@rmartz/pr-policy 0.2.0 → 0.8.0

package/dist/{chunk-QINHHFJN.js → chunk-5VYRZAUT.js}

@@ -2,6 +2,25 @@
 var PR_POLICY_CHECK_NAME = "pr-policy";
 var CI_APPROVAL_NEEDED_LABEL = "CI approval needed";
 var CI_CHANGE_APPROVED_LABEL = "CI change approved";
+var UAT_PASSED_LABEL = "UAT passed";
+var LEGACY_UAT_PASSED_LABEL = "tested";
+var NO_UAT_NEEDED_LABEL = "no UAT needed";
+var SIGN_OFF_LABELS = [
+  CI_CHANGE_APPROVED_LABEL,
+  UAT_PASSED_LABEL,
+  LEGACY_UAT_PASSED_LABEL,
+  NO_UAT_NEEDED_LABEL
+];
+var DO_NOT_MERGE_LABEL = "do not merge";
+var DNM_LABEL = "dnm";
+var BLOCKED_LABEL = "blocked";
+var ESCALATION_NEEDED_LABEL = "escalation needed";
+var BLOCKING_LABELS = [
+  DO_NOT_MERGE_LABEL,
+  DNM_LABEL,
+  BLOCKED_LABEL,
+  ESCALATION_NEEDED_LABEL
+];
 var BREAKING_CHANGE_LABEL = "breaking change";
 var HOTFIX_LABEL = "hotfix";
 var RELEASE_PLEASE_PENDING_LABEL = "autorelease: pending";
@@ -519,15 +538,42 @@ function classifyWorkflowChanges(changes) {
   return { verdict: indicators.length > 0 ? "loosening" : "tightening", indicators };
 }
 
+// src/policy.ts
+var REPO_PERMISSIONS = ["admin", "maintain", "write", "triage", "read", "none"];
+
+// src/sign-off.ts
+function isRepoPermission(value) {
+  return REPO_PERMISSIONS.some((permission) => permission === value);
+}
+var MERGE_PERMISSIONS = /* @__PURE__ */ new Set(["admin", "maintain", "write"]);
+function vet(actor) {
+  if (actor === void 0) return "no labeling event names a live account";
+  if (actor.type !== "User") return `\`${actor.login}\` is a ${actor.type}, not a person`;
+  if (!MERGE_PERMISSIONS.has(actor.permission)) {
+    return `\`${actor.login}\` has \`${actor.permission}\` permission; write, maintain, or admin is required`;
+  }
+  return actor;
+}
+function signOffState(pr, names) {
+  const present = names.filter((name) => pr.labels.includes(name));
+  let untrusted;
+  for (const label of present) {
+    const vetted = vet(pr.signOffs.find((signOff) => signOff.label === label)?.appliedBy);
+    if (typeof vetted !== "string") return { status: "trusted", label, appliedBy: vetted };
+    untrusted ??= { status: "untrusted", label, reason: vetted };
+  }
+  return untrusted ?? { status: "absent" };
+}
+
 // src/checks/ci-change/index.ts
 var CI_CHANGE_CHECK = "ci-change";
 function indicatorMessage(indicator) {
   return `\`${indicator.file}\` \`${indicator.location}\` \u2014 ${indicator.kind} (${indicator.class}): ${indicator.detail}`;
 }
-function decideCiChange(classification, labels) {
-  const present = new Set(labels);
-  const signedOff = present.has(CI_CHANGE_APPROVED_LABEL);
-  const flagged = present.has(CI_APPROVAL_NEEDED_LABEL);
+function decideCiChange(classification, pr) {
+  const approval = signOffState(pr, [CI_CHANGE_APPROVED_LABEL]);
+  const signedOff = approval.status === "trusted";
+  const flagged = pr.labels.includes(CI_APPROVAL_NEEDED_LABEL);
   const loosening = classification.verdict === "loosening";
   const labelsToAdd = loosening && !flagged ? [CI_APPROVAL_NEEDED_LABEL] : [];
   const labelsToRemove = !loosening && flagged && !signedOff ? [CI_APPROVAL_NEEDED_LABEL] : [];
@@ -550,54 +596,68 @@ function decideCiChange(classification, labels) {
     message: `This PR loosens CI and is waiting for a human to review the change and apply \`${CI_CHANGE_APPROVED_LABEL}\`. No code change clears this. Ambiguous indicators are treated as loosening because a miss skips the sign-off entirely.`,
     effect: "hold"
   };
+  const untrusted = approval.status === "untrusted" ? [
+    {
+      check: CI_CHANGE_CHECK,
+      message: `\`${approval.label}\` doesn't count: ${approval.reason}.`,
+      effect: "info"
+    }
+  ] : [];
   const evidence = classification.indicators.map((indicator) => ({
     check: CI_CHANGE_CHECK,
     message: indicatorMessage(indicator),
     effect: "info"
   }));
-  return { findings: [headline, ...evidence], labelsToAdd, labelsToRemove };
+  return { findings: [headline, ...untrusted, ...evidence], labelsToAdd, labelsToRemove };
 }
 var ciChangeCheck = {
   name: CI_CHANGE_CHECK,
-  evaluate: async (pr) => decideCiChange(classifyWorkflowChanges(pr.workflowChanges), pr.labels)
+  evaluate: async (pr) => decideCiChange(classifyWorkflowChanges(pr.workflowChanges), pr)
 };
 
-// src/checks/title/conventional.ts
-var COMMIT_TYPES = [
-  "feat",
-  "fix",
-  "docs",
-  "chore",
-  "refactor",
-  "test",
-  "style",
-  "perf",
-  "ci",
-  "build",
-  "revert"
-];
-var FUNCTIONAL_TYPES = [
-  "feat",
-  "fix",
-  "perf",
-  "revert"
-];
-var TITLE = /^([a-z]+)(?:\(([^)]+)\))?(!)?: (\S.*)$/;
-function isCommitType(value) {
-  return COMMIT_TYPES.includes(value);
-}
-function parseTitle(title) {
-  const match = TITLE.exec(title);
-  const [, type, scope, bang, subject] = match ?? [];
-  if (type === void 0 || subject === void 0 || !isCommitType(type)) return null;
-  return { type, scope, breaking: bang === "!", subject };
-}
-function isFunctionalType(type) {
-  return FUNCTIONAL_TYPES.includes(type);
+// src/checks/dependabot/claims.ts
+var NAME = /(?:\[([^\[\]\n]+)\]\([^()\n]*\)|`([^`]+)`|([^\s[\]`]+))/.source;
+var VERSION = /(\S+?)\.?(?=\s|$)/.source;
+var BUMP = new RegExp(String.raw`^Bumps ${NAME} from \S+ to ${VERSION}`, "gm");
+var UPDATE = new RegExp(String.raw`^Updates ${NAME} from \S+ to ${VERSION}`, "gm");
+var CELL = /`[^`|]+`/.source;
+var TABLE_ROW = new RegExp(String.raw`^\| ${NAME} \| ${CELL} \| \x60([^\x60|]+)\x60 \|`, "gm");
+var GROUP_HEADER = /^Bumps the \S+ group\b[^:\n]*:(.*)$/gm;
+var LINK = /\[([^\[\]\n]+)\]\([^()\n]*\)/g;
+var REQUIREMENTS = new RegExp(String.raw`^Updates the requirements on ${NAME}`, "gm");
+var REMOVAL = new RegExp(String.raw`^Removes ${NAME}`, "gm");
+function clean(name) {
+  return name.replace(/\u200b/g, "").trim();
+}
+function nameOf(match) {
+  return clean(match[1] ?? match[2] ?? match[3] ?? "");
+}
+function parseClaims(body) {
+  const claims = /* @__PURE__ */ new Map();
+  for (const pattern of [TABLE_ROW, BUMP, UPDATE]) {
+    for (const match of body.matchAll(pattern)) {
+      const name = nameOf(match);
+      if (name !== "" && match[4] !== void 0) claims.set(name, { name, to: match[4] });
+    }
+  }
+  for (const pattern of [REQUIREMENTS, REMOVAL]) {
+    for (const match of body.matchAll(pattern)) {
+      const name = nameOf(match);
+      if (name !== "" && !claims.has(name)) claims.set(name, { name });
+    }
+  }
+  for (const header of body.matchAll(GROUP_HEADER)) {
+    for (const link of (header[1] ?? "").matchAll(LINK)) {
+      const name = clean(link[1] ?? "");
+      if (name !== "" && !claims.has(name)) claims.set(name, { name });
+    }
+  }
+  return [...claims.values()];
 }
-var RELEASE_PLEASE_TITLE = /^chore(\([^)]*\))?!?:\s+release\b/;
-function isReleasePleaseTitle(title) {
-  return RELEASE_PLEASE_TITLE.test(title);
+var TITLE_BUMP = /\bbump (\S+) from \S+ to \S+/i;
+function titlePackage(title) {
+  const name = TITLE_BUMP.exec(title)?.[1];
+  return name === void 0 || name.toLowerCase() === "the" ? void 0 : name;
 }
 
 // src/checks/title/sensitive-bump.ts
@@ -630,9 +690,9 @@ function npmVersions(text) {
   const versions = /* @__PURE__ */ new Map();
   if (typeof parsed !== "object" || parsed === null) return versions;
   for (const field of DEPENDENCY_FIELDS) {
-    const block2 = parsed[field];
-    if (typeof block2 !== "object" || block2 === null) continue;
-    for (const [name, spec] of Object.entries(block2)) {
+    const block3 = parsed[field];
+    if (typeof block3 !== "object" || block3 === null) continue;
+    for (const [name, spec] of Object.entries(block3)) {
       if (typeof spec === "string") versions.set(name, spec);
     }
   }
@@ -666,8 +726,28 @@ function sensitiveBumps(changes) {
   return [...bumped];
 }
 
-// src/checks/title/workflow-change.ts
+// src/checks/ci-change/workflow-paths.ts
+var WORKFLOW_FILE = /^\.github\/workflows\/.+\.ya?ml$/;
+function isWorkflowPath(path) {
+  return WORKFLOW_FILE.test(path);
+}
+
+// src/checks/dependabot/actions.ts
 import { parse as parse2 } from "yaml";
+function usesValues(node, into = []) {
+  const seq = asArray(node);
+  if (seq) {
+    for (const entry of seq) usesValues(entry, into);
+    return into;
+  }
+  const map = asRecord(node);
+  if (!map) return into;
+  for (const [key, value] of Object.entries(map)) {
+    if (key === "uses" && typeof value === "string") into.push(value);
+    else usesValues(value, into);
+  }
+  return into;
+}
 function parses(text) {
   try {
     return { doc: parse2(text) };
@@ -675,21 +755,404 @@ function parses(text) {
     return null;
   }
 }
-function isPinBumpOnly(change) {
-  if (change.baseText === void 0 || change.headText === void 0) return false;
+function diffWorkflow(change) {
   const before = parses(change.baseText);
   const after = parses(change.headText);
+  if (before === null || after === null) return { kind: "unparseable" };
+  if (!deepEqual(normalizeUses(before.doc), normalizeUses(after.doc))) {
+    return { kind: "structural" };
+  }
+  const was = usesValues(before.doc);
+  const now = usesValues(after.doc);
+  const actions = now.flatMap((uses, index) => uses === was[index] ? [] : [stripActionRef(uses)]);
+  return { kind: "pins", actions: [...new Set(actions)] };
+}
+
+// src/checks/dependabot/manifests.ts
+function packageName(key) {
+  const leaf = key.slice(key.lastIndexOf(">") + 1);
+  const at = leaf.indexOf("@", 1);
+  return at === -1 ? leaf : leaf.slice(0, at);
+}
+function collect(where, block3, into) {
+  const record = asRecord(block3);
+  if (record === void 0) return;
+  const parent = where.slice(where.lastIndexOf(" ") + 1);
+  for (const [key, value] of Object.entries(record)) {
+    const at = `${where} ${key}`;
+    if (typeof value === "string") {
+      into.set(at, { name: packageName(key === "." ? parent : key), spec: value });
+    } else {
+      collect(at, value, into);
+    }
+  }
+}
+function splitNpm(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const doc = asRecord(parsed);
+  if (doc === void 0) return null;
+  const entries = /* @__PURE__ */ new Map();
+  const rest = { ...doc };
+  for (const field of [...DEPENDENCY_FIELDS, "overrides", "resolutions"]) {
+    collect(field, doc[field], entries);
+    delete rest[field];
+  }
+  const pnpm = asRecord(doc["pnpm"]);
+  if (pnpm !== void 0) {
+    collect("pnpm.overrides", pnpm["overrides"], entries);
+    const { overrides: _overrides, ...pnpmRest } = pnpm;
+    rest["pnpm"] = pnpmRest;
+  }
+  const manager = doc["packageManager"];
+  if (typeof manager === "string") {
+    const at = manager.indexOf("@", 1);
+    const name = at === -1 ? manager : manager.slice(0, at);
+    const spec = at === -1 ? "" : manager.slice(at + 1).replace(/\+.*/, "");
+    entries.set("packageManager", { name, spec });
+    delete rest["packageManager"];
+  }
+  return { entries, rest };
+}
+function diffEntries(before, after) {
+  const edits = [];
+  for (const key of /* @__PURE__ */ new Set([...before.keys(), ...after.keys()])) {
+    const was = before.get(key);
+    const now = after.get(key);
+    if (was?.spec === now?.spec && was?.name === now?.name) continue;
+    edits.push({ name: (now ?? was)?.name ?? key, before: was?.spec, after: now?.spec });
+  }
+  return edits;
+}
+function diffNpm(baseText, headText) {
+  const before = splitNpm(baseText);
+  const after = splitNpm(headText);
+  if (before === null || after === null) return null;
+  const otherChanges = [.../* @__PURE__ */ new Set([...Object.keys(before.rest), ...Object.keys(after.rest)])].filter((key) => !deepEqual(before.rest[key], after.rest[key])).map((key) => `\`${key}\``);
+  return { edits: diffEntries(before.entries, after.entries), otherChanges };
+}
+function otherLines(text) {
+  return text.split("\n").map((line) => line.trim()).filter((line) => line !== "" && !REQUIREMENT_LINE.test(line.replace(/#.*/, "")));
+}
+function diffPip(baseText, headText) {
+  const toEntries = (text) => new Map([...pipVersions(text)].map(([name, spec]) => [name, { name, spec }]));
+  const edits = diffEntries(toEntries(baseText), toEntries(headText));
+  const otherChanges = deepEqual(otherLines(baseText), otherLines(headText)) ? [] : ["lines other than pinned requirements"];
+  return { edits, otherChanges };
+}
+function diffManifest(change) {
+  return change.path.endsWith("package.json") ? diffNpm(change.baseText, change.headText) : diffPip(change.baseText, change.headText);
+}
+function manifestKey(path, name) {
+  return path.endsWith("package.json") ? name : normalize(name);
+}
+function specMentions(spec, version) {
+  const escaped = version.replace(/^v/, "").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:^|[^\\w.])v?${escaped}(?:$|[^\\w.-])`).test(spec);
+}
+
+// src/checks/title/workflow-change.ts
+import { parse as parse3 } from "yaml";
+function parses2(text) {
+  try {
+    return { doc: parse3(text) };
+  } catch {
+    return null;
+  }
+}
+function isPinBumpOnly(change) {
+  if (change.baseText === void 0 || change.headText === void 0) return false;
+  const before = parses2(change.baseText);
+  const after = parses2(change.headText);
   if (before === null || after === null) return false;
   return deepEqual(normalizeUses(before.doc), normalizeUses(after.doc));
 }
+function onlyWorkflowCall(doc) {
+  if (typeof doc !== "object" || doc === null) return false;
+  const on = doc["on"];
+  if (on === "workflow_call") return true;
+  if (Array.isArray(on)) return on.length === 1 && on[0] === "workflow_call";
+  if (typeof on === "object" && on !== null) {
+    const events = Object.keys(on);
+    return events.length === 1 && events[0] === "workflow_call";
+  }
+  return false;
+}
+function isShippedReusableWorkflow(change) {
+  const text = change.headText ?? change.baseText;
+  if (text === void 0) return false;
+  const parsed = parses2(text);
+  return parsed !== null && onlyWorkflowCall(parsed.doc);
+}
 function substantiveWorkflowChanges(changes) {
-  return changes.filter((change) => !isPinBumpOnly(change)).map((change) => change.path);
+  return changes.filter((change) => !isShippedReusableWorkflow(change) && !isPinBumpOnly(change)).map((change) => change.path);
+}
+
+// src/checks/uat/trivial.ts
+var TRIVIAL_CATEGORIES = ["docs", "tests", "ci", "dependencies", "metadata"];
+var TEST_DIRS = /* @__PURE__ */ new Set(["test", "tests", "__tests__", "__snapshots__", "__mocks__", "e2e"]);
+var TEST_FILE = /\.(test|spec)\.[cm]?[jt]sx?$|^test_.*\.py$|_test\.py$|^conftest\.py$/;
+var LOCKFILES = /* @__PURE__ */ new Set([
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "poetry.lock",
+  "uv.lock",
+  "Pipfile.lock",
+  "Cargo.lock",
+  "go.sum"
+]);
+var ROOT_METADATA = /^(LICEN[CS]E|COPYING)(\..+)?$|^CODEOWNERS$|^\.(gitignore|gitattributes|editorconfig)$/;
+function isDependencyOnlyManifest(change) {
+  if (change?.baseText === void 0 || change.headText === void 0) return false;
+  const strip = (text) => {
+    let parsed;
+    try {
+      parsed = JSON.parse(text);
+    } catch {
+      return void 0;
+    }
+    const record = asRecord(parsed);
+    if (record === void 0) return void 0;
+    const rest = { ...record };
+    for (const field of [...DEPENDENCY_FIELDS, "packageManager"]) delete rest[field];
+    return rest;
+  };
+  const before = strip(change.baseText);
+  const after = strip(change.headText);
+  return before !== void 0 && after !== void 0 && deepEqual(before, after);
+}
+function categoryOf(path, pr) {
+  const parts = path.split("/");
+  const name = parts[parts.length - 1] ?? "";
+  const dirs = parts.slice(0, -1);
+  if (name.endsWith(".md") || parts[0] === "docs") return "docs";
+  if (dirs.some((dir) => TEST_DIRS.has(dir)) || TEST_FILE.test(name)) return "tests";
+  if (path.startsWith(".github/workflows/") || path.startsWith(".github/actions/")) {
+    const change = pr.workflowChanges.find((file) => file.path === path);
+    return change !== void 0 && isShippedReusableWorkflow(change) ? void 0 : "ci";
+  }
+  if (LOCKFILES.has(name)) return "dependencies";
+  if (isManifestPath(path)) {
+    if (name !== "package.json") return "dependencies";
+    const change = pr.manifestChanges.find((file) => file.path === path);
+    return isDependencyOnlyManifest(change) ? "dependencies" : void 0;
+  }
+  if (parts[0] === ".github" || parts[0] === ".vscode") return "metadata";
+  if (parts.length === 1 && ROOT_METADATA.test(name)) return "metadata";
+  return void 0;
+}
+function trivialCategories(pr) {
+  const found = /* @__PURE__ */ new Set();
+  for (const path of pr.changedFiles) {
+    const category = categoryOf(path, pr);
+    if (category === void 0) return void 0;
+    found.add(category);
+  }
+  return TRIVIAL_CATEGORIES.filter((category) => found.has(category));
+}
+
+// src/checks/dependabot/paths.ts
+var OTHER_ECOSYSTEM_FILES = /* @__PURE__ */ new Set([
+  "go.mod",
+  "Cargo.toml",
+  "pyproject.toml",
+  "Pipfile",
+  "setup.cfg",
+  "setup.py",
+  "Gemfile",
+  "Gemfile.lock",
+  "composer.json",
+  "composer.lock",
+  ".terraform.lock.hcl",
+  "action.yml",
+  "action.yaml"
+]);
+var DOCKERFILE = /^(Dockerfile|Containerfile)([.-].+)?$|\.Dockerfile$|^docker-compose.*\.ya?ml$/;
+function dependencyPathKind(path) {
+  if (isWorkflowPath(path)) return "workflow";
+  if (isManifestPath(path)) return "manifest";
+  const name = path.slice(path.lastIndexOf("/") + 1);
+  if (LOCKFILES.has(name)) return "lockfile";
+  if (OTHER_ECOSYSTEM_FILES.has(name) || DOCKERFILE.test(name)) return "other-ecosystem";
+  return void 0;
+}
+
+// src/checks/dependabot/index.ts
+var DEPENDABOT_CHECK = "dependabot";
+var DEPENDABOT_LOGIN = "dependabot[bot]";
+var RECREATE = "Drop the change, or comment `@dependabot recreate` to rebuild the PR.";
+function block(message) {
+  return { check: DEPENDABOT_CHECK, message: `${message} ${RECREATE}`, effect: "block" };
+}
+function info(message) {
+  return { check: DEPENDABOT_CHECK, message, effect: "info" };
+}
+function indexClaims(claims, key) {
+  return new Map(claims.map((claim) => [key(claim.name), claim]));
+}
+function isComplete(change) {
+  return change.baseText !== void 0 && change.headText !== void 0;
+}
+function manifestProblems(change, claims) {
+  if (!isComplete(change)) {
+    return [`\`${change.path}\` was added or deleted; Dependabot only edits existing manifests.`];
+  }
+  const diff = diffManifest(change);
+  if (diff === null) return [`\`${change.path}\` doesn't parse, so its changes can't be verified.`];
+  const claimed = indexClaims(claims, (name) => manifestKey(change.path, name));
+  const problems = diff.otherChanges.map(
+    (field) => `\`${change.path}\` changes ${field}, which Dependabot never edits.`
+  );
+  for (const edit of diff.edits) {
+    const claim = claimed.get(manifestKey(change.path, edit.name));
+    const specs = `\`${edit.before ?? "(none)"}\` \u2192 \`${edit.after ?? "(none)"}\``;
+    if (claim === void 0) {
+      problems.push(
+        `\`${change.path}\` changes \`${edit.name}\` (${specs}), which the description doesn't claim.`
+      );
+    } else if (claim.to !== void 0 && edit.after !== void 0 && !specMentions(edit.after, claim.to)) {
+      problems.push(
+        `\`${change.path}\` sets \`${edit.name}\` to \`${edit.after}\`, but the description claims ${claim.to}.`
+      );
+    }
+  }
+  return problems;
+}
+function workflowProblems(change, claims) {
+  if (!isComplete(change)) {
+    return [`\`${change.path}\` was added or deleted; Dependabot only edits existing workflows.`];
+  }
+  const diff = diffWorkflow(change);
+  if (diff.kind === "unparseable") {
+    return [`\`${change.path}\` doesn't parse, so its changes can't be verified.`];
+  }
+  if (diff.kind === "structural") {
+    return [
+      `\`${change.path}\` changes more than action refs; Dependabot only moves \`uses:\` pins.`
+    ];
+  }
+  const claimed = indexClaims(claims, (name) => name.toLowerCase());
+  return diff.actions.filter((action) => !claimed.has(action.toLowerCase())).map(
+    (action) => `\`${change.path}\` moves \`${action}\`, which the description doesn't claim.`
+  );
+}
+function decideDependabot(pr) {
+  if (pr.author?.login !== DEPENDABOT_LOGIN) return { findings: [] };
+  const claims = parseClaims(pr.body ?? "");
+  if (claims.length === 0) {
+    return {
+      findings: [
+        block(
+          "The description names no update (`Bumps \u2026` / ``Updates `\u2026` from \u2026 to \u2026``), so the PR's content can't be checked against it. It was edited or truncated."
+        )
+      ]
+    };
+  }
+  const problems = [];
+  const named = titlePackage(pr.title);
+  const sameName = (claim) => claim.name.toLowerCase() === named?.toLowerCase();
+  if (named !== void 0 && !claims.some(sameName)) {
+    problems.push(`The title bumps \`${named}\`, but the description doesn't claim it.`);
+  }
+  const unverified = [];
+  for (const path of new Set(pr.changedFiles)) {
+    const kind = dependencyPathKind(path);
+    if (kind === void 0) {
+      problems.push(`\`${path}\` isn't a dependency file; Dependabot never edits it.`);
+    } else if (kind === "lockfile" || kind === "other-ecosystem") {
+      unverified.push(`\`${path}\``);
+    }
+  }
+  for (const change of pr.manifestChanges) problems.push(...manifestProblems(change, claims));
+  for (const change of pr.workflowChanges) problems.push(...workflowProblems(change, claims));
+  const findings = problems.map(block);
+  if (unverified.length > 0) {
+    findings.push(info(`Allowed but not content-verified: ${unverified.join(", ")}.`));
+  }
+  if (problems.length === 0) {
+    const count = `${claims.length} claimed update${claims.length === 1 ? "" : "s"}`;
+    findings.unshift({ ...info(`Dependabot PR matches its ${count}`), headline: true });
+  }
+  return { findings };
+}
+var dependabotCheck = {
+  name: DEPENDABOT_CHECK,
+  evaluate: async (pr) => decideDependabot(pr)
+};
+
+// src/checks/merge-block.ts
+var MERGE_BLOCK_CHECK = "merge-block";
+function normalizeLabel(label) {
+  return label.toLowerCase().replace(/[-_\s]+/g, " ").trim();
+}
+var BLOCKING = new Set(BLOCKING_LABELS.map(normalizeLabel));
+function decideMergeBlock(pr) {
+  const present = pr.labels.filter((label) => BLOCKING.has(normalizeLabel(label)));
+  if (present.length === 0) return { findings: [] };
+  const names = present.map((label) => `\`${label}\``).join(", ");
+  return {
+    findings: [
+      {
+        check: MERGE_BLOCK_CHECK,
+        message: `Held by ${names}. The PR can merge once ${present.length === 1 ? "the label is" : "the labels are"} removed.`,
+        effect: "hold"
+      }
+    ]
+  };
+}
+var mergeBlockCheck = {
+  name: MERGE_BLOCK_CHECK,
+  evaluate: async (pr) => decideMergeBlock(pr)
+};
+
+// src/checks/title/conventional.ts
+var COMMIT_TYPES = [
+  "feat",
+  "fix",
+  "docs",
+  "chore",
+  "refactor",
+  "test",
+  "style",
+  "perf",
+  "ci",
+  "build",
+  "revert"
+];
+var FUNCTIONAL_TYPES = [
+  "feat",
+  "fix",
+  "perf",
+  "revert"
+];
+var TITLE = /^([a-z]+)(?:\(([^)]+)\))?(!)?: (\S.*)$/;
+function isCommitType(value) {
+  return COMMIT_TYPES.includes(value);
+}
+function parseTitle(title) {
+  const match = TITLE.exec(title);
+  const [, type, scope, bang, subject] = match ?? [];
+  if (type === void 0 || subject === void 0 || !isCommitType(type)) return null;
+  return { type, scope, breaking: bang === "!", subject };
+}
+function isFunctionalType(type) {
+  return FUNCTIONAL_TYPES.includes(type);
+}
+var RELEASE_PLEASE_TITLE = /^chore(\([^)]*\))?!?:\s+release\b/;
+function isReleasePleaseTitle(title) {
+  return RELEASE_PLEASE_TITLE.test(title);
 }
 
 // src/checks/title/index.ts
 var TITLE_CHECK = "title";
 var FUNCTIONAL = FUNCTIONAL_TYPES.map((type) => `\`${type}\``).join("/");
-function block(message) {
+function block2(message) {
   return { check: TITLE_CHECK, message, effect: "block" };
 }
 function decideTitle(pr) {
@@ -701,7 +1164,7 @@ function decideTitle(pr) {
   if (title === null) {
     return {
       findings: [
-        block(
+        block2(
           `\`${pr.title}\` is not a Conventional Commit. Expected \`<type>[(<scope>)][!]: <subject>\` with a type of ${COMMIT_TYPES.join(", ")}. Edit the title; it becomes the squash commit on \`main\`.`
         )
       ]
@@ -714,44 +1177,44 @@ function decideTitle(pr) {
   if (!functional) {
     if (title.breaking) {
       findings.push(
-        block(
+        block2(
           `\`!\` is only allowed on ${FUNCTIONAL}; on \`${title.type}\` it would cut a spurious major release. Drop the \`!\`.`
         )
       );
     }
     if (breakingLabel) {
       findings.push(
-        block(
-          `\`${BREAKING_CHANGE_LABEL}\` is only meaningful on ${FUNCTIONAL}. Remove the label, or retitle to the functional type if this really is a breaking code change. (A \`ci\` change already forces sibling rebases through its type.)`
+        block2(
+          `\`${BREAKING_CHANGE_LABEL}\` is only meaningful on ${FUNCTIONAL}. Remove the label, or retitle to the functional type if this really is a breaking code change. (A CI change doesn't need it: sibling rebases key off the changed paths.)`
         )
       );
     }
   } else if (breakingIntent && !title.breaking) {
     findings.push(
-      block(
+      block2(
         `The PR is labelled breaking but the title has no \`!\`, so the release would miss the major. Retitle to \`${title.type}${title.scope ? `(${title.scope})` : ""}!: ${title.subject}\`.`
       )
     );
   } else if (!breakingIntent && title.breaking) {
     findings.push(
-      block(
+      block2(
         `The title marks a breaking change but the PR lacks the \`${BREAKING_CHANGE_LABEL}\` label, which is the source of truth. Add the label, or drop the \`!\`.`
       )
     );
   }
+  const mayRetitle = !functional && title.type !== "ci";
   const workflows = substantiveWorkflowChanges(pr.workflowChanges);
-  const bundledCi = functional && breakingLabel;
-  if (workflows.length > 0 && title.type !== "ci" && !bundledCi) {
-    findings.push(
-      block(
-        `This PR changes CI (${workflows.map((path) => `\`${path}\``).join(", ")}), so it must be \`ci\`-typed: retitle to \`ci(<scope>): \u2026\`. If the CI change is bundled with a functional change, keep the ${FUNCTIONAL} type and apply \`${BREAKING_CHANGE_LABEL}\` instead.`
-      )
-    );
+  if (workflows.length > 0 && mayRetitle) {
+    findings.push({
+      check: TITLE_CHECK,
+      effect: "info",
+      message: `This PR changes this repo's own CI (${workflows.map((path) => `\`${path}\``).join(", ")}); consider titling it \`ci(<scope>): \u2026\`.`
+    });
   }
   const bumps = sensitiveBumps(pr.manifestChanges);
-  if (bumps.length > 0 && title.type !== "ci") {
+  if (bumps.length > 0 && mayRetitle) {
     findings.push(
-      block(
+      block2(
         `This PR changes the version of ${bumps.map((name) => `\`${name}\``).join(", ")}, which can change lint/format results on every in-flight PR. Retitle to \`ci(deps): \u2026\` so siblings re-test; do not use \`!\` or \`${BREAKING_CHANGE_LABEL}\` for it.`
       )
     );
@@ -763,13 +1226,52 @@ var titleCheck = {
   evaluate: async (pr) => decideTitle(pr)
 };
 
-// src/checks/index.ts
-var CHECKS = [titleCheck, ciChangeCheck];
+// src/checks/uat/index.ts
+var UAT_CHECK = "uat";
+var PASSING_LABELS = [UAT_PASSED_LABEL, LEGACY_UAT_PASSED_LABEL, NO_UAT_NEEDED_LABEL];
+function info2(message) {
+  return { check: UAT_CHECK, message, effect: "info" };
+}
+function decideUat(pr) {
+  const categories = trivialCategories(pr);
+  if (categories !== void 0) {
+    const kinds = categories.length > 0 ? categories.join(", ") : "no files";
+    return { findings: [info2(`No UAT needed: the PR changes only ${kinds}.`)] };
+  }
+  const state = signOffState(pr, PASSING_LABELS);
+  if (state.status === "trusted") {
+    return {
+      findings: [
+        {
+          ...info2(`UAT signed off with \`${state.label}\` by \`${state.appliedBy.login}\``),
+          headline: true
+        }
+      ]
+    };
+  }
+  const hold = {
+    check: UAT_CHECK,
+    message: `Waiting for UAT. A person applies \`${UAT_PASSED_LABEL}\` after testing, or the review agent or a person applies \`${NO_UAT_NEEDED_LABEL}\`.`,
+    effect: "hold"
+  };
+  const why = state.status === "untrusted" ? [info2(`\`${state.label}\` doesn't count: ${state.reason}.`)] : [];
+  return { findings: [hold, ...why] };
+}
+var uatCheck = {
+  name: UAT_CHECK,
+  evaluate: async (pr) => decideUat(pr)
+};
 
-// src/checks/ci-change/workflow-paths.ts
-var WORKFLOW_FILE = /^\.github\/workflows\/.+\.ya?ml$/;
-function isWorkflowPath(path) {
-  return WORKFLOW_FILE.test(path);
+// src/checks/index.ts
+var CHECKS = [
+  mergeBlockCheck,
+  titleCheck,
+  ciChangeCheck,
+  uatCheck,
+  dependabotCheck
+];
+function selectChecks(options = {}) {
+  return options.skipUat ? CHECKS.filter((check) => check !== uatCheck) : CHECKS;
 }
 
 // src/report.ts
@@ -830,22 +1332,62 @@ function parseFileChanges(field, value) {
   if (!Array.isArray(value)) throw new Error(`facts.${field} must be an array`);
   return value.map((item, index) => parseFileChange(field, item, index));
 }
+function parseActor(where, value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null) throw new Error(`${where} must be an object`);
+  const { login, type, permission } = value;
+  if (typeof login !== "string" || typeof type !== "string") {
+    throw new Error(`${where}.login / type must be strings`);
+  }
+  if (!isRepoPermission(permission)) {
+    throw new Error(`${where}.permission must be one of ${REPO_PERMISSIONS.join(", ")}`);
+  }
+  return { login, type, permission };
+}
+function parseSignOffs(value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error("facts.signOffs must be an array");
+  return value.map((item, index) => {
+    const where = `facts.signOffs[${index}]`;
+    if (typeof item !== "object" || item === null) throw new Error(`${where} must be an object`);
+    const { label, appliedBy } = item;
+    if (typeof label !== "string") throw new Error(`${where}.label must be a string`);
+    const actor = parseActor(`${where}.appliedBy`, appliedBy);
+    return actor === void 0 ? { label } : { label, appliedBy: actor };
+  });
+}
+function parseAuthor(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null)
+    throw new Error("facts.author must be an object");
+  const { login, type } = value;
+  if (typeof login !== "string" || typeof type !== "string") {
+    throw new Error("facts.author.login / type must be strings");
+  }
+  return { login, type };
+}
 function parseFacts(raw) {
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     throw new Error("facts must be a JSON object");
   }
-  const { title, labels, changedFiles, workflowChanges, manifestChanges } = parsed;
+  const { title, body, author, labels, changedFiles, workflowChanges, manifestChanges, signOffs } = parsed;
   if (typeof title !== "string") throw new Error("facts.title must be a string");
+  if (!isOptionalString(body)) throw new Error("facts.body must be a string");
   if (!isStringArray(labels)) throw new Error("facts.labels must be a string array");
   if (!isStringArray(changedFiles)) throw new Error("facts.changedFiles must be a string array");
-  return {
+  const pr = {
     title,
     labels,
     changedFiles,
     workflowChanges: parseFileChanges("workflowChanges", workflowChanges),
-    manifestChanges: parseFileChanges("manifestChanges", manifestChanges)
+    manifestChanges: parseFileChanges("manifestChanges", manifestChanges),
+    signOffs: parseSignOffs(signOffs)
   };
+  const parsedAuthor = parseAuthor(author);
+  if (body !== void 0) pr.body = body;
+  if (parsedAuthor !== void 0) pr.author = parsedAuthor;
+  return pr;
 }
 
 // src/lib/bounded-subprocess.ts
@@ -1025,6 +1567,90 @@ async function postCheckRun(target, headSha, evaluation) {
   const out = await ghCall({ argv, stdin: JSON.stringify(payload) }, null, { cwd: target.cwd });
   if (out === null) throw new Error(`could not post the ${PR_POLICY_CHECK_NAME} check-run`);
 }
+var STATUS_DESCRIPTION_MAX = 140;
+function statusBody(evaluation, runUrl) {
+  return {
+    state: evaluation.outcome,
+    context: PR_POLICY_CHECK_NAME,
+    description: evaluation.title.slice(0, STATUS_DESCRIPTION_MAX),
+    ...runUrl ? { target_url: runUrl } : {}
+  };
+}
+async function postCommitStatus(target, headSha, evaluation) {
+  const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
+  const runUrl = GITHUB_SERVER_URL && GITHUB_REPOSITORY && GITHUB_RUN_ID ? `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}` : void 0;
+  const out = await ghCall(
+    {
+      argv: ["gh", "api", "-X", "POST", `repos/${target.repo}/statuses/${headSha}`, "--input", "-"],
+      stdin: JSON.stringify(statusBody(evaluation, runUrl))
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) {
+    console.warn(
+      `::warning::could not set the ${PR_POLICY_CHECK_NAME} commit status on ${headSha} \u2014 does the caller workflow grant \`statuses: write\`? (rmartz/pr-policy#24)`
+    );
+  }
+}
+async function postVerdict(target, headSha, evaluation) {
+  await postCheckRun(target, headSha, evaluation);
+  await postCommitStatus(target, headSha, evaluation);
+}
+
+// src/github/sign-offs.ts
+async function listLabelEvents(target) {
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        "--paginate",
+        `repos/${target.repo}/issues/${target.pr}/events`,
+        "--jq",
+        '.[] | select(.event == "labeled") | {label: .label.name, login: .actor.login, type: .actor.type}'
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) throw new Error(`could not list label events of ${target.repo}#${target.pr}`);
+  return out.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+}
+async function lookupPermission(target, login) {
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        `repos/${target.repo}/collaborators/${encodeURIComponent(login)}/permission`,
+        "--jq",
+        "{permission, role_name}"
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) return "none";
+  const { permission, role_name: roleName } = JSON.parse(out);
+  if (isRepoPermission(roleName)) return roleName;
+  return isRepoPermission(permission) ? permission : "none";
+}
+async function gatherSignOffs(target, labels) {
+  const present = SIGN_OFF_LABELS.filter((label) => labels.includes(label));
+  if (present.length === 0) return [];
+  const latest = /* @__PURE__ */ new Map();
+  for (const event of await listLabelEvents(target)) latest.set(event.label, event);
+  return Promise.all(
+    present.map(async (label) => {
+      const event = latest.get(label);
+      if (event === void 0 || event.login === null) return { label };
+      const type = event.type ?? "unknown actor";
+      const permission = type === "User" ? await lookupPermission(target, event.login) : "none";
+      return { label, appliedBy: { login: event.login, type, permission } };
+    })
+  );
+}
 
 // src/github/pull-request.ts
 async function ghJson(target, argv) {
@@ -1095,12 +1721,19 @@ async function gatherFacts(target) {
     workflowChanges = await Promise.all(workflowFiles.map(read));
     manifestChanges = await Promise.all(manifestFiles.map(read));
   }
+  const labels = view.labels.map((label) => label.name);
   const facts = {
     title: view.title,
-    labels: view.labels.map((label) => label.name),
-    changedFiles: files.map((file) => file.filename),
+    body: view.body ?? "",
+    author: { login: view.user.login, type: view.user.type },
+    labels,
+    // A rename's old path counts too: moving code into docs/ is not docs-only.
+    changedFiles: files.flatMap(
+      (file) => file.previous_filename === void 0 || file.previous_filename === null ? [file.filename] : [file.previous_filename, file.filename]
+    ),
     workflowChanges,
-    manifestChanges
+    manifestChanges,
+    signOffs: await gatherSignOffs(target, labels)
   };
   return { facts, headSha };
 }
@@ -1117,6 +1750,11 @@ export {
   PR_POLICY_CHECK_NAME,
   CI_APPROVAL_NEEDED_LABEL,
   CI_CHANGE_APPROVED_LABEL,
+  DO_NOT_MERGE_LABEL,
+  DNM_LABEL,
+  BLOCKED_LABEL,
+  ESCALATION_NEEDED_LABEL,
+  BLOCKING_LABELS,
   BREAKING_CHANGE_LABEL,
   HOTFIX_LABEL,
   RELEASE_PLEASE_PENDING_LABEL,
@@ -1128,17 +1766,26 @@ export {
   CI_CHANGE_CHECK,
   decideCiChange,
   ciChangeCheck,
-  COMMIT_TYPES,
-  FUNCTIONAL_TYPES,
-  parseTitle,
+  parseClaims,
   CI_SENSITIVE_PACKAGES,
   isManifestPath,
   sensitiveBumps,
+  isWorkflowPath,
+  DEPENDABOT_CHECK,
+  DEPENDABOT_LOGIN,
+  decideDependabot,
+  dependabotCheck,
+  MERGE_BLOCK_CHECK,
+  decideMergeBlock,
+  mergeBlockCheck,
+  COMMIT_TYPES,
+  FUNCTIONAL_TYPES,
+  parseTitle,
   TITLE_CHECK,
   decideTitle,
   titleCheck,
   CHECKS,
-  isWorkflowPath,
+  selectChecks,
   POLICY_OUTCOMES,
   buildReport,
   evaluatePolicy,
@@ -1146,6 +1793,8 @@ export {
   resolveRepoTarget,
   checkRunBody,
   postCheckRun,
+  statusBody,
+  postVerdict,
   gatherFacts,
   applyLabelEdits
 };