@intentius/chant 0.124.32 → 0.124.34

package/src/workspace/checks/ci-workflow.test.ts

@@ -0,0 +1,150 @@
+/**
+ * WSP151, what a member under ci.workflow still lacks (#4168 step 6), and the
+ * reference page printed from CI_WORKFLOW_REQUIREMENTS.
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterAll, describe, expect, test } from "vitest";
+import { runDeclarationChecks } from "../checks";
+import { ciWorkflowTable, CI_WORKFLOW_FINDING_CODES, workflowOf } from "../ci-workflow";
+import { REASON_CODES } from "../reason-codes";
+
+const DOCS = fileURLToPath(new URL("../../../../../docs/src/content/docs/", import.meta.url));
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+function repo(files: Record<string, string>): string {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-ci-workflow-")));
+  scratch.push(root);
+  execFileSync("git", ["init", "-q"], { cwd: root });
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  }
+  return root;
+}
+
+const member = (extra: Record<string, unknown> = {}) => ({ name: "app", dir: "app", kind: "other", because: "the app", ...extra });
+const declaration = (extra: Record<string, unknown> = {}, members = [member()]) => JSON.stringify({ name: "acme", schema: 1, members, ...extra }, null, 2);
+const green = (extra: Record<string, unknown> = {}) => ({ branch: "main", phases: { check: ["check"], suites: ["suites"] }, require: ["check", "suites"], preMerge: ["check"], ...extra });
+
+const CONFIG = 'export default { lexicons: ["aws"], environments: ["staging", "prod"] };\n';
+const COMPONENT = 'import { gate, phase } from "@intentius/chant/components/component";\nexport const app = { name: "app", deploy: [phase("Apply", [gate("prod")])] };\n';
+const PIPELINE = [
+  "on: [pull_request, push]",
+  "jobs:",
+  "  plan:",
+  "    steps:",
+  "      - run: chant ci run plan --in-place --no-push --env prod --gate pr-apply --forge github",
+  "  record:",
+  "    steps:",
+  "      - run: chant ci run record --in-place --env prod --gate pr-apply --forge github",
+  "",
+].join("\n");
+const TICK = "jobs:\n  tick:\n    steps:\n      - run: npx --yes @intentius/chant@0.124.33 ci tick\n";
+const PUBLISH = "jobs:\n  publish:\n    steps:\n      - run: npx chant release publish \"$LABEL\"\n";
+
+/** A member under trunk-curated with everything the workflow needs. */
+const complete = (extra: Record<string, string> = {}) => ({
+  "chant.workspace.json": declaration({ ci: { workflow: "trunk-curated", green: green() } }),
+  "app/chant.config.ts": CONFIG,
+  "app/app.component.ts": COMPONENT,
+  ".github/workflows/chant-pr.yml": PIPELINE,
+  ".github/workflows/chant-ci-green.yml": TICK,
+  ".github/workflows/chant-release.yml": PUBLISH,
+  ...extra,
+});
+
+/** The WSP151 findings as [code, entity]. */
+const found = async (root: string) =>
+  (await runDeclarationChecks(root, (f) => f, { gather: false })).diagnostics.filter((d) => d.ruleId === "WSP151").map((d) => [d.code, d.entity ?? null]);
+
+describe("ci.workflow (WSP151)", () => {
+  test("a declaration that names no workflow gets no finding", async () => {
+    const root = repo({ "chant.workspace.json": declaration(), "app/chant.config.ts": "export default {};\n" });
+    expect(await found(root)).toEqual([]);
+  });
+
+  test("a workspace with everything trunk-curated needs passes", async () => {
+    expect(await found(repo(complete()))).toEqual([]);
+  });
+
+  test("an empty workspace under trunk-curated reports each missing piece", async () => {
+    const root = repo({ "chant.workspace.json": declaration({ ci: { workflow: "trunk-curated" } }), "app/chant.config.ts": "export default {};\n" });
+    expect(await found(root)).toEqual([
+      ["ci-workflow-no-environments", "app"],
+      ["ci-workflow-no-components", "app"],
+      ["ci-workflow-green-undeclared", null],
+      ["ci-workflow-pipeline-missing", null],
+      ["ci-workflow-publish-missing", null],
+    ]);
+  });
+
+  test("no preMerge phases, and a required phase that matches the apply job", async () => {
+    const root = repo(complete({ "chant.workspace.json": declaration({ ci: { workflow: "trunk-curated", green: green({ phases: { check: ["check"], deploy: ["*apply"] }, require: ["check", "deploy"], preMerge: [] }) } }) }));
+    expect(await found(root)).toEqual([
+      ["ci-workflow-no-pre-merge", null],
+      ["ci-workflow-apply-in-green", null],
+    ]);
+  });
+
+  test("a component with no gate", async () => {
+    const root = repo(complete({ "app/app.component.ts": 'export const app = { name: "app", deploy: [] };\n' }));
+    expect(await found(root)).toEqual([["ci-workflow-ungated-env", "app"]]);
+  });
+
+  test("trunk-curated with an apply job on merge differs", async () => {
+    const root = repo(complete({ ".github/workflows/chant-pr.yml": PIPELINE.replace("ci run record", "ci run apply") }));
+    expect(await found(root)).toEqual([["ci-workflow-pipeline-differs", null]]);
+  });
+
+  test("trunk-curated+apply-on-merge with only a record job differs, and with an apply job passes", async () => {
+    const decl = declaration({ ci: { workflow: "trunk-curated+apply-on-merge", green: green() } });
+    expect(await found(repo(complete({ "chant.workspace.json": decl })))).toEqual([["ci-workflow-pipeline-differs", null]]);
+    expect(await found(repo(complete({ "chant.workspace.json": decl, ".github/workflows/chant-pr.yml": PIPELINE.replace("ci run record", "ci run apply") })))).toEqual([]);
+  });
+
+  test("a member's own workflow wins, and a top-level workflow skips members that don't build with chant", async () => {
+    const root = repo({
+      ...complete(),
+      "chant.workspace.json": declaration({ ci: { green: green() } }, [member({ ci: { workflow: "trunk-curated" } }), member({ name: "docs", dir: "docs" })]),
+      "docs/README.md": "",
+    });
+    expect(await found(root)).toEqual([]);
+    const top = repo({ ...complete(), "docs/README.md": "", "chant.workspace.json": declaration({ ci: { workflow: "trunk-curated", green: green() } }, [member(), member({ name: "docs", dir: "docs" })]) });
+    expect(await found(top)).toEqual([]);
+  });
+
+  test("ci.green.preMerge must name declared phases", async () => {
+    const root = repo({ "chant.workspace.json": declaration({ ci: { green: green({ preMerge: ["lint"] }) } }) });
+    const report = await runDeclarationChecks(root, (f) => f, { gather: false });
+    expect(report.diagnostics.find((d) => d.ruleId === "WSP001")?.message).toMatch(/ci\.green\.preMerge names the phase "lint"/);
+  });
+});
+
+describe("workflowOf", () => {
+  test("the member's own wins over the top level's", () => {
+    const d = { ci: { green: null, workflow: "trunk-curated" as const, reportUrl: null } };
+    expect(workflowOf(d, { ciWorkflow: null })).toBe("trunk-curated");
+    expect(workflowOf(d, { ciWorkflow: "trunk-curated+apply-on-merge" })).toBe("trunk-curated+apply-on-merge");
+    expect(workflowOf({ ci: null }, null)).toBeNull();
+  });
+});
+
+describe("the ci.workflow codes and reference page", () => {
+  test("every code is a read-contract reason code", () => {
+    for (const code of CI_WORKFLOW_FINDING_CODES) expect(REASON_CODES, code).toContain(code);
+  });
+
+  test("the CI workflows page carries the table CI_WORKFLOW_REQUIREMENTS prints", () => {
+    const page = readFileSync(join(DOCS, "reference", "ci-workflows.mdx"), "utf-8");
+    const table = /^\| Code \| Requirement \|[^\n]*\n(?:\|[^\n]*\n)*/m.exec(page)?.[0].trimEnd();
+    expect(table, "regenerate the table under Requirements from ciWorkflowTable()").toBe(ciWorkflowTable());
+  });
+});

package/src/workspace/checks/ci-workflow.ts

@@ -0,0 +1,129 @@
+/**
+ * WSP151 (#4168 step 6): what a member under `ci.workflow` still lacks.
+ *
+ * A declaration that names no workflow gets no finding from this file. The
+ * requirements and their codes are {@link CI_WORKFLOW_REQUIREMENTS}
+ * (../ci-workflow.ts). Like the security checklists (./security.ts), the
+ * check reads files and never runs them: `chant.config.ts` for the
+ * environments (its literal `environments`, as `workspace status` reads it),
+ * `*.component.ts` for components and gates, and the forge pipeline files for
+ * the jobs. A generated file that differs from what its generator writes is
+ * WSP101 to WSP106's to report; this check asks only whether the jobs the
+ * workflow needs are there.
+ */
+
+import type { WorkspaceCheck, WorkspaceDiagnostic } from "../checks";
+import type { CiWorkflow, Member } from "../declaration";
+import { appliesOnMerge, STUB_MARKER, workflowOf, type CiWorkflowCode } from "../ci-workflow";
+import { matchesCheckRun } from "../ci-green";
+import { staticPromotionOrder } from "../promotion-order";
+import { joinPath } from "../tree";
+import { allPipelineFiles, commandLines, componentFiles, read } from "./security";
+
+export const WSP_CI_WORKFLOW = "WSP151";
+
+const memberDir = (dir: string) => (dir === "." ? "" : dir);
+
+const PLAN = /\bci\s+run\s+plan\b|\bcomponents\s+pr-plan\b/;
+const RECORD = /\bci\s+run\s+record\b|\bcomponents\s+pr-record\b/;
+const APPLY = /\bci\s+run\s+apply\b|\bcomponents\s+pr-apply\b/;
+const TICK = /\bci\s+tick\b/;
+const PUBLISH = /\brelease\s+publish\b/;
+
+/** The apply job names a required phase could match. */
+const APPLY_JOB_NAMES = ["apply", "pr-apply"];
+
+export const CI_WORKFLOW_CHECKS: readonly WorkspaceCheck[] = [
+  {
+    id: WSP_CI_WORKFLOW,
+    name: "ci-workflow",
+    description: "Under ci.workflow: ci.green with pre-merge phases and no apply job required, each member with a component, environments and a gate on each component, and pipeline files that plan, record (or apply under apply on merge), tick and publish.",
+    severity: "warning",
+    configurable: true,
+    check(ctx) {
+      const d = ctx.declaration;
+      const under = d.members
+        .map((m) => ({ member: m, workflow: workflowOf(d, m) }))
+        .filter((u): u is { member: Member; workflow: CiWorkflow } => u.workflow !== null)
+        // The top level's workflow covers the members that build with chant; a member that names one itself is held to it.
+        .filter((u) => u.member.ciWorkflow !== null || ctx.tree.stat(joinPath(memberDir(u.member.dir), "chant.config.ts")) === "file");
+      if (under.length === 0 && !d.ci?.workflow) return [];
+      const pointer = d.ci?.workflow ? "/ci/workflow" : `${under[0]!.member.pointer}/ci/workflow`;
+      const out: WorkspaceDiagnostic[] = [];
+      const finding = (code: CiWorkflowCode, message: string, at: { pointer?: string; entity?: string; treeFile?: string; line?: number } = {}): void => {
+        out.push({
+          checkId: this.id,
+          severity: this.severity,
+          code,
+          message: `${code}: ${message}`,
+          pointer: at.pointer ?? pointer,
+          ...(at.entity !== undefined ? { entity: at.entity } : {}),
+          ...(at.treeFile !== undefined ? { treeFile: at.treeFile, line: at.line ?? 1, column: 1 } : {}),
+        });
+      };
+
+      const green = d.ci?.green ?? null;
+      if (!green) {
+        finding("ci-workflow-green-undeclared", "the workspace follows a ci.workflow and declares no ci.green, so no commit gets a verdict and no release can be cut; run chant ci init or add a ci.green block");
+      } else {
+        if ((green.preMerge ?? []).length === 0) {
+          finding("ci-workflow-no-pre-merge", "ci.green.preMerge names no phase, so nothing says which checks run before the branch moves; name the quick ones", { pointer: green.pointer });
+        }
+        for (const name of green.require) {
+          const phase = green.phases.find((p) => p.name === name);
+          const hit = phase?.runs.find((pattern) => APPLY_JOB_NAMES.some((job) => matchesCheckRun(pattern, job)));
+          if (phase && hit) {
+            finding("ci-workflow-apply-in-green", `the required phase ${name} matches the apply job with ${JSON.stringify(hit)}, so an apply that waits for a green commit would wait on itself; drop the pattern`, { pointer: phase.pointer });
+          }
+        }
+      }
+
+      for (const { member } of under) {
+        const dir = memberDir(member.dir);
+        const components = componentFiles(ctx.tree, dir);
+        if (components.length === 0) {
+          finding("ci-workflow-no-components", `member ${member.name} declares no component, so nothing of it can be cut or promoted; chant ci init writes a stub`, { pointer: member.pointer, entity: member.name });
+        } else if (components.every((f) => (read(ctx.tree, f) ?? "").includes(STUB_MARKER))) {
+          finding("ci-workflow-no-components", `member ${member.name}'s only component is the stub chant ci init wrote (${components[0]}); say how it is built and deployed, then delete its ${STUB_MARKER} line`, { pointer: member.pointer, entity: member.name, treeFile: components[0] });
+        }
+        const configPath = joinPath(dir, "chant.config.ts");
+        const config = read(ctx.tree, configPath);
+        // A config whose environments aren't literals can't be read without running it; say nothing rather than guess.
+        const order = config === null ? [] : staticPromotionOrder(config);
+        if (order !== undefined && order.length === 0) {
+          finding("ci-workflow-no-environments", `member ${member.name}'s chant.config.ts declares no environments, so a release has nowhere to be promoted to`, { pointer: member.pointer, entity: member.name, ...(config !== null ? { treeFile: configPath } : {}) });
+        }
+        for (const file of components) {
+          const text = read(ctx.tree, file) ?? "";
+          if (/\bgate\s*\(|kind\s*:\s*["']gate["']/.test(text)) continue;
+          const last = order && order.length > 0 ? order[order.length - 1]!.name : "the last environment";
+          finding("ci-workflow-ungated-env", `${file} has no gate, so a promote to ${last} waits on no approval; add a gate() step`, { pointer: member.pointer, entity: member.name, treeFile: file });
+        }
+      }
+
+      const files = allPipelineFiles(ctx);
+      const has = (re: RegExp) => files.some((f) => f.lines.some((l) => re.test(l)));
+      const applyOnMerge = under.some((u) => appliesOnMerge(u.workflow)) || (d.ci?.workflow ? appliesOnMerge(d.ci.workflow) : false);
+      const missing = [
+        ...(has(PLAN) ? [] : ["a plan job (ci run plan)"]),
+        ...(has(RECORD) || has(APPLY) ? [] : [applyOnMerge ? "an apply job (ci run apply)" : "a record job (ci run record)"]),
+        ...(has(TICK) ? [] : ["chant ci tick"]),
+      ];
+      if (missing.length > 0) {
+        finding("ci-workflow-pipeline-missing", `no pipeline file runs ${missing.join(", ")}; generate them with chant build --components --generate <forge> --pr-loop and chant ci workflow`);
+      }
+      if (!applyOnMerge) {
+        for (const l of commandLines(ctx, APPLY)) {
+          finding("ci-workflow-pipeline-differs", `${l.path} applies on merge, and the workflow is trunk-curated, where a merge records the plan and deploys nothing; regenerate without --apply-on-merge, or set ci.workflow to trunk-curated+apply-on-merge`, { treeFile: l.path, line: l.line });
+        }
+      } else if (!has(APPLY) && has(RECORD)) {
+        const l = commandLines(ctx, RECORD)[0]!;
+        finding("ci-workflow-pipeline-differs", `${l.path} records on merge, and the workflow is trunk-curated+apply-on-merge; regenerate with --apply-on-merge`, { treeFile: l.path, line: l.line });
+      }
+      if (!has(PUBLISH)) {
+        finding("ci-workflow-publish-missing", "no pipeline file runs chant release publish, so a cut release is never published; generate one with chant release workflow");
+      }
+      return out;
+    },
+  },
+];

package/src/workspace/checks/security.test.ts

@@ -0,0 +1,138 @@
+/**
+ * The security group checklists, WSP161 to WSP165 (#4168 step 7).
+ */
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { runDeclarationChecks } from "../checks";
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+function repo(files: Record<string, string>): string {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-security-")));
+  scratch.push(root);
+  execFileSync("git", ["init", "-q"], { cwd: root });
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+  }
+  return root;
+}
+
+const member = (extra: Record<string, unknown> = {}) => ({ name: "app", dir: "app", kind: "other", because: "the app", ...extra });
+const declaration = (extra: Record<string, unknown> = {}, members = [member()]) => JSON.stringify({ name: "acme", schema: 1, members, ...extra }, null, 2);
+
+/** The security findings as [id, code, entity]. */
+const found = async (root: string) =>
+  (await runDeclarationChecks(root, (f) => f, { gather: false })).diagnostics.filter((d) => /^WSP16/.test(d.ruleId)).map((d) => [d.ruleId, d.code, d.entity ?? null]);
+
+describe("security groups (WSP161 to WSP165)", () => {
+  test("a workspace that opts into no group gets no security finding", async () => {
+    const root = repo({ "chant.workspace.json": declaration(), "app/chant.config.ts": "export default { release: { publish: [{ npm: {} , sbom: false }] } };" });
+    expect(await found(root)).toEqual([]);
+  });
+
+  test("verified-releases with nothing set reports the signers file and the release gate", async () => {
+    const root = repo({ "chant.workspace.json": declaration({ security: ["verified-releases"] }), "app/x": "" });
+    expect(await found(root)).toEqual([
+      ["WSP161", "security-signers-missing", null],
+      ["WSP161", "security-release-gate-missing", null],
+    ]);
+  });
+
+  test("verified-releases passes with signers and a release gate, and flags --allow-unsigned in a publish job", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["verified-releases"], identity: { gates: { release: { class: "person" } } } }),
+      ".chant/allowed_signers": "",
+      ".github/workflows/publish.yml": "jobs:\n  publish:\n    steps:\n      - run: npx chant release publish v1 --allow-unsigned\n",
+      "app/x": "",
+    });
+    expect(await found(root)).toEqual([["WSP161", "security-publish-allows-unsigned", null]]);
+  });
+
+  test("a member's group applies to that member only", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({}, [member({ security: ["supply-chain"] }), member({ name: "web", dir: "web" })]),
+      "app/chant.config.ts": "export default { release: { publish: [{ forge: {}, sbom: false }] } };",
+      "web/chant.config.ts": "export default { release: { publish: [{ forge: {}, sbom: false }] } };",
+    });
+    expect(await found(root)).toEqual([["WSP162", "security-sbom-disabled", "app"]]);
+  });
+
+  test("supply-chain reports an unsourced SBOM, missing component steps and a publish without provenance", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["supply-chain"] }),
+      "app/chant.config.ts": "export default { release: { publish: [{ forge: {} }] } };",
+      "app/src/api.component.ts": "export const api = component({ deploy: [shell({ cmd: 'x' })] });",
+      ".github/workflows/publish.yml": "      - run: chant release publish v1\n",
+    });
+    expect((await found(root)).map((f) => f[1]).sort()).toEqual(["security-component-no-sbom", "security-component-no-verify", "security-publish-no-provenance", "security-sbom-unsourced"]);
+  });
+
+  test("a Cargo.lock above the member is an SBOM source", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["supply-chain"] }),
+      "Cargo.lock": "version = 4\n",
+      "app/chant.config.ts": "export default { release: { publish: [{ forge: {} }] } };",
+    });
+    expect(await found(root)).toEqual([]);
+  });
+
+  test("who-ran-it reports signedSince, the runner key and an unsigned tick", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["who-ran-it"], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"] } } }),
+      ".github/workflows/chant-ci-green.yml": "        run: npx --yes @intentius/chant@1 ci tick\n",
+      "app/x": "",
+    });
+    expect((await found(root)).map((f) => f[1]).sort()).toEqual(["security-runner-untrusted", "security-signed-since-unset", "security-tick-no-key"]);
+  });
+
+  test("who-ran-it passes with signedSince, a trusted runner and a keyed tick", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["who-ran-it"], ci: { green: { branch: "main", phases: { test: ["test"] }, require: ["test"], signedSince: "abc1234" } } }),
+      ".chant/trust.json": JSON.stringify({ schema: 1, runners: [{ principal: "chant-runner:box", key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl", class: "runner" }] }),
+      ".github/workflows/chant-ci-green.yml": "        env:\n          CHANT_RUNNER_KEY: ${{ secrets.K }}\n        run: npx chant ci tick\n",
+      "app/x": "",
+    });
+    expect(await found(root)).toEqual([]);
+  });
+
+  test("review-rules reports --no-require-review, attribution and an unsigned gate", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["review-rules"] }),
+      ".github/workflows/pr.yml": "      - run: chant components pr-apply --base \"$BASE_SHA\" --env prod --gate deploy --forge github --no-require-review\n",
+      "app/x": "",
+    });
+    expect(await found(root)).toEqual([
+      ["WSP164", "security-review-not-required", null],
+      ["WSP164", "security-attribution-any", null],
+      ["WSP164", "security-gate-unsigned", null],
+    ]);
+  });
+
+  test("review-rules passes with identified attribution and the apply gate signed", async () => {
+    const root = repo({
+      "chant.workspace.json": declaration({ security: ["review-rules"], identity: { attribution: "identified", gates: { deploy: { class: "person" } } } }),
+      ".github/workflows/pr.yml": "      - run: chant components pr-apply --base \"$BASE_SHA\" --env prod --gate deploy --forge github\n",
+      "app/x": "",
+    });
+    expect(await found(root)).toEqual([]);
+  });
+
+  test("isolated-runners reports a missing runner key, then a runner without the runner role, then passes", async () => {
+    const files = { "chant.workspace.json": declaration({ security: ["isolated-runners"] }), "app/x": "" };
+    expect(await found(repo(files))).toEqual([["WSP165", "security-runner-start-no-key", null]]);
+    const runner = { principal: "chant-runner:box", key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl", class: "runner" };
+    expect(await found(repo({ ...files, ".chant/trust.json": JSON.stringify({ schema: 1, runners: [runner] }) }))).toEqual([["WSP165", "security-runner-start-no-role", null]]);
+    expect(await found(repo({ ...files, ".chant/trust.json": JSON.stringify({ schema: 1, runners: [runner], roles: { runner: ["chant-runner:box"] } }) }))).toEqual([]);
+  });
+
+  test("isolated-runners reports a trust.json that does not read", async () => {
+    expect(await found(repo({ "chant.workspace.json": declaration({ security: ["isolated-runners"] }), ".chant/trust.json": "{", "app/x": "" }))).toEqual([["WSP165", "security-trust-unreadable", null]]);
+  });
+});