@workerstack/repo 0.0.0-stage → 0.1.0

package/agents/subagents/implementer-fast.md

@@ -0,0 +1,57 @@
+---
+name: implementer-fast
+description: "Implements one reviewed phase. Writes product code and tests."
+tier: implementer
+exec: true
+claudecode:
+  model: sonnet
+  effort: medium
+  autoCompactWindow: 350000
+  maxTurns: 100
+  permissionMode: bypassPermissions
+  omitClaudeMd: true
+  tools: [Read, Grep, Glob, Bash, Write, Edit]
+  disallowedTools: [Agent]
+grokcli:
+  model: grok-4.7
+  maxTurns: 100
+  permission_mode: bypassPermissions
+  agents_md: false
+  mcpInheritance: none
+  tools: read_file, grep, list_dir, write, search_replace, run_terminal_command
+codexcli:
+  model: gpt-6-luna
+  model_reasoning_effort: medium
+  sandbox_mode: danger-full-access
+  approval_policy: never
+cursor:
+  model: inherit
+antigravity-cli:
+  model: flash
+  subagent: true
+  mainAgent: false
+  inheritMcp: false
+  commandExecutionPolicy: eager
+  tools: [read_file, run_command, edit_file, write_file]
+---
+You implement one phase for a reviewer. The brief you receive is the whole task: the leaves of one phase, and any findings to fix. Do exactly that.
+
+Write product files and tests only. Never write the plan, the journal, or anything under `.tmp/repo/plans` or `.tmp/repo/implementations`. The reviewer owns those.
+
+Write only the files the brief lists.
+
+Never stage and never commit. Leave every change in the working tree.
+
+Write the failing test first when a leaf asks for one. Run it and see it fail. Then make the change. Run the phase's tests before you report.
+
+Rules:
+- Work only in the worktree the brief names.
+- Run the CLI as `bun repo …`.
+- Route big output through `bun repo job`: `--job test --query '<cmd>'` for tests, `--job exec` or `--job search` for anything else that prints a lot. Read a stash path only with offset and limit.
+
+If a leaf cannot be done as written, stop and say why. Do not work around it.
+
+End with exactly these three lines:
+changed: <comma-separated repo-relative paths>
+tests: <last test command> → exit <N>
+status: done|partial|stuck

package/agents/subagents/orchestrator.md

@@ -0,0 +1,43 @@
+---
+name: orchestrator
+description: "Does the work. Spawn scout when isolation is cheaper. Use a host agent or fan-out when that is cheaper for the task, or when the user asks."
+tier: parent
+targets:
+  - grokcli
+  - antigravity-cli
+grokcli:
+  model: grok-4.7
+  permission_mode: bypassPermissions
+  agents_md: false
+  mcpInheritance: none
+  # Registry ids. A comma-separated line splits Agent(...) and the allowlist stays empty.
+  tools:
+    - read_file
+    - grep
+    - list_dir
+    - write
+    - search_replace
+    - web_search
+    - web_fetch
+    - todo_write
+    - run_terminal_cmd
+    - task
+    - get_task_output
+    - kill_task
+    - workflow
+    - search_tool
+    - use_tool
+    - monitor
+    - ask_user_question
+    - enter_plan_mode
+    - exit_plan_mode
+    - Agent(scout, explore, plan, general-purpose)
+antigravity-cli:
+  model: inherit
+  subagent: false
+  mainAgent: true
+  inheritMcp: false
+  commandExecutionPolicy: eager
+  tools: [read_file, run_command, manage_task, send_message, schedule, invoke_subagent, define_subagent, manage_subagents, write_file, edit_file, search_web, ask_question]
+---
+Follow AGENTS.md. Scratch in `.tmp/repo/`. Browse with `bun repo browser`; the rail swaps to Chromium when Lightpanda is blocked. App e2e uses Playwright.

package/agents/subagents/researcher.md

@@ -0,0 +1,47 @@
+---
+name: researcher
+description: "Heavy research worker. Web docs, browser, Playwright. Facts with sources."
+tier: scout
+exec: true
+claudecode:
+  model: haiku
+  effort: medium
+  autoCompactWindow: 200000
+  maxTurns: 60
+  permissionMode: bypassPermissions
+  omitClaudeMd: true
+  tools: [Read, Grep, Glob, Bash, Write, WebSearch, WebFetch]
+  disallowedTools: [Agent]
+grokcli:
+  model: grok-4.7
+  maxTurns: 60
+  permission_mode: bypassPermissions
+  agents_md: false
+  mcpInheritance: none
+  tools: read_file, grep, list_dir, write, run_terminal_command, web_search, web_fetch
+codexcli:
+  model: gpt-6-luna
+  model_reasoning_effort: medium
+  sandbox_mode: danger-full-access
+  approval_policy: never
+cursor:
+  model: inherit
+antigravity-cli:
+  model: flash_lite
+  subagent: true
+  mainAgent: false
+  inheritMcp: false
+  commandExecutionPolicy: eager
+  tools: [read_file, run_command, write_file]
+---
+You research one question for an agent. Heavy research is your job: read web docs, drive pages with `bun repo browser`, and run Playwright through Bash when a page needs a real browser. Where your host has no web tool, browse with `bun repo browser` and `curl` in the shell. Your return is read by an agent, not a person: facts only, no voice, each fact with its source.
+
+Rules:
+- Work only in the worktree the brief names.
+- Run the CLI as `bun repo …`.
+- Route big output through `bun repo job`: `--job test --query '<cmd>'` for tests, `--job exec` or `--job search` for anything else that prints a lot. Read a stash path only with offset and limit.
+
+End with exactly these three lines:
+facts: <one fact per line, each with its source>
+sources: <urls or repo paths>
+status: done|partial|stuck

package/agents/subagents/scout.md

@@ -0,0 +1,44 @@
+---
+name: scout
+description: "Isolation worker. Facts only."
+tier: scout
+exec: true
+claudecode:
+  model: haiku
+  effort: low
+  autoCompactWindow: 100000
+  maxTurns: 40
+  permissionMode: bypassPermissions
+  omitClaudeMd: true
+  tools: [Read, Grep, Glob, Bash, Write, Edit, WebSearch, WebFetch]
+  disallowedTools: [Agent]
+grokcli:
+  model: grok-4.7
+  maxTurns: 40
+  permission_mode: bypassPermissions
+  agents_md: false
+  mcpInheritance: none
+  tools: read_file, grep, list_dir, write, search_replace, run_terminal_command, web_search, web_fetch
+codexcli:
+  model: gpt-6-luna
+  model_reasoning_effort: low
+  sandbox_mode: danger-full-access
+  approval_policy: never
+antigravity-cli:
+  model: flash_lite
+  subagent: true
+  mainAgent: false
+  inheritMcp: false
+  commandExecutionPolicy: eager
+  tools: [read_file, run_command, edit_file]
+---
+Return isolation facts (≤8 lines, stash receipt when needed). A browse snap is the payload. Your return is read by an agent, not a person: facts only, no voice.
+
+Rules:
+- Work only in the worktree the brief names.
+- Run the CLI as `bun repo …`.
+- Route big output through `bun repo job`: `--job test --query '<cmd>'` for tests, `--job exec` or `--job search` for anything else that prints a lot. Read a stash path only with offset and limit.
+
+End with exactly these two lines:
+facts: <one fact per line>
+status: done|partial|stuck

package/bin/repo.ts

@@ -0,0 +1,4 @@
+#!/usr/bin/env bun
+import { main } from "../cli/bin.ts";
+
+await main(process.argv.slice(2));

package/cli/actionlint-default.test.ts

@@ -0,0 +1,38 @@
+import path from "node:path";
+import { expect, it } from "vitest";
+import { childEnv } from "./env.ts";
+import { fetchArchive, spawnCaptured } from "./actionlint.ts";
+
+it("fetches the bytes of an archive over http and refuses a failing status", async () => {
+  const server = Bun.serve({
+    port: 0,
+    fetch: (request) =>
+      new URL(request.url).pathname === "/ok" ? new Response("an archive") : new Response("gone", { status: 404 }),
+  });
+  try {
+    const base = `http://127.0.0.1:${server.port}`;
+    expect(new TextDecoder().decode(await fetchArchive(`${base}/ok`))).toBe("an archive");
+    await expect(fetchArchive(`${base}/missing`)).rejects.toThrow(`${base}/missing answered 404`);
+  } finally {
+    await server.stop(true);
+  }
+});
+
+it("captures the output and exit code of a command, and a spawn error as stderr", () => {
+  const cwd = path.join(import.meta.dirname);
+  const run = spawnCaptured(process.execPath, ["-e", 'console.log("out"); console.error("err"); process.exit(3)'], {
+    cwd,
+    env: childEnv(),
+  });
+  expect(run).toEqual({ code: 3, stdout: "out\n", stderr: "err\n" });
+  const missing = spawnCaptured(path.join(cwd, "no-such-binary"), [], { cwd, env: childEnv() });
+  expect(missing.code).toBe(1);
+  expect(missing.stdout).toBe("");
+  expect(missing.stderr).toContain("no-such-binary");
+});
+
+it("reports a command killed by a signal as exit 1", () => {
+  const cwd = import.meta.dirname;
+  const killed = spawnCaptured(process.execPath, ["-e", "process.kill(process.pid, 9)"], { cwd, env: childEnv() });
+  expect(killed.code).toBe(1);
+});

package/cli/actionlint-download.test.ts

@@ -0,0 +1,162 @@
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, expect, it } from "vitest";
+import { childEnv } from "./env.ts";
+import { checkActionlintAt, type Spawn } from "./actionlint.ts";
+
+const dirs: string[] = [];
+const temp = (): string => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "workerstack-actionlint-"));
+  dirs.push(dir);
+  return dir;
+};
+afterEach(() => {
+  for (const dir of dirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+const ARCHIVE = new TextEncoder().encode("an archive");
+const sha = createHash("sha256").update(ARCHIVE).digest("hex");
+const URL_BASE = "https://github.com/rhysd/actionlint/releases/download/v1.7.12/";
+type Call = { command: string; args: string[] };
+
+/** A spawn that plays tar (it unpacks a binary named `exe` into the -C dir) and answers actionlint cleanly. */
+function fakes(exe: string, tarCode = 0) {
+  const calls: Call[] = [];
+  const archives: string[] = [];
+  const spawn: Spawn = (command, args) => {
+    calls.push({ command, args });
+    if (args[0] !== "-xf") return { code: 0, stdout: "[]", stderr: "" };
+    archives.push(fs.readFileSync(args[1] ?? "", "utf8"));
+    fs.writeFileSync(path.join(args[3] ?? "", exe), "binary");
+    return { code: tarCode, stdout: "", stderr: tarCode === 0 ? "" : "tar broke\n" };
+  };
+  return { calls, archives, spawn };
+}
+
+/** A release-pack repo with one workflow and no cache. */
+function planted() {
+  const root = temp();
+  fs.writeFileSync(path.join(root, "workerstack.config.ts"), 'export default { packs: ["release"] };\n');
+  fs.mkdirSync(path.join(root, ".github", "workflows"), { recursive: true });
+  fs.writeFileSync(path.join(root, ".github", "workflows", "ci.yml"), "name: x\n");
+  return { root, cacheDir: path.join(temp(), "actionlint", "1.7.12") };
+}
+
+const hashes = (key: string) => ({ [key]: sha });
+const ok = () => Promise.resolve(ARCHIVE);
+
+it("fetches the archive, checks its hash, unpacks it, caches the binary and runs it", async () => {
+  const { root, cacheDir } = planted();
+  const { calls, archives, spawn } = fakes("actionlint");
+  const urls: string[] = [];
+  const fetch = (url: string) => {
+    urls.push(url);
+    return ok();
+  };
+  const deps = { fetch, spawn, cacheDir, platform: "linux", arch: "x64", hashes: hashes("linux_amd64") };
+  expect(await checkActionlintAt(root, deps)).toEqual({ problems: [] });
+  expect(urls).toEqual([`${URL_BASE}actionlint_1.7.12_linux_amd64.tar.gz`]);
+  expect(archives).toEqual(["an archive"]);
+  expect(calls[0]?.command).toBe("tar");
+  expect(calls.at(-1)?.command).toBe(path.join(cacheDir, "actionlint"));
+  expect(fs.readdirSync(cacheDir)).toEqual(["actionlint"]);
+  await checkActionlintAt(root, { ...deps, fetch: () => Promise.reject(new Error("cached")) });
+  expect(urls).toHaveLength(1);
+});
+
+it("names its archive and unpack directory for the process, and removes both", async () => {
+  const { root, cacheDir } = planted();
+  const seen: string[][] = [];
+  const spawn: Spawn = (_command, args) => {
+    if (args[0] !== "-xf") return { code: 0, stdout: "[]", stderr: "" };
+    seen.push([args[1] ?? "", args[3] ?? ""]);
+    fs.writeFileSync(path.join(args[3] ?? "", "actionlint"), "binary");
+    return { code: 0, stdout: "", stderr: "" };
+  };
+  const deps = { fetch: ok, spawn, cacheDir, platform: "linux", arch: "arm64", hashes: hashes("linux_arm64") };
+  await checkActionlintAt(root, deps);
+  expect(seen).toHaveLength(1);
+  for (const name of seen[0] ?? []) {
+    expect(path.dirname(name)).toBe(cacheDir);
+    expect(path.basename(name)).toContain(String(process.pid));
+  }
+  expect(fs.readdirSync(cacheDir)).toEqual(["actionlint"]);
+});
+
+it.each([
+  [{ platform: "darwin", arch: "x64", archive: "darwin_amd64.tar.gz", exe: "actionlint" }],
+  [{ platform: "darwin", arch: "arm64", archive: "darwin_arm64.tar.gz", exe: "actionlint" }],
+  [{ platform: "win32", arch: "x64", archive: "windows_amd64.zip", exe: "actionlint.exe" }],
+  [{ platform: "win32", arch: "arm64", archive: "windows_arm64.zip", exe: "actionlint.exe" }],
+])("$platform $arch fetches $archive and caches $exe", async ({ platform, arch, archive, exe }) => {
+  const { root, cacheDir } = planted();
+  const key = archive.replace(/\.(tar\.gz|zip)$/, "");
+  const urls: string[] = [];
+  const fetch = (url: string) => {
+    urls.push(url);
+    return ok();
+  };
+  const { calls, spawn } = fakes(exe);
+  await checkActionlintAt(root, { fetch, spawn, cacheDir, platform, arch, hashes: hashes(key) });
+  expect(urls).toEqual([`${URL_BASE}actionlint_1.7.12_${archive}`]);
+  const tar = platform === "win32" ? `${childEnv().SystemRoot ?? "C:\\Windows"}\\System32\\tar.exe` : "tar";
+  expect(calls[0]?.command).toBe(tar);
+  expect(fs.readdirSync(cacheDir)).toEqual([exe]);
+});
+
+it("refuses an archive whose hash differs and caches nothing", async () => {
+  const { root, cacheDir } = planted();
+  const { calls, spawn } = fakes("actionlint");
+  const wrong = { linux_amd64: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8" };
+  const deps = { fetch: ok, spawn, cacheDir, platform: "linux", arch: "x64", hashes: wrong };
+  const out = await checkActionlintAt(root, deps);
+  expect(out.problems).toEqual([
+    `actionlint: actionlint_1.7.12_linux_amd64.tar.gz has sha256 ${sha.slice(0, 8)}\u2026, expected 8aca8db9\u2026; nothing was cached`,
+  ]);
+  expect(calls).toEqual([]);
+  expect(fs.readdirSync(cacheDir)).toEqual([]);
+});
+
+it.each([
+  ["an error", new Error("fetch failed"), "fetch failed"],
+  ["a bare value", "offline", "offline"],
+])("reports a fetch that rejects with %s", async (_name, reason, text) => {
+  const { root, cacheDir } = planted();
+  const { calls, spawn } = fakes("actionlint");
+  const fetch = () => Promise.reject(reason);
+  const out = await checkActionlintAt(root, { fetch, spawn, cacheDir, platform: "linux", arch: "x64" });
+  expect(out.problems).toEqual([`actionlint: could not fetch 1.7.12 (${text}); connect once so repo can cache it`]);
+  expect(calls).toEqual([]);
+});
+
+it("reports a tar that fails and removes what it made", async () => {
+  const { root, cacheDir } = planted();
+  const { spawn } = fakes("actionlint", 1);
+  const deps = { fetch: ok, spawn, cacheDir, platform: "linux", arch: "x64", hashes: hashes("linux_amd64") };
+  const out = await checkActionlintAt(root, deps);
+  expect(out.problems).toEqual(["actionlint: could not unpack actionlint_1.7.12_linux_amd64.tar.gz: tar broke"]);
+  expect(fs.readdirSync(cacheDir)).toEqual([]);
+});
+
+it.each([
+  ["freebsd", "x64"],
+  ["linux", "ia32"],
+])("says %s %s is unsupported and fetches nothing", async (platform, arch) => {
+  const { root, cacheDir } = planted();
+  const fetch = () => Promise.reject(new Error("no"));
+  const out = await checkActionlintAt(root, { fetch, spawn: fakes("x").spawn, cacheDir, platform, arch });
+  expect(out.problems).toEqual([
+    `actionlint: no 1.7.12 build for ${platform} ${arch}; run repo check on linux, macOS or Windows`,
+  ]);
+});
+
+it("treats a platform with no pinned hash as a mismatch", async () => {
+  const { root, cacheDir } = planted();
+  const deps = { fetch: ok, spawn: fakes("actionlint").spawn, cacheDir, platform: "linux", arch: "x64", hashes: {} };
+  const out = await checkActionlintAt(root, deps);
+  expect(out.problems).toEqual([
+    `actionlint: actionlint_1.7.12_linux_amd64.tar.gz has sha256 ${sha.slice(0, 8)}…, expected …; nothing was cached`,
+  ]);
+});

package/cli/actionlint-real.test.ts

@@ -0,0 +1,33 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, expect, it } from "vitest";
+import { checkActionlintAt } from "./actionlint.ts";
+
+const SLOW = 180_000;
+const dirs: string[] = [];
+afterEach(() => {
+  for (const dir of dirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+/** A release-pack repo whose one workflow has `jobs` as its job section. */
+function planted(jobs: string): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "workerstack-actionlint-real-"));
+  dirs.push(root);
+  fs.writeFileSync(path.join(root, "workerstack.config.ts"), 'export default { packs: ["release"] };\n');
+  fs.mkdirSync(path.join(root, ".github", "workflows"), { recursive: true });
+  const body = `name: x\non: push\njobs:\n  build:\n${jobs}\n    steps:\n      - run: echo hi\n`;
+  fs.writeFileSync(path.join(root, ".github", "workflows", "ci.yml"), body);
+  return root;
+}
+
+it("lints a planted workflow with the real binary from the real cache: runs_on fails", { timeout: SLOW }, async () => {
+  const out = await checkActionlintAt(planted("    runs_on: ubuntu-latest"));
+  const line = 'actionlint: .github/workflows/ci.yml:5:5: unexpected key "runs_on" for "job" section';
+  expect(out.problems.some((problem) => problem.startsWith(line) && problem.endsWith("[syntax-check]"))).toBe(true);
+});
+
+it("gives no line for a clean workflow", { timeout: SLOW }, async () => {
+  const out = await checkActionlintAt(planted("    runs-on: ubuntu-latest"));
+  expect(out).toEqual({ problems: [] });
+});

package/cli/actionlint.constants.ts

@@ -0,0 +1,43 @@
+/** The pinned actionlint release. */
+export const ACTIONLINT_VERSION: string = "1.7.12";
+/** The directory under the state home that caches the binary, then the version. */
+export const CACHE_DIR: string = "actionlint";
+/** Where the pinned release's archives are published. */
+export const RELEASE_URL: string = `https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}`;
+/** How long the archive download may take. */
+export const FETCH_TIMEOUT_MS = 120_000;
+/** The most output a spawned tool may print before it is cut off. */
+export const MAX_OUTPUT_BYTES: number = 64 * 1024 * 1024;
+/** The workflow directory, relative to the repo root. */
+export const WORKFLOWS_DIR = ".github/workflows";
+/** The extensions of a workflow file. */
+export const WORKFLOW_EXTENSIONS: readonly string[] = [".yml", ".yaml"];
+/** The flags that print json and turn off the tools runners differ in. */
+export const ACTIONLINT_FLAGS: readonly string[] = ["-format", "{{json .}}", "-shellcheck=", "-pyflakes="];
+/** The windows system directory when `SystemRoot` is unset. */
+export const DEFAULT_SYSTEM_ROOT = "C:\\Windows";
+/** What `process.platform` calls windows. */
+export const WINDOWS_PLATFORM = "win32";
+/** The windows tar, under the system root; Git's GNU tar can come first on PATH and cannot read a zip. */
+export const WINDOWS_TAR = "\\System32\\tar.exe";
+/** The hash characters a mismatch line shows. */
+export const SHOWN_HASH = 8;
+/** The exit code actionlint gives when it found problems. */
+export const EXIT_PROBLEMS = 1;
+/** The octal mode of the cached binary. */
+export const BINARY_MODE = 0o755;
+
+/** What `process.platform` calls an os that actionlint publishes, mapped to the name its archives use. */
+export const OS_NAMES: Record<string, string> = { darwin: "darwin", linux: "linux", win32: "windows" };
+/** What `process.arch` calls an architecture that actionlint publishes, mapped to the name its archives use. */
+export const ARCH_NAMES: Record<string, string> = { x64: "amd64", arm64: "arm64" };
+
+/** The sha256 of each archive of the release, from its checksums.txt, by `<os>_<arch>`. */
+export const HASHES: Record<string, string> = {
+  darwin_amd64: "5b44c3bc2255115c9b69e30efc0fecdf498fdb63c5d58e17084fd5f16324c644",
+  darwin_arm64: "aba9ced2dee8d27fecca3dc7feb1a7f9a52caefa1eb46f3271ea66b6e0e6953f",
+  linux_amd64: "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8",
+  linux_arm64: "325e971b6ba9bfa504672e29be93c24981eeb1c07576d730e9f7c8805afff0c6",
+  windows_amd64: "6e7241b51e6817ea6a047693d8e6fed13b31819c9a0dd6c5a726e1592d22f6e9",
+  windows_arm64: "cadcf7ea4efe3a68728893813643cebe1185e5b1d4be5b96245f65c9a4d5ea41",
+};

package/cli/actionlint.test.ts

@@ -0,0 +1,108 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, expect, it, vi } from "vitest";
+import { childEnv } from "./env.ts";
+import { checkActionlintAt, type Spawn } from "./actionlint.ts";
+
+const dirs: string[] = [];
+const temp = (): string => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), "workerstack-actionlint-"));
+  dirs.push(dir);
+  return dir;
+};
+afterEach(() => {
+  vi.unstubAllEnvs();
+  for (const dir of dirs.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+const EXE = process.platform === "win32" ? "actionlint.exe" : "actionlint";
+type Call = { command: string; args: string[]; cwd: string; env: NodeJS.ProcessEnv };
+let calls: Call[] = [];
+beforeEach(() => {
+  calls = [];
+});
+const answering =
+  (code: number, stdout: string, stderr = ""): Spawn =>
+  (command, args, options) => {
+    calls.push({ command, args, ...options });
+    return { code, stdout, stderr };
+  };
+const failFetch = () => Promise.reject(new Error("the cache should have been used"));
+
+/** A repo with a config of `packs`, the workflow files named, and a cached binary. */
+function repo(packs: string, workflows: string[]): { root: string; cacheDir: string } {
+  const root = temp();
+  const cacheDir = temp();
+  fs.writeFileSync(path.join(cacheDir, EXE), "binary");
+  fs.writeFileSync(path.join(root, "workerstack.config.ts"), `export default { packs: ${packs} };\n`);
+  const flows = path.join(root, ".github", "workflows");
+  fs.mkdirSync(flows, { recursive: true });
+  for (const name of workflows) fs.writeFileSync(path.join(flows, name), "name: x\n");
+  return { root, cacheDir };
+}
+
+it("runs nothing without a config, without the release pack or without a workflow", async () => {
+  const bare = temp();
+  const spawn = answering(0, "");
+  expect(await checkActionlintAt(bare, { spawn, fetch: failFetch })).toEqual({ problems: [] });
+  const off = repo('["standards"]', ["ci.yml"]);
+  expect(await checkActionlintAt(off.root, { spawn, fetch: failFetch, cacheDir: off.cacheDir })).toEqual({
+    problems: [],
+  });
+  const none = repo('["release"]', ["notes.txt"]);
+  fs.rmSync(path.join(none.root, ".github", "workflows", "notes.txt"));
+  expect(await checkActionlintAt(none.root, { spawn, fetch: failFetch, cacheDir: none.cacheDir })).toEqual({
+    problems: [],
+  });
+  fs.rmSync(path.join(none.root, ".github"), { recursive: true });
+  expect(await checkActionlintAt(none.root, { spawn, fetch: failFetch, cacheDir: none.cacheDir })).toEqual({
+    problems: [],
+  });
+  expect(calls).toEqual([]);
+});
+
+it("lints every .yml and .yaml workflow with the cached binary, in the repo root, and nothing else", async () => {
+  vi.stubEnv("GIT_DIR", "/elsewhere");
+  const { root, cacheDir } = repo('["release"]', ["b.yaml", "a.yml", "notes.txt"]);
+  const out = await checkActionlintAt(root, { spawn: answering(0, "[]"), fetch: failFetch, cacheDir });
+  expect(out).toEqual({ problems: [] });
+  expect(calls).toHaveLength(1);
+  const [call] = calls;
+  expect(call?.command).toBe(path.join(cacheDir, EXE));
+  expect(call?.args).toEqual([
+    "-format",
+    "{{json .}}",
+    "-shellcheck=",
+    "-pyflakes=",
+    ".github/workflows/a.yml",
+    ".github/workflows/b.yaml",
+  ]);
+  expect(call?.cwd).toBe(root);
+  expect(call?.env.PATH).toBe(childEnv().PATH);
+  expect(call?.env.GIT_DIR).toBeUndefined();
+});
+
+it("prints one line per problem actionlint finds", async () => {
+  const { root, cacheDir } = repo('["release"]', ["release.yml"]);
+  const items = [
+    { message: 'unexpected key "runs_on" for "job" section', filepath: "release.yml", line: 40, column: 9 },
+    { message: "bad", filepath: "release.yml", line: 2, column: 1, kind: "expression" },
+  ];
+  const spawn = answering(1, JSON.stringify(items.map((item) => ({ kind: "syntax-check", ...item }))));
+  const out = await checkActionlintAt(root, { spawn, fetch: failFetch, cacheDir });
+  expect(out.problems).toEqual([
+    'actionlint: release.yml:40:9: unexpected key "runs_on" for "job" section [syntax-check]',
+    "actionlint: release.yml:2:1: bad [expression]",
+  ]);
+});
+
+it.each([
+  [{ name: "another exit code", code: 2, stdout: "", stderr: "boom\n", line: "actionlint: exited 2: boom" }],
+  [{ name: "unparsable output", code: 1, stdout: "not json", stderr: "oops\n", line: "actionlint: exited 1: oops" }],
+  [{ name: "json of another shape", code: 1, stdout: '{"a":1}', stderr: "", line: "actionlint: exited 1: " }],
+])("reports $name as a failure line", async ({ code, stdout, stderr, line }) => {
+  const { root, cacheDir } = repo('["release"]', ["ci.yml"]);
+  const out = await checkActionlintAt(root, { spawn: answering(code, stdout, stderr), fetch: failFetch, cacheDir });
+  expect(out.problems).toEqual([line]);
+});