forgedock 1.17.0 → 1.19.0

package/scripts/diff-size.sh

@@ -1,9 +1,12 @@
 #!/usr/bin/env bash
-# diff-size.sh — the ONE measurement of a build's diff size for the build phase size gate (forge#3450).
+# diff-size.sh — the ONE measurement of a build's diff size and scope (forge#3450, forge#3862).
 # SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios
 # SPDX-License-Identifier: AGPL-3.0-or-later
 #
 # Usage: diff-size.sh --repo-path P --base B [--threshold N] [--exclude-glob G]...
+#          [--test-weight PCT] [--module-depth N] [--plan-files FILE] [--estimate N] [--overrun-pct PCT]
+#   The size is never a gate (forge#3862): review_weight scales review depth and the scope diff (--plan-files) flags
+#   files outside the architect plan. --threshold/over/cohesive are DEPRECATED (kept one release for old callers).
 #   Measures lines changed (added + deleted) by the index plus any earlier commits against the MERGE BASE of
 #   HEAD and origin/B (git diff --cached --numstat --no-renames $(git merge-base HEAD origin/B)), so commits that
 #   landed on the base after the branch point are never counted as this build's changes. Exit 2 when the merge
@@ -15,7 +18,7 @@
 #   build/ dist/ generated/ fixtures/ vendor/ are anchored to the repo root (so first-party dirs such as
 #   commands/work-on/build/ are counted); __generated__/ and __snapshots__/ match at any depth.
 #   Globs are data, never evaluated.
-# Default globs (mirrored in docs/CONFIG.md under build.diff_size.exclude_globs):
+# Default globs (mirrored in docs/CONFIG.md under build.scope.exclude_globs, deprecated alias build.diff_size.exclude_globs):
 #   lockfiles (package-lock.json yarn.lock pnpm-lock.yaml Cargo.lock poetry.lock uv.lock go.sum Gemfile.lock
 #   composer.lock), *.min.*, *.snap, root-anchored dist/ build/ generated/ fixtures/ vendor/, any-depth
 #   __generated__/ __snapshots__/
@@ -27,6 +30,17 @@
 #   by basename); cohesive_lines = the union (a new test file counts once). cohesive=true when diff_lines>0 and
 #   cohesive_lines*100 >= 70*diff_lines and diff_lines <= threshold*3/2 (integer math; threshold 0 -> false).
 #   Test lines are classified, never discounted from diff_lines.
+#   review_weight (forge#3862): ws_lines = lines changed with whitespace ignored (git diff -w; a pure re-indent is 0)
+#   over the counted (non-excluded) files; review_weight = ceil((ws_lines of non-test files + --test-weight percent
+#   (default 50) of ws_lines of test files)); modules = distinct directories (first --module-depth path segments,
+#   default 2) holding a file with at least one non-whitespace changed line. Keys ws_lines, review_weight, modules
+#   follow cohesive= and precede top=.
+#   Scope diff, emitted only with --plan-files and/or --estimate: --plan-files FILE lists the architect's planned files
+#   (one per line; a leading "- " or "* ", backticks and "./" are stripped; an entry ending in "/" is a directory prefix;
+#   blank and "#" lines are ignored). scope=no_baseline (no entries) | ok | out_of_plan; plan_files=N; out_of_plan_count=K;
+#   up to 50 "out_of_plan=<path>" lines (counted files absent from the plan). --estimate N with --overrun-pct P
+#   (default 200) sets overrun=true when ws_lines*100 > N*P (N=0 means no estimate: overrun=false). Unreadable
+#   --plan-files is exit 2 (fail closed: an unreadable plan is never "in plan").
 # Exit: 0 measured (even when over); 2 usage or git failure with EMPTY stdout (fail closed: unknown is not zero).
 
 set -euo pipefail
@@ -34,7 +48,7 @@ set -euo pipefail
 _TEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/lib/telemetry.sh"; [ -f "$_TEL" ] && . "$_TEL" 2>/dev/null
 type forge_emit >/dev/null 2>&1 || forge_emit() { :; }
 
-REPO_PATH=""; BASE=""; THRESHOLD="1000"; EXTRA=()
+REPO_PATH=""; BASE=""; THRESHOLD="1000"; EXTRA=(); TEST_WEIGHT="50"; MODULE_DEPTH="2"; PLAN_FILE=""; ESTIMATE=""; OVERRUN_PCT="200"
 die() { echo "diff-size.sh: $*" >&2; exit 2; }
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -42,12 +56,33 @@ while [ $# -gt 0 ]; do
     --base) [ $# -ge 2 ] || die "missing value for $1"; BASE="$2"; shift 2 ;;
     --threshold) [ $# -ge 2 ] || die "missing value for $1"; THRESHOLD="$2"; shift 2 ;;
     --exclude-glob) [ $# -ge 2 ] || die "missing value for $1"; [ -z "$2" ] || EXTRA+=("$2"); shift 2 ;;
+    --test-weight) [ $# -ge 2 ] || die "missing value for $1"; TEST_WEIGHT="$2"; shift 2 ;;
+    --module-depth) [ $# -ge 2 ] || die "missing value for $1"; MODULE_DEPTH="$2"; shift 2 ;;
+    --plan-files) [ $# -ge 2 ] || die "missing value for $1"; PLAN_FILE="$2"; shift 2 ;;
+    --estimate) [ $# -ge 2 ] || die "missing value for $1"; ESTIMATE="$2"; shift 2 ;;
+    --overrun-pct) [ $# -ge 2 ] || die "missing value for $1"; OVERRUN_PCT="$2"; shift 2 ;;
     *) die "unknown argument: $1" ;;
   esac
 done
 [ -n "$REPO_PATH" ] && [ -d "$REPO_PATH" ] || die "--repo-path must be an existing directory"
 [ -n "$BASE" ] || die "--base is required"
 case "$THRESHOLD" in ""|*[!0-9]*) die "--threshold must be a non-negative integer" ;; esac
+case "$TEST_WEIGHT" in ""|*[!0-9]*) die "--test-weight must be a non-negative integer percent" ;; esac
+case "$MODULE_DEPTH" in ""|0|*[!0-9]*) die "--module-depth must be a positive integer" ;; esac
+case "$OVERRUN_PCT" in ""|*[!0-9]*) die "--overrun-pct must be a non-negative integer percent" ;; esac
+case "$ESTIMATE" in ""|*[!0-9]*) [ -z "$ESTIMATE" ] || die "--estimate must be a non-negative integer" ;; esac
+PLAN=(); PLAN_SET=0
+if [ -n "$PLAN_FILE" ]; then
+  [ -f "$PLAN_FILE" ] && [ -r "$PLAN_FILE" ] || die "--plan-files must be a readable file"
+  PLAN_SET=1
+  while IFS= read -r _l || [ -n "$_l" ]; do
+    _l="${_l#"${_l%%[![:space:]]*}"}"; _l="${_l%"${_l##*[![:space:]]}"}"
+    case "$_l" in ""|"#"*) continue ;; esac
+    case "$_l" in "- "*|"* "*) _l="${_l#??}" ;; esac
+    _l="${_l//\`/}"; _l="${_l#./}"
+    [ -n "$_l" ] && PLAN+=("$_l")
+  done < "$PLAN_FILE"
+fi
 
 DEFAULTS=(package-lock.json yarn.lock pnpm-lock.yaml Cargo.lock poetry.lock uv.lock go.sum Gemfile.lock composer.lock
   '*.min.*' '*.snap' __generated__/ __snapshots__/)
@@ -102,6 +137,32 @@ while IFS= read -r -d $'\001' rec; do
   fi
 done <<< "$RAW"
 
+# Whitespace-insensitive pass (forge#3862): review_weight and module count come from `git diff -w`.
+RAWW="$(git -C "$REPO_PATH" diff --cached -w --numstat --no-renames -z "$MB" -- | tr '\0' '\001')" \
+  || die "git diff -w against merge base $MB failed"
+WSL=0; WS_NT=0; WS_T=0; MODS=$'\001'; NMODS=0
+while IFS= read -r -d $'\001' rec; do
+  [ -n "$rec" ] || continue
+  a="${rec%%$'\t'*}"; rest="${rec#*$'\t'}"; d="${rest%%$'\t'*}"; path="${rest#*$'\t'}"
+  case "$a" in ''|*[!0-9]*) a=0 ;; esac
+  case "$d" in ''|*[!0-9]*) d=0 ;; esac
+  n=$((a + d))
+  excluded "$path" && continue
+  WSL=$((WSL + n))
+  if is_test "$path"; then WS_T=$((WS_T + n)); else WS_NT=$((WS_NT + n)); fi
+  if [ "$n" -gt 0 ]; then
+    dir="${path%/*}"; [ "$dir" = "$path" ] && dir="."
+    mod=""; _i=0; _rest="$dir"
+    while [ "$_i" -lt "$MODULE_DEPTH" ] && [ -n "$_rest" ]; do
+      _seg="${_rest%%/*}"; mod="${mod:+$mod/}$_seg"
+      case "$_rest" in */*) _rest="${_rest#*/}" ;; *) _rest="" ;; esac
+      _i=$((_i + 1))
+    done
+    case "$MODS" in *$'\001'"$mod"$'\001'*) ;; *) MODS="${MODS}${mod}"$'\001'; NMODS=$((NMODS + 1)) ;; esac
+  fi
+done <<< "$RAWW"
+REVIEW_WEIGHT=$(( (WS_NT * 100 + WS_T * TEST_WEIGHT + 99) / 100 ))
+
 OVER=false
 if [ "$THRESHOLD" -gt 0 ] && [ "$TOTAL" -gt "$THRESHOLD" ]; then OVER=true; fi
 echo "diff_lines=$TOTAL"
@@ -115,8 +176,36 @@ echo "new_lines=$NEWL"
 echo "test_lines=$TESTL"
 echo "cohesive_lines=$COHL"
 echo "cohesive=$COHESIVE"
+echo "ws_lines=$WSL"
+echo "review_weight=$REVIEW_WEIGHT"
+echo "modules=$NMODS"
+OOP_LIST=""; OOP=0; SCOPE=ok
+if [ "$PLAN_SET" = 1 ] || [ -n "$ESTIMATE" ]; then
+  if [ "${#PLAN[@]}" -eq 0 ]; then SCOPE=no_baseline; else
+    while IFS= read -r -d $'\001' rec; do
+      [ -n "$rec" ] || continue
+      path="${rec#*$'\t'}"; path="${path#*$'\t'}"
+      excluded "$path" && continue
+      inplan=0
+      for _p in "${PLAN[@]}"; do
+        case "$_p" in */) case "$path" in "$_p"*) inplan=1; break ;; esac ;; *) [ "$path" = "$_p" ] && { inplan=1; break; } ;; esac
+      done
+      if [ "$inplan" = 0 ]; then OOP=$((OOP + 1)); OOP_LIST="${OOP_LIST}${path}"$'\n'; fi
+    done <<< "$RAW"
+    [ "$OOP" -gt 0 ] && SCOPE=out_of_plan
+  fi
+  OVERRUN=false
+  if [ -n "$ESTIMATE" ] && [ "$ESTIMATE" -gt 0 ] && [ $((WSL * 100)) -gt $((ESTIMATE * OVERRUN_PCT)) ]; then OVERRUN=true; fi
+  echo "scope=$SCOPE"
+  echo "plan_files=${#PLAN[@]}"
+  echo "out_of_plan_count=$OOP"
+  [ -n "$ESTIMATE" ] && { echo "estimate=$ESTIMATE"; echo "overrun=$OVERRUN"; }
+fi
 _res=OK; if [ "$COHESIVE" = true ]; then _res=COHESIVE; elif [ "$OVER" = true ]; then _res=OVER; fi
-forge_emit diff_size lines="$TOTAL" excluded="$EXCL" threshold="$THRESHOLD" result="$_res"
+forge_emit diff_size lines="$TOTAL" excluded="$EXCL" threshold="$THRESHOLD" result="$_res" review_weight="$REVIEW_WEIGHT" modules="$NMODS" ws_lines="$WSL"
 if [ -n "$LIST" ]; then
   printf '%s' "$LIST" | sort -t' ' -k1,1nr | head -n 10 | sed 's/^/top=/' || true
 fi
+if [ -n "$OOP_LIST" ]; then
+  printf '%s' "$OOP_LIST" | head -n 50 | sed 's/^/out_of_plan=/' || true
+fi

package/scripts/diff-size.test.sh

@@ -137,10 +137,67 @@ check "test name patterns" "$OUT" test_lines 30
 reset; gen 20 > keep.py; gen 900 > package-lock.json; git add -A
 OUT="$(run --threshold 1000)"; check "excluded not in new_lines" "$OUT" new_lines 20
 
-# existing key order is unchanged: cohesion keys sit between over= and top=
+# existing key order is unchanged: cohesion keys sit between over= and top=; review keys follow cohesive=
 reset; gen 3 > s.txt; git add -A
 KEYS="$(run | sed -n 's/^\([a-z_]*\)=.*/\1/p' | tr '\n' ' ')"
-[ "$KEYS" = "diff_lines excluded_lines threshold over new_lines test_lines cohesive_lines cohesive top " ] && ok || bad "key order ($KEYS)"
+[ "$KEYS" = "diff_lines excluded_lines threshold over new_lines test_lines cohesive_lines cohesive ws_lines review_weight modules top " ] && ok || bad "key order ($KEYS)"
+
+# review_weight (forge#3862): a pure re-indent counts about 0, whatever its raw size
+reset; mkdir -p svc; awk 'BEGIN{for(i=0;i<120;i++) print "if x:\n    y" i}' > svc/h.py; git add -A; git commit -qm h; git push -q origin feat:staging 2>/dev/null
+awk 'BEGIN{for(i=0;i<120;i++) print "if x:\n        y" i}' > svc/h.py; git add -A
+OUT="$(run)"; check "re-indent raw diff_lines" "$OUT" diff_lines 240; check "re-indent ws_lines" "$OUT" ws_lines 0
+check "re-indent review_weight" "$OUT" review_weight 0; check "re-indent modules" "$OUT" modules 0
+git reset -q --hard origin/staging
+
+# tests are weighted (default 50%, configurable); ws_lines is unweighted
+reset; mkdir -p src tests; gen 100 > src/m.py; gen 200 > tests/test_m.py; git add -A
+OUT="$(run)"; check "weight ws_lines" "$OUT" ws_lines 300; check "weight default 50" "$OUT" review_weight 200
+OUT="$(run --test-weight 25)"; check "weight 25" "$OUT" review_weight 150
+OUT="$(run --test-weight 0)"; check "weight 0" "$OUT" review_weight 100
+OUT="$(run --test-weight 100)"; check "weight 100" "$OUT" review_weight 300
+reset; mkdir -p src; gen 3 > src/o.py; mkdir -p tests; gen 1 > tests/test_o.py; git add -A
+OUT="$(run)"; check "weight rounds up" "$OUT" review_weight 4
+
+# generated and vendored code is excluded from review_weight and modules
+reset; gen 10 > keep.py; mkdir -p vendor generated; gen 900 > vendor/v.js; gen 900 > generated/g.js; gen 900 > package-lock.json; git add -A
+OUT="$(run)"; check "excluded ws_lines" "$OUT" ws_lines 10; check "excluded review_weight" "$OUT" review_weight 10; check "excluded modules" "$OUT" modules 1
+
+# module count: distinct directories at --module-depth
+reset; mkdir -p a/b/c a/b/d a/e f; gen 5 > a/b/c/1.py; gen 5 > a/b/d/2.py; gen 5 > a/e/3.py; gen 5 > f/4.py; gen 5 > root.py; git add -A
+OUT="$(run)"; check "modules depth 2" "$OUT" modules 4
+OUT="$(run --module-depth 1)"; check "modules depth 1" "$OUT" modules 3
+OUT="$(run --module-depth 3)"; check "modules depth 3" "$OUT" modules 5
+
+# scope diff: in-plan, out-of-plan, prefix entries, formatting noise, no baseline, overrun
+reset; mkdir -p src tests docs; gen 10 > src/a.py; gen 10 > src/b.py; gen 10 > tests/test_a.py; gen 10 > docs/x.md; git add -A
+printf '%s\n' '# plan' '- `src/a.py`' '* ./src/b.py' '' 'tests/' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"
+check "scope out_of_plan" "$OUT" scope out_of_plan; check "scope count" "$OUT" out_of_plan_count 1
+check "scope plan_files" "$OUT" plan_files 3; check "scope path" "$OUT" out_of_plan docs/x.md
+printf '%s\n' src/a.py src/b.py tests/test_a.py docs/x.md > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "scope ok" "$OUT" scope ok; check "scope ok count" "$OUT" out_of_plan_count 0
+printf '%s\n' 'src/a.py' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "scope 3 out" "$OUT" out_of_plan_count 3
+: > "$TMP/plan"; OUT="$(run --plan-files "$TMP/plan")"; check "empty plan is no_baseline" "$OUT" scope no_baseline; check "no_baseline count" "$OUT" out_of_plan_count 0
+OUT="$(run)"; [ -z "$(val "$OUT" scope)" ] && ok || bad "scope keys absent without plan args"
+# excluded files are never out-of-plan; a path is data (glob chars, spaces) not a pattern
+reset; mkdir -p vendor; gen 5 > vendor/z.js; gen 5 > 'we ird[1].txt'; git add -A
+printf '%s\n' 'src/a.py' > "$TMP/plan"
+OUT="$(run --plan-files "$TMP/plan")"; check "excluded not out-of-plan" "$OUT" out_of_plan_count 1; check "path with space and glob quoted" "$OUT" out_of_plan 'we ird[1].txt'
+printf '%s\n' '*.txt' > "$TMP/plan"; OUT="$(run --plan-files "$TMP/plan")"; check "plan entry is not a glob" "$OUT" out_of_plan_count 1
+# overrun against the plan estimate (ws-insensitive actual)
+reset; gen 500 > big.py; git add -A
+OUT="$(run --estimate 200)"; check "overrun 2.5x" "$OUT" overrun true; check "overrun estimate" "$OUT" estimate 200; check "overrun no plan file is no_baseline" "$OUT" scope no_baseline
+OUT="$(run --estimate 250)"; check "at 2x not overrun" "$OUT" overrun false
+OUT="$(run --estimate 200 --overrun-pct 300)"; check "custom overrun pct" "$OUT" overrun false
+OUT="$(run --estimate 0)"; check "estimate 0 is no estimate" "$OUT" overrun false
+# unreadable plan fails closed; bad numeric args are usage errors
+OUT="$(bash "$S" --repo-path "$TMP/w" --base staging --plan-files "$TMP/none" 2>/dev/null)"; rc=$?
+{ [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "unreadable plan (rc=$rc)"
+for bad_arg in "--test-weight x" "--module-depth 0" "--overrun-pct -1" "--estimate x"; do
+  OUT="$(bash "$S" --repo-path "$TMP/w" --base staging $bad_arg 2>/dev/null)"; rc=$?
+  { [ "$rc" = 2 ] && [ -z "$OUT" ]; } && ok || bad "bad arg $bad_arg (rc=$rc)"
+done
 
 # fail closed: bad repo path, bad base, bad threshold, unknown arg, missing base
 OUT="$(bash "$S" --repo-path "$TMP/nope" --base staging 2>/dev/null)"; rc=$?

package/scripts/fixtures/ci-local/azure/azure-pipelines.yml

@@ -0,0 +1,11 @@
+pr:
+  branches:
+    include: [main]
+pool:
+  vmImage: ubuntu-latest
+variables:
+  greeting: hi
+steps:
+  - script: echo "$(greeting) azure"
+    displayName: say
+  - task: SomeUnknownTask@1

package/scripts/fixtures/ci-local/bitbucket/bitbucket-pipelines.yml

@@ -0,0 +1,12 @@
+image: atlassian/default-image:4
+pipelines:
+  default:
+    - step:
+        name: Build and test
+        script:
+          - echo bitbucket-test
+    - step:
+        name: Deploy
+        deployment: production
+        script:
+          - echo deploy

package/scripts/fixtures/ci-local/buildkite/.buildkite/pipeline.yml

@@ -0,0 +1,10 @@
+steps:
+  - label: ":hammer: test"
+    command: echo bk-test
+  - wait
+  - label: "docker plugin"
+    command: echo bk-docker
+    plugins:
+      - docker#v5.0.0:
+          image: node:20
+  - block: ":rocket: release"

package/scripts/fixtures/ci-local/circleci/.circleci/config.yml

@@ -0,0 +1,29 @@
+version: 2.1
+jobs:
+  test:
+    docker:
+      - image: cimg/base:stable
+    steps:
+      - checkout
+      - run:
+          name: unit
+          command: echo circle-unit
+  secured:
+    docker:
+      - image: cimg/base:stable
+    steps:
+      - run: echo secured
+  deploy-prod:
+    docker:
+      - image: cimg/base:stable
+    steps:
+      - run: echo deploy
+workflows:
+  main:
+    jobs:
+      - test
+      - secured:
+          context: org-secrets
+          requires: [test]
+      - deploy-prod:
+          requires: [test]

package/scripts/fixtures/ci-local/gha-basic/.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/ci.yml'
+jobs:
+  unit:
+    name: Unit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: unit tests
+        run: bash tests/greet.test.sh
+  matrix:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-14, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo matrix-ok
+  withservice:
+    runs-on: ubuntu-latest
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: example
+        ports:
+          - 5432:5432
+        options: --health-cmd pg_isready --health-interval 5s
+    steps:
+      - run: echo service-ok
+  needsecret:
+    runs-on: ubuntu-latest
+    env:
+      API_TOKEN: ${{ secrets.API_TOKEN }}
+    steps:
+      - run: echo uses-secret
+  unknownaction:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: some-org/mystery-action@v9
+  deployprod:
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - run: echo deploy
+  conditional:
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push'
+    steps:
+      - run: echo push-only

package/scripts/fixtures/ci-local/gha-basic/.github/workflows/docs.yml

@@ -0,0 +1,10 @@
+name: Docs
+on:
+  pull_request:
+    paths:
+      - 'docs/**'
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo docs-ok

package/scripts/fixtures/ci-local/gha-basic/.github/workflows/nightly.yml

@@ -0,0 +1,10 @@
+name: Nightly
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+jobs:
+  nightly:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo nightly

package/scripts/fixtures/ci-local/gha-basic/docs/index.md

@@ -0,0 +1 @@
+# docs

package/scripts/fixtures/ci-local/gha-basic/src/greet.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+greet() { echo "hello $1"; }

package/scripts/fixtures/ci-local/gha-basic/tests/greet.test.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+. "$(dirname "$0")/../src/greet.sh"
+[ "$(greet x)" = "hello x" ] || exit 1

package/scripts/fixtures/ci-local/gha-dorny/.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+on:
+  pull_request:
+    branches: [staging, main]
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.filter.outputs.backend }}
+      frontend: ${{ steps.filter.outputs.frontend }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dorny/paths-filter@v3
+        id: filter
+        with:
+          filters: |
+            backend:
+              - 'backend/**'
+            frontend:
+              - 'frontend/**'
+  backend:
+    needs: changes
+    if: needs.changes.outputs.backend == 'true'
+    runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:7
+        ports:
+          - 6379:6379
+    steps:
+      - run: echo backend-ok
+  frontend:
+    needs: changes
+    if: needs.changes.outputs.frontend == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo frontend-ok
+  integration:
+    needs: [changes]
+    if: needs.changes.outputs.backend == 'true'
+    runs-on: ubuntu-latest
+    env:
+      DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
+    steps:
+      - run: echo integration
+  deploy-staging:
+    needs: [backend]
+    runs-on: ubuntu-latest
+    environment: staging
+    steps:
+      - run: echo deploy

package/scripts/fixtures/ci-local/gha-dorny/backend/app.py

@@ -0,0 +1 @@
+print("a")

package/scripts/fixtures/ci-local/gha-dorny/docs/a.md

@@ -0,0 +1 @@
+# d

package/scripts/fixtures/ci-local/gha-dorny/frontend/app.js

@@ -0,0 +1 @@
+console.log(1)

package/scripts/fixtures/ci-local/gha-run/.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+on:
+  pull_request:
+jobs:
+  first:
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo first >> "$RUN_LOG"
+      - name: reads GITHUB_ENV
+        run: |
+          echo "FROM_STEP=carried" >> "$GITHUB_ENV"
+      - run: test "$FROM_STEP" = carried
+    env:
+      RUN_LOG: run.log
+  second:
+    needs: first
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo second
+  failing:
+    runs-on: ubuntu-latest
+    steps:
+      - run: |
+          echo "about to fail"
+          exit 3
+  skippedbyneed:
+    needs: failing
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo never
+  slow:
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    steps:
+      - run: echo slow-ok
+  broken-install:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm ci --no-audit --registry=http://127.0.0.1:9

package/scripts/fixtures/ci-local/gha-run/src/x.txt

@@ -0,0 +1 @@
+ok

package/scripts/fixtures/ci-local/gitlab/.gitlab-ci.yml

@@ -0,0 +1,43 @@
+stages: [build, test, deploy]
+variables:
+  GREETING: hello
+.template:
+  script:
+    - echo template
+lint:
+  stage: test
+  image: node:20
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes:
+        - src/**/*
+  script:
+    - echo "$GREETING lint"
+unit:
+  stage: test
+  extends: .template
+  only:
+    - merge_requests
+withdb:
+  stage: test
+  services:
+    - postgres:16
+  script:
+    - echo db
+manualjob:
+  stage: test
+  when: manual
+  script:
+    - echo manual
+release:
+  stage: deploy
+  environment: production
+  script:
+    - echo release
+docsonly:
+  stage: test
+  rules:
+    - changes:
+        - docs/**/*
+  script:
+    - echo docs

package/scripts/fixtures/ci-local/gitlab/docs/d.md

@@ -0,0 +1 @@
+d

package/scripts/fixtures/ci-local/gitlab/src/a.txt

@@ -0,0 +1 @@
+a

package/scripts/fixtures/ci-local/monorepo/.github/workflows/ci.yml

@@ -0,0 +1,13 @@
+name: CI
+on:
+  pull_request:
+jobs:
+  test-a:
+    runs-on: ubuntu-latest
+    steps:
+      - run: bash packages/a/tests/a.test.sh
+      - run: bash packages/b/tests/b.test.sh
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - run: shellcheck -S error packages/a/src/a.sh packages/b/src/b.sh

package/scripts/fixtures/ci-local/monorepo/package-lock.json

@@ -0,0 +1 @@
+{"lockfileVersion":1}

package/scripts/fixtures/ci-local/monorepo/packages/a/src/a.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+a() { echo a; }

package/scripts/fixtures/ci-local/monorepo/packages/a/tests/a.test.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+. "$(dirname "$0")/../src/a.sh"
+[ "$(a)" = a ]

package/scripts/fixtures/ci-local/monorepo/packages/b/src/b.sh

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+b() { echo b; }

package/scripts/fixtures/ci-local/monorepo/packages/b/tests/b.test.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+. "$(dirname "$0")/../src/b.sh"
+[ "$(b)" = b ]

package/scripts/fixtures/ci-local/no-ci/Makefile

@@ -0,0 +1,6 @@
+test:
+	@echo make-test
+lint:
+	@echo make-lint
+build:
+	@echo build

package/scripts/fixtures/ci-local/no-ci/package.json

@@ -0,0 +1 @@
+{ "name": "noci", "version": "1.0.0", "scripts": { "test": "node --test tests/", "lint": "echo lint-ok" } }

package/scripts/fixtures/ci-local/no-ci/src/a.js

@@ -0,0 +1 @@
+module.exports = 1

package/scripts/fixtures/ci-local/no-ci/src/b.js

@@ -0,0 +1 @@
+module.exports = 2

package/scripts/fixtures/ci-local/no-ci/tests/a.test.js

@@ -0,0 +1,2 @@
+const t = require('node:test');
+t('a', () => require('../src/a.js'));

package/scripts/fixtures/ci-local/no-ci/tests/b.test.js

@@ -0,0 +1,2 @@
+const t = require('node:test');
+t('b', () => require('../src/b.js'));