@davidvornholt/standards 0.26.4 → 0.28.0

package/src/dev-env-brokered-resolve.ts

@@ -4,8 +4,9 @@
 // layer's reference, and a reference that lost the merge is never decrypted.
 
 import { lookupS3Pair } from './creds-r2';
-import { resolveTargetRelResult } from './creds-target';
 import type { BrokeredS3Reference } from './dev-env-brokered';
+import { prepareBrokeredSources } from './dev-env-brokered-preflight';
+import { brokeredReferenceIdentity } from './dev-env-brokered-source';
 import type { ComposedDevEnvTarget } from './dev-env-compose';
 import { encodePortableDotenvValue } from './dev-env-dotenv-value';
 import { decryptSopsJson, type SopsJsonResult } from './sops-exec';
@@ -55,39 +56,49 @@ export const resolveBrokeredReferences = (
 ): ResolvedDevEnv => {
   const problems: Array<string> = [];
   const documents = new Map<string, SopsJsonResult>();
-  const readDocument = (targetName: string): SopsJsonResult => {
-    const cached = documents.get(targetName);
+  const preflight = prepareBrokeredSources(
+    consumer,
+    targets,
+    allowedReferences,
+    preservedReferences,
+  );
+  if (preflight.problems.length > 0) {
+    return {
+      problems: preflight.problems,
+      targets: targets.map((target) => ({
+        ...target,
+        env: Object.fromEntries(
+          Object.entries(target.env).filter(
+            (entry): entry is [string, string] => typeof entry[1] === 'string',
+          ),
+        ),
+      })),
+    };
+  }
+  const { sources } = preflight;
+  const readDocument = (reference: BrokeredS3Reference): SopsJsonResult => {
+    const source = sources.get(reference);
+    if (source === undefined) {
+      return { ok: false, problem: 'unresolved source target' };
+    }
+    const documentKey = `${source.root}/${source.rel}`;
+    const cached = documents.get(documentKey);
     if (cached !== undefined) {
       return cached;
     }
-    const resolved = resolveTargetRelResult(consumer, targetName);
-    const result = resolved.ok
-      ? decryptSopsJson(consumer, resolved.rel)
-      : {
-          ok: false as const,
-          problem:
-            resolved.kind === 'ambiguous'
-              ? resolved.problem
-              : `secrets target "${targetName}" does not exist; create it and mint the pair with \`bun standards creds add cloudflare --s3\``,
-        };
-    documents.set(targetName, result);
+    const result = decryptSopsJson(source.root, source.rel);
+    documents.set(documentKey, result);
     return result;
   };
   const resolveValue = (
     label: string,
     reference: BrokeredS3Reference,
   ): { readonly value: string | null; readonly problem: string | null } => {
-    const allowlistEntry = `${reference.brokeredS3}:${reference.key}`;
-    if (!allowedReferences.has(allowlistEntry)) {
-      return {
-        value: null,
-        problem: `${label}: unauthorized brokered S3 pair; add "${allowlistEntry}" to the encrypted secrets/dev.yaml brokeredReferences allowlist`,
-      };
-    }
+    const allowlistEntry = brokeredReferenceIdentity(reference);
     if (preservedReferences.has(allowlistEntry)) {
       return { value: '', problem: null };
     }
-    const document = readDocument(reference.brokeredS3);
+    const document = readDocument(reference);
     if (!document.ok) {
       return { value: null, problem: `${label}: ${document.problem}` };
     }

package/src/dev-env-brokered-source.ts

@@ -0,0 +1,128 @@
+import { execFileSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseDestination } from './creds-dest';
+import { resolveTargetRelResult } from './creds-target';
+import type { BrokeredS3Reference } from './dev-env-brokered';
+import { isRecord } from './github-settings-parse';
+
+const repositoryPattern =
+  /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const gitSuffixPattern = /\.git$/u;
+const sshRemotePattern = /^git@github\.com:(?<repository>[^\s]+?)(?:\.git)?$/u;
+
+export type BrokeredS3Source = Readonly<{
+  repository: string;
+  checkout: string;
+}>;
+
+export const parseBrokeredSource = (raw: unknown): BrokeredS3Source | null => {
+  if (
+    !(
+      isRecord(raw) &&
+      Object.keys(raw).length === 2 &&
+      typeof raw.repository === 'string' &&
+      repositoryPattern.test(raw.repository) &&
+      typeof raw.checkout === 'string' &&
+      raw.checkout.trim() === raw.checkout &&
+      raw.checkout.length > 0 &&
+      !raw.checkout.includes('\\')
+    )
+  ) {
+    return null;
+  }
+  return { repository: raw.repository, checkout: raw.checkout };
+};
+
+export const brokeredReferenceIdentity = (
+  reference: BrokeredS3Reference,
+): string =>
+  `${reference.source === undefined ? '' : `${reference.source.repository}@`}${reference.brokeredS3}:${reference.key}`;
+
+export const validBrokeredIdentity = (raw: string): boolean => {
+  const separator = raw.indexOf('@');
+  return separator === -1
+    ? parseDestination(raw) !== null
+    : repositoryPattern.test(raw.slice(0, separator)) &&
+        parseDestination(raw.slice(separator + 1)) !== null;
+};
+
+const remoteRepository = (remote: string): string | null => {
+  const ssh = sshRemotePattern.exec(remote)?.groups?.repository;
+  if (ssh !== undefined) {
+    return ssh;
+  }
+  try {
+    const url = new URL(remote);
+    if (
+      url.hostname !== 'github.com' ||
+      !['https:', 'ssh:'].includes(url.protocol) ||
+      url.port !== '' ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return null;
+    }
+    return url.pathname.slice(1).replace(gitSuffixPattern, '');
+  } catch {
+    return null;
+  }
+};
+
+type SourceResolution =
+  | Readonly<{ ok: true; root: string; rel: string }>
+  | Readonly<{ ok: false; problem: string }>;
+
+export const resolveBrokeredSource = (
+  consumer: string,
+  reference: BrokeredS3Reference,
+): SourceResolution => {
+  let root = consumer;
+  if (reference.source !== undefined) {
+    try {
+      root = resolve(consumer, reference.source.checkout);
+      if (realpathSync(root) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must not contain symlinks',
+        };
+      }
+      const git = (args: ReadonlyArray<string>) =>
+        execFileSync('git', ['-C', root, ...args], {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+      if (git(['rev-parse', '--show-toplevel']) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must name a repository root',
+        };
+      }
+      if (
+        remoteRepository(git(['remote', 'get-url', 'origin'])) !==
+        reference.source.repository
+      ) {
+        return {
+          ok: false,
+          problem:
+            'source checkout origin does not match the authorized repository',
+        };
+      }
+    } catch {
+      return {
+        ok: false,
+        problem: 'source checkout is not an accessible Git repository',
+      };
+    }
+  }
+  const target = resolveTargetRelResult(root, reference.brokeredS3);
+  return target.ok
+    ? { ok: true, root, rel: target.rel }
+    : {
+        ok: false,
+        problem:
+          target.kind === 'ambiguous'
+            ? target.problem
+            : `secrets target "${reference.brokeredS3}" does not exist; create it and mint the pair with \`bun standards creds add cloudflare --s3\``,
+      };
+};

package/src/dev-env-brokered.ts

@@ -7,6 +7,10 @@
 
 import { parseDestination } from './creds-dest';
 import { parseSopsKeyPath } from './creds-sops-structure';
+import {
+  type BrokeredS3Source,
+  parseBrokeredSource,
+} from './dev-env-brokered-source';
 import { isRecord } from './github-settings-parse';
 
 export const BROKERED_S3_PARTS = [
@@ -20,9 +24,10 @@ export type BrokeredS3Reference = {
   readonly brokeredS3: string;
   readonly key: string;
   readonly part: BrokeredS3Part;
+  readonly source?: BrokeredS3Source;
 };
 
-const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part'] as const;
+const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part', 'source'] as const;
 
 export const isBrokeredS3ReferenceShape = (
   value: unknown,
@@ -46,11 +51,18 @@ export const parseBrokeredS3Reference = (
   for (const property of Object.keys(raw)) {
     if (!REFERENCE_PROPERTIES.includes(property as 'brokeredS3')) {
       problems.push(
-        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, and part`,
+        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, part, and source`,
       );
     }
   }
   const { brokeredS3: target, key, part } = raw;
+  const source =
+    raw.source === undefined ? undefined : parseBrokeredSource(raw.source);
+  if (source === null) {
+    problems.push(
+      `${label} source must contain exactly a GitHub repository owner/name and a checkout path`,
+    );
+  }
   if (
     typeof target !== 'string' ||
     parseDestination(`${target}:reference_validation`) === null
@@ -78,6 +90,7 @@ export const parseBrokeredS3Reference = (
       brokeredS3: target as string,
       key: key as string,
       part: part as BrokeredS3Part,
+      ...(source === undefined || source === null ? {} : { source }),
     },
   };
 };

package/src/dev-env.ts

@@ -42,6 +42,21 @@ export type DevEnvPlan = {
   readonly problems: ReadonlyArray<string>;
 };
 
+const workspaceConfigurationProblems = (
+  consumer: string,
+  targets: ReadonlyArray<import('./dev-env-compose').ComposedDevEnvTarget>,
+): ReadonlyArray<string> =>
+  targets.flatMap((target) => {
+    const workspace = `${target.group}/${target.workspace}`;
+    if (!existsSync(join(consumer, workspace, 'package.json'))) {
+      return [
+        `${target.sources.join(' + ')} defines ${target.group}.${target.workspace}, but ${workspace}/package.json does not exist`,
+      ];
+    }
+    const problem = devEnvGitIgnoreProblem(consumer, `${workspace}/.env.local`);
+    return problem === null ? [] : [problem];
+  });
+
 export const planDevEnvChanges = (
   consumer: string,
   inputs: DevEnvInputs,
@@ -66,6 +81,13 @@ export const planDevEnvChanges = (
     },
     layer(DEV_LOCAL_FILE, inputs.local),
   );
+  const configurationProblems = [
+    ...composed.problems,
+    ...workspaceConfigurationProblems(consumer, composed.targets),
+  ];
+  if (configurationProblems.length > 0) {
+    return { writes: [], removals: [], problems: configurationProblems };
+  }
   const resolved = resolveBrokeredReferences(
     consumer,
     composed.targets,

package/src/github-api.ts

@@ -16,7 +16,7 @@ import { isRecord } from './github-settings-parse';
 const API_ROOT = 'https://api.github.com';
 
 const GITHUB_REMOTE_PATTERN =
-  /github\.com[/:](?<repo>[^/]+\/[^/]+?)(?:\.git)?$/u;
+  /^(?:https?:\/\/(?:[^/@]+@)?github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)(?<repo>[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+?)(?:\.git)*$/iu;
 
 export const HTTP_OK = 200;
 export const HTTP_CREATED = 201;
@@ -55,7 +55,10 @@ export const resolveToken = (): string | null => {
 
 export const resolveGithubRepo = (consumer: string): string | null => {
   const url = quietExec('git', ['-C', consumer, 'remote', 'get-url', 'origin']);
-  return url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo ?? null;
+  const repo = url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo?.toLowerCase();
+  return repo === undefined || ['.', '..'].includes(repo.split('/')[1] ?? '')
+    ? null
+    : repo;
 };
 
 export type ApiResponse = { readonly status: number; readonly body: unknown };

package/src/github-apply.ts

@@ -9,9 +9,12 @@ import {
   HTTP_OK,
   request,
 } from './github-api';
+import { resolveHiddenBypassActors } from './github-bypass-actors';
 import { diffRepositorySettings } from './github-diff';
+import { fetchBypassActorCountsViaGraphql } from './github-graphql';
 import { fetchLiveRulesets } from './github-ruleset-api';
-import { diffRuleset } from './github-ruleset-diff';
+import { diffRuleset, diffRulesets } from './github-ruleset-diff';
+import { isHiddenBypassActors } from './github-ruleset-visibility';
 import { type GithubSettings, isRecord } from './github-settings-parse';
 
 // GitHub answers a PATCH containing a plan-unavailable setting with HTTP 200
@@ -123,7 +126,28 @@ export const applyRulesets = async (
   if (live.rulesets === null) {
     throw new Error(live.problem ?? 'unable to read rulesets');
   }
-  const liveByName = new Map(live.rulesets.map((r) => [String(r.name), r]));
+  let comparable = live.rulesets;
+  const initialDiff = diffRulesets(declared.rulesets, comparable);
+  if (initialDiff.unverifiable.some(isHiddenBypassActors)) {
+    const answered = await fetchBypassActorCountsViaGraphql(token, repo);
+    comparable = resolveHiddenBypassActors(
+      declared.rulesets,
+      comparable,
+      answered.counts,
+    );
+  }
+  const invisible = diffRulesets(declared.rulesets, comparable).unverifiable;
+  if (invisible.length > 0) {
+    throw new Error(
+      `cannot verify ruleset fields before applying: ${invisible.map(({ name, key }) => `${name}: ${key}`).join('; ')}; use a credential that can read the declared fields`,
+    );
+  }
+  const liveByName = new Map(comparable.map((r) => [String(r.name), r]));
+  if (liveByName.size !== comparable.length) {
+    throw new Error(
+      'duplicate live ruleset names prevent safe reconciliation; remove or rename the duplicate rulesets explicitly',
+    );
+  }
   const declaredNames = new Set(declared.rulesets.map((r) => String(r.name)));
   const actions: Array<string> = [];
   for (const ruleset of declared.rulesets) {

package/src/github-bypass-actors.ts

@@ -2,7 +2,7 @@
 // answers for tokens that cannot read the actors themselves. Pure logic; the
 // GraphQL call lives in github-graphql.ts.
 
-import { BYPASS_ACTORS_KEY } from './github-ruleset-diff';
+import { BYPASS_ACTORS_KEY } from './github-settings-parse';
 
 // Stand-ins for bypass actors GraphQL counted but would not name. They exist
 // only to carry the count into the ordinary length comparison, and are attached
@@ -10,8 +10,8 @@ import { BYPASS_ACTORS_KEY } from './github-ruleset-diff';
 // their content is never observed: subsetMatches short-circuits at the length
 // check, two empty lists compare no element, and a declared ruleset with no
 // bypass_actors array never reaches that comparison. Nothing else looks inside
-// them; bypassActorCountDetail reads only `.length`, and github-live-drift.ts
-// is the sole importer, so a stand-in cannot reach a PATCH body. The guarantee
+// them; bypassActorCountDetail reads only `.length`, and both check/apply only use these live records for comparison. Writes
+// always send the original declaration, so a stand-in cannot reach a PATCH body. The guarantee
 // is not local: it also relies on declared ruleset names being unique, which
 // github-settings-parse.ts and github-settings-merge.ts enforce.
 const unreadableBypassActors = (count: number): ReadonlyArray<unknown> =>

package/src/github-ruleset-diff.ts

@@ -3,9 +3,11 @@
 // general value comparison lives in github-diff.ts.
 
 import { subsetMatches } from './github-diff';
-import { isRecord } from './github-settings-parse';
-
-export const BYPASS_ACTORS_KEY = 'bypass_actors';
+import {
+  BYPASS_ACTORS_KEY,
+  isRecord,
+  rulesetComparedKeys,
+} from './github-settings-parse';
 
 // A declared ruleset field the live side did not carry. It stays structured so
 // the caller owns both the wording and the test for *which* field it is;
@@ -21,13 +23,6 @@ export type RulesetDiff = {
   readonly unverifiable: ReadonlyArray<UnverifiableRulesetField>;
 };
 
-const RULESET_COMPARED_KEYS = [
-  'target',
-  'enforcement',
-  'conditions',
-  BYPASS_ACTORS_KEY,
-] as const;
-
 const diffRules = (
   name: string,
   declared: Readonly<Record<string, unknown>>,
@@ -99,15 +94,13 @@ export const diffRuleset = (
   const name = String(declared.name);
   const drifted: Array<string> = [];
   const unverifiable: Array<UnverifiableRulesetField> = [];
-  for (const key of RULESET_COMPARED_KEYS) {
-    if (declared[key] !== undefined) {
-      if (live[key] === undefined) {
-        unverifiable.push({ key, name });
-      } else if (!subsetMatches(declared[key], live[key])) {
-        drifted.push(
-          `ruleset "${name}": ${key} differs from the declared configuration${bypassActorCountDetail(key, declared[key], live[key])}`,
-        );
-      }
+  for (const key of rulesetComparedKeys(declared.target)) {
+    if (live[key] === undefined) {
+      unverifiable.push({ key, name });
+    } else if (!subsetMatches(declared[key], live[key])) {
+      drifted.push(
+        `ruleset "${name}": ${key} differs from the declared configuration${bypassActorCountDetail(key, declared[key], live[key])}`,
+      );
     }
   }
   drifted.push(...diffRules(name, declared, live));

package/src/github-ruleset-visibility.ts

@@ -8,10 +8,8 @@ import {
   ADMIN_VISIBILITY_ADVICE,
   unverifiableProblem,
 } from './github-command-shared';
-import {
-  BYPASS_ACTORS_KEY,
-  type UnverifiableRulesetField,
-} from './github-ruleset-diff';
+import type { UnverifiableRulesetField } from './github-ruleset-diff';
+import { BYPASS_ACTORS_KEY } from './github-settings-parse';
 
 const SCOPE = 'ruleset field(s)';
 

package/src/github-settings-parse.ts

@@ -45,6 +45,89 @@ export const isNamedRuleset = (
 ): value is Readonly<Record<string, unknown>> & { readonly name: string } =>
   isRecord(value) && typeof value.name === 'string' && value.name.length > 0;
 
+export const BYPASS_ACTORS_KEY = 'bypass_actors';
+const RULESET_COMPARED_KEYS = [
+  'target',
+  'enforcement',
+  'conditions',
+  BYPASS_ACTORS_KEY,
+] as const;
+
+// Push rules cover every push to the repository and have no ref-name scope.
+// The parser and comparison share the same field contract.
+export const rulesetComparedKeys = (target: unknown) =>
+  target === 'push'
+    ? RULESET_COMPARED_KEYS.filter((key) => key !== 'conditions')
+    : RULESET_COMPARED_KEYS;
+
+const isStringList = (value: unknown): value is ReadonlyArray<string> =>
+  Array.isArray(value) && value.every((item) => typeof item === 'string');
+
+const isOneOf = (value: unknown, choices: ReadonlyArray<string>): boolean =>
+  typeof value === 'string' && choices.includes(value);
+
+const rulesetConditionsProblem = (
+  ruleset: Readonly<Record<string, unknown>>,
+  prefix: string,
+): string | null => {
+  if (ruleset.conditions === undefined) {
+    return null;
+  }
+  if (ruleset.target === 'push') {
+    return `${prefix} must omit "conditions" for target "push", which applies to every push`;
+  }
+  const refName = isRecord(ruleset.conditions)
+    ? ruleset.conditions.ref_name
+    : undefined;
+  return isRecord(refName) &&
+    isStringList(refName.include) &&
+    isStringList(refName.exclude)
+    ? null
+    : `${prefix} "conditions" must declare "ref_name.include" and "ref_name.exclude" as arrays of strings`;
+};
+
+const rulesetFieldProblems = (
+  ruleset: Readonly<Record<string, unknown>>,
+  label: string,
+): ReadonlyArray<string> => {
+  const problems: Array<string> = [];
+  const prefix = `${label} ruleset "${String(ruleset.name)}"`;
+  for (const key of rulesetComparedKeys(ruleset.target)) {
+    if (ruleset[key] === undefined) {
+      const advice =
+        key === BYPASS_ACTORS_KEY ? '; use [] if nobody may bypass' : '';
+      problems.push(`${prefix} must declare "${key}"${advice}`);
+    }
+  }
+  if (
+    ruleset.target !== undefined &&
+    !isOneOf(ruleset.target, ['branch', 'tag', 'push'])
+  ) {
+    problems.push(`${prefix} "target" must be "branch", "tag", or "push"`);
+  }
+  if (
+    ruleset.enforcement !== undefined &&
+    !isOneOf(ruleset.enforcement, ['active', 'disabled', 'evaluate'])
+  ) {
+    problems.push(
+      `${prefix} "enforcement" must be "active", "disabled", or "evaluate"`,
+    );
+  }
+  if (
+    ruleset[BYPASS_ACTORS_KEY] !== undefined &&
+    !Array.isArray(ruleset[BYPASS_ACTORS_KEY])
+  ) {
+    problems.push(
+      `${prefix} "${BYPASS_ACTORS_KEY}" must be an array; use [] if nobody may bypass`,
+    );
+  }
+  const conditionsProblem = rulesetConditionsProblem(ruleset, prefix);
+  if (conditionsProblem !== null) {
+    problems.push(conditionsProblem);
+  }
+  return problems;
+};
+
 const LABEL_COLOR = /^[0-9a-f]{6}$/u;
 const LABEL_DECLARATION_KEY_COUNT = 3;
 
@@ -98,6 +181,9 @@ const rulesetListProblems = (
     } else {
       names.add(ruleset.name);
     }
+    if (isNamedRuleset(ruleset)) {
+      problems.push(...rulesetFieldProblems(ruleset, label));
+    }
   }
   return problems;
 };

package/src/sops-action-callers.ts

@@ -0,0 +1,133 @@
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { isRecord } from './github-settings-parse';
+import type { ManagedEntry } from './managed-files';
+import { parseYaml } from './yaml-parse';
+
+const YAML_FILE = /\.ya?ml$/u;
+const ACTION = '.github/actions/sops-secret/action.yml';
+const LOCAL_ACTION = './.github/actions/sops-secret';
+const yamlFiles = async (root: string, rel: string): Promise<Array<string>> => {
+  if (!existsSync(join(root, rel))) {
+    return [];
+  }
+  const entries = await readdir(join(root, rel), { withFileTypes: true });
+  return (
+    await Promise.all(
+      entries.map((entry) => {
+        const path = `${rel}/${entry.name}`;
+        if (entry.isDirectory()) {
+          return yamlFiles(root, path);
+        }
+        return Promise.resolve(
+          entry.isFile() && YAML_FILE.test(path) ? [path] : [],
+        );
+      }),
+    )
+  ).flat();
+};
+const hasLegacyCaller = (value: unknown): boolean => {
+  if (Array.isArray(value)) {
+    return value.some(hasLegacyCaller);
+  }
+  if (!isRecord(value)) {
+    return false;
+  }
+  return (
+    (typeof value.uses === 'string' &&
+      value.uses.startsWith('./') &&
+      posix.resolve('/', value.uses) === posix.resolve('/', LOCAL_ACTION) &&
+      isRecord(value.with) &&
+      Object.hasOwn(value.with, 'env-name')) ||
+    Object.values(value).some(hasLegacyCaller)
+  );
+};
+
+const localActions = (value: unknown): Array<string> => {
+  if (Array.isArray(value)) {
+    return value.flatMap(localActions);
+  }
+  if (!isRecord(value)) {
+    return [];
+  }
+  const reference = value.uses;
+  return [
+    ...(typeof reference === 'string' && reference.startsWith('./')
+      ? [posix.normalize(reference)]
+      : []),
+    ...Object.values(value).flatMap(localActions),
+  ];
+};
+const callerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry>,
+): Promise<Array<string>> => {
+  const visited = new Set<string>();
+  const visit = async (path: string): Promise<Array<string>> => {
+    if (visited.has(path)) {
+      return [];
+    }
+    visited.add(path);
+    const source = incoming.get(path)?.absolutePath ?? join(consumer, path);
+    const parsed = parseYaml(await readFile(source, 'utf8'), path);
+    if (parsed.problem !== null) {
+      return [parsed.problem];
+    }
+    const problems =
+      !incoming.has(path) && hasLegacyCaller(parsed.value)
+        ? [
+            `${path} still passes env-name to ${LOCAL_ACTION}; before syncing, give the resolver step an id, remove env-name, and pass steps.<id>.outputs.value only to each consuming step's env or action input`,
+          ]
+        : [];
+    const nested = await Promise.all(
+      localActions(parsed.value).map(async (directory) => {
+        if (directory === '..' || directory.startsWith('../')) {
+          return [`${path} references a local action outside the repository`];
+        }
+        const paths = ['action.yml', 'action.yaml']
+          .map((filename) => posix.join(directory, filename))
+          .filter(
+            (target) =>
+              incoming.has(target) || existsSync(join(consumer, target)),
+          );
+        return (await Promise.all(paths.map(visit))).flat();
+      }),
+    );
+    return [...problems, ...nested.flat()];
+  };
+  return (
+    await Promise.all((await yamlFiles(consumer, '.github')).map(visit))
+  ).flat();
+};
+
+// Called before mirror writes. Consumer-owned workflows and composite actions
+// are not silently rewritten, so an action interface migration must stop before
+// replacing the implementation they still invoke with its retired input.
+export const collectSopsActionCallerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry> = new Map(),
+): Promise<ReadonlyArray<string>> => {
+  const action = incoming.get(ACTION);
+  const actionPath = action?.absolutePath ?? join(consumer, ACTION);
+  if (
+    !existsSync(actionPath) ||
+    (action !== undefined && action.kind !== 'file')
+  ) {
+    return [];
+  }
+  const { value: definition } = parseYaml(
+    await readFile(actionPath, 'utf8'),
+    ACTION,
+  );
+  if (
+    !(
+      isRecord(definition) &&
+      isRecord(definition.outputs) &&
+      Object.hasOwn(definition.outputs, 'value')
+    )
+  ) {
+    return [];
+  }
+  return callerProblems(consumer, incoming);
+};