forgedock 1.29.0 → 1.29.1

package/scripts/test-map.sh

@@ -17,11 +17,16 @@
 #     `ruff check .` (through `uv run` / `poetry run` when that lockfile exists), `**/*.py`
 #   go.mod (dir D) → `go test ./...`, `go vet ./...` in D, `D/**/*.go`, `D/go.mod`, `D/go.sum`
 #   Makefile / GNUmakefile targets test/lint/check/typecheck/vet → `make <target>`, `**`
-#   .github/workflows/*.yml|*.yaml `run:` steps (one command per line of a `|` block, a `>` block is one command;
-#     install/setup lines skipped): globs
-#     from the tool (python/go/shell/js), else the workflow's `paths:` filter, else `**`. A step whose job id, job
-#     name, step name or command matches deploy/publish/release/push/secret is never mapped (forge#4297): the engine
-#     runs these commands before a PR, so only check steps belong here.
+#   .github/workflows/*.yml|*.yaml `run:` steps (one command per line of a `|` block, a `>` block is one command).
+#     The engine runs these commands before a PR, so a step is mapped only when its whole
+#     command is an allowlisted check (forge#4300): `<pm> test`, `<pm> run <package.json check script>` (also `test:*`
+#     style names, `pnpm -r`, `npm --prefix DIR`), `make <check target>`, `go test|vet|build`, `cargo test|clippy|check`,
+#     gradle/maven with check tasks/goals only, `[bundle exec] rspec`, `python manage.py test`, `python -m unittest`,
+#     `tox`/`nox` (not a publish/release/deploy/upload env), `deno|bun test`, `bash|sh <path>.test.sh` or a known
+#     test/lint/typecheck tool (forge#4315); everything else is dropped, and job and step names are never consulted. One leading `cd DIR &&` / `pushd DIR &&` becomes the entry cwd; any other chaining,
+#     substitution, `${{ }}`, `$GITHUB_*`, redirect or `<(...)`/`>(...)`, a non-check make target, or a fixer form
+#     (`--fix`, `--write`, `-w`, `black`/`ruff format`/`gofmt`/`prettier` without their check flag) drops the step (forge#4316). Globs from the tool (python/go/shell/js, under the cwd), else the
+#     workflow's `paths:` filter, else `DIR/**` for a cwd; a workflow entry never gets a bare `**`.
 # Exit: 0 ok | 2 usage or bad repo path. bash 3.2 portable.
 set -uo pipefail
 
@@ -53,6 +58,38 @@ fi
 US="$(printf '\037')"
 row() { printf '%s\t%s\t%s\t%s\n' "$1" "$2" "$3" "$4" >> "$T/rows"; }
 JS_EXT="js jsx ts tsx mjs cjs"
+# check recognisers shared by package.json scripts / Makefile targets and the workflow allowlist (forge#4300)
+PKG_SCRIPTS="test|lint|typecheck|type-check|check|tsc"
+MAKE_TARGETS="test|lint|check|typecheck|vet"
+# forge#4315: `test:unit`, `lint:css` ... are the same check under a sub-name
+# (#4314: only a closed set of suffixes; fixers `lint:fix`, watchers, e2e/integration (need services), deploy-ish and
+# snapshot-updating scripts never run pre-PR.) $2 (optional) is the script's command: `format` is a check only when
+# that command is a check form.
+PKG_DENY='fix|watch|write|update|dev|serve|start|e2e|integration|deploy|release|publish|snapshot|-u'
+PKG_SUFFIXES="unit ci node types type ts js static check"
+pkg_check_script() {
+  [ -n "${1:-}" ] || return 1
+  case "$1" in *[!A-Za-z0-9:_.-]*) return 1 ;; esac
+  b=${1%%:*}
+  case "|$PKG_SCRIPTS|" in *"|$b|"*) ;; *) return 1 ;; esac
+  [ "$b" = "$1" ] && return 0
+  printf '%s' "$1" | grep -qiE "$PKG_DENY" && return 1
+  rest=${1#*:}; [ -n "$rest" ] || return 1
+  oldifs=$IFS; IFS=:; set -f
+  for seg in $rest; do
+    ok=0
+    case " $PKG_SUFFIXES " in *" $seg "*) [ -n "$seg" ] && ok=1 ;; esac
+    if [ "$ok" = 0 ] && [ "$seg" = format ]; then
+      case " ${2:-} " in *" --check "*|*" -c "*|*" --list-different "*|*" -l "*) ok=1 ;; esac
+    fi
+    [ "$ok" = 1 ] || { IFS=$oldifs; set +f; return 1; }
+  done
+  IFS=$oldifs; set +f
+  return 0
+}
+make_check_target() { case "|$MAKE_TARGETS|" in *"|$1|"*) [ -n "$1" ] ;; *) return 1 ;; esac; }
+has_word() { k=$1; shift; for w in "$@"; do [ "$w" = "$k" ] && return 0; done; return 1; }
+safe_dir() { case "$1" in ""|/*|*[!A-Za-z0-9._/-]*|..|../*|*/..|*/../*) return 1 ;; esac; return 0; }
 # globs for the extensions in $2 under dir $1 ("." = repo root)
 ext_globs() {
   g=""; pre=""; [ "$1" = "." ] || pre="$1/"
@@ -70,10 +107,10 @@ grep -E '(^|/)package\.json$' "$T/files" | grep -v -E '(^|/)node_modules/' | sor
   globs="$(ext_globs "$d" "$JS_EXT")$US$pj"
   tag=""
   if [ -n "$(ls "$d"/vitest.config.* "$d"/jest.config.* 2>/dev/null)" ] || jq -e 'has("jest")' "$pj" >/dev/null 2>&1; then tag=" (vitest/jest config)"; fi
-  jq -r '(.scripts // {}) | to_entries[] | select(.value | type == "string") | .key' "$pj" 2>/dev/null | while IFS= read -r s; do
+  jq -r '(.scripts // {}) | to_entries[] | select(.value | type == "string") | .key + "\t" + .value' "$pj" 2>/dev/null | while IFS="$(printf '\t')" read -r s sv; do
     case "$s" in
       test) row "$pj#scripts.$s$tag" "$d" "$PM run $s" "$globs" ;;
-      lint|typecheck|type-check|check) row "$pj#scripts.$s" "$d" "$PM run $s" "$globs" ;;
+      *) pkg_check_script "$s" "$sv" && row "$pj#scripts.$s" "$d" "$PM run $s" "$globs" ;;
     esac
   done
 done
@@ -105,20 +142,20 @@ done
 # ---- Makefile ----
 for mf in Makefile GNUmakefile; do
   [ -f "$mf" ] || continue
-  grep -oE '^(test|lint|check|typecheck|vet)[[:space:]]*:' "$mf" | sed -E 's/[[:space:]]*:$//' | sort -u | while IFS= read -r t; do
+  grep -oE "^($MAKE_TARGETS)[[:space:]]*:" "$mf" | sed -E 's/[[:space:]]*:$//' | sort -u | while IFS= read -r t; do
     row "$mf#$t" "." "make $t" "**"
   done
 done
 
 # ---- CI workflow run: steps ----
-# Emits: job US jobname US stepname US command (US = \037, so empty names survive `read`), one per command line; and P TAB path for each `paths:` filter item
+# Emits: job US command (US = \037), one per command line; and P TAB path for each `paths:` filter item
 # before `jobs:`. A block ends at the first non-blank line not indented past the `run` key (sibling keys such as env:).
 wf_extract() {
   awk '
     function indent(s) { match(s, /^ */); return RLENGTH }
     function unq(s) { sub(/^[ \t]+/, "", s); sub(/[ \t]+$/, "", s); if (s ~ /^".*"$/ || s ~ /^\x27.*\x27$/) s = substr(s, 2, length(s) - 2); return s }
-    function emit(c) { c = unq(c); if (c != "") print job "\037" jname "\037" sname "\037" c }
-    BEGIN { injobs = 0; jind = -1; block = 0; inpaths = 0; job = ""; jname = ""; sname = "" }
+    function emit(c) { c = unq(c); if (c != "") print job "\037" c }
+    BEGIN { injobs = 0; jind = -1; block = 0; inpaths = 0; job = "" }
     {
       line = $0; sub(/\r$/, "", line)
       if (block) {
@@ -143,13 +180,7 @@ wf_extract() {
         next
       }
       if (line ~ /^[^ \t#]/) { injobs = 0; next }
-      if (line ~ /^ +[A-Za-z0-9_-]+:[ \t]*$/ && (jind < 0 || indent(line) == jind)) { jind = indent(line); job = line; sub(/^ +/, "", job); sub(/:.*$/, "", job); jname = ""; sname = ""; next }
-      if (line ~ /^[ \t]*-[ \t]/) sname = ""
-      if (line ~ /^[ \t]*(-[ \t]+)?name:/) {
-        nm = line; sub(/^[ \t]*(-[ \t]+)?name:[ \t]*/, "", nm); sub(/[ \t]+#.*$/, "", nm)
-        if (line !~ /^[ \t]*-[ \t]/ && indent(line) == jind + 2) jname = unq(nm); else sname = unq(nm)
-        next
-      }
+      if (line ~ /^ +[A-Za-z0-9_-]+:[ \t]*$/ && (jind < 0 || indent(line) == jind)) { jind = indent(line); job = line; sub(/^ +/, "", job); sub(/:.*$/, "", job); next }
       if (line ~ /^[ \t]*(-[ \t]+)?run:/) {
         rest = line; sub(/^[ \t]*(-[ \t]+)?run:[ \t]*/, "", rest); sub(/[ \t]+#.*$/, "", rest)
         # bind = the column of the `run` key: step keys after it (env:, shell:) sit there and end the block
@@ -160,20 +191,93 @@ wf_extract() {
     END { if (block && pend != "") emit(pend) }
   ' "$1"
 }
-skip_cmd() {
-  case "$1" in
-    \#*|echo\ *|echo|cd\ *|export\ *|set\ *|if\ *|then|fi|else|for\ *|do|done|\}*|\{*|*'$GITHUB_'*|*'>> $GITHUB'*) return 0 ;;
-    npm\ ci*|npm\ install*|npm\ i|npm\ i\ *|pnpm\ install*|pnpm\ i|yarn|yarn\ install*|pip\ install*|pip3\ install*|python*\ -m\ pip\ install*|uv\ sync*|uv\ pip\ install*|poetry\ install*|go\ mod\ download*|apt-get*|sudo\ *|corepack\ *|brew\ *) return 0 ;;
+# forge#4300: allowlist. 0 when the whole command $1 is a recognised check; sets CK_CWD (one leading `cd|pushd DIR &&`,
+# else ".") and CK_CMD (the command without that prefix). Names never matter: a mutating command is dropped whatever its
+# step is called, and a check is mapped whatever it is called.
+check_cmd() {
+  c=$1; CK_CWD=.; CK_CMD=
+  # shellcheck disable=SC2016 # literal ${{ and $( patterns
+  # forge#4316: runner-file writes, redirects and process substitution are CI plumbing, never a local check
+  case "$c" in *'${{'*|*'`'*|*'$('*|*'$GITHUB_'*|*'<'*|*'>'*) return 1 ;; esac
+  case "$c" in
+    "cd "*" && "*|"pushd "*" && "*)
+      d=${c#* }; d=${d%%" && "*}; c=${c#*" && "}
+      case "$d" in ""|/*|*[!A-Za-z0-9._/-]*|..|../*|*/..|*/../*) return 1 ;; esac
+      d=${d%/}; [ -n "$d" ] && [ "$d" != . ] && CK_CWD=$d ;;
+  esac
+  c=${c%" && popd"}
+  case "$c" in *';'*|*'|'*|*'&'*) return 1 ;; esac
+  CK_CMD=$c
+  set -f
+  # shellcheck disable=SC2086 # split into words on purpose; set -f stops glob expansion
+  set -- $c
+  set +f
+  while [ $# -gt 0 ]; do case "$1" in [A-Za-z_]*=*) shift ;; *) break ;; esac; done
+  case "${1:-} ${2:-}" in
+    "uv run"|"poetry run"|"pnpm exec"|"yarn exec"|"python -m"|"python3 -m"|"bundle exec") shift 2 ;;
+    "npx "*|"bunx "*) shift ;;
+  esac
+  # forge#4316: a fixer rewrites the tree; only its read-only check form is a check
+  for w in "$@"; do case "$w" in --fix|--fix=*|--write|-w) return 1 ;; esac; done
+  case "${1:-} ${2:-}" in
+    "black "*|"ruff format") has_word --check "$@" || return 1 ;;
+    "gofmt "*) has_word -l "$@" || has_word -d "$@" || return 1 ;;
+    "prettier "*) has_word --check "$@" || has_word -c "$@" || has_word --list-different "$@" || has_word -l "$@" || return 1 ;;
+  esac
+  case "${1:-}" in
+    npm|pnpm|yarn|bun)
+      pm=$1; shift
+      case "$pm ${1:-}" in # forge#4315: pnpm -r test, npm --prefix DIR test
+        "pnpm -r"|"pnpm --recursive") shift ;;
+        "npm --prefix") [ $# -ge 2 ] && safe_dir "$2" || return 1; shift 2 ;;
+      esac
+      [ "${1:-}" = test ] && return 0
+      [ "${1:-}" = run ] && pkg_check_script "${2:-}" && return 0
+      case "$pm" in yarn|pnpm) pkg_check_script "${1:-}" && return 0 ;; esac
+      return 1 ;;
+    cargo) case "${2:-}" in test|clippy|check) return 0 ;; esac; return 1 ;;
+    ./gradlew|gradlew|gradle|./mvnw|mvnw|mvn)
+      # every non-flag word is a check task/goal (`:mod:test` qualified for gradle); publish/deploy/install never pass
+      case "$1" in *mvn*) goals="test|verify|validate" ;; *) goals="test|check|lint" ;; esac
+      shift; nt=0
+      for w in "$@"; do
+        case "$w" in -*) continue ;; esac
+        t=${w##*:}
+        case "|$goals|" in *"|$t|"*) [ -n "$t" ] && nt=$((nt+1)) ;; *) return 1 ;; esac
+      done
+      [ "$nt" -gt 0 ]; return ;;
+    rspec|unittest) return 0 ;;
+    python|python3) [ "${2:-}" = manage.py ] && [ "${3:-}" = test ]; return ;;
+    tox|nox)
+      shift; prev=""
+      for w in "$@"; do
+        case "$prev" in -e|-s|--env|--session|--sessions) case ",$w," in *publish*|*release*|*deploy*|*upload*) return 1 ;; esac ;; esac
+        case "$w" in -e*|-s*) case "${w#-?}" in *publish*|*release*|*deploy*|*upload*) return 1 ;; esac ;; esac
+        prev=$w
+      done
+      return 0 ;;
+    deno) [ "${2:-}" = test ]; return ;;
+    bash|sh) case "${2:-}" in *.test.sh) safe_dir "$2"; return ;; esac; return 1 ;;
+    make)
+      # forge#4316: every target must be a check (`make test deploy` is dropped); VAR=value and flags are not targets
+      shift; nt=0
+      for w in "$@"; do case "$w" in -*|*=*) continue ;; esac; make_check_target "$w" || return 1; nt=$((nt+1)); done
+      [ "$nt" -gt 0 ]; return ;;
+    go) case "${2:-}" in test|vet|build) return 0 ;; esac; return 1 ;;
+    node) [ "${2:-}" = --test ]; return ;;
+    eslint|tsc|prettier|vitest|jest|pytest|ruff|flake8|pylint|mypy|black|golangci-lint|gofmt|staticcheck|shellcheck) return 0 ;;
   esac
   return 1
 }
-# forge#4297: deploy, publish, release, push and secret-using steps are never check commands
-deploy_step() {
-  grep -qiE 'deploy|publish|release|push|secret' <<<"$*"
-}
 tool_globs() {
   c=" $1 "
   case "$c" in
+    *\ cargo\ *) printf '%s' "**/*.rs$US**/Cargo.toml${US}Cargo.lock"; return ;;
+    *gradlew\ *|*\ gradle\ *|*mvnw\ *|*\ mvn\ *) printf '%s' "$(ext_globs . "java kt kts gradle groovy scala")$US**/pom.xml"; return ;;
+    *[\ /]rspec\ *) printf '**/*.rb'; return ;;
+    *\ manage.py\ test\ *|*\ unittest\ *|*\ tox\ *|*\ nox\ *) printf '**/*.py'; return ;;
+    *\ npm\ --prefix\ *) d=${1#*--prefix }; d=${d%% *}; ext_globs "$d" "$JS_EXT"; return ;;
+    *\ deno\ *|*\ bun\ *|*\ bunx\ *) ext_globs . "$JS_EXT"; return ;;
     *[\ /]ruff\ *|*[\ /]flake8\ *|*[\ /]pylint\ *|*[\ /]mypy\ *|*[\ /]black\ *|*[\ /]pytest\ *) printf '**/*.py'; return ;;
     *[\ /]golangci-lint\ *|*[\ /]gofmt\ *|*[\ /]staticcheck\ *|*\ go\ *) printf '**/*.go'; return ;;
     *[\ /]shellcheck\ *|*\ bash\ *.sh\ *|*\ sh\ *.sh\ *) printf '**/*.sh'; return ;;
@@ -185,13 +289,14 @@ grep -E '^\.github/workflows/[^/]+\.(yml|yaml)$' "$T/files" | sort | while IFS=
   [ -f "$wf" ] || continue
   wf_extract "$wf" > "$T/wf"
   paths=$(awk -F'\t' '$1 == "P" { printf "%s\037", $2 }' "$T/wf"); paths=${paths%"$US"}
-  awk -F'\t' '$1 != "P"' "$T/wf" | while IFS="$(printf '\037')" read -r job jname sname cmd; do
-    skip_cmd "$cmd" && continue
-    deploy_step "$job" "$jname" "$sname" "$cmd" && continue
-    g=$(tool_globs "$cmd")
+  awk -F'\t' '$1 != "P"' "$T/wf" | while IFS="$US" read -r job cmd; do
+    check_cmd "$cmd" || continue
+    g=$(tool_globs "$CK_CMD")
+    [ -n "$g" ] && [ "$CK_CWD" != . ] && g="$CK_CWD/${g//$US/$US$CK_CWD/}"
     [ -n "$g" ] || g="$paths"
-    [ -n "$g" ] || g="**"
-    row "$wf#jobs.$job" "." "$cmd" "$g"
+    [ -n "$g" ] || { [ "$CK_CWD" != . ] && g="$CK_CWD/**"; }
+    [ -n "$g" ] || continue
+    row "$wf#jobs.$job" "$CK_CWD" "$CK_CMD" "$g"
   done
 done
 
@@ -207,5 +312,6 @@ MAP=$(jq -R -s -c '
 if [ "$STDOUT" = 1 ]; then printf '%s\n' "$MAP"; exit 0; fi
 [ -n "$OUT" ] || OUT=".forge/test-map.json"
 mkdir -p "$(dirname "$OUT")" || die "cannot create $(dirname "$OUT")"
-printf '%s\n' "$MAP" > "$OUT.tmp.$$" && mv "$OUT.tmp.$$" "$OUT" || die "cannot write $OUT"
+printf '%s\n' "$MAP" > "$OUT.tmp.$$" || die "cannot write $OUT"
+mv "$OUT.tmp.$$" "$OUT" || die "cannot write $OUT"
 echo "$OUT"

package/scripts/test-map.test.sh

@@ -15,11 +15,13 @@ eq() { if [ "$2" = "$3" ]; then ok; else bad "$1 (got: $2 want: $3)"; fi }
 
 # copy a fixture into a fresh git repo and build its map
 setup() {
-  rm -rf "$TMP/$1"; cp -R "$FIX/$1" "$TMP/$1"; cd "$TMP/$1" || exit 1
+  rm -rf "${TMP:?}/$1"; cp -R "$FIX/$1" "$TMP/$1"; cd "$TMP/$1" || exit 1
   git init -q -b main; git config user.email t@example.com; git config user.name t; git config commit.gpgsign false
   git add -A; git commit -qm init
   OUTP="$(bash "$S")"; RC=$?
 }
+# forge#4300: workflow-derived entries of the map JSON in $2 carry no bare `**` glob
+nostar() { eq "$1 no bare ** on workflow entries" "$(printf '%s' "$2" | jq '[.entries[] | select(.source | startswith(".github/workflows/")) | .globs[] | select(. == "**")] | length')" 0; }
 # selected commands for changed files, sorted, joined by |
 sel() { node "$SEL" --map .forge/test-map.json --select "$@" | LC_ALL=C sort | paste -sd'|' -; }
 
@@ -44,13 +46,15 @@ eq "python non-py" "$(sel uv.lock)" ""
 # ---- 3. go: go.mod, Makefile and CI workflow steps; CI-only lint step; install lines skipped ----
 setup go
 eq "go rc" "$RC" 0
-eq "go file" "$(sel main.go)" "./scripts/check-docs|go test ./...|go vet ./...|golangci-lint run ./...|make test"
-eq "nested go file" "$(sel internal/util/util.go)" "./scripts/check-docs|go test ./...|go vet ./...|golangci-lint run ./...|make test"
+eq "go file" "$(sel main.go)" "go test ./...|go vet ./...|golangci-lint run ./...|make test|make vet"
+eq "nested go file" "$(sel internal/util/util.go)" "go test ./...|go vet ./...|golangci-lint run ./...|make test|make vet"
+eq "unrecognised ci script dropped" "$(jq '[.entries[] | select(.command | test("check-docs"))] | length' .forge/test-map.json)" 0
 eq "ci-only lint source" "$(jq -r '.entries[] | select(.command == "golangci-lint run ./...") | .source' .forge/test-map.json)" ".github/workflows/ci.yml#jobs.lint"
 eq "install line skipped" "$(jq '[.entries[] | select(.command | test("mod download"))] | length' .forge/test-map.json)" 0
-eq "paths filter fallback" "$(jq -c '.entries[] | select(.command == "./scripts/check-docs") | .globs' .forge/test-map.json)" '["**.go","go.mod"]'
+eq "paths filter fallback" "$(jq -c '.entries[] | select(.command == "make vet") | .globs' .forge/test-map.json)" '["**.go","go.mod"]'
 eq "docs file" "$(sel README.md)" "make test"
 eq "go.sum" "$(sel go.sum)" "go test ./...|go vet ./...|make test"
+nostar go "$(cat .forge/test-map.json)"
 
 # ---- 4. regenerable: a rerun is byte-identical; --stdout writes nothing; --output ----
 cp .forge/test-map.json "$TMP/first.json"
@@ -84,8 +88,11 @@ jobs:
 EOF
 git add -A
 OUTS="$(bash "$S" --stdout)"
-eq "wf commands" "$(printf '%s' "$OUTS" | jq -r '[.entries[].command] | sort | join("|")')" "./custom-check|bash scripts/verify.sh --strict|ruff check --fix|shellcheck scripts/*.sh"
-eq "wf globs" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | {(.command): .globs}] | add')" '{"./custom-check":["**"],"bash scripts/verify.sh --strict":["**/*.sh"],"ruff check --fix":["**/*.py"],"shellcheck scripts/*.sh":["**/*.sh"]}'
+# forge#4300: ./custom-check and `bash scripts/verify.sh` are not allowlisted checks, so they are dropped
+# forge#4316: `ruff check --fix` rewrites the tree, so it is dropped too
+eq "wf commands" "$(printf '%s' "$OUTS" | jq -r '[.entries[].command] | sort | join("|")')" "shellcheck scripts/*.sh"
+eq "wf globs" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | {(.command): .globs}] | add')" '{"shellcheck scripts/*.sh":["**/*.sh"]}'
+nostar wf "$OUTS"
 
 # ---- 5b. forge#4297: `- run: |` then env:/shell: ends the block; deploy/publish/release/push/secret steps dropped ----
 mkdir -p "$TMP/wf2/.github/workflows"; cd "$TMP/wf2" || exit 1
@@ -130,6 +137,56 @@ EOF
 git add -A
 OUTS="$(bash "$S" --stdout)"
 eq "wf2 commands" "$(printf '%s' "$OUTS" | jq -r '[.entries[].command] | sort | join("|")')" "npm run lint|npm test|tsc --noEmit"
+nostar wf2 "$OUTS"
+
+# ---- 5d. forge#4300: allowlist, not a name/substring denylist; names never decide; cd/pushd prefix becomes the cwd ----
+mkdir -p "$TMP/wf3/.github/workflows"; cd "$TMP/wf3" || exit 1
+git init -q -b main
+cat > .github/workflows/ci.yml <<'EOF'
+on: pull_request
+jobs:
+  release-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - run: npm test
+      - run: pytest tests/test_release.py
+      - run: pushd sub && make test
+      - run: npm run lint
+        name: Deploy
+      - name: Run tests
+        uses: some/action@v1
+        with:
+          name: release
+      - name: Typecheck
+        with:
+          name: release
+        run: npm run typecheck
+  ship:
+    runs-on: ubuntu-latest
+    steps:
+      - run: twine upload dist/*
+      - run: terraform apply -auto-approve
+      - run: kubectl apply -f k8s/
+      - run: ./deploy.sh
+        name: test
+      - name: Tests
+        with:
+          name: test
+        run: ./publish.sh
+      - run: pytest && twine upload dist/*
+      - run: cd ../other && make test
+      - run: npm run build
+      - run: npm test -- --token=${{ secrets.NPM_TOKEN }}
+EOF
+git add -A
+OUTS="$(bash "$S" --stdout)"
+eq "wf3 commands" "$(printf '%s' "$OUTS" | jq -r '[.entries[].command] | sort | join("|")')" "make test|npm run lint|npm run typecheck|npm test|pytest tests/test_release.py"
+eq "wf3 release-tests job kept" "$(printf '%s' "$OUTS" | jq -r '[.entries[].source] | unique | join("|")')" ".github/workflows/ci.yml#jobs.release-tests"
+eq "wf3 pushd cwd + globs" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | select(.command == "make test") | {cwd, globs}]')" '[{"cwd":"sub","globs":["sub/**"]}]'
+eq "wf3 no mutating command" "$(printf '%s' "$OUTS" | jq '[.entries[] | select(.command | test("twine|terraform|kubectl|deploy|publish|build|secrets"))] | length')" 0
+nostar wf3 "$OUTS"
+printf '%s' "$OUTS" > "$TMP/wf3-map.json"
+eq "wf3 pushd entry runs in its dir" "$(node "$SEL" --map "$TMP/wf3-map.json" --select sub/Makefile)" "cd sub && make test"
 
 # ---- 5c. forge#4298: a package dir with a space and a non-ASCII name keeps whole globs; workflow paths with spaces ----
 mkdir -p "$TMP/sp/web app" "$TMP/sp/pkg/ü/src" "$TMP/sp/.github/workflows"; cd "$TMP/sp" || exit 1
@@ -148,15 +205,146 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - run: ./build-docs.sh
+      - run: make check
 EOF
 git add -A
 OUTS="$(bash "$S" --stdout)"
 eq "spaced package globs" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | select(.cwd == "web app") | .globs[]] | map(select(endswith("package.json") or endswith(".js")))')" '["web app/**/*.js","web app/package.json"]'
 eq "non-ASCII package dir" "$(printf '%s' "$OUTS" | jq -r '[.entries[] | select(.command == "npm run lint") | .cwd] | join("|")')" "pkg/ü"
-eq "spaced workflow path filter" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | select(.command == "./build-docs.sh") | .globs]')" '[["docs site/**"]]'
+eq "spaced workflow path filter" "$(printf '%s' "$OUTS" | jq -c '[.entries[] | select(.command == "make check") | .globs]')" '[["docs site/**"]]'
+nostar sp "$OUTS"
+eq "unrecognised docs script dropped" "$(printf '%s' "$OUTS" | jq '[.entries[] | select(.command == "./build-docs.sh")] | length')" 0
 printf '%s' "$OUTS" > "$TMP/sp-map.json"
 eq "spaced changed file selects its package test" "$(node "$SEL" --map "$TMP/sp-map.json" --select "web app/src/x.js")" "cd 'web app' && npm run test"
 
+# ---- 5e. forge#4315: real runners per ecosystem are mapped with their globs; mutating siblings stay dropped ----
+# wf_case NAME: the step commands on stdin become .github/workflows/ci.yml of a fresh repo; OUTS = its map
+wf_case() {
+  mkdir -p "$TMP/$1/.github/workflows"; cd "$TMP/$1" || exit 1
+  git init -q -b main
+  { printf 'on: pull_request\njobs:\n  ci:\n    runs-on: ubuntu-latest\n    steps:\n'; sed 's/^/      - run: /'; } > .github/workflows/ci.yml
+  git add -A
+  OUTS="$(bash "$S" --stdout)"
+  nostar "$1" "$OUTS"
+}
+cmds() { printf '%s' "$OUTS" | jq -r '[.entries[].command] | sort | join("|")'; }
+globs_of() { printf '%s' "$OUTS" | jq -r --arg c "$1" '[.entries[] | select(.command == $c) | .globs[]] | join(",")'; }
+
+wf_case rust <<'WF'
+cargo test --workspace
+cargo clippy -- -D warnings
+cargo publish
+cargo build --release
+WF
+eq "rust commands" "$(cmds)" "cargo clippy -- -D warnings|cargo test --workspace"
+eq "rust globs" "$(globs_of "cargo test --workspace")" "**/*.rs,**/Cargo.toml,Cargo.lock"
+
+wf_case jvm <<'WF'
+./gradlew test
+./gradlew :app:check --no-daemon
+mvn -B test
+./gradlew publish
+./gradlew test publish
+mvn deploy
+mvn install
+WF
+eq "jvm commands" "$(cmds)" "./gradlew :app:check --no-daemon|./gradlew test|mvn -B test"
+eq "jvm globs" "$(globs_of "mvn -B test")" "**/*.java,**/*.kt,**/*.kts,**/*.gradle,**/*.groovy,**/*.scala,**/pom.xml"
+
+wf_case ruby <<'WF'
+bundle exec rspec
+rspec spec/models
+bundle exec rake release
+WF
+eq "ruby commands" "$(cmds)" "bundle exec rspec|rspec spec/models"
+eq "ruby globs" "$(globs_of "bundle exec rspec")" "**/*.rb"
+
+wf_case pyrun <<'WF'
+python manage.py test
+python -m unittest discover
+tox
+nox -s lint
+tox -e publish
+nox -s release
+python manage.py migrate
+WF
+eq "python runner commands" "$(cmds)" "nox -s lint|python -m unittest discover|python manage.py test|tox"
+eq "python runner globs" "$(globs_of "tox")" "**/*.py"
+
+wf_case js <<'WF'
+deno test
+bun test
+pnpm -r test
+npm --prefix web test
+npm run test:unit
+deno deploy
+npm run deploy:prod
+npm --prefix ../x test
+WF
+eq "js runner commands" "$(cmds)" "bun test|deno test|npm --prefix web test|npm run test:unit|pnpm -r test"
+eq "bun globs" "$(globs_of "bun test")" "**/*.js,**/*.jsx,**/*.ts,**/*.tsx,**/*.mjs,**/*.cjs"
+eq "npm --prefix globs" "$(globs_of "npm --prefix web test")" "web/**/*.js,web/**/*.jsx,web/**/*.ts,web/**/*.tsx,web/**/*.mjs,web/**/*.cjs"
+
+# ---- 5f. forge#4314: package.json script suffix allowlist (fixers/watchers/e2e/deploy never run pre-PR) ----
+mkdir -p "$TMP/sfx"; cd "$TMP/sfx" || exit 1
+git init -q -b main
+cat > package.json <<'JSON'
+{"name":"s","scripts":{"test":"x","test:unit":"x","test:ci":"x","test:node":"x","test:types":"x","lint:ts":"x","lint:js":"x","check:static":"x","check:types":"x","tsc":"tsc --noEmit","typecheck":"tsc","lint:check":"x","test:unit:ci":"x","lint:format":"prettier --check .","check:format":"prettier --write .",
+"lint:fix":"eslint --fix .","check:fix":"x","test:watch":"x","test:e2e":"x","test:integration":"x","test:deploy":"x","test:update":"x","test:snapshot":"x","lint:css":"x","test:unit:watch":"x","test:-u":"x","lint:write":"x","test:dev":"x","check:release":"x"}}
+JSON
+git add -A
+SFX="$(bash "$S" --stdout | jq -r '[.entries[].source | sub("^package.json#scripts\\.";"")] | sort | join("|")')"
+eq "script suffix allowlist" "$SFX" "check:static|check:types|lint:check|lint:format|lint:js|lint:ts|test|test:ci|test:node|test:types|test:unit|test:unit:ci|tsc|typecheck"
+
+wf_case sfxwf <<'WF'
+npm run lint:fix
+npm run check:fix
+pnpm test:watch
+yarn test:e2e
+bun run test:integration
+npm run test:deploy
+pnpm run lint:fix
+npm run test:unit
+pnpm lint:ts
+yarn check:types
+bun run test:ci
+WF
+eq "workflow suffix commands" "$(cmds)" "bun run test:ci|npm run test:unit|pnpm lint:ts|yarn check:types"
+
+wf_case shell <<'WF'
+bash scripts/a.test.sh
+sh tests/b.test.sh
+bash scripts/deploy.sh
+bash scripts/verify.sh
+WF
+eq "shell commands" "$(cmds)" "bash scripts/a.test.sh|sh tests/b.test.sh"
+eq "shell globs" "$(globs_of "bash scripts/a.test.sh")" "**/*.sh"
+
+# ---- 5f. forge#4316: redirects, process substitution, $GITHUB_*, extra make targets and fixer forms are dropped ----
+# (make needs a cwd for its globs: a workflow entry never gets a bare **)
+wf_case unsafe <<'WF'
+pytest > out.txt
+pytest 2>&1
+diff <(a) <(b)
+tee >(x)
+cd sub && make test deploy
+eslint --fix .
+prettier --write .
+gofmt -w .
+black .
+ruff format .
+cargo clippy --fix
+pytest --junitxml=$GITHUB_WORKSPACE/r.xml
+cd sub && make test lint
+cd sub && make test V=1
+black --check .
+ruff format --check .
+prettier --check .
+gofmt -l .
+eslint .
+WF
+eq "unsafe forms dropped, check forms kept" "$(cmds)" "black --check .|eslint .|gofmt -l .|make test V=1|make test lint|prettier --check .|ruff format --check ."
+
 # ---- 6. usage ----
 bash "$S" --repo-path "$TMP/missing" >/dev/null 2>&1; eq "bad repo path" "$?" 2
 bash "$S" --nope >/dev/null 2>&1; eq "unknown option" "$?" 2