@preventive/triage 1.0.0-alpha.43 → 1.0.0-alpha.45

package/server-managed/repository-risk-read.ts

@@ -0,0 +1,165 @@
+// A repository as a repository risk scan reads it of GitHub
+// (repository-risk.ts): opened at its default branch's head, its lockfiles
+// of npm's ecosystem listed (findRepoLockfiles), those of its `paths` alone,
+// each read for its packages (@preventive/lockfile), and access to it checked
+// again before they are told (`recheck`); and its Dependabot alerts, open or dismissed, of
+// npm's, where the source asks them (dependabot-alerts.ts), asked meanwhile
+// and never kept, a failure to have them its own, and its GitHub Actions
+// (repository-actions.ts). A listing is kept by the commit it was listed at,
+// its Actions' files too, and a lockfile's packages by its blob: in the
+// instance's memory, and the source's `listings`, `actionFiles` and
+// `lockfiles` for SCAN_READ_KEPT_MS, so that only opening a repository and
+// checking access to it again ask GitHub where all else is kept.
+import type { LockfileFormat, RepoLockfile } from '@preventive/upstream/github.js'
+import type { AlertsRead } from './dependabot-access.ts'
+import type { DependabotAlert } from './dependabot-alerts.ts'
+import { type LockedPackage, isTestFixture, lockedPackages } from './locked-packages.ts'
+import type { Lru } from './lru.ts'
+import type { KeptStore } from './npm-kept.ts'
+import { type WorkflowsRead, lastingRead, readActions } from './repository-actions.ts'
+import { type RiskFailure, failureOf } from './repository-risk-assess.ts'
+import type { RepositoryRiskLine, RepositoryRiskRepo } from './repository-risk.ts'
+
+// The formats of npm's ecosystem, as findRepoLockfiles names them, and those
+// of them read here.
+const NPM_LOCKFILE_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn', 'bun', 'deno'])
+const READ_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn'])
+
+// How long the source's `listings` and `lockfiles` are read for: what
+// GitHub has at a commit or a blob doesn't change, how it is read here may.
+export const SCAN_READ_KEPT_MS = 24 * 60 * 60_000
+
+export type ListedLockfile = Pick<RepoLockfile, 'path' | 'format' | 'sha'>
+export type LockfileRead = { packages: LockedPackage[] } | RiskFailure
+// A repository's Dependabot alerts, those of its `paths` alone, with access to
+// them to check again before they are told (`recheck`), or why they couldn't
+// be had.
+export type DependabotRead = { alerts: DependabotAlert[]; recheck?(): Promise<void> } | RiskFailure
+type LockfileLine = Extract<RepositoryRiskLine, { type: 'lockfile' }>
+export type RepositoryFailure = Extract<RepositoryRiskLine, { type: 'repo'; error: string }>
+
+// A repository opened at its default branch's head (`commit`): its lockfiles,
+// as findRepoLockfiles lists them, each with its blob's id, and a file's
+// text; `recheck` checks access to it again, throwing where it is gone; and
+// `dependabot`, where asked, its Dependabot alerts of npm's, open or dismissed, as GitHub
+// has them now, with access to them to check again before they are told.
+export interface OpenedRepository {
+  commit: string
+  lockfiles(): Promise<ListedLockfile[]>
+  file(path: string): Promise<string>
+  recheck(): Promise<void>
+  dependabot?(): Promise<AlertsRead>
+  // Its workflows' paths, none where it has none.
+  workflows?(): Promise<string[]>
+}
+
+// What a repository is read with: the scan's source and caches, and its
+// signal.
+export interface RepositoryReading<R extends RepositoryRiskRepo> {
+  source: { open(repo: R): Promise<OpenedRepository>; listings?: KeptStore<ListedLockfile[]>; lockfiles?: KeptStore<LockfileRead>; actionFiles?: KeptStore<WorkflowsRead> }
+  caches: { listings: Lru<ListedLockfile[]>; lockfiles: Lru<LockfileRead>; actionFiles: Lru<WorkflowsRead> }
+  signal: AbortSignal
+}
+
+// A repository read: its commit, its lockfiles' lines, each with its blob's
+// id, its Dependabot alerts where asked, and access to it to check again just
+// before they are told (OpenedRepository `recheck`), as GitHub may have
+// withdrawn it meanwhile.
+export interface RepositoryRead {
+  commit: string
+  lockfiles: { sha: string; line: LockfileLine }[]
+  dependabot: DependabotRead | null
+  // Its Actions' files, where it lists its workflows.
+  actions: WorkflowsRead | null
+  recheck(): Promise<void>
+}
+
+// Whether a lockfile at `path` is of `paths` (RepositoryRiskRepo).
+function lockfileOf(path: string, paths: readonly string[] | undefined) {
+  const dir = path.slice(0, Math.max(path.lastIndexOf('/'), 0))
+  return !paths || paths.some(scope => dir === '' || dir === scope || dir.startsWith(`${scope}/`) || scope.startsWith(`${dir}/`))
+}
+
+// What is kept by `key`: in this instance's memory, else in `store` within
+// SCAN_READ_KEPT_MS, else `read` and kept in both, where it is to be.
+async function keptRead<T>(memory: Lru<T>, store: KeptStore<T> | undefined, key: string, read: () => Promise<T>, keep = (_value: T) => true) {
+  const known = memory.get(key)
+  if (known !== undefined) return known
+  const kept = await store?.read(key)
+  if (kept && Date.now() - kept.at < SCAN_READ_KEPT_MS) { memory.set(key, kept.value); return kept.value }
+  const value = await read()
+  if (!keep(value)) return value
+  memory.set(key, value)
+  await store?.write(key, value, Date.now())
+  return value
+}
+
+// A lockfile's line, its packages or why they couldn't be had: as kept by its
+// blob, else read from GitHub and kept.
+async function readLockfile({ source, caches }: RepositoryReading<RepositoryRiskRepo>, repo: number, opened: OpenedRepository,
+  { path, format, sha }: ListedLockfile): Promise<LockfileLine> {
+  const at = { type: 'lockfile', repo, path, format } as const
+  if (!READ_FORMATS.has(format)) return { ...at, error: 'unsupported-format' }
+  try {
+    return { ...at, ...await keptRead(caches.lockfiles, source.lockfiles, `${format}\0${sha}`, async (): Promise<LockfileRead> => {
+      const text = await opened.file(path)
+      try { return { packages: lockedPackages(format, text) } } catch (error) {
+        return { error: 'lockfile-unreadable', ...error instanceof Error ? { detail: error.message.slice(0, 500) } : {} }
+      }
+    }) }
+  } catch (error) { return { ...at, ...failureOf(error) } }
+}
+
+// A repository opened and its lockfiles of npm's ecosystem listed, as kept
+// for its commit or else from GitHub, those of its `paths` alone; its line
+// telling why where either failed; null where the scan stopped.
+async function listLockfiles<R extends RepositoryRiskRepo>(reading: RepositoryReading<R>, repo: R) {
+  let doing = 'opening it'
+  try {
+    const opened = await reading.source.open(repo)
+    if (reading.signal.aborted) return null
+    doing = 'listing its lockfiles'
+    const listed = await keptRead(reading.caches.listings, reading.source.listings, `${repo.repoId}@${opened.commit}`, () => opened.lockfiles())
+    const lockfiles = listed.filter(({ path, format }) => NPM_LOCKFILE_FORMATS.has(format) && lockfileOf(path, repo.paths))
+    return { opened, lockfiles }
+  } catch (error) {
+    return reading.signal.aborted ? null : { type: 'repo', id: repo.repoId, ...failureOf(error, doing) } as const
+  }
+}
+
+// A repository's Dependabot alerts of its `paths` (RepositoryRiskRepo), as
+// its lockfiles are, or why they couldn't be had; null where they aren't
+// asked.
+async function readDependabot(opened: OpenedRepository, paths: readonly string[] | undefined): Promise<DependabotRead | null> {
+  if (!opened.dependabot) return null
+  try {
+    const { alerts, recheck } = await opened.dependabot()
+    return { alerts: alerts.filter(alert => lockfileOf(alert.manifest, paths)), recheck }
+  } catch (error) {
+    return failureOf(error, 'asking its Dependabot alerts')
+  }
+}
+
+// A repository read: its lockfiles listed and read, its Dependabot alerts
+// asked and its Actions read meanwhile; its line telling why where listing
+// failed; null where the scan stopped. A test's
+// fixture or example its reader refuses (isTestFixture) is left out, as a
+// test may keep one so on purpose.
+export async function readRepository<R extends RepositoryRiskRepo>(reading: RepositoryReading<R>, repo: R): Promise<RepositoryRead | RepositoryFailure | null> {
+  const listed = await listLockfiles(reading, repo)
+  if (!listed || 'type' in listed) return listed
+  const alerting = readDependabot(listed.opened, repo.paths)
+  const { opened } = listed, { workflows } = opened
+  const acting = workflows ? keptRead(reading.caches.actionFiles, reading.source.actionFiles, `${repo.repoId}@${opened.commit}`,
+    () => readActions({ workflows, file: path => opened.file(path) }), lastingRead) : Promise.resolve(null)
+  acting.catch(() => {})
+  const lockfiles: RepositoryRead['lockfiles'] = []
+  for (const lockfile of listed.lockfiles) {
+    if (reading.signal.aborted) return null
+    const line = await readLockfile(reading, repo.repoId, listed.opened, lockfile)
+    if (!('error' in line && line.error === 'lockfile-unreadable' && isTestFixture(line.path))) lockfiles.push({ sha: lockfile.sha, line })
+  }
+  const dependabot = await alerting
+  const actions = await acting
+  return reading.signal.aborted ? null : { commit: listed.opened.commit, lockfiles, dependabot, actions, recheck: () => listed.opened.recheck() }
+}

package/server-managed/repository-risk.ts

@@ -12,58 +12,47 @@
 // host with an integrity, such as a company's mirror of npm's, as npm's
 // package of its name and version where npm's integrity is among it; one
 // from elsewhere (git, a tarball with no integrity, a file) is listed, not
-// assessed. Repositories are read one at a time, as GitHub's limits are the
-// caller's; packages are assessed meanwhile, as many at a time as npm-risk.ts
+// assessed. Repositories are read a few at a time (READ_AHEAD), each told in
+// turn, as GitHub's limits are the caller's; packages are assessed meanwhile, as many at a time as npm-risk.ts
 // makes spare assessments, those only devDependencies need in every lockfile
 // that locks them (LockedPackage `dev`) once all the rest are, as an install
 // of no devDependencies leaves them out. A lockfile's packages of npm's
 // registry or a mirror are asked of npm's advisories all at once, as `npm
 // audit` asks, each advisory told with whether it is of malware (risk's
 // npmMalwareAdvisory), which alone is a supply chain's risk; the rest are
-// vulnerabilities, told beside.
-import type { LockfileFormat, RepoLockfile } from '@preventive/upstream/github.js'
-import type { Severity } from '../risk/index.js'
+// vulnerabilities, told beside. A repository's Dependabot alerts of npm's, open or dismissed,
+// are told once its lockfiles' advisories are, each with the versions its
+// lockfile locks that it covers, for the page to blend them into npm's; one
+// whose alerts couldn't be had tells why, and the scan goes on. Its GitHub
+// Actions are told once its lockfiles are, the references they make
+// resolved as the scan goes on (repository-actions.ts).
+import type { LockfileFormat } from '@preventive/upstream/github.js'
+import { type Severity, npmMalwareAdvisory } from '../risk/index.js'
 import { isNpmPackageName, isNpmPackageSpec } from '../common/managed/npm-packages.js'
 import type { NpmVersionDocument } from './npm-packages.ts'
 import { type Lru, lru } from './lru.ts'
 import type { KeptStore } from './npm-kept.ts'
 import { MAX_SPARE_ASSESSMENTS } from './npm-risk.ts'
-import { type LockedPackage, lockedPackages } from './locked-packages.ts'
+import type { LockedPackage } from './locked-packages.ts'
 import { type Queue, queue } from './queue.ts'
 import { type DownloadsSource, readyingDownloads } from './scan-downloads.ts'
 import { type AssessedPackage, type Assessment, BUSY_RETRIES, BUSY_WAIT_MS, RISK_KEPT_MS, type RiskFailure, assessPackage, failureOf, isBusy } from './repository-risk-assess.ts'
 import { type AdvisoryRow, type Audit, type AuditSource, auditLockfile } from './repository-risk-audit.ts'
+import { type DependabotRead, type ListedLockfile, type LockfileRead, type OpenedRepository, type RepositoryFailure, type RepositoryRead, SCAN_READ_KEPT_MS,
+  readRepository } from './repository-risk-read.ts'
+import { type DependabotAlert, alertVersions } from './dependabot-alerts.ts'
+import type { ActionsSource } from '../risk/index.js'
+import { type ActionAnswers, type ActionLine, type ActionRef, type WorkflowLine, type WorkflowsLine, type WorkflowsRead, actionsLines, answerWeight,
+  lockedNames, resolvingActions } from './repository-actions.ts'
 
 export { RISK_KEPT_MS, highestSeverity } from './repository-risk-assess.ts'
-
-// The formats of npm's ecosystem, as findRepoLockfiles names them, and those
-// of them read here.
-const NPM_LOCKFILE_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn', 'bun', 'deno'])
-const READ_FORMATS: ReadonlySet<LockfileFormat> = new Set(['npm', 'pnpm', 'yarn'])
+export { type OpenedRepository, SCAN_READ_KEPT_MS } from './repository-risk-read.ts'
 
 // A repository to read: where `paths` are given, a team's directories in it,
 // only the lockfiles in them or above them, as a workspace's root lockfile
 // locks them too.
 export interface RepositoryRiskRepo { repoId: number; fullName: string; paths?: readonly string[] }
 
-// Whether a lockfile at `path` is of `paths` (RepositoryRiskRepo).
-function lockfileOf(path: string, paths: readonly string[] | undefined) {
-  const dir = path.slice(0, Math.max(path.lastIndexOf('/'), 0))
-  return !paths || paths.some(scope => dir === '' || dir === scope || dir.startsWith(`${scope}/`) || scope.startsWith(`${dir}/`))
-}
-
-type ListedLockfile = Pick<RepoLockfile, 'path' | 'format' | 'sha'>
-
-// A repository opened at its default branch's head (`commit`): its lockfiles,
-// as findRepoLockfiles lists them, each with its blob's id, and a file's
-// text; `recheck` checks access to it again, throwing where it is gone.
-export interface OpenedRepository {
-  commit: string
-  lockfiles(): Promise<ListedLockfile[]>
-  file(path: string): Promise<string>
-  recheck(): Promise<void>
-}
-
 export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends AuditSource {
   repos(): Promise<R[]>
   open(repo: R): Promise<OpenedRepository>
@@ -94,10 +83,21 @@ export interface RepositoryRiskSource<R extends RepositoryRiskRepo> extends Audi
   // Readies npm's downloads of packages before they are assessed
   // (scan-downloads.ts); without it, each assessment asks its own.
   downloads?: DownloadsSource
+  // GitHub as references are resolved with; none without it.
+  actions?: ActionsSource
+  // Where Actions' files read and references resolved are kept.
+  actionFiles?: KeptStore<WorkflowsRead>
+  actionLines?: KeptStore<ActionLine>
 }
 
 
 
+// A Dependabot alert as a scan tells it: with the versions of its package
+// the lockfile it is of locks that it covers, none where it is of none read
+// (a package.json, bun's lockfile), and whether it is of malware, as an
+// advisory's is told.
+export type DependabotAlertRow = DependabotAlert & { versions: string[]; malware: boolean }
+
 // A risk line is of npm's package of its name and version, or, with an
 // `integrity`, of a mirror's that its lockfiles hold to it; its `score` risk's
 // of it, out of 100 (assessNpm `score`, risk/npm/score.js).
@@ -108,6 +108,8 @@ export type RepositoryRiskLine =
   | ({ type: 'risk'; name: string; version: string; integrity?: string; stale?: { assessedAt: number } }
     & ({ published: string | null; severity: Severity | null; score: number; findings: { id: string; severity: Severity; takenDown?: true }[] } | RiskFailure))
   | ({ type: 'advisories'; repo: number; path: string } & ({ advisories: AdvisoryRow[] } | RiskFailure))
+  | ({ type: 'dependabot'; repo: number } & ({ alerts: DependabotAlertRow[] } | RiskFailure))
+  | WorkflowsLine | WorkflowLine | ActionLine
   | { type: 'done' }
   // The scan stopped for its part's time (repositoryRiskLines `partMs`), what
   // it told kept: to be asked again, from where it stopped.
@@ -115,12 +117,12 @@ export type RepositoryRiskLine =
 
 // The repositories a scan answered in parts told whole by a part's end: each
 // by its id, its name and a team's directories in it then, and its
-// lockfiles' keys (`${format}\0${sha}`) of those read.
+// lockfiles' keys (`${format}\0${sha}`) of those read, and the references
+// its Actions make, to resolve.
 export interface ScanProgress { repos: ToldRepository[] }
-interface ToldRepository { id: number; name: string; paths: readonly string[] | null; lockfiles: string[] }
+interface ToldRepository { id: number; name: string; paths: readonly string[] | null; lockfiles: string[]; actions?: ActionRef[] }
 
 type RiskLine = Extract<RepositoryRiskLine, { type: 'risk' }>
-type LockfileRead = { packages: LockedPackage[] } | RiskFailure
 
 // What scans keep between them, in this instance's memory: a repository's
 // lockfiles as listed at a commit, and a lockfile's packages by its blob,
@@ -135,6 +137,9 @@ export interface RiskCaches {
   lockfiles: Lru<LockfileRead>
   risks: Lru<{ at: number; line: RiskLine }>
   advisories: Lru<{ at: number; audit: Audit }>
+  actionFiles: Lru<WorkflowsRead>
+  actions: Lru<{ at: number; line: ActionLine }>
+  actionAnswers: ActionAnswers
 }
 export const riskCaches = (): RiskCaches => ({
   listings: lru(1000),
@@ -142,10 +147,16 @@ export const riskCaches = (): RiskCaches => ({
   lockfiles: lru(200_000, read => 'packages' in read ? read.packages.length + 1 : 1),
   risks: lru(50_000),
   advisories: lru(50_000, kept => Array.isArray(kept.audit) ? kept.audit.length + 1 : 1),
+  // By their text, a kilobyte at a time.
+  actionFiles: lru(64 * 1024, read => 'files' in read ? read.files.reduce((sum, file) => sum + ('text' in file ? Math.ceil(file.text.length / 1024) : 1), 1) : 1),
+  actions: lru(10_000),
+  // What GitHub answered of public repositories' actions, by answerWeight.
+  actionAnswers: lru(200_000, answerWeight),
 })
-// How long the source's `listings` and `lockfiles` are read for: what
-// GitHub has at a commit or a blob doesn't change, how it is read here may.
-export const SCAN_READ_KEPT_MS = 24 * 60 * 60_000
+// How many repositories are read at once (repository-risk-read.ts), ahead of
+// the one told: each asks GitHub one thing after another (opening it, and
+// its head) even where all else is kept.
+const READ_AHEAD = 6
 // How long a part's progress, written as it ends (`progress`), is waited on.
 const PROGRESS_WRITE_MS = 5000
 // How many kept risk lines are read of the source's `risks` at once.
@@ -168,6 +179,7 @@ interface Scan {
   stale: AssessedPackage[]
   // The repositories told whole, this part or one before (ScanProgress).
   told: Map<number, ToldRepository>
+  actions: ReturnType<typeof resolvingActions> | null
 }
 
 // A package as a scan meets it: by its name, version and a mirror's integrity.
@@ -255,36 +267,6 @@ async function assessing(scan: Scan, feed: (assess: (packages: AssessedPackage[]
   await Promise.all(assessors)
 }
 
-type LockfileLine = Extract<RepositoryRiskLine, { type: 'lockfile' }>
-
-// What is kept by `key`: in this instance's memory, else in `store` within
-// SCAN_READ_KEPT_MS, else `read` and kept in both.
-async function keptRead<T>(memory: Lru<T>, store: KeptStore<T> | undefined, key: string, read: () => Promise<T>) {
-  const known = memory.get(key)
-  if (known !== undefined) return known
-  const kept = await store?.read(key)
-  if (kept && Date.now() - kept.at < SCAN_READ_KEPT_MS) { memory.set(key, kept.value); return kept.value }
-  const value = await read()
-  memory.set(key, value)
-  await store?.write(key, value, Date.now())
-  return value
-}
-
-// A lockfile's line, its packages or why they couldn't be had: as kept by its
-// blob, else read from GitHub and kept.
-async function readLockfile({ source, caches }: Scan, repo: number, opened: OpenedRepository, { path, format, sha }: ListedLockfile): Promise<LockfileLine> {
-  const at = { type: 'lockfile', repo, path, format } as const
-  if (!READ_FORMATS.has(format)) return { ...at, error: 'unsupported-format' }
-  try {
-    return { ...at, ...await keptRead(caches.lockfiles, source.lockfiles, `${format}\0${sha}`, async (): Promise<LockfileRead> => {
-      const text = await opened.file(path)
-      try { return { packages: lockedPackages(format, text) } } catch (error) {
-        return { error: 'lockfile-unreadable', ...error instanceof Error ? { detail: error.message.slice(0, 500) } : {} }
-      }
-    }) }
-  } catch (error) { return { ...at, ...failureOf(error) } }
-}
-
 // A lockfile's packages of npm's registry or a mirror not yet seen this scan,
 // to look up as kept (lookUp), and assess where none is; and one seen as only
 // devDependencies need it, and put off, that this lockfile needs otherwise,
@@ -303,25 +285,8 @@ function assessLater(scan: Scan, packages: LockedPackage[]) {
   if (fresh.length > 0) scan.lookups.add(fresh)
 }
 
-// A repository opened and its lockfiles of npm's ecosystem listed, as kept
-// for its commit or else from GitHub, those of its `paths` alone; null, with
-// its line telling why, where either failed, or where the scan stopped.
-async function listLockfiles(scan: Scan, repo: RepositoryRiskRepo) {
-  let doing = 'opening it'
-  try {
-    const opened = await scan.source.open(repo)
-    if (scan.signal.aborted) return null
-    doing = 'listing its lockfiles'
-    const listed = await keptRead(scan.caches.listings, scan.source.listings, `${repo.repoId}@${opened.commit}`, () => opened.lockfiles())
-    const lockfiles = listed.filter(({ path, format }) => NPM_LOCKFILE_FORMATS.has(format) && lockfileOf(path, repo.paths))
-    return { opened, lockfiles }
-  } catch (error) {
-    if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, doing) })
-    return null
-  }
-}
-
 type AdvisoriesLine = Extract<RepositoryRiskLine, { type: 'advisories' }>
+type LockfileLine = Extract<RepositoryRiskLine, { type: 'lockfile' }>
 
 // A lockfile's advisories line (repository-risk-audit.ts auditLockfile);
 // null where it locks none, or once the scan stops.
@@ -331,36 +296,67 @@ async function readAdvisories(scan: Scan, { repo, path, format, packages }: Lock
   return audit === null ? null : Array.isArray(audit) ? { ...at, advisories: audit } : { ...at, ...audit }
 }
 
-// A repository's line, its lockfiles or why they couldn't be listed, and
-// then its lockfiles', and their advisories: told once they are all read
-// and access to the repository is checked again, as GitHub may have
-// withdrawn it meanwhile.
-async function readRepository(scan: Scan, repo: RepositoryRiskRepo) {
-  const listed = await listLockfiles(scan, repo)
-  if (!listed) return
-  const lockfiles: LockfileLine[] = []
-  for (const lockfile of listed.lockfiles) {
-    if (scan.signal.aborted) return
-    lockfiles.push(await readLockfile(scan, repo.repoId, listed.opened, lockfile))
-  }
-  try { await listed.opened.recheck() } catch (error) {
+type DependabotLine = Extract<RepositoryRiskLine, { type: 'dependabot' }>
+
+// A repository's Dependabot alerts' line, each alert with the versions the
+// lockfile it is of locks that it covers (`lockfiles`, a repository read's),
+// or why they couldn't be had.
+function dependabotLine(repo: number, read: DependabotRead, lockfiles: RepositoryRead['lockfiles']): DependabotLine {
+  if ('error' in read) return { type: 'dependabot', repo, ...read }
+  const locked = new Map(lockfiles.flatMap(({ line }) => 'packages' in line ? [[line.path, line.packages] as const] : []))
+  return { type: 'dependabot', repo, alerts: read.alerts.map(alert => ({ ...alert, versions: alertVersions(alert, locked.get(alert.manifest)),
+    malware: npmMalwareAdvisory({ id: alert.ghsa, aliases: alert.aliases, cwe: alert.cwe, title: alert.title }) })) }
+}
+
+// A repository's alerts checked again just before they are told, as access to
+// the repository is (DependabotRead `recheck`): why not, where the user's
+// access to them is withdrawn since they were read.
+async function rechecked(read: DependabotRead): Promise<DependabotRead> {
+  if (!('alerts' in read) || !read.recheck) return read
+  try { await read.recheck() } catch (error) { return failureOf(error, 'checking access to its Dependabot alerts again') }
+  return read
+}
+
+// A repository read (repository-risk-read.ts readRepository) told: its
+// line, or why it couldn't be read, then its lockfiles', and their
+// advisories, its packages assessed meanwhile, then its Dependabot alerts.
+// Access to it is checked again
+// just before, however long ago it was read, as GitHub may have withdrawn it.
+async function tellRepository(scan: Scan, repo: RepositoryRiskRepo, read: RepositoryRead | RepositoryFailure | null) {
+  if (!read || scan.signal.aborted) return
+  if ('type' in read) { scan.lines.add(read); return }
+  try { await read.recheck() } catch (error) {
     if (!scan.signal.aborted) scan.lines.add({ type: 'repo', id: repo.repoId, ...failureOf(error, 'checking access to it again') })
     return
   }
   if (scan.signal.aborted) return
-  scan.lines.add({ type: 'repo', id: repo.repoId, commit: listed.opened.commit, lockfiles: listed.lockfiles.map(({ path, format }) => ({ path, format })) })
-  for (const line of lockfiles) {
+  const { commit, lockfiles } = read
+  scan.lines.add({ type: 'repo', id: repo.repoId, commit, lockfiles: lockfiles.map(({ line: { path, format } }) => ({ path, format })) })
+  for (const { line } of lockfiles) {
     scan.lines.add(line)
     if ('packages' in line) assessLater(scan, line.packages)
   }
-  for (const [at, line] of lockfiles.entries()) {
+  const refs = read.actions ? tellActions(scan, repo, read.actions, lockfiles) : []
+  for (const { sha, line } of lockfiles) {
     if (scan.signal.aborted) return
-    const advisories = 'packages' in line ? await readAdvisories(scan, line, listed.lockfiles[at]!.sha) : null
+    const advisories = 'packages' in line ? await readAdvisories(scan, line, sha) : null
     if (advisories) scan.lines.add(advisories)
   }
   if (scan.signal.aborted) return
+  const dependabot = read.dependabot && await rechecked(read.dependabot)
+  if (scan.signal.aborted) return
+  if (dependabot) scan.lines.add(dependabotLine(repo.repoId, dependabot, lockfiles))
   scan.told.set(repo.repoId, { id: repo.repoId, name: repo.fullName, paths: repo.paths ?? null,
-    lockfiles: lockfiles.flatMap((line, at) => 'packages' in line ? [`${line.format}\0${listed.lockfiles[at]!.sha}`] : []) })
+    lockfiles: lockfiles.flatMap(({ sha, line }) => 'packages' in line ? [`${line.format}\0${sha}`] : []), ...refs.length > 0 ? { actions: refs } : {} })
+}
+
+// A repository's Actions told, and the references they make to resolve.
+function tellActions(scan: Scan, repo: RepositoryRiskRepo, read: WorkflowsRead, lockfiles: RepositoryRead['lockfiles']) {
+  const locked = lockfiles.flatMap(({ line }) => 'packages' in line ? [lockedNames(line.path, line.packages)] : [])
+  const { lines, refs } = actionsLines(repo.repoId, repo.fullName.split('/')[0]!, read, locked)
+  for (const line of lines) scan.lines.add(line)
+  scan.actions?.add(refs)
+  return refs
 }
 
 // Whether an earlier part told `repo` whole, by its name and a team's
@@ -377,11 +373,12 @@ async function toldBefore(scan: Scan, repo: RepositoryRiskRepo) {
     reads.push(read.packages)
   }
   for (const packages of reads) assessLater(scan, packages)
+  scan.actions?.add(told.actions ?? [])
   return true
 }
 
-// Each repository, a repository at a time, but those an earlier part told
-// whole (ScanProgress).
+// Each repository, READ_AHEAD read at a time, each told in turn, but those an
+// earlier part told whole (ScanProgress), read of none.
 async function readRepositories(scan: Scan) {
   const repos = await scan.source.repos()
   scan.lines.add({ type: 'repos', repos: repos.map(repo => ({ id: repo.repoId, fullName: repo.fullName })) })
@@ -391,9 +388,19 @@ async function readRepositories(scan: Scan) {
   const kept = await scan.source.progress?.read()
   const progress = kept && Date.now() - kept.at < SCAN_READ_KEPT_MS ? kept.value.repos : []
   for (const told of progress) if (listed.has(told.id)) scan.told.set(told.id, told)
-  for (const repo of repos) {
+  const reads: Promise<RepositoryRead | RepositoryFailure | null>[] = []
+  const read = (at: number) => {
+    if (reads[at]) return reads[at]
+    const repo = repos[at]!
+    const started = reads[at] = toldBefore(scan, repo).then(told => told ? null : readRepository(scan, repo))
+    // One read ahead and no longer waited on, as the scan stopped, fails alone.
+    started.catch(() => {})
+    return started
+  }
+  for (const [at, repo] of repos.entries()) {
     if (scan.signal.aborted) return
-    if (!await toldBefore(scan, repo)) await readRepository(scan, repo)
+    for (let ahead = at; ahead < Math.min(at + READ_AHEAD, repos.length); ahead++) void read(ahead)
+    await tellRepository(scan, repo, await read(at))
   }
 }
 
@@ -429,7 +436,9 @@ export async function* repositoryRiskLines<R extends RepositoryRiskRepo>(source:
   // none waited for: the work under way, such as a request to GitHub, which
   // isn't given up on at once, outlasting it.
   const lines = queue<RepositoryRiskLine>(AbortSignal.any([signal, part.signal]), { drain: true })
-  const scan: Scan = { source, caches, signal: running, lines, lookups: queue(running), seen: new Map(), dev: new Map(), stale: [], told: new Map() }
+  const actions = source.actions ? resolvingActions({ source: source.actions, signal: running, tell: line => { lines.add(line) }, memory: caches.actions,
+    answers: caches.actionAnswers, store: source.actionLines }) : null
+  const scan: Scan = { source, caches, signal: running, lines, lookups: queue(running), seen: new Map(), dev: new Map(), stale: [], told: new Map(), actions }
   const failed: unknown[] = []
   void (async () => {
     try {
@@ -444,6 +453,7 @@ export async function* repositoryRiskLines<R extends RepositoryRiskRepo>(source:
       for (const left of leftOver(scan)) {
         if (!running.aborted && left.length > 0) await assessing(scan, assess => { assess(left); return Promise.resolve() })
       }
+      await actions?.close()
       if (!running.aborted) scan.lines.add({ type: 'done' })
     } catch (error) {
       failed.push(error)