@trofimyukdev/repo-truth 0.0.0-stage → 0.1.0

package/dist/checks/suppressions.js

@@ -0,0 +1,203 @@
+/**
+ * Suppression directives.
+ *
+ * A line that no longer type-checks, a rule the change breaks, a branch no test
+ * reaches: each passes once a comment tells the gate not to look. This check
+ * reads the lines `base..candidate` removes and adds in source files, pairs each
+ * directive the range removes with one it adds in the same file, and reports an
+ * added directive left without a pair (`suppression-added`) for a human to
+ * sanction. Only the diff is read, through git.
+ *
+ * Which files and directives count lives in the exported
+ * `SUPPRESSION_DIRECTIVES`, read each time the check runs: a consumer appends
+ * its own entry. A directive only counts right after a comment opener.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-31";
+const SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+/** A line comment opener, or a block one with any further asterisks, then white space. */
+const OPENER = "(?:\\/\\/|\\/\\*+)\\s*";
+function directive(label, words) {
+    return { name: label, files: SOURCE_FILE, pattern: new RegExp(`${OPENER}${words}(?![\\w-])`) };
+}
+export const SUPPRESSION_DIRECTIVES = [
+    directive("@ts-ignore", "@ts-ignore"),
+    directive("@ts-nocheck", "@ts-nocheck"),
+    directive("@ts-expect-error", "@ts-expect-error"),
+    directive("eslint-disable", "eslint-disable(?:-next-line|-line)?"),
+    directive("istanbul ignore", "istanbul\\s+ignore"),
+    directive("c8 ignore", "c8\\s+ignore"),
+    directive("v8 ignore", "v8\\s+ignore"),
+];
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.trim() || error.message));
+            else
+                resolve(stdout);
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const NO_LINES = { removed: [], added: [] };
+function wholeFile(text) {
+    return text.replace(/\n$/, "").split("\n").map((t, i) => ({ number: i + 1, text: t.replace(/\r$/, "") }));
+}
+/** The lines changed between two blobs; a missing side (`null`) is a file that is not there. */
+async function diffBlobs(cwd, oldBlob, newBlob) {
+    const blobs = new Map();
+    for (const blob of [oldBlob, newBlob])
+        if (blob !== null)
+            blobs.set(blob, await runGit(cwd, ["cat-file", "blob", blob]));
+    if ([...blobs.values()].some((text) => text.includes("\0")))
+        return NO_LINES;
+    if (oldBlob === null || newBlob === null) {
+        const only = oldBlob ?? newBlob;
+        const lines = only === null ? [] : wholeFile(blobs.get(only) ?? "");
+        return oldBlob === null ? { removed: [], added: lines } : { removed: lines, added: [] };
+    }
+    const out = await runGit(cwd, ["diff", "-U0", "--no-color", "--no-ext-diff", "--no-textconv", oldBlob, newBlob]);
+    const removed = [];
+    const added = [];
+    let oldLine = 0;
+    let newLine = 0;
+    let inHunk = false;
+    for (const raw of out.split("\n")) {
+        const hunk = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(raw);
+        const text = raw.slice(1).replace(/\r$/, "");
+        if (hunk !== null) {
+            oldLine = Number(hunk[1]);
+            newLine = Number(hunk[2]);
+            inHunk = true;
+        }
+        else if (inHunk && raw.startsWith("-"))
+            removed.push({ number: oldLine++, text });
+        else if (inHunk && raw.startsWith("+"))
+            added.push({ number: newLine++, text });
+    }
+    return { removed, added };
+}
+async function readChanges(cwd, from, to) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "--no-abbrev", "--find-renames", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const changes = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [oldMode = "", newMode = "", oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const first = fields[++i] ?? "";
+        const second = status.startsWith("R") || status.startsWith("C") ? (fields[++i] ?? "") : first;
+        const blob = (mode, sha) => (mode.startsWith("100") ? sha : null);
+        const lines = await diffBlobs(cwd, blob(oldMode, oldSha), blob(newMode, newSha));
+        changes.push({ oldPath: status.startsWith("A") ? null : first, newPath: status.startsWith("D") ? null : second, ...lines });
+    }
+    return changes;
+}
+/** The line number of every match the entry finds in the lines, one per match. */
+function hitsOf(entry, path, lines) {
+    if (path === null || !new RegExp(entry.files.source, entry.files.flags.replace(/[gy]/g, "")).test(path))
+        return [];
+    const pattern = new RegExp(entry.pattern.source, entry.pattern.flags.replace("g", "") + "g");
+    return lines.flatMap((line) => [...line.text.matchAll(pattern)].map(() => line.number));
+}
+function draftsOf(changes, entries) {
+    const drafts = [];
+    for (const change of changes) {
+        for (const entry of entries) {
+            const removed = hitsOf(entry, change.oldPath, change.removed);
+            const added = hitsOf(entry, change.newPath, change.added);
+            for (const line of added.slice(removed.length)) {
+                drafts.push({ category: "suppression-added", file: change.newPath ?? "", line, name: entry.name });
+            }
+        }
+    }
+    return drafts.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line));
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(draft, id, lines, given) {
+    for (const key of [id, `${draft.category}:${draft.file}`]) {
+        const reason = Object.hasOwn(given, key) ? given[key] : undefined;
+        if (typeof reason === "string" && reason.trim().length > 0)
+            return reason.trim();
+        for (const line of lines) {
+            const rest = line.slice(key.length);
+            if (line.startsWith(key) && /^\s+\S/.test(rest))
+                return rest.trim();
+        }
+    }
+    return null;
+}
+function describeFinding(finding) {
+    const tail = finding.sanction === null ? "" : ` - sanctioned: ${finding.sanction}`;
+    return `${escapeText(finding.file)}:${finding.line}: ${escapeText(`added ${finding.name}${tail}`)}`;
+}
+/**
+ * Report the suppression directives `base..candidate` adds without a pair.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, and never a thrown error.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = draftsOf(await readChanges(cwd, ancestor, candidateCommit), SUPPRESSION_DIRECTIVES);
+        const lines = drafts.length === 0 ? [] : await readSanctionLines(cwd, baseCommit, candidateCommit);
+        const findings = drafts.map((draft) => {
+            const id = `${draft.category}:${draft.file}:${draft.line}`;
+            return { id, ...draft, sanction: sanctionFor(draft, id, lines, options.sanctions ?? {}) };
+        });
+        if (findings.length === 0)
+            return { name, status: "pass", evidence: ["no suppression directive added"], findings };
+        const open = findings.some((finding) => finding.sanction === null);
+        return { name, status: open ? "fail" : "pass", evidence: findings.map(describeFinding), findings };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))], findings: [] };
+    }
+}
+//# sourceMappingURL=suppressions.js.map

package/dist/checks/suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suppressions.js","sourceRoot":"","sources":["../../src/checks/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAY5B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,0FAA0F;AAC1F,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC,SAAS,SAAS,CAAC,KAAa,EAAE,KAAa;IAC7C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,MAAM,CAAC,GAAG,MAAM,GAAG,KAAK,YAAY,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC;IACrC,SAAS,CAAC,aAAa,EAAE,aAAa,CAAC;IACvC,SAAS,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IACjD,SAAS,CAAC,gBAAgB,EAAE,qCAAqC,CAAC;IAClE,SAAS,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;IAClD,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC;IACtC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC;CACvC,CAAC;AAyBF,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACpH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACxD,OAAO,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAcD,MAAM,QAAQ,GAAG,EAAE,OAAO,EAAE,EAAY,EAAE,KAAK,EAAE,EAAY,EAAE,CAAC;AAEhE,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,OAAsB,EAAE,OAAsB;IAClF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACzH,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACjH,MAAM,OAAO,GAAW,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,yCAAyC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1B,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;aAAM,IAAI,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;aAC/E,IAAI,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC9D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACzH,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC9F,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,GAAW,EAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjG,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,kFAAkF;AAClF,SAAS,MAAM,CAAC,KAA2B,EAAE,IAAmB,EAAE,KAAsB;IACtF,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACnH,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1F,CAAC;AAID,SAAS,QAAQ,CAAC,OAA0B,EAAE,OAAwC;IACpF,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAY,EAAE,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAC9G,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;QACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtE,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,OAA2B;IAClD,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,QAAQ,EAAE,CAAC;IACnF,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,SAAS,OAAO,CAAC,IAAI,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAA4B;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACnG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACnG,MAAM,QAAQ,GAAyB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC1D,MAAM,EAAE,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5F,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,gCAAgC,CAAC,EAAE,QAAQ,EAAE,CAAC;QACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;IACrG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;AACH,CAAC"}

package/dist/checks/workflow-permissions.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Raised workflow permissions.
+ *
+ * A workflow's `permissions:` decide what the job's token may do, and the
+ * `pull_request_target` trigger runs a workflow with the base repository's token
+ * and secrets for a pull request from anyone. This check reads every workflow
+ * file the range adds, changes or renames onto - `.github/workflows/<name>.yml`
+ * or `.yaml` directly in that directory, no deeper and nowhere else - whole and
+ * through git at the merge base of `base` and `candidate` and at `candidate`,
+ * renames detected; the working tree is never read. The YAML is not parsed.
+ *
+ * A line's text is the line with white space at both ends removed; its
+ * value-text is that text with a trailing comment (a `#` after white space)
+ * removed. A line is added when the candidate's file holds its text more often
+ * than the source file held it - the file at the merge base, the one a rename
+ * came from, or none for a file the range adds. A line moved or re-indented is
+ * not added, and a text added more than once is one finding.
+ *
+ * Three categories, each judged on an added line's value-text with an opening
+ * `- ` removed; a value is the same plain, in double quotes or in single quotes,
+ * and white space around a colon does not matter:
+ *  - `write-all`: the key `permissions` with the value `write-all`.
+ *  - `write-permission`: a scope with the value `write`, as the whole value-text
+ *    (`contents: write`) or as one entry of a one-line mapping that is the value
+ *    of `permissions` (`permissions: { contents: write }`). The scopes are
+ *    `actions`, `attestations`, `checks`, `contents`, `deployments`,
+ *    `discussions`, `id-token`, `issues`, `models`, `packages`, `pages`,
+ *    `pull-requests`, `repository-projects`, `security-events` and `statuses`.
+ *  - `pull-request-target`: the key `pull_request_target` with or without a
+ *    value, the list item `pull_request_target`, or the key `on` whose value is
+ *    `pull_request_target` or a one-line list (`[...]`) holding it.
+ *
+ * Not a finding: `read`, `none`, `read-all`, `{}`, a scope not listed,
+ * `pull_request`, `workflow_run`, the words inside a comment line or inside a
+ * `run:` line's command.
+ *
+ * A finding's id is `<category>:<file>`; it is sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`. The check declares no options.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-91";
+export interface WorkflowPermissionsOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`<category>:<file>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * Report each line `base..candidate` adds to a workflow that raises the token's
+ * permissions or runs it on `pull_request_target`. Fails while any finding is
+ * unsanctioned, and fails closed: a revision that names no commit, or a git that
+ * fails, is a `fail` record naming the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: WorkflowPermissionsOptions): Promise<CheckRecord>;

package/dist/checks/workflow-permissions.js

@@ -0,0 +1,237 @@
+/**
+ * Raised workflow permissions.
+ *
+ * A workflow's `permissions:` decide what the job's token may do, and the
+ * `pull_request_target` trigger runs a workflow with the base repository's token
+ * and secrets for a pull request from anyone. This check reads every workflow
+ * file the range adds, changes or renames onto - `.github/workflows/<name>.yml`
+ * or `.yaml` directly in that directory, no deeper and nowhere else - whole and
+ * through git at the merge base of `base` and `candidate` and at `candidate`,
+ * renames detected; the working tree is never read. The YAML is not parsed.
+ *
+ * A line's text is the line with white space at both ends removed; its
+ * value-text is that text with a trailing comment (a `#` after white space)
+ * removed. A line is added when the candidate's file holds its text more often
+ * than the source file held it - the file at the merge base, the one a rename
+ * came from, or none for a file the range adds. A line moved or re-indented is
+ * not added, and a text added more than once is one finding.
+ *
+ * Three categories, each judged on an added line's value-text with an opening
+ * `- ` removed; a value is the same plain, in double quotes or in single quotes,
+ * and white space around a colon does not matter:
+ *  - `write-all`: the key `permissions` with the value `write-all`.
+ *  - `write-permission`: a scope with the value `write`, as the whole value-text
+ *    (`contents: write`) or as one entry of a one-line mapping that is the value
+ *    of `permissions` (`permissions: { contents: write }`). The scopes are
+ *    `actions`, `attestations`, `checks`, `contents`, `deployments`,
+ *    `discussions`, `id-token`, `issues`, `models`, `packages`, `pages`,
+ *    `pull-requests`, `repository-projects`, `security-events` and `statuses`.
+ *  - `pull-request-target`: the key `pull_request_target` with or without a
+ *    value, the list item `pull_request_target`, or the key `on` whose value is
+ *    `pull_request_target` or a one-line list (`[...]`) holding it.
+ *
+ * Not a finding: `read`, `none`, `read-all`, `{}`, a scope not listed,
+ * `pull_request`, `workflow_run`, the words inside a comment line or inside a
+ * `run:` line's command.
+ *
+ * A finding's id is `<category>:<file>`; it is sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`. The check declares no options.
+ */
+import { execFile } from "node:child_process";
+import { SANCTION_KEY } from "../weakened-tests.js";
+export const name = "RT-91";
+const SCOPES = new Set([
+    "actions", "attestations", "checks", "contents", "deployments", "discussions", "id-token", "issues",
+    "models", "packages", "pages", "pull-requests", "repository-projects", "security-events", "statuses",
+]);
+function runGit(cwd, args) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, maxBuffer: 1024 * 1024 * 1024, encoding: "buffer" }, (error, stdout, stderr) => {
+            if (error)
+                reject(new Error(stderr.toString("utf8").trim() || error.message));
+            else
+                resolve(stdout.toString("utf8"));
+        });
+    });
+}
+/** Escape everything outside printable ASCII, so evidence cannot replay a control sequence. */
+function escapeText(text) {
+    let escaped = "";
+    for (const char of text) {
+        const codePoint = char.codePointAt(0) ?? 0;
+        escaped += codePoint >= 0x20 && codePoint <= 0x7e ? char : `\\u{${codePoint.toString(16).padStart(4, "0")}}`;
+    }
+    return escaped;
+}
+async function resolveCommit(cwd, revision) {
+    const fail = (cause) => new Error(`revision "${escapeText(String(revision))}" does not name a commit${cause}`);
+    // A revision that begins with a dash would be read as an option.
+    if (typeof revision !== "string" || revision.length === 0 || revision.startsWith("-"))
+        throw fail("");
+    let hash = "";
+    try {
+        hash = (await runGit(cwd, ["rev-parse", "--verify", "--quiet", `${revision}^{commit}`])).trim();
+    }
+    catch (error) {
+        throw fail(`: ${error.message}`);
+    }
+    if (hash.length === 0)
+        throw fail("");
+    return hash;
+}
+const isWorkflowPath = (path) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(path);
+const isNull = (sha) => /^0+$/.test(sha);
+/** A blob read whole through git; an absent blob is an empty file. */
+const readBlob = async (cwd, sha) => isNull(sha) ? "" : runGit(cwd, ["cat-file", "blob", sha]);
+/** How many times each line's text occurs, lines being split at line feeds, one CR dropped, white space trimmed. */
+function countLines(content) {
+    const counts = new Map();
+    for (const raw of content.split("\n")) {
+        const text = (raw.endsWith("\r") ? raw.slice(0, -1) : raw).trim();
+        if (text.length > 0)
+            counts.set(text, (counts.get(text) ?? 0) + 1);
+    }
+    return counts;
+}
+/** A scalar without the quotes around it, when it is wholly quoted. */
+function unquote(value) {
+    const v = value.trim();
+    const first = v.charAt(0);
+    return v.length >= 2 && (first === '"' || first === "'") && v.endsWith(first) ? v.slice(1, -1).trim() : v;
+}
+/** The entries of a one-line `[...]` or `{...}`, or null when the value is not wrapped so. */
+function flowEntries(value, open, close) {
+    const v = value.trim();
+    if (!v.startsWith(open) || !v.endsWith(close))
+        return null;
+    return v.slice(1, -1).split(",").map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+/** Splits `key : value`; the key is unquoted. */
+function splitPair(text) {
+    const match = /^("[^"]*"|'[^']*'|[^\s:"'][^:]*?)\s*:(?:\s+(.*)|(.*))$/.exec(text);
+    if (match === null)
+        return null;
+    const rest = match[2] ?? match[3] ?? "";
+    // A colon with no space after it belongs to a scalar (`a:b`), unless nothing follows.
+    if (match[2] === undefined && rest.length > 0)
+        return null;
+    return { key: unquote(match[1] ?? ""), value: rest.trim() };
+}
+/** The category of an added line, or null. */
+function categorize(text) {
+    const valueText = text.replace(/(?:^|\s)#.*$/, "").trimEnd().replace(/^-\s+/, "").trim();
+    if (valueText.length === 0)
+        return null;
+    if (unquote(valueText) === "pull_request_target")
+        return "pull-request-target";
+    const pair = splitPair(valueText);
+    if (pair === null)
+        return null;
+    const value = unquote(pair.value);
+    if (pair.key === "pull_request_target")
+        return "pull-request-target";
+    if (pair.key === "on") {
+        const list = flowEntries(pair.value, "[", "]");
+        const holds = value === "pull_request_target" || list?.some((entry) => unquote(entry) === "pull_request_target");
+        return holds ? "pull-request-target" : null;
+    }
+    if (pair.key === "permissions") {
+        if (value === "write-all")
+            return "write-all";
+        for (const entry of flowEntries(pair.value, "{", "}") ?? []) {
+            const inner = splitPair(entry);
+            if (inner !== null && SCOPES.has(inner.key) && unquote(inner.value) === "write")
+                return "write-permission";
+        }
+        return null;
+    }
+    return SCOPES.has(pair.key) && value === "write" ? "write-permission" : null;
+}
+async function compare(cwd, from, to) {
+    const out = await runGit(cwd, ["diff", "--raw", "-z", "-M", "--no-abbrev", "--no-ext-diff", "--no-relative", from, to, "--"]);
+    const fields = out.split("\0");
+    const drafts = [];
+    for (let i = 0; i < fields.length; i++) {
+        const head = fields[i] ?? "";
+        if (!head.startsWith(":"))
+            continue;
+        const [, , oldSha = "", newSha = "", status = ""] = head.slice(1).split(" ");
+        const moved = status.startsWith("R") || status.startsWith("C");
+        i++;
+        const newPath = moved ? (fields[++i] ?? "") : (fields[i] ?? "");
+        const letter = status.charAt(0);
+        if (!["A", "M", "R", "C", "T"].includes(letter) || !isWorkflowPath(newPath))
+            continue;
+        // A rename is read against the file it came from, whatever that path was.
+        const hasSource = letter === "M" || letter === "T" || letter === "R";
+        const before = countLines(hasSource ? await readBlob(cwd, oldSha) : "");
+        const after = countLines(await readBlob(cwd, newSha));
+        for (const [text, count] of after) {
+            if (count <= (before.get(text) ?? 0))
+                continue;
+            const category = categorize(text);
+            if (category !== null)
+                drafts.push({ category, file: newPath, line: text });
+        }
+    }
+    return drafts;
+}
+/** The text after the sanction key on every such line of the range's commit messages. */
+async function readSanctionLines(cwd, from, to) {
+    const out = await runGit(cwd, ["log", "--format=%B%x00", `${from}..${to}`, "--"]);
+    const prefix = `${SANCTION_KEY}:`;
+    return out
+        .split(/[\n\0]/)
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith(prefix))
+        .map((line) => line.slice(prefix.length).trim());
+}
+function sanctionFor(id, lines, given) {
+    const reason = Object.hasOwn(given, id) ? given[id] : undefined;
+    if (typeof reason === "string" && reason.trim().length > 0)
+        return reason.trim();
+    for (const line of lines) {
+        const rest = line.slice(id.length);
+        if (line.startsWith(id) && /^\s+\S/.test(rest))
+            return rest.trim();
+    }
+    return null;
+}
+/**
+ * Report each line `base..candidate` adds to a workflow that raises the token's
+ * permissions or runs it on `pull_request_target`. Fails while any finding is
+ * unsanctioned, and fails closed: a revision that names no commit, or a git that
+ * fails, is a `fail` record naming the cause - never a `pass`, never a throw.
+ */
+export async function check(options) {
+    try {
+        const { cwd, base, candidate } = options;
+        const baseCommit = await resolveCommit(cwd, base);
+        const candidateCommit = await resolveCommit(cwd, candidate);
+        let ancestor;
+        try {
+            ancestor = (await runGit(cwd, ["merge-base", baseCommit, candidateCommit])).trim();
+        }
+        catch (error) {
+            throw new Error(`no merge base of "${escapeText(base)}" and "${escapeText(candidate)}": ${error.message}`);
+        }
+        const drafts = await compare(cwd, ancestor, candidateCommit);
+        if (drafts.length === 0)
+            return { name, status: "pass", evidence: ["no workflow permission raised"] };
+        const lines = await readSanctionLines(cwd, baseCommit, candidateCommit);
+        let open = false;
+        const evidence = drafts.map((draft) => {
+            const reason = sanctionFor(`${draft.category}:${draft.file}`, lines, options.sanctions ?? {});
+            if (reason === null)
+                open = true;
+            const tail = reason === null ? "" : ` - sanctioned: ${escapeText(reason)}`;
+            return `${escapeText(draft.file)}: ${draft.category} "${escapeText(draft.line)}"${tail}`;
+        });
+        return { name, status: open ? "fail" : "pass", evidence };
+    }
+    catch (error) {
+        return { name, status: "fail", evidence: [escapeText(error instanceof Error ? error.message : String(error))] };
+    }
+}
+//# sourceMappingURL=workflow-permissions.js.map

package/dist/checks/workflow-permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-permissions.js","sourceRoot":"","sources":["../../src/checks/workflow-permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC;AAU5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ;IACnG,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,UAAU;CACrG,CAAC,CAAC;AAEH,SAAS,MAAM,CAAC,GAAW,EAAE,IAAuB;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CAAC,KAAK,EAAE,IAAgB,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtH,IAAI,KAAK;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;;gBACzE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+FAA+F;AAC/F,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;IAC/G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,QAAgB;IACxD,MAAM,IAAI,GAAG,CAAC,KAAa,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,aAAa,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAC;IAC9H,iEAAiE;IACjE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,QAAQ,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,MAAM,MAAM,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE1D,sEAAsE;AACtE,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAmB,EAAE,CACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;AAE5D,oHAAoH;AACpH,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,uEAAuE;AACvE,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,8FAA8F;AAC9F,SAAS,WAAW,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa;IAC7D,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,iDAAiD;AACjD,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,sFAAsF;IACtF,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,8CAA8C;AAC9C,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IAC/E,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,GAAG,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACrE,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,KAAK,qBAAqB,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,qBAAqB,CAAC,CAAC;QACjH,OAAO,KAAK,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,EAAE,CAAC;QAC/B,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO,WAAW,CAAC;QAC9C,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC/B,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,OAAO;gBAAE,OAAO,kBAAkB,CAAC;QAC7G,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAQD,KAAK,UAAU,OAAO,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,CAAC,EAAE,AAAD,EAAG,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,EAAE,MAAM,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC,EAAE,CAAC;QACJ,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YAAE,SAAS;QACtF,0EAA0E;QAC1E,MAAM,SAAS,GAAG,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;QACrE,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAE,SAAS;YAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAY,EAAE,EAAU;IACpE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,IAAI,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,GAAG,YAAY,GAAG,CAAC;IAClC,OAAO,GAAG;SACP,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,EAAU,EAAE,KAAwB,EAAE,KAAuC;IAChG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAmC;IAC7D,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC5D,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,UAAU,CAAC,IAAI,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,+BAA+B,CAAC,EAAE,CAAC;QACtG,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACxE,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YAC9F,IAAI,MAAM,KAAK,IAAI;gBAAE,IAAI,GAAG,IAAI,CAAC;YACjC,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;QAC3F,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/checks/workflow-weakening.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Weakened workflows.
+ *
+ * The cheapest way to turn a red check green is to change the workflow rather
+ * than the code. This check reads every workflow file the range deletes, adds,
+ * changes or renames, whole and through git at the merge base and at the
+ * candidate, and reports each workflow the range removes (`workflow-removed`)
+ * and each line of a weakening shape (`WEAKENING_SHAPES`) that the candidate's
+ * file holds more often than its source did. A line moved or re-indented is not
+ * a new line. The YAML is not parsed, and the working tree is never read.
+ *
+ * A finding's id is `<category>:<file>`; it is sanctioned by a
+ * `Sanctioned-Weakening: <id> <reason>` line in a commit message of the range
+ * or by the caller's `sanctions`.
+ */
+import type { CheckRecord } from "../index.js";
+export declare const name = "RT-56";
+export interface WeakeningShape {
+    readonly category: string;
+    /** Tested against a line's text with white space at both ends removed. */
+    readonly pattern: RegExp;
+}
+/** The shapes a line may have. A consumer appends to this array; it is read at each run. */
+export declare const WEAKENING_SHAPES: WeakeningShape[];
+export interface WorkflowWeakeningOptions {
+    readonly cwd: string;
+    readonly base: string;
+    readonly candidate: string;
+    /** Ids (`<category>:<file>`) mapped to reasons. */
+    readonly sanctions?: Readonly<Record<string, string>> | undefined;
+}
+/**
+ * Report each workflow `base..candidate` removes and each weakening line it adds.
+ * Fails while any finding is unsanctioned, and fails closed: a revision that
+ * names no commit, or any git invocation that fails, is a `fail` record naming
+ * the cause - never a `pass`, never a throw.
+ */
+export declare function check(options: WorkflowWeakeningOptions): Promise<CheckRecord>;