@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/infra/powershell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"powershell.js","sourceRoot":"","sources":["../../../src/checks/infra/powershell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKlD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO;QACL,IAAI;QACJ,iEAAiE;QACjE,+BAA+B;QAC/B,cAAc;QACd,kDAAkD;QAClD,8DAA8D;QAC9D,yEAAyE;QACzE,4FAA4F;QAC5F,qCAAqC;QACrC,sBAAsB;QACtB,2BAA2B;QAC3B,sBAAsB;QACtB,mEAAmE;QACnE,OAAO;QACP,qDAAqD;QACrD,8CAA8C;QAC9C,KAAK;QACL,GAAG;QACH,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;CAuB7B,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC1B,CAAC,CAAC,iFAAiF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;QAClG,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,oBAAoB,CAAC,CAAC,IAAI,EAAE;YAClC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5B,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;aACnD;YACD,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAiB,EAAE,IAAuB;IAC5D,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;YAClC,GAAG,EAAE,GAAG,CAAC,IAAI;YACb,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,2BAA2B,EAAE,GAAG,EAAE,sBAAsB,EAAE,KAAK,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,uDAAuD,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAiB;IAChD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACxD,MAAM,EAAE,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7D,MAAM,SAAS,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IACrD,MAAM,SAAS,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/checks/infra/report.js

@@ -0,0 +1,46 @@
+import { EngineError } from '../../core/check.js';
+const BOM = String.fromCodePoint(0xfeff);
+function trimTrailing(text, characters) {
+    let end = text.length;
+    while (end > 0 && characters.includes(text.charAt(end - 1)))
+        end -= 1;
+    return text.slice(0, end);
+}
+/** Where a line's first sentence ends: a stop before a space, not the end of an ellipsis. */
+function firstStop(line) {
+    for (let index = 0; index < line.length - 1; index += 1) {
+        const char = line.charAt(index);
+        const ellipsis = char === '.' && line.charAt(index - 1) === '.';
+        if ('.!?'.includes(char) && /\s/.test(line.charAt(index + 1)) && !ellipsis)
+            return index;
+    }
+    return -1;
+}
+/** A tool's message as one sentence: its first, capitalised, ending with a full stop. */
+export function sentence(text) {
+    const line = (text.trim().split('\n')[0] ?? '').trim();
+    const end = firstStop(line);
+    const first = trimTrailing(end === -1 ? line : line.slice(0, end + 1), ' \t:;,');
+    const capital = first.charAt(0).toUpperCase() + first.slice(1);
+    return /[.!?]$/.test(capital) ? capital : `${capital}.`;
+}
+/** Text a tool printed as JSON; anything else is an engine error. */
+export function parseJson(text, what) {
+    try {
+        const value = JSON.parse(text.startsWith(BOM) ? text.slice(1) : text);
+        return value;
+    }
+    catch {
+        const shown = text.trim().slice(0, 200);
+        const detail = shown === '' ? '' : `: ${shown}`;
+        throw new EngineError(`${what} printed no readable JSON${detail}`);
+    }
+}
+/** An engine error for a tool that failed, ending with the last of what it printed. */
+export function toolFailed(what, result) {
+    const printed = result.stderr.trim() === '' ? result.stdout : result.stderr;
+    const last = printed.trim().split('\n').slice(-10).join('\n');
+    const detail = last === '' ? '' : `:\n${last}`;
+    return new EngineError(`${what} exited ${result.code}${detail}`);
+}
+//# sourceMappingURL=report.js.map

package/dist/checks/infra/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../src/checks/infra/report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;AAEzC,SAAS,YAAY,CAAC,IAAY,EAAE,UAAkB;IACpD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,OAAO,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,IAAY;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;IAC3F,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC;AAC1D,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,4BAA4B,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,MAAkB;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/checks/infra/shell.js

@@ -0,0 +1,64 @@
+import { z } from 'zod';
+import { batches, shellScripts } from './files.js';
+import { parseJson, sentence, toolFailed } from './report.js';
+import { EngineError } from '../../core/check.js';
+/** Every optional check but braces around every variable, which the scripts' style leaves out. */
+export const SHELLCHECK_ENABLE = 'all';
+export const SHELLCHECK_DISABLE = 'SC2250';
+/**
+ * The gate passes every setting itself and reads no `.shellcheckrc`, so only a directive in
+ * a script, which counts as a suppression, can turn a rule off.
+ */
+const SHELLCHECK_ARGS = [
+    '--norc',
+    '--format=json1',
+    `--enable=${SHELLCHECK_ENABLE}`,
+    `--exclude=${SHELLCHECK_DISABLE}`,
+    '--severity=style',
+    '--external-sources',
+    '--source-path=SCRIPTDIR',
+];
+const comment = z.object({
+    file: z.string(),
+    line: z.number().int(),
+    endLine: z.number().int(),
+    column: z.number().int(),
+    code: z.number().int(),
+    message: z.string(),
+});
+const output = z.object({ comments: z.array(comment) });
+/** shellcheck's `json1` output as findings. */
+export function parseShellcheck(stdout) {
+    const parsed = output.safeParse(parseJson(stdout, 'shellcheck'));
+    if (!parsed.success)
+        throw new EngineError('shellcheck printed JSON Talos cannot read');
+    return parsed.data.comments.map((c) => ({
+        rule: `shellcheck/SC${c.code}`,
+        message: sentence(c.message),
+        location: {
+            file: c.file,
+            line: c.line,
+            endLine: Math.max(c.line, c.endLine),
+            column: c.column,
+        },
+        docs: `https://www.shellcheck.net/wiki/SC${c.code}`,
+    }));
+}
+/** shellcheck over every shell script: named `.sh` or `.bash`, or with a shell's shebang. */
+export async function shell(ctx) {
+    const scripts = await shellScripts(ctx.root, ctx.facts.files);
+    if (scripts.length === 0)
+        return [];
+    const shellcheck = await ctx.tools.path('shellcheck');
+    const findings = [];
+    for (const batch of batches(scripts)) {
+        const result = await ctx.exec(shellcheck, [...SHELLCHECK_ARGS, '--', ...batch], {
+            cwd: ctx.root,
+        });
+        if (result.code > 1)
+            throw toolFailed('shellcheck', result);
+        findings.push(...parseShellcheck(result.stdout));
+    }
+    return findings;
+}
+//# sourceMappingURL=shell.js.map

package/dist/checks/infra/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["../../../src/checks/infra/shell.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AAE3C;;;GAGG;AACH,MAAM,eAAe,GAAG;IACtB,QAAQ;IACR,gBAAgB;IAChB,YAAY,iBAAiB,EAAE;IAC/B,aAAa,kBAAkB,EAAE;IACjC,kBAAkB;IAClB,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAExD,+CAA+C;AAC/C,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,2CAA2C,CAAC,CAAC;IACxF,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,EAAE;QAC9B,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5B,QAAQ,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB;QACD,IAAI,EAAE,qCAAqC,CAAC,CAAC,IAAI,EAAE;KACpD,CAAC,CAAC,CAAC;AACN,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,GAAiB;IAC3C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,EAAE;YAC9E,GAAG,EAAE,GAAG,CAAC,IAAI;SACd,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5D,QAAQ,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/checks/infra/zizmor.js

@@ -0,0 +1,93 @@
+import { writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { parseJson, sentence, toolFailed } from './report.js';
+import { EngineError } from '../../core/check.js';
+/**
+ * zizmor's settings for the gate, which replace any `zizmor.yml` in the repository. Dependabot
+ * waits one day before proposing a release, the minimum age for any dependency across
+ * SVP-Labs, where zizmor's default asks for seven.
+ */
+export const ZIZMOR_CONFIG = [
+    'rules:',
+    '  dependabot-cooldown:',
+    '    config:',
+    '      days: 1',
+    '',
+].join('\n');
+/**
+ * Pedantic, offline (the online audits need a GitHub token, which a job running repository
+ * code never holds), and exiting 0 whatever it finds, so any other exit is a failure.
+ */
+function zizmorArgs(config) {
+    return [
+        '--persona',
+        'pedantic',
+        '--format',
+        'json',
+        '--offline',
+        '--config',
+        config,
+        '--no-progress',
+        '--no-exit-codes',
+        '--color',
+        'never',
+    ];
+}
+const point = z.object({ row: z.number().int(), column: z.number().int() });
+const location = z.object({
+    symbolic: z.object({
+        key: z.object({ Local: z.object({ verbatim_path: z.string() }).optional() }),
+        annotation: z.string(),
+        kind: z.string(),
+    }),
+    concrete: z.object({ location: z.object({ start_point: point, end_point: point }) }),
+});
+const result = z.object({
+    ident: z.string(),
+    desc: z.string(),
+    url: z.string(),
+    locations: z.array(location),
+    ignored: z.boolean().default(false),
+});
+/** Rows are 0-based and the end is exclusive: a span ending at column 0 ends on the row before. */
+function toLocation(at) {
+    const file = at.symbolic.key.Local?.verbatim_path;
+    if (file === undefined)
+        return undefined;
+    const { start_point: start, end_point: end } = at.concrete.location;
+    const line = start.row + 1;
+    const last = end.column === 0 && end.row > start.row ? end.row : end.row + 1;
+    return { file, line, column: start.column + 1, ...(last > line ? { endLine: last } : {}) };
+}
+function toFinding(r) {
+    const primary = r.locations.find((l) => l.symbolic.kind === 'Primary') ?? r.locations[0];
+    const where = primary === undefined ? undefined : toLocation(primary);
+    const detail = primary === undefined ? '' : `: ${primary.symbolic.annotation}`;
+    return {
+        rule: `zizmor/${r.ident}`,
+        message: sentence(`${r.desc}${detail}`),
+        ...(where === undefined ? { key: r.ident } : { location: where }),
+        docs: r.url,
+    };
+}
+/** zizmor's JSON output as findings; findings an ignore comment covers are left out. */
+export function parseZizmor(stdout) {
+    const parsed = z.array(result).safeParse(parseJson(stdout, 'zizmor'));
+    if (!parsed.success)
+        throw new EngineError('zizmor printed JSON Talos cannot read');
+    return parsed.data.filter((r) => !r.ignored).map(toFinding);
+}
+/** zizmor over the workflows, the action definitions and Dependabot's config. */
+export async function zizmor(ctx, inputs) {
+    if (inputs.length === 0)
+        return [];
+    const tool = await ctx.tools.path('zizmor');
+    const config = join(ctx.scratch, 'zizmor.yml');
+    await writeFile(config, ZIZMOR_CONFIG);
+    const run = await ctx.exec(tool, [...zizmorArgs(config), '--', ...inputs], { cwd: ctx.root });
+    if (run.code !== 0)
+        throw toolFailed('zizmor', run);
+    return parseZizmor(run.stdout);
+}
+//# sourceMappingURL=zizmor.js.map

package/dist/checks/infra/zizmor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zizmor.js","sourceRoot":"","sources":["../../../src/checks/infra/zizmor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAIlD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,QAAQ;IACR,wBAAwB;IACxB,aAAa;IACb,eAAe;IACf,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,MAAM;QACN,WAAW;QACX,UAAU;QACV,MAAM;QACN,eAAe;QACf,iBAAiB;QACjB,SAAS;QACT,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAE5E,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;KACjB,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;CACrF,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC;AAIH,mGAAmG;AACnG,SAAS,UAAU,CAAC,EAAkB;IACpC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,SAAS,CAAC,CAAyB;IAC1C,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;IAC/E,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjE,IAAI,EAAE,CAAC,CAAC,GAAG;KACZ,CAAC;AACJ,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,uCAAuC,CAAC,CAAC;IACpF,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC9D,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAiB,EAAE,MAAyB;IACvE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC/C,MAAM,SAAS,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9F,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC"}

package/dist/checks/process/commits.js

@@ -0,0 +1,74 @@
+import { avoidedWords } from '../../docs/glossary.js';
+const MAX_SUBJECT = 72;
+const DEPENDABOT = /^\d+\+dependabot\[bot\]@users\.noreply\.github\.com$|^support@dependabot\.com$/;
+function isDependabot(commit) {
+    return commit.dependabotVouched && DEPENDABOT.test(commit.authorEmail);
+}
+/** The number `rest` reads where `text` goes on after starting with `lead`. */
+function numberAfter(text, lead, rest) {
+    const digits = text.startsWith(lead) ? rest.exec(text.slice(lead.length))?.[1] : undefined;
+    return digits === undefined ? undefined : Number(digits);
+}
+/**
+ * A merge commit, which no governed repository lands: `main` takes rebased commits through the
+ * merge queue, and a merge's change against its first parent carries whatever it merged in, so
+ * the commit is reported once and judged no further.
+ */
+export function mergeFinding(sha) {
+    return {
+        rule: 'commit/merge',
+        key: `${sha}:merge`,
+        policy: 'always',
+        message: `${sha.slice(0, 12)}: a merge commit; rebase instead of merging, since main takes no merges`,
+    };
+}
+/** The ticket a branch names, when it is a ticket branch `<P>-<N>`. */
+export function ticketOf(branch, prefix) {
+    return branch === undefined ? undefined : numberAfter(branch, `${prefix}-`, /^(\d+)$/);
+}
+/**
+ * The commit subject: `[<P>-<N>]: what changed`, at most 72 characters, with the
+ * branch's own ticket on a ticket branch, and no word the glossary says to avoid. Dependabot's
+ * commits are exempt from the ticket rules, by its account.
+ */
+export function subjectFindings(commit, prefix, ticket, glossary) {
+    const findings = [];
+    const key = `${commit.sha}:${commit.subject}`;
+    if (!isDependabot(commit)) {
+        const number = numberAfter(commit.subject, `[${prefix}-`, /^(\d+)\]: \S/);
+        if (number === undefined) {
+            findings.push({
+                rule: 'commit/subject',
+                key,
+                policy: 'always',
+                message: `${commit.sha.slice(0, 12)}: the subject must read "[${prefix}-<issue>]: what changed", not "${commit.subject}"`,
+            });
+        }
+        else if (ticket !== undefined && number !== ticket) {
+            findings.push({
+                rule: 'commit/ticket',
+                key,
+                policy: 'always',
+                message: `${commit.sha.slice(0, 12)}: on branch ${prefix}-${ticket} every subject starts [${prefix}-${ticket}]:`,
+            });
+        }
+    }
+    if (commit.subject.length > MAX_SUBJECT) {
+        findings.push({
+            rule: 'commit/length',
+            key,
+            policy: 'always',
+            message: `${commit.sha.slice(0, 12)}: the subject is ${commit.subject.length} characters; at most ${MAX_SUBJECT}`,
+        });
+    }
+    for (const hit of avoidedWords(glossary, commit.subject)) {
+        findings.push({
+            rule: 'glossary/avoid',
+            key: `${key}:${hit.word}`,
+            policy: 'always',
+            message: `${commit.sha.slice(0, 12)}: the subject says "${hit.word}"; the glossary's term is "${hit.instead}"`,
+        });
+    }
+    return findings;
+}
+//# sourceMappingURL=commits.js.map

package/dist/checks/process/commits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commits.js","sourceRoot":"","sources":["../../../src/checks/process/commits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAsB,MAAM,wBAAwB,CAAC;AAc1E,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,UAAU,GAAG,gFAAgF,CAAC;AAEpG,SAAS,YAAY,CAAC,MAAmB;IACvC,OAAO,MAAM,CAAC,iBAAiB,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,GAAG,EAAE,GAAG,GAAG,QAAQ;QACnB,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,yEAAyE;KACtG,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,QAAQ,CAAC,MAA0B,EAAE,MAAc;IACjE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,MAAM,GAAG,EAAE,SAAS,CAAC,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,MAAc,EACd,MAA0B,EAC1B,QAAkC;IAElC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,MAAM,GAAG,EAAE,cAAc,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,gBAAgB;gBACtB,GAAG;gBACH,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,6BAA6B,MAAM,kCAAkC,MAAM,CAAC,OAAO,GAAG;aAC1H,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,eAAe;gBACrB,GAAG;gBACH,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,MAAM,IAAI,MAAM,0BAA0B,MAAM,IAAI,MAAM,IAAI;aACjH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,eAAe;YACrB,GAAG;YACH,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,MAAM,CAAC,OAAO,CAAC,MAAM,wBAAwB,WAAW,EAAE;SAClH,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,gBAAgB;YACtB,GAAG,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE;YACzB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,GAAG,CAAC,IAAI,8BAA8B,GAAG,CAAC,OAAO,GAAG;SAC/G,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/checks/runtime/assess.js

@@ -0,0 +1,140 @@
+import { RUNTIMES } from './runtimes.js';
+import { compareVersions, cycleOf, inCycle, leadingRelease, newest } from './versions.js';
+import { EngineError } from '../../core/check.js';
+export const SECURITY_RULE = 'runtime/security';
+const EOL_RULE = 'runtime/eol';
+const UNPINNED_RULE = 'runtime/unpinned';
+const MAX_WRITTEN = 80;
+function shown(declaration) {
+    const { written } = declaration;
+    return written.length > MAX_WRITTEN ? `${written.slice(0, MAX_WRITTEN - 1)}…` : written;
+}
+/** The declaration as written, in parentheses, unless it says no more than its version. */
+function aside(declaration) {
+    return declaration.written === declaration.version ? '' : ` (${shown(declaration)})`;
+}
+function locationOf(declaration) {
+    const { file, line, endLine } = declaration;
+    return { file, line, ...(endLine !== undefined && endLine > line ? { endLine } : {}) };
+}
+function docsOf(declaration) {
+    return `https://endoflife.date/${RUNTIMES[declaration.runtime].product}`;
+}
+/** Whether the cycle is past its end of life on `today` (`YYYY-MM-DD`). */
+export function isPast(cycle, today) {
+    return cycle.isEol || (cycle.eol !== undefined && cycle.eol <= today);
+}
+/** The newest cycle still supported, to suggest instead of one past its end of life. */
+function supported(feed, today) {
+    const live = feed.cycles.filter((cycle) => !isPast(cycle, today));
+    const name = newest(live.map((cycle) => cycle.name));
+    return live.find((cycle) => cycle.name === name);
+}
+function cycleFor(declaration, feed) {
+    const release = leadingRelease(declaration.version ?? '');
+    if (release === undefined)
+        return undefined;
+    const name = cycleOf(release, feed.cycles.map((cycle) => cycle.name));
+    return feed.cycles.find((cycle) => cycle.name === name);
+}
+/** The cycle's releases after `version` that are security releases. */
+function securityAfter(declaration, feed, cycle, version) {
+    const source = RUNTIMES[declaration.runtime].security;
+    if (source === 'none')
+        return [];
+    if (source === 'phase') {
+        const { latest, latestDate, activeUntil } = cycle;
+        const inPhase = latest !== undefined && latestDate !== undefined && activeUntil !== undefined
+            ? latestDate >= activeUntil
+            : false;
+        return inPhase && latest !== undefined && compareVersions(latest, version) > 0 ? [latest] : [];
+    }
+    if (feed.security === undefined) {
+        throw new EngineError(`no security feed was loaded for ${declaration.runtime}`);
+    }
+    return [...feed.security].filter((release) => inCycle(release, cycle.name) && compareVersions(release, version) > 0);
+}
+function securityFinding({ declaration, feed, cycle }) {
+    const { version } = declaration;
+    if (declaration.exactness !== 'exact' || version === undefined || cycle === undefined)
+        return [];
+    const releases = securityAfter(declaration, feed, cycle, version);
+    const fixed = newest(releases);
+    if (fixed === undefined)
+        return [];
+    const target = newest([fixed, cycle.latest ?? fixed]) ?? fixed;
+    const label = RUNTIMES[declaration.runtime].label;
+    const advice = target === fixed
+        ? `move to ${target} or later`
+        : `move to ${target}, the cycle's newest (${fixed} is its newest security release)`;
+    return [
+        {
+            rule: SECURITY_RULE,
+            message: `${label} ${version}${aside(declaration)} is behind a security release of its cycle; ${advice}.`,
+            location: locationOf(declaration),
+            key: `${declaration.runtime} ${version}`,
+            policy: 'always',
+            docs: docsOf(declaration),
+        },
+    ];
+}
+function eolMessage(declaration, cycle, instead) {
+    const label = RUNTIMES[declaration.runtime].label;
+    const when = cycle.eol === undefined ? 'is past its end of life' : `reached its end of life on ${cycle.eol}`;
+    const suggestion = instead === undefined ? 'a supported cycle' : `a supported cycle such as ${instead.name}`;
+    if (declaration.exactness === 'minimum') {
+        return `${declaration.file} resolves dependencies for ${label} ${cycle.name}, which ${when}; raise config.platform.php to ${suggestion}.`;
+    }
+    return `${label} ${cycle.name}${aside(declaration)} ${when} and gets no more security releases; move to ${suggestion}.`;
+}
+function eolFinding({ declaration, feed, cycle, today }) {
+    if (cycle === undefined || !isPast(cycle, today))
+        return [];
+    return [
+        {
+            rule: EOL_RULE,
+            message: eolMessage(declaration, cycle, supported(feed, today)),
+            location: locationOf(declaration),
+            docs: docsOf(declaration),
+        },
+    ];
+}
+/** The release to suggest: its own cycle's newest while supported, else the newest supported. */
+function example({ feed, cycle, today }) {
+    const own = cycle !== undefined && !isPast(cycle, today) ? cycle.latest : undefined;
+    return own ?? supported(feed, today)?.latest;
+}
+function unpinnedFinding(judging) {
+    const { declaration } = judging;
+    if (declaration.exactness !== 'floating')
+        return [];
+    const label = RUNTIMES[declaration.runtime].label;
+    const release = example(judging);
+    const pin = release === undefined ? 'pin an exact release' : `pin an exact release, such as ${release}`;
+    return [
+        {
+            rule: UNPINNED_RULE,
+            message: `${shown(declaration)} in ${declaration.file} pins no exact ${label} release, so it can't be checked for security releases; ${pin}.`,
+            location: locationOf(declaration),
+            docs: docsOf(declaration),
+        },
+    ];
+}
+/**
+ * The findings for each declaration, judged against the feeds on `today` (`YYYY-MM-DD`):
+ * - `runtime/security` (`always`): an exact release with a newer security release in its cycle;
+ * - `runtime/eol`: a cycle past its end of life, for pins and minimums alike;
+ * - `runtime/unpinned`: no exact release pinned.
+ * A minimum (composer.json's platform PHP) is never a security finding: it isn't what ships.
+ */
+export function assessRuntimes(declarations, feeds, today) {
+    return declarations.flatMap((declaration) => {
+        const feed = feeds.get(declaration.runtime);
+        if (feed === undefined) {
+            throw new EngineError(`no release feed was loaded for ${declaration.runtime}`);
+        }
+        const judging = { declaration, feed, cycle: cycleFor(declaration, feed), today };
+        return [...securityFinding(judging), ...eolFinding(judging), ...unpinnedFinding(judging)];
+    });
+}
+//# sourceMappingURL=assess.js.map

package/dist/checks/runtime/assess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assess.js","sourceRoot":"","sources":["../../../src/checks/runtime/assess.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAChD,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,SAAS,KAAK,CAAC,WAAwB;IACrC,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,OAAO,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;AAC1F,CAAC;AAED,2FAA2F;AAC3F,SAAS,KAAK,CAAC,WAAwB;IACrC,OAAO,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;AACvF,CAAC;AAED,SAAS,UAAU,CAAC,WAAwB;IAC1C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,SAAS,MAAM,CAAC,WAAwB;IACtC,OAAO,0BAA0B,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;AAC3E,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,MAAM,CAAC,KAAY,EAAE,KAAa;IAChD,OAAO,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAa;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,WAAwB,EAAE,IAAiB;IAC3D,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAClB,OAAO,EACP,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACvC,CAAC;IACF,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CACpB,WAAwB,EACxB,IAAiB,EACjB,KAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACtD,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;QAClD,MAAM,OAAO,GACX,MAAM,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;YAC3E,CAAC,CAAC,UAAU,IAAI,WAAW;YAC3B,CAAC,CAAC,KAAK,CAAC;QACZ,OAAO,OAAO,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,MAAM,IAAI,WAAW,CAAC,mCAAmC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAC9B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CACnF,CAAC;AACJ,CAAC;AAUD,SAAS,eAAe,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAW;IAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;IAChC,IAAI,WAAW,CAAC,SAAS,KAAK,OAAO,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC;IAC/D,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,MAAM,GACV,MAAM,KAAK,KAAK;QACd,CAAC,CAAC,WAAW,MAAM,WAAW;QAC9B,CAAC,CAAC,WAAW,MAAM,yBAAyB,KAAK,kCAAkC,CAAC;IACxF,OAAO;QACL;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,GAAG,KAAK,IAAI,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,+CAA+C,MAAM,GAAG;YACzG,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC;YACjC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,IAAI,OAAO,EAAE;YACxC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,WAAwB,EAAE,KAAY,EAAE,OAA0B;IACpF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,IAAI,GACR,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,8BAA8B,KAAK,CAAC,GAAG,EAAE,CAAC;IAClG,MAAM,UAAU,GACd,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,6BAA6B,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5F,IAAI,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxC,OAAO,GAAG,WAAW,CAAC,IAAI,8BAA8B,KAAK,IAAI,KAAK,CAAC,IAAI,WAAW,IAAI,kCAAkC,UAAU,GAAG,CAAC;IAC5I,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,gDAAgD,UAAU,GAAG,CAAC;AAC1H,CAAC;AAED,SAAS,UAAU,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAW;IAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5D,OAAO;QACL;YACE,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/D,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,SAAS,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAW;IAC9C,MAAM,GAAG,GAAG,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,OAAO,GAAG,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC;IAChC,IAAI,WAAW,CAAC,SAAS,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC;IACpD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GACP,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,iCAAiC,OAAO,EAAE,CAAC;IAC9F,OAAO;QACL;YACE,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,WAAW,CAAC,IAAI,kBAAkB,KAAK,2DAA2D,GAAG,GAAG;YAC7I,QAAQ,EAAE,UAAU,CAAC,WAAW,CAAC;YACjC,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC;SAC1B;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,YAAoC,EACpC,KAAY,EACZ,KAAa;IAEb,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,kCAAkC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAY,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;QAC1F,OAAO,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/runtime/check.js

@@ -0,0 +1,67 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { assessRuntimes, SECURITY_RULE } from './assess.js';
+import { declaredRuntimes, isDeclaringFile } from './declarations.js';
+import { loadFeeds } from './feeds.js';
+import { defaultFetcher } from './fetchers.js';
+import { APPLIES, EngineError, skip } from '../../core/check.js';
+function normalisedKey(key) {
+    return key.trim().toLowerCase().replaceAll(/\s+/g, ' ');
+}
+/** Drops each security finding an unexpired exception names. */
+export function excepted(findings, exceptions, today) {
+    const live = new Set(Object.entries(exceptions)
+        .filter(([, entry]) => entry.expires >= today)
+        .map(([key]) => normalisedKey(key)));
+    return findings.filter((f) => f.rule !== SECURITY_RULE || f.key === undefined || !live.has(normalisedKey(f.key)));
+}
+/**
+ * The runtime findings for a repository's files, by repository-relative path: what the gate's
+ * check reports and what the hourly sweep files issues from.
+ */
+export async function runtimeFindings(files, options) {
+    const declarations = declaredRuntimes(files);
+    if (declarations.length === 0)
+        return [];
+    const feeds = await loadFeeds(declarations, options.fetcher);
+    const findings = assessRuntimes(declarations, feeds, options.today);
+    return excepted(findings, options.exceptions ?? {}, options.today);
+}
+function utcToday() {
+    return new Date().toISOString().slice(0, 10);
+}
+async function readAll(root, paths) {
+    const texts = await Promise.all(paths.map(async (path) => {
+        try {
+            return await readFile(join(root, path), 'utf8');
+        }
+        catch {
+            throw new EngineError(`${path} could not be read`);
+        }
+    }));
+    return new Map(paths.map((path, index) => [path, texts[index] ?? '']));
+}
+/**
+ * `runtime/runtimes`: every runtime the repository declares, against its vendor's release feed.
+ * A repository without a Dockerfile is checked through its version files and `tools.lock`.
+ */
+export function runtimesCheck(options = {}) {
+    return {
+        id: 'runtime/runtimes',
+        tier: 'head',
+        scope: 'repo',
+        title: "runtimes against their vendors' release feeds",
+        applies: (ctx) => ctx.facts.files.some((file) => isDeclaringFile(file))
+            ? APPLIES
+            : skip('no Dockerfile, runtime version file or tools.lock declares a runtime'),
+        run: async (ctx) => {
+            const files = await readAll(ctx.root, ctx.facts.files.filter((file) => isDeclaringFile(file)));
+            return runtimeFindings(files, {
+                fetcher: (options.fetcher ?? defaultFetcher)(),
+                today: (options.today ?? utcToday)(),
+                exceptions: ctx.config.supply_chain.exceptions,
+            });
+        },
+    };
+}
+//# sourceMappingURL=check.js.map

package/dist/checks/runtime/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../src/checks/runtime/check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,cAAc,EAAgB,MAAM,eAAe,CAAC;AAE7D,OAAO,EAAE,OAAO,EAAc,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAW7E,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,QAAQ,CACtB,QAA4B,EAC5B,UAAoD,EACpD,KAAa;IAEb,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;SACvB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC;SAC7C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CACtC,CAAC;IACF,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkC,EAClC,OAAuB;IAEvB,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAoB,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,UAAwB,EAAE;IACtD,OAAO;QACL,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,+CAA+C;QACtD,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,sEAAsE,CAAC;QAClF,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,MAAM,OAAO,CACzB,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CACxD,CAAC;YACF,OAAO,eAAe,CAAC,KAAK,EAAE;gBAC5B,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC,EAAE;gBAC9C,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,QAAQ,CAAC,EAAE;gBACpC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU;aAC/C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/runtime/declaration.js

@@ -0,0 +1,33 @@
+import { isExactRelease } from './versions.js';
+/** A pin: exact when the version is one release, floating otherwise. */
+export function pinned(runtime, place, written, version) {
+    const exactness = version !== undefined && isExactRelease(version) ? 'exact' : 'floating';
+    return {
+        runtime,
+        ...place,
+        written,
+        ...(version === undefined ? {} : { version }),
+        exactness,
+    };
+}
+/** The 1-based line of a character offset. */
+export function lineAt(text, offset) {
+    let line = 1;
+    for (let index = 0; index < offset && index < text.length; index += 1) {
+        if (text[index] === '\n')
+            line += 1;
+    }
+    return line;
+}
+function withoutComment(line) {
+    const hash = line.indexOf('#');
+    return hash < 0 ? line : line.slice(0, hash);
+}
+/** Non-empty lines with `#` comments removed, each with its 1-based line number. */
+export function meaningfulLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((raw, index) => ({ text: withoutComment(raw).trim(), line: index + 1 }))
+        .filter((entry) => entry.text !== '');
+}
+//# sourceMappingURL=declaration.js.map

package/dist/checks/runtime/declaration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declaration.js","sourceRoot":"","sources":["../../../src/checks/runtime/declaration.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA8B/C,wEAAwE;AACxE,MAAM,UAAU,MAAM,CACpB,OAAgB,EAChB,KAAY,EACZ,OAAe,EACf,OAA2B;IAE3B,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IAC1F,OAAO;QACL,OAAO;QACP,GAAG,KAAK;QACR,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,SAAS;KACV,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,MAAc;IACjD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;YAAE,IAAI,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,IAAI;SACR,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;SAC5E,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC;AAC1C,CAAC"}

package/dist/checks/runtime/declarations.js

@@ -0,0 +1,38 @@
+import { dockerfileDeclarations } from './dockerfile.js';
+import { TOOLS_LOCK, toolsLockDeclarations } from './tools-lock.js';
+import { composerFile, goModFile, nodeVersionFile, pythonVersionFile, rustToolchainFile, } from './version-files.js';
+import { isDockerfile } from '../infra/files.js';
+const BY_NAME = new Map([
+    ['.nvmrc', nodeVersionFile],
+    ['.node-version', nodeVersionFile],
+    ['.python-version', pythonVersionFile],
+    ['rust-toolchain', rustToolchainFile],
+    ['rust-toolchain.toml', rustToolchainFile],
+    ['go.mod', goModFile],
+    ['composer.json', composerFile],
+]);
+function readerFor(path) {
+    if (path === TOOLS_LOCK)
+        return toolsLockDeclarations;
+    const known = BY_NAME.get(path.split('/').at(-1) ?? '');
+    if (known !== undefined)
+        return known;
+    return isDockerfile(path) ? dockerfileDeclarations : undefined;
+}
+/**
+ * Whether a repository-relative path can declare a runtime: a Dockerfile (or Containerfile), a
+ * version file, `composer.json`, or the root `tools.lock`.
+ */
+export function isDeclaringFile(path) {
+    return readerFor(path) !== undefined;
+}
+/**
+ * Every runtime declaration in the files, by repository-relative path: each Dockerfile's `FROM`
+ * lines, `.nvmrc`, `.node-version`, `.python-version`, `rust-toolchain(.toml)`, `go.mod`'s
+ * `toolchain`, `composer.json`'s platform PHP (a minimum) and the runtimes in `tools.lock`.
+ * Pure: the sweep passes files read through the API, the gate files from the checkout.
+ */
+export function declaredRuntimes(files) {
+    return [...files].flatMap(([path, text]) => readerFor(path)?.(path, text) ?? []);
+}
+//# sourceMappingURL=declarations.js.map

package/dist/checks/runtime/declarations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declarations.js","sourceRoot":"","sources":["../../../src/checks/runtime/declarations.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,YAAY,EACZ,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAIjD,MAAM,OAAO,GAAgC,IAAI,GAAG,CAAiB;IACnE,CAAC,QAAQ,EAAE,eAAe,CAAC;IAC3B,CAAC,eAAe,EAAE,eAAe,CAAC;IAClC,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IACtC,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;IACrC,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;IAC1C,CAAC,QAAQ,EAAE,SAAS,CAAC;IACrB,CAAC,eAAe,EAAE,YAAY,CAAC;CAChC,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,qBAAqB,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkC;IACjE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AACnF,CAAC"}