workspace-conformance 1.1.0 → 1.2.0

package/dist/cli.js

@@ -1,17 +1,98 @@
 #!/usr/bin/env node
 import { dirname, extname, join, posix, relative, resolve, sep } from "node:path";
 import { parseArgs } from "node:util";
+import { z } from "zod";
 import { existsSync } from "node:fs";
 import { escapePath, glob, isDynamicPattern } from "tinyglobby";
 import { Node, Project } from "ts-morph";
 import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
-import { parse } from "yaml";
 import { execFile } from "node:child_process";
+import { LineCounter, isMap, isNode, isScalar, isSeq, parse, parseDocument } from "yaml";
 import { findNodeAtLocation, parse as parse$1, parseTree, printParseErrorCode } from "jsonc-parser";
 import { parse as parse$2 } from "smol-toml";
 import { defineSection, layoutSection, loadSection } from "@exadev/config";
-import { z } from "zod";
+//#region src/errors.ts
+/**
+* A problem with how the tool was used or configured rather than a finding about the workspace: an unknown or disabled check, a missing or invalid section, a layout that cannot be resolved, a repository that is not a git checkout. The command line reports it and exits 2.
+*/
+var ConformanceError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "ConformanceError";
+	}
+};
+//#endregion
+//#region src/github.ts
+const repositorySchema = z.object({
+	default_branch: z.string(),
+	allow_rebase_merge: z.optional(z.boolean()),
+	allow_squash_merge: z.optional(z.boolean()),
+	allow_merge_commit: z.optional(z.boolean())
+});
+const rulesSchema = z.array(z.looseObject({
+	type: z.string(),
+	parameters: z.optional(z.looseObject({
+		required_status_checks: z.optional(z.array(z.object({ context: z.string() }))),
+		strict_required_status_checks_policy: z.optional(z.boolean()),
+		required_review_thread_resolution: z.optional(z.boolean()),
+		allowed_merge_methods: z.optional(z.array(z.string()))
+	}))
+}));
+const API_ROOT = "https://api.github.com";
+const API_VERSION = "2022-11-28";
+/**
+* How many rules the API returns in one page, its maximum.
+*/
+const PAGE_SIZE = 100;
+/**
+* A {@link GitHubClient} over the REST API.
+*/
+function createGitHubClient(options) {
+	const request = options.fetch ?? fetch;
+	const root = options.apiUrl ?? API_ROOT;
+	async function get(path) {
+		const response = await request(`${root}${path}`, { headers: {
+			Accept: "application/vnd.github+json",
+			Authorization: `Bearer ${options.token}`,
+			"X-GitHub-Api-Version": API_VERSION
+		} });
+		if (!response.ok) throw new ConformanceError(`GET ${path} failed: ${String(response.status)} ${response.statusText}`);
+		return response.json();
+	}
+	return {
+		repository: async (slug) => {
+			const parsed = repositorySchema.parse(await get(`/repos/${slug.owner}/${slug.name}`));
+			const { allow_rebase_merge: allowRebaseMerge, allow_squash_merge: allowSquashMerge, allow_merge_commit: allowMergeCommit } = parsed;
+			if (allowRebaseMerge === void 0 || allowSquashMerge === void 0 || allowMergeCommit === void 0) throw new ConformanceError(`GET /repos/${slug.owner}/${slug.name} did not report the merge-method settings, which GitHub shows only to a token with write access to the repository`);
+			return {
+				defaultBranch: parsed.default_branch,
+				allowRebaseMerge,
+				allowSquashMerge,
+				allowMergeCommit
+			};
+		},
+		branchRules: async (slug, branch) => {
+			const rules = [];
+			for (let page = 1, more = true; more; page += 1) {
+				const found = rulesSchema.parse(await get(`/repos/${slug.owner}/${slug.name}/rules/branches/${encodeURIComponent(branch)}?per_page=${String(PAGE_SIZE)}&page=${String(page)}`));
+				rules.push(...found);
+				more = found.length === PAGE_SIZE;
+			}
+			return {
+				requiredStatusChecks: rules.filter((rule) => rule.type === "required_status_checks").map((rule) => ({
+					contexts: (rule.parameters?.required_status_checks ?? []).map((check) => check.context),
+					strict: rule.parameters?.strict_required_status_checks_policy === true
+				})),
+				pullRequests: rules.filter((rule) => rule.type === "pull_request").map((rule) => ({
+					requiredReviewThreadResolution: rule.parameters?.required_review_thread_resolution === true,
+					allowedMergeMethods: rule.parameters?.allowed_merge_methods
+				}))
+			};
+		}
+	};
+}
+//#endregion
 //#region src/files.ts
 /**
 * Directories no check descends into: installed dependencies are not the workspace's own files.
@@ -77,17 +158,6 @@ function relativePosix(cwd, absolute) {
 	return toPosix(relative(cwd, absolute));
 }
 //#endregion
-//#region src/errors.ts
-/**
-* A problem with how the tool was used or configured rather than a finding about the workspace: an unknown or disabled check, a missing or invalid section, a layout that cannot be resolved, a repository that is not a git checkout. The command line reports it and exits 2.
-*/
-var ConformanceError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "ConformanceError";
-	}
-};
-//#endregion
 //#region src/template.ts
 const PLACEHOLDER = /\{([a-z]+)\}/gu;
 /**
@@ -249,7 +319,7 @@ function aliasNamed(typeName) {
 /**
 * Why a command type is not derived from a schema, or `undefined` when it is. `followed` holds the aliases already followed from the exported type, so a chain of aliases is followed to its end and a loop of them is not followed twice.
 */
-function problem(declaration, name, inferences, followed = /* @__PURE__ */ new Set()) {
+function problem$1(declaration, name, inferences, followed = /* @__PURE__ */ new Set()) {
 	if (Node.isInterfaceDeclaration(declaration)) return {
 		reason: "hand-written-interface",
 		message: `${name} is a hand-written interface; derive the command from its schema`
@@ -266,7 +336,7 @@ function problem(declaration, name, inferences, followed = /* @__PURE__ */ new S
 			};
 		}
 		const alias = aliasNamed(written.getTypeName());
-		if (alias !== void 0 && !followed.has(alias)) return problem(alias, name, inferences, /* @__PURE__ */ new Set([...followed, alias]));
+		if (alias !== void 0 && !followed.has(alias)) return problem$1(alias, name, inferences, /* @__PURE__ */ new Set([...followed, alias]));
 	}
 	return {
 		reason: "hand-written-alias",
@@ -290,7 +360,7 @@ const commandTypes = async ({ cwd, options }) => {
 	for (const file of files) for (const [name, declaration] of exportedTypes(project.getSourceFileOrThrow(resolve(cwd, file)))) {
 		if (excluded.has(name) || seen.has(declaration)) continue;
 		seen.add(declaration);
-		const found = problem(declaration, name, inferences);
+		const found = problem$1(declaration, name, inferences);
 		if (found !== void 0) violations.push({
 			code: `command-types/${found.reason}`,
 			message: found.message,
@@ -371,175 +441,1439 @@ async function readObject(cwd, file, configFiles) {
 	return config;
 }
 /**
-* The commit types the conventional presets know, which is the `type-enum` of `@commitlint/config-conventional` and the type list the conventional changelog presets label. Their release behaviour is the preset's own, so a preset type needs no release rule or changelog section to be accounted for; a type outside this list does.
+* The commit types the conventional presets know, which is the `type-enum` of `@commitlint/config-conventional` and the type list the conventional changelog presets label. Their release behaviour is the preset's own, so a preset type needs no release rule or changelog section to be accounted for; a type outside this list does.
+*/
+const PRESET_COMMIT_TYPES = [
+	"build",
+	"chore",
+	"ci",
+	"docs",
+	"feat",
+	"fix",
+	"perf",
+	"refactor",
+	"revert",
+	"style",
+	"test"
+];
+function isCustom(type) {
+	return !PRESET_COMMIT_TYPES.includes(type);
+}
+/**
+* The commit types commitlint accepts are accounted for in the release config. A type no preset knows must have a release rule and, when the config lists changelog sections (`presetConfig.types` of the release notes generator), a section, or it can be committed and never released or shown; a release rule or changelog section for a type commitlint rejects can never apply. Types are enumerated only by a `type-enum` rule of the form `[level, 'always', [types]]`; a `'never'` rule forbids the types it lists and enumerates none, and a rule that is off (level 0) accepts every type. A preset type may be left out of either list: leaving out a type that does not release is how a release rule list is normally written.
+*
+* It compares only what is written. The check has nothing to say when the commit types are the preset's and every listed type is one of them. A commitlint config that does not set `type-enum` while the release config lists a type no preset knows is a violation, since the commit types cannot then be read. Both configs are evaluated, so a list may be derived from one shared constant.
+*/
+const commitTypes = async ({ cwd, options, configFiles }) => {
+	const commitlintFile = options.commitlint ?? DEFAULT_COMMITLINT_CONFIG;
+	const releaseFile = options.release ?? DEFAULT_RELEASE_CONFIG;
+	const commitlint = await readObject(cwd, commitlintFile, configFiles);
+	const release = await readObject(cwd, releaseFile, configFiles);
+	const violations = [];
+	if (commitlint === void 0) violations.push({
+		code: "commit-types/missing-config",
+		message: `${commitlintFile} does not exist`,
+		file: commitlintFile
+	});
+	if (release === void 0) violations.push({
+		code: "commit-types/missing-config",
+		message: `${releaseFile} does not exist`,
+		file: releaseFile
+	});
+	if (commitlint === void 0 || release === void 0) return violations;
+	const releaseRules = typesOfEntries(pluginOptions(release, COMMIT_ANALYZER)?.["releaseRules"], releaseFile, "releaseRules");
+	const presetConfig = pluginOptions(release, RELEASE_NOTES_GENERATOR)?.["presetConfig"];
+	const changelog = typesOfEntries(isRecord(presetConfig) ? presetConfig["types"] : void 0, releaseFile, "presetConfig.types");
+	const accepted = commitTypeRule(commitlint, commitlintFile);
+	if (accepted === void 0) {
+		const unknown = [releaseRules, changelog].flatMap((list) => list ?? []).filter(isCustom);
+		if (unknown.length > 0) violations.push({
+			code: "commit-types/no-type-enum",
+			message: `${releaseFile} lists ${unknown.map((type) => `'${type}'`).join(", ")}, which no preset knows, but ${commitlintFile} sets no 'type-enum' rule, so the commit types cannot be read`,
+			file: commitlintFile
+		});
+		return violations;
+	}
+	const lists = [{
+		listed: releaseRules,
+		required: true,
+		noun: "release rule",
+		absent: "no-release-rule",
+		extra: "release-rule-not-a-commit-type"
+	}, {
+		listed: changelog,
+		required: changelog !== void 0,
+		noun: "changelog section",
+		absent: "no-changelog-section",
+		extra: "changelog-section-not-a-commit-type"
+	}];
+	for (const { listed, required, noun, absent, extra } of lists) {
+		for (const type of required ? (accepted.enumerated ?? []).filter(isCustom) : []) if (listed?.includes(type) !== true) violations.push({
+			code: `commit-types/${absent}`,
+			message: `'${type}' is a commit type in ${commitlintFile} that no preset knows, and ${releaseFile} has no ${noun} for it`,
+			file: releaseFile
+		});
+		for (const type of (listed ?? []).filter((candidate) => !accepted.accepts(candidate))) violations.push({
+			code: `commit-types/${extra}`,
+			message: `'${type}' has a ${noun} in ${releaseFile} but is not a commit type in ${commitlintFile}`,
+			file: commitlintFile
+		});
+	}
+	return violations;
+};
+//#endregion
+//#region src/checks/dockerfile-package-manager.ts
+const DEFAULT_DOCKERFILES = [
+	"**/Dockerfile",
+	"**/Dockerfile.*",
+	"**/*.Dockerfile"
+];
+const DEFAULT_PACKAGE_JSON = "package.json";
+/**
+* A package manager and a version, `pnpm@12.4.1` or `pnpm@12.4.1+sha512.abc`, as `packageManager` and corepack write them.
+*/
+const PACKAGE_MANAGER = /^([a-z]+)@([^+\s]+)/u;
+/**
+* A variable reference in a version: `$NAME` or `${NAME}`, capturing the name.
+*/
+const VARIABLE = /\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/gu;
+/**
+* `<manager>@<version>` wherever a Dockerfile installs or activates a package manager. The manager is not the end of a longer name (`create-pnpm`, `@scope/pnpm`). The version is what a version is made of, plus variable references, and stops at anything else, such as a comma or a quote; a `+` suffix such as `+sha512.abc` is not part of it.
+*/
+const PIN = /(?<![\w./@-])(pnpm|yarn|npm)@((?:\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$[A-Za-z_][A-Za-z0-9_]*|[0-9A-Za-z._-])+)/gu;
+const INSTRUCTION = /^\s*(ARG|ENV)\s+(.*)$/iu;
+const ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S*)/gu;
+function unquoted(value) {
+	return value.replace(/^(["'])(.*)\1$/u, "$2");
+}
+/**
+* The variables an `ARG` or `ENV` instruction sets, with the value it gives each, or `undefined` for an `ARG` without a default. `ARG NAME=value`, `ENV NAME=value NAME2=value2` and `ENV NAME value` are read; any other line sets nothing.
+*/
+function variablesSetBy(line) {
+	const [, instruction, body] = INSTRUCTION.exec(line) ?? [];
+	const variables = /* @__PURE__ */ new Map();
+	if (instruction === void 0 || body === void 0) return variables;
+	for (const [, name, value] of body.matchAll(ASSIGNMENT)) if (name !== void 0 && value !== void 0) variables.set(name, unquoted(value));
+	if (variables.size === 0) {
+		const [name, ...value] = body.trim().split(/\s+/u);
+		if (name !== void 0 && name !== "") variables.set(name, instruction.toUpperCase() === "ENV" && value.length > 0 ? unquoted(value.join(" ")) : void 0);
+	}
+	return variables;
+}
+/**
+* The version a pin names once the variables it refers to are replaced by the values in effect, or `undefined` when a variable has no value there (an `ARG` without a default, or a variable this file does not set) or its value refers to another variable, which makes the version unknowable from the file. A `+sha` suffix is dropped.
+*/
+function versionOf(token, variables) {
+	const unknown = [];
+	const replaced = token.replace(VARIABLE, (_reference, variable) => {
+		const value = variables.get(variable);
+		if (value === void 0 || value.includes("$")) {
+			unknown.push(variable);
+			return "";
+		}
+		return value;
+	});
+	return unknown.length === 0 ? replaced.split("+")[0] : void 0;
+}
+/**
+* Every pin of the package manager that `packageManager` names, in each Dockerfile, is the version `packageManager` names, with any `+sha` integrity suffix ignored on both sides. Pins of other package managers are not the workspace's package manager and are left alone.
+*
+* It reads `<manager>@<version>` as written on a line that is not a comment. A version that refers to a variable is compared with the value the file gives that variable by an `ARG` or `ENV` before the pin (the latest such value, whichever build stage it was in); one whose variable has no value in the file is not compared, since the build supplies it.
+*/
+const dockerfilePackageManager = async ({ cwd, options }) => {
+	const packageJson = options.packageJson ?? DEFAULT_PACKAGE_JSON;
+	const manifest = JSON.parse(await readFile(resolve(cwd, packageJson), "utf8"));
+	const declared = isRecord(manifest) && typeof manifest["packageManager"] === "string" ? PACKAGE_MANAGER.exec(manifest["packageManager"]) : null;
+	const name = declared?.[1];
+	const version = declared?.[2];
+	if (name === void 0 || version === void 0) return [{
+		code: "dockerfile-package-manager/no-package-manager",
+		message: `${packageJson} has no valid 'packageManager' field to compare Dockerfile pins with`,
+		file: packageJson
+	}];
+	const violations = [];
+	for (const file of await findFiles(cwd, [...options.dockerfiles ?? DEFAULT_DOCKERFILES, ...excludedFrom(options.exclude)])) {
+		const variables = /* @__PURE__ */ new Map();
+		(await readFile(resolve(cwd, file), "utf8")).split("\n").forEach((text, index) => {
+			if (text.trimStart().startsWith("#")) return;
+			for (const [variable, value] of variablesSetBy(text)) variables.set(variable, value);
+			for (const match of text.matchAll(PIN)) {
+				const pinned = versionOf(String(match[2]), variables);
+				if (match[1] === name && pinned !== void 0 && pinned !== version) violations.push({
+					code: "dockerfile-package-manager/version-mismatch",
+					message: `${file} pins ${name}@${pinned} but packageManager in ${packageJson} is ${name}@${version}`,
+					file,
+					location: {
+						line: index + 1,
+						column: match.index + 1
+					}
+				});
+			}
+		});
+	}
+	return violations;
+};
+async function git(cwd, args) {
+	return new Promise((resolve, reject) => {
+		execFile("git", [...args], {
+			cwd,
+			encoding: "utf8"
+		}, (error, stdout) => {
+			if (error === null) resolve(stdout);
+			else reject(new ConformanceError(`git ${args.join(" ")} failed in ${cwd}; this check reads the git index, so it needs a git working tree`, { cause: error }));
+		});
+	});
+}
+/**
+* The index entry for `path` (relative to `cwd`), or `undefined` when git does not track it.
+*/
+async function indexEntry(cwd, path) {
+	const listing = await git(cwd, [
+		"ls-files",
+		"--stage",
+		"--",
+		path
+	]);
+	const match = /^(\d+) ([0-9a-f]+) \d\t/u.exec(listing);
+	const mode = match?.[1];
+	const blob = match?.[2];
+	return mode === void 0 || blob === void 0 ? void 0 : {
+		mode,
+		blob
+	};
+}
+/**
+* The content of a blob. For a symbolic link it is the link's target.
+*/
+async function blobContent(cwd, blob) {
+	return git(cwd, [
+		"cat-file",
+		"blob",
+		blob
+	]);
+}
+/**
+* The URL of the remote `name` as configured, before any `url.<base>.insteadOf` rewriting (which `git remote get-url` applies and which can turn a GitHub address into a host alias), or `undefined` when the working tree has no such remote.
+*/
+async function remoteUrl(cwd, name) {
+	if (!(await git(cwd, ["remote"])).split("\n").includes(name)) return;
+	return (await git(cwd, [
+		"config",
+		"--get",
+		`remote.${name}.url`
+	])).trim();
+}
+//#endregion
+//#region src/settings/repository.ts
+const SLUG = /^([^/\s]+)\/([^/\s]+)$/u;
+const REMOTE = /github\.com[:/]([^/\s]+)\/([^/\s]+?)(?:\.git)?\/?$/u;
+const REMOTE_NAME = "origin";
+/**
+* The repository the settings checks read: `repository` from the options, else the one the `origin` remote of `cwd` points at.
+*/
+async function repositoryOf(cwd, options) {
+	if (options.repository !== void 0) {
+		const [, owner, name] = SLUG.exec(options.repository) ?? [];
+		if (owner === void 0 || name === void 0) throw new ConformanceError(`the repository '${options.repository}' is not written owner/name`);
+		return {
+			owner,
+			name
+		};
+	}
+	const url = await remoteUrl(cwd, REMOTE_NAME);
+	const [, owner, name] = REMOTE.exec(url ?? "") ?? [];
+	if (owner === void 0 || name === void 0) throw new ConformanceError(`${cwd} has no '${REMOTE_NAME}' remote on github.com; set the repository option`);
+	return {
+		owner,
+		name
+	};
+}
+/**
+* The branch whose rules are read: `branch` from the options, else the repository's default branch.
+*/
+async function branchOf(github, slug, options) {
+	return options.branch ?? (await github.repository(slug)).defaultBranch;
+}
+/**
+* What a violation of a settings check names as its file.
+*/
+function repositoryFile(slug) {
+	return `${slug.owner}/${slug.name}`;
+}
+//#endregion
+//#region src/checks/settings-merge-methods.ts
+const METHODS = [
+	"rebase",
+	"squash",
+	"merge"
+];
+/**
+* Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it and no `pull_request` rule that applies to the branch leaves it out of its allowed methods.
+*
+* Limits: it reads the repository settings and the rules of rulesets that apply to the branch; classic branch protection and a merge queue's own merge method are not read, so a repository whose queue owns the strategy is judged by what it still allows for a direct merge.
+*/
+const settingsMergeMethods = async ({ cwd, options, github }) => {
+	const slug = await repositoryOf(cwd, options);
+	const file = repositoryFile(slug);
+	const settings = await github.repository(slug);
+	const rules = await github.branchRules(slug, await branchOf(github, slug, options));
+	const wanted = options.allowed ?? "rebase";
+	const repositoryAllows = {
+		rebase: settings.allowRebaseMerge,
+		squash: settings.allowSquashMerge,
+		merge: settings.allowMergeCommit
+	};
+	const available = METHODS.filter((method) => repositoryAllows[method] && rules.pullRequests.every((rule) => rule.allowedMergeMethods === void 0 || rule.allowedMergeMethods.includes(method)));
+	const violations = available.filter((method) => method !== wanted).map((method) => ({
+		code: "settings-merge-methods/method-enabled",
+		message: `${file} allows ${method} merges; only ${wanted} should be allowed`,
+		file
+	}));
+	if (!available.includes(wanted)) violations.push({
+		code: "settings-merge-methods/method-unavailable",
+		message: `${file} does not allow ${wanted} merges`,
+		file
+	});
+	return violations;
+};
+//#endregion
+//#region src/workflows/model.ts
+/**
+* The access `permissions` grants to `scope`, or `undefined` when the permissions are not declared and the repository default applies.
+*/
+function accessOf(permissions, scope) {
+	if (permissions.kind === "default") return;
+	return permissions.kind === "all" ? permissions.access : permissions.scopes.get(scope) ?? "none";
+}
+/**
+* The text of a scalar value; `undefined` for anything that is not a string, number or boolean.
+*/
+function scalarText(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean" ? String(value) : void 0;
+}
+/**
+* Where a node of the document is: the key for a mapping entry, the item for a sequence entry, else the node itself. Positions are counted from 1.
+*/
+function locationAt(document, lineCounter, path) {
+	const parent = path.length === 0 ? document.contents : document.getIn(path.slice(0, -1), true);
+	const last = path.at(-1);
+	let range;
+	if (isMap(parent) && typeof last === "string") {
+		const pair = parent.items.find((item) => isScalar(item.key) && item.key.value === last);
+		range = isScalar(pair?.key) ? pair.key.range : void 0;
+	} else {
+		const target = isSeq(parent) && typeof last === "number" ? parent.items[last] : parent;
+		range = isNode(target) ? target.range : void 0;
+	}
+	const position = lineCounter.linePos(range?.[0] ?? 0);
+	return {
+		line: position.line,
+		column: position.col
+	};
+}
+/**
+* Parse YAML text. It throws `ConformanceError` naming `file` when the text is not valid YAML.
+*/
+function parseYaml(file, source) {
+	const lineCounter = new LineCounter();
+	const document = parseDocument(source, {
+		lineCounter,
+		prettyErrors: false
+	});
+	const [error] = document.errors;
+	if (error !== void 0) throw new ConformanceError(`${file}: not valid YAML: ${error.message}`, { cause: error });
+	return {
+		value: document.toJS(),
+		locate: (path) => locationAt(document, lineCounter, path)
+	};
+}
+/**
+* A reader for one file, so the helpers can name the field they read when the file is not a workflow.
+*/
+var Reader = class {
+	file;
+	parsed;
+	constructor(file, parsed) {
+		this.file = file;
+		this.parsed = parsed;
+	}
+	fail(what) {
+		throw new ConformanceError(`${this.file}: ${what}`);
+	}
+	location(path) {
+		return this.parsed.locate(path);
+	}
+	record(value, what) {
+		if (value === void 0 || value === null) return {};
+		if (!isRecord(value)) return this.fail(`${what} must be a mapping`);
+		return value;
+	}
+	text(value, what) {
+		if (value === void 0 || value === null) return;
+		return scalarText(value) ?? this.fail(`${what} must be a string, number or boolean`);
+	}
+	texts(value, what) {
+		return Object.fromEntries(Object.entries(this.record(value, what)).map(([key, entry]) => [key, this.text(entry, `${what}.${key}`) ?? ""]));
+	}
+	list(value, what) {
+		if (value === void 0 || value === null) return [];
+		return (Array.isArray(value) ? value : [value]).map((item) => this.text(item, what) ?? this.fail(`${what} must be a string or a list of strings`));
+	}
+};
+const PERMISSION_ACCESS = /* @__PURE__ */ new Set([
+	"read",
+	"write",
+	"none"
+]);
+function isPermissionAccess(value) {
+	return PERMISSION_ACCESS.has(value);
+}
+function permissionsOf(reader, value, what) {
+	if (value === void 0 || value === null) return { kind: "default" };
+	if (value === "read-all") return {
+		kind: "all",
+		access: "read"
+	};
+	if (value === "write-all") return {
+		kind: "all",
+		access: "write"
+	};
+	const scopes = /* @__PURE__ */ new Map();
+	for (const [scope, access] of Object.entries(reader.record(value, what))) {
+		const text = reader.text(access, `${what}.${scope}`);
+		if (text === void 0 || !isPermissionAccess(text)) return reader.fail(`${what}.${scope} must be read, write or none`);
+		scopes.set(scope, text);
+	}
+	return {
+		kind: "scopes",
+		scopes
+	};
+}
+function runsOnOf(reader, value, what) {
+	const mapping = isRecord(value) ? value : void 0;
+	const entries = reader.list(mapping === void 0 ? value : mapping["labels"], what);
+	const group = mapping === void 0 ? void 0 : reader.text(mapping["group"], `${what}.group`);
+	return {
+		labels: entries.filter((entry) => !entry.includes("${{")),
+		expressions: entries.filter((entry) => entry.includes("${{")),
+		group
+	};
+}
+function stepOf(reader, value, jobPath, index) {
+	const path = [
+		...jobPath,
+		"steps",
+		index
+	];
+	const what = path.join(".");
+	const step = reader.record(value, what);
+	return {
+		index,
+		id: reader.text(step["id"], `${what}.id`),
+		name: reader.text(step["name"], `${what}.name`),
+		uses: reader.text(step["uses"], `${what}.uses`),
+		run: reader.text(step["run"], `${what}.run`),
+		with: reader.texts(step["with"], `${what}.with`),
+		env: reader.texts(step["env"], `${what}.env`),
+		condition: reader.text(step["if"], `${what}.if`),
+		location: reader.location(path)
+	};
+}
+function jobOf(reader, id, value) {
+	const path = ["jobs", id];
+	const what = path.join(".");
+	const job = reader.record(value, what);
+	const steps = job["steps"];
+	if (steps !== void 0 && !Array.isArray(steps)) return reader.fail(`${what}.steps must be a list`);
+	return {
+		id,
+		name: reader.text(job["name"], `${what}.name`),
+		needs: reader.list(job["needs"], `${what}.needs`),
+		condition: reader.text(job["if"], `${what}.if`),
+		permissions: permissionsOf(reader, job["permissions"], `${what}.permissions`),
+		env: reader.texts(job["env"], `${what}.env`),
+		runsOn: runsOnOf(reader, job["runs-on"], `${what}.runs-on`),
+		timeoutMinutes: reader.text(job["timeout-minutes"], `${what}.timeout-minutes`),
+		uses: reader.text(job["uses"], `${what}.uses`),
+		with: reader.texts(job["with"], `${what}.with`),
+		outputs: reader.texts(job["outputs"], `${what}.outputs`),
+		steps: (steps ?? []).map((step, index) => stepOf(reader, step, path, index)),
+		location: reader.location(path)
+	};
+}
+function triggerLocationsOf(reader, triggers, value) {
+	const events = [...triggers.keys()];
+	return new Map(events.map((event, index) => [event, reader.location(Array.isArray(value) ? ["on", index] : isRecord(value) ? ["on", event] : ["on"])]));
+}
+function triggersOf(reader, value) {
+	if (typeof value === "string") return /* @__PURE__ */ new Map([[value, void 0]]);
+	if (Array.isArray(value)) return new Map(reader.list(value, "on").map((event) => [event, void 0]));
+	return new Map(Object.entries(reader.record(value, "on")));
+}
+/**
+* Parse the text of a workflow file into the model the checks read. It throws `ConformanceError` when the file is not YAML or is not shaped like a workflow, since a check cannot judge what it cannot read.
+*/
+function parseWorkflow(file, source) {
+	const parsed = parseYaml(file, source);
+	const reader = new Reader(file, parsed);
+	const root = reader.record(parsed.value, "the workflow");
+	const triggers = triggersOf(reader, root["on"]);
+	const call = triggers.get("workflow_call");
+	const outputs = reader.record(reader.record(call, "on.workflow_call")["outputs"], "on.workflow_call.outputs");
+	return {
+		file,
+		name: reader.text(root["name"], "name"),
+		triggers,
+		triggerLocations: triggerLocationsOf(reader, triggers, root["on"]),
+		permissions: permissionsOf(reader, root["permissions"], "permissions"),
+		env: reader.texts(root["env"], "env"),
+		jobs: Object.entries(reader.record(root["jobs"], "jobs")).map(([id, job]) => jobOf(reader, id, job)),
+		callOutputs: Object.fromEntries(Object.entries(outputs).map(([name, output]) => [name, reader.text(reader.record(output, `on.workflow_call.outputs.${name}`)["value"], `on.workflow_call.outputs.${name}.value`) ?? ""]))
+	};
+}
+/**
+* The permissions that apply to a job: its own when it declares any, else the workflow's. A job's declaration replaces the workflow's whole, it is not merged with it.
+*/
+function effectivePermissions(workflow, job) {
+	return job.permissions.kind === "default" ? workflow.permissions : job.permissions;
+}
+/**
+* The environment a step runs with: the workflow's, the job's and the step's, the later winning.
+*/
+function effectiveEnv(workflow, job, step) {
+	return {
+		...workflow.env,
+		...job.env,
+		...step?.env
+	};
+}
+/**
+* Every job `jobId` waits for, directly or through other jobs, not including itself. A `needs` that names no job of the workflow is followed no further.
+*/
+function transitiveNeeds(workflow, jobId) {
+	const byId = new Map(workflow.jobs.map((job) => [job.id, job]));
+	const reached = /* @__PURE__ */ new Set();
+	const pending = [...byId.get(jobId)?.needs ?? []];
+	for (let next = pending.pop(); next !== void 0; next = pending.pop()) if (!reached.has(next)) {
+		reached.add(next);
+		pending.push(...byId.get(next)?.needs ?? []);
+	}
+	reached.delete(jobId);
+	return reached;
+}
+/**
+* Split a `uses` value into its parts.
+*/
+function parseUses(uses) {
+	if (uses.startsWith("./")) return {
+		kind: "local",
+		path: uses
+	};
+	if (uses.startsWith("docker://")) {
+		const reference = uses.slice(9);
+		const at = reference.indexOf("@");
+		return at === -1 ? {
+			kind: "docker",
+			image: reference,
+			digest: void 0
+		} : {
+			kind: "docker",
+			image: reference.slice(0, at),
+			digest: reference.slice(at + 1)
+		};
+	}
+	const at = uses.lastIndexOf("@");
+	const [owner = "", repository = "", ...path] = (at === -1 ? uses : uses.slice(0, at)).split("/");
+	return {
+		kind: "remote",
+		owner,
+		repository,
+		path: path.join("/"),
+		ref: at === -1 ? void 0 : uses.slice(at + 1)
+	};
+}
+/**
+* Whether `value` contains an expression, which is only known when the workflow runs.
+*/
+function hasExpression(value) {
+	return value.includes("${{");
+}
+//#endregion
+//#region src/workflows/load.ts
+/**
+* Where GitHub looks for workflows: only this directory, and only the files directly in it.
+*/
+const DEFAULT_WORKFLOWS = [".github/workflows/*.yml", ".github/workflows/*.yaml"];
+/**
+* Read and parse the selected workflow files, sorted by path.
+*/
+async function loadWorkflows(cwd, selection) {
+	const files = await findFiles(cwd, [...selection.workflows ?? DEFAULT_WORKFLOWS, ...excludedFrom(selection.exclude)]);
+	return Promise.all(files.map(async (file) => parseWorkflow(file, await readFile(resolve(cwd, file), "utf8"))));
+}
+//#endregion
+//#region src/workflows/shared.ts
+/**
+* A violation about a place in a workflow file.
+*/
+function workflowViolation(workflow, code, message, location) {
+	return {
+		code,
+		message,
+		file: workflow.file,
+		location
+	};
+}
+/**
+* The commands of a `run` script as logical lines: a line ended by a backslash is joined to the next one, comment lines and blank lines are dropped.
+*/
+function commandLines(run) {
+	const lines = [];
+	let continued = "";
+	for (const line of run.split("\n")) {
+		const joined = `${continued}${line.trim()}`;
+		if (joined.endsWith("\\")) continued = `${joined.slice(0, -1).trimEnd()} `;
+		else {
+			continued = "";
+			if (joined !== "" && !joined.startsWith("#")) lines.push(joined);
+		}
+	}
+	if (continued !== "") lines.push(continued.trim());
+	return lines;
+}
+/**
+* Variable assignments that prefix a command (`HUSKY=0 pnpm exec ...`).
+*/
+const LEADING_ASSIGNMENTS = /^(?:[A-Za-z_]\w*=\S*\s+)+/u;
+/**
+* The simple commands of a logical line, without the variable assignments that prefix them: it is split at `&&`, `||`, `;`, `|` and `&` that are outside quotes and outside `${{ }}` expressions, and that are not part of a redirection (`2>&1`, `&>file`), so text inside a quoted string (an `echo` of a command) is not mistaken for a command.
+*/
+function commandSegments(line) {
+	const segments = [];
+	let current = "";
+	let quote;
+	for (let index = 0; index < line.length; index += 1) {
+		const rest = line.slice(index);
+		const character = rest.charAt(0);
+		if (quote !== void 0) {
+			current += character;
+			quote = character === quote ? void 0 : quote;
+		} else if (rest.startsWith("${{")) {
+			const end = rest.indexOf("}}");
+			const expression = end === -1 ? rest : rest.slice(0, end + 2);
+			current += expression;
+			index += expression.length - 1;
+		} else if (character === "\"" || character === "'") {
+			current += character;
+			quote = character;
+		} else if (character === "&" && (current.endsWith(">") || current.endsWith("<") || rest.startsWith("&>"))) current += character;
+		else if (character === "&" || character === "|" || character === ";") {
+			segments.push(current);
+			current = "";
+		} else current += character;
+	}
+	segments.push(current);
+	return segments.map((segment) => segment.trim().replace(LEADING_ASSIGNMENTS, "")).filter((segment) => segment !== "");
+}
+/**
+* The simple commands of every line of a `run` script.
+*/
+function scriptCommands(run) {
+	return commandLines(run ?? "").flatMap(commandSegments);
+}
+/**
+* Whether a step uses the action `owner/repository`, at any path or ref.
+*/
+function stepUses(step, action) {
+	const target = step.uses?.split("@")[0]?.toLowerCase();
+	return target === action.toLowerCase() || target?.startsWith(`${action.toLowerCase()}/`) === true;
+}
+/**
+* The jobs among `ids` that exist in the workflow, in the workflow's order.
+*/
+function jobsNamed(workflow, ids) {
+	return workflow.jobs.filter((job) => ids.includes(job.id));
+}
+/**
+* Whether an `if` expression calls `always()`.
+*/
+function callsAlways(condition) {
+	return condition !== void 0 && /\balways\(\)/u.test(condition);
+}
+/**
+* The default ids of junction jobs, shared by the checks that look for one.
+*/
+const DEFAULT_JUNCTION_JOBS = ["required-checks"];
+//#endregion
+//#region src/checks/settings-required-checks.ts
+/**
+* The branch requires the check of every junction job of the workflows, and requires branches to be up to date before merging (strict mode). The check name of a job is its `name`, else its id.
+*
+* The junction job is the one that reports for the whole workflow, so requiring it requires everything it needs, including jobs a path filter may skip. Codes: `no-required-checks` (no `required_status_checks` rule applies), `required-check-missing` (a junction job's check is not among the required ones), `not-strict` (no rule sets the strict policy) and `no-junction-job` (no workflow has a job with an id from `junctionJobs`).
+*
+* Limits: it reads the rules of rulesets that apply to the branch; classic branch protection is not read, so a repository that uses it is reported as having no required checks. A junction job in a reusable workflow, or a name that is an expression, is not resolved.
+*/
+const settingsRequiredChecks = async ({ cwd, options, github }) => {
+	const slug = await repositoryOf(cwd, options);
+	const file = repositoryFile(slug);
+	const rules = await github.branchRules(slug, await branchOf(github, slug, options));
+	const junctions = (await loadWorkflows(cwd, options)).flatMap((workflow) => jobsNamed(workflow, options.junctionJobs ?? DEFAULT_JUNCTION_JOBS).map((job) => ({
+		workflow,
+		name: job.name ?? job.id
+	})));
+	const violations = [];
+	if (junctions.length === 0) violations.push({
+		code: "settings-required-checks/no-junction-job",
+		message: "no workflow has a junction job, so there is no check that reports for the whole workflow to require",
+		file
+	});
+	if (rules.requiredStatusChecks.length === 0) {
+		violations.push({
+			code: "settings-required-checks/no-required-checks",
+			message: `no rule requires status checks on the branch of ${file}`,
+			file
+		});
+		return violations;
+	}
+	const required = new Set(rules.requiredStatusChecks.flatMap((rule) => rule.contexts));
+	for (const { workflow, name } of junctions.filter((junction) => !required.has(junction.name))) violations.push({
+		code: "settings-required-checks/required-check-missing",
+		message: `${file} does not require the check '${name}' of ${workflow.file}`,
+		file
+	});
+	if (!rules.requiredStatusChecks.some((rule) => rule.strict)) violations.push({
+		code: "settings-required-checks/not-strict",
+		message: `${file} does not require branches to be up to date before merging`,
+		file
+	});
+	return violations;
+};
+//#endregion
+//#region src/checks/settings-review-thread-resolution.ts
+/**
+* A pull request cannot merge while a review conversation is unresolved: a `pull_request` rule that applies to the branch sets `required_review_thread_resolution`.
+*
+* Limits: it reads the rules of rulesets; classic branch protection is not read.
+*/
+const settingsReviewThreadResolution = async ({ cwd, options, github }) => {
+	const slug = await repositoryOf(cwd, options);
+	const rules = await github.branchRules(slug, await branchOf(github, slug, options));
+	const file = repositoryFile(slug);
+	return rules.pullRequests.some((rule) => rule.requiredReviewThreadResolution) ? [] : [{
+		code: "settings-review-thread-resolution/not-required",
+		message: `no rule requires review conversations to be resolved before merging on the branch of ${file}`,
+		file
+	}];
+};
+//#endregion
+//#region src/checks/workflow-action-pinning.ts
+const FULL_COMMIT_SHA = /^[0-9a-f]{40}$/u;
+const DOCKER_DIGEST = /^sha256:[0-9a-f]{64}$/u;
+/**
+* Whether `repository` (`owner/repository`) matches an `allow` entry, which is `owner/repository` or `owner/*`.
+*/
+function allowed(owner, repository, allow) {
+	return allow.some((entry) => entry.toLowerCase() === `${owner}/${repository}`.toLowerCase() || entry.toLowerCase() === `${owner}/*`.toLowerCase());
+}
+/**
+* Why a reference breaks the policy, with the code of the violation, or `undefined` when it follows it.
+*/
+function problem(reference, options) {
+	if (reference.kind === "local") return;
+	if (reference.kind === "docker") return reference.digest !== void 0 && DOCKER_DIGEST.test(reference.digest) ? void 0 : {
+		code: "docker-not-pinned",
+		reason: "a Docker image must be pinned by digest (@sha256:...), because a tag can be moved"
+	};
+	const { owner, repository, ref } = reference;
+	if (allowed(owner, repository, options.allow ?? [])) return;
+	if (ref === void 0 || ref === "") return {
+		code: "missing-ref",
+		reason: "it names no ref"
+	};
+	return ((options.organisations ?? []).some((organisation) => organisation.toLowerCase() === owner.toLowerCase()) ? options.sameOrganisation ?? "ref" : options.thirdParty ?? "sha") === "sha" && !FULL_COMMIT_SHA.test(ref) ? {
+		code: "not-pinned",
+		reason: `ref '${ref}' is not a full commit SHA, and a tag or branch can be moved to different code`
+	} : void 0;
+}
+/**
+* Every `uses` of a step or job follows the pinning policy. By default an action or reusable workflow from outside the organisations in the options must be pinned by full commit SHA (a Docker image by digest), and one owned by an organisation listed in `organisations` may use any ref; `thirdParty` and `sameOrganisation` set either to `sha` or `ref`, and `allow` exempts repositories. Local actions and workflows (`./...`) are not judged.
+*
+* The check encodes whichever policy the options state and is never silent about it: with nothing configured every remote reference must be a SHA. Limits: it checks the form of the ref, not that the SHA belongs to the repository or to a release; a SHA written with a trailing version comment is read as the SHA; composite actions are not read.
+*/
+const workflowActionPinning = async ({ cwd, options }) => {
+	const violations = [];
+	for (const workflow of await loadWorkflows(cwd, options)) {
+		const uses = [...workflow.jobs.flatMap((job) => job.uses === void 0 ? [] : [{
+			value: job.uses,
+			location: job.location
+		}]), ...workflow.jobs.flatMap((job) => job.steps.flatMap((step) => step.uses === void 0 ? [] : [{
+			value: step.uses,
+			location: step.location
+		}]))].sort((left, right) => left.location.line - right.location.line || left.location.column - right.location.column);
+		for (const { value, location } of uses) {
+			const found = problem(parseUses(value), options);
+			if (found !== void 0) violations.push(workflowViolation(workflow, `workflow-action-pinning/${found.code}`, `${value}: ${found.reason}`, location));
+		}
+	}
+	return violations;
+};
+//#endregion
+//#region src/checks/workflow-credentials.ts
+/**
+* The actions that sign an attestation, which needs an OIDC identity and the right to store the attestation.
+*/
+const ATTESTATION_ACTIONS = [
+	"actions/attest",
+	"actions/attest-build-provenance",
+	"actions/attest-sbom"
+];
+/**
+* The scopes an attestation step needs written.
+*/
+const ATTESTATION_SCOPES = ["id-token", "attestations"];
+/**
+* The options a package manager takes before its subcommand: flags such as `-r`, and the options that select a workspace package or directory, with their value after a space or an equals sign.
+*/
+const PACKAGE_MANAGER_OPTIONS = String.raw`(?:\s+(?:(?:--filter|-F|--workspace|-w|--dir|-C)(?:\s+|=)\S+|--?[\w-]+))*`;
+/**
+* Commands that publish a package to a registry.
+*/
+const PUBLISH_COMMAND = new RegExp(String.raw`^(?:(?:npm|pnpm|yarn)${PACKAGE_MANAGER_OPTIONS}(?:\s+npm)?\s+publish|(?:(?:pnpm|yarn)(?:\s+exec)?\s+|npx\s+)?(?:semantic-release|changeset\s+publish|lerna\s+publish))(?:\s|$)`, "u");
+/**
+* The variables a token for the registry is passed in.
+*/
+const TOKEN_VARIABLES = ["NODE_AUTH_TOKEN", "NPM_TOKEN"];
+const PROVENANCE_FLAG = /--provenance(?:=true)?(?:\s|$)/u;
+/**
+* Whether the `package.json` in the working directory asks for provenance with `publishConfig.provenance: true`, which applies to every publish of that package.
+*/
+async function requestsProvenance(cwd) {
+	const file = resolve(cwd, "package.json");
+	if (!existsSync(file)) return false;
+	const manifest = JSON.parse(await readFile(file, "utf8"));
+	const config = isRecord(manifest) ? manifest["publishConfig"] : void 0;
+	return isRecord(config) && config["provenance"] === true;
+}
+function attestationViolations(workflow, job) {
+	const permissions = effectivePermissions(workflow, job);
+	return job.steps.filter((step) => ATTESTATION_ACTIONS.some((action) => stepUses(step, action))).flatMap((step) => {
+		const missing = ATTESTATION_SCOPES.filter((scope) => accessOf(permissions, scope) !== "write").map((scope) => `${scope}: write`).join(" and ");
+		const problem = permissions.kind === "default" ? `declares no permissions; declare ${missing}` : `does not grant ${missing}`;
+		return missing === "" ? [] : [workflowViolation(workflow, "workflow-credentials/attestation-permissions", `job '${job.id}' creates an attestation but ${problem}`, step.location)];
+	});
+}
+/**
+* Whether the job passes a registry token to a step, which makes its publish not tokenless: a token variable with a value other than the empty string, anywhere in the environment.
+*/
+function passesToken(workflow, job) {
+	return [void 0, ...job.steps].some((step) => TOKEN_VARIABLES.some((variable) => (effectiveEnv(workflow, job, step)[variable] ?? "") !== ""));
+}
+function tokenlessPublishViolations(workflow, job, provenanceInManifest) {
+	if (accessOf(effectivePermissions(workflow, job), "id-token") !== "write" || passesToken(workflow, job)) return [];
+	return job.steps.flatMap((step) => {
+		const publishes = scriptCommands(step.run).filter((line) => PUBLISH_COMMAND.test(line));
+		if (publishes.length === 0) return [];
+		const env = effectiveEnv(workflow, job, step);
+		const blanked = TOKEN_VARIABLES.every((variable) => env[variable] === "");
+		const provenance = provenanceInManifest || publishes.some((line) => PROVENANCE_FLAG.test(line)) || env["NPM_CONFIG_PROVENANCE"] === "true";
+		return blanked || provenance ? [] : [workflowViolation(workflow, "workflow-credentials/tokenless-publish-unprotected", `job '${job.id}' publishes with an OIDC identity and no token, but does not set ${TOKEN_VARIABLES.join(" and ")} to the empty string, so a token inherited from the environment is used when the OIDC exchange fails; set them to the empty string to prevent that, or request provenance so that such a publish at least carries a traceable attestation`, step.location)];
+	});
+}
+/**
+* Credentials are granted to the steps that need them, and a publish with no token cannot quietly use one.
+*
+* `workflow-credentials/attestation-permissions`: a step of `actions/attest`, `actions/attest-build-provenance` or `actions/attest-sbom` needs `id-token: write` and `attestations: write` in the job's effective permissions. Permissions a job declares replace the workflow's; permissions declared nowhere are the repository's default, which the file cannot show and which never includes `id-token`, so they are reported.
+*
+* `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank `NODE_AUTH_TOKEN` and `NPM_TOKEN` (set them to `''` at step, job or workflow level) or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
+*
+* Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
+*/
+const workflowCredentials = async ({ cwd, options }) => {
+	const provenanceInManifest = await requestsProvenance(cwd);
+	return (await loadWorkflows(cwd, options)).flatMap((workflow) => workflow.jobs.flatMap((job) => [...attestationViolations(workflow, job), ...tokenlessPublishViolations(workflow, job, provenanceInManifest)]));
+};
+//#endregion
+//#region src/checks/workflow-job-ordering.ts
+const DEFAULT_RELEASE_JOBS = ["release"];
+const DEFAULT_DEPLOY_JOBS = ["deploy"];
+const DEFAULT_DOCS_DEPLOY_JOBS = ["docs-deploy"];
+const DEFAULT_BRANCH = "main";
+/**
+* The expression that always names the repository's default branch.
+*/
+const DEFAULT_BRANCH_EXPRESSION$1 = /^\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}$/u;
+/**
+* The text a junction job decides on: its `if`, and the conditions and scripts of its steps.
+*/
+function decisionText(job) {
+	return [job.condition, ...job.steps.flatMap((step) => [
+		step.condition,
+		step.run,
+		...Object.values(step.env),
+		...Object.values(step.with)
+	])].filter((text) => text !== void 0).join("\n");
+}
+/**
+* Where a script gets the results of the jobs it needs from: `needs.*.result`, one job's `needs.<job>.result` or the whole of `needs`.
+*/
+const RESULT_SOURCE = /needs\.(?:\*|[\w-]+)\.result|toJSON\(\s*needs\s*\)/u;
+const FAILURE_WORD = /['"]failure['"]/u;
+const CANCELLED_WORD = /['"]cancelled['"]/u;
+const SKIPPED_OR_NOT_SUCCESS = /needs\.(?:\*|[\w-]+)\.result[^\n]*(?:['"]skipped['"]|!==?\s*['"]success['"])|!\s*contains\(\s*needs\.\*\.result\s*,\s*['"]success['"]/u;
+/**
+* An `if` that compares the ref or the event name.
+*/
+const COMPARES_REF_OR_EVENT = /github\.(?:ref|ref_name|event_name)\s*==/u;
+/**
+* An expression written inside the `${{ }}` that marks it as one.
+*/
+const EXPRESSION_WRAPPER = /^\$\{\{\s*([\s\S]*?)\s*\}\}$/u;
+/**
+* The operands of `operator` at the top level of an expression: not inside parentheses or quotes.
+*/
+function operands(expression, operator) {
+	const parts = [];
+	let depth = 0;
+	let quote;
+	let start = 0;
+	for (let index = 0; index < expression.length; index += 1) {
+		const character = expression.charAt(index);
+		if (quote !== void 0) quote = character === quote ? void 0 : quote;
+		else if (character === "'" || character === "\"") quote = character;
+		else if (character === "(") depth += 1;
+		else if (character === ")") depth -= 1;
+		else if (depth === 0 && expression.startsWith(operator, index)) {
+			parts.push(expression.slice(start, index));
+			index += operator.length - 1;
+			start = index + 1;
+		}
+	}
+	parts.push(expression.slice(start));
+	return parts.map((part) => part.trim());
+}
+/**
+* Whether the first parenthesis of an expression is closed by its last character, so the parentheses enclose all of it, unlike `(a) && (b)`.
+*/
+function enclosedByOneGroup(expression) {
+	let depth = 0;
+	for (let index = 0; index < expression.length; index += 1) {
+		depth += expression.charAt(index) === "(" ? 1 : expression.charAt(index) === ")" ? -1 : 0;
+		if (depth === 0) return index === expression.length - 1;
+	}
+	return false;
+}
+/**
+* The expression without the `${{ }}` that wraps it, or the parentheses that enclose all of it.
+*/
+function unwrapped(expression) {
+	const trimmed = expression.trim();
+	const inner = EXPRESSION_WRAPPER.exec(trimmed)?.[1] ?? trimmed;
+	return enclosedByOneGroup(inner) ? unwrapped(inner.slice(1, -1)) : inner;
+}
+/**
+* Whether an expression can only hold in runs other than those of a pull request and of a merge group, which are the runs the required check decides on: an operand of an `&&` that does so is enough, every operand of an `||` must, and a comparison of the ref or the event name does so when it names neither `pull_request` nor `merge_group`.
+*/
+function keepsOutOfPullRequests(expression) {
+	if (expression === void 0) return false;
+	const text = unwrapped(expression);
+	const alternatives = operands(text, "||");
+	if (alternatives.length > 1) return alternatives.every(keepsOutOfPullRequests);
+	const conjuncts = operands(text, "&&");
+	if (conjuncts.length > 1) return conjuncts.some(keepsOutOfPullRequests);
+	return COMPARES_REF_OR_EVENT.test(text) && !text.includes("pull_request") && !text.includes("merge_group");
+}
+const OUTCOME_ACTION = "re-actors/alls-green";
+function releaseAndDocsOrdering(workflow, options) {
+	const releases = jobsNamed(workflow, options.releaseJobs ?? DEFAULT_RELEASE_JOBS);
+	const deploys = jobsNamed(workflow, options.deployJobs ?? DEFAULT_DEPLOY_JOBS);
+	const docs = jobsNamed(workflow, options.docsDeployJobs ?? DEFAULT_DOCS_DEPLOY_JOBS);
+	const violations = [];
+	for (const release of releases) {
+		const waitsFor = transitiveNeeds(workflow, release.id);
+		for (const deploy of deploys.filter((candidate) => candidate.id !== release.id && !waitsFor.has(candidate.id))) violations.push(workflowViolation(workflow, "workflow-job-ordering/release-before-deploy", `release job '${release.id}' does not need deploy job '${deploy.id}', so a release can be published after a failed deploy`, release.location));
+	}
+	for (const doc of docs) {
+		const waitsFor = transitiveNeeds(workflow, doc.id);
+		for (const release of releases.filter((candidate) => candidate.id !== doc.id && !waitsFor.has(candidate.id))) violations.push(workflowViolation(workflow, "workflow-job-ordering/docs-deploy-before-release", `documentation job '${doc.id}' does not need release job '${release.id}', so it can publish documentation for a release that did not happen`, doc.location));
+		const branch = options.defaultBranch ?? DEFAULT_BRANCH;
+		for (const checkout of doc.steps.filter((step) => stepUses(step, "actions/checkout"))) {
+			const ref = checkout.with["ref"]?.trim();
+			if (!(ref !== void 0 && (DEFAULT_BRANCH_EXPRESSION$1.test(ref) || ref === branch || ref === `refs/heads/${branch}`))) violations.push(workflowViolation(workflow, "workflow-job-ordering/docs-deploy-stale-checkout", `documentation job '${doc.id}' checks out ${ref === void 0 ? "the triggering commit" : `'${ref}'`}, which predates the release commit; check out the default branch afresh with ref: \${{ github.event.repository.default_branch }}`, checkout.location));
+		}
+	}
+	return violations;
+}
+/**
+* The jobs a pull request's required check need not wait for: those the options exempt, those whose `if` keeps them to events other than pull requests and merge groups, and those that need such a job and so are skipped with it.
+*/
+function exemptFromJunction(workflow, junctionExempt) {
+	const direct = /* @__PURE__ */ new Set([...junctionExempt, ...workflow.jobs.filter((job) => keepsOutOfPullRequests(job.condition)).map((job) => job.id)]);
+	return new Set(workflow.jobs.filter((job) => direct.has(job.id) || [...transitiveNeeds(workflow, job.id)].some((needed) => direct.has(needed))).map((job) => job.id));
+}
+function junctionOrdering(workflow, options) {
+	const violations = [];
+	const exempt = exemptFromJunction(workflow, options.junctionExempt ?? []);
+	for (const junction of jobsNamed(workflow, options.junctionJobs ?? DEFAULT_JUNCTION_JOBS)) {
+		if (!callsAlways(junction.condition)) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-not-always", `junction job '${junction.id}' has no if: always(), so it is skipped, and its required check never reports, when a job it needs fails`, junction.location));
+		const missing = workflow.jobs.filter((job) => job.id !== junction.id && !exempt.has(job.id) && !junction.needs.includes(job.id) && !transitiveNeeds(workflow, job.id).has(junction.id));
+		for (const job of missing) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-missing-need", `junction job '${junction.id}' does not list job '${job.id}' in needs, so its result is not part of the required check`, junction.location));
+		const text = decisionText(junction);
+		const reportsOutcome = junction.steps.some((step) => stepUses(step, OUTCOME_ACTION));
+		if (SKIPPED_OR_NOT_SUCCESS.test(text)) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-fails-on-skipped", `junction job '${junction.id}' fails when a needed job is skipped, but a skipped job is how a path filter or an if keeps a job out; fail only on 'failure' and 'cancelled'`, junction.location));
+		if (!reportsOutcome && !(RESULT_SOURCE.test(text) && FAILURE_WORD.test(text) && CANCELLED_WORD.test(text))) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-no-failure-condition", `junction job '${junction.id}' does not test the results of its needs for both 'failure' and 'cancelled', so it can pass when a job it needs did not succeed`, junction.location));
+	}
+	return violations;
+}
+/**
+* The jobs that release, deploy and report a required check are ordered so that a failure stops what follows: a release job needs the deploy job, a documentation deploy job needs the release job and checks out the default branch afresh, and one junction job with `if: always()` needs every other job and fails only on `failure` or `cancelled`.
+*
+* Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete.
+*/
+const workflowJobOrdering = async ({ cwd, options }) => (await loadWorkflows(cwd, options)).flatMap((workflow) => [...releaseAndDocsOrdering(workflow, options), ...junctionOrdering(workflow, options)]);
+//#endregion
+//#region src/checks/workflow-merge-group.ts
+/**
+* A workflow that checks pull requests also runs for the merge queue: GitHub starts no run of it for a queued pull request unless the workflow has a `merge_group` trigger, and a required check that never reports blocks the queue.
+*
+* A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged. Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read.
+*/
+const workflowMergeGroup = async ({ cwd, options }) => (await loadWorkflows(cwd, options)).flatMap((workflow) => {
+	const location = workflow.triggerLocations.get("pull_request");
+	return location === void 0 || workflow.triggers.has("merge_group") ? [] : [workflowViolation(workflow, "workflow-merge-group/missing-trigger", "the workflow runs for pull requests but has no merge_group trigger, so its checks do not report for a pull request in the merge queue", location)];
+});
+//#endregion
+//#region src/checks/workflow-repository-dispatch.ts
+const DEFAULT_BRANCHES = ["main", "master"];
+const DEFAULT_BRANCH_EXPRESSION = /\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}/u;
+const DEFAULT_TOKEN = /\b(?:secrets\.GITHUB_TOKEN|github\.token)\b/u;
+/**
+* The start of a `git push` command: `git`, the global options that take a value (`-C <directory>`, `-c <name=value>`) or are written `--name=value`, then `push`.
+*/
+const PUSH = /^git(?:\s+(?:-[Cc]\s+\S+|--[\w-]+=\S+))*\s+push\b/u;
+const BRANCH_CREATION = /^git\s+(?:checkout\s+-[bB]|switch\s+-[cC])\b/u;
+const AUTO_MERGE = /^gh\s+pr\s+merge\b.*\s--auto\b/u;
+const PULL_REQUEST_CREATION = /^gh\s+pr\s+create\b|^gh\s+api\b.*\brepos\/[^\s]+\/pulls\b/u;
+const DISPATCH_TARGETS = [/^(?:gh\s+api|curl)\b.*\brepos\/([^\s/]+\/[^\s/]+)\/dispatches\b/u, /^gh\s+workflow\s+run\b.*\s(?:-R|--repo)[\s=]+(\S+)/u];
+const AUTO_COMMIT_ACTION = "stefanzweifel/git-auto-commit-action";
+const PULL_REQUEST_ACTION = "peter-evans/create-pull-request";
+const DISPATCH_ACTION = "peter-evans/repository-dispatch";
+const CHECKOUT_ACTION = "actions/checkout";
+function isDefaultBranch(branch, branches) {
+	const name = branch.replace(/^refs\/heads\//u, "");
+	return branches.includes(name) || DEFAULT_BRANCH_EXPRESSION.test(name);
+}
+/**
+* The `git push` options that take their value as the next word, which would otherwise be read as the remote.
+*/
+const PUSH_OPTIONS_WITH_VALUE = /* @__PURE__ */ new Set([
+	"-o",
+	"--push-option",
+	"--repo",
+	"--receive-pack",
+	"--exec"
+]);
+/**
+* A URL with credentials in it (an expression such as `${{ secrets.TOKEN }}` may be part of them), which authenticates a push itself instead of using what the checkout left in git config.
+*/
+const URL_WITH_CREDENTIALS = /[a-z][a-z0-9+.-]*:\/\/(?:[^\s/@{]|\$\{\{[^}]*\}\})*@/iu;
+/**
+* The words of a `git push` command line after `push`, without the quotes that wrap a word.
+*/
+function pushWords(line) {
+	return line.replace(PUSH, "").split(/\s+/u).map((word) => word.replace(/^(["'])(.*)\1$/u, "$2")).filter((word) => word !== "");
+}
+/**
+* The refspecs of a `git push` command line, after the remote, the options and the values of the options that take one.
+*/
+function pushRefspecs(line) {
+	const positional = [];
+	const words = pushWords(line)[Symbol.iterator]();
+	for (const word of words) if (PUSH_OPTIONS_WITH_VALUE.has(word)) words.next();
+	else if (!word.startsWith("-")) positional.push(word);
+	return positional.slice(1);
+}
+/**
+* Whether a `git push` command line pushes to the default branch. With a refspec it is the destination (a leading `+` only forces the update, and a bare `HEAD` is the checked-out branch); without one it is the branch the handler has checked out, which is the default branch unless the job created another or checked one out by `ref`.
+*/
+function pushesToDefault(line, onOtherBranch, branches) {
+	const refspecs = pushRefspecs(line);
+	if (refspecs.length === 0) return !onOtherBranch;
+	return refspecs.some((refspec) => {
+		const destination = refspec.replace(/^\+/u, "");
+		const named = destination.includes(":") ? destination.slice(destination.lastIndexOf(":") + 1) : destination;
+		return named === "HEAD" ? !onOtherBranch : isDefaultBranch(named, branches);
+	});
+}
+/**
+* Whether a `git push` command line authenticates with what the checkout left in git config, which it does unless the command line names a URL carrying its own credentials.
+*/
+function pushesWithGitConfig(line) {
+	return !URL_WITH_CREDENTIALS.test(line);
+}
+function usesDefaultToken(workflow, job, step) {
+	return DEFAULT_TOKEN.test([
+		step.run,
+		...Object.values(effectiveEnv(workflow, job, step)),
+		...Object.values(step.with)
+	].filter((text) => text !== void 0).join("\n"));
+}
+/**
+* Whether the job's checkout leaves the default token in the git config, so a `git push` authenticates as it.
+*/
+function checkoutKeepsDefaultToken(job) {
+	return job.steps.some((step) => stepUses(step, CHECKOUT_ACTION) && (step.with["token"] === void 0 || DEFAULT_TOKEN.test(step.with["token"])) && step.with["persist-credentials"] !== "false");
+}
+function checkoutRefOtherThanDefault(job, branches) {
+	return job.steps.some((step) => stepUses(step, CHECKOUT_ACTION) && step.with["ref"] !== void 0 && !isDefaultBranch(step.with["ref"], branches));
+}
+function stepViolations(context, step, onOtherBranch) {
+	const { workflow, job, branches } = context;
+	const lines = scriptCommands(step.run);
+	const found = [];
+	const report = (reason, message) => {
+		found.push(workflowViolation(workflow, `workflow-repository-dispatch/${reason}`, message, step.location));
+	};
+	const pushes = lines.filter((line) => PUSH.test(line));
+	const autoCommits = stepUses(step, AUTO_COMMIT_ACTION);
+	const autoCommitBranch = step.with["branch"];
+	if (autoCommits && !onOtherBranch && (autoCommitBranch === void 0 || isDefaultBranch(autoCommitBranch, branches)) || pushes.some((line) => pushesToDefault(line, onOtherBranch, branches))) report("pushes-default-branch", `job '${job.id}' pushes to the default branch from a repository_dispatch handler, which anyone who can dispatch can trigger, bypassing review; push a branch and open a pull request`);
+	if (!context.assumeRequiredChecks && lines.some((line) => AUTO_MERGE.test(line))) report("auto-merge-without-required-checks", `job '${job.id}' merges with --auto, which merges at once when the base branch has no required checks; require status checks on the default branch (or set assumeRequiredChecks once it does)`);
+	const pushesAsDefaultToken = (pushes.some(pushesWithGitConfig) || autoCommits) && checkoutKeepsDefaultToken(job);
+	const createsPullRequestAsDefaultToken = lines.some((line) => PULL_REQUEST_CREATION.test(line)) && usesDefaultToken(workflow, job, step) || stepUses(step, PULL_REQUEST_ACTION) && (step.with["token"] === void 0 || DEFAULT_TOKEN.test(step.with["token"]));
+	if (pushesAsDefaultToken || createsPullRequestAsDefaultToken) report("default-token-triggers-nothing", `job '${job.id}' pushes or opens a pull request as GITHUB_TOKEN, and events GitHub Actions creates with that token start no workflows, so nothing validates the result; use a token from a GitHub App or a personal access token`);
+	const targets = [...lines.flatMap((line) => DISPATCH_TARGETS.map((pattern) => pattern.exec(line)?.[1])), ...stepUses(step, DISPATCH_ACTION) ? [step.with["repository"]] : []].filter((target) => target !== void 0);
+	for (const target of targets.filter((candidate) => !candidate.includes("github.repository"))) if (usesDefaultToken(workflow, job, step)) report("dispatch-other-repository-with-default-token", `job '${job.id}' dispatches to ${target} with GITHUB_TOKEN, which is limited to this repository; use a token that has access to ${target}`);
+	return found;
+}
+function jobViolations(context) {
+	let onOtherBranch = checkoutRefOtherThanDefault(context.job, context.branches);
+	const found = [];
+	for (const step of context.job.steps) {
+		found.push(...stepViolations(context, step, onOtherBranch));
+		onOtherBranch ||= scriptCommands(step.run).some((line) => BRANCH_CREATION.test(line));
+	}
+	return found;
+}
+/**
+* A workflow that handles `repository_dispatch` can be started by anyone with write access through the API, so what it does with the repository is held to a higher bar.
+*
+* `workflow-repository-dispatch/pushes-default-branch`: a `git push` to the default branch, or one with no refspec while the default branch is checked out, or `git-auto-commit-action` on it. `auto-merge-without-required-checks`: `gh pr merge --auto`, which merges at once when the base branch requires no checks (the file cannot show the rule; `assumeRequiredChecks` states it, and `settings-required-checks` verifies it). `default-token-triggers-nothing`: a push (the checkout leaves `GITHUB_TOKEN` in git config unless it is given a `token`, and a push to a URL carrying its own credentials does not use it) or a pull request opened as `GITHUB_TOKEN`; events created with it start no workflows, apart from `workflow_dispatch` and `repository_dispatch`, so the pushed commit gets no checks. `dispatch-other-repository-with-default-token`: a dispatch to a repository other than `github.repository` with `GITHUB_TOKEN`, whose access is limited to its own repository. Dispatching in the same repository with `GITHUB_TOKEN` is allowed by GitHub and is not reported.
+*
+* Limits: commands are read as text, so a script file or composite action is not seen; a push is judged by its command line, so a branch created by a helper is not seen, and a quoted word that contains a space is not read as one word; a dispatch target written literally as this repository's own name is reported, since the file does not know the name; a job that calls a reusable workflow is not read.
+*/
+const workflowRepositoryDispatch = async ({ cwd, options }) => (await loadWorkflows(cwd, options)).filter((workflow) => workflow.triggers.has("repository_dispatch")).flatMap((workflow) => workflow.jobs.flatMap((job) => jobViolations({
+	workflow,
+	job,
+	branches: options.defaultBranches ?? DEFAULT_BRANCHES,
+	assumeRequiredChecks: options.assumeRequiredChecks === true
+})));
+//#endregion
+//#region src/checks/workflow-runner-resolution.ts
+/**
+* GitHub's own images: `ubuntu`, `windows` and `macos`, as `-latest`, a version, or a version with an architecture or size suffix, and `ubuntu-slim`.
+*/
+const DEFAULT_HOSTED_LABELS = ["^(?:ubuntu|windows|macos)-(?:latest|slim|[0-9][0-9.]*)(?:-(?:arm|intel|xlarge|large))*$"];
+/**
+* `fromJson(needs.<job>.outputs.<name>)` in a `runs-on`.
+*/
+const RESOLVED_RUNNER = /fromJSON\(\s*needs\.([\w-]+)\.outputs\.([\w-]+)\s*\)/giu;
+/**
+* `${{ jobs.<job>.outputs.<name> }}` as the value of a reusable workflow's output.
+*/
+const JOB_OUTPUT_REFERENCE = /^\$\{\{\s*jobs\.([\w-]+)\.outputs\.([\w-]+)\s*\}\}$/u;
+/**
+* A fallback in an output expression: `||` followed by a string literal, whose body may hold `''` for a quote.
+*/
+const LITERAL_FALLBACK = /\|\|\s*'((?:[^']|'')*)'/gu;
+/**
+* The resolver behind each `fromJson(needs.<job>.outputs.<name>)` in a `runs-on` of the workflow; none for one this check cannot read.
+*/
+function resolversOf(workflow, workflows) {
+	return workflow.jobs.flatMap((job) => job.runsOn.expressions.flatMap((expression) => [...expression.matchAll(RESOLVED_RUNNER)].flatMap((match) => {
+		const caller = workflow.jobs.find((candidate) => candidate.id === match[1]);
+		const output = match[2];
+		const resolver = caller === void 0 || output === void 0 ? void 0 : implementation(workflow, workflows, caller, output);
+		return resolver === void 0 ? [] : [resolver];
+	})));
+}
+/**
+* The job that produces `output` for `caller`: the job itself, or for a call of a local reusable workflow the job in that workflow the output is forwarded from. `undefined` when the reusable workflow is not a file of this repository, which this check cannot read.
+*/
+function implementation(workflow, workflows, caller, output) {
+	if (caller.uses === void 0) return {
+		workflow,
+		job: caller,
+		output
+	};
+	const reference = parseUses(caller.uses);
+	if (reference.kind !== "local") return;
+	const called = workflows.find((candidate) => `./${candidate.file}` === reference.path);
+	if (called === void 0) throw new ConformanceError(`${workflow.file}: job '${caller.id}' calls ${caller.uses}, which is not a workflow file`);
+	const forwarded = JOB_OUTPUT_REFERENCE.exec(called.callOutputs[output] ?? "");
+	const job = called.jobs.find((candidate) => candidate.id === forwarded?.[1]);
+	const jobOutput = forwarded?.[2];
+	return job === void 0 || jobOutput === void 0 ? void 0 : {
+		workflow: called,
+		job,
+		output: jobOutput
+	};
+}
+/**
+* The runner labels the last literal fallback of an output expression names, read as the JSON the `fromJson` that consumes it expects: a label or a list of labels. `undefined` when there is no literal fallback, and an empty list when the literal is not labels.
+*/
+function fallbackLabels(expression) {
+	const literal = [...expression.matchAll(LITERAL_FALLBACK)].at(-1)?.[1]?.replaceAll("''", "'");
+	if (literal === void 0) return;
+	let parsed;
+	try {
+		parsed = JSON.parse(literal);
+	} catch {
+		return [];
+	}
+	const items = Array.isArray(parsed) ? parsed : [parsed];
+	const labels = items.filter((item) => typeof item === "string");
+	return labels.length === items.length ? labels : [];
+}
+function resolverViolations(resolver, hosted) {
+	const violations = [];
+	if (resolver.job.timeoutMinutes === void 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-no-timeout", `resolver job '${resolver.job.id}' has no timeout-minutes, so a runner that never starts holds every job waiting for it until the default six hours`, resolver.job.location));
+	const fallback = fallbackLabels(resolver.job.outputs[resolver.output] ?? "");
+	if (fallback === void 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-no-fallback", `output '${resolver.output}' of resolver job '${resolver.job.id}' has no literal fallback (\`|| '["<hosted label>"]'\`), so the jobs that read it have no runner when resolution produces nothing`, resolver.job.location));
+	else if (fallback.length === 0 || !fallback.every((label) => hosted.some((pattern) => pattern.test(label)))) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-fallback-not-hosted", `the literal fallback of output '${resolver.output}' of resolver job '${resolver.job.id}' does not name only hosted runner labels, so it offers no runner when the self-hosted fleet is down`, resolver.job.location));
+	return violations;
+}
+function customLabels(job, hosted) {
+	return /* @__PURE__ */ new Set([...job.runsOn.labels.filter((label) => !hosted.some((pattern) => pattern.test(label))), ...job.runsOn.group === void 0 ? [] : [`group:${job.runsOn.group}`]]);
+}
+function repeatedLabels(workflow, hosted) {
+	const labelsByJob = workflow.jobs.map((job) => ({
+		job,
+		labels: customLabels(job, hosted)
+	}));
+	const users = (label) => labelsByJob.filter((entry) => entry.labels.has(label)).map((entry) => entry.job.id);
+	return labelsByJob.flatMap(({ job, labels }) => {
+		const repeated = [...labels].filter((label) => users(label).length > 1);
+		return repeated.length === 0 ? [] : [workflowViolation(workflow, "workflow-runner-resolution/repeated-label", `job '${job.id}' names the runner label${repeated.length === 1 ? "" : "s"} ${repeated.map((label) => `'${label}'`).join(", ")} literally, like ${[...new Set(repeated.flatMap(users))].filter((id) => id !== job.id).map((id) => `'${id}'`).join(", ")}; resolve it once in a resolver job and read it with fromJson`, job.location)];
+	});
+}
+/**
+* A self-hosted or custom runner label named literally in more than one job of a workflow is resolved once instead: a resolver job decides the runner and the others read it with `fromJson(needs.<resolver>.outputs.<name>)`. The resolver must have a `timeout-minutes` and its output a literal fallback that names only hosted runner labels, so jobs still get a runner when resolution fails or the self-hosted fleet is down.
+*
+* A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output is taken to have a fallback when its expression has `||` followed by a string literal, and the last such literal is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported.
+*/
+const workflowRunnerResolution = async ({ cwd, options }) => {
+	const hosted = (options.hostedLabels ?? DEFAULT_HOSTED_LABELS).map((source) => new RegExp(source, "u"));
+	const selected = await loadWorkflows(cwd, options);
+	const available = await loadWorkflows(cwd, { workflows: DEFAULT_WORKFLOWS });
+	const resolvers = /* @__PURE__ */ new Map();
+	for (const workflow of selected) for (const resolver of resolversOf(workflow, available)) resolvers.set(`${resolver.workflow.file}#${resolver.job.id}#${resolver.output}`, resolver);
+	return [...selected.flatMap((workflow) => repeatedLabels(workflow, hosted)), ...[...resolvers.values()].flatMap((resolver) => resolverViolations(resolver, hosted))];
+};
+//#endregion
+//#region src/checks/workflow-skippable-jobs.ts
+const DEFAULT_PATH_FILTER_ACTIONS = [
+	"dorny/paths-filter",
+	"tj-actions/changed-files",
+	"step-security/changed-files"
+];
+/**
+* The events whose `paths` and `paths-ignore` decide whether the whole workflow runs for a pull request.
+*/
+const PULL_REQUEST_EVENTS = ["pull_request", "pull_request_target"];
+/**
+* The jobs a job `if` reads outputs from: `needs.<job>.outputs.<name>`.
+*/
+const NEEDS_OUTPUT = /\bneeds\.([\w-]+)\.outputs\./gu;
+function hasPathFilter(workflow, event) {
+	const configuration = workflow.triggers.get(event);
+	return isRecord(configuration) && ("paths" in configuration || "paths-ignore" in configuration);
+}
+/**
+* The jobs a job's `if` reads path filter outputs from.
 */
-const PRESET_COMMIT_TYPES = [
-	"build",
-	"chore",
-	"ci",
-	"docs",
-	"feat",
-	"fix",
-	"perf",
-	"refactor",
-	"revert",
-	"style",
-	"test"
-];
-function isCustom(type) {
-	return !PRESET_COMMIT_TYPES.includes(type);
+function filterJobsRead(workflow, job, actions) {
+	const read = [...(job.condition ?? "").matchAll(NEEDS_OUTPUT)].map((match) => match[1]);
+	return workflow.jobs.filter((candidate) => read.includes(candidate.id) && candidate.steps.some((step) => actions.some((action) => stepUses(step, action)))).map((candidate) => candidate.id);
 }
 /**
-* The commit types commitlint accepts are accounted for in the release config. A type no preset knows must have a release rule and, when the config lists changelog sections (`presetConfig.types` of the release notes generator), a section, or it can be committed and never released or shown; a release rule or changelog section for a type commitlint rejects can never apply. Types are enumerated only by a `type-enum` rule of the form `[level, 'always', [types]]`; a `'never'` rule forbids the types it lists and enumerates none, and a rule that is off (level 0) accepts every type. A preset type may be left out of either list: leaving out a type that does not release is how a release rule list is normally written.
+* Keeping work off a pull request must not leave a required check without a result. A `paths` or `paths-ignore` filter on the trigger of a workflow with a junction job skips the whole workflow, so the required check stays pending forever; a job whose own `if` reads a path filter's outputs is skipped, which is only safe when a junction job with `if: always()` needs it and reports for it. Filter the steps of the job instead and the job still runs and reports.
 *
-* It compares only what is written. The check has nothing to say when the commit types are the preset's and every listed type is one of them. A commitlint config that does not set `type-enum` while the release config lists a type no preset knows is a violation, since the commit types cannot then be read. Both configs are evaluated, so a list may be derived from one shared constant.
+* Limits: a workflow is taken to produce a required check when it has a junction job, so a trigger path filter in a workflow without one is not reported; a path filter is recognised by the actions in the options, so a script that computes changed paths itself is not seen, and a job gated on the output of such a script is not reported; only the filters of the `pull_request` and `pull_request_target` triggers are read, so a `paths` filter on `push` is not reported; only `needs.<job>.outputs` in the job's own `if` is read. Whether the junction job really reports is judged by `workflow-job-ordering`.
 */
-const commitTypes = async ({ cwd, options, configFiles }) => {
-	const commitlintFile = options.commitlint ?? DEFAULT_COMMITLINT_CONFIG;
-	const releaseFile = options.release ?? DEFAULT_RELEASE_CONFIG;
-	const commitlint = await readObject(cwd, commitlintFile, configFiles);
-	const release = await readObject(cwd, releaseFile, configFiles);
+const workflowSkippableJobs = async ({ cwd, options }) => {
 	const violations = [];
-	if (commitlint === void 0) violations.push({
-		code: "commit-types/missing-config",
-		message: `${commitlintFile} does not exist`,
-		file: commitlintFile
-	});
-	if (release === void 0) violations.push({
-		code: "commit-types/missing-config",
-		message: `${releaseFile} does not exist`,
-		file: releaseFile
-	});
-	if (commitlint === void 0 || release === void 0) return violations;
-	const releaseRules = typesOfEntries(pluginOptions(release, COMMIT_ANALYZER)?.["releaseRules"], releaseFile, "releaseRules");
-	const presetConfig = pluginOptions(release, RELEASE_NOTES_GENERATOR)?.["presetConfig"];
-	const changelog = typesOfEntries(isRecord(presetConfig) ? presetConfig["types"] : void 0, releaseFile, "presetConfig.types");
-	const accepted = commitTypeRule(commitlint, commitlintFile);
-	if (accepted === void 0) {
-		const unknown = [releaseRules, changelog].flatMap((list) => list ?? []).filter(isCustom);
-		if (unknown.length > 0) violations.push({
-			code: "commit-types/no-type-enum",
-			message: `${releaseFile} lists ${unknown.map((type) => `'${type}'`).join(", ")}, which no preset knows, but ${commitlintFile} sets no 'type-enum' rule, so the commit types cannot be read`,
-			file: commitlintFile
-		});
-		return violations;
-	}
-	const lists = [{
-		listed: releaseRules,
-		required: true,
-		noun: "release rule",
-		absent: "no-release-rule",
-		extra: "release-rule-not-a-commit-type"
-	}, {
-		listed: changelog,
-		required: changelog !== void 0,
-		noun: "changelog section",
-		absent: "no-changelog-section",
-		extra: "changelog-section-not-a-commit-type"
-	}];
-	for (const { listed, required, noun, absent, extra } of lists) {
-		for (const type of required ? (accepted.enumerated ?? []).filter(isCustom) : []) if (listed?.includes(type) !== true) violations.push({
-			code: `commit-types/${absent}`,
-			message: `'${type}' is a commit type in ${commitlintFile} that no preset knows, and ${releaseFile} has no ${noun} for it`,
-			file: releaseFile
-		});
-		for (const type of (listed ?? []).filter((candidate) => !accepted.accepts(candidate))) violations.push({
-			code: `commit-types/${extra}`,
-			message: `'${type}' has a ${noun} in ${releaseFile} but is not a commit type in ${commitlintFile}`,
-			file: commitlintFile
-		});
+	for (const workflow of await loadWorkflows(cwd, options)) {
+		const junctions = jobsNamed(workflow, options.junctionJobs ?? DEFAULT_JUNCTION_JOBS);
+		if (junctions.length > 0) {
+			for (const [event, location] of workflow.triggerLocations) if (PULL_REQUEST_EVENTS.includes(event) && hasPathFilter(workflow, event)) violations.push(workflowViolation(workflow, "workflow-skippable-jobs/trigger-path-filter", `${event} has a paths filter, so the workflow does not run, and its required check stays pending, when no matching file changed; filter the steps of the jobs instead`, location));
+		}
+		for (const job of workflow.jobs) {
+			const filters = filterJobsRead(workflow, job, options.pathFilterActions ?? DEFAULT_PATH_FILTER_ACTIONS);
+			const reported = junctions.some((junction) => junction.needs.includes(job.id));
+			if (filters.length > 0 && !reported) violations.push(workflowViolation(workflow, "workflow-skippable-jobs/job-gated-by-path-filter", `job '${job.id}' is skipped by an if on the path filter in '${filters.join("', '")}' and no junction job reports for it; put the condition on its steps, or add the job to the needs of a junction job with if: always()`, job.location));
+		}
 	}
 	return violations;
 };
 //#endregion
-//#region src/checks/dockerfile-package-manager.ts
-const DEFAULT_DOCKERFILES = [
-	"**/Dockerfile",
-	"**/Dockerfile.*",
-	"**/*.Dockerfile"
+//#region src/checks/workflow-update-bot-cooldown.ts
+const DEPENDABOT_FILES = [".github/dependabot.yml", ".github/dependabot.yaml"];
+const RENOVATE_FILES = [
+	"renovate.json",
+	".renovaterc.json",
+	".renovaterc",
+	".github/renovate.json"
 ];
-const DEFAULT_PACKAGE_JSON = "package.json";
 /**
-* A package manager and a version, `pnpm@12.4.1` or `pnpm@12.4.1+sha512.abc`, as `packageManager` and corepack write them.
-*/
-const PACKAGE_MANAGER = /^([a-z]+)@([^+\s]+)/u;
-/**
-* A variable reference in a version: `$NAME` or `${NAME}`, capturing the name.
+* The cooldown settings that delay a release by a number of days.
 */
-const VARIABLE = /\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?/gu;
+const COOLDOWN_DAYS = [
+	"default-days",
+	"semver-major-days",
+	"semver-minor-days",
+	"semver-patch-days"
+];
+const RENOVATE_SETTING = "minimumReleaseAge";
+function firstExisting$1(cwd, explicit, defaults) {
+	if (explicit !== void 0) {
+		if (!existsSync(resolve(cwd, explicit))) throw new ConformanceError(`${explicit} does not exist`);
+		return explicit;
+	}
+	return defaults.find((file) => existsSync(resolve(cwd, file)));
+}
+function hasCooldown(update) {
+	if (!isRecord(update) || !isRecord(update["cooldown"])) return false;
+	const cooldown = update["cooldown"];
+	return COOLDOWN_DAYS.some((setting) => typeof cooldown[setting] === "number" && cooldown[setting] > 0);
+}
+async function dependabotViolations(cwd, file) {
+	const parsed = parseYaml(file, await readFile(resolve(cwd, file), "utf8"));
+	return (isRecord(parsed.value) && Array.isArray(parsed.value["updates"]) ? parsed.value["updates"] : []).flatMap((update, index) => hasCooldown(update) ? [] : [{
+		code: "workflow-update-bot-cooldown/dependabot-no-cooldown",
+		message: `the update entry for ${isRecord(update) && typeof update["package-ecosystem"] === "string" ? update["package-ecosystem"] : `entry ${String(index)}`} has no cooldown with a number of days above zero, so Dependabot proposes a release the day it is published`,
+		file,
+		location: parsed.locate(["updates", index])
+	}]);
+}
 /**
-* `<manager>@<version>` wherever a Dockerfile installs or activates a package manager. The manager is not the end of a longer name (`create-pnpm`, `@scope/pnpm`). The version is what a version is made of, plus variable references, and stops at anything else, such as a comma or a quote; a `+` suffix such as `+sha512.abc` is not part of it.
+* Whether a `minimumReleaseAge` value waits for a positive time: a duration string such as `3 days`, whose number is above zero. `0 days` and `null` (which clears the setting) wait for nothing.
 */
-const PIN = /(?<![\w./@-])(pnpm|yarn|npm)@((?:\$\{[A-Za-z_][A-Za-z0-9_]*\}|\$[A-Za-z_][A-Za-z0-9_]*|[0-9A-Za-z._-])+)/gu;
-const INSTRUCTION = /^\s*(ARG|ENV)\s+(.*)$/iu;
-const ASSIGNMENT = /([A-Za-z_][A-Za-z0-9_]*)=("[^"]*"|'[^']*'|\S*)/gu;
-function unquoted(value) {
-	return value.replace(/^(["'])(.*)\1$/u, "$2");
+function delaysRelease(age) {
+	const amount = typeof age === "string" ? /^\s*(\d+(?:\.\d+)?)\s*[a-z]/iu.exec(age)?.[1] : void 0;
+	return amount !== void 0 && Number(amount) > 0;
+}
+function setsMinimumReleaseAge(value) {
+	if (!isRecord(value)) return false;
+	const rules = Array.isArray(value["packageRules"]) ? value["packageRules"] : [];
+	const presets = Array.isArray(value["extends"]) ? value["extends"] : [];
+	return delaysRelease(value[RENOVATE_SETTING]) || rules.some((rule) => isRecord(rule) && delaysRelease(rule[RENOVATE_SETTING])) || presets.some((preset) => typeof preset === "string" && preset.includes(RENOVATE_SETTING));
+}
+async function renovateViolations(cwd, file) {
+	const errors = [];
+	const value = parse$1(await readFile(resolve(cwd, file), "utf8"), errors, { allowTrailingComma: true });
+	const [error] = errors;
+	if (error !== void 0) throw new ConformanceError(`${file}: not valid JSON: ${printParseErrorCode(error.error)} at offset ${String(error.offset)}`);
+	return setsMinimumReleaseAge(value) ? [] : [{
+		code: "workflow-update-bot-cooldown/renovate-no-minimum-release-age",
+		message: `${file} sets no ${RENOVATE_SETTING} above zero, so Renovate proposes a release the day it is published`,
+		file
+	}];
 }
 /**
-* The variables an `ARG` or `ENV` instruction sets, with the value it gives each, or `undefined` for an `ARG` without a default. `ARG NAME=value`, `ENV NAME=value NAME2=value2` and `ENV NAME value` are read; any other line sets nothing.
+* The update bots wait before proposing a release, so a compromised release is withdrawn before it is installed. Dependabot: every `updates` entry needs a `cooldown` with `default-days` or one of the `semver-*-days` above zero. Renovate: `minimumReleaseAge` must be set to a duration above zero at the top level or in a `packageRules` entry.
+*
+* Limits: the bots' own rules differ, since Dependabot's cooldown does not apply to security updates, and a Renovate preset is not resolved (an `extends` entry counts only when its name contains `minimumReleaseAge`), so a setting that comes from a preset under another name is reported. Renovate configs in JSON5 syntax beyond comments and trailing commas, and a `renovate` key in `package.json`, are not read. A repository with neither bot has nothing to report.
 */
-function variablesSetBy(line) {
-	const [, instruction, body] = INSTRUCTION.exec(line) ?? [];
-	const variables = /* @__PURE__ */ new Map();
-	if (instruction === void 0 || body === void 0) return variables;
-	for (const [, name, value] of body.matchAll(ASSIGNMENT)) if (name !== void 0 && value !== void 0) variables.set(name, unquoted(value));
-	if (variables.size === 0) {
-		const [name, ...value] = body.trim().split(/\s+/u);
-		if (name !== void 0 && name !== "") variables.set(name, instruction.toUpperCase() === "ENV" && value.length > 0 ? unquoted(value.join(" ")) : void 0);
+const workflowUpdateBotCooldown = async ({ cwd, options }) => {
+	const dependabot = firstExisting$1(cwd, options.dependabot, DEPENDABOT_FILES);
+	const renovate = firstExisting$1(cwd, options.renovate, RENOVATE_FILES);
+	return [...dependabot === void 0 ? [] : await dependabotViolations(cwd, dependabot), ...renovate === void 0 ? [] : await renovateViolations(cwd, renovate)];
+};
+//#endregion
+//#region src/checks/workflow-version-single-source.ts
+const TOOL_VERSIONS = ".tool-versions";
+const NVMRC = ".nvmrc";
+const SETUP_ACTIONS = [
+	{
+		action: "actions/setup-node",
+		versionInput: "node-version",
+		fileInput: "node-version-file",
+		tools: ["nodejs", "node"]
+	},
+	{
+		action: "actions/setup-python",
+		versionInput: "python-version",
+		fileInput: "python-version-file",
+		tools: ["python"]
+	},
+	{
+		action: "actions/setup-go",
+		versionInput: "go-version",
+		fileInput: "go-version-file",
+		tools: ["golang", "go"]
+	},
+	{
+		action: "actions/setup-java",
+		versionInput: "java-version",
+		fileInput: "java-version-file",
+		tools: ["java"]
+	},
+	{
+		action: "actions/setup-dotnet",
+		versionInput: "dotnet-version",
+		fileInput: "global-json-file",
+		tools: ["dotnet", "dotnet-core"]
+	},
+	{
+		action: "ruby/setup-ruby",
+		versionInput: "ruby-version",
+		fileInput: void 0,
+		tools: ["ruby"]
+	},
+	{
+		action: "oven-sh/setup-bun",
+		versionInput: "bun-version",
+		fileInput: "bun-version-file",
+		tools: ["bun"]
+	},
+	{
+		action: "denoland/setup-deno",
+		versionInput: "deno-version",
+		fileInput: "deno-version-file",
+		tools: ["deno"]
+	},
+	{
+		action: "pnpm/action-setup",
+		versionInput: "version",
+		fileInput: void 0,
+		tools: ["pnpm"]
+	},
+	{
+		action: "hashicorp/setup-terraform",
+		versionInput: "terraform_version",
+		fileInput: void 0,
+		tools: ["terraform"]
 	}
-	return variables;
-}
+];
 /**
-* The version a pin names once the variables it refers to are replaced by the values in effect, or `undefined` when a variable has no value there (an `ARG` without a default, or a variable this file does not set) or its value refers to another variable, which makes the version unknowable from the file. A `+sha` suffix is dropped.
+* The tool names a `.tool-versions` file lists. Each line is a tool name followed by versions; a comment starts with `#`.
 */
-function versionOf(token, variables) {
-	const unknown = [];
-	const replaced = token.replace(VARIABLE, (_reference, variable) => {
-		const value = variables.get(variable);
-		if (value === void 0 || value.includes("$")) {
-			unknown.push(variable);
-			return "";
-		}
-		return value;
-	});
-	return unknown.length === 0 ? replaced.split("+")[0] : void 0;
+function listedTools(content) {
+	return new Set(content.split("\n").map((line) => line.replace(/#.*$/u, "").trim().split(/\s+/u)).filter((fields) => fields.length >= 2).map((fields) => String(fields[0])));
 }
 /**
-* Every pin of the package manager that `packageManager` names, in each Dockerfile, is the version `packageManager` names, with any `+sha` integrity suffix ignored on both sides. Pins of other package managers are not the workspace's package manager and are left alone.
+* A setup step keeps a runtime version in the workflow when a version file already says it: `.nvmrc` for Node, `.tool-versions` for any tool it lists. The step reads the file instead (`node-version-file`, or `mise` or `asdf` actions), so there is one place to change.
 *
-* It reads `<manager>@<version>` as written on a line that is not a comment. A version that refers to a variable is compared with the value the file gives that variable by an `ARG` or `ENV` before the pin (the latest such value, whichever build stage it was in); one whose variable has no value in the file is not compared, since the build supplies it.
+* A version is a literal when it contains no expression, so `${{ matrix.node }}` is not reported: a matrix tests versions on purpose. A range or alias such as `lts/*` is a literal. Only the setup actions listed in the README are recognised, only the files in the working directory are looked for, and composite actions are not read.
 */
-const dockerfilePackageManager = async ({ cwd, options }) => {
-	const packageJson = options.packageJson ?? DEFAULT_PACKAGE_JSON;
-	const manifest = JSON.parse(await readFile(resolve(cwd, packageJson), "utf8"));
-	const declared = isRecord(manifest) && typeof manifest["packageManager"] === "string" ? PACKAGE_MANAGER.exec(manifest["packageManager"]) : null;
-	const name = declared?.[1];
-	const version = declared?.[2];
-	if (name === void 0 || version === void 0) return [{
-		code: "dockerfile-package-manager/no-package-manager",
-		message: `${packageJson} has no valid 'packageManager' field to compare Dockerfile pins with`,
-		file: packageJson
-	}];
+const workflowVersionSingleSource = async ({ cwd, options }) => {
+	const toolVersions = existsSync(resolve(cwd, TOOL_VERSIONS)) ? listedTools(await readFile(resolve(cwd, TOOL_VERSIONS), "utf8")) : /* @__PURE__ */ new Set();
+	const hasNvmrc = existsSync(resolve(cwd, NVMRC));
 	const violations = [];
-	for (const file of await findFiles(cwd, [...options.dockerfiles ?? DEFAULT_DOCKERFILES, ...excludedFrom(options.exclude)])) {
-		const variables = /* @__PURE__ */ new Map();
-		(await readFile(resolve(cwd, file), "utf8")).split("\n").forEach((text, index) => {
-			if (text.trimStart().startsWith("#")) return;
-			for (const [variable, value] of variablesSetBy(text)) variables.set(variable, value);
-			for (const match of text.matchAll(PIN)) {
-				const pinned = versionOf(String(match[2]), variables);
-				if (match[1] === name && pinned !== void 0 && pinned !== version) violations.push({
-					code: "dockerfile-package-manager/version-mismatch",
-					message: `${file} pins ${name}@${pinned} but packageManager in ${packageJson} is ${name}@${version}`,
-					file,
-					location: {
-						line: index + 1,
-						column: match.index + 1
-					}
-				});
-			}
-		});
+	for (const workflow of await loadWorkflows(cwd, options)) for (const job of workflow.jobs) for (const step of job.steps) for (const setup of SETUP_ACTIONS.filter((candidate) => stepUses(step, candidate.action))) {
+		const version = step.with[setup.versionInput];
+		const source = setup.action === "actions/setup-node" && hasNvmrc ? NVMRC : setup.tools.find((tool) => toolVersions.has(tool)) === void 0 ? void 0 : TOOL_VERSIONS;
+		if (version !== void 0 && !hasExpression(version) && source !== void 0) violations.push(workflowViolation(workflow, "workflow-version-single-source/literal-version", `${setup.action} sets ${setup.versionInput}: ${version}, but ${source} already holds the version; read it from there${setup.fileInput === void 0 ? "" : ` with ${setup.fileInput}`}`, step.location));
 	}
 	return violations;
 };
@@ -1163,45 +2497,6 @@ const importUphillSpec = {
 		message: (edge) => `${describePackage(edge.from)} (rank ${String(edge.from.rank)}) imports ${describeTarget(edge)} (rank ${String(edge.to.rank)}), a higher rank`
 	})
 };
-async function git(cwd, args) {
-	return new Promise((resolve, reject) => {
-		execFile("git", [...args], {
-			cwd,
-			encoding: "utf8"
-		}, (error, stdout) => {
-			if (error === null) resolve(stdout);
-			else reject(new ConformanceError(`git ${args.join(" ")} failed in ${cwd}; this check reads the git index, so it needs a git working tree`, { cause: error }));
-		});
-	});
-}
-/**
-* The index entry for `path` (relative to `cwd`), or `undefined` when git does not track it.
-*/
-async function indexEntry(cwd, path) {
-	const listing = await git(cwd, [
-		"ls-files",
-		"--stage",
-		"--",
-		path
-	]);
-	const match = /^(\d+) ([0-9a-f]+) \d\t/u.exec(listing);
-	const mode = match?.[1];
-	const blob = match?.[2];
-	return mode === void 0 || blob === void 0 ? void 0 : {
-		mode,
-		blob
-	};
-}
-/**
-* The content of a blob. For a symbolic link it is the link's target.
-*/
-async function blobContent(cwd, blob) {
-	return git(cwd, [
-		"cat-file",
-		"blob",
-		blob
-	]);
-}
 //#endregion
 //#region src/checks/instruction-symlinks.ts
 /**
@@ -1503,6 +2798,7 @@ function plain(spec) {
 		name: spec.name,
 		description: spec.description,
 		requiresLayout: false,
+		requiresGitHub: false,
 		isEnabled: (checks) => spec.select(checks) !== void 0,
 		run: async ({ cwd, checks, configFiles }) => {
 			const options = spec.select(checks);
@@ -1515,11 +2811,32 @@ function plain(spec) {
 		}
 	};
 }
+function online(spec) {
+	return {
+		name: spec.name,
+		description: spec.description,
+		requiresLayout: false,
+		requiresGitHub: true,
+		isEnabled: (checks) => spec.select(checks) !== void 0,
+		run: async ({ cwd, checks, configFiles, github }) => {
+			const options = spec.select(checks);
+			if (options === void 0) throw new ConformanceError(`the check '${spec.name}' is not enabled`);
+			if (github === void 0) throw new ConformanceError(`the check '${spec.name}' reads the repository's settings and needs a GitHub client`);
+			return spec.check({
+				cwd,
+				options,
+				github,
+				...configFiles === void 0 ? {} : { configFiles }
+			});
+		}
+	};
+}
 function importCheck(spec) {
 	return {
 		name: spec.name,
 		description: spec.description,
 		requiresLayout: true,
+		requiresGitHub: false,
 		isEnabled: (checks) => spec.select(checks) !== void 0,
 		importGraph: {
 			spec: spec.importSpec,
@@ -1602,6 +2919,78 @@ const registry = {
 		description: "The directory a schema generator writes migrations to is the one the deploy tool applies them from, and no script applies them with the generator",
 		select: (checks) => enabledOptions(checks["migrations-directory"]),
 		check: migrationsDirectory
+	}),
+	"workflow-job-ordering": plain({
+		name: "workflow-job-ordering",
+		description: "Release, deploy and junction jobs are ordered so a failure stops what follows",
+		select: (checks) => enabledOptions(checks["workflow-job-ordering"]),
+		check: workflowJobOrdering
+	}),
+	"workflow-skippable-jobs": plain({
+		name: "workflow-skippable-jobs",
+		description: "A path filter does not leave a required check pending or skip a job no junction job reports for",
+		select: (checks) => enabledOptions(checks["workflow-skippable-jobs"]),
+		check: workflowSkippableJobs
+	}),
+	"workflow-runner-resolution": plain({
+		name: "workflow-runner-resolution",
+		description: "A self-hosted or custom runner label is resolved once by a resolver job, not repeated in several jobs",
+		select: (checks) => enabledOptions(checks["workflow-runner-resolution"]),
+		check: workflowRunnerResolution
+	}),
+	"workflow-version-single-source": plain({
+		name: "workflow-version-single-source",
+		description: "Setup steps read a runtime version from .nvmrc or .tool-versions instead of holding a literal",
+		select: (checks) => enabledOptions(checks["workflow-version-single-source"]),
+		check: workflowVersionSingleSource
+	}),
+	"workflow-credentials": plain({
+		name: "workflow-credentials",
+		description: "Attestation steps have the permissions they need, and a tokenless publish cannot quietly use a token",
+		select: (checks) => enabledOptions(checks["workflow-credentials"]),
+		check: workflowCredentials
+	}),
+	"workflow-repository-dispatch": plain({
+		name: "workflow-repository-dispatch",
+		description: "A repository_dispatch handler does not push to the default branch, auto-merge unguarded, or rely on the default token",
+		select: (checks) => enabledOptions(checks["workflow-repository-dispatch"]),
+		check: workflowRepositoryDispatch
+	}),
+	"workflow-update-bot-cooldown": plain({
+		name: "workflow-update-bot-cooldown",
+		description: "Dependabot and Renovate wait before proposing a new release",
+		select: (checks) => enabledOptions(checks["workflow-update-bot-cooldown"]),
+		check: workflowUpdateBotCooldown
+	}),
+	"workflow-merge-group": plain({
+		name: "workflow-merge-group",
+		description: "A workflow that runs for pull requests also runs for the merge queue",
+		select: (checks) => enabledOptions(checks["workflow-merge-group"]),
+		check: workflowMergeGroup
+	}),
+	"workflow-action-pinning": plain({
+		name: "workflow-action-pinning",
+		description: "Actions and reusable workflows are pinned as the configured policy requires",
+		select: (checks) => enabledOptions(checks["workflow-action-pinning"]),
+		check: workflowActionPinning
+	}),
+	"settings-merge-methods": online({
+		name: "settings-merge-methods",
+		description: "The repository allows only one merge method",
+		select: (checks) => enabledOptions(checks["settings-merge-methods"]),
+		check: settingsMergeMethods
+	}),
+	"settings-required-checks": online({
+		name: "settings-required-checks",
+		description: "The default branch requires the junction job check, up to date with the base",
+		select: (checks) => enabledOptions(checks["settings-required-checks"]),
+		check: settingsRequiredChecks
+	}),
+	"settings-review-thread-resolution": online({
+		name: "settings-review-thread-resolution",
+		description: "A pull request cannot merge while a review conversation is unresolved",
+		select: (checks) => enabledOptions(checks["settings-review-thread-resolution"]),
+		check: settingsReviewThreadResolution
 	})
 };
 /**
@@ -1632,6 +3021,15 @@ function compiles(source) {
 */
 const pattern = z.string().min(1).refine(compiles, "not a valid regular expression");
 const patterns = z.array(pattern);
+const selection = {
+	workflows: z.exactOptional(paths),
+	exclude: z.exactOptional(paths)
+};
+const pinningLevel = z.enum(["sha", "ref"]);
+const settings = {
+	repository: z.exactOptional(z.string().regex(/^[^/\s]+\/[^/\s]+$/u, "expected owner/name")),
+	branch: z.exactOptional(z.string().min(1))
+};
 const importGraph = z.strictObject({
 	exclude: z.exactOptional(patterns),
 	doNotFollow: z.exactOptional(patterns),
@@ -1690,7 +3088,58 @@ const checks = z.strictObject({
 		database: z.exactOptional(z.string().min(1)),
 		environment: z.exactOptional(z.string().min(1)),
 		packageJsons: z.exactOptional(paths)
-	})))
+	}))),
+	"workflow-job-ordering": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		releaseJobs: z.exactOptional(names),
+		deployJobs: z.exactOptional(names),
+		docsDeployJobs: z.exactOptional(names),
+		junctionJobs: z.exactOptional(names),
+		junctionExempt: z.exactOptional(names),
+		defaultBranch: z.exactOptional(z.string().min(1))
+	}))),
+	"workflow-skippable-jobs": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		junctionJobs: z.exactOptional(names),
+		pathFilterActions: z.exactOptional(names)
+	}))),
+	"workflow-runner-resolution": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		hostedLabels: z.exactOptional(patterns)
+	}))),
+	"workflow-version-single-source": z.exactOptional(enabled(z.strictObject(selection))),
+	"workflow-credentials": z.exactOptional(enabled(z.strictObject(selection))),
+	"workflow-repository-dispatch": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		defaultBranches: z.exactOptional(names),
+		assumeRequiredChecks: z.exactOptional(z.boolean())
+	}))),
+	"workflow-update-bot-cooldown": z.exactOptional(enabled(z.strictObject({
+		dependabot: z.exactOptional(path),
+		renovate: z.exactOptional(path)
+	}))),
+	"workflow-merge-group": z.exactOptional(enabled(z.strictObject(selection))),
+	"workflow-action-pinning": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		thirdParty: z.exactOptional(pinningLevel),
+		sameOrganisation: z.exactOptional(pinningLevel),
+		organisations: z.exactOptional(names),
+		allow: z.exactOptional(names)
+	}))),
+	"settings-merge-methods": z.exactOptional(enabled(z.strictObject({
+		...settings,
+		allowed: z.exactOptional(z.enum([
+			"rebase",
+			"squash",
+			"merge"
+		]))
+	}))),
+	"settings-required-checks": z.exactOptional(enabled(z.strictObject({
+		...settings,
+		...selection,
+		junctionJobs: z.exactOptional(names)
+	}))),
+	"settings-review-thread-resolution": z.exactOptional(enabled(z.strictObject(settings)))
 });
 /**
 * The Standard Schema for {@link ConformanceConfig}. It rejects unknown keys at every level, so a misspelt check name or option fails when the section loads.
@@ -1729,14 +3178,18 @@ async function layoutOf(options, needed) {
 	if (loaded === void 0) throw new ConformanceError(`${needed.join(", ")} read the workspace layout, and there is no 'layout' section in ${options.cwd}; define it in exadev.config.ts or in exadev.layout.config.ts`);
 	return loaded;
 }
-function selected(config, requested) {
+function selected(config, requested, online) {
 	const enabled = checkNames.filter((name) => registry[name].isEnabled(config.checks));
 	if (requested === void 0) {
 		if (enabled.length === 0) throw new ConformanceError("no check is enabled; add one to the 'checks' of the 'conformance' section");
-		return enabled;
+		const runnable = enabled.filter((name) => online || !registry[name].requiresGitHub);
+		if (runnable.length === 0) throw new ConformanceError(`only checks that read the repository's settings are enabled (${enabled.join(", ")}); they run only with a GitHub client (--settings on the command line)`);
+		return runnable;
 	}
 	const disabled = requested.filter((name) => !enabled.includes(name));
 	if (disabled.length > 0) throw new ConformanceError(`${disabled.join(", ")} ${disabled.length === 1 ? "is" : "are"} not enabled in the 'conformance' section`);
+	const offline = requested.filter((name) => !online && registry[name].requiresGitHub);
+	if (offline.length > 0) throw new ConformanceError(`${offline.join(", ")} read${offline.length === 1 ? "s" : ""} the repository's settings and need${offline.length === 1 ? "s" : ""} a GitHub client (--settings on the command line)`);
 	return checkNames.filter((name) => requested.includes(name));
 }
 /**
@@ -1775,7 +3228,7 @@ function readImported(imported, name) {
 */
 async function runChecks(options) {
 	const config = await conformanceOf(options);
-	const names = selected(config, options.checks);
+	const names = selected(config, options.checks, options.github !== void 0);
 	const layout = await layoutOf(options, names.filter((name) => registry[name].requiresLayout));
 	const imported = await runImportGraphChecks(options.cwd, layout, names, config.checks);
 	const results = [];
@@ -1785,7 +3238,8 @@ async function runChecks(options) {
 			cwd: options.cwd,
 			checks: config.checks,
 			layout,
-			configFiles: options.configFiles
+			configFiles: options.configFiles,
+			github: options.github
 		}) : readImported(imported, name);
 		results.push({
 			check: name,
@@ -1801,13 +3255,14 @@ async function runChecks(options) {
 }
 //#endregion
 //#region src/cli-command.ts
-const USAGE = `Usage: workspace-conformance check [--cwd <directory>] [--check <name>]... [--list]
+const USAGE = `Usage: workspace-conformance check [--cwd <directory>] [--check <name>]... [--list] [--settings]
 
 Runs the conformance checks enabled in the 'conformance' section of exadev.config.ts (or exadev.conformance.config.ts).
 
   --cwd <directory>   Directory that holds the config files. Defaults to the current directory.
   --check <name>      Run only this check, which must be enabled. Repeatable.
   --list              Print the names of all checks and stop.
+  --settings          Also run the enabled settings-* checks, which read the repository's settings through the GitHub API with the token in GITHUB_TOKEN or GH_TOKEN. Offline otherwise.
   --help, -h          Show this message.
 
 Exit status: ${String(EXIT_CODES.clean)} when nothing is found, ${String(EXIT_CODES.violations)} when a check finds a violation, ${String(EXIT_CODES.failed)} when the checks could not run.
@@ -1824,6 +3279,14 @@ function requestedChecks(names) {
 		return name;
 	});
 }
+/**
+* The client the settings checks read through, authenticated by the first non-empty token of `GITHUB_TOKEN` and `GH_TOKEN`.
+*/
+function clientFromEnvironment() {
+	const token = [process.env["GITHUB_TOKEN"], process.env["GH_TOKEN"]].find((value) => value !== void 0 && value !== "");
+	if (token === void 0) throw new ConformanceError("--settings needs a token in GITHUB_TOKEN or GH_TOKEN");
+	return createGitHubClient({ token });
+}
 async function runCheck(args, output) {
 	const { values } = parseArgs({
 		args: [...args],
@@ -1834,6 +3297,7 @@ async function runCheck(args, output) {
 				multiple: true
 			},
 			list: { type: "boolean" },
+			settings: { type: "boolean" },
 			help: {
 				type: "boolean",
 				short: "h"
@@ -1852,7 +3316,8 @@ async function runCheck(args, output) {
 	}
 	const result = await runChecks({
 		cwd: resolve(values.cwd ?? process.cwd()),
-		...requested === void 0 ? {} : { checks: requested }
+		...requested === void 0 ? {} : { checks: requested },
+		...values.settings === true ? { github: clientFromEnvironment() } : {}
 	});
 	for (const violation of result.violations) output.stderr(formatViolation(violation));
 	if (result.violations.length === 0) output.stdout(`no violations from ${result.results.map((entry) => entry.check).join(", ")}\n`);