workspace-conformance 1.5.0 → 1.7.0

package/dist/cli.js

@@ -8,8 +8,9 @@ import { escapePath, glob, isDynamicPattern } from "tinyglobby";
 import { Node, Project, SyntaxKind } from "ts-morph";
 import { createJitiLoader, validateStandard } from "cosmiconfig-extends";
 import { readFile, realpath } from "node:fs/promises";
-import { execFile } from "node:child_process";
+import { Range, subset, valid, validRange } from "semver";
 import { LineCounter, isMap, isNode, isScalar, isSeq, parse, parseDocument } from "yaml";
+import { execFile } from "node:child_process";
 import { findNodeAtLocation, parse as parse$1, parseTree, printParseErrorCode } from "jsonc-parser";
 import { parse as parse$2 } from "smol-toml";
 import { defineSection, layoutSection, loadSection } from "@exadev/config";
@@ -852,6 +853,301 @@ const dockerfilePackageManager = async ({ cwd, options }) => {
 	}
 	return violations;
 };
+//#endregion
+//#region src/workspace/packages.ts
+function segmentsOf(path) {
+	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
+}
+function groupRoot(group) {
+	return segmentsOf(group.path ?? group.name);
+}
+function startsWithSegments(segments, prefix) {
+	return prefix.every((segment, index) => segments[index] === segment);
+}
+/**
+* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
+*/
+function owningGroup(dir, groups) {
+	const segments = segmentsOf(dir);
+	let best;
+	let bestLength = -1;
+	for (const group of groups) {
+		const root = groupRoot(group);
+		if (root.length > bestLength && startsWithSegments(segments, root)) {
+			best = group;
+			bestLength = root.length;
+		}
+	}
+	return best;
+}
+function rankOf(name, group, layout) {
+	if (name !== void 0) {
+		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
+		if (rule !== void 0) return rule.rank;
+	}
+	return group.rank ?? layout.defaultRank;
+}
+/**
+* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
+*/
+function unscoped(name) {
+	return name.replace(/^@[^/]+\//u, "");
+}
+/**
+* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
+*/
+function sliceByNamePrefix(name, known) {
+	const bare = unscoped(name);
+	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
+}
+/**
+* Classify discovered packages by the layout: group, rank and slice. Pure.
+*
+* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
+*/
+function classifyPackages(discovered, layout) {
+	const owned = discovered.map((found) => {
+		const group = owningGroup(found.dir, layout.groups);
+		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
+		return {
+			found,
+			group
+		};
+	});
+	const knownSlices = /* @__PURE__ */ new Set();
+	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
+		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		if (value !== void 0) knownSlices.add(value);
+	}
+	const packages = owned.map(({ found, group }) => {
+		let slice;
+		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
+		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
+		return {
+			...found,
+			group: group.name,
+			rank: rankOf(found.name, group, layout),
+			slice
+		};
+	});
+	for (const outer of packages) {
+		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
+		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
+	}
+	return packages;
+}
+/**
+* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
+*/
+function workspaceRoot(cwd, layout) {
+	return layout.root === void 0 ? cwd : resolve(cwd, layout.root);
+}
+const PNPM_WORKSPACE_FILE = "pnpm-workspace.yaml";
+/**
+* The `packages` list of `pnpm-workspace.yaml` in `root`, or `undefined` when there is no such file. A file that exists but cannot be read, or has no list of strings under `packages`, is a configuration error.
+*/
+async function pnpmWorkspacePatterns(root) {
+	const file = join(root, PNPM_WORKSPACE_FILE);
+	if (!existsSync(file)) return;
+	let source;
+	try {
+		source = await readFile(file, "utf8");
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read`, { cause: error });
+	}
+	const document = parse(source);
+	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
+	const patterns = document.packages;
+	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
+	return patterns;
+}
+/**
+* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
+*/
+async function workspacePatterns(root, layout) {
+	if (layout.packages !== void 0) return layout.packages;
+	const patterns = await pnpmWorkspacePatterns(root);
+	if (patterns === void 0) throw new ConformanceError(`the layout has no 'packages' and ${join(root, PNPM_WORKSPACE_FILE)} does not exist`);
+	return patterns;
+}
+async function readName(manifest) {
+	let content;
+	try {
+		content = JSON.parse(await readFile(manifest, "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
+	}
+	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
+}
+/**
+* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
+*/
+async function discoverPackages(root, patterns) {
+	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
+	const dirs = (await glob(manifests, {
+		cwd: root,
+		dot: true,
+		ignore: [INSTALLED_DEPENDENCIES_GLOB],
+		onlyFiles: true
+	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
+	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
+		dir,
+		name: await readName(join(root, dir, "package.json"))
+	})));
+}
+/**
+* The layout's packages found under the workspace root.
+*/
+async function readWorkspacePackages(cwd, layout) {
+	const root = workspaceRoot(cwd, layout);
+	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
+}
+//#endregion
+//#region src/checks/engines-floor.ts
+/**
+* The pattern that selects the root package, the `package.json` in the directory the checks run in.
+*/
+const ROOT_PACKAGE = ".";
+const MANIFEST = "package.json";
+const ANY_INSTALLED_COPY = {};
+const DEPENDENCY_FIELDS = [
+	{
+		field: "dependencies",
+		noun: "dependency",
+		mayBeAbsent: () => false,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "optionalDependencies",
+		noun: "optional dependency",
+		mayBeAbsent: () => true,
+		judgedCopy: () => ANY_INSTALLED_COPY
+	},
+	{
+		field: "peerDependencies",
+		noun: "peer dependency",
+		mayBeAbsent: (manifest, name) => {
+			const meta = manifest["peerDependenciesMeta"];
+			const entry = isRecord(meta) ? meta[name] : void 0;
+			return isRecord(entry) && entry["optional"] === true;
+		},
+		judgedCopy: (spec) => {
+			const version = onlyAdmittedVersion(spec);
+			return version === null ? void 0 : { version };
+		}
+	}
+];
+/**
+* The one version `spec` admits, when it is a semver range of a single comparator naming an exact version (`1.2.3` or `=1.2.3`); `null`, as semver gives for no version, for any other range, including one of a single major, and for a spec that is not a semver range (`workspace:^`, a tag or a URL).
+*/
+function onlyAdmittedVersion(spec) {
+	if (validRange(spec) === null) return null;
+	const [comparators, ...others] = new Range(spec).set;
+	if (comparators === void 0 || others.length > 0 || comparators.length !== 1) return null;
+	const [comparator] = comparators;
+	if (comparator?.operator !== "") return null;
+	return valid(comparator.value);
+}
+async function readManifest(cwd, file) {
+	let content;
+	try {
+		content = JSON.parse(await readFile(resolve(cwd, file), "utf8"));
+	} catch (error) {
+		throw new ConformanceError(`${file} cannot be read as JSON`, { cause: error });
+	}
+	if (!isRecord(content)) throw new ConformanceError(`${file} is not a JSON object`);
+	return content;
+}
+/**
+* The `engines.node` range the manifest at `file` declares, or `undefined` when it declares none. A range semver cannot parse is a configuration error, since nothing can be said about the versions it admits.
+*/
+function nodeRange(manifest, file) {
+	const engines = manifest["engines"];
+	if (engines === void 0) return;
+	if (!isRecord(engines)) throw new ConformanceError(`${file}: engines must be an object`);
+	const node = engines["node"];
+	if (node === void 0) return;
+	if (typeof node !== "string") throw new ConformanceError(`${file}: engines.node must be a string, not ${JSON.stringify(node)}`);
+	if (validRange(node) === null) throw new ConformanceError(`${file}: engines.node '${node}' is not a valid semver range`);
+	return node;
+}
+/**
+* The name and version spec of each dependency a dependency field of the manifest at `file` lists, sorted by name; none when the field is absent.
+*/
+function dependencyEntries(manifest, field, file) {
+	const listed = manifest[field];
+	if (listed === void 0) return [];
+	if (!isRecord(listed)) throw new ConformanceError(`${file}: ${field} must be an object`);
+	return Object.keys(listed).sort().map((name) => {
+		const spec = listed[name];
+		if (typeof spec !== "string") throw new ConformanceError(`${file}: ${field}.${name} must be a string, not ${JSON.stringify(spec)}`);
+		return [name, spec];
+	});
+}
+/**
+* The `package.json` of the dependency `name` as installed for the package in `packageDirectory`, found the way Node finds a package directory: in `node_modules` of the package's own directory, then of each directory above it, stopping at the working directory, since a copy above the workspace is not one its install put there. A symbolic link, as pnpm installs every dependency, is followed. `undefined` when no directory has it.
+*/
+function installedManifest(cwd, packageDirectory, name) {
+	const top = resolve(cwd);
+	for (let directory = resolve(cwd, packageDirectory);; directory = dirname(directory)) {
+		const candidate = join(directory, "node_modules", name, MANIFEST);
+		if (existsSync(candidate)) return relativePosix(cwd, candidate);
+		if (directory === top) return;
+	}
+}
+/**
+* The directories of the packages to judge: those `packages` selects, else the root package and the `packages` of `pnpm-workspace.yaml`. Selecting none is a configuration error, so a pattern that matches nothing never reads as a pass.
+*/
+async function packageDirectories(cwd, options) {
+	const patterns = options.packages ?? [ROOT_PACKAGE, ...await pnpmWorkspacePatterns(cwd) ?? []];
+	const members = await discoverPackages(cwd, patterns.filter((pattern) => pattern !== ROOT_PACKAGE));
+	const directories = [...patterns.includes(ROOT_PACKAGE) ? [ROOT_PACKAGE] : [], ...members.map((member) => member.dir)];
+	if (directories.length === 0) throw new ConformanceError(`no package.json is selected by ${patterns.join(", ")}`);
+	return directories;
+}
+/**
+* The `engines.node` range of each package is a subset of the `engines.node` range of each dependency and optional dependency it lists, and of each peer dependency whose range admits a single version, as installed in `node_modules`, so the package admits no Node version that something it needs at run time rejects. A package that declares no range admits every version, so it is reported for each dependency that declares one. A dependency that declares no range constrains nothing and is ignored.
+*
+* The comparison is `semver.subset(package, dependency)`: every version the package's range admits satisfies the dependency's range. A floor alone is not enough, because a range of several lines (`^20.19.0 || ^22.13.0 || >=24`) also rejects the versions between them, which `>=20.19.0` admits. semver compares a range of several comparator sets set by set, so each set of the package's range must lie within one set of the dependency's; a set that only two adjacent dependency sets cover together (`>=22` against `^22.0.0 || >=23`) is reported, and splitting it the same way (`^22.0.0 || >=23`) satisfies the check.
+*
+* A peer dependency is judged only when its range admits a single version (`1.2.3` or `=1.2.3`), and then by the copy installed, which must be that version. The consumer chooses which admitted version to install, so the package's range holds when each Node version in it is accepted by some admitted version; one installed copy that rejects a Node version does not show that every admitted version does, and the others are not on disk.
+*
+* A dependency that is not installed fails the run: its range cannot be read, and passing it unjudged would read as a pass. An optional dependency and a peer dependency marked optional in `peerDependenciesMeta` may be absent and are then skipped.
+*/
+const enginesFloor = async ({ cwd, options }) => {
+	const violations = [];
+	for (const directory of await packageDirectories(cwd, options)) {
+		const file = posix.join(directory, MANIFEST);
+		const manifest = await readManifest(cwd, file);
+		const own = nodeRange(manifest, file);
+		const seen = /* @__PURE__ */ new Set();
+		for (const { field, noun, mayBeAbsent, judgedCopy } of DEPENDENCY_FIELDS) for (const [name, spec] of dependencyEntries(manifest, field, file).filter(([candidate]) => !seen.has(candidate))) {
+			seen.add(name);
+			const copy = judgedCopy(spec);
+			if (copy === void 0) continue;
+			const installed = installedManifest(cwd, directory, name);
+			if (installed === void 0) {
+				if (mayBeAbsent(manifest, name)) continue;
+				throw new ConformanceError(`${file}: the ${noun} '${name}' is not installed (no node_modules/${name}/package.json in its directory or any directory above it up to the working directory); install the workspace before running engines-floor`);
+			}
+			const dependency = await readManifest(cwd, installed);
+			if (copy.version !== void 0 && dependency["version"] !== copy.version) throw new ConformanceError(`${file}: the ${noun} '${name}' admits only version ${copy.version}, but ${installed} is version ${String(dependency["version"])}; install the workspace before running engines-floor`);
+			const theirs = nodeRange(dependency, installed);
+			if (theirs === void 0) continue;
+			if (own === void 0) violations.push({
+				code: "engines-floor/no-engines",
+				message: `no engines.node is declared, so every Node version is admitted, but the ${noun} '${name}' requires engines.node '${theirs}'; declare a subset of that range`,
+				file
+			});
+			else if (!subset(own, theirs)) violations.push({
+				code: "engines-floor/wider-than-dependency",
+				message: `engines.node '${own}' admits Node versions that the ${noun} '${name}' rejects with engines.node '${theirs}'; narrow it to a subset of that range`,
+				file
+			});
+		}
+	}
+	return violations;
+};
 async function git(cwd, args) {
 	return new Promise((resolve, reject) => {
 		execFile("git", [...args], {
@@ -1098,6 +1394,9 @@ function runsOnOf(reader, value, what) {
 		group
 	};
 }
+function environmentOf(reader, value, what) {
+	return isRecord(value) ? reader.text(value["name"], `${what}.name`) : reader.text(value, what);
+}
 function stepOf(reader, value, jobPath, index) {
 	const path = [
 		...jobPath,
@@ -1130,6 +1429,7 @@ function jobOf(reader, id, value) {
 		needs: reader.list(job["needs"], `${what}.needs`),
 		condition: reader.text(job["if"], `${what}.if`),
 		permissions: permissionsOf(reader, job["permissions"], `${what}.permissions`),
+		environment: environmentOf(reader, job["environment"], `${what}.environment`),
 		env: reader.texts(job["env"], `${what}.env`),
 		runsOn: runsOnOf(reader, job["runs-on"], `${what}.runs-on`),
 		timeoutMinutes: reader.text(job["timeout-minutes"], `${what}.timeout-minutes`),
@@ -1165,6 +1465,7 @@ function parseWorkflow(file, source) {
 		triggers,
 		triggerLocations: triggerLocationsOf(reader, triggers, root["on"]),
 		permissions: permissionsOf(reader, root["permissions"], "permissions"),
+		permissionsLocation: root["permissions"] === void 0 ? void 0 : reader.location(["permissions"]),
 		env: reader.texts(root["env"], "env"),
 		jobs: Object.entries(reader.record(root["jobs"], "jobs")).map(([id, job]) => jobOf(reader, id, job)),
 		callOutputs: Object.fromEntries(Object.entries(outputs).map(([name, output]) => [name, reader.text(reader.record(output, `on.workflow_call.outputs.${name}`)["value"], `on.workflow_call.outputs.${name}.value`) ?? ""]))
@@ -1343,6 +1644,14 @@ function callsAlways(condition) {
 * The default ids of junction jobs, shared by the checks that look for one.
 */
 const DEFAULT_JUNCTION_JOBS = ["required-checks"];
+/**
+* The default ids of release jobs, shared by the checks that look for one.
+*/
+const DEFAULT_RELEASE_JOBS = ["release"];
+/**
+* The variables a token for the npm registry is passed in.
+*/
+const REGISTRY_TOKEN_VARIABLES = ["NODE_AUTH_TOKEN", "NPM_TOKEN"];
 //#endregion
 //#region src/checks/settings-required-checks.ts
 /**
@@ -1478,10 +1787,6 @@ const PACKAGE_MANAGER_OPTIONS = String.raw`(?:\s+(?:(?:--filter|-F|--workspace|-
 * Commands that publish a package to a registry.
 */
 const PUBLISH_COMMAND = new RegExp(String.raw`^(?:(?:npm|pnpm|yarn)${PACKAGE_MANAGER_OPTIONS}(?:\s+npm)?\s+publish|(?:(?:pnpm|yarn)(?:\s+exec)?\s+|npx\s+)?(?:semantic-release|changeset\s+publish|lerna\s+publish))(?:\s|$)`, "u");
-/**
-* The variables a token for the registry is passed in.
-*/
-const TOKEN_VARIABLES = ["NODE_AUTH_TOKEN", "NPM_TOKEN"];
 const PROVENANCE_FLAG = /--provenance(?:=true)?(?:\s|$)/u;
 /**
 * Whether the `package.json` in the working directory asks for provenance with `publishConfig.provenance: true`, which applies to every publish of that package.
@@ -1505,7 +1810,7 @@ function attestationViolations(workflow, job) {
 * Whether the job passes a registry token to a step, which makes its publish not tokenless: a token variable with a value other than the empty string, anywhere in the environment.
 */
 function passesToken(workflow, job) {
-	return [void 0, ...job.steps].some((step) => TOKEN_VARIABLES.some((variable) => (effectiveEnv(workflow, job, step)[variable] ?? "") !== ""));
+	return [void 0, ...job.steps].some((step) => REGISTRY_TOKEN_VARIABLES.some((variable) => (effectiveEnv(workflow, job, step)[variable] ?? "") !== ""));
 }
 function tokenlessPublishViolations(workflow, job, provenanceInManifest) {
 	if (accessOf(effectivePermissions(workflow, job), "id-token") !== "write" || passesToken(workflow, job)) return [];
@@ -1513,9 +1818,9 @@ function tokenlessPublishViolations(workflow, job, provenanceInManifest) {
 		const publishes = scriptCommands(step.run).filter((line) => PUBLISH_COMMAND.test(line));
 		if (publishes.length === 0) return [];
 		const env = effectiveEnv(workflow, job, step);
-		const blanked = TOKEN_VARIABLES.every((variable) => env[variable] === "");
+		const blanked = REGISTRY_TOKEN_VARIABLES.every((variable) => env[variable] === "");
 		const provenance = provenanceInManifest || publishes.some((line) => PROVENANCE_FLAG.test(line)) || env["NPM_CONFIG_PROVENANCE"] === "true";
-		return blanked || provenance ? [] : [workflowViolation(workflow, "workflow-credentials/tokenless-publish-unprotected", `job '${job.id}' publishes with an OIDC identity and no token, but does not set ${TOKEN_VARIABLES.join(" and ")} to the empty string, so a token inherited from the environment is used when the OIDC exchange fails; set them to the empty string to prevent that, or request provenance so that such a publish at least carries a traceable attestation`, step.location)];
+		return blanked || provenance ? [] : [workflowViolation(workflow, "workflow-credentials/tokenless-publish-unprotected", `job '${job.id}' publishes with an OIDC identity and no token, but does not set ${REGISTRY_TOKEN_VARIABLES.join(" and ")} to the empty string, so a token inherited from the environment is used when the OIDC exchange fails; set them to the empty string to prevent that, or request provenance so that such a publish at least carries a traceable attestation`, step.location)];
 	});
 }
 /**
@@ -1533,7 +1838,6 @@ const workflowCredentials = async ({ cwd, options }) => {
 };
 //#endregion
 //#region src/checks/workflow-job-ordering.ts
-const DEFAULT_RELEASE_JOBS = ["release"];
 const DEFAULT_DEPLOY_JOBS = ["deploy"];
 const DEFAULT_DOCS_DEPLOY_JOBS = ["docs-deploy"];
 const DEFAULT_BRANCH = "main";
@@ -1681,6 +1985,71 @@ const workflowMergeGroup = async ({ cwd, options }) => (await loadWorkflows(cwd,
 	return location === void 0 || workflow.triggers.has("merge_group") ? [] : [workflowViolation(workflow, "workflow-merge-group/missing-trigger", "the workflow runs for pull requests but has no merge_group trigger, so its checks do not report for a pull request in the merge queue", location)];
 });
 //#endregion
+//#region src/checks/workflow-release-job.ts
+const CHECKOUT_ACTION$1 = "actions/checkout";
+/**
+* A value that reads the `secrets` context inside an expression.
+*/
+const FROM_SECRET = /\$\{\{[^}]*\bsecrets\./u;
+/**
+* The release jobs named for a message: `release job 'a'` or `release jobs 'a' and 'b'`.
+*/
+function releaseJobsText(releases) {
+	const ids = releases.map((job) => `'${job.id}'`);
+	return `release job${ids.length === 1 ? "" : "s"} ${ids.join(" and ")}`;
+}
+function grantsIdToken(permissions) {
+	return accessOf(permissions, "id-token") === "write";
+}
+function idTokenViolations(workflow, releases) {
+	const releaseIds = new Set(releases.map((job) => job.id));
+	const named = releaseJobsText(releases);
+	const workflowLevel = grantsIdToken(workflow.permissions) && workflow.permissionsLocation !== void 0 ? [workflowViolation(workflow, "workflow-release-job/id-token-workflow-level", `the workflow's permissions grant id-token: write to every job that declares none of its own; grant it on ${named} only`, workflow.permissionsLocation)] : [];
+	const jobLevel = workflow.jobs.filter((job) => !releaseIds.has(job.id) && grantsIdToken(job.permissions)).map((job) => workflowViolation(workflow, "workflow-release-job/id-token-outside-release", `job '${job.id}' is granted id-token: write but is not a release job, so it can mint the OIDC identity npm trusted publishing accepts for this workflow; only ${named} may hold it`, job.location));
+	return [...workflowLevel, ...jobLevel];
+}
+/**
+* What a checkout that does not set `persist-credentials: false` leaves in git config.
+*/
+function persistedCredential(step) {
+	if (step.with["ssh-key"] !== void 0) return "the SSH key";
+	return step.with["token"] === void 0 ? "the job token" : "the token it was given";
+}
+function releaseJobViolations(workflow, job) {
+	if (job.uses !== void 0) return [];
+	const environment = job.environment === void 0 ? [workflowViolation(workflow, "workflow-release-job/missing-environment", `release job '${job.id}' declares no environment, so nothing outside the workflow file stops a branch's copy of it publishing; run it in a protected environment restricted to the default branch`, job.location)] : [];
+	const checkouts = job.steps.filter((step) => stepUses(step, CHECKOUT_ACTION$1) && step.with["persist-credentials"] !== "false").map((step) => workflowViolation(workflow, "workflow-release-job/persisted-credentials", `release job '${job.id}' checks out without persist-credentials: false, which leaves ${persistedCredential(step)} in git config for every later step`, step.location));
+	return [...environment, ...checkouts];
+}
+/**
+* The token variables an environment sets from a secret.
+*/
+function secretTokens(env) {
+	return REGISTRY_TOKEN_VARIABLES.filter((variable) => FROM_SECRET.test(env[variable] ?? ""));
+}
+function tokenBesideOidcViolations(workflow, job) {
+	if (!grantsIdToken(effectivePermissions(workflow, job))) return [];
+	const report = (variables, location) => variables.length === 0 ? [] : [workflowViolation(workflow, "workflow-release-job/token-beside-oidc", `job '${job.id}' holds id-token: write and passes ${variables.join(" and ")} from a secret, a long-lived npm token beside the OIDC identity; publish through trusted publishing and blank the token variables`, location)];
+	return [...report(secretTokens(effectiveEnv(workflow, job, void 0)), job.location), ...job.steps.flatMap((step) => report(secretTokens(step.env), step.location))];
+}
+/**
+* npm binds a trusted publisher to the repository and the workflow file, not to a branch, so anyone who can push a branch can edit that branch's copy of the workflow, drop an `if` that keeps publishing to the default branch, and publish. What stops that has to live outside the file: a protected environment that only the default branch may deploy to, named in npm's trusted publisher too. This check holds the release job to the shape that makes that protection hold.
+*
+* In a workflow with a release job (by id, `releaseJobs`, `release` by default): `workflow-release-job/id-token-workflow-level`, the workflow's own `permissions` grant `id-token: write` (directly or through `write-all`), which every job that declares none inherits; `id-token-outside-release`, a job that is not a release job declares `id-token: write` itself, a job that calls a reusable workflow included; `missing-environment`, a release job declares no `environment`; `persisted-credentials`, a release job runs `actions/checkout` without `persist-credentials: false` (literally; an expression is unknown and reported), so the job token, a `token` input or an `ssh-key` stays in git config for every later step. A release job that pushes as a deploy key provisions the key in a step and hands it to git through that step's `GIT_SSH_COMMAND`, after a checkout that persists nothing, and is accepted as written; semantic-release authenticates its own push (`repositoryUrl` as written, else the URL with `GITHUB_TOKEN` or `GH_TOKEN` from the environment), so it needs nothing from the checkout.
+*
+* In every workflow: `token-beside-oidc`, a job whose effective permissions grant `id-token: write` sets `NODE_AUTH_TOKEN` or `NPM_TOKEN` from the `secrets` context in its workflow, job or step `env`.
+*
+* Limits: the environment's protection rules and npm's trusted publisher settings are not visible in the file and are not read; a release job that calls a reusable workflow is judged only for `id-token`, since `environment` and steps belong to the called workflow; a token passed through `with`, written to an `.npmrc` by a script, or inherited through a composite action is not seen.
+*/
+const workflowReleaseJob = async ({ cwd, options }) => {
+	return (await loadWorkflows(cwd, options)).flatMap((workflow) => {
+		const releases = jobsNamed(workflow, options.releaseJobs ?? DEFAULT_RELEASE_JOBS);
+		const releaseFindings = releases.length === 0 ? [] : idTokenViolations(workflow, releases);
+		const jobFindings = workflow.jobs.flatMap((job) => [...releases.includes(job) ? releaseJobViolations(workflow, job) : [], ...tokenBesideOidcViolations(workflow, job)]);
+		return [...releaseFindings, ...jobFindings];
+	});
+};
+//#endregion
 //#region src/checks/workflow-repository-dispatch.ts
 const DEFAULT_BRANCHES = ["main", "master"];
 const DEFAULT_BRANCH_EXPRESSION = /\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}/u;
@@ -2272,145 +2641,6 @@ function unresolvedNameImportRule(packages) {
 	};
 }
 //#endregion
-//#region src/workspace/packages.ts
-function segmentsOf(path) {
-	return path.split("/").filter((segment) => segment !== "" && segment !== ".");
-}
-function groupRoot(group) {
-	return segmentsOf(group.path ?? group.name);
-}
-function startsWithSegments(segments, prefix) {
-	return prefix.every((segment, index) => segments[index] === segment);
-}
-/**
-* The group whose root is the longest prefix of `dir`; the first declared wins a tie. `undefined` when no group owns the directory.
-*/
-function owningGroup(dir, groups) {
-	const segments = segmentsOf(dir);
-	let best;
-	let bestLength = -1;
-	for (const group of groups) {
-		const root = groupRoot(group);
-		if (root.length > bestLength && startsWithSegments(segments, root)) {
-			best = group;
-			bestLength = root.length;
-		}
-	}
-	return best;
-}
-function rankOf(name, group, layout) {
-	if (name !== void 0) {
-		const rule = layout.nameRanks?.find((candidate) => new RegExp(candidate.pattern, "u").test(name));
-		if (rule !== void 0) return rule.rank;
-	}
-	return group.rank ?? layout.defaultRank;
-}
-/**
-* The name without its npm scope: `@scope/store-cli` gives `store-cli`.
-*/
-function unscoped(name) {
-	return name.replace(/^@[^/]+\//u, "");
-}
-/**
-* The longest slice value that is the whole unscoped name or its prefix up to a `-`.
-*/
-function sliceByNamePrefix(name, known) {
-	const bare = unscoped(name);
-	return [...known].filter((candidate) => bare === candidate || bare.startsWith(`${candidate}-`)).sort((a, b) => b.length - a.length)[0];
-}
-/**
-* Classify discovered packages by the layout: group, rank and slice. Pure.
-*
-* A package no group owns is a configuration error, because every check would otherwise skip it without saying so. Nested package directories are one too: the checks attribute a file to the package whose directory is its prefix, which is ambiguous for a package inside another. A `namePrefix` slice takes the longest slice value that a `segment` group produced and that prefixes the package's unscoped name; a package without a name has no such slice.
-*/
-function classifyPackages(discovered, layout) {
-	const owned = discovered.map((found) => {
-		const group = owningGroup(found.dir, layout.groups);
-		if (group === void 0) throw new ConformanceError(`the package directory '${found.dir}' is not under any layout group's path; add a group whose path prefixes it, or narrow the workspace package globs`);
-		return {
-			found,
-			group
-		};
-	});
-	const knownSlices = /* @__PURE__ */ new Set();
-	for (const { found, group } of owned) if (group.slice !== void 0 && "segment" in group.slice) {
-		const value = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		if (value !== void 0) knownSlices.add(value);
-	}
-	const packages = owned.map(({ found, group }) => {
-		let slice;
-		if (group.slice !== void 0 && "segment" in group.slice) slice = segmentsOf(found.dir).slice(groupRoot(group).length)[group.slice.segment];
-		else if (group.slice !== void 0 && found.name !== void 0) slice = sliceByNamePrefix(found.name, knownSlices);
-		return {
-			...found,
-			group: group.name,
-			rank: rankOf(found.name, group, layout),
-			slice
-		};
-	});
-	for (const outer of packages) {
-		const nested = packages.find((inner) => inner.dir !== outer.dir && inner.dir.startsWith(`${outer.dir}/`));
-		if (nested !== void 0) throw new ConformanceError(`the package directory '${nested.dir}' is inside the package directory '${outer.dir}'; workspace packages must not nest`);
-	}
-	return packages;
-}
-/**
-* The workspace root: `layout.root` resolved against `cwd`, or `cwd` itself.
-*/
-function workspaceRoot(cwd, layout) {
-	return layout.root === void 0 ? cwd : resolve(cwd, layout.root);
-}
-/**
-* The package globs: `layout.packages`, else the `packages` list of `pnpm-workspace.yaml` in `root`.
-*/
-async function workspacePatterns(root, layout) {
-	if (layout.packages !== void 0) return layout.packages;
-	const file = join(root, "pnpm-workspace.yaml");
-	let source;
-	try {
-		source = await readFile(file, "utf8");
-	} catch (error) {
-		throw new ConformanceError(`the layout has no 'packages' and ${file} cannot be read`, { cause: error });
-	}
-	const document = parse(source);
-	if (typeof document !== "object" || document === null || !("packages" in document) || !Array.isArray(document.packages)) throw new ConformanceError(`${file} has no 'packages' list`);
-	const patterns = document.packages;
-	if (!patterns.every((pattern) => typeof pattern === "string")) throw new ConformanceError(`${file}: every entry of 'packages' must be a string`);
-	return patterns;
-}
-async function readName(manifest) {
-	let content;
-	try {
-		content = JSON.parse(await readFile(manifest, "utf8"));
-	} catch (error) {
-		throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
-	}
-	if (typeof content === "object" && content !== null && "name" in content && typeof content.name === "string") return content.name;
-}
-/**
-* The directories under `root` that the pnpm-style `patterns` select and that hold a `package.json`, sorted. A `!` pattern excludes. The root package itself (`.`) is not a member of any group and is left out.
-*/
-async function discoverPackages(root, patterns) {
-	const manifests = patterns.map((pattern) => pattern.startsWith("!") ? `!${pattern.slice(1)}/**` : `${pattern}/package.json`);
-	const dirs = (await glob(manifests, {
-		cwd: root,
-		dot: true,
-		ignore: [INSTALLED_DEPENDENCIES_GLOB],
-		onlyFiles: true
-	})).map((manifest) => manifest.replace(/\/?package\.json$/u, "")).filter((dir) => dir !== "");
-	return Promise.all([...new Set(dirs)].sort().map(async (dir) => ({
-		dir,
-		name: await readName(join(root, dir, "package.json"))
-	})));
-}
-/**
-* The layout's packages found under the workspace root.
-*/
-async function readWorkspacePackages(cwd, layout) {
-	const root = workspaceRoot(cwd, layout);
-	return classifyPackages(await discoverPackages(root, await workspacePatterns(root, layout)), layout);
-}
-//#endregion
 //#region src/checks/import-graph.ts
 /**
 * Paths left out of the import graph unless the options say otherwise: a package's own installed dependencies.
@@ -3332,6 +3562,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["commit-types"]),
 		check: commitTypes
 	}),
+	"engines-floor": plain({
+		name: "engines-floor",
+		description: "A package's engines.node range admits no Node version that one of its installed dependencies rejects",
+		select: (checks) => enabledOptions(checks["engines-floor"]),
+		check: enginesFloor
+	}),
 	"dockerfile-package-manager": plain({
 		name: "dockerfile-package-manager",
 		description: "A package manager version pinned in a Dockerfile is the version packageManager names",
@@ -3380,6 +3616,12 @@ const registry = {
 		select: (checks) => enabledOptions(checks["workflow-credentials"]),
 		check: workflowCredentials
 	}),
+	"workflow-release-job": plain({
+		name: "workflow-release-job",
+		description: "The release job alone holds id-token, runs in an environment and persists no credentials, and no job with id-token passes an npm token secret",
+		select: (checks) => enabledOptions(checks["workflow-release-job"]),
+		check: workflowReleaseJob
+	}),
 	"workflow-repository-dispatch": plain({
 		name: "workflow-repository-dispatch",
 		description: "A repository_dispatch handler does not push to the default branch, auto-merge unguarded, or rely on the default token",
@@ -3530,6 +3772,7 @@ const checks = z.strictObject({
 		commitlint: z.exactOptional(path),
 		release: z.exactOptional(path)
 	}))),
+	"engines-floor": z.exactOptional(enabled(z.strictObject({ packages: z.exactOptional(paths) }))),
 	"dockerfile-package-manager": z.exactOptional(enabled(z.strictObject({
 		dockerfiles: z.exactOptional(paths),
 		exclude: z.exactOptional(paths),
@@ -3574,6 +3817,10 @@ const checks = z.strictObject({
 	}))),
 	"workflow-version-single-source": z.exactOptional(enabled(z.strictObject(selection))),
 	"workflow-credentials": z.exactOptional(enabled(z.strictObject(selection))),
+	"workflow-release-job": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		releaseJobs: z.exactOptional(names)
+	}))),
 	"workflow-repository-dispatch": z.exactOptional(enabled(z.strictObject({
 		...selection,
 		defaultBranches: z.exactOptional(names),