@starci/hfs 4.4.0 → 4.5.0

package/stack/release-store.mjs

@@ -5,7 +5,6 @@
 // the remote shell. The record holds names and digests, never a secret value. Files travel as text on stdin / stdout.
 import fs from 'node:fs';
 import path from 'node:path';
-import { eachInOrder, mapInOrder } from '../runtime/scripts/lib/in-order.mjs';
 import { firstLine, lines as splitLines } from './context.mjs';
 import { isReleaseId } from './digest.mjs';
 import { failure, refusal } from './errors.mjs';
@@ -56,9 +55,8 @@ export function createReleaseStore(config, ssh) {
     async store(dir, id) {
       const target = dirOf(id);
       const contents = FILES.map((name) => [name, readLocal(dir, name)]);
-      await run(`set -e; d="${target}"; if [ -d "$d" ]; then chmod -R u+w "$d"; else mkdir -p "$d"; fi`);
-      await eachInOrder(contents, ([name, text]) => run(`set -e; d="${target}"; cat > "$d/${name}"`, text));
-      await run(`set -e; d="${target}"; chmod 440 "$d/stack.yaml" "$d/release.json"; chmod 550 "$d"`);
+      const input = contents.map(([, text]) => Buffer.from(text, 'utf8').toString('base64')).join('\n') + '\n';
+      await run(`set -e; d="${target}"; if [ -d "$d" ]; then chmod -R u+w "$d"; else mkdir -p "$d"; fi; IFS= read -r stack; IFS= read -r release; printf '%s' "$stack" | base64 -d > "$d/stack.yaml"; printf '%s' "$release" | base64 -d > "$d/release.json"; chmod 440 "$d/stack.yaml" "$d/release.json"; chmod 550 "$d"`, input);
     },
     /** The release was verified: previous := current, current := id. */
     async accept(id) {
@@ -72,15 +70,22 @@ export function createReleaseStore(config, ssh) {
     /** Downloads a stored release (both files) into `targetDir` for a rollback or an audit. */
     async fetch(id, targetDir) {
       const source = dirOf(id);
-      const files = await mapInOrder(FILES, async (name) => [name, await run(`cat "${source}/${name}"`)]);
+      const out = await run(`set -e; for f in stack.yaml release.json; do test -r "${source}/$f"; base64 < "${source}/$f" | tr -d '\\n'; printf '\\n'; done`);
+      const frames = out.split('\n');
+      if (frames.length !== 3 || frames[2] !== '' || frames.slice(0, 2).some((frame) => !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u.test(frame))) throw failure('STACK_RELEASE_SSH', 'invalid release response framing');
+      const files = FILES.map((name, index) => [name, Buffer.from(frames[index], 'base64').toString('utf8')]);
       fs.mkdirSync(targetDir, { recursive: true });
       for (const [name, text] of files) fs.writeFileSync(path.join(targetDir, name), text);
       return targetDir;
     },
     /** The stored releases, newest first: [{ id, current, previous }]. */
     async list() {
-      const [now, before] = [await pointer('current'), await pointer('previous')];
-      const out = await run(`cd "${base}/releases" 2>/dev/null && ls -1t || true`);
+      const pointerScript = (name) => `if [ -L "${base}/${name}" ]; then basename "$(readlink "${base}/${name}")"; else printf '\\n'; fi`;
+      const response = await run(`${pointerScript('current')}; ${pointerScript('previous')}; cd "${base}/releases" 2>/dev/null && ls -1t || true`);
+      const [current, previous, ...entries] = response.split('\n');
+      const now = isReleaseId(current) ? current : '';
+      const before = isReleaseId(previous) ? previous : '';
+      const out = entries.join('\n');
       return splitLines(out).filter(isReleaseId).map((id) => ({ id, current: id === now, previous: id === before }));
     },
   };

package/stack/remote.mjs

@@ -13,6 +13,7 @@ import path from 'node:path';
 import { tool } from './context.mjs';
 import { restrictToUser, writePrivate } from './private-file.mjs';
 import { refusal } from './errors.mjs';
+import { createSshSession, sessionDirectory } from './ssh-session.mjs';
 
 const ACCOUNT = /^[A-Za-z0-9._@-]+$/u;
 const CI_VARIABLES = ['VPS_SSH_KEY', 'VPS_KNOWN_HOSTS', 'VPS_HOST', 'VPS_USER'];
@@ -33,11 +34,11 @@ export const remoteDocker = (run, args) => run(['docker', ...args.map(shellQuote
 
 const noop = () => {};
 
-function makeRunner(ctx, argv, { cleanup = noop, notes = [] } = {}) {
+function makeRunner(ctx, argv, { cleanup = noop, notes = [], connection } = {}) {
   const [command, ...head] = argv;
   const run = (remote, { input } = {}) => {
     const options = input === undefined ? {} : { input: lfOnly(input) };
-    const result = tool(ctx, command, [...head, lfOnly(remote)], options);
+    const result = connection ? connection.remote(lfOnly(remote), options) : tool(ctx, command, [...head, lfOnly(remote)], options);
     if (result.error) return { status: 127, stdout: '', stderr: `cannot run ${command}: ${result.error.message}` };
     return { status: result.status ?? 1, stdout: result.stdout, stderr: result.stderr };
   };
@@ -119,21 +120,28 @@ export function openSealedSession(ctx, config) {
 function sealedRunner(ctx, config) {
   const session = openSealedSession(ctx, config);
   const argv = ['ssh', '-T', '-i', session.keyFile, '-o', 'IdentitiesOnly=yes', '-o', `UserKnownHostsFile=${session.knownFile}`, '-o', `StrictHostKeyChecking=${session.strict}`, '-o', 'BatchMode=yes', '-o', 'ConnectTimeout=20', session.account];
-  return makeRunner(ctx, argv, { cleanup: session.cleanup, notes: session.notes });
+  return sessionRunner(ctx, argv, session.dir, session.cleanup, session.notes);
+}
+
+function sessionRunner(ctx, argv, dir, cleanup, notes = []) {
+  const connection = createSshSession(ctx, { argv, controlPath: path.join(dir, 'cm').replaceAll('\\', '/'), cleanup });
+  return makeRunner(ctx, argv, { connection, cleanup: connection.close, notes });
 }
 
 /** The ssh runner of one invocation (see the top of the file). */
-export function sshRunner(ctx, config, { sshCmd = null } = {}) {
+function sshRunner(ctx, config, { sshCmd = null } = {}) {
+  if (ctx.stackSsh && !sshCmd) return makeRunner(ctx, ['ssh'], { connection: ctx.stackSsh });
   if (sshCmd) return makeRunner(ctx, sshCommandArgv(sshCmd));
   if (config.remote.sealed && ctx.env.STARCI_STACK_SEALED_SSH === '1') return sealedRunner(ctx, config);
-  return makeRunner(ctx, ['ssh', ...SSH_OPTIONS, config.remote.host]);
+  const dir = sessionDirectory();
+  return sessionRunner(ctx, ['ssh', ...SSH_OPTIONS, config.remote.host], dir, () => fs.rmSync(dir, { recursive: true, force: true }));
 }
 
 /**
  * The context to open the runner with. On an operator machine (not CI, no --ssh-cmd, the sealed members exist, no explicit
  * STARCI_STACK_SEALED_SSH) the sealed session is selected; otherwise the context is returned unchanged.
  */
-export function withOwnerTransport(ctx, config, { sshCmd = null } = {}) {
+function withOwnerTransport(ctx, config, { sshCmd = null } = {}) {
   const { sealed } = config.remote;
   if (sshCmd || !sealed || ctx.env.GITHUB_ACTIONS === 'true' || ctx.env.STARCI_STACK_SEALED_SSH !== undefined) return ctx;
   const present = [sealed.ops, sealed.sshKey, sealed.knownHosts].every((slug) => fs.existsSync(path.join(config.secretsDir, `${slug}.enc`)));
@@ -150,7 +158,7 @@ export async function withRunner(ctx, config, options, deps, body) {
   try {
     return await body(run, run.notes ?? []);
   } finally {
-    run.cleanup?.();
+    await run.cleanup?.();
   }
 }
 
@@ -174,7 +182,7 @@ function ciInputs(ctx) {
 const sshBlock = (alias, inputs) => [
   '', `Host ${alias}`, `  HostName ${inputs.host}`, `  User ${inputs.user}`, '  IdentityFile ~/.ssh/deploy_key',
   '  StrictHostKeyChecking yes', '  BatchMode yes', '  ConnectTimeout 20', '  ServerAliveInterval 30',
-  '  ControlMaster auto', '  ControlPath ~/.ssh/cm-%C', '  ControlPersist 15m', '',
+  '  ControlMaster auto', '  ControlPath ~/.ssh/cm-%C', '  ControlPersist 60', '',
 ].join('\n');
 
 /** CI transport: pinned key, known_hosts, ssh config block and DOCKER_HOST=ssh://<alias> in $GITHUB_ENV. */

package/stack/sealed.mjs

@@ -19,16 +19,16 @@ const CR = String.fromCodePoint(13);
 const LF = String.fromCodePoint(10);
 
 /** True for content that is not text: a NUL byte in the first 8 KiB. Binary files are never rewritten. */
-export const isBinary = (bytes) => bytes.subarray(0, 8192).includes(0);
+const isBinary = (bytes) => bytes.subarray(0, 8192).includes(0);
 
 /** Every CRLF of a string becomes LF. */
-export const lfText = (text) => text.replaceAll(CR + LF, LF);
+const lfText = (text) => text.replaceAll(CR + LF, LF);
 
 /**
  * Line endings of a text file as the services need them: every CRLF becomes LF (a script rendered from a Windows checkout failed with
  * `set: Illegal option -`). Binary content is returned untouched. Takes and returns a Buffer.
  */
-export function lfBytes(bytes) {
+function lfBytes(bytes) {
   if (isBinary(bytes) || !bytes.includes(13)) return bytes;
   return Buffer.from(lfText(bytes.toString('latin1')), 'latin1');
 }
@@ -37,14 +37,14 @@ export function lfBytes(bytes) {
 export const configBytes = (file) => lfBytes(fs.readFileSync(file));
 
 /** The key that makes the version suffix of a secret name unguessable from the name alone: a local fixture key or the age identity. */
-export function versionKeyOf(ctx) {
+function versionKeyOf(ctx) {
   const key = ctx.env.STARCI_SECRET_VERSION_KEY || ctx.env.SOPS_AGE_KEY;
   if (!key) throw refusal('STACK_VERSION_KEY_MISSING', 'STARCI_SECRET_VERSION_KEY (a local fixture) or SOPS_AGE_KEY is needed to version the secret names');
   return key;
 }
 
 /** `<stack>-<key>-v<10 hex of HMAC(versionKey, key NUL value)>`: a changed value is a new name, an unchanged one keeps its name. */
-export function secretRuntimeName(stack, key, value, versionKey) {
+function secretRuntimeName(stack, key, value, versionKey) {
   const version = createHmac('sha256', versionKey).update(`${key}\0${value}`).digest('hex').slice(0, 10);
   const name = `${stack}-${key.toLowerCase().replaceAll('_', '-')}-v${version}`;
   if (name.length > MAX_NAME) throw refusal('STACK_SECRET_NAME_TOO_LONG', `the Swarm secret name for ${key} would exceed ${MAX_NAME} characters`);

package/stack/ssh-session.mjs

@@ -0,0 +1,178 @@
+// ssh-session.mjs - one command-owned connection; all processes use ctx.spawn. Windows prefers a Unix socket in private 0700 HOME
+// when runtime ssh -V reports OpenSSH >= 6.7 and a local AF_UNIX Docker CLI probe succeeds. Otherwise a fresh ephemeral TCP
+// port is asserted to bind only 127.0.0.1 and never reaches files or logs. Finally and SIGINT/SIGTERM close the tunnel.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { failure } from './errors.mjs';
+import { restrictToUser } from './private-file.mjs';
+
+const FREE_PORT = "const net=require('node:net');const s=net.createServer();s.on('error',()=>process.exit(1));s.listen(0,'127.0.0.1',()=>{console.log(s.address().port);s.close();});";
+const WAIT_PORT = "const net=require('node:net');const deadline=Date.now()+20000;function probe(){const s=net.connect({host:'127.0.0.1',port:Number(process.argv[1])});s.setTimeout(200);s.on('connect',()=>{s.destroy();process.exit(0);});function retry(){s.destroy();if(Date.now()>=deadline)process.exit(1);else setTimeout(probe,50);}s.on('error',retry);s.on('timeout',retry);}probe();";
+
+const WAIT_SOCKET = WAIT_PORT.replace("{host:'127.0.0.1',port:Number(process.argv[1])}", '{path:process.argv[1]}');
+const UNIX_PROBE = String.raw`
+const http = require('node:http');
+const fs = require('node:fs');
+const { spawn } = require('node:child_process');
+const socket = process.argv[1];
+let child;
+function finish(code) {
+  child?.kill();
+  server.close();
+  try { fs.unlinkSync(socket); } catch {}
+  process.exit(code);
+}
+const server = http.createServer((req, res) => {
+  res.setHeader('Api-Version', '1.47');
+  res.setHeader('Content-Type', 'application/json');
+  res.end(req.url.endsWith('/_ping') ? 'OK' : JSON.stringify({ Version: '27.0.0', ApiVersion: '1.47', MinAPIVersion: '1.24', Os: 'linux', Arch: 'amd64' }));
+});
+server.on('error', () => finish(1));
+server.listen(socket, () => {
+  child = spawn('docker', ['--host', 'unix://' + socket.replaceAll('\\', '/'), 'version', '--format', '{{.Server.Version}}'], { stdio: 'ignore', windowsHide: true });
+  child.on('error', () => finish(1));
+  child.on('exit', code => finish(code === 0 ? 0 : 1));
+});
+setTimeout(() => finish(1), 5000);
+`;
+
+/** TCP Docker forwarding must never expose the manager on a non-loopback interface. */
+function loopbackForward(bind, port, socket) {
+  if (bind !== '127.0.0.1') throw failure('STACK_SSH_SESSION', 'the Docker tunnel must bind 127.0.0.1');
+  return `${bind}:${port}:${socket}`;
+}
+
+function unixEndpoint(ctx, command, env) {
+  const version = ctx.spawn(command, ['-V'], { env });
+  const match = /OpenSSH(?:_for_Windows)?_(\d+)\.(\d+)/u.exec(`${version.stderr ?? ''} ${version.stdout ?? ''}`);
+  if (!successful(version) || !match || Number(match[1]) < 6 || Number(match[1]) === 6 && Number(match[2]) < 7) return null;
+  if (!env.HOME) return null;
+  fs.mkdirSync(env.HOME, { recursive: true, mode: 0o700 });
+  fs.chmodSync(env.HOME, 0o700);
+  restrictToUser(ctx, env.HOME, '(OI)(CI)F');
+  const probe = path.join(env.HOME, 'probe.sock');
+  try {
+    if (!successful(ctx.spawn(process.execPath, ['-e', UNIX_PROBE, probe], { env, timeout: 7000 }))) return null;
+  } finally {
+    fs.rmSync(probe, { force: true });
+  }
+  return path.join(env.HOME, 'docker.sock').replaceAll('\\', '/');
+}
+
+/** The same multiplexing settings belong to the master, remote commands and Docker's SSH alias. */
+export function controlSettings(controlPath) {
+  return ['ControlMaster=auto', `ControlPath=${controlPath}`, 'ControlPersist=60'];
+}
+
+function successful(result) {
+  return !result.error && result.status === 0;
+}
+
+function freePort(ctx) {
+  const result = ctx.spawn(process.execPath, ['-e', FREE_PORT]);
+  const port = Number(result.stdout?.trim());
+  if (!successful(result) || !Number.isInteger(port) || port < 1 || port > 65535) throw failure('STACK_SSH_SESSION', 'cannot allocate a loopback port');
+  return port;
+}
+
+/** Waits for the tunnel child to exit before any private credentials are removed. */
+function stopTunnel(child) {
+  if (!child || child.spawnError || child.exitCode !== null && child.exitCode !== undefined || child.signalCode) return;
+  if (!child.once) { child.kill(); return; }
+  return new Promise((resolve) => {
+    const timer = setTimeout(() => child.kill('SIGKILL'), 2000);
+    child.once('close', () => { clearTimeout(timer); resolve(); });
+    child.kill();
+  });
+}
+
+async function closeTunnel(child, cleanup) {
+  try { await stopTunnel(child); } finally { cleanup(); }
+}
+
+/** Creates a lazy connection; no SSH is spawned until a Docker query or remote command needs it. */
+export function createSshSession(ctx, { argv, env = ctx.env, controlPath, socket = '/var/run/docker.sock', cleanup = () => {} }) {
+  const windows = (ctx.platform ?? process.platform) === 'win32';
+  const [command, ...head] = argv;
+  const controls = windows ? [] : controlSettings(controlPath).flatMap((setting) => ['-o', setting]);
+  let started = false;
+  let ready = false;
+  let child;
+  let host;
+  let closing;
+  const signalHandlers = new Map();
+  let closed = false;
+
+  function start() {
+    if (closed) throw failure('STACK_SSH_SESSION', 'the command session is already closed');
+    if (ready) return;
+    if (started) throw failure('STACK_SSH_SESSION', 'the SSH connection failed to open');
+    started = true;
+    if (windows) {
+      const localSocket = unixEndpoint(ctx, command, env);
+      const port = localSocket ? null : freePort(ctx);
+      const forward = localSocket ? `./docker.sock:${socket}` : loopbackForward('127.0.0.1', port, socket);
+      host = localSocket ? `unix://${localSocket}` : `tcp://127.0.0.1:${port}`;
+      child = ctx.spawn(command, ['-N', '-o', 'ExitOnForwardFailure=yes', '-o', 'GatewayPorts=no', ...(localSocket ? ['-o', 'StreamLocalBindMask=0177'] : []), '-L', forward, ...head], { env, cwd: localSocket ? env.HOME : undefined, background: true });
+      if (typeof child?.kill !== 'function') {
+        child = undefined;
+        throw failure('STACK_SSH_SESSION', 'cannot start the Docker SSH tunnel');
+      }
+      installSignals();
+      const probeArgs = localSocket ? ['-e', WAIT_SOCKET, localSocket] : ['-e', WAIT_PORT, String(port)];
+      const probe = ctx.spawn(process.execPath, probeArgs, { env, timeout: 25000 });
+      if (!successful(probe)) throw failure('STACK_SSH_SESSION', 'the Docker SSH tunnel did not become ready');
+    } else {
+      const result = ctx.spawn(command, ['-MNf', ...controls, ...head], { env });
+      if (!successful(result)) throw failure('STACK_SSH_SESSION', 'cannot open the SSH control master');
+    }
+    ready = true;
+  }
+
+  function remote(remoteCommand, options = {}) {
+    // Windows cannot multiplex exec channels; Docker queries share the tunnel and remote scripts remain one call per step.
+    if (!windows) start();
+    return ctx.spawn(command, [...controls, ...head, remoteCommand], { ...options, env });
+  }
+
+  function dockerHost(alias) {
+    start();
+    return windows ? host : `ssh://${alias}`;
+  }
+
+  function installSignals() {
+    for (const [signal, code] of [['SIGINT', 130], ['SIGTERM', 143]]) {
+      const handler = () => { Promise.resolve(close()).finally(() => process.exit(code)); };
+      signalHandlers.set(signal, handler);
+      process.once(signal, handler);
+    }
+  }
+
+  function finish() {
+    for (const [signal, handler] of signalHandlers) process.removeListener(signal, handler);
+    signalHandlers.clear();
+    cleanup();
+  }
+
+  function close() {
+    if (closed) return closing;
+    closed = true;
+    if (windows && child) {
+      closing = closeTunnel(child, finish);
+      return closing;
+    }
+    try {
+      if (!windows && started) ctx.spawn(command, ['-O', 'exit', ...controls, ...head], { env });
+    } finally {
+      finish();
+    }
+  }
+
+  return { remote, dockerHost, close };
+}
+
+/** A short private directory for an invocation whose SSH credentials already live in the operator or CI HOME. */
+export function sessionDirectory() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'sc-'));
+}

package/sync/ci-commands.mjs

@@ -1,13 +1,115 @@
+import fs from 'node:fs';
+
 // One command vocabulary for managed CI rendering and the runtime coverage gate.
 const exampleCommand = (source, command) => source?.runtimeExample
   ? 'node node_modules/@starci/hfs/runtime/scripts/hfs/example-secrets.mjs --run . -- ' + command
   : command;
 
-export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info') {
+const UPLOAD_ARTIFACT = 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2';
+const DOWNLOAD_ARTIFACT = 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0';
+const SONAR_CONDITION = "${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') && env.SONAR_TOKEN != '' }}";
+
+/** Codecov reports missing coverage without failing twice; uploads retain the release-tag condition and required authentication. */
+function codecovSteps(lcovReport, codecov) {
+  if (codecov.enabled === false || codecov.wiring === 'not-used') return [
+    '      - name: coverage upload',
+    '        run: echo "codecov disabled in .starcistacks/application-stacks.yaml"',
+  ].join('\n');
+  return [
+    '      - name: coverage upload skipped',
+    `        if: \${{ !cancelled() && hashFiles('${lcovReport}') == '' }}`,
+    '        run: |',
+    `          echo "::notice::codecov upload skipped: no coverage file at ${lcovReport} (the test step failed or produced none)"`,
+    '          exit 0',
+    '      - name: coverage upload',
+    '        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5',
+    `        if: \${{ !cancelled() && startsWith(github.ref, 'refs/tags/v') && hashFiles('${lcovReport}') != '' }}`,
+    '        with:',
+    codecov.auth === 'token' ? `          token: \${{ secrets.${codecov.token} }}` : '          use_oidc: true',
+    `          files: ${lcovReport}`,
+    '          disable_search: true',
+    '          fail_ci_if_error: true',
+  ].join('\n');
+}
+
+/** Sonar consumes the test coverage and fast lint artifacts only on release tags with a configured token. */
+function sonarJob(sonar, lcovReport, lcovArtifact, nodeMajor) {
+  if (!sonar) return '';
+  const header = [
+    '  sonar:',
+    '    needs: [fast, test]',
+    '    runs-on: ubuntu-latest',
+    '    env:',
+    `      SONAR_TOKEN: \${{ secrets.${sonar.token} }}`,
+    `      SONAR_HOST_URL: \${{ vars.${sonar.hostVar} }}`,
+    '    steps:',
+  ].join('\n');
+  const steps = [
+    `      - uses: ${DOWNLOAD_ARTIFACT}`,
+    `        if: ${SONAR_CONDITION}`,
+    '        with:',
+    `          name: ${lcovArtifact}`,
+    `          path: ${lcovReport.split('/').slice(0, -1).join('/') || '.'}`,
+    `      - uses: ${DOWNLOAD_ARTIFACT}`,
+    `        if: ${SONAR_CONDITION}`,
+    '        with:',
+    '          name: sonar-lint',
+    '          path: reports',
+    '      - uses: SonarSource/sonarqube-scan-action@c7ee0f9df90b7aa20e8dcf9695dcfe2e7da5b4f2 # v7.2.1',
+    `        if: ${SONAR_CONDITION}`,
+    '      - uses: SonarSource/sonarqube-quality-gate-action@7a5fffe8e523c40e0c740b6bc2712ab503e52efa # v1.2.1',
+    `        if: ${SONAR_CONDITION}`,
+    '        timeout-minutes: 10',
+  ].join('\n');
+  // Variable strings are inserted after render() expands partials, so resolve Sonar's shared install partial before insertion.
+  const read = name => fs.readFileSync(new URL('../templates/app/ci-workflows/' + name, import.meta.url), 'utf8').replaceAll('\r\n', '\n');
+  return read('sonar-steps.yml')
+    .replace('{{> app/ci-workflows/install-steps.yml}}', () => read('install-steps.yml').trimEnd())
+    .replaceAll('{{nodeMajor}}', nodeMajor)
+    .replace('{{sonarJobHeader}}', () => header)
+    .replace('{{sonarJobSteps}}', () => steps)
+    .trimEnd();
+}
+
+/** An omitted quality declaration preserves hosted Sonar, required OIDC Codecov, and the high production dependency audit. */
+export function ciWorkflowCommands(source, lcovReport = 'be/coverage/lcov.info', quality = undefined, { nodeMajor = '22' } = {}) {
+  const configuredSonar = quality === undefined ? { token: 'SONAR_TOKEN', hostVar: 'SONAR_HOST_URL' } : quality.sonar;
+  const sonar = configuredSonar?.wiring === 'not-used' || configuredSonar?.mode === 'disabled' ? null : configuredSonar;
+  const codecov = quality?.codecov ?? { enabled: true, auth: 'oidc' };
+  const audit = quality?.audit ?? { level: 'high', omitDev: true };
+  const lcovArtifact = 'coverage-lcov';
   return {
     ciLint: exampleCommand(source, 'npm run lint'),
     ciLintSonar: exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json'),
     ciCoverageProof: exampleCommand(source, 'npx starci app check --coverage-from ' + lcovReport),
     ciDatabaseLint: exampleCommand(source, 'npm run db:lint'),
+    auditCommand: `npm audit${audit.omitDev ? ' --omit=dev' : ''} --audit-level=${audit.level}`,
+    sonarTokenSecret: sonar?.token ?? 'SONAR_TOKEN',
+    sonarHostVar: sonar?.hostVar ?? 'SONAR_HOST_URL',
+    sonarEnv: sonar ? `    env:\n      SONAR_TOKEN: \${{ secrets.${sonar.token} }}` : '',
+    ciLintSteps: [
+      ...['be', 'fe'].flatMap((side) => [
+        '      - name: lint ' + side,
+        ...(sonar ? ["        if: env.SONAR_TOKEN == ''"] : []),
+        `        run: ${exampleCommand(source, 'npm run lint -- --side ' + side)}`,
+        '        env:',
+        '          NODE_OPTIONS: --max-old-space-size=6144',
+      ]),
+      ...(sonar ? [
+        '      - name: lint with Sonar import',
+        "        if: env.SONAR_TOKEN != ''",
+        `        run: ${exampleCommand(source, 'npm run lint -- --sonar reports/lint.sonar.json')}`,
+        '        env:',
+        '          NODE_OPTIONS: --max-old-space-size=6144',
+        `      - uses: ${UPLOAD_ARTIFACT}`,
+        "        if: always() && env.SONAR_TOKEN != '' && hashFiles('reports/lint.sonar.json') != ''",
+        '        with:',
+        '          name: sonar-lint',
+        '          path: reports/lint.sonar.json',
+      ] : []),
+    ].join('\n'),
+    codecovSteps: codecovSteps(lcovReport, codecov),
+    sonarJob: sonarJob(sonar, lcovReport, lcovArtifact, nodeMajor),
+    lcovArtifact,
   };
 }

package/sync/format.mjs

@@ -13,7 +13,7 @@ const IGNORE_FILE = '.prettierignore';
 const LOCKFILES = new Set(['package-lock.json']);
 
 /** The repository's own prettier, or a SyncError when it is not installed. */
-export function loadPrettier(repoRoot) {
+function loadPrettier(repoRoot) {
   const require = createRequire(path.join(repoRoot, 'package.json'));
   try {
     return require('prettier');

package/sync/hygiene.mjs

@@ -43,7 +43,7 @@ function ignoredAmong(cwd, files) {
 }
 
 /** Violations among `files` (repository-relative, '/'-separated): [{ file, code, message }]. `ignored` is a Set of ignored paths. */
-export function hygieneFindings(files, ignored) {
+function hygieneFindings(files, ignored) {
   const findings = [];
   for (const file of files) {
     if (file.startsWith(WORK) && ignored.has(file)) {