@rmartz/pr-policy 0.2.0

package/dist/chunk-QINHHFJN.js

@@ -0,0 +1,1151 @@
+// src/contract.ts
+var PR_POLICY_CHECK_NAME = "pr-policy";
+var CI_APPROVAL_NEEDED_LABEL = "CI approval needed";
+var CI_CHANGE_APPROVED_LABEL = "CI change approved";
+var BREAKING_CHANGE_LABEL = "breaking change";
+var HOTFIX_LABEL = "hotfix";
+var RELEASE_PLEASE_PENDING_LABEL = "autorelease: pending";
+
+// src/checks/ci-change/indicators.ts
+var LOOSENING_INDICATORS = [
+  "workflow-removed",
+  "job-removed",
+  "step-removed",
+  "continue-on-error-added",
+  "if-added",
+  "trigger-narrowed",
+  "matrix-reduced",
+  "needs-reduced"
+];
+var AMBIGUOUS_INDICATORS = [
+  "runs-on-changed",
+  "permissions-changed",
+  "env-changed",
+  "timeout-changed",
+  "unparseable",
+  "unclassified-change"
+];
+function looseningIndicator(kind, file, location, detail) {
+  return { kind, class: "loosening", file, location, detail };
+}
+function ambiguousIndicator(kind, file, location, detail) {
+  return { kind, class: "ambiguous", file, location, detail };
+}
+var CI_CHANGE_VERDICTS = ["no-change", "tightening", "loosening"];
+
+// src/checks/ci-change/classify.ts
+import { parse } from "yaml";
+
+// src/checks/ci-change/structure.ts
+function asRecord(node) {
+  if (typeof node !== "object" || node === null || Array.isArray(node)) return void 0;
+  return node;
+}
+function asArray(node) {
+  return Array.isArray(node) ? node : void 0;
+}
+function asNameList(node) {
+  if (typeof node === "string") return [node];
+  const seq = asArray(node);
+  if (!seq) return [];
+  return seq.filter((entry) => typeof entry === "string");
+}
+function deepEqual(a, b) {
+  if (a === b) return true;
+  const aSeq = asArray(a);
+  const bSeq = asArray(b);
+  if (aSeq && bSeq) {
+    return aSeq.length === bSeq.length && aSeq.every((entry, i) => deepEqual(entry, bSeq[i]));
+  }
+  if (aSeq || bSeq) return false;
+  const aMap = asRecord(a);
+  const bMap = asRecord(b);
+  if (aMap && bMap) {
+    const aKeys = Object.keys(aMap);
+    const bKeys = Object.keys(bMap);
+    if (aKeys.length !== bKeys.length) return false;
+    return aKeys.every((key) => key in bMap && deepEqual(aMap[key], bMap[key]));
+  }
+  return false;
+}
+function missingEntries(base, head) {
+  const remaining = [...head];
+  const missing = [];
+  for (const entry of base) {
+    const at = remaining.findIndex((candidate) => deepEqual(candidate, entry));
+    if (at === -1) missing.push(entry);
+    else remaining.splice(at, 1);
+  }
+  return missing;
+}
+function containsAll(base, head) {
+  if (deepEqual(base, head)) return true;
+  const baseSeq = asArray(base);
+  const headSeq = asArray(head);
+  if (baseSeq && headSeq) {
+    const remaining = [...headSeq];
+    for (const entry of baseSeq) {
+      const at = remaining.findIndex((candidate) => containsAll(entry, candidate));
+      if (at === -1) return false;
+      remaining.splice(at, 1);
+    }
+    return true;
+  }
+  const baseMap = asRecord(base);
+  const headMap = asRecord(head);
+  if (baseMap && headMap) {
+    return Object.keys(baseMap).every(
+      (key) => key in headMap && containsAll(baseMap[key], headMap[key])
+    );
+  }
+  return false;
+}
+function stripActionRef(uses) {
+  const at = uses.lastIndexOf("@");
+  return at === -1 ? uses : uses.slice(0, at);
+}
+function normalizeUses(node) {
+  const seq = asArray(node);
+  if (seq) return seq.map(normalizeUses);
+  const map = asRecord(node);
+  if (!map) return node;
+  const out = {};
+  for (const [key, value] of Object.entries(map)) {
+    out[key] = key === "uses" && typeof value === "string" ? stripActionRef(value) : normalizeUses(value);
+  }
+  return out;
+}
+
+// src/checks/ci-change/common-rules.ts
+function continuesOnError(node) {
+  const value = node["continue-on-error"];
+  return value !== void 0 && value !== false;
+}
+function guardIndicators(file, location, base, head) {
+  const before = asRecord(base);
+  const after = asRecord(head);
+  if (!before || !after) return [];
+  const found = [];
+  if (!continuesOnError(before) && continuesOnError(after)) {
+    found.push(
+      looseningIndicator(
+        "continue-on-error-added",
+        file,
+        `${location}.continue-on-error`,
+        `\`continue-on-error\` was enabled, so a failure here no longer fails the run.`
+      )
+    );
+  }
+  if (before.if === void 0 && after.if !== void 0) {
+    found.push(
+      looseningIndicator(
+        "if-added",
+        file,
+        `${location}.if`,
+        `An \`if:\` condition was added to something that previously always ran.`
+      )
+    );
+  }
+  if (!deepEqual(before.env, after.env)) {
+    found.push(ambiguousIndicator("env-changed", file, `${location}.env`, `\`env\` changed.`));
+  }
+  if (!deepEqual(before["timeout-minutes"], after["timeout-minutes"])) {
+    found.push(
+      ambiguousIndicator(
+        "timeout-changed",
+        file,
+        `${location}.timeout-minutes`,
+        `\`timeout-minutes\` changed from ${JSON.stringify(before["timeout-minutes"]) ?? "unset"} to ${JSON.stringify(after["timeout-minutes"]) ?? "unset"}.`
+      )
+    );
+  }
+  return found;
+}
+
+// src/checks/ci-change/step-rules.ts
+function stepsOf(job) {
+  return asArray(asRecord(job)?.steps) ?? [];
+}
+function stepKey(step) {
+  const map = asRecord(step);
+  if (!map) return JSON.stringify(step ?? null);
+  const { id, name, uses, run } = map;
+  if (typeof id === "string") return `id:${id}`;
+  if (typeof name === "string") return `name:${name}`;
+  if (typeof uses === "string") return `uses:${stripActionRef(uses)}`;
+  if (typeof run === "string") return `run:${run}`;
+  return `step:${JSON.stringify(map)}`;
+}
+function byKey(steps) {
+  const index = /* @__PURE__ */ new Map();
+  for (const step of steps) {
+    const key = stepKey(step);
+    if (!index.has(key)) index.set(key, step);
+  }
+  return index;
+}
+function stepIndicators(file, jobId, base, head) {
+  const before = byKey(stepsOf(base));
+  const after = byKey(stepsOf(head));
+  const found = [];
+  for (const [key, step] of before) {
+    const location = `jobs.${jobId}.steps[${key}]`;
+    const counterpart = after.get(key);
+    if (counterpart === void 0) {
+      found.push(
+        looseningIndicator("step-removed", file, location, `Step \`${key}\` was removed.`)
+      );
+      continue;
+    }
+    found.push(...guardIndicators(file, location, step, counterpart));
+  }
+  return found;
+}
+
+// src/checks/ci-change/job-rules.ts
+function jobsOf(doc) {
+  return asRecord(asRecord(doc)?.jobs) ?? {};
+}
+function needsIndicators(file, jobId, base, head) {
+  const before = asNameList(asRecord(base)?.needs);
+  const after = new Set(asNameList(asRecord(head)?.needs));
+  const dropped = before.filter((dependency) => !after.has(dependency));
+  if (dropped.length === 0) return [];
+  return [
+    looseningIndicator(
+      "needs-reduced",
+      file,
+      `jobs.${jobId}.needs`,
+      `${dropped.map((name) => `\`${name}\``).join(", ")} removed from \`needs\`, so the job no longer waits on it.`
+    )
+  ];
+}
+function matrixIndicators(file, jobId, base, head) {
+  const before = asRecord(asRecord(base)?.strategy)?.matrix;
+  if (before === void 0) return [];
+  const beforeMap = asRecord(before);
+  const afterMap = asRecord(asRecord(asRecord(head)?.strategy)?.matrix);
+  const at = `jobs.${jobId}.strategy.matrix`;
+  if (!beforeMap) return [];
+  if (!afterMap) {
+    return [
+      looseningIndicator("matrix-reduced", file, at, "The build matrix was removed entirely.")
+    ];
+  }
+  const found = [];
+  for (const [dimension, values] of Object.entries(beforeMap)) {
+    if (dimension === "exclude") continue;
+    if (!(dimension in afterMap)) {
+      found.push(
+        looseningIndicator(
+          "matrix-reduced",
+          file,
+          `${at}.${dimension}`,
+          `Matrix dimension \`${dimension}\` was removed.`
+        )
+      );
+      continue;
+    }
+    const beforeValues = asArray(values);
+    if (!beforeValues) continue;
+    const dropped = missingEntries(beforeValues, asArray(afterMap[dimension]) ?? []);
+    if (dropped.length > 0) {
+      found.push(
+        looseningIndicator(
+          "matrix-reduced",
+          file,
+          `${at}.${dimension}`,
+          `${dropped.length} value${dropped.length === 1 ? "" : "s"} removed from matrix dimension \`${dimension}\`.`
+        )
+      );
+    }
+  }
+  const addedExclusions = missingEntries(
+    asArray(afterMap.exclude) ?? [],
+    asArray(beforeMap.exclude) ?? []
+  );
+  if (addedExclusions.length > 0) {
+    found.push(
+      looseningIndicator(
+        "matrix-reduced",
+        file,
+        `${at}.exclude`,
+        `${addedExclusions.length} combination${addedExclusions.length === 1 ? "" : "s"} added to \`exclude\`.`
+      )
+    );
+  }
+  return found;
+}
+function jobSurfaceIndicators(file, jobId, base, head) {
+  const before = asRecord(base) ?? {};
+  const after = asRecord(head) ?? {};
+  const found = [];
+  if (!deepEqual(before["runs-on"], after["runs-on"])) {
+    found.push(
+      ambiguousIndicator(
+        "runs-on-changed",
+        file,
+        `jobs.${jobId}.runs-on`,
+        `\`runs-on\` changed, so the job runs on a different runner.`
+      )
+    );
+  }
+  if (!deepEqual(before.permissions, after.permissions)) {
+    found.push(
+      ambiguousIndicator(
+        "permissions-changed",
+        file,
+        `jobs.${jobId}.permissions`,
+        `Job-level \`permissions\` changed.`
+      )
+    );
+  }
+  return found;
+}
+function jobIndicators(file, base, head) {
+  const before = jobsOf(base);
+  const after = jobsOf(head);
+  const found = [];
+  for (const [jobId, job] of Object.entries(before)) {
+    const counterpart = after[jobId];
+    if (counterpart === void 0) {
+      found.push(
+        looseningIndicator("job-removed", file, `jobs.${jobId}`, `Job \`${jobId}\` was removed.`)
+      );
+      continue;
+    }
+    found.push(
+      ...guardIndicators(file, `jobs.${jobId}`, job, counterpart),
+      ...jobSurfaceIndicators(file, jobId, job, counterpart),
+      ...needsIndicators(file, jobId, job, counterpart),
+      ...matrixIndicators(file, jobId, job, counterpart),
+      ...stepIndicators(file, jobId, job, counterpart)
+    );
+  }
+  return found;
+}
+
+// src/checks/ci-change/workflow-rules.ts
+var INCLUSIVE_FILTERS = ["branches", "tags", "paths", "types"];
+var EXCLUSIVE_FILTERS = ["branches-ignore", "tags-ignore", "paths-ignore"];
+function triggersOf(doc) {
+  const map = asRecord(doc);
+  if (!map) return void 0;
+  const on = "on" in map ? map.on : map.true;
+  if (on === void 0) return void 0;
+  if (typeof on === "string") return { [on]: {} };
+  const seq = asArray(on);
+  if (seq) {
+    const out2 = {};
+    for (const event of seq) if (typeof event === "string") out2[event] = {};
+    return out2;
+  }
+  const onMap = asRecord(on);
+  if (!onMap) return void 0;
+  const out = {};
+  for (const [event, filters] of Object.entries(onMap)) out[event] = filters ?? {};
+  return out;
+}
+function filterIndicators(file, event, base, head) {
+  const found = [];
+  const at = (key) => `on.${event}.${key}`;
+  const baseSeq = asArray(base);
+  const headSeq = asArray(head);
+  if (baseSeq) {
+    const dropped = missingEntries(baseSeq, headSeq ?? []);
+    if (dropped.length > 0) {
+      found.push(
+        looseningIndicator(
+          "trigger-narrowed",
+          file,
+          `on.${event}`,
+          `${dropped.length} \`${event}\` entr${dropped.length === 1 ? "y" : "ies"} removed.`
+        )
+      );
+    }
+    return found;
+  }
+  const baseFilters = asRecord(base) ?? {};
+  const headFilters = asRecord(head) ?? {};
+  for (const key of INCLUSIVE_FILTERS) {
+    const before = asArray(baseFilters[key]);
+    const after = asArray(headFilters[key]);
+    if (!before && after) {
+      found.push(
+        looseningIndicator(
+          "trigger-narrowed",
+          file,
+          at(key),
+          `\`${key}\` filter added to \`${event}\`, which previously matched everything.`
+        )
+      );
+      continue;
+    }
+    if (!before) continue;
+    const dropped = missingEntries(before, after ?? []);
+    if (dropped.length > 0) {
+      found.push(
+        looseningIndicator(
+          "trigger-narrowed",
+          file,
+          at(key),
+          `${dropped.map((entry) => `\`${String(entry)}\``).join(", ")} removed from \`${key}\`.`
+        )
+      );
+    }
+  }
+  for (const key of EXCLUSIVE_FILTERS) {
+    const before = asArray(baseFilters[key]) ?? [];
+    const after = asArray(headFilters[key]) ?? [];
+    const added = missingEntries(after, before);
+    if (added.length > 0) {
+      found.push(
+        looseningIndicator(
+          "trigger-narrowed",
+          file,
+          at(key),
+          `${added.map((entry) => `\`${String(entry)}\``).join(", ")} added to \`${key}\`, excluding more runs.`
+        )
+      );
+    }
+  }
+  return found;
+}
+function triggerIndicators(file, base, head) {
+  const before = triggersOf(base);
+  const after = triggersOf(head);
+  if (!before) return [];
+  const found = [];
+  for (const [event, filters] of Object.entries(before)) {
+    if (!after || !(event in after)) {
+      found.push(
+        looseningIndicator(
+          "trigger-narrowed",
+          file,
+          `on.${event}`,
+          `The \`${event}\` trigger was removed.`
+        )
+      );
+      continue;
+    }
+    found.push(...filterIndicators(file, event, filters, after[event]));
+  }
+  return found;
+}
+function topLevelIndicators(file, base, head) {
+  const baseMap = asRecord(base) ?? {};
+  const headMap = asRecord(head) ?? {};
+  const found = [];
+  for (const key of ["permissions", "env"]) {
+    const before = baseMap[key];
+    const after = headMap[key];
+    if (before === void 0 && after === void 0) continue;
+    if (deepEqual(before, after)) continue;
+    found.push(
+      ambiguousIndicator(
+        key === "permissions" ? "permissions-changed" : "env-changed",
+        file,
+        key,
+        `Workflow-level \`${key}\` changed.`
+      )
+    );
+  }
+  return found;
+}
+
+// src/checks/ci-change/classify.ts
+function parseWorkflow(text) {
+  try {
+    return { doc: parse(text) };
+  } catch (err) {
+    return { error: err instanceof Error ? err.message : String(err) };
+  }
+}
+function classifyWorkflowFile(change) {
+  const { path, baseText, headText } = change;
+  if (headText === void 0) {
+    if (baseText === void 0) return [];
+    return [
+      looseningIndicator(
+        "workflow-removed",
+        path,
+        path,
+        "The workflow file was deleted, removing every check it defined."
+      )
+    ];
+  }
+  if (baseText === void 0) return [];
+  const before = parseWorkflow(baseText);
+  const after = parseWorkflow(headText);
+  if ("error" in after) {
+    return [
+      ambiguousIndicator(
+        "unparseable",
+        path,
+        path,
+        `The workflow could not be parsed at head, so its change cannot be classified: ${after.error}`
+      )
+    ];
+  }
+  if ("error" in before) {
+    return [
+      ambiguousIndicator(
+        "unparseable",
+        path,
+        path,
+        `The workflow could not be parsed at the merge base, so its change cannot be classified: ${before.error}`
+      )
+    ];
+  }
+  const found = [
+    ...triggerIndicators(path, before.doc, after.doc),
+    ...topLevelIndicators(path, before.doc, after.doc),
+    ...jobIndicators(path, before.doc, after.doc)
+  ];
+  if (found.length > 0) return found;
+  if (containsAll(normalizeUses(before.doc), normalizeUses(after.doc))) return [];
+  return [
+    ambiguousIndicator(
+      "unclassified-change",
+      path,
+      path,
+      "The workflow changed in a way that is not purely additive and matches no known tightening pattern."
+    )
+  ];
+}
+function classifyWorkflowChanges(changes) {
+  if (changes.length === 0) return { verdict: "no-change", indicators: [] };
+  const indicators = changes.flatMap(classifyWorkflowFile);
+  return { verdict: indicators.length > 0 ? "loosening" : "tightening", indicators };
+}
+
+// src/checks/ci-change/index.ts
+var CI_CHANGE_CHECK = "ci-change";
+function indicatorMessage(indicator) {
+  return `\`${indicator.file}\` \`${indicator.location}\` \u2014 ${indicator.kind} (${indicator.class}): ${indicator.detail}`;
+}
+function decideCiChange(classification, labels) {
+  const present = new Set(labels);
+  const signedOff = present.has(CI_CHANGE_APPROVED_LABEL);
+  const flagged = present.has(CI_APPROVAL_NEEDED_LABEL);
+  const loosening = classification.verdict === "loosening";
+  const labelsToAdd = loosening && !flagged ? [CI_APPROVAL_NEEDED_LABEL] : [];
+  const labelsToRemove = !loosening && flagged && !signedOff ? [CI_APPROVAL_NEEDED_LABEL] : [];
+  if (classification.verdict === "no-change") return { findings: [], labelsToAdd, labelsToRemove };
+  if (!loosening) {
+    const note = {
+      check: CI_CHANGE_CHECK,
+      message: "Workflow changes only add coverage or are maintenance. No sign-off needed.",
+      effect: "info"
+    };
+    return { findings: [note], labelsToAdd, labelsToRemove };
+  }
+  const headline = signedOff ? {
+    check: CI_CHANGE_CHECK,
+    message: `CI loosening signed off with \`${CI_CHANGE_APPROVED_LABEL}\``,
+    effect: "info",
+    headline: true
+  } : {
+    check: CI_CHANGE_CHECK,
+    message: `This PR loosens CI and is waiting for a human to review the change and apply \`${CI_CHANGE_APPROVED_LABEL}\`. No code change clears this. Ambiguous indicators are treated as loosening because a miss skips the sign-off entirely.`,
+    effect: "hold"
+  };
+  const evidence = classification.indicators.map((indicator) => ({
+    check: CI_CHANGE_CHECK,
+    message: indicatorMessage(indicator),
+    effect: "info"
+  }));
+  return { findings: [headline, ...evidence], labelsToAdd, labelsToRemove };
+}
+var ciChangeCheck = {
+  name: CI_CHANGE_CHECK,
+  evaluate: async (pr) => decideCiChange(classifyWorkflowChanges(pr.workflowChanges), pr.labels)
+};
+
+// src/checks/title/conventional.ts
+var COMMIT_TYPES = [
+  "feat",
+  "fix",
+  "docs",
+  "chore",
+  "refactor",
+  "test",
+  "style",
+  "perf",
+  "ci",
+  "build",
+  "revert"
+];
+var FUNCTIONAL_TYPES = [
+  "feat",
+  "fix",
+  "perf",
+  "revert"
+];
+var TITLE = /^([a-z]+)(?:\(([^)]+)\))?(!)?: (\S.*)$/;
+function isCommitType(value) {
+  return COMMIT_TYPES.includes(value);
+}
+function parseTitle(title) {
+  const match = TITLE.exec(title);
+  const [, type, scope, bang, subject] = match ?? [];
+  if (type === void 0 || subject === void 0 || !isCommitType(type)) return null;
+  return { type, scope, breaking: bang === "!", subject };
+}
+function isFunctionalType(type) {
+  return FUNCTIONAL_TYPES.includes(type);
+}
+var RELEASE_PLEASE_TITLE = /^chore(\([^)]*\))?!?:\s+release\b/;
+function isReleasePleaseTitle(title) {
+  return RELEASE_PLEASE_TITLE.test(title);
+}
+
+// src/checks/title/sensitive-bump.ts
+var CI_SENSITIVE_PACKAGES = ["eslint", "black", "pylint", "ruff", "prettier"];
+var REQUIREMENTS_FILE = /^requirements[\w.-]*\.txt$/;
+function basename(path) {
+  return path.slice(path.lastIndexOf("/") + 1);
+}
+function isManifestPath(path) {
+  if (path.split("/").includes("node_modules")) return false;
+  const name = basename(path);
+  return name === "package.json" || REQUIREMENTS_FILE.test(name);
+}
+function normalize(name) {
+  return name.trim().toLowerCase().replace(/[-_.]+/g, "-");
+}
+var DEPENDENCY_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
+function npmVersions(text) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  const versions = /* @__PURE__ */ new Map();
+  if (typeof parsed !== "object" || parsed === null) return versions;
+  for (const field of DEPENDENCY_FIELDS) {
+    const block2 = parsed[field];
+    if (typeof block2 !== "object" || block2 === null) continue;
+    for (const [name, spec] of Object.entries(block2)) {
+      if (typeof spec === "string") versions.set(name, spec);
+    }
+  }
+  return versions;
+}
+var REQUIREMENT_LINE = /^\s*([A-Za-z0-9][A-Za-z0-9._-]*)\s*((?:==|~=|>=|<=|!=|<|>).*)$/;
+function pipVersions(text) {
+  const versions = /* @__PURE__ */ new Map();
+  for (const line of text.split("\n")) {
+    const [, name, spec] = REQUIREMENT_LINE.exec(line.replace(/#.*/, "")) ?? [];
+    if (name !== void 0 && spec !== void 0) versions.set(normalize(name), spec.trim());
+  }
+  return versions;
+}
+function versionsOf(path, text) {
+  return basename(path) === "package.json" ? npmVersions(text) : pipVersions(text);
+}
+function sensitiveBumps(changes) {
+  const bumped = /* @__PURE__ */ new Set();
+  for (const change of changes) {
+    if (change.baseText === void 0 || change.headText === void 0) continue;
+    const before = versionsOf(change.path, change.baseText);
+    const after = versionsOf(change.path, change.headText);
+    if (before === null || after === null) continue;
+    for (const name of CI_SENSITIVE_PACKAGES) {
+      const was = before.get(name);
+      const now = after.get(name);
+      if (was !== void 0 && now !== void 0 && was !== now) bumped.add(name);
+    }
+  }
+  return [...bumped];
+}
+
+// src/checks/title/workflow-change.ts
+import { parse as parse2 } from "yaml";
+function parses(text) {
+  try {
+    return { doc: parse2(text) };
+  } catch {
+    return null;
+  }
+}
+function isPinBumpOnly(change) {
+  if (change.baseText === void 0 || change.headText === void 0) return false;
+  const before = parses(change.baseText);
+  const after = parses(change.headText);
+  if (before === null || after === null) return false;
+  return deepEqual(normalizeUses(before.doc), normalizeUses(after.doc));
+}
+function substantiveWorkflowChanges(changes) {
+  return changes.filter((change) => !isPinBumpOnly(change)).map((change) => change.path);
+}
+
+// src/checks/title/index.ts
+var TITLE_CHECK = "title";
+var FUNCTIONAL = FUNCTIONAL_TYPES.map((type) => `\`${type}\``).join("/");
+function block(message) {
+  return { check: TITLE_CHECK, message, effect: "block" };
+}
+function decideTitle(pr) {
+  const labels = new Set(pr.labels.map((label) => label.toLowerCase()));
+  if (labels.has(RELEASE_PLEASE_PENDING_LABEL) || isReleasePleaseTitle(pr.title)) {
+    return { findings: [] };
+  }
+  const title = parseTitle(pr.title);
+  if (title === null) {
+    return {
+      findings: [
+        block(
+          `\`${pr.title}\` is not a Conventional Commit. Expected \`<type>[(<scope>)][!]: <subject>\` with a type of ${COMMIT_TYPES.join(", ")}. Edit the title; it becomes the squash commit on \`main\`.`
+        )
+      ]
+    };
+  }
+  const findings = [];
+  const functional = isFunctionalType(title.type);
+  const breakingLabel = labels.has(BREAKING_CHANGE_LABEL);
+  const breakingIntent = breakingLabel || labels.has(HOTFIX_LABEL);
+  if (!functional) {
+    if (title.breaking) {
+      findings.push(
+        block(
+          `\`!\` is only allowed on ${FUNCTIONAL}; on \`${title.type}\` it would cut a spurious major release. Drop the \`!\`.`
+        )
+      );
+    }
+    if (breakingLabel) {
+      findings.push(
+        block(
+          `\`${BREAKING_CHANGE_LABEL}\` is only meaningful on ${FUNCTIONAL}. Remove the label, or retitle to the functional type if this really is a breaking code change. (A \`ci\` change already forces sibling rebases through its type.)`
+        )
+      );
+    }
+  } else if (breakingIntent && !title.breaking) {
+    findings.push(
+      block(
+        `The PR is labelled breaking but the title has no \`!\`, so the release would miss the major. Retitle to \`${title.type}${title.scope ? `(${title.scope})` : ""}!: ${title.subject}\`.`
+      )
+    );
+  } else if (!breakingIntent && title.breaking) {
+    findings.push(
+      block(
+        `The title marks a breaking change but the PR lacks the \`${BREAKING_CHANGE_LABEL}\` label, which is the source of truth. Add the label, or drop the \`!\`.`
+      )
+    );
+  }
+  const workflows = substantiveWorkflowChanges(pr.workflowChanges);
+  const bundledCi = functional && breakingLabel;
+  if (workflows.length > 0 && title.type !== "ci" && !bundledCi) {
+    findings.push(
+      block(
+        `This PR changes CI (${workflows.map((path) => `\`${path}\``).join(", ")}), so it must be \`ci\`-typed: retitle to \`ci(<scope>): \u2026\`. If the CI change is bundled with a functional change, keep the ${FUNCTIONAL} type and apply \`${BREAKING_CHANGE_LABEL}\` instead.`
+      )
+    );
+  }
+  const bumps = sensitiveBumps(pr.manifestChanges);
+  if (bumps.length > 0 && title.type !== "ci") {
+    findings.push(
+      block(
+        `This PR changes the version of ${bumps.map((name) => `\`${name}\``).join(", ")}, which can change lint/format results on every in-flight PR. Retitle to \`ci(deps): \u2026\` so siblings re-test; do not use \`!\` or \`${BREAKING_CHANGE_LABEL}\` for it.`
+      )
+    );
+  }
+  return { findings };
+}
+var titleCheck = {
+  name: TITLE_CHECK,
+  evaluate: async (pr) => decideTitle(pr)
+};
+
+// src/checks/index.ts
+var CHECKS = [titleCheck, ciChangeCheck];
+
+// src/checks/ci-change/workflow-paths.ts
+var WORKFLOW_FILE = /^\.github\/workflows\/.+\.ya?ml$/;
+function isWorkflowPath(path) {
+  return WORKFLOW_FILE.test(path);
+}
+
+// src/report.ts
+var POLICY_OUTCOMES = ["success", "pending", "failure"];
+var ICONS = { block: "\u274C", hold: "\u23F3", info: "\u2139\uFE0F" };
+function plural(count, noun) {
+  return `${count} ${noun}${count === 1 ? "" : "s"}`;
+}
+function buildReport(findings) {
+  const blocks = findings.filter((finding) => finding.effect === "block");
+  const holds = findings.filter((finding) => finding.effect === "hold");
+  const headline = findings.find((finding) => finding.headline);
+  let outcome = "success";
+  let title = headline?.message ?? "All PR policy checks pass";
+  if (blocks.length > 0) {
+    outcome = "failure";
+    title = plural(blocks.length, "blocking policy finding");
+  } else if (holds.length > 0) {
+    outcome = "pending";
+    title = `Waiting on ${plural(holds.length, "human sign-off")}`;
+  }
+  const lines = findings.map(
+    (finding) => `- ${ICONS[finding.effect]} **${finding.check}**: ${finding.message}`
+  );
+  const summary = lines.length > 0 ? lines.join("\n") : "No policy findings.";
+  return { outcome, title, summary, findings };
+}
+
+// src/evaluate.ts
+async function evaluatePolicy(pr, checks = CHECKS) {
+  const results = await Promise.all(checks.map((check) => check.evaluate(pr)));
+  return {
+    ...buildReport(results.flatMap((result) => result.findings)),
+    labelsToAdd: results.flatMap((result) => result.labelsToAdd ?? []),
+    labelsToRemove: results.flatMap((result) => result.labelsToRemove ?? [])
+  };
+}
+
+// src/facts.ts
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function isOptionalString(value) {
+  return value === void 0 || typeof value === "string";
+}
+function parseFileChange(field, value, index) {
+  const where = `facts.${field}[${index}]`;
+  if (typeof value !== "object" || value === null) throw new Error(`${where} must be an object`);
+  const { path, baseText, headText } = value;
+  if (typeof path !== "string") throw new Error(`${where}.path must be a string`);
+  if (!isOptionalString(baseText) || !isOptionalString(headText)) {
+    throw new Error(`${where}.baseText / headText must be strings when present`);
+  }
+  return { path, baseText, headText };
+}
+function parseFileChanges(field, value) {
+  if (value === void 0) return [];
+  if (!Array.isArray(value)) throw new Error(`facts.${field} must be an array`);
+  return value.map((item, index) => parseFileChange(field, item, index));
+}
+function parseFacts(raw) {
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new Error("facts must be a JSON object");
+  }
+  const { title, labels, changedFiles, workflowChanges, manifestChanges } = parsed;
+  if (typeof title !== "string") throw new Error("facts.title must be a string");
+  if (!isStringArray(labels)) throw new Error("facts.labels must be a string array");
+  if (!isStringArray(changedFiles)) throw new Error("facts.changedFiles must be a string array");
+  return {
+    title,
+    labels,
+    changedFiles,
+    workflowChanges: parseFileChanges("workflowChanges", workflowChanges),
+    manifestChanges: parseFileChanges("manifestChanges", manifestChanges)
+  };
+}
+
+// src/lib/bounded-subprocess.ts
+import { spawn } from "child_process";
+function boundedRun(command, args, options) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      detached: true
+      // new process group, so we can kill the whole tree
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+      }
+    }, options.timeoutMs);
+    if (options.input !== void 0 && child.stdin) {
+      child.stdin.on("error", () => {
+      });
+      child.stdin.write(options.input);
+      child.stdin.end();
+    }
+    child.stdout.on("data", (chunk) => stdout += chunk.toString());
+    child.stderr.on("data", (chunk) => stderr += chunk.toString());
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      resolve({ stdout, stderr, code, timedOut });
+    });
+  });
+}
+
+// src/lib/github.ts
+var GH_API_TIMEOUT_MS = 3e4;
+var MAX_RETRIES = 2;
+var BACKOFF_BASE_MS = 1e3;
+var BACKOFF_CAP_MS = 8e3;
+var realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function isRateLimited(text) {
+  const t = (text ?? "").toLowerCase();
+  return t.includes("rate limit") || t.includes("rate-limit");
+}
+async function runTransport({ argv, stdin }, cwd) {
+  const [command, ...args] = argv;
+  if (command === void 0) return { stdout: null, stderr: "empty argv" };
+  try {
+    const r = await boundedRun(command, args, { timeoutMs: GH_API_TIMEOUT_MS, cwd, input: stdin });
+    if (r.code === 0) return { stdout: r.stdout, stderr: "" };
+    return { stdout: null, stderr: r.stderr || "" };
+  } catch (err) {
+    return { stdout: null, stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+async function ghCall(primary, fallback, opts = {}) {
+  const sleep = opts.sleep ?? realSleep;
+  for (const transport of [primary, fallback]) {
+    if (!transport) continue;
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      const { stdout, stderr } = await runTransport(transport, opts.cwd);
+      if (stdout !== null) return stdout;
+      if (isRateLimited(stderr)) break;
+      if (attempt < MAX_RETRIES) {
+        await sleep(Math.min(BACKOFF_BASE_MS * 2 ** attempt, BACKOFF_CAP_MS));
+      }
+    }
+  }
+  return null;
+}
+function parseSlugFromRemoteUrl(url) {
+  const trimmed = url.trim();
+  const match = trimmed.match(/[/:]([^/:]+)\/([^/]+?)(?:\.git)?\/?$/);
+  if (match) return `${match[1]}/${match[2]}`;
+  const bare = trimmed.match(/^([^/:\s]+)\/([^/:\s]+?)(?:\.git)?$/);
+  return bare ? `${bare[1]}/${bare[2]}` : null;
+}
+async function currentRepo(opts = {}) {
+  const out = await ghCall(
+    { argv: ["gh", "repo", "view", "--json", "nameWithOwner", "--jq", ".nameWithOwner"] },
+    null,
+    opts
+  );
+  if (out && out.trim()) return out.trim();
+  const remote = await boundedRun("git", ["remote", "get-url", "origin"], {
+    timeoutMs: GH_API_TIMEOUT_MS,
+    cwd: opts.cwd
+  });
+  return remote.code === 0 ? parseSlugFromRemoteUrl(remote.stdout) : null;
+}
+async function resolveRepoTarget(opts = {}) {
+  const explicit = opts.repo?.trim();
+  if (explicit) return explicit;
+  const ghRepo = (opts.env ?? process.env).GH_REPO?.trim();
+  if (ghRepo) return ghRepo;
+  return currentRepo(opts);
+}
+function issueNumber(ref) {
+  const s = String(ref);
+  if (/^\d+$/.test(s)) return s;
+  const m = s.match(/\/(?:issues|pull)\/(\d+)/);
+  return m?.[1] ?? null;
+}
+async function addLabels(repo, issue, labels, call = {}) {
+  const number = issueNumber(issue);
+  if (number === null || !labels.length) return null;
+  const rest = {
+    argv: ["gh", "api", "-X", "POST", `repos/${repo}/issues/${number}/labels`, "--input", "-"],
+    stdin: JSON.stringify({ labels })
+  };
+  const fb = {
+    argv: ["gh", "issue", "edit", number, "--repo", repo, "--add-label", labels.join(",")]
+  };
+  const out = await ghCall(rest, fb, call);
+  return out !== null ? out.trim() : null;
+}
+async function removeLabel(repo, issue, label, call = {}) {
+  const number = issueNumber(issue);
+  if (number === null) return null;
+  const rest = {
+    argv: [
+      "gh",
+      "api",
+      "-X",
+      "DELETE",
+      `repos/${repo}/issues/${number}/labels/${encodeURIComponent(label)}`
+    ]
+  };
+  const fb = {
+    argv: ["gh", "issue", "edit", number, "--repo", repo, "--remove-label", label]
+  };
+  const out = await ghCall(rest, fb, call);
+  return out !== null ? out.trim() : null;
+}
+
+// src/github/check-run.ts
+function checkRunBody(evaluation, now) {
+  const output = { title: evaluation.title, summary: evaluation.summary };
+  if (evaluation.outcome === "pending") return { status: "in_progress", output };
+  return {
+    status: "completed",
+    conclusion: evaluation.outcome,
+    completed_at: now.toISOString(),
+    output
+  };
+}
+async function openRun(target, headSha) {
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        `repos/${target.repo}/commits/${headSha}/check-runs?check_name=${PR_POLICY_CHECK_NAME}&filter=latest`,
+        "--jq",
+        ".check_runs"
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) throw new Error(`could not list ${PR_POLICY_CHECK_NAME} check-runs`);
+  const runs = JSON.parse(out);
+  return runs.find((run) => run.status !== "completed")?.id ?? null;
+}
+async function postCheckRun(target, headSha, evaluation) {
+  const body = checkRunBody(evaluation, /* @__PURE__ */ new Date());
+  const existing = await openRun(target, headSha);
+  const argv = existing === null ? ["gh", "api", "-X", "POST", `repos/${target.repo}/check-runs`, "--input", "-"] : ["gh", "api", "-X", "PATCH", `repos/${target.repo}/check-runs/${existing}`, "--input", "-"];
+  const payload = existing === null ? { name: PR_POLICY_CHECK_NAME, head_sha: headSha, ...body } : body;
+  const out = await ghCall({ argv, stdin: JSON.stringify(payload) }, null, { cwd: target.cwd });
+  if (out === null) throw new Error(`could not post the ${PR_POLICY_CHECK_NAME} check-run`);
+}
+
+// src/github/pull-request.ts
+async function ghJson(target, argv) {
+  const out = await ghCall({ argv }, null, { cwd: target.cwd });
+  if (out === null) throw new Error(`gh call failed: ${argv.join(" ")}`);
+  return JSON.parse(out);
+}
+async function blob(target, path, ref) {
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        "-H",
+        "Accept: application/vnd.github.raw",
+        `repos/${target.repo}/contents/${path}?ref=${encodeURIComponent(ref)}`
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) throw new Error(`could not read ${path} at ${ref}`);
+  return out;
+}
+async function listFiles(target) {
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        "--paginate",
+        `repos/${target.repo}/pulls/${target.pr}/files`,
+        "--jq",
+        ".[] | {filename, status, previous_filename}"
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) throw new Error(`could not list files of ${target.repo}#${target.pr}`);
+  return out.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+}
+async function gatherFacts(target) {
+  const view = await ghJson(target, [
+    "gh",
+    "api",
+    `repos/${target.repo}/pulls/${target.pr}`
+  ]);
+  const headSha = view.head.sha;
+  const files = await listFiles(target);
+  const touches = (predicate) => files.filter((file) => predicate(file.filename) || predicate(file.previous_filename ?? ""));
+  const workflowFiles = touches(isWorkflowPath);
+  const manifestFiles = touches(isManifestPath);
+  let workflowChanges = [];
+  let manifestChanges = [];
+  if (workflowFiles.length > 0 || manifestFiles.length > 0) {
+    const comparison = await ghJson(target, [
+      "gh",
+      "api",
+      `repos/${target.repo}/compare/${view.base.ref}...${headSha}`
+    ]);
+    const mergeBase = comparison.merge_base_commit.sha;
+    const read = async (file) => ({
+      path: file.filename,
+      baseText: file.status === "added" ? void 0 : await blob(target, file.previous_filename ?? file.filename, mergeBase),
+      headText: file.status === "removed" ? void 0 : await blob(target, file.filename, headSha)
+    });
+    workflowChanges = await Promise.all(workflowFiles.map(read));
+    manifestChanges = await Promise.all(manifestFiles.map(read));
+  }
+  const facts = {
+    title: view.title,
+    labels: view.labels.map((label) => label.name),
+    changedFiles: files.map((file) => file.filename),
+    workflowChanges,
+    manifestChanges
+  };
+  return { facts, headSha };
+}
+async function applyLabelEdits(target, evaluation) {
+  if (evaluation.labelsToAdd.length > 0) {
+    await addLabels(target.repo, target.pr, evaluation.labelsToAdd, { cwd: target.cwd });
+  }
+  for (const label of evaluation.labelsToRemove) {
+    await removeLabel(target.repo, target.pr, label, { cwd: target.cwd });
+  }
+}
+
+export {
+  PR_POLICY_CHECK_NAME,
+  CI_APPROVAL_NEEDED_LABEL,
+  CI_CHANGE_APPROVED_LABEL,
+  BREAKING_CHANGE_LABEL,
+  HOTFIX_LABEL,
+  RELEASE_PLEASE_PENDING_LABEL,
+  LOOSENING_INDICATORS,
+  AMBIGUOUS_INDICATORS,
+  CI_CHANGE_VERDICTS,
+  classifyWorkflowFile,
+  classifyWorkflowChanges,
+  CI_CHANGE_CHECK,
+  decideCiChange,
+  ciChangeCheck,
+  COMMIT_TYPES,
+  FUNCTIONAL_TYPES,
+  parseTitle,
+  CI_SENSITIVE_PACKAGES,
+  isManifestPath,
+  sensitiveBumps,
+  TITLE_CHECK,
+  decideTitle,
+  titleCheck,
+  CHECKS,
+  isWorkflowPath,
+  POLICY_OUTCOMES,
+  buildReport,
+  evaluatePolicy,
+  parseFacts,
+  resolveRepoTarget,
+  checkRunBody,
+  postCheckRun,
+  gatherFacts,
+  applyLabelEdits
+};