scenescout 3.18.0 → 3.19.1

package/dist/engine/export.js

@@ -13,6 +13,7 @@
  */
 import { createHash } from "node:crypto";
 import { readFindingPicture } from "./capture.js";
+import { CHECK_RULES, WORTH_A_LOOK_RULES } from "./check.js";
 import { readFindings } from "./ci.js";
 import { isWorthALook, redactSecrets } from "./memory.js";
 import { retryAfterMs } from "./provider.js";
@@ -31,6 +32,7 @@ export const EXPORT_OPTION_NAMES = [
     "jira-link-type",
     "jira-update",
     "project",
+    "from",
     "min-severity",
     "only",
     "max-issues",
@@ -163,7 +165,7 @@ export function parseExportArgs(args, cwd, env) {
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if (!a.startsWith("--"))
-            return { ok: false, error: `unexpected argument ${a}: export takes options only (the findings come from --project)` };
+            return { ok: false, error: `unexpected argument ${a}: export takes options only (the findings come from --project, or --from a check.json or ci.json)` };
         const eq = a.indexOf("=");
         const name = eq > 0 ? a.slice(2, eq) : a.slice(2);
         if (CREDENTIAL_FLAGS.has(name))
@@ -276,6 +278,9 @@ export function parseExportArgs(args, cwd, env) {
     const screenshots = flags.get("screenshots") ?? "on";
     if (screenshots !== "on" && screenshots !== "off")
         return { ok: false, error: "--screenshots must be on or off" };
+    const from = flags.get("from");
+    if (from !== undefined && from.trim() === "")
+        return { ok: false, error: "--from needs the path of a check.json or a ci.json" };
     if (flags.has("dry-run") && flags.has("yes"))
         return { ok: false, error: "--dry-run and --yes contradict each other: give one" };
     const resolve = (p) => (p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p) ? p : `${cwd.replace(/[\\/]$/, "")}/${p}`);
@@ -284,6 +289,7 @@ export function parseExportArgs(args, cwd, env) {
         options: {
             ...target,
             projectDir: resolve(flags.get("project") ?? cwd),
+            ...(from !== undefined ? { from: resolve(from) } : {}),
             minSeverity: minSeverity,
             ...(only ? { only } : {}),
             maxIssues,
@@ -371,6 +377,123 @@ function timeOf(iso) {
     const t = typeof iso === "string" ? Date.parse(iso) : NaN;
     return Number.isNaN(t) ? 0 : t;
 }
+// ── a check.json or a ci.json as the source ─────────────────────────────────
+/** The prefix of a check issue's finding id: the issue's fingerprint follows it. */
+export const CHECK_FINDING_PREFIX = "check-";
+const MAX_ROUTES_NAMED = 10;
+/** A route of a check, as an address on the checked site; the site itself for a route that is not a path, such as the shared chrome. */
+function addressOf(base, route) {
+    if (!route.startsWith("/"))
+        return base;
+    try {
+        return new URL(route, base).href;
+    }
+    catch {
+        return route;
+    }
+}
+/**
+ * A check.json issue or worth-a-look observation as a finding. Its id is its
+ * fingerprint, which the check keys on the rule and the evidence and so keeps
+ * from run to run: a later check of the same defect re-exports to the same
+ * issue. Null for an entry that does not read.
+ */
+function checkEntryFinding(entry, base, generatedAt, look) {
+    if (!isObject(entry) || typeof entry.rule !== "string" || typeof entry.evidence !== "string" || typeof entry.fingerprint !== "string")
+        return null;
+    const id = `${CHECK_FINDING_PREFIX}${entry.fingerprint}`;
+    if (!FINDING_ID_RE.test(id))
+        return null;
+    const routes = (Array.isArray(entry.routes) ? entry.routes : []).filter((r) => typeof r === "string");
+    const severity = look ? "low" : entry.severity;
+    if (!SEVERITIES.includes(severity))
+        return null;
+    if (look && typeof entry.convention !== "string")
+        return null;
+    const rules = look ? WORTH_A_LOOK_RULES : CHECK_RULES;
+    const rule = Object.prototype.hasOwnProperty.call(rules, entry.rule) ? rules[entry.rule] : null;
+    const first = routes[0] ?? "";
+    const named = routes.slice(0, MAX_ROUTES_NAMED).join(", ") + (routes.length > MAX_ROUTES_NAMED ? `, and ${routes.length - MAX_ROUTES_NAMED} more` : "");
+    const embed = typeof entry.embed === "string" ? entry.embed : null;
+    const flow = typeof entry.flow === "string" ? entry.flow : null;
+    return {
+        id,
+        severity: severity,
+        category: entry.rule,
+        title: `${rule?.title ?? entry.rule}: ${oneLine(entry.evidence, 120)}`,
+        detail: [
+            rule?.help ?? "",
+            routes.length ? `Seen on ${routes.length === 1 ? "1 page" : `${routes.length} pages`}: ${named}.` : "",
+            embed ? `In a frame from ${embed}.` : "",
+            `Found by scenescout check (rule ${entry.rule}).`,
+        ]
+            .filter(Boolean)
+            .join(" "),
+        evidence: entry.evidence,
+        url: addressOf(base, first),
+        state: first,
+        repro: flow ? [`Replay the saved flow ${flow}`] : first ? [`Open ${first}`] : [],
+        foundAt: generatedAt,
+        runs: 1,
+        status: "open",
+        ...(look ? { tier: "worth_a_look", convention: entry.convention } : {}),
+    };
+}
+/** A ci.json finding as a finding: the same id as in the run's memory, so an export from either files it once. Null for an entry that does not read. */
+function ciEntryFinding(entry, base, writtenAt) {
+    if (!isObject(entry) || typeof entry.id !== "string" || typeof entry.title !== "string" || !SEVERITIES.includes(entry.severity))
+        return null;
+    const route = typeof entry.path === "string" ? entry.path : "";
+    const look = entry.tier === "worth-a-look";
+    return {
+        id: entry.id,
+        severity: entry.severity,
+        category: typeof entry.category === "string" ? entry.category : "other",
+        title: entry.title,
+        detail: "",
+        ...(typeof entry.evidence === "string" ? { evidence: entry.evidence } : {}),
+        url: addressOf(base, route),
+        state: route,
+        repro: [],
+        foundAt: writtenAt,
+        runs: 1,
+        status: "open",
+        ...(look ? { tier: "worth_a_look", convention: typeof entry.convention === "string" ? entry.convention : "" } : {}),
+    };
+}
+/**
+ * The findings of a check.json or a ci.json, as `--from` exports them. An
+ * entry that does not read is kept as it is, so selectFindings counts it as
+ * unreadable rather than it vanishing. `writtenAt` dates a ci.json's findings,
+ * which carry no time of their own: the time the file was written.
+ */
+export function findingsFromResult(raw, writtenAt) {
+    if (!isObject(raw))
+        return { ok: false, error: "it is not a check.json or a ci.json" };
+    const base = typeof raw.url === "string" ? raw.url : "";
+    if (raw.tool === "scenescout-check") {
+        if (!Array.isArray(raw.issues))
+            return { ok: false, error: "it is a check.json with no list of issues" };
+        const generatedAt = typeof raw.generatedAt === "string" ? raw.generatedAt : writtenAt;
+        const looks = Array.isArray(raw.worthALook) ? raw.worthALook : [];
+        return {
+            ok: true,
+            value: {
+                kind: "check",
+                findings: [
+                    ...raw.issues.map((e) => checkEntryFinding(e, base, generatedAt, false) ?? e),
+                    ...looks.map((e) => checkEntryFinding(e, base, generatedAt, true) ?? e),
+                ],
+            },
+        };
+    }
+    if (raw.tool === "scenescout" && raw.command === "ci") {
+        if (!Array.isArray(raw.findings))
+            return { ok: false, error: "it is a ci.json with no list of findings" };
+        return { ok: true, value: { kind: "ci", findings: raw.findings.map((e) => ciEntryFinding(e, base, writtenAt) ?? e) } };
+    }
+    return { ok: false, error: "it is not a check.json or a ci.json (its tool field names neither scenescout check nor scenescout ci)" };
+}
 const isObject = (v) => !!v && typeof v === "object" && !Array.isArray(v);
 const MAX_CRITERIA_PER_ISSUE = 10;
 /**
@@ -800,6 +923,82 @@ export function rememberFiled(map, id, issue) {
     if (!held || (issue.open && !held.open) || (issue.open === held.open && issue.number < held.number))
         map.set(id, issue);
 }
+// ── the local record of what was filed ──────────────────────────────────────
+/**
+ * A tracker's listing of labelled issues can lag behind a create: GitHub's
+ * label filter and Jira's search are both eventually consistent. So each
+ * export keeps, beside the memory, the issue it filed for each finding, and
+ * a later export on the same machine reads that issue back by its number,
+ * which is consistent, before it trusts the listing's silence.
+ */
+export const EXPORT_RECORD_FILE = "exported.json";
+/** How long a Jira create that may have been made holds its finding back, unless the issue turns up sooner. Jira's search can take minutes. */
+export const UNCERTAIN_HOLD_MS = 15 * 60_000;
+/** The key a tracker's entries are kept under: the API's address and the repository or project, so two trackers never share an entry. */
+export function recordKey(t) {
+    return t.to === "github"
+        ? `github ${t.github.apiUrl.replace(/\/+$/, "")} ${t.github.repo}`
+        : `jira ${t.jira.baseUrl.replace(/\/+$/, "")} ${t.jira.projectKey}`;
+}
+/**
+ * The record file's text, read. None yet is an empty record. A file that
+ * cannot be read is refused rather than taken as empty: empty would let an
+ * export file again what the lagging listing does not show yet.
+ */
+export function parseExportRecord(text) {
+    if (text === null)
+        return { ok: true, value: {} };
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch (err) {
+        return { ok: false, error: `it is not JSON (${err instanceof Error ? err.message : String(err)})` };
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        return { ok: false, error: "it is not an object" };
+    const { version, trackers } = raw;
+    if (version !== 1)
+        return { ok: false, error: `it is version ${oneLine(version, 20)}, which this version does not read` };
+    if (!trackers || typeof trackers !== "object" || Array.isArray(trackers))
+        return { ok: false, error: "it holds no trackers" };
+    const value = {};
+    for (const [key, entries] of Object.entries(trackers)) {
+        if (!entries || typeof entries !== "object" || Array.isArray(entries))
+            return { ok: false, error: `its entry for ${oneLine(key, 80)} is not an object` };
+        const kept = {};
+        for (const [id, e] of Object.entries(entries)) {
+            const x = e && typeof e === "object" ? e : {};
+            if (!FINDING_ID_RE.test(id) || typeof x.at !== "string")
+                return { ok: false, error: `its entry for finding ${oneLine(id, 80)} cannot be read` };
+            if (x.uncertain === true)
+                kept[id] = { uncertain: true, at: x.at };
+            else if (typeof x.ref === "string" && Number.isInteger(x.number) && typeof x.url === "string")
+                kept[id] = { ref: x.ref, number: x.number, url: x.url, at: x.at };
+            else
+                return { ok: false, error: `its entry for finding ${id} cannot be read` };
+        }
+        value[key] = kept;
+    }
+    return { ok: true, value };
+}
+/** The record with one finding's entry set, as the text to write. The record passed in is not changed. */
+export function recordWith(record, key, id, entry) {
+    const trackers = { ...record, [key]: { ...(record[key] ?? {}), [id]: entry } };
+    return JSON.stringify({ version: 1, trackers }, null, 2) + "\n";
+}
+/**
+ * Whether a create that may have been made still holds its finding back: for
+ * UNCERTAIN_HOLD_MS after it. A time that cannot be read, or one further
+ * ahead than that (a clock set wrong), holds nothing, so no finding is held
+ * back for good.
+ */
+export function uncertainHolds(entry, nowMs) {
+    if (!("uncertain" in entry))
+        return false;
+    const at = Date.parse(entry.at);
+    return Number.isFinite(at) && Math.abs(nowMs - at) < UNCERTAIN_HOLD_MS;
+}
 // ── talking to a tracker ────────────────────────────────────────────────────
 /** The longest a rate limit may ask an export to wait before it gives up and says when to try again. */
 export const MAX_RATE_WAIT_MS = 60_000;

package/dist/engine/flow.js

@@ -8,8 +8,10 @@
  * gate naming the flow and the step (ADR 12).
  *
  * The steps are `scout_run_plan`'s steps, so a plan that worked in an
- * exploratory run can be saved as it is, plus three assertions a plan has no
- * need for: text is visible, the URL matches, a request answered with a status.
+ * exploratory run can be saved as it is, plus four assertions a plan has no
+ * need for: text is visible, an element is in a state (visible, hidden,
+ * enabled, disabled, checked or unchecked), the URL matches, and a request
+ * answered with a status.
  *
  * Everything here is pure: the schema and its error messages, the target
  * grammar, and the rules that decide whether a URL or a request matched. The
@@ -19,7 +21,9 @@ import fs from "node:fs";
 import path from "node:path";
 import { z } from "zod";
 import { beaconResourceType, BROWSER_ENGINES } from "../browsers.js";
+import { FIXTURE_KINDS } from "./fixtures.js";
 import { MEMORY_DIRNAME, SELF_IGNORE_KEEP } from "./memory.js";
+import { validateRoleName } from "./profiles.js";
 /** Most steps one flow may hold. A longer flow is several flows, and each would fail more usefully on its own. */
 export const MAX_FLOW_STEPS = 50;
 /** Most flows one check replays. */
@@ -137,6 +141,48 @@ export function parseTarget(target) {
     const name = role[2] ?? role[3] ?? role[4];
     return name === undefined ? { by: "role", role: role[1].toLowerCase() } : { by: "role", role: role[1].toLowerCase(), name };
 }
+/**
+ * Why a step cannot act on a target that is visible, or null when it can: a
+ * click or a select needs the control enabled, typing needs it editable. The
+ * report leads with this, then the action limit's hint, which still applies
+ * when the app enables the control later than the limit allows.
+ */
+export function notActionable(action, facts) {
+    if (!facts.enabled)
+        return "is visible but disabled";
+    if (action === "type" && facts.editable === false)
+        return "is visible but read-only";
+    return null;
+}
+/**
+ * The states an expect-element step can ask of its target. `hidden` also holds
+ * when nothing matches: "the receipt was never shown" and "the dialog closed"
+ * are both the absence of a visible element.
+ */
+export const ELEMENT_STATES = ["visible", "hidden", "enabled", "disabled", "checked", "unchecked"];
+/**
+ * Whether an element in the state `facts` describes satisfies `state`, and if
+ * not, what is true instead, in the words the report uses. `facts` is null when
+ * nothing matches the target.
+ */
+export function elementStateMatches(state, facts) {
+    if (state === "hidden")
+        return !facts || !facts.visible ? { ok: true } : { ok: false, actual: "is visible" };
+    if (!facts)
+        return { ok: false, actual: "matches nothing" };
+    if (!facts.visible)
+        return { ok: false, actual: "is not visible" };
+    if (state === "visible")
+        return { ok: true };
+    if (state === "enabled" || state === "disabled") {
+        if (facts.enabled === null)
+            return { ok: false, actual: "cannot be enabled or disabled" };
+        return facts.enabled === (state === "enabled") ? { ok: true } : { ok: false, actual: facts.enabled ? "is enabled" : "is disabled" };
+    }
+    if (facts.checked === null)
+        return { ok: false, actual: "cannot be checked" };
+    return facts.checked === (state === "checked") ? { ok: true } : { ok: false, actual: facts.checked ? "is checked" : "is unchecked" };
+}
 const REQUEST_RE = /^(GET|POST|PUT|PATCH|DELETE|HEAD) (\/\S*)$/;
 function isRegex(pattern) {
     try {
@@ -159,13 +205,26 @@ const target = z
         });
     }
 });
-const STEP_SCHEMAS = [
+/** Most times a repeat step may run its steps. A longer loop is a page that should be reached another way. */
+export const MAX_REPEATS = 100;
+const SINGLE_STEP_SCHEMAS = [
     z.object({ action: z.literal("navigate"), target: z.string().regex(/^\//, "must be a path on the app, starting with /") }).strict(),
     z.object({ action: z.literal("click"), target }).strict(),
     z.object({ action: z.literal("type"), target, value: z.string(), pressEnter: z.boolean().optional(), replace: z.boolean().optional() }).strict(),
     z.object({ action: z.literal("select"), target, value: z.string() }).strict(),
     z.object({ action: z.literal("press"), value: z.string().min(1, "names the key to press, e.g. Enter") }).strict(),
+    // A small valid file generated for the input (its kind from `fixture`, else the input's accept attribute), as
+    // scout_upload attaches one. `target` is the file input or the control that opens its chooser; absent, the page's only file input.
+    z
+        .object({
+        action: z.literal("upload"),
+        target: target.optional(),
+        fixture: z.enum(FIXTURE_KINDS).optional(),
+        name: z.string().min(1).max(120).optional(),
+    })
+        .strict(),
     z.object({ action: z.literal("expect-text"), text: z.string().min(1, "is the text that must be visible") }).strict(),
+    z.object({ action: z.literal("expect-element"), target, state: z.enum(ELEMENT_STATES) }).strict(),
     z.object({ action: z.literal("expect-url"), pattern: z.string().min(1).refine(isRegex, { message: "is not a valid regular expression" }) }).strict(),
     z
         .object({
@@ -175,12 +234,48 @@ const STEP_SCHEMAS = [
     })
         .strict(),
 ];
+const singleStepSchema = z.discriminatedUnion("action", [...SINGLE_STEP_SCHEMAS]);
+const isRepeatable = (s) => s.action === "click" || s.action === "type" || s.action === "select" || s.action === "press";
+const isRepeatCondition = (s) => s.action === "expect-text" || s.action === "expect-element" || s.action === "expect-url";
+/**
+ * Repeat some actions until a condition holds: paging through a document until
+ * the Continue button is enabled, pressing Next until the last slide shows. The
+ * condition is checked first, so a page already in the wanted state runs the
+ * actions no times; it fails when the condition still does not hold after `max`.
+ */
+const repeatSchema = z
+    .object({
+    action: z.literal("repeat"),
+    steps: z
+        .array(singleStepSchema)
+        .min(1, "needs at least one step to repeat")
+        .max(10, "holds at most 10 steps")
+        .refine((steps) => steps.every(isRepeatable), { message: "may only hold click, type, select and press steps" }),
+    until: singleStepSchema.refine(isRepeatCondition, { message: "must be an expect-text, expect-element or expect-url step" }),
+    max: z.number().int().min(1).max(MAX_REPEATS, `is at most ${MAX_REPEATS}`),
+})
+    .strict();
+const STEP_SCHEMAS = [...SINGLE_STEP_SCHEMAS, repeatSchema];
 const stepSchema = z.discriminatedUnion("action", [...STEP_SCHEMAS]);
 export const FLOW_ACTIONS = STEP_SCHEMAS.map((s) => s.shape.action.value);
 const flowSchema = z
     .object({
     name: z.string().min(1).max(100).optional(),
     description: z.string().max(500).optional(),
+    /**
+     * Who walks the flow: a role whose sign-in `scenescout login --role` saved in the project. Absent, the flow runs
+     * in the check's own session. Flows run in file-name order, so one role's flow can pick up what another's left.
+     */
+    role: z
+        .string()
+        .optional()
+        .superRefine((role, ctx) => {
+        if (role === undefined)
+            return;
+        const checked = validateRoleName(role);
+        if (!checked.ok)
+            ctx.addIssue({ code: z.ZodIssueCode.custom, message: checked.error });
+    }),
     steps: z.array(stepSchema).min(1, "needs at least one step").max(MAX_FLOW_STEPS, `holds at most ${MAX_FLOW_STEPS} steps`),
 })
     .strict()
@@ -232,7 +327,10 @@ export function parseFlow(text, file) {
     const parsed = parseJsonFile(text, file, flowSchema);
     if (!parsed.ok)
         return parsed;
-    return { ok: true, flow: { name: parsed.data.name ?? file.replace(/\.json$/i, ""), file, steps: parsed.data.steps } };
+    const flow = { name: parsed.data.name ?? file.replace(/\.json$/i, ""), file, steps: parsed.data.steps };
+    if (parsed.data.role !== undefined)
+        flow.role = parsed.data.role;
+    return { ok: true, flow };
 }
 /**
  * Read every `*.json` in a flows directory, in name order. Throws on the first
@@ -313,14 +411,27 @@ export function describeStep(step) {
             return `type into ${step.target}${step.pressEnter ? " and press Enter" : ""}`;
         case "press":
             return `press ${step.value}`;
+        case "upload":
+            return `upload ${step.fixture ? `a ${step.fixture} file` : "a file"}${step.name ? ` named ${JSON.stringify(step.name)}` : ""} ${step.target ? `to ${step.target}` : "to the page's file input"}`;
         case "expect-text":
             return `expect text ${JSON.stringify(step.text)}`;
+        case "expect-element":
+            return `expect ${step.target} to be ${step.state}`;
         case "expect-url":
             return `expect the URL to match /${step.pattern}/`;
         case "expect-request":
             return `expect ${step.request} → ${step.status}`;
+        case "repeat":
+            return `repeat ${step.steps.map(describeStep).join(", then ")} until ${describeStep(step.until)} (at most ${step.max} times)`;
     }
 }
+/**
+ * Why a repeat step failed when its condition never held: what never became
+ * true, how many times the actions ran, and what the last check found.
+ */
+export function repeatFailure(until, max, reason) {
+    return `${describeStep(until)} still did not hold after repeating ${max} time(s): ${reason}`;
+}
 /** Whether a step acts on the page (and so opens a new window for expect-request) rather than reading it. */
 export function isAction(step) {
     return !step.action.startsWith("expect-");
@@ -400,6 +511,62 @@ export function splitRefusals(refusals, appOrigin) {
     }
     return { charged, background };
 }
+/** A value taken from the environment when the flow runs: `${env:NAME}` in a type or select step's value. */
+const ENV_REF = /\$\{env:([A-Za-z_][A-Za-z0-9_]*)\}/g;
+/** Shortest substituted value masked in the check's output. Shorter ones would mask ordinary words and numbers. */
+export const MIN_MASKED_ENV_VALUE = 4;
+/** Every step that takes a value, the steps inside a repeat included. */
+function valueSteps(steps) {
+    return steps.flatMap((s) => s.action === "repeat" ? valueSteps(s.steps) : "value" in s && s.action !== "press" ? [s] : []);
+}
+/** The environment variables a flow's values name, each once. */
+export function flowEnvNames(flow) {
+    return [...new Set(valueSteps(flow.steps).flatMap((s) => [...s.value.matchAll(ENV_REF)].map((m) => m[1])))];
+}
+/**
+ * The flow with every `${env:NAME}` in a type or select value replaced by that
+ * variable, and the values used, for masking; or the names that are not set.
+ * A secret such as a one-time code or a password then lives in the CI's secret
+ * store, not in the flow file.
+ */
+export function resolveFlowEnv(flow, env) {
+    const names = flowEnvNames(flow);
+    const missing = names.filter((n) => env[n] === undefined);
+    if (missing.length > 0)
+        return { ok: false, missing };
+    const values = new Map(names.map((n) => [n, env[n]]));
+    const sub = (steps) => steps.map((s) => {
+        if (s.action === "repeat")
+            return { ...s, steps: sub(s.steps) };
+        if (s.action === "type" || s.action === "select")
+            return { ...s, value: s.value.replace(ENV_REF, (_, n) => values.get(n)) };
+        return s;
+    });
+    return { ok: true, flow: { ...flow, steps: sub(flow.steps) }, values };
+}
+/**
+ * Text with every substituted value long enough to mask replaced by the name
+ * it came from, `[$NAME]`. Applied to the check's whole result before anything
+ * is written, so a value the page echoed into a URL or an error is not saved.
+ */
+export function maskEnvValues(text, values) {
+    let out = text;
+    // Longest first, so a value inside a longer one does not split it.
+    for (const [name, value] of [...values].sort((a, b) => b[1].length - a[1].length)) {
+        if (value.length < MIN_MASKED_ENV_VALUE)
+            continue;
+        out = out.split(value).join(`[$${name}]`);
+        // The same value as JSON writes it, for text that is a serialised result.
+        const escaped = JSON.stringify(value).slice(1, -1);
+        if (escaped !== value)
+            out = out.split(escaped).join(`[$${name}]`);
+    }
+    return out;
+}
+/** The roles a set of flows run as, each once, in the order they first appear. */
+export function flowRoles(flows) {
+    return [...new Set(flows.flatMap((f) => (f.role === undefined ? [] : [f.role])))];
+}
 /** The step a run stopped at, as the evidence of its issue or the reason the check could not run. */
 export function flowStepEvidence(run) {
     if (run.outcome.status === "passed")