@plainconceptsplatform/workflows 0.20.2 → 0.20.3

package/loops/actions/close-agent-issues/action.yml

@@ -1,43 +1,43 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/close-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Close agent issues
-description: Close every close_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Close issues
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'close_issue');
-
-          let closed = 0;
-
-          for (const item of items) {
-            if (!item.item_number) {
-              core.warning(`close_issue item has no item_number, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: Number(item.item_number),
-              state: 'closed',
-              state_reason: item.state_reason === 'not_planned' ? 'not_planned' : 'completed',
-            });
-
-            closed += 1;
-          }
-
-          core.info(`Closed ${closed} issue(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/close-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Close agent issues
+description: Close every close_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Close issues
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'close_issue');
+
+          let closed = 0;
+
+          for (const item of items) {
+            if (!item.item_number) {
+              core.warning(`close_issue item has no item_number, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: Number(item.item_number),
+              state: 'closed',
+              state_reason: item.state_reason === 'not_planned' ? 'not_planned' : 'completed',
+            });
+
+            closed += 1;
+          }
+
+          core.info(`Closed ${closed} issue(s).`);

package/loops/actions/collect-app-errors/action.yml

@@ -0,0 +1,297 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/collect-app-errors/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Collect application errors
+description: >-
+  Ask Application Insights what the deployed application threw, group it, and file one issue per
+  distinct problem in THIS repository, labelled so the refine and implement workers pick it up.
+  Deterministic: no model runs. Nothing leaves this repository.
+
+inputs:
+  token:
+    description: Token for this repository. Needs issues:write to file anything.
+    required: true
+  workspace-id:
+    description: >-
+      The Log Analytics workspace GUID (its customerId). Empty means do nothing and say so,
+      which is what a repository with no Application Insights should get.
+    required: false
+    default: ''
+  environment:
+    description: Which deployed environment this is, as it appears in issue titles and fingerprints.
+    required: false
+    default: pre
+  lookback-hours:
+    description: How far back to look. Match the schedule, or problems are counted twice.
+    required: false
+    default: '24'
+  min-occurrences:
+    description: Below this many occurrences in the window, nothing is filed.
+    required: false
+    default: '5'
+  min-operations:
+    description: Below this many distinct operations affected, nothing is filed.
+    required: false
+    default: '1'
+  max-findings:
+    description: >-
+      The most issues one run may open. The rest are named in the job summary and picked up
+      next run, never dropped in silence.
+    required: false
+    default: '3'
+  max-open:
+    description: >-
+      Backpressure. While at least this many issues carrying the label are already open,
+      nothing new is filed.
+    required: false
+    default: '5'
+  label:
+    description: The label every issue from here carries, and the one backpressure counts.
+    required: false
+    default: app-error
+  extra-labels:
+    description: >-
+      Comma-separated labels added alongside, which is how a finding reaches the belt.
+      Empty files a bare issue that nothing picks up.
+    required: false
+    default: 'bug,refine'
+  accepted-label:
+    description: >-
+      On a closed issue, this label means the problem is known and accepted, and it is never
+      filed again.
+    required: false
+    default: error-accepted
+  own-code-prefix:
+    description: >-
+      The assembly or namespace prefix that marks a stack frame as this repository's own.
+      Empty publishes no frames at all, which loses detail rather than leaking somebody else's.
+    required: false
+    default: ''
+  dry-run:
+    description: Work out what would be filed, write it to the job summary, and file nothing.
+    required: false
+    default: 'false'
+
+outputs:
+  filed:
+    description: The issue numbers opened or updated, comma separated. Empty if nothing was.
+    value: ${{ steps.file.outputs.filed }}
+
+runs:
+  using: composite
+  steps:
+    - name: Query the workspace
+      id: query
+      if: inputs.workspace-id != ''
+      shell: bash
+      env:
+        WORKSPACE_ID: ${{ inputs.workspace-id }}
+        LOOKBACK_HOURS: ${{ inputs.lookback-hours }}
+        MIN_OCCURRENCES: ${{ inputs.min-occurrences }}
+        MAX_FINDINGS: ${{ inputs.max-findings }}
+      run: |
+        set -euo pipefail
+        # Four times the ceiling, so the grouping step can drop what is already filed or
+        # accepted and still have something left to open. Asking for exactly the ceiling
+        # means one known problem at the top of the list starves everything behind it.
+        bash "${GITHUB_ACTION_PATH}/query-app-errors.sh" \
+          "$WORKSPACE_ID" "$LOOKBACK_HOURS" "$MIN_OCCURRENCES" "$(( MAX_FINDINGS * 4 ))" \
+          "${RUNNER_TEMP}/app-errors.json"
+
+    - name: Group, redact and file
+      id: file
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        WORKSPACE_ID: ${{ inputs.workspace-id }}
+        APP_ENVIRONMENT: ${{ inputs.environment }}
+        LOOKBACK_HOURS: ${{ inputs.lookback-hours }}
+        MIN_OCCURRENCES: ${{ inputs.min-occurrences }}
+        MIN_OPERATIONS: ${{ inputs.min-operations }}
+        MAX_FINDINGS: ${{ inputs.max-findings }}
+        MAX_OPEN: ${{ inputs.max-open }}
+        LABEL: ${{ inputs.label }}
+        EXTRA_LABELS: ${{ inputs.extra-labels }}
+        ACCEPTED_LABEL: ${{ inputs.accepted-label }}
+        OWN_CODE_PREFIX: ${{ inputs.own-code-prefix }}
+        DRY_RUN: ${{ inputs.dry-run }}
+        ACTION_PATH: ${{ github.action_path }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          // No runner expressions anywhere in this block, comments included: the runner
+          // substitutes them before Node parses this, and CI rejects the file if it finds one.
+          const path = require('node:path');
+          const fs = require('node:fs');
+          const { pathToFileURL } = require('node:url');
+
+          const workspaceId = process.env.WORKSPACE_ID ?? '';
+          const environment = process.env.APP_ENVIRONMENT ?? 'pre';
+          const lookbackHours = process.env.LOOKBACK_HOURS ?? '24';
+          const label = process.env.LABEL ?? 'app-error';
+          const acceptedLabel = process.env.ACCEPTED_LABEL ?? 'error-accepted';
+          const extraLabels = (process.env.EXTRA_LABELS ?? '').split(',').map((n) => n.trim()).filter(Boolean);
+          const maxFindings = Number(process.env.MAX_FINDINGS ?? '3');
+          const maxOpen = Number(process.env.MAX_OPEN ?? '5');
+          const dryRun = process.env.DRY_RUN === 'true';
+
+          const summary = core.summary.addHeading('Application errors', 2);
+          const done = async (lines) => {
+            await summary.addList(lines).write();
+            core.setOutput('filed', '');
+          };
+
+          // A repository with no Application Insights installed this by accident, or has not
+          // been configured yet. A warning and a green run, never a failure: a red run every
+          // morning is how a workflow gets switched off for good.
+          if (!workspaceId) {
+            core.warning('No workspace was given, so nothing was queried. Set the workspace id, or uninstall this workflow.');
+            return done(['No workspace configured. Nothing was queried.']);
+          }
+
+          const rowsPath = path.join(process.env.RUNNER_TEMP, 'app-errors.json');
+          const rows = fs.existsSync(rowsPath) ? JSON.parse(fs.readFileSync(rowsPath, 'utf8')) : [];
+          if (rows.length === 0) {
+            return done([`Nothing was thrown in the last ${lookbackHours}h in ${environment}. Good.`]);
+          }
+
+          // The real module, imported rather than restated. It is a file precisely so it can be
+          // executed by its own tests; inlining it here would put it back out of reach.
+          const grouping = await import(pathToFileURL(path.join(process.env.ACTION_PATH, 'group-and-redact.mjs')).href);
+
+          const outcome = grouping.prepare(rows, {
+            environment,
+            lookbackHours,
+            ownCodePrefix: process.env.OWN_CODE_PREFIX ?? '',
+            minOccurrences: Number(process.env.MIN_OCCURRENCES ?? '5'),
+            minOperations: Number(process.env.MIN_OPERATIONS ?? '1'),
+          });
+
+          // A field nobody agreed to publish is a change to the module that got past review.
+          // Nothing is filed, because the new field is probably on all of them.
+          if (outcome.refused) {
+            core.setFailed(`Nothing was filed: ${outcome.refused}.`);
+            return;
+          }
+
+          const open = await github.paginate(github.rest.issues.listForRepo, {
+            ...context.repo, state: 'open', labels: label, per_page: 100,
+          });
+
+          // Backpressure, the audit's rule in a workflow that cannot use skip-if-match:
+          // do not pile reports on top of reports nobody has actioned.
+          if (open.length >= maxOpen) {
+            return done([
+              `${open.length} issue(s) labelled \`${label}\` are already open, which is the limit.`,
+              'Nothing new was filed. Close or accept some, and the next run will carry on.',
+            ]);
+          }
+
+          // Made before anything is filed. A label that does not exist yet is a 422 on the
+          // create, which reads as "the issue could not be filed" and sends whoever is
+          // debugging it looking at permissions.
+          for (const name of [label, acceptedLabel, ...extraLabels]) {
+            try {
+              await github.rest.issues.getLabel({ ...context.repo, name });
+            } catch (missing) {
+              if (missing.status !== 404) { throw missing; }
+              if (dryRun) { continue; }
+              await github.rest.issues.createLabel({
+                ...context.repo, name, color: 'd73a4a',
+                description: 'Filed automatically from Application Insights.',
+              });
+            }
+          }
+
+          const marker = (fingerprint) => `<!-- pcp-app-error: ${fingerprint} -->`;
+
+          // Everything ever filed from here, open or closed. Closed matters as much as open:
+          // it is how "we know, leave it" and "this came back" are told apart.
+          const seen = await github.paginate(github.rest.issues.listForRepo, {
+            ...context.repo, state: 'all', labels: label, per_page: 100,
+          });
+          const find = (fingerprint) => seen.find((issue) => (issue.body ?? '').includes(marker(fingerprint)));
+
+          const today = new Date().toISOString().slice(0, 10);
+          const filed = [];
+          const notes = [];
+          let opened = 0;
+
+          for (const report of outcome.prepared) {
+            const existing = find(report.fingerprint);
+            const accepted = existing
+              && (existing.labels ?? []).some((l) => (typeof l === 'string' ? l : l.name) === acceptedLabel);
+
+            // Somebody looked at this and said it is fine. That decision does not expire.
+            if (existing && existing.state === 'closed' && accepted) {
+              notes.push(`\`${report.fingerprint}\` is accepted (#${existing.number}); left alone.`);
+              continue;
+            }
+
+            const line = `- ${today}: ${report.occurrences} in the last ${lookbackHours}h`;
+
+            if (existing && existing.state === 'open') {
+              if (!dryRun) {
+                await github.rest.issues.createComment({
+                  ...context.repo, issue_number: existing.number, body: line,
+                });
+              }
+              filed.push(existing.number);
+              notes.push(`\`${report.fingerprint}\` still happening; noted on #${existing.number}.`);
+              continue;
+            }
+
+            // Closed, and not accepted. It came back. Reopening keeps the history of what was
+            // tried last time, which is most of what makes the second attempt cheaper.
+            if (existing) {
+              if (!dryRun) {
+                await github.rest.issues.update({
+                  ...context.repo, issue_number: existing.number, state: 'open',
+                });
+                await github.rest.issues.createComment({
+                  ...context.repo,
+                  issue_number: existing.number,
+                  body: `This was closed and has come back.\n${line}`,
+                });
+              }
+              filed.push(existing.number);
+              notes.push(`\`${report.fingerprint}\` regressed; reopened #${existing.number}.`);
+              continue;
+            }
+
+            // The ceiling applies only to new issues. Commenting on one that already exists is
+            // not noise, and stopping early would hide a problem that is getting worse.
+            if (opened >= maxFindings) {
+              notes.push(`\`${report.fingerprint}\` (${report.occurrences}) waits for the next run: the ceiling is ${maxFindings}.`);
+              continue;
+            }
+
+            if (!dryRun) {
+              const created = await github.rest.issues.create({
+                ...context.repo,
+                title: report.title,
+                body: report.body,
+                labels: [label, ...extraLabels],
+              });
+              filed.push(created.data.number);
+              notes.push(`\`${report.fingerprint}\` filed as #${created.data.number}.`);
+            } else {
+              notes.push(`\`${report.fingerprint}\` would be filed: ${report.title}`);
+            }
+
+            opened += 1;
+          }
+
+          for (const held of outcome.withheld) {
+            core.error(`A report was withheld: the leak scanner matched ${held.matched.join('; ')}.`);
+          }
+
+          await summary
+            .addRaw(dryRun ? '\n_Dry run: nothing was filed._\n' : '')
+            .addList(notes.length > 0 ? notes : ['Nothing to report.'])
+            .write();
+
+          core.setOutput('filed', filed.join(','));
+
+          // Red only after everything clean has been filed. A single unlucky operation name
+          // must not mean the belt never hears about anything again.
+          if (outcome.withheld.length > 0) {
+            core.setFailed(`${outcome.withheld.length} report(s) were withheld by the leak scanner; fix the field that carried private text.`);
+          }

package/loops/actions/collect-app-errors/group-and-redact.mjs

@@ -0,0 +1,252 @@
+// Managed by @plainconceptsplatform/workflows. Source: loops/actions/collect-app-errors/group-and-redact.mjs. Update with workflows update --force; consumer edits may be overwritten.
+//
+// Turn rows from an Application Insights query into findings that are safe to write into an
+// issue, or refuse.
+//
+// A module rather than a block of JavaScript inside an `action.yml`, and that is the point.
+// The logic in `report-workflow-errors/action.yml` lives inside a `script:` string, so nothing
+// can execute it and its tests are greps over the file. This one runs, so its tests run it,
+// and the "replay real history" pass can be done on a laptop with no Azure at all.
+//
+// Pure: rows in, findings out. It reads no environment, opens no socket and files nothing.
+
+import { createHash } from "node:crypto";
+
+/**
+ * The only fields that may reach an issue body. Anything else means nothing is filed.
+ *
+ * The same shape the workflow-error report uses, for the same reason: a redaction rule is a
+ * filter over values and it cannot see a field somebody adds next year. An allowlist can.
+ *
+ * `run_id` is deliberately absent. It is the one unhashed identifier on this telemetry and it
+ * joins to a conversation and to a person, so putting it in an issue is a decision somebody
+ * has to take on purpose rather than by adding a line here.
+ */
+export const FINDING_FIELDS = [
+  "exceptionType",
+  "problemId",
+  "operationName",
+  "roleName",
+  "occurrences",
+  "operations",
+  "firstSeen",
+  "lastSeen",
+  "frames",
+  "fingerprint",
+];
+
+/**
+ * What must never appear in a finding.
+ *
+ * Narrower than the upstream report's scanner, because the audience is different: this issue
+ * is filed in the private repository the application belongs to, so its own name is not a
+ * leak. What is still a leak is anything that identifies a customer, anything that would let
+ * a reader join this back to one person's conversation, and any credential.
+ */
+export const LEAK_CHECKS = [
+  { what: "a GUID", test: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i },
+  { what: "a connection or instrumentation string", test: /(InstrumentationKey|IngestionEndpoint|AccountKey|SharedAccessKey|Password)\s*=/i },
+  { what: "a bearer token or long secret", test: /\b(eyJ[A-Za-z0-9_-]{10,}|gh[pousr]_[A-Za-z0-9]{20,}|[A-Za-z0-9+/]{60,}={0,2})\b/ },
+  { what: "an absolute path", test: /(^|[\s"'(])(\/home\/|\/Users\/|\/root\/|\/mnt\/|\/var\/|[A-Za-z]:\\)/ },
+  { what: "an email address", test: /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/ },
+  { what: "a URL with a query string", test: /https?:\/\/\S+\?\S+/ },
+];
+
+/**
+ * What is masked on the way in, before anything is rendered or scanned.
+ *
+ * Scrubbing rather than refusing, for the things that are both common and safely
+ * replaceable. An operation name that carries a GUID is ordinary -- a route that was never
+ * templated, a queue name with an id in it -- and refusing the whole run over one would be a
+ * workflow that is red every morning and files nothing, which is worse than one that says
+ * `{guid}`. The scanner below is still there for whatever this does not catch.
+ */
+export const SCRUBS = [
+  [/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "{guid}"],
+  [/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g, "{email}"],
+  [/(\/home\/|\/Users\/|\/root\/|\/mnt\/|\/var\/)[^\s"'),]*/g, "{path}"],
+  [/[A-Za-z]:\\[^\s"'),]*/g, "{path}"],
+  [/(https?:\/\/[^\s"'),?]+)\?[^\s"'),]*/g, "$1?{query}"],
+];
+
+/** How long a single message may be before it is cut. */
+export const MAX_MESSAGE_LENGTH = 300;
+
+/** How many stack frames are worth reading in an issue. */
+export const MAX_FRAMES = 8;
+
+/**
+ * A stable name for one problem, so the same error tomorrow finds today's issue.
+ *
+ * The environment is in it on purpose: the same exception in pre and in pro are two different
+ * pieces of news, and one closing should not silence the other.
+ */
+export function fingerprint(problemId, operationName, environment) {
+  return createHash("sha256")
+    .update(`${problemId}|${operationName}|${environment}`)
+    .digest("hex")
+    .slice(0, 12);
+}
+
+/**
+ * The frames that belong to us.
+ *
+ * `Details[].parsedStack` carries our own assemblies mixed in with the framework's and with
+ * whatever a package vendored. An empty prefix returns nothing at all, which is the safe
+ * direction: a consumer that has not said which code is its own loses the stack rather than
+ * publishing somebody else's file paths.
+ */
+export function ownFrames(details, prefix) {
+  if (!prefix) {
+    return [];
+  }
+
+  const stacks = (Array.isArray(details) ? details : []).flatMap((detail) =>
+    Array.isArray(detail?.parsedStack) ? detail.parsedStack : []);
+
+  return stacks
+    .filter((frame) => typeof frame?.method === "string" && frame.method.startsWith(prefix))
+    // The method alone. `frame.fileName` is an absolute path from the build machine and
+    // `frame.line` without it says nothing, so neither is worth the risk.
+    .map((frame) => clip(frame.method))
+    .slice(0, MAX_FRAMES);
+}
+
+/** Masks everything in SCRUBS. Applied to every string before it is rendered or scanned. */
+export function scrub(value) {
+  return SCRUBS.reduce((text, [pattern, replacement]) => text.replace(pattern, replacement), value);
+}
+
+/**
+ * One field, ready to publish: whitespace flattened, masked, and cut.
+ *
+ * Scrubbed after flattening and before cutting, so a pattern cannot be split across a line
+ * break and survive, and a cut cannot leave half a GUID behind looking like ordinary hex.
+ */
+export function clip(value) {
+  const text = scrub(String(value ?? "").replace(/\s+/g, " ").trim());
+  return text.length <= MAX_MESSAGE_LENGTH ? text : `${text.slice(0, MAX_MESSAGE_LENGTH)}…`;
+}
+
+/**
+ * Whether every field on this finding is one we agreed to publish.
+ *
+ * Returns the offending names rather than a boolean, so the caller can say which field
+ * stopped the run instead of "something did".
+ */
+export function unexpectedFields(finding) {
+  return Object.keys(finding).filter((key) => !FINDING_FIELDS.includes(key));
+}
+
+/** Which leak checks a piece of text trips. Empty means it is safe to write. */
+export function leaks(text) {
+  return LEAK_CHECKS.filter((check) => check.test.test(text)).map((check) => check.what);
+}
+
+/**
+ * Rows from the query, as findings.
+ *
+ * Ordered by how often it happened, because that is the order somebody would want to fix
+ * them in, and the ceiling is applied by the caller so the ones left over can be named
+ * rather than silently dropped.
+ */
+export function toFindings(rows, { environment, ownCodePrefix = "", minOccurrences = 1, minOperations = 1 } = {}) {
+  return (Array.isArray(rows) ? rows : [])
+    .map((row) => ({
+      exceptionType: clip(row.ExceptionType),
+      problemId: clip(row.ProblemId),
+      operationName: clip(row.OperationName),
+      roleName: clip(row.AppRoleName),
+      occurrences: Number(row.Occurrences) || 0,
+      operations: Number(row.Operations) || 0,
+      firstSeen: clip(row.FirstSeen),
+      lastSeen: clip(row.LastSeen),
+      frames: ownFrames(row.AnyDetails, ownCodePrefix),
+      fingerprint: fingerprint(clip(row.ProblemId), clip(row.OperationName), environment),
+    }))
+    .filter((finding) => finding.occurrences >= minOccurrences && finding.operations >= minOperations)
+    .sort((first, second) => second.occurrences - first.occurrences);
+}
+
+/**
+ * The issue this finding becomes.
+ *
+ * The marker is the first line, which is what the dedupe searches for, and the body says
+ * plainly that a machine wrote it: somebody reading this in six months should not have to
+ * work out whether a person investigated.
+ */
+export function render(finding, { environment, lookbackHours, ownCodePrefix = "" }) {
+  const marker = `<!-- pcp-app-error: ${finding.fingerprint} -->`;
+  const title = `${finding.exceptionType} in ${finding.operationName || finding.roleName || environment}`;
+
+  const body = [
+    marker,
+    `**${finding.occurrences} occurrence(s)** in the last ${lookbackHours}h in \`${environment}\`, across ${finding.operations} operation(s).`,
+    "",
+    `- Exception: \`${finding.exceptionType}\``,
+    `- Operation: \`${finding.operationName || "(none recorded)"}\``,
+    `- Role: \`${finding.roleName || "(none recorded)"}\``,
+    `- First seen: ${finding.firstSeen}`,
+    `- Last seen: ${finding.lastSeen}`,
+    finding.frames.length > 0
+      ? `\n**Our own frames, outermost first**\n\n\`\`\`\n${finding.frames.join("\n")}\n\`\`\``
+      : ownCodePrefix
+        // The prefix is set and nothing matched: every frame belongs to the framework or to a
+        // dependency. Routine for an exception raised inside framework code -- a cancelled task
+        // is the common one -- and nothing for the reader to go and configure.
+        ? `\n_No frame in this exception belongs to \`${clip(ownCodePrefix)}\`: all of them are the framework's or a dependency's. That is usual for an exception thrown inside framework code, such as a cancelled task._`
+        // No prefix, so no frame can be recognised as this repository's own and the
+        // stack is dropped rather than publishing somebody else's file paths.
+        : "\n_No stack frames are shown: this repository has not said which assemblies are its own. Set `OWN_CODE_PREFIX` in the workflow to name them._",
+    "",
+    "---",
+    "",
+    "Filed automatically from Application Insights. Nothing here was read by a model, and no",
+    "identifier that joins back to a person is included, so the reproduction is still somebody's",
+    "to work out. Close this with the `error-accepted` label to stop it being filed again.",
+  ].join("\n");
+
+  return { title, body, marker };
+}
+
+/**
+ * Everything the caller needs, and what it must complain about.
+ *
+ * Two different failures, handled two different ways.
+ *
+ * A field nobody agreed to publish is a change to this file that got past review, and it
+ * stops everything: `refused`, nothing prepared, nothing filed. One report is not worth the
+ * risk that the new field is on all of them.
+ *
+ * A body that still trips the scanner after scrubbing is one bad row. That report is
+ * withheld and the others are prepared as usual, because a single unlucky operation name
+ * must not mean the belt never hears about anything again. The caller files what it has and
+ * then goes red, naming what was withheld -- the same shape the workflow-error report uses.
+ */
+export function prepare(rows, options) {
+  const findings = toFindings(rows, options);
+  const prepared = [];
+  const withheld = [];
+
+  for (const finding of findings) {
+    const unexpected = unexpectedFields(finding);
+    if (unexpected.length > 0) {
+      return {
+        refused: `a finding carries ${unexpected.join(", ")}, which is not in the reportable field list`,
+        prepared: [],
+        withheld: [],
+      };
+    }
+
+    const issue = render(finding, options);
+    const tripped = leaks(`${issue.title}\n${issue.body}`);
+    if (tripped.length > 0) {
+      withheld.push({ fingerprint: finding.fingerprint, matched: tripped });
+      continue;
+    }
+
+    prepared.push({ ...issue, fingerprint: finding.fingerprint, occurrences: finding.occurrences });
+  }
+
+  return { refused: "", prepared, withheld };
+}