pumuki 6.3.7

package/scripts/consumer-support-bundle-markdown-top-sections-lib.ts

@@ -0,0 +1,51 @@
+import type {
+  ConsumerSupportBundleCliOptions,
+  ConsumerSupportBundleRepoResponse,
+  ConsumerSupportBundleWorkflowRun,
+} from './consumer-support-bundle-contract';
+
+const toMarkdownLiteral = (value: string): string => {
+  return value.length > 0 ? value : '(empty)';
+};
+
+export const buildConsumerSupportBundleHeaderLines = (params: {
+  generatedAtIso: string;
+  options: ConsumerSupportBundleCliOptions;
+  repoInfo?: ConsumerSupportBundleRepoResponse;
+  runs: ReadonlyArray<ConsumerSupportBundleWorkflowRun>;
+  startupFailures: ReadonlyArray<ConsumerSupportBundleWorkflowRun>;
+  startupStalledRuns: ReadonlyArray<ConsumerSupportBundleWorkflowRun>;
+  oldestQueuedRunAgeMinutes?: number;
+}): string[] => {
+  const lines: string[] = [];
+  lines.push('# Consumer Startup Failure Support Bundle');
+  lines.push('');
+  lines.push(`- generated_at: ${params.generatedAtIso}`);
+  lines.push(`- target_repo: \`${params.options.repo}\``);
+  if (params.repoInfo) {
+    lines.push(
+      `- repo_visibility: \`${params.repoInfo.visibility}\` (private=${String(params.repoInfo.private)})`
+    );
+  }
+  lines.push(`- runs_checked: ${params.runs.length}`);
+  lines.push(`- startup_failure_runs: ${params.startupFailures.length}`);
+  lines.push(`- startup_stalled_runs: ${params.startupStalledRuns.length}`);
+  lines.push(
+    `- oldest_queued_run_age_minutes: ${params.oldestQueuedRunAgeMinutes ?? 'unknown'}`
+  );
+  lines.push('');
+  return lines;
+};
+
+export const buildConsumerSupportBundleAuthSectionLines = (
+  authStatus: string
+): string[] => {
+  const lines: string[] = [];
+  lines.push('## GH Auth Status');
+  lines.push('');
+  lines.push('```text');
+  lines.push(toMarkdownLiteral(authStatus.trimEnd()));
+  lines.push('```');
+  lines.push('');
+  return lines;
+};

package/scripts/consumer-support-bundle-runner-lib.ts

@@ -0,0 +1,49 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { buildConsumerSupportBundleMarkdown } from './consumer-startup-failure-support-bundle-lib';
+import type { ConsumerSupportBundleCliOptions } from './consumer-support-bundle-contract';
+import {
+  collectConsumerSupportBundleRunDiagnostics,
+  ensureConsumerSupportBundleAuth,
+  loadConsumerSupportBundleActionsPermissions,
+  loadConsumerSupportBundleBillingInfo,
+  loadConsumerSupportBundleRepoInfo,
+  loadConsumerSupportBundleWorkflowRuns,
+} from './consumer-support-bundle-gh-lib';
+
+export const buildConsumerSupportBundleReport = (
+  options: ConsumerSupportBundleCliOptions
+): string => {
+  const authStatus = ensureConsumerSupportBundleAuth();
+  const repoInfoResult = loadConsumerSupportBundleRepoInfo(options.repo);
+  const actionsPermissionsResult = loadConsumerSupportBundleActionsPermissions(options.repo);
+  const billingResult = loadConsumerSupportBundleBillingInfo(options.repo);
+  const runs = loadConsumerSupportBundleWorkflowRuns(options);
+  const diagnostics = collectConsumerSupportBundleRunDiagnostics({
+    repo: options.repo,
+    runs,
+  });
+
+  return buildConsumerSupportBundleMarkdown({
+    generatedAtIso: new Date().toISOString(),
+    options,
+    authStatus,
+    repoInfo: repoInfoResult.ok ? repoInfoResult.data : undefined,
+    actionsPermissions: actionsPermissionsResult.ok ? actionsPermissionsResult.data : undefined,
+    actionsPermissionsError: actionsPermissionsResult.ok ? undefined : actionsPermissionsResult.error,
+    billingInfo: billingResult.ok ? billingResult.data : undefined,
+    billingError: billingResult.ok ? undefined : billingResult.error,
+    runs,
+    diagnostics,
+  });
+};
+
+export const writeConsumerSupportBundleReport = (params: {
+  markdown: string;
+  outFile: string;
+}): string => {
+  const outputPath = resolve(process.cwd(), params.outFile);
+  mkdirSync(dirname(outputPath), { recursive: true });
+  writeFileSync(outputPath, params.markdown, 'utf8');
+  return outputPath;
+};

package/scripts/consumer-support-ticket-cli-arg-setters-lib.ts

@@ -0,0 +1,30 @@
+import type { ConsumerSupportTicketCliOptions } from './consumer-support-ticket-cli-contract';
+
+export type ConsumerSupportTicketValueArg =
+  | '--repo'
+  | '--support-bundle'
+  | '--auth-report'
+  | '--out';
+
+type ConsumerSupportTicketValueSetter = (
+  options: ConsumerSupportTicketCliOptions,
+  value: string
+) => void;
+
+export const CONSUMER_SUPPORT_TICKET_VALUE_ARG_SETTERS: Record<
+  ConsumerSupportTicketValueArg,
+  ConsumerSupportTicketValueSetter
+> = {
+  '--repo': (options, value) => {
+    options.repo = value;
+  },
+  '--support-bundle': (options, value) => {
+    options.supportBundleFile = value;
+  },
+  '--auth-report': (options, value) => {
+    options.authReportFile = value;
+  },
+  '--out': (options, value) => {
+    options.outFile = value;
+  },
+};

package/scripts/consumer-support-ticket-cli-contract.ts

@@ -0,0 +1,14 @@
+export type ConsumerSupportTicketCliOptions = {
+  repo: string;
+  supportBundleFile: string;
+  authReportFile: string;
+  outFile: string;
+};
+
+export const DEFAULT_CONSUMER_SUPPORT_TICKET_REPO = 'owner/repo';
+export const DEFAULT_CONSUMER_SUPPORT_TICKET_SUPPORT_BUNDLE_FILE =
+  '.audit-reports/consumer-triage/consumer-startup-failure-support-bundle.md';
+export const DEFAULT_CONSUMER_SUPPORT_TICKET_AUTH_REPORT_FILE =
+  '.audit-reports/consumer-triage/consumer-ci-auth-check.md';
+export const DEFAULT_CONSUMER_SUPPORT_TICKET_OUT_FILE =
+  '.audit-reports/consumer-triage/consumer-support-ticket-draft.md';

package/scripts/consumer-support-ticket-cli-defaults-lib.ts

@@ -0,0 +1,14 @@
+import {
+  DEFAULT_CONSUMER_SUPPORT_TICKET_AUTH_REPORT_FILE,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_OUT_FILE,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_REPO,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_SUPPORT_BUNDLE_FILE,
+  type ConsumerSupportTicketCliOptions,
+} from './consumer-support-ticket-cli-contract';
+
+export const createConsumerSupportTicketDefaultOptions = (): ConsumerSupportTicketCliOptions => ({
+  repo: DEFAULT_CONSUMER_SUPPORT_TICKET_REPO,
+  supportBundleFile: DEFAULT_CONSUMER_SUPPORT_TICKET_SUPPORT_BUNDLE_FILE,
+  authReportFile: DEFAULT_CONSUMER_SUPPORT_TICKET_AUTH_REPORT_FILE,
+  outFile: DEFAULT_CONSUMER_SUPPORT_TICKET_OUT_FILE,
+});

package/scripts/consumer-support-ticket-cli-lib.ts

@@ -0,0 +1,63 @@
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import {
+  CONSUMER_SUPPORT_TICKET_VALUE_ARG_SETTERS,
+  type ConsumerSupportTicketValueArg,
+} from './consumer-support-ticket-cli-arg-setters-lib';
+import {
+  type ConsumerSupportTicketCliOptions,
+} from './consumer-support-ticket-cli-contract';
+import { createConsumerSupportTicketDefaultOptions } from './consumer-support-ticket-cli-defaults-lib';
+
+export type { ConsumerSupportTicketCliOptions } from './consumer-support-ticket-cli-contract';
+export {
+  DEFAULT_CONSUMER_SUPPORT_TICKET_AUTH_REPORT_FILE,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_OUT_FILE,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_REPO,
+  DEFAULT_CONSUMER_SUPPORT_TICKET_SUPPORT_BUNDLE_FILE,
+} from './consumer-support-ticket-cli-contract';
+
+const readRequiredArgValue = (
+  args: ReadonlyArray<string>,
+  index: number,
+  option: string
+): string => {
+  const value = args[index + 1];
+  if (!value) {
+    throw new Error(`Missing value for ${option}`);
+  }
+  return value;
+};
+
+export const parseConsumerSupportTicketArgs = (
+  args: ReadonlyArray<string>
+): ConsumerSupportTicketCliOptions => {
+  const options: ConsumerSupportTicketCliOptions = createConsumerSupportTicketDefaultOptions();
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg in CONSUMER_SUPPORT_TICKET_VALUE_ARG_SETTERS) {
+      const value = readRequiredArgValue(args, index, arg);
+      const setter =
+        CONSUMER_SUPPORT_TICKET_VALUE_ARG_SETTERS[arg as ConsumerSupportTicketValueArg];
+      setter(options, value);
+      index += 1;
+      continue;
+    }
+
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+
+  return options;
+};
+
+export const resolveRequiredConsumerSupportTicketFile = (
+  cwd: string,
+  pathLike: string
+): string => {
+  const absolute = resolve(cwd, pathLike);
+  if (!existsSync(absolute)) {
+    throw new Error(`Input file not found: ${pathLike}`);
+  }
+  return absolute;
+};

package/scripts/consumer-support-ticket-draft-diagnostics-sections-lib.ts

@@ -0,0 +1,67 @@
+import type { ParsedAuthReport, ParsedSupportBundle } from './consumer-support-ticket-parser-lib';
+
+const buildSiblingReportPath = (basePath: string, reportName: string): string => {
+  const separatorIndex = basePath.lastIndexOf('/');
+  if (separatorIndex < 0) {
+    return reportName;
+  }
+  return `${basePath.slice(0, separatorIndex)}/${reportName}`;
+};
+
+export const buildSupportTicketEvidenceLines = (
+  support: ParsedSupportBundle
+): ReadonlyArray<string> => {
+  const runUrls = support.runUrls.slice(0, 3);
+  if (runUrls.length === 0) {
+    return [
+      '## Evidence',
+      '',
+      '- No run URLs extracted from support bundle; attach report file directly.',
+      '',
+    ];
+  }
+
+  return ['## Evidence', '', 'Sample run URLs:', ...runUrls.map((runUrl) => `- ${runUrl}`), ''];
+};
+
+export const buildSupportTicketAuthLines = (auth: ParsedAuthReport): ReadonlyArray<string> => {
+  const lines = [
+    '## Auth and Billing Probe',
+    '',
+    `- auth verdict: ${auth.verdict ?? 'unknown'}`,
+    `- detected scopes: ${auth.detectedScopes ?? 'unknown'}`,
+    `- missing scopes: ${auth.missingScopes ?? 'unknown'}`,
+  ];
+
+  if (auth.billingError) {
+    lines.push(`- billing probe error: ${auth.billingError}`);
+  }
+  lines.push('');
+
+  return lines;
+};
+
+export const buildSupportTicketAttachmentLines = (params: {
+  supportBundlePath: string;
+  authReportPath: string;
+}): ReadonlyArray<string> => {
+  const attachmentPaths = [
+    params.supportBundlePath,
+    params.authReportPath,
+    buildSiblingReportPath(params.supportBundlePath, 'consumer-ci-artifacts-report.md'),
+    buildSiblingReportPath(params.supportBundlePath, 'consumer-workflow-lint-report.md'),
+    'docs/validation/archive/skills-rollout-mock_consumer-startup-fix-experiment.md',
+    'docs/validation/archive/private-actions-healthcheck.md',
+  ];
+
+  const uniqueAttachmentPaths = attachmentPaths.filter(
+    (path, index) => attachmentPaths.indexOf(path) === index
+  );
+
+  return [
+    '## Attachments',
+    '',
+    ...uniqueAttachmentPaths.map((path) => `- ${path}`),
+    '',
+  ];
+};

package/scripts/consumer-support-ticket-draft-lib.ts

@@ -0,0 +1,36 @@
+import type { ParsedAuthReport, ParsedSupportBundle } from './consumer-support-ticket-parser-lib';
+import {
+  buildSupportTicketAttachmentLines,
+  buildSupportTicketAuthLines,
+  buildSupportTicketEvidenceLines,
+  buildSupportTicketHeaderLines,
+  buildSupportTicketProblemSummaryLines,
+  buildSupportTicketRequestLines,
+} from './consumer-support-ticket-draft-sections-lib';
+
+export const buildSupportTicketDraft = (params: {
+  repo: string;
+  supportBundlePath: string;
+  authReportPath: string;
+  support: ParsedSupportBundle;
+  auth: ParsedAuthReport;
+}): string => {
+  const lines = [
+    ...buildSupportTicketHeaderLines({
+      generatedAt: new Date().toISOString(),
+      repo: params.repo,
+      supportBundlePath: params.supportBundlePath,
+      authReportPath: params.authReportPath,
+    }),
+    ...buildSupportTicketProblemSummaryLines(params.support),
+    ...buildSupportTicketEvidenceLines(params.support),
+    ...buildSupportTicketAuthLines(params.auth),
+    ...buildSupportTicketRequestLines(),
+    ...buildSupportTicketAttachmentLines({
+      supportBundlePath: params.supportBundlePath,
+      authReportPath: params.authReportPath,
+    }),
+  ];
+
+  return `${lines.join('\n')}\n`;
+};

package/scripts/consumer-support-ticket-draft-primary-sections-lib.ts

@@ -0,0 +1,51 @@
+import type { ParsedSupportBundle } from './consumer-support-ticket-parser-lib';
+
+export const buildSupportTicketHeaderLines = (params: {
+  generatedAt: string;
+  repo: string;
+  supportBundlePath: string;
+  authReportPath: string;
+}): ReadonlyArray<string> => [
+  '# Consumer CI Support Ticket Draft',
+  '',
+  `- generated_at: ${params.generatedAt}`,
+  `- repository: \`${params.repo}\``,
+  `- source_support_bundle: \`${params.supportBundlePath}\``,
+  `- source_auth_report: \`${params.authReportPath}\``,
+  '',
+  '## Subject',
+  '',
+  'Persistent GitHub Actions `startup_failure` with no jobs in private repository',
+  '',
+];
+
+export const buildSupportTicketProblemSummaryLines = (
+  support: ParsedSupportBundle
+): ReadonlyArray<string> => {
+  const lines: string[] = [
+    '## Problem Summary',
+    '',
+    '- Runs consistently end with `conclusion: startup_failure`.',
+    `- startup_failure_runs observed: ${support.startupFailureRuns ?? 'unknown'}.`,
+    `- startup_stalled_runs observed: ${support.startupStalledRuns ?? 'unknown'}.`,
+    `- oldest_queued_run_age_minutes observed: ${support.oldestQueuedRunAgeMinutes ?? 'unknown'}.`,
+    `- run metadata path: ${support.path ?? 'unknown'}.`,
+    `- jobs.total_count: ${support.jobsCount ?? 'unknown'}.`,
+    `- artifacts.total_count: ${support.artifactsCount ?? 'unknown'}.`,
+    `- repo visibility: ${support.repoVisibility ?? 'unknown'}.`,
+  ];
+
+  if (support.jobsCount === '0' && support.artifactsCount === '0') {
+    lines.push('- Latest runs remain queued/stuck before any job is created (job graph is empty).');
+  }
+
+  lines.push('');
+  return lines;
+};
+
+export const buildSupportTicketRequestLines = (): ReadonlyArray<string> => [
+  '## Request',
+  '',
+  'Please verify account/repository-level controls for private Actions execution (billing, policy, quotas, or internal restrictions) and provide the exact root cause for startup_failure before job graph creation.',
+  '',
+];

package/scripts/consumer-support-ticket-draft-sections-lib.ts

@@ -0,0 +1,10 @@
+export {
+  buildSupportTicketHeaderLines,
+  buildSupportTicketProblemSummaryLines,
+  buildSupportTicketRequestLines,
+} from './consumer-support-ticket-draft-primary-sections-lib';
+export {
+  buildSupportTicketAttachmentLines,
+  buildSupportTicketAuthLines,
+  buildSupportTicketEvidenceLines,
+} from './consumer-support-ticket-draft-diagnostics-sections-lib';

package/scripts/consumer-support-ticket-lib.ts

@@ -0,0 +1,3 @@
+export type { ParsedAuthReport, ParsedSupportBundle } from './consumer-support-ticket-parser-lib';
+export { parseAuthReport, parseSupportBundle } from './consumer-support-ticket-parser-lib';
+export { buildSupportTicketDraft } from './consumer-support-ticket-draft-lib';

package/scripts/consumer-support-ticket-parser-lib.ts

@@ -0,0 +1,72 @@
+export type ParsedSupportBundle = {
+  repoVisibility?: string;
+  startupFailureRuns?: string;
+  startupStalledRuns?: string;
+  oldestQueuedRunAgeMinutes?: string;
+  runUrls: ReadonlyArray<string>;
+  path?: string;
+  jobsCount?: string;
+  artifactsCount?: string;
+};
+
+export type ParsedAuthReport = {
+  verdict?: string;
+  detectedScopes?: string;
+  missingScopes?: string;
+  billingError?: string;
+};
+
+const extractLineValue = (source: string, pattern: RegExp): string | undefined => {
+  const match = source.match(pattern);
+  if (!match || !match[1]) {
+    return undefined;
+  }
+  return match[1].trim();
+};
+
+const dedupe = (values: ReadonlyArray<string>): string[] => {
+  const seen = new Set<string>();
+  const output: string[] = [];
+
+  for (const value of values) {
+    if (seen.has(value)) {
+      continue;
+    }
+    seen.add(value);
+    output.push(value);
+  }
+
+  return output;
+};
+
+export const parseSupportBundle = (markdown: string): ParsedSupportBundle => {
+  const runUrls = dedupe(
+    Array.from(
+      markdown.matchAll(/https:\/\/github\.com\/[^\s)]+\/actions\/runs\/\d+/g),
+      (match) => match[0]
+    )
+  );
+
+  return {
+    repoVisibility: extractLineValue(markdown, /- repo_visibility:\s*`([^`]+)`/),
+    startupFailureRuns: extractLineValue(markdown, /- startup_failure_runs:\s*([0-9]+)/),
+    startupStalledRuns: extractLineValue(markdown, /- startup_stalled_runs:\s*([0-9]+)/),
+    oldestQueuedRunAgeMinutes: extractLineValue(
+      markdown,
+      /- oldest_queued_run_age_minutes:\s*([0-9]+)/
+    ),
+    runUrls,
+    path: extractLineValue(markdown, /- path:\s*([^\n]+)/),
+    jobsCount: extractLineValue(markdown, /- jobs\.total_count:\s*([0-9]+)/),
+    artifactsCount: extractLineValue(markdown, /- artifacts\.total_count:\s*([0-9]+)/),
+  };
+};
+
+export const parseAuthReport = (markdown: string): ParsedAuthReport => {
+  return {
+    verdict: extractLineValue(markdown, /- verdict:\s*([^\n]+)/),
+    detectedScopes: extractLineValue(markdown, /- detected_scopes:\s*([^\n]+)/),
+    missingScopes: extractLineValue(markdown, /- missing_scopes:\s*([^\n]+)/),
+    billingError: extractLineValue(markdown, /## Billing Probe\s+[\s\S]*?- error:\s*([^\n]+)/),
+  };
+};

package/scripts/consumer-support-ticket-runner-lib.ts

@@ -0,0 +1,42 @@
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import type { ConsumerSupportTicketCliOptions } from './consumer-support-ticket-cli-contract';
+import { resolveRequiredConsumerSupportTicketFile } from './consumer-support-ticket-cli-lib';
+import { buildSupportTicketDraft } from './consumer-support-ticket-draft-lib';
+import { parseAuthReport, parseSupportBundle } from './consumer-support-ticket-parser-lib';
+
+export const buildConsumerSupportTicketDraftFromOptions = (params: {
+  cwd: string;
+  options: ConsumerSupportTicketCliOptions;
+}): string => {
+  const supportBundlePath = resolveRequiredConsumerSupportTicketFile(
+    params.cwd,
+    params.options.supportBundleFile
+  );
+  const authReportPath = resolveRequiredConsumerSupportTicketFile(
+    params.cwd,
+    params.options.authReportFile
+  );
+
+  const supportBundle = readFileSync(supportBundlePath, 'utf8');
+  const authReport = readFileSync(authReportPath, 'utf8');
+
+  return buildSupportTicketDraft({
+    repo: params.options.repo,
+    supportBundlePath: params.options.supportBundleFile,
+    authReportPath: params.options.authReportFile,
+    support: parseSupportBundle(supportBundle),
+    auth: parseAuthReport(authReport),
+  });
+};
+
+export const writeConsumerSupportTicketDraft = (params: {
+  cwd: string;
+  outFile: string;
+  draft: string;
+}): string => {
+  const outputPath = resolve(params.cwd, params.outFile);
+  mkdirSync(dirname(outputPath), { recursive: true });
+  writeFileSync(outputPath, params.draft, 'utf8');
+  return outputPath;
+};

package/scripts/consumer-workflow-lint-args-lib.ts

@@ -0,0 +1,56 @@
+import {
+  DEFAULT_CONSUMER_WORKFLOW_LINT_OUT_FILE,
+  type ConsumerWorkflowLintCliOptions,
+} from './consumer-workflow-lint-contract';
+
+export const parseConsumerWorkflowLintArgs = (
+  args: ReadonlyArray<string>
+): ConsumerWorkflowLintCliOptions => {
+  const options: ConsumerWorkflowLintCliOptions = {
+    repoPath: '',
+    outFile: DEFAULT_CONSUMER_WORKFLOW_LINT_OUT_FILE,
+    actionlintBin: 'actionlint',
+  };
+
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+
+    if (arg === '--repo-path') {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error('Missing value for --repo-path');
+      }
+      options.repoPath = value;
+      index += 1;
+      continue;
+    }
+
+    if (arg === '--out') {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error('Missing value for --out');
+      }
+      options.outFile = value;
+      index += 1;
+      continue;
+    }
+
+    if (arg === '--actionlint-bin') {
+      const value = args[index + 1];
+      if (!value) {
+        throw new Error('Missing value for --actionlint-bin');
+      }
+      options.actionlintBin = value;
+      index += 1;
+      continue;
+    }
+
+    throw new Error(`Unknown argument: ${arg}`);
+  }
+
+  if (!options.repoPath) {
+    throw new Error('Missing required argument --repo-path <path>');
+  }
+
+  return options;
+};

package/scripts/consumer-workflow-lint-command-lib.ts

@@ -0,0 +1,60 @@
+import { execFileSync } from 'node:child_process';
+import type {
+  ConsumerWorkflowLintCliOptions,
+  ConsumerWorkflowLintResult,
+} from './consumer-workflow-lint-contract';
+
+const normalizeWorkflowLintFailure = (params: {
+  error: unknown;
+  workflowPath: string;
+}): ConsumerWorkflowLintResult | undefined => {
+  if (
+    params.error &&
+    typeof params.error === 'object' &&
+    'status' in params.error &&
+    'stdout' in params.error &&
+    'stderr' in params.error
+  ) {
+    const status = Number((params.error as { status?: number }).status ?? 1);
+    const stdout = String((params.error as { stdout?: string | Buffer }).stdout ?? '');
+    const stderr = String((params.error as { stderr?: string | Buffer }).stderr ?? '');
+    return {
+      exitCode: Number.isFinite(status) ? status : 1,
+      output: `${stdout}${stderr}`.trim(),
+      workflowPath: params.workflowPath,
+    };
+  }
+
+  return undefined;
+};
+
+export const executeConsumerWorkflowLintCommand = (params: {
+  options: ConsumerWorkflowLintCliOptions;
+  workflowFiles: ReadonlyArray<string>;
+  workflowPath: string;
+}): ConsumerWorkflowLintResult => {
+  try {
+    const output = execFileSync(
+      params.options.actionlintBin,
+      ['-color', '-shellcheck=', '-pyflakes=', ...params.workflowFiles],
+      {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+      }
+    );
+    return {
+      exitCode: 0,
+      output,
+      workflowPath: params.workflowPath,
+    };
+  } catch (error) {
+    const normalizedFailure = normalizeWorkflowLintFailure({
+      error,
+      workflowPath: params.workflowPath,
+    });
+    if (normalizedFailure) {
+      return normalizedFailure;
+    }
+    throw error;
+  }
+};

package/scripts/consumer-workflow-lint-contract.ts

@@ -0,0 +1,14 @@
+export type ConsumerWorkflowLintCliOptions = {
+  repoPath: string;
+  outFile: string;
+  actionlintBin: string;
+};
+
+export type ConsumerWorkflowLintResult = {
+  exitCode: number;
+  output: string;
+  workflowPath: string;
+};
+
+export const DEFAULT_CONSUMER_WORKFLOW_LINT_OUT_FILE =
+  '.audit-reports/consumer-triage/consumer-workflow-lint-report.md';