@graphty/visual-review 0.0.1 → 0.1.0

package/trusted/cli.mjs

@@ -0,0 +1,334 @@
+#!/usr/bin/env node
+/**
+ * visual-review: capture Storybook stories, compare them with the baselines in git, and serve
+ * the page where the owner accepts or rejects the differences.
+ *
+ * Every command runs in a git checkout and reads its settings from visual-review.config.json at
+ * the checkout's root (see config.mjs and the README). `visual-review <command> --help` describes
+ * each command. Each command's modules are imported only when it runs, so `gate` needs nothing
+ * beyond Node's standard library and runs from a checkout without an install.
+ */
+
+import { readFile, readdir } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { parseArgs } from "node:util";
+
+const HELP = {
+    init: `usage: visual-review init [--force]
+
+Sets up visual review in the current git repository. Writes, at the repository's root:
+  visual-review.config.json           the projects to capture and the repository's settings
+  .gitattributes                      a rule storing the baseline PNGs in Git LFS
+  .gitignore                          an entry for the work directory (downloads, review state)
+  .github/workflows/<workflow>        captures every pull request and push, and gates pull requests
+  .github/workflows/visual-seed.yml   captures an older commit, to seed baselines from
+
+An existing file is kept, and a line already present is not added again. --force rewrites the
+workflows init wrote before (they start with "Generated by visual-review init"), to pick up a
+newer template; it never replaces the config or a workflow you wrote. Edit
+visual-review.config.json afterwards: it starts with one Storybook built by
+\`<package manager> run build-storybook\` into storybook-static/.`,
+
+    capture: `usage: visual-review capture --project <id> --out <dir> [options]
+
+Captures every story of one built Storybook and writes results.json and the PNGs to review into
+<dir>. Exits 0 whatever it finds; non-zero only when the tool itself fails, including a baseline
+that is an LFS pointer (run \`git lfs pull\`).
+
+  --project <id>          a project of visual-review.config.json
+  --out <dir>             where results.json and the PNGs go
+  --storybook <dir>       the built Storybook (default: the project's "storybook")
+  --baselines <dir>       the baselines (default: <baselines>/<id> from the config)
+  --workers <n>           browsers in parallel (default: the project's "workers")
+  --reference <dir>       the default branch's capture (from \`reference\`): a story with no
+                          baseline that looks as it does there is "unseeded", not "new"
+  --stories <prefix,...>  only the story ids starting with a prefix, for a quick local preview`,
+
+    reference: `usage: visual-review reference --project <id> --out <dir>
+
+Downloads the default branch's newest complete capture of the project with gh into <dir> and
+prints its directory, or prints nothing when there is none. CI runs it before \`capture\`.`,
+
+    compare: `usage: visual-review compare --baselines <dir> --captures <dir> [--threshold <0..1>] [--include-aa]
+
+Compares every PNG in the two directories by name and prints one JSON line per file that is not
+unchanged, then a summary. Exits 1 when anything differs. For local use.`,
+
+    serve: `usage: PORT=<n> visual-review serve [--master-run <id>] [--results <dir>]
+
+Serves the review page on $PORT, bound to $HOST (default localhost). With $HTTPS_CERT_PATH and
+$HTTPS_KEY_PATH set it serves HTTPS; without them, plain HTTP, and then only on a loopback HOST.
+Lists the open pull requests that have a run of the config's workflow and downloads their
+captures with gh. Refuses to start without git-lfs, because an accept would commit raw PNGs.
+The URL to open, with its session token, is printed at every start.
+
+  --master-run <id>  also list the default branch at that workflow run, for seeding baselines
+  --results <dir>    serve a local directory of <project>/results.json instead, offline, as a
+                     preview to look at: gh is never run, nothing can be decided, no Finish`,
+
+    gate: null, // gate.mjs's own usage
+
+    "install-browser": `usage: visual-review install-browser
+
+Installs the Chromium, and on Linux the system libraries, that this package's Playwright uses
+(\`playwright install --with-deps chromium\` of the same Playwright version capture imports).`,
+};
+
+const COMMANDS = {
+    init,
+    capture,
+    reference,
+    compare,
+    serve,
+    gate,
+    "install-browser": installBrowser,
+};
+
+const MAIN_HELP = `usage: visual-review <command> [options]
+
+Screenshots every story of your Storybooks in CI, compares them with baseline PNGs kept in git
+(Git LFS), and serves a local page where you accept or reject each difference.
+
+Commands:
+  init             set up a repository: config, .gitattributes, GitHub Actions workflows
+  capture          screenshot one project's built Storybook and compare with its baselines
+  reference        download the default branch's newest capture (CI, before capture)
+  gate             fail a pull request that holds changes nobody accepted (CI)
+  serve            the review page
+  compare          compare two directories of PNGs (local use)
+  install-browser  install the Chromium capture uses
+
+\`visual-review <command> --help\` describes each command. Documentation:
+https://graphty.app/docs/visual-review/`;
+
+/**
+ * The repository and its config, loaded only by the commands that need them.
+ * @returns {Promise<{ root: string, config: object }>} the checkout's root and its settings
+ */
+async function settings() {
+    const { loadConfig, repoRoot } = await import("./lib/config.mjs");
+    const root = repoRoot();
+    return { root, config: loadConfig(root) };
+}
+
+async function capture(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            project: { type: "string" },
+            out: { type: "string" },
+            storybook: { type: "string" },
+            baselines: { type: "string" },
+            workers: { type: "string" },
+            reference: { type: "string" },
+            stories: { type: "string" },
+        },
+    });
+    const { root, config } = await settings();
+    const project = Object.hasOwn(config.projects, values.project ?? "") ? config.projects[values.project] : undefined;
+    const workers = Number(values.workers ?? project?.workers);
+    if (!project || !values.out || !(Number.isInteger(workers) && workers > 0)) {
+        console.error(`${HELP.capture}\n\nprojects: ${Object.keys(config.projects).join(", ")}`);
+        return 2;
+    }
+    // Playwright is capture's only dependency, so it loads only for this command.
+    const { capture: run } = await import("../capture/capture.mjs");
+    await run({
+        project: values.project,
+        storybook: resolve(values.storybook ?? join(root, project.storybook)),
+        baselines: resolve(values.baselines ?? join(root, config.baselines, values.project)),
+        out: resolve(values.out),
+        workers,
+        waitFor: project.waitFor,
+        reference: values.reference ? resolve(values.reference) : null,
+        stories: values.stories ? values.stories.split(",").filter(Boolean) : null,
+    });
+    return 0;
+}
+
+async function reference(args) {
+    const { values } = parseArgs({ args, options: { project: { type: "string" }, out: { type: "string" } } });
+    if (!values.project || !values.out) {
+        console.error(HELP.reference);
+        return 2;
+    }
+    const { root, config } = await settings();
+    const { ghRunner, newestMasterCapture } = await import("./lib/github.mjs");
+    console.log((await newestMasterCapture(ghRunner(root), values.project, resolve(values.out), config)) ?? "");
+    return 0;
+}
+
+const LOOPBACK = new Set(["localhost", "127.0.0.1", "::1"]);
+
+async function serve(args) {
+    if (args.includes("--branch")) {
+        console.error("visual-review serve: --branch is gone: a --results preview is look only and has no Finish");
+        return 2;
+    }
+    const { values } = parseArgs({
+        args,
+        options: {
+            "master-run": { type: "string" },
+            results: { type: "string" },
+        },
+    });
+    const { PORT, HOST = "localhost", HTTPS_CERT_PATH, HTTPS_KEY_PATH } = process.env;
+    const masterRun = values["master-run"] === undefined ? undefined : Number(values["master-run"]);
+    const https = Boolean(HTTPS_CERT_PATH && HTTPS_KEY_PATH);
+    if (!PORT || (masterRun !== undefined && !Number.isInteger(masterRun))) {
+        console.error(HELP.serve);
+        return 2;
+    }
+    if (!https && !LOOPBACK.has(HOST)) {
+        console.error(
+            `visual-review serve: HOST=${HOST} is reachable from other machines, so the page needs HTTPS: ` +
+                "set HTTPS_CERT_PATH and HTTPS_KEY_PATH, or serve on localhost",
+        );
+        return 2;
+    }
+    const { root, config } = await settings();
+    const { readFileSync } = await import("node:fs");
+    const { lfsProblem } = await import("./lib/accept.mjs");
+    const { ghRunner } = await import("./lib/github.mjs");
+    const { createApp, sessionToken } = await import("./lib/serve.mjs");
+    const lfs = await lfsProblem(root);
+    if (lfs) {
+        console.error(`visual-review serve: ${lfs}`);
+        return 1;
+    }
+    const tmp = join(root, config.workDir);
+    const token = sessionToken(join(tmp, "state"));
+    const origin = `${https ? "https" : "http"}://${HOST.includes(":") ? `[${HOST}]` : HOST}:${PORT}`;
+    // Offline: a local results directory is a preview, so nothing is posted to GitHub.
+    const offline = async (ghArgs, input) => {
+        console.log(`gh (offline, not run): ${ghArgs.join(" ")}\n${input ?? ""}`);
+        return JSON.stringify({ html_url: null });
+    };
+    const certs = https ? `HTTPS_CERT_PATH=${HTTPS_CERT_PATH} HTTPS_KEY_PATH=${HTTPS_KEY_PATH} ` : "";
+    const app = createApp({
+        repo: root,
+        gh: values.results ? offline : ghRunner(root),
+        config,
+        tmp,
+        token,
+        origin,
+        masterRun,
+        results: values.results && resolve(values.results),
+        // What the owner types to run this server from their own shell, so Finish signs with
+        // their key rather than the environment of whoever started it (an agent, say).
+        startCommand:
+            `cd ${root} && PORT=${PORT} HOST=${HOST} ${certs}node ${process.argv[1]} serve ${args.join(" ")}`.trim(),
+    });
+    const server = https
+        ? (await import("node:https")).createServer(
+              { cert: readFileSync(HTTPS_CERT_PATH), key: readFileSync(HTTPS_KEY_PATH) },
+              app,
+          )
+        : (await import("node:http")).createServer(app);
+    await new Promise((done) => server.listen({ port: Number(PORT), host: HOST }, () => done(null)));
+    console.log(`visual-review: open ${origin}/#token=${token}`);
+    // Keep running until the process is stopped.
+    await new Promise(() => {});
+    return 0;
+}
+
+async function compare(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            baselines: { type: "string" },
+            captures: { type: "string" },
+            threshold: { type: "string" },
+            "include-aa": { type: "boolean", default: false },
+        },
+    });
+    const { classify, DEFAULT_THRESHOLD, readBaseline } = await import("./lib/compare.mjs");
+    const threshold = Number(values.threshold ?? DEFAULT_THRESHOLD);
+    if (!values.baselines || !values.captures || !(threshold >= 0 && threshold <= 1)) {
+        console.error(HELP.compare);
+        return 2;
+    }
+    const pngs = async (dir) => (await readdir(dir)).filter((f) => f.endsWith(".png"));
+    const read = (dir, file, present) =>
+        present.includes(file) ? (dir === values.baselines ? readBaseline : readFile)(join(dir, file)) : null;
+    const [baselines, captures] = await Promise.all([pngs(values.baselines), pngs(values.captures)]);
+    const counts = {};
+    for (const file of [...new Set([...baselines, ...captures])].sort()) {
+        const item = classify({
+            baseline: await read(values.baselines, file, baselines),
+            first: await read(values.captures, file, captures),
+            threshold,
+            includeAA: values["include-aa"],
+        });
+        counts[item.status] = (counts[item.status] ?? 0) + 1;
+        if (item.status !== "unchanged") {
+            console.log(JSON.stringify({ file, ...item }));
+        }
+    }
+    console.log(JSON.stringify({ summary: counts }));
+    return Object.keys(counts).some((status) => status !== "unchanged") ? 1 : 0;
+}
+
+async function gate(args) {
+    const { runGate } = await import("./gate.mjs");
+    return runGate(args);
+}
+
+async function init(args) {
+    const { values } = parseArgs({ args, options: { force: { type: "boolean", default: false } } });
+    const { repoRoot } = await import("./lib/config.mjs");
+    const { init: run } = await import("./lib/init.mjs");
+    const root = repoRoot();
+    for (const line of run(root, { force: values.force })) {
+        console.log(line);
+    }
+    return 0;
+}
+
+async function installBrowser() {
+    const { createRequire } = await import("node:module");
+    const { spawnSync } = await import("node:child_process");
+    const { dirname } = await import("node:path");
+    let pkg;
+    try {
+        pkg = createRequire(import.meta.url).resolve("playwright/package.json");
+    } catch {
+        console.error(
+            "visual-review: playwright is not installed; add it to your devDependencies (npm i -D playwright)",
+        );
+        return 1;
+    }
+    const cli = join(dirname(pkg), JSON.parse(await readFile(pkg, "utf8")).bin.playwright);
+    return spawnSync(process.execPath, [cli, "install", "--with-deps", "chromium"], { stdio: "inherit" }).status ?? 1;
+}
+
+const [name, ...rest] = process.argv.slice(2);
+if (name === undefined || name === "--help" || name === "-h" || name === "help") {
+    console.log(MAIN_HELP);
+    process.exit(name === undefined ? 2 : 0);
+}
+if (name === "--version" || name === "-v") {
+    console.log(JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8")).version);
+    process.exit(0);
+}
+const run = Object.hasOwn(COMMANDS, name) ? COMMANDS[name] : undefined;
+if (run === undefined) {
+    console.error(`visual-review: unknown command "${name}"\n\n${MAIN_HELP}`);
+    process.exit(2);
+}
+if (rest.includes("--help") || rest.includes("-h")) {
+    const text = HELP[name] ?? (await import("./gate.mjs")).GATE_USAGE;
+    console.log(text);
+    process.exit(0);
+}
+try {
+    process.exitCode = await run(rest);
+} catch (err) {
+    // A bad option, a missing config or a failed git call: say what, without a stack.
+    if (err?.code?.startsWith?.("ERR_PARSE_ARGS") || /visual-review\.config\.json|git repository/.test(err?.message)) {
+        console.error(`visual-review ${name}: ${err.message}`);
+        process.exitCode = 2;
+    } else {
+        throw err;
+    }
+}

package/trusted/gate.mjs

@@ -0,0 +1,272 @@
+#!/usr/bin/env node
+/**
+ * The pull request gate: fails while a project that has baselines on the base branch holds visual
+ * changes the owner has not reviewed.
+ *
+ * Seeding is per story, so a seeded project can hold stories with no baseline yet. Those that the
+ * pull request did not change are `unseeded` (capture compared them with master's newest capture)
+ * and pass; a story the pull request adds or changes is `new` and blocks until the owner accepts
+ * it there, which creates its first baseline.
+ *
+ * <dir> holds the downloaded `visual-<project>-<attempt>` artifacts of this CI run, every attempt
+ * of it. For each project only the highest attempt counts, so re-running failed jobs (which
+ * leaves the visual jobs' old attempt as the newest) can neither hide nor resurrect a capture.
+ * Which projects exist and are seeded is read from <ref> (the base branch tip, fetched by the
+ * caller), not from the pull request, and so is visual-review.config.json (where the baselines
+ * live), so neither deleting a project's baselines nor moving the baselines directory in the pull
+ * request turns the gate off. A seeded project with no results.json, or an incomplete one, fails: a capture that
+ * crashed has shown the owner nothing. An invalid results.json counts as missing.
+ *
+ * It also fails when a baseline PNG, or a settings file that excludes a story, differs from the
+ * base without a review record added in the pull request (<baselines>/reviews/*.json) naming
+ * that path and its new hash. Without that, committing the captured PNGs straight into
+ * the baselines directory would turn the capture check green with no review at all. Only a
+ * record's items[].path and items[].to are read, so this proves a record names the change, not
+ * that Finish wrote it or the owner pressed it (the README, "What the gate does and does not
+ * guarantee").
+ *
+ * Usage: visual-review gate --captures <dir> --base <ref> [--head <ref>], or node gate.mjs with
+ * the same options. Standard library only (results.mjs and config.mjs have no dependencies), so
+ * it runs from a checkout of this package without an install.
+ */
+
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "node:util";
+
+import { loadConfigAt, repoRoot } from "./lib/config.mjs";
+import { validateResults } from "./lib/results.mjs";
+
+const PASSING = new Set(["unchanged", "excluded", "unseeded"]);
+
+/**
+ * The newest attempt's results.json of every project in a directory of downloaded artifacts.
+ * @param {string} dir the download directory, one subdirectory per artifact
+ * @returns {Record<string, { attempt: number, results: object | null }>} by project
+ */
+export function newestResults(dir) {
+    /** @type {Record<string, { attempt: number, results: object | null }>} */
+    const out = {};
+    const names = existsSync(dir) ? readdirSync(dir) : [];
+    for (const name of names) {
+        const m = /^visual-(.+)-(\d+)$/.exec(name);
+        if (!m) {
+            continue;
+        }
+        const [, project, n] = m;
+        const attempt = Number(n);
+        if (out[project] && out[project].attempt > attempt) {
+            continue;
+        }
+        const file = join(dir, name, "results.json");
+        out[project] = { attempt, results: existsSync(file) ? JSON.parse(readFileSync(file, "utf8")) : null };
+    }
+    return out;
+}
+
+/**
+ * What blocks the pull request.
+ * @param {{ projects: string[], seeded: Set<string>, captures: Record<string, { attempt: number,
+ *     results: object | null }> }} input every captured project, those with baselines on the base
+ *     branch, and the newest capture of each
+ * @returns {string[]} one line per blocked project; empty when the gate passes
+ */
+export function gateProblems({ projects, seeded, captures }) {
+    const problems = [];
+    for (const p of projects) {
+        if (!seeded.has(p)) {
+            continue;
+        }
+        const r = captures[p]?.results;
+        if (!r) {
+            problems.push(`${p}: no capture results (the visual job failed or uploaded nothing); re-run it`);
+            continue;
+        }
+        const invalid = validateResults(r);
+        if (invalid.length > 0) {
+            problems.push(`${p}: results.json is invalid (${invalid[0]}); re-run the visual job`);
+            continue;
+        }
+        if (!r.complete) {
+            problems.push(`${p}: the capture did not finish (${r.items.length} of ${r.expected} items); re-run it`);
+            continue;
+        }
+        const open = r.items.map((i) => i.status).filter((s) => !PASSING.has(s));
+        if (open.length > 0) {
+            // No Object.groupBy: the gate runs on the runner's own Node, which may be 20.
+            const counts = new Map();
+            for (const s of open) {
+                counts.set(s, (counts.get(s) ?? 0) + 1);
+            }
+            problems.push(
+                `${p}: ${[...counts].map(([s, n]) => `${n} ${s}`).join(", ")} ` +
+                    "(not accepted; a rejected item needs a code change, not another review)",
+            );
+        }
+    }
+    return problems;
+}
+
+const gitOut = (cwd, args) => execFileSync("git", args, { cwd, maxBuffer: 1 << 28 });
+
+/**
+ * Baseline changes between two refs that no review record added between them accounts for.
+ * @param {string} base the base branch tip
+ * @param {string} head the pull request's checkout
+ * @param {string} [cwd] the repository
+ * @param {string} [baselines] the baselines directory
+ * @returns {string[]} one line per unaccounted change; empty when every change has a record
+ */
+export function unrecordedChanges(base, head, cwd = process.cwd(), baselines = "visual-baselines") {
+    const fields = gitOut(cwd, ["diff", "-z", "--no-renames", "--name-status", base, head, "--", `${baselines}/`])
+        .toString("utf8")
+        .split("\0");
+    const show = (path) => gitOut(cwd, ["show", `${head}:${path}`]);
+    const problems = [];
+    const records = [];
+    const changed = [];
+    for (let i = 0; i + 1 < fields.length; i += 2) {
+        const [status, path] = [fields[i], fields[i + 1]];
+        if (path.startsWith(`${baselines}/reviews/`)) {
+            if (status === "A") {
+                records.push(path);
+            } else {
+                problems.push(`${path}: review records are append-only, but this one was changed or deleted`);
+            }
+        } else if (path.endsWith(".png")) {
+            changed.push({ path, hash: status === "D" ? null : contentHash(show(path)) });
+        } else if (path.endsWith(".json") && status !== "D") {
+            // ponytail: only settings that exclude a story need a record. Any other settings edit,
+            // and deleting a settings file, passes: the capture it causes is itself reviewed.
+            const bytes = show(path);
+            if (parseOr(bytes)?.disableSnapshot === true) {
+                changed.push({ path, hash: sha256(bytes) });
+            }
+        }
+    }
+    const reviewed = new Set();
+    for (const path of records) {
+        const items = parseOr(show(path))?.items;
+        for (const item of Array.isArray(items) ? items : []) {
+            reviewed.add(`${item?.path}\0${item?.to ?? null}`);
+        }
+    }
+    const missing = changed.filter((c) => !reviewed.has(`${c.path}\0${c.hash}`)).map((c) => c.path);
+    for (const path of missing.slice(0, 20)) {
+        problems.push(`${path}: changed with no review record naming its new contents`);
+    }
+    if (missing.length > 20) {
+        problems.push(`... and ${missing.length - 20} more baseline files with no review record`);
+    }
+    return problems;
+}
+
+const sha256 = (bytes) => createHash("sha256").update(bytes).digest("hex");
+
+/**
+ * The SHA-256 of the file a blob stands for. Baseline PNGs are Git LFS pointers in git, and a
+ * pointer names its object's SHA-256 (`oid sha256:<hex>`), which is the PNG's own hash, so no
+ * LFS object is ever downloaded to check a record. Any other blob is hashed as it is.
+ * @param {Buffer} bytes the blob
+ * @returns {string} the hex SHA-256 of the content
+ */
+export function contentHash(bytes) {
+    const text = bytes.subarray(0, 200).toString("latin1");
+    const oid = /^version https:\/\/git-lfs\.github\.com\/spec\/v1\noid sha256:([0-9a-f]{64})\n/.exec(text);
+    return oid ? oid[1] : sha256(bytes);
+}
+
+function parseOr(bytes) {
+    try {
+        return JSON.parse(bytes.toString("utf8"));
+    } catch {
+        return null;
+    }
+}
+
+/**
+ * The projects with at least one baseline PNG at a git ref: the directories under the baselines
+ * directory at the base tip, so a pull request cannot drop a project from the gate by editing
+ * visual-review.config.json.
+ * @param {string} ref the base branch tip
+ * @param {string} [cwd] the repository
+ * @param {string} [baselines] the baselines directory
+ * @returns {Set<string>} the seeded ones
+ */
+export function seededAt(ref, cwd = process.cwd(), baselines = "visual-baselines") {
+    const files = execFileSync("git", ["ls-tree", "-r", "--name-only", ref, "--", `${baselines}/`], {
+        cwd,
+        encoding: "utf8",
+        maxBuffer: 1 << 28,
+    }).split("\n");
+    const prefix = `${baselines}/`;
+    return new Set(
+        files
+            .filter((f) => f.startsWith(prefix) && f.endsWith(".png"))
+            .map((f) => f.slice(prefix.length).split("/"))
+            .filter((parts) => parts.length > 1)
+            .map((parts) => parts[0]),
+    );
+}
+
+export const GATE_USAGE = `usage: visual-review gate --captures <dir> --base <ref> [--head <ref>]
+
+Fails (exit 1) while a pull request holds visual changes nobody accepted, or a baseline change
+with no review record. Run it in CI after the capture jobs, on the pull request's merge commit.
+
+  --captures <dir>  the downloaded visual-<project>-<attempt> artifacts of this run
+  --base <ref>      the base branch tip (HEAD^1 on a pull request's merge commit)
+  --head <ref>      the pull request's checkout (default HEAD)`;
+
+/**
+ * The gate as a command.
+ * @param {string[]} args the command line after "gate"
+ * @returns {number} the exit code
+ */
+export function runGate(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            captures: { type: "string" },
+            base: { type: "string" },
+            head: { type: "string", default: "HEAD" },
+            help: { type: "boolean", default: false },
+        },
+    });
+    if (values.help) {
+        console.log(GATE_USAGE);
+        return 0;
+    }
+    if (!values.captures || !values.base) {
+        console.error(GATE_USAGE);
+        return 2;
+    }
+    const root = repoRoot();
+    const { baselines } = loadConfigAt(values.base, root);
+    const seeded = seededAt(values.base, root, baselines);
+    const problems = gateProblems({
+        projects: [...seeded],
+        seeded,
+        captures: newestResults(values.captures),
+    });
+    for (const line of problems) {
+        console.log(`::error::visual changes not accepted -- ${line}`);
+    }
+    const unrecorded = unrecordedChanges(values.base, values.head, root, baselines);
+    for (const line of unrecorded) {
+        console.log(`::error::baseline without a review -- ${line}`);
+    }
+    if (problems.length + unrecorded.length > 0) {
+        console.log("Review them with `visual-review serve` (the @graphty/visual-review README).");
+        return 1;
+    }
+    console.log("No unaccepted visual changes, and every baseline change has a review record.");
+    return 0;
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+    process.exitCode = runGate(process.argv.slice(2));
+}