string) {
+  // Config reads an empty value as unset, and a CI secret that is missing expands to one, so the pack would silently drop.
+  const file = yield* Config.option(Config.String(PACK_VARIABLE)).parse(ConfigProvider.fromEnv({ preserveEmptyStrings: true }));
+  return yield* packConfig(name, scratch, file);
+});

package/src/delivery/secrets.ts

@@ -1,9 +1,10 @@
 #!/usr/bin/env bun
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { Console, Effect, FileSystem, Schema } from "effect";
 import { commitOf, git, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
 import { cacheRoot } from "../dependencies/cache-root.ts";
 import { pinnedGitleaks, scanCommits, type Leak } from "./gitleaks.ts";
+import { scanConfig } from "./secrets-pack.ts";
 
 const NAME = "secrets";
 const USAGE = "usage: secrets.ts <ref> | <base-ref> <head-ref>";
@@ -70,16 +71,16 @@ export function report(leaks: readonly Leak[]): string {
 
 const secrets = Effect.gen(function* () {
   const fs = yield* FileSystem.FileSystem;
-  const path = yield* Path.Path;
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
   const logOptions = yield* logOptionsOf(process.argv.slice(2), root);
-  const binary = yield* pinnedGitleaks(yield* cacheRoot());
-  const config = path.join(import.meta.dir, "gitleaks.toml");
   const ignoreDir = yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-" });
+  const { config, notice } = yield* scanConfig(NAME, yield* fs.makeTempDirectoryScoped({ prefix: "checks-secrets-pack-" }));
+  const binary = yield* pinnedGitleaks(yield* cacheRoot());
   const gitDir = (yield* git(["rev-parse", "--absolute-git-dir"], root)).trim();
   const reported = yield* scanCommits({ binary, gitDir, logOptions, config, ignoreDir });
   const leaks = yield* Effect.forEach(reported, (leak) => atRepositoryPath(leak, root));
   yield* Console.log(report(leaks));
+  yield* Console.log(notice);
   return leaks.length === 0;
 }).pipe(Effect.scoped);