@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/pull-reviews.ts

@@ -0,0 +1,205 @@
+// What an open pull request's reviews say, as the code viewer's Pull requests
+// tab and a pull request's popup show it (repository-issues.ts): who
+// reviewed it and how, each by their latest review and the commit it was on,
+// its author's own aside (the replies GitHub makes reviews of in a thread);
+// whose review is requested, and how many more than those read; its review
+// threads open and resolved, the latest read (open ones are, mostly, those
+// lately opened), the gravest open one by the P0–P3 badge Codex marks a
+// finding with; and
+// Codex's own, which it keeps in a comment of its own (its summary, edited in
+// place) rather than in reviews, reviewing only where it finds something:
+// the commit its code review and its security review were last on, either
+// one still running, asked for again since, or failed since. A review an
+// agentic workflow (gh-aw) posted, as GitHub Actions' bot, names its
+// workflow by the marker gh-aw leaves (`<!-- gh-aw-workflow-id: NAME -->`), in
+// the popup, which reads reviews' bodies.
+import { githubAgent } from '../common/managed/github-agents.ts'
+import { ACTOR, type GraphAccount, actorOf } from './github-accounts.ts'
+
+const REVIEWERS = 20
+const REQUESTS = 10
+// The threads the Pull requests tab counts, and those a popup lists.
+export const TILE_THREADS = 50
+export const ITEM_THREADS = 100
+// The comments read for Codex's: its summary among the first, posted as the
+// pull request opens, or among the last, where it was first asked later;
+// asking it again, and its failures, among the last.
+const FIRST_COMMENTS = 5
+const LAST_COMMENTS = 20
+const MAX_TITLE = 200
+const MAX_PATH = 1000
+const COMMIT = /^[a-f\d]{40}$/u
+
+// The fields a pull request's reviews are read by, its threads' places and
+// links with them for its popup (`detail`). A team requested is no reviewer
+// read, but one of those requested GitHub names no one for: reading a team
+// needs its organization's Members permission, and a query reading one
+// without it fails whole (as one naming an EnterpriseTeam, which GitHub's
+// docs name and its API knows none of, does).
+export const reviewFields = (threads: number, detail: boolean) => `headRefOid
+  latestReviews(first: ${REVIEWERS}) { totalCount nodes { author { ${ACTOR} } state submittedAt commit { oid }${detail ? ' body' : ''} } }
+  reviewRequests(first: ${REQUESTS}) { totalCount nodes { requestedReviewer { __typename ... on User { login databaseId } ... on Bot { login databaseId }
+    ... on Mannequin { login databaseId } } } }
+  reviewThreads(last: ${threads}) { totalCount nodes { isResolved isOutdated${detail ? ' path line originalLine' : ''}
+    comments(first: 1) { nodes { author { ${ACTOR} } body${detail ? ' url' : ''} } } } }
+  firstComments: comments(first: ${FIRST_COMMENTS}) { nodes { author { ${ACTOR} } body updatedAt } }
+  lastComments: comments(last: ${LAST_COMMENTS}) { nodes { author { ${ACTOR} } body createdAt updatedAt } }`
+
+// The fields read for reviews that GitHub may refuse alone, as it refuses an
+// App a pull request's checks: their pull request then shows no reviews.
+const REVIEW_PATHS = new Set(['latestReviews', 'reviewRequests', 'reviewThreads', 'firstComments', 'lastComments'])
+export const reviewsRefused = (error: { type?: unknown; path?: unknown } | null | undefined) => error?.type === 'FORBIDDEN' && Array.isArray(error.path)
+  && error.path.some(part => REVIEW_PATHS.has(part as string))
+
+type Comment = { author?: GraphAccount; body?: unknown; updatedAt?: unknown; createdAt?: unknown } | null
+type Thread = { isResolved?: unknown; isOutdated?: unknown; path?: unknown; line?: unknown; originalLine?: unknown
+  comments?: { nodes?: (Comment & { url?: unknown })[] } | null } | null
+export type ReviewNode = {
+  headRefOid?: unknown
+  latestReviews?: { totalCount?: unknown; nodes?: ({ author?: GraphAccount; state?: unknown; submittedAt?: unknown; commit?: { oid?: unknown } | null; body?: unknown } | null)[] } | null
+  reviewRequests?: { totalCount?: unknown; nodes?: ({ requestedReviewer?: { __typename?: unknown; login?: unknown; databaseId?: unknown } | null } | null)[] } | null
+  reviewThreads?: { totalCount?: unknown; nodes?: Thread[] } | null
+  firstComments?: { nodes?: Comment[] } | null
+  lastComments?: { nodes?: Comment[] } | null
+}
+
+const STATES: Record<string, string> = { APPROVED: 'approved', CHANGES_REQUESTED: 'changes', COMMENTED: 'commented', DISMISSED: 'dismissed' }
+const CODEX_STATES: Record<string, string> = { completed: 'done', running: 'running', queued: 'running', pending: 'running', in_progress: 'running', failed: 'failed', error: 'failed' }
+const SEVERITY = /!\[(P[0-3]) Badge\]/u
+const SUMMARY = /<!--\s*codex-review-state:v1\s+(\{[^]*?\})\s*-->/u
+// Asking it to review again reruns its code review alone, never its security review.
+const ASKED = /^@codex\s+review\b/iu
+const FAILED = /^Codex Review: Something went wrong/u
+const WORKFLOW = /<!--\s*gh-aw-workflow-id:\s*([\w.-]{1,100})\s*-->/u
+
+const timeOf = (value: unknown) => {
+  const at = typeof value === 'string' ? Date.parse(value) : Number.NaN
+  return Number.isSafeInteger(at) ? at : null
+}
+const commitOf = (value: unknown) => typeof value === 'string' && COMMIT.test(value.toLowerCase()) ? value.toLowerCase() : null
+const textOf = (value: unknown) => typeof value === 'string' ? value : ''
+const isCodex = (account: GraphAccount) => {
+  const { login, id } = actorOf(account)
+  return login !== null && githubAgent(login, id) === 'codex'
+}
+
+// A finding's gravity, by its badge, `p0` the gravest; null for none.
+const severityOf = (body: string) => SEVERITY.exec(body.slice(0, 500))?.[1]?.toLowerCase() ?? null
+// A thread's title: its first comment's first line with words, as written,
+// but for Codex's badge and emphasis.
+function titleOf(body: string) {
+  for (const line of body.split('\n', 6)) {
+    const words = line.replaceAll(/!\[[^\]]*\]\([^)]*\)|<\/?sub>|\*\*|__/gu, '').trim()
+    if (words) return words.slice(0, MAX_TITLE)
+  }
+  return ''
+}
+
+// Codex's review of one kind, as its summary names it: the commit it was
+// last on and how it stands.
+function codexReview(value: unknown) {
+  const review = value && typeof value === 'object' ? value as { commit_sha?: unknown; status?: unknown } : null
+  if (!review) return null
+  return { commit: commitOf(review.commit_sha), status: CODEX_STATES[String(review.status)] ?? null }
+}
+
+// What Codex's summary says of its reviews, else null.
+function summaryState(body: string): { code_review?: unknown; security_review?: unknown } | null {
+  try {
+    const value: unknown = JSON.parse(SUMMARY.exec(body)?.[1] ?? 'null')
+    return value && typeof value === 'object' ? value : null
+  } catch { return null }
+}
+
+// Codex's reviews, from its summary, else none: its account, as the summary
+// names it; whether it was asked again since the summary last changed
+// (`@codex review`), and whether it failed since it was last asked.
+function codexOf(node: ReviewNode) {
+  const summary = [...node.firstComments?.nodes ?? [], ...node.lastComments?.nodes ?? []]
+    .find(comment => comment && isCodex(comment.author) && SUMMARY.test(textOf(comment.body)))
+  if (!summary) return null
+  const state = summaryState(textOf(summary.body))
+  if (!state) return null
+  const since = timeOf(summary.updatedAt) ?? 0
+  const later = (node.lastComments?.nodes ?? []).filter(comment => comment && (timeOf(comment.createdAt) ?? 0) > since) as NonNullable<Comment>[]
+  const at = (comment: NonNullable<Comment> | undefined) => comment ? timeOf(comment.createdAt) ?? 0 : null
+  const asked = at(later.findLast(comment => !isCodex(comment.author) && ASKED.test(textOf(comment.body).trim())))
+  const failed = at(later.findLast(comment => isCodex(comment.author) && FAILED.test(textOf(comment.body).trim())))
+  const { login, id } = actorOf(summary.author)
+  return { login, id, code: codexReview(state.code_review), security: codexReview(state.security_review),
+    requested: asked !== null && !(failed !== null && failed > asked), failed: failed !== null && (asked === null || failed > asked) }
+}
+
+type Reviewer = { login: string | null; id: number | null; workflow?: string; state: string | null; requested: boolean; commit: string | null; at: number | null }
+
+// The reviewers, each once: by their latest review, its state and commit;
+// whose is requested (again, for one who reviewed), a user, a bot (Copilot's
+// code review, asked for, is its bot's) or an imported account's mannequin.
+// Codex's reviews are its summary's where it has one (`codex`). How many
+// requested GitHub named no one for, a team among them, as `unnamed`,
+// counted with those past the ones read.
+function reviewersOf(node: ReviewNode, author: string | null, codex: boolean) {
+  const own = author?.toLowerCase()
+  const reviewers: Reviewer[] = (node.latestReviews?.nodes ?? []).flatMap(review => {
+    const { login, id } = actorOf(review?.author)
+    const state = STATES[String(review?.state)]
+    if (!state || (login !== null && login.toLowerCase() === own) || (codex && isCodex(review?.author))) return []
+    const workflow = WORKFLOW.exec(textOf(review?.body))?.[1]
+    return [{ login, id, ...workflow ? { workflow } : {}, state, requested: false, commit: commitOf(review?.commit?.oid), at: timeOf(review?.submittedAt) }]
+  })
+  let unnamed = 0
+  for (const request of node.reviewRequests?.nodes ?? []) {
+    const reviewer = request?.requestedReviewer
+    const { login, id } = actorOf(reviewer)
+    if (login === null) {
+      unnamed++
+      continue
+    }
+    // By their account where both name it, as GitHub may name one account
+    // otherwise on its reviews than on its requests (Copilot's code review's
+    // bot); else by their login.
+    const reviewed = reviewers.find(item => id !== null && item.id !== null ? item.id === id : item.login?.toLowerCase() === login.toLowerCase())
+    if (reviewed) reviewed.requested = true
+    else reviewers.push({ login, id, state: null, requested: true, commit: null, at: null })
+  }
+  return { reviewers, unnamed }
+}
+
+// Its review threads, the latest read: how many are open and resolved,
+// whether more than those read are, the gravest open one; and, for its popup (`detail`), each
+// open one: its gravity, title, file and line, whether its code changed
+// since, who opened it and where it is on GitHub.
+function threadsOf(node: ReviewNode, detail: boolean) {
+  const threads = (node.reviewThreads?.nodes ?? []).filter(Boolean) as NonNullable<Thread>[]
+  const open = threads.filter(thread => thread.isResolved !== true)
+  const severities = open.map(thread => severityOf(textOf(thread.comments?.nodes?.[0]?.body))).filter(Boolean) as string[]
+  const total = node.reviewThreads?.totalCount
+  const counted = { open: open.length, resolved: threads.length - open.length,
+    more: Number.isSafeInteger(total) && (total as number) > threads.length, severity: severities.toSorted()[0] ?? null }
+  if (!detail) return counted
+  return { ...counted, list: open.map(thread => {
+    const first = thread.comments?.nodes?.[0]
+    const body = textOf(first?.body)
+    const opener = actorOf(first?.author)
+    const line = Number.isSafeInteger(thread.line) ? thread.line : Number.isSafeInteger(thread.originalLine) ? thread.originalLine : null
+    const url = typeof first?.url === 'string' && first.url.startsWith('https://github.com/') ? first.url : null
+    return { severity: severityOf(body), title: titleOf(body), path: typeof thread.path === 'string' ? thread.path.slice(0, MAX_PATH) : null, line,
+      outdated: thread.isOutdated === true, author: opener.login, authorId: opener.id, url }
+  }) }
+}
+
+// A pull request's reviews (`author` its author's login), for its tile or,
+// with its threads listed, its popup (`detail`); null where none was read, or
+// GitHub refused its reviews, requests or threads (reviewsRefused), rather
+// than none.
+export function pullReviews(node: ReviewNode, author: string | null, detail = false) {
+  if (node.headRefOid === undefined || node.latestReviews === null || node.reviewRequests === null || node.reviewThreads === null) return null
+  const codex = codexOf(node)
+  // Those past the reviews and the requests read, as many as GitHub counts,
+  // apart: a review unread may be on the latest commit, a request never is.
+  const past = (connection: { totalCount?: unknown; nodes?: unknown[] } | null | undefined) => Number.isSafeInteger(connection?.totalCount)
+    ? Math.max(0, (connection!.totalCount as number) - (connection!.nodes?.length ?? 0)) : 0
+  const { reviewers, unnamed } = reviewersOf(node, author, codex !== null)
+  return { head: commitOf(node.headRefOid), reviewers, moreReviews: past(node.latestReviews), moreRequests: past(node.reviewRequests) + unnamed,
+    threads: threadsOf(node, detail), codex }
+}

package/server-managed/release-commits.ts

@@ -0,0 +1,84 @@
+// The commits that release a repository, for its Pulse (repository-pulse.ts
+// commitStats): one a tag names that changes no code, only package.json
+// files (at least one, in any directory), the lockfiles beside them
+// (RELEASE_LOCKFILES) and changelogs written in Markdown (RELEASE_CHANGELOG,
+// a changeset's file among them), as `npm version` and a release's tooling
+// leave one. What each commit changes is read as Replay reads it, kept by
+// the commit (repository-changes.ts repositoryChanges).
+import { type ChangesStore, type CommitChanges, repositoryChanges } from './repository-changes.ts'
+import { githubGraphql } from './repository-history.ts'
+
+// The tags read, a page a query, the latest commits' first, as many pages as
+// TAG_PAGES; of the commits they name, as many as RELEASES_READ have their
+// files read.
+const TAG_PAGE = 100
+const TAG_PAGES = 5
+const RELEASES_READ = 200
+// An annotated tag's target, its own target in turn, through as many as
+// TAG_DEPTH annotated tags.
+const TAG_DEPTH = 3
+const SHA = /^[a-f\d]{40}$/u
+const RELEASE_LOCKFILES = new Set(['package-lock.json', 'npm-shrinkwrap.json', 'pnpm-lock.yaml', 'yarn.lock', 'bun.lock', 'bun.lockb'])
+const RELEASE_CHANGELOG = /^(?:changelog|changes|history|news|releases?)(?:[._-][^/]*)?\.(?:md|markdown)$/iu
+const CHANGESET = /(?:^|\/)\.changeset\/[^/]+\.md$/iu
+
+const tagTarget = (depth: number): string => `target { __typename oid ... on Commit { committedDate }${depth > 0 ? ` ... on Tag { ${tagTarget(depth - 1)} }` : ''} }`
+const TAGS_QUERY = `query($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    refs(refPrefix: "refs/tags/", first: ${TAG_PAGE}, after: $after, orderBy: { field: TAG_COMMIT_DATE, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes { ${tagTarget(TAG_DEPTH)} }
+    }
+  }
+}`
+type TagTarget = { __typename?: unknown; oid?: unknown; committedDate?: unknown; target?: TagTarget | null } | null | undefined
+type TagsPage = { repository?: { refs?: { pageInfo?: { hasNextPage?: unknown; endCursor?: unknown }; nodes?: ({ target?: TagTarget } | null)[] } | null } | null }
+
+// The commit a tag names, through its annotated tags, and when it was
+// committed; null for one naming no commit (a tree, a blob).
+function taggedCommit(target: TagTarget, depth = TAG_DEPTH): { oid: string; at: number } | null {
+  if (target?.__typename === 'Tag' && depth > 0) return taggedCommit(target.target, depth - 1)
+  const at = typeof target?.committedDate === 'string' ? Date.parse(target.committedDate) : Number.NaN
+  return target?.__typename === 'Commit' && typeof target.oid === 'string' && SHA.test(target.oid) && Number.isSafeInteger(at) ? { oid: target.oid, at } : null
+}
+
+// The commits the repository's tags name committed since `since`, the
+// latest first, as many pages of them as TAG_PAGES.
+export async function taggedCommits(fullName: string, token: string, since: number, fetchImpl: typeof fetch = globalThis.fetch): Promise<Set<string>> {
+  const [owner, name] = fullName.split('/') as [string, string]
+  const tagged = new Set<string>()
+  let after: string | null = null
+  for (let pages = 0; pages < TAG_PAGES; pages++) {
+    const page = await githubGraphql(TAGS_QUERY, { owner, name, after }, token, fetchImpl) as TagsPage | null
+    const refs = page?.repository?.refs
+    const commits = (refs?.nodes ?? []).flatMap(node => taggedCommit(node?.target) ?? [])
+    for (const commit of commits) if (commit.at >= since) tagged.add(commit.oid)
+    if (refs?.pageInfo?.hasNextPage !== true || typeof refs.pageInfo.endCursor !== 'string' || commits.some(commit => commit.at < since)) break
+    after = refs.pageInfo.endCursor
+  }
+  return tagged
+}
+
+// Whether a path is one a release changes: a package.json, a lockfile beside
+// one, or a changelog in Markdown.
+const releaseFile = (path: string) => {
+  const base = path.slice(path.lastIndexOf('/') + 1)
+  return base === 'package.json' || RELEASE_LOCKFILES.has(base) || RELEASE_CHANGELOG.test(base) || CHANGESET.test(path)
+}
+
+// Whether what a commit changes is a release's: a package.json at least, and
+// nothing a release changes none of, a rename's both paths alike; one
+// GitHub listed only some files of, not.
+export function releaseChanges({ files, more }: CommitChanges): boolean {
+  const paths = files.flatMap(([path, status, from]) => status === 'R' ? [path, from] : [path])
+  return !more && paths.some(path => path.slice(path.lastIndexOf('/') + 1) === 'package.json') && paths.every(releaseFile)
+}
+
+// The commits since `since` that release the repository: those its tags
+// name whose changes are a release's, each read as Replay reads it (`kept`),
+// as many as RELEASES_READ, sorted.
+export async function releaseCommits(fullName: string, token: string, since: number, kept: ChangesStore, fetchImpl: typeof fetch = globalThis.fetch): Promise<string[]> {
+  const tagged = [...await taggedCommits(fullName, token, since, fetchImpl)].slice(0, RELEASES_READ)
+  const changes = await repositoryChanges(fullName, token, tagged, kept, fetchImpl)
+  return tagged.filter(sha => { const read = changes.get(sha); return read ? releaseChanges(read) : false }).toSorted()
+}

package/server-managed/repository-actions.ts

@@ -0,0 +1,209 @@
+// A repository's GitHub Actions in a risk scan (repository-risk.ts): its
+// workflows and its own actions scanned (risk scanWorkflow), and the
+// references they make resolved (risk resolveAction). Of a public
+// repository, a reference resolved and what GitHub answers are kept for
+// every scan, as many repositories use the same few actions.
+import { type ActionsSource, type ResolvedAction, type ScanOptions, type WorkflowScan, dockerfileFindings, keptSource, ownFilesOf, resolveAction,
+  scanWorkflow, usesOfKey } from '../risk/index.js'
+import type { OpenedRepository } from './repository-risk-read.ts'
+import type { Lru } from './lru.ts'
+import type { KeptStore } from './npm-kept.ts'
+import { type Queue, queue } from './queue.ts'
+import { RISK_KEPT_MS, type RiskFailure, failureOf } from './repository-risk-assess.ts'
+
+export const WORKFLOWS_DIR = '.github/workflows'
+// How many files of a repository's Actions are read, and how large.
+const MAX_FILES = 200
+const MAX_FILE_CHARS = 1024 * 1024
+// How many references a scan resolves, how deep it follows what they name,
+// and how many at once.
+const MAX_ACTIONS = 1000
+const MAX_DEPTH = 4
+const RESOLVERS = 4
+
+// A file of a repository's Actions: its text, or why it couldn't be had.
+export type ActionsFile = { path: string; kind: 'workflow' | 'action' | 'dockerfile' } & ({ text: string } | RiskFailure)
+export type WorkflowsRead = { files: ActionsFile[] } | RiskFailure
+
+// What a scan tells of them: the workflows' paths, each file's scan, and
+// each reference resolved, or why not.
+export type WorkflowsLine = { type: 'workflows'; repo: number } & ({ paths: string[] } | RiskFailure)
+export type WorkflowLine = { type: 'workflow'; repo: number; path: string; kind: ActionsFile['kind'] } & (WorkflowScan | RiskFailure)
+export type ActionLine = { type: 'action' } & (ResolvedAction | { key: string } & RiskFailure)
+
+// A reference to resolve, by the owner of the workflow naming it.
+export interface ActionRef { key: string; owner: string | null; depth: number }
+
+// What reading a repository's Actions asks of it.
+export type ActionsReading = Required<Pick<OpenedRepository, 'workflows' | 'file'>>
+
+// A file's text, or why not: one GitHub hasn't, or larger than read.
+async function readFile(reading: ActionsReading, path: string): Promise<{ text: string } | RiskFailure> {
+  try {
+    const text = await reading.file(path)
+    return text.length > MAX_FILE_CHARS ? { error: 'workflow-too-large' } : { text }
+  } catch (error) { return failureOf(error) }
+}
+
+// Whether a read holds what any read of its commit would: no file that
+// couldn't be had for a while, as GitHub's limits are.
+export const lastingRead = (read: WorkflowsRead) => !('error' in read) && read.files.every(file => 'text' in file || file.error === 'workflow-too-large' || file.error === 'github-not-found')
+
+// An action's directory, by its metadata's path.
+const actionDir = (path: string) => path.replace(/\/?action\.ya?ml$/u, '')
+const inRepository = (path: string) => !path.split('/').includes('..')
+const notFound = (read: { text: string } | RiskFailure) => 'error' in read && read.error === 'github-not-found'
+
+// A repository's workflows, the actions of its own they use in turn (`./`
+// as the workspace has it, the repository checked out first) and those's
+// Dockerfiles, MAX_FILES at most; why not, where they couldn't be listed.
+export async function readActions(reading: ActionsReading): Promise<WorkflowsRead> {
+  let listed
+  try { listed = await reading.workflows() } catch (error) { return failureOf(error, 'listing its workflows') }
+  const files: ActionsFile[] = await Promise.all(listed.slice(0, MAX_FILES).map(async path => ({ path, kind: 'workflow' as const, ...await readFile(reading, path) })))
+  const seen = new Set<string>()
+  for (let at = 0; at < files.length; at++) {
+    const file = files[at]!
+    if (!('text' in file) || file.kind === 'dockerfile') continue
+    const { actions, dockerfile } = ownFilesOf(file.kind, file.text)
+    const path = dockerfile && [actionDir(file.path), dockerfile].filter(Boolean).join('/')
+    if (path && inRepository(path) && files.length < MAX_FILES) files.push({ path, kind: 'dockerfile', ...await readFile(reading, path) })
+    for (const dir of actions) {
+      if (files.length >= MAX_FILES || seen.has(dir) || !inRepository(dir) || !seen.add(dir)) continue
+      const named = dir === '' ? 'action' : `${dir}/action`, yml = await readFile(reading, `${named}.yml`)
+      const yaml = notFound(yml) ? await readFile(reading, `${named}.yaml`) : null
+      files.push(yaml && !notFound(yaml) ? { path: `${named}.yaml`, kind: 'action', ...yaml } : { path: `${named}.yml`, kind: 'action', ...yml })
+    }
+  }
+  return { files }
+}
+
+// A lockfile's packages, by name and by `name@version`, and those only
+// devDependencies need.
+export function lockedNames(path: string, packages: readonly { name: string; version: string | null; dev?: true }[]) {
+  const dev = new Map<string, boolean>()
+  for (const { name, version, dev: only } of packages) for (const key of version ? [name, `${name}@${version}`] : [name]) dev.set(key, (dev.get(key) ?? true) && only === true)
+  return { path, names: new Set(dev.keys()), dev: new Set([...dev].flatMap(([name, only]) => only ? [name] : [])) }
+}
+
+// The lines a repository's Actions read are told by, and the references
+// they make to resolve. `lockfiles`, its lockfiles' packages' names by path.
+export function actionsLines(repo: number, owner: string, read: WorkflowsRead, lockfiles: NonNullable<ScanOptions['lockfiles']>) {
+  if ('error' in read) return { lines: [{ type: 'workflows', repo, ...read } as WorkflowsLine], refs: [] as ActionRef[] }
+  const lines: (WorkflowsLine | WorkflowLine)[] = [{ type: 'workflows', repo, paths: read.files.filter(file => file.kind === 'workflow').map(file => file.path) }]
+  const refs = new Map<string, ActionRef>()
+  const actions = new Map(read.files.flatMap(file => file.kind === 'action' && 'text' in file ? [[actionDir(file.path), file.text] as const] : []))
+  for (const file of read.files) {
+    const scan = 'error' in file ? file : file.kind === 'dockerfile' ? { uses: [], findings: dockerfileFindings(file.text) } : scanWorkflow(file.kind, file.text, { owner, lockfiles, actions })
+    lines.push({ type: 'workflow', repo, path: file.path, kind: file.kind, ...scan })
+    if ('uses' in scan) for (const uses of scan.uses) if (uses.kind === 'action' || uses.kind === 'workflow') refs.set(uses.key!, { key: uses.key!, owner, depth: 0 })
+  }
+  return { lines, refs: [...refs.values()] }
+}
+
+export type ActionAnswers = Lru<{ at: number; answer: unknown }>
+// An answer's weight: an entry of a list, a kilobyte of a file.
+export const answerWeight = ({ answer }: { at: number; answer: unknown }) => Array.isArray(answer) ? answer.length + 1
+  : typeof answer === 'string' ? Math.ceil(answer.length / 1024) + 1 : ((answer as { branches?: unknown[] } | null)?.branches?.length ?? 0) + 1
+
+const isCommit = (text: string) => /^[\da-f]{40}$/u.test(text)
+
+// `source`, what it answers of a public repository kept for every scan, the
+// same whoever asks: of a commit while kept (but none, as one can be pushed
+// later), the rest for RISK_KEPT_MS. A private one's, or one missing, never.
+export function sharedSource(source: ActionsSource, answers: ActionAnswers): ActionsSource {
+  const keyOf = (what: string, name: string, ...more: string[]) => [what, name.toLowerCase(), ...more].join('\0')
+  const kept = (key: string, lasting = false) => {
+    const at = answers.get(key)
+    return at && ((lasting && at.answer !== null) || Date.now() - at.at < RISK_KEPT_MS) ? at : undefined
+  }
+  async function shared<T>(name: string, key: string, lasting: boolean, ask: () => Promise<T>): Promise<T> {
+    if (!kept(keyOf('repo', name))) return ask()
+    const at = kept(key, lasting)
+    if (at) return at.answer as T
+    const answer = await ask()
+    answers.set(key, { at: Date.now(), answer })
+    return answer
+  }
+  return {
+    async repo(name) {
+      const at = kept(keyOf('repo', name))
+      if (at) return at.answer as Awaited<ReturnType<ActionsSource['repo']>>
+      const info = await source.repo(name)
+      if (info?.private === false) for (const each of [name, info.fullName]) answers.set(keyOf('repo', each), { at: Date.now(), answer: info })
+      return info
+    },
+    tags: name => shared(name, keyOf('tags', name), false, () => source.tags(name)),
+    tag: (name, tag) => shared(name, keyOf('tag', name, tag), false, () => source.tag(name, tag)),
+    branch: (name, branch) => shared(name, keyOf('branch', name, branch), false, () => source.branch(name, branch)),
+    branches: name => shared(name, keyOf('branches', name), false, () => source.branches(name)),
+    contains: (name, base, sha) => shared(name, keyOf('contains', name, base, sha), isCommit(base), () => source.contains(name, base, sha)),
+    file: (name, path, commit) => shared(name, keyOf('file', name, path, commit), isCommit(commit), () => source.file(name, path, commit)),
+  }
+}
+
+export interface ActionsResolving {
+  source: ActionsSource
+  signal: AbortSignal
+  tell(line: ActionLine): void
+  memory: Lru<{ at: number; line: ActionLine }>
+  answers: ActionAnswers
+  store?: KeptStore<ActionLine> | undefined
+}
+
+// A reference's line: kept, else resolved, and kept where it is a public
+// repository's; why not, where it couldn't be.
+async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef): Promise<ActionLine | null> {
+  const kept = resolving.memory.get(key) ?? await resolving.store?.read(key).then(row => row && { at: row.at, line: row.value })
+  if (kept && Date.now() - kept.at < RISK_KEPT_MS) { resolving.memory.set(key, kept); return kept.line }
+  const uses = usesOfKey(key)
+  if (!uses) return { type: 'action', key, error: 'invalid-uses' }
+  let found: ResolvedAction
+  try { found = await resolveAction(uses, source, { owner }) } catch (error) { return resolving.signal.aborted ? null : { type: 'action', key, ...failureOf(error) } }
+  const line: ActionLine = { type: 'action', ...found }
+  if (found.repository?.private === false) {
+    const at = Date.now()
+    resolving.memory.set(key, { at, line })
+    await resolving.store?.write(key, line, at)
+  }
+  return line
+}
+
+// Whether a reference is named by a workflow of its repository's owner.
+const ownOwners = ({ key, owner }: ActionRef) => key.split('/')[0] === owner?.toLowerCase()
+
+// Resolves the references added, and those they name in turn, each once a
+// scan, RESOLVERS at once, each told as it is; once more where another
+// owner's workflow names one its own owner's did, as a repository missing is
+// red then, or one is met nearer, its own followed as far as they then go. `close` settles once all are told, or the scan stops.
+export function resolvingActions(resolving: ActionsResolving) {
+  const source = keptSource(sharedSource(resolving.source, resolving.answers))
+  const pending: Queue<ActionRef> = queue(resolving.signal)
+  const latest = new Map<string, ActionRef>()
+  let closed = false, waiting = 0
+  const settle = () => { if (closed && waiting === 0) pending.close() }
+  const add = (refs: ActionRef[]) => {
+    for (const ref of refs) {
+      const first = latest.get(ref.key)
+      if (ref.depth > MAX_DEPTH || (first ? (!ownOwners(first) || ownOwners(ref)) && first.depth <= ref.depth : latest.size >= MAX_ACTIONS)) continue
+      const kept = first ? { ...ref, owner: ownOwners(first) ? ref.owner : first.owner, depth: Math.min(ref.depth, first.depth) } : ref
+      latest.set(ref.key, kept)
+      waiting++
+      pending.add(kept)
+    }
+  }
+  const work = async () => {
+    for (let ref = await pending.take(); ref !== undefined; ref = await pending.take()) {
+      try {
+        const line = await resolved(resolving, source, ref)
+        if (line && latest.get(ref.key) === ref) {
+          resolving.tell(line)
+          const owner = 'repository' in line ? (line.repository?.fullName ?? line.repo).split('/')[0]! : ref.owner
+          if ('uses' in line) add(line.uses.map(key => ({ key, owner, depth: ref.depth + 1 })))
+        }
+      } finally { waiting--; settle() }
+    }
+  }
+  const workers = Array.from({ length: RESOLVERS }, work)
+  return { add, async close() { closed = true; settle(); await Promise.all(workers) } }
+}