@avi2dg/checks 0.60.0 → 0.61.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.61.1
+
+Released 2026-11-02.
+
+### Fixes
+
+- **changelog:** keep a release's section when its commit gets its tag [#23](https://github.com/avi2d/checks/pull/23)
+
+## 0.61.0
+
+Released 2026-11-01.
+
+### Features
+
+- **ci-wiring:** refuse a scheduled release in every repository [#22](https://github.com/avi2d/checks/pull/22)
+
 ## 0.60.0
 
 Released 2026-10-31.

package/docs/design.md

@@ -202,7 +202,8 @@ A daily release pull request would leave each merged change unpublished until a
 `checks-release-push` builds the release commit on top of `main` and runs the required checks on it from the `release/<branch>` branch it owns.
 Only then does it move `main` to it without a force, so `main` only ever gains a release commit whose checks passed.
 It tags the commit it landed and nothing else.
-A repository that is no package keeps the daily release pull request.
+A repository that is no package keeps the release pull request, and it opens only when someone runs the workflow.
+No release runs on a schedule, in a package or not, since a schedule cuts releases no one asked for.
 `checks-release-pr` writes only to the `release/<branch>` branch it owns, and rebuilds that branch on `main` rather than merging `main` into it, so the changelog it carries is the one the build writes.
 `checks-release-tag` writes only the `v*` tag of a release commit that already landed.
 The `github-release` job's `contents: write` creates or updates the GitHub release from the tag's `CHANGELOG.md` section.
@@ -218,7 +219,7 @@ So each dispatched job reports its result as a commit status named for the job,
 Where a status and a check share a name, branch protection requires both, so the status never passes a pull request whose own check failed.
 The cost is a `workflow_dispatch` trigger and a status step on each workflow a release needs.
 The title lint reads its title from the open pull request, or lints the head subject when none is open.
-The daily release also needs the repository setting that lets the token open a pull request.
+The release pull request also needs the repository setting that lets the token open a pull request.
 
 ## The docs gate judges what a change touches
 

package/docs/gates/checks-changelog.md

@@ -27,6 +27,8 @@ It finds releases in the version bumps of `package.json` across all of `HEAD` an
 It reads a commit whose `package.json` is missing or has no version as unversioned, so the commit that adds the version is the first release and a repository that adopts a version late still writes its changelog.
 A bump to a version no newer than the release before it is a revert.
 A revert cancels every release above the version it returns to, except a release a `v` tag marks as published.
+A `v` tag publishes only the newest bump of its version that the tagged commit reaches.
+So a version bumped again after a cancel keeps its cancelled bump cancelled, and the tag leaves the changelog unchanged.
 A version older than the newest in the committed `CHANGELOG.md` and absent from it was never published, so its commits go into the next release.
 It refuses a shallow checkout, since the releases reach back past its history.
 It refuses a `package.json` with no repository address, since each entry links its pull request under it.

package/docs/gates/checks-ci-wiring.md

@@ -84,6 +84,19 @@ This rule skips a repository with no setup-bun step.
 A kit release that moves the fleet version turns each consumer red until its pin follows.
 Each refusal names the workflow file and line, the version found and where it was read, and the fleet version.
 
+### Release schedule
+
+It refuses a workflow that triggers on `schedule` and releases, in every repository, whether or not it publishes to npm.
+A workflow releases when a run step calls `checks-release-pr`, `checks-release-push`, `checks-release-tag` or `checks-release-publish`.
+A call counts directly, through `bunx`, or through `bun` or `bun run` with the bin's path or its source file.
+A call through a `package.json` script counts, as `bun run <script>` where the named script releases.
+A call through a local reusable workflow counts, as a job that uses a file under `.github/workflows/` that releases.
+A call through a repository shell script counts, as a path inside the repository whose file releases.
+A workflow also releases when a run step publishes to npm, as [checks-release-preflight](checks-release-preflight.md) reads it, directly or through one of those paths.
+Text that only names a release bin, such as an `echo`, never counts.
+A release runs when someone starts it, as [checks-release-pr](checks-release-pr.md#when-it-runs) says.
+Each refusal names the workflow file and the line of its `schedule` trigger.
+
 ## What it reads
 
 The bin reads `.github/workflows/*.yml`, `*.yaml`, the `scripts` and `checks` runners in `package.json` and the shell scripts those steps and scripts run from the working tree.
@@ -102,7 +115,7 @@ It takes no arguments.
 | Code | Result |
 | --- | --- |
 | 0 | Every required command has a reachable step. |
-| 1 | A required command is missing or blocked, a job runs on the wrong runner, a workflow names a missing workflow or job, or a setup-bun step drifts from the fleet bun version. |
+| 1 | A required command is missing or blocked, a job runs on the wrong runner, a workflow names a missing workflow or job, a setup-bun step drifts from the fleet bun version, or a workflow that releases runs on a schedule. |
 | 2 | A workflow or `package.json` cannot be decoded, or the kit's own `.bun-version` is missing, unreadable or blank. |
 
 ## Sample output
@@ -129,6 +142,13 @@ ci-wiring: 1 reference(s) name a missing workflow or job:
   .github/workflows/daily-release.yml line 31: names missing workflow commitlint.yml
 ```
 
+A workflow that releases on a schedule produces a report like this:
+
+```
+ci-wiring: 1 workflow(s) release on a schedule:
+  .github/workflows/daily-release.yml line 3: drop the schedule, so a release runs only when someone starts it
+```
+
 ## When it runs
 
 `checks-lint` runs it in the full run in every repository.

package/docs/gates/checks-release-notes.md

@@ -175,7 +175,7 @@ The approval setting has no read only check under the release token, so `checks-
 A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on each job in either workflow, as [checks-ci-wiring](checks-ci-wiring.md#runners) requires.
 A release is one commit that holds only the version bump and the built changelog.
 A package repository lands it on every push to `main` through [checks-release-push](checks-release-push.md), which tags it and dispatches this workflow on the tag.
-Another repository takes it as the pull request [checks-release-pr](checks-release-pr.md) opens on the daily release's schedule.
+Another repository takes it as the pull request [checks-release-pr](checks-release-pr.md) opens when someone runs the `release-pr` workflow.
 When it lands, [checks-release-tag](checks-release-tag.md) tags the merge commit and dispatches this workflow on the tag.
 A tag the workflow token pushes starts no `push` run, so the workflow triggers on `workflow_dispatch` as well, and refuses a dispatch on a ref that is not a tag.
 A tag a person pushes starts the same workflow through its `push` trigger.

package/docs/gates/checks-release-pr.md

@@ -18,7 +18,8 @@ It bumps the version `package.json` holds by the kit's rule:
 | only fixes, performance changes or reverts | patch | patch |
 
 It refuses when the last release tag names a version other than the one `package.json` holds, since an untagged bump means a release landed that nothing published.
-The refusal points at the `tag` job of `daily-release` on the release commit, whose own refusal says what to fix, rather than at a tag pushed by hand.
+The refusal points at the `tag` job of the workflow it runs in, rerun on the release commit, rather than at a tag pushed by hand.
+That job's own refusal says what to fix.
 It refuses a version that is not a plain `major.minor.patch`.
 It writes the next version into `package.json`, runs `bun run build` so the build writes `CHANGELOG.md`, and commits every tracked file the build changed as `chore: release <version>`.
 The commit's one parent is `HEAD`.
@@ -35,6 +36,7 @@ It leaves the working tree as it found it.
 ## What it reads
 
 It reads the `v*` tags, the commit subjects since the last one and `package.json` from the checkout.
+It names the workflow it runs in by `GITHUB_WORKFLOW`, or as `release-pr` when that is unset.
 It refuses a shallow checkout, a detached `HEAD` and a working tree with changes to tracked files.
 It reads the release branch from `origin` with `git ls-remote` and `git fetch`.
 It calls the GitHub API through `gh api`, which takes the repository from the checkout's remote and the token from `GH_TOKEN`.
@@ -74,22 +76,20 @@ release-pr: https://github.com/acme/widget/pull/12 releases 0.4.0 from 3f2a9c81d
 
 ## When it runs
 
-The daily release workflow below runs it once a day on the default branch.
+The `release-pr` workflow below runs it on the default branch when someone starts it with `gh workflow run release-pr`.
+The workflow has no schedule, so a release is cut only when someone asks for one.
 A package published to npm releases each push to `main` through [checks-release-push](checks-release-push.md) instead, with no pull request.
-Run the workflow by hand with `gh workflow run daily-release` to refresh the release pull request sooner.
+[checks-ci-wiring](checks-ci-wiring.md#release-schedule) refuses a schedule on any workflow that releases.
 
 ## Running it in CI
 
-A repository takes the daily release as the `daily-release` workflow below.
-A consuming repository pins daily-release between 03:00 and 04:00 UTC at a minute chosen so repositories do not start together.
+A repository takes the release pull request as the `release-pr` workflow below.
 The `pull-request` job checks out its branch's tip when it starts, so a run that starts late never rebuilds the release on an older commit.
-The `pull-request` job runs on the schedule, and the `tag` job runs when a release commit lands on `main`, as [checks-release-tag](checks-release-tag.md) says:
+The `pull-request` job runs when someone starts the workflow, and the `tag` job runs when a release commit lands on `main`, as [checks-release-tag](checks-release-tag.md) says:
 
 ```yaml
-name: daily-release
+name: release-pr
 on:
-  schedule:
-    - cron: "7 3 * * *"
   workflow_dispatch:
   push:
     branches: [main]
@@ -155,7 +155,7 @@ The checks it dispatches are the release pull request's own required checks, and
 The pull request also lists its own `pull_request` runs as waiting for approval.
 Nothing requires them, and approving them runs the same checks again.
 
-The daily release needs the repository's other workflows to accept the dispatch:
+The release pull request needs the repository's other workflows to accept the dispatch:
 
 - `.github/workflows/ci.yml` triggers on `workflow_dispatch`, grants `statuses: write` and `pull-requests: read`, and ends each required job with the step below.
 - The title lint reads the title of the one open pull request its branch heads when the event carries none, as [Commit messages](../configs/commit-messages.md) says.

package/docs/gates/checks-release-preflight.md

@@ -82,7 +82,7 @@ A wrong trusted publisher setting on npm itself surfaces only at the publish ste
 ## Operator check
 
 No endpoint the release token may read exposes the approval setting, so the bin never checks it.
-Turn on **Allow GitHub Actions to create and approve pull requests** under the repository Actions settings before the daily release plans.
+Turn on **Allow GitHub Actions to create and approve pull requests** under the repository Actions settings before the release pull request plans.
 `checks-release-pr` fails while opening the pull request when the setting is off.
 
 ## Related topics

package/docs/gates/checks-release-tag.md

@@ -19,11 +19,13 @@ It refuses when `v<version>` already tags another commit.
 Before it pushes the tag, it runs `bun run build` and refuses when the build rewrites a committed file.
 That happens when a release pull request merged behind `main`, so its `CHANGELOG.md` lacks the commits `main` gained.
 The refusal says to open a `chore: cancel the unpublished <version>` pull request that returns `package.json` to the last tag's version and commits what `bun run build` then writes to `CHANGELOG.md`.
-The build reads the returned version as a revert, so it drops the unpublished section, and the next `daily-release` run cuts the release again with every change since the last tag.
+The build reads the returned version as a revert, so it drops the unpublished section.
+The next run of the workflow that tags it then cuts the release again with every change since the last tag.
 
 ## What it reads
 
 It reads the subject of `HEAD` and `package.json` from the checkout, and the tag from `origin` with `git ls-remote`.
+It names the workflow it runs in by `GITHUB_WORKFLOW`, or as `release-pr` when that is unset.
 The build it runs reads the whole history, so the checkout fetches all of it.
 It pushes the tag with the credentials the checkout holds.
 It calls the GitHub API through `gh api`, which takes the repository from the checkout's remote and the token from `GH_TOKEN`.
@@ -55,7 +57,7 @@ release-tag: tagged 3f2a9c81d0b4 as v0.4.0, and dispatched release.yml on it
 
 ## When it runs
 
-The `tag` job of the daily release workflow runs it on each push to `main` whose head commit reads as a release, as [checks-release-pr](checks-release-pr.md#running-it-in-ci) shows.
+The `tag` job of the `release-pr` workflow runs it on each push to `main` whose head commit reads as a release, as [checks-release-pr](checks-release-pr.md#running-it-in-ci) shows.
 A package repository needs no `tag` job, since [checks-release-push](checks-release-push.md) tags the release it lands.
 
 ## Related topics

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.60.0",
+  "version": "0.61.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",
@@ -43,6 +43,7 @@
     "src/delivery/release-commit.ts",
     "src/delivery/release-pr.ts",
     "src/delivery/release-preflight.ts",
+    "src/delivery/release-schedule.ts",
     "src/delivery/release-publish.ts",
     "src/delivery/release-push.ts",
     "src/delivery/release-tag.ts",

package/src/delivery/changelog-write.ts

@@ -64,9 +64,26 @@ const readBumps = Effect.fn("readBumps")(function* (root: string) {
   return bumps;
 });
 
-const readPublished = Effect.fn("readPublished")(function* (root: string) {
+const reaches = (root: string, ancestor: string, descendant: string) =>
+  git(["merge-base", "--is-ancestor", ancestor, descendant], root).pipe(
+    Effect.as(true),
+    Effect.catchTag("GitFailure", () => Effect.succeed(false)),
+  );
+
+// A tag publishes the newest bump of its version that it reaches, so a cancelled older bump of that version stays cancelled.
+const readPublishedShas = Effect.fn("readPublishedShas")(function* (root: string, bumps: readonly Bump[]) {
   const tags = yield* git(["for-each-ref", "--format=%(refname:strip=2)", `refs/tags/${TAG_PREFIX}*`], root);
-  return new Set(tags.split("\n").flatMap((tag) => (tag.startsWith(TAG_PREFIX) ? [tag.slice(TAG_PREFIX.length)] : [])));
+  const published = new Set<string>();
+  for (const tag of tags.split("\n").filter((line) => line.startsWith(TAG_PREFIX))) {
+    const version = tag.slice(TAG_PREFIX.length);
+    for (const bump of bumps.filter((one) => one.version === version).toReversed()) {
+      if (yield* reaches(root, bump.sha, `refs/tags/${tag}`)) {
+        published.add(bump.sha);
+        break;
+      }
+    }
+  }
+  return published;
 });
 
 const mergedTips = Effect.fn("mergedTips")(function* (root: string, through: string) {
@@ -78,11 +95,7 @@ const mergedTips = Effect.fn("mergedTips")(function* (root: string, through: str
   for (const [, ...parents] of merges.split("\n").filter((line) => line !== "").map((line) => line.split(" "))) {
     for (const parent of parents) {
       // A parent past the bump belongs to a later release, so only a parent beside it joins this one.
-      const past = yield* git(["merge-base", "--is-ancestor", through, parent], root).pipe(
-        Effect.as(true),
-        Effect.catchTag("GitFailure", () => Effect.succeed(false)),
-      );
-      if (!past) tips.push(parent);
+      if (!(yield* reaches(root, through, parent))) tips.push(parent);
     }
   }
   return tips;
@@ -113,7 +126,8 @@ const write = Effect.gen(function* () {
   }
   const recorded = (yield* fs.exists(target)) ? releaseDates(yield* fs.readFileString(target)) : new Map<string, string>();
   const pending = version === (yield* versionAt(root, "HEAD")) ? undefined : { sha: "HEAD", version, date: yield* today };
-  const released = cuts(yield* readBumps(root), recorded, yield* readPublished(root), pending);
+  const bumps = yield* readBumps(root);
+  const released = cuts(bumps, recorded, yield* readPublishedShas(root, bumps), pending);
   const tip = released.at(-1);
   const extra = tip === undefined || tip.through === "HEAD" ? [] : yield* mergedTips(root, tip.through);
   const found = (yield* Effect.forEach(released, (cut, index) => subjectsOf(root, cut, index === released.length - 1 ? extra : [])))

package/src/delivery/changelog.ts

@@ -57,12 +57,13 @@ function entryOf(subject: string, repositoryUrl: string): Entry | undefined {
 }
 
 // A bump not newer than the release before it is a revert: it cancels every release above the version it
-// returns to, except a published one.
-function standing(bumps: readonly Bump[], published: ReadonlySet<string>): readonly Bump[] {
+// returns to, except a published one. A version cancelled and bumped again holds two bumps, so a bump is
+// published by its sha and never by its version.
+function standing(bumps: readonly Bump[], publishedShas: ReadonlySet<string>): readonly Bump[] {
   return bumps.reduce<readonly Bump[]>((kept, bump) => {
     const before = kept.at(-1);
     if (before === undefined || Bun.semver.order(bump.version, before.version) === 1) return [...kept, bump];
-    return kept.filter(({ version }) => published.has(version) || Bun.semver.order(version, bump.version) !== 1);
+    return kept.filter(({ sha, version }) => publishedShas.has(sha) || Bun.semver.order(version, bump.version) !== 1);
   }, []);
 }
 
@@ -71,11 +72,11 @@ function standing(bumps: readonly Bump[], published: ReadonlySet<string>): reado
 export function cuts(
   bumps: readonly Bump[],
   recorded: ReadonlyMap<string, string>,
-  published: ReadonlySet<string>,
+  publishedShas: ReadonlySet<string>,
   pending: Bump | undefined,
 ): readonly Cut[] {
   const newest = [...recorded.keys()].toSorted(Bun.semver.order).at(-1);
-  const candidates = standing(pending === undefined ? bumps : [...bumps, pending], published);
+  const candidates = standing(pending === undefined ? bumps : [...bumps, pending], publishedShas);
   const released = candidates.filter(
     ({ version }, index) =>
       index === candidates.length - 1 || newest === undefined || recorded.has(version) || Bun.semver.order(version, newest) !== -1,

package/src/delivery/ci-wiring.ts

@@ -4,7 +4,8 @@ import { defaultBranch, git } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
 import { ENTRY_POINT, KIT_GATES, type KitGate } from "../core/gates.ts";
 import { findBunPinFaults, formatBunPinReport, readBunPinPolicy } from "./bun-pin.ts";
-import { readShellFiles } from "./mutation-job.ts";
+import { readScheduleFiles, readShellFiles } from "./mutation-job.ts";
+import { findScheduledReleases, formatScheduleReport } from "./release-schedule.ts";
 import { findRunnerFaults, formatRunnerReport, jobRuns, readRunnerConfig } from "./runner-policy.ts";
 import { invokes, mentions, plainCommand, type Command } from "./shell-command.ts";
 import { findMissingWorkflows, formatMissingReport, isRecord, names, workflowJobs, type Workflow } from "./workflow-references.ts";
@@ -328,7 +329,10 @@ const wiring = Effect.gen(function* () {
   if (faults.length > 0) yield* Console.error(formatRunnerReport(faults));
   const bunFaults = findBunPinFaults(yield* readBunPinPolicy(root, workflows), workflows);
   if (bunFaults.length > 0) yield* Console.error(formatBunPinReport(bunFaults));
-  return gaps.length === 0 && faults.length === 0 && missing.length === 0 && bunFaults.length === 0;
+  const scheduleFiles = yield* readScheduleFiles(root, scripts, runs);
+  const scheduled = findScheduledReleases(workflows, { scripts, files: scheduleFiles });
+  if (scheduled.length > 0) yield* Console.error(formatScheduleReport(scheduled));
+  return gaps.length === 0 && faults.length === 0 && missing.length === 0 && bunFaults.length === 0 && scheduled.length === 0;
 });
 
 if (import.meta.main) runMain("ci-wiring", wiring);

package/src/delivery/mutation-job.ts

@@ -16,6 +16,8 @@ type Walked = {
   readonly files: readonly string[];
 };
 
+export type BinCheck = (program: Command) => boolean;
+
 type Context = {
   readonly scripts: ReadonlyMap<string, string>;
   readonly files: (file: string) => string | undefined;
@@ -41,15 +43,32 @@ export function within(dir: string | undefined, path: string): string | undefine
 }
 
 export function runsMutation(run: Run, scripts: ReadonlyMap<string, string>, files: (file: string) => string | undefined): boolean {
-  return scriptRunsMutation(run.script, run.dir, { scripts, files }, { scripts: [], files: [] });
+  return runsBin(run, scripts, files, mutationBin);
+}
+
+export function runsBin(
+  run: Run,
+  scripts: ReadonlyMap<string, string>,
+  files: (file: string) => string | undefined,
+  isBin: BinCheck,
+  followShellOperands = false,
+): boolean {
+  return scriptRunsBin(run.script, run.dir, { scripts, files }, { scripts: [], files: [] }, isBin, followShellOperands);
 }
 
-function scriptRunsMutation(script: string, dir: string | undefined, context: Context, walked: Walked): boolean {
+function scriptRunsBin(
+  script: string,
+  dir: string | undefined,
+  context: Context,
+  walked: Walked,
+  isBin: BinCheck,
+  followShellOperands: boolean,
+): boolean {
   let cwd = dir;
   for (const command of shellCommands(script)) {
     const [program = "", ...args] = fromProgram(command);
     if (program === "cd") cwd = changedDirectory(cwd, withoutOptions(args, new Set()));
-    else if (mutationCommand(command, cwd, context, walked)) return true;
+    else if (binCommand(command, cwd, context, walked, isBin, followShellOperands)) return true;
   }
   return false;
 }
@@ -73,11 +92,16 @@ function fileAt(dir: string | undefined, path: string): string | undefined {
   return within(dir, path) || undefined;
 }
 
-function invocation(command: Command, dir: string | undefined, context: Context, walked: Walked): Invocation | undefined {
+function invocation(command: Command, dir: string | undefined, context: Context, walked: Walked, followShellOperands: boolean): Invocation | undefined {
   const [first = "", ...rest] = fromProgram(command);
-  if (first !== "bun") return { program: [first, ...rest], file: first.includes("/") ? fileAt(dir, first) : undefined, dir };
+  if (first !== "bun") {
+    if (followShellOperands && rest[0] !== undefined && !rest[0].startsWith("-") && SHELLS.includes(first.slice(first.lastIndexOf("/") + 1))) {
+      return { program: [first, ...rest], file: fileAt(dir, rest[0]), dir };
+    }
+    return { program: [first, ...rest], file: first.includes("/") ? fileAt(dir, first) : undefined, dir };
+  }
   const [subcommand = "", ...operands] = withoutOptions(rest, BUN_OPERANDS);
-  if (subcommand === "x") return invocation(["bunx", ...operands], dir, context, walked);
+  if (subcommand === "x") return invocation(["bunx", ...operands], dir, context, walked, followShellOperands);
   if (BUN_COMMANDS.has(subcommand)) return undefined;
   const [target = "", ...targetArgs] = subcommand === "run" ? withoutOptions(operands, BUN_OPERANDS) : [subcommand, ...operands];
   const cwd = bunDirectory([...bunOptions(rest), ...(subcommand === "run" ? bunOptions(operands) : [])], dir);
@@ -85,19 +109,33 @@ function invocation(command: Command, dir: string | undefined, context: Context,
   return body === undefined ? { program: [target, ...targetArgs], file: fileAt(cwd, target), dir: cwd } : { script: target, body };
 }
 
-function mutationCommand(command: Command, dir: string | undefined, context: Context, walked: Walked): boolean {
-  const call = invocation(command, dir, context, walked);
+function binCommand(
+  command: Command,
+  dir: string | undefined,
+  context: Context,
+  walked: Walked,
+  isBin: BinCheck,
+  followShellOperands: boolean,
+): boolean {
+  const call = invocation(command, dir, context, walked, followShellOperands);
   if (call === undefined) return false;
   // bun runs a script from the directory of the package.json that names it.
-  if ("body" in call) return scriptRunsMutation(call.body, ROOT, context, { ...walked, scripts: [...walked.scripts, call.script] });
-  return mutationBin(call.program) || fileRunsMutation(call.file, call.dir, context, walked);
+  if ("body" in call) return scriptRunsBin(call.body, ROOT, context, { ...walked, scripts: [...walked.scripts, call.script] }, isBin, followShellOperands);
+  return isBin(call.program) || fileRunsBin(call.file, call.dir, context, walked, isBin, followShellOperands);
 }
 
 // A script file runs in its caller's directory, not its own.
-function fileRunsMutation(file: string | undefined, dir: string | undefined, context: Context, walked: Walked): boolean {
+function fileRunsBin(
+  file: string | undefined,
+  dir: string | undefined,
+  context: Context,
+  walked: Walked,
+  isBin: BinCheck,
+  followShellOperands: boolean,
+): boolean {
   if (file === undefined || walked.files.includes(file)) return false;
   const body = context.files(file);
-  return body !== undefined && scriptRunsMutation(body, dir, context, { ...walked, files: [...walked.files, file] });
+  return body !== undefined && scriptRunsBin(body, dir, context, { ...walked, files: [...walked.files, file] }, isBin, followShellOperands);
 }
 
 function mutationBin([program = "", subcommand]: Command): boolean {
@@ -115,13 +153,25 @@ function filesWanted(runs: readonly Run[], scripts: ReadonlyMap<string, string>,
   return [...wanted];
 }
 
-export const readShellFiles = Effect.fn("readShellFiles")(function* (root: string, scripts: ReadonlyMap<string, string>, runs: readonly Run[]) {
+function scheduleFilesWanted(runs: readonly Run[], scripts: ReadonlyMap<string, string>, files: ReadonlyMap<string, string>, read: ReadonlySet<string>): readonly string[] {
+  const wanted = new Set<string>();
+  const lookup = (file: string) => {
+    if (!read.has(file)) wanted.add(file);
+    return files.get(file);
+  };
+  for (const run of runs) runsBin(run, scripts, lookup, () => false, true);
+  return [...wanted];
+}
+
+type FilesWanted = (runs: readonly Run[], scripts: ReadonlyMap<string, string>, files: ReadonlyMap<string, string>, read: ReadonlySet<string>) => readonly string[];
+
+const readFiles = Effect.fn("readFiles")(function* (root: string, scripts: ReadonlyMap<string, string>, runs: readonly Run[], wanted: FilesWanted) {
   const fs = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
   const contents = new Map<string, string>();
   const read = new Set<string>();
-  for (let wanted = filesWanted(runs, scripts, contents, read); wanted.length > 0; wanted = filesWanted(runs, scripts, contents, read)) {
-    for (const file of wanted) {
+  for (let pending = wanted(runs, scripts, contents, read); pending.length > 0; pending = wanted(runs, scripts, contents, read)) {
+    for (const file of pending) {
       read.add(file);
       const text = yield* fs.readFileString(path.join(root, file)).pipe(Effect.orElseSucceed(() => undefined));
       if (text !== undefined && (file.endsWith(".sh") || SHELL_SHEBANG.test(text))) contents.set(file, text);
@@ -129,3 +179,11 @@ export const readShellFiles = Effect.fn("readShellFiles")(function* (root: strin
   }
   return contents;
 });
+
+export const readShellFiles = Effect.fn("readShellFiles")(function* (root: string, scripts: ReadonlyMap<string, string>, runs: readonly Run[]) {
+  return yield* readFiles(root, scripts, runs, filesWanted);
+});
+
+export const readScheduleFiles = Effect.fn("readScheduleFiles")(function* (root: string, scripts: ReadonlyMap<string, string>, runs: readonly Run[]) {
+  return yield* readFiles(root, scripts, runs, scheduleFilesWanted);
+});

package/src/delivery/release-pr.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { Console, Effect, Schema } from "effect";
 import { dispatch, gitHubJson, REPOSITORY } from "./github.ts";
-import { releaseTitle } from "./release.ts";
+import { releaseTitle, runningWorkflow } from "./release.ts";
 import { buildRelease, commitRelease, hasBranch, MANIFEST, planRelease, pointBranch, versionIn } from "./release-commit.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
@@ -13,7 +13,6 @@ type Remote = {
 
 const NAME = "checks-release-pr";
 const USAGE = "usage: release-pr.ts <workflow>...";
-const UNTAGGED = "rerun the tag job of daily-release on the release commit, whose refusal says what to fix";
 
 const PullRequest = Schema.Struct({ number: Schema.Int, title: Schema.String, html_url: Schema.String });
 type PullRequest = typeof PullRequest.Type;
@@ -53,7 +52,8 @@ const releasePullRequest = Effect.gen(function* () {
   const workflows = process.argv.slice(2);
   if (workflows.length === 0) return yield* new Usage({ message: USAGE });
   const root = (yield* git(["rev-parse", "--show-toplevel"])).trim();
-  const plan = yield* planRelease("release-pr", root, UNTAGGED);
+  const untagged = `rerun the tag job of ${yield* runningWorkflow} on the release commit, whose refusal says what to fix`;
+  const plan = yield* planRelease("release-pr", root, untagged);
   if (plan === undefined) return true;
   const { base, branch, head, next, bumped } = plan;
   const remote = yield* readRemote(root, branch);

package/src/delivery/release-schedule.ts

@@ -0,0 +1,72 @@
+import { runsBin } from "./mutation-job.ts";
+import { jobRuns } from "./runner-policy.ts";
+import type { Command } from "./shell-command.ts";
+import { isRecord, locate, names, workflowJobs, type Workflow } from "./workflow-references.ts";
+
+export type ScheduledRelease = {
+  readonly location: string;
+};
+
+export type ScheduleContext = {
+  readonly scripts: ReadonlyMap<string, string>;
+  readonly files: ReadonlyMap<string, string>;
+};
+
+const EMPTY: ScheduleContext = { scripts: new Map(), files: new Map() };
+
+const RELEASE_BINS = ["pr", "push", "tag", "publish"].flatMap((bin) => [`checks-release-${bin}`, `release-${bin}.ts`]);
+
+function isReleaseBin(word: string): boolean {
+  return RELEASE_BINS.some((name) => word === name || word.endsWith(`/${name}`));
+}
+
+function isReleaseCommand(program: Command): boolean {
+  const [head = "", ...rest] = program;
+  if (head === "npm" && rest[0] === "publish") return true;
+  return isReleaseBin(head);
+}
+
+function localUses(job: Readonly<Record<string, unknown>>): string | undefined {
+  const uses = job["uses"];
+  return typeof uses === "string" && uses.startsWith("./") ? uses.slice(2) : undefined;
+}
+
+function workflowReleases(
+  workflow: Workflow,
+  context: ScheduleContext,
+  byPath: ReadonlyMap<string, Workflow>,
+  walkedWorkflows: readonly string[],
+): boolean {
+  const files = (file: string) => context.files.get(file);
+  if (
+    workflowJobs(workflow)
+      .flatMap(([, job]) => jobRuns(workflow, job))
+      .some((run) => runsBin(run, context.scripts, files, isReleaseCommand, true))
+  )
+    return true;
+  return workflowJobs(workflow).some(([, job]) => {
+    const called = localUses(job);
+    if (called === undefined || walkedWorkflows.includes(called)) return false;
+    const next = byPath.get(called);
+    return next !== undefined && workflowReleases(next, context, byPath, [...walkedWorkflows, called]);
+  });
+}
+
+function schedules(document: unknown): boolean {
+  const on = isRecord(document) ? document["on"] : undefined;
+  return isRecord(on) ? "schedule" in on : (names(on) ?? []).includes("schedule");
+}
+
+export function findScheduledReleases(workflows: readonly Workflow[], context: ScheduleContext = EMPTY): readonly ScheduledRelease[] {
+  const byPath = new Map(workflows.map((workflow) => [workflow.path, workflow] as const));
+  return workflows
+    .filter((workflow) => schedules(workflow.document) && workflowReleases(workflow, context, byPath, [workflow.path]))
+    .map((workflow) => ({ location: locate(workflow.path, workflow.text.split("\n"))(["on"], "schedule", "on schedule") }));
+}
+
+export function formatScheduleReport(scheduled: readonly ScheduledRelease[]): string {
+  return [
+    `ci-wiring: ${scheduled.length} workflow(s) release on a schedule:`,
+    ...scheduled.map(({ location }) => `  ${location}: drop the schedule, so a release runs only when someone starts it`),
+  ].join("\n");
+}

package/src/delivery/release-tag.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Effect } from "effect";
+import { runningWorkflow } from "./release.ts";
 import { tagHead } from "./release-tagging.ts";
 import { git } from "../core/git.ts";
 import { runMain, Usage } from "../core/main.ts";
@@ -9,7 +10,7 @@ const USAGE = "usage: release-tag.ts <workflow>";
 const releaseTag = Effect.gen(function* () {
   const [workflow, ...extra] = process.argv.slice(2);
   if (workflow === undefined || extra.length > 0) return yield* new Usage({ message: USAGE });
-  return yield* tagHead("release-tag", (yield* git(["rev-parse", "--show-toplevel"])).trim(), workflow, "daily-release");
+  return yield* tagHead("release-tag", (yield* git(["rev-parse", "--show-toplevel"])).trim(), workflow, yield* runningWorkflow);
 });
 
 if (import.meta.main) runMain("checks-release-tag", releaseTag);

package/src/delivery/release.ts

@@ -1,4 +1,4 @@
-import { Effect, Schema } from "effect";
+import { Config, Effect, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { groupOf } from "./changelog.ts";
 import { git } from "../core/git.ts";
@@ -40,6 +40,8 @@ export function withVersion(manifest: string, from: string, to: string): string
   return field.test(manifest) ? manifest.replace(field, `$1${to}$2`) : undefined;
 }
 
+export const runningWorkflow = Config.String("GITHUB_WORKFLOW").pipe(Config.withDefault("release-pr"));
+
 export function releaseTitle(version: string): string {
   return `chore: release ${version}`;
 }