dd-trace 6.4.0 → 6.6.0

package/ci/test-optimization-validation/approval.js

@@ -0,0 +1,299 @@
+'use strict'
+
+const crypto = require('node:crypto')
+const fs = require('node:fs')
+const path = require('node:path')
+
+const { getCommandOutputPaths } = require('./command-output-policy')
+const { getCommandExecutionSettings } = require('./command-runner')
+const { bindManifestExecutables, getManifestCommands } = require('./executable')
+const { getFixtureRecipeDigests } = require('./offline-fixtures')
+const { sanitizeForReport } = require('./redaction')
+
+const APPROVAL_DIGEST_PATTERN = /^[a-f0-9]{64}$/
+const OFFLINE_FIXTURE_NONCE_PATTERN = /^[a-f0-9]{32}$/
+const PACKAGE_SNAPSHOT_EXCLUDED_NAMES = new Set(['.git', '.nyc_output', 'node_modules'])
+
+/**
+ * Binds an approval to the exact manifest bytes and live validator options.
+ *
+ * @param {object} input approval inputs
+ * @param {object} input.manifest loaded manifest
+ * @param {string} input.out validation output directory
+ * @param {string[]} [input.selectedFrameworkIds] selected framework ids
+ * @param {string|null} [input.requestedScenario] selected scenario
+ * @param {string} input.offlineFixtureNonce random fixture-root nonce shown in the execution plan
+ * @param {boolean} [input.keepTempFiles] whether generated files are retained
+ * @param {boolean} [input.verbose] whether command progress is printed
+ * @returns {string} SHA-256 approval digest
+ */
+function getApprovalDigest ({
+  manifest,
+  out,
+  selectedFrameworkIds = [],
+  requestedScenario = null,
+  offlineFixtureNonce,
+  keepTempFiles = false,
+  verbose = false,
+}) {
+  const approvalJson = serializeApprovalMaterial({
+    manifest,
+    out,
+    selectedFrameworkIds,
+    requestedScenario,
+    offlineFixtureNonce,
+    keepTempFiles,
+    verbose,
+  })
+  return crypto.createHash('sha256').update(approvalJson).digest('hex')
+}
+
+/**
+ * Builds the complete, inspectable material covered by one approval fingerprint.
+ *
+ * Secret-like values are redacted for the artifact while the raw manifest digest still binds their exact bytes.
+ *
+ * @param {object} input approval inputs
+ * @param {object} input.manifest loaded validation manifest
+ * @param {string} input.out validation output directory
+ * @param {string[]} [input.selectedFrameworkIds] selected framework identifiers
+ * @param {string|null} [input.requestedScenario] selected validation scenario
+ * @param {string} input.offlineFixtureNonce private offline fixture nonce
+ * @param {boolean} [input.keepTempFiles] whether generated files remain after validation
+ * @param {boolean} [input.verbose] whether verbose validation output is enabled
+ * @returns {object} deterministic approval material
+ */
+function getApprovalMaterial ({
+  manifest,
+  out,
+  selectedFrameworkIds = [],
+  requestedScenario = null,
+  offlineFixtureNonce,
+  keepTempFiles = false,
+  verbose = false,
+}) {
+  if (!OFFLINE_FIXTURE_NONCE_PATTERN.test(String(offlineFixtureNonce || ''))) {
+    throw new Error('Invalid offline fixture nonce. Render a fresh plan with --print-plan.')
+  }
+
+  const validationDirectory = __dirname
+  const packageRoot = path.resolve(validationDirectory, '..', '..')
+  const packageJsonPath = path.join(packageRoot, 'package.json')
+  const packageMetadata = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+  const packageFiles = getPackageFiles(packageRoot, [
+    manifest.__path,
+    out,
+    path.join(packageRoot, '.junit-tmp'),
+  ])
+  const executableIdentities = bindManifestExecutables(manifest)
+
+  return {
+    schemaVersion: 1,
+    sharingWarning: 'Internal diagnostic material. Review repository paths, commands, and CI metadata before sharing.',
+    validator: {
+      package: packageMetadata.name,
+      version: packageMetadata.version,
+      packageRoot,
+      coveredFiles: packageFiles.map(filename => ({
+        path: path.relative(packageRoot, filename).split(path.sep).join('/'),
+        sha256: getFileDigest(filename),
+      })),
+    },
+    manifest: {
+      path: path.resolve(manifest.__path),
+      sha256: getManifestDigest(manifest),
+    },
+    selection: {
+      frameworks: [...selectedFrameworkIds],
+      scenario: requestedScenario,
+    },
+    validation: {
+      outputDirectory: path.resolve(out),
+      offlineFixtureNonce,
+      keepTemporaryFiles: keepTempFiles,
+      verbose,
+    },
+    fixtureRecipeDigests: getFixtureRecipeDigests({
+      frameworks: manifest.frameworks || [],
+      selectedFrameworkIds,
+      requestedScenario,
+    }),
+    commands: getManifestCommands(manifest).map(([id, command]) => getApprovalCommand(id, command)),
+    generatedFiles: getGeneratedFileMaterial(manifest),
+    executables: executableIdentities,
+  }
+}
+
+/**
+ * Serializes approval material using stable formatting suitable for independent SHA-256 tools.
+ *
+ * @param {object} input approval inputs
+ * @returns {string} UTF-8 JSON text ending in one newline
+ */
+function serializeApprovalMaterial (input) {
+  return `${JSON.stringify(getApprovalMaterial(input), null, 2)}\n`
+}
+
+/**
+ * Returns every regular file owned by the installed dd-trace package.
+ *
+ * @param {string} packageRoot installed dd-trace package root
+ * @param {string[]} excludedPaths generated files or directories outside the package snapshot
+ * @returns {string[]} sorted absolute file paths
+ */
+function getPackageFiles (packageRoot, excludedPaths) {
+  const files = []
+  collectPackageFiles(
+    fs.realpathSync(packageRoot),
+    excludedPaths.map(resolvePhysicalPath),
+    files
+  )
+  return files.sort()
+}
+
+/**
+ * Converts one manifest command into its sanitized, execution-relevant approval shape.
+ *
+ * @param {string} id stable command identifier
+ * @param {object} command structured command
+ * @returns {object} command approval material
+ */
+function getApprovalCommand (id, command) {
+  const shape = {
+    id,
+    required: command.required !== false,
+    usesShell: command.usesShell === true,
+    cwd: path.resolve(command.cwd),
+    environmentMode: 'clean',
+    environment: command.env || {},
+    ...getCommandExecutionSettings(command),
+    outputPaths: getCommandOutputPaths(command),
+  }
+  if (command.usesShell) {
+    shape.shell = command.shell || null
+    shape.shellCommand = command.shellCommand
+  } else {
+    shape.argv = command.argv
+  }
+  return sanitizeForReport(shape)
+}
+
+/**
+ * Returns exact generated test source and cleanup policy covered by the manifest digest.
+ *
+ * @param {object} manifest loaded manifest
+ * @returns {object[]} generated file approval material
+ */
+function getGeneratedFileMaterial (manifest) {
+  const files = []
+  for (const framework of manifest.frameworks || []) {
+    const strategy = framework.generatedTestStrategy
+    for (const file of strategy?.files || []) {
+      const content = `${file.contentLines.join('\n')}\n`
+      files.push(sanitizeForReport({
+        frameworkId: framework.id,
+        path: path.resolve(file.path),
+        sha256: crypto.createHash('sha256').update(content).digest('hex'),
+        content,
+        removeAfterValidation: (strategy.cleanupPaths || []).some(cleanupPath => {
+          return path.resolve(cleanupPath) === path.resolve(file.path)
+        }),
+      }))
+    }
+  }
+  return files
+}
+
+/**
+ * Hashes one covered regular file.
+ *
+ * @param {string} filename absolute filename
+ * @returns {string} lowercase SHA-256 digest
+ */
+function getFileDigest (filename) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filename)).digest('hex')
+}
+
+/**
+ * Collects regular package files without following package-internal symbolic links.
+ *
+ * @param {string} directory current package directory
+ * @param {string[]} excludedPaths generated paths omitted from the package snapshot
+ * @param {string[]} files collected files
+ */
+function collectPackageFiles (directory, excludedPaths, files) {
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    const filename = path.join(directory, entry.name)
+    if (PACKAGE_SNAPSHOT_EXCLUDED_NAMES.has(entry.name) || isExcludedPackagePath(filename, excludedPaths)) continue
+    if (entry.isDirectory()) {
+      collectPackageFiles(filename, excludedPaths, files)
+    } else if (entry.isFile()) {
+      files.push(filename)
+    }
+  }
+}
+
+/**
+ * Checks whether a package path belongs to a generated approval input or output.
+ *
+ * @param {string} filename package path
+ * @param {string[]} excludedPaths generated paths omitted from the package snapshot
+ * @returns {boolean} whether the path is excluded
+ */
+function isExcludedPackagePath (filename, excludedPaths) {
+  return excludedPaths.some(excluded => filename === excluded || filename.startsWith(`${excluded}${path.sep}`))
+}
+
+/**
+ * Resolves an existing path or its nearest existing ancestor through filesystem aliases.
+ *
+ * @param {string} filename path that may not exist yet
+ * @returns {string} physical path
+ */
+function resolvePhysicalPath (filename) {
+  const missingSegments = []
+  let existingPath = path.resolve(filename)
+  while (!fs.existsSync(existingPath)) {
+    missingSegments.unshift(path.basename(existingPath))
+    const parent = path.dirname(existingPath)
+    if (parent === existingPath) return path.resolve(filename)
+    existingPath = parent
+  }
+  return path.join(fs.realpathSync(existingPath), ...missingSegments)
+}
+
+/**
+ * Validates an approval digest before live validation executes project code.
+ *
+ * @param {string} digest supplied approval digest
+ * @param {object} input approval inputs
+ * @returns {void}
+ */
+function assertApprovalDigest (digest, input) {
+  if (!APPROVAL_DIGEST_PATTERN.test(String(digest || ''))) {
+    throw new Error('Invalid approved plan SHA-256. Render a fresh plan with --print-plan.')
+  }
+
+  const expected = getApprovalDigest(input)
+  if (digest !== expected) {
+    throw new Error(
+      'The validation manifest or execution options changed after approval. ' +
+      'Render a fresh plan with --print-plan and approve that exact plan before live validation.'
+    )
+  }
+}
+
+function getManifestDigest (manifest) {
+  if (manifest.__sourceSha256) return manifest.__sourceSha256
+
+  const serializable = { ...manifest }
+  delete serializable.__path
+  return crypto.createHash('sha256').update(JSON.stringify(serializable)).digest('hex')
+}
+
+module.exports = {
+  assertApprovalDigest,
+  getApprovalDigest,
+  getApprovalMaterial,
+  serializeApprovalMaterial,
+}

package/ci/test-optimization-validation/artifact-id.js

@@ -0,0 +1,20 @@
+'use strict'
+
+const crypto = require('node:crypto')
+
+const MAX_PREFIX_LENGTH = 72
+
+/**
+ * Maps an arbitrary manifest identifier to a bounded, portable, collision-resistant path segment.
+ *
+ * @param {string} value original identifier
+ * @returns {string} artifact path segment
+ */
+function getArtifactId (value) {
+  const source = String(value)
+  const prefix = source.replaceAll(/[^a-zA-Z0-9._-]+/g, '-').slice(0, MAX_PREFIX_LENGTH) || 'framework'
+  const digest = crypto.createHash('sha256').update(source).digest('hex').slice(0, 12)
+  return `${prefix}-${digest}`
+}
+
+module.exports = { getArtifactId }

package/ci/test-optimization-validation/bounded-json.js

@@ -0,0 +1,121 @@
+'use strict'
+
+const DEFAULT_MAX_COLLECTION_ENTRIES = 100_000
+const DEFAULT_MAX_NESTING_DEPTH = 128
+const DEFAULT_MAX_STRING_BYTES = 64 * 1024
+
+/**
+ * Parses JSON only after a no-allocation scan bounds nesting, strings, and collection cardinality.
+ *
+ * @param {Buffer|string} source encoded JSON
+ * @param {object} [options] parser limits
+ * @param {string} [options.label] value label used in errors
+ * @param {number} [options.maxCollectionEntries] aggregate array/object entries
+ * @param {number} [options.maxNestingDepth] maximum container nesting
+ * @param {number} [options.maxStringBytes] maximum encoded string bytes
+ * @returns {{collectionEntries: number, value: unknown}} parsed value and scanned cardinality
+ */
+function parseBoundedJson (source, options = {}) {
+  const buffer = Buffer.isBuffer(source) ? source : Buffer.from(String(source))
+  const limits = {
+    label: options.label || 'JSON',
+    maxCollectionEntries: options.maxCollectionEntries || DEFAULT_MAX_COLLECTION_ENTRIES,
+    maxNestingDepth: options.maxNestingDepth || DEFAULT_MAX_NESTING_DEPTH,
+    maxStringBytes: options.maxStringBytes || DEFAULT_MAX_STRING_BYTES,
+  }
+  const collectionEntries = scanJson(buffer, limits)
+  return {
+    collectionEntries,
+    value: JSON.parse(buffer.toString('utf8')),
+  }
+}
+
+/**
+ * Scans JSON bytes without creating one object per delimiter.
+ *
+ * @param {Buffer} buffer JSON bytes
+ * @param {object} limits parser limits
+ * @returns {number} aggregate collection entries
+ */
+function scanJson (buffer, limits) {
+  const containerTypes = new Uint8Array(limits.maxNestingDepth)
+  const arrayHasEntry = new Uint8Array(limits.maxNestingDepth)
+  let collectionEntries = 0
+  let depth = 0
+  let escaped = false
+  let inString = false
+  let stringBytes = 0
+
+  for (const byte of buffer) {
+    if (inString) {
+      stringBytes++
+      if (stringBytes > limits.maxStringBytes) {
+        throw new Error(`${limits.label} contains a string larger than ${limits.maxStringBytes} bytes.`)
+      }
+      if (escaped) {
+        escaped = false
+      } else if (byte === 0x5C) {
+        escaped = true
+      } else if (byte === 0x22) {
+        inString = false
+      }
+      continue
+    }
+
+    if (byte === 0x22) {
+      inString = true
+      stringBytes = 0
+      markArrayEntry()
+      continue
+    }
+
+    const containerIndex = depth - 1
+    if (containerIndex >= 0 && containerTypes[containerIndex] === 1 &&
+      arrayHasEntry[containerIndex] === 0 && !isJsonWhitespace(byte) && byte !== 0x5D) {
+      arrayHasEntry[containerIndex] = 1
+      addEntry()
+    }
+
+    if (byte === 0x5B || byte === 0x7B) {
+      if (depth >= limits.maxNestingDepth) {
+        throw new Error(`${limits.label} nesting exceeds ${limits.maxNestingDepth}.`)
+      }
+      containerTypes[depth] = byte === 0x5B ? 1 : 2
+      arrayHasEntry[depth] = 0
+      depth++
+    } else if (byte === 0x5D || byte === 0x7D) {
+      if (depth > 0) depth--
+    } else if (byte === 0x2C && containerIndex >= 0 && containerTypes[containerIndex] === 1) {
+      arrayHasEntry[containerIndex] = 0
+    } else if (byte === 0x3A && containerIndex >= 0 && containerTypes[containerIndex] === 2) {
+      addEntry()
+    }
+  }
+
+  return collectionEntries
+
+  function markArrayEntry () {
+    const index = depth - 1
+    if (index < 0 || containerTypes[index] !== 1 || arrayHasEntry[index] !== 0) return
+    arrayHasEntry[index] = 1
+    addEntry()
+  }
+
+  function addEntry () {
+    collectionEntries++
+    if (collectionEntries > limits.maxCollectionEntries) {
+      throw new Error(`${limits.label} exceeds ${limits.maxCollectionEntries} aggregate collection entries.`)
+    }
+  }
+}
+
+function isJsonWhitespace (byte) {
+  return byte === 0x20 || byte === 0x09 || byte === 0x0A || byte === 0x0D
+}
+
+module.exports = {
+  DEFAULT_MAX_COLLECTION_ENTRIES,
+  DEFAULT_MAX_NESTING_DEPTH,
+  DEFAULT_MAX_STRING_BYTES,
+  parseBoundedJson,
+}

package/ci/test-optimization-validation/ci-command-candidate.js

@@ -0,0 +1,83 @@
+'use strict'
+
+const {
+  getCommandDetails,
+  serializeDisplayCommand,
+} = require('./command-runner')
+const { sanitizeEnv } = require('./redaction')
+
+/**
+ * Builds the normalized CI command metadata shape shared by reports and UI payloads.
+ *
+ * @param {object} framework manifest framework entry
+ * @returns {object|undefined} CI command candidate context when available
+ */
+function buildCiCommandCandidate (framework) {
+  const ciWiring = framework.ciWiring || {}
+  const command = framework.ciWiringCommand
+
+  if (!command && !hasCiWiringContext(ciWiring)) return
+
+  return removeUndefined({
+    provider: ciWiring.provider || undefined,
+    configFile: ciWiring.configFile || undefined,
+    workflow: ciWiring.workflow || undefined,
+    job: ciWiring.job || undefined,
+    step: ciWiring.step || undefined,
+    runner: ciWiring.runner || undefined,
+    shell: ciWiring.shell || undefined,
+    command: command ? serializeDisplayCommand(command) : ciWiring.command,
+    cwd: command?.cwd || ciWiring.workingDirectory,
+    whySelected: ciWiring.whySelected || ciWiring.selectionReason || ciWiring.diagnosis,
+    replayability: ciWiring.replayability,
+    replayBlocker: ciWiring.replayBlocker,
+    initialization: ciWiring.initialization,
+    env: buildCiEnvSummary(ciWiring, command),
+    packageScriptExpansionChain: getFirstArray(
+      ciWiring.packageScriptExpansionChain,
+      ciWiring.scriptExpansionChain,
+      ciWiring.commandExpansion
+    ),
+    runnerToolChain: getFirstArray(
+      ciWiring.runnerToolChain,
+      ciWiring.toolChain,
+      ciWiring.commandChain
+    ),
+    setupCommandIds: ciWiring.setupCommandIds,
+    unresolved: ciWiring.unresolved,
+    commandDetails: command && getCommandDetails(command),
+  })
+}
+
+function buildCiEnvSummary (ciWiring, command) {
+  const summary = removeUndefined({
+    workflow: sanitizeEnv(ciWiring.workflowEnv || ciWiring.env?.workflow),
+    job: sanitizeEnv(ciWiring.jobEnv || ciWiring.env?.job),
+    step: sanitizeEnv(ciWiring.stepEnv || command?.env || ciWiring.env?.step),
+    inherited: sanitizeEnv(ciWiring.inheritedEnv),
+  })
+
+  return Object.keys(summary).length > 0 ? summary : undefined
+}
+
+function hasCiWiringContext (ciWiring) {
+  return Object.keys(ciWiring).length > 0
+}
+
+function getFirstArray (...values) {
+  for (const value of values) {
+    if (Array.isArray(value) && value.length > 0) return value
+  }
+}
+
+function removeUndefined (object) {
+  const result = {}
+  for (const [key, value] of Object.entries(object)) {
+    if (value !== undefined) result[key] = value
+  }
+  return result
+}
+
+module.exports = {
+  buildCiCommandCandidate,
+}

package/ci/test-optimization-validation/ci-discovery.js

@@ -0,0 +1,181 @@
+'use strict'
+
+const path = require('node:path')
+
+const DEFAULT_CI_SEARCHES = [
+  '.github/workflows/*.yml',
+  '.github/workflows/*.yaml',
+  '.gitlab-ci.yml',
+  '.gitlab-ci.yaml',
+  '.circleci/config.yml',
+  '.circleci/config.yaml',
+  '.buildkite/pipeline.yml',
+  '.buildkite/pipeline.yaml',
+  'bitbucket-pipelines.yml',
+  'bitbucket-pipelines.yaml',
+  'azure-pipelines.yml',
+  'azure-pipelines.yaml',
+  '.azure-pipelines/*.yml',
+  '.azure-pipelines/*.yaml',
+  'Jenkinsfile',
+]
+
+function annotateCiDiscovery ({ manifest, diagnosis }) {
+  manifest.ciDiscovery = buildCiDiscovery({ manifest, diagnosis })
+
+  if (manifest.ciDiscovery.contradictions.length === 0) return
+
+  const warnings = Array.isArray(manifest.warnings) ? manifest.warnings : []
+  for (const contradiction of manifest.ciDiscovery.contradictions) {
+    const warning = `CI discovery contradiction: ${contradiction}`
+    if (!warnings.includes(warning)) warnings.push(warning)
+  }
+  manifest.warnings = warnings
+}
+
+function buildCiDiscovery ({ manifest, diagnosis }) {
+  const declared = isObject(manifest.ciDiscovery) ? manifest.ciDiscovery : {}
+  const staticFound = getStaticWorkflowLocations(diagnosis)
+  const declaredFound = normalizeStringArray(declared.found)
+  const candidateFound = getManifestWorkflowLocations(manifest)
+  const manifestFound = uniqueStrings([...declaredFound, ...candidateFound])
+  const searched = normalizeStringArray(declared.searched)
+  let method = 'validator-static-diagnosis'
+  if (candidateFound.length > 0) method = 'framework-ci-command'
+  if (declaredFound.length > 0) method = 'manifest'
+  if (typeof declared.method === 'string' && declared.method) method = declared.method
+  const found = manifestFound.length > 0 ? manifestFound : staticFound
+  const contradictions = getCiDiscoveryContradictions({ manifest, declaredFound: manifestFound, staticFound })
+
+  return {
+    searched: searched.length > 0 ? searched : DEFAULT_CI_SEARCHES,
+    found,
+    staticFound,
+    method,
+    warnings: normalizeStringArray(declared.warnings),
+    notes: normalizeStringArray(declared.notes),
+    contradictions,
+  }
+}
+
+function getManifestWorkflowLocations (manifest) {
+  const root = manifest.repository?.root
+  const locations = []
+  for (const framework of manifest.frameworks || []) {
+    const configFile = framework.ciWiring?.configFile
+    if (typeof configFile !== 'string') continue
+    if (!root || !path.isAbsolute(configFile)) {
+      locations.push(configFile)
+      continue
+    }
+
+    const relative = path.relative(root, configFile)
+    locations.push(relative && relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)
+      ? relative.split(path.sep).join('/')
+      : configFile)
+  }
+  return uniqueStrings(locations)
+}
+
+function getFrameworkCiDiscoveryContradiction (framework, manifest) {
+  const ciDiscovery = manifest?.ciDiscovery
+  if (!ciDiscovery || !Array.isArray(ciDiscovery.staticFound) || ciDiscovery.staticFound.length === 0) return null
+  if (!frameworkClaimsNoCi(framework)) return null
+
+  return {
+    reason: 'CI workflow files were found by validator static diagnosis, but this manifest entry says no CI ' +
+      'workflow was found. The manifest cannot support a "no CI workflow found" conclusion.',
+    recommendation: 'Inspect the discovered CI files with hidden-directory-aware discovery, then update ciWiring, ' +
+      'ciWiringCommand, omittedTestCommands, notes, or unresolved blockers before rerunning live validation.',
+    ciDiscovery,
+  }
+}
+
+function manifestHasCiDiscoveryContradiction (manifest) {
+  return Array.isArray(manifest?.ciDiscovery?.contradictions) &&
+    manifest.ciDiscovery.contradictions.length > 0
+}
+
+function getCiDiscoveryContradictions ({ manifest, declaredFound, staticFound }) {
+  if (staticFound.length === 0) return []
+
+  const contradictions = []
+  if (isObject(manifest.ciDiscovery) && declaredFound.length === 0) {
+    contradictions.push(
+      `manifest ciDiscovery.found is empty, but static diagnosis found ${formatList(staticFound)}`
+    )
+  }
+
+  for (const framework of manifest.frameworks || []) {
+    if (!frameworkClaimsNoCi(framework)) continue
+    contradictions.push(
+      `framework ${framework.id || '<unknown>'} records no CI workflow, but static diagnosis found ` +
+        formatList(staticFound)
+    )
+  }
+
+  return contradictions
+}
+
+function frameworkClaimsNoCi (framework) {
+  const ciWiring = framework?.ciWiring
+  if (!isObject(ciWiring)) return false
+  if (ciWiring.provider === 'none') return true
+
+  return textClaimsNoCi([
+    ciWiring.diagnosis,
+    ...(Array.isArray(ciWiring.unresolved) ? ciWiring.unresolved : []),
+    ...(Array.isArray(framework.notes) ? framework.notes : []),
+  ])
+}
+
+function textClaimsNoCi (values) {
+  return values.some(value => {
+    if (typeof value !== 'string') return false
+    return /no .*ci .*workflow/i.test(value) ||
+      /no .*ci .*configuration/i.test(value) ||
+      /no github actions.*gitlab.*circleci.*jenkins/i.test(value)
+  })
+}
+
+function getStaticWorkflowLocations (diagnosis) {
+  const results = Array.isArray(diagnosis?.results) ? diagnosis.results : []
+  const locations = []
+  const seen = new Set()
+
+  for (const result of results) {
+    if (result.title !== 'CI workflow files found' || !Array.isArray(result.locations)) continue
+    for (const location of result.locations) {
+      if (typeof location !== 'string' || seen.has(location)) continue
+      seen.add(location)
+      locations.push(location)
+    }
+  }
+
+  return locations
+}
+
+function normalizeStringArray (value) {
+  if (!Array.isArray(value)) return []
+  return value.filter(item => typeof item === 'string')
+}
+
+function uniqueStrings (values) {
+  return [...new Set(values.filter(value => typeof value === 'string' && value !== ''))]
+}
+
+function formatList (values) {
+  return values.map(value => `"${value}"`).join(', ')
+}
+
+function isObject (value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+module.exports = {
+  annotateCiDiscovery,
+  buildCiDiscovery,
+  getFrameworkCiDiscoveryContradiction,
+  getStaticWorkflowLocations,
+  manifestHasCiDiscoveryContradiction,
+}