@joshuafolkken/kit 1.1050.0 → 1.1094.0

package/scripts/security/security-audit.ts

@@ -137,7 +137,6 @@ const security_audit = {
 	meets_floor,
 	resolve_scanner,
 	run_scanner,
-	scanner_version,
 }
 
 export { security_audit }

package/scripts/security/security-updates-logic.ts

@@ -120,7 +120,6 @@ function format_security_updates_report(
 }
 
 const security_updates_logic = {
-	SETTING_LABEL,
 	enable_command,
 	classify_security_updates,
 	is_exposed,

package/scripts/sonar/sonar-hotspots-cli.ts

@@ -1,9 +1,5 @@
 #!/usr/bin/env tsx
-import { existsSync, readFileSync } from 'node:fs'
-import path from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { git_command } from '#scripts/git/git-command'
-import { error_text } from '#scripts/lib/error-message'
 import { managed_config_scope } from '#scripts/sync/managed-config-scope'
 import { z } from 'zod'
 import {
@@ -12,6 +8,7 @@ import {
 	type HotspotDisposition,
 	type HotspotFetch,
 } from './sonar-hotspots'
+import { sonar_project } from './sonar-project'
 
 // `josh sonar:hotspots <PR>` — fetch the SonarCloud hotspots on a pull request and print the Step B
 // disposition of each (joshuafolkken/kit#2182).
@@ -24,11 +21,7 @@ import {
 
 const ARGV_OFFSET = 2
 const USAGE = 'Usage: josh sonar:hotspots <PR>'
-const SONAR_HOST = 'https://sonarcloud.io'
 const HOTSPOTS_PATH = '/api/hotspots/search'
-const PROPERTIES_FILE = 'sonar-project.properties'
-const PROJECT_KEY_PREFIX = 'sonar.projectKey='
-const FETCH_TIMEOUT_MS = 10_000
 const FAILURE_EXIT_CODE = 1
 const UNKNOWN_LINE = '?'
 
@@ -44,34 +37,17 @@ const hotspot_schema = z.looseObject({
 })
 const response_schema = z.looseObject({ hotspots: z.array(hotspot_schema).optional() })
 
-function read_project_key(root: string): string | undefined {
-	const file = path.join(root, PROPERTIES_FILE)
-	if (!existsSync(file)) return undefined
-
-	const line = readFileSync(file, 'utf8')
-		.split('\n')
-		.find((entry) => entry.startsWith(PROJECT_KEY_PREFIX))
-
-	return line?.slice(PROJECT_KEY_PREFIX.length).trim()
-}
-
 function hotspots_url(project_key: string, pull_request: string): string {
-	const query = new URLSearchParams({ projectKey: project_key, pullRequest: pull_request })
-
-	return `${SONAR_HOST}${HOTSPOTS_PATH}?${query.toString()}`
+	return sonar_project.api_url(HOTSPOTS_PATH, {
+		projectKey: project_key,
+		pullRequest: pull_request,
+	})
 }
 
 async function fetch_hotspots(url: string): Promise<HotspotFetch> {
-	try {
-		const response = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) })
-		if (!response.ok) return { error: `HTTP ${String(response.status)}` }
-
-		const parsed = response_schema.parse(await response.json())
+	const read = await sonar_project.fetch_json(url, response_schema)
 
-		return { hotspots: parsed.hotspots ?? [] }
-	} catch (error) {
-		return { error: error_text.message_of(error) }
-	}
+	return 'error' in read ? read : { hotspots: read.data.hotspots ?? [] }
 }
 
 function is_managed(component: string): boolean {
@@ -108,23 +84,10 @@ async function fetch_and_print(project_key: string, pull_request: string): Promi
 }
 
 async function run(argv: ReadonlyArray<string>): Promise<number> {
-	const [pull_request] = argv
-
-	if (pull_request === undefined || pull_request.startsWith('-')) {
-		console.error(USAGE)
-
-		return FAILURE_EXIT_CODE
-	}
-
-	const project_key = read_project_key(await git_command.repository_root())
-
-	if (project_key === undefined) {
-		console.error(`no ${PROJECT_KEY_PREFIX} found in ${PROPERTIES_FILE}`)
-
-		return FAILURE_EXIT_CODE
-	}
+	const target = await sonar_project.resolve_target(argv, USAGE)
+	if (target === undefined) return FAILURE_EXIT_CODE
 
-	await fetch_and_print(project_key, pull_request)
+	await fetch_and_print(target.project_key, target.pull_request)
 
 	return 0
 }
@@ -136,12 +99,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 const sonar_hotspots_cli = {
 	fetch_hotspots,
 	format_hotspot,
-	hotspots_url,
-	is_managed,
-	main,
 	print_disposition,
-	read_project_key,
-	run,
 	USAGE,
 }
 

package/scripts/sonar/sonar-hotspots.ts

@@ -95,7 +95,6 @@ const sonar_hotspots = {
 	classify_fetch,
 	classify_hotspot,
 	component_path,
-	HOTSPOT_BRANCHES,
 	UNREADABLE,
 }
 

package/scripts/sonar/sonar-new-code-cli.ts

@@ -0,0 +1,150 @@
+#!/usr/bin/env tsx
+import { fileURLToPath } from 'node:url'
+import { z } from 'zod'
+import {
+	CLEAN,
+	FINDINGS,
+	sonar_new_code,
+	UNREADABLE,
+	type NewCodeFetch,
+	type NewCodeIssue,
+	type NewCodeReading,
+} from './sonar-new-code'
+import { sonar_project } from './sonar-project'
+
+// `josh sonar:new-code <PR>` — fail when a pull request adds any new SonarCloud issue or duplicated
+// block (joshuafolkken/kit#3045).
+//
+// `sonar-qube.yml` runs it after the scan on every pull request, so the `SonarQube` check turns red on
+// a single finding instead of only when the Quality Gate's ratios tip over. The verdict lives in
+// `sonar-new-code.ts`; this file is the I/O around it: two SonarCloud API reads, one line per issue,
+// and the verdict line. A read that fails is `unreadable` and fails the check too, so an outage never
+// passes a pull request as clean.
+
+const ARGV_OFFSET = 2
+const USAGE = 'Usage: josh sonar:new-code <PR>'
+const ISSUES_PATH = '/api/issues/search'
+const MEASURES_PATH = '/api/measures/component'
+const DUPLICATED_BLOCKS_METRIC = 'new_duplicated_blocks'
+// The most issues one page carries; the verdict reads the API's own total, so a longer list only
+// shortens what is printed.
+const ISSUE_PAGE_SIZE = '100'
+const FAILURE_EXIT_CODE = 1
+const UNKNOWN = '?'
+
+// `looseObject` so a field SonarCloud adds later does not fail the parse; only the fields the report
+// prints are declared.
+const issue_schema = z.looseObject({
+	rule: z.string(),
+	severity: z.string().optional(),
+	type: z.string().optional(),
+	component: z.string(),
+	line: z.number().optional(),
+	message: z.string(),
+})
+const issues_schema = z.looseObject({ total: z.number(), issues: z.array(issue_schema) })
+const period_schema = z.looseObject({ value: z.string().optional() })
+const measure_schema = z.looseObject({
+	metric: z.string(),
+	value: z.string().optional(),
+	periods: z.array(period_schema).optional(),
+})
+const measures_schema = z.looseObject({
+	component: z.looseObject({ measures: z.array(measure_schema) }),
+})
+
+function issues_url(project_key: string, pull_request: string): string {
+	return sonar_project.api_url(ISSUES_PATH, {
+		componentKeys: project_key,
+		pullRequest: pull_request,
+		resolved: 'false',
+		ps: ISSUE_PAGE_SIZE,
+	})
+}
+
+function measures_url(project_key: string, pull_request: string): string {
+	return sonar_project.api_url(MEASURES_PATH, {
+		component: project_key,
+		pullRequest: pull_request,
+		metricKeys: DUPLICATED_BLOCKS_METRIC,
+	})
+}
+
+function duplicated_blocks_of(measures: z.infer<typeof measures_schema>): NewCodeFetch {
+	const measure = measures.component.measures.find(
+		(entry) => entry.metric === DUPLICATED_BLOCKS_METRIC,
+	)
+	const blocks = sonar_new_code.measure_value(measure)
+
+	return blocks === undefined
+		? { error: `${DUPLICATED_BLOCKS_METRIC} is not a number` }
+		: { issues: [], issue_total: 0, duplicated_blocks: blocks }
+}
+
+async function fetch_new_code(project_key: string, pull_request: string): Promise<NewCodeFetch> {
+	const [issues, measures] = await Promise.all([
+		sonar_project.fetch_json(issues_url(project_key, pull_request), issues_schema),
+		sonar_project.fetch_json(measures_url(project_key, pull_request), measures_schema),
+	])
+	if ('error' in issues) return { error: `issues: ${issues.error}` }
+	if ('error' in measures) return { error: `measures: ${measures.error}` }
+
+	const blocks = duplicated_blocks_of(measures.data)
+
+	return 'error' in blocks
+		? blocks
+		: { ...blocks, issues: issues.data.issues, issue_total: issues.data.total }
+}
+
+function format_issue(issue: NewCodeIssue): string {
+	const line = issue.line === undefined ? UNKNOWN : String(issue.line)
+	const kind = `${issue.severity ?? UNKNOWN} ${issue.type ?? UNKNOWN}`
+
+	return `${kind}\t${issue.component}:${line}\t${issue.rule}\t${issue.message}`
+}
+
+function findings_line(reading: NewCodeReading): string {
+	const counts = `${String(reading.issue_total)} new issue(s), ${String(reading.duplicated_blocks)} new duplicated block(s)`
+
+	return `${FINDINGS}: ${counts} — fix them, or resolve a deliberate exception in SonarCloud`
+}
+
+// The report, and whether it passes: one line per issue, then the verdict line.
+function report(fetched: NewCodeFetch): { lines: ReadonlyArray<string>; is_clean: boolean } {
+	const verdict = sonar_new_code.verdict_of(fetched)
+
+	if ('error' in fetched) return { lines: [`${UNREADABLE}: ${fetched.error}`], is_clean: false }
+	if (verdict === CLEAN) return { lines: [CLEAN], is_clean: true }
+
+	const issue_lines = fetched.issues.map((issue) => format_issue(issue))
+
+	return { lines: [...issue_lines, findings_line(fetched)], is_clean: false }
+}
+
+async function run(argv: ReadonlyArray<string>): Promise<number> {
+	const target = await sonar_project.resolve_target(argv, USAGE)
+	if (target === undefined) return FAILURE_EXIT_CODE
+
+	const { lines, is_clean } = report(await fetch_new_code(target.project_key, target.pull_request))
+
+	for (const line of lines) console.info(line)
+
+	return is_clean ? 0 : FAILURE_EXIT_CODE
+}
+
+async function main(argv: ReadonlyArray<string>): Promise<void> {
+	process.exitCode = await run(argv)
+}
+
+const sonar_new_code_cli = {
+	fetch_new_code,
+	issues_url,
+	measures_url,
+	report,
+	run,
+	USAGE,
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
+
+export { sonar_new_code_cli }

package/scripts/sonar/sonar-new-code.ts

@@ -0,0 +1,79 @@
+// Whether a pull request adds any new SonarCloud finding — computed from the counts rather than from
+// the Quality Gate (joshuafolkken/kit#3045).
+//
+// The built-in `Sonar way` gate judges a ratio and a rating, not a count: a few MINOR code smells keep
+// the maintainability rating at A, and a copied block in a large pull request stays under the 3%
+// duplication threshold. So a pull request could add both and the `SonarQube` check stayed green. The
+// verdict here is a count: one new issue of any type or severity, or one new duplicated block, is a
+// finding. An issue resolved in SonarCloud (accepted, false positive) is not counted — the fetch asks
+// for unresolved issues only — so that resolution stays the escape hatch for a deliberate exception.
+
+const CLEAN = 'clean'
+const FINDINGS = 'findings'
+// The fetch could not be read — told apart from a clean read so a failed request never passes the
+// check as "no findings".
+const UNREADABLE = 'unreadable'
+
+const NEW_CODE_VERDICTS = [CLEAN, FINDINGS, UNREADABLE] as const
+
+type NewCodeVerdict = (typeof NEW_CODE_VERDICTS)[number]
+
+// One issue as `api/issues/search` returns it; only the fields the report prints are declared.
+// The optional fields carry `| undefined` explicitly so the zod-parsed shape assigns to this type
+// under `exactOptionalPropertyTypes`.
+interface NewCodeIssue {
+	rule: string
+	severity?: string | undefined
+	type?: string | undefined
+	component: string
+	line?: number | undefined
+	message: string
+}
+
+// What the pull request's analysis holds: the unresolved issues (`issue_total` is the API's own count,
+// which can exceed the page `issues` carries) and the `new_duplicated_blocks` measure.
+interface NewCodeReading {
+	issues: ReadonlyArray<NewCodeIssue>
+	issue_total: number
+	duplicated_blocks: number
+}
+
+type NewCodeFetch = NewCodeReading | { error: string }
+
+// A measure as `api/measures/component` returns it. A `new_*` metric carries its value under
+// `periods`; any other metric carries a top-level `value`.
+interface SonarMeasure {
+	value?: string | undefined
+	periods?: ReadonlyArray<{ value?: string | undefined }> | undefined
+}
+
+function to_count(raw: string | undefined): number | undefined {
+	if (raw === undefined) return undefined
+
+	const value = Number(raw)
+
+	return Number.isFinite(value) ? value : undefined
+}
+
+// The numeric value of a measure, or `undefined` when it is present but not a number. A measure the
+// response leaves out is 0: SonarCloud omits a metric it has nothing to count on, such as a pull
+// request that changes no analyzable file.
+function measure_value(measure: SonarMeasure | undefined): number | undefined {
+	if (measure === undefined) return 0
+
+	return to_count(measure.periods?.[0]?.value ?? measure.value)
+}
+
+function verdict_of(fetch: NewCodeFetch): NewCodeVerdict {
+	if ('error' in fetch) return UNREADABLE
+
+	return fetch.issue_total > 0 || fetch.duplicated_blocks > 0 ? FINDINGS : CLEAN
+}
+
+const sonar_new_code = {
+	measure_value,
+	verdict_of,
+}
+
+export { sonar_new_code, CLEAN, FINDINGS, UNREADABLE, NEW_CODE_VERDICTS }
+export type { NewCodeFetch, NewCodeIssue, NewCodeReading, NewCodeVerdict, SonarMeasure }

package/scripts/sonar/sonar-project.ts

@@ -0,0 +1,97 @@
+import { existsSync, readFileSync } from 'node:fs'
+import path from 'node:path'
+import { git_command } from '#scripts/git/git-command'
+import { error_text } from '#scripts/lib/error-message'
+import { timed_fetch } from '#scripts/lib/timed-fetch'
+import type { z } from 'zod'
+
+// The SonarCloud project a `josh sonar:*` command reads, shared by every command that calls the
+// SonarCloud API (joshuafolkken/kit#3045): the host, the project key `sonar-project.properties`
+// records — the file `josh init` / `josh sync` generate from the GitHub repository name — and the
+// `<PR>` positional each command takes.
+
+const SONAR_HOST = 'https://sonarcloud.io'
+const PROPERTIES_FILE = 'sonar-project.properties'
+const PROJECT_KEY_PREFIX = 'sonar.projectKey='
+const TOKEN_VARIABLE = 'SONAR_TOKEN'
+const AUTHORIZATION_HEADER = 'Authorization'
+
+interface SonarTarget {
+	project_key: string
+	pull_request: string
+}
+
+type SonarRead<T> = { data: T } | { error: string }
+
+function read_project_key(root: string): string | undefined {
+	const file = path.join(root, PROPERTIES_FILE)
+	if (!existsSync(file)) return undefined
+
+	const line = readFileSync(file, 'utf8')
+		.split('\n')
+		.find((entry) => entry.startsWith(PROJECT_KEY_PREFIX))
+
+	return line?.slice(PROJECT_KEY_PREFIX.length).trim()
+}
+
+function api_url(api_path: string, query: Record<string, string>): string {
+	return `${SONAR_HOST}${api_path}?${new URLSearchParams(query).toString()}`
+}
+
+// A public project reads without a token; a private one needs it. CI lifts `SONAR_TOKEN` into the
+// job env, so it is sent when present and the request is anonymous otherwise.
+function request_init(): RequestInit {
+	const token = process.env[TOKEN_VARIABLE] ?? ''
+
+	return token === '' ? {} : { headers: [[AUTHORIZATION_HEADER, `Bearer ${token}`]] }
+}
+
+// One SonarCloud API read: the parsed body on success, or the reason the read failed — rate-limited,
+// offline, a non-OK response or an unexpected shape — so a caller cannot mistake a failed read for an
+// empty success.
+async function fetch_json<T>(url: string, schema: z.ZodType<T>): Promise<SonarRead<T>> {
+	try {
+		const response = await timed_fetch(url, request_init())
+		if (!response.ok) return { error: `HTTP ${String(response.status)}` }
+
+		return { data: schema.parse(await response.json()) }
+	} catch (error) {
+		return { error: error_text.message_of(error) }
+	}
+}
+
+// The pull request named on the command line and this repository's project key, or `undefined`
+// after printing why the command cannot run — the usage line, or the missing project key.
+async function resolve_target(
+	argv: ReadonlyArray<string>,
+	usage: string,
+): Promise<SonarTarget | undefined> {
+	const [pull_request] = argv
+
+	if (pull_request === undefined || pull_request.startsWith('-')) {
+		console.error(usage)
+
+		return undefined
+	}
+
+	const project_key = read_project_key(await git_command.repository_root())
+
+	if (project_key === undefined) {
+		console.error(`no ${PROJECT_KEY_PREFIX} found in ${PROPERTIES_FILE}`)
+
+		return undefined
+	}
+
+	return { project_key, pull_request }
+}
+
+const sonar_project = {
+	api_url,
+	fetch_json,
+	read_project_key,
+	request_init,
+	resolve_target,
+}
+
+export { sonar_project }
+export type { SonarRead, SonarTarget }

package/scripts/split/split-assess-cli.ts

@@ -45,7 +45,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const split_assess_cli = { JSON_KEY, USAGE, main, parse_is_json, run }
+const split_assess_cli = { parse_is_json }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/split/split-assess.ts

@@ -27,7 +27,8 @@ interface SizeMeasurement {
 	verdict: SplitVerdict
 }
 
-// The guide from `split-assessment.md`. Strictly greater than: "about 10 changed files" and a change
+// The guide's single source: `split-assessment.md` states these once and a test pins the two equal
+// (joshuafolkken/kit#2996). Strictly greater than: "about 10 changed files" and a change
 // that "lands at 11 files is not thereby a split" put the bar above the round number, not at it.
 const FILE_GUIDE = 10
 const LINE_GUIDE = 400
@@ -112,12 +113,8 @@ const split_assess = {
 	SPLIT_VERDICT,
 	SINGLE_VERDICT,
 	assess,
-	measure,
-	non_test_changes,
 	parse_numstat,
-	parse_row,
 	reason,
-	verdict_for,
 }
 
 export type { FileChange, SizeMeasurement, SplitVerdict }

package/scripts/sync/managed-config-scope-cli.ts

@@ -54,7 +54,7 @@ async function main(argv: ReadonlyArray<string>): Promise<void> {
 	process.exitCode = await run(argv)
 }
 
-const managed_config_scope_cli = { decide, format_reason, JSON_KEY, main, run, USAGE }
+const managed_config_scope_cli = { decide, format_reason, run, USAGE }
 
 if (process.argv[1] === fileURLToPath(import.meta.url)) await main(process.argv.slice(ARGV_OFFSET))
 

package/scripts/sync/skill-migration.ts

@@ -180,7 +180,6 @@ function kept_note(source: MigrationSource): string {
 }
 
 const skill_migration = {
-	is_unmodified_copy,
 	migrate_removed_skill_directories,
 	migrate_manifest_skills,
 	expected_manifest,

package/scripts/sync/sync-hook-safety.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { json_value } from '#scripts/lib/json-value'
 import { package_version_schema } from '#scripts/lib/schemas'
 import { KIT_PACKAGE_NAME } from '#scripts/version/kit-descriptor'
-import { safe_json_parse } from '#scripts/version/parse-json'
 import semver from 'semver'
 
 // `josh sync` writes the consumer's Claude and Codex hook files, whose hooks invoke bundles under
@@ -21,7 +21,7 @@ const NODE_MODULES = 'node_modules'
 function read_version_at(package_json_path: string): string | undefined {
 	if (!existsSync(package_json_path)) return undefined
 	const parsed = package_version_schema.safeParse(
-		safe_json_parse(readFileSync(package_json_path, 'utf8')),
+		json_value.parse_or_undefined(readFileSync(package_json_path, 'utf8')),
 	)
 
 	return parsed.success ? parsed.data.version : undefined
@@ -75,7 +75,6 @@ const sync_hook_safety = {
 	hook_write_warning,
 	installed_consumer_version,
 	is_safe_to_write_hooks,
-	outdated_install_warning,
 	read_version_at,
 }
 

package/scripts/sync/sync.ts

@@ -7,7 +7,6 @@ import { gh_spawn } from '#scripts/gh/gh-spawn'
 import { basic_path_migration } from '#scripts/init/basic-path-migration'
 import { init_logic } from '#scripts/init/init-logic'
 import { PACKAGE_DIR, PROJECT_ROOT } from '#scripts/init/init-paths'
-import { plugin_install_hint_module } from '#scripts/init/plugin-install-hint'
 import { project_profile } from '#scripts/init/project-profile'
 import { auto_merge_setting } from '#scripts/repo/auto-merge-setting'
 import { repository_labels } from '#scripts/repo/repository-labels'
@@ -247,11 +246,6 @@ function sync_basic_artifacts(is_force: boolean): void {
 	sync_basic_prettier_config(path.join(PROJECT_ROOT, BASIC_PRETTIER_CONFIG))
 }
 
-function sync_full_artifacts(is_force: boolean): void {
-	sync_project_artifacts(is_force)
-	plugin_install_hint_module.report_plugin_install_hint()
-}
-
 // Checked before anything is written, never per file: the damage is the whole run, and a partial
 // sync that stopped halfway would leave the source repository in a state neither `git checkout` nor
 // a re-run describes (joshuafolkken/kit#868).
@@ -265,7 +259,7 @@ function main(): void {
 
 	console.info('\n🔄 Syncing @joshuafolkken/kit AI files\n')
 	if (project_checks.is_basic(PROJECT_ROOT)) sync_basic_artifacts(is_force)
-	else sync_full_artifacts(is_force)
+	else sync_project_artifacts(is_force)
 	console.info('\n✅ Done.\n')
 }
 
@@ -278,7 +272,6 @@ const sync = {
 	sync_workspace_yaml: sync_ai_files.sync_workspace_yaml,
 	sync_claude_md: sync_ai_files.sync_claude_md,
 	sync_prettier_config,
-	sync_basic_prettier_config,
 	sync_playwright_config,
 	sync_deploy_vps,
 	sync_package_manager_version,

package/scripts/sync/template-source-logic.ts

@@ -110,7 +110,6 @@ const template_source_logic = {
 	TRIPWIRE_PAIRS,
 	hash_text,
 	find_copy_drift,
-	build_tripwire_manifest,
 	find_tripwire_drift,
 	read_recorded_manifest,
 	format_drift_message,

package/scripts/sync/workflow-pin-logic.ts

@@ -1,5 +1,6 @@
-import { readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { readdirSync, readFileSync } from 'node:fs'
 import path from 'node:path'
+import { composite_actions } from '#scripts/ci/composite-actions'
 import { is_workflow_destination } from '#scripts/claude/workflow-destination'
 import { package_path } from '#scripts/init/init-paths'
 
@@ -9,7 +10,8 @@ import { package_path } from '#scripts/init/init-paths'
 //
 // The refs committed in templates/workflows/* are NOT authoritative: every consumer
 // workflow is written through apply_pins_for_destination, which resolves the pins from
-// .github/workflows at write time. Dependabot only ever updates .github/workflows (its
+// .github/workflows (and the composite actions under .github/actions) at write time. Dependabot
+// only ever updates .github (its
 // github-actions ecosystem cannot scan templates/), so a stale template ref must not be
 // able to reach a consumer — and must not fail CI either. `josh sync-workflow-pins`
 // stays available to refresh the committed refs, but nothing depends on it having run.
@@ -144,8 +146,19 @@ function list_workflow_sources(relative_directory: string): Array<WorkflowSource
 		.map((name) => read_source(relative_directory, name))
 }
 
+// The local composite actions are runtime sources too: `.github/actions/setup-pnpm` is the only
+// place kit's own workflows still pin pnpm/setup (joshuafolkken/kit#2982).
+function list_composite_action_sources(): Array<WorkflowSource> {
+	return composite_actions
+		.list(package_path)
+		.map((file) => ({ file, text: readFileSync(package_path(file), 'utf8') }))
+}
+
 function build_canonical_pins(): Map<string, string> {
-	return collect_canonical(list_workflow_sources(RUNTIME_WORKFLOWS_DIR))
+	return collect_canonical([
+		...list_workflow_sources(RUNTIME_WORKFLOWS_DIR),
+		...list_composite_action_sources(),
+	])
 }
 
 // An action the templates use but .github/workflows does not: write-time injection has no
@@ -181,32 +194,10 @@ function scan_templates<T>(
 	return list_workflow_sources(TEMPLATE_WORKFLOWS_DIR).flatMap((source) => scan(source, canonical))
 }
 
-function find_pin_drift(): Array<PinDrift> {
-	return scan_templates((source, canonical) =>
-		find_drift_in_text(source.file, source.text, canonical),
-	)
-}
-
 function find_unknown_template_actions(): Array<UnknownAction> {
 	return scan_templates(unknown_actions_in_source)
 }
 
-function write_synced(source: WorkflowSource, canonical: ReadonlyMap<string, string>): void {
-	const synced = apply_to_text(source.text, canonical)
-	if (synced !== source.text) writeFileSync(package_path(source.file), synced)
-}
-
-function sync_pins(): Array<PinDrift> {
-	const canonical = build_canonical_pins()
-	const drifts = find_pin_drift()
-
-	for (const source of list_workflow_sources(TEMPLATE_WORKFLOWS_DIR)) {
-		write_synced(source, canonical)
-	}
-
-	return drifts
-}
-
 function format_drift_message(drifts: ReadonlyArray<PinDrift>): string {
 	const lines = drifts.map(
 		(drift) =>
@@ -222,7 +213,6 @@ function format_drift_message(drifts: ReadonlyArray<PinDrift>): string {
 
 const workflow_pin_logic = {
 	RUNTIME_WORKFLOWS_DIR,
-	TEMPLATE_WORKFLOWS_DIR,
 	parse_uses_line,
 	collect_canonical,
 	find_drift_in_text,
@@ -230,9 +220,7 @@ const workflow_pin_logic = {
 	is_workflow_destination,
 	apply_pins_for_destination,
 	build_canonical_pins,
-	find_pin_drift,
 	find_unknown_template_actions,
-	sync_pins,
 	format_drift_message,
 }