@davidvornholt/standards 0.26.3 → 0.27.0

package/src/dev-env-brokered-preserve.ts

@@ -1,5 +1,6 @@
 import { lstatSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { brokeredReferenceIdentity } from './dev-env-brokered-source';
 import type { DevEnvValue } from './dev-env-document';
 import { preserveRenderedDotenvValues, renderDotenv } from './dev-env-dotenv';
 
@@ -27,7 +28,7 @@ const preservedKeys = (
 ): ReadonlyArray<string> =>
   Object.entries(env).flatMap(([key, value]) =>
     typeof value !== 'string' &&
-    references.has(`${value.brokeredS3}:${value.key}`)
+    references.has(brokeredReferenceIdentity(value))
       ? [key]
       : [],
   );

package/src/dev-env-brokered-refresh.ts

@@ -34,7 +34,7 @@ const layerReferenceTargets = (
   return {
     references: document.targets.flatMap((target) =>
       Object.values(target.env).flatMap((value) =>
-        typeof value === 'string'
+        typeof value === 'string' || value.source !== undefined
           ? []
           : [{ target: value.brokeredS3, key: value.key }],
       ),

package/src/dev-env-brokered-resolve.ts

@@ -4,8 +4,9 @@
 // layer's reference, and a reference that lost the merge is never decrypted.
 
 import { lookupS3Pair } from './creds-r2';
-import { resolveTargetRelResult } from './creds-target';
 import type { BrokeredS3Reference } from './dev-env-brokered';
+import { prepareBrokeredSources } from './dev-env-brokered-preflight';
+import { brokeredReferenceIdentity } from './dev-env-brokered-source';
 import type { ComposedDevEnvTarget } from './dev-env-compose';
 import { encodePortableDotenvValue } from './dev-env-dotenv-value';
 import { decryptSopsJson, type SopsJsonResult } from './sops-exec';
@@ -55,39 +56,49 @@ export const resolveBrokeredReferences = (
 ): ResolvedDevEnv => {
   const problems: Array<string> = [];
   const documents = new Map<string, SopsJsonResult>();
-  const readDocument = (targetName: string): SopsJsonResult => {
-    const cached = documents.get(targetName);
+  const preflight = prepareBrokeredSources(
+    consumer,
+    targets,
+    allowedReferences,
+    preservedReferences,
+  );
+  if (preflight.problems.length > 0) {
+    return {
+      problems: preflight.problems,
+      targets: targets.map((target) => ({
+        ...target,
+        env: Object.fromEntries(
+          Object.entries(target.env).filter(
+            (entry): entry is [string, string] => typeof entry[1] === 'string',
+          ),
+        ),
+      })),
+    };
+  }
+  const { sources } = preflight;
+  const readDocument = (reference: BrokeredS3Reference): SopsJsonResult => {
+    const source = sources.get(reference);
+    if (source === undefined) {
+      return { ok: false, problem: 'unresolved source target' };
+    }
+    const documentKey = `${source.root}/${source.rel}`;
+    const cached = documents.get(documentKey);
     if (cached !== undefined) {
       return cached;
     }
-    const resolved = resolveTargetRelResult(consumer, targetName);
-    const result = resolved.ok
-      ? decryptSopsJson(consumer, resolved.rel)
-      : {
-          ok: false as const,
-          problem:
-            resolved.kind === 'ambiguous'
-              ? resolved.problem
-              : `secrets target "${targetName}" does not exist; create it and mint the pair with \`bun standards creds add cloudflare --s3\``,
-        };
-    documents.set(targetName, result);
+    const result = decryptSopsJson(source.root, source.rel);
+    documents.set(documentKey, result);
     return result;
   };
   const resolveValue = (
     label: string,
     reference: BrokeredS3Reference,
   ): { readonly value: string | null; readonly problem: string | null } => {
-    const allowlistEntry = `${reference.brokeredS3}:${reference.key}`;
-    if (!allowedReferences.has(allowlistEntry)) {
-      return {
-        value: null,
-        problem: `${label}: unauthorized brokered S3 pair; add "${allowlistEntry}" to the encrypted secrets/dev.yaml brokeredReferences allowlist`,
-      };
-    }
+    const allowlistEntry = brokeredReferenceIdentity(reference);
     if (preservedReferences.has(allowlistEntry)) {
       return { value: '', problem: null };
     }
-    const document = readDocument(reference.brokeredS3);
+    const document = readDocument(reference);
     if (!document.ok) {
       return { value: null, problem: `${label}: ${document.problem}` };
     }

package/src/dev-env-brokered-source.ts

@@ -0,0 +1,128 @@
+import { execFileSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseDestination } from './creds-dest';
+import { resolveTargetRelResult } from './creds-target';
+import type { BrokeredS3Reference } from './dev-env-brokered';
+import { isRecord } from './github-settings-parse';
+
+const repositoryPattern =
+  /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const gitSuffixPattern = /\.git$/u;
+const sshRemotePattern = /^git@github\.com:(?<repository>[^\s]+?)(?:\.git)?$/u;
+
+export type BrokeredS3Source = Readonly<{
+  repository: string;
+  checkout: string;
+}>;
+
+export const parseBrokeredSource = (raw: unknown): BrokeredS3Source | null => {
+  if (
+    !(
+      isRecord(raw) &&
+      Object.keys(raw).length === 2 &&
+      typeof raw.repository === 'string' &&
+      repositoryPattern.test(raw.repository) &&
+      typeof raw.checkout === 'string' &&
+      raw.checkout.trim() === raw.checkout &&
+      raw.checkout.length > 0 &&
+      !raw.checkout.includes('\\')
+    )
+  ) {
+    return null;
+  }
+  return { repository: raw.repository, checkout: raw.checkout };
+};
+
+export const brokeredReferenceIdentity = (
+  reference: BrokeredS3Reference,
+): string =>
+  `${reference.source === undefined ? '' : `${reference.source.repository}@`}${reference.brokeredS3}:${reference.key}`;
+
+export const validBrokeredIdentity = (raw: string): boolean => {
+  const separator = raw.indexOf('@');
+  return separator === -1
+    ? parseDestination(raw) !== null
+    : repositoryPattern.test(raw.slice(0, separator)) &&
+        parseDestination(raw.slice(separator + 1)) !== null;
+};
+
+const remoteRepository = (remote: string): string | null => {
+  const ssh = sshRemotePattern.exec(remote)?.groups?.repository;
+  if (ssh !== undefined) {
+    return ssh;
+  }
+  try {
+    const url = new URL(remote);
+    if (
+      url.hostname !== 'github.com' ||
+      !['https:', 'ssh:'].includes(url.protocol) ||
+      url.port !== '' ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return null;
+    }
+    return url.pathname.slice(1).replace(gitSuffixPattern, '');
+  } catch {
+    return null;
+  }
+};
+
+type SourceResolution =
+  | Readonly<{ ok: true; root: string; rel: string }>
+  | Readonly<{ ok: false; problem: string }>;
+
+export const resolveBrokeredSource = (
+  consumer: string,
+  reference: BrokeredS3Reference,
+): SourceResolution => {
+  let root = consumer;
+  if (reference.source !== undefined) {
+    try {
+      root = resolve(consumer, reference.source.checkout);
+      if (realpathSync(root) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must not contain symlinks',
+        };
+      }
+      const git = (args: ReadonlyArray<string>) =>
+        execFileSync('git', ['-C', root, ...args], {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+      if (git(['rev-parse', '--show-toplevel']) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must name a repository root',
+        };
+      }
+      if (
+        remoteRepository(git(['remote', 'get-url', 'origin'])) !==
+        reference.source.repository
+      ) {
+        return {
+          ok: false,
+          problem:
+            'source checkout origin does not match the authorized repository',
+        };
+      }
+    } catch {
+      return {
+        ok: false,
+        problem: 'source checkout is not an accessible Git repository',
+      };
+    }
+  }
+  const target = resolveTargetRelResult(root, reference.brokeredS3);
+  return target.ok
+    ? { ok: true, root, rel: target.rel }
+    : {
+        ok: false,
+        problem:
+          target.kind === 'ambiguous'
+            ? target.problem
+            : `secrets target "${reference.brokeredS3}" does not exist; create it and mint the pair with \`bun standards creds add cloudflare --s3\``,
+      };
+};

package/src/dev-env-brokered.ts

@@ -7,6 +7,10 @@
 
 import { parseDestination } from './creds-dest';
 import { parseSopsKeyPath } from './creds-sops-structure';
+import {
+  type BrokeredS3Source,
+  parseBrokeredSource,
+} from './dev-env-brokered-source';
 import { isRecord } from './github-settings-parse';
 
 export const BROKERED_S3_PARTS = [
@@ -20,9 +24,10 @@ export type BrokeredS3Reference = {
   readonly brokeredS3: string;
   readonly key: string;
   readonly part: BrokeredS3Part;
+  readonly source?: BrokeredS3Source;
 };
 
-const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part'] as const;
+const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part', 'source'] as const;
 
 export const isBrokeredS3ReferenceShape = (
   value: unknown,
@@ -46,11 +51,18 @@ export const parseBrokeredS3Reference = (
   for (const property of Object.keys(raw)) {
     if (!REFERENCE_PROPERTIES.includes(property as 'brokeredS3')) {
       problems.push(
-        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, and part`,
+        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, part, and source`,
       );
     }
   }
   const { brokeredS3: target, key, part } = raw;
+  const source =
+    raw.source === undefined ? undefined : parseBrokeredSource(raw.source);
+  if (source === null) {
+    problems.push(
+      `${label} source must contain exactly a GitHub repository owner/name and a checkout path`,
+    );
+  }
   if (
     typeof target !== 'string' ||
     parseDestination(`${target}:reference_validation`) === null
@@ -78,6 +90,7 @@ export const parseBrokeredS3Reference = (
       brokeredS3: target as string,
       key: key as string,
       part: part as BrokeredS3Part,
+      ...(source === undefined || source === null ? {} : { source }),
     },
   };
 };

package/src/dev-env.ts

@@ -42,6 +42,21 @@ export type DevEnvPlan = {
   readonly problems: ReadonlyArray<string>;
 };
 
+const workspaceConfigurationProblems = (
+  consumer: string,
+  targets: ReadonlyArray<import('./dev-env-compose').ComposedDevEnvTarget>,
+): ReadonlyArray<string> =>
+  targets.flatMap((target) => {
+    const workspace = `${target.group}/${target.workspace}`;
+    if (!existsSync(join(consumer, workspace, 'package.json'))) {
+      return [
+        `${target.sources.join(' + ')} defines ${target.group}.${target.workspace}, but ${workspace}/package.json does not exist`,
+      ];
+    }
+    const problem = devEnvGitIgnoreProblem(consumer, `${workspace}/.env.local`);
+    return problem === null ? [] : [problem];
+  });
+
 export const planDevEnvChanges = (
   consumer: string,
   inputs: DevEnvInputs,
@@ -66,6 +81,13 @@ export const planDevEnvChanges = (
     },
     layer(DEV_LOCAL_FILE, inputs.local),
   );
+  const configurationProblems = [
+    ...composed.problems,
+    ...workspaceConfigurationProblems(consumer, composed.targets),
+  ];
+  if (configurationProblems.length > 0) {
+    return { writes: [], removals: [], problems: configurationProblems };
+  }
   const resolved = resolveBrokeredReferences(
     consumer,
     composed.targets,

package/src/github-api.ts

@@ -16,7 +16,7 @@ import { isRecord } from './github-settings-parse';
 const API_ROOT = 'https://api.github.com';
 
 const GITHUB_REMOTE_PATTERN =
-  /github\.com[/:](?<repo>[^/]+\/[^/]+?)(?:\.git)?$/u;
+  /^(?:https?:\/\/(?:[^/@]+@)?github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)(?<repo>[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+?)(?:\.git)*$/iu;
 
 export const HTTP_OK = 200;
 export const HTTP_CREATED = 201;
@@ -55,7 +55,10 @@ export const resolveToken = (): string | null => {
 
 export const resolveGithubRepo = (consumer: string): string | null => {
   const url = quietExec('git', ['-C', consumer, 'remote', 'get-url', 'origin']);
-  return url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo ?? null;
+  const repo = url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo?.toLowerCase();
+  return repo === undefined || ['.', '..'].includes(repo.split('/')[1] ?? '')
+    ? null
+    : repo;
 };
 
 export type ApiResponse = { readonly status: number; readonly body: unknown };

package/src/github-apply.ts

@@ -9,9 +9,12 @@ import {
   HTTP_OK,
   request,
 } from './github-api';
+import { resolveHiddenBypassActors } from './github-bypass-actors';
 import { diffRepositorySettings } from './github-diff';
+import { fetchBypassActorCountsViaGraphql } from './github-graphql';
 import { fetchLiveRulesets } from './github-ruleset-api';
-import { diffRuleset } from './github-ruleset-diff';
+import { diffRuleset, diffRulesets } from './github-ruleset-diff';
+import { isHiddenBypassActors } from './github-ruleset-visibility';
 import { type GithubSettings, isRecord } from './github-settings-parse';
 
 // GitHub answers a PATCH containing a plan-unavailable setting with HTTP 200
@@ -123,7 +126,28 @@ export const applyRulesets = async (
   if (live.rulesets === null) {
     throw new Error(live.problem ?? 'unable to read rulesets');
   }
-  const liveByName = new Map(live.rulesets.map((r) => [String(r.name), r]));
+  let comparable = live.rulesets;
+  const initialDiff = diffRulesets(declared.rulesets, comparable);
+  if (initialDiff.unverifiable.some(isHiddenBypassActors)) {
+    const answered = await fetchBypassActorCountsViaGraphql(token, repo);
+    comparable = resolveHiddenBypassActors(
+      declared.rulesets,
+      comparable,
+      answered.counts,
+    );
+  }
+  const invisible = diffRulesets(declared.rulesets, comparable).unverifiable;
+  if (invisible.length > 0) {
+    throw new Error(
+      `cannot verify ruleset fields before applying: ${invisible.map(({ name, key }) => `${name}: ${key}`).join('; ')}; use a credential that can read the declared fields`,
+    );
+  }
+  const liveByName = new Map(comparable.map((r) => [String(r.name), r]));
+  if (liveByName.size !== comparable.length) {
+    throw new Error(
+      'duplicate live ruleset names prevent safe reconciliation; remove or rename the duplicate rulesets explicitly',
+    );
+  }
   const declaredNames = new Set(declared.rulesets.map((r) => String(r.name)));
   const actions: Array<string> = [];
   for (const ruleset of declared.rulesets) {

package/src/github-bypass-actors.ts

@@ -10,8 +10,8 @@ import { BYPASS_ACTORS_KEY } from './github-ruleset-diff';
 // their content is never observed: subsetMatches short-circuits at the length
 // check, two empty lists compare no element, and a declared ruleset with no
 // bypass_actors array never reaches that comparison. Nothing else looks inside
-// them; bypassActorCountDetail reads only `.length`, and github-live-drift.ts
-// is the sole importer, so a stand-in cannot reach a PATCH body. The guarantee
+// them; bypassActorCountDetail reads only `.length`, and both check/apply only use these live records for comparison. Writes
+// always send the original declaration, so a stand-in cannot reach a PATCH body. The guarantee
 // is not local: it also relies on declared ruleset names being unique, which
 // github-settings-parse.ts and github-settings-merge.ts enforce.
 const unreadableBypassActors = (count: number): ReadonlyArray<unknown> =>

package/src/sops-action-callers.ts

@@ -0,0 +1,133 @@
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { isRecord } from './github-settings-parse';
+import type { ManagedEntry } from './managed-files';
+import { parseYaml } from './yaml-parse';
+
+const YAML_FILE = /\.ya?ml$/u;
+const ACTION = '.github/actions/sops-secret/action.yml';
+const LOCAL_ACTION = './.github/actions/sops-secret';
+const yamlFiles = async (root: string, rel: string): Promise<Array<string>> => {
+  if (!existsSync(join(root, rel))) {
+    return [];
+  }
+  const entries = await readdir(join(root, rel), { withFileTypes: true });
+  return (
+    await Promise.all(
+      entries.map((entry) => {
+        const path = `${rel}/${entry.name}`;
+        if (entry.isDirectory()) {
+          return yamlFiles(root, path);
+        }
+        return Promise.resolve(
+          entry.isFile() && YAML_FILE.test(path) ? [path] : [],
+        );
+      }),
+    )
+  ).flat();
+};
+const hasLegacyCaller = (value: unknown): boolean => {
+  if (Array.isArray(value)) {
+    return value.some(hasLegacyCaller);
+  }
+  if (!isRecord(value)) {
+    return false;
+  }
+  return (
+    (typeof value.uses === 'string' &&
+      value.uses.startsWith('./') &&
+      posix.resolve('/', value.uses) === posix.resolve('/', LOCAL_ACTION) &&
+      isRecord(value.with) &&
+      Object.hasOwn(value.with, 'env-name')) ||
+    Object.values(value).some(hasLegacyCaller)
+  );
+};
+
+const localActions = (value: unknown): Array<string> => {
+  if (Array.isArray(value)) {
+    return value.flatMap(localActions);
+  }
+  if (!isRecord(value)) {
+    return [];
+  }
+  const reference = value.uses;
+  return [
+    ...(typeof reference === 'string' && reference.startsWith('./')
+      ? [posix.normalize(reference)]
+      : []),
+    ...Object.values(value).flatMap(localActions),
+  ];
+};
+const callerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry>,
+): Promise<Array<string>> => {
+  const visited = new Set<string>();
+  const visit = async (path: string): Promise<Array<string>> => {
+    if (visited.has(path)) {
+      return [];
+    }
+    visited.add(path);
+    const source = incoming.get(path)?.absolutePath ?? join(consumer, path);
+    const parsed = parseYaml(await readFile(source, 'utf8'), path);
+    if (parsed.problem !== null) {
+      return [parsed.problem];
+    }
+    const problems =
+      !incoming.has(path) && hasLegacyCaller(parsed.value)
+        ? [
+            `${path} still passes env-name to ${LOCAL_ACTION}; before syncing, give the resolver step an id, remove env-name, and pass steps.<id>.outputs.value only to each consuming step's env or action input`,
+          ]
+        : [];
+    const nested = await Promise.all(
+      localActions(parsed.value).map(async (directory) => {
+        if (directory === '..' || directory.startsWith('../')) {
+          return [`${path} references a local action outside the repository`];
+        }
+        const paths = ['action.yml', 'action.yaml']
+          .map((filename) => posix.join(directory, filename))
+          .filter(
+            (target) =>
+              incoming.has(target) || existsSync(join(consumer, target)),
+          );
+        return (await Promise.all(paths.map(visit))).flat();
+      }),
+    );
+    return [...problems, ...nested.flat()];
+  };
+  return (
+    await Promise.all((await yamlFiles(consumer, '.github')).map(visit))
+  ).flat();
+};
+
+// Called before mirror writes. Consumer-owned workflows and composite actions
+// are not silently rewritten, so an action interface migration must stop before
+// replacing the implementation they still invoke with its retired input.
+export const collectSopsActionCallerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry> = new Map(),
+): Promise<ReadonlyArray<string>> => {
+  const action = incoming.get(ACTION);
+  const actionPath = action?.absolutePath ?? join(consumer, ACTION);
+  if (
+    !existsSync(actionPath) ||
+    (action !== undefined && action.kind !== 'file')
+  ) {
+    return [];
+  }
+  const { value: definition } = parseYaml(
+    await readFile(actionPath, 'utf8'),
+    ACTION,
+  );
+  if (
+    !(
+      isRecord(definition) &&
+      isRecord(definition.outputs) &&
+      Object.hasOwn(definition.outputs, 'value')
+    )
+  ) {
+    return [];
+  }
+  return callerProblems(consumer, incoming);
+};

package/src/source-text.ts

@@ -0,0 +1,98 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { basename, extname, join } from 'node:path';
+import { isContainedPath } from './contained-path';
+
+const sourceExtensions = new Set(
+  '.ts,.tsx,.mts,.cts,.js,.jsx,.mjs,.cjs,.json,.jsonc,.yaml,.yml,.toml,.nix,.sh,.bash,.zsh,.rb,.py,.css,.scss,.html,.xml,.svg,.md,.mdx,.sql,.just'.split(
+    ',',
+  ),
+);
+const sourceFileNames = new Set([
+  'Dockerfile',
+  'Containerfile',
+  'Makefile',
+  'justfile',
+  '.envrc',
+  '.gitignore',
+  '.gitattributes',
+  '.dockerignore',
+  '.editorconfig',
+  '.npmrc',
+]);
+const dotenvFileName = /^\.env(?:\..*)?$/u;
+const forbiddenControl = /[^\P{Cc}\t\n]/u;
+const gitOutputLimit = 16_777_216;
+const hexadecimalRadix = 16;
+const minimumCodePointWidth = 4;
+
+export const inspectSourceText = (
+  path: string,
+  bytes: Uint8Array,
+): string | null => {
+  let text: string;
+  try {
+    text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+  } catch {
+    return `${JSON.stringify(path)}: source text must be valid UTF-8`;
+  }
+  const match = forbiddenControl.exec(text);
+  if (!match) {
+    return null;
+  }
+  const point = match[0]
+    .codePointAt(0)
+    ?.toString(hexadecimalRadix)
+    .toUpperCase()
+    .padStart(minimumCodePointWidth, '0');
+  const line = text.slice(0, match.index).split('\n').length;
+  return `${JSON.stringify(path)}:${line}: raw control character U+${point}; use an escaped representation (only tab and LF are allowed)`;
+};
+
+export const collectSourceTextProblems = (
+  root: string,
+): ReadonlyArray<string> => {
+  let tracked: string;
+  try {
+    tracked = execFileSync('git', ['ls-files', '--cached', '-z'], {
+      cwd: root,
+      encoding: 'utf8',
+      maxBuffer: gitOutputLimit,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+  } catch {
+    return [
+      'Cannot enumerate tracked source files; run the gate from a readable Git working tree.',
+    ];
+  }
+  const problems: Array<string> = [];
+  const paths = new Set(
+    tracked
+      .split('\0')
+      .filter(
+        (path) =>
+          sourceExtensions.has(extname(path)) ||
+          sourceFileNames.has(basename(path)) ||
+          dotenvFileName.test(basename(path)),
+      ),
+  );
+  for (const path of paths) {
+    if (isContainedPath(root, path, 'file')) {
+      try {
+        const problem = inspectSourceText(path, readFileSync(join(root, path)));
+        if (problem !== null) {
+          problems.push(problem);
+        }
+      } catch {
+        problems.push(
+          `${JSON.stringify(path)}: cannot read tracked source text`,
+        );
+      }
+    } else {
+      problems.push(
+        `${JSON.stringify(path)}: tracked source must be a contained regular file`,
+      );
+    }
+  }
+  return problems;
+};

package/src/structure-check.ts

@@ -4,6 +4,7 @@ import { isAbsolute, join } from 'node:path';
 import { isContainedPath } from './contained-path';
 import { isRecord } from './github-settings-parse';
 import { readJsonFile } from './json-file';
+import { collectSopsActionCallerProblems } from './sops-action-callers';
 import { collectBunVersionProblems } from './structure-bun-version';
 import {
   missingPublishedCliProblems,
@@ -154,14 +155,16 @@ export const collectStructureProblems = async (
   consumer: string,
   profile: StructureProfile,
 ): Promise<ReadonlyArray<string>> => {
-  const [root, secretsProblems] = await Promise.all([
+  const [root, secretsProblems, callerProblems] = await Promise.all([
     readJsonFile(join(consumer, 'package.json')),
     collectCiSecretsProblems(consumer),
+    collectSopsActionCallerProblems(consumer),
   ]);
   if (root === null) {
     return [
       'package.json must exist and contain a JSON object',
       ...secretsProblems,
+      ...callerProblems,
     ];
   }
   const declaration = workspacePatternsOf(root);
@@ -193,5 +196,6 @@ export const collectStructureProblems = async (
     ...inspectRootScripts(root, profile, requireA11y),
     ...inspections.flatMap((i) => [...i.problems]),
     ...secretsProblems,
+    ...callerProblems,
   ];
 };

package/src/structure-profile.ts

@@ -31,6 +31,7 @@ const SOURCE_ROOT_EXPECTATIONS: ReadonlyArray<RootScriptExpectation> = [
     name: 'check',
     commands: [
       `${SOURCE_CLI} structure --profile source`,
+      `${SOURCE_CLI} source-text`,
       `${SOURCE_CLI} dependabot --check`,
       `${SOURCE_CLI} github --check`,
       'turbo run lint check-types test --output-logs=errors-only',
@@ -41,6 +42,7 @@ const SOURCE_ROOT_EXPECTATIONS: ReadonlyArray<RootScriptExpectation> = [
     name: 'check:fix',
     commands: [
       `${SOURCE_CLI} structure --profile source`,
+      `${SOURCE_CLI} source-text`,
       `${SOURCE_CLI} dependabot --write`,
       `${SOURCE_CLI} github --check`,
       'turbo run lint:fix check-types test --output-logs=errors-only',