@davidvornholt/standards 0.19.0 → 0.21.0

package/src/dev-env.ts

@@ -1,89 +1,107 @@
-import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { composeDevEnv } from './dev-env-compose';
 import {
+  type DevEnvRemoval,
   type DevEnvWrite,
   devEnvDestinationProblems,
 } from './dev-env-destination';
+import { devEnvGitIgnoreProblem } from './dev-env-destination-gitignore';
 import { parseDevEnvDocument } from './dev-env-document';
 import { renderDotenv } from './dev-env-dotenv';
-import { writeDevEnvFiles } from './dev-env-transaction';
-import { runSops } from './sops-exec';
+import { planDevEnvRemovals } from './dev-env-reconciliation';
+import { DEV_SECRETS_FILE, readDevSecrets } from './dev-env-secrets';
+import { applyDevEnvChanges } from './dev-env-transaction';
+import { parseYaml } from './yaml-parse';
 
-export const DEV_SECRETS_FILE = 'secrets/dev.yaml';
+export const DEV_CONFIG_FILE = 'config/dev.yaml';
+export const DEV_LOCAL_FILE = 'config/dev.local.yaml';
 
-const SOPS_ARGS = ['--decrypt', '--output-type', 'json', DEV_SECRETS_FILE];
+export type DevEnvPlainInput = { readonly raw: unknown } | null;
 
-type DecryptResult =
-  | { readonly ok: true; readonly value: unknown }
-  | { readonly ok: false; readonly problem: string };
+export type DevEnvInputs = {
+  readonly config: DevEnvPlainInput;
+  readonly secrets: unknown;
+  readonly local: DevEnvPlainInput;
+};
+
+const isMissingPathError = (error: unknown): boolean =>
+  (error as { readonly code?: unknown } | null)?.code === 'ENOENT';
 
-// sops emits JSON here so the CLI never parses the encrypted YAML itself.
-const decryptDevSecrets = (consumer: string): DecryptResult => {
-  const result = runSops(SOPS_ARGS, consumer);
-  if (result.status !== 0) {
-    const detail = result.errorMessage ?? result.stderr.trim();
+const readPlainLayer = (consumer: string, rel: string) => {
+  const path = join(consumer, rel);
+  try {
+    lstatSync(path);
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      return { input: null, present: false, problems: [] };
+    }
+    const detail = error instanceof Error ? error.message : String(error);
     return {
-      ok: false,
-      problem: detail
-        ? `could not decrypt ${DEV_SECRETS_FILE}: ${detail}`
-        : `could not decrypt ${DEV_SECRETS_FILE}`,
+      input: null,
+      present: true,
+      problems: [`could not inspect ${rel}: ${detail}`],
     };
   }
+  let raw: string;
   try {
-    return { ok: true, value: JSON.parse(result.stdout) as unknown };
+    raw = readFileSync(path, 'utf8');
   } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
     return {
-      ok: false,
-      problem: `could not parse decrypted ${DEV_SECRETS_FILE} as JSON: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
+      input: null,
+      present: true,
+      problems: [`could not read ${rel}: ${detail}`],
     };
   }
-};
-
-// Writing decrypted values into the tree is only safe when git will never
-// track them. `git check-ignore` is authoritative; anything but a clear
-// "ignored" answer fails closed, including running outside a git checkout.
-const gitIgnoreProblem = (consumer: string, rel: string): string | null => {
-  const result = spawnSync('git', ['check-ignore', '-q', '--', rel], {
-    cwd: consumer,
-  });
-  if (result.error !== undefined || result.status === null) {
-    return `cannot run git to verify ${rel} is gitignored`;
-  }
-  if (result.status === 0) {
-    return null;
-  }
-  if (result.status === 1) {
-    return `${rel} is not gitignored; ignore it before generating dev env files`;
+  const parsed = parseYaml(raw, rel);
+  if (parsed.problem !== null) {
+    return { input: null, present: true, problems: [parsed.problem] };
   }
-  return `cannot verify ${rel} is gitignored (git check-ignore exited ${result.status})`;
+  return { input: { raw: parsed.value ?? {} }, present: true, problems: [] };
 };
 
+const documentProblems = (
+  source: string,
+  input: DevEnvPlainInput,
+): ReadonlyArray<string> =>
+  input === null ? [] : parseDevEnvDocument(input.raw, source).problems;
+
 export type DevEnvPlan = {
   readonly writes: ReadonlyArray<DevEnvWrite>;
+  readonly removals: ReadonlyArray<DevEnvRemoval>;
   readonly problems: ReadonlyArray<string>;
 };
 
-export const planDevEnvWrites = (
+export const planDevEnvChanges = (
   consumer: string,
-  raw: unknown,
+  inputs: DevEnvInputs,
 ): DevEnvPlan => {
-  const document = parseDevEnvDocument(raw, DEV_SECRETS_FILE);
-  const problems: Array<string> = [...document.problems];
+  const layer = (source: string, input: DevEnvPlainInput) =>
+    input === null
+      ? null
+      : { source, document: parseDevEnvDocument(input.raw, source) };
+  const composed = composeDevEnv(
+    layer(DEV_CONFIG_FILE, inputs.config),
+    {
+      source: DEV_SECRETS_FILE,
+      document: parseDevEnvDocument(inputs.secrets, DEV_SECRETS_FILE),
+    },
+    layer(DEV_LOCAL_FILE, inputs.local),
+  );
+  const problems: Array<string> = [...composed.problems];
   const writes: Array<DevEnvWrite> = [];
-  for (const target of document.targets) {
+  for (const target of composed.targets) {
     const workspaceDir = `${target.group}/${target.workspace}`;
     const rel = `${workspaceDir}/.env.local`;
     if (existsSync(join(consumer, workspaceDir, 'package.json'))) {
-      const ignoreProblem = gitIgnoreProblem(consumer, rel);
+      const ignoreProblem = devEnvGitIgnoreProblem(consumer, rel);
       if (ignoreProblem === null) {
         writes.push({
           rel,
           content: renderDotenv(
             `${target.group}.${target.workspace}`,
-            DEV_SECRETS_FILE,
+            target.sources,
             target.env,
           ),
         });
@@ -92,36 +110,62 @@ export const planDevEnvWrites = (
       }
     } else {
       problems.push(
-        `${DEV_SECRETS_FILE} defines ${target.group}.${target.workspace}, but ${workspaceDir}/package.json does not exist`,
+        `${target.sources.join(' + ')} defines ${target.group}.${target.workspace}, but ${workspaceDir}/package.json does not exist`,
       );
     }
   }
-  return { writes, problems };
+  const removalPlan = planDevEnvRemovals(consumer, writes);
+  return {
+    writes,
+    removals: removalPlan.removals,
+    problems: [...problems, ...removalPlan.problems],
+  };
 };
 
 export const runDevEnv = async (consumer: string): Promise<boolean> => {
-  if (!existsSync(join(consumer, DEV_SECRETS_FILE))) {
-    console.error(
-      `standards dev-env: ${DEV_SECRETS_FILE} not found; create it with \`just secrets edit dev\``,
-    );
-    return false;
-  }
-  const decrypted = decryptDevSecrets(consumer);
-  if (!decrypted.ok) {
-    console.error(`standards dev-env: ${decrypted.problem}`);
+  const config = readPlainLayer(consumer, DEV_CONFIG_FILE);
+  const secrets = readDevSecrets(consumer);
+  const local = readPlainLayer(consumer, DEV_LOCAL_FILE);
+  const localIgnoreProblem = local.present
+    ? devEnvGitIgnoreProblem(consumer, DEV_LOCAL_FILE)
+    : null;
+  const inputProblems = [
+    ...config.problems,
+    ...(secrets.ok ? [] : [secrets.problem]),
+    ...local.problems,
+    ...(localIgnoreProblem === null ? [] : [localIgnoreProblem]),
+    ...documentProblems(DEV_CONFIG_FILE, config.input),
+    ...(secrets.ok
+      ? parseDevEnvDocument(secrets.value, DEV_SECRETS_FILE).problems
+      : []),
+    ...documentProblems(DEV_LOCAL_FILE, local.input),
+  ];
+  if (inputProblems.length > 0 || !secrets.ok) {
+    console.error(`standards dev-env: ${inputProblems.length} problem(s):`);
+    console.error(inputProblems.map((problem) => `  - ${problem}`).join('\n'));
     return false;
   }
-  const plan = planDevEnvWrites(consumer, decrypted.value);
+  const plan = planDevEnvChanges(consumer, {
+    config: config.input,
+    secrets: secrets.value,
+    local: local.input,
+  });
   const problems = [
     ...plan.problems,
-    ...(await devEnvDestinationProblems(consumer, plan.writes)),
+    ...(await devEnvDestinationProblems(consumer, [
+      ...plan.writes,
+      ...plan.removals,
+    ])),
   ];
   if (problems.length > 0) {
     console.error(`standards dev-env: ${problems.length} problem(s):`);
     console.error(problems.map((problem) => `  - ${problem}`).join('\n'));
     return false;
   }
-  const generated = await writeDevEnvFiles(consumer, plan.writes);
+  const generated = await applyDevEnvChanges(consumer, [
+    ...plan.writes,
+    ...plan.removals,
+  ]);
   if (!generated.ok) {
     console.error('standards dev-env: generation failed:');
     console.error(
@@ -140,8 +184,16 @@ export const runDevEnv = async (consumer: string): Promise<boolean> => {
   for (const write of plan.writes) {
     console.log(`  wrote ${write.rel}`);
   }
+  for (const removal of plan.removals) {
+    console.log(`  removed ${removal.rel}`);
+  }
+  const inputFiles = [
+    ...(config.input === null ? [] : [DEV_CONFIG_FILE]),
+    DEV_SECRETS_FILE,
+    ...(local.input === null ? [] : [DEV_LOCAL_FILE]),
+  ];
   console.log(
-    `standards dev-env: generated ${plan.writes.length} env file(s) from ${DEV_SECRETS_FILE}`,
+    `standards dev-env: generated ${plan.writes.length} and removed ${plan.removals.length} env file(s) from ${inputFiles.join(' + ')}`,
   );
   return true;
 };

package/src/github-command-shared.ts

@@ -33,7 +33,14 @@ export const optOutEligibilityProblem = (
     : null;
 
 export const ADMIN_VISIBILITY_ADVICE =
-  'Use a token with read access to repository administration (in CI: ci.github_settings_read_token in secrets/ci.yaml), or verify locally with admin auth';
+  'Use a user-scoped token with read access to repository administration, or verify locally with admin auth; a CI token cannot hold that access, so widening what CI reads with is not the fix';
+
+// Merge settings have a different remedy from everything else this advice used
+// to cover. GraphQL serves them to read-only tokens by design, so reaching this
+// message means the fallback request itself failed — pointing the reader at a
+// permission they cannot obtain would send them after the wrong cause.
+export const MERGE_SETTINGS_VISIBILITY_ADVICE =
+  'REST serves repository merge settings only to write-level viewers, and the GraphQL fallback that answers them for a read-only token did not respond, so this is more likely a failed request than a permission gap: re-run the check, and if it keeps failing verify locally with admin auth';
 
 // Declared state the token cannot see is a gate failure, not a pass with a
 // log line: a gate that cannot perform its comparison fails closed. The advice

package/src/github-live-drift.ts

@@ -13,8 +13,8 @@ import {
 } from './github-api';
 import { resolveHiddenBypassActors } from './github-bypass-actors';
 import {
-  ADMIN_VISIBILITY_ADVICE,
   enforceableRepositorySettings,
+  MERGE_SETTINGS_VISIBILITY_ADVICE,
   optOutEligibilityProblem,
   unverifiableProblem,
 } from './github-command-shared';
@@ -35,7 +35,7 @@ import {
 import { type GithubSettings, isRecord } from './github-settings-parse';
 
 const LABEL_VISIBILITY_PROBLEM =
-  'declared labels not visible to this token, so the gate cannot verify them. In CI, use a valid ci.github_settings_read_token from secrets/ci.yaml with read-only "Issues" access (or "Pull requests" read); locally use a token with one of those permissions';
+  'declared labels not visible to this token, so the gate cannot verify them. Label reads need issues: read (or pull-requests: read); the canonical github-settings job already grants issues: read, so in CI this points at a stale synced workflow or an organization policy restricting the workflow token rather than anything to change in the declaration. Locally, use a token with one of those permissions';
 const PERMISSION_DENIAL_MESSAGES: ReadonlySet<string> = new Set([
   'Resource not accessible by integration',
   'Resource not accessible by personal access token',
@@ -87,7 +87,7 @@ const repositoryDrift = async (
     ...unverifiableProblem(
       'repository setting(s)',
       rediff.unverifiable,
-      ADMIN_VISIBILITY_ADVICE,
+      MERGE_SETTINGS_VISIBILITY_ADVICE,
     ),
   ];
 };

package/src/poller-closing-reference.ts

@@ -0,0 +1,179 @@
+const CLOSING_KEYWORD_PATTERN = String.raw`(?:close(?:s|d)?|fix(?:es|ed)?|resolve(?:s|d)?):?[ \t]+#`;
+const FENCE_OPEN_PATTERN = /^ {0,3}(?<marker>`{3,}|~{3,})(?<info>[^\r\n]*)$/u;
+const BODY_LINE_PATTERN = /\r?\n/u;
+const INDENTED_CODE_PATTERN = /^ {0,3}\t|^ {4}/u;
+const COMMENT_START = '<!--';
+const COMMENT_END = '-->';
+
+type BacktickRun = {
+  readonly start: number;
+  readonly end: number;
+};
+
+const isEscaped = (line: string, index: number): boolean => {
+  let backslashes = 0;
+  for (
+    let cursor = index - 1;
+    cursor >= 0 && line[cursor] === '\\';
+    cursor -= 1
+  ) {
+    backslashes += 1;
+  }
+  return backslashes % 2 === 1;
+};
+
+const nextBacktickRun = (line: string, from: number): BacktickRun | null => {
+  let start = line.indexOf('`', from);
+  while (start !== -1) {
+    let end = start + 1;
+    while (line[end] === '`') {
+      end += 1;
+    }
+    if (!isEscaped(line, start)) {
+      return { start, end };
+    }
+    start = line.indexOf('`', end);
+  }
+  return null;
+};
+
+const matchingBacktickRun = (
+  line: string,
+  opener: BacktickRun,
+): BacktickRun | null => {
+  const ticks = opener.end - opener.start;
+  let candidate = nextBacktickRun(line, opener.end);
+  while (candidate !== null) {
+    if (candidate.end - candidate.start === ticks) {
+      return candidate;
+    }
+    candidate = nextBacktickRun(line, candidate.end);
+  }
+  return null;
+};
+
+const nextActiveCommentStart = (line: string, from: number): number => {
+  let cursor = from;
+  while (cursor < line.length) {
+    const comment = line.indexOf(COMMENT_START, cursor);
+    const opener = nextBacktickRun(line, cursor);
+    if (
+      comment !== -1 &&
+      !isEscaped(line, comment) &&
+      (opener === null || comment < opener.start)
+    ) {
+      return comment;
+    }
+    if (opener === null) {
+      return -1;
+    }
+    const closer = matchingBacktickRun(line, opener);
+    cursor = closer === null ? opener.end : closer.end;
+  }
+  return -1;
+};
+
+const commentIsOpenAfter = (line: string, initiallyOpen: boolean): boolean => {
+  let open = initiallyOpen;
+  let cursor = 0;
+  while (cursor < line.length) {
+    const marker = open
+      ? line.indexOf(COMMENT_END, cursor)
+      : nextActiveCommentStart(line, cursor);
+    if (marker === -1) {
+      return open;
+    }
+    open = !open;
+    cursor = marker + (open ? COMMENT_START.length : COMMENT_END.length);
+  }
+  return open;
+};
+
+const isIndentedCodeLine = (
+  lines: ReadonlyArray<string>,
+  index: number,
+): boolean => {
+  if (!INDENTED_CODE_PATTERN.test(lines[index] ?? '')) {
+    return false;
+  }
+  for (let cursor = index - 1; cursor >= 0; cursor -= 1) {
+    const previous = lines[cursor] ?? '';
+    if (previous.trim().length === 0) {
+      return true;
+    }
+    if (!INDENTED_CODE_PATTERN.test(previous)) {
+      return false;
+    }
+  }
+  return true;
+};
+
+const commentStateAfterContentLine = (
+  lines: ReadonlyArray<string>,
+  index: number,
+  initiallyOpen: boolean,
+): boolean => {
+  if (!initiallyOpen && isIndentedCodeLine(lines, index)) {
+    return false;
+  }
+  return commentIsOpenAfter(lines[index] ?? '', initiallyOpen);
+};
+
+const fenceCloseForLine = (line: string): RegExp | null => {
+  const groups = FENCE_OPEN_PATTERN.exec(line)?.groups;
+  const marker = groups?.marker;
+  if (
+    marker === undefined ||
+    (marker[0] === '`' && (groups?.info ?? '').includes('`'))
+  ) {
+    return null;
+  }
+  return new RegExp(`^ {0,3}${marker[0]}{${marker.length},}[ \\t]*$`, 'u');
+};
+
+type MarkdownState = {
+  readonly fenceClose: RegExp | null;
+  readonly commentOpen: boolean;
+};
+
+const markdownStateAfterContentLine = (
+  lines: ReadonlyArray<string>,
+  index: number,
+  state: MarkdownState,
+): MarkdownState => {
+  const line = lines[index] ?? '';
+  if (state.fenceClose !== null) {
+    return {
+      fenceClose: state.fenceClose.test(line) ? null : state.fenceClose,
+      commentOpen: state.commentOpen,
+    };
+  }
+  const fenceClose = state.commentOpen ? null : fenceCloseForLine(line);
+  return {
+    fenceClose,
+    commentOpen:
+      fenceClose === null
+        ? commentStateAfterContentLine(lines, index, state.commentOpen)
+        : state.commentOpen,
+  };
+};
+
+export const hasClosingReferenceToIssue = (
+  body: string,
+  issueNumber: number,
+): boolean => {
+  const reference = new RegExp(
+    `^${CLOSING_KEYWORD_PATTERN}${issueNumber}$`,
+    'iu',
+  );
+  const lines = body.split(BODY_LINE_PATTERN);
+  if (!reference.test(lines.at(-1) ?? '')) {
+    return false;
+  }
+  let state: MarkdownState = { fenceClose: null, commentOpen: false };
+  const content = lines.slice(0, -1);
+  for (const [index] of content.entries()) {
+    state = markdownStateAfterContentLine(content, index, state);
+  }
+  return state.fenceClose === null && !state.commentOpen;
+};

package/src/poller-fix-outcome.ts

@@ -1,3 +1,4 @@
+import type { CodexRunResult } from './poller-codex';
 import type { FixPublication } from './poller-fix-publication';
 import { createComment } from './poller-github-write';
 import {
@@ -6,8 +7,16 @@ import {
   type JobLabels,
   releaseLabels,
 } from './poller-job-shared';
+import { readFixOutcome } from './poller-outcome';
 import type { FixOutcome } from './poller-protocol';
 
+export const readFixRunOutcome = (
+  run: CodexRunResult,
+  workDir: string,
+  issueNumber: number,
+): Promise<FixOutcome | null> =>
+  run.succeeded ? readFixOutcome(workDir, issueNumber) : Promise.resolve(null);
+
 export const handleNonFixedOutcome = async (
   job: FixPublication,
   labels: JobLabels,

package/src/poller-fix-publication.ts

@@ -16,10 +16,7 @@ import {
   type JobLabels,
   releaseLabels,
 } from './poller-job-shared';
-import {
-  changedWorkspaceQualityManifests,
-  lockedPathsOf,
-} from './poller-protected-paths';
+import { lockedPathsOf } from './poller-protected-paths';
 import {
   APPROVED_FOR_REVIEW,
   type FixOutcome,
@@ -150,14 +147,10 @@ export const finishFixedJob = async (
     return `#${issue.number}: failed (fixed without commits)`;
   }
   const paths = changedPaths(workspace.dir, workspace.baseSha);
-  const forbidden = [
-    ...forbiddenDiffPaths(paths, await lockedPathsOf(workspace.dir)),
-    ...changedWorkspaceQualityManifests(
-      workspace.dir,
-      workspace.baseSha,
-      paths,
-    ),
-  ];
+  const forbidden = forbiddenDiffPaths(
+    paths,
+    await lockedPathsOf(workspace.dir),
+  );
   if (forbidden.length > 0) {
     await failJob(
       deps,

package/src/poller-fix-run.ts

@@ -5,7 +5,7 @@ import { hasLabel } from './github-label-identity';
 import { approvalIsCurrent, issueRevision } from './poller-approval';
 import { startClaim, withClaimReleasedOnFailure } from './poller-claim';
 import { runCodex } from './poller-codex';
-import { handleNonFixedOutcome } from './poller-fix-outcome';
+import { handleNonFixedOutcome, readFixRunOutcome } from './poller-fix-outcome';
 import { readSealedFixOutput } from './poller-fix-output';
 import {
   type FixPublication,
@@ -21,7 +21,6 @@ import {
   type JobResult,
   jobPreamble,
 } from './poller-job-shared';
-import { readFixOutcome } from './poller-outcome';
 import { fixPrompt } from './poller-prompts';
 import {
   APPROVED_FOR_FIX,
@@ -170,7 +169,7 @@ export const runFixJob = async (
       config,
     });
     await validateFixClaim(job);
-    const outcome = run.succeeded ? await readFixOutcome(workspace.dir) : null;
+    const outcome = await readFixRunOutcome(run, workspace.dir, issue.number);
     if (outcome === null) {
       await failJob(
         deps,

package/src/poller-fix-validation.ts

@@ -1,4 +1,5 @@
 import { join } from 'node:path';
+import { hasClosingReferenceToIssue } from './poller-closing-reference';
 import type { SealedFixOutput } from './poller-fix-output';
 import type { JobDeps } from './poller-job-shared';
 import {
@@ -7,10 +8,7 @@ import {
   createValidationWorktree,
   isAncestor,
 } from './poller-output-integrity';
-import {
-  changedWorkspaceQualityManifests,
-  lockedPathsOf,
-} from './poller-protected-paths';
+import { lockedPathsOf } from './poller-protected-paths';
 import { forbiddenDiffPaths } from './poller-protocol';
 
 export const validateSealedFixOutput = async (
@@ -27,6 +25,7 @@ export const validateSealedFixOutput = async (
     output.repo !== job.deps.repo ||
     output.issueNumber !== job.issueNumber ||
     output.approvalId !== job.approvalId ||
+    !hasClosingReferenceToIssue(output.body, job.issueNumber) ||
     !isAncestor(job.cloneDir, output.baseSha, job.defaultBranch) ||
     !isAncestor(job.cloneDir, output.baseSha, output.generatedHead) ||
     commitCountBetween(job.cloneDir, output.baseSha, output.generatedHead) !==
@@ -49,10 +48,10 @@ export const validateSealedFixOutput = async (
     ),
   );
   try {
-    const forbidden = [
-      ...forbiddenDiffPaths(paths, await lockedPathsOf(workspace.dir)),
-      ...changedWorkspaceQualityManifests(workspace.dir, output.baseSha, paths),
-    ];
+    const forbidden = forbiddenDiffPaths(
+      paths,
+      await lockedPathsOf(workspace.dir),
+    );
     if (forbidden.length > 0) {
       throw new Error(
         `sealed fix output modified protected paths:\n${forbidden.join('\n')}`,

package/src/poller-outcome.ts

@@ -7,6 +7,7 @@ import { existsSync, rmSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isNonEmptyString, isRecord } from './github-settings-parse';
+import { hasClosingReferenceToIssue } from './poller-closing-reference';
 import {
   type FixOutcome,
   OUTCOME_FILE,
@@ -59,6 +60,7 @@ const PR_TITLE_PATTERN = /^[a-z]+(?:\([^)]+\))?!?: .+/u;
 
 export const readFixOutcome = async (
   workDir: string,
+  issueNumber: number,
 ): Promise<FixOutcome | null> => {
   const raw = await readOutcomeRaw(workDir);
   if (
@@ -78,7 +80,8 @@ export const readFixOutcome = async (
     !(
       isNonEmptyString(raw.prTitle) &&
       PR_TITLE_PATTERN.test(raw.prTitle) &&
-      isNonEmptyString(raw.prBody)
+      isNonEmptyString(raw.prBody) &&
+      hasClosingReferenceToIssue(raw.prBody, issueNumber)
     )
   ) {
     return null;

package/src/poller-protected-paths.ts

@@ -1,11 +1,7 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isRecord } from './github-settings-parse';
-import { changesWorkspaceQualityScripts } from './poller-protocol';
-import { runGit } from './poller-workspace';
-
-const WORKSPACE_MANIFEST = /^(?:apps|packages)\/[^/]+\/package\.json$/u;
 
 export const lockedPathsOf = async (
   workDir: string,
@@ -29,23 +25,3 @@ export const lockedPathsOf = async (
     );
   }
 };
-
-export const changedWorkspaceQualityManifests = (
-  workDir: string,
-  baseSha: string,
-  paths: ReadonlyArray<string>,
-): ReadonlyArray<string> =>
-  paths.filter((path) => {
-    if (!WORKSPACE_MANIFEST.test(path)) {
-      return false;
-    }
-    try {
-      return changesWorkspaceQualityScripts(
-        path,
-        runGit(['-C', workDir, 'show', `${baseSha}:${path}`], null),
-        readFileSync(join(workDir, path), 'utf8'),
-      );
-    } catch {
-      return true;
-    }
-  });