@williamthorsen/nmr 0.51.0 → 0.52.0

package/.meta/changelog.json

@@ -1,4 +1,42 @@
 [
+  {
+    "version": "0.52.0",
+    "date": "2026-10-24",
+    "sections": [
+      {
+        "title": "🎉 Features",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)",
+            "hash": "15c0d637325fff429ceae5aa5ec6e0ee19741daa",
+            "entry": 1
+          },
+          {
+            "description": "Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)",
+            "hash": "b4ddac2c4954a882d6be05962f9709e323ac3ece",
+            "entry": 1
+          },
+          {
+            "description": "Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)",
+            "hash": "b4ddac2c4954a882d6be05962f9709e323ac3ece",
+            "entry": 2
+          }
+        ]
+      },
+      {
+        "title": "🐛 Bug fixes",
+        "audience": "all",
+        "items": [
+          {
+            "description": "Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)",
+            "hash": "5b694689a51679ddfbb04f65a88d0757ca310f3f",
+            "entry": 1
+          }
+        ]
+      }
+    ]
+  },
   {
     "version": "0.51.0",
     "date": "2026-10-24",

package/.readyup/kits/default.js

@@ -7646,6 +7646,7 @@ var TYPECHECK_STEP = { run: "typecheck", shouldDeclineArguments: true };
 var ROOT_TYPECHECK_STEP = { run: "root:typecheck", shouldDeclineArguments: true };
 var LINT_CHECK_STEP = { run: "lint:check", shouldRunInBackground: true };
 var LINT_STRICT_STEP = { run: "lint:strict", shouldRunInBackground: true };
+var LINT_WORKFLOWS_STEP = { run: "lint:workflows", shouldDeclineArguments: true };
 var workspaceScripts = {
   build: ["compile"],
   check: [LINT_CHECK_STEP, TYPECHECK_STEP, "fmt:check", "test"],
@@ -7678,8 +7679,8 @@ function buildRootScripts(workspaceGlobs) {
     "audit:dev": "pnpm exec v11y --dev",
     "audit:prod": "pnpm exec v11y --prod",
     build: ["-R build"],
-    check: [LINT_CHECK_STEP, TYPECHECK_STEP, "fmt:check", "test"],
-    "check:strict": [LINT_STRICT_STEP, TYPECHECK_STEP, "fmt:check", "test"],
+    check: [LINT_CHECK_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, "fmt:check", "test"],
+    "check:strict": [LINT_STRICT_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, "fmt:check", "test"],
     // Excludes the audit, which in CI has a workflow of its own. The narrowed check runs against the build, so
     // the build declines the arguments rather than being narrowed by them.
     ci: [{ run: "build", shouldDeclineArguments: true }, "check:strict"],
@@ -7691,11 +7692,12 @@ function buildRootScripts(workspaceGlobs) {
     lint: "eslint --fix .",
     "lint:check": "eslint .",
     "lint:strict": "strict-lint",
+    "lint:workflows": "nmr-actionlint",
     // The audit takes seconds and `ci` takes minutes, so the cheap gate fails first. The audit reads the
     // dependency tree, and an argument narrowing the code under test does not say anything about that tree.
     prepush: [{ run: "audit", shouldDeclineArguments: true }, "ci"],
     "report-overrides": "nmr-report-overrides",
-    "root:check": [ROOT_TYPECHECK_STEP, "fmt:check", "root:lint:check", "root:test"],
+    "root:check": [ROOT_TYPECHECK_STEP, "fmt:check", "root:lint:check", LINT_WORKFLOWS_STEP, "root:test"],
     "root:lint": `eslint --fix ${ignorePatterns}.`,
     "root:lint:check": `eslint ${ignorePatterns}.`,
     "root:lint:strict": `strict-lint ${ignorePatterns}.`,
@@ -9188,7 +9190,7 @@ function hasSupportedStrictLintVersion() {
   });
 }
 function getMinVersion() {
-  const pickedFields = { "version": "0.51.0" };
+  const pickedFields = { "version": "0.52.0" };
   if (typeof pickedFields["version"] !== "string") {
     throw new TypeError("nmr/package.json: 'version' must be a string");
   }

package/.readyup/manifest.json

@@ -24,7 +24,7 @@
           "checklist": "nmr",
           "checks": [
             "@williamthorsen/nmr in devDependencies",
-            "@williamthorsen/nmr >= 0.51.0",
+            "@williamthorsen/nmr >= 0.52.0",
             "pnpm-workspace.yaml exists",
             "catalogued dependencies use catalog:",
             "package.json has packageManager field",
@@ -201,7 +201,7 @@
           "path": "lib/workspace-build.ts"
         },
         {
-          "hash": "006bcdd5",
+          "hash": "0d9124f7",
           "kind": "inline",
           "path": "../package.json",
           "paths": [
@@ -224,7 +224,7 @@
           "path": "../src/config.ts"
         },
         {
-          "hash": "72ad1e0e",
+          "hash": "b8e98c81",
           "kind": "module",
           "path": "../src/default-scripts.ts"
         },
@@ -319,7 +319,7 @@
       "readyupVersion": "0.43.0",
       "source": "kits/default.ts",
       "sourceHash": "9fd61bf4",
-      "targetHash": "54da2b6a"
+      "targetHash": "547201fd"
     }
   ]
 }

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## 0.52.0 — 2026-10-24
+
+### 🎉 Features
+
+- Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)
+- Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)
+- Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)
+
 ## 0.51.0 — 2026-10-24
 
 ### 🎉 Features

package/README.md

@@ -5,12 +5,17 @@
 Context-aware script runner for pnpm monorepos. Includes an `nmr` (node-monorepo run) binary that provides centralized, consistent script execution across workspace packages and the monorepo root.
 
 <!-- section:release-notes -->
-## Release notes — v0.51.0 (2026-10-24)
+## Release notes — v0.52.0 (2026-10-24)
 
 ### 🎉 Features
 
-- Widens the optional `vitest` peer range of `@williamthorsen/nmr` from `>=4.0.0 <5` to `>=4.0.0 <6`, adding support for Vitest 5, under which a bare `vitest` started from a package without its own config needs `--config` naming the root's `vitest.config.*`. (#1100)
-- Adds the `nmr-vitest` command and runs every package-scope `test*` script through it; when the package directory does not contain a `vitest.config.*` or `vite.config.*`, `nmr-vitest` passes `--config` naming the `vitest.config.*` at the monorepo root, and otherwise passes its arguments to Vitest unchanged. (#1100)
+- Adds a 📡 glyph before the host name in the rich-output `nmr` verdicts that name a host, for a passed, failed, or recalled run, which leaves plain output and verdicts reading `on this tree` unchanged. (#1105)
+- Adds the root command `lint:workflows` and its `nmr-actionlint` bin, which lint `.github/workflows/` with actionlint 1.7.12, including its shellcheck pass over each `run:` block with shellcheck 0.11.0, using binaries that nmr downloads on first use, checks against pinned SHA-256 checksums, and caches under `node_modules/.cache/nmr-tools/`. (#1107)
+- Adds `lint:workflows` to the root `check`, `check:strict`, and `root:check` composites, which makes those composites and `nmr ci` fail on any actionlint finding in a repo that has workflows, need access to `github.com` on their first run, and fail on any platform other than macOS or Linux on x64 or arm64. (#1107)
+
+### 🐛 Bug fixes
+
+- Fixes the issue that a delegated `nmr` command could not find a bin that the branch added to a workspace package, because the host's `pnpm install --frozen-lockfile` did not link new bins when the lockfile was unchanged. (#1108)
 <!-- /section:release-notes -->
 
 ## Installation
@@ -57,7 +62,7 @@ From the monorepo root:
 ```bash
 nmr test    # Run root tests + recursive workspace tests
 nmr build   # Build all packages
-nmr ci      # Build, then run the strict checks
+nmr ci      # Build, then run the strict checks, workflow lint included
 nmr prepush # Run everything the remote runs, before a push
 ```
 
@@ -206,7 +211,7 @@ export default {
 
 ```console
 $ nmr --delegate-to imac2 ci
-✅ my-repo: ci: passed on imac2 in 1m 48s
+✅ my-repo: ci: passed on 📡 imac2 in 1m 48s
 ```
 
 A delegation consults the [check-result cache](#check-result-cache) first, so a tree that already passed is not sent to the host; a pass that a host earned does not satisfy a run here. A repo whose checks must run on the machine that has the tree declares `delegate: false` in its config. [Delegating to another machine](docs/delegate.md) covers the user config, `--delegate`, `NMR_DELEGATE`, the rules that decide where a command runs, which commands can be delegated, how nmr chooses among several hosts, how the cache is consulted, what the host runs, how failures are reported, and setting up the host.
@@ -317,7 +322,7 @@ rdy list --from npm:@williamthorsen/nmr  # what nmr publishes
 - [Machine lock](docs/machine-lock.md): Which commands wait for one another, where the lock lives, and bypassing it
 - [Delegating to another machine](docs/delegate.md): The user config, `--delegate`, `--delegate-to`, `NMR_DELEGATE`, where a command runs, choosing among several hosts, what the host runs, and setting it up
 - [Dependency upgrades](docs/upgrades.md): `nmr upgrade`, the upgrade policy, `report-catalog`, `report-overrides`, and `nmr-taze`
-- [Standalone utilities](docs/utilities.md): `nmr-clean`, `nmr-compile`, `nmr-fmt`, `nmr-vitest`, and `ensure-prepublish-hooks`
+- [Standalone utilities](docs/utilities.md): `nmr-actionlint`, `nmr-clean`, `nmr-compile`, `nmr-fmt`, `nmr-vitest`, and `ensure-prepublish-hooks`
 - [Shared Vitest config](docs/vitest.md): Test tiers, test selections, the conventions check, and customization
 - [Shared Prettier config](docs/prettier.md): What it formats and how to customize it
 - [Workspace introspection](docs/workspace.md): The two workspace lookups

package/bin/nmr-actionlint.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+try {
+  await import('../dist/esm/cli-actionlint.js');
+} catch (error) {
+  if (error.code === 'ERR_MODULE_NOT_FOUND') {
+    process.stderr.write('nmr-actionlint: build output not found; run `pnpm run bootstrap` first\n');
+  } else {
+    process.stderr.write(`nmr-actionlint: failed to load: ${error.message}\n`);
+  }
+  process.exit(1);
+}

package/dist/esm/check-cache.js

@@ -11,6 +11,7 @@ export const DEFAULT_CACHEABLE_COMMANDS = [
     'fmt:check',
     'lint:check',
     'lint:strict',
+    'lint:workflows',
     'root:check',
     'root:lint:check',
     'root:lint:strict',

package/dist/esm/cli-actionlint.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/cli-actionlint.js

@@ -0,0 +1,12 @@
+import process from 'node:process';
+import { reportError } from '@williamthorsen/nmr-core';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { runActionlint } from "./commands/actionlint.js";
+import { findMonorepoRoot } from "./workspace.js";
+try {
+    process.exitCode = await runActionlint(findMonorepoRoot(), process.argv.slice(2));
+}
+catch (error) {
+    reportError(describeError(error));
+    process.exitCode = 1;
+}

package/dist/esm/commands/actionlint.d.ts

@@ -0,0 +1,23 @@
+import { type WorkflowTool } from './workflow-tools.js';
+/** How a spawned actionlint ended. */
+export interface ActionlintOutcome {
+    error?: Error | undefined;
+    signal: NodeJS.Signals | null;
+    status: number | null;
+}
+export interface RunActionlintOptions {
+    /** Directory under which the pinned tools are cached; defaults to `node_modules/.cache/nmr-tools` at the root. */
+    cacheRoot?: string;
+    ensure?: (tool: WorkflowTool, cacheRoot: string) => Promise<string>;
+    spawn?: (file: string, args: string[], cwd: string) => ActionlintOutcome;
+}
+/**
+ * Lints the monorepo's GitHub Actions workflows with the pinned actionlint, running its shellcheck pass with the
+ * pinned shellcheck, and returns actionlint's exit status. A repo without a workflows directory passes.
+ */
+export declare function runActionlint(monorepoRoot: string, args: readonly string[], options?: RunActionlintOptions): Promise<number>;
+/**
+ * Builds actionlint's arguments. The pyflakes integration is disabled so that the result does not depend on whether
+ * the machine happens to have pyflakes on `PATH`.
+ */
+export declare function buildActionlintArgs(shellcheckPath: string, args: readonly string[]): string[];

package/dist/esm/commands/actionlint.js

@@ -0,0 +1,31 @@
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { describeSignalExitCode } from "../child-process.js";
+import { ensureTool } from "./workflow-tools.js";
+const WORKFLOWS_DIR = path.join('.github', 'workflows');
+export async function runActionlint(monorepoRoot, args, options = {}) {
+    if (!fs.existsSync(path.join(monorepoRoot, WORKFLOWS_DIR))) {
+        console.info(`No workflows to lint: ${WORKFLOWS_DIR}/ does not exist.`);
+        return 0;
+    }
+    const cacheRoot = options.cacheRoot ?? path.join(monorepoRoot, 'node_modules', '.cache', 'nmr-tools');
+    const ensure = options.ensure ?? ((tool, root) => ensureTool(tool, { cacheRoot: root }));
+    const actionlintPath = await ensure('actionlint', cacheRoot);
+    const shellcheckPath = await ensure('shellcheck', cacheRoot);
+    const outcome = (options.spawn ?? spawnInherited)(actionlintPath, buildActionlintArgs(shellcheckPath, args), monorepoRoot);
+    if (outcome.error !== undefined) {
+        throw new Error(`Cannot run actionlint: ${outcome.error.message}`, { cause: outcome.error });
+    }
+    if (outcome.signal !== null) {
+        return describeSignalExitCode(outcome.signal);
+    }
+    return outcome.status ?? 1;
+}
+export function buildActionlintArgs(shellcheckPath, args) {
+    return [`-shellcheck=${shellcheckPath}`, '-pyflakes=', ...args];
+}
+function spawnInherited(file, args, cwd) {
+    const result = spawnSync(file, args, { cwd, stdio: 'inherit' });
+    return { error: result.error, signal: result.signal, status: result.status };
+}

package/dist/esm/commands/workflow-tools.d.ts

@@ -0,0 +1,39 @@
+/** A program that `nmr-actionlint` downloads rather than takes from `PATH`. */
+export type WorkflowTool = 'actionlint' | 'shellcheck';
+/** A supported pair of `process.platform` and `process.arch`, joined by a hyphen. */
+export type ToolPlatform = 'darwin-arm64' | 'darwin-x64' | 'linux-arm64' | 'linux-x64';
+/** One release of a tool: where each platform's archive is, its SHA-256, and the binary's path inside it. */
+export interface ToolPin {
+    archiveMember: string;
+    assets: Record<ToolPlatform, {
+        sha256: string;
+        url: string;
+    }>;
+    version: string;
+}
+export type ToolPins = Record<WorkflowTool, ToolPin>;
+/** The subset of `fetch` that the download uses. */
+export type FetchFunction = (url: string, init?: RequestInit) => Promise<Response>;
+export interface EnsureToolOptions {
+    /** Directory under which each tool version is cached in a directory of its own. */
+    cacheRoot: string;
+    arch?: string;
+    fetch?: FetchFunction;
+    pins?: ToolPins;
+    platform?: NodeJS.Platform;
+}
+/**
+ * The pinned releases. To move a pin, change its version and URLs and take each SHA-256 from the release's `digest`
+ * as `gh api repos/{owner}/{repo}/releases/tags/{tag}` reports it, confirming actionlint's against the release's
+ * `checksums.txt`. The pins move only with a release of nmr.
+ */
+export declare const TOOL_PINS: ToolPins;
+/**
+ * Returns the path of the tool's pinned binary, downloading, verifying, and caching it first on a cache miss.
+ *
+ * A failure at any step leaves the cache without the tool, and a concurrent run never sees a partial binary: The
+ * binary is assembled in a scratch directory beside its target and renamed into place only once verified.
+ */
+export declare function ensureTool(tool: WorkflowTool, options: EnsureToolOptions): Promise<string>;
+/** Maps Node's platform and architecture onto a supported pair, rejecting every other pair. */
+export declare function resolveToolPlatform(platform: NodeJS.Platform, arch: string): ToolPlatform;

package/dist/esm/commands/workflow-tools.js

@@ -0,0 +1,140 @@
+import { spawnSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import process from 'node:process';
+import { describeError } from '@williamthorsen/toolbelt.errors';
+import { UserError } from "../UserError.js";
+const SUPPORTED_PLATFORMS = ['darwin-arm64', 'darwin-x64', 'linux-arm64', 'linux-x64'];
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+const ACTIONLINT_RELEASE = 'https://github.com/rhysd/actionlint/releases/download/v1.7.12';
+const SHELLCHECK_RELEASE = 'https://github.com/koalaman/shellcheck/releases/download/v0.11.0';
+export const TOOL_PINS = {
+    actionlint: {
+        archiveMember: 'actionlint',
+        assets: {
+            'darwin-arm64': {
+                sha256: 'aba9ced2dee8d27fecca3dc7feb1a7f9a52caefa1eb46f3271ea66b6e0e6953f',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_arm64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: '5b44c3bc2255115c9b69e30efc0fecdf498fdb63c5d58e17084fd5f16324c644',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_darwin_amd64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '325e971b6ba9bfa504672e29be93c24981eeb1c07576d730e9f7c8805afff0c6',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_arm64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8',
+                url: `${ACTIONLINT_RELEASE}/actionlint_1.7.12_linux_amd64.tar.gz`,
+            },
+        },
+        version: '1.7.12',
+    },
+    shellcheck: {
+        archiveMember: 'shellcheck-v0.11.0/shellcheck',
+        assets: {
+            'darwin-arm64': {
+                sha256: '339b930feb1ea764467013cc1f72d09cd6b869ebf1013296ba9055ab2ffbd26f',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.aarch64.tar.gz`,
+            },
+            'darwin-x64': {
+                sha256: 'c2c15e08df0e8fbc374c335b230a7ee958c313fa5714817a59aa59f1aa594f51',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.darwin.x86_64.tar.gz`,
+            },
+            'linux-arm64': {
+                sha256: '68a8133197a50beb8803f8d42f9908d1af1c5540d4bb05fdfca8c1fa47decefc',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.aarch64.tar.gz`,
+            },
+            'linux-x64': {
+                sha256: 'b7af85e41cc99489dcc21d66c6d5f3685138f06d34651e6d34b42ec6d54fe6f6',
+                url: `${SHELLCHECK_RELEASE}/shellcheck-v0.11.0.linux.x86_64.tar.gz`,
+            },
+        },
+        version: '0.11.0',
+    },
+};
+export async function ensureTool(tool, options) {
+    const pin = (options.pins ?? TOOL_PINS)[tool];
+    const asset = pin.assets[resolveToolPlatform(options.platform ?? process.platform, options.arch ?? process.arch)];
+    const targetDir = path.join(options.cacheRoot, `${tool}-${pin.version}`);
+    const binaryPath = path.join(targetDir, tool);
+    if (fs.existsSync(binaryPath)) {
+        return binaryPath;
+    }
+    createCacheRoot(options.cacheRoot);
+    const scratchDir = `${targetDir}.tmp-${process.pid}`;
+    fs.rmSync(scratchDir, { force: true, recursive: true });
+    fs.mkdirSync(scratchDir);
+    try {
+        const archive = await download(asset.url, options.fetch ?? globalThis.fetch);
+        const actualSha256 = createHash('sha256').update(archive).digest('hex');
+        if (actualSha256 !== asset.sha256) {
+            throw new Error(`Checksum mismatch for ${asset.url}: expected sha256 ${asset.sha256}, got ${actualSha256}`);
+        }
+        const archivePath = path.join(scratchDir, 'archive.tar.gz');
+        fs.writeFileSync(archivePath, archive);
+        const extractDir = path.join(scratchDir, 'extract');
+        fs.mkdirSync(extractDir);
+        extractMember(archivePath, extractDir, pin.archiveMember);
+        const stageDir = path.join(scratchDir, 'stage');
+        fs.mkdirSync(stageDir);
+        const stagedBinary = path.join(stageDir, tool);
+        fs.renameSync(path.join(extractDir, pin.archiveMember), stagedBinary);
+        fs.chmodSync(stagedBinary, 0o755);
+        publishStage(stageDir, targetDir, binaryPath);
+    }
+    finally {
+        fs.rmSync(scratchDir, { force: true, recursive: true });
+    }
+    return binaryPath;
+}
+export function resolveToolPlatform(platform, arch) {
+    const key = `${platform}-${arch}`;
+    const supported = SUPPORTED_PLATFORMS.find((candidate) => candidate === key);
+    if (supported === undefined) {
+        throw new UserError(`Workflow linting does not support ${key}; the supported platforms are ${SUPPORTED_PLATFORMS.join(', ')}`);
+    }
+    return supported;
+}
+function createCacheRoot(cacheRoot) {
+    try {
+        fs.mkdirSync(cacheRoot, { recursive: true });
+    }
+    catch (error) {
+        throw new Error(`Cannot create the tool cache at ${cacheRoot}`, { cause: error });
+    }
+}
+async function download(url, fetchImpl) {
+    let response;
+    try {
+        response = await fetchImpl(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+    }
+    catch (error) {
+        throw new Error(`Cannot download ${url}: ${describeError(error)}`, { cause: error });
+    }
+    if (!response.ok) {
+        throw new Error(`Cannot download ${url}: HTTP ${response.status}`);
+    }
+    return Buffer.from(await response.arrayBuffer());
+}
+function extractMember(archivePath, extractDir, member) {
+    const result = spawnSync('tar', ['-xzf', archivePath, '-C', extractDir, member], { encoding: 'utf8' });
+    if (result.error !== undefined) {
+        throw new Error(`Cannot run tar to extract ${member}: ${result.error.message}`, { cause: result.error });
+    }
+    if (result.status !== 0) {
+        throw new Error(`tar could not extract ${member} from ${archivePath}: ${result.stderr.trim()}`);
+    }
+}
+function publishStage(stageDir, targetDir, binaryPath) {
+    try {
+        fs.renameSync(stageDir, targetDir);
+    }
+    catch (error) {
+        if (!fs.existsSync(binaryPath)) {
+            throw error;
+        }
+    }
+}

package/dist/esm/default-scripts.js

@@ -4,6 +4,7 @@ const TYPECHECK_STEP = { run: 'typecheck', shouldDeclineArguments: true };
 const ROOT_TYPECHECK_STEP = { run: 'root:typecheck', shouldDeclineArguments: true };
 const LINT_CHECK_STEP = { run: 'lint:check', shouldRunInBackground: true };
 const LINT_STRICT_STEP = { run: 'lint:strict', shouldRunInBackground: true };
+const LINT_WORKFLOWS_STEP = { run: 'lint:workflows', shouldDeclineArguments: true };
 export const workspaceScripts = {
     build: ['compile'],
     check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
@@ -35,8 +36,8 @@ export function buildRootScripts(workspaceGlobs) {
         'audit:dev': 'pnpm exec v11y --dev',
         'audit:prod': 'pnpm exec v11y --prod',
         build: ['-R build'],
-        check: [LINT_CHECK_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
-        'check:strict': [LINT_STRICT_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        check: [LINT_CHECK_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
+        'check:strict': [LINT_STRICT_STEP, LINT_WORKFLOWS_STEP, TYPECHECK_STEP, 'fmt:check', 'test'],
         ci: [{ run: 'build', shouldDeclineArguments: true }, 'check:strict'],
         clean: 'nmr-clean',
         fix: ['lint', 'fmt'],
@@ -46,9 +47,10 @@ export function buildRootScripts(workspaceGlobs) {
         lint: 'eslint --fix .',
         'lint:check': 'eslint .',
         'lint:strict': 'strict-lint',
+        'lint:workflows': 'nmr-actionlint',
         prepush: [{ run: 'audit', shouldDeclineArguments: true }, 'ci'],
         'report-overrides': 'nmr-report-overrides',
-        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', 'root:test'],
+        'root:check': [ROOT_TYPECHECK_STEP, 'fmt:check', 'root:lint:check', LINT_WORKFLOWS_STEP, 'root:test'],
         'root:lint': `eslint --fix ${ignorePatterns}.`,
         'root:lint:check': `eslint ${ignorePatterns}.`,
         'root:lint:strict': `strict-lint ${ignorePatterns}.`,

package/dist/esm/glyphs.d.ts

@@ -5,5 +5,5 @@
  * `noop` is a neutral circle: Nothing ran because the repo asked for nothing to run, which is neither a
  * failure nor a block.
  */
-export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
+export declare const NMR_GLYPHS: Readonly<Record<"plain" | "rich", Readonly<Record<"overrides" | "clean" | "host" | "catalog" | "noop" | "package" | "recording", import("@williamthorsen/toolbelt.terminal/candidate").Glyph>>>>;
 export type NmrGlyphName = keyof (typeof NMR_GLYPHS)['rich'];

package/dist/esm/glyphs.js

@@ -2,6 +2,7 @@ import { defineGlyphSet } from '@williamthorsen/nmr-core';
 export const NMR_GLYPHS = defineGlyphSet({
     catalog: { plain: '', rich: '\u{1F4DA}' },
     clean: { plain: '', rich: '\u{1F9F9}' },
+    host: { plain: '', rich: '\u{1F4E1}' },
     noop: { plain: 'NOOP', rich: '\u{26AA}' },
     overrides: { plain: '', rich: '\u{1F512}' },
     package: { plain: '', rich: '\u{1F4E6}' },

package/dist/esm/remote-host-session.js

@@ -14,6 +14,8 @@ export function runHostSession(params) {
     const COMMAND_NOT_FOUND_EXIT_CODE = 127;
     const DELEGATION_FAILURE_EXIT_CODE = 255;
     const STOP_GRACE_MS = 5_000;
+    const NODE_MODULES_DIR = path.join(params.rootDir, 'node_modules');
+    const BINS_RECORD_PATH = path.join(NODE_MODULES_DIR, '.nmr-delegate-bins');
     const token = crypto.randomUUID();
     let isHolding = false;
     let activeChild;
@@ -36,6 +38,10 @@ export function runHostSession(params) {
                 return;
             }
         }
+        const binsFingerprint = readBinsFingerprint();
+        if (binsFingerprint === undefined || readBinsRecord() !== binsFingerprint) {
+            removeWorkspaceState();
+        }
         const install = await runPhase('pnpm', ['install', '--frozen-lockfile'], params.rootDir, {
             ...process.env,
             CI: 'true',
@@ -46,6 +52,8 @@ export function runHostSession(params) {
             fail('install', install);
             return;
         }
+        if (binsFingerprint !== undefined)
+            writeBinsRecord(binsFingerprint);
         emit({ kind: 'run' });
         fs.mkdirSync(params.runDir, { recursive: true });
         fs.mkdirSync(params.passManifestDir, { recursive: true });
@@ -146,6 +154,42 @@ export function runHostSession(params) {
             return true;
         return state.holder !== undefined && isProcessGone(state.holder.pid);
     }
+    function readBinsFingerprint() {
+        let listing;
+        try {
+            listing = childProcess.execFileSync('git', ['ls-files', '-z', '--', '*package.json'], {
+                cwd: params.rootDir,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+        }
+        catch {
+            return undefined;
+        }
+        const lines = listing
+            .split('\0')
+            .filter((file) => path.basename(file) === 'package.json')
+            .toSorted()
+            .map((file) => {
+            try {
+                const manifest = JSON.parse(fs.readFileSync(path.join(params.rootDir, file), 'utf8'));
+                const fields = typeof manifest === 'object' && manifest !== null ? { ...manifest } : {};
+                return JSON.stringify([file, fields['name'], fields['bin']]);
+            }
+            catch {
+                return JSON.stringify([file]);
+            }
+        });
+        return crypto.createHash('sha256').update(lines.join('\n')).digest('hex');
+    }
+    function readBinsRecord() {
+        try {
+            return fs.readFileSync(BINS_RECORD_PATH, 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+    }
     function readErrorCode(error) {
         return typeof error === 'object' && error !== null && 'code' in error ? error.code : undefined;
     }
@@ -218,6 +262,14 @@ export function runHostSession(params) {
             fs.rmSync(LOCK_PATH, { force: true });
         }
     }
+    function removeWorkspaceState() {
+        const names = fs.existsSync(NODE_MODULES_DIR) ? fs.readdirSync(NODE_MODULES_DIR) : [];
+        for (const name of names) {
+            if (name.startsWith('.pnpm-workspace-state') && name.endsWith('.json')) {
+                fs.rmSync(path.join(NODE_MODULES_DIR, name), { force: true });
+            }
+        }
+    }
     function runPhase(file, args, cwd, env) {
         const head = [];
         const tail = [];
@@ -274,4 +326,12 @@ export function runHostSession(params) {
         catch {
         }
     }
+    function writeBinsRecord(fingerprint) {
+        try {
+            fs.mkdirSync(NODE_MODULES_DIR, { recursive: true });
+            fs.writeFileSync(BINS_RECORD_PATH, fingerprint);
+        }
+        catch {
+        }
+    }
 }

package/dist/esm/verdict.js

@@ -23,7 +23,7 @@ const MIN_CUT_BYTES = Buffer.byteLength(TRUNCATION_MARK);
 const REPLAY_MARKER = 'replayed:';
 function describeOutcome(verdict, style) {
     const statuses = STATUS_GLYPHS[style];
-    const onHost = verdict.host === undefined ? '' : ` on ${verdict.host}`;
+    const onHost = verdict.host === undefined ? '' : ` on ${formatHost(verdict.host, style)}`;
     switch (verdict.outcome) {
         case 'passed':
             return { marker: statuses.passed.text, phrase: `passed${onHost} in ${formatDuration(verdict.durationMs)}` };
@@ -35,9 +35,10 @@ function describeOutcome(verdict, style) {
         case 'recalled': {
             const saving = formatSaving(verdict.savedMs);
             const savingClause = saving === undefined ? '' : `, ${saving}`;
+            const source = verdict.host === undefined ? 'this tree' : formatHost(verdict.host, style);
             return {
                 marker: statuses.skipped.text,
-                phrase: `passed ${formatDuration(verdict.ageMs)} ago on ${verdict.host ?? 'this tree'}${savingClause}`,
+                phrase: `passed ${formatDuration(verdict.ageMs)} ago on ${source}${savingClause}`,
             };
         }
         case 'no-op':
@@ -87,6 +88,10 @@ function findCutTarget(sizesBytes, longestSizeBytes, overrunBytes) {
 function isWithinBudget(renderedLine) {
     return Buffer.byteLength(renderedLine) <= LINE_BUDGET_BYTES;
 }
+function formatHost(host, style) {
+    const glyph = NMR_GLYPHS[style].host.text;
+    return glyph === '' ? host : `${glyph} ${host}`;
+}
 function readAttribution(verdict) {
     if (verdict.outcome !== 'recalled' || verdict.replay === undefined) {
         return [];

package/docs/check-cache.md

@@ -10,7 +10,7 @@ The cache is a working-tree cache, not a build cache: It answers "has this exact
 
 ## What is cached
 
-Cacheable by default: `check`, `check:strict`, `ci`, `fix:check`, `fmt:check`, `lint:check`, `lint:strict`, `test`, `test:coverage`, `test:tool`, `test:unit`, `typecheck`, and the `root:` variants `root:check`, `root:lint:check`, `root:lint:strict`, `root:test`, `root:test:tool`, `root:test:unit`, and `root:typecheck`.
+Cacheable by default: `check`, `check:strict`, `ci`, `fix:check`, `fmt:check`, `lint:check`, `lint:strict`, `lint:workflows`, `test`, `test:coverage`, `test:tool`, `test:unit`, `typecheck`, and the `root:` variants `root:check`, `root:lint:check`, `root:lint:strict`, `root:test`, `root:test:tool`, `root:test:unit`, and `root:typecheck`.
 
 Everything else runs every time:
 

package/docs/delegate.md

@@ -5,7 +5,7 @@ nmr runs a command on another machine over SSH, against the working tree on this
 ```console
 $ nmr --delegate-to imac2 ci
 # ... the host's own output and verdicts ...
-✅ my-repo: ci: passed on imac2 in 1m 48s
+✅ my-repo: ci: passed on 📡 imac2 in 1m 48s
 ```
 
 A machine that runs several worktrees' checks at once runs out of memory, and the [machine lock](machine-lock.md) protects it by making the checks wait for one another. Delegation moves a check to a machine that has the room for it instead. Which hosts a machine can reach is a fact about the machine, so a user config on the machine, not the repo, names them and turns delegation on.
@@ -61,7 +61,7 @@ With several hosts, nmr asks every host at once, with one `ssh` call each, wheth
 
 ```console
 $ NMR_DELEGATE=imac2,imac3 nmr ci
-✅ my-repo: ci: passed on imac3 in 1m 52s
+✅ my-repo: ci: passed on 📡 imac3 in 1m 52s
 ```
 
 - **A single host is not asked.** The delegation goes to it directly.
@@ -98,7 +98,7 @@ $ nmr --delegate-to imac2 ci
 
 nmr records the working tree as it is on disk as a commit: tracked changes, staged or not, and untracked files that git does not ignore. This is the tree that a local run checks. The commit is built in a temporary index, so the repository's index, refs, and stash do not change.
 
-nmr pushes the commit to a checkout on the host under `~/.cache/nmr/delegate/`, without running the repository's `pre-push` hook, then runs `pnpm install --frozen-lockfile` and the command from the directory that corresponds to the local one, with nmr's own flags as they were given. The host keeps one checkout for each repository on each machine that delegates to it, so concurrent delegations from different worktrees do not share one, and `node_modules` and build output persist between runs. nmr does not remove these checkouts.
+nmr pushes the commit to a checkout on the host under `~/.cache/nmr/delegate/`, without running the repository's `pre-push` hook, then runs `pnpm install --frozen-lockfile` and the command from the directory that corresponds to the local one, with nmr's own flags as they were given. The host keeps one checkout for each repository on each machine that delegates to it, so concurrent delegations from different worktrees do not share one, and `node_modules` and build output persist between runs. When the workspace packages' `bin` entries differ from those of the checkout's last successful install, nmr first removes pnpm's workspace state, so that the install links the new bins, which an unchanged lockfile would otherwise let pnpm skip; that install reruns the workspace's `prepare` scripts. nmr does not remove these checkouts.
 
 - **Ignored files stay here.** A command that needs a gitignored file, such as a local `.env`, does not find it on the host.
 - **A repository with submodules cannot be delegated**, nor can a tree containing a nested repository, because the snapshot does not include their content. A delegation flag refuses such a tree; under `NMR_DELEGATE` or the user config, the command runs here, and nmr prints one line saying why.
@@ -123,7 +123,7 @@ The host's nmr prints its output and verdicts, and nmr here adds one verdict for
 A failure of the delegation itself, rather than of the command, exits 255, the status with which `ssh` reports its own failures, and names the step that failed, after what that step printed:
 
 ```console
-❌ my-repo: ci: failed on imac2 in 10.0s (exit 255) — could not prepare imac2
+❌ my-repo: ci: failed on 📡 imac2 in 10.0s (exit 255) — could not prepare imac2
 ```
 
 The steps are `prepare`, which reaches the host and creates the checkout, `push`, `check out`, and `install`. A connection lost while the command runs is reported as `lost connection to <host>`.

package/docs/scripts.md

@@ -182,7 +182,7 @@ Neither is bound to a git hook. `prepush` is named for when a developer runs it,
 
 ### Check and quality
 
-`check` and `check:strict` start their lint step first and [run it in the background](#running-a-step-in-the-background), alongside typecheck, the format check, and the tests.
+`check` and `check:strict` start their lint step first and [run it in the background](#running-a-step-in-the-background), alongside typecheck, the format check, and the tests. At the root, both then run [`lint:workflows`](#workflow-lint) before typecheck, and `root:check` runs it after `root:lint:check`.
 
 Neither gate computes coverage: Instrumentation multiplies the wall time of the run that they exist to keep short. Coverage is [`test:coverage`](vitest.md#test-selections), run as a step of its own; a repo that wants it inside the gate [overrides](#configuration) `check:strict`.
 
@@ -194,6 +194,14 @@ Requires `eslint` >= 10 and, for `lint:strict`, `@williamthorsen/strict-lint` >=
 
 The run never enters a package, so per-package `lint:pre` and `lint:post` hooks do not fire from the root. They still run from inside the package and under `nmr -F <package> lint`.
 
+### Workflow lint
+
+`lint:workflows`, a root command, lints the GitHub Actions workflows under `.github/workflows/` with [actionlint](https://github.com/rhysd/actionlint), including its shellcheck pass over every `run:` block, and fails on any finding. A repo without `.github/workflows/` passes. The command runs `nmr-actionlint`, which forwards trailing arguments to actionlint, so `nmr lint:workflows .github/workflows/ci.yaml` lints that file alone; inside `check`, `check:strict`, and `root:check`, the step declines them.
+
+The result does not depend on what the machine has installed. nmr pins actionlint 1.7.12 and shellcheck 0.11.0, downloads each from its upstream GitHub release on first use, verifies it against the SHA-256 recorded in nmr, and caches it under `node_modules/.cache/nmr-tools/` at the monorepo root. The first run therefore needs access to `github.com`, and a failed download or a checksum mismatch fails the command. The pyflakes integration is off. The pins move only with a release of nmr.
+
+The supported platforms are macOS and Linux on x64 and arm64; on any other, the command fails and names the platform. actionlint reads its own configuration from `.github/actionlint.yaml`, through which a repo can ignore a finding.
+
 ### Root-only
 
 The `root:`-prefixed commands operate on root-level code only (not workspace packages).

package/docs/utilities.md

@@ -1,6 +1,14 @@
 # Standalone utilities
 
-The binaries behind nmr's default `clean`, `compile`, `fmt`, and package `test` commands, and a check for the `prepublishOnly` hooks of publishable packages.
+The binaries behind nmr's default `clean`, `compile`, `fmt`, `lint:workflows`, and package `test` commands, and a check for the `prepublishOnly` hooks of publishable packages.
+
+## `nmr-actionlint`
+
+Lint the monorepo's GitHub Actions workflows with pinned actionlint and shellcheck binaries, forwarding any arguments to actionlint. This is the default root `lint:workflows` script; [Workflow lint](scripts.md#workflow-lint) covers the pins, the download, and the supported platforms.
+
+```bash
+nmr-actionlint
+```
 
 ## `nmr-clean`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@williamthorsen/nmr",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "private": false,
   "description": "Context-aware script runner for pnpm monorepos",
   "keywords": [
@@ -58,6 +58,7 @@
   "bin": {
     "ensure-prepublish-hooks": "bin/ensure-prepublish-hooks.js",
     "nmr": "bin/nmr.js",
+    "nmr-actionlint": "bin/nmr-actionlint.js",
     "nmr-clean": "bin/nmr-clean.js",
     "nmr-compile": "bin/nmr-compile.js",
     "nmr-fmt": "bin/nmr-fmt.js",