reposets 0.4.2 → 1.0.0

package/sync/decide.js

@@ -0,0 +1,56 @@
+//#region src/sync/decide.ts
+/**
+* Decides what to do about one resource from three fingerprints.
+*
+* @remarks
+* Pure and total — no I/O, no failure mode. All three inputs are
+* {@link fingerprint} outputs over the same resource.
+*
+* The distinction that justifies persisting anything: **`desired` vs `live`
+* tells you something is wrong; `live` vs `applied` tells you who did it.**
+* Without the stored `applied` fingerprint the two are indistinguishable, and
+* every divergence looks like a config change.
+*
+* `Drift` is reported even when `needsApply` is `false` — that is the case where
+* someone edited the repository in the GitHub UI to a value that happens to
+* match the config. Nothing needs writing, but a human still changed something
+* out of band and the journal should say so.
+*
+* A missing `applied` row yields `FirstSync` rather than `Drift`: with no
+* baseline there is no evidence anyone changed anything, and claiming drift on
+* first contact would flag every pre-existing repository.
+*
+* @param desired - fingerprint of the resolved config for this resource
+* @param live - fingerprint of what GitHub currently reports
+* @param applied - fingerprint reposets last wrote, if it has ever written one
+*
+* @public
+*/
+const decide = (desired, live, applied) => {
+	if (applied._tag === "None") return {
+		_tag: "FirstSync",
+		needsApply: desired !== live
+	};
+	if (applied.value === live) return desired === live ? { _tag: "InSync" } : { _tag: "ConfigChanged" };
+	return {
+		_tag: "Drift",
+		applied: applied.value,
+		live,
+		needsApply: desired !== live
+	};
+};
+/**
+* Whether a decision requires writing to GitHub.
+*
+* @public
+*/
+const needsApply = (decision) => decision._tag === "ConfigChanged" || (decision._tag === "FirstSync" || decision._tag === "Drift") && decision.needsApply;
+/**
+* Whether a decision represents an out-of-band change worth reporting.
+*
+* @public
+*/
+const isDrift = (decision) => decision._tag === "Drift";
+
+//#endregion
+export { decide, isDrift, needsApply };

package/sync/phase.js

@@ -0,0 +1,55 @@
+import { Effect } from "effect";
+
+//#region src/sync/phase.ts
+/** A phase that touched nothing and failed at nothing. */
+const emptyResult = {
+	changes: [],
+	errors: []
+};
+/**
+* The phases a run can execute, in the order they must run.
+*
+* @remarks
+* Order is not cosmetic. Environments exist before the secrets and variables
+* scoped to them, and settings land before the security toggles that read the
+* repository's state. The array *is* the contract.
+*
+* @public
+*/
+const PHASE_NAMES = [
+	"settings",
+	"security",
+	"code-scanning",
+	"environments",
+	"secrets",
+	"variables",
+	"rulesets",
+	"cleanup"
+];
+/**
+* Select the phases a run should execute.
+*
+* @remarks
+* `only` wins over `skip` when both name the same phase — an explicit inclusion
+* is a stronger statement than an exclusion, and the alternative is silently
+* running nothing.
+*
+* Selection preserves {@link PHASE_NAMES} order regardless of the order the
+* flags were given, because the order is a correctness property rather than a
+* preference.
+*
+* @public
+*/
+const selectPhases = (phases, options) => phases.filter((phase) => options.only !== void 0 && options.only.size > 0 ? options.only.has(phase.name) : !(options.skip?.has(phase.name) ?? false));
+/**
+* Merge results from several phases.
+*
+* @public
+*/
+const mergeResults = (results) => ({
+	changes: results.flatMap((r) => r.changes),
+	errors: results.flatMap((r) => r.errors)
+});
+
+//#endregion
+export { PHASE_NAMES, emptyResult, mergeResults, selectPhases };

package/sync/phases/cleanup.js

@@ -0,0 +1,220 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState } from "../../store/AppliedState.js";
+import { emptyResult } from "../phase.js";
+import { capture, declaredNames, read } from "./resource.js";
+import { Effect } from "effect";
+import { DeploymentEnvironment, RepositorySecret, RepositoryVariable, Ruleset } from "@effected/github";
+
+//#region src/sync/phases/cleanup.ts
+/** The secret stores that live on the repository rather than an environment. */
+const SECRET_SCOPES = [
+	"actions",
+	"dependabot",
+	"codespaces"
+];
+/**
+* Which live resources a scope permits deleting.
+*
+* @remarks
+* Total over the three-way union, and the reason it is a separate pure function
+* is that it is the only place the policy is decided — every sweep below routes
+* through it, so `preserve` cannot be honoured in one scope and forgotten in
+* another.
+*/
+const undeclared = (live, declared, scope) => {
+	if (scope === false) return [];
+	const preserved = scope === true ? /* @__PURE__ */ new Set() : new Set(scope.preserve);
+	return live.filter((entry) => !declared.has(entry.name) && !preserved.has(entry.name));
+};
+/** Whether any scope in a group's cleanup config is turned on. */
+const anyEnabled = (cleanup) => {
+	if (cleanup === void 0) return false;
+	return [
+		cleanup.secrets.actions,
+		cleanup.secrets.dependabot,
+		cleanup.secrets.codespaces,
+		cleanup.secrets.environments,
+		cleanup.variables.actions,
+		cleanup.variables.environments,
+		cleanup.rulesets,
+		cleanup.environments
+	].some((scope) => scope !== false);
+};
+/**
+* Delete undeclared resources.
+*
+* @remarks
+* This phase is the only one that removes anything, and it runs last because
+* every other phase's writes define what "declared" means.
+*
+* **An enabled scope with nothing declared deletes everything in that scope.**
+* That is the literal reading of "delete what the config does not declare", and
+* it is deliberate rather than an oversight: a group that turns on
+* `cleanup.secrets.actions` and references no secret groups is saying this
+* repository should have no Actions secrets, which is a legitimate thing to
+* say and the only way to say it. It is also the most destructive thing in this
+* program, so every deletion is named in the output and `--dry-run` lists them
+* without touching anything.
+*
+* **An organization's rulesets are never deleted.** `listRulesets` returns
+* rulesets inherited from the org alongside the repository's own, and they are
+* not this repository's to remove — deleting one would change policy for every
+* repository in the organization. They are filtered out before anything is
+* considered undeclared, and a test pins it.
+*
+* **Every deletion forgets its applied-state row.** Leaving the row behind
+* would make the next run compare a recreated resource against a fingerprint
+* from before the deletion and report drift that nobody caused.
+*
+* Nothing here reads a secret value. Deciding what to delete needs names, which
+* {@link declaredNames} takes from the config without opening a file.
+*
+* @public
+*/
+const cleanupPhase = Effect.gen(function* () {
+	const secrets = yield* RepositorySecret;
+	const variables = yield* RepositoryVariable;
+	const rulesets = yield* Ruleset;
+	const environments = yield* DeploymentEnvironment;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	/**
+	* Sweep one scope.
+	*
+	* @remarks
+	* A disabled scope returns before the listing, so cleanup that is off costs
+	* no round trip — the same reason `appliesTo` exists at the phase level.
+	*/
+	const sweep = (ctx, options) => Effect.gen(function* () {
+		if (options.scope === false) return emptyResult;
+		const listing = yield* read(options.live());
+		if ("failed" in listing) return {
+			changes: [],
+			errors: [{
+				context: `list ${options.resource}s`,
+				message: listing.failed
+			}]
+		};
+		const targets = undeclared(listing.value, options.declared, options.scope);
+		if (targets.length === 0) return emptyResult;
+		const changes = [];
+		const errors = [];
+		const deleted = [];
+		for (const target of targets) {
+			if (!ctx.dryRun) {
+				const failure = yield* capture(`delete ${options.resource} ${target.name}`, target.remove());
+				if (failure !== void 0) {
+					errors.push(failure);
+					continue;
+				}
+				yield* applied.forget({
+					repo: ctx.slug,
+					kind: options.kind,
+					name: options.appliedName(target.name)
+				}).pipe(Effect.ignore);
+			}
+			deleted.push(target.name);
+			changes.push({
+				repo: ctx.slug,
+				kind: options.kind,
+				name: options.appliedName(target.name),
+				action: "deleted"
+			});
+		}
+		if (deleted.length > 0) yield* logger.cleanupSummary(options.resource, deleted.length, deleted);
+		return {
+			changes,
+			errors
+		};
+	});
+	const run = (ctx) => Effect.gen(function* () {
+		const group = ctx.config.groups[ctx.group];
+		const cleanup = group?.cleanup;
+		if (group === void 0 || cleanup === void 0) return emptyResult;
+		const results = [];
+		for (const scope of SECRET_SCOPES) results.push(yield* sweep(ctx, {
+			scope: cleanup.secrets[scope],
+			kind: "secret",
+			resource: `${scope} secret`,
+			declared: declaredNames(group.secrets?.[scope] ?? [], ctx.config.secrets),
+			live: () => secrets.list(scope).pipe(Effect.map((list) => list.map((entry) => ({
+				name: entry.name,
+				remove: () => secrets.delete(entry.name, scope)
+			})))),
+			appliedName: (name) => `${scope}/${name}`
+		}));
+		for (const [environment, refs] of Object.entries(group.secrets?.environments ?? {})) results.push(yield* sweep(ctx, {
+			scope: cleanup.secrets.environments,
+			kind: "secret",
+			resource: `${environment} environment secret`,
+			declared: declaredNames(refs, ctx.config.secrets),
+			live: () => secrets.listForEnvironment(environment).pipe(Effect.map((list) => list.map((entry) => ({
+				name: entry.name,
+				remove: () => secrets.deleteForEnvironment(environment, entry.name)
+			})))),
+			appliedName: (name) => `env:${environment}/${name}`
+		}));
+		results.push(yield* sweep(ctx, {
+			scope: cleanup.variables.actions,
+			kind: "variable",
+			resource: "variable",
+			declared: declaredNames(group.variables?.actions ?? [], ctx.config.variables),
+			live: () => variables.list().pipe(Effect.map((list) => list.map((entry) => ({
+				name: entry.name,
+				remove: () => variables.delete(entry.name)
+			})))),
+			appliedName: (name) => name
+		}));
+		for (const [environment, refs] of Object.entries(group.variables?.environments ?? {})) results.push(yield* sweep(ctx, {
+			scope: cleanup.variables.environments,
+			kind: "variable",
+			resource: `${environment} environment variable`,
+			declared: declaredNames(refs, ctx.config.variables),
+			live: () => variables.listForEnvironment(environment).pipe(Effect.map((list) => list.map((entry) => ({
+				name: entry.name,
+				remove: () => variables.deleteForEnvironment(environment, entry.name)
+			})))),
+			appliedName: (name) => `${environment}/${name}`
+		}));
+		const declaredRulesets = new Set((group.rulesets ?? []).map((ref) => ctx.config.rulesets[ref]?.name).filter((name) => name !== void 0));
+		results.push(yield* sweep(ctx, {
+			scope: cleanup.rulesets,
+			kind: "ruleset",
+			resource: "ruleset",
+			declared: declaredRulesets,
+			live: () => rulesets.list().pipe(Effect.map((list) => list.filter((entry) => entry.source_type !== "Organization").map((entry) => ({
+				name: entry.name,
+				remove: () => rulesets.delete(entry.id)
+			})))),
+			appliedName: (name) => name
+		}));
+		results.push(yield* sweep(ctx, {
+			scope: cleanup.environments,
+			kind: "environment",
+			resource: "environment",
+			declared: new Set(group.environments ?? []),
+			live: () => environments.list().pipe(Effect.map((list) => list.map((entry) => ({
+				name: entry.name,
+				remove: () => environments.delete(entry.name)
+			})))),
+			appliedName: (name) => name
+		}));
+		return {
+			changes: results.flatMap((result) => result.changes),
+			errors: results.flatMap((result) => result.errors)
+		};
+	});
+	return {
+		name: "cleanup",
+		/**
+		* `--no-cleanup` declines here rather than inside `run`, so the flag costs
+		* nothing and reads as "this phase has nothing to do" — which is what the
+		* user asked for by passing it.
+		*/
+		appliesTo: (ctx) => !ctx.noCleanup && anyEnabled(ctx.config.groups[ctx.group]?.cleanup),
+		run
+	};
+});
+
+//#endregion
+export { cleanupPhase };

package/sync/phases/code-scanning.js

@@ -0,0 +1,187 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { RepoCache } from "../../store/RepoCache.js";
+import { read } from "./resource.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option } from "effect";
+import { CodeScanning, WorkflowDispatch } from "@effected/github";
+
+//#region src/sync/phases/code-scanning.ts
+/**
+* Stands in for live state this phase cannot read.
+*
+* @remarks
+* `decide` needs three fingerprints, and GitHub exposes no read of these
+* resources comparable to what is written — the PATCH surface and the GET
+* surface differ, and some fields are not on the GET at all. So live is taken
+* to be the last applied value, and this sentinel covers the case where there
+* is no last applied value.
+*
+* It must never equal a real fingerprint. Using the desired fingerprint here
+* instead would make `FirstSync` compute `needsApply: desired !== live` as
+* `false` — and the very first sync of a repository would write nothing at all.
+*
+* The consequence, stated plainly: **this phase reports config change, not
+* drift.** A baseline that differs reads as `ConfigChanged`, never as `Drift`,
+* because there is no independent observation to attribute the difference to.
+*/
+const UNREADABLE = "\0unreadable";
+const KIND = "code_scanning";
+/** A repository has one default-setup configuration. */
+const NAME = "default-setup";
+/**
+* GitHub's repository language names mapped to CodeQL default-setup languages.
+*
+* @remarks
+* The two vocabularies differ: `listLanguages` reports `TypeScript`, CodeQL
+* wants `javascript-typescript`, and several source languages collapse onto one
+* analyzer. A language with no mapping is dropped from the detected set —
+* CodeQL cannot analyse it, so it cannot corroborate a configured language.
+*/
+const REPO_LANG_TO_CODEQL = {
+	JavaScript: "javascript-typescript",
+	TypeScript: "javascript-typescript",
+	C: "c-cpp",
+	"C++": "c-cpp",
+	"C#": "csharp",
+	Go: "go",
+	Java: "java-kotlin",
+	Kotlin: "java-kotlin",
+	Python: "python",
+	Ruby: "ruby",
+	Swift: "swift"
+};
+/** Last-write-wins merge of the code scanning groups a repository references. */
+const mergeCodeScanning = (ctx) => {
+	const refs = ctx.config.groups[ctx.group]?.code_scanning ?? [];
+	const merged = {};
+	for (const ref of refs) {
+		const group = ctx.config.code_scanning[ref];
+		if (group === void 0) continue;
+		for (const [key, value] of Object.entries(group)) if (value !== void 0) merged[key] = value;
+	}
+	return merged;
+};
+/**
+* CodeQL default setup, gated by the languages GitHub actually detects.
+*
+* @remarks
+* Configuring a language the repository does not contain makes GitHub reject
+* the whole request, so the configured list is intersected with the detected
+* one and the difference is reported rather than sent. That read goes through
+* {@link RepoCache}, whose languages entry is deliberately short-lived — a repo
+* that just gained a language should start scanning it within the hour, not the
+* month.
+*
+* `actions` is checked against the repository's **workflow count** rather than
+* against its languages, because GitHub validates it and `listRepoLanguages`
+* cannot see it. Passing it through unconditionally — which this did — answers
+*
+* > One or more languages you selected are not present in the repository.
+*
+* with a 422 on a repository that has no workflows. The check runs only when
+* `actions` is actually configured.
+*
+* Historically it analysed workflow YAML rather
+* than a repository language, so `listLanguages` never reports it and filtering
+* on detection would remove it from every repository.
+*
+* @public
+*/
+const codeScanningPhase = Effect.gen(function* () {
+	const codeScanning = yield* CodeScanning;
+	const workflows = yield* WorkflowDispatch;
+	const cache = yield* RepoCache;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	const run = (ctx) => Effect.gen(function* () {
+		const merged = mergeCodeScanning(ctx);
+		if (Object.keys(merged).length === 0) return {
+			changes: [],
+			errors: []
+		};
+		const errors = [];
+		let desired = merged;
+		if (merged.languages !== void 0) {
+			const detected = yield* cache.repoLanguages(ctx.owner, ctx.repo, codeScanning.languages()).pipe(Effect.map(Option.some), Effect.orElseSucceed(() => Option.none()));
+			if (Option.isNone(detected)) errors.push({
+				context: "list repo languages",
+				message: "could not read repository languages"
+			});
+			const detectedCodeQL = /* @__PURE__ */ new Set();
+			for (const language of Option.getOrElse(detected, () => [])) {
+				const mapped = REPO_LANG_TO_CODEQL[language];
+				if (mapped !== void 0) detectedCodeQL.add(mapped);
+			}
+			const hasWorkflows = merged.languages.includes("actions") ? yield* read(cache.repoWorkflows(ctx.owner, ctx.repo, Effect.map(workflows.list, (found) => found.filter((workflow) => workflow.path.startsWith(".github/workflows/")).length))) : { value: 0 };
+			const filtered = [];
+			for (const language of merged.languages) {
+				if (language === "actions") {
+					if ("failed" in hasWorkflows) errors.push({
+						context: "code_scanning",
+						message: `could not count workflows: ${hasWorkflows.failed}`
+					});
+					else if (hasWorkflows.value > 0) filtered.push(language);
+					else yield* logger.syncOperation("skip", "code_scanning language", language, "(no workflow files)");
+					continue;
+				}
+				if (detectedCodeQL.has(language)) filtered.push(language);
+				else yield* logger.syncOperation("skip", "code_scanning language", language, "(not detected in repository)");
+			}
+			if (filtered.length === 0) {
+				yield* logger.syncOperation("skip", "code_scanning", NAME, "(no configured language is present in this repository)");
+				return {
+					changes: [],
+					errors
+				};
+			}
+			desired = {
+				...merged,
+				languages: filtered
+			};
+		}
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		const baseline = Option.map(lookup(baselines, KIND, NAME), (record) => record.fingerprint);
+		const desiredPrint = fingerprint(desired);
+		const decision = decide(desiredPrint, Option.getOrElse(baseline, () => UNREADABLE), baseline);
+		if (isDrift(decision)) yield* logger.driftDetected(KIND, NAME, decision);
+		if (!needsApply(decision)) return {
+			changes: [],
+			errors
+		};
+		if (!ctx.dryRun) {
+			const failure = yield* codeScanning.configure(desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+			if (Option.isSome(failure)) return {
+				changes: [],
+				errors: [...errors, {
+					context: "code_scanning default setup",
+					message: failure.value
+				}]
+			};
+			yield* applied.record({
+				repo: ctx.slug,
+				kind: KIND,
+				name: NAME
+			}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+		}
+		yield* logger.syncOperation("sync", KIND, desired.state ?? NAME);
+		return {
+			changes: [{
+				repo: ctx.slug,
+				kind: KIND,
+				name: NAME,
+				action: isDrift(decision) ? "drift-overwritten" : "updated"
+			}],
+			errors
+		};
+	});
+	return {
+		name: "code-scanning",
+		appliesTo: (ctx) => (ctx.config.groups[ctx.group]?.code_scanning?.length ?? 0) > 0,
+		run
+	};
+});
+
+//#endregion
+export { codeScanningPhase };

package/sync/phases/environments.js

@@ -0,0 +1,106 @@
+import { SyncLogger } from "../../services/SyncLogger.js";
+import { AppliedState, lookup } from "../../store/AppliedState.js";
+import { fingerprint } from "../../lib/fingerprint.js";
+import { decide, isDrift, needsApply } from "../decide.js";
+import { Effect, Option } from "effect";
+import { DeploymentEnvironment } from "@effected/github";
+
+//#region src/sync/phases/environments.ts
+/**
+* Stands in for live state this phase cannot read.
+*
+* @remarks
+* `decide` needs three fingerprints, and GitHub exposes no read of these
+* resources comparable to what is written — the PATCH surface and the GET
+* surface differ, and some fields are not on the GET at all. So live is taken
+* to be the last applied value, and this sentinel covers the case where there
+* is no last applied value.
+*
+* It must never equal a real fingerprint. Using the desired fingerprint here
+* instead would make `FirstSync` compute `needsApply: desired !== live` as
+* `false` — and the very first sync of a repository would write nothing at all.
+*
+* The consequence, stated plainly: **this phase reports config change, not
+* drift.** A baseline that differs reads as `ConfigChanged`, never as `Drift`,
+* because there is no independent observation to attribute the difference to.
+*/
+const UNREADABLE = "\0unreadable";
+const KIND = "environment";
+/**
+* Deployment environments.
+*
+* @remarks
+* **Runs before secrets and variables**, because an environment-scoped secret
+* cannot be written to an environment that does not exist yet. That ordering
+* lives in `PHASE_NAMES`; this phase only relies on it.
+*
+* Each environment is its own drift resource, so someone adding a required
+* reviewer to `production` in the UI is reported as `production` changing
+* rather than as "environments changed".
+*
+* An environment named in a group but missing from `[environments.*]` is
+* skipped rather than erroring — cross-reference validation is
+* `danglingReferences`'s job — run by `validate` and by `sync` before it writes
+* anything — and duplicating it here would report the same
+* mistake twice with less context.
+*
+* @public
+*/
+const environmentsPhase = Effect.gen(function* () {
+	const environments = yield* DeploymentEnvironment;
+	const applied = yield* AppliedState;
+	const logger = yield* SyncLogger;
+	const run = (ctx) => Effect.gen(function* () {
+		const refs = ctx.config.groups[ctx.group]?.environments ?? [];
+		if (refs.length === 0) return {
+			changes: [],
+			errors: []
+		};
+		const baselines = yield* applied.getMany(ctx.slug).pipe(Effect.orElseSucceed(() => /* @__PURE__ */ new Map()));
+		const changes = [];
+		const errors = [];
+		for (const name of refs) {
+			const desired = ctx.config.environments[name];
+			if (desired === void 0) continue;
+			const baseline = Option.map(lookup(baselines, KIND, name), (record) => record.fingerprint);
+			const desiredPrint = fingerprint(desired);
+			const decision = decide(desiredPrint, Option.getOrElse(baseline, () => UNREADABLE), baseline);
+			if (isDrift(decision)) yield* logger.driftDetected(KIND, name, decision);
+			if (!needsApply(decision)) continue;
+			if (!ctx.dryRun) {
+				const failure = yield* environments.upsert(name, desired).pipe(Effect.as(Option.none()), Effect.catch((error) => Effect.succeed(Option.some(error.message ?? String(error)))));
+				if (Option.isSome(failure)) {
+					errors.push({
+						context: `environment ${name}`,
+						message: failure.value
+					});
+					continue;
+				}
+				yield* applied.record({
+					repo: ctx.slug,
+					kind: KIND,
+					name
+				}, desiredPrint, ctx.runId).pipe(Effect.ignore);
+			}
+			yield* logger.syncOperation("sync", KIND, name);
+			changes.push({
+				repo: ctx.slug,
+				kind: KIND,
+				name,
+				action: isDrift(decision) ? "drift-overwritten" : "updated"
+			});
+		}
+		return {
+			changes,
+			errors
+		};
+	});
+	return {
+		name: "environments",
+		appliesTo: (ctx) => (ctx.config.groups[ctx.group]?.environments?.length ?? 0) > 0,
+		run
+	};
+});
+
+//#endregion
+export { environmentsPhase };

package/sync/phases/index.js

@@ -0,0 +1,39 @@
+import { capture, declaredNames, resolveGroups } from "./resource.js";
+import { cleanupPhase } from "./cleanup.js";
+import { codeScanningPhase } from "./code-scanning.js";
+import { environmentsPhase } from "./environments.js";
+import { rulesetsPhase } from "./rulesets.js";
+import { secretsPhase } from "./secrets.js";
+import { securityPhase } from "./security.js";
+import { settingsPhase } from "./settings.js";
+import { variablesPhase } from "./variables.js";
+import { Effect } from "effect";
+
+//#region src/sync/phases/index.ts
+/**
+* Every phase, in `PHASE_NAMES` order.
+*
+* @remarks
+* The order is the contract, not a preference — environments exist before the
+* secrets scoped to them — so the array is built in that order here rather than
+* sorted later. `SyncEngineLive` takes this and walks it.
+*
+* `cleanup` runs last because every other phase's writes are what define
+* "declared" — sweeping before them would delete a resource this very run was
+* about to create.
+*
+* @public
+*/
+const allPhases = Effect.all([
+	settingsPhase,
+	securityPhase,
+	codeScanningPhase,
+	environmentsPhase,
+	secretsPhase,
+	variablesPhase,
+	rulesetsPhase,
+	cleanupPhase
+]);
+
+//#endregion
+export { allPhases };