@theagilemonkeys/facility 0.11.4 → 0.12.0

package/templates/doctor/resolve.mjs

@@ -1,572 +0,0 @@
-#!/usr/bin/env node
-// Generated by facility — https://github.com/theam/facility
-//
-// Deterministic CI Doctor admission policy. The model only runs after this
-// resolver has proved that the PR head is current, every check is terminal,
-// the failure is low risk, and the bounded retry budget remains.
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { pathToFileURL } from "node:url";
-
-const MAX_REPAIR_ATTEMPTS = 2;
-const MAX_BRANCH_REPAIR_ATTEMPTS = 3;
-const FAILURE_CONCLUSIONS = new Set([
-  "action_required",
-  "cancelled",
-  "failure",
-  "stale",
-  "startup_failure",
-  "timed_out",
-]);
-const LOW_RISK_CATEGORIES = new Set(["build", "lint", "typecheck", "unit_test"]);
-const CATEGORY_PRIORITY = [
-  "secret_scan",
-  "workflow_security",
-  "auth_access",
-  "dependency_supply_chain",
-  "verify_guard",
-  "unknown",
-  "e2e",
-  "flaky_infra",
-  "typecheck",
-  "lint",
-  "unit_test",
-  "build",
-];
-const SENSITIVE_PATHS = [
-  /^\.github\//,
-  /^\.claude\//,
-  /^\.agents\//,
-  /(^|\/)guards\//,
-  /(^|\/)scripts\/ci\//,
-  /(^|\/)\.env(?:\.|$)/,
-  /(^|\/)migrations?\//,
-  /(^|\/)(?:auth|authorization|rbac|access-control|permissions?|secrets?|crypto)(?:\/|[._-]|$)/i,
-  /(^|\/)middleware\.[cm]?[jt]sx?$/,
-  /(^|\/)(?:package(?:-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|pyproject\.toml|poetry\.lock|Cargo\.toml|Cargo\.lock|go\.mod|go\.sum)$/,
-];
-
-const TOKEN_RE = /\b(?:gh[pousr]_|github_pat_|sk-|sb_)[A-Za-z0-9_=-]{8,}\b/g;
-const URL_RE = /https?:\/\/\S+/g;
-const UUID_RE = /\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b/gi;
-const SHA_RE = /\b[0-9a-f]{7,40}\b/gi;
-const NUMBER_RE = /\b\d{2,}\b/g;
-const ATTEMPT_RE =
-  /<!--\s*facility-doctor\s+attempt\s+fingerprint="([^"]+)"\s+head_sha="([0-9a-f]{40})"\s+outcome="([^"]+)"\s*-->/g;
-
-export function sanitizeFailureSignal(value, maxLength = 1_200) {
-  return String(value ?? "")
-    .replace(TOKEN_RE, "[redacted-token]")
-    .replace(URL_RE, "[url]")
-    .replace(UUID_RE, "[uuid]")
-    .replace(SHA_RE, "[sha]")
-    .replace(NUMBER_RE, "[n]")
-    .slice(0, maxLength)
-    .trim();
-}
-
-export function classifyFailure(check) {
-  const output = sanitizeFailureSignal(
-    `${check.output?.title ?? ""}\n${check.output?.summary ?? ""}`,
-  );
-  // Check names are workflow-owned evidence. Check output can contain text
-  // derived from the PR, so it affects only the fingerprint, never admission.
-  const haystack = String(check.name ?? "").toLowerCase();
-  let category = "unknown";
-
-  if (/\b(gitleaks|secret scan|secret-scanning|credential leak)\b/.test(haystack)) {
-    category = "secret_scan";
-  } else if (
-    /\b(codeql|security|trivy|scorecard|workflow security|github actions|pull_request_target)\b/.test(
-      haystack,
-    )
-  ) {
-    category = "workflow_security";
-  } else if (
-    /\b(auth|authorization|rbac|rls|jwt|service role|security definer|migration)\b/.test(haystack)
-  ) {
-    category = "auth_access";
-  } else if (
-    /\b(audit|dependabot|dependency|supply chain|lockfile|package lock)\b/.test(haystack)
-  ) {
-    category = "dependency_supply_chain";
-  } else if (/\b(verify|guard|policy check|invariant)\b/.test(haystack)) {
-    category = "verify_guard";
-  } else if (/\b(playwright|e2e|browser|ui smoke|visual regression)\b/.test(haystack)) {
-    category = "e2e";
-  } else if (["cancelled", "stale", "startup_failure", "timed_out"].includes(check.conclusion)) {
-    category = "flaky_infra";
-  } else if (/\b(typecheck|tsc|typescript|type error)\b/.test(haystack)) {
-    category = "typecheck";
-  } else if (/\b(lint|eslint|biome)\b/.test(haystack)) {
-    category = "lint";
-  } else if (/\b(vitest|jest|unit test|test)\b/.test(haystack)) {
-    category = "unit_test";
-  } else if (/\b(build|compile)\b/.test(haystack)) {
-    category = "build";
-  }
-
-  const normalizedSignal = output
-    .split("\n")
-    .map((line) => line.trim())
-    .filter((line) => /error|failed|failure|exception|expected|received|cannot|timeout/i.test(line))
-    .slice(0, 3)
-    .join(" | ");
-  const fingerprint = createHash("sha256")
-    .update(
-      [
-        category,
-        normalize(check.name),
-        normalize(check.conclusion),
-        normalize(normalizedSignal),
-      ].join("|"),
-    )
-    .digest("hex")
-    .slice(0, 16);
-
-  return {
-    category,
-    check,
-    displayName: safeLabel(check.name),
-    fingerprint,
-    risk: LOW_RISK_CATEGORIES.has(category) ? "low" : "high",
-    verificationCommands: verificationCommands(category),
-  };
-}
-
-export function countAttempts(comments, fingerprint) {
-  let count = 0;
-  for (const comment of comments) {
-    ATTEMPT_RE.lastIndex = 0;
-    let match = ATTEMPT_RE.exec(comment.body ?? "");
-    while (match) {
-      if (match[1] === fingerprint && match[3] === "started") count += 1;
-      match = ATTEMPT_RE.exec(comment.body ?? "");
-    }
-  }
-  return count;
-}
-
-export function countBranchAttempts(comments) {
-  let count = 0;
-  for (const comment of comments) {
-    ATTEMPT_RE.lastIndex = 0;
-    let match = ATTEMPT_RE.exec(comment.body ?? "");
-    while (match) {
-      if (match[3] === "started") count += 1;
-      match = ATTEMPT_RE.exec(comment.body ?? "");
-    }
-  }
-  return count;
-}
-
-function attemptState(comments, fingerprint, headSha) {
-  const state = { startedAtHead: false, triageSeen: false };
-  for (const comment of comments) {
-    ATTEMPT_RE.lastIndex = 0;
-    let match = ATTEMPT_RE.exec(comment.body ?? "");
-    while (match) {
-      if (match[1] === fingerprint && match[2] === headSha && match[3] === "started") {
-        state.startedAtHead = true;
-      }
-      if (match[1] === fingerprint && match[3] === "triage") state.triageSeen = true;
-      match = ATTEMPT_RE.exec(comment.body ?? "");
-    }
-  }
-  return state;
-}
-
-export function hasSensitiveFiles(files) {
-  return files.some((file) => SENSITIVE_PATHS.some((pattern) => pattern.test(file)));
-}
-
-export function decideDoctorAction({
-  eventHeadSha,
-  pullRequest,
-  checks,
-  comments = [],
-  doctorRunIds = [],
-  allowedBotLogins = ["claude[bot]"],
-}) {
-  if (!pullRequest) return none("no same-repository PR is associated with this run");
-  if (pullRequest.state !== "open") return none("PR is not open");
-  if (!eventHeadSha || pullRequest.head?.sha !== eventHeadSha) {
-    return none("workflow run is stale for the current PR head");
-  }
-
-  const relevantChecks = latestChecks(checks).filter(
-    (check) => !isDoctorCheck(check, doctorRunIds),
-  );
-  if (relevantChecks.length === 0) return none("no current-head checks were found");
-  if (relevantChecks.some((check) => check.status !== "completed")) {
-    return none("waiting for all non-doctor checks to reach a terminal state");
-  }
-
-  const failures = relevantChecks
-    .filter((check) => FAILURE_CONCLUSIONS.has(check.conclusion))
-    .map(classifyFailure)
-    .sort(compareFailureRisk);
-  if (failures.length === 0) return none("all terminal checks passed or were skipped");
-
-  const failure = failures[0];
-  const attempts = countAttempts(comments, failure.fingerprint);
-  const branchAttempts = countBranchAttempts(comments);
-  const markers = attemptState(comments, failure.fingerprint, eventHeadSha);
-  const base = {
-    attempts,
-    branchAttempts,
-    failure,
-    triageSeen: markers.triageSeen,
-    pullRequest,
-  };
-  const crossRepository =
-    !pullRequest.head?.repo?.full_name ||
-    pullRequest.head.repo.full_name !== pullRequest.base?.repo?.full_name;
-  if (crossRepository) {
-    return triageOnce(base, "fork or cross-repository PRs are never auto-repaired");
-  }
-  if (hasSensitiveFiles(pullRequest.changedFiles ?? [])) {
-    return triageOnce(base, "PR touches a privileged or sensitive boundary");
-  }
-  if (failure.risk === "high") {
-    return triageOnce(base, `failure category ${failure.category} requires human review`);
-  }
-
-  const authorLogin = String(pullRequest.user?.login ?? "");
-  const authorIsBot = pullRequest.user?.type === "Bot";
-  const authorIsCrewBot = authorIsBot && allowedBotLogins.includes(authorLogin);
-  if (!authorIsCrewBot) {
-    if (authorIsBot) {
-      return triageOnce(
-        base,
-        "bot author is not the configured Facility App; set FACILITY_BOT_LOGIN to its App slug",
-      );
-    }
-    if (pullRequest.draft) return none("human-authored draft is still work in progress");
-    return triageOnce(base, "human-authored PRs never receive uninvited commits");
-  }
-  if (markers.startedAtHead) {
-    return none(`repair already attempted at current head for ${failure.fingerprint}`);
-  }
-  if (attempts >= MAX_REPAIR_ATTEMPTS) {
-    return none(`repair attempt limit reached for fingerprint ${failure.fingerprint}`);
-  }
-  if (branchAttempts >= MAX_BRANCH_REPAIR_ATTEMPTS) {
-    return none(`repair attempt limit reached for this pull-request branch`);
-  }
-
-  return {
-    ...base,
-    action: "repair",
-    reason: "low-risk failure on a current, same-repository, bot-authored PR",
-  };
-}
-
-export async function resolveDoctor({
-  repository,
-  event,
-  gh,
-  currentDoctorRunId,
-  allowedBotLogin,
-}) {
-  const run = event?.workflow_run;
-  if (run?.event !== "pull_request") return none("event is not a pull-request workflow run");
-  if (!/^[0-9a-f]{40}$/i.test(String(run.head_sha ?? ""))) {
-    return none("workflow run head SHA is malformed");
-  }
-  const prNumber =
-    run.pull_requests?.find((pr) => pr.number)?.number ??
-    (await associatedPr(gh, repository, run.head_sha));
-  if (!Number.isInteger(prNumber) || prNumber < 1) {
-    return none("no valid PR is associated with the workflow run");
-  }
-
-  const pullRequest = JSON.parse(await gh(["api", `repos/${repository}/pulls/${prNumber}`]));
-  pullRequest.changedFiles = flattenPages(
-    JSON.parse(
-      await gh([
-        "api",
-        `repos/${repository}/pulls/${prNumber}/files?per_page=100`,
-        "--paginate",
-        "--slurp",
-      ]),
-    ),
-  ).map((file) => file.filename);
-
-  const checkPages = asPages(
-    JSON.parse(
-      await gh([
-        "api",
-        `repos/${repository}/commits/${run.head_sha}/check-runs?per_page=100`,
-        "--paginate",
-        "--slurp",
-      ]),
-    ),
-  );
-  const checks = checkPages.flatMap((page) => page.check_runs ?? []);
-  const workflowRunPages = asPages(
-    JSON.parse(
-      await gh([
-        "api",
-        `repos/${repository}/actions/runs?head_sha=${run.head_sha}&per_page=100`,
-        "--paginate",
-        "--slurp",
-      ]),
-    ),
-  );
-  const doctorRunIds = workflowRunPages
-    .flatMap((page) => page.workflow_runs ?? [])
-    .filter((candidate) => isDoctorWorkflow(candidate.name))
-    .map((candidate) => String(candidate.id));
-  if (currentDoctorRunId) doctorRunIds.push(String(currentDoctorRunId));
-  const comments = flattenPages(
-    JSON.parse(
-      await gh([
-        "api",
-        `repos/${repository}/issues/${prNumber}/comments?per_page=100`,
-        "--paginate",
-        "--slurp",
-      ]),
-    ),
-  );
-
-  return decideDoctorAction({
-    eventHeadSha: run.head_sha,
-    pullRequest,
-    checks,
-    comments,
-    doctorRunIds,
-    allowedBotLogins: crewBotLogins(allowedBotLogin),
-  });
-}
-
-async function main() {
-  const outputPath = process.env.GITHUB_OUTPUT;
-  const output = (key, value) => {
-    if (outputPath) appendFileSync(outputPath, `${key}=${String(value).replaceAll("\n", " ")}\n`);
-  };
-
-  let decision;
-  try {
-    const repository = requiredEnv("GITHUB_REPOSITORY");
-    const event = JSON.parse(readFileSync(requiredEnv("GITHUB_EVENT_PATH"), "utf8"));
-    const gh = async (args) =>
-      execFileSync("gh", args, { encoding: "utf8", maxBuffer: 20 * 1024 * 1024 });
-    decision = await resolveDoctor({
-      repository,
-      event,
-      gh,
-      currentDoctorRunId: process.env.GITHUB_RUN_ID,
-      allowedBotLogin: process.env.FACILITY_BOT_LOGIN,
-    });
-
-    if (decision.action === "triage") {
-      const body = renderTriageComment(decision);
-      await gh([
-        "api",
-        `repos/${repository}/issues/${decision.pullRequest.number}/comments`,
-        "-f",
-        `body=${body}`,
-      ]);
-    } else if (decision.action === "repair") {
-      const startedComment = JSON.parse(
-        await gh([
-          "api",
-          `repos/${repository}/issues/${decision.pullRequest.number}/comments`,
-          "-f",
-          `body=${renderRepairStartedComment(decision)}`,
-        ]),
-      );
-      if (!Number.isInteger(startedComment.id))
-        throw new Error("repair attempt comment was not created");
-      writeRepairContext(decision, startedComment.id);
-      output("pr_number", decision.pullRequest.number);
-      output("head_ref", decision.pullRequest.head.ref);
-      output("head_sha", decision.pullRequest.head.sha);
-      output("fingerprint", decision.failure.fingerprint);
-    }
-  } catch {
-    decision = none("resolver failed closed because GitHub evidence was invalid or unavailable");
-    process.exitCode = 1;
-  }
-
-  console.log(`doctor: ${decision.action} — ${decision.reason}`);
-  output("action", decision.action);
-}
-
-function writeRepairContext(decision, commentId) {
-  const marker = attemptMarker(
-    decision.failure.fingerprint,
-    decision.pullRequest.head.sha,
-    "started",
-  );
-  mkdirSync(".facility-doctor", { recursive: true });
-  writeFileSync(
-    ".facility-doctor/context.json",
-    `${JSON.stringify(
-      {
-        schema: "facility.doctor.context.v2",
-        failure: {
-          category: decision.failure.category,
-          check: decision.failure.displayName,
-          conclusion: decision.failure.check.conclusion,
-          verificationCommands: decision.failure.verificationCommands,
-        },
-        pr: {
-          number: decision.pullRequest.number,
-          headRef: decision.pullRequest.head.ref,
-          headSha: decision.pullRequest.head.sha,
-          baseRef: decision.pullRequest.base.ref,
-          draft: decision.pullRequest.draft === true,
-        },
-        attempt: decision.attempts + 1,
-        maxAttempts: MAX_REPAIR_ATTEMPTS,
-        commentId,
-        fingerprint: decision.failure.fingerprint,
-        marker,
-      },
-      null,
-      2,
-    )}\n`,
-  );
-}
-
-function renderRepairStartedComment(decision) {
-  return [
-    "### Facility CI Doctor repair",
-    "",
-    `Starting bounded attempt ${decision.attempts + 1}/${MAX_REPAIR_ATTEMPTS} for \`${decision.failure.displayName}\` (${decision.failure.category.replaceAll("_", " ")}).`,
-    "The repair agent will update this comment with its verified result.",
-    attemptMarker(decision.failure.fingerprint, decision.pullRequest.head.sha, "started"),
-  ].join("\n");
-}
-
-function renderTriageComment(decision) {
-  return [
-    "### Facility CI Doctor triage",
-    "",
-    `- Failing check: ${decision.failure.displayName}`,
-    `- Category: ${decision.failure.category.replaceAll("_", " ")}`,
-    `- Reason: ${decision.reason}.`,
-    "",
-    "A human must review this failure; no repair agent was started.",
-    attemptMarker(decision.failure.fingerprint, decision.pullRequest.head.sha, "triage"),
-  ].join("\n");
-}
-
-function triageOnce(base, reason) {
-  if (base.triageSeen) return none(`triage already posted for ${base.failure.fingerprint}`);
-  return triage(base, reason);
-}
-
-function triage(base, reason) {
-  return { ...base, action: "triage", reason };
-}
-
-function none(reason) {
-  return { action: "none", reason };
-}
-
-function compareFailureRisk(a, b) {
-  if (a.risk !== b.risk) return a.risk === "high" ? -1 : 1;
-  return CATEGORY_PRIORITY.indexOf(a.category) - CATEGORY_PRIORITY.indexOf(b.category);
-}
-
-function latestChecks(checks) {
-  const latest = new Map();
-  for (const check of [...checks].sort((a, b) => Number(b.id ?? 0) - Number(a.id ?? 0))) {
-    const key = `${check.app?.slug ?? "unknown"}:${check.name ?? "unknown"}`;
-    if (!latest.has(key)) latest.set(key, check);
-  }
-  return [...latest.values()];
-}
-
-function isDoctorCheck(check, doctorRunIds) {
-  const name = String(check.name ?? "").toLowerCase();
-  const url = String(check.details_url ?? "");
-  return (
-    name.includes("facility-doctor") ||
-    name.includes("ci-doctor") ||
-    doctorRunIds.some((runId) => url.includes(`/actions/runs/${runId}/`))
-  );
-}
-
-function isDoctorWorkflow(name) {
-  const normalized = String(name ?? "").toLowerCase();
-  return normalized.includes("facility-doctor") || normalized.includes("ci-doctor");
-}
-
-function crewBotLogins(configured) {
-  const logins = new Set(["claude[bot]"]);
-  for (const value of String(configured ?? "").split(",")) {
-    const login = value.trim();
-    if (!login) continue;
-    logins.add(login.endsWith("[bot]") ? login : `${login}[bot]`);
-  }
-  return [...logins];
-}
-
-function verificationCommands(category) {
-  if (category === "lint") return ["lint"];
-  if (category === "typecheck") return ["typecheck"];
-  if (category === "unit_test") return ["test"];
-  if (category === "build") return ["typecheck", "build"];
-  return [];
-}
-
-function normalize(value) {
-  return String(value ?? "")
-    .toLowerCase()
-    .replace(/[^a-z0-9._/-]+/g, " ")
-    .replace(/\s+/g, " ")
-    .trim();
-}
-
-function safeLabel(value) {
-  return String(value ?? "unknown")
-    .replace(/[\r\n\t]+/g, " ")
-    .replaceAll("@", "＠")
-    .replaceAll("<", "‹")
-    .replaceAll(">", "›")
-    .replaceAll("`", "'")
-    .replace(/\s+/g, " ")
-    .slice(0, 160)
-    .trim();
-}
-
-function attemptMarker(fingerprint, headSha, outcome) {
-  return `<!-- facility-doctor attempt fingerprint="${fingerprint}" head_sha="${headSha}" outcome="${outcome}" -->`;
-}
-
-function asPages(value) {
-  return Array.isArray(value) ? value : [value];
-}
-
-function flattenPages(value) {
-  return asPages(value).flatMap((page) => (Array.isArray(page) ? page : [page]));
-}
-
-async function associatedPr(gh, repository, headSha) {
-  if (!headSha) return undefined;
-  const pages = JSON.parse(
-    await gh([
-      "api",
-      `repos/${repository}/commits/${headSha}/pulls?per_page=100`,
-      "--paginate",
-      "--slurp",
-      "-H",
-      "Accept: application/vnd.github+json",
-    ]),
-  );
-  return flattenPages(pages).find((pr) => pr.number)?.number;
-}
-
-function requiredEnv(name) {
-  const value = process.env[name];
-  if (!value) throw new Error(`${name} is required`);
-  return value;
-}
-
-const invokedPath = process.argv[1] ? pathToFileURL(process.argv[1]).href : "";
-if (import.meta.url === invokedPath) await main();

package/templates/guards/README.md

@@ -1,30 +0,0 @@
-# Guards
-
-Deterministic, fast invariant checks for this repository, run as **one**
-umbrella status. Generated by [facility](https://github.com/theam/facility);
-every file here is yours.
-
-```
-node guards/run.mjs                 # run all guards
-node guards/run.mjs --only=<name>   # run one guard (repeatable)
-node guards/run.mjs --json          # machine-readable (CI / agents)
-node guards/run.mjs --list          # list registered guards
-```
-
-The rule behind this directory, from `STANDARD.md`: **if a rule is repeatedly
-missed, add a deterministic check instead of more prose.** Prose decays;
-checks hold.
-
-## Add a guard
-
-1. Create `guards/<name>.mjs` exporting a default `{ name, description,
-   requires?, run() }`. Return a list of `{ file?, line?, message }`
-   violations (empty = pass). Keep it deterministic and read-only.
-2. Give it an in-code `ALLOWLIST` (keyed, with a written reason per entry) for
-   justified exceptions — `applyAllowlist` from `_kit.mjs` flags stale entries
-   so the list cannot rot.
-3. To wrap an existing CLI/DB check instead of porting its logic, use
-   `commandGuard(...)` from `_kit.mjs`.
-4. Guards needing external state declare `requires: ["SOME_ENV_VAR"]` and are
-   **skipped** (not failed) when it is absent, so local runs stay fast while
-   CI runs everything.

package/templates/guards/_kit.mjs

@@ -1,81 +0,0 @@
-// Generated by facility — https://github.com/theam/facility
-//
-// Small helpers for writing guards. Zero dependencies; everything is yours
-// to read and change.
-import { execFileSync } from "node:child_process";
-import { readdirSync, readFileSync, statSync } from "node:fs";
-import { join } from "node:path";
-
-/** Recursively list files under `dir` matching any of `extensions`. */
-export function listFiles(dir, extensions, ignore = ["node_modules", ".git"]) {
-  const out = [];
-  let entries;
-  try {
-    entries = readdirSync(dir);
-  } catch {
-    return out;
-  }
-  for (const entry of entries) {
-    if (ignore.includes(entry)) continue;
-    const path = join(dir, entry);
-    const stats = statSync(path);
-    if (stats.isDirectory()) out.push(...listFiles(path, extensions, ignore));
-    else if (extensions.some((ext) => entry.endsWith(ext))) out.push(path);
-  }
-  return out;
-}
-
-/** Read a file as UTF-8, returning "" when it does not exist. */
-export function readText(path) {
-  try {
-    return readFileSync(path, "utf8");
-  } catch {
-    return "";
-  }
-}
-
-/**
- * Wrap an existing CLI/DB check as a guard instead of re-implementing its
- * logic. The command's non-zero exit becomes a single violation carrying its
- * output tail.
- */
-export function commandGuard({ name, description, command, args = [], requires = [] }) {
-  return {
-    name,
-    description,
-    requires,
-    run() {
-      try {
-        execFileSync(command, args, { stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
-        return [];
-      } catch (error) {
-        const tail = `${error.stdout ?? ""}${error.stderr ?? ""}`
-          .trim()
-          .split("\n")
-          .slice(-12)
-          .join("\n");
-        return [{ message: `\`${[command, ...args].join(" ")}\` failed:\n${tail}` }];
-      }
-    },
-  };
-}
-
-/**
- * Filter violations through a keyed allowlist. Every allowlist entry must
- * carry a written reason; entries that no longer match anything are reported
- * as stale so the list cannot rot.
- */
-export function applyAllowlist(violations, allowlist) {
-  const used = new Set();
-  const kept = violations.filter((violation) => {
-    const hit = Object.keys(allowlist).find((key) => violation.key === key);
-    if (hit) used.add(hit);
-    return !hit;
-  });
-  for (const key of Object.keys(allowlist)) {
-    if (!used.has(key)) {
-      kept.push({ message: `stale allowlist entry "${key}" (${allowlist[key]}) — remove it` });
-    }
-  }
-  return kept;
-}