@zgeoff/chex 0.0.2 → 0.0.3

package/README.md

@@ -80,7 +80,7 @@ skipped file back:
   `linguist-vendored`.
 
 `chex init` writes the `extends` line into `lefthook.yml` and adds a `check:docs` script of
-`chex prose length links` when the repo has none. A second run changes nothing.
+`chex prose length links skill` when the repo has none. A second run changes nothing.
 
 ## The pre-push baseline
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zgeoff/chex",
-  "version": "0.0.2",
+  "version": "0.0.3",
   "description": "Run each shared docs and repo check as one subcommand, with the lefthook pre-push baseline that calls them",
   "keywords": [
     "checks",

package/src/build-init-package.ts

@@ -2,7 +2,7 @@ import { isRecord } from '@zgeoff/std';
 
 // The baseline's jobs run chex, the related tests through rig, and each job under diet's memory cap.
 export const baselinePackages = ['@zgeoff/chex', '@zgeoff/rig', '@zgeoff/diet'] as const;
-export const docsScript = 'chex prose length links';
+export const docsScript = 'chex prose length links skill';
 
 export type PackageOutcome =
   | { readonly kind: 'missing'; readonly packages: readonly string[] }

package/src/read-checks-profile.ts

@@ -0,0 +1,57 @@
+import type { RunProgram } from './run-program.ts';
+
+export type ChecksProfile = 'public' | 'private';
+
+export interface ChecksProfileOptions {
+  readonly cwd: string;
+  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly runProgram: RunProgram;
+  readonly writeError: (text: string) => void;
+}
+
+// bun-checks picks the profile from the repo's visibility, so a run that CHECKS_PROFILE gives no
+// profile, such as a pre-push hook, asks GitHub for the same visibility.
+export function readChecksProfile(
+  options: Readonly<ChecksProfileOptions>,
+): ChecksProfile | undefined {
+  const given = parseChecksProfile(options.env['CHECKS_PROFILE']);
+
+  if (given !== undefined) {
+    return given;
+  }
+
+  const visibility = readRepoVisibility(options);
+
+  if (visibility instanceof Error) {
+    options.writeError(
+      `workflows: the repo's visibility is unknown, so every rule applies: ${visibility.message}\n`,
+    );
+
+    return undefined;
+  }
+
+  return visibility;
+}
+
+function parseChecksProfile(value: string | undefined): ChecksProfile | undefined {
+  return value === 'public' || value === 'private' ? value : undefined;
+}
+
+const visibilityCommand = ['gh', 'repo', 'view', '--json', 'isPrivate', '--jq', '.isPrivate'];
+
+function readRepoVisibility(options: Readonly<ChecksProfileOptions>): ChecksProfile | Error {
+  try {
+    const result = options.runProgram(visibilityCommand, { cwd: options.cwd, env: options.env });
+    const answer = result.stdout.trim();
+
+    if (result.exitCode === 0 && (answer === 'true' || answer === 'false')) {
+      return answer === 'true' ? 'private' : 'public';
+    }
+
+    return new Error(
+      `${visibilityCommand.join(' ')} exited ${result.exitCode}: ${result.stderr.trim() || answer}`,
+    );
+  } catch (error) {
+    return error instanceof Error ? error : new Error(String(error));
+  }
+}

package/src/run-workflows-check.ts

@@ -3,11 +3,11 @@ import { collectCommandNames } from './collect-command-names.ts';
 import { collectExpressionReferences } from './collect-expression-references.ts';
 import { findInstallCachePath } from './find-install-cache-path.ts';
 import { parseShellWords } from './parse-shell-words.ts';
+import type { ChecksProfile } from './read-checks-profile.ts';
+import { readChecksProfile } from './read-checks-profile.ts';
 import type { RunProgram } from './run-program.ts';
 import { runProgram } from './run-program.ts';
 
-export type ChecksProfile = 'public' | 'private';
-
 export interface WorkflowsCheckOptions {
   readonly cwd: string;
   readonly env: Readonly<Record<string, string | undefined>>;
@@ -15,7 +15,7 @@ export interface WorkflowsCheckOptions {
   // The workflow files to read, relative to the repo root; empty reads every one HEAD holds.
   readonly paths: readonly string[];
 
-  // The bun-checks profile of the run; undefined when the check cannot see it, such as in a hook.
+  // The bun-checks profile of the run; undefined when it is unknown, which applies every rule.
   readonly profile: ChecksProfile | undefined;
 
   readonly runProgram: RunProgram;
@@ -552,7 +552,14 @@ export function runWorkflowsCommand(args: readonly string[]): number {
       cwd: process.cwd(),
       env: process.env,
       paths,
-      profile: parseChecksProfile(process.env['CHECKS_PROFILE']),
+      profile: readChecksProfile({
+        cwd: process.cwd(),
+        env: process.env,
+        runProgram,
+        writeError: (text) => {
+          process.stderr.write(text);
+        },
+      }),
       runProgram,
     });
 
@@ -585,10 +592,6 @@ function parseCLIPaths(args: readonly string[]): string[] | Error {
   }
 }
 
-function parseChecksProfile(value: string | undefined): ChecksProfile | undefined {
-  return value === 'public' || value === 'private' ? value : undefined;
-}
-
 // GitHub reads a workflow command's properties up to `,` and `::`, and its message up to a
 // newline, so each escapes its own characters.
 function formatAnnotation(finding: WorkflowFinding): string {