@mmerterden/multi-agent-pipeline 20.8.3 → 20.9.0

package/pipeline/lib/owned-path-gate.mjs

@@ -0,0 +1,699 @@
+/**
+ * owned-path-gate.mjs  -  a change to a path an automated account owns is a
+ * violation, decided from the repo profile rather than from judgement.
+ *
+ * The repo profile (repo-profile.mjs) lists `ownedPaths[]`: trees a sync job or
+ * generator writes, where a hand edit is reverted on the next sync or rejected
+ * by CI. This module takes a set of changed paths, keeps the owned entries the
+ * profile's confidence policy allows for the run's mode, and reports every
+ * changed path an entry covers, unless one of these applies:
+ *
+ *   except        the path matches one of the entry's `except[]` globs;
+ *   owner         every author of the change matches the entry's `owner`;
+ *   bypass-author every author of the change matches `bypass.author`;
+ *   bypass-label  the PR carries `bypass.label` (given with --pr-labels, or
+ *                 read read-only through `gh` when it is installed).
+ *
+ * Glob semantics, shared by `glob` and `except`: `**` as a whole segment
+ * matches any number of segments (zero included; a trailing one needs at least
+ * one), `*`, `?` and a `**` inside a segment stay inside that segment, `[...]`
+ * is a character class (`[!...]` negated, `]` first is a member) that never
+ * matches `/`. A glob with no wildcard, or one ending in `/`, names a file or a
+ * whole directory, so a stored directory covers its subtree. Matching walks
+ * segments and characters with two pointers, so its time is linear in the
+ * glob times the path, whatever the number of wildcards.
+ *
+ * Owner and bypass-author values are regular expressions when anchored (`^` or
+ * `$`) and exact literal names otherwise.
+ *
+ * When several entries cover a path, the first one whose `except` does not
+ * exempt it decides; an `except` only releases the path from its own entry.
+ *
+ * @module pipeline/lib/owned-path-gate
+ */
+
+import { execFileSync } from "node:child_process";
+import { ensureProfile, locateProfile, policyMode, resolveField } from "./repo-profile.mjs";
+import { runPosture } from "./unattended.mjs";
+
+export const FINDING_TAG = "owned_path";
+
+const WILDCARD = /[*?[]/;
+
+function normalize(p) {
+  return String(p)
+    .replace(/\\/g, "/")
+    .replace(/\/{2,}/g, "/")
+    .replace(/^(?:\.\/)+/, "")
+    .replace(/^\/+/, "");
+}
+
+/** A glob without its trailing slashes, and whether it had any (a directory). */
+function trimGlob(glob) {
+  const g = normalize(glob);
+  const trimmed = g.replace(/\/+$/, "");
+  return { g: trimmed, dir: trimmed !== g };
+}
+
+/**
+ * One segment's tokens: a literal character, `?`, `*`, or a class. A class
+ * opens at `[`, takes a leading `!` as negation and a `]` right after that as
+ * a member, and closes at the next `]`; an unclosed `[` is a literal.
+ */
+function compileSegment(seg) {
+  const tokens = [];
+  for (let i = 0; i < seg.length; i += 1) {
+    const ch = seg[i];
+    if (ch === "*") {
+      while (seg[i + 1] === "*") i += 1;
+      tokens.push({ star: true });
+    } else if (ch === "?") {
+      tokens.push({ any: true });
+    } else if (ch === "[") {
+      let j = i + 1;
+      const negate = seg[j] === "!";
+      if (negate) j += 1;
+      const from = j;
+      if (seg[j] === "]") j += 1;
+      while (j < seg.length && seg[j] !== "]") j += 1;
+      if (j >= seg.length) {
+        tokens.push({ lit: ch });
+        continue;
+      }
+      const body = seg.slice(from, j);
+      const ranges = [];
+      for (let k = 0; k < body.length; k += 1) {
+        if (body[k + 1] === "-" && k + 2 < body.length) {
+          ranges.push([body[k], body[k + 2]]);
+          k += 2;
+        } else {
+          ranges.push([body[k], body[k]]);
+        }
+      }
+      tokens.push({ ranges, negate });
+      i = j;
+    } else {
+      tokens.push({ lit: ch });
+    }
+  }
+  return tokens;
+}
+
+function tokenMatches(t, ch) {
+  if (t.any) return true;
+  if (t.lit !== undefined) return t.lit === ch;
+  const inside = t.ranges.some(([a, b]) => ch >= a && ch <= b);
+  return t.negate ? !inside : inside;
+}
+
+/**
+ * Two-pointer wildcard match: on a mismatch, return to the last `*` and let
+ * it take one more item. `step(atom, item)` compares one non-star atom with
+ * one item. Time is bounded by atoms times items; nothing backtracks further.
+ */
+function wildMatch(atoms, items, isStar, step) {
+  let a = 0;
+  let i = 0;
+  let starA = -1;
+  let starI = 0;
+  while (i < items.length) {
+    if (a < atoms.length && !isStar(atoms[a]) && step(atoms[a], items[i])) {
+      a += 1;
+      i += 1;
+    } else if (a < atoms.length && isStar(atoms[a])) {
+      starA = a;
+      starI = i;
+      a += 1;
+    } else if (starA >= 0) {
+      a = starA + 1;
+      starI += 1;
+      i = starI;
+    } else {
+      return false;
+    }
+  }
+  while (a < atoms.length && isStar(atoms[a])) a += 1;
+  return a === atoms.length;
+}
+
+const GLOBSTAR = { globstar: true };
+const ANY_SEGMENT = { tokens: [{ star: true }], nonEmpty: true };
+
+/**
+ * Compile a glob to segment atoms. `**` alone in a segment is any number of
+ * segments; a trailing `**` needs at least one. Inside a segment `**` is `*`.
+ * A glob with no wildcard, or one ending in `/`, also covers its subtree.
+ *
+ * @param {string} glob
+ * @returns {{atoms: object[]}}
+ */
+export function compileGlob(glob) {
+  const { g, dir } = trimGlob(glob);
+  const parts = g === "" ? [] : g.split("/");
+  const atoms = [];
+  parts.forEach((part, idx) => {
+    if (part === "**" || /^\*{2,}$/.test(part)) {
+      if (idx === parts.length - 1) atoms.push(ANY_SEGMENT, GLOBSTAR);
+      else if (atoms.at(-1) !== GLOBSTAR) atoms.push(GLOBSTAR);
+    } else {
+      atoms.push({ tokens: compileSegment(part) });
+    }
+  });
+  if ((dir || !WILDCARD.test(g)) && atoms.at(-1) !== GLOBSTAR) atoms.push(GLOBSTAR);
+  return { atoms };
+}
+
+function segmentMatches(atom, seg) {
+  if (atom.nonEmpty && seg === "") return false;
+  return wildMatch(
+    atom.tokens,
+    seg,
+    (t) => t.star === true,
+    (t, ch) => tokenMatches(t, ch),
+  );
+}
+
+const compiled = new Map();
+
+/**
+ * @param {string} glob
+ * @param {string} path repo-relative
+ * @returns {boolean}
+ */
+export function matchGlob(glob, path) {
+  let c = compiled.get(glob);
+  if (!c) {
+    c = compileGlob(glob);
+    compiled.set(glob, c);
+  }
+  const p = normalize(path);
+  const segs = p === "" ? [] : p.split("/");
+  return wildMatch(c.atoms, segs, (a) => a === GLOBSTAR, segmentMatches);
+}
+
+/**
+ * The literal part of a glob a matching path must start with: everything up to
+ * the last `/` before the first wildcard, or the whole glob (trailing slashes
+ * trimmed) when it has none. The pre-commit hook uses the same rule to skip
+ * the gate cheaply; an empty prefix matches every path.
+ *
+ * @param {string} glob
+ * @returns {string}
+ */
+export function ownedPrefix(glob) {
+  const { g } = trimGlob(glob);
+  const at = g.search(WILDCARD);
+  if (at < 0) return g;
+  const head = g.slice(0, at);
+  const slash = head.lastIndexOf("/");
+  return slash < 0 ? "" : head.slice(0, slash + 1);
+}
+
+const isAnchored = (pattern) => /^\^|\$$/.test(String(pattern));
+
+/**
+ * An owner or bypass author: a regular expression when it is anchored (`^` or
+ * `$`), otherwise one literal name compared exactly, so `x[bot]` is itself and
+ * `bot` is not `robot`.
+ */
+function compileAuthor(pattern) {
+  if (!isAnchored(pattern)) return { test: (s) => s === pattern };
+  try {
+    return new RegExp(pattern);
+  } catch {
+    return { test: (s) => s === pattern };
+  }
+}
+
+/** Whether every author of a change matches `pattern`; an empty author list never does. */
+export function allAuthorsMatch(pattern, authors) {
+  if (!pattern || !authors || authors.length === 0) return false;
+  const re = compileAuthor(pattern);
+  return authors.every((a) => [a.name, a.email, `${a.name} <${a.email}>`].some((s) => re.test(s)));
+}
+
+/** A regex owner such as `^(?:a\[bot\]|b)$` as a reader would write it: `a[bot], b`. */
+export function ownerLabel(owner) {
+  if (!isAnchored(owner)) return String(owner);
+  return String(owner)
+    .replace(/^\^/, "")
+    .replace(/\$$/, "")
+    .replace(/^\(\?:(.*)\)$/, "$1")
+    .split("|")
+    .map((s) => s.replace(/\\(.)/g, "$1"))
+    .join(", ");
+}
+
+function fixText(path, entry, hints) {
+  const who = ownerLabel(entry.owner);
+  const where = hints.length ? ` (${hints.join("; ")})` : "";
+  let text =
+    `${path} is generated or synced by ${who}; change its source instead${where}, ` +
+    "or wait for the sync. Never hand-edit it.";
+  if (entry.bypass && entry.bypass.label) {
+    text += ` A deliberate exception needs the PR label "${entry.bypass.label}".`;
+  }
+  return text;
+}
+
+function sourceHints(path, generators, authoring) {
+  const hints = [];
+  for (const g of generators) {
+    if (!g || !g.output || !matchGlob(g.output, path)) continue;
+    if (g.input) hints.push(`generator input: ${g.input}`);
+    if (g.command) hints.push(`regenerate with: ${g.command}`);
+  }
+  for (const [domain, cmd] of Object.entries(authoring || {})) {
+    hints.push(`author ${domain} with: ${cmd}`);
+  }
+  return [...new Set(hints)];
+}
+
+/**
+ * The decision, as a pure function of its inputs.
+ *
+ * @param {{paths: string[], entries: object[], authorsFor?: (p: string) => {name: string, email: string}[],
+ *   labels?: string[], fetchLabels?: () => string[], generators?: object[], authoring?: object}} input
+ * @returns {{violations: object[], exempt: object[], labels: string[]}}
+ */
+export function evaluate({
+  paths,
+  entries,
+  authorsFor = () => [],
+  labels = [],
+  fetchLabels = null,
+  generators = [],
+  authoring = null,
+}) {
+  const violations = [];
+  const exempt = [];
+  let known = [...labels];
+  let fetched = false;
+  const hasLabel = (label) => {
+    if (known.includes(label)) return true;
+    if (!fetched && fetchLabels) {
+      fetched = true;
+      known = [...new Set([...known, ...fetchLabels()])];
+    }
+    return known.includes(label);
+  };
+  for (const raw of paths) {
+    const path = normalize(raw);
+    let entry = null;
+    let excepted = null;
+    for (const e of entries) {
+      if (!e || !e.glob || !matchGlob(e.glob, path)) continue;
+      const except = (e.except || []).find((g) => matchGlob(g, path));
+      if (!except) {
+        entry = e;
+        break;
+      }
+      excepted ??= { path, glob: e.glob, reason: "except", except };
+    }
+    if (!entry) {
+      if (excepted) exempt.push(excepted);
+      continue;
+    }
+    const base = { path, glob: entry.glob };
+    const authors = authorsFor(path);
+    if (allAuthorsMatch(entry.owner, authors)) {
+      exempt.push({ ...base, reason: "owner" });
+      continue;
+    }
+    if (entry.bypass && entry.bypass.author && allAuthorsMatch(entry.bypass.author, authors)) {
+      exempt.push({ ...base, reason: "bypass-author", author: entry.bypass.author });
+      continue;
+    }
+    if (entry.bypass && entry.bypass.label && hasLabel(entry.bypass.label)) {
+      exempt.push({ ...base, reason: "bypass-label", label: entry.bypass.label });
+      continue;
+    }
+    violations.push({
+      ...base,
+      owner: entry.owner,
+      evidence: entry.evidence || [],
+      confidence: entry.confidence,
+      fix: fixText(path, entry, sourceHints(path, generators, authoring)),
+    });
+  }
+  return { violations, exempt, labels: known };
+}
+
+/** Reviewer-shaped findings, so Phase 3 triage adjudicates a violation that reached it. */
+export function toFindings(violations) {
+  return violations.map((v) => ({
+    file: v.path,
+    line: 0,
+    severity: "blocking",
+    tag: FINDING_TAG,
+    issue: `Edits ${v.path}, which ${ownerLabel(v.owner)} owns (${v.glob}, ${v.confidence} confidence, evidence ${v.evidence.join(", ") || "none"}).`,
+    fix: v.fix,
+  }));
+}
+
+// ---------------------------------------------------------------------------
+// reading the change set from git
+
+function git(repo, args, { input } = {}) {
+  return execFileSync("git", ["-C", repo, "-c", "core.quotePath=false", ...args], {
+    encoding: "utf8",
+    input,
+    stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+    maxBuffer: 256 * 1024 * 1024,
+  });
+}
+
+function tryGit(repo, args) {
+  try {
+    return git(repo, args).trim();
+  } catch {
+    return "";
+  }
+}
+
+const splitNul = (s) => s.split("\0").filter(Boolean);
+
+/** The identity a commit made now would carry (GIT_AUTHOR_* and config both count). */
+export function localAuthor(repo) {
+  const ident = tryGit(repo, ["var", "GIT_AUTHOR_IDENT"]);
+  const m = ident.match(/^(.*?) <([^>]*)>/);
+  return m ? { name: m[1], email: m[2] } : null;
+}
+
+/**
+ * Authors per path over the commits of `range`, renames split into both sides.
+ * A merge lists the files its author changed while resolving it (dense
+ * combined diff), never what the merge brought in from the other side.
+ */
+function rangeAuthors(repo, range) {
+  const out = new Map();
+  const log = git(repo, [
+    "log",
+    "--no-renames",
+    "--diff-merges=dense-combined",
+    "--name-only",
+    "-z",
+    "--format=%x01%an%x00%ae%x00",
+    range,
+  ]);
+  for (const chunk of log.split("\x01").filter(Boolean)) {
+    const [name, email, ...files] = chunk.split("\0");
+    for (const f of files.map((s) => s.replace(/^\n/, "")).filter(Boolean)) {
+      if (!out.has(f)) out.set(f, []);
+      out.get(f).push({ name, email });
+    }
+  }
+  return out;
+}
+
+function isCommit(repo, ref) {
+  return Boolean(tryGit(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]));
+}
+
+function isShallow(repo) {
+  return tryGit(repo, ["rev-parse", "--is-shallow-repository"]) === "true";
+}
+
+const UNSHALLOW = "fetch more history (git fetch --unshallow)";
+
+/** A git call whose failure is one readable line naming `what`, not git's stderr dump. */
+function gitOr(repo, args, what) {
+  try {
+    return git(repo, args);
+  } catch (err) {
+    const said = String(err.stderr || "")
+      .split("\n")
+      .map((l) => l.replace(/^(?:fatal|error):\s*/, "").trim())
+      .find(Boolean);
+    throw new Error(`${what}${said ? `: ${said}` : ""}`, { cause: err });
+  }
+}
+
+/** The repository's top level, so a subdirectory `--repo` still sees every path. */
+export function repoTop(repo) {
+  const top = tryGit(repo, ["rev-parse", "--show-toplevel"]);
+  if (!top) throw new Error(`not a git repository: ${repo}`);
+  return top;
+}
+
+function baseCandidates(profile, mode) {
+  const refs = [];
+  for (const field of ["repo.workBranch", "repo.defaultBranch"]) {
+    const r = profile ? resolveField(profile, field, { mode }) : { use: false };
+    if (r.use && r.value) refs.push(`origin/${r.value}`, String(r.value));
+  }
+  refs.push("origin/HEAD", "origin/main", "origin/master", "main", "master");
+  return [...new Set(refs)];
+}
+
+/**
+ * The merge-base the default change set starts from: --base when given, else
+ * the first of the profile's work and default branch (origin first), origin's
+ * HEAD, main and master that shares history with HEAD.
+ *
+ * @returns {{base: string, ref: string} | {base: null, reason: string}}
+ */
+function resolveBase(repo, profile, mode, explicit) {
+  if (explicit) {
+    if (!isCommit(repo, explicit)) {
+      throw new Error(`--base ${explicit}: not a commit in this repository`);
+    }
+    const base = tryGit(repo, ["merge-base", "HEAD", explicit]);
+    if (base) return { base, ref: explicit };
+    if (isShallow(repo)) {
+      throw new Error(
+        `--base ${explicit}: no merge-base with HEAD in this shallow clone; ${UNSHALLOW}, or pass --range or --staged`,
+      );
+    }
+    throw new Error(`--base ${explicit}: no merge-base with HEAD`);
+  }
+  const present = [];
+  for (const ref of baseCandidates(profile, mode)) {
+    if (!isCommit(repo, ref)) continue;
+    present.push(ref);
+    const base = tryGit(repo, ["merge-base", "HEAD", ref]);
+    if (base) return { base, ref };
+  }
+  if (present.length && isShallow(repo)) {
+    return {
+      base: null,
+      reason: `shallow clone: no merge-base between HEAD and ${present.join(", ")}; ${UNSHALLOW}, or pass --base, --range or --staged`,
+    };
+  }
+  return {
+    base: null,
+    reason:
+      "no base to diff against (no work or default branch in the profile, no origin/HEAD, main or master sharing history with HEAD); pass --base, --range or --staged",
+  };
+}
+
+/** The index, the uncommitted tracked changes and the untracked files, repo-root relative. */
+function workingTree(repo) {
+  const hasHead = isCommit(repo, "HEAD");
+  return [
+    ...new Set([
+      ...splitNul(git(repo, ["diff", "--cached", "--name-only", "--no-renames", "-z"])),
+      ...(hasHead
+        ? splitNul(git(repo, ["diff", "--name-only", "--no-renames", "-z", "HEAD"]))
+        : []),
+      ...splitNul(git(repo, ["ls-files", "--others", "--exclude-standard", "--full-name", "-z"])),
+    ]),
+  ];
+}
+
+/** Above this many paths a default change set says more about its base than about the change. */
+export const MAX_CHANGED = 5000;
+
+/**
+ * The changed paths and who changed each one. With no --base and no base to
+ * resolve, the result carries `noBase` (the reason) and no paths; the caller
+ * decides what that means for its mode.
+ *
+ * @param {string} repo
+ * @param {{staged?: boolean, range?: string|null, paths?: string[]|null, base?: string|null,
+ *   author?: string|null, profile?: object|null, mode?: string, maxChanged?: number}} opts
+ * @returns {{paths: string[], authorsFor: (p: string) => object[], source: string, noBase?: string}}
+ */
+export function changeSet(
+  repo,
+  {
+    staged,
+    range,
+    paths,
+    base = null,
+    author,
+    profile = null,
+    mode = "attended",
+    maxChanged = MAX_CHANGED,
+  },
+) {
+  const local = author ? parseAuthor(author) : localAuthor(repo);
+  const localList = local ? [local] : [];
+  if (paths) return { paths, authorsFor: () => localList, source: "paths" };
+  const top = repoTop(repo);
+  if (staged) {
+    const list = splitNul(git(top, ["diff", "--cached", "--name-only", "--no-renames", "-z"]));
+    return { paths: list, authorsFor: () => localList, source: "staged" };
+  }
+  if (range) {
+    const m = range.match(/^(.+?)\.\.\.?(.+)$/);
+    if (!m) throw new Error(`--range needs <base>..<head>, got ${range}`);
+    const [, a, b] = m;
+    for (const side of [a, b]) {
+      if (!isCommit(top, side)) {
+        throw new Error(`--range ${range}: ${side} is not a commit in this repository`);
+      }
+    }
+    const mb = tryGit(top, ["merge-base", a, b]);
+    if (!mb && isShallow(top)) {
+      throw new Error(`--range ${range}: no merge-base in this shallow clone; ${UNSHALLOW}`);
+    }
+    const list = splitNul(
+      gitOr(top, ["diff", "--name-only", "--no-renames", "-z", `${a}...${b}`], `--range ${range}`),
+    );
+    const byPath = rangeAuthors(top, `${mb || a}..${b}`);
+    return { paths: list, authorsFor: (p) => byPath.get(p) || [], source: `range ${range}` };
+  }
+  const found = resolveBase(top, profile, mode, base);
+  if (!found.base) {
+    return { paths: [], authorsFor: () => localList, source: "none", noBase: found.reason };
+  }
+  const committed = new Set(
+    splitNul(git(top, ["diff", "--name-only", "--no-renames", "-z", found.base, "HEAD"])),
+  );
+  const dirty = new Set([
+    ...splitNul(git(top, ["diff", "--name-only", "--no-renames", "-z", "HEAD"])),
+    ...splitNul(git(top, ["ls-files", "--others", "--exclude-standard", "--full-name", "-z"])),
+  ]);
+  const all = [...new Set([...committed, ...dirty])];
+  if (!base && all.length > maxChanged) {
+    throw new Error(
+      `base looks wrong: ${all.length} changed paths since the merge-base with ${found.ref} (more than ${maxChanged}); pass --base or --range`,
+    );
+  }
+  const byPath = rangeAuthors(top, `${found.base}..HEAD`);
+  return {
+    paths: all,
+    authorsFor: (p) => [
+      ...(committed.has(p) ? byPath.get(p) || [] : []),
+      ...(dirty.has(p) ? localList : []),
+    ],
+    source: `merge-base with ${found.ref}`,
+  };
+}
+
+/** The working tree as the change set, when unattended and no base resolves. */
+function workingTreeSet(repo, author) {
+  const local = author ? parseAuthor(author) : localAuthor(repo);
+  const localList = local ? [local] : [];
+  return { paths: workingTree(repoTop(repo)), authorsFor: () => localList };
+}
+
+function parseAuthor(s) {
+  const m = String(s).match(/^(.*?)\s*<([^>]*)>$/);
+  return m ? { name: m[1], email: m[2] } : { name: String(s), email: "" };
+}
+
+/** PR labels for the checked-out branch through `gh`, read-only; nothing on any failure. */
+export function ghLabels(repo) {
+  try {
+    const out = execFileSync("gh", ["pr", "view", "--json", "labels", "--jq", ".labels[].name"], {
+      cwd: repo,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15000,
+    });
+    return out
+      .split("\n")
+      .map((s) => s.trim())
+      .filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+
+// ---------------------------------------------------------------------------
+// the whole gate
+
+/**
+ * Load (or, unattended, derive) the profile, read the change set, decide.
+ *
+ * @param {string} repo
+ * @param {{staged?: boolean, range?: string|null, paths?: string[]|null, base?: string|null,
+ *   author?: string|null, labels?: string[], gh?: boolean, env?: object, state?: object|null,
+ *   home?: string, maxChanged?: number}} [opts]
+ * A profile that honours no owned entry for the mode skips before any git
+ * call. With no base to diff against, an attended run skips with the reason;
+ * an unattended run scans the index and working tree, and skips only when
+ * those are clean.
+ *
+ * @returns {object} the result; `exitCode` is 0 clean or skipped, 1 on violations
+ */
+export function runGate(repo, opts = {}) {
+  const { env = process.env, state = null, home, labels = [], gh = true } = opts;
+  const { mode: storeMode, gatesActive } = runPosture(state, env);
+  const mode = policyMode(env, state);
+  const found = locateProfile(repo, { home, env, mode: storeMode });
+  let profile = found?.profile ?? null;
+  let profileAction = profile ? "loaded" : "none";
+  let source = found?.path ?? null;
+  if (!profile && gatesActive) {
+    const ensured = ensureProfile(repo, { home, env, state });
+    profile = ensured.profile;
+    profileAction = ensured.action;
+    source = ensured.path;
+  }
+  const empty = { violations: [], exempt: [], findings: [], ignored: [], checked: 0 };
+  const skip = (note, extra = {}) => ({
+    ...empty,
+    mode,
+    skipped: true,
+    note,
+    profileSource: source,
+    profileAction,
+    exitCode: 0,
+    ...extra,
+  });
+  if (!profile) return skip("no repo profile, gate skipped");
+  const owned = resolveField(profile, "ownedPaths", { mode });
+  if (!owned.value.length) {
+    return skip(`no owned path the profile honours in ${mode} mode, gate skipped`, {
+      ignored: owned.ignored,
+    });
+  }
+  const gens = resolveField(profile, "generators", { mode });
+  const rs = resolveField(profile, "resourceSource", { mode });
+  let change = changeSet(repo, { ...opts, profile, mode });
+  if (change.noBase) {
+    const tree = mode === "unattended" ? workingTreeSet(repo, opts.author) : null;
+    if (!tree || !tree.paths.length) {
+      return skip(
+        `${change.noBase}; gate skipped${tree ? " (the working tree has no changes)" : ""}`,
+        { ignored: owned.ignored },
+      );
+    }
+    change = { ...tree, source: `working tree (${change.noBase})` };
+  }
+  const decided = evaluate({
+    paths: change.paths,
+    entries: owned.value,
+    authorsFor: change.authorsFor,
+    labels,
+    fetchLabels: gh ? () => ghLabels(repo) : null,
+    generators: gens.value || [],
+    authoring: rs.use && rs.value ? rs.value.authoring : null,
+  });
+  return {
+    violations: decided.violations,
+    exempt: decided.exempt,
+    findings: toFindings(decided.violations),
+    ignored: owned.ignored,
+    checked: change.paths.length,
+    changeSource: change.source,
+    mode,
+    skipped: false,
+    profileSource: source,
+    profileAction,
+    exitCode: decided.violations.length ? 1 : 0,
+  };
+}