@effected/github-actions 0.6.1 → 0.8.0

package/ActionEnvironment.js

@@ -286,6 +286,26 @@ var ActionEnvironment = class ActionEnvironment extends Context.Service()("@effe
 	* `undefined` means *not served*, so a suite cannot arrange `undefined` as
 	* the payload itself. A webhook payload is always a JSON object; the case
 	* does not arise, and reserving the sentinel keeps the argument optional.
+	*
+	* When a suite wants the **real read path** rather than a served value —
+	* exercising the actual `GITHUB_EVENT_PATH` read-and-parse — this member is
+	* the seam: it leaves `FileSystem` in `R` precisely so the suite chooses
+	* the filesystem. Compose it with `@effected/memfs`'s seeded in-memory
+	* volume rather than a hand-rolled stub: the volume honors the whole
+	* `FileSystem` contract, and an unseeded path fails typed `NotFound`
+	* instead of whatever a hand stub happens to answer.
+	*
+	* @example
+	* ```ts
+	* import { ActionEnvironment } from "@effected/github-actions";
+	* import { MemoryFileSystem } from "@effected/memfs";
+	* import { Layer } from "effect";
+	*
+	* const layer = Layer.effect(
+	*   ActionEnvironment,
+	*   ActionEnvironment.makeTest({ GITHUB_EVENT_PATH: "/event.json" }),
+	* ).pipe(Layer.provide(MemoryFileSystem.layerWith({ "/event.json": JSON.stringify({ action: "opened" }) })));
+	* ```
 	*/
 	static makeTest = (overrides = {}, payload) => Effect.map(make({
 		...TEST_DEFAULTS,
@@ -302,7 +322,10 @@ var ActionEnvironment = class ActionEnvironment extends Context.Service()("@effe
 	* The stub is why the payload has to be served here rather than through the
 	* filesystem: `make` captures the filesystem at construction, so seeding
 	* `GITHUB_EVENT_PATH` through `overrides` would send the read to a noop
-	* filesystem and fail. Pass the payload as the second argument instead.
+	* filesystem and fail. Pass the payload as the second argument instead —
+	* or, for a suite that wants the real read path over a full filesystem,
+	* compose {@link ActionEnvironment.makeTest} with `@effected/memfs`'s
+	* seeded volume; the recipe is on that member.
 	*
 	* @example
 	* ```ts

package/DetachedProcess.js

@@ -1,4 +1,5 @@
 import { Effect, Schema } from "effect";
+import { HttpClient } from "effect/unstable/http";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { spawn } from "node:child_process";
 import { closeSync, openSync } from "node:fs";
@@ -79,6 +80,10 @@ var DetachedProcessError = class extends Schema.TaggedError()("DetachedProcessEr
 const ProcessId = Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isInteger(value) && value > 0 ? void 0 : "Expected a positive integer process id")), Schema.brand("ProcessId"));
 /** Whether a thrown value is a Node errno error with the given code. */
 const isErrno = (cause, code) => typeof cause === "object" && cause !== null && cause.code === code;
+/** See {@link DetachedProcess.makeTestOps}: an unstubbed member dies naming itself. */
+const unimplemented = (member) => {
+	throw new Error(`DetachedProcess.makeTestOps: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
+};
 /**
 * A long-lived child that outlives the phase that started it.
 *
@@ -111,7 +116,7 @@ const isErrno = (cause, code) => typeof cause === "object" && cause !== null &&
 *
 * @public
 */
-var DetachedProcess = class {
+var DetachedProcess = class DetachedProcess {
 	constructor() {}
 	/**
 	* Start a detached child with its output routed to a log file.
@@ -187,6 +192,34 @@ var DetachedProcess = class {
 		return yield* poll(attempts);
 	});
 	/**
+	* A readiness probe over HTTP: `true` when a `GET` answers 2xx.
+	*
+	* @remarks
+	* The probe {@link DetachedProcess.awaitReady} almost always wants: an HTTP
+	* `GET` at a port the child is still binding, where connection-refused *is*
+	* "not up yet". The consumers that hand-rolled the polling wrote exactly
+	* this probe around it, and each had to discover the same subtlety — the
+	* probe's error channel must stay empty, because `awaitReady` deliberately
+	* propagates probe failures, and a refused connection is not a failure of
+	* the probe.
+	*
+	* So this probe never fails: a refused connection, any other transport
+	* error and a non-2xx answer all collapse to `false`, leaving
+	* `awaitReady`'s own exhaustion as the only failure left. That is a
+	* deliberate opt-out of the propagate-probe-failures posture, and it is
+	* only sound because every failure an HTTP readiness check can see means
+	* the same thing here. The cost is the documented one: a *misconfigured*
+	* probe — a typo'd port, a wrong path — is indistinguishable from a child
+	* that never came up, and reports as `notReady` only after the full budget.
+	* A probe whose failures are meaningfully distinct should stay a
+	* hand-written effect with those failures in `E`.
+	*
+	* The request goes through core's `HttpClient` — `Action.run` provides it
+	* ambiently — rather than a bare `fetch`, per the package rule that
+	* everything that *can* go through a core contract does.
+	*/
+	static httpProbe = (url) => HttpClient.get(url).pipe(Effect.map((response) => response.status >= 200 && response.status < 300), Effect.catch(() => Effect.succeed(false)));
+	/**
 	* Signal a pid that came back across the phase boundary.
 	*
 	* @remarks
@@ -225,6 +258,36 @@ var DetachedProcess = class {
 			}
 		});
 	});
+	/**
+	* The real operations: the production default for a
+	* {@link DetachedProcessOps} parameter.
+	*
+	* @remarks
+	* The members ARE the statics — same references, not wrappers — so taking
+	* the seam costs a consumer nothing over calling the statics directly.
+	*/
+	static ops = {
+		spawn: DetachedProcess.spawn,
+		awaitReady: DetachedProcess.awaitReady,
+		reap: DetachedProcess.reap
+	};
+	/**
+	* A test double. Unstubbed members die rather than silently succeeding.
+	*
+	* @remarks
+	* The package's `makeTest` convention, on the module's one non-service.
+	* Every member a test does not stub dies loudly **naming the member**,
+	* because silence is worse here than anywhere else in the package: a spawn
+	* that silently "succeeds" fakes a child that does not exist, and a reap
+	* that silently succeeds asserts nothing about the one call whose
+	* production form signals a real pid.
+	*/
+	static makeTestOps = (overrides = {}) => ({
+		spawn: () => Effect.sync(() => unimplemented("spawn")),
+		awaitReady: () => Effect.sync(() => unimplemented("awaitReady")),
+		reap: () => Effect.sync(() => unimplemented("reap")),
+		...overrides
+	});
 };
 
 //#endregion

package/README.md

@@ -8,7 +8,7 @@
 The GitHub Actions runtime for [Effect](https://effect.website) v4: the services an action needs to talk to the runner it is executing inside. `Action.run` composes the runtime, runs your program, renders a failure as an `::error::` annotation and sets the exit code. `ActionInput` reads workflow inputs as typed `Config` values — string, boolean, integer, redacted secret, multiline list, `key=value` pairs, or a schema-decoded JSON blob — with one absence rule shared by every accessor: unset and `""` are both missing data. `ActionOutputs`, `ActionState`, `ActionLogger` and a fiber-local `ActionEnvironment` round out the runner surface, alongside `ActionCache`, `Artifact`, a metadata-carrying `BlobStore` (S3-compatible or the runner's own cache), `OidcTokenIssuer` and `ToolInstaller` for the heavier protocols. A reporting suite — `GitHubMarkdown`, `ManagedDocument`, `CheckState` and `CheckDocument` — covers the other direction: rendering what a run did onto a pull request comment, a check run or the job summary. No `@actions/*` dependency anywhere — the cache, artifact and tool-cache protocols are implemented directly against their HTTP APIs.
 
 > **Pre-release.** This package is part of the `@effected/*` kit, in pre-`1.0.0`
-> development against a single pinned Effect v4 beta. Packages graduate to
+> development against a single pinned Effect v4 prerelease. Packages graduate to
 > `1.0.0` once Effect `4.0.0` ships. To hold your own `effect` versions at
 > exactly the ones the kit is built and tested against, install
 > [`@effected/pnpm-plugin-effect`](https://www.npmjs.com/package/@effected/pnpm-plugin-effect).

package/Secret.js

@@ -14,10 +14,18 @@ import { Config, Effect, Redacted } from "effect";
 * it makes declassification **explicit, auditable, and impossible to do
 * quietly**.
 *
-* The invariant: **masking and declassification are the same call.** Every
-* member registers the value with the runner's log filter (`::add-mask::`)
-* *before* returning plaintext, so a secret cannot reach a child's environment
-* or a state file without the runner already knowing to redact it from logs.
+* The invariant: **masking is the floor, and declassification implies it.**
+* Every member that touches plaintext routes through
+* `ActionOutputs.setSecret`, registering the value with the runner's log
+* filter (`::add-mask::`) *before* any plaintext is returned — and the one
+* member that returns nothing, {@link Secret.mask}, registers and stops there
+* — so under the normal runner layer a secret cannot reach a child's
+* environment or a state file without the runner already knowing to redact it
+* from logs. Two scoped exceptions: {@link Secret.adopt} is a `Config` that
+* re-wraps an inherited plaintext without involving `ActionOutputs` at all —
+* the parent masked that value before the handoff — and under
+* `ActionOutputs.layerDetached` the registration is a documented no-op,
+* because a mask emitted inside a detached worker would itself be the leak.
 *
 * `Redacted.value` appears nowhere else in this package, and a test asserts
 * that structurally — a reintroduction elsewhere fails the suite rather than
@@ -97,12 +105,9 @@ var Secret = class Secret {
 	* dividing line is where the value goes, not what it is for: a value
 	* crossing into a **child's** environment is {@link Secret.forChildEnv},
 	* one written to `GITHUB_STATE` or `GITHUB_OUTPUT` is
-	* {@link Secret.forRunnerFile}, and one that stays in this process is this
-	* member. A third-party SDK that reads only the ambient environment is the
-	* hard case: this package never mutates `process.env` (reads are seeded
-	* once through `ActionEnvironment`), so if a consumer chooses that bridge,
-	* the mutation — and its restore discipline — lives in consumer code as
-	* the consumer's own tradeoff, not as a pattern this member recommends.
+	* {@link Secret.forRunnerFile}, one bound for the ambient environment is
+	* {@link Secret.forProcessEnv}, and one that stays in this process — held
+	* by this code, passed as an argument — is this member.
 	*
 	* It masks even though the value is never *written* anywhere, and that is
 	* deliberate rather than superstitious: a signing key that leaks does so
@@ -126,6 +131,70 @@ var Secret = class Secret {
 	*/
 	static forSigning = (secret) => Secret.forRunnerFile(secret);
 	/**
+	* Declassify one secret for the caller to bridge into `process.env`.
+	*
+	* @remarks
+	* The third-party-SDK case, under its own auditable name: an SDK that reads
+	* only the ambient environment cannot take the plaintext as an argument, so
+	* the value has to cross into `process.env` before the SDK looks. The
+	* mechanism is identical to {@link Secret.forRunnerFile} — mask first, then
+	* return plaintext — and the name is what earns the member: these names are
+	* the audit vocabulary, and a search for this one finds every place a
+	* secret enters the ambient environment without wading through signing
+	* keys and runner files.
+	*
+	* The ruling on who mutates is unchanged by the name existing: **this
+	* package never mutates `process.env`.** Reads are seeded once, at layer
+	* construction, through `ActionEnvironment`, and nothing here writes back
+	* — a write from inside the kit would be invisible to that seeding and to
+	* every consumer's assumptions about when the environment is stable. This
+	* member declassifies and masks; the assignment to `process.env`, and the
+	* restore discipline that unwinds it when the bridged scope ends, live in
+	* the **caller**, as the caller's own explicit tradeoff.
+	*
+	* The detached-worker inversion applies exactly as it does to
+	* {@link Secret.forSigning}: the mask only works where the runner parses
+	* stdout, so a worker that needs a bridged environment gets it from the
+	* parent — masked before the spawn via {@link Secret.forChildEnv} — rather
+	* than declassifying inside itself.
+	*/
+	static forProcessEnv = (secret) => Secret.forRunnerFile(secret);
+	/**
+	* Register a secret with the runner's log filter — and return nothing.
+	*
+	* @remarks
+	* Masking without declassification: the value is registered with
+	* `::add-mask::` through the same route as every other member, and the
+	* success channel is `void`, so a caller cannot come away holding the raw
+	* value at all. This is the register-only shape consumers previously spelled
+	* as a {@link Secret.forSigning} whose result was discarded — a spelling
+	* that lied to the audit vocabulary (a grep for signing found masking),
+	* contradicted forSigning's own once-at-construction guidance, and needed a
+	* comment to apologize for itself. The names are the vocabulary: a grep for
+	* this member finds every register-only site, and a grep for `forSigning`
+	* again finds only signing.
+	*
+	* The canonical caller masks every supplied credential input
+	* unconditionally, before the logic that decides which of them will
+	* actually be used — a secret the workflow supplied deserves redaction from
+	* the log whether or not resolution reaches for it.
+	*
+	* One value per call is the blessed shape; there is deliberately no
+	* set-taking form. {@link Secret.forChildEnv} takes a set because its
+	* mask-everything-before-returning-anything ordering is load-bearing; a
+	* plain mask returns nothing to order against, and a loop is fine.
+	*
+	* **In a detached worker, the mask this member emits is a leak.** The
+	* `::add-mask::` command only masks when the runner parses this process's
+	* stdout; a detached worker's stdout is a log file no runner parses, so
+	* there the command masks nothing *and* spells the plaintext into the log
+	* — a signing key shipped exactly that way for one round. A worker must
+	* compose `ActionOutputs.layerDetached`, under which the mask is a
+	* documented no-op; the masking itself is the **parent's** job, done
+	* before the spawn via {@link Secret.forChildEnv} under the real layer.
+	*/
+	static mask = (secret) => Effect.asVoid(Secret.forRunnerFile(secret));
+	/**
 	* The far side of a handoff: re-wrap a plaintext environment variable.
 	*
 	* @remarks

package/index.d.ts

@@ -194,6 +194,26 @@ declare class ActionEnvironment extends ActionEnvironment_base {
    * `undefined` means *not served*, so a suite cannot arrange `undefined` as
    * the payload itself. A webhook payload is always a JSON object; the case
    * does not arise, and reserving the sentinel keeps the argument optional.
+   *
+   * When a suite wants the **real read path** rather than a served value —
+   * exercising the actual `GITHUB_EVENT_PATH` read-and-parse — this member is
+   * the seam: it leaves `FileSystem` in `R` precisely so the suite chooses
+   * the filesystem. Compose it with `@effected/memfs`'s seeded in-memory
+   * volume rather than a hand-rolled stub: the volume honors the whole
+   * `FileSystem` contract, and an unseeded path fails typed `NotFound`
+   * instead of whatever a hand stub happens to answer.
+   *
+   * @example
+   * ```ts
+   * import { ActionEnvironment } from "@effected/github-actions";
+   * import { MemoryFileSystem } from "@effected/memfs";
+   * import { Layer } from "effect";
+   *
+   * const layer = Layer.effect(
+   *   ActionEnvironment,
+   *   ActionEnvironment.makeTest({ GITHUB_EVENT_PATH: "/event.json" }),
+   * ).pipe(Layer.provide(MemoryFileSystem.layerWith({ "/event.json": JSON.stringify({ action: "opened" }) })));
+   * ```
    */
   static readonly makeTest: (overrides?: Readonly<Record<string, string>>, payload?: unknown) => Effect.Effect<ActionEnvironmentShape, never, FileSystem.FileSystem>;
   /**
@@ -204,7 +224,10 @@ declare class ActionEnvironment extends ActionEnvironment_base {
    * The stub is why the payload has to be served here rather than through the
    * filesystem: `make` captures the filesystem at construction, so seeding
    * `GITHUB_EVENT_PATH` through `overrides` would send the read to a noop
-   * filesystem and fail. Pass the payload as the second argument instead.
+   * filesystem and fail. Pass the payload as the second argument instead —
+   * or, for a suite that wants the real read path over a full filesystem,
+   * compose {@link ActionEnvironment.makeTest} with `@effected/memfs`'s
+   * seeded volume; the recipe is on that member.
    *
    * @example
    * ```ts
@@ -2897,6 +2920,36 @@ interface ReadinessOptions {
   /** How many times to retry after the first probe. Defaults to 40. */
   readonly attempts?: number | undefined;
 }
+/**
+ * The module's operations as a value: the seam a consumer's tests inject.
+ *
+ * @remarks
+ * `DetachedProcess` is statics on a class, deliberately — there is no scope to
+ * hang a service off, because the whole point is a child that outlives the
+ * process holding any handle to it. The cost of that choice is that the
+ * package's `makeTest`/`layerTest` convention has nothing to attach to:
+ * statics cannot be swapped by a layer, and a test must never spawn a real
+ * child, poll a real port, or — above all — signal a real pid. This interface
+ * restores the seam as **parameter injection**: production code takes a
+ * `DetachedProcessOps`, defaulting to {@link DetachedProcess.ops}, and a test
+ * passes {@link DetachedProcess.makeTestOps} with only the members it means to
+ * observe.
+ *
+ * {@link DetachedProcess.httpProbe} is deliberately not a member. It is a
+ * probe *constructor* with no process side effect of its own; a test stubs
+ * `awaitReady` — the operation that runs the probe — or provides a stub
+ * `HttpClient`.
+ *
+ * @public
+ */
+interface DetachedProcessOps {
+  /** {@link DetachedProcess.spawn}. */
+  readonly spawn: (options: DetachedSpawnOptions) => Effect.Effect<ChildProcessSpawner.ProcessId, DetachedProcessError>;
+  /** {@link DetachedProcess.awaitReady}. */
+  readonly awaitReady: <E, R>(probe: Effect.Effect<boolean, E, R>, options?: ReadinessOptions) => Effect.Effect<void, E | DetachedProcessError, R>;
+  /** {@link DetachedProcess.reap}. */
+  readonly reap: (pid: number, signal?: NodeJS.Signals) => Effect.Effect<boolean, DetachedProcessError>;
+}
 /**
  * A long-lived child that outlives the phase that started it.
  *
@@ -2955,6 +3008,34 @@ declare class DetachedProcess {
    * timeout six seconds later with nothing to show for it.
    */
   static readonly awaitReady: <E, R>(probe: Effect.Effect<boolean, E, R>, options?: ReadinessOptions | undefined) => Effect.Effect<void, E | DetachedProcessError, R>;
+  /**
+   * A readiness probe over HTTP: `true` when a `GET` answers 2xx.
+   *
+   * @remarks
+   * The probe {@link DetachedProcess.awaitReady} almost always wants: an HTTP
+   * `GET` at a port the child is still binding, where connection-refused *is*
+   * "not up yet". The consumers that hand-rolled the polling wrote exactly
+   * this probe around it, and each had to discover the same subtlety — the
+   * probe's error channel must stay empty, because `awaitReady` deliberately
+   * propagates probe failures, and a refused connection is not a failure of
+   * the probe.
+   *
+   * So this probe never fails: a refused connection, any other transport
+   * error and a non-2xx answer all collapse to `false`, leaving
+   * `awaitReady`'s own exhaustion as the only failure left. That is a
+   * deliberate opt-out of the propagate-probe-failures posture, and it is
+   * only sound because every failure an HTTP readiness check can see means
+   * the same thing here. The cost is the documented one: a *misconfigured*
+   * probe — a typo'd port, a wrong path — is indistinguishable from a child
+   * that never came up, and reports as `notReady` only after the full budget.
+   * A probe whose failures are meaningfully distinct should stay a
+   * hand-written effect with those failures in `E`.
+   *
+   * The request goes through core's `HttpClient` — `Action.run` provides it
+   * ambiently — rather than a bare `fetch`, per the package rule that
+   * everything that *can* go through a core contract does.
+   */
+  static readonly httpProbe: (url: string | URL) => Effect.Effect<boolean, never, HttpClient.HttpClient>;
   /**
    * Signal a pid that came back across the phase boundary.
    *
@@ -2976,6 +3057,27 @@ declare class DetachedProcess {
    * finding its child already dead is the normal ending, not a failure.
    */
   static readonly reap: (pid: number, signal?: NodeJS.Signals | undefined) => Effect.Effect<boolean, DetachedProcessError, never>;
+  /**
+   * The real operations: the production default for a
+   * {@link DetachedProcessOps} parameter.
+   *
+   * @remarks
+   * The members ARE the statics — same references, not wrappers — so taking
+   * the seam costs a consumer nothing over calling the statics directly.
+   */
+  static readonly ops: DetachedProcessOps;
+  /**
+   * A test double. Unstubbed members die rather than silently succeeding.
+   *
+   * @remarks
+   * The package's `makeTest` convention, on the module's one non-service.
+   * Every member a test does not stub dies loudly **naming the member**,
+   * because silence is worse here than anywhere else in the package: a spawn
+   * that silently "succeeds" fakes a child that does not exist, and a reap
+   * that silently succeeds asserts nothing about the one call whose
+   * production form signals a real pid.
+   */
+  static readonly makeTestOps: (overrides?: Partial<DetachedProcessOps>) => DetachedProcessOps;
 }
 //#endregion
 //#region src/DryRun.d.ts
@@ -4134,10 +4236,18 @@ declare class PackageManagerInstaller extends PackageManagerInstaller_base {
  * it makes declassification **explicit, auditable, and impossible to do
  * quietly**.
  *
- * The invariant: **masking and declassification are the same call.** Every
- * member registers the value with the runner's log filter (`::add-mask::`)
- * *before* returning plaintext, so a secret cannot reach a child's environment
- * or a state file without the runner already knowing to redact it from logs.
+ * The invariant: **masking is the floor, and declassification implies it.**
+ * Every member that touches plaintext routes through
+ * `ActionOutputs.setSecret`, registering the value with the runner's log
+ * filter (`::add-mask::`) *before* any plaintext is returned — and the one
+ * member that returns nothing, {@link Secret.mask}, registers and stops there
+ * — so under the normal runner layer a secret cannot reach a child's
+ * environment or a state file without the runner already knowing to redact it
+ * from logs. Two scoped exceptions: {@link Secret.adopt} is a `Config` that
+ * re-wraps an inherited plaintext without involving `ActionOutputs` at all —
+ * the parent masked that value before the handoff — and under
+ * `ActionOutputs.layerDetached` the registration is a documented no-op,
+ * because a mask emitted inside a detached worker would itself be the leak.
  *
  * `Redacted.value` appears nowhere else in this package, and a test asserts
  * that structurally — a reintroduction elsewhere fails the suite rather than
@@ -4203,12 +4313,9 @@ declare class Secret {
    * dividing line is where the value goes, not what it is for: a value
    * crossing into a **child's** environment is {@link Secret.forChildEnv},
    * one written to `GITHUB_STATE` or `GITHUB_OUTPUT` is
-   * {@link Secret.forRunnerFile}, and one that stays in this process is this
-   * member. A third-party SDK that reads only the ambient environment is the
-   * hard case: this package never mutates `process.env` (reads are seeded
-   * once through `ActionEnvironment`), so if a consumer chooses that bridge,
-   * the mutation — and its restore discipline — lives in consumer code as
-   * the consumer's own tradeoff, not as a pattern this member recommends.
+   * {@link Secret.forRunnerFile}, one bound for the ambient environment is
+   * {@link Secret.forProcessEnv}, and one that stays in this process — held
+   * by this code, passed as an argument — is this member.
    *
    * It masks even though the value is never *written* anywhere, and that is
    * deliberate rather than superstitious: a signing key that leaks does so
@@ -4231,6 +4338,70 @@ declare class Secret {
    * {@link Secret.forChildEnv} under the real layer.
    */
   static readonly forSigning: (secret: Redacted.Redacted<string>) => Effect.Effect<string, never, ActionOutputs>;
+  /**
+   * Declassify one secret for the caller to bridge into `process.env`.
+   *
+   * @remarks
+   * The third-party-SDK case, under its own auditable name: an SDK that reads
+   * only the ambient environment cannot take the plaintext as an argument, so
+   * the value has to cross into `process.env` before the SDK looks. The
+   * mechanism is identical to {@link Secret.forRunnerFile} — mask first, then
+   * return plaintext — and the name is what earns the member: these names are
+   * the audit vocabulary, and a search for this one finds every place a
+   * secret enters the ambient environment without wading through signing
+   * keys and runner files.
+   *
+   * The ruling on who mutates is unchanged by the name existing: **this
+   * package never mutates `process.env`.** Reads are seeded once, at layer
+   * construction, through `ActionEnvironment`, and nothing here writes back
+   * — a write from inside the kit would be invisible to that seeding and to
+   * every consumer's assumptions about when the environment is stable. This
+   * member declassifies and masks; the assignment to `process.env`, and the
+   * restore discipline that unwinds it when the bridged scope ends, live in
+   * the **caller**, as the caller's own explicit tradeoff.
+   *
+   * The detached-worker inversion applies exactly as it does to
+   * {@link Secret.forSigning}: the mask only works where the runner parses
+   * stdout, so a worker that needs a bridged environment gets it from the
+   * parent — masked before the spawn via {@link Secret.forChildEnv} — rather
+   * than declassifying inside itself.
+   */
+  static readonly forProcessEnv: (secret: Redacted.Redacted<string>) => Effect.Effect<string, never, ActionOutputs>;
+  /**
+   * Register a secret with the runner's log filter — and return nothing.
+   *
+   * @remarks
+   * Masking without declassification: the value is registered with
+   * `::add-mask::` through the same route as every other member, and the
+   * success channel is `void`, so a caller cannot come away holding the raw
+   * value at all. This is the register-only shape consumers previously spelled
+   * as a {@link Secret.forSigning} whose result was discarded — a spelling
+   * that lied to the audit vocabulary (a grep for signing found masking),
+   * contradicted forSigning's own once-at-construction guidance, and needed a
+   * comment to apologize for itself. The names are the vocabulary: a grep for
+   * this member finds every register-only site, and a grep for `forSigning`
+   * again finds only signing.
+   *
+   * The canonical caller masks every supplied credential input
+   * unconditionally, before the logic that decides which of them will
+   * actually be used — a secret the workflow supplied deserves redaction from
+   * the log whether or not resolution reaches for it.
+   *
+   * One value per call is the blessed shape; there is deliberately no
+   * set-taking form. {@link Secret.forChildEnv} takes a set because its
+   * mask-everything-before-returning-anything ordering is load-bearing; a
+   * plain mask returns nothing to order against, and a loop is fine.
+   *
+   * **In a detached worker, the mask this member emits is a leak.** The
+   * `::add-mask::` command only masks when the runner parses this process's
+   * stdout; a detached worker's stdout is a log file no runner parses, so
+   * there the command masks nothing *and* spells the plaintext into the log
+   * — a signing key shipped exactly that way for one round. A worker must
+   * compose `ActionOutputs.layerDetached`, under which the mask is a
+   * documented no-op; the masking itself is the **parent's** job, done
+   * before the spawn via {@link Secret.forChildEnv} under the real layer.
+   */
+  static readonly mask: (secret: Redacted.Redacted<string>) => Effect.Effect<void, never, ActionOutputs>;
   /**
    * The far side of a handoff: re-wrap a plaintext environment variable.
    *
@@ -4242,5 +4413,5 @@ declare class Secret {
   static readonly adopt: (name: string) => Config.Config<Redacted.Redacted<string>>;
 }
 //#endregion
-export { Action, ActionCache, ActionCacheError, type ActionCacheShape, ActionEnvironment, ActionEnvironmentError, type ActionEnvironmentShape, ActionInput, ActionLogger, type ActionLoggerShape, ActionOutputError, ActionOutputs, type ActionOutputsShape, type ActionRunOptions, ActionRuntime, type ActionServices, ActionState, ActionStateError, type ActionStateShape, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, type AnnotationProperties, Artifact, ArtifactError, type ArtifactItem, type ArtifactRef, type ArtifactShape, type Blob, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, type BlobStoreShape, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, type CheckDocumentOptions, type CheckDocumentShape, type CheckDocumentSink, CheckReport, type CheckRunConclusion, type CheckRunProjection, CheckState, ChildEnv, type ClientLayerOptions, type DataBlobTransfer, DetachedProcess, DetachedProcessError, type DetachedSpawnOptions, type DownloadOptions, type DownloadResult, DryRun, type DryRunShape, type ExtractOptions, type FileBlobTransfer, GitHubCacheBlobStore, GitHubContext, type GitHubHeadingDepth, type GitHubListOptions, GitHubMarkdown, type GitHubRowSchema, type GitHubSchemaTable, type GitHubSchemaTableColumn, type GitHubSchemaTableColumns, type GitHubSchemaTableFormatRequiredKeys, type GitHubSchemaTableFormattedColumn, type GitHubSchemaTableOptions, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, type ManagedDocumentSource, OidcClaims, OidcTokenError, OidcTokenIssuer, type OidcTokenIssuerShape, type PackageManagerInstallOptions, PackageManagerInstaller, PackageManagerInstallerError, type PackageManagerInstallerShape, type PathPrependEnv, type PathPrependOptions, ProcessId, type ProvisionFileOptions, type ProvisionOptions, type ProvisionedFile, type ReadOptions, type ReadinessOptions, RunnerContext, type S3Config, Secret, type ToolDownloadOptions, ToolInstaller, ToolInstallerError, type ToolInstallerShape, type UploadOptions, type UploadResult, type WithBufferOptions, type WithStepOptions, WorkflowCommand, describeCause, projectCheckState };
+export { Action, ActionCache, ActionCacheError, type ActionCacheShape, ActionEnvironment, ActionEnvironmentError, type ActionEnvironmentShape, ActionInput, ActionLogger, type ActionLoggerShape, ActionOutputError, ActionOutputs, type ActionOutputsShape, type ActionRunOptions, ActionRuntime, type ActionServices, ActionState, ActionStateError, type ActionStateShape, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, type AnnotationProperties, Artifact, ArtifactError, type ArtifactItem, type ArtifactRef, type ArtifactShape, type Blob, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, type BlobStoreShape, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, type CheckDocumentOptions, type CheckDocumentShape, type CheckDocumentSink, CheckReport, type CheckRunConclusion, type CheckRunProjection, CheckState, ChildEnv, type ClientLayerOptions, type DataBlobTransfer, DetachedProcess, DetachedProcessError, type DetachedProcessOps, type DetachedSpawnOptions, type DownloadOptions, type DownloadResult, DryRun, type DryRunShape, type ExtractOptions, type FileBlobTransfer, GitHubCacheBlobStore, GitHubContext, type GitHubHeadingDepth, type GitHubListOptions, GitHubMarkdown, type GitHubRowSchema, type GitHubSchemaTable, type GitHubSchemaTableColumn, type GitHubSchemaTableColumns, type GitHubSchemaTableFormatRequiredKeys, type GitHubSchemaTableFormattedColumn, type GitHubSchemaTableOptions, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, type ManagedDocumentSource, OidcClaims, OidcTokenError, OidcTokenIssuer, type OidcTokenIssuerShape, type PackageManagerInstallOptions, PackageManagerInstaller, PackageManagerInstallerError, type PackageManagerInstallerShape, type PathPrependEnv, type PathPrependOptions, ProcessId, type ProvisionFileOptions, type ProvisionOptions, type ProvisionedFile, type ReadOptions, type ReadinessOptions, RunnerContext, type S3Config, Secret, type ToolDownloadOptions, ToolInstaller, ToolInstallerError, type ToolInstallerShape, type UploadOptions, type UploadResult, type WithBufferOptions, type WithStepOptions, WorkflowCommand, describeCause, projectCheckState };
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.6.1",
+	"version": "0.8.0",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,16 +39,16 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.4.0",
-		"@effected/glob": "^0.3.0",
-		"@effected/markdown": "^0.5.1",
-		"@effected/npm": "^0.9.0",
-		"@effected/sbom": "^0.3.0",
-		"@effected/templates": "^0.2.0"
+		"@effected/github": "^0.5.0",
+		"@effected/glob": "^0.4.0",
+		"@effected/markdown": "^0.6.0",
+		"@effected/npm": "^0.10.0",
+		"@effected/sbom": "^0.4.0",
+		"@effected/templates": "^0.3.0"
 	},
 	"peerDependencies": {
-		"@effect/platform-node": "4.0.0-beta.107",
-		"effect": "4.0.0-beta.107"
+		"@effect/platform-node": "4.0.0-rc.109",
+		"effect": "4.0.0-rc.109"
 	},
 	"engines": {
 		"node": ">=24.11.0"