@preventive/triage 1.0.0-alpha.45 → 1.0.0-alpha.46

package/server-managed/pretty-print.ts

@@ -12,16 +12,17 @@ import { promisify } from 'node:util'
 import { brotliDecompress } from 'node:zlib'
 import { format } from '@preventive/compare/pretty.js'
 import { computeFileHash } from '@preventive/report'
-import { FILE_HASH } from '../common/bundle-metadata.js'
+import { FILE_HASH, computeBundleFileHashes } from '../common/bundle-metadata.js'
 import { bundleCompareFiles } from '../common/bundle-compare-inputs.js'
 import { bundlePackageDirs, bundleSourcesAsMap } from '../common/bundle-sources.js'
 import { MAX_PRETTY_BYTES, needsPrettyPrint, prettyExtension } from '../common/pretty-print.js'
 import type { OpenedBlob } from './blob-store.ts'
-import { type BundleCacheStorage, readBundleDetails } from './bundle-cache.ts'
+import { type BundleCacheStorage, readSizedBundleDetails } from './bundle-cache.ts'
 import type { BundleStore } from './bundle-store.ts'
 import { encodeBrotli } from './brotli.ts'
 import { CacheMissError, type CacheStorage } from './cache-storage.ts'
 import type { ManagedBundle, ManagedDb } from './db.ts'
+import { keptBriefly } from './kept-briefly.ts'
 import { loadNpmFiles } from './npm-loads.ts'
 import { type NpmVersionDocument, npmFileText } from './npm-packages.ts'
 
@@ -34,6 +35,16 @@ const PRETTY_VERSION = 4
 // after another, beside other readers'), any more refused.
 const MAX_ACTIVE_FORMATS = 2
 const MAX_WAITING_FORMATS = 16
+// How long a bundle's details are kept once read, and what the two last read
+// may have decoded from between them, the least lately read going first past
+// it: Compare's requests for a pair of bundles come one after another, each
+// reading both, and the Code tab's for one, each reading it.
+const DETAILS_KEPT_MS = 60_000
+const MAX_KEPT_DETAILS = 2
+const MAX_KEPT_DETAILS_BYTES = 256 * 1024 * 1024
+// Files hashed at once: one at a time, each waits its own round trip to the
+// thread pool; all at once, every one's job is held together.
+const HASHES_AT_ONCE = 32
 
 export class PrettyError extends Error {
   status: number
@@ -108,6 +119,18 @@ export async function prettyBody(text: string, extension: string): Promise<Buffe
 
 const opened = (body: Buffer): OpenedBlob => ({ size: body.byteLength, stream: Readable.from([body]) })
 
+// A version's file's hash, by its bytes: those of a version's files loaded
+// a little while since are the same bytes (npm-loads.ts), hashed once.
+const fileHashes = new WeakMap<Uint8Array, Promise<string>>()
+function npmFileHash(bytes: Uint8Array): Promise<string> {
+  let hash = fileHashes.get(bytes)
+  if (!hash) {
+    fileHashes.set(bytes, hash = computeFileHash(bytes))
+    hash.catch(() => { fileHashes.delete(bytes) })
+  }
+  return hash
+}
+
 const decompress = promisify(brotliDecompress)
 
 // A pretty-printed copy's text, from its Brotli-encoded bytes.
@@ -127,7 +150,7 @@ async function npmPrintable(doc: NpmVersionDocument): Promise<Array<PrettyReques
       const extension = prettyExtension(path)
       if (extension === null || bytes.byteLength > MAX_PRETTY_BYTES) continue
       const text = npmFileText(bytes)
-      if (text !== null && needsPrettyPrint(path, text)) files.push({ path, hash: await computeFileHash(bytes), extension, text })
+      if (text !== null && needsPrettyPrint(path, text)) files.push({ path, hash: await npmFileHash(bytes), extension, text })
     }
   } finally { load.release() }
   return files.toSorted((a, b) => (a.path < b.path ? -1 : 1))
@@ -206,26 +229,35 @@ async function kept(open: () => Promise<OpenedBlob>): Promise<OpenedBlob | null>
 
 // A side's files that can be formatted, with their texts, and every one of
 // its files' hashes by path, from their paths and contents: texts, or bytes,
-// read as text where they are.
-async function sideFiles(entries: Iterable<[string, string | Uint8Array]>): Promise<Pick<ComparedSide, 'files' | 'hashes'>> {
+// read as text where they are; hashed by `hashOf`, a few at once.
+async function sideFiles<T extends string | Uint8Array>(entries: Array<[string, T]>, hashOf: (file: string, content: T) => Promise<string>): Promise<Pick<ComparedSide, 'files' | 'hashes'>> {
   const files: ComparedSide['files'] = [], hashes = new Map<string, string>()
+  for (let i = 0; i < entries.length; i += HASHES_AT_ONCE) {
+    const chunk = entries.slice(i, i + HASHES_AT_ONCE)
+    const hashed = await Promise.all(chunk.map(async ([path, content]) => [path, await hashOf(path, content)] as const))
+    for (const [path, hash] of hashed) hashes.set(path, hash)
+  }
   for (const [path, content] of entries) {
-    const hash = await computeFileHash(content)
-    hashes.set(path, hash)
     const extension = prettyExtension(path)
     if (extension === null || (typeof content === 'string' ? Buffer.byteLength(content) : content.byteLength) > MAX_PRETTY_BYTES) continue
     const text = typeof content === 'string' ? content : npmFileText(content)
-    if (text !== null) files.push({ path, hash, extension, text })
+    if (text !== null) files.push({ path, hash: hashes.get(path)!, extension, text })
   }
   return { files, hashes }
 }
 
 // A bundle's side, from its details: its files, as sideFiles reads them,
 // within a reason `scope` as Compare reads them there (bundleCompareFiles),
-// and its packages' directories.
+// and its packages' directories; hashed once for its details, as long as
+// they are kept (computeBundleFileHashes).
 async function bundleSide(details: Parameters<typeof bundlePackageDirs>[0], scope: string): Promise<Pick<ComparedSide, 'files' | 'hashes' | 'packageDirs'>> {
   const scoped = scope ? new Set(bundleCompareFiles(details, scope).keys()) : null, sources = bundleSourcesAsMap(details)
-  return { ...await sideFiles(scoped ? [...sources].filter(([path]) => scoped.has(path)) : sources), packageDirs: bundlePackageDirs(details) }
+  const hashed: Map<string, string> = await computeBundleFileHashes(details)
+  return { ...await sideFiles(scoped ? [...sources].filter(([path]) => scoped.has(path)) : [...sources], (path, content) => {
+    const hash = hashed.get(path)
+    return hash === undefined ? computeFileHash(content) : Promise.resolve(hash)
+  }),
+    packageDirs: bundlePackageDirs(details) }
 }
 
 // A version's files by path, from one load of them.
@@ -251,14 +283,25 @@ export function stalePrettyRemover(npm: CacheStorage): (signal?: AbortSignal) =>
 }
 
 // A bundle's details, from its bytes in `store`: bundles are read one at a
-// time, as reading one decodes all of it.
+// time, as reading one decodes all of it, readers asking for one waiting its
+// turn or being read sharing it; and kept a little while once read
+// (DETAILS_KEPT_MS), each reader's access to the bundle the caller's to check
+// as ever.
 function detailsReader(store: BundleStore) {
-  const enqueue = serial()
-  return (record: ManagedBundle) => enqueue(async () => {
-    const details = await readBundleDetails(record, store)
-    if (!details) throw new PrettyError(422, 'bundle-unavailable')
-    return details
-  })
+  type Details = NonNullable<Awaited<ReturnType<typeof readSizedBundleDetails>>>['details']
+  const enqueue = serial(), share = sharing<Details>()
+  const held = keptBriefly<Details>({ keptMs: DETAILS_KEPT_MS, maxBytes: MAX_KEPT_DETAILS_BYTES, maxEntries: MAX_KEPT_DETAILS })
+  return (record: ManagedBundle): Promise<Details> => {
+    const key = `${record.id} ${record.integrity}`
+    const hit = held.get(key)
+    if (hit) return Promise.resolve(hit)
+    return share(key, () => enqueue(async () => {
+      const read = await readSizedBundleDetails(record, store)
+      if (!read) throw new PrettyError(422, 'bundle-unavailable')
+      held.keep(key, read.details, read.decodedBytes)
+      return read.details
+    }))
+  }
 }
 
 export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage, db: Pick<ManagedDb, 'getBundle'>, store: BundleStore) {
@@ -317,7 +360,7 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
         try {
           const bytes = (await load.result).find(entry => entry.path === request.path)?.bytes
           if (!bytes) throw new PrettyError(404, 'no-file')
-          if (await computeFileHash(bytes) !== request.hash) throw new PrettyError(409, 'hash-mismatch')
+          if (await npmFileHash(bytes) !== request.hash) throw new PrettyError(409, 'hash-mismatch')
           text = npmFileText(bytes)
         } finally { load.release() }
         if (text === null) throw new PrettyError(422, 'unformattable')
@@ -338,19 +381,20 @@ export function createPrettyCache(bundles: BundleCacheStorage, npm: CacheStorage
     // pretty-printed (compared), and their diffs with renamed names hidden
     // (rename-diff.ts renamedPairs); a bundle's within a reason `scope`
     // where one is asked for, as Compare reads it then.
-    async bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
+    bundleSides(base: ManagedBundle, other: ManagedBundle, scope = ''): Promise<[ComparedSide, ComparedSide]> {
       const sideOf = async (record: ManagedBundle, side: Side): Promise<ComparedSide> => ({ side, ...await bundleSide(await bundleDetails(record), scope),
         kept: request => kept(() => bundles.open(record.id, prettyFile(request))),
         made: async (request, text) => opened(await bundleCopy(record, request, () => Promise.resolve(text))) })
-      return [await sideOf(base, 'base'), await sideOf(other, 'other')]
+      return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
     },
     // A bundle's details, read in its turn, as Compare pairs them (comparison.ts).
     bundleDetails,
-    async npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
-      const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc)), packageDirs: null,
+    npmSides(base: NpmVersionDocument, other: NpmVersionDocument): Promise<[ComparedSide, ComparedSide]> {
+      const sideOf = async (doc: NpmVersionDocument, side: Side): Promise<ComparedSide> => ({ side, ...await sideFiles(await npmFiles(doc), (_, bytes) => npmFileHash(bytes)),
+        packageDirs: null,
         kept: request => (doc.private ? Promise.resolve(null) : kept(() => npm.open(prettyFile(request)))),
         made: (request, text) => npmCopy(doc, request, () => Promise.resolve(text)) })
-      return [await sideOf(base, 'base'), await sideOf(other, 'other')]
+      return Promise.all([sideOf(base, 'base'), sideOf(other, 'other')])
     },
   }
 }

package/server-managed/pull-dependencies.ts

@@ -109,6 +109,8 @@ export interface PullDependencyStore {
 // scan's are (repository-risk.ts riskCaches).
 type LockfileRead = { packages: LockedPackage[] } | { error: string; detail?: string }
 const lockfileReads: Lru<LockfileRead> = lru(200_000, read => 'packages' in read ? read.packages.length + 1 : 1)
+// Those being read, by the token reading them too, lest each asking at once read them.
+const lockfilesReading = new Map<string, Promise<LockfileRead>>()
 
 const api = (fullName: string) => `https://api.github.com/repos/${fullName.split('/').map(encodeURIComponent).join('/')}`
 
@@ -169,14 +171,26 @@ function lockfilesChanged(files: ChangedFile[]) {
     omitted: all.slice(MAX_DIRECTORIES).flatMap(([, directory]) => [...directory.paths]).toSorted() }
 }
 
-// A lockfile's packages at `ref`, as read in this instance, else of GitHub;
-// a lockfile its reader refuses, why. Any failure to read it of GitHub but
-// its having none there is the whole answer's, as it would be every file's.
-export async function readLockfile(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }): Promise<LockfileRead> {
-  if (format === 'bun') return { error: 'lockfile-unsupported' }
-  const key = `${fullName}\0${ref}\0${path}`
+// Whether `lockfile` at `ref` is held in this instance, read without asking
+// GitHub: Bun's, never read, too.
+export const lockfileHeld = (fullName: string, ref: string, { path, format }: { path: string; format: Format }) =>
+  format === 'bun' || lockfileReads.get(`${fullName}\0${ref}\0${path}`) !== undefined
+
+// A lockfile's packages at `ref`, as read in this instance, else shared with
+// a read of it with the same token still under way, else of GitHub; a
+// lockfile its reader refuses, why. Any failure to read it of GitHub but its
+// having none there is the whole answer's, as it would be every file's.
+export function readLockfile(fullName: string, token: string, ref: string, lockfile: { path: string; format: Format }): Promise<LockfileRead> {
+  if (lockfile.format === 'bun') return Promise.resolve({ error: 'lockfile-unsupported' })
+  const key = `${fullName}\0${ref}\0${lockfile.path}`
   const known = lockfileReads.get(key)
-  if (known) return known
+  if (known) return Promise.resolve(known)
+  const shared = `${token}\0${key}`
+  const reading = lockfilesReading.get(shared) ?? readOf(fullName, token, ref, lockfile, key).finally(() => lockfilesReading.delete(shared))
+  lockfilesReading.set(shared, reading)
+  return reading
+}
+async function readOf(fullName: string, token: string, ref: string, { path, format }: { path: string; format: Format }, key: string): Promise<LockfileRead> {
   let text: string
   try {
     text = await upstreamGithub(() => createClient({ token, userAgent: 'deepview-triage' }).getRepoFile({ repo: fullName, path, ref }))
@@ -261,10 +275,16 @@ function addedIn(paths: string[], before: LockfileRead[], after: LockfileRead[])
 // where it changes no lockfile read here.
 export async function pullDependencies(fullName: string, token: string, number: number, kept: PullDependencyStore,
   fetchImpl: typeof fetch = globalThis.fetch): Promise<PullDependencies> {
+  return (await pullDependenciesAt(fullName, token, number, kept, fetchImpl)).told
+}
+// The same, with the commits it is kept by (`commits`), its base's and
+// head's, by which `kept` reads it.
+export async function pullDependenciesAt(fullName: string, token: string, number: number, kept: PullDependencyStore,
+  fetchImpl: typeof fetch = globalThis.fetch): Promise<{ commits: string; told: PullDependencies }> {
   const { base, head } = await pullCommits(fullName, token, number, fetchImpl)
   const key = `${base}...${head}`
   const held = await kept.read(key)
-  if (held) return held
+  if (held) return { commits: key, told: held }
   const { mergeBase, files, cut: filesCut } = await pullFiles(fullName, token, number, base, head, fetchImpl)
   const { directories, cut, omitted } = lockfilesChanged(files)
   const reads = directories.flatMap(({ before, after }) => [...before.map(lockfile => [mergeBase, lockfile] as const), ...after.map(lockfile => [head, lockfile] as const)])
@@ -276,5 +296,5 @@ export async function pullDependencies(fullName: string, token: string, number:
   })
   const told = { base: mergeBase, head, lockfiles, cut: filesCut || cut, ...cut && !filesCut && omitted.length <= MAX_OMITTED ? { omitted } : {} }
   await kept.write(key, told)
-  return told
+  return { commits: key, told }
 }

package/server-managed/pull-dependency-reviews.ts

@@ -24,7 +24,7 @@
 // changes: it is read once, every lockfile there of those read here
 // (pull-dependencies.ts), and kept by the commit (`baselines` in this
 // instance, `kept` beyond it), never stored as reviews.
-import { lockedAt, lockedIn } from './commit-lockfiles.ts'
+import { type GithubAsked, lockedAt, lockedIn } from './commit-lockfiles.ts'
 import { GithubApiError } from './github-app.ts'
 import type { LockedPackage } from './locked-packages.ts'
 import { EVERY_LOCKFILE, type LockfileScope, heldTo, isEvery, reviewedIn } from './lockfile-scope.ts'
@@ -68,13 +68,13 @@ const baselineKeys = (pkg: LockedPackage) => hashesOf(pkg).map(hash => `${pkg.na
 // and kept; with the lockfiles there its reader refuses, isn't one of, or
 // past those read (`unread`). GitHub having none of a lockfile it lists
 // there is a failure of the whole, as of any file, never kept.
-export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore): Promise<Baseline> {
+export async function reviewBaseline(fullName: string, token: string, repoId: number, since: string, kept: ReviewBaselineStore, asked?: GithubAsked): Promise<Baseline> {
   const key = `${repoId}\0${since}`
   const known = baselines.get(key)
   if (known) return known
   const stored = await kept.read(key)
   if (stored) { const baseline = { versions: new Set(stored.versions), unread: stored.unread }; baselines.set(key, baseline); return baseline }
-  const read = await lockedAt(fullName, token, since)
+  const read = await lockedAt(fullName, token, since, () => true, asked)
   const { packages } = lockedIn(read), { unread } = read
   const versions = new Set<string>()
   for (const pkg of packages) if (reviewedAs(pkg) === 'version') for (const held of baselineKeys(pkg)) versions.add(held)
@@ -298,18 +298,18 @@ export async function reviewedDependencies(told: PullDependencies, state: RepoRe
     ...unread.length > 0 && !reviewed ? { baselineUnread: unread.slice(0, MAX_UNREVIEWED) } : {}, ...isEvery(scope) ? {} : { lockfiles: scope } } }
 }
 
-// The packages a pull request's lockfiles lock that its reviews here may
-// pass, whose reviews are asked: those that can be reviewed, unpatched.
+// The package versions a pull request's lockfiles lock that its reviews here
+// may pass, whose reviews are asked: those that can be reviewed, unpatched.
 export const reviewedPackages = (told: PullDependencies) => told.lockfiles
-  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version' && !pkg.patchHash).map(pkg => pkg.name))
+  .flatMap(dir => 'error' in dir ? [] : dir.locked.filter(pkg => reviewedAs(pkg) === 'version' && !pkg.patchHash).map(pkg => ({ name: pkg.name, version: pkg.version! })))
 
 // A repository's baseline as read for a pull request: its versions and the
 // lockfiles there left unread; none where it reviews since no commit; and
 // where GitHub doesn't read it, none and why.
-export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore) {
+export async function baselineFor(fullName: string, token: string, repoId: number, state: RepoReviewState, kept: ReviewBaselineStore, asked?: GithubAsked) {
   if (!state.since) return { baseline: null, unread: [], error: null }
   try {
-    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept)
+    const { versions, unread } = await reviewBaseline(fullName, token, repoId, state.since, kept, asked)
     return { baseline: versions, unread, error: null }
   } catch (err) {
     if (err instanceof GithubApiError && err.status !== 429 && err.status !== 401) return { baseline: null, unread: [], error: err.message }

package/server-managed/queue.ts

@@ -21,3 +21,19 @@ export function queue<T>(signal: AbortSignal, { drain = false } = {}): Queue<T>
     },
   }
 }
+
+// Work done `count` at a time, in the order asked, the rest waiting their
+// turn.
+export function inTurns(count: number): <T>(work: () => Promise<T>) => Promise<T> {
+  let active = 0
+  const waiting: (() => void)[] = []
+  return async work => {
+    if (active < count) active++
+    else await new Promise<void>(resolve => { waiting.push(resolve) })
+    try { return await work() } finally {
+      const next = waiting.shift()
+      if (next) next()
+      else active--
+    }
+  }
+}

package/server-managed/rename-diff.ts

@@ -179,7 +179,10 @@ export async function renameDiffOf(request: RenameDiffRequest, texts: () => Prom
   return opened(await answerOf(request, texts, keep))
 }
 
-async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean): Promise<Buffer> {
+// Sides `verified` to be the files the request names (renamedPairs) are read
+// only where no answer is kept or on its way; others are read first, as
+// reading them checks they are.
+async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string, string]>, keep: boolean, verified = false): Promise<Buffer> {
   // Sides not kept are formatted again for each diff (pretty-print.ts), so
   // they are read in its turn: the files a Diff view asks for at once wait
   // here rather than being refused by the formats running. Within its minute
@@ -193,21 +196,27 @@ async function answerOf(request: RenameDiffRequest, texts: () => Promise<[string
     })
     return encoded(diff, request, sides)
   }
-  const [before, after] = await texts()
   // A file's type is part of how it is read: the same text as a script and as a module differ.
   const key = `${request.base.hash}\0${request.base.extension}\0${request.other.hash}\0${request.other.extension}`
-  const found = kept.get(key)
-  if (found) {
-    kept.delete(key)
-    kept.set(key, found)
-    return found
+  const held = () => {
+    const found = kept.get(key)
+    if (found) {
+      kept.delete(key)
+      kept.set(key, found)
+    }
+    return found ?? pending.get(key)
   }
-  let job = pending.get(key)
-  if (!job) {
-    const deadline = Date.now() + DIFF_TIMEOUT_MS
-    pending.set(key, job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key)))
+  let answer = verified ? held() : undefined
+  if (!answer) {
+    const [before, after] = await texts()
+    answer = held()
+    if (!answer) {
+      const deadline = Date.now() + DIFF_TIMEOUT_MS
+      const job = inTurn(deadline, () => inWorker(before, after, request, deadline)).then(diff => encoded(diff, request, [before, after])).finally(() => pending.delete(key))
+      pending.set(key, answer = job)
+    }
   }
-  const body = await job
+  const body = await answer
   kept.set(key, body)
   if (kept.size > KEPT_DIFFS) kept.delete(kept.keys().next().value!)
   return body
@@ -258,7 +267,7 @@ export function renamedPairs([base, other]: readonly [ComparedSide, ComparedSide
       const named = { path: from.path, hash: from.hash, otherPath: to.path, otherHash: to.hash }
       const copy = async (side: ComparedSide, { text, ...file }: typeof from) => prettyText(await side.kept(file) ?? await side.made(file, text))
       let body
-      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep) }
+      try { body = await answerOf(request, async () => [await copy(base, from), await copy(other, to)], keep, true) }
       catch (err) {
         if (!(err instanceof PrettyError)) throw err
         yield { ...named, error: err.message, status: err.status }

package/server-managed/report-sources.ts

@@ -146,7 +146,7 @@ export function createReportSourcesCache(storage: CacheStorage, db: ManagedDb, r
   }
   return {
     async open(report: ReportRecord, bundle: ManagedBundle, permissions: ViewerPermissions, sourcePaths?: Set<string>) {
-      const repo = { github: (await db.listAllRepos()).find(entry => entry.repoId === report.repoId)?.fullName ?? null }
+      const repo = { github: report.repoId == null ? null : await db.getRepoFullName(report.repoId) }
       const target = sourceCacheFilename(report, bundle, permissions, repo, sourcePaths)
       try { return { ...await storage.open(target), repo } }
       catch (error) { if (!(error instanceof CacheMissError)) throw error }

package/server-managed/report-store.ts

@@ -15,33 +15,66 @@ async function readBytes(stored: OpenedBlob): Promise<Buffer> {
   } finally { stored.stream.destroy() }
 }
 
+// Ids whose original copy is known gone, at most this many.
+const COMPRESSED_ONLY_MAX = 16_384
+
 export function createReportStore(legacy: BlobStore, compressed: BlobStore,
   replaceLegacy: (id: string, bytes: Buffer) => Promise<unknown>): BlobStore {
+  // Reports this store wrote, converted, or found with only the compressed
+  // copy. Uploads write only that copy and nothing writes an original again,
+  // so their reads stop asking storage for one, each a miss (and, encrypted,
+  // a row read too). A compressed copy missing there asks for the original
+  // after all. An original left by a conversion that failed is never in it:
+  // the next read finds that original and resumes the conversion.
+  const compressedOnly = new Set<string>()
+  function remember(id: string): void {
+    compressedOnly.delete(id)
+    if (compressedOnly.size >= COMPRESSED_ONLY_MAX) compressedOnly.delete(compressedOnly.values().next().value!)
+    compressedOnly.add(id)
+  }
+  async function openCompressed(id: string): Promise<OpenedBlob | null> {
+    const stored = await compressed.open(id)
+    if (!stored) return null
+    const stream = createBrotliDecompress()
+    // pipeline carries storage/authentication errors into the decoded stream
+    // and closes the stored source when a reader leaves before EOF.
+    void pipeline(stored.stream, stream).catch(() => {})
+    return { size: null, stream }
+  }
   async function open(id: string): Promise<OpenedBlob | null> {
+    if (compressedOnly.has(id)) {
+      const stored = await openCompressed(id)
+      if (stored) return stored
+      compressedOnly.delete(id)
+    }
     // Keep the original available until conversion succeeds. Concurrent reads
     // can finish using an already-open stream while another reader converts it.
     const original = await legacy.open(id)
     if (original) {
       const bytes = await readBytes(original)
       await replaceLegacy(id, await encodeBrotli(bytes, 9))
+      remember(id)
       return { size: bytes.length, stream: Readable.from([bytes]) }
     }
-    const stored = await compressed.open(id)
-    if (!stored) return null
-    const stream = createBrotliDecompress()
-    // pipeline carries storage/authentication errors into the decoded stream
-    // and closes the stored source when a reader leaves before EOF.
-    void pipeline(stored.stream, stream).catch(() => {})
-    return { size: null, stream }
+    const stored = await openCompressed(id)
+    if (stored) remember(id)
+    return stored
   }
   return {
-    put: async (id, bytes) => compressed.put(id, await encodeBrotli(bytes, 9)),
+    async put(id, bytes) {
+      const wrapped = await compressed.put(id, await encodeBrotli(bytes, 9))
+      remember(id)
+      return wrapped
+    },
     open,
     async get(id) {
       const stored = await open(id)
       if (!stored) return null
       return readBytes(stored)
     },
-    async delete(id) { await Promise.all([compressed.delete(id), legacy.delete(id)]) },
+    async delete(id) {
+      compressedOnly.delete(id)
+      await Promise.all([compressed.delete(id), legacy.delete(id)])
+    },
   }
 }

package/server-managed/repository-actions.ts

@@ -92,7 +92,8 @@ export function actionsLines(repo: number, owner: string, read: WorkflowsRead, l
   if ('error' in read) return { lines: [{ type: 'workflows', repo, ...read } as WorkflowsLine], refs: [] as ActionRef[] }
   const lines: (WorkflowsLine | WorkflowLine)[] = [{ type: 'workflows', repo, paths: read.files.filter(file => file.kind === 'workflow').map(file => file.path) }]
   const refs = new Map<string, ActionRef>()
-  const actions = new Map(read.files.flatMap(file => file.kind === 'action' && 'text' in file ? [[actionDir(file.path), file.text] as const] : []))
+  // Its own actions by their directories and workflows by their paths, as a step or a job uses one.
+  const actions = new Map(read.files.flatMap(file => file.kind !== 'dockerfile' && 'text' in file ? [[file.kind === 'action' ? actionDir(file.path) : file.path, file.text] as const] : []))
   for (const file of read.files) {
     const scan = 'error' in file ? file : file.kind === 'dockerfile' ? { uses: [], findings: dockerfileFindings(file.text) } : scanWorkflow(file.kind, file.text, { owner, lockfiles, actions })
     lines.push({ type: 'workflow', repo, path: file.path, kind: file.kind, ...scan })
@@ -151,10 +152,12 @@ export interface ActionsResolving {
   store?: KeptStore<ActionLine> | undefined
 }
 
-// A reference's line: kept, else resolved, and kept where it is a public
-// repository's; why not, where it couldn't be.
-async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef): Promise<ActionLine | null> {
-  const kept = resolving.memory.get(key) ?? await resolving.store?.read(key).then(row => row && { at: row.at, line: row.value })
+// A reference's line: kept (`stored`, as read of the store with others),
+// else resolved, and kept where it is a public repository's; why not, where
+// it couldn't be.
+async function resolved(resolving: ActionsResolving, source: ActionsSource, { key, owner }: ActionRef,
+  stored = resolving.store?.read(key)): Promise<ActionLine | null> {
+  const kept = resolving.memory.get(key) ?? await stored?.then(row => row && { at: row.at, line: row.value })
   if (kept && Date.now() - kept.at < RISK_KEPT_MS) { resolving.memory.set(key, kept); return kept.line }
   const uses = usesOfKey(key)
   if (!uses) return { type: 'action', key, error: 'invalid-uses' }
@@ -180,6 +183,9 @@ export function resolvingActions(resolving: ActionsResolving) {
   const source = keptSource(sharedSource(resolving.source, resolving.answers))
   const pending: Queue<ActionRef> = queue(resolving.signal)
   const latest = new Map<string, ActionRef>()
+  // Those of the references added at once kept beyond this instance, read of
+  // the store together as they are added.
+  const stored = new Map<string, Promise<{ at: number; value: ActionLine } | null>>()
   let closed = false, waiting = 0
   const settle = () => { if (closed && waiting === 0) pending.close() }
   const add = (refs: ActionRef[]) => {
@@ -191,11 +197,14 @@ export function resolvingActions(resolving: ActionsResolving) {
       waiting++
       pending.add(kept)
     }
+    const unread = [...new Set(refs.map(ref => ref.key))].filter(key => latest.has(key) && !stored.has(key) && !resolving.memory.get(key))
+    const read = unread.length > 0 ? resolving.store?.readMany(unread) : undefined
+    for (const key of read ? unread : []) stored.set(key, read!.then(found => found.get(key) ?? null))
   }
   const work = async () => {
     for (let ref = await pending.take(); ref !== undefined; ref = await pending.take()) {
       try {
-        const line = await resolved(resolving, source, ref)
+        const line = await resolved(resolving, source, ref, stored.get(ref.key))
         if (line && latest.get(ref.key) === ref) {
           resolving.tell(line)
           const owner = 'repository' in line ? (line.repository?.fullName ?? line.repo).split('/')[0]! : ref.owner