@cplieger/deadset-ts 8.0.0-dev.17 → 8.0.0-dev.19

package/src/conformance-record.ts

@@ -4,7 +4,7 @@ export const RECORD = {
   conformance: {
     corpusVersion: "6.0.0",
     result: "pass",
-    digest: "sha256:a4ffbc1c2d9dc7903ccbf52af0e1a22094e0b50363f59365f6aa37b9437d3427",
+    digest: "sha256:e4af2b9bcd07fd745101bf3215cd21e9df1448bdc332a791f25d5676cf15c794",
   },
   gaps: [],
 } as const;

package/src/contract/contract.generated.ts

@@ -423,7 +423,7 @@ export const KIND_ROWS = [
     holdsLive: true,
     rule: "An exported symbol whose every reference is inside the symbol's own package or module, reported as a candidate for unexporting. The subject is a package-level declaration or a method. Three subjects are excluded. An interface method is excluded because its exportedness is the contract of the interface that declares it. A struct field is excluded because an encoder reads it by name. A method that satisfies an interface some symbol uses as a type is excluded because it cannot be unexported without its type ceasing to satisfy that interface, and so is a method whose name and signature are those of a method of an exported interface type declared by a package outside the target that the import closure holds, because that interface fixes them whether or not the program converts the method's type to it. The finding names the narrower visibility the references support. A declared cross-language edge counts as an out-of-package reference. Where the edge's other side is unknown to the analyzer, the finding is emitted pending. A reference from a Go external test package, a test file whose package clause names its directory's package with the suffix _test, is a reference from outside the package, because that test builds as another package and needs the export.",
     precondition:
-      "Closed world only. A Go main package, and an internal/ directory tree for importers outside its parent, are closed worlds whatever the configuration declares, because no other program can import them, so this finding is reported there always. A published package is a closed world only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first. A type that a parameter or a result of an exported function or method of its own package names is not reported when a reference from outside the package references that function or method, because the caller holds values of the type, and unexporting it would leave an exported signature naming a type its callers cannot name. A package-level declaration whose name a string literal spells carries the class grammar/analysis/confidence.md gives it.",
+      "Closed world only. A Go main package, and an internal/ directory tree for importers outside its parent, are closed worlds whatever the configuration declares, because no other program can import them, so this finding is reported there always. A published package is a closed world only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first. A type is not reported when a reference from outside the package reaches its values through its own package's exported declarations: a reference to an exported function or method whose parameters or results name the type, to an exported variable or constant whose type names it, to an exported field or property whose type names it, an embedded field included, or to an exported member of the type itself, a field promoted through an embedding included. A type a reference from outside the package names, or whose values such a reference reaches, passes the reach on to each type its definition names other than through an unexported member, whether it is exported or not, so an unexported type an exported function returns passes it to the types its exported fields name. A type names another through every composite that spells it: a pointer, an array, a slice, a map key or value, a channel, a function signature and a type argument. The referencing code holds values of the type, so unexporting it would leave an exported declaration naming a type its users cannot name. A package-level declaration whose name a string literal spells carries the class grammar/analysis/confidence.md gives it.",
     details: { narrower_visibility: "required", name_literal: "optional" },
     defaultEnabled: true,
     defaultSeverity: "warn",
@@ -439,7 +439,7 @@ export const KIND_ROWS = [
     holdsLive: true,
     rule: "An exported symbol of a non-internal package whose every reference is inside the target module, reported as a candidate for relocation behind an internal boundary. The subject is a package-level declaration or a method. Three subjects are excluded. An interface method is excluded because its exportedness is the contract of the interface that declares it. A struct field is excluded because an encoder reads it by name. A method that satisfies an interface some symbol uses as a type is excluded because it cannot be unexported without its type ceasing to satisfy that interface, and so is a method whose name and signature are those of a method of an exported interface type declared by a package outside the target that the import closure holds, because that interface fixes them whether or not the program converts the method's type to it. The finding names the narrower visibility the references support. A declared cross-language edge counts as an out-of-package reference. Where the edge's other side is unknown to the analyzer, the finding is emitted pending. A reference from a Go external test package, a test file whose package clause names its directory's package with the suffix _test, is a reference from outside the package, because that test builds as another package and needs the export.",
     precondition:
-      "Closed world only. Reported always for a main package and an internal/ directory tree, and for a published package only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first. A type that a parameter or a result of an exported function or method of its own package names is not reported when a reference from outside the target module references that function or method, because the caller holds values of the type, and moving it behind an internal boundary would leave an exported signature naming a type its callers cannot name.",
+      "Closed world only. Reported always for a main package and an internal/ directory tree, and for a published package only when the configuration declares the consumer set complete and every declared consumer loads. A library with no consumer loaded and no complete consumer set declared gets this finding on its internal/ tree and its main packages and never on its published API. A symbol the rule of DS1301 holds for is not reported under this code, whatever severity the configuration gives DS1301, because the write-only finding names the defect to fix first. A type is not reported when a reference from outside the target module reaches its values through its own package's exported declarations, as DS1501 defines that reach, because the referencing code holds values of the type, and moving it behind an internal boundary would leave an exported declaration naming a type its users cannot name.",
     details: { narrower_visibility: "required", name_literal: "optional" },
     defaultEnabled: true,
     defaultSeverity: "warn",
@@ -1280,6 +1280,13 @@ export const EVIDENCE = [
       "DS1602",
     ],
   },
+  {
+    evidence: "unwritten-run-path",
+    rule: "confidence.35",
+    class: "possible",
+    languages: ["ts"],
+    codes: ["DS1601", "DS1602"],
+  },
   {
     evidence: "schema-operation-default",
     rule: "schemas.10",

package/src/dependencies.ts

@@ -519,7 +519,7 @@ interface CommandUses {
   readonly words: ReadonlySet<string>;
   /** The package each module a read command preloads by name is in. */
   readonly preloads: ReadonlySet<string>;
-  /** The text layer 3 reads, all of every string, whose every package or command name is a use. */
+  /** The whole text of every string, which the dependency rule reads: each package or command name in it is a use. */
   readonly held: string;
 }
 

package/src/entries/conventions.ts

@@ -23,13 +23,8 @@ import {
   type TestFileReading,
 } from "./convention-rows.ts";
 import { documentStrings } from "./configuration-files.ts";
-import { readCommands } from "../commands/read.ts";
-import {
-  nodeTestGlobs,
-  type RunnerInput,
-  type ScriptCommand,
-  type TestGlob,
-} from "./test-runners.ts";
+import { readCommands, type CommandReading } from "../commands/read.ts";
+import { nodeTestGlobs, type RunnerInput, type TestGlob } from "./test-runners.ts";
 import {
   documentModule,
   membersNamed,
@@ -814,12 +809,12 @@ function packageKeyUses(
   );
 }
 
-/** Every simple command of a manifest's `scripts`, as the command reader reads it in the manifest's directory. */
-function scriptCommands(manifest: unknown, dir: string): readonly ScriptCommand[] {
+/** What the command reader reads each of a manifest's `scripts` as, in the manifest's directory. */
+function scriptReadings(manifest: unknown, dir: string): readonly CommandReading[] {
   const scripts = isRecord(manifest) ? manifest["scripts"] : undefined;
   return isRecord(scripts)
     ? Object.values(scripts).flatMap((text) =>
-        typeof text === "string" ? readCommands(text, dir).commands : [],
+        typeof text === "string" ? [readCommands(text, dir)] : [],
       )
     : [];
 }
@@ -846,6 +841,7 @@ export function readConventions(
   const read = readFilesOnce(host, parse);
   for (const manifest of manifests) {
     const declared = readJSON(host, joinPath(manifest.dir, MANIFEST));
+    const scripts = scriptReadings(declared, manifest.dir);
     let input: RunnerInput | undefined;
     const runnerInput = (): RunnerInput => {
       input ??= {
@@ -861,7 +857,7 @@ export function readConventions(
           }
           return undefined;
         },
-        scripts: scriptCommands(declared, manifest.dir),
+        scripts: scripts.flatMap((one) => one.commands),
       };
       return input;
     };
@@ -965,7 +961,7 @@ export function readConventions(
         });
       }
     }
-    testGlobs.push(...nodeTestGlobs(runnerInput().scripts));
+    testGlobs.push(...nodeTestGlobs(scripts.flatMap((one) => one.tests)));
   }
   const unique = [...new Map(applied.map((one) => [JSON.stringify(one), one])).values()];
   unique.sort(

package/src/entries/test-runners.ts

@@ -5,6 +5,7 @@
  * source reads them. A value a reader needs that the text does not write out names no file.
  */
 
+import type { CommandTests } from "../commands/read.ts";
 import { readJSON, readJSONFile } from "../fs/manifest.ts";
 import type { Host } from "../host.ts";
 import { ancestors, dirnamePath, joinPath, relativePath, resolvePath } from "../paths.ts";
@@ -27,7 +28,7 @@ export interface TestGlob {
 }
 
 /** One simple command of a manifest's scripts, a dynamic word `undefined`, in the directory it runs in. */
-export interface ScriptCommand {
+interface ScriptCommand {
   readonly dir: string;
   readonly words: readonly (string | undefined)[];
 }
@@ -140,8 +141,6 @@ interface OptionTable {
   /** The options that take the next word, or the text after `=`, as their value. */
   readonly valued: ReadonlySet<string>;
   readonly flags: ReadonlySet<string>;
-  /** Whether a long option the table does not name is read where its value follows `=`. */
-  readonly assigned?: boolean;
 }
 
 /** One command's options and operands. */
@@ -182,7 +181,7 @@ function parsed(words: readonly (string | undefined)[], table: OptionTable): Par
       keep(name, value);
     } else if (table.flags.has(name)) {
       keep(name, equals < 0 ? "true" : word.slice(equals + 1));
-    } else if (!(table.assigned === true && equals > 0)) {
+    } else {
       return undefined;
     }
   }
@@ -813,32 +812,6 @@ export const AVA_6 = avaRunner(AVA_CONFIG, ["cjs", "mjs", "js"]);
 /** AVA 8, which reads no `ava.config.cjs` and defaults to no `.cjs` test. */
 export const AVA_8 = avaRunner(["ava.config.js", "ava.config.mjs"], ["mjs", "js"]);
 
-/**
- * The options of `node` (https://nodejs.org/api/cli.html) a test run writes: the ones that take
- * a value, the flags, and any long option whose value follows `=`.
- */
-const NODE_OPTIONS: OptionTable = {
-  valued: new Set([
-    ...["-r", "--require", "--import", "--loader", "--experimental-loader", "--env-file"],
-    ...["--env-file-if-exists", "--conditions", "-C", "--input-type", "--watch-path"],
-    ...["--test-reporter", "--test-reporter-destination", "--test-concurrency"],
-    ...["--test-name-pattern", "--test-skip-pattern", "--test-timeout", "--test-shard"],
-    ...["--test-coverage-include", "--test-coverage-exclude", "--test-coverage-branches"],
-    ...["--test-coverage-functions", "--test-coverage-lines", "--test-isolation"],
-    ...["--test-global-setup"],
-  ]),
-  flags: new Set([
-    ...["--test", "--test-only", "--watch", "--test-force-exit", "--test-update-snapshots"],
-    ...["--test-randomize", "--experimental-test-coverage", "--experimental-test-module-mocks"],
-    ...["--experimental-test-snapshots", "--experimental-strip-types", "--no-strip-types"],
-    ...["--no-experimental-strip-types", "--experimental-transform-types", "--enable-source-maps"],
-    ...["--experimental-vm-modules", "--experimental-detect-module", "--no-warnings"],
-    ...["--no-experimental-detect-module", "--experimental-require-module", "--trace-warnings"],
-    ...["--no-experimental-require-module", "--expose-gc", "--inspect", "--inspect-brk"],
-  ]),
-  assigned: true,
-};
-
 /** The patterns `node --test` runs with no operand (`doc/api/test.md`), the TypeScript ones where types are stripped. */
 function nodeTestDefaults(stripped: boolean): readonly string[] {
   const forms = ["**/*.test", "**/*-test", "**/*_test", "**/test-*", "**/test", "**/test/**/*"];
@@ -849,20 +822,14 @@ function nodeTestDefaults(stripped: boolean): readonly string[] {
 }
 
 /**
- * The files each `node --test` command of a manifest's scripts runs: its operands, each a glob
- * read in the command's directory, or the default patterns where it writes none. A command
- * holding a dynamic word or an option {@link NODE_OPTIONS} does not name runs no file here.
+ * The files each `node --test` run of a manifest's scripts runs, as the command reader reads
+ * it: its operands, each a glob read in the command's directory, or the default patterns where
+ * it writes none.
  */
-export function nodeTestGlobs(scripts: readonly ScriptCommand[]): readonly TestGlob[] {
-  return scripts.flatMap((command) => {
-    const words = afterProgram(command, ["node"]);
-    const read = words === undefined ? undefined : parsed(words, NODE_OPTIONS);
-    if (!read?.values.has("--test")) {
-      return [];
-    }
-    const stripped =
-      !read.values.has("--no-strip-types") && !read.values.has("--no-experimental-strip-types");
-    const patterns = read.operands.length > 0 ? read.operands : nodeTestDefaults(stripped);
-    return patterns.map((one) => belowGlob(command.dir, one));
-  });
+export function nodeTestGlobs(runs: readonly CommandTests[]): readonly TestGlob[] {
+  return runs.flatMap((run) =>
+    (run.patterns.length > 0 ? run.patterns : nodeTestDefaults(run.stripped)).map((one) =>
+      belowGlob(run.dir, one),
+    ),
+  );
 }

package/src/entries/workflow-steps.ts

@@ -1,12 +1,14 @@
 /**
  * The command strings beside a target root's packages: a CI workflow's `run:` steps, the git
- * hooks, the hook managers' commands and the makefile's recipe lines, each with the directory
- * it runs in. A workflow or hook manager file is read by `text/yaml.ts`, and one it does not
+ * hooks, the hook managers' commands and scripts and the makefile's recipe lines, each with the
+ * directory it runs in. A workflow or hook manager file is read by `text/yaml.ts`, and one it does not
  * read gives no command; each command is read by `commands/read.ts`.
  */
 
 import type { SourceFile } from "@typescript/native/ast";
+import type { HeldText } from "../commands/held.ts";
 import { pathsNamed, readCommands, type CommandReading } from "../commands/read.ts";
+import { PART } from "../commands/shell.ts";
 import type { Host } from "../host.ts";
 import { isRecord } from "../json-document.ts";
 import { joinPath, resolvePath } from "../paths.ts";
@@ -29,8 +31,6 @@ interface CommandString {
    * where: a directory holding a `${{ }}` expression, which GitHub Actions evaluates.
    */
   readonly dir: string | undefined;
-  /** The directory the file writes for it, as YAML decodes it, which layer 3 holds beside the text. */
-  readonly writtenDirectory: string | undefined;
 }
 
 const WORKFLOWS = ".github/workflows";
@@ -41,16 +41,32 @@ const HOOK_DIRS = [".husky", ".githooks"] as const;
 /** The key setting the directory a workflow step, or each step a `defaults.run` covers, runs in. */
 const WORKING_DIRECTORY = "working-directory";
 
+/** One hook manager's file. */
+interface HookManager {
+  readonly name: string;
+  /** The key its commands are written under. */
+  readonly key: string;
+  /** The key of a command's directory: lefthook's `root`, https://lefthook.dev/configuration/root/ */
+  readonly dirKey?: string;
+  /** Whether its hooks name script files it runs, as lefthook's do. */
+  readonly scripts?: true;
+}
+
+const HOOK_MANAGERS: readonly HookManager[] = [
+  { name: ".pre-commit-config.yaml", key: "entry" },
+  ...["lefthook.yml", "lefthook.yaml", ".lefthook.yml"].map((name): HookManager => ({
+    name,
+    key: "run",
+    dirKey: "root",
+    scripts: true,
+  })),
+];
+
 /**
- * The hook manager files, each with the key its commands are written under and the key of their
- * directory: lefthook's `root`, https://lefthook.dev/configuration/root/
+ * The directories lefthook searches for a hook's scripts after the file's `source_dir` and
+ * `source_dir_local`: https://github.com/evilmartians/lefthook/blob/master/internal/command/run.go
  */
-const HOOK_MANAGERS: readonly (readonly [string, string, string | undefined])[] = [
-  [".pre-commit-config.yaml", "entry", undefined],
-  ...["lefthook.yml", "lefthook.yaml", ".lefthook.yml"].map(
-    (name) => [name, "run", "root"] as const,
-  ),
-];
+const LEFTHOOK_DIRS = [".config/lefthook", ".config/lefthook-local"] as const;
 
 /** The names GNU make reads a makefile under, in the order it tries them. */
 const MAKEFILES = ["GNUmakefile", "makefile", "Makefile"] as const;
@@ -112,7 +128,6 @@ function keyedCommands(
             : written.includes("${{")
               ? undefined
               : resolvePath(root, written),
-        writtenDirectory: written,
       });
     }
     for (const value of Object.values(node)) {
@@ -123,6 +138,52 @@ function keyedCommands(
   return found;
 }
 
+/**
+ * The command lefthook runs for each script a lefthook file's hooks name, each key of a hook's
+ * `scripts` and each `script` of a job in its `jobs`, a group's among them, from each directory
+ * it searches: its `runner`, then the path `<dir>/<hook>/<name>` quoted as lefthook quotes it,
+ * run in the target root: https://lefthook.dev/configuration/Scripts/
+ */
+function lefthookScripts(text: string, root: string): readonly CommandString[] {
+  const document = yamlDocument(text);
+  if (!isRecord(document)) {
+    return [];
+  }
+  const dirs = [
+    scalarText(document["source_dir"]) ?? ".lefthook/",
+    scalarText(document["source_dir_local"]) ?? ".lefthook-local/",
+    ...LEFTHOOK_DIRS,
+  ];
+  const found: CommandString[] = [];
+  const add = (hook: string, name: string, runner: string | undefined): void => {
+    for (const dir of dirs) {
+      const path = `'${joinPath(dir, hook, name).replaceAll("'", "'\\''")}'`;
+      found.push({
+        text: runner === undefined || runner.trim() === "" ? path : `${runner} ${path}`,
+        dir: root,
+      });
+    }
+  };
+  const jobs = (hook: string, list: unknown): void => {
+    for (const job of Array.isArray(list) ? list : []) {
+      const script = isRecord(job) ? scalarText(job["script"]) : undefined;
+      if (isRecord(job) && script !== undefined) {
+        add(hook, script, scalarText(job["runner"]));
+      }
+      const group = isRecord(job) ? job["group"] : undefined;
+      jobs(hook, isRecord(group) ? group["jobs"] : undefined);
+    }
+  };
+  for (const [hook, value] of Object.entries(document)) {
+    const scripts = isRecord(value) ? value["scripts"] : undefined;
+    for (const [name, options] of Object.entries(isRecord(scripts) ? scripts : {})) {
+      add(hook, name, isRecord(options) ? scalarText(options["runner"]) : undefined);
+    }
+    jobs(hook, isRecord(value) ? value["jobs"] : undefined);
+  }
+  return found;
+}
+
 /** The path of each git hook script at `root`, every file in {@link HOOK_DIRS}. */
 function hookScripts(host: Host, root: string): readonly string[] {
   return HOOK_DIRS.flatMap((dir) =>
@@ -137,10 +198,43 @@ function makefileAt(host: Host, root: string): string | undefined {
   );
 }
 
+/**
+ * One recipe line as make hands it to the shell: each `$$` a `$`, and each reference to a
+ * variable or a function, which make expands first, a part only the run knows:
+ * https://www.gnu.org/software/make/manual/html_node/Reference.html
+ */
+function expandedByMake(line: string): string {
+  let expanded = "";
+  for (let at = 0; at < line.length; at += 1) {
+    const char = line.charAt(at);
+    const next = line.charAt(at + 1);
+    if (char !== "$") {
+      expanded += char;
+    } else if (next === "$") {
+      expanded += "$";
+      at += 1;
+    } else {
+      let end = at + 1;
+      if (next === "(" || next === "{") {
+        const close = next === "(" ? ")" : "}";
+        for (let depth = 0; end < line.length; end += 1) {
+          depth += line.charAt(end) === next ? 1 : line.charAt(end) === close ? -1 : 0;
+          if (depth === 0) {
+            break;
+          }
+        }
+      }
+      expanded += PART;
+      at = Math.min(end, line.length);
+    }
+  }
+  return expanded;
+}
+
 /**
  * Each recipe line of the target root's makefile: a line that starts with a tab, joined with
- * the lines a trailing `\` continues it onto, less the `@`, `-` and `+` make reads before it.
- * Make runs each line in a shell of its own.
+ * the lines a trailing `\` continues it onto, less the `@`, `-` and `+` make reads before it,
+ * as make expands it. Make runs each line in a shell of its own.
  */
 function recipeLines(host: Host, root: string): readonly CommandString[] {
   const path = makefileAt(host, root);
@@ -150,9 +244,8 @@ function recipeLines(host: Host, root: string): readonly CommandString[] {
     .split(/\r?\n/u)
     .filter((line) => line.startsWith("\t"))
     .map((line) => ({
-      text: line.slice(1).replace(/^[@+-]+/u, ""),
+      text: expandedByMake(line.slice(1).replace(/^[@+-]+/u, "")),
       dir: root,
-      writtenDirectory: undefined,
     }));
 }
 
@@ -160,7 +253,7 @@ function recipeLines(host: Host, root: string): readonly CommandString[] {
  * Every command the target root's workflow steps, git hooks, hook managers and makefile run:
  * the `run:` steps of the workflow files in `.github/workflows`, each file in `.husky` and
  * `.githooks` as one shell script, the `entry:` commands of `.pre-commit-config.yaml`, the
- * `run:` commands of a lefthook file and the makefile's recipe lines.
+ * `run:` commands and the scripts of a lefthook file and the makefile's recipe lines.
  */
 export function workflowCommands(host: Host, targetRoot: string): readonly CommandString[] {
   const root = resolvePath(host.workingDirectory(), targetRoot);
@@ -177,49 +270,145 @@ export function workflowCommands(host: Host, targetRoot: string): readonly Comma
     ...hookScripts(host, root).map((path): CommandString => ({
       text: readText(host, path) ?? "",
       dir: root,
-      writtenDirectory: undefined,
     })),
-    ...HOOK_MANAGERS.flatMap(([name, key, dirKey]) =>
-      keyedCommands(readText(host, joinPath(root, name)) ?? "", root, key, dirKey),
-    ),
+    ...HOOK_MANAGERS.flatMap(({ name, key, dirKey, scripts }) => {
+      const text = readText(host, joinPath(root, name)) ?? "";
+      return [
+        ...keyedCommands(text, root, key, dirKey),
+        ...(scripts === true ? lefthookScripts(text, root) : []),
+      ];
+    }),
     ...recipeLines(host, root),
   ];
 }
 
 /**
  * The whole text of each file {@link workflowCommands} reads a command from, each workflow file,
- * git hook, hook manager file and makefile at the target root. Layer 3 holds it whole, so a part
- * no command is read from, a comment included, or one the reading of the structure misses, still
- * holds every file it names.
+ * git hook, hook manager file and makefile at the target root, which the dependency rule reads.
  */
 export function commandFileTexts(host: Host, targetRoot: string): readonly string[] {
+  return commandFiles(host, targetRoot).flatMap(({ path }) => readText(host, path) ?? []);
+}
+
+/** Each file {@link workflowCommands} reads a command from, with the key a YAML file writes its commands under. */
+function commandFiles(
+  host: Host,
+  targetRoot: string,
+): readonly { readonly path: string; readonly key: string | undefined }[] {
   const root = resolvePath(host.workingDirectory(), targetRoot);
   return [
-    ...filesIn(host, joinPath(root, WORKFLOWS), (name) => /\.ya?ml$/u.test(name)).map((name) =>
-      joinPath(root, WORKFLOWS, name),
-    ),
-    ...hookScripts(host, root),
-    ...HOOK_MANAGERS.map(([name]) => joinPath(root, name)),
-    ...[makefileAt(host, root) ?? []].flat(),
-  ].flatMap((path) => readText(host, path) ?? []);
+    ...filesIn(host, joinPath(root, WORKFLOWS), (name) => /\.ya?ml$/u.test(name)).map((name) => ({
+      path: joinPath(root, WORKFLOWS, name),
+      key: "run",
+    })),
+    ...hookScripts(host, root).map((path) => ({ path, key: undefined })),
+    ...HOOK_MANAGERS.map(({ name, key }) => ({ path: joinPath(root, name), key })),
+    ...[makefileAt(host, root) ?? []].flat().map((path) => ({ path, key: undefined })),
+  ];
+}
+
+/**
+ * The filters of a workflow's `on` key, which name the files and refs whose change triggers it
+ * and run none: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#onpushpull_requestpull_request_targetpathspaths-ignore
+ */
+const TRIGGER_FILTERS = new Set([
+  "paths",
+  "paths-ignore",
+  "branches",
+  "branches-ignore",
+  "tags",
+  "tags-ignore",
+]);
+
+/**
+ * The values of one YAML file that are no command, each with its key: every scalar but one
+ * written under `key`, which is read as a command string, and one of a trigger filter. A file
+ * `yamlDocument` does not read is one value, its whole text. No key and no comment is a value.
+ */
+function yamlValues(text: string, key: string): readonly HeldText[] {
+  const document = yamlDocument(text);
+  if (document === undefined) {
+    return [{ text, shell: false }];
+  }
+  const found: HeldText[] = [];
+  // `trigger` is 1 for the value of the top-level `on`, a map of events, and 2 for an event's.
+  const visit = (node: unknown, under: string | undefined, trigger = 0): void => {
+    if (Array.isArray(node)) {
+      for (const item of node) {
+        visit(item, under);
+      }
+    } else if (isRecord(node)) {
+      for (const [name, value] of Object.entries(node)) {
+        const on = node === document && (name === "on" || name === "true");
+        if (
+          (name !== key || scalarText(value) === undefined) &&
+          !(trigger === 2 && TRIGGER_FILTERS.has(name))
+        ) {
+          visit(value, name, on ? 1 : trigger === 1 ? 2 : 0);
+        }
+      }
+    } else {
+      const value = scalarText(node);
+      if (value !== undefined) {
+        found.push({ text: value, shell: false, ...(under === undefined ? {} : { key: under }) });
+      }
+    }
+  };
+  visit(document, undefined);
+  return found;
+}
+
+/**
+ * The lines of a makefile that are no recipe line, joined with the lines a trailing `\`
+ * continues them onto, each without the comment a `#` make does not read as escaped starts.
+ */
+function makefileValues(text: string): readonly HeldText[] {
+  return text
+    .replace(/\\\r?\n/gu, " ")
+    .split(/\r?\n/u)
+    .filter((line) => !line.startsWith("\t"))
+    .map((line) => line.replace(/(?<!\\)#.*$/u, ""))
+    .filter((line) => line.trim() !== "")
+    .map((line) => ({ text: line, shell: false }));
+}
+
+/**
+ * The texts layer 3 reads of the target root's command files: each command string, and each
+ * value of a workflow file, a hook manager file and the makefile that is no command.
+ */
+function heldTexts(host: Host, targetRoot: string): readonly HeldText[] {
+  const makefile = makefileAt(host, resolvePath(host.workingDirectory(), targetRoot));
+  return [
+    ...workflowCommands(host, targetRoot).map(({ text }) => ({ text, shell: true })),
+    ...commandFiles(host, targetRoot).flatMap(({ path, key }) => {
+      const text = readText(host, path);
+      return text === undefined
+        ? []
+        : key !== undefined
+          ? yamlValues(text, key)
+          : path === makefile
+            ? makefileValues(text)
+            : [];
+    }),
+  ];
 }
 
 /** What the target root's workflow steps, git hooks, hook managers and makefile run, read once per run. */
 export interface Workflows {
-  /** Each command read, its held text followed by the directory the file writes for it. */
+  /** Each command read. */
   readonly readings: readonly CommandReading[];
-  /** The whole text of each file a command is read from. */
+  /** The whole text of each file a command is read from, which the dependency rule reads. */
   readonly texts: readonly string[];
+  /** What layer 3 reads of them: each command string, and each value that is no command. */
+  readonly held: readonly HeldText[];
 }
 
 /** Reads the target root's workflow steps, git hooks, hook managers and makefile. */
 export function readWorkflows(host: Host, targetRoot: string): Workflows {
   return {
-    readings: workflowCommands(host, targetRoot).map(({ text, dir, writtenDirectory }) => {
-      const reading = readCommands(text, dir);
-      return { ...reading, held: [reading.held, writtenDirectory ?? ""].join("\n") };
-    }),
+    readings: workflowCommands(host, targetRoot).map(({ text, dir }) => readCommands(text, dir)),
     texts: commandFileTexts(host, targetRoot),
+    held: heldTexts(host, targetRoot),
   };
 }