@avi2dg/checks 0.69.0 → 0.71.0

package/docs/gates/checks-night-run.md

@@ -1,257 +0,0 @@
----
-kind: reference
-audience: consumers
----
-# checks-night-run
-
-`checks-night-run` turns each finding of a night run on `main` into a GitHub issue.
-A finding is a file whose mutation score fell, a failing test, a failed nightly gate or a missing mutation report.
-It closes the issue of a test, gate or missing mutation report that a later night no longer reports, and it comments on a mutation issue it no longer reports without closing it, but only when a previous night exists and every requested mutation report is present.
-
-## What it checks
-
-It scores each file of tonight's Stryker reports as Stryker does, the `Killed` and `Timeout` mutants over every mutant but the `Ignored`, `CompileError`, `RuntimeError` and `Pending` ones.
-It compares each file's score with the same file's score from the previous night.
-A file whose score is lower than the previous night's is a finding.
-A file only one night holds is no finding, since it lacks one of the two scores.
-A file with no scored mutant has no score, so it is no finding either.
-An equal score is no finding, even when it counts other mutants.
-Each failing test in a JUnit report is a finding, whatever the previous night holds.
-Each nightly gate the lint log names as failed is a finding.
-A log where every named gate is undecided files `checks-lint` itself, with no per-gate issue.
-A log with no passing run and no named gate files `checks-lint` itself, so a gate run that never finished still reaches an issue.
-A file whose test worker crashed is one finding, since Bun reports none of its tests.
-With no previous night it compares no score and still files each failing test.
-Each mutation report `--mutation` names that does not exist is a finding, since the mutation job that writes it failed, timed out or was cancelled.
-With no mutation report it compares and records no score and still files each failing test.
-With some mutation reports missing it compares the files the others hold and records no score.
-The next night then compares every file with the last night that scored them all.
-
-Each finding has a key that stays the same from night to night:
-
-| Finding | Key |
-| --- | --- |
-| a file whose mutation score fell | `mutation:<file>` |
-| a failing test | `test:<file> > <describe> > <name>` |
-| a file whose test worker crashed | `test:<file>` |
-| a nightly gate that failed | `gates:<gate>` |
-| a missing mutation report | `mutation-report:<path>` |
-
-## How it files a finding
-
-It creates the `night-run` label when the repository lacks it.
-It reads every open issue labelled `night-run`, and reads the key each one carries in a hidden marker in its body.
-A finding whose key an open issue carries gets one comment on that issue, so a regression that lasts two nights stays one issue.
-Any other finding opens one issue labelled `night-run`.
-The issue and the comment name tonight's run, the file and the test, the score of both nights or the failed gate.
-The body holds the file, the full test name or the failed gate, and the finding key.
-A title longer than GitHub's 256 characters is cut to at most 256 and ends in `…`.
-A night with no finding creates no label and writes no issue, and only reads the open issues to close any test, gate or mutation-report issue whose finding is gone and, when a previous night exists and every requested mutation report is present, to comment on any mutation issue whose finding is gone.
-Closing an issue ends it, and the same finding on a later night opens a new one.
-
-## How it closes an issue
-
-An open test, gate or mutation-report issue whose key tonight's findings lack gets one comment naming tonight's run and the key.
-It then closes as completed.
-When a previous night exists and every requested mutation report is present, an open mutation issue whose key tonight's findings lack gets one comment that names tonight's run and the key, and stays open.
-A closed issue is no longer read, so a later night without the finding comments on it no more.
-A comment that reports the finding carries a reported marker, and a note that a mutation finding is gone carries a noted marker.
-A mutation issue whose latest marked comment already notes the finding gone gets no further note.
-So a mutation finding gone for many nights is noted once, and noted again only after a later night reports it again.
-A person's comment carries no marker, so it never makes the run note an issue twice.
-It judges a key only from a report it read tonight:
-
-| Key | Closes when |
-| --- | --- |
-| `test:<file> > <describe> > <name>` | tonight read a JUnit report, the test is not failing, and `<file>`'s worker did not crash |
-| `test:<file>` | tonight read a JUnit report and `<file>`'s worker did not crash |
-| `gates:<gate>` | tonight read a lint log that passes or names its failed gates, and `<gate>` is not among them |
-| `mutation-report:<path>` | tonight read the mutation report at `<path>` |
-| `mutation:<file>` | never |
-
-A crashed worker loses every result of its file, so the issue of a test in that file stays open.
-A lint log that is undecided or never finished says nothing of any one gate, so every gate issue stays open.
-A mutation finding is a fall from one night to the next.
-A later night that does not fall again still holds the lower score.
-Only a night that compared scores with every requested mutation report present comments on the mutation issue without closing it, since a score can recover and drop again.
-So a person closes a mutation issue once the score is back.
-An issue with no key in its body is never read, so a person's issue under the `night-run` label is never commented on or closed.
-A run off `main` comments on and closes no issue.
-Agents and people fix each issue as a task of its own, so no pull request waits for a night run.
-A run on any ref but `refs/heads/main` files no issue and records no score, and lists each finding in its log only.
-
-## What it reads
-
-It reads tonight's Stryker `mutation.json` reports and any number of JUnit reports, such as the ones `checks-test --junit=<file>` keeps, as [checks-test](checks-test.md#arguments) says.
-It reads the lint log `--gates` names for the `gate(s) failed:` line `checks-lint --night` prints.
-It scans the newest 30 successful runs of the same workflow on `main` from newest to oldest.
-It takes the first run whose `night-run` artifact still exists as the previous night.
-That artifact holds `night-run.json`, the scores the run recorded.
-When no scanned run holds the artifact it compares no score.
-A run on another branch never becomes the previous night.
-On `main` with every mutation report present it writes tonight's scores to `reports/night-run.json`, and the workflow uploads that file as the `night-run` artifact.
-It reads the run from `GITHUB_SERVER_URL`, `GITHUB_REPOSITORY`, `GITHUB_RUN_ID`, `GITHUB_WORKFLOW_REF` and `GITHUB_REF`, so it runs only inside a GitHub Actions job.
-It calls `gh` with the job's `GH_TOKEN`, which needs `actions: read` for the previous night and `issues: write` for the issues.
-
-## Arguments
-
-```sh
-checks-night-run [--mutation <mutation-report>]... [--tests <junit-report>]... [--gates <lint-log>]
-```
-
-`--mutation` names one of tonight's Stryker reports and is given once per report the workflow's mutation jobs write, whether or not each job wrote it.
-`--tests` names one JUnit report and is given once per report.
-`--gates` names tonight's `checks-lint --night` log and is given at most once.
-At least one report is given.
-
-## Exit codes
-
-| Code | When |
-| --- | --- |
-| 0 | it filed every finding, closed each issue whose finding is gone and recorded tonight's scores, it found nothing to file, or the run is off `main` and it listed each finding |
-| 2 | an argument does not parse, a report or the lint log does not decode, a GitHub Actions variable is unset or a `gh` call fails |
-
-It never exits 1, because a finding becomes an issue rather than a failed run.
-
-## Sample output
-
-```
-checks-night-run: the night run https://github.com/acme/widget/actions/runs/12 compared with the night run https://github.com/acme/widget/actions/runs/11; 2 finding(s)
-  opened #31 for mutation:src/cart.ts
-  commented on #27 for test:tests/unit/cart.test.ts > totals > rounds half to even
-  closed #24 for gates:checks-repetition
-checks-night-run: recorded 42 file score(s) in reports/night-run.json
-```
-
-## When it runs
-
-Only a night workflow the repository writes runs it, after that workflow's full mutation run, its long test tiers and its nightly lint gates.
-
-## Running it by hand
-
-A repository runs it from a workflow named `night-run`, which someone starts with `gh workflow run night-run`.
-The workflow holds no schedule, since [checks-ci-wiring](checks-ci-wiring.md#schedules) refuses one:
-
-```yaml
-name: night-run
-on:
-  workflow_dispatch:
-permissions:
-  contents: read
-concurrency:
-  group: night-run
-  cancel-in-progress: false
-jobs:
-  mutation:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@v5
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: .bun-version
-      - run: bun install --frozen-lockfile
-      - run: bunx stryker run
-      - uses: actions/upload-artifact@v4
-        with:
-          name: night-run-mutation
-          path: reports/mutation/mutation.json
-          retention-days: 1
-  tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v5
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: .bun-version
-      - run: bun install --frozen-lockfile
-      - run: |
-          bunx checks-test --tier=live --junit=reports/night-run-tests/live.xml || true
-          bunx checks-test --tier=pixel --junit=reports/night-run-tests/pixel.xml || true
-      - uses: actions/upload-artifact@v4
-        with:
-          name: night-run-tests
-          path: reports/night-run-tests/
-          retention-days: 1
-  gates:
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: .bun-version
-      - run: bun install --frozen-lockfile
-      - run: mkdir -p reports/night-run-gates && bunx checks-lint --night > reports/night-run-gates/gates.log 2>&1 || true
-      - uses: actions/upload-artifact@v4
-        with:
-          name: night-run-gates
-          path: reports/night-run-gates/
-          retention-days: 1
-  report:
-    needs: [mutation, gates, tests]
-    if: ${{ !cancelled() && needs.tests.result == 'success' }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      actions: read
-      issues: write
-    steps:
-      - uses: actions/checkout@v5
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version-file: .bun-version
-      - run: bun install --frozen-lockfile
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: night-run-mutation
-          path: reports/mutation
-      - if: needs.gates.result == 'success'
-        uses: actions/download-artifact@v4
-        with:
-          name: night-run-gates
-          path: reports/night-run-gates
-      - uses: actions/download-artifact@v4
-        with:
-          name: night-run-tests
-          path: reports/night-run-tests
-      - env:
-          GH_TOKEN: ${{ github.token }}
-        run: bunx checks-night-run --mutation reports/mutation/night-run-mutation/mutation.json --tests reports/night-run-tests/live.xml --tests reports/night-run-tests/pixel.xml ${{ needs.gates.result == 'success' && '--gates reports/night-run-gates/gates.log' || '' }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: night-run
-          path: reports/night-run.json
-          if-no-files-found: ignore
-          retention-days: 90
-```
-
-The tests job runs each long tier the repository holds, `live` and `pixel` as [checks-test](checks-test.md#test-tiers) names them, and keeps each JUnit report.
-Each `|| true` lets the job go on to the upload after a failing test, since that test becomes an issue.
-A tier that writes no report fails the report job, because `checks-night-run` cannot read it.
-The gates job runs the nightly lint gates and keeps the log, since a failing gate becomes an issue.
-The report job runs whenever the tests job succeeds, so a failing test that also stops Stryker still becomes an issue.
-It always passes `--mutation`, so a mutation job that failed or timed out leaves a missing report that becomes an issue.
-The download names the artifact by `pattern`, which downloads nothing rather than failing when the artifact is missing.
-A full run too long for one job splits into a matrix of shards.
-Each shard uploads its own artifact under the one pattern, and each report gets its own `--mutation`.
-It passes `--gates` only when the gates job succeeded, and the failed gates job still fails the run.
-The concurrency group queues a run behind one already going, so two runs never file the same finding twice.
-A dispatch on a branch runs both jobs and lists its findings in the report job's log, and `if-no-files-found: ignore` lets that run upload no record.
-`issues: write` on the report job is the one permission beyond reading the repository and its runs.
-A public repository keeps `runs-on: ubuntu-latest` on every job.
-A private repository sets `runs-on` on the mutation job to the labels declared under `checks.mutationRunner` in `package.json`, and [checks-ci-wiring](checks-ci-wiring.md#runners) refuses a mutation job that names `CI_RUNS_ON`.
-A private repository sets `runs-on: ${{ vars.CI_RUNS_ON || 'ubuntu-latest' }}` on the tests, gates, and report jobs.
-A successful run with every mutation report present uploads `night-run`, so the next night compares with it, and a run that failed or missed a report uploads nothing a later night reads.
-The artifact keeps 90 days, so a gap of nights still leaves a previous night to compare with.
-
-## Related topics
-
-- [checks-test](checks-test.md)
-- [checks-mutation](checks-mutation.md)
-- [checks-mutation-compare](checks-mutation-compare.md)
-- [checks-ci-wiring](checks-ci-wiring.md)

package/src/delivery/night-step.ts

@@ -1,79 +0,0 @@
-import { ENTRY_POINT } from "../core/gates.ts";
-import { runsBin } from "./mutation-job.ts";
-import type { ScheduleContext } from "./release-schedule.ts";
-import { jobRuns } from "./runner-policy.ts";
-import type { Command } from "./shell-command.ts";
-import { isRecord, localUses, names, skippedBy, switchedOff, type Workflow } from "./workflow-references.ts";
-
-const NIGHT_STEP = `${ENTRY_POINT.bin} --night`;
-
-export type NightStepFault = {
-  readonly gate: string;
-};
-
-const NIGHT_BINS = [ENTRY_POINT.bin, ENTRY_POINT.script];
-
-function isNightLint([head = "", ...rest]: Command): boolean {
-  return NIGHT_BINS.some((name) => head === name || head.endsWith("/" + name)) && rest.length === 1 && rest[0] === "--night";
-}
-
-function rootBlocker(workflow: Workflow): string | undefined {
-  const on = isRecord(workflow.document) ? workflow.document["on"] : undefined;
-  const events = isRecord(on) ? Object.keys(on) : (names(on) ?? []);
-  if (events.length > 0 && events.every((event) => event.toLowerCase() === "workflow_call")) {
-    return `${workflow.path} runs only when called`;
-  }
-  return undefined;
-}
-
-function workflowRunsNightStep(
-  workflow: Workflow,
-  context: ScheduleContext,
-  byPath: ReadonlyMap<string, Workflow>,
-  walkedWorkflows: readonly string[],
-  inherited: string | undefined,
-): boolean {
-  const files = (file: string) => context.files.get(file);
-  const jobs = isRecord(workflow.document) ? workflow.document["jobs"] : undefined;
-  if (!isRecord(jobs)) return false;
-  return Object.entries(jobs).some(([id, job]) => {
-    if (!isRecord(job)) return false;
-    const skipped = skippedBy(jobs, id, []);
-    const jobBlocker =
-      inherited ?? switchedOff(job, `job ${id}`) ?? (skipped === undefined ? undefined : `job ${id} needs a job that never runs: ${skipped}`);
-    const steps = Array.isArray(job["steps"]) ? job["steps"] : [];
-    const runRecords: readonly Readonly<Record<string, unknown>>[] = steps.flatMap((step: unknown) =>
-      isRecord(step) && typeof step["run"] === "string" ? [step] : [],
-    );
-    const unblocked = jobRuns(workflow, job).some(
-      (run, index) =>
-        (jobBlocker ?? switchedOff(runRecords[index] ?? {}, "the step")) === undefined &&
-        runsBin(run, context.scripts, files, isNightLint, true),
-    );
-    if (unblocked) return true;
-    const called = localUses(job["uses"]);
-    if (called === undefined || walkedWorkflows.includes(called)) return false;
-    const next = byPath.get(called);
-    return next !== undefined && workflowRunsNightStep(next, context, byPath, [...walkedWorkflows, called], jobBlocker);
-  });
-}
-
-function runsNightStep(workflows: readonly Workflow[], context: ScheduleContext): boolean {
-  const byPath = new Map(workflows.map((workflow) => [workflow.path, workflow] as const));
-  return workflows.some((workflow) => workflowRunsNightStep(workflow, context, byPath, [workflow.path], rootBlocker(workflow)));
-}
-
-export function findNightStepFaults(
-  tracksTypeScript: boolean,
-  workflows: readonly Workflow[],
-  context: ScheduleContext,
-): readonly NightStepFault[] {
-  return tracksTypeScript && !runsNightStep(workflows, context) ? [{ gate: NIGHT_STEP }] : [];
-}
-
-export function formatNightStepReport(faults: readonly NightStepFault[]): string {
-  return [
-    "ci-wiring: " + faults.length + " gate(s) never run on the night run:",
-    ...faults.flatMap(({ gate }) => ["  " + gate, "    no run step invokes it"]),
-  ].join("\n");
-}