@node-core/utils 7.2.3 → 7.3.0

package/bin/ncu-ci.js

@@ -23,6 +23,7 @@ import {
 import {
   RunPRJob
 } from '../lib/ci/run_ci.js';
+import { ResumePRJob } from '../lib/ci/resume_ci.js';
 import { writeJson, writeFile } from '../lib/file.js';
 import { getMergedConfig } from '../lib/config.js';
 import { runPromise } from '../lib/run.js';
@@ -134,6 +135,26 @@ const args = yargs(hideBin(process.argv))
     },
     handler
   })
+  .command({
+    command: 'resume <prid>',
+    desc: 'Resume the latest CI run for given PR',
+    builder: (yargs) => {
+      yargs
+        .positional('prid', {
+          describe: 'ID of the PR or URL to the PR',
+          type: 'string'
+        })
+        .option('owner', {
+          default: '',
+          describe: 'GitHub repository owner'
+        })
+        .option('repo', {
+          default: '',
+          describe: 'GitHub repository name'
+        });
+    },
+    handler
+  })
   .command({
     command: 'url <url>',
     desc: 'Automatically detect CI type and show results',
@@ -278,11 +299,13 @@ class RunPRJobCommand {
     return this.argv.prid;
   }
 
-  async start() {
-    const {
-      cli, request, prid, repo, owner
-    } = this;
+  validate() {
+    const { cli, prid, repo, owner } = this;
     let validArgs = true;
+    if (!Number.isSafeInteger(prid) || prid <= 0) {
+      validArgs = false;
+      cli.error('Pull request ID must be a positive integer');
+    }
     if (!repo) {
       validArgs = false;
       cli.error('GitHub repository is missing, please set it via ncu-config ' +
@@ -295,6 +318,13 @@ class RunPRJobCommand {
     }
     if (!validArgs) {
       this.cli.setExitCode(1);
+    }
+    return validArgs;
+  }
+
+  async start() {
+    const { cli, request, prid, repo, owner } = this;
+    if (!this.validate()) {
       return;
     }
     const { certifySafe, checkForDuplicates } = this.argv;
@@ -308,6 +338,20 @@ class RunPRJobCommand {
   }
 }
 
+class ResumePRJobCommand extends RunPRJobCommand {
+  async start() {
+    const { cli, request, prid, repo, owner } = this;
+    if (!this.validate()) {
+      return;
+    }
+    const jobRunner = new ResumePRJob(cli, request, owner, repo, prid);
+    if (!(await jobRunner.resume())) {
+      cli.setExitCode(1);
+      process.exitCode = 1;
+    }
+  }
+}
+
 class CICommand {
   constructor(cli, request, argv) {
     this.cli = cli;
@@ -565,7 +609,8 @@ async function main(command, argv) {
   let commandHandler;
   // Prepare queue.
   switch (command) {
-    case 'run': {
+    case 'run':
+    case 'resume': {
       const maybeURL = URL.parse(argv.prid);
       if (maybeURL?.host === 'github.com') {
         const [, owner, repo, , prid, , commit_sha] = maybeURL.pathname.split('/');
@@ -575,7 +620,8 @@ async function main(command, argv) {
         argv.prid = prid;
       }
       argv.prid = Number(argv.prid);
-      const jobRunner = new RunPRJobCommand(cli, request, argv);
+      const Command = command === 'run' ? RunPRJobCommand : ResumePRJobCommand;
+      const jobRunner = new Command(cli, request, argv);
       return jobRunner.start();
     }
     case 'rate': {

package/lib/ci/ci_failure_parser.js

@@ -132,35 +132,54 @@ function failureMatcher(Failure, patterns, ctx, text) {
   return null;
 }
 
+const fatalPattern = /fatal: .+/g;
+
+// Shared by the whole-log parser and the streaming file scanner.
+export const FAILURE_MARKERS = {
+  tap: {
+    start: /^not ok \d+/,
+    end: / {2}\.\.\.\r?\n/,
+    todo: '# TODO :'
+  },
+  cpp: /\[ {2}FAILED {2}\]/,
+  git: [{
+    start: /Changes not staged for commit:/,
+    end: /no changes added to commit/
+  }, {
+    start: /error: Your local changes to the following files/,
+    end: /Failed to merge in the changes./
+  }]
+};
+
+const tapPattern = new RegExp(
+  `${FAILURE_MARKERS.tap.start.source}[\\s\\S]+?${FAILURE_MARKERS.tap.end.source}`, 'mg');
+
 // The elements are ranked by priority
 const FAILURE_FILTERS = [{
   // NOTE(mmarchini): infra-related issues should have the highest priority, as
   // they can cause other issues to happen.
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /Read-only file system/g,
-      context: { index: 0, contextBefore: 1, contextAfter: 0 }
-    },
-    {
-      pattern: /Device or resource busy/g,
-      context: { index: 0, contextBefore: 1, contextAfter: 0 }
-    },
-    {
-      pattern: /There is not enough space in the file system./g,
-      context: { index: 0, contextBefore: 1, contextAfter: 0 }
-    }
-    ];
-    return failureMatcher(InfraFailure, patterns, ctx, text);
+  Failure: InfraFailure,
+  patterns: [{
+    pattern: /Read-only file system/g,
+    context: { index: 0, contextBefore: 1, contextAfter: 0 }
+  },
+  {
+    pattern: /Device or resource busy/g,
+    context: { index: 0, contextBefore: 1, contextAfter: 0 }
+  },
+  {
+    pattern: /There is not enough space in the file system./g,
+    context: { index: 0, contextBefore: 1, contextAfter: 0 }
   }
+  ],
 }, {
   // TODO: match indentation to avoid skipping context with '...'
   filter(ctx, text) {
-    const pattern = /^not ok \d+[\s\S]+? {2}\.\.\.\r?\n/mg;
-    const matches = text.match(pattern);
+    const matches = text.match(tapPattern);
     if (!matches) {
       return null;
     }
-    const nonFlaky = matches.filter((m) => !m.includes('# TODO :'));
+    const nonFlaky = matches.filter((m) => !m.includes(FAILURE_MARKERS.tap.todo));
     if (!nonFlaky.length) {
       return null;
     }
@@ -169,89 +188,71 @@ const FAILURE_FILTERS = [{
     );
   }
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /\[ {2}FAILED {2}\].+/g,
-      context: { index: 0, contextBefore: 5, contextAfter: 0 }
-    }];
-    return failureMatcher(CCTestFailure, patterns, ctx, text);
-  }
+  Failure: CCTestFailure,
+  patterns: [{
+    pattern: new RegExp(`${FAILURE_MARKERS.cpp.source}.+`, 'g'),
+    context: { index: 0, contextBefore: 5, contextAfter: 0 }
+  }],
 }, {
   // VS compilation error
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /error C\d+:/mg,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }];
-    return failureMatcher(BuildFailure, patterns, ctx, text);
-  }
+  Failure: BuildFailure,
+  patterns: [{
+    pattern: /error C\d+:/mg,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }],
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /java\.io\.IOException.+/g,
-      context: { index: -1, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /Build timed out/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 1 }
-    }];
-    return failureMatcher(JenkinsFailure, patterns, ctx, text);
-  }
+  Failure: JenkinsFailure,
+  patterns: [{
+    pattern: /java\.io\.IOException.+/g,
+    context: { index: -1, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /Build timed out/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 1 }
+  }],
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern:
-        /Changes not staged for commit:[\s\S]+no changes added to commit/mg,
-      context: { index: 0, contextBefore: 0, contextAfter: 0 }
-    }, {
-      pattern:
-        /error: Your local changes to the following files[\s\S]+Failed to merge in the changes./g,
-      context: { index: 0, contextBefore: 0, contextAfter: 0 }
-    }, {
-      pattern: /warning: failed to remove .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 0 }
-    }];
-    return failureMatcher(GitFailure, patterns, ctx, text);
-  }
+  Failure: GitFailure,
+  patterns: [...FAILURE_MARKERS.git.map(({ start, end }) => ({
+    pattern: new RegExp(`${start.source}[\\s\\S]+${end.source}`, 'mg'),
+    context: { index: 0, contextBefore: 0, contextAfter: 0 }
+  })), {
+    pattern: /warning: failed to remove .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 0 }
+  }],
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /ERROR: Error fetching .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /hudson\.plugins\.git\.GitException+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /Cannot rebase: .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 1 }
-    }];
-    return failureMatcher(GitFailure, patterns, ctx, text);
-  }
+  Failure: GitFailure,
+  patterns: [{
+    pattern: /ERROR: Error fetching .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /hudson\.plugins\.git\.GitException+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /Cannot rebase: .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 1 }
+  }],
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /sh: line /g,
-      context: { index: 0, contextBefore: 0, contextAfter: 1 }
-    }, {
-      pattern: /fatal error:/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 1 }
-    }, {
-      pattern: /dtrace: failed to compile script/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 1 }
-    }, {
-      pattern: /ERROR: .+/g,
-      // Pick the last one
-      context: { index: -1, contextBefore: 0, contextAfter: 5 }
-    }, {
-      // Pick the first one
-      pattern: /Error: .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }];
-    return failureMatcher(BuildFailure, patterns, ctx, text);
-  }
+  Failure: BuildFailure,
+  patterns: [{
+    pattern: /sh: line /g,
+    context: { index: 0, contextBefore: 0, contextAfter: 1 }
+  }, {
+    pattern: /fatal error:/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 1 }
+  }, {
+    pattern: /dtrace: failed to compile script/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 1 }
+  }, {
+    pattern: /ERROR: .+/g,
+    // Pick the last one
+    context: { index: -1, contextBefore: 0, contextAfter: 5 }
+  }, {
+    // Pick the first one
+    pattern: /Error: .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }],
 }, {
   filter(ctx, text) {
-    const pattern = /fatal: .+/g;
-    const matches = text.match(pattern);
+    const matches = text.match(fatalPattern);
     if (!matches) {
       return null;
     }
@@ -259,30 +260,42 @@ const FAILURE_FILTERS = [{
     return [new BuildFailure(ctx, reason)];
   }
 }, {
-  filter(ctx, text) {
-    const patterns = [{
-      pattern: /FATAL: .+/g,
-      context: { index: -1, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /make.*: write error/mg,
-      context: { index: 0, contextBefore: 0, contextAfter: 3 }
-    }, {
-      pattern: /error: .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /Makefile:.+failed/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 5 }
-    }, {
-      pattern: /make.*: .+ Error \d.*/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 3 }
-    }, {
-      pattern: /warning: failed .+/g,
-      context: { index: 0, contextBefore: 0, contextAfter: 3 }
-    }];
-    return failureMatcher(BuildFailure, patterns, ctx, text);
-  }
+  Failure: BuildFailure,
+  patterns: [{
+    pattern: /FATAL: .+/g,
+    context: { index: -1, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /make.*: write error/mg,
+    context: { index: 0, contextBefore: 0, contextAfter: 3 }
+  }, {
+    pattern: /error: .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /Makefile:.+failed/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 5 }
+  }, {
+    pattern: /make.*: .+ Error \d.*/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 3 }
+  }, {
+    pattern: /warning: failed .+/g,
+    context: { index: 0, contextBefore: 0, contextAfter: 3 }
+  }],
 }];
 
+// Share recognition patterns with streaming consumers without exposing the
+// parser's constructors, filter priority, or context-selection machinery.
+export const FAILURE_PATTERNS = {
+  infrastructure: FAILURE_FILTERS
+    .filter(({ Failure }) => Failure === InfraFailure)
+    .flatMap(({ patterns }) => patterns.map(({ pattern }) => pattern)),
+  diagnostic: [
+    ...FAILURE_FILTERS
+      .filter(({ Failure }) => Failure && Failure !== InfraFailure && Failure !== CCTestFailure)
+      .flatMap(({ patterns }) => patterns.map(({ pattern }) => pattern)),
+    fatalPattern
+  ]
+};
+
 export default class CIFailureParser {
   constructor(ctx, text) {
     this.ctx = ctx;
@@ -291,8 +304,10 @@ export default class CIFailureParser {
 
   parse() {
     const text = this.text;
-    for (const { filter } of FAILURE_FILTERS) {
-      const result = filter(this.ctx, text);
+    for (const { filter, Failure, patterns } of FAILURE_FILTERS) {
+      const result = filter
+        ? filter(this.ctx, text)
+        : failureMatcher(Failure, patterns, this.ctx, text);
       // TODO: we may want to concat certain types of failures
       if (result) {
         return result;

package/lib/ci/failure_file_scanner.js

@@ -0,0 +1,153 @@
+import { StringDecoder } from 'node:string_decoder';
+
+import { FAILURE_MARKERS, FAILURE_PATTERNS } from './ci_failure_parser.js';
+
+function createMatcher(patterns) {
+  // Preserve matching flags without sharing RegExp.lastIndex between scans.
+  const matchers = patterns.map(pattern =>
+    new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, '')));
+  return text => matchers.some(pattern => pattern.test(text));
+}
+
+const diagnostic = createMatcher(FAILURE_PATTERNS.diagnostic);
+const infrastructure = createMatcher(FAILURE_PATTERNS.infrastructure);
+const gitStart = createMatcher(FAILURE_MARKERS.git.map(({ start }) => start));
+const gitEnd = createMatcher(FAILURE_MARKERS.git.map(({ end }) => end));
+
+function fileAliases(filename) {
+  const paths = new Set([filename]);
+  if (filename.startsWith('test/')) {
+    paths.add(filename.slice(5));
+    paths.add(filename.slice(5).replace(/\.(?:js|mjs|cjs|out)$/, ''));
+  } else if (filename.startsWith('lib/')) {
+    paths.add(filename.slice(4));
+  }
+  return [...paths];
+}
+
+// Emit overlapping, normalized windows rather than buffering whole log lines.
+// Explicit line boundaries keep network chunk boundaries out of the matching rules.
+async function * logWindows(source, overlap) {
+  const decoder = new StringDecoder('utf8');
+  let tail = '';
+  let lineStart = true;
+  let afterBackslash = false;
+
+  function * consume(raw) {
+    raw = raw.replace(/\r/g, '');
+    let text = raw.replace(/\\+/g, '/');
+    if (afterBackslash && raw.startsWith('\\')) text = text.slice(1);
+    if (raw) afterBackslash = raw.endsWith('\\');
+    for (let offset = 0; offset < text.length;) {
+      const newline = text.indexOf('\n', offset);
+      const end = Math.min(offset + 8192, newline < 0 ? text.length : newline + 1);
+      const window = tail + text.slice(offset, end);
+      const lineEnd = end === newline + 1;
+      yield { text: window, lineStart, lineEnd };
+      if (lineEnd) {
+        tail = '';
+        lineStart = true;
+      } else {
+        lineStart &&= window.length <= overlap;
+        tail = window.slice(-overlap);
+      }
+      offset = end;
+    }
+  }
+
+  for await (const chunk of source) yield * consume(decoder.write(chunk));
+  yield * consume(decoder.end());
+  if (tail) yield { text: `${tail}\n`, lineStart, lineEnd: true };
+}
+
+// Each line is reduced to a filename and failure markers. Neither a giant line
+// nor a giant TAP block needs to survive in memory.
+async function * failureLines(windows, matchFile) {
+  let line = {};
+  for await (const { text, lineStart, lineEnd } of windows) {
+    line.file ??= matchFile(text, lineStart);
+    line.diagnostic ||= diagnostic(text);
+    line.infrastructure ||= infrastructure(text);
+    line.cpp ||= FAILURE_MARKERS.cpp.test(text);
+    line.tapStart ||= lineStart && FAILURE_MARKERS.tap.start.test(text);
+    line.tapEnd ||= lineEnd && FAILURE_MARKERS.tap.end.test(text);
+    line.todo ||= text.includes(FAILURE_MARKERS.tap.todo);
+    line.gitStart ||= gitStart(text);
+    line.gitEnd ||= gitEnd(text);
+    if (lineEnd) {
+      yield line;
+      line = {};
+    }
+  }
+}
+
+async function findFailure(lines) {
+  let history = [];
+  let followingLines = 0;
+  let tap = null;
+  let git = null;
+
+  for await (const line of lines) {
+    const precedingLines = history;
+    history = [...history, line.file].slice(-5);
+    if (line.tapStart) {
+      tap = {};
+      followingLines = 0;
+    }
+    if (tap) {
+      tap.file ??= line.file;
+      tap.todo ||= line.todo;
+      // A later TODO can mark this as an expected failure; wait for the ending.
+      if (line.tapEnd) {
+        if (!tap.todo && tap.file) return tap.file;
+        tap = null;
+      }
+      continue;
+    }
+
+    if (line.gitStart) git = {};
+    if (git) {
+      git.file ??= line.file;
+      if (line.gitEnd) {
+        if (git.file) return git.file;
+        git = null;
+      }
+    }
+    if (line.infrastructure || line.cpp) {
+      const before = line.cpp ? 5 : 1;
+      const file = line.file || precedingLines.slice(-before).find(Boolean);
+      if (file) return file;
+    }
+    if (line.diagnostic) followingLines = 6;
+    if (followingLines > 0) {
+      followingLines--;
+      if (line.file) return line.file;
+    }
+  }
+}
+
+export class FailureFileScanner {
+  constructor(filenames) {
+    const aliases = [...filenames].map(filename => ({ filename, paths: fileAliases(filename) }));
+    this.overlap = Math.max(256,
+      ...aliases.flatMap(({ paths }) => paths.map(path => path.length + 2)));
+    const matchers = aliases.map(({ filename, paths }) => ({
+      filename,
+      patterns: paths.map(path => {
+        const escaped = path.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        // Both delimiters must be real: a window boundary is not a path boundary.
+        return new RegExp(`[^\\w.-]${escaped}(?=[^\\w./-])`);
+      })
+    }));
+    this.matchFile = (text, lineStart) => {
+      // The start of a real log line is also a valid left delimiter.
+      if (lineStart) text = `\n${text}`;
+      return matchers.find(({ patterns }) =>
+        patterns.some(pattern => pattern.test(text)))?.filename;
+    };
+  }
+
+  scan(source) {
+    return findFailure(failureLines(logWindows(source, this.overlap), this.matchFile));
+  }
+}

package/lib/ci/resume_ci.js

@@ -0,0 +1,150 @@
+import { JobParser, CI_TYPES_KEYS } from './ci_type_parser.js';
+import { CI_CRUMB_URL } from './run_ci.js';
+import { PRBuild } from './build-types/pr_build.js';
+import { getPrURL } from '../links.js';
+import { debuglog } from '../verbosity.js';
+import { FailureFileScanner } from './failure_file_scanner.js';
+
+export class ResumePRJob {
+  constructor(cli, request, owner, repo, prid) {
+    this.cli = cli;
+    this.request = request;
+    this.owner = owner;
+    this.repo = repo;
+    this.prid = prid;
+  }
+
+  async checkFailures(jobid) {
+    const { cli, request, owner, repo, prid } = this;
+    const filenames = new Set();
+    for await (const file of request.getPullRequestFiles({ owner, repo, prid })) {
+      for (const filename of [file.filename, file.previous_filename].filter(Boolean)) {
+        filenames.add(filename);
+      }
+    }
+    const overlaps = new Set();
+    const buildRequest = Object.create(request);
+    buildRequest.json = async(...args) => {
+      const data = await request.json(...args);
+      // Inspect failed descendants even when their parent job was aborted.
+      return data?.result === 'ABORTED' ? { ...data, result: 'FAILURE' } : data;
+    };
+    // Reuse the build traversal, but consume console responses directly instead
+    // of handing whole logs to its summary parser. Serialize downloads so a
+    // match cancels this response and prevents queued logs from being opened.
+    let pending = Promise.resolve();
+    buildRequest.text = (url) => {
+      const scan = pending.then(async() => {
+        if (!filenames.size || overlaps.size) return '';
+        const scanner = new FailureFileScanner(filenames);
+        const match = await scanner.scan(request.stream(url));
+        if (match) overlaps.add(match);
+        return '';
+      });
+      pending = scan.catch(debuglog);
+      return scan;
+    };
+    const build = new PRBuild(cli, buildRequest, jobid, Infinity);
+    try {
+      await build.getResults();
+    } catch (err) {
+      debuglog(err);
+    }
+    await pending;
+    if (overlaps.size) {
+      for (const filename of [...overlaps].sort()) {
+        cli.error(filename);
+      }
+      return false;
+    }
+    return true;
+  }
+
+  async resume() {
+    const { cli, request, prid } = this;
+    let crumb;
+    cli.startSpinner('Validating Jenkins credentials');
+    try {
+      ({ crumb } = await request.json(CI_CRUMB_URL));
+      if (!crumb) {
+        throw new Error('Missing Jenkins crumb');
+      }
+    } catch (err) {
+      debuglog(err);
+      cli.stopSpinner('Jenkins credentials invalid', cli.SPINNER_STATUS.FAILED);
+      return false;
+    }
+    cli.stopSpinner('Jenkins credentials valid');
+
+    try {
+      cli.startSpinner(`Looking for CI runs for pull request ${prid}`);
+      const parser = await JobParser.fromPR(getPrURL(this), cli, request);
+      const job = parser.parse().get(CI_TYPES_KEYS.PR);
+      if (!job) {
+        cli.stopSpinner(`No CI run detected from pull request ${prid}`,
+          cli.SPINNER_STATUS.FAILED);
+        return false;
+      }
+      cli.stopSpinner(`Found PR CI job ${job.jobid}`);
+
+      const build = new PRBuild(cli, request, job.jobid, undefined,
+        'result,building,actions[_class,parameters[name,value]]');
+      const { result, building, actions = [] } = await build.getBuildData();
+      if (building || (result !== 'FAILURE' && result !== 'ABORTED')) {
+        const status = building ? 'RUNNING' : result ?? 'RUNNING';
+        cli.error(`CI job ${job.jobid} is in status ${status}, skipping resume`);
+        return false;
+      }
+      if (!actions.some(action =>
+        action._class === 'com.tikal.jenkins.plugins.multijob.MultiJobResumeBuild')) {
+        cli.error(`CI job ${job.jobid} is not resumable`);
+        return false;
+      }
+
+      const approvedSHAs = new Set(actions.flatMap(action => action.parameters ?? [])
+        .filter(parameter => parameter.name === 'COMMIT_SHA_CHECK')
+        .map(parameter => parameter.value));
+      const [approvedSHA] = approvedSHAs;
+      if (approvedSHAs.size !== 1 || typeof approvedSHA !== 'string' || !approvedSHA) {
+        cli.error(`Refusing to resume CI job ${job.jobid}: cannot determine its approved commit`);
+        return false;
+      }
+
+      cli.startSpinner('Checking failures against changed PR files');
+      if (!(await this.checkFailures(job.jobid))) {
+        cli.stopSpinner('Refusing to resume CI: failures reference files changed by this PR',
+          cli.SPINNER_STATUS.FAILED);
+        return false;
+      }
+      cli.stopSpinner('No changed PR files found in available failure details');
+
+      // Read HEAD after inspecting failures so the comparison is fresh when resuming.
+      const pr = await request.getPullRequest(getPrURL(this));
+      if (pr.head?.sha !== approvedSHA) {
+        cli.error(`Refusing to resume CI job ${job.jobid}: ` +
+          'its approved commit does not match the current PR HEAD');
+        return false;
+      }
+
+      cli.startSpinner(`Resuming PR CI job ${job.jobid}`);
+      const response = await request.fetch(`${build.jobUrl}resume`, {
+        method: 'POST',
+        headers: {
+          'Jenkins-Crumb': crumb
+        }
+      });
+      if (response.status !== 200) {
+        cli.stopSpinner(
+          `Failed to resume PR CI: ${response.status} ${response.statusText}`,
+          cli.SPINNER_STATUS.FAILED);
+        return false;
+      }
+      cli.stopSpinner('PR CI job successfully resumed');
+    } catch (err) {
+      debuglog(err);
+      cli.stopSpinner('Failed to resume CI', cli.SPINNER_STATUS.FAILED);
+      return false;
+    }
+    return true;
+  }
+}

package/lib/cli.js

@@ -154,7 +154,13 @@ export default class CLI {
       case INFO:
         symbol = info;
     }
-    this.spinner.stop(`${symbol}  ${rawText}`);
+    const text = `${symbol}  ${rawText}`;
+    if (this.spinner.isSpinning) {
+      this.spinner.stop(text);
+    } else {
+      // A nested operation may already have stopped the shared spinner.
+      this.log(text);
+    }
   }
 
   write(text) {

package/lib/prepare_security.js

@@ -1,24 +1,40 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import auth from './auth.js';
 import Request from './request.js';
 import { parsePRFromURL } from './links.js';
+import {
+  assertNewSecurityRelease,
+  getSecurityReleaseDraftPath,
+  writeSecurityReleaseDraft
+} from './security-release/draft.js';
+import {
+  buildIncludedTriagedReport,
+  getReportPRURL,
+  getMissingReportInformation,
+  groupMissingReportInformation,
+  listSecurityReleaseCandidates,
+  prepareSecurityRelease
+} from './security-release/preparation.js';
+
 import {
   NEXT_SECURITY_RELEASE_BRANCH,
-  NEXT_SECURITY_RELEASE_FOLDER,
   checkoutOnSecurityReleaseBranch,
   commitAndPushVulnerabilitiesJSON,
   validateDate,
   promptDependencies,
   getSupportedVersions,
   getReportSeverity,
-  getSummary,
   pickReport,
   confirmSecurityStep,
-  writeSecurityFile,
   SecurityRelease
 } from './security-release/security-release.js';
 
+export {
+  buildIncludedTriagedReport,
+  getMissingReportInformation,
+  groupMissingReportInformation
+} from './security-release/preparation.js';
+
 function relativeDate(date) {
   const days = Math.floor((Date.now() - date) / (1000 * 60 * 60 * 24));
   if (days < 30) return days === 1 ? '1 day ago' : `${days} days ago`;
@@ -82,79 +98,11 @@ export function getNextTuesdayReleaseDateChoices(fromDate = new Date(), count =
   return choices;
 }
 
-function getReportPRURL(report) {
-  const customFieldValues = report.relationships.custom_field_values?.data ?? [];
-  return customFieldValues[0]?.attributes?.value ?? '';
-}
-
-export function buildIncludedTriagedReport(report, options = {}) {
-  const {
-    affectedVersions = '',
-    patchAuthors = [],
-    prURL = getReportPRURL(report)
-  } = options;
-  const {
-    id,
-    attributes: { title, cve_ids = [] },
-    relationships: { reporter }
-  } = report;
-  const link = `https://hackerone.com/reports/${id}`;
-  const summaryContent = getSummary(report);
-
-  return {
-    id,
-    title,
-    cveIds: cve_ids,
-    severity: getReportSeverity(report),
-    summary: summaryContent ?? '',
-    patchAuthors,
-    prURL,
-    affectedVersions: affectedVersions
-      .split(',')
-      .map((v) => v.replace('v', '').trim())
-      .filter(Boolean),
-    link,
-    reporter: reporter?.data?.attributes?.username ?? ''
-  };
-}
-
-export function getMissingReportInformation(report) {
-  const missing = [];
-
-  if (!report.severity?.rating) missing.push('severity rating');
-  if (!report.severity?.cvss_vector_string) missing.push('CVSS vector');
-  if (!report.severity?.weakness_id) missing.push('weakness ID');
-  if (!report.summary) missing.push('team summary');
-  if (!report.prURL) missing.push('PR URL');
-  if (!report.patchAuthors?.length) missing.push('patch authors');
-  if (!report.affectedVersions?.length) missing.push('affected versions');
-
-  return missing;
-}
-
-export function groupMissingReportInformation(reports) {
-  const grouped = new Map();
-
-  for (const report of reports) {
-    for (const field of report.missing) {
-      const current = grouped.get(field) ?? [];
-      current.push(report);
-      grouped.set(field, current);
-    }
-  }
-
-  return Array.from(grouped.entries())
-    .map(([field, fieldReports]) => ({
-      field,
-      reports: fieldReports
-    }))
-    .sort((a, b) => b.reports.length - a.reports.length);
-}
-
 export default class PrepareSecurityRelease extends SecurityRelease {
   title = 'Next Security Release';
 
   async start() {
+    assertNewSecurityRelease(process.cwd());
     const credentials = await auth({
       github: true,
       h1: true
@@ -172,14 +120,15 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     const content = await this.buildDescription(releaseDate);
     if (createVulnerabilitiesJSON) {
       const reportSelectionMode = await this.promptReportSelectionMode();
+      const candidates = await listSecurityReleaseCandidates(this.req);
       if (reportSelectionMode === 'review') {
         const showTriaged = await this.promptShowTriagedWithoutPR();
         if (showTriaged) {
-          excludedReports = await this.showTriagedReportsWithoutPR();
+          excludedReports = await this.showTriagedReportsWithoutPR(candidates);
         }
       }
       await this.startVulnerabilitiesJSONCreation(
-        releaseDate, content, excludedReports, reportSelectionMode);
+        releaseDate, content, excludedReports, reportSelectionMode, candidates);
     }
 
     this.cli.ok('Done!');
@@ -251,19 +200,25 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     releaseDate,
     content,
     excludedReports = [],
-    reportSelectionMode = 'review'
+    reportSelectionMode = 'review',
+    candidates
   ) {
-    // checkout on the next-security-release branch
-    await checkoutOnSecurityReleaseBranch(this.cli, this.repository);
+    assertNewSecurityRelease(process.cwd());
 
     // choose the reports to include in the security release
     const reports = reportSelectionMode === 'include-all'
-      ? await this.includeAllTriagedReports(excludedReports)
-      : await this.chooseReports(excludedReports);
+      ? await this.includeAllTriagedReports(excludedReports, candidates)
+      : await this.chooseReports(excludedReports, candidates);
     const deps = await this.getDependencyUpdates();
+    const { release } = prepareSecurityRelease({ releaseDate, reports, dependencies: deps });
 
-    // create the vulnerabilities.json file in the security-release repo
-    const filePath = await this.createVulnerabilitiesJSON(reports, deps, releaseDate);
+    // Prepare all data before changing Git state. An existing branch may contain
+    // a draft that was not present on the branch where this command started.
+    await checkoutOnSecurityReleaseBranch(this.cli, this.repository);
+    assertNewSecurityRelease(process.cwd());
+
+    const filePath = await this.createVulnerabilitiesJSON(
+      release.reports, release.dependencies, release.releaseDate);
 
     // review the vulnerabilities.json file
     const review = await this.promptReviewVulnerabilitiesJSON();
@@ -366,11 +321,11 @@ export default class PrepareSecurityRelease extends SecurityRelease {
       { defaultAnswer: true });
   }
 
-  async showTriagedReportsWithoutPR() {
+  async showTriagedReportsWithoutPR(candidates) {
     this.cli.info('Fetching triaged reports without PR URL...');
-    const reports = await this.req.getTriagedReports();
-    const reportsWithoutPR = reports.data.filter(
-      (report) => !report.relationships.custom_field_values.data.length
+    const reports = candidates ?? await listSecurityReleaseCandidates(this.req);
+    const reportsWithoutPR = reports.filter(
+      (report) => !getReportPRURL(report)
     );
     if (!reportsWithoutPR.length) {
       this.cli.ok('All triaged reports have a PR URL.');
@@ -408,12 +363,12 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     return template;
   }
 
-  async chooseReports(excludedReports = []) {
+  async chooseReports(excludedReports = [], candidates) {
     this.cli.info('Getting triaged H1 reports...');
-    const reports = await this.req.getTriagedReports();
+    const reports = candidates ?? await listSecurityReleaseCandidates(this.req);
     const selectedReports = [];
 
-    for (const report of reports.data) {
+    for (const report of reports) {
       if (excludedReports.includes(report.id)) continue;
       const rep = await pickReport(report, { cli: this.cli, req: this.req });
       if (!rep) continue;
@@ -422,14 +377,14 @@ export default class PrepareSecurityRelease extends SecurityRelease {
     return selectedReports;
   }
 
-  async includeAllTriagedReports(excludedReports = []) {
+  async includeAllTriagedReports(excludedReports = [], candidates) {
     this.cli.info('Getting triaged H1 reports...');
-    const reports = await this.req.getTriagedReports();
+    const reports = candidates ?? await listSecurityReleaseCandidates(this.req);
     const supportedVersions = await getSupportedVersions();
     const selectedReports = [];
     const missingInformation = [];
 
-    for (const report of reports.data) {
+    for (const report of reports) {
       if (excludedReports.includes(report.id)) continue;
 
       const reportData = await this.buildIncludedTriagedReport(
@@ -497,29 +452,23 @@ export default class PrepareSecurityRelease extends SecurityRelease {
   }
 
   async createVulnerabilitiesJSON(reports, dependencies, releaseDate) {
-    this.cli.startSpinner('Creating vulnerabilities.json...');
-    const fileContent = JSON.stringify({
-      releaseDate,
-      reports,
-      dependencies
-    }, null, 2) + '\n';
-
-    const folderPath = path.resolve(NEXT_SECURITY_RELEASE_FOLDER);
-    const fullPath = path.join(folderPath, 'vulnerabilities.json');
+    const { release } = prepareSecurityRelease({ releaseDate, reports, dependencies });
+    const directory = process.cwd();
+    const fullPath = getSecurityReleaseDraftPath(directory);
+    assertNewSecurityRelease(directory);
     await confirmSecurityStep(
       this.cli,
-      `create directory \`${folderPath}\``,
+      `create directory \`${path.dirname(fullPath)}\``,
       'This creates the security release folder if it does not already exist.'
     );
-    await fs.promises.mkdir(folderPath, { recursive: true });
-    await writeSecurityFile(
+    await confirmSecurityStep(
       this.cli,
-      fullPath,
-      fileContent,
+      `write \`${fullPath}\``,
       'This creates vulnerabilities.json for the next security release.'
     );
+    this.cli.startSpinner('Creating vulnerabilities.json...');
+    writeSecurityReleaseDraft(directory, release);
     this.cli.stopSpinner(`Created ${fullPath}`);
-
     return fullPath;
   }
 

package/lib/request.js

@@ -58,6 +58,17 @@ export default class Request {
     return res.text();
   }
 
+  async * stream(url, options = {}) {
+    const res = await this.fetch(url, options);
+    if (!res.ok) {
+      await res.body?.cancel();
+      throw new Error(`Unable to stream ${url}: ${res.status} ${res.statusText}`);
+    }
+    // Undici decompresses HTTP content encodings as it reads. Returning early
+    // from this iterator also cancels the response body and its HTTP download.
+    yield * res.body;
+  }
+
   async json(url, options = {}) {
     options.headers = options.headers || {};
     const text = await this.text(url, options);
@@ -106,7 +117,10 @@ export default class Request {
       const url =
         `/repos/${owner}/${repo}/pulls/${prid}/files?per_page=100&page=${page}`;
       const batch = await this.json(url);
-      if (!Array.isArray(batch) || batch.length === 0) {
+      if (!Array.isArray(batch)) {
+        throw new Error('Unable to retrieve pull request files');
+      }
+      if (batch.length === 0) {
         break;
       }
       yield * batch;
@@ -193,22 +207,52 @@ export default class Request {
   }
 
   async getTriagedReports() {
-    const url = 'https://api.hackerone.com/v1/reports?filter[program][]=nodejs&filter[state][]=triaged';
+    let url = 'https://api.hackerone.com/v1/reports?filter[program][]=nodejs&filter[state][]=triaged';
     const options = {
       method: 'GET',
+      redirect: 'error',
       headers: {
         Authorization: `Basic ${this.credentials.h1}`,
         'User-Agent': 'node-core-utils',
         Accept: 'application/json'
       }
     };
-    const data = await this.json(url, options);
-    if (data?.errors) {
-      throw new Error(
-        `Request to fetch triaged reports failed with: ${JSON.stringify(data.errors)}`
-      );
+    const reports = [];
+    const reportIds = new Set();
+    const pages = new Set();
+    let result;
+
+    while (url) {
+      const pageUrl = new URL(url);
+      if (pageUrl.origin !== 'https://api.hackerone.com' ||
+          pageUrl.pathname !== '/v1/reports' || pageUrl.username || pageUrl.password) {
+        throw new Error('Invalid HackerOne reports pagination URL');
+      }
+      if (pages.has(pageUrl.href)) {
+        throw new Error('Repeated HackerOne reports pagination URL');
+      }
+      pages.add(pageUrl.href);
+
+      result = await this.json(url, options);
+      if (result?.errors?.length) {
+        throw new Error(
+          `Request to fetch triaged reports failed with: ${JSON.stringify(result.errors)}`
+        );
+      }
+      if (!Array.isArray(result?.data)) {
+        throw new Error('Invalid HackerOne reports response: expected a data array');
+      }
+      for (const report of result.data) {
+        if (reportIds.has(report.id)) continue;
+        reportIds.add(report.id);
+        reports.push(report);
+      }
+
+      const next = result.links?.next;
+      url = next ? new URL(next, pageUrl).href : null;
     }
-    return data;
+
+    return { ...result, data: reports };
   }
 
   async getPrograms() {

package/lib/security-release/draft.js

@@ -0,0 +1,32 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { NEXT_SECURITY_RELEASE_FOLDER } from './security-release.js';
+import { prepareSecurityRelease } from './preparation.js';
+
+export function getSecurityReleaseDraftPath(directory) {
+  if (typeof directory !== 'string' || !directory.trim()) {
+    throw new Error('Security release repository directory is required');
+  }
+  return path.resolve(directory, NEXT_SECURITY_RELEASE_FOLDER, 'vulnerabilities.json');
+}
+
+export function assertNewSecurityRelease(directory) {
+  const file = getSecurityReleaseDraftPath(directory);
+  if (fs.existsSync(file)) {
+    throw new Error(
+      `Security release draft already exists: ${file}. ` +
+      'Use --sync, --add-report, or --remove-report to update the existing release.'
+    );
+  }
+}
+
+// Local persistence only. The caller handles review, Git, and publication.
+export function writeSecurityReleaseDraft(directory, draft) {
+  const { release } = prepareSecurityRelease(draft);
+  const file = getSecurityReleaseDraftPath(directory);
+  assertNewSecurityRelease(directory);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(release, null, 2) + '\n', { flag: 'wx' });
+  return file;
+}

package/lib/security-release/preparation.js

@@ -0,0 +1,168 @@
+import { getReportSeverity, getSummary } from './security-release.js';
+
+// Request.getTriagedReports rejects failed pages rather than returning partial data.
+// Selection, metadata edits, and all mutations belong to the caller.
+export async function listSecurityReleaseCandidates(request) {
+  const { data } = await request.getTriagedReports();
+  return data;
+}
+
+export function getReportPRURL(report) {
+  const customFieldValues = report.relationships.custom_field_values?.data ?? [];
+  return customFieldValues[0]?.attributes?.value ?? '';
+}
+
+export function buildIncludedTriagedReport(report, options = {}) {
+  const {
+    affectedVersions = '',
+    patchAuthors = [],
+    prURL = getReportPRURL(report)
+  } = options;
+  const {
+    id,
+    attributes: { title, cve_ids = [] },
+    relationships: { reporter }
+  } = report;
+  const link = `https://hackerone.com/reports/${id}`;
+  const summaryContent = getSummary(report);
+
+  return {
+    id,
+    title,
+    cveIds: cve_ids,
+    severity: getReportSeverity(report),
+    summary: summaryContent ?? '',
+    patchAuthors,
+    prURL,
+    affectedVersions: affectedVersions
+      .split(',')
+      .map((v) => v.replace('v', '').trim())
+      .filter(Boolean),
+    link,
+    reporter: reporter?.data?.attributes?.username ?? ''
+  };
+}
+
+export function getMissingReportInformation(report) {
+  const missing = [];
+
+  if (!report.severity?.rating) missing.push('severity rating');
+  if (!report.severity?.cvss_vector_string) missing.push('CVSS vector');
+  if (!report.severity?.weakness_id) missing.push('weakness ID');
+  if (!report.summary) missing.push('team summary');
+  if (!report.prURL) missing.push('PR URL');
+  if (!report.patchAuthors?.length) missing.push('patch authors');
+  if (!Object.keys(report.affectedVersions ?? {}).length) missing.push('affected versions');
+
+  return missing;
+}
+
+export function groupMissingReportInformation(reports) {
+  const grouped = new Map();
+
+  for (const report of reports) {
+    for (const field of report.missing) {
+      const current = grouped.get(field) ?? [];
+      current.push(report);
+      grouped.set(field, current);
+    }
+  }
+
+  return Array.from(grouped.entries())
+    .map(([field, fieldReports]) => ({
+      field,
+      reports: fieldReports
+    }))
+    .sort((a, b) => b.reports.length - a.reports.length);
+}
+
+function normalizeReleaseDate(value) {
+  if (value === 'TBD') return value;
+  if (typeof value !== 'string' || !/^\d{4}([/-])\d{2}\1\d{2}$/.test(value)) {
+    throw new Error('Release date must be YYYY-MM-DD, YYYY/MM/DD, or TBD');
+  }
+  const date = value.replaceAll('/', '-');
+  const timestamp = Date.parse(`${date}T00:00:00Z`);
+  if (!Number.isFinite(timestamp) || new Date(timestamp).toISOString().slice(0, 10) !== date) {
+    throw new Error('Invalid release date');
+  }
+  return date;
+}
+
+function normalizeAffectedVersions(value, fallbackPR = '') {
+  if (value == null || value === '') return {};
+  if (typeof fallbackPR !== 'string') throw new Error('PR URL must be a string');
+  let entries;
+  if (typeof value === 'string' || Array.isArray(value)) {
+    const lines = typeof value === 'string' ? value.split(',') : value;
+    entries = lines.map((line) => [line, fallbackPR]);
+  } else if (typeof value === 'object') {
+    entries = Object.entries(value);
+  } else {
+    throw new Error('Affected versions must be release lines or a PR map');
+  }
+
+  const result = new Map();
+  for (const [line, prURL] of entries) {
+    if (typeof line !== 'string') throw new Error('Release line must be a string');
+    const trimmed = line.trim();
+    const match = /^v?(\d+)(?:\.x)?$/.exec(trimmed);
+    const normalized = trimmed === 'main' ? 'main' : match && `${match[1]}.x`;
+    if (!normalized) throw new Error(`Invalid release line: ${line}`);
+    if (typeof prURL !== 'string') throw new Error(`PR URL for ${normalized} must be a string`);
+    if (result.has(normalized) && result.get(normalized) !== prURL) {
+      throw new Error(`Conflicting PR URLs for ${normalized}`);
+    }
+    result.set(normalized, prURL);
+  }
+  return Object.fromEntries(result);
+}
+
+// This function only builds data. It does not fetch reports, prompt, write files,
+// change branches, commit, push, or create a pull request.
+export function prepareSecurityRelease({ releaseDate, reports, dependencies = {} }) {
+  const date = normalizeReleaseDate(releaseDate);
+  if (!Array.isArray(reports)) throw new Error('Reports must be an array');
+  if (!dependencies || typeof dependencies !== 'object' || Array.isArray(dependencies)) {
+    throw new Error('Dependencies must be an object');
+  }
+
+  const ids = new Set();
+  const selected = reports.map((report) => {
+    if (!report || typeof report.id !== 'string' || !/^\d+$/.test(report.id)) {
+      throw new Error('Report ID must be a numeric string');
+    }
+    if (ids.has(report.id)) throw new Error(`Duplicate report ID: ${report.id}`);
+    ids.add(report.id);
+    return {
+      ...structuredClone(report),
+      // A canonical patch is not evidence of a backport for every affected line.
+      affectedVersions: normalizeAffectedVersions(report.affectedVersions)
+    };
+  });
+
+  const deps = Object.fromEntries(Object.entries(dependencies).map(([name, updates]) => {
+    const normalizeUpdate = (update) => {
+      if (!update || typeof update !== 'object' || Array.isArray(update)) {
+        throw new Error(`Invalid dependency update: ${name}`);
+      }
+      return {
+        ...structuredClone(update),
+        affectedVersions: normalizeAffectedVersions(update.affectedVersions, update.prURL ?? '')
+      };
+    };
+    const normalized = Array.isArray(updates)
+      ? updates.map(normalizeUpdate)
+      : normalizeUpdate(updates);
+    return [name, normalized];
+  }));
+
+  return {
+    release: { releaseDate: date, reports: selected, dependencies: deps },
+    missingInformation: selected.flatMap((report) => {
+      const missing = getMissingReportInformation(report);
+      if (!missing.length) return [];
+      return [{ id: report.id, title: report.title, link: report.link, missing }];
+    })
+  };
+}

package/lib/security-release/security-release.js

@@ -79,10 +79,24 @@ export async function checkoutOnSecurityReleaseBranch(cli, repository) {
   cli.info(`Current branch: ${currentBranch} `);
 
   if (currentBranch !== NEXT_SECURITY_RELEASE_BRANCH) {
+    const refs = new Set(runSync('git', [
+      'for-each-ref', '--format=%(refname)',
+      `refs/heads/${NEXT_SECURITY_RELEASE_BRANCH}`,
+      `refs/remotes/origin/${NEXT_SECURITY_RELEASE_BRANCH}`
+    ]).trim().split('\n'));
+    let args;
+    if (refs.has(`refs/heads/${NEXT_SECURITY_RELEASE_BRANCH}`)) {
+      args = ['checkout', NEXT_SECURITY_RELEASE_BRANCH];
+    } else if (refs.has(`refs/remotes/origin/${NEXT_SECURITY_RELEASE_BRANCH}`)) {
+      args = ['checkout', '-b', NEXT_SECURITY_RELEASE_BRANCH,
+        '--track', `origin/${NEXT_SECURITY_RELEASE_BRANCH}`];
+    } else {
+      args = ['checkout', '-b', NEXT_SECURITY_RELEASE_BRANCH];
+    }
     await runSecurityGitCommand(
       cli,
-      ['checkout', '-B', NEXT_SECURITY_RELEASE_BRANCH],
-      `This checks out or recreates the ${NEXT_SECURITY_RELEASE_BRANCH} branch locally.`
+      args,
+      `This switches to ${NEXT_SECURITY_RELEASE_BRANCH} without resetting an existing branch.`
     );
     cli.ok(`Checkout on branch: ${NEXT_SECURITY_RELEASE_BRANCH} `);
   }
@@ -95,6 +109,22 @@ export async function commitAndPushVulnerabilitiesJSON(
 ) {
   await checkRemote(cli, repository);
 
+  const files = (Array.isArray(filePath) ? filePath : [filePath])
+    .map((file) => path.resolve(file));
+  const stagedFiles = runSync('git', ['diff', '--cached', '--name-only', '-z'])
+    .split('\0').filter(Boolean);
+  const unrelated = stagedFiles.filter((file) => {
+    const absolute = path.resolve(file);
+    return !files.some((target) =>
+      absolute === target || absolute.startsWith(`${target}${path.sep}`));
+  });
+  if (unrelated.length) {
+    throw new Error(
+      'Unrelated staged changes would be included in the security release commit: ' +
+      unrelated.join(', ') + '. Commit or unstage them before continuing.'
+    );
+  }
+
   if (Array.isArray(filePath)) {
     for (const currentPath of filePath) {
       runSync('git', ['add', currentPath]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@node-core/utils",
-  "version": "7.2.3",
+  "version": "7.3.0",
   "description": "Utilities for Node.js core collaborators",
   "type": "module",
   "engines": {