github-settings-as-code 4.0.4 → 4.0.6

package/dist/github/vulnerability-alerts/constants.d.mts

@@ -46,6 +46,8 @@ export declare const VulnerabilityAlertsSettings: Readonly<{
         typeName: string;
         details?: t.ValidationErrorDetails | undefined;
     }>[]>;
+    structure?: t.TypeStructure;
+    annotations?: t.TypeAnnotations;
     optional?: true;
 }> & Readonly<{
     shape: {
@@ -64,6 +66,8 @@ export declare const VulnerabilityAlertsSettings: Readonly<{
                 typeName: string;
                 details?: t.ValidationErrorDetails | undefined;
             }>[]>;
+            structure?: t.TypeStructure;
+            annotations?: t.TypeAnnotations;
             optional?: true;
         }>;
     };

package/dist/github/vulnerability-alerts/constants.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,2BAA2B,CACnC,CAAC"}
+{"version":3,"file":"constants.d.mts","sourceRoot":"","sources":["../../../src/github/vulnerability-alerts/constants.mts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEtC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAChD,OAAO,2BAA2B,CACnC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "github-settings-as-code",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "private": false,
   "keywords": [
     "github",
@@ -27,39 +27,39 @@
   "dependencies": {
     "@octokit/core": "^7.0.8",
     "dedent": "^1.7.2",
-    "dotenv": "^18.0.6",
+    "dotenv": "^18.0.8",
     "octokit-safe-types": "^1.2.28",
-    "ts-data-forge": "^14.7.1",
-    "ts-fortress": "^12.2.0",
-    "ts-repo-utils": "^10.7.1",
+    "ts-data-forge": "^14.11.0",
+    "ts-fortress": "^12.4.3",
+    "ts-repo-utils": "^10.7.2",
     "ts-type-forge": "^9.2.2"
   },
   "devDependencies": {
-    "@types/node": "26.6.4",
-    "@vitest/coverage-v8": "5.0.3",
-    "@vitest/ui": "5.0.3",
-    "cspell": "10.3.6",
-    "eslint": "10.12.0",
-    "eslint-config-typed": "5.17.3",
-    "eslint-plugin-ts-data-forge": "0.8.5",
-    "eslint-plugin-ts-fortress": "1.3.2",
-    "eslint-plugin-ts-type-forge": "0.8.7",
+    "@types/node": "26.6.5",
+    "@vitest/coverage-v8": "5.0.5",
+    "@vitest/ui": "5.0.5",
+    "cspell": "10.4.0",
+    "eslint": "10.13.0",
+    "eslint-config-typed": "7.4.0",
+    "eslint-plugin-ts-data-forge": "0.10.9",
+    "eslint-plugin-ts-fortress": "1.3.13",
+    "eslint-plugin-ts-type-forge": "0.8.18",
     "jiti": "2.7.0",
-    "npm-run-all2": "9.0.3",
-    "prettier": "3.9.9",
+    "npm-run-all2": "9.0.4",
+    "prettier": "3.9.10",
     "prettier-plugin-organize-imports": "4.3.0",
     "prettier-plugin-packagejson": "3.0.2",
     "tsx": "4.23.15",
     "typescript": "6.0.3",
     "typescript-native": "npm:typescript@7.0.2",
-    "vitest": "5.0.3"
+    "vitest": "5.0.5"
   },
   "engines": {
-    "node": ">=22.22.2",
+    "node": ">=22.23.4",
     "pnpm": ">=9.0.0"
   },
   "volta": {
-    "node": "26.11.1"
+    "node": "26.12.1"
   },
   "publishConfig": {
     "access": "public",
@@ -69,10 +69,10 @@
     "build": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/build.mts",
     "check:cspell": "cspell \"**\" --gitignore --gitignore-root ../../ --no-progress",
     "check:ext": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/check-ext.mts",
-    "check:lint": "oxlint . && eslint .",
-    "check:test": "pnpm run z:vitest:node run",
-    "check:test:cov": "pnpm run z:vitest:node run --coverage",
-    "check:types": "node ../../node_modules/typescript-native/bin/tsc --noEmit",
+    "check:lint": "node ../../tools/scripts/cmd/assert-deps-built.mts && oxlint . && eslint .",
+    "check:test": "node ../../tools/scripts/cmd/assert-deps-built.mts && pnpm run z:vitest:node run",
+    "check:test:cov": "node ../../tools/scripts/cmd/assert-deps-built.mts && pnpm run z:vitest:node run --coverage",
+    "check:types": "node ../../tools/scripts/cmd/assert-deps-built.mts && node ../../node_modules/typescript-native/bin/tsc --noEmit",
     "check-all": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/check-all.mts",
     "doc": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ./scripts/cmd/gen-docs.mts",
     "fix:codemod": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-codemod-cli/src/cmd/ts-codemod.mts --uncommitted --transformer append-as-const --transformer convert-to-readonly '{src,scripts,samples}/**/*.mts' && pnpm run fix:fmt",
@@ -81,7 +81,7 @@
     "fix:fmt": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-uncommitted.mts --cwd .",
     "fix:fmt:diff": "tsx --tsconfig ../../tools/configs/tsconfig.tsx.json ../../libs/ts-repo-utils/src/cmd/format-diff-from.mts origin/main --cwd .",
     "fix:fmt:full": "prettier --write .",
-    "fix:lint": "oxlint . --fix && eslint . --fix",
+    "fix:lint": "node ../../tools/scripts/cmd/assert-deps-built.mts && oxlint . --fix && eslint . --fix",
     "fmt": "pnpm run fix:fmt",
     "gen": "run-s gen:index",
     "gen:index": "run-s gen:index:src fix:fmt",

package/src/github/clear-json-files.mts

@@ -1,5 +1,5 @@
 import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
+import { listJsonFilesIn } from './list-json-files.mjs';
 
 /**
  * `dir` の直下の `*.json` を消す。ディレクトリが無ければ作る。
@@ -20,12 +20,7 @@ export const clearJsonFilesIn = async (dir: string): Promise<void> => {
   // eslint-disable-next-line security/detect-non-literal-fs-filename
   await fs.mkdir(dir, { recursive: true });
 
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
-  const entries = await fs.readdir(dir, { withFileTypes: true });
-
-  for (const entry of entries) {
-    if (entry.isFile() && entry.name.endsWith('.json')) {
-      await fs.rm(path.resolve(dir, entry.name));
-    }
+  for (const file of await listJsonFilesIn(dir)) {
+    await fs.rm(file);
   }
 };

package/src/github/environments/api/get-environments.mts

@@ -51,15 +51,6 @@ export const getAllEnvironments = async (): Promise<
   return settings.toSorted((a, b) => a.name.localeCompare(b.name));
 };
 
-/** 宣言ファイルに載る形。 `id` は GitHub 側の都合なので落とす。 */
-const getDeploymentBranchPolicyNames = async (
-  environmentName: string,
-): Promise<readonly Readonly<{ name: string; type: 'branch' | 'tag' }>[]> => {
-  const policies = await getDeploymentBranchPolicies(environmentName);
-
-  return policies.map(({ name, type }) => ({ name, type }));
-};
-
 /** 「 Selected branches and tags 」に登録されている pattern を列挙する。 */
 export const getDeploymentBranchPolicies = async (
   environmentName: string,
@@ -83,6 +74,15 @@ export const getDeploymentBranchPolicies = async (
   }));
 };
 
+/** 宣言ファイルに載る形。 `id` は GitHub 側の都合なので落とす。 */
+const getDeploymentBranchPolicyNames = async (
+  environmentName: string,
+): Promise<readonly Readonly<{ name: string; type: 'branch' | 'tag' }>[]> => {
+  const policies = await getDeploymentBranchPolicies(environmentName);
+
+  return policies.map(({ name, type }) => ({ name, type }));
+};
+
 export type DeploymentBranchPolicy = Readonly<{
   id: number;
   name: string;

package/src/github/environments/read-environment-contents.mts

@@ -1,30 +1,28 @@
-import type { Dirent } from 'node:fs';
 import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
 import * as t from 'ts-fortress';
 import { isDirectlyExecuted, Result } from 'ts-repo-utils';
 import { environmentsDir } from '../constants.mjs';
+import { listJsonFilesIn } from '../list-json-files.mjs';
 import { EnvironmentSettings } from './constants.mjs';
 
 export const readEnvironmentFiles = async (): Promise<
   readonly EnvironmentSettings[]
-> => readFilesIn(environmentsDir);
+> => readEnvironmentFilesIn(environmentsDir);
 
-const readFilesIn = async (
+/**
+ * `dir` の直下の宣言（`*.json`）を読んで検証する。テストが一時ディレクトリを
+ * 渡せるように、ディレクトリを引数に取る。
+ */
+export const readEnvironmentFilesIn = async (
   dir: string,
 ): Promise<readonly EnvironmentSettings[]> => {
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
-  const files: readonly Dirent<string>[] = await fs.readdir(dir, {
-    withFileTypes: true,
-  });
+  const files = await listJsonFilesIn(dir);
 
   const fileContents: readonly string[] = await Promise.all(
-    files
-      .filter((d) => d.isFile())
-      .map((d) =>
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        fs.readFile(path.resolve(dir, d.name), { encoding: 'utf8' }),
-      ),
+    files.map((file) =>
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      fs.readFile(file, { encoding: 'utf8' }),
+    ),
   );
 
   const validationResults = fileContents.map((content) =>

package/src/github/environments/read-environment-contents.test.mts

@@ -0,0 +1,31 @@
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { readEnvironmentFilesIn } from './read-environment-contents.mjs';
+
+// This repository's own declarations, as a known-valid fixture.
+const environmentsDir = path.resolve(
+  import.meta.dirname,
+  '../../../../../repo-settings/environments',
+);
+
+describe(readEnvironmentFilesIn, () => {
+  test('reads the declarations and ignores a README beside them', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'read-environments-'));
+
+    const declarations = await fs
+      .readdir(environmentsDir)
+      .then((names) => names.filter((n) => n.endsWith('.json')));
+
+    for (const name of declarations) {
+      await fs.copyFile(path.join(environmentsDir, name), path.join(dir, name));
+    }
+
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await fs.writeFile(path.join(dir, 'README.md'), '# notes');
+
+    const values = await readEnvironmentFilesIn(dir);
+
+    expect(values).toHaveLength(declarations.length);
+  });
+});

package/src/github/index.mts

@@ -2,6 +2,7 @@ export * from './actions-settings/index.mjs';
 export * from './clear-json-files.mjs';
 export * from './constants.mjs';
 export * from './environments/index.mjs';
+export * from './list-json-files.mjs';
 export * from './pages/index.mjs';
 export * from './repository/index.mjs';
 export * from './resolve-target-repo.mjs';

package/src/github/list-json-files.mts

@@ -0,0 +1,22 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+
+/**
+ * `dir` の直下にある `*.json` の絶対パス。宣言のディレクトリを読むところと
+ * 消すところは、どちらもこれで宣言のファイルを選ぶ。
+ *
+ * 拡張子で絞るのは、宣言の隣に置く README（`repo-settings/variables/README.md`
+ * のような、JSON でない同居ファイル）を宣言として読んだり消したりしないため。
+ * 読む側が絞らないと、README を置いただけで `JSON.parse` が投げ、apply が何も
+ * 送らずに止まる。
+ */
+export const listJsonFilesIn = async (
+  dir: string,
+): Promise<readonly string[]> => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  const entries = await fs.readdir(dir, { withFileTypes: true });
+
+  return entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith('.json'))
+    .map((entry) => path.resolve(dir, entry.name));
+};

package/src/github/list-json-files.test.mts

@@ -0,0 +1,45 @@
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { listJsonFilesIn } from './list-json-files.mjs';
+
+const makeDir = async (): Promise<string> =>
+  fs.mkdtemp(path.join(os.tmpdir(), 'list-json-files-'));
+
+/** 途中のディレクトリごと作って書く。入れ子の fixture もこれで用意する。 */
+const write = async (filePath: string, content: string): Promise<void> => {
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+
+  // eslint-disable-next-line security/detect-non-literal-fs-filename
+  await fs.writeFile(filePath, content);
+};
+
+describe(listJsonFilesIn, () => {
+  test('lists the json files directly under the directory, and nothing beside them', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'main.json'), '{}');
+
+    await write(path.join(dir, 'release.json'), '{}');
+
+    await write(path.join(dir, 'README.md'), '# notes');
+
+    await write(path.join(dir, 'nested', 'deep.json'), '{}');
+
+    const files = await listJsonFilesIn(dir);
+
+    assert.deepStrictEqual(files.toSorted(), [
+      path.join(dir, 'main.json'),
+      path.join(dir, 'release.json'),
+    ]);
+  });
+
+  test('is empty for a directory holding no json', async () => {
+    const dir = await makeDir();
+
+    await write(path.join(dir, 'README.md'), '# notes');
+
+    assert.deepStrictEqual(await listJsonFilesIn(dir), []);
+  });
+});

package/src/github/resolve-target-repo.mts

@@ -10,6 +10,53 @@ export type TargetRepo = Readonly<{
   repo: string;
 }>;
 
+/**
+ * 操作対象の repository を決める。
+ *
+ * 優先順位は以下の通り。
+ *
+ * 1. コマンドライン引数 `--owner` / `--repo`
+ * 2. 環境変数 `OWNER` / `REPO_NAME`
+ * 3. `git remote get-url origin`
+ * 4. `package.json` の `name` （ repo のみ ）
+ */
+export const resolveTargetRepo = async (): Promise<TargetRepo> => {
+  const sources: readonly Partial<TargetRepo>[] = [
+    fromCliArgs(),
+    fromEnv(),
+    fromGitRemote(),
+    await fromPackageJson(),
+  ] as const;
+
+  const owner = sources.map((s) => s.owner).find((v) => v !== undefined);
+
+  if (owner === undefined) {
+    throw new Error(
+      [
+        'owner を特定できませんでした。次のいずれかで指定してください:',
+        '  --owner <owner> （コマンドライン引数）',
+        '  OWNER=<owner>   （環境変数）',
+        '  git remote add origin <URL> （ origin の URL から推測されます）',
+      ].join('\n'),
+    );
+  }
+
+  const repo = sources.map((s) => s.repo).find((v) => v !== undefined);
+
+  if (repo === undefined) {
+    throw new Error(
+      [
+        'repository 名を特定できませんでした。次のいずれかで指定してください:',
+        '  --repo <repo>     （コマンドライン引数）',
+        '  REPO_NAME=<repo>  （環境変数）',
+        '  git remote add origin <URL> （ origin の URL から推測されます）',
+      ].join('\n'),
+    );
+  }
+
+  return { owner, repo };
+};
+
 /** `strict: false` の解析結果は string | boolean | 配列 になりうるため絞り込む。 */
 const pickString = (value: unknown): string | undefined =>
   value !== '' && isString(value) ? value : undefined;
@@ -95,50 +142,3 @@ const fromPackageJson = async (): Promise<Partial<TargetRepo>> => {
     return {};
   }
 };
-
-/**
- * 操作対象の repository を決める。
- *
- * 優先順位は以下の通り。
- *
- * 1. コマンドライン引数 `--owner` / `--repo`
- * 2. 環境変数 `OWNER` / `REPO_NAME`
- * 3. `git remote get-url origin`
- * 4. `package.json` の `name` （ repo のみ ）
- */
-export const resolveTargetRepo = async (): Promise<TargetRepo> => {
-  const sources: readonly Partial<TargetRepo>[] = [
-    fromCliArgs(),
-    fromEnv(),
-    fromGitRemote(),
-    await fromPackageJson(),
-  ] as const;
-
-  const owner = sources.map((s) => s.owner).find((v) => v !== undefined);
-
-  if (owner === undefined) {
-    throw new Error(
-      [
-        'owner を特定できませんでした。次のいずれかで指定してください:',
-        '  --owner <owner> （コマンドライン引数）',
-        '  OWNER=<owner>   （環境変数）',
-        '  git remote add origin <URL> （ origin の URL から推測されます）',
-      ].join('\n'),
-    );
-  }
-
-  const repo = sources.map((s) => s.repo).find((v) => v !== undefined);
-
-  if (repo === undefined) {
-    throw new Error(
-      [
-        'repository 名を特定できませんでした。次のいずれかで指定してください:',
-        '  --repo <repo>     （コマンドライン引数）',
-        '  REPO_NAME=<repo>  （環境変数）',
-        '  git remote add origin <URL> （ origin の URL から推測されます）',
-      ].join('\n'),
-    );
-  }
-
-  return { owner, repo };
-};

package/src/github/ruleset/read-rule-set-contents.mts

@@ -1,29 +1,27 @@
-import type { Dirent } from 'node:fs';
 import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
 import * as t from 'ts-fortress';
 import { isDirectlyExecuted, Result } from 'ts-repo-utils';
 import { rulesetsDir } from '../constants.mjs';
+import { listJsonFilesIn } from '../list-json-files.mjs';
 import { RulesetPicked } from './constants.mjs';
 
 export const readRulesetFiles = async (): Promise<readonly RulesetPicked[]> =>
-  readFilesIn(rulesetsDir);
+  readRulesetFilesIn(rulesetsDir);
 
-const readFilesIn = async (dir: string): Promise<readonly RulesetPicked[]> => {
-  // eslint-disable-next-line security/detect-non-literal-fs-filename
-  const files: readonly Dirent<string>[] = await fs.readdir(dir, {
-    withFileTypes: true,
-  });
+/**
+ * `dir` の直下の宣言（`*.json`）を読んで検証する。テストが一時ディレクトリを
+ * 渡せるように、ディレクトリを引数に取る。
+ */
+export const readRulesetFilesIn = async (
+  dir: string,
+): Promise<readonly RulesetPicked[]> => {
+  const files = await listJsonFilesIn(dir);
 
   const rulesetFileContents: readonly string[] = await Promise.all(
-    files
-      .filter((d) => d.isFile())
-      .map((d) =>
-        // eslint-disable-next-line security/detect-non-literal-fs-filename
-        fs.readFile(path.resolve(dir, d.name), {
-          encoding: 'utf8',
-        }),
-      ),
+    files.map((file) =>
+      // eslint-disable-next-line security/detect-non-literal-fs-filename
+      fs.readFile(file, { encoding: 'utf8' }),
+    ),
   );
 
   const validationResults = rulesetFileContents.map((rule) =>

package/src/github/ruleset/read-rule-set-contents.test.mts

@@ -0,0 +1,31 @@
+import * as fs from 'node:fs/promises';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { readRulesetFilesIn } from './read-rule-set-contents.mjs';
+
+// This repository's own declarations, as a known-valid fixture.
+const rulesetsDir = path.resolve(
+  import.meta.dirname,
+  '../../../../../repo-settings/rulesets',
+);
+
+describe(readRulesetFilesIn, () => {
+  test('reads the declarations and ignores a README beside them', async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), 'read-rulesets-'));
+
+    const declarations = await fs
+      .readdir(rulesetsDir)
+      .then((names) => names.filter((n) => n.endsWith('.json')));
+
+    for (const name of declarations) {
+      await fs.copyFile(path.join(rulesetsDir, name), path.join(dir, name));
+    }
+
+    // eslint-disable-next-line security/detect-non-literal-fs-filename
+    await fs.writeFile(path.join(dir, 'README.md'), '# notes');
+
+    const values = await readRulesetFilesIn(dir);
+
+    expect(values).toHaveLength(declarations.length);
+  });
+});

package/src/github/ruleset/schema.test.mts

@@ -70,7 +70,7 @@ describe('the ruleset schema', () => {
     assert.isTrue(Arr.isNonEmpty(files));
 
     for (const [name, content] of files) {
-      assert.deepStrictEqual(
+      assert.strictEqual(
         outcomeOf(name, RulesetPicked.validate(content)),
         name,
       );
@@ -84,7 +84,7 @@ describe('the ruleset schema', () => {
 
     const declared = RulesetPicked.validate(files[0][1]);
 
-    assert.deepStrictEqual(outcomeOf(files[0][0], declared), files[0][0]);
+    assert.strictEqual(outcomeOf(files[0][0], declared), files[0][0]);
 
     if (Result.isErr(declared)) {
       return;

package/src/github/settings-file-path.test.mts

@@ -13,47 +13,44 @@ const outcomeOf = (name: string): string => {
 
 describe(settingsFilePath, () => {
   test('names a file directly under the directory it was given', () => {
-    assert.deepStrictEqual(
+    assert.strictEqual(
       settingsFilePath(dir, 'release'),
       path.join(dir, 'release.json'),
     );
   });
 
   test('keeps the characters a name is allowed to carry', () => {
-    assert.deepStrictEqual(
+    assert.strictEqual(
       settingsFilePath(dir, 'main-no-bypass'),
       path.join(dir, 'main-no-bypass.json'),
     );
 
-    assert.deepStrictEqual(
+    assert.strictEqual(
       settingsFilePath(dir, 'Production (US East)'),
       path.join(dir, 'Production (US East).json'),
     );
   });
 
   test('rejects a name that would resolve above the directory', () => {
-    assert.deepStrictEqual(outcomeOf('../release'), 'rejected');
+    assert.strictEqual(outcomeOf('../release'), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf('../../../../tmp/elsewhere'), 'rejected');
+    assert.strictEqual(outcomeOf('../../../../tmp/elsewhere'), 'rejected');
   });
 
   test('rejects a name carrying a separator, rather than nesting it', () => {
-    assert.deepStrictEqual(outcomeOf('production/us-east'), 'rejected');
+    assert.strictEqual(outcomeOf('production/us-east'), 'rejected');
 
-    assert.deepStrictEqual(
-      outcomeOf(String.raw`production\us-east`),
-      'rejected',
-    );
+    assert.strictEqual(outcomeOf(String.raw`production\us-east`), 'rejected');
   });
 
   test('rejects the names that are not file names at all', () => {
-    assert.deepStrictEqual(outcomeOf(''), 'rejected');
+    assert.strictEqual(outcomeOf(''), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf('.'), 'rejected');
+    assert.strictEqual(outcomeOf('.'), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf('..'), 'rejected');
+    assert.strictEqual(outcomeOf('..'), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf('release\u{0}'), 'rejected');
+    assert.strictEqual(outcomeOf('release\u{0}'), 'rejected');
   });
 
   test('says which name it refused', () => {

package/src/github/variables/constants.test.mts

@@ -55,7 +55,7 @@ describe('the repository-variables schema', () => {
 
 describe(assertVariableNamesAreValid, () => {
   test('accepts the names GitHub accepts', () => {
-    assert.deepStrictEqual(
+    assert.strictEqual(
       outcomeOf({
         REPO_AUTOMATION_BOT_CLIENT_ID: 'x',
         lowercase_is_allowed: 'x',
@@ -67,25 +67,25 @@ describe(assertVariableNamesAreValid, () => {
   });
 
   test('rejects a name starting with a digit', () => {
-    assert.deepStrictEqual(outcomeOf({ '1ST_PLACE': 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ '1ST_PLACE': 'x' }), 'rejected');
   });
 
   test('rejects a name carrying a character GitHub does not allow', () => {
-    assert.deepStrictEqual(outcomeOf({ 'WITH-HYPHEN': 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ 'WITH-HYPHEN': 'x' }), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf({ 'WITH SPACE': 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ 'WITH SPACE': 'x' }), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf({ 'WITH.DOT': 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ 'WITH.DOT': 'x' }), 'rejected');
   });
 
   test('rejects the reserved GITHUB_ prefix, in any case', () => {
-    assert.deepStrictEqual(outcomeOf({ GITHUB_TOKEN: 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ GITHUB_TOKEN: 'x' }), 'rejected');
 
-    assert.deepStrictEqual(outcomeOf({ github_token: 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ github_token: 'x' }), 'rejected');
   });
 
   test('rejects an empty name', () => {
-    assert.deepStrictEqual(outcomeOf({ '': 'x' }), 'rejected');
+    assert.strictEqual(outcomeOf({ '': 'x' }), 'rejected');
   });
 
   test('names every offender, so one run fixes the file', () => {