@svp-labs/talos 0.0.0 → 0.1.0

package/dist/central/org-rulesets.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+import { CHANNELS } from './channels.js';
+/**
+ * The three channel rulesets of the organisation: reading their pins and history, and moving a
+ * pin. Moving one needs organisation administration, which only `talos-release` holds.
+ */
+const SHA = /^[0-9a-f]{40}$/;
+const summarySchema = z.object({ id: z.number().int(), name: z.string() });
+const ruleSchema = z.looseObject({ type: z.string(), parameters: z.unknown().optional() });
+const detailSchema = z.looseObject({
+    id: z.number().int(),
+    name: z.string(),
+    target: z.string().optional(),
+    enforcement: z.string(),
+    bypass_actors: z.array(z.unknown()).optional(),
+    conditions: z.unknown().optional(),
+    rules: z.array(ruleSchema).default([]),
+});
+/** Loose, so a move keeps every field GitHub has and Talos doesn't know. */
+const workflowsParameters = z.looseObject({
+    workflows: z.array(z.looseObject({
+        repository_id: z.number().int(),
+        sha: z.string().optional(),
+        ref: z.string().optional(),
+    })),
+});
+const versionSchema = z.object({ version_id: z.number().int(), updated_at: z.string() });
+const versionDetailSchema = z.object({
+    updated_at: z.string(),
+    state: z.looseObject({ rules: z.array(ruleSchema).default([]) }),
+});
+export function channelRulesetName(channel) {
+    return `talos-${channel}`;
+}
+/** The commit a ruleset runs Talos's gate at, when its workflows rules agree on exactly one. */
+export function pinOfRules(rules, talosId) {
+    const shas = new Set();
+    for (const rule of rules) {
+        if (rule.type !== 'workflows')
+            continue;
+        const parsed = workflowsParameters.safeParse(rule.parameters);
+        if (!parsed.success)
+            continue;
+        for (const workflow of parsed.data.workflows) {
+            if (workflow.repository_id === talosId)
+                shas.add(workflow.sha ?? '');
+        }
+    }
+    const [only] = shas;
+    return shas.size === 1 && only !== undefined && SHA.test(only) ? only : undefined;
+}
+/** The rules with each workflow from the Talos repository pinned at `sha`, nothing else changed. */
+export function withPin(rules, talosId, sha) {
+    return rules.map((rule) => {
+        if (rule.type !== 'workflows')
+            return rule;
+        const parsed = workflowsParameters.safeParse(rule.parameters);
+        if (!parsed.success)
+            return rule;
+        const workflows = parsed.data.workflows.map((workflow) => {
+            if (workflow.repository_id !== talosId)
+                return workflow;
+            const { ref: _ref, ...rest } = workflow;
+            return { ...rest, sha };
+        });
+        return { ...rule, parameters: { ...parsed.data, workflows } };
+    });
+}
+/** The body the update endpoint takes: the ruleset as it is, its Talos pin moved. */
+export function movedBody(ruleset, talosId, sha) {
+    return {
+        name: ruleset.name,
+        ...(ruleset.target === undefined ? {} : { target: ruleset.target }),
+        enforcement: ruleset.enforcement,
+        bypass_actors: ruleset.bypass_actors ?? [],
+        ...(ruleset.conditions === undefined ? {} : { conditions: ruleset.conditions }),
+        rules: withPin(ruleset.rules, talosId, sha),
+    };
+}
+/** The organisation's channel rulesets, by channel; a channel without one is `undefined`. */
+export async function readChannelRulesets(gh, org) {
+    const at = `orgs/${encodeURIComponent(org)}/rulesets`;
+    const summaries = z.array(summarySchema).parse(await gh.paginate(at));
+    const entries = await Promise.all(CHANNELS.map(async (channel) => {
+        const summary = summaries.find((s) => s.name === channelRulesetName(channel));
+        if (summary === undefined)
+            return [channel, undefined];
+        const detail = detailSchema.parse(await gh.request('GET', `${at}/${summary.id}`));
+        return [channel, detail];
+    }));
+    return {
+        evaluate: entries.find(([c]) => c === 'evaluate')?.[1],
+        canary: entries.find(([c]) => c === 'canary')?.[1],
+        stable: entries.find(([c]) => c === 'stable')?.[1],
+    };
+}
+export function pinsOf(rulesets, talosId) {
+    const pin = (channel) => {
+        const ruleset = rulesets[channel];
+        return ruleset === undefined ? undefined : pinOfRules(ruleset.rules, talosId);
+    };
+    return { evaluate: pin('evaluate'), canary: pin('canary'), stable: pin('stable') };
+}
+export async function movePin(gh, at, ruleset, sha) {
+    await gh.request('PUT', `orgs/${encodeURIComponent(at.org)}/rulesets/${ruleset.id}`, {
+        body: movedBody(ruleset, at.talosId, sha),
+    });
+}
+const HISTORY_DEPTH = 10;
+/**
+ * A ruleset's pins through its history, newest first, from GitHub's ruleset versions. Only the
+ * newest few are read: enough to see when the current pin began.
+ */
+export async function pinHistory(gh, at, rulesetId, sha) {
+    const base = `orgs/${encodeURIComponent(at.org)}/rulesets/${rulesetId}/history`;
+    const versions = z
+        .array(versionSchema)
+        .parse(await gh.request('GET', `${base}?per_page=${HISTORY_DEPTH}`));
+    const pins = [];
+    for (const version of versions.slice(0, HISTORY_DEPTH)) {
+        const detail = versionDetailSchema.parse(await gh.request('GET', `${base}/${version.version_id}`));
+        const pin = pinOfRules(detail.state.rules, at.talosId);
+        pins.push({ at: detail.updated_at, sha: pin });
+        if (pin !== sha)
+            break;
+    }
+    return pins;
+}
+//# sourceMappingURL=org-rulesets.js.map

package/dist/central/org-rulesets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-rulesets.js","sourceRoot":"","sources":["../../src/central/org-rulesets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAgB,QAAQ,EAAa,MAAM,eAAe,CAAC;AAGlE;;;GAGG;AAEH,MAAM,GAAG,GAAG,gBAAgB,CAAC;AAE7B,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3E,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE3F,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,KAAK,CAChB,CAAC,CAAC,WAAW,CAAC;QACZ,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC3B,CAAC,CACH;CACF,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEzF,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;CACjE,CAAC,CAAC;AAKH,MAAM,UAAU,kBAAkB,CAAC,OAAgB;IACjD,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,KAAsB,EAAE,OAAe;IAChE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,SAAS;QAC9B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7C,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACpB,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpF,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,OAAO,CAAC,KAAsB,EAAE,OAAe,EAAE,GAAW;IAC1E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,IAAI,CAAC;QAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YACvD,IAAI,QAAQ,CAAC,aAAa,KAAK,OAAO;gBAAE,OAAO,QAAQ,CAAC;YACxD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;YACxC,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,SAAS,CACvB,OAAmB,EACnB,OAAe,EACf,GAAW;IAEX,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACnE,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,EAAE;QAC1C,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAC/E,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC;KAC5C,CAAC;AACJ,CAAC;AAID,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAU,EAAE,GAAW;IAC/D,MAAM,EAAE,GAAG,QAAQ,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC;IACtD,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAU,EAAE,CAAC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAU,CAAC;QAChE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,OAAO,EAAE,MAAM,CAAU,CAAC;IACpC,CAAC,CAAC,CACH,CAAC;IACF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACtD,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAyB,EAAE,OAAe;IAC/D,MAAM,GAAG,GAAG,CAAC,OAAgB,EAAsB,EAAE;QACnD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,EAAsD,EACtD,OAAmB,EACnB,GAAW;IAEX,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,EAAE,EAAE,EAAE;QACnF,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC;KAC1C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,aAAa,GAAG,EAAE,CAAC;AAEzB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,EAAsD,EACtD,SAAiB,EACjB,GAAW;IAEX,MAAM,IAAI,GAAG,QAAQ,kBAAkB,CAAC,EAAE,CAAC,GAAG,CAAC,aAAa,SAAS,UAAU,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC;SACf,KAAK,CAAC,aAAa,CAAC;SACpB,KAAK,CAAC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,GAAG,IAAI,aAAa,aAAa,EAAE,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAA8C,EAAE,CAAC;IAC3D,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,CAAC;QACvD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CACtC,MAAM,EAAE,CAAC,OAAO,CAAU,KAAK,EAAE,GAAG,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAClE,CAAC;QACF,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/C,IAAI,GAAG,KAAK,GAAG;YAAE,MAAM;IACzB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/central/pick.js

@@ -0,0 +1,67 @@
+import { CHANNELS } from './channels.js';
+import { maskCommands } from './privacy.js';
+import { CentralError } from './repos.js';
+import { listPropertyValues } from '../github/repos.js';
+/**
+ * How a central job learns the repositories it reads while its public log never names them.
+ * The organisation's custom property listing, read with a token that reaches no repository,
+ * gives the governed repositories in id order, the order the job's matrix of indices counts in.
+ * The chosen names are masked before anything else is printed, and only then handed to the
+ * job's later steps through `$GITHUB_OUTPUT`, which mint a token limited to them.
+ */
+/** One half of an `owner/name` as GitHub allows it: nothing a workflow command could split. */
+const NAME_PART = /^[\w.-]+$/;
+const DIGITS = /^\d+$/;
+/**
+ * The workflow's index and channel, checked before anything is read. One of them must be given:
+ * a job that lost its index reads no repository rather than every one.
+ */
+function selection(wanted) {
+    const { index, channel } = wanted;
+    if (index === undefined && channel === undefined) {
+        throw new CentralError('neither an index nor a channel selects a repository');
+    }
+    if (index !== undefined && !DIGITS.test(index))
+        throw new CentralError('the index is no number');
+    const named = CHANNELS.find((known) => known === channel);
+    if (channel !== undefined && named === undefined)
+        throw new CentralError('no such channel');
+    return { index: index === undefined ? undefined : Number(index), channel: named };
+}
+/** The channel a repository's `talos` property names, if it names one. */
+function channelOf(row) {
+    const value = row.properties.talos;
+    return CHANNELS.find((known) => known === value);
+}
+/** The governed repositories the selection names, in id order. */
+function chosen(rows, wanted) {
+    const governed = rows
+        .filter((row) => {
+        const channel = channelOf(row);
+        return channel !== undefined && (wanted.channel ?? channel) === channel;
+    })
+        .sort((a, b) => a.id - b.id);
+    return wanted.index === undefined ? governed : governed.slice(wanted.index, wanted.index + 1);
+}
+/** A repository's names, refused unless both halves of its `owner/name` are plain names. */
+function namesOf(row) {
+    const [owner = '', name = '', ...rest] = row.fullName.split('/');
+    if (rest.length > 0 || !NAME_PART.test(owner) || !NAME_PART.test(name)) {
+        throw new CentralError('the listing holds a name GitHub does not give a repository');
+    }
+    return { fullName: row.fullName, name };
+}
+/**
+ * Masks the full and bare name of each repository the job reads, then hands the bare names on,
+ * comma-separated (`names`, empty when there are none). Counts only come back.
+ */
+export async function pickRepositories(deps) {
+    const wanted = selection(deps);
+    const rows = chosen(await listPropertyValues(deps.properties, deps.org), wanted);
+    const picked = rows.map((row) => namesOf(row));
+    if (picked.length > 0)
+        deps.out(maskCommands(picked));
+    await deps.output('names', picked.map((repo) => repo.name).join(','));
+    return { repositories: picked.length };
+}
+//# sourceMappingURL=pick.js.map

package/dist/central/pick.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pick.js","sourceRoot":"","sources":["../../src/central/pick.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAgB,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,YAAY,EAAoB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAoB,MAAM,oBAAoB,CAAC;AAE1E;;;;;;GAMG;AAEH,+FAA+F;AAC/F,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,MAAM,MAAM,GAAG,OAAO,CAAC;AAOvB;;;GAGG;AACH,SAAS,SAAS,CAAC,MAAc;IAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,IAAI,YAAY,CAAC,qDAAqD,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,wBAAwB,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC5F,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,GAAgB;IACjC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,kEAAkE;AAClE,SAAS,MAAM,CAAC,IAA4B,EAAE,MAAiB;IAC7D,MAAM,QAAQ,GAAG,IAAI;SAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,OAAO,CAAC;IAC1E,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,4FAA4F;AAC5F,SAAS,OAAO,CAAC,GAAgB;IAC/B,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,YAAY,CAAC,4DAA4D,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAYD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAc;IACnD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACjF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AACzC,CAAC"}

package/dist/central/privacy.js

@@ -0,0 +1,158 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { literalMatches } from '../core/literal.js';
+import { GitHubError } from '../github/api.js';
+import { listInstallationRepositories, listPropertyValues } from '../github/repos.js';
+/**
+ * The repositories to look for: every one but the current. A public repository's bare name is no
+ * secret (and `Talos` is all over its own logs), so only a private one's is watched.
+ */
+export function watchedNames(repos, current) {
+    const seen = new Set([current.toLowerCase()]);
+    const watched = [];
+    for (const repo of repos) {
+        const key = repo.fullName.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        const name = repo.fullName.split('/').at(-1);
+        watched.push({ fullName: repo.fullName, name: repo.private && name !== '' ? name : undefined });
+    }
+    return watched;
+}
+/** `::add-mask::` commands for every watched name, full names first. */
+export function maskCommands(watched) {
+    const names = [
+        ...watched.map((repo) => repo.fullName),
+        ...watched.flatMap((repo) => (repo.name === undefined ? [] : [repo.name])),
+    ];
+    return names.map((name) => `::add-mask::${name}\n`).join('');
+}
+/** A bare name on its own: no word character, `.` or `-` against it, but a full stop after it. */
+const BARE_NAME = { start: /(?<![\w.-])/y, end: /(?![\w-]|\.[\w-])/y };
+/**
+ * How many watched repositories a log names: by full name anywhere, or by bare name as a whole
+ * word (a sentence's full stop may follow it), regardless of case.
+ */
+export function leaksIn(log, watched) {
+    const text = log.toLowerCase();
+    const named = (repo) => {
+        if (text.includes(repo.fullName.toLowerCase()))
+            return true;
+        if (repo.name === undefined)
+            return false;
+        return literalMatches(text, repo.name.toLowerCase(), BARE_NAME).length > 0;
+    };
+    return watched.filter(named).length;
+}
+/** The SHA-256 of a repository's lower-cased `owner/name`, as the canary's variable holds it. */
+export function nameDigest(fullName) {
+    return createHash('sha256').update(fullName.toLowerCase()).digest('hex');
+}
+/** The private watched repository whose name has the canary's digest. */
+function canaryIn(watched, digest) {
+    return watched.find((repo) => repo.name !== undefined && nameDigest(repo.fullName) === digest);
+}
+/**
+ * Whether the scratch canary is among the watched repositories. Its name is known only by its
+ * digest: the name itself in a workflow expression would print it.
+ */
+export function canaryWatched(watched, digest) {
+    return canaryIn(watched, digest) !== undefined;
+}
+/**
+ * Every repository of `org`, the private ones marked, from two listings of its custom property
+ * values: all of them, then those the search `is:private` finds.
+ */
+export async function organisationRepositories(gh, org) {
+    const [all, hidden] = await Promise.all([
+        listPropertyValues(gh, org),
+        listPropertyValues(gh, org, 'is:private'),
+    ]);
+    const secret = new Set(hidden.map((repo) => repo.id));
+    const listed = new Map(all.map((repo) => [repo.id, repo.fullName]));
+    for (const repo of hidden)
+        listed.set(repo.id, repo.fullName);
+    return [...listed].map(([id, fullName]) => ({ fullName, private: secret.has(id) }));
+}
+async function maskAll(names) {
+    const repos = await organisationRepositories(names.properties, names.org);
+    const watched = watchedNames(repos, names.current);
+    names.out(maskCommands(watched));
+    return watched;
+}
+/**
+ * The privacy job's first step: masks every name, then hands the canary's bare name, masked by
+ * now, to the steps that mint each App's token for the canary alone.
+ */
+export async function maskNames(deps) {
+    const watched = await maskAll(deps);
+    if (deps.canary === undefined)
+        return { names: watched.length, canary: null };
+    const found = canaryIn(watched, deps.canary);
+    if (found?.name !== undefined)
+        await deps.output('name', found.name);
+    return { names: watched.length, canary: found !== undefined };
+}
+const jobsSchema = z.array(z.object({
+    id: z.number().int(),
+    name: z.string(),
+    status: z.string(),
+    conclusion: z.string().nullable(),
+}));
+/** Whether a token reaches the canary and nothing else. */
+async function reachesOnly(gh, digest) {
+    const [only, ...rest] = await listInstallationRepositories(gh);
+    return only !== undefined && rest.length === 0 && nameDigest(only.fullName) === digest;
+}
+/**
+ * Whether the canary was watched, and each App's token minted for it reaches it alone: a clean
+ * search then covered a private name that every App of the run could print.
+ */
+async function canaryProven(deps, watched) {
+    const digest = deps.canary;
+    if (digest === undefined)
+        return null;
+    if (!canaryWatched(watched, digest) || deps.apps.length === 0)
+        return false;
+    const reached = await Promise.all(deps.apps.map((gh) => reachesOnly(gh, digest)));
+    return reached.every(Boolean);
+}
+const LOG_TRIES = 4;
+const LOG_WAIT_MS = 5000;
+function sleep(ms) {
+    return new Promise((done) => setTimeout(done, ms));
+}
+/** A finished job's log, which GitHub may store a few seconds after the job ends. */
+async function jobLog(deps, jobId) {
+    const path = `repos/${deps.run.repo}/actions/jobs/${jobId}/logs`;
+    for (let attempt = 1;; attempt += 1) {
+        try {
+            return new TextDecoder().decode(await deps.download(path));
+        }
+        catch (error) {
+            const missing = error instanceof GitHubError && error.status === 404;
+            if (!missing || attempt >= LOG_TRIES)
+                throw error;
+            await (deps.wait ?? sleep)(LOG_WAIT_MS * attempt);
+        }
+    }
+}
+/** Masks every name, then searches every finished job of this run attempt. */
+export async function runPrivacy(deps) {
+    const watched = await maskAll({ ...deps, current: deps.run.repo });
+    const { repo, id, attempt, self } = deps.run;
+    const listed = jobsSchema.parse(await deps.actions.paginate(`repos/${repo}/actions/runs/${id}/attempts/${attempt}/jobs`, 'jobs'));
+    // A skipped job has no log; this job's own is still being written.
+    const done = listed.filter((job) => job.status === 'completed' && job.conclusion !== 'skipped' && job.name !== self);
+    let leaks = 0;
+    for (const job of done)
+        leaks += leaksIn(await jobLog(deps, job.id), watched);
+    return {
+        names: watched.length,
+        jobs: done.length,
+        leaks,
+        canary: await canaryProven(deps, watched),
+    };
+}
+//# sourceMappingURL=privacy.js.map

package/dist/central/privacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.js","sourceRoot":"","sources":["../../src/central/privacy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAe,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,EAAE,4BAA4B,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAgBtF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,OAAe;IACpE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAAC,OAA+B;IAC1D,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QACvC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3E,CAAC;IACF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,kGAAkG;AAClG,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,oBAAoB,EAAE,CAAC;AAEvE;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,GAAW,EAAE,OAA+B;IAClE,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,CAAC,IAAiB,EAAW,EAAE;QAC3C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1C,OAAO,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;AACtC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,yEAAyE;AACzE,SAAS,QAAQ,CAAC,OAA+B,EAAE,MAAc;IAC/D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAA+B,EAAE,MAAc;IAC3E,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,SAAS,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAU,EAAE,GAAW;IACpE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACtC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC;QAC3B,kBAAkB,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC;KAC1C,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,IAAI,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC;AAeD,KAAK,UAAU,OAAO,CAAC,KAAmB;IACxC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjC,OAAO,OAAO,CAAC;AACjB,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAc;IAC5C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,EAAE,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;IACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CACH,CAAC;AA2BF,2DAA2D;AAC3D,KAAK,UAAU,WAAW,CAAC,EAAU,EAAE,MAAc;IACnD,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,IAAiB,EACjB,OAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,MAAM,CAAC,IAAiB,EAAE,KAAa;IACpD,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,KAAK,OAAO,CAAC;IACjE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC;YACH,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC;YACrE,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,SAAS;gBAAE,MAAM,KAAK,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAiB;IAChD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CACzB,SAAS,IAAI,iBAAiB,EAAE,aAAa,OAAO,OAAO,EAC3D,MAAM,CACP,CACF,CAAC;IACF,mEAAmE;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACxB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CACzF,CAAC;IACF,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,KAAK,IAAI,OAAO,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;IAC9E,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM;QACrB,IAAI,EAAE,IAAI,CAAC,MAAM;QACjB,KAAK;QACL,MAAM,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/central/releases.js

@@ -0,0 +1,130 @@
+import { z } from 'zod';
+import { REGRESSION_LABEL, regressionOf, releasesOf, } from './channels.js';
+import { parseIssues } from '../ticket/schemas.js';
+/**
+ * What the Talos repository says about its releases: its tags, whether each is on `main`, and
+ * its `regression` issues. Talos is public, so the workflow's own token reads all of it.
+ */
+const commitTarget = z.object({
+    __typename: z.literal('Commit'),
+    oid: z.string(),
+    committedDate: z.string(),
+});
+const tagTarget = z.object({
+    __typename: z.literal('Tag'),
+    tagger: z.object({ date: z.string().nullable() }).nullable(),
+    target: z.object({ oid: z.string(), committedDate: z.string() }),
+});
+const otherTarget = z.object({ __typename: z.string(), oid: z.string() });
+const tagsPage = z.object({
+    repository: z.object({
+        refs: z.object({
+            pageInfo: z.object({ hasNextPage: z.boolean(), endCursor: z.string().nullable() }),
+            nodes: z.array(z.object({ name: z.string(), target: z.union([commitTarget, tagTarget, otherTarget]) })),
+        }),
+    }),
+});
+const TAGS_QUERY = `
+query TalosTags($owner: String!, $name: String!, $after: String) {
+  repository(owner: $owner, name: $name) {
+    refs(refPrefix: "refs/tags/", first: 100, after: $after,
+         orderBy: { field: TAG_COMMIT_DATE, direction: DESC }) {
+      pageInfo { hasNextPage endCursor }
+      nodes {
+        name
+        target {
+          __typename
+          oid
+          ... on Commit { committedDate }
+          ... on Tag { tagger { date } target { oid ... on Commit { committedDate } } }
+        }
+      }
+    }
+  }
+}`;
+const TAG_PAGES = 3;
+/** A tag's commit and when it was made; a tag of anything but a commit is no release. */
+export function tagOf(node) {
+    const parsedCommit = commitTarget.safeParse(node.target);
+    if (parsedCommit.success) {
+        const { oid, committedDate } = parsedCommit.data;
+        return { name: node.name, sha: oid, taggedAt: committedDate };
+    }
+    const parsedTag = tagTarget.safeParse(node.target);
+    if (!parsedTag.success)
+        return undefined;
+    const { tagger, target } = parsedTag.data;
+    return { name: node.name, sha: target.oid, taggedAt: tagger?.date ?? target.committedDate };
+}
+function ownerAndName(repo) {
+    const [owner = '', name = ''] = repo.split('/');
+    return { owner, name };
+}
+/** The repository's releases, newest version first. */
+export async function readReleases(gh, repo) {
+    const tags = [];
+    let after = null;
+    for (let page = 0; page < TAG_PAGES; page += 1) {
+        const data = tagsPage.parse(await gh.graphql(TAGS_QUERY, { ...ownerAndName(repo), after }));
+        const { nodes, pageInfo } = data.repository.refs;
+        tags.push(...nodes.flatMap((node) => tagOf(node) ?? []));
+        if (!pageInfo.hasNextPage)
+            break;
+        after = pageInfo.endCursor;
+    }
+    return releasesOf(tags);
+}
+const compareSchema = z.object({ status: z.string() });
+/** Whether `sha` is in `branch`'s history: comparing it with the branch finds the branch ahead. */
+export async function isAncestor(gh, repo, sha, branch) {
+    const raw = await gh.request('GET', `repos/${repo}/compare/${sha}...${encodeURIComponent(branch)}`);
+    const { status } = compareSchema.parse(raw);
+    return status === 'ahead' || status === 'identical';
+}
+const CANDIDATES = 10;
+/**
+ * The newest releases whose commit is on `branch`, newest first. Rollback goes back one release
+ * at a time, so the newest few are all a decision ever needs.
+ */
+export async function releasesOnBranch(gh, repo, releases, branch) {
+    const candidates = releases.slice(0, CANDIDATES);
+    const onBranch = await Promise.all(candidates.map((r) => isAncestor(gh, repo, r.sha, branch)));
+    return candidates.filter((_release, index) => onBranch[index] === true);
+}
+const eventSchema = z.object({
+    event: z.string(),
+    label: z.object({ name: z.string() }).nullable().optional(),
+    actor: z.object({ login: z.string() }).nullable().optional(),
+    created_at: z.string(),
+});
+/** Who put which label on an issue, and when. */
+export function labelledEvents(raw) {
+    return z
+        .array(eventSchema)
+        .parse(raw)
+        .flatMap((event) => event.event === 'labeled' && event.label != null
+        ? [{ label: event.label.name, actor: event.actor?.login, at: event.created_at }]
+        : []);
+}
+const MAX_REGRESSIONS = 50;
+/** The repository's `regression` issues, open or closed, that a trusted actor raised. */
+export async function readRegressions(gh, repo, trusted) {
+    const raw = await gh.paginate(`repos/${repo}/issues?state=all&labels=${encodeURIComponent(REGRESSION_LABEL)}`);
+    const issues = parseIssues(raw)
+        .filter((issue) => !issue.isPull)
+        .slice(0, MAX_REGRESSIONS);
+    const regressions = await Promise.all(issues.map(async (issue) => {
+        const events = await gh.paginate(`repos/${repo}/issues/${issue.number}/events`);
+        return regressionOf({
+            number: issue.number,
+            author: issue.author,
+            open: issue.state === 'open',
+            stateReason: issue.stateReason,
+            labels: issue.labels,
+            createdAt: issue.createdAt,
+            labelled: labelledEvents(events),
+        }, trusted);
+    }));
+    return regressions.filter((r) => r !== undefined);
+}
+//# sourceMappingURL=releases.js.map

package/dist/central/releases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"releases.js","sourceRoot":"","sources":["../../src/central/releases.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAGhB,YAAY,EAEZ,UAAU,GACX,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD;;;GAGG;AAEH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;CAC1B,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACjE,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACb,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;YAClF,KAAK,EAAE,CAAC,CAAC,KAAK,CACZ,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CACxF;SACF,CAAC;KACH,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;EAiBjB,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,CAAC;AAIpB,yFAAyF;AACzF,MAAM,UAAU,KAAK,CAAC,IAAU;IAC9B,MAAM,YAAY,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAU,EAAE,IAAY;IACzD,MAAM,IAAI,GAAsD,EAAE,CAAC;IACnE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CACzB,MAAM,EAAE,CAAC,OAAO,CAAU,UAAU,EAAE,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CACxE,CAAC;QACF,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,WAAW;YAAE,MAAM;QACjC,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC;IAC7B,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEvD,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,IAAY,EACZ,GAAW,EACX,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAC1B,KAAK,EACL,SAAS,IAAI,YAAY,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAC/D,CAAC;IACF,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,WAAW,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,EAAU,EACV,IAAY,EACZ,QAA4B,EAC5B,MAAc;IAEd,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/F,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,CAAC;SACL,KAAK,CAAC,WAAW,CAAC;SAClB,KAAK,CAAC,GAAG,CAAC;SACV,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;QAC9C,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAChF,CAAC,CAAC,EAAE,CACP,CAAC;AACN,CAAC;AAED,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,IAAY,EACZ,OAA0B;IAE1B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,SAAS,IAAI,4BAA4B,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAChF,CAAC;IACF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;SAChC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC7B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CACnC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAU,SAAS,IAAI,WAAW,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;QACzF,OAAO,YAAY,CACjB;YACE,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,KAAK,KAAK,MAAM;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC;SACjC,EACD,OAAO,CACR,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACrE,CAAC"}

package/dist/central/repos.js

@@ -0,0 +1,36 @@
+import { sameLogin } from '../github/identities.js';
+import { listInstallationRepositories, propertyOf } from '../github/repos.js';
+import { parseIssues } from '../ticket/schemas.js';
+/**
+ * Each central matrix job mints a token limited to the one repository its index names, so the
+ * repository is learnt from the token itself and its name never passes through the workflow.
+ */
+export class CentralError extends Error {
+    name = 'CentralError';
+}
+const CHANNEL_VALUES = new Set(['evaluate', 'canary', 'stable']);
+/** The one repository a scoped installation token reaches. */
+export async function soleRepository(gh) {
+    const repos = await listInstallationRepositories(gh);
+    const [only] = repos;
+    if (repos.length !== 1 || only === undefined) {
+        throw new CentralError(`the token reaches ${repos.length} repositories, not one`);
+    }
+    return only;
+}
+/** A repository Talos governs: not archived, its `talos` property naming a channel. */
+export function isGoverned(repo) {
+    return !repo.archived && CHANNEL_VALUES.has(propertyOf(repo, 'talos') ?? '');
+}
+/** Open issues with `label` that Talos's reviewer App filed. */
+export async function openTalosIssues(gh, at, label) {
+    const raw = await gh.paginate(`repos/${at.repo}/issues?state=open&labels=${encodeURIComponent(label)}`);
+    return parseIssues(raw).filter((issue) => !issue.isPull && sameLogin(issue.author, at.who.reviewer));
+}
+/** Closes an issue Talos filed, as done: what it reported is gone. */
+export async function closeIssue(gh, repo, number) {
+    await gh.request('PATCH', `repos/${repo}/issues/${number}`, {
+        body: { state: 'closed', state_reason: 'completed' },
+    });
+}
+//# sourceMappingURL=repos.js.map

package/dist/central/repos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repos.js","sourceRoot":"","sources":["../../src/central/repos.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAmB,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAc,MAAM,sBAAsB,CAAC;AAE/D;;;GAGG;AACH,MAAM,OAAO,YAAa,SAAQ,KAAK;IACnB,IAAI,GAAG,cAAc,CAAC;CACzC;AAED,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEtF,8DAA8D;AAC9D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,KAAK,GAAG,MAAM,4BAA4B,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,qBAAqB,KAAK,CAAC,MAAM,wBAAwB,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAU,EACV,EAAuD,EACvD,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAC3B,SAAS,EAAE,CAAC,IAAI,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CACzE,CAAC;IACF,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAC5B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,MAAc;IACvE,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,WAAW,MAAM,EAAE,EAAE;QAC1D,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE;KACrD,CAAC,CAAC;AACL,CAAC"}

package/dist/central/runtime-port.js

@@ -0,0 +1,49 @@
+import { alertOf } from './sweep.js';
+import { runtimeFindings } from '../checks/runtime/check.js';
+import { isDeclaringFile } from '../checks/runtime/declarations.js';
+import { defaultFetcher } from '../checks/runtime/fetchers.js';
+import { parseConfig } from '../config/load.js';
+import { repoFacts } from '../repo/facts.js';
+const FALLBACK_CONFIG = 'name: sweep\nprefix: S\n';
+function configOf(text) {
+    if (text !== undefined) {
+        try {
+            return parseConfig(text);
+        }
+        catch {
+            // An invalid talos.yml fails the repository's own gate; the sweep still checks runtimes.
+        }
+    }
+    return parseConfig(FALLBACK_CONFIG);
+}
+function utcToday() {
+    return new Date().toISOString().slice(0, 10);
+}
+/**
+ * The runtime check as an assessor. A feed that can't be read fails the whole repository's
+ * assessment, counted as one error and never as a pass; its message, which may name a file, is
+ * dropped, since the sweep's log is public.
+ */
+export function runtimeAssessor(options = {}) {
+    return async (files) => {
+        const config = configOf(files.get('talos.yml'));
+        const declaring = new Map(repoFacts([...files.keys()], config.exclude)
+            .files.filter((path) => isDeclaringFile(path))
+            .flatMap((path) => {
+            const text = files.get(path);
+            return text === undefined ? [] : [[path, text]];
+        }));
+        try {
+            const findings = await runtimeFindings(declaring, {
+                fetcher: options.fetcher ?? defaultFetcher(),
+                today: (options.today ?? utcToday)(),
+                exceptions: config.supply_chain.exceptions,
+            });
+            return { alerts: findings.flatMap((f) => alertOf(f) ?? []), errors: 0 };
+        }
+        catch {
+            return { alerts: [], errors: 1 };
+        }
+    };
+}
+//# sourceMappingURL=runtime-port.js.map

package/dist/central/runtime-port.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-port.js","sourceRoot":"","sources":["../../src/central/runtime-port.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAqB,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAgB,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAa7C,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,QAAQ,CAAC,IAAwB;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;QAC3F,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC,eAAe,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAA2B,EAAE;IAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CACvB,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC;aACzC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;aAC7C,OAAO,CAAC,CAAC,IAAI,EAAsB,EAAE;YACpC,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CACL,CAAC;QACF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE;gBAChD,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE;gBAC5C,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE;gBACpC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,UAAU;aAC3C,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}