@uknows/setup 0.1.0 → 0.2.0

package/lib/hosts.mjs

@@ -1,15 +1,15 @@
 /*
  * Where the app runs, read from deploy files in the repo, and the "set your
- * key once" steps for those hosts. Source cues and precedence come from
- * instrumentation/agents/setup-cli/lib/hosting.mjs. Environment variables of
- * this computer are never used: the CLI runs on a laptop, not on the host.
+ * key once" steps for those hosts. Environment variables of this computer
+ * are never used: the CLI runs on a laptop, not on the host.
  */
-import { DOCS_URL, HOSTS, SETTINGS_FILE, SETTINGS_FILE_LOADERS } from './contract.mjs'
+import { APP_SERVICE_SLOTS, DEPLOY_CHECKS, DOCS_URL, EXAMPLE_NAMES, EXAMPLE_SERVICE, FUNCTIONS, GITHUB_JOBS, HOSTS, SECRET, SETTINGS, SETTINGS_FILE, SETTINGS_FILE_LOADERS,
+  acaKeyScript, appServiceKeyScript, appServiceSlotScript, functionsKeyScript, githubKeyStep, githubSecretCommands } from './contract.mjs'
 
 const MAX_BYTES = 262144
-const RUNTIME = ['azure-container-apps', 'azure-app-service', 'aws-ecs', 'kubernetes', 'alibaba-sae', 'vm-docker']
-/** hosting.mjs adapter ids -> docs host ids. */
-const DOCS_ID = { 'azure-aca': 'azure-container-apps', 'azure-app-service': 'azure-app-service', 'aws-ecs': 'aws-ecs',
+const RUNTIME = ['azure-container-apps', 'azure-app-service', 'azure-functions', 'aws-ecs', 'kubernetes', 'alibaba-sae', 'vm-docker']
+/** Adapter ids -> docs host ids. */
+const DOCS_ID = { 'azure-aca': 'azure-container-apps', 'azure-app-service': 'azure-app-service', 'azure-functions': 'azure-functions', 'aws-ecs': 'aws-ecs',
   kubernetes: 'kubernetes', 'alibaba-ack': 'kubernetes',
   'alibaba-sae': 'alibaba-sae', 'alibaba-ecs': 'vm-docker', vm: 'vm-docker', docker: 'vm-docker' }
 
@@ -22,7 +22,7 @@ const SCRIPT = /\.(?:ya?ml|sh|ps1)$/
 const TF = /\.tf$/
 const API = /^[ \t]*apiVersion[ \t]*:/m
 const WORKFLOW = /^(?:\.\.\/)*\.github\/workflows\/[^/]+\.ya?ml$/
-const DEPLOY_CUE = /deploy(?![._-]?tests?\b)|kubectl|containerapp|webapp|docker push|aliyun|aws ecs|helm upgrade/i
+const DEPLOY_CUE = /deploy(?![._-]?tests?\b)|kubectl|containerapp|webapp|functionapp|docker push|aliyun|aws ecs|helm upgrade/i
 /** An ECS task definition file: a JSON file with containerDefinitions. */
 const TASK_DEF = /(?:^|\/)[^/]*task[-_.]?def(?:inition)?[^/]*\.json$/i
 
@@ -45,6 +45,14 @@ const RULES = [
   ['azure-app-service', 'Azure App Service deploy action', null, /azure\/webapps-deploy@/],
   ['azure-app-service', 'azure.yaml deploys to App Service', /(?:^|\/)azure\.ya?ml$/, /^[ \t]*host[ \t]*:[ \t]*['"]?appservice\b/m],
   ['azure-app-service', 'Deploy step runs az webapp', SCRIPT, /\baz[ \t]+webapp[ \t]+(?:create|up|deploy|config[ \t]+(?:container|appsettings))\b/],
+  // Azure Functions: not a host of the docs page yet (FUNCTIONS in the contract). host.json with version 2.0 is the
+  // project file of a Functions app.
+  ['azure-functions', 'Azure Functions in Terraform', TF, /\bresource\s+"azurerm_(?:linux_|windows_)?function_app(?:_flex_consumption)?"\s+"[^"\r\n]+"/],
+  ['azure-functions', 'Azure Functions in Bicep or ARM', null, /\bkind['"]?\s*:\s*['"]functionapp/i, /Microsoft\.Web\/sites(?:@|["'\s])/],
+  ['azure-functions', 'Azure Functions deploy action', null, /\bAzure\/functions-action@/i],
+  ['azure-functions', 'Deploy step runs az functionapp', SCRIPT, /\baz[ \t]+functionapp[ \t]+(?:create|deployment|config|update|deploy)\b/],
+  ['azure-functions', 'azure.yaml deploys to Azure Functions', /(?:^|\/)azure\.ya?ml$/, /^[ \t]*host[ \t]*:[ \t]*['"]?function\b/m],
+  ['azure-functions', 'host.json of an Azure Functions app', /(?:^|\/)host\.json$/, /"version"\s*:\s*"2\.0"/],
   ['aws-ecs', 'AWS ECS in Terraform', TF, /\bresource\s+"aws_ecs_(?:service|task_definition)"\s+"[^"\r\n]+"/],
   ['aws-ecs', 'AWS ECS in CloudFormation or CDK output', null, /\bAWS::ECS::(?:TaskDefinition|Service)\b/],
   ['aws-ecs', 'ECS task definition', TASK_DEF, /"containerDefinitions"\s*:/],
@@ -59,8 +67,31 @@ const RULES = [
   ['alibaba-sae', 'Deploy step runs aliyun sae', SCRIPT, /\baliyun[ \t]+sae\b/],
 ]
 
+/**
+ * The checks of install.ts HOSTS[].checks, and the deploy files that select them: [check id, host id, the evidence
+ * (RULES text) of the files to read, the line that selects the check, the snippet languages to print]. A check
+ * with no evidence is printed for every repo with that host. The texts come from install.ts.
+ */
+const CHECKS = [
+  ['replace-env-vars', 'azure-container-apps', ['Deploy step runs az containerapp'], /--replace-env-vars\b/],
+  ['deploy-action-env', 'azure-container-apps', ['Azure Container Apps deploy action'], /^[ \t]*environmentVariables[ \t]*:/m],
+  ['deploy-action-yaml', 'azure-container-apps', ['Azure Container Apps deploy action'], /^[ \t]*yamlConfigPath[ \t]*:/m],
+  ['template', 'azure-container-apps', ['Azure Container App in Bicep or ARM'], /Microsoft\.App\/containerApps(?:@|["'\s])/, ['bicep']],
+  ['template', 'azure-container-apps', ['Azure Container App in Terraform'], /\bresource\s+"azurerm_container_app"/, ['hcl']],
+  // lifecycle ignore_changes on the env or the secrets: terraform apply keeps what az sets, so the template check does not apply to that file.
+  // The list on 1 line (with [0] indexes in it), or over several lines up to its closing ] line.
+  ['template-ignored', 'azure-container-apps', ['Azure Container App in Terraform'],
+    /\bignore_changes\s*=\s*\[(?:[^\n\]]*(?:\[[^\n\]]*\][^\n\]]*)*\b(?:env|secret)\b|[ \t]*\n(?:(?!\n\s*\])[\s\S]){0,400}?\b(?:env|secret)\b)/],
+  ['secret-first', 'azure-container-apps', null],
+  ['slot', 'azure-app-service', ['Azure App Service deploy action'], /^[ \t]*slot-name[ \t]*:[ \t]*\S/m],
+  ['slot', 'azure-app-service', ['Deploy step runs az webapp'], /\baz[ \t]+webapp\b[^\n]*(?:\\\n[^\n]*)*?[ \t]--slot(?:[ \t=]|$)/m],
+  ['task-definition', 'aws-ecs', ['ECS task definition'], /"containerDefinitions"\s*:/],
+  ['optional', 'kubernetes', null],
+  ['guard', 'github-actions', null],
+]
+
 const deployFile = (path) => DOCKERFILE.test(path) || /\.(?:ya?ml|tf|bicep|service|sh|ps1)$/.test(path) || TASK_DEF.test(path)
-  || /(?:^|\/)(?:containerapp|azure-container-app|azuredeploy|template|ecs|ack|sae|webapp|appservice)\.json$/.test(path)
+  || /(?:^|\/)(?:containerapp|azure-container-app|azuredeploy|template|ecs|ack|sae|webapp|appservice|host)\.json$/.test(path)
 
 /**
  * Where the app runs, from deploy files in the repo.
@@ -105,22 +136,51 @@ export function detectHosts(ws) {
 }
 
 /**
- * The 'set your key once' steps for the detected hosts, from contract HOSTS.
- * envFile: true when a service got otel.env, so the steps also say how to load it.
+ * The 'set your key once' steps for the detected hosts, from contract HOSTS. After the steps of each host, the
+ * checks for the deploy files of the repo (HOSTS[].checks), with the file and line that selected each one.
  * Fields are read defensively: the docs file keeps changing.
+ *
+ * options (all optional):
+ *   envFile   a service got otel.env and no repo file loads it, so the steps also say how to load it.
+ *   otelEnv   a service keeps its settings in otel.env. Without it, the VM and Docker steps leave out otel.env.
+ *   docker    every service starts from a Dockerfile: the VM and Docker steps are the key file and docker run only.
+ *   view      reads the evidence files. Without it, only the checks that need no file are printed, and no names.
+ *   names     deployNames(): the app names, resource groups, slots and GitHub jobs that the deploy files hold.
+ *   repo      the GitHub repo, as owner/name, for the gh commands.
+ *   service   the name of the 1 service of this run, for the container name in the YAML, Bicep and Terraform examples.
+ *   settings  the settings of this run, as [name, value] pairs, so "the 5 settings" and the Kubernetes snippets fit.
+ *   startLine true when the stack of the run needs its start line on the platform (Python and .NET).
+ *   secretName the variable that holds the key: OTEL_EXPORTER_OTLP_TRACES_HEADERS for apps that keep their own metrics and logs.
  * @param {import('./types.mjs').Host[]} hosts
- * @param {{envFile?: boolean}} [options]
  * @returns {import('./types.mjs').Block[]}
  */
 export function keySteps(hosts, options = {}) {
-  const ids = [...new Set((Array.isArray(hosts) ? hosts : []).map((h) => h?.id))]
+  const list = (Array.isArray(hosts) ? hosts : []).filter((h) => h && typeof h === 'object')
+  const ids = [...new Set(list.map((h) => h.id))]
+  const names = options.names ?? emptyNames()
+  const count = options.settings?.length ?? SETTINGS.length
   const blocks = []
+  const runtimes = ids.filter((id) => id !== 'github-actions')
   for (const id of ids) {
+    if (id === 'azure-functions') {
+      const fn = scriptNames(names.functions ?? { apps: [], groups: [] })
+      blocks.push({ title: FUNCTIONS.key.title, lines: [...FUNCTIONS.key.lines], snippets: [{ caption: 'Set the key on your function apps', language: 'bash', code: functionsKeyScript(fn) }] })
+      continue
+    }
+    // A function app keeps its app settings when new code is deployed: the key needs no step in the workflow.
+    if (id === 'github-actions' && runtimes.length && runtimes.every((r) => r === 'azure-functions')) continue
     const host = (Array.isArray(HOSTS) ? HOSTS : []).find((h) => h?.id === id)
     if (!host) continue
-    const lines = [...strings(host.steps), ...strings(host.notes)]
+    let lines = [...strings(host.steps), ...strings(host.notes)]
+    let code = snippets(host.snippets)
     if (typeof host.stricter?.title === 'string') lines.push(`${host.stricter.title}. See ${DOCS_URL}.`)
-    blocks.push({ title: `Set your key once: ${host.label ?? id}`, lines, snippets: snippets(host.snippets) })
+    const fitted = fit(id, lines, code, { ...options, names })
+    lines = fitted.lines.map((line) => line.replace(/\bthe 5 settings\b/g, `the ${count} settings`).replace(/\bThe 5 settings\b/g, `The ${count} settings`))
+    code = fitted.snippets.map((x) => ({ ...x, caption: x.caption.replace(/\b5 settings\b/g, `${count} settings`) }))
+    blocks.push({ title: `Set your key once: ${host.label ?? id}`, lines, snippets: code })
+    const checks = hostChecks(host, list.filter((h) => h.id === id).flatMap((h) => h.evidence ?? []), options.view)
+    if (checks.lines.length) blocks.push({ title: `${DEPLOY_CHECKS.title}: ${host.label ?? id}`, ...checks })
+    if (id === 'azure-app-service') blocks.push(...slotBlocks(names))
   }
   if (options.envFile) {
     const loaders = (Array.isArray(SETTINGS_FILE_LOADERS) ? SETTINGS_FILE_LOADERS : [])
@@ -129,9 +189,454 @@ export function keySteps(hosts, options = {}) {
       lines: loaders.filter((l) => l.summary).map((l) => `${l.label ?? l.id}: ${l.summary}`),
       snippets: snippets(loaders.map((l) => l.snippet)) })
   }
-  return blocks
+  // Apps that keep their own OTLP metrics and logs get the key in the traces-only variable (settings.mjs).
+  const secret = options.secretName ?? SECRET.name
+  if (secret === SECRET.name) return blocks
+  const rename = (text) => text.split(SECRET.name).join(secret)
+  return blocks.map((b) => ({ ...b, title: rename(b.title), lines: b.lines.map(rename), snippets: (b.snippets ?? []).map((x) => ({ ...x, caption: rename(x.caption), code: rename(x.code) })) }))
+}
+
+/** The steps and snippets of 1 host, fitted to this repo: its names, its settings and how its apps start. */
+function fit(id, lines, code, options) {
+  const { names, repo, service, settings } = options
+  const container = (text) => (service ? text.split(EXAMPLE_SERVICE).join(service) : text)
+  if (id === 'azure-container-apps') {
+    const aca = scriptNames(names.aca)
+    code = code.map((x, i) => (i === 0 ? { ...x, code: acaKeyScript(aca) } : { ...x, code: container(x.code) }))
+    if (names.aca.apps.length) lines = lines.map((l) => (/^Set SUBSCRIPTION, RESOURCE_GROUP and APPS/.test(l) ? `${l} The script lists the apps that your deploy files name.` : l))
+  } else if (id === 'azure-app-service') {
+    const web = scriptNames(names.webapp)
+    code = code.map((x, i) => (i === 0 ? { ...x, code: appServiceKeyScript(web) } : x))
+    // The start line goes on App Service only for a stack that has one (Python, .NET).
+    lines = lines.filter((l) => options.startLine !== false || !/^For Python and \.NET, put the start line/.test(l))
+    if (names.webapp.slots.length) lines = lines.filter((l) => !/^If you swap a deployment slot/.test(l))
+  } else if (id === 'github-actions') return github(lines, code, options)
+  else if (id === 'kubernetes' && settings?.length) {
+    // The settings of this run, not the 5 of the page: an app with OpenTelemetry keeps its metrics and logs.
+    code = code.map((x) => (/settings in your deployment/.test(x.caption) ? { ...x, code: k8sEnv(x.code, settings, 10) }
+      : /^Helm/.test(x.caption) ? { ...x, code: helmEnv(x.code, settings) } : { ...x, code: container(x.code) }))
+  } else if (id === 'vm-docker') {
+    // otel.env only when a service keeps its settings there. systemd only when a service does not start from a Dockerfile.
+    const settingsFile = (t) => t.includes(SETTINGS_FILE.path)
+    const systemd = (t) => /systemd|EnvironmentFile|daemon-reload/.test(t)
+    lines = lines.filter((l) => (options.otelEnv || !settingsFile(l)) && (!options.docker || !systemd(l)))
+    code = code.filter((x) => !options.docker || !systemd(`${x.caption}\n${x.code}`))
+      .map((x) => ({ ...x, code: container(options.otelEnv ? x.code : x.code.split('\n').filter((l, i, all) => !settingsFile(l)
+        && !(settingsFile(all[i + 1] ?? '') && /^#/.test(l))).join('\n')) }))
+  } else code = code.map((x) => ({ ...x, code: container(x.code) }))
+  if (repo) lines = lines.map((l) => l.split(EXAMPLE_NAMES.repo).join(repo))
+  return { lines, snippets: code }
+}
+
+/** The GitHub Actions steps with the environments of the deploy jobs, the repo and the app names of this repo. */
+function github(lines, code, { names, repo }) {
+  const jobs = names.jobs ?? []
+  const where = (j) => `${j.file} line ${j.line}`
+  // A job with environment: ${{ inputs.X }} deploys to the values that the deploy files give X.
+  const dynamic = (j) => Boolean(j.environment?.includes('$'))
+  const envs = [...new Set(jobs.flatMap((j) => (!j.environment ? [] : dynamic(j) ? (j.environments ?? []).map((e) => e.name) : [j.environment])))]
+  const none = jobs.filter((j) => !j.environment)
+  const slug = repo ?? EXAMPLE_NAMES.repo
+  const aca = names.aca.apps[0]?.name, group = names.aca.groups[0]?.name
+  const found = jobs.map((j) => (dynamic(j) ? dynamicJob(j, where(j))
+    : (j.environment ? GITHUB_JOBS.found : GITHUB_JOBS.none).replace('{where}', where(j)).replace('{job}', j.job).replace('{environment}', j.environment)))
+  const noEnvNote = lines.find((l) => /^A job can read an environment secret only/.test(l))
+  // Every deploy job has no environment: line, so the key is a repository secret and no environment name applies.
+  // A job whose environment is a ${{ }} value still reads an environment secret.
+  const repoSecretOnly = jobs.length > 0 && none.length === jobs.length
+  lines = lines.flatMap((l) => {
+    if (l === noEnvNote) return !jobs.length || none.length > 0 ? [l.split(EXAMPLE_NAMES.repo).join(slug)] : []
+    // "Replace <repo> with your repo, and <environment> with the environment: name of your deploy job. Never rename ...":
+    // only the names that are still examples.
+    const replace = /^Replace (\S+ with your repo), and (\S+ with the environment: name of your deploy job)\. (.+)$/.exec(l)
+    if (replace) {
+      const ask = [repo ? null : replace[1], envs.length || repoSecretOnly ? null : replace[2]].filter(Boolean)
+      const head = ask.length ? `Replace ${ask.join(', and ')}.` : null
+      return repoSecretOnly ? [head].filter(Boolean) : [[head, replace[3]].filter(Boolean).join(' ')]
+    }
+    // "Each environment has its own key. gh secret set UKNOWS_KEY --env <environment> sets the key for <environment> only. For staging, ...":
+    // the environments of the deploy jobs. No line when no job has one.
+    const each = /^(Each environment has its own key\. gh secret set UKNOWS_KEY --env )(\S+)( sets the key for )\2( only\.)( For (\S+), run it again with --env \6 and the \6 key\.)$/.exec(l)
+    if (each) {
+      if (repoSecretOnly) return []
+      if (!envs.length) return [l]
+      const [first, second] = envs
+      return [`${each[1]}${first}${each[3]}${first}${each[4]}${second ? each[5].split(each[6]).join(second) : ''}`]
+    }
+    // "In the example, replace <resource group> and <app> with your resource group and app.": only the names still examples.
+    const example = /^In the example, replace (\S+) and (\S+) with your (resource group) and (app)\.$/.exec(l)
+    if (example) {
+      if (aca && group) return []
+      if (aca || group) return [`In the example, replace ${aca ? example[1] : example[2]} with your ${aca ? example[3] : example[4]}.`]
+      return [l]
+    }
+    // A repository secret holds 1 key: it is run once, not once for each environment.
+    if (repoSecretOnly && /^Run the command once for each GitHub environment that your deploy jobs use\. Paste the key of that environment when it asks\./.test(l)) {
+      return [l.replace(/^.*?when it asks\./, 'Run the command once. Paste the key of the UKNOWS environment that this repo deploys to when it asks.')]
+    }
+    if (repo && /--repos /.test(l)) return [l.replace(/--repos \S+ /, `--repos ${repo.split('/')[1]} `)]
+    // The key step names 1 app. Deploy files that name more get 1 step for each app (review 2 of the installer, F2).
+    const apps = [...new Set(names.aca.apps.map((a) => a.name))]
+    if (/^Add the step below to each deploy job/.test(l) && apps.length > 1) {
+      return [l, `Your deploy files name ${apps.length} container apps, ${apps.slice(0, -1).join(', ')} and ${apps.at(-1)}. The step below sets the key on ${aca}. Add 1 step for each app, with its own APP and RESOURCE_GROUP.`]
+    }
+    return [l.split(EXAMPLE_NAMES.repo).join(slug)]
+  })
+  const secret = [envs.length ? githubSecretCommands(envs, slug) : !none.length ? githubSecretCommands(undefined, slug) : null,
+    none.length ? `# For a deploy job with no environment: line, a repository secret:\ngh secret set UKNOWS_KEY --repo ${slug}` : null].filter(Boolean).join('\n')
+  // The job of the key step: the first job with an environment: line, as it is written (staging, or ${{ inputs.environment }}).
+  const first = jobs.find((j) => j.environment)
+  code = code.map((x, i) => (i === 0 ? { ...x, code: secret }
+    : i === 1 ? { ...x, code: githubKeyStep({ environment: first ? first.environment : none.length ? null : undefined, resourceGroup: group, app: aca }) }
+      : { ...x, code: repo ? x.code.split(EXAMPLE_NAMES.org).join(repo.split('/')[0]) : x.code }))
+  return { lines: [...found, ...lines], snippets: code }
+}
+
+/** What a deploy job with environment: ${{ inputs.X }} deploys to: the workflows that call it and the choices of its own input. */
+function dynamicJob(job, at) {
+  const head = `${at}: the deploy job ${job.job} has environment: ${job.environment}.`
+  const from = job.environments ?? []
+  if (!from.length) return `${head} This tool cannot tell which environments that is. Set the key for each environment that this job deploys to.`
+  const said = [...new Set(from.map((e) => e.where))].map((w) => {
+    const here = from.filter((e) => e.where === w)
+    const list = here.map((e) => e.name)
+    const or = list.length > 1 ? `${list.slice(0, -1).join(', ')} or ${list.at(-1)}` : list[0]
+    return here[0].how === 'call' ? `${w} sets it to ${or}.` : `${w} lets you pick ${or}.`
+  })
+  return `${head} ${said.join(' ')} Set the key for each of these environments.`
+}
+
+/**
+ * The App Service slot block: both slots get the key as a slot setting, with 1 script each. A slot that only a workflow
+ * input or variable holds keeps an example SLOT that the script says to replace.
+ */
+function slotBlocks(names) {
+  const slot = names.webapp.slots[0]
+  if (!slot) return []
+  const app = names.webapp.apps[0]
+  const base = scriptNames(names.webapp, true)
+  const unknown = slot.name === null
+  const values = { app: app?.name ?? 'your web app', slot: unknown ? slot.raw : slot.name, where: slot.where }
+  const fill = (t) => t.replace(/\{(\w+)\}/g, (m, k) => (k in values ? values[k] : m))
+  return [{ title: fill(APP_SERVICE_SLOTS.title), lines: APP_SERVICE_SLOTS.lines.map(fill), snippets: [
+    { caption: 'The production slot', language: 'bash', code: appServiceSlotScript({ ...base, slot: undefined }) },
+    { caption: unknown ? 'The deployment slot' : `The ${slot.name} slot`, language: 'bash',
+      code: appServiceSlotScript({ ...base, slot: values.slot, ...(unknown ? { slotUnknown: true } : {}), from: { ...base.from, slot: slot.where } }) },
+  ] }]
+}
+
+/** The ScriptNames for the builders of install.ts: the names found, or none, so the examples stay with their comment. */
+function scriptNames(found, one = false) {
+  const apps = found.apps.map((a) => a.name)
+  const group = found.groups.length === 1 || new Set(found.groups.map((g) => g.name)).size === 1 ? found.groups[0] : null
+  const out = { from: {} }
+  if (apps.length) { out.apps = apps.join(' '); out.app = apps[0]; out.from.apps = joinAnd([...new Set(found.apps.map((a) => a.where))]); out.from.app = found.apps[0].where }
+  if (group) { out.resourceGroup = group.name; out.from.resourceGroup = group.where }
+  if (one) delete out.apps
+  return out
+}
+
+const emptyNames = () => ({ aca: { apps: [], groups: [] }, webapp: { apps: [], groups: [], slots: [] }, functions: { apps: [], groups: [] }, jobs: [], code: [] })
+
+/** env list items for a Kubernetes container: the YAML of the docs snippet, with the settings of this run. */
+function k8sEnv(text, settings, indent) {
+  const head = text.split('\n').slice(0, text.split('\n').findIndex((l) => /^\s*env:\s*$/.test(l)) + 1)
+  const pad = ' '.repeat(indent + 2)
+  return [...head, ...settings.flatMap(([name, value]) => [`${' '.repeat(indent)}  - name: ${name}`, `${pad}  value: ${value}`])].join('\n')
+}
+
+function helmEnv(text, settings) {
+  const rows = text.split('\n')
+  const at = rows.findIndex((l) => /^env:\s*$/.test(l)), end = rows.findIndex((l, i) => i > at && /^\S/.test(l))
+  return [...rows.slice(0, at + 1), ...settings.flatMap(([name, value]) => [`  - name: ${name}`, `    value: ${value}`]), ...rows.slice(end)].join('\n')
 }
 
+/**
+ * The names that the deploy files of the repo hold, for the key steps: the container apps and web apps that an az
+ * command, a deploy action or a workflow variable names, their resource groups, the App Service slots, the deploy jobs
+ * of each GitHub workflow with their environment: line, and the App Service code deploys (deploys of a package, not
+ * an image) with their startup command. A value that only a workflow variable or secret holds (${{ vars.X }}) is unknown.
+ * A slot is null for the production slot; a slot that only an input or variable holds is kept as slotUnknown (code)
+ * or { name: null, raw } (webapp.slots). A job with environment: ${{ inputs.X }} gets environments: the values that the
+ * workflows calling it pass as X, and the options of its own workflow_dispatch choice input X.
+ * @param {Pick<import('./workspace.mjs').RepoView, 'read'|'stat'>} view
+ * @param {import('./types.mjs').Host[]} hosts
+ */
+export function deployNames(view, hosts) {
+  const out = emptyNames()
+  const add = (list, name, where) => { if (name && !list.some((x) => x.name === name)) list.push({ name, where }) }
+  const files = [...new Set((hosts ?? []).flatMap((h) => (h.evidence ?? []).map((e) => e.file)))].filter((f) => /\.(?:ya?ml|sh|ps1)$/.test(f))
+  const rowsOf = (file) => {
+    let body = null
+    try { body = (view.stat?.(file)?.size ?? 0) <= MAX_BYTES ? view.read(file) : null } catch { body = null }
+    return body ? body.split(/\r?\n/).map((l) => (/^\s*#/.test(l) ? '' : l)) : null
+  }
+  // The calls of reusable workflows, from every workflow of the repo: they give the environment: ${{ inputs.X }} of a job.
+  const workflows = new Map()
+  let listed = []
+  try { listed = view.files?.() ?? [] } catch { listed = [] }
+  for (const file of [...files, ...listed].filter((f) => WORKFLOW.test(f))) if (!workflows.has(file)) workflows.set(file, rowsOf(file))
+  const calls = [...workflows].flatMap(([file, rows]) => (rows ? workflowCalls(file, rows) : []))
+  for (const file of files) {
+    const rows = workflows.get(file) ?? rowsOf(file)
+    if (!rows) continue
+    const vars = new Map()
+    for (const l of rows) {
+      const m = /^\s*([A-Z][A-Z0-9_]*)\s*:\s*(.+?)\s*$/.exec(l) ?? /^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)=(\S+)\s*$/.exec(l)
+      if (m && !vars.has(m[1])) vars.set(m[1], m[2].replace(/\s+#.*$/, ''))
+    }
+    const value = (raw) => {
+      let v = String(raw ?? '').trim().replace(/^["']|["']$/g, '')
+      for (let hop = 0; hop < 3; hop++) {
+        const ref = /^\$\{\{\s*env\.([A-Za-z_]\w*)\s*\}\}$/.exec(v) ?? /^\$\{?([A-Za-z_]\w*)\}?$/.exec(v)
+        if (!ref) break
+        v = String(vars.get(ref[1]) ?? '').replace(/^["']|["']$/g, '')
+      }
+      return /^[A-Za-z0-9][\w.-]{0,79}$/.test(v) ? v : null
+    }
+    // The slot of an App Service command or deploy step. The production slot is no slot: none, an empty one, or one named
+    // production (the portal template writes slot-name: 'Production'). unknown: the text of a slot that only a workflow
+    // input or variable holds.
+    const slotOf = (raw) => {
+      const text = String(raw ?? '').trim().replace(/^["']|["']$/g, '').trim()
+      if (!text) return { slot: null, unknown: null }
+      const v = value(text)
+      if (v) return { slot: v.toLowerCase() === 'production' ? null : v, unknown: null }
+      return { slot: null, unknown: text }
+    }
+    const addSlot = (raw, where) => {
+      const { slot, unknown } = slotOf(raw)
+      if (slot) add(out.webapp.slots, slot, where)
+      else if (unknown && !out.webapp.slots.some((s) => s.raw === unknown)) out.webapp.slots.push({ name: null, raw: unknown, where })
+    }
+    const code = (entry, raw) => {
+      const { slot, unknown } = slotOf(raw)
+      out.code.push({ ...entry, slot, ...(unknown ? { slotUnknown: unknown } : {}) })
+    }
+    // Logical lines: a command over several lines (\ at the end) counts as 1, at the line where it starts.
+    const logical = []
+    for (let i = 0; i < rows.length; i++) {
+      let text = rows[i], j = i
+      while (/\\\s*$/.test(text) && j + 1 < rows.length) text = text.replace(/\\\s*$/, ' ') + rows[++j]
+      logical.push({ text, line: i + 1 })
+      i = j
+    }
+    const opt = (text, re) => re.exec(text)?.[1] ?? null
+    for (const { text, line } of logical) {
+      const where = `${file} line ${line}`
+      const az = /\baz\s+(containerapp|webapp|functionapp)\b(.*)$/.exec(text)
+      if (az) {
+        const target = az[1] === 'containerapp' ? out.aca : az[1] === 'functionapp' ? out.functions : out.webapp
+        add(target.apps, value(opt(az[2], /(?:^|\s)(?:--name|-n)[\s=]+("[^"]*"|'[^']*'|\S+)/)), where)
+        add(target.groups, value(opt(az[2], /(?:^|\s)(?:--resource-group|-g)[\s=]+("[^"]*"|'[^']*'|\S+)/)), where)
+        // The --slot of the command as written. slotOf() makes it null for the production slot.
+        const slot = az[1] === 'webapp' ? opt(az[2], /(?:^|\s)--slot[\s=]+("[^"]*"|'[^']*'|\S+)/) : null
+        if (az[1] === 'webapp') addSlot(slot, where)
+        const startup = /(?:^|\s)--startup-file[\s=]+("[^"]*"|'[^']*'|\S+)/.exec(az[2])
+        if (az[1] === 'webapp' && startup) code({ kind: 'startup', startup: startup[1].replace(/^["']|["']$/g, ''), where }, slot)
+        if (az[1] === 'webapp' && (/\bdeploy\b.*--src-(?:path|url)\b|\bdeployment\s+source\s+config-zip\b|\bup\b/.test(az[2]))) code({ kind: 'deploy', where }, slot)
+      }
+      const key = /^\s*(?:-\s+)?([\w-]+)\s*:\s*(.+?)\s*$/.exec(text)
+      if (key) {
+        if (key[1] === 'containerAppName') add(out.aca.apps, value(key[2]), where)
+        if (key[1] === 'resourceGroup') add(out.aca.groups, value(key[2]), where)
+        if (key[1] === 'app-name') add(out.webapp.apps, value(key[2]), where)
+        if (key[1] === 'slot-name') addSlot(key[2], where)
+      }
+    }
+    // azure/webapps-deploy with package: and no images: deploys code, not an image.
+    rows.forEach((l, i) => {
+      const uses = /^(\s*)(?:-\s+)?uses\s*:\s*azure\/webapps-deploy@/.exec(l)
+      if (!uses) return
+      const step = stepRows(rows, i)
+      const slot = step.map((r) => /^\s*slot-name\s*:\s*(.+?)\s*$/.exec(r)?.[1]).find(Boolean) ?? null
+      if (step.some((r) => /^\s*package\s*:/.test(r)) && !step.some((r) => /^\s*images\s*:/.test(r))) code({ kind: 'deploy', where: `${file} line ${i + 1}` }, slot)
+    })
+    if (WORKFLOW.test(file)) out.jobs.push(...deployJobs(file, rows))
+  }
+  // Known slots first, then the slots that only a workflow input or variable holds.
+  out.webapp.slots.sort((a, b) => (a.name === null) - (b.name === null))
+  // A job that only builds and pushes the image is not where the key goes, when another job deploys.
+  if (out.jobs.some((j) => !j.push)) out.jobs = out.jobs.filter((j) => !j.push)
+  // environment: ${{ inputs.X }}: the values that the workflows that call this one pass as X, and the options of a
+  // workflow_dispatch choice input X of the same workflow.
+  out.jobs = out.jobs.map(({ push, input, ...job }) => {
+    if (!input) return job
+    const own = job.file.replace(/^(?:\.\.\/)*/, '')
+    const environments = []
+    const put = (name, where, how) => { if (plainName(name) && !environments.some((e) => e.name === name && e.where === where)) environments.push({ name, where, how }) }
+    for (const call of calls.filter((c) => c.path === own)) {
+      const given = call.values.get(input)
+      if (given) put(given.value, `${call.file} line ${given.line}`, 'call')
+    }
+    for (const option of choices(workflows.get(job.file) ?? [], input)) put(option.name, `${job.file} line ${option.line}`, 'pick')
+    return { ...job, environments }
+  })
+  return out
+}
+
+/** The rows of the workflow step that row i is in: from its - line to the next - at the same indent or less. */
+function stepRows(rows, i) {
+  let start = i
+  while (start > 0 && !/^\s*-\s/.test(rows[start])) start--
+  const indent = /^\s*/.exec(rows[start])[0].length
+  let end = start + 1
+  while (end < rows.length && (!rows[end].trim() || /^\s*/.exec(rows[end])[0].length > indent)) end++
+  return rows.slice(start, end)
+}
+
+const indentOf = (line) => /^\s*/.exec(line)[0].length
+/** A ${{ ... }} expression. It names other jobs and steps, so it is never a deploy cue. */
+const EXPRESSION = /\$\{\{[^}]*\}\}/g
+/** A job id, a step name or a step id that says deploy: deploy-prod, Deploy the new image. Not deployment, nor deploy tests or a deploy summary. */
+const NAME_CUE = /(?:^|[^a-z])(?:re)?deploy(?:s|ing)?(?![a-z])(?![\s._-]*(?:tests?|summary|report|status|notes?)\b)/i
+/** az commands that only read an app: they deploy nothing. */
+const READ_ONLY_AZ = /\baz\s+(?:containerapp|webapp)\s+(?:(?:revision|replica|secret|env|ingress|logs?|config(?:\s+appsettings)?|deployment\s+slot)\s+)?(?:show|list|tail|browse)\b/g
+/** The input of an environment: ${{ inputs.X }} line. */
+const INPUT_REF = /^\$\{\{\s*(?:github\.event\.)?inputs\.([A-Za-z_][\w-]*)\s*\}\}$/
+const plainName = (text) => /^[A-Za-z0-9][\w.-]{0,79}$/.test(text)
+const unquote = (text) => String(text ?? '').replace(/\s+#.*$/, '').trim().replace(/^["']|["']$/g, '')
+
+/** The jobs of a workflow: id, 1-based line, the rows of the job, and the indent of its keys. */
+function jobBlocks(rows) {
+  const at = rows.findIndex((l) => /^jobs\s*:\s*$/.test(l))
+  if (at < 0) return []
+  let end = at + 1
+  while (end < rows.length && !/^\S/.test(rows[end] || ' ')) end++
+  const heads = []
+  for (let i = at + 1; i < end; i++) {
+    const m = /^( {1,8})([\w-]+)\s*:\s*$/.exec(rows[i])
+    if (m && (!heads.length || m[1].length === heads[0].indent)) heads.push({ job: m[2], line: i + 1, indent: m[1].length })
+  }
+  return heads.map((h, k) => {
+    const body = rows.slice(h.line, k + 1 < heads.length ? heads[k + 1].line - 1 : end)
+    const first = body.find((l) => l.trim())
+    return { ...h, body, pad: first ? indentOf(first) : h.indent + 2 }
+  })
+}
+
+/**
+ * 1 key of a job, such as steps: or environment:. head: its line, i: its index in the job rows, rows: the lines under it
+ * (a list may sit at the same indent as its key). null when the job has no such key.
+ */
+function jobKey(block, name) {
+  const i = block.body.findIndex((l) => indentOf(l) === block.pad && new RegExp(`^\\s*${name}\\s*:`).test(l))
+  if (i < 0) return null
+  let j = i + 1
+  while (j < block.body.length && (!block.body[j].trim() || indentOf(block.body[j]) > block.pad || (indentOf(block.body[j]) === block.pad && /^\s*-/.test(block.body[j])))) j++
+  return { i, head: block.body[i], rows: block.body.slice(i + 1, j) }
+}
+
+/**
+ * The jobs of 1 workflow that deploy, with their environment: value (null when none). A job deploys when its id says so
+ * (deploy-prod) or its steps do: a deploy command or action, or a step named Deploy. Echo lines, ${{ }} expressions and
+ * az commands that only read do not count, so a summary job that prints "Deployment Summary" deploys nothing.
+ * push: the only cue is docker push, which builds the image (deployNames drops such a job when another job deploys).
+ * input: the X of environment: ${{ inputs.X }}.
+ */
+function deployJobs(file, rows) {
+  const jobs = []
+  for (const block of jobBlocks(rows)) {
+    // A call of a reusable workflow (job-level uses:) has no steps. The jobs of the workflow it calls deploy.
+    if (jobKey(block, 'uses')) continue
+    const steps = (jobKey(block, 'steps')?.rows ?? []).map((l) => l.replace(EXPRESSION, ''))
+      .filter((l) => !/^\s*(?:-\s+)?(?:run\s*:\s*)?(?:echo|printf)\b/.test(l))
+    const named = (l) => /^\s*(?:-\s+)?(?:name|id)\s*:\s*(.*)$/.exec(l)?.[1]
+    const cue = (l) => (named(l) !== undefined ? NAME_CUE.test(named(l)) : DEPLOY_CUE.test(l.replace(READ_ONLY_AZ, '').replace(/\bdocker\s+push\b/gi, '')))
+    const strong = NAME_CUE.test(block.job) || steps.some(cue)
+    if (!strong && !steps.some((l) => named(l) === undefined && /\bdocker\s+push\b/i.test(l))) continue
+    const env = jobKey(block, 'environment')
+    let environment = env ? unquote(env.head.replace(/^\s*environment\s*:\s*/, '')) : null
+    if (environment === '') environment = unquote(env.rows.map((r) => /^\s*name\s*:\s*(.+?)\s*$/.exec(r)?.[1]).find(Boolean) ?? '') || null
+    const input = environment ? INPUT_REF.exec(environment)?.[1] : undefined
+    jobs.push({ file, job: block.job, line: block.line, environment, ...(strong ? {} : { push: true }), ...(input ? { input } : {}) })
+  }
+  return jobs
+}
+
+/** The jobs of 1 workflow that call a reusable workflow of this repo (uses: ./.github/workflows/x.yml), with their with: values. */
+function workflowCalls(file, rows) {
+  return jobBlocks(rows).flatMap((block) => {
+    const uses = jobKey(block, 'uses')
+    const path = uses && /^\s*uses\s*:\s*["']?\.\/(\S+?\.ya?ml)["']?\s*$/.exec(uses.head)?.[1]
+    if (!path) return []
+    const given = jobKey(block, 'with')
+    const values = new Map()
+    given?.rows.forEach((r, k) => {
+      const m = /^\s*([\w-]+)\s*:\s*(.+?)\s*$/.exec(r)
+      if (m && !values.has(m[1])) values.set(m[1], { value: unquote(m[2]), line: block.line + given.i + k + 2 })
+    })
+    return [{ file, path, values }]
+  })
+}
+
+/** The options of a workflow_dispatch choice input of 1 workflow, with the line of each: [{name, line}]. */
+function choices(rows, input) {
+  const at = rows.findIndex((l) => /^\s*workflow_dispatch\s*:\s*$/.test(l))
+  if (at < 0) return []
+  const base = indentOf(rows[at])
+  let end = at + 1
+  while (end < rows.length && (!rows[end].trim() || indentOf(rows[end]) > base)) end++
+  const inputs = rows.slice(at + 1, end).findIndex((l) => /^\s*inputs\s*:\s*$/.test(l))
+  if (inputs < 0) return []
+  const from = at + 1 + inputs
+  const head = rows.slice(from + 1, end).findIndex((l) => new RegExp(`^\\s*${input}\\s*:\\s*$`).test(l) && indentOf(l) > indentOf(rows[from]))
+  if (head < 0) return []
+  const i = from + 1 + head, pad = indentOf(rows[i])
+  let stop = i + 1
+  while (stop < end && (!rows[stop].trim() || indentOf(rows[stop]) > pad)) stop++
+  const block = rows.slice(i + 1, stop)
+  if (!block.some((l) => /^\s*type\s*:\s*["']?choice["']?\s*$/.test(l))) return []
+  const k = block.findIndex((l) => /^\s*options\s*:/.test(l))
+  if (k < 0) return []
+  const line = i + 1 + k + 1
+  const inline = /^\s*options\s*:\s*\[(.*)\]\s*$/.exec(block[k])
+  const names = inline ? inline[1].split(',').map(unquote)
+    : block.slice(k + 1).filter((l) => l.trim()).map((l) => /^\s*-\s*(.+?)\s*$/.exec(l)?.[1]).filter((v, n, all) => v !== undefined && all.slice(0, n).every((x) => x !== undefined)).map(unquote)
+  return names.filter(plainName).map((name) => ({ name, line }))
+}
+
+/**
+ * The checks of 1 host that the repo needs: each check of CHECKS whose deploy files the evidence names and whose
+ * line is in them, and each check that needs no file. 1 line per check, with the files and lines it found. A file
+ * with template-ignored (Terraform ignore_changes on the env or secrets) does not get the template check.
+ */
+function hostChecks(host, evidence, view) {
+  const texts = new Map((Array.isArray(host.checks) ? host.checks : []).filter((c) => typeof c?.text === 'string').map((c) => [c.id, c]))
+  const found = new Map(), languages = new Map()
+  for (const [id, hostId, what, re, langs = []] of CHECKS) {
+    if (hostId !== host.id || !texts.has(id)) continue
+    if (!what) { if (!found.has(id)) found.set(id, []); continue }
+    for (const file of [...new Set(evidence.filter((e) => what.includes(e.what)).map((e) => e.file))]) {
+      let body = null
+      try { body = view?.read(file) ?? null } catch { body = null }
+      const code = body?.replace(/^[ \t]*(?:#|\/\/).*$/gm, '')
+      if (!code || !re.test(code)) continue
+      // The line where the match ends, so a command over several lines points at its option.
+      const m = new RegExp(re.source, re.flags.replace('g', '')).exec(code)
+      const end = m.index + m[0].trimEnd().length
+      found.set(id, [...(found.get(id) ?? []), { file, at: `${file} line ${code.slice(0, end).split('\n').length}`, langs }])
+    }
+  }
+  const ignored = new Set((found.get('template-ignored') ?? []).map((x) => x.file))
+  if (ignored.size && found.has('template')) {
+    const left = found.get('template').filter((x) => !ignored.has(x.file))
+    if (left.length) found.set('template', left); else found.delete('template')
+  }
+  for (const [id, hits] of found) languages.set(id, hits.flatMap((x) => x.langs))
+  const lines = [], out = []
+  for (const [id, check] of texts) {
+    if (!found.has(id)) continue
+    const where = found.get(id).map((x) => x.at)
+    lines.push(where.length ? `${check.text} ${DEPLOY_CHECKS.found.replace('{where}', joinAnd([...new Set(where)]))}` : check.text)
+    const langs = languages.get(id) ?? []
+    out.push(...snippets(check.snippets).filter((x) => !langs.length || langs.includes(x.language)))
+  }
+  return { lines, snippets: out }
+}
+
+const joinAnd = (items) => (items.length > 1 ? `${items.slice(0, -1).join(', ')} and ${items.at(-1)}` : items.join(''))
+
 /** Deploy files before deploy steps (RULES order), then by path and line. */
 const rank = (e) => RULES.findIndex((rule) => rule[1] === e.what)
 const byStrength = (a, b) => rank(a) - rank(b) || (a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line)