@avi2dg/checks 0.6.0 → 0.8.0

package/scripts/ci-wiring.ts

@@ -1,6 +1,8 @@
 #!/usr/bin/env bun
-import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { git } from "./git.ts";
+import { runMain } from "./main.ts";
+import { DEFAULT_BRANCH, ENTRY_POINT, KIT_GATES } from "./gates.ts";
 
 export type Command = readonly string[];
 
@@ -26,6 +28,7 @@ export type BlockedInvocation = {
 
 export type Gap = {
   readonly gate: string;
+  readonly entryPoint?: string;
   readonly blocked: readonly BlockedInvocation[];
 };
 
@@ -35,10 +38,11 @@ type RunStep = {
   readonly script: string;
 };
 
-export class WiringError extends Error {}
+export class WiringError extends Schema.TaggedError<WiringError>()("WiringError", {
+  message: Schema.String,
+}) {}
 
 const WORKFLOWS = ".github/workflows";
-const DEFAULT_BRANCH = "main";
 // Without these a pull_request workflow never sees the commits a pull request pushes.
 const GATING_TYPES = ["opened", "synchronize"];
 const CONSTANTS = new Map([
@@ -226,19 +230,32 @@ function runSteps(workflows: readonly Workflow[], branch: string): readonly RunS
   return steps;
 }
 
+function entryPointCommand(gate: Command): Command | undefined {
+  const index = gate.findIndex((word) => KIT_GATES.some((kitGate) => kitGate.bin === word));
+  return index === -1 ? undefined : [...gate.slice(0, index), ENTRY_POINT.bin];
+}
+
 export function findGaps(declaration: Declaration, workflows: readonly Workflow[]): readonly Gap[] {
   const steps = runSteps(workflows, declaration.defaultBranch);
   return declaration.gates.flatMap((gate) => {
-    const alone = `the step runs more than ${gate.command}; give it its own step with nothing else in it`;
+    const entryPoint = entryPointCommand(gate.words);
+    const commands = [
+      { command: gate.command, words: gate.words },
+      ...(entryPoint === undefined ? [] : [{ command: entryPoint.join(" "), words: entryPoint }]),
+    ];
     const invoking = steps.flatMap(({ location, blocker, script }) => {
-      if (invokes(plainCommand(script), gate.words)) return [{ location, blocker }];
-      return mentions(script, gate.words) ? [{ location, blocker: blocker ?? alone }] : [];
+      const plain = plainCommand(script);
+      if (commands.some(({ words }) => invokes(plain, words))) return [{ location, blocker }];
+      const mentioned = commands.find(({ words }) => mentions(script, words));
+      if (mentioned === undefined) return [];
+      const alone = `the step runs more than ${mentioned.command}; give it its own step with nothing else in it`;
+      return [{ location, blocker: blocker ?? alone }];
     });
     if (invoking.some((step) => step.blocker === undefined)) return [];
     const blocked = invoking.flatMap(({ location, blocker }) =>
       blocker === undefined ? [] : [{ location, blocker }],
     );
-    return [{ gate: gate.command, blocked }];
+    return [{ gate: gate.command, entryPoint: entryPoint?.join(" "), blocked }];
   });
 }
 
@@ -248,80 +265,84 @@ export function formatReport(declaration: Declaration, gaps: readonly Gap[]): st
   const lines = [`ci-wiring: ${gaps.length} of ${declaration.gates.length} gate(s) do not run on ${target}:`];
   for (const gap of gaps) {
     lines.push(`  ${gap.gate}`);
-    if (gap.blocked.length === 0) lines.push("    no run step invokes it");
+    if (gap.blocked.length === 0) {
+      lines.push(gap.entryPoint === undefined ? "    no run step invokes it" : `    no run step invokes it or ${gap.entryPoint}`);
+    }
     for (const { location, blocker } of gap.blocked) lines.push(`    ${location}: ${blocker}`);
   }
   return lines.join("\n");
 }
 
-export function parseDeclaration(manifest: unknown, source: string): Declaration {
+export const parseDeclaration = Effect.fnUntraced(function* (
+  manifest: unknown,
+  source: string,
+): Effect.fn.Return<Declaration, WiringError> {
   const configured = isRecord(manifest) && isRecord(manifest["ciWiring"]) ? manifest["ciWiring"] : {};
-  const listed = configured["gates"];
+  const listed: unknown = configured["gates"];
   if (!Array.isArray(listed) || listed.length === 0) {
-    throw new WiringError(`ci-wiring: ${source} sets no ciWiring.gates, a non-empty array of commands`);
+    return yield* new WiringError({ message: `${source} sets no ciWiring.gates, a non-empty array of commands` });
   }
-  const gates = listed.map((command: unknown): Gate => {
+  const commands: readonly unknown[] = listed;
+  const gates: Gate[] = [];
+  for (const command of commands) {
     const words = typeof command === "string" ? plainCommand(command) : undefined;
     if (typeof command !== "string" || words === undefined) {
-      throw new WiringError(`ci-wiring: ${source} ciWiring gate ${JSON.stringify(command)} is not one plain command`);
+      return yield* new WiringError({
+        message: `${source} ciWiring gate ${JSON.stringify(command)} is not one plain command`,
+      });
     }
-    return { command, words };
-  });
+    gates.push({ command, words });
+  }
   const defaultBranch = configured["defaultBranch"] ?? DEFAULT_BRANCH;
   if (typeof defaultBranch !== "string" || defaultBranch === "") {
-    throw new WiringError(`ci-wiring: ${source} ciWiring.defaultBranch is not a branch name`);
+    return yield* new WiringError({ message: `${source} ciWiring.defaultBranch is not a branch name` });
   }
   return { gates, defaultBranch };
-}
-
-export function parseWorkflow(path: string, text: string): Workflow {
-  try {
-    return { path, document: Bun.YAML.parse(text) };
-  } catch (error) {
-    throw new WiringError(`ci-wiring: cannot parse ${path}: ${String(error)}`);
-  }
-}
+});
 
-export function readDeclaration(root: string): Declaration {
-  const path = join(root, "package.json");
-  let manifest: unknown;
-  try {
-    manifest = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    throw new WiringError(`ci-wiring: cannot read ${path} as JSON`);
-  }
-  return parseDeclaration(manifest, path);
-}
+export const parseWorkflow = (path: string, text: string): Effect.Effect<Workflow, WiringError> =>
+  Effect.try({
+    try: () => ({ path, document: Bun.YAML.parse(text) }),
+    catch: (error) => new WiringError({ message: `cannot parse ${path}: ${String(error)}` }),
+  });
 
-export function readWorkflows(root: string): readonly Workflow[] {
-  const directory = join(root, WORKFLOWS);
-  if (!existsSync(directory)) return [];
-  return readdirSync(directory)
+const parseJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+
+export const readDeclaration = Effect.fn("readDeclaration")(function* (root: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = (yield* Path.Path).join(root, "package.json");
+  const manifest = yield* fs.readFileString(path).pipe(
+    Effect.flatMap(parseJson),
+    Effect.mapError((cause) => new WiringError({ message: `cannot read ${path} as JSON: ${cause.message}` })),
+  );
+  return yield* parseDeclaration(manifest, path);
+});
+
+export const readWorkflows = Effect.fn("readWorkflows")(function* (root: string) {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const directory = path.join(root, WORKFLOWS);
+  if (!(yield* fs.exists(directory))) return [];
+  const files = (yield* fs.readDirectory(directory))
     .filter((name) => name.endsWith(".yml") || name.endsWith(".yaml"))
-    .sort()
-    .map((name) => parseWorkflow(`${WORKFLOWS}/${name}`, readFileSync(join(directory, name), "utf8")));
-}
-
-function repositoryRoot(): string {
-  const result = Bun.spawnSync(["git", "rev-parse", "--show-toplevel"], { stdout: "pipe", stderr: "pipe" });
-  if (!result.success) {
-    throw new WiringError(`ci-wiring: git rev-parse --show-toplevel: ${result.stderr.toString().trim()}`);
+    .sort();
+  return yield* Effect.forEach(files, (name) =>
+    fs
+      .readFileString(path.join(directory, name))
+      .pipe(Effect.flatMap((text) => parseWorkflow(`${WORKFLOWS}/${name}`, text))),
+  );
+});
+
+const wiring = Effect.gen(function* () {
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const declaration = yield* readDeclaration(root);
+  const gaps = findGaps(declaration, yield* readWorkflows(root));
+  if (gaps.length > 0) {
+    yield* Console.error(formatReport(declaration, gaps));
+    return false;
   }
-  return result.stdout.toString().trim();
-}
+  yield* Console.log(formatReport(declaration, gaps));
+  return true;
+});
 
-if (import.meta.main) {
-  try {
-    const root = repositoryRoot();
-    const declaration = readDeclaration(root);
-    const gaps = findGaps(declaration, readWorkflows(root));
-    if (gaps.length > 0) {
-      console.error(formatReport(declaration, gaps));
-      process.exit(1);
-    }
-    console.log(formatReport(declaration, gaps));
-  } catch (error) {
-    console.error(error instanceof WiringError ? error.message : `ci-wiring: ${String(error)}`);
-    process.exit(2);
-  }
-}
+if (import.meta.main) runMain("ci-wiring", wiring);

package/scripts/comment-gate.ts

@@ -1,5 +1,8 @@
 #!/usr/bin/env bun
+import { Console, Effect, Option } from "effect";
 import { refused, SYNTAXES } from "./comments.ts";
+import { git } from "./git.ts";
+import { runMain, Usage } from "./main.ts";
 
 export type GateResult = {
   readonly files: number;
@@ -9,19 +12,6 @@ export type GateResult = {
 
 const USAGE = "usage: comment-gate.ts <ref> | <base-ref> <head-ref>";
 
-function die(message: string): never {
-  console.error(message);
-  process.exit(2);
-}
-
-function git(root: string, ...args: readonly string[]): string {
-  const result = Bun.spawnSync(["git", ...args], { cwd: root, stdout: "pipe", stderr: "pipe" });
-  if (!result.success) {
-    die(`comment-gate: git ${args.join(" ")}: ${result.stderr.toString().trim()}`);
-  }
-  return result.stdout.toString();
-}
-
 function readable(path: string): boolean {
   return path.slice(path.lastIndexOf(".") + 1) in SYNTAXES;
 }
@@ -68,29 +58,23 @@ export function parseAddedLines(diff: string): Map<string, Set<number>> {
   return added;
 }
 
-function show(rev: string, path: string, root: string): string | undefined {
-  const result = Bun.spawnSync(["git", "show", `${rev}:${path}`], {
-    cwd: root,
-    stdout: "pipe",
-    stderr: "pipe",
-  });
-  return result.success ? result.stdout.toString() : undefined;
-}
+const show = (rev: string, path: string, root: string) =>
+  git(["show", `${rev}:${path}`], root).pipe(Effect.option);
 
-export function runRange(root: string, base: string, head: string): GateResult {
-  const diff = git(root, "-c", "core.quotePath=false", "diff", "-U0", "--no-color", "--no-prefix", base, head);
+export const runRange = Effect.fn("runRange")(function* (root: string, base: string, head: string) {
+  const diff = yield* git(["-c", "core.quotePath=false", "diff", "-U0", "--no-color", "--no-prefix", base, head], root);
   const added = parseAddedLines(diff);
   const violations: string[] = [];
   let addedLines = 0;
   for (const [path, lines] of added) {
     addedLines += lines.size;
     if (!readable(path)) continue;
-    const source = show(head, path, root);
-    if (source === undefined) continue;
-    violations.push(...refused(path, source, lines));
+    const source = yield* show(head, path, root);
+    if (Option.isNone(source)) continue;
+    violations.push(...(yield* refused(path, source.value, lines)));
   }
   return { files: added.size, addedLines, violations };
-}
+});
 
 export function report({ files, addedLines, violations }: GateResult): string {
   if (violations.length === 0) {
@@ -99,18 +83,19 @@ export function report({ files, addedLines, violations }: GateResult): string {
   return [`comment-gate: ${violations.length} violation(s):`, ...violations.map((one) => `  ${one}`)].join("\n");
 }
 
-function parentOf(root: string, rev: string): string {
-  return git(root, "rev-parse", "--verify", `${rev}^`).trim();
-}
+const parentOf = (root: string, rev: string) =>
+  git(["rev-parse", "--verify", `${rev}^`], root).pipe(Effect.map((parent) => parent.trim()));
 
-if (import.meta.main) {
+const gate = Effect.gen(function* () {
   const [first, second, ...extra] = process.argv.slice(2);
-  if (first === undefined || extra.length > 0) die(USAGE);
+  if (first === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
 
-  const root = git(process.cwd(), "rev-parse", "--show-toplevel").trim();
-  const result =
-    second !== undefined ? runRange(root, first, second) : runRange(root, parentOf(root, first), first);
+  const root = (yield* git(["rev-parse", "--show-toplevel"], process.cwd())).trim();
+  const base = second === undefined ? yield* parentOf(root, first) : first;
+  const result = yield* runRange(root, base, second ?? first);
 
-  console.log(report(result));
-  process.exit(result.violations.length === 0 ? 0 : 1);
-}
+  yield* Console.log(report(result));
+  return result.violations.length === 0;
+});
+
+if (import.meta.main) runMain("comment-gate", gate);

package/scripts/comments.ts

@@ -1,3 +1,5 @@
+import { Effect, Schema } from "effect";
+
 export type Comment = { line: number; text: string };
 
 type Marker = { readonly token: string; readonly afterAWordBreak: boolean };
@@ -80,15 +82,20 @@ export const SYNTAXES: Readonly<Record<string, Syntax>> = {
   ml: ML,
 };
 
-export function syntaxFor(path: string): Syntax {
+export class UnreadableCode extends Schema.TaggedError<UnreadableCode>()("UnreadableCode", {
+  message: Schema.String,
+}) {}
+
+export function syntaxFor(path: string): Effect.Effect<Syntax, UnreadableCode> {
   const extension = path.slice(path.lastIndexOf(".") + 1);
   const syntax = SYNTAXES[extension];
-  if (!syntax) {
-    throw new Error(
-      `${path} is code the comment checks cannot read: add a comment syntax for .${extension} to scripts/comments.ts`,
-    );
-  }
-  return syntax;
+  return syntax
+    ? Effect.succeed(syntax)
+    : Effect.fail(
+        new UnreadableCode({
+          message: `${path} is code the comment checks cannot read: add a comment syntax for .${extension} to scripts/comments.ts`,
+        }),
+      );
 }
 
 const WORD = /[\w$]/;
@@ -147,8 +154,8 @@ function endOfRegex(source: string, start: number): number {
   return source.length;
 }
 
-export function comments(path: string, source: string): Comment[] {
-  const syntax = syntaxFor(path);
+export const comments = Effect.fn("comments")(function* (path: string, source: string) {
+  const syntax = yield* syntaxFor(path);
   const found: Comment[] = [];
   let i = 0;
   let line = 1;
@@ -215,7 +222,7 @@ export function comments(path: string, source: string): Comment[] {
   }
 
   return found;
-}
+});
 
 const LICENCE = /copyright|spdx-license-identifier|all rights reserved|licen[cs]ed under|permission is hereby granted/i;
 
@@ -268,9 +275,13 @@ function spans(from: number, lineCount: number, within: ReadonlySet<number> | un
   return false;
 }
 
-export function refused(path: string, source: string, within?: ReadonlySet<number>): string[] {
+export const refused = Effect.fn("refused")(function* (
+  path: string,
+  source: string,
+  within?: ReadonlySet<number>,
+) {
   const out: string[] = [];
-  const found = comments(path, source);
+  const found = yield* comments(path, source);
 
   const opening = openingBlock(found, source);
   const openingText = opening.map((comment) => comment.text).join("\n");
@@ -295,4 +306,4 @@ export function refused(path: string, source: string, within?: ReadonlySet<numbe
     }
   }
   return out;
-}
+});

package/scripts/commit-identity.ts

@@ -1,7 +1,10 @@
 #!/usr/bin/env bun
-import { existsSync, readFileSync } from "node:fs";
+import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { git } from "./git.ts";
+import { runMain, Usage } from "./main.ts";
 
-type Identity = { readonly name: string; readonly email: string };
+const Identity = Schema.Struct({ name: Schema.String, email: Schema.String });
+type Identity = typeof Identity.Type;
 
 type Commit = {
   readonly sha: string;
@@ -29,80 +32,77 @@ const RECORD = "\u001e";
 
 const USAGE = "usage: commit-identity.ts <ref> | <base-ref> <head-ref>";
 
-function die(message: string): never {
-  console.error(message);
-  process.exit(2);
-}
+const Manifest = Schema.Struct({
+  commitIdentity: Schema.optional(Schema.Struct({ authors: Schema.NonEmptyArray(Identity) })),
+});
+const parseJson = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown));
+const decodeManifest = Schema.decodeUnknownEffect(Manifest);
 
-function git(...args: readonly string[]): string {
-  const result = Bun.spawnSync(["git", ...args], { stdout: "pipe", stderr: "pipe" });
-  if (!result.success) {
-    die(`commit-identity: git ${args.join(" ")}: ${result.stderr.toString().trim()}`);
-  }
-  return result.stdout.toString();
-}
+class InvalidAllowlist extends Schema.TaggedError<InvalidAllowlist>()("InvalidAllowlist", {
+  message: Schema.String,
+}) {}
+
+class UnreadableLog extends Schema.TaggedError<UnreadableLog>()("UnreadableLog", {
+  message: Schema.String,
+}) {}
 
 function render(identity: Identity): string {
   return `${identity.name} <${identity.email}>`;
 }
 
-function isIdentity(value: unknown): value is Identity {
-  if (typeof value !== "object" || value === null) return false;
-  const candidate = value as { name?: unknown; email?: unknown };
-  return typeof candidate.name === "string" && typeof candidate.email === "string";
-}
+const allowedAuthors = Effect.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
+  const manifestPath = path.join(root, "package.json");
+  if (!(yield* fs.exists(manifestPath))) return DEFAULT_AUTHORS;
 
-function allowedAuthors(): readonly Identity[] {
-  const root = git("rev-parse", "--show-toplevel").trim();
-  const manifestPath = `${root}/package.json`;
-  if (!existsSync(manifestPath)) return DEFAULT_AUTHORS;
-
-  const parsed: unknown = JSON.parse(readFileSync(manifestPath, "utf8"));
-  const configured = (parsed as { commitIdentity?: unknown }).commitIdentity;
-  if (configured === undefined) return DEFAULT_AUTHORS;
-
-  const authors = (configured as { authors?: unknown }).authors;
-  if (!Array.isArray(authors) || authors.length === 0 || !authors.every(isIdentity)) {
-    die(
-      `commit-identity: ${manifestPath} sets commitIdentity without a non-empty authors array of {name, email}`,
-    );
-  }
-  return authors;
-}
+  const parsed = yield* fs.readFileString(manifestPath).pipe(
+    Effect.flatMap(parseJson),
+    Effect.mapError((cause) => new InvalidAllowlist({ message: `cannot read ${manifestPath} as JSON: ${cause.message}` })),
+  );
+  const manifest = yield* decodeManifest(parsed).pipe(
+    Effect.mapError(
+      () =>
+        new InvalidAllowlist({
+          message: `${manifestPath} sets commitIdentity without a non-empty authors array of {name, email}`,
+        }),
+    ),
+  );
+  return manifest.commitIdentity?.authors ?? DEFAULT_AUTHORS;
+});
 
-function readCommits(revisions: readonly string[]): readonly Commit[] {
+const readCommits = Effect.fn("readCommits")(function* (revisions: readonly string[]) {
   const format =
     ["%H", "%an", "%ae", "%cn", "%ce", "%s", CO_AUTHORED_BY_FORMAT].join(FIELD_FORMAT) +
     RECORD_FORMAT;
-  const log = git("log", `--format=${format}`, ...revisions);
-
-  return log
-    .split(RECORD)
-    .map((record) => record.replace(/^\n/, ""))
-    .filter((record) => record !== "")
-    .map((record) => {
-      const [sha, authorName, authorEmail, committerName, committerEmail, subject, trailers] =
-        record.split(FIELD);
-      if (
-        sha === undefined ||
-        authorName === undefined ||
-        authorEmail === undefined ||
-        committerName === undefined ||
-        committerEmail === undefined ||
-        subject === undefined ||
-        trailers === undefined
-      ) {
-        return die(`commit-identity: cannot parse git log record: ${JSON.stringify(record)}`);
-      }
-      return {
-        sha,
-        subject,
-        author: { name: authorName, email: authorEmail },
-        committer: { name: committerName, email: committerEmail },
-        coAuthoredBy: trailers.split("\n").filter((line) => line !== ""),
-      };
+  const log = yield* git(["log", `--format=${format}`, ...revisions]);
+
+  const commits: Commit[] = [];
+  for (const record of log.split(RECORD).map((one) => one.replace(/^\n/, ""))) {
+    if (record === "") continue;
+    const [sha, authorName, authorEmail, committerName, committerEmail, subject, trailers] = record.split(FIELD);
+    if (
+      sha === undefined ||
+      authorName === undefined ||
+      authorEmail === undefined ||
+      committerName === undefined ||
+      committerEmail === undefined ||
+      subject === undefined ||
+      trailers === undefined
+    ) {
+      return yield* new UnreadableLog({ message: `cannot parse git log record: ${JSON.stringify(record)}` });
+    }
+    commits.push({
+      sha,
+      subject,
+      author: { name: authorName, email: authorEmail },
+      committer: { name: committerName, email: committerEmail },
+      coAuthoredBy: trailers.split("\n").filter((line) => line !== ""),
     });
-}
+  }
+  return commits;
+});
 
 function allows(allowed: readonly Identity[], identity: Identity): boolean {
   return allowed.some(
@@ -126,28 +126,32 @@ function inspect(commit: Commit, allowed: readonly Identity[]): Offence | undefi
   return reasons.length === 0 ? undefined : { commit, reasons };
 }
 
-const [first, second, ...extra] = process.argv.slice(2);
-if (first === undefined || extra.length > 0) die(USAGE);
-const range = second === undefined ? first : `${first}..${second}`;
-const revisions = second === undefined ? ["-1", range] : [range];
-
-const allowed = allowedAuthors();
-const commits = readCommits(revisions);
-const offences = commits
-  .map((commit) => inspect(commit, allowed))
-  .filter((offence) => offence !== undefined);
-
-if (offences.length > 0) {
-  console.error(
-    `commit-identity: ${offences.length} of ${commits.length} commit(s) in ${range} carry a foreign identity:`,
-  );
-  for (const { commit, reasons } of offences) {
-    console.error(`  ${commit.sha.slice(0, 12)} ${commit.subject}`);
-    for (const reason of reasons) console.error(`    ${reason}`);
+const check = Effect.gen(function* () {
+  const [first, second, ...extra] = process.argv.slice(2);
+  if (first === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
+  const range = second === undefined ? first : `${first}..${second}`;
+  const revisions = second === undefined ? ["-1", range] : [range];
+
+  const allowed = yield* allowedAuthors;
+  const commits = yield* readCommits(revisions);
+  const offences = commits
+    .map((commit) => inspect(commit, allowed))
+    .filter((offence) => offence !== undefined);
+
+  if (offences.length > 0) {
+    const lines = [`commit-identity: ${offences.length} of ${commits.length} commit(s) in ${range} carry a foreign identity:`];
+    for (const { commit, reasons } of offences) {
+      lines.push(`  ${commit.sha.slice(0, 12)} ${commit.subject}`);
+      for (const reason of reasons) lines.push(`    ${reason}`);
+    }
+    lines.push(`  allowed: ${allowed.map(render).join(", ")}`);
+    lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}`);
+    yield* Console.error(lines.join("\n"));
+    return false;
   }
-  console.error(`  allowed: ${allowed.map(render).join(", ")}`);
-  console.error(`  allowed as committer only: ${render(SQUASH_COMMITTER)}`);
-  process.exit(1);
-}
 
-console.log(`commit-identity: ${commits.length} commit(s) in ${range} carry only allowed identities`);
+  yield* Console.log(`commit-identity: ${commits.length} commit(s) in ${range} carry only allowed identities`);
+  return true;
+});
+
+runMain("commit-identity", check);

package/scripts/gates.ts

@@ -0,0 +1,21 @@
+export type Program = {
+  readonly bin: string;
+  readonly script: string;
+};
+
+export type KitGate = Program & {
+  readonly reads: "tree" | "range";
+};
+
+export const ENTRY_POINT: Program = { bin: "checks-lint", script: "lint.ts" };
+
+export const DEFAULT_BRANCH = "main";
+
+export const KIT_GATES: readonly KitGate[] = [
+  { bin: "checks-lint-coverage", script: "lint-coverage.sh", reads: "tree" },
+  { bin: "checks-test-layout", script: "test-layout.ts", reads: "tree" },
+  { bin: "checks-commit-identity", script: "commit-identity.ts", reads: "range" },
+  { bin: "checks-comment-gate", script: "comment-gate.ts", reads: "range" },
+  { bin: "checks-suppressions-ratchet", script: "suppressions-ratchet.ts", reads: "range" },
+  { bin: "checks-ci-wiring", script: "ci-wiring.ts", reads: "tree" },
+];

package/scripts/git.ts

@@ -0,0 +1,27 @@
+import { Effect, Schema, Stream } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
+
+export class GitFailure extends Schema.TaggedError<GitFailure>()("GitFailure", {
+  message: Schema.String,
+}) {}
+
+const text = <E>(bytes: Stream.Stream<Uint8Array, E>): Effect.Effect<string, E> =>
+  bytes.pipe(Stream.decodeText(), Stream.mkString);
+
+// Both pipes drain while git runs: one left unread fills its buffer and stalls git.
+export const git = Effect.fn("git")(
+  function* (args: readonly string[], cwd?: string) {
+    const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+    const command = `git ${args.join(" ")}`;
+    const failed = (stderr: string): GitFailure => new GitFailure({ message: `${command}: ${stderr.trim()}` });
+    const handle = yield* spawner
+      .spawn(ChildProcess.make("git", args, { cwd }))
+      .pipe(Effect.mapError((cause) => failed(cause.message)));
+    const [stdout, stderr, exitCode] = yield* Effect.all([text(handle.stdout), text(handle.stderr), handle.exitCode], {
+      concurrency: "unbounded",
+    }).pipe(Effect.mapError((cause) => failed(cause.message)));
+    if (exitCode !== ChildProcessSpawner.ExitCode(0)) return yield* failed(stderr);
+    return stdout;
+  },
+  Effect.scoped,
+);