@intentius/chant 0.6.0 → 0.8.0

package/src/audit/discover.ts

@@ -0,0 +1,329 @@
+/**
+ * Unified, detectTemplate-driven discovery (prototype for #391).
+ *
+ * Today `commands/audit.ts` ships six bespoke discoverers — `discoverManifests`,
+ * `discoverGcp`, `discoverCloudFormation`, `discoverArm`, `discoverDocker`,
+ * `discoverHelm` — each walking the tree and re-implementing a `looksLike*`
+ * content heuristic that mostly duplicates the lexicon plugin's own
+ * `detectTemplate(parsed)` (already used by `chant import`).
+ *
+ * This module collapses that into ONE walk plus a single content-detection
+ * pass that delegates to each plugin's `detectTemplate`. A new content-detected
+ * lexicon then needs only a `detectTemplate` and a precedence entry — no new
+ * walk, no new heuristic.
+ *
+ * It is deliberately a HYBRID, because some classification can't be expressed
+ * by content shape alone:
+ *   - CI (github/forgejo/gitlab) stays a PATH fast-path. github and forgejo
+ *     workflows are byte-for-byte the same shape (`on:` + `jobs:`), so only the
+ *     directory (`.github` vs `.forgejo`) disambiguates them.
+ *   - Dockerfiles are matched by FILENAME — they aren't YAML/JSON, so
+ *     `detectTemplate` (which only knows Compose's `services:`) can't see them.
+ *   - Helm charts are a directory BUNDLE keyed by `Chart.yaml`; the helm checks
+ *     read `output.files`, so the whole chart is one AuditInput.
+ *   - k8s `detectTemplate` matches any `apiVersion`+`kind`, including GCP Config
+ *     Connector (`cnrm.cloud.google.com`) resources, so gcp must be tried first.
+ *   - aws/azure checks `JSON.parse` their input, so YAML/templated content is
+ *     normalized to a JSON string here.
+ */
+
+import { readdirSync, readFileSync, statSync } from "fs";
+import { basename, join, relative } from "path";
+import { parseYAML } from "../yaml";
+import type { LexiconPlugin } from "../lexicon";
+import type { AuditInput, AuditLexicon } from "./core";
+
+/** Lexicons the auditor knows how to detect and run checks for. */
+export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm"] as const;
+
+/**
+ * Load the plugins used for detection. Each is loaded in isolation (no
+ * cross-lexicon conflict aggregation — detection only reads `detectTemplate`),
+ * and a lexicon that isn't installed is skipped rather than failing the audit.
+ * `init()` is intentionally not called: `detectTemplate` is a pure function of
+ * its input and needs no plugin setup.
+ */
+export async function loadAuditPlugins(names: readonly string[] = AUDIT_LEXICONS): Promise<LexiconPlugin[]> {
+  // Lazy import: a top-level `cli/plugins` import would pull the root barrel
+  // (index.ts -> lint/parser -> the TypeScript compiler) into anyone importing
+  // `classifyFiles`, crashing edge runtimes. Edge callers build detectors from
+  // static `detect` imports and never call this. See #408/#426.
+  const { loadPlugin } = await import("../cli/plugins");
+  const plugins: LexiconPlugin[] = [];
+  for (const name of names) {
+    try {
+      plugins.push(await loadPlugin(name));
+    } catch {
+      // lexicon package not installed — its files simply won't be detected
+    }
+  }
+  return plugins;
+}
+
+const WALK_SKIP = new Set(["node_modules", ".git", "dist"]);
+/** Dot-directories the walk descends into anyway (CI lives here). */
+const WALK_DOT_DIRS = new Set([".github", ".forgejo"]);
+const MAX_WALK_FILES = 1000;
+/** Skip absurdly large files before parsing — mirrors the fetch layer's caps. */
+const MAX_FILE_BYTES = 2 * 1024 * 1024;
+
+/** Recursively collect file paths under a root, skipping noise dirs. */
+function walkFiles(dir: string, out: string[]): void {
+  if (out.length >= MAX_WALK_FILES) return;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+    if (out.length >= MAX_WALK_FILES) return;
+    if (e.name.startsWith(".") && e.isDirectory() && !WALK_DOT_DIRS.has(e.name)) continue;
+    if (WALK_SKIP.has(e.name)) continue;
+    const full = join(dir, e.name);
+    if (e.isDirectory()) walkFiles(full, out);
+    else out.push(full);
+  }
+}
+
+function readSafe(full: string): string | undefined {
+  try {
+    if (statSync(full).size > MAX_FILE_BYTES) return undefined;
+    return readFileSync(full, "utf-8");
+  } catch {
+    return undefined;
+  }
+}
+
+function isYaml(name: string): boolean {
+  return name.endsWith(".yml") || name.endsWith(".yaml");
+}
+
+function isDockerfileName(name: string): boolean {
+  return name === "Dockerfile" || name.startsWith("Dockerfile.") || name.endsWith(".Dockerfile") || name.endsWith(".dockerfile");
+}
+
+/** Split a possibly multi-document YAML string into per-doc parsed objects. */
+function parseDocs(content: string): Record<string, unknown>[] {
+  const docs: Record<string, unknown>[] = [];
+  for (const raw of content.split(/\n---\n/)) {
+    const t = raw.trim();
+    if (!t) continue;
+    try {
+      const obj = parseYAML(t);
+      if (obj && typeof obj === "object") docs.push(obj);
+    } catch {
+      // a non-parseable doc just doesn't contribute a candidate
+    }
+  }
+  return docs;
+}
+
+/** Parse JSON or YAML content into a single object, or undefined. */
+function parseStructured(content: string): Record<string, unknown> | undefined {
+  try {
+    const j = JSON.parse(content);
+    if (j && typeof j === "object") return j as Record<string, unknown>;
+  } catch {
+    // not JSON — try YAML
+  }
+  try {
+    const y = parseYAML(content);
+    if (y && typeof y === "object") return y;
+  } catch {
+    // not YAML either
+  }
+  return undefined;
+}
+
+/**
+ * A content detector for one lexicon. `detect` delegates to the plugin's
+ * `detectTemplate`; the surrounding fields encode the bits `detectTemplate`
+ * can't: which files to even consider, in what precedence, and how to normalize
+ * the content the lexicon's checks ultimately read.
+ */
+interface ContentDetector {
+  lexicon: AuditLexicon;
+  /** Cheap filename gate before reading/parsing. */
+  accepts(name: string): boolean;
+  /**
+   * Decide whether this file belongs to the lexicon, by delegating to the
+   * plugin's detectTemplate. Returns the (possibly normalized) content to feed
+   * the checks, or null if it doesn't match.
+   */
+  detect(plugin: DetectPlugin, name: string, content: string): string | null;
+}
+
+/** Run a plugin's detectTemplate over each parsed doc; true if any matches. */
+function anyDoc(plugin: DetectPlugin, content: string): boolean {
+  return parseDocs(content).some((doc) => plugin.detectTemplate?.(doc) ?? false);
+}
+
+/**
+ * Precedence-ordered content detectors. Order matters: gcp before k8s (Config
+ * Connector resources are also valid k8s manifests).
+ */
+const CONTENT_DETECTORS: ContentDetector[] = [
+  {
+    // GCP Config Connector — must win over k8s for cnrm.cloud.google.com docs.
+    lexicon: "gcp",
+    accepts: isYaml,
+    detect: (plugin, _name, content) => (anyDoc(plugin, content) ? content : null),
+  },
+  {
+    lexicon: "k8s",
+    accepts: isYaml,
+    detect: (plugin, _name, content) => (anyDoc(plugin, content) ? content : null),
+  },
+  {
+    // CloudFormation — JSON, YAML, or `.template`; normalized to a JSON string
+    // because the aws checks JSON.parse their input.
+    lexicon: "aws",
+    accepts: (name) => /\.(json|ya?ml|template)$/i.test(name),
+    detect: (plugin, _name, content) => {
+      const parsed = parseStructured(content);
+      return parsed && plugin.detectTemplate?.(parsed) ? JSON.stringify(parsed) : null;
+    },
+  },
+  {
+    // Azure ARM — JSON only; azure's detectTemplate takes the raw string.
+    lexicon: "azure",
+    accepts: (name) => /\.json$/i.test(name),
+    detect: (plugin, _name, content) => {
+      if (!plugin.detectTemplate?.(content)) return null;
+      const parsed = parseStructured(content);
+      return parsed ? JSON.stringify(parsed) : null;
+    },
+  },
+  {
+    // Docker Compose (services:). Dockerfiles are handled separately by name.
+    lexicon: "docker",
+    accepts: isYaml,
+    detect: (plugin, _name, content) => {
+      const parsed = parseStructured(content);
+      return parsed && plugin.detectTemplate?.(parsed) ? content : null;
+    },
+  },
+];
+
+/** A repo file (relative POSIX path + content) — the unit both local and remote feed the classifier. */
+export interface RepoFile {
+  path: string;
+  content: string;
+}
+
+/**
+ * The minimal shape `classifyFiles` needs from a lexicon: its name and (for
+ * content-detected lexicons) its `detectTemplate`. Narrower than `LexiconPlugin`
+ * so an edge caller can build detectors from static `@…/detect` imports without
+ * loading the full plugin (which drags the TypeScript compiler — see #426).
+ */
+export interface DetectPlugin {
+  name: string;
+  detectTemplate?: (data: unknown) => boolean;
+}
+
+/** Which CI lexicon a path belongs to (by location — content can't disambiguate github vs forgejo). */
+function ciLexiconForPath(path: string): AuditLexicon | undefined {
+  if (/^\.github\/workflows\/[^/]+\.ya?ml$/.test(path)) return "github";
+  if (/^\.forgejo\/workflows\/[^/]+\.ya?ml$/.test(path)) return "forgejo";
+  if (path === ".gitlab-ci.yml") return "gitlab";
+  return undefined;
+}
+
+/**
+ * Whether a path is worth reading/fetching at all. Bounds the local walk and,
+ * crucially, the remote fetch (so we never pull a whole repo's contents).
+ */
+export function isCandidatePath(path: string): boolean {
+  const name = basename(path);
+  if (ciLexiconForPath(path)) return true;
+  if (isDockerfileName(name)) return true;
+  if (name === "Chart.yaml") return true;
+  return /\.(ya?ml|json|template)$/i.test(name);
+}
+
+/** Collect Helm charts as bundles from an in-memory file set; returns inputs + chart path-prefixes. */
+function classifyHelm(files: RepoFile[], plugin: DetectPlugin | undefined): { inputs: AuditInput[]; prefixes: string[] } {
+  const inputs: AuditInput[] = [];
+  const prefixes: string[] = [];
+  if (!plugin) return { inputs, prefixes };
+  const charts = files.filter((f) => f.path === "Chart.yaml" || f.path.endsWith("/Chart.yaml"));
+  for (const chartFile of charts) {
+    const dir = chartFile.path === "Chart.yaml" ? "" : chartFile.path.slice(0, -"/Chart.yaml".length);
+    const prefix = dir === "" ? "" : `${dir}/`;
+    const bundle: Record<string, string> = {};
+    for (const f of files) {
+      if (prefix !== "" && !f.path.startsWith(prefix)) continue;
+      bundle[prefix === "" ? f.path : f.path.slice(prefix.length)] = f.content;
+    }
+    const chart = bundle["Chart.yaml"];
+    if (chart === undefined) continue;
+    const parsed = parseStructured(chart);
+    if (!parsed || !plugin.detectTemplate?.(parsed)) continue;
+    inputs.push({ path: dir || ".", content: chart, lexicon: "helm", files: bundle });
+    prefixes.push(prefix);
+  }
+  return { inputs, prefixes };
+}
+
+/**
+ * Classify an in-memory set of repo files into per-lexicon audit inputs. Pure
+ * (no fs, no network) so the local walk and the remote tree-fetch share exactly
+ * one detection path. Each file maps to at most one lexicon: CI by path,
+ * Dockerfiles by name, Helm charts as a bundle, everything else by the
+ * precedence-ordered content detectors (delegating to each plugin's
+ * `detectTemplate`). Lexicons whose plugin isn't provided are skipped.
+ */
+export function classifyFiles(files: RepoFile[], plugins: DetectPlugin[]): AuditInput[] {
+  const byName = new Map(plugins.map((p) => [p.name, p]));
+
+  // Helm claims whole chart directories first; chart-internal files are excluded
+  // from the loose-file pass so templates aren't double-audited.
+  const helm = classifyHelm(files, byName.get("helm"));
+  const underChart = (p: string): boolean => helm.prefixes.some((pre) => (pre === "" ? true : p.startsWith(pre)));
+
+  const inputs: AuditInput[] = [...helm.inputs];
+  for (const { path, content } of files) {
+    if (underChart(path)) continue;
+    const name = basename(path);
+
+    const ci = ciLexiconForPath(path);
+    if (ci) {
+      if (byName.has(ci)) inputs.push({ path, content, lexicon: ci });
+      continue;
+    }
+    if (isDockerfileName(name)) {
+      if (byName.has("docker")) inputs.push({ path, content, lexicon: "docker" });
+      continue;
+    }
+    for (const det of CONTENT_DETECTORS) {
+      const plugin = byName.get(det.lexicon);
+      if (!plugin || !det.accepts(name)) continue;
+      const normalized = det.detect(plugin, name, content);
+      if (normalized !== null) {
+        inputs.push({ path, content: normalized, lexicon: det.lexicon });
+        break; // first detector in precedence wins — one lexicon per file
+      }
+    }
+  }
+  return inputs;
+}
+
+/**
+ * Local discovery: one filesystem walk, candidate-filtered, read into memory,
+ * then handed to the shared `classifyFiles`. Detection is skipped for any
+ * lexicon whose plugin isn't provided, so a caller can scope discovery.
+ */
+export function discoverByDetection(root: string, plugins: LexiconPlugin[]): AuditInput[] {
+  const all: string[] = [];
+  walkFiles(root, all);
+  const files: RepoFile[] = [];
+  for (const full of all) {
+    const path = relative(root, full);
+    if (!isCandidatePath(path)) continue;
+    const content = readSafe(full);
+    if (content !== undefined) files.push({ path, content });
+  }
+  return classifyFiles(files, plugins);
+}

package/src/audit/edge-init-safety.test.ts

@@ -0,0 +1,43 @@
+import { describe, test, expect } from "vitest";
+import { readdirSync, readFileSync, existsSync } from "fs";
+import { fileURLToPath } from "url";
+import { join } from "path";
+
+/**
+ * #428: the lexicon modules the hosted service imports on the edge — post-synth
+ * checks (+ their local helpers) and the `detect` modules — must not run Node-only
+ * APIs at module load. `createRequire(import.meta.url)` at module scope throws on
+ * Workers (import.meta.url is undefined), crashing the worker at startup. Anything
+ * that genuinely needs it must do so lazily, inside a function, behind a try.
+ */
+const lexiconsDir = fileURLToPath(new URL("../../../../lexicons", import.meta.url));
+
+function edgeImportedFiles(): string[] {
+  const out: string[] = [];
+  for (const lex of readdirSync(lexiconsDir)) {
+    const detect = join(lexiconsDir, lex, "src", "detect.ts");
+    if (existsSync(detect)) out.push(detect);
+    const ps = join(lexiconsDir, lex, "src", "lint", "post-synth");
+    if (existsSync(ps)) {
+      for (const f of readdirSync(ps)) {
+        if (f.endsWith(".ts") && !f.endsWith(".test.ts")) out.push(join(ps, f));
+      }
+    }
+  }
+  return out;
+}
+
+describe("edge-imported lexicon modules are init-safe", () => {
+  test("no module-scope createRequire(import.meta.url)", () => {
+    const offenders: string[] = [];
+    for (const file of edgeImportedFiles()) {
+      for (const line of readFileSync(file, "utf-8").split("\n")) {
+        // Module scope = no leading whitespace. Inside a function it's indented.
+        if (/^(const|let|var|\s*)?\S.*createRequire\(import\.meta\.url\)/.test(line) && !/^\s/.test(line)) {
+          offenders.push(`${file.replace(lexiconsDir, "lexicons")}: ${line.trim()}`);
+        }
+      }
+    }
+    expect(offenders, "move these into a function (lazy) — they crash edge bundles").toEqual([]);
+  });
+});

package/src/audit/fetch.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { fetchCiFiles, parseRepoUrl, resolveActionSha, resolveImageDigest, parseImageRef, FetchError } from "./fetch";
+import { fetchRepoFiles, parseRepoUrl, resolveActionSha, resolveImageDigest, parseImageRef, FetchError } from "./fetch";
 
 const b64 = (s: string) => Buffer.from(s, "utf-8").toString("base64");
 const CI_YAML = "name: CI\non:\n  push:\npermissions: write-all\njobs:\n  build:\n    runs-on: ubuntu-latest\n";
@@ -9,6 +9,7 @@ interface Route {
   make: () => Response;
 }
 
+/** Route-based fetch mock (used by the resolver tests). */
 function fakeFetch(routes: Route[]) {
   const calls: Array<{ url: string; init?: RequestInit }> = [];
   const impl = (async (url: string | URL | Request, init?: RequestInit) => {
@@ -21,16 +22,51 @@ function fakeFetch(routes: Route[]) {
   return { impl, calls };
 }
 
-const githubRoutes = (size = 100): Route[] => [
-  {
-    match: "/contents/.github/workflows/ci.yml",
-    make: () => new Response(JSON.stringify({ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", content: b64(CI_YAML), encoding: "base64" }), { status: 200 }),
-  },
-  {
-    match: "/contents/.github/workflows",
-    make: () => new Response(JSON.stringify([{ name: "ci.yml", path: ".github/workflows/ci.yml", type: "file", size }]), { status: 200 }),
-  },
-];
+/**
+ * A GitHub/Forgejo-shaped mock: repo-info default_branch, recursive git/trees,
+ * base64 contents. `sizes` overrides the reported blob size for cap tests.
+ */
+function gitTreeMock(files: Record<string, string>, sizes: Record<string, number> = {}) {
+  const calls: Array<{ url: string; init?: RequestInit }> = [];
+  const impl = (async (url: string | URL | Request, init?: RequestInit) => {
+    const u = String(url);
+    calls.push({ url: u, init });
+    if (u.includes("/git/trees/")) {
+      const tree = Object.keys(files).map((path) => ({ path, type: "blob", size: sizes[path] ?? files[path].length }));
+      return new Response(JSON.stringify({ tree }), { status: 200 });
+    }
+    const cm = u.match(/\/contents\/(.+?)\?/);
+    if (cm) {
+      const path = decodeURIComponent(cm[1]);
+      if (files[path] === undefined) return new Response("not found", { status: 404 });
+      return new Response(JSON.stringify({ path, type: "file", content: b64(files[path]), encoding: "base64" }), { status: 200 });
+    }
+    if (/\/repos\/[^/]+\/[^/]+(\?|$)/.test(u)) return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
+    return new Response("not found", { status: 404 });
+  }) as unknown as typeof fetch;
+  return { impl, calls };
+}
+
+/** A GitLab-shaped mock: project default_branch, paginated repository/tree, raw files. */
+function gitlabMock(files: Record<string, string>) {
+  const impl = (async (url: string | URL | Request) => {
+    const u = String(url);
+    if (u.includes("/repository/tree")) {
+      const page = Number(new URL(u).searchParams.get("page") ?? "1");
+      const all = Object.keys(files).map((path) => ({ path, type: "blob" }));
+      return new Response(JSON.stringify(page === 1 ? all : []), { status: 200 });
+    }
+    const rm = u.match(/\/repository\/files\/(.+?)\/raw\?/);
+    if (rm) {
+      const path = decodeURIComponent(rm[1]);
+      if (files[path] === undefined) return new Response("not found", { status: 404 });
+      return new Response(files[path], { status: 200 });
+    }
+    if (/\/projects\/[^/]+(\?|$)/.test(u)) return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
+    return new Response("not found", { status: 404 });
+  }) as unknown as typeof fetch;
+  return { impl };
+}
 
 describe("parseRepoUrl", () => {
   test("rejects non-https", () => {
@@ -47,68 +83,63 @@ describe("parseRepoUrl", () => {
   });
 });
 
-describe("fetchCiFiles", () => {
-  test("fetches and decodes github workflow files", async () => {
-    const { impl } = fakeFetch(githubRoutes());
-    const files = await fetchCiFiles("https://github.com/acme/widgets", { fetchImpl: impl });
-    expect(files).toHaveLength(1);
-    expect(files[0].path).toBe(".github/workflows/ci.yml");
-    expect(files[0].lexicon).toBe("github");
+describe("fetchRepoFiles", () => {
+  test("github: tree-walks and decodes candidate files", async () => {
+    const { impl } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML, "README.md": "# hi" });
+    const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl });
+    // README.md is not a candidate path; only the workflow is fetched.
+    expect(files.map((f) => f.path)).toEqual([".github/workflows/ci.yml"]);
     expect(files[0].content).toContain("permissions: write-all");
   });
 
   test("sends an auth token when provided", async () => {
-    const { impl, calls } = fakeFetch(githubRoutes());
-    await fetchCiFiles("https://github.com/acme/widgets", { fetchImpl: impl, token: "secret" });
+    const { impl, calls } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML });
+    await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl, token: "secret" });
     const auth = calls.map((c) => (c.init?.headers as Record<string, string>)?.Authorization);
     expect(auth).toContain("Bearer secret");
   });
 
-  test("skips a file over the per-file size cap", async () => {
-    const { impl } = fakeFetch(githubRoutes(10_000_000));
-    const files = await fetchCiFiles("https://github.com/acme/widgets", { fetchImpl: impl, maxBytesPerFile: 1024 });
+  test("skips a file over the per-file size cap (reported by the tree)", async () => {
+    const { impl } = gitTreeMock({ ".github/workflows/ci.yml": CI_YAML }, { ".github/workflows/ci.yml": 10_000_000 });
+    const files = await fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl, maxBytesPerFile: 1024 });
     expect(files).toHaveLength(0);
   });
 
-  test("refuses to follow a redirect", async () => {
-    const { impl } = fakeFetch([{ match: "/contents/", make: () => new Response(null, { status: 302 }) }]);
-    await expect(fetchCiFiles("https://github.com/acme/widgets", { fetchImpl: impl })).rejects.toThrow(/redirect/i);
+  test("throws when the total byte cap is exceeded", async () => {
+    const big = "x".repeat(2000);
+    const { impl } = gitTreeMock({ "a.yaml": big, "b.yaml": big });
+    await expect(fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl, maxTotalBytes: 3000 })).rejects.toThrow(/total size cap/i);
+  });
+
+  test("refuses to follow a redirect on the tree request", async () => {
+    const impl = (async (url: string | URL | Request) => {
+      const u = String(url);
+      if (u.includes("/git/trees/")) return new Response(null, { status: 302 });
+      return new Response(JSON.stringify({ default_branch: "main" }), { status: 200 });
+    }) as unknown as typeof fetch;
+    await expect(fetchRepoFiles("https://github.com/acme/widgets", { fetchImpl: impl })).rejects.toThrow(/redirect/i);
   });
 
   test("throws on a non-allowlisted host before any fetch", async () => {
-    await expect(fetchCiFiles("https://evil.example.com/o/r")).rejects.toThrow(/Host not allowed/);
+    await expect(fetchRepoFiles("https://evil.example.com/o/r")).rejects.toThrow(/Host not allowed/);
   });
 
-  test("returns the gitlab pipeline file", async () => {
-    const { impl } = fakeFetch([
-      { match: "/repository/files/", make: () => new Response("stages:\n  - build\n", { status: 200 }) },
-    ]);
-    const files = await fetchCiFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl });
-    expect(files).toHaveLength(1);
-    expect(files[0].path).toBe(".gitlab-ci.yml");
-    expect(files[0].lexicon).toBe("gitlab");
-  });
-
-  test("forgejo (codeberg) reads .forgejo/workflows", async () => {
-    const { impl } = fakeFetch([
-      {
-        match: "/contents/.forgejo/workflows/ci.yml",
-        make: () => new Response(JSON.stringify({ name: "ci.yml", path: ".forgejo/workflows/ci.yml", type: "file", content: b64(CI_YAML), encoding: "base64" }), { status: 200 }),
-      },
-      {
-        match: "/contents/.forgejo/workflows",
-        make: () => new Response(JSON.stringify([{ name: "ci.yml", path: ".forgejo/workflows/ci.yml", type: "file", size: 100 }]), { status: 200 }),
-      },
-    ]);
-    const files = await fetchCiFiles("https://codeberg.org/acme/widgets", { fetchImpl: impl });
-    expect(files).toHaveLength(1);
-    expect(files[0].lexicon).toBe("forgejo");
-    expect(files[0].path).toBe(".forgejo/workflows/ci.yml");
+  test("gitlab: paginated tree + raw file content", async () => {
+    const { impl } = gitlabMock({ ".gitlab-ci.yml": "stages:\n  - build\n" });
+    const files = await fetchRepoFiles("https://gitlab.com/acme/widgets", { fetchImpl: impl });
+    expect(files.map((f) => f.path)).toEqual([".gitlab-ci.yml"]);
+    expect(files[0].content).toContain("stages:");
+  });
+
+  test("forgejo (codeberg): gitea tree + contents", async () => {
+    const { impl } = gitTreeMock({ ".forgejo/workflows/ci.yml": CI_YAML });
+    const files = await fetchRepoFiles("https://codeberg.org/acme/widgets", { fetchImpl: impl });
+    expect(files.map((f) => f.path)).toEqual([".forgejo/workflows/ci.yml"]);
   });
 
-  test("a repo with no CI files returns []", async () => {
-    const { impl } = fakeFetch([]); // everything 404s
-    const files = await fetchCiFiles("https://github.com/acme/empty", { fetchImpl: impl });
+  test("an empty repo returns []", async () => {
+    const { impl } = gitTreeMock({});
+    const files = await fetchRepoFiles("https://github.com/acme/empty", { fetchImpl: impl });
     expect(files).toEqual([]);
   });
 });