@homeflare/config 0.5.1 → 0.8.0

package/dist/repo-shape.js

@@ -0,0 +1,615 @@
+// @bun
+// src/repo-shape/shape.ts
+function except(exception) {
+  return {
+    file: exception.file,
+    reason: requireSentence("reason", exception.reason),
+    since: requireIsoDate(exception.since)
+  };
+}
+function extraJob(job) {
+  if (job.steps.length === 0) {
+    throw new Error(`repo-shape: extra job "${job.id}" has no steps`);
+  }
+  return {
+    bun: job.bun ?? true,
+    id: requireJobId(job.id),
+    name: requireNonEmpty("name", job.name),
+    needs: [...job.needs ?? []],
+    reason: requireSentence("reason", job.reason),
+    steps: [...job.steps]
+  };
+}
+var SENTENCE = 12;
+function requireNonEmpty(field, value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0)
+    throw new Error(`repo-shape: ${field} must not be blank`);
+  return trimmed;
+}
+function requireSentence(field, value) {
+  const trimmed = value.trim();
+  if (trimmed.length < SENTENCE) {
+    throw new Error(`repo-shape: ${field} must be a sentence, got ${JSON.stringify(value)}`);
+  }
+  return trimmed;
+}
+function requireIsoDate(value) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    throw new Error(`repo-shape: since must be YYYY-MM-DD, got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+function requireJobId(value) {
+  if (!/^[a-z][a-z0-9_-]*$/.test(value)) {
+    throw new Error(`repo-shape: job id must match /^[a-z][a-z0-9_-]*$/, got ${JSON.stringify(value)}`);
+  }
+  return value;
+}
+function runsOn(runner) {
+  return runner === "mini" ? "[self-hosted, homeflare-mini]" : "ubuntu-latest";
+}
+function isExcepted(shape, file) {
+  return (shape.exceptions ?? []).some((exception) => exception.file === file);
+}
+
+// src/repo-shape/yaml.ts
+var INDENT = "  ";
+function indent(depth) {
+  return INDENT.repeat(depth);
+}
+var PLAIN = /^[A-Za-z0-9_./][A-Za-z0-9_ ./@:+-]*$/;
+var YAML_KEYWORD = /^(y|Y|n|N|on|On|ON|no|No|NO|yes|Yes|YES|true|True|TRUE|false|False|FALSE|null|Null|NULL|~)$/;
+function scalar(value) {
+  if (typeof value === "number")
+    return String(value);
+  if (value === "")
+    return "''";
+  const plain = PLAIN.test(value) && !YAML_KEYWORD.test(value) && !value.includes(": ") && !value.includes(" #") && !/^\d.*:/.test(value) && value.trimEnd() === value;
+  return plain ? value : `'${value.replaceAll("'", "''")}'`;
+}
+function renderMapping(entries, depth) {
+  return Object.entries(entries).map(([key, value]) => `${indent(depth)}${key}: ${scalar(value)}`);
+}
+function renderRun(command, depth) {
+  const lines = command.replace(/\n+$/, "").split(`
+`);
+  if (lines.length === 1)
+    return [`${indent(depth)}run: ${scalar(lines[0] ?? "")}`];
+  return [`${indent(depth)}run: |`, ...lines.map((line) => `${indent(depth + 1)}${line}`)];
+}
+function renderStep(step, depth) {
+  const lines = [];
+  const body = step.uses === undefined ? renderRun(step.run ?? "", depth + 1) : [`${indent(depth + 1)}uses: ${step.uses}`];
+  const head = [];
+  if (step.name !== undefined)
+    head.push(`${indent(depth + 1)}name: ${scalar(step.name)}`);
+  if (step.if !== undefined)
+    head.push(`${indent(depth + 1)}if: ${scalar(step.if)}`);
+  const [first = "", ...rest] = [...head, ...body];
+  lines.push(`${indent(depth)}- ${first.trimStart()}`, ...rest);
+  if (step.with !== undefined && Object.keys(step.with).length > 0) {
+    lines.push(`${indent(depth + 1)}with:`, ...renderMapping(step.with, depth + 2));
+  }
+  if (step.env !== undefined && Object.keys(step.env).length > 0) {
+    lines.push(`${indent(depth + 1)}env:`, ...renderMapping(step.env, depth + 2));
+  }
+  return lines;
+}
+function renderSteps(steps, depth) {
+  return steps.flatMap((step) => renderStep(step, depth)).join(`
+`);
+}
+
+// src/repo-shape/ci.ts
+var BUN_VERSION = "1.4.0";
+var ACTIONLINT_VERSION = "1.7.12";
+var CHECKOUT = "actions/checkout@v7";
+var SETUP_BUN = "oven-sh/setup-bun@v2";
+function runnerNote(shape) {
+  if (shape.runner !== "mini") {
+    return "# \u26A0\uFE0F RUNS ON GitHub-HOSTED `ubuntu-latest`. Only a public repository should: hosted minutes\n#   are refused for this account's private repos (billing lock, 2026-09-22).\n";
+  }
+  return [
+    "# \u26A0\uFE0F RUNS ON THE MINI (`[self-hosted, homeflare-mini]`): GitHub-hosted runners are refused for",
+    "#   this account (billing lock, 2026-09-22), so every job here runs in a one-job Linux arm64",
+    "#   container started by homeflare-mini's src/ci-runner (docs/ci-runner.md there). Each action",
+    `#   below was checked for linux/arm64. The job image preloads bun ${BUN_VERSION} where setup-bun`,
+    "#   looks, gh, actionlint, gitleaks, typos and shfmt; no node on PATH.",
+    ""
+  ].join(`
+`);
+}
+var HEADER = `# Pull requests: is this code correct?
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Its input is this repository's \`repo-shape.ts\`. Change that, then:
+#        bun run repo-shape:refresh
+#    A hand edit is reverted by the next refresh and fails \`bun run check\` before that.
+#    A file this repository must own outright is declared as an \`except({...})\` with a
+#    reason, which stops the check from comparing it \u2014 see @homeflare/config/repo-shape.
+#
+# \u2605 SPLIT BY CONCERN, NOT ONE BIG JOB \u2014 AND NOT ONE JOB PER COMMAND EITHER: lanes that
+#   share a prologue are steps inside \`check\`, so the install is paid once.
+# \u26D4 EVERY ACTION IS FIRST-PARTY OR THE VENDOR'S OWN, PINNED TO A MAJOR TAG.
+`;
+var TRIGGER = `name: ci
+
+on:
+  # \u26D4 NO \`push: branches: [main]\`. Every commit reaches main through a pull request whose
+  #   \`ci\` had to be green \u2014 the branch ruleset requires it and carries no bypass actors \u2014
+  #   so a second run on the squash commit recomputed an answer it already had. Measured
+  #   2026-09-15..22 across the estate: 613 of 619 main-push runs had a head_sha identical
+  #   to the merge_commit_sha of an already-green PR. That duplication was ~41% of the Mac
+  #   mini's entire CI load.
+  # \u26A0\uFE0F WHAT THIS GIVES UP, SAID OUT LOUD: the ~4% of merges whose base DID move between the
+  #   PR run and the squash no longer get a post-merge re-test. That run gated nothing \u2014 it
+  #   reported after main already had the commit \u2014 and the next PR, which branches from the
+  #   merged main, is what actually catches a semantic conflict.
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-\${{ github.ref }}
+  cancel-in-progress: true
+`;
+var CHECK_NOTE = `  # \u2500\u2500 One job, one install \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 WAS 3 SEPARATE JOBS: lint and format, types, tests. They shared an identical
+  #   prologue \u2014 checkout, setup-bun, \`bun install --frozen-lockfile\` \u2014 and the install,
+  #   not the check, was the cost: measured on the mini 2026-09-22, install p50 51s /
+  #   p90 81s against 1-3s for the command the install existed to enable. 3 jobs meant 3
+  #   installs and 3 containers to compute one answer, and on a 3-slot pool that was one
+  #   pull request asking for every slot to answer a single question.
+  # \u26D4 ONE STEP: \`bun run check\`, THE REPOSITORY'S OWN GATE, NOT A COPY OF ITS LANES.
+  #   The house rule is that CI runs the same command a person runs, and a workflow that
+  #   re-lists \`lint\`, \`types\`, \`test\` is a second copy of that command which can quietly
+  #   check LESS than the local gate. Measured 2026-09-22: \`bun run check\` in homeflare-kit
+  #   is \`lint && types && build && test\`, and its tests/dist.test.ts SKIPS ITSELF when
+  #   dist/ is absent \u2014 so a workflow running lint/types/test without the build would drop
+  #   that test silently and still report green. homeflare-alerts' check runs
+  #   \`check:types\` and \`build:web\`; homeflare-subnet-calc's delegates to \`verify\`. All
+  #   fourteen repositories have a \`check\` script and every one is local-only \u2014 no network,
+  #   no deploy. Checked, not assumed.
+  # \u2605 THE SPLIT OF RESPONSIBILITY: this renderer owns the PLUMBING \u2014 triggers, permissions,
+  #   concurrency, runner, action versions, the aggregate gate \u2014 and the repository owns
+  #   WHAT ITS GATE RUNS, in package.json, where a change to it shows up in that
+  #   repository's own diff rather than in a workflow nobody reads.
+  # \u26A0\uFE0F THE TRADE, STATED: a red X says \`check\` rather than naming the lane. \`bun run check\`
+  #   short-circuits on the first failure and its output names the lane, which is the same
+  #   signal a person gets locally.`;
+var WORKFLOWS_NOTE = `  # \u2605 \`workflow lint\` STAYS ITS OWN JOB on purpose: it needs no \`bun install\` at all
+  #   (actionlint is preloaded on the mini's job image \u2014 measured 5s end to end), so
+  #   folding it into \`check\` would make a YAML-only change pay the install for nothing.`;
+var ACTIONLINT_NOTE = `      # \u26D4 THERE IS NO FIRST-PARTY actionlint ACTION, and the npm package by that name is
+      #   an unrelated wasm port with no \`bin\`. The vendor's own documented CI path is
+      #   \`download-actionlint.bash\` \u2014 but that script does NOT verify a checksum (read at
+      #   the v${ACTIONLINT_VERSION} tag, 2026-09-16: \`curl -L "$url" | tar xvz\`, no sha256sum anywhere).
+      #   rhysd's releases DO publish a \`_checksums.txt\` per version; this verifies against
+      #   that instead of trusting the tarball on receipt.
+      # \u26A0\uFE0F ARCH FROM THE RUNNER, NOT HARD-CODED: the mini's runners are arm64, and an amd64
+      #   binary fails with "exec format error" (the checksum file lists both).`;
+var INSTALL_ACTIONLINT = `set -euo pipefail
+version=${ACTIONLINT_VERSION}
+if command -v actionlint >/dev/null 2>&1 &&
+  [ "$(actionlint -version 2>/dev/null | sed -n 1p)" = "\${version}" ]; then
+  cp "$(command -v actionlint)" ./actionlint
+  exit 0
+fi
+case "$(uname -m)" in
+  x86_64) arch=amd64 ;;
+  aarch64 | arm64) arch=arm64 ;;
+  *) echo "unsupported architecture $(uname -m)" >&2; exit 1 ;;
+esac
+file="actionlint_\${version}_linux_\${arch}.tar.gz"
+base="https://github.com/rhysd/actionlint/releases/download/v\${version}"
+curl -sSfLO "\${base}/\${file}"
+curl -sSfLO "\${base}/actionlint_\${version}_checksums.txt"
+grep " \${file}\\$" "actionlint_\${version}_checksums.txt" | sha256sum -c -
+tar xzf "\${file}" actionlint`;
+var AGGREGATE_NOTE = `  # \u2500\u2500 The one check a branch rule can require \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 A single required check that depends on all of them. Without this, adding a job
+  #   means editing the branch ruleset too, and forgetting to means the new job is
+  #   advisory without anyone noticing.
+  # \u26D4 FAILS ON ANYTHING OTHER THAN success, INCLUDING skipped. A job result has exactly
+  #   four values: success, failure, cancelled, skipped. Checking only the first two lets
+  #   a skipped job \u2014 a bad \`if:\` condition, a misconfigured dependency, a runner picking
+  #   up nothing \u2014 report this aggregate green with a required job never having run.`;
+var VERIFY = `if [ "\${{ contains(needs.*.result, 'failure') }}" = "true" ] || \\
+   [ "\${{ contains(needs.*.result, 'cancelled') }}" = "true" ] || \\
+   [ "\${{ contains(needs.*.result, 'skipped') }}" = "true" ]; then
+  echo "one or more required jobs did not succeed: \${{ toJSON(needs.*.result) }}" >&2
+  exit 1
+fi`;
+function prologue() {
+  return renderSteps([
+    { uses: CHECKOUT },
+    { uses: SETUP_BUN, with: { "bun-version": BUN_VERSION } },
+    { run: "bun install --frozen-lockfile" }
+  ], 3);
+}
+function renderExtraJob(job, on) {
+  const needs = (job.needs ?? []).length === 0 ? "" : `    needs: [${(job.needs ?? []).join(", ")}]
+`;
+  const steps = job.bun === false ? renderSteps([{ uses: CHECKOUT }, ...job.steps], 3) : [prologue(), renderSteps(job.steps, 3)].join(`
+`);
+  return `  # \u2605 NOT PART OF THE STANDARD SHAPE \u2014 ${job.reason}
+  ${job.id}:
+    name: ${job.name}
+${needs}    runs-on: ${on}
+    steps:
+${steps}
+`;
+}
+function renderCi(shape) {
+  const on = runsOn(shape.runner);
+  const extras = shape.extraJobs ?? [];
+  const needs = ["check", "workflows", ...extras.map((job) => job.id)];
+  return `${HEADER}${runnerNote(shape)}${TRIGGER}
+jobs:
+${CHECK_NOTE}
+  check:
+    name: check
+    runs-on: ${on}
+    steps:
+${prologue()}
+${renderSteps([{ run: "bun run check" }], 3)}
+
+${WORKFLOWS_NOTE}
+  workflows:
+    name: workflow lint
+    runs-on: ${on}
+    steps:
+${renderSteps([{ uses: CHECKOUT }], 3)}
+${ACTIONLINT_NOTE}
+${renderSteps([{ name: "Install actionlint (checksum-verified)", run: INSTALL_ACTIONLINT }], 3)}
+${renderSteps([{ name: "Lint workflows", run: "./actionlint -color" }], 3)}
+
+${extras.map((job) => `${renderExtraJob(job, on)}
+`).join("")}${AGGREGATE_NOTE}
+  ci:
+    name: ci
+    if: always()
+    needs: [${needs.join(", ")}]
+    runs-on: ${on}
+    steps:
+${renderSteps([{ name: "Verify every job succeeded", run: VERIFY }], 3)}
+`;
+}
+// src/repo-shape/companions.ts
+var CHANGESET_SCHEMA = "4.0.1";
+function renderChangesetConfig(shape) {
+  const config = {
+    $schema: `https://unpkg.com/@changesets/config@${CHANGESET_SCHEMA}/schema.json`,
+    changelog: ["@changesets/changelog-github", { repo: `${shape.owner}/${shape.repository}` }],
+    commit: false,
+    fixed: [],
+    linked: [],
+    access: shape.publishes ? "public" : "restricted",
+    baseBranch: "main",
+    updateInternalDependencies: "patch",
+    ignore: [],
+    ...shape.publishes ? {} : { privatePackages: { version: true, tag: false } }
+  };
+  return `${JSON.stringify(config, undefined, 2)}
+`;
+}
+function renderActionlintConfig(shape) {
+  if (shape.runner !== "mini")
+    return;
+  return `# actionlint's list of self-hosted runner labels (its \`runner-label\` check).
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Refresh with \`bun run repo-shape:refresh\`.
+#
+# \u2605 DECLARED, NOT SUPPRESSED: the rule stays on, so a typo'd label (\`homeflare-mnii\`)
+#   still fails the \`workflow lint\` job rather than queueing a job no runner claims.
+#   \`homeflare-mini\` is the interim runner on the Mac mini (homeflare-mini's
+#   docs/ci-runner.md); setting this repository's shape to \`runner: 'github'\` removes
+#   this file with the \`runs-on\` that needed it.
+self-hosted-runner:
+  labels:
+    - homeflare-mini
+`;
+}
+function renderDependabot(shape) {
+  const bunDirs = shape.publishes ? ["/", "/packages/*"] : ["/"];
+  return `# Dependabot for ${shape.repository}.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Refresh with \`bun run repo-shape:refresh\`.
+#
+# \u26D4 THIS FILE LIVES AT .github/dependabot.yml, NOT IN .github/workflows/. Dependabot is a
+#   platform feature, not an Action \u2014 a config placed among the workflows is silently
+#   ignored, and the symptom is simply that no pull requests ever arrive. Measured
+#   2026-09-22: 13 of 14 HomeFlare repositories had no dependabot config at all, so their
+#   Actions and their toolchain went stale invisibly, which is exactly how nothing fails.
+#
+# \u2605 WHY GROUPED RATHER THAN ONE PR PER DEPENDENCY. The default opens a pull request per
+#   outdated package; that is a trickle nobody reviews properly. Each group below is a set
+#   that is either safe to take together or needs deciding together.
+version: 2
+
+updates:
+  # \u2500\u2500 The toolchain (bun.lock) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  - package-ecosystem: bun
+    directories:
+${bunDirs.map((dir) => `      - ${dir}`).join(`
+`)}
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'chore'
+      include: scope
+    labels: [dependencies]
+    groups:
+      # oxfmt and oxlint move together and only affect style. Minor and patch bumps are
+      # noise unless they fail CI, which is what CI is for.
+      lint-and-format:
+        patterns: ['oxfmt', 'oxlint']
+        update-types: [minor, patch]
+
+      # \u26A0\uFE0F MAJORS EXCLUDED DELIBERATELY. TypeScript majors change what typechecks;
+      #   changesets majors have renamed inputs and dropped compatibility (the action's v2
+      #   did both). These want reading, not merging on green.
+      build-tooling:
+        patterns: ['typescript', '@changesets/*', '@types/bun']
+        update-types: [minor, patch]
+
+  # \u2500\u2500 The workflows themselves \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+  # \u2605 Actions go stale invisibly: nothing fails, they just keep running old code. The
+  #   estate's first workflows pinned checkout@v5 (current: v7) and changesets/action@v1
+  #   (current: v2, with every input renamed) \u2014 measured 2026-09-15.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:00'
+      timezone: America/New_York
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: 'ci'
+    labels: [dependencies, github-actions]
+    groups:
+      actions:
+        patterns: ['*']
+        update-types: [minor, patch]
+`;
+}
+// src/repo-shape/security.ts
+var CRON = "41 6 * * 1";
+var HEADER2 = `# Secret scanning, on its own schedule and its own check.
+#
+# \uD83E\uDD16 RENDERED BY @homeflare/config \u2014 DO NOT EDIT THIS FILE BY HAND.
+#    Its input is this repository's \`repo-shape.ts\`; refresh with \`bun run repo-shape:refresh\`.
+#
+# \u2605 SEPARATE FROM ci.yml BY CONCERN. A secret scan answers a different question from "is
+#   this code correct", it runs on a schedule as well as on pull requests (a rule added
+#   tomorrow can find a secret committed today), and it needs full history, which the CI
+#   jobs deliberately do not fetch.
+`;
+var TRIGGER2 = `name: security
+
+on:
+  # \u26D4 NO \`push: branches: [main]\`, for the reason ci.yml gives: main only moves by
+  #   squashing a pull request this same workflow already scanned, so the post-merge scan
+  #   re-read commits it had just cleared. The weekly cron is what covers "a rule added
+  #   tomorrow finds a secret committed today" \u2014 and it is the one that fetches full history.
+  pull_request:
+  schedule:
+    - cron: '${CRON}'
+
+permissions:
+  contents: read
+  # \uD83D\uDD34 gitleaks-action lists pull-request commits through GitHub's API before scanning,
+  #   and posts inline annotations. Without this, \`pull_request\` runs fail 403 before
+  #   inspecting any code. Two of thirteen repositories were missing it (2026-09-22).
+  pull-requests: read
+
+# \u26D4 cancel-in-progress IS CONDITIONAL, NOT \`true\`. The scheduled run's ref is
+#   refs/heads/main; a plain \`true\` would let anything sharing that group kill the weekly
+#   full-history scan. Only pull-request runs are ever cancelled.
+concurrency:
+  group: security-\${{ github.ref }}
+  cancel-in-progress: \${{ github.event_name == 'pull_request' }}
+`;
+var FETCH_NOTE = `        with:
+          # \u26D4 FULL HISTORY. A shallow clone scans only the tip, which misses the case that
+          #   matters most: a secret added and then removed in a later commit. It is still
+          #   in the history, still fetchable, and still compromised.
+          fetch-depth: 0`;
+var GITLEAKS_NOTE = `      # \u26D4 v3, NOT v2. v2 declares \`runs: node20\`. GitHub removed that runtime from
+      #   its HOSTED runner images on 2026-09-16 (gitleaks/gitleaks-action's own v3.0.0
+      #   migration notes, verified 2026-09-17), so v2 fails on ubuntu-latest and still
+      #   runs on the mini's self-hosted runner. Moving to v3 drops a dependency on a
+      #   runtime the platform has already withdrawn, before any job moves back to a
+      #   hosted runner \u2014 it is not repairing a scan that is currently broken. v3
+      #   changes only the runtime to node24 \u2014 inputs, outputs and behaviour are unchanged.
+      # \u2605 arm64-SAFE ON THE MINI, verified rather than assumed: v3's src/gitleaks.js builds
+      #   its download URL from \`process.arch\`, so the runner asks for
+      #   gitleaks_<version>_linux_arm64.tar.gz, an asset its default release publishes
+      #   (both read 2026-09-22). Nothing here is hard-coded to x64.
+      # \u2605 No \`GITLEAKS_LICENSE\`: that env var is required only for GitHub Organization
+      #   accounts, and \`taslabs-net\` is a personal User account (2026-09-17,
+      #   \`gh api users/taslabs-net --jq .type\` -> \`User\`).`;
+function renderSecurity(shape) {
+  const on = runsOn(shape.runner);
+  const token = "${{ secrets.GITHUB_TOKEN }}";
+  const scheduled = shape.runner === "mini" ? `
+    # \u26D4 THE SCHEDULED RUN GOES TO THE MINI TOO: if the runner daemon is down this queues
+    #   rather than failing, so a missed weekly scan is silent. homeflare-mini's
+    #   \`ci-runner\` vmalert group is what notices that, not this workflow.` : "";
+  return `${HEADER2}${TRIGGER2}
+jobs:
+  secrets:
+    name: secret scan${scheduled}
+    runs-on: ${on}
+    steps:
+${renderSteps([{ uses: "actions/checkout@v7" }], 3)}
+${FETCH_NOTE}
+
+${GITLEAKS_NOTE}
+${renderSteps([{ uses: "gitleaks/gitleaks-action@v3", env: { GITHUB_TOKEN: token } }], 3)}
+`;
+}
+
+// src/repo-shape/render.ts
+function renderRepoShape(shape) {
+  const files = {
+    ".changeset/config.json": renderChangesetConfig(shape),
+    ".github/dependabot.yml": renderDependabot(shape),
+    ".github/workflows/ci.yml": renderCi(shape),
+    ".github/workflows/security.yml": renderSecurity(shape)
+  };
+  const actionlint = renderActionlintConfig(shape);
+  if (actionlint !== undefined)
+    files[".github/actionlint.yaml"] = actionlint;
+  return {
+    files,
+    policy: { checks: ["ci", "secret scan"], owner: shape.owner, repository: shape.repository }
+  };
+}
+var RENDERED_PATHS = [
+  ".changeset/config.json",
+  ".github/actionlint.yaml",
+  ".github/dependabot.yml",
+  ".github/workflows/ci.yml",
+  ".github/workflows/security.yml"
+];
+
+// src/repo-shape/drift.ts
+var REFRESH_COMMAND = "bun run repo-shape:refresh";
+function normalize(text) {
+  return text.replaceAll(`\r
+`, `
+`);
+}
+async function readIfPresent(path) {
+  const file = Bun.file(path);
+  return await file.exists() ? normalize(await file.text()) : undefined;
+}
+function staleExceptions(rendered, exceptions) {
+  return exceptions.filter((exception) => rendered.files[exception.file] === undefined).map((exception) => `${exception.file}: excepted (since ${exception.since}) but this shape renders no such file \u2014 drop the exception`);
+}
+function duplicateExceptions(exceptions) {
+  const seen = new Set;
+  const duplicated = new Set;
+  for (const exception of exceptions) {
+    if (seen.has(exception.file))
+      duplicated.add(exception.file);
+    seen.add(exception.file);
+  }
+  return [...duplicated].map((file) => `${file}: declared as an exception more than once \u2014 keep one, with one reason`);
+}
+async function driftInRepoShape(projectDir, shape) {
+  const rendered = renderRepoShape(shape);
+  const exceptions = shape.exceptions ?? [];
+  const excepted = new Map(exceptions.map((exception) => [exception.file, exception]));
+  const problems = [
+    ...duplicateExceptions(exceptions),
+    ...staleExceptions(rendered, exceptions)
+  ];
+  const drifted = [];
+  for (const [path, expected] of Object.entries(rendered.files)) {
+    if (excepted.has(path))
+      continue;
+    const actual = await readIfPresent(`${projectDir}/${path}`);
+    if (actual === undefined) {
+      problems.push(`${path}: missing \u2014 run \`${REFRESH_COMMAND}\``);
+      drifted.push(path);
+      continue;
+    }
+    if (actual !== normalize(expected)) {
+      drifted.push(path);
+      problems.push(`${path}: differs from what @homeflare/config renders for this shape. ` + `Run \`${REFRESH_COMMAND}\` to take the standard, ` + `or declare it with except({ file: '${path}', reason: '\u2026', since: '\u2026' }) in repo-shape.ts.`);
+    }
+  }
+  return { drifted, excepted: exceptions, problems };
+}
+function exceptionSummary(shape) {
+  return (shape.exceptions ?? []).map((exception) => `${exception.file}: not checked \u2014 ${exception.reason} (since ${exception.since})`);
+}
+// src/repo-shape/refresh.ts
+async function refreshRepoShape(projectDir, shape) {
+  const rendered = renderRepoShape(shape);
+  const written = [];
+  const unchanged = [];
+  const skipped = [];
+  for (const [path, contents] of Object.entries(rendered.files)) {
+    if (isExcepted(shape, path)) {
+      skipped.push(path);
+      continue;
+    }
+    const target = `${projectDir}/${path}`;
+    const file = Bun.file(target);
+    if (await file.exists() && await file.text() === contents) {
+      unchanged.push(path);
+      continue;
+    }
+    await Bun.write(target, contents);
+    written.push(path);
+  }
+  return { skipped, unchanged, written };
+}
+async function say(stream, lines) {
+  if (lines.length === 0)
+    return;
+  await Bun.write(stream, `${lines.join(`
+`)}
+`);
+}
+async function repoShapeCli(projectDir, shape, argv) {
+  if (argv.includes("--check")) {
+    const report = await driftInRepoShape(projectDir, shape);
+    await say(Bun.stdout, exceptionSummary(shape).map((note) => `\xB7 ${note}`));
+    if (report.problems.length === 0) {
+      const count = report.excepted.length;
+      await say(Bun.stdout, [
+        `repo shape: in step with @homeflare/config (${count} declared exception(s))`
+      ]);
+      return 0;
+    }
+    await say(Bun.stderr, [
+      ...report.problems.map((problem) => `\u2717 ${problem}`),
+      "",
+      `Run \`${REFRESH_COMMAND}\`, or declare the deviation with a reason.`
+    ]);
+    return 1;
+  }
+  const result = await refreshRepoShape(projectDir, shape);
+  await say(Bun.stdout, [
+    ...result.written.map((path) => `wrote    ${path}`),
+    ...result.unchanged.map((path) => `ok       ${path}`),
+    ...result.skipped.map((path) => `excepted ${path}`)
+  ]);
+  return 0;
+}
+export {
+  ACTIONLINT_VERSION,
+  BUN_VERSION,
+  REFRESH_COMMAND,
+  RENDERED_PATHS,
+  driftInRepoShape,
+  except,
+  exceptionSummary,
+  extraJob,
+  isExcepted,
+  refreshRepoShape,
+  renderActionlintConfig,
+  renderChangesetConfig,
+  renderCi,
+  renderDependabot,
+  renderRepoShape,
+  renderSecurity,
+  repoShapeCli,
+  runsOn
+};
+
+//# debugId=90AE28FCE975727B64756E2164756E21
+//# sourceMappingURL=repo-shape.js.map