@codyswann/lisa 2.311.10 → 2.311.12

package/dist/cli/doctor-readiness-domain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-domain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AA4PhE;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA2BnC"}
+{"version":3,"file":"doctor-readiness-domain.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EACL,KAAK,cAAc,EAIpB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,eAAO,MAAM,6BAA6B,qBAAqB,CAAC;AA4PhE;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,eAAe,CAAC,EAAE,SAAS,cAAc,EAAE,GAC1C,OAAO,CAAC,wBAAwB,CAAC,CA4BnC"}

package/dist/cli/doctor-readiness-domain.js

@@ -27,6 +27,7 @@
  * @module cli/doctor-readiness-domain
  */
 import { commandTargetsOwnedService, describeCommands, hasCheckedInRunbook, looksEphemeral, scanCommands, } from "./doctor-readiness-operations.js";
+import { expandLocalScriptCommands } from "./doctor-readiness-local-scripts.js";
 import { informationalFindings } from "./doctor-readiness-shared.js";
 import { parseRepositoryWorkflows, } from "./doctor-readiness-workflows.js";
 /** The domain-ownership readiness dimension id (readiness-rubric, RRR-1). */
@@ -237,7 +238,8 @@ function skipRecord(guarded, scan, inspected, runbook, recoverableDestructiveOps
  * @returns The domain-ownership dimension record
  */
 export async function assessDomainOwnershipDimension(root, parsedWorkflows) {
-    const workflows = parsedWorkflows ?? (await parseRepositoryWorkflows(root));
+    const parsed = parsedWorkflows ?? (await parseRepositoryWorkflows(root));
+    const workflows = await expandLocalScriptCommands(root, parsed);
     const scan = scanCommands(workflows, destroysData, {
         exemptStep: jobTakesBackupBeforeStep,
         unresolvedStep: servicesDeferral,

package/dist/cli/doctor-readiness-domain.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-domain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GAEb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAGL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,mFAAmF;AACnF,MAAM,6BAA6B,GACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,6BAA6B;IAC7B,6CAA6C;IAC7C,kCAAkC;IAClC,mEAAmE;IACnE,uCAAuC;IACvC,yBAAyB;IACzB,+CAA+C;IAC/C,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,sCAAsC;IACtC,kCAAkC;IAClC,mCAAmC;IACnC,2EAA2E;CAC5E,CAAC;AAEF,8EAA8E;AAC9E,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,eAAe;IACf,YAAY;IACZ,cAAc;IACd,qBAAqB;CACtB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,OAAe;IAClD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,2BAA2B,CAAC,OAAO,CAAC;SACxC,KAAK,CAAC,0BAA0B,CAAC;SACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,CACzC,UAAU,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,UAAU,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,8DAA8D;QAC7E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,yEAAyE;QACzE,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,GAAsB,EACtB,IAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,KAAK;SACb,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;SACnB,IAAI,CAAC,YAAY,CAAC,EAAE,CACnB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAC7C,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,kBAAkB,EAChB,yEAAyE;YACzE,wBAAwB;QAC1B,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;QAClD,eAAe,EACb,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;QAClE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,wDAAwD;SAC3D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CACjB,SAAiB,EACjB,OAAgB,EAChB,yBAAiC;IAEjC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,0EAA0E;YAC1E,uEAAuE;YACvE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CACL,QAAQ,SAAS,8BAA8B;YAC/C,GAAG,yBAAyB,6CAA6C;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,kDAAkD,6BAA6B,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,QAAQ,SAAS,qDAAqD;QACtE,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CACjB,OAAkC,EAClC,IAAmB,EACnB,SAAiB,EACjB,OAAgB,EAChB,yBAAyB,GAAG,CAAC;IAE7B,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC;gBACjE,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,OAAO,CAAC,GAAG,CACZ,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,wBAAwB;oBAClE,gBAAgB,KAAK,CAAC,OAAO,oCAAoC;oBACjE,mEAAmE;oBACnE,+CAA+C,CAClD;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,eAA2C;IAE3C,MAAM,SAAS,GACb,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,YAAY,EAAE;QACjD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAC3D,IAAI,EACJ,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-domain.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-domain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EAEd,YAAY,GAEb,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,OAAO,EAGL,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC;AAEhE,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,0EAA0E;AAC1E,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,mFAAmF;AACnF,MAAM,6BAA6B,GACjC,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,6BAA6B,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAsB;IAC/C,6BAA6B;IAC7B,6CAA6C;IAC7C,kCAAkC;IAClC,mEAAmE;IACnE,uCAAuC;IACvC,yBAAyB;IACzB,+CAA+C;IAC/C,sBAAsB;IACtB,oBAAoB;IACpB,mBAAmB;IACnB,sBAAsB;IACtB,sCAAsC;IACtC,kCAAkC;IAClC,mCAAmC;IACnC,2EAA2E;CAC5E,CAAC;AAEF,8EAA8E;AAC9E,MAAM,iBAAiB,GAAsB;IAC3C,aAAa;IACb,eAAe;IACf,YAAY;IACZ,cAAc;IACd,qBAAqB;CACtB,CAAC;AAEF,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,2BAA2B,CAAC,OAAe;IAClD,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,OAAO,2BAA2B,CAAC,OAAO,CAAC;SACxC,KAAK,CAAC,0BAA0B,CAAC;SACjC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,YAAY,CACnB,OAAe,EACf,GAAsB,EACtB,IAAwB;IAExB,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC,IAAI,CACzC,UAAU,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,UAAU,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC,CACxE,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,SAAyB,EACzB,GAAsB,EACtB,IAAwB;IAExB,IAAI,CAAC,0BAA0B,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CACL,SAAS,GAAG,CAAC,EAAE,8DAA8D;QAC7E,+BAA+B,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB;QAC7E,yEAAyE;QACzE,oCAAoC,CACrC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAC/B,GAAsB,EACtB,IAAwB;IAExB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,KAAK;SACb,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;SACnB,IAAI,CAAC,YAAY,CAAC,EAAE,CACnB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAC/B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAC7C,CACF,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAmB;IACxC,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,kBAAkB,EAChB,yEAAyE;YACzE,wBAAwB;QAC1B,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC;QAC/D,gBAAgB,EACd,0EAA0E;YAC1E,sEAAsE;YACtE,gDAAgD;QAClD,eAAe,EACb,uEAAuE;YACvE,uEAAuE;YACvE,gEAAgE;QAClE,mBAAmB,EAAE;YACnB,wEAAwE;gBACtE,wDAAwD;SAC3D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CACjB,SAAiB,EACjB,OAAgB,EAChB,yBAAiC;IAEjC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,CACL,0EAA0E;YAC1E,uEAAuE;YACvE,0CAA0C;YAC1C,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,IAAI,yBAAyB,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,CACL,QAAQ,SAAS,8BAA8B;YAC/C,GAAG,yBAAyB,6CAA6C;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,kDAAkD,6BAA6B,EAAE,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,CACL,QAAQ,SAAS,qDAAqD;QACtE,yEAAyE;QACzE,kDAAkD;QAClD,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,MAAM,6BAA6B,EAAE,CACvE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CACjB,OAAkC,EAClC,IAAmB,EACnB,SAAiB,EACjB,OAAgB,EAChB,yBAAyB,GAAG,CAAC;IAE7B,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE;YACR;gBACE,MAAM,EAAE,UAAU,CAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC;gBACjE,IAAI,EAAE,IAAI;aACX;YACD,GAAG,qBAAqB,CAAC;gBACvB,GAAG,OAAO,CAAC,GAAG,CACZ,KAAK,CAAC,EAAE,CACN,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,CAAC,KAAK,wBAAwB;oBAClE,gBAAgB,KAAK,CAAC,OAAO,oCAAoC;oBACjE,mEAAmE;oBACnE,+CAA+C,CAClD;gBACD,GAAG,IAAI,CAAC,UAAU;aACnB,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,IAAY,EACZ,eAA2C;IAE3C,MAAM,MAAM,GACV,eAAe,IAAI,CAAC,MAAM,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,YAAY,EAAE;QACjD,UAAU,EAAE,wBAAwB;QACpC,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IACH,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC;QAC7C,OAAO,UAAU,CACf,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAC3D,IAAI,EACJ,SAAS,CAAC,MAAM,EAChB,WAAW,EACX,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,6BAA6B;QACjC,4EAA4E;QAC5E,yEAAyE;QACzE,6EAA6E;QAC7E,MAAM,EAAE,MAAM;QACd,QAAQ,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;KAC3E,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-local-scripts.d.ts

@@ -0,0 +1,9 @@
+import type { ParsedWorkflow } from "./doctor-readiness-workflows.js";
+/**
+ * Inline directly invoked local shell scripts into the parsed workflow commands.
+ * @param root - Repository root
+ * @param workflows - Parsed workflow files
+ * @returns Workflows with bounded script content appended to matching steps
+ */
+export declare function expandLocalScriptCommands(root: string, workflows: readonly ParsedWorkflow[]): Promise<readonly ParsedWorkflow[]>;
+//# sourceMappingURL=doctor-readiness-local-scripts.d.ts.map

package/dist/cli/doctor-readiness-local-scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-local-scripts.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-local-scripts.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,iCAAiC,CAAC;AA8QzC;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,OAAO,CAAC,SAAS,cAAc,EAAE,CAAC,CAKpC"}

package/dist/cli/doctor-readiness-local-scripts.js

@@ -0,0 +1,267 @@
+/**
+ * Bounded expansion of repo-local shell wrappers referenced by workflow run
+ * steps.
+ * @module cli/doctor-readiness-local-scripts
+ */
+import { open, realpath } from "node:fs/promises";
+import * as path from "node:path";
+/** Most bytes read from one local wrapper script during offline expansion. */
+const MAX_LOCAL_SCRIPT_BYTES = 16_384;
+/** Most wrapper scripts expanded across one readiness scan. */
+const MAX_LOCAL_SCRIPT_EXPANSIONS = 64;
+/** Separators that end one shell invocation for this conservative scan. */
+const SHELL_INVOCATION_SEPARATOR = /\n|&&|\|\||[;&|]/;
+/** Shell commands that execute another shell script path. */
+const SHELL_SCRIPT_RUNNERS = new Set(["bash", "sh", "source", "."]);
+/** Shell runners that accept option flags before the script path. */
+const OPTIONED_SHELL_RUNNERS = new Set(["bash", "sh"]);
+/** Prefix assignments that set env only for the following shell invocation. */
+const SHELL_ENV_ASSIGNMENT = /^[A-Za-z_]\w*=.*$/u;
+/**
+ * Whether a word is a shell-runner option rather than the script path.
+ * @param word - Shell token
+ * @returns True when the token should be skipped after bash/sh
+ */
+function isShellRunnerOption(word) {
+    return word.startsWith("-") && word !== "-";
+}
+/**
+ * Find the first non-assignment token in one shell invocation.
+ * @param words - Whitespace-split shell invocation
+ * @param index - Current scan index
+ * @returns Index of the command token
+ */
+function firstCommandIndex(words, index = 0) {
+    return SHELL_ENV_ASSIGNMENT.test(words[index] ?? "")
+        ? firstCommandIndex(words, index + 1)
+        : index;
+}
+/**
+ * Find the first non-option script argument after a shell runner.
+ * @param words - Whitespace-split shell invocation
+ * @param index - Current scan index
+ * @returns Index of the script argument
+ */
+function firstShellScriptIndex(words, index) {
+    return isShellRunnerOption(words[index] ?? "")
+        ? firstShellScriptIndex(words, index + 1)
+        : index;
+}
+/**
+ * Locate the word in one invocation that names the script to expand.
+ * @param words - Whitespace-split shell invocation
+ * @returns Script word and whether a shell runner selected it
+ */
+function scriptCandidate(words) {
+    const index = firstCommandIndex(words);
+    const command = words[index];
+    if (command === undefined) {
+        return null;
+    }
+    const usesRunner = SHELL_SCRIPT_RUNNERS.has(command);
+    if (!usesRunner) {
+        return { candidate: command, usesRunner };
+    }
+    const candidateIndex = OPTIONED_SHELL_RUNNERS.has(command)
+        ? firstShellScriptIndex(words, index + 1)
+        : index + 1;
+    const candidate = words[candidateIndex];
+    return candidate === undefined ? null : { candidate, usesRunner };
+}
+/**
+ * Extract repo-relative shell scripts named directly by a workflow run step.
+ * @param command - Workflow step command
+ * @returns Unique repo-relative script paths
+ */
+function localScriptPaths(command) {
+    return [
+        ...new Set(command
+            .split(SHELL_INVOCATION_SEPARATOR)
+            .flatMap(invocation => {
+            const words = invocation.trim().split(/\s+/u);
+            if (words.length === 0 || words[0]?.startsWith("#")) {
+                return [];
+            }
+            const parsed = scriptCandidate(words);
+            if (parsed === null) {
+                return [];
+            }
+            const candidate = parsed?.candidate;
+            if (candidate === undefined ||
+                !candidate.endsWith(".sh") ||
+                candidate.includes("..")) {
+                return [];
+            }
+            if (!parsed.usesRunner &&
+                !candidate.includes("/") &&
+                !candidate.startsWith("./")) {
+                return [];
+            }
+            return [candidate.replace(/^\.\//u, "")];
+        })
+            .filter(candidate => !candidate.startsWith("-"))),
+    ];
+}
+/**
+ * Read one bounded repo-local script for offline command expansion.
+ * @param root - Repository root
+ * @param relativePath - Repo-relative script path
+ * @returns Script content, or null when it cannot be safely read
+ */
+async function readLocalScript(root, relativePath) {
+    try {
+        const rootPath = await realpath(root);
+        const target = await realpath(path.resolve(rootPath, relativePath));
+        if (!target.startsWith(`${rootPath}${path.sep}`)) {
+            return null;
+        }
+        const file = await open(target, "r");
+        try {
+            const buffer = Buffer.alloc(MAX_LOCAL_SCRIPT_BYTES + 1);
+            const { bytesRead } = await file.read(buffer, 0, MAX_LOCAL_SCRIPT_BYTES + 1, 0);
+            return bytesRead > MAX_LOCAL_SCRIPT_BYTES
+                ? null
+                : buffer.subarray(0, bytesRead).toString("utf8");
+        }
+        finally {
+            await file.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Append any bounded local script bodies referenced by a workflow step.
+ * @param root - Repository root
+ * @param step - Parsed workflow step
+ * @param context - Shared expansion budget
+ * @returns Step with script bodies appended to `run`, when present
+ */
+async function expandLocalScriptStep(root, step, context) {
+    const expanded = await expandLocalScriptBodies(root, localScriptPaths(step.run), context.remainingScripts);
+    return {
+        remainingScripts: expanded.remainingScripts,
+        value: expanded.value.length === 0
+            ? step
+            : { ...step, run: [step.run, ...expanded.value].join("\n") },
+    };
+}
+/**
+ * Read script bodies sequentially under the aggregate expansion budget.
+ * @param root - Repository root
+ * @param scripts - Candidate script paths
+ * @param remainingScripts - Remaining aggregate expansion budget
+ * @returns Expanded script bodies and updated budget
+ */
+async function expandLocalScriptBodies(root, scripts, remainingScripts) {
+    const [script, ...rest] = scripts;
+    if (script === undefined || remainingScripts <= 0) {
+        return { value: [], remainingScripts };
+    }
+    const content = await readLocalScript(root, script);
+    const expanded = await expandLocalScriptBodies(root, rest, remainingScripts - 1);
+    return {
+        remainingScripts: expanded.remainingScripts,
+        value: content === null ? expanded.value : [content, ...expanded.value],
+    };
+}
+/**
+ * Expand directly invoked local shell scripts in one parsed job.
+ * @param root - Repository root
+ * @param job - Parsed workflow job
+ * @param context - Shared expansion budget
+ * @returns Job with script-expanded steps
+ */
+async function expandLocalScriptJob(root, job, context) {
+    const expanded = await expandLocalScriptSteps(root, job.steps, context);
+    return {
+        remainingScripts: expanded.remainingScripts,
+        value: {
+            ...job,
+            steps: expanded.value,
+        },
+    };
+}
+/**
+ * Expand local scripts across a job's steps under the shared budget.
+ * @param root - Repository root
+ * @param steps - Parsed workflow steps
+ * @param context - Shared expansion budget
+ * @returns Expanded steps and updated budget
+ */
+async function expandLocalScriptSteps(root, steps, context) {
+    const [step, ...rest] = steps;
+    if (step === undefined) {
+        return { value: [], remainingScripts: context.remainingScripts };
+    }
+    const expandedStep = await expandLocalScriptStep(root, step, context);
+    const expandedRest = await expandLocalScriptSteps(root, rest, {
+        remainingScripts: expandedStep.remainingScripts,
+    });
+    return {
+        remainingScripts: expandedRest.remainingScripts,
+        value: [expandedStep.value, ...expandedRest.value],
+    };
+}
+/**
+ * Inline directly invoked local shell scripts into the parsed workflow commands.
+ * @param root - Repository root
+ * @param workflows - Parsed workflow files
+ * @returns Workflows with bounded script content appended to matching steps
+ */
+export async function expandLocalScriptCommands(root, workflows) {
+    const expanded = await expandLocalScriptWorkflows(root, workflows, {
+        remainingScripts: MAX_LOCAL_SCRIPT_EXPANSIONS,
+    });
+    return expanded.value;
+}
+/**
+ * Expand local scripts across workflows under the shared budget.
+ * @param root - Repository root
+ * @param workflows - Parsed workflow files
+ * @param context - Shared expansion budget
+ * @returns Expanded workflows and updated budget
+ */
+async function expandLocalScriptWorkflows(root, workflows, context) {
+    const [workflow, ...rest] = workflows;
+    if (workflow === undefined) {
+        return { value: [], remainingScripts: context.remainingScripts };
+    }
+    const expandedJobs = await expandLocalScriptJobs(root, workflow.jobs, context);
+    const expandedRest = await expandLocalScriptWorkflows(root, rest, {
+        remainingScripts: expandedJobs.remainingScripts,
+    });
+    return {
+        remainingScripts: expandedRest.remainingScripts,
+        value: [
+            {
+                ...workflow,
+                jobs: expandedJobs.value,
+            },
+            ...expandedRest.value,
+        ],
+    };
+}
+/**
+ * Expand local scripts across workflow jobs under the shared budget.
+ * @param root - Repository root
+ * @param jobs - Parsed workflow jobs
+ * @param context - Shared expansion budget
+ * @returns Expanded jobs and updated budget
+ */
+async function expandLocalScriptJobs(root, jobs, context) {
+    const [job, ...rest] = jobs;
+    if (job === undefined) {
+        return { value: [], remainingScripts: context.remainingScripts };
+    }
+    const expandedJob = await expandLocalScriptJob(root, job, context);
+    const expandedRest = await expandLocalScriptJobs(root, rest, {
+        remainingScripts: expandedJob.remainingScripts,
+    });
+    return {
+        remainingScripts: expandedRest.remainingScripts,
+        value: [expandedJob.value, ...expandedRest.value],
+    };
+}
+//# sourceMappingURL=doctor-readiness-local-scripts.js.map

package/dist/cli/doctor-readiness-local-scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-readiness-local-scripts.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-local-scripts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAOlC,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,+DAA+D;AAC/D,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAEvC,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAEtD,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAEpE,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAalD;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,KAAwB,EAAE,KAAK,GAAG,CAAC;IAC5D,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,KAAwB,EACxB,KAAa;IAEb,OAAO,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5C,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,KAAwB;IAExB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,cAAc,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC;QACxD,CAAC,CAAC,qBAAqB,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO;QACL,GAAG,IAAI,GAAG,CACR,OAAO;aACJ,KAAK,CAAC,0BAA0B,CAAC;aACjC,OAAO,CAAC,UAAU,CAAC,EAAE;YACpB,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;YACpC,IACE,SAAS,KAAK,SAAS;gBACvB,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAC1B,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,IACE,CAAC,MAAM,CAAC,UAAU;gBAClB,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACxB,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAC3B,CAAC;gBACD,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC,CAAC;aACD,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,eAAe,CAC5B,IAAY,EACZ,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,MAAM,EACN,CAAC,EACD,sBAAsB,GAAG,CAAC,EAC1B,CAAC,CACF,CAAC;YACF,OAAO,SAAS,GAAG,sBAAsB;gBACvC,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,IAAwB,EACxB,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,IAAI,EACJ,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1B,OAAO,CAAC,gBAAgB,CACzB,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,KAAK,EACH,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KACjE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,uBAAuB,CACpC,IAAY,EACZ,OAA0B,EAC1B,gBAAwB;IAExB,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IAClC,IAAI,MAAM,KAAK,SAAS,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,IAAI,EACJ,IAAI,EACJ,gBAAgB,GAAG,CAAC,CACrB,CAAC;IACF,OAAO;QACL,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,GAAsB,EACtB,OAAyB;IAEzB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACxE,OAAO;QACL,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,KAAK,EAAE;YACL,GAAG,GAAG;YACN,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,sBAAsB,CACnC,IAAY,EACZ,KAAoC,EACpC,OAAyB;IAEzB,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,MAAM,sBAAsB,CAAC,IAAI,EAAE,IAAI,EAAE;QAC5D,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,KAAK,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAY,EACZ,SAAoC;IAEpC,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,SAAS,EAAE;QACjE,gBAAgB,EAAE,2BAA2B;KAC9C,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,KAAK,CAAC;AACxB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,0BAA0B,CACvC,IAAY,EACZ,SAAoC,EACpC,OAAyB;IAEzB,MAAM,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,IAAI,EACJ,QAAQ,CAAC,IAAI,EACb,OAAO,CACR,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,0BAA0B,CAAC,IAAI,EAAE,IAAI,EAAE;QAChE,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;KAChD,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,KAAK,EAAE;YACL;gBACE,GAAG,QAAQ;gBACX,IAAI,EAAE,YAAY,CAAC,KAAK;aACzB;YACD,GAAG,YAAY,CAAC,KAAK;SACtB;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,qBAAqB,CAClC,IAAY,EACZ,IAAkC,EAClC,OAAyB;IAEzB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE;QAC3D,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;KAC/C,CAAC,CAAC;IACH,OAAO;QACL,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;QAC/C,KAAK,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-promoted-artifact.d.ts

@@ -6,6 +6,12 @@ import type { ParsedWorkflowJob, ParsedWorkflowStep } from "./doctor-readiness-w
 import type { ReleasePathOutcome } from "./doctor-readiness-release-path.js";
 /** The GitHub Actions promotion step Lisa recognizes for CI-built artifacts. */
 export declare const PROMOTION_ACTION = "actions/download-artifact";
+/**
+ * Whether an action step publishes something externally.
+ * @param step - The step to classify
+ * @returns True when the action is a known publishing action
+ */
+export declare function isPublishAction(step: ParsedWorkflowStep): boolean;
 /**
  * Whether an action reference is the trusted artifact-promotion action.
  * @param uses - Raw action reference
@@ -16,9 +22,25 @@ export declare function isPromotionAction(uses: string): boolean;
  * Whether the job promotes an artifact produced by another job.
  * @param job - The publishing job
  * @param publishStep - The step that ships
+ * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
  * @returns True when a download-artifact step is present before publication
  */
-export declare function promotesValidatedArtifact(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep): boolean;
+export declare function promotesValidatedArtifact(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep, ancestorJobs?: readonly ParsedWorkflowJob[]): boolean;
+/**
+ * Whether a named artifact download disagrees with named ancestor uploads.
+ * @param job - The publishing job
+ * @param publishStep - The step that ships
+ * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
+ * @returns True when the downloaded artifact name is not uploaded by any ancestor
+ */
+export declare function hasArtifactNameMismatch(job: ParsedWorkflowJob, publishStep: ParsedWorkflowStep, ancestorJobs: readonly ParsedWorkflowJob[]): boolean;
+/**
+ * The release job downloaded a named artifact different from anything a
+ * validating ancestor uploaded, so the shipped bytes are not the tested bytes.
+ * @param where - Evidence location label
+ * @returns The violation outcome
+ */
+export declare function artifactNameMismatch(where: string): ReleasePathOutcome;
 /**
  * A downloaded artifact without linked validation is unestablished, not clean.
  * @param where - Evidence location label

package/dist/cli/doctor-readiness-promoted-artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-promoted-artifact.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-promoted-artifact.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAE5D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,WAAW,EAAE,kBAAkB,GAC9B,OAAO,CAIT;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAQ5E"}
+{"version":3,"file":"doctor-readiness-promoted-artifact.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-promoted-artifact.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AA4B5D;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAMjE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD;AA6CD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,WAAW,EAAE,kBAAkB,EAC/B,YAAY,GAAE,SAAS,iBAAiB,EAAO,GAC9C,OAAO,CAWT;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,iBAAiB,EACtB,WAAW,EAAE,kBAAkB,EAC/B,YAAY,EAAE,SAAS,iBAAiB,EAAE,GACzC,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAOtE;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,CAQ5E"}

package/dist/cli/doctor-readiness-promoted-artifact.js

@@ -1,24 +1,127 @@
 /** The GitHub Actions promotion step Lisa recognizes for CI-built artifacts. */
 export const PROMOTION_ACTION = "actions/download-artifact";
+const DOCKER_BUILD_PUSH_ACTION = "docker/build-push-action";
+const GITHUB_RELEASE_ACTION = "softprops/action-gh-release";
+const PYPI_PUBLISH_ACTION = "pypa/gh-action-pypi-publish";
+const UPLOAD_ARTIFACT_ACTION = "actions/upload-artifact";
+/**
+ * Normalize an action reference to its owner/repo component.
+ * @param uses - Raw `uses:` value
+ * @returns Lowercase action id without an `@ref`
+ */
+function actionId(uses) {
+    return (uses.split("@")[0] ?? "").trim().toLowerCase();
+}
+/**
+ * Whether a serialized `with:` block sets a boolean option to true.
+ * @param inputs - Flattened step inputs
+ * @param name - Input name to read
+ * @returns True when the option is explicitly true
+ */
+function hasTrueInput(inputs, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    return new RegExp(`(^|\\n)${escaped}:\\s*['"]?true['"]?(\\s|$)`, "i").test(inputs);
+}
+/**
+ * Whether an action step publishes something externally.
+ * @param step - The step to classify
+ * @returns True when the action is a known publishing action
+ */
+export function isPublishAction(step) {
+    const id = actionId(step.uses);
+    if (id === DOCKER_BUILD_PUSH_ACTION) {
+        return hasTrueInput(step.inputs, "push");
+    }
+    return id === PYPI_PUBLISH_ACTION || id === GITHUB_RELEASE_ACTION;
+}
 /**
  * Whether an action reference is the trusted artifact-promotion action.
  * @param uses - Raw action reference
  * @returns True when the action id is exactly actions/download-artifact
  */
 export function isPromotionAction(uses) {
-    const actionId = uses.split("@")[0]?.trim();
-    return actionId === PROMOTION_ACTION;
+    return actionId(uses) === PROMOTION_ACTION;
+}
+/**
+ * Whether an action reference uploads an artifact produced by CI.
+ * @param uses - Raw action reference
+ * @returns True when the action id is exactly actions/upload-artifact
+ */
+function isUploadAction(uses) {
+    return actionId(uses) === UPLOAD_ARTIFACT_ACTION;
+}
+/**
+ * Read a scalar step input from the parser's flattened `with:` text.
+ * @param inputs - Flattened step inputs
+ * @param name - Input name to read
+ * @returns The input value, or null when absent
+ */
+function stepInput(inputs, name) {
+    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const match = new RegExp(`(^|\\n)${escaped}:\\s*(.+)(\\n|$)`).exec(inputs);
+    const value = match?.[2]?.trim();
+    if (value === undefined || value === "") {
+        return null;
+    }
+    return value.replace(/^['"]|['"]$/g, "");
+}
+/**
+ * List artifact names uploaded by jobs whose outputs have already been validated.
+ * @param validatingAncestorJobs - Validating jobs in the publishing job's `needs:` closure
+ * @returns Uploaded artifact names
+ */
+function uploadedArtifactNames(validatingAncestorJobs) {
+    return new Set(validatingAncestorJobs.flatMap(job => job.steps
+        .filter(step => isUploadAction(step.uses))
+        .map(step => stepInput(step.inputs, "name"))
+        .filter((name) => name !== null)));
 }
 /**
  * Whether the job promotes an artifact produced by another job.
  * @param job - The publishing job
  * @param publishStep - The step that ships
+ * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
  * @returns True when a download-artifact step is present before publication
  */
-export function promotesValidatedArtifact(job, publishStep) {
-    return job.steps
-        .slice(0, job.steps.indexOf(publishStep))
-        .some(step => isPromotionAction(step.uses));
+export function promotesValidatedArtifact(job, publishStep, ancestorJobs = []) {
+    const uploads = uploadedArtifactNames(ancestorJobs);
+    return job.steps.slice(0, job.steps.indexOf(publishStep)).some(step => {
+        if (!isPromotionAction(step.uses)) {
+            return false;
+        }
+        const downloadName = stepInput(step.inputs, "name");
+        return (downloadName === null || uploads.size === 0 || uploads.has(downloadName));
+    });
+}
+/**
+ * Whether a named artifact download disagrees with named ancestor uploads.
+ * @param job - The publishing job
+ * @param publishStep - The step that ships
+ * @param ancestorJobs - Jobs in the publishing job's `needs:` closure
+ * @returns True when the downloaded artifact name is not uploaded by any ancestor
+ */
+export function hasArtifactNameMismatch(job, publishStep, ancestorJobs) {
+    const uploads = uploadedArtifactNames(ancestorJobs);
+    return job.steps.slice(0, job.steps.indexOf(publishStep)).some(step => {
+        if (!isPromotionAction(step.uses)) {
+            return false;
+        }
+        const downloadName = stepInput(step.inputs, "name");
+        return downloadName !== null && !uploads.has(downloadName);
+    });
+}
+/**
+ * The release job downloaded a named artifact different from anything a
+ * validating ancestor uploaded, so the shipped bytes are not the tested bytes.
+ * @param where - Evidence location label
+ * @returns The violation outcome
+ */
+export function artifactNameMismatch(where) {
+    return {
+        kind: "violation",
+        evidence: `${where} downloads a named artifact that no validating ancestor uploads, ` +
+            "so the release path cannot prove the shipped artifact is the one CI tested",
+    };
 }
 /**
  * A downloaded artifact without linked validation is unestablished, not clean.

package/dist/cli/doctor-readiness-promoted-artifact.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-promoted-artifact.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-promoted-artifact.ts"],"names":[],"mappings":"AAUA,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAE5D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,OAAO,QAAQ,KAAK,gBAAgB,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAsB,EACtB,WAA+B;IAE/B,OAAO,GAAG,CAAC,KAAK;SACb,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACxC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EACJ,GAAG,KAAK,+BAA+B,gBAAgB,aAAa;YACpE,2EAA2E;YAC3E,uEAAuE;KAC1E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"doctor-readiness-promoted-artifact.js","sourceRoot":"","sources":["../../src/cli/doctor-readiness-promoted-artifact.ts"],"names":[],"mappings":"AAUA,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,wBAAwB,GAAG,0BAA0B,CAAC;AAC5D,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,sBAAsB,GAAG,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,SAAS,YAAY,CAAC,MAAc,EAAE,IAAY;IAChD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,OAAO,IAAI,MAAM,CAAC,UAAU,OAAO,4BAA4B,EAAE,GAAG,CAAC,CAAC,IAAI,CACxE,MAAM,CACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,EAAE,KAAK,wBAAwB,EAAE,CAAC;QACpC,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,KAAK,mBAAmB,IAAI,EAAE,KAAK,qBAAqB,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,gBAAgB,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,sBAAsB,CAAC;AACnD,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,MAAc,EAAE,IAAY;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,UAAU,OAAO,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAC5B,sBAAoD;IAEpD,OAAO,IAAI,GAAG,CACZ,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CACnC,GAAG,CAAC,KAAK;SACN,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SACzC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC3C,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,CACnD,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,GAAsB,EACtB,WAA+B,EAC/B,eAA6C,EAAE;IAE/C,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,OAAO,CACL,YAAY,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CACzE,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAsB,EACtB,WAA+B,EAC/B,YAA0C;IAE1C,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QACpE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpD,OAAO,YAAY,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,QAAQ,EACN,GAAG,KAAK,mEAAmE;YAC3E,4EAA4E;KAC/E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EACJ,GAAG,KAAK,+BAA+B,gBAAgB,aAAa;YACpE,2EAA2E;YAC3E,uEAAuE;KAC1E,CAAC;AACJ,CAAC"}

package/dist/cli/doctor-readiness-release-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor-readiness-release-path.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-release-path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AAYzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAwF3E,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAW7D;AAuDD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,iBAAiB,GACrB,SAAS,kBAAkB,EAAE,CAE/B;AAmJD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,iBAAiB,EACtB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,EACnC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,GACvC,SAAS,kBAAkB,EAAE,CA8B/B"}
+{"version":3,"file":"doctor-readiness-release-path.d.ts","sourceRoot":"","sources":["../../src/cli/doctor-readiness-release-path.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,iCAAiC,CAAC;AAezC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAgF3E,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAE/B;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAW7D;AA4BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,iBAAiB,GACrB,SAAS,kBAAkB,EAAE,CAE/B;AAmJD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,iBAAiB,EACtB,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,EACnC,YAAY,CAAC,EAAE,SAAS,cAAc,EAAE,GACvC,SAAS,kBAAkB,EAAE,CAuC/B"}

package/dist/cli/doctor-readiness-release-path.js

@@ -1,17 +1,8 @@
-import { ancestorJobs, reusableCallerValidation, } from "./doctor-readiness-reusable-callers.js";
-import { isPromotionAction, promotesValidatedArtifact, PROMOTION_ACTION, unresolvedPromotedArtifact, } from "./doctor-readiness-promoted-artifact.js";
+import { ancestorJobs as ancestors, reusableCallerValidation, } from "./doctor-readiness-reusable-callers.js";
+import { artifactNameMismatch, hasArtifactNameMismatch, isPublishAction, isPromotionAction, promotesValidatedArtifact, PROMOTION_ACTION, unresolvedPromotedArtifact, } from "./doctor-readiness-promoted-artifact.js";
 export { PROMOTION_ACTION } from "./doctor-readiness-promoted-artifact.js";
-const PUBLISH_VERBS = [
-    "npm publish",
-    "docker push",
-    "gh release upload",
-    "aws s3 sync",
-    "cdk deploy",
-    "eas submit",
-];
+const PUBLISH_VERB = /(npm publish|docker push|gh release upload|aws s3 sync|cdk deploy|eas submit)/;
 const DOCKER_BUILD_PUSH_ACTION = "docker/build-push-action";
-const PYPI_PUBLISH_ACTION = "pypa/gh-action-pypi-publish";
-const GITHUB_RELEASE_ACTION = "softprops/action-gh-release";
 /** Commands that actually run a test suite. */
 const VALIDATING_COMMANDS = [
     /\b(npm|yarn|pnpm|bun|npx|bunx)\s+(run\s+)?test\b/,
@@ -101,28 +92,6 @@ const DRY_RUN_FLAG = /--dry[-_]?run\b/;
 function actionId(uses) {
     return (uses.split("@")[0] ?? "").trim().toLowerCase();
 }
-/**
- * Whether a serialized `with:` block sets a boolean option to true.
- * @param inputs - Flattened step inputs
- * @param name - Input name to read
- * @returns True when the option is explicitly true
- */
-function hasTrueInput(inputs, name) {
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    return new RegExp(`(^|\\n)${escaped}:\\s*['"]?true['"]?(\\s|$)`, "i").test(inputs);
-}
-/**
- * Whether an action step publishes something externally.
- * @param step - The step to classify
- * @returns True when the action is a known publishing action
- */
-function isPublishAction(step) {
-    const id = actionId(step.uses);
-    if (id === DOCKER_BUILD_PUSH_ACTION) {
-        return hasTrueInput(step.inputs, "push");
-    }
-    return id === PYPI_PUBLISH_ACTION || id === GITHUB_RELEASE_ACTION;
-}
 /**
  * Whether a step actually puts an artifact in front of users. A `--dry-run`
  * invocation names a publish verb but ships nothing, so faulting its release
@@ -131,8 +100,7 @@ function isPublishAction(step) {
  * @returns True when the step really publishes
  */
 function isPublishStep(step) {
-    return ((PUBLISH_VERBS.some(verb => step.run.includes(verb)) &&
-        !DRY_RUN_FLAG.test(step.run)) ||
+    return ((PUBLISH_VERB.test(step.run) && !DRY_RUN_FLAG.test(step.run)) ||
         isPublishAction(step));
 }
 /**
@@ -169,7 +137,7 @@ function validationPrecedesPublish(workflow, job, publishStep, allWorkflows) {
         "validated") {
         return true;
     }
-    if (ancestorJobs(workflow, job).some(isValidatingJob)) {
+    if (ancestors(workflow, job).some(isValidatingJob)) {
         return true;
     }
     return job.steps
@@ -260,16 +228,21 @@ function offlineUnresolvableTrigger(workflow, defaultBranches, allWorkflows) {
 export function assessReleasePaths(workflow, job, defaultBranches, allWorkflows) {
     return findPublishSteps(job).map(publishStep => {
         const where = `${workflow.file} job \`${job.id}\` step \`${describeStep(publishStep)}\``;
+        const validatingAncestors = ancestors(workflow, job).filter(isValidatingJob);
         const validated = validationPrecedesPublish(workflow, job, publishStep, allWorkflows);
         if (shipsSelfBuiltArtifact(job, publishStep)) {
             return validated
                 ? rebuildPastValidation(where)
                 : unvalidatedSelfBuild(where, workflow, defaultBranches, allWorkflows);
         }
+        if (validated &&
+            hasArtifactNameMismatch(job, publishStep, validatingAncestors)) {
+            return artifactNameMismatch(where);
+        }
         if (validated) {
             return { kind: "clean" };
         }
-        if (promotesValidatedArtifact(job, publishStep))
+        if (promotesValidatedArtifact(job, publishStep, validatingAncestors))
             return unresolvedPromotedArtifact(where);
         // Neither built here nor promoted from CI, and nothing validating precedes it:
         // the link between what ships and what was validated is simply not observable