workspace-conformance 2.0.2 → 3.0.0

package/dist/cli.js

@@ -129,7 +129,9 @@ function createGitHubClient(options) {
 				pullRequests: rules.filter((rule) => rule.type === "pull_request").map((rule) => ({
 					requiredReviewThreadResolution: rule.parameters?.required_review_thread_resolution === true,
 					allowedMergeMethods: rule.parameters?.allowed_merge_methods
-				}))
+				})),
+				requiredLinearHistory: rules.some((rule) => rule.type === "required_linear_history"),
+				mergeQueue: rules.some((rule) => rule.type === "merge_queue")
 			};
 		}
 	};
@@ -1058,6 +1060,41 @@ async function readWorkspacePackages(cwd, layout) {
 	if (discovered.length === 0) throw new ConformanceError(`no workspace package found: ${patterns.length === 0 ? "the package patterns are empty, so no directory is selected" : `no directory the patterns ${patterns.join(", ")} select holds a package.json`}; for a single-package repository, set the layout's packages to ['.']`);
 	return classifyPackages(discovered, layout);
 }
+/**
+* The `package.json` fields a package's declared dependencies are read from when the layout's `dependencyFields` is omitted, the default of the ESLint workspace rules that read the same layout.
+*/
+const DEFAULT_DEPENDENCY_FIELDS = ["dependencies"];
+/**
+* The fields npm and pnpm install dependencies from, read alongside the layout's own so that a dependency declared outside them can be told apart from one not declared at all.
+*/
+const MANIFEST_DEPENDENCY_FIELDS = [
+	"dependencies",
+	"devDependencies",
+	"peerDependencies",
+	"optionalDependencies"
+];
+/**
+* For each package directory, the fields its `package.json` declares each dependency in: the manifest dependency fields and any other the layout's `dependencyFields` names.
+*/
+async function readDeclaredDependencies(root, packages, layout) {
+	const fields = [.../* @__PURE__ */ new Set([...MANIFEST_DEPENDENCY_FIELDS, ...layout.dependencyFields ?? DEFAULT_DEPENDENCY_FIELDS])];
+	return new Map(await Promise.all(packages.map(async (member) => {
+		const manifest = join(root, member.dir, "package.json");
+		let content;
+		try {
+			content = JSON.parse(await readFile(manifest, "utf8"));
+		} catch (error) {
+			throw new ConformanceError(`${manifest} cannot be read as JSON`, { cause: error });
+		}
+		if (!isRecord(content)) throw new ConformanceError(`${manifest} is not a JSON object`);
+		const declared = /* @__PURE__ */ new Map();
+		for (const field of fields) {
+			const entries = content[field];
+			for (const name of isRecord(entries) ? Object.keys(entries) : []) declared.set(name, [...declared.get(name) ?? [], field]);
+		}
+		return [member.dir, declared];
+	})));
+}
 //#endregion
 //#region src/checks/engines-floor.ts
 /**
@@ -1317,7 +1354,15 @@ const METHODS = [
 	"merge"
 ];
 /**
-* Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it and no `pull_request` rule that applies to the branch leaves it out of its allowed methods.
+* How a message names each method, in the words GitHub's settings page uses.
+*/
+const METHOD_NAMES = {
+	rebase: "rebase merging",
+	squash: "squash merging",
+	merge: "merge commits"
+};
+/**
+* Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it, no `pull_request` rule that applies to the branch leaves it out of its allowed methods, and, for a merge commit, no `required_linear_history` rule applies, since that rule keeps merge commits off the branch.
 *
 * When the repository's plan has no rulesets, no rule applies to the branch and the repository settings alone decide.
 *
@@ -1335,15 +1380,17 @@ const settingsMergeMethods = async ({ cwd, options, github }) => {
 		squash: settings.allowSquashMerge,
 		merge: settings.allowMergeCommit
 	};
-	const available = METHODS.filter((method) => repositoryAllows[method] && pullRequests.every((rule) => rule.allowedMergeMethods === void 0 || rule.allowedMergeMethods.includes(method)));
+	const requiredLinearHistory = "unavailable" in read ? false : read.rules.requiredLinearHistory;
+	const rulesAllow = (method) => !(method === "merge" && requiredLinearHistory) && pullRequests.every((rule) => rule.allowedMergeMethods === void 0 || rule.allowedMergeMethods.includes(method));
+	const available = METHODS.filter((method) => repositoryAllows[method] && rulesAllow(method));
 	const violations = available.filter((method) => method !== wanted).map((method) => ({
 		code: "settings-merge-methods/method-enabled",
-		message: `${file} allows ${method} merges; only ${wanted} should be allowed`,
+		message: `${file} allows ${METHOD_NAMES[method]}; only ${METHOD_NAMES[wanted]} should be allowed`,
 		file
 	}));
 	if (!available.includes(wanted)) violations.push({
 		code: "settings-merge-methods/method-unavailable",
-		message: `${file} does not allow ${wanted} merges`,
+		message: `${file} does not allow ${METHOD_NAMES[wanted]}`,
 		file
 	});
 	return violations;
@@ -1536,6 +1583,7 @@ function parseWorkflow(file, source) {
 	const triggers = triggersOf(reader, root["on"]);
 	const call = triggers.get("workflow_call");
 	const outputs = reader.record(reader.record(call, "on.workflow_call")["outputs"], "on.workflow_call.outputs");
+	const inputs = reader.record(reader.record(call, "on.workflow_call")["inputs"], "on.workflow_call.inputs");
 	return {
 		file,
 		name: reader.text(root["name"], "name"),
@@ -1545,7 +1593,8 @@ function parseWorkflow(file, source) {
 		permissionsLocation: root["permissions"] === void 0 ? void 0 : reader.location(["permissions"]),
 		env: reader.texts(root["env"], "env"),
 		jobs: Object.entries(reader.record(root["jobs"], "jobs")).map(([id, job]) => jobOf(reader, id, job)),
-		callOutputs: Object.fromEntries(Object.entries(outputs).map(([name, output]) => [name, reader.text(reader.record(output, `on.workflow_call.outputs.${name}`)["value"], `on.workflow_call.outputs.${name}.value`) ?? ""]))
+		callOutputs: Object.fromEntries(Object.entries(outputs).map(([name, output]) => [name, reader.text(reader.record(output, `on.workflow_call.outputs.${name}`)["value"], `on.workflow_call.outputs.${name}.value`) ?? ""])),
+		callInputs: Object.fromEntries(Object.entries(inputs).map(([name, input]) => [name, reader.text(reader.record(input, `on.workflow_call.inputs.${name}`)["default"], `on.workflow_call.inputs.${name}.default`)]))
 	};
 }
 /**
@@ -1877,6 +1926,15 @@ const PACKAGE_MANAGER_OPTIONS = String.raw`(?:\s+(?:(?:--filter|-F|--workspace|-
 * Commands that publish a package to a registry.
 */
 const PUBLISH_COMMAND = new RegExp(String.raw`^(?:(?:npm|pnpm|yarn)${PACKAGE_MANAGER_OPTIONS}(?:\s+npm)?\s+publish|(?:(?:pnpm|yarn)(?:\s+exec)?\s+|npx\s+)?(?:semantic-release|changeset\s+publish|lerna\s+publish))(?:\s|$)`, "u");
+/**
+* npm reads no token variable by name: a variable reaches it only through `${NAME}` (or `${NAME?}`) in the value of an `.npmrc` setting. These are the settings that carry credentials.
+*/
+const NPMRC_AUTH_SETTING = /^\s*[^#;=\s]*(?:_authToken|_auth|_password)\s*=(.*)$/u;
+const NPMRC_VARIABLE = /\$\{([^${}?]+)\??\}/gu;
+/**
+* `semantic-release` as the command a publish line runs, whose npm plugin reads `NPM_TOKEN` itself.
+*/
+const SEMANTIC_RELEASE = /(?:^|\s)semantic-release(?:\s|$)/u;
 const PROVENANCE_FLAG = /--provenance(?:=true)?(?:\s|$)/u;
 /**
 * Whether the `package.json` in the working directory asks for provenance with `publishConfig.provenance: true`, which applies to every publish of that package.
@@ -1888,6 +1946,34 @@ async function requestsProvenance(cwd) {
 	const config = isRecord(manifest) ? manifest["publishConfig"] : void 0;
 	return isRecord(config) && config["provenance"] === true;
 }
+/**
+* The variables the auth settings of the `.npmrc` in the working directory read, which npm and pnpm load for a publish run there.
+*/
+async function npmrcTokenVariables(cwd) {
+	const file = resolve(cwd, ".npmrc");
+	if (!existsSync(file)) return [];
+	const values = (await readFile(file, "utf8")).split("\n").flatMap((line) => NPMRC_AUTH_SETTING.exec(line)?.[1] ?? []);
+	return [...new Set(values.flatMap((value) => [...value.matchAll(NPMRC_VARIABLE)].flatMap((match) => match[1] ?? [])))];
+}
+/**
+* The token variables that what a publish step runs reads, with what reads each: the `.npmrc` that an earlier `actions/setup-node` step with `registry-url` writes reads `NODE_AUTH_TOKEN`, semantic-release's npm plugin reads `NPM_TOKEN`, and the `.npmrc` of the working directory reads the variables of its auth settings.
+*/
+function tokenReads(job, step, publishes, npmrcVariables) {
+	const reads = [];
+	if (job.steps.some((earlier) => earlier.index < step.index && stepUses(earlier, "actions/setup-node") && (earlier.with["registry-url"] ?? "") !== "")) reads.push({
+		variable: "NODE_AUTH_TOKEN",
+		reader: "the .npmrc actions/setup-node writes for registry-url"
+	});
+	if (publishes.some((line) => SEMANTIC_RELEASE.test(line))) reads.push({
+		variable: "NPM_TOKEN",
+		reader: "semantic-release's npm plugin"
+	});
+	reads.push(...npmrcVariables.map((variable) => ({
+		variable,
+		reader: "the .npmrc of the working directory"
+	})));
+	return reads.filter((read, index) => reads.findIndex((other) => other.variable === read.variable) === index);
+}
 function attestationViolations(workflow, job) {
 	const permissions = effectivePermissions(workflow, job);
 	return job.steps.filter((step) => ATTESTATION_ACTIONS.some((action) => stepUses(step, action))).flatMap((step) => {
@@ -1899,18 +1985,18 @@ function attestationViolations(workflow, job) {
 /**
 * Whether the job passes a registry token to a step, which makes its publish not tokenless: a token variable with a value other than the empty string, anywhere in the environment.
 */
-function passesToken(workflow, job) {
-	return [void 0, ...job.steps].some((step) => REGISTRY_TOKEN_VARIABLES.some((variable) => (effectiveEnv(workflow, job, step)[variable] ?? "") !== ""));
+function passesToken(workflow, job, variables) {
+	return [void 0, ...job.steps].some((step) => variables.some((variable) => (effectiveEnv(workflow, job, step)[variable] ?? "") !== ""));
 }
-function tokenlessPublishViolations(workflow, job, provenanceInManifest) {
-	if (accessOf(effectivePermissions(workflow, job), "id-token") !== "write" || passesToken(workflow, job)) return [];
+function tokenlessPublishViolations(workflow, job, provenanceInManifest, npmrcVariables) {
+	if (accessOf(effectivePermissions(workflow, job), "id-token") !== "write" || passesToken(workflow, job, [...REGISTRY_TOKEN_VARIABLES, ...npmrcVariables])) return [];
 	return job.steps.flatMap((step) => {
 		const publishes = scriptCommands(step.run).filter((line) => PUBLISH_COMMAND.test(line));
 		if (publishes.length === 0) return [];
 		const env = effectiveEnv(workflow, job, step);
-		const blanked = REGISTRY_TOKEN_VARIABLES.every((variable) => env[variable] === "");
+		const unprotected = tokenReads(job, step, publishes, npmrcVariables).filter((read) => env[read.variable] !== "");
 		const provenance = provenanceInManifest || publishes.some((line) => PROVENANCE_FLAG.test(line)) || env["NPM_CONFIG_PROVENANCE"] === "true";
-		return blanked || provenance ? [] : [workflowViolation(workflow, "workflow-credentials/tokenless-publish-unprotected", `job '${job.id}' publishes with an OIDC identity and no token, but does not set ${REGISTRY_TOKEN_VARIABLES.join(" and ")} to the empty string, so a token inherited from the environment is used when the OIDC exchange fails; set them to the empty string to prevent that, or request provenance so that such a publish at least carries a traceable attestation`, step.location)];
+		return unprotected.length === 0 || provenance ? [] : [workflowViolation(workflow, "workflow-credentials/tokenless-publish-unprotected", `job '${job.id}' publishes with an OIDC identity and no token, but does not set ${unprotected.map((read) => `${read.variable} (read by ${read.reader})`).join(" and ")} to the empty string, so a token inherited from the environment is used when the OIDC exchange fails; set ${unprotected.length === 1 ? "it" : "them"} to the empty string to prevent that, or request provenance so that such a publish at least carries a traceable attestation`, step.location)];
 	});
 }
 /**
@@ -1918,45 +2004,19 @@ function tokenlessPublishViolations(workflow, job, provenanceInManifest) {
 *
 * `workflow-credentials/attestation-permissions`: a step of `actions/attest`, `actions/attest-build-provenance` or `actions/attest-sbom` needs `id-token: write` and `attestations: write` in the job's effective permissions. Permissions a job declares replace the workflow's; permissions declared nowhere are the repository's default, which the file cannot show and which never includes `id-token`, so they are reported.
 *
-* `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank `NODE_AUTH_TOKEN` and `NPM_TOKEN` (set them to `''` at step, job or workflow level) or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
+* `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank (set to `''` at step, job or workflow level) every token variable the publish reads, or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
 *
-* Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
+* A variable is judged only where something reads it, since npm reads none by name, only through `${NAME}` in an `.npmrc`: `NODE_AUTH_TOKEN` after an `actions/setup-node` step with `registry-url`, whose `.npmrc` refers to it; `NPM_TOKEN` for `semantic-release`, whose npm plugin reads it; and the variables the auth settings (`_authToken`, `_auth`, `_password`) of the `.npmrc` in the working directory refer to.
+*
+* Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); an `.npmrc` the file does not show, such as one in the runner's home directory, a Yarn `.yarnrc.yml` and a token set through an `npm_config_` variable are not read; a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
 */
 const workflowCredentials = async ({ cwd, options }) => {
 	const provenanceInManifest = await requestsProvenance(cwd);
-	return (await loadWorkflows(cwd, options)).flatMap((workflow) => workflow.jobs.flatMap((job) => [...attestationViolations(workflow, job), ...tokenlessPublishViolations(workflow, job, provenanceInManifest)]));
+	const npmrcVariables = await npmrcTokenVariables(cwd);
+	return (await loadWorkflows(cwd, options)).flatMap((workflow) => workflow.jobs.flatMap((job) => [...attestationViolations(workflow, job), ...tokenlessPublishViolations(workflow, job, provenanceInManifest, npmrcVariables)]));
 };
 //#endregion
-//#region src/checks/workflow-job-ordering.ts
-const DEFAULT_DEPLOY_JOBS = ["deploy"];
-const DEFAULT_DOCS_DEPLOY_JOBS = ["docs-deploy"];
-const DEFAULT_BRANCH = "main";
-/**
-* The expression that always names the repository's default branch.
-*/
-const DEFAULT_BRANCH_EXPRESSION$1 = /^\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}$/u;
-/**
-* The text a junction job decides on: its `if`, and the conditions and scripts of its steps.
-*/
-function decisionText(job) {
-	return [job.condition, ...job.steps.flatMap((step) => [
-		step.condition,
-		step.run,
-		...Object.values(step.env),
-		...Object.values(step.with)
-	])].filter((text) => text !== void 0).join("\n");
-}
-/**
-* Where a script gets the results of the jobs it needs from: `needs.*.result`, one job's `needs.<job>.result` or the whole of `needs`.
-*/
-const RESULT_SOURCE = /needs\.(?:\*|[\w-]+)\.result|toJSON\(\s*needs\s*\)/u;
-const FAILURE_WORD = /['"]failure['"]/u;
-const CANCELLED_WORD = /['"]cancelled['"]/u;
-const SKIPPED_OR_NOT_SUCCESS = /needs\.(?:\*|[\w-]+)\.result[^\n]*(?:['"]skipped['"]|!==?\s*['"]success['"])|!\s*contains\(\s*needs\.\*\.result\s*,\s*['"]success['"]/u;
-/**
-* An `if` that compares the ref or the event name.
-*/
-const COMPARES_REF_OR_EVENT = /github\.(?:ref|ref_name|event_name)\s*==/u;
+//#region src/workflows/expressions.ts
 /**
 * An expression written inside the `${{ }}` that marks it as one.
 */
@@ -2004,6 +2064,153 @@ function unwrapped(expression) {
 	return enclosedByOneGroup(inner) ? unwrapped(inner.slice(1, -1)) : inner;
 }
 /**
+* A string literal of an expression, whose body writes a quote as `''`.
+*/
+const STRING_LITERAL = /^'((?:[^']|'')*)'$/u;
+/**
+* A call of `format`, whose name, like every function name in an expression, is case-insensitive.
+*/
+const FORMAT_CALL = /^format\s*\(([\s\S]*)\)$/iu;
+/**
+* A reference to an input of the workflow.
+*/
+const INPUT_REFERENCE = /^inputs\.([\w-]+)$/u;
+/**
+* A placeholder of a `format` pattern, or the doubled brace that writes a literal one.
+*/
+const FORMAT_PLACEHOLDER = /\{\{|\}\}|\{(\d+)\}/gu;
+/**
+* The arguments of a call, split at the commas outside quotes and parentheses.
+*/
+function callArguments(text) {
+	const parts = [];
+	let depth = 0;
+	let quoted = false;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const character = text.charAt(index);
+		if (character === "'") quoted = !quoted;
+		else if (!quoted && character === "(") depth += 1;
+		else if (!quoted && character === ")") depth -= 1;
+		else if (!quoted && depth === 0 && character === ",") {
+			parts.push(text.slice(start, index));
+			start = index + 1;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts.map((part) => part.trim());
+}
+/**
+* `format(pattern, ...values)` as GitHub evaluates it: `{N}` is the value at index N and `{{` and `}}` are literal braces. `undefined` when a placeholder names a value that is not given, which GitHub rejects.
+*/
+function formatted(pattern, values) {
+	let text = "";
+	let end = 0;
+	for (const match of pattern.matchAll(FORMAT_PLACEHOLDER)) {
+		const index = match[1];
+		const value = index === void 0 ? match[0].charAt(0) : values[Number(index)];
+		if (value === void 0) return;
+		text += `${pattern.slice(end, match.index)}${value}`;
+		end = match.index + match[0].length;
+	}
+	return `${text}${pattern.slice(end)}`;
+}
+/**
+* The value an operand of an expression has on every run, or `undefined` when that depends on the run: a string literal, an input whose value `inputs` gives, or `format()` of such values. An input `inputs` holds as `undefined`, or does not hold, is not known.
+*/
+function constantString(operand, inputs) {
+	const text = unwrapped(operand);
+	const literal = STRING_LITERAL.exec(text)?.[1];
+	if (literal !== void 0) return literal.replaceAll("''", "'");
+	const input = INPUT_REFERENCE.exec(text)?.[1];
+	if (input !== void 0) return Object.hasOwn(inputs, input) ? inputs[input] : void 0;
+	const call = FORMAT_CALL.exec(text)?.[1];
+	if (call === void 0) return;
+	const [pattern, ...rest] = callArguments(call).map((argument) => constantString(argument, inputs));
+	const values = rest.filter((value) => value !== void 0);
+	return pattern === void 0 || values.length !== rest.length ? void 0 : formatted(pattern, values);
+}
+//#endregion
+//#region src/checks/workflow-job-ordering.ts
+const DEFAULT_DEPLOY_JOBS = ["deploy"];
+const DEFAULT_DOCS_DEPLOY_JOBS = ["docs-deploy"];
+const DEFAULT_BRANCH = "main";
+/**
+* The expression that always names the repository's default branch.
+*/
+const DEFAULT_BRANCH_EXPRESSION$1 = /^\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}$/u;
+/**
+* The whole of an environment value that is one expression, `${{ <expression> }}`.
+*/
+const WHOLE_EXPRESSION = /^\$\{\{\s*([\s\S]*?)\s*\}\}$/u;
+/**
+* A reference to an environment variable in a script, `$NAME` or `${NAME}`, and in an expression, `env.NAME`.
+*/
+const SCRIPT_VARIABLE = /\$(?:\{([A-Za-z_]\w*)\}|([A-Za-z_]\w*))/gu;
+const EXPRESSION_VARIABLE = /\benv\.([A-Za-z_]\w*)/gu;
+/**
+* A script or condition with each environment variable whose value is a whole expression replaced by that expression, so `"$RESULT" != "success"` with `RESULT: ${{ needs.test.result }}` reads as the test of `needs.test.result` it is.
+*/
+function withVariablesResolved(text, env, reference) {
+	return text.replaceAll(reference, (match, ...names) => {
+		const name = names.find((candidate) => typeof candidate === "string");
+		const value = name === void 0 ? void 0 : env[name];
+		return (value === void 0 ? void 0 : WHOLE_EXPRESSION.exec(value.trim())?.[1]) ?? match;
+	});
+}
+/**
+* The text a junction job decides on: its `if`, and the conditions, scripts and inputs of its steps, with the environment variables they read replaced by the expressions that set them, and the values of their environments.
+*/
+function decisionText(workflow, job) {
+	return [job.condition === void 0 ? void 0 : withVariablesResolved(job.condition, effectiveEnv(workflow, job, void 0), EXPRESSION_VARIABLE), ...job.steps.flatMap((step) => {
+		const env = effectiveEnv(workflow, job, step);
+		return [
+			step.condition === void 0 ? void 0 : withVariablesResolved(step.condition, env, EXPRESSION_VARIABLE),
+			step.run === void 0 ? void 0 : withVariablesResolved(step.run, env, SCRIPT_VARIABLE),
+			...Object.values(env),
+			...Object.values(step.with)
+		];
+	})].filter((text) => text !== void 0).join("\n");
+}
+/**
+* Where a script gets the results of the jobs it needs from: `needs.*.result`, one job's `needs.<job>.result` or the whole of `needs`.
+*/
+const RESULT_SOURCE = /needs\.(?:\*|[\w-]+)\.result|toJSON\(\s*needs\s*\)/u;
+const FAILURE_WORD = /['"]failure['"]/u;
+const CANCELLED_WORD = /['"]cancelled['"]/u;
+/**
+* A test that a result is not `success`, which fails on `failure` and `cancelled`, and on `skipped` too. The group is the job, or `*`.
+*/
+const NOT_SUCCESS = /needs\.(\*|[\w-]+)\.result[^\n]*?!==?\s*['"]success['"]/gu;
+/**
+* A test that names `skipped`, or that fails unless some result is `success`.
+*/
+const SKIPPED_TEST = /needs\.(?:\*|[\w-]+)\.result[^\n]*['"]skipped['"]|!\s*contains\(\s*needs\.\*\.result\s*,\s*['"]success['"]/u;
+/**
+* A read of a job's output, which is what an `if` that skips a job on the result of an earlier one reads.
+*/
+const OUTPUT_READ = /needs\.[\w-]+\.outputs\.[\w-]+/gu;
+/**
+* Whether an `if` can skip the job, its own or that of a job it needs, without the junction job seeing why: a job runs unless an `if` other than `always()` stops it, and a skip that comes only from a need that failed is a failure the junction rightly fails on. A skip is seen when the junction reads every job output those conditions read, as a junction that tests `has-packages` before the result of a job skipped on it does.
+*/
+function skippableUnseen(workflow, jobId, text) {
+	return workflow.jobs.filter((job) => job.id === jobId || transitiveNeeds(workflow, jobId).has(job.id)).flatMap((job) => job.condition === void 0 || callsAlways(job.condition) ? [] : [job.condition]).some((condition) => {
+		const reads = [...condition.matchAll(OUTPUT_READ)].map((read) => read[0]);
+		return reads.length === 0 || !reads.every((read) => text.includes(read));
+	});
+}
+/**
+* Whether the junction fails when a job it needs is skipped: it names `skipped`, or tests a result for not being `success` where an `if` can skip that job (any of its needs, for `needs.*.result`) unseen.
+*/
+function failsOnSkipped(workflow, junction, text) {
+	const tested = [...text.matchAll(NOT_SUCCESS)].flatMap((match) => match[1] === "*" ? junction.needs : match[1] ?? []);
+	return SKIPPED_TEST.test(text) || tested.some((id) => skippableUnseen(workflow, id, text));
+}
+/**
+* An `if` that compares the ref or the event name.
+*/
+const COMPARES_REF_OR_EVENT = /github\.(?:ref|ref_name|event_name)\s*==/u;
+/**
 * Whether an expression can only hold in runs other than those of a pull request and of a merge group, which are the runs the required check decides on: an operand of an `&&` that does so is enough, every operand of an `||` must, and a comparison of the ref or the event name does so when it names neither `pull_request` nor `merge_group`.
 */
 function keepsOutOfPullRequests(expression) {
@@ -2050,17 +2257,17 @@ function junctionOrdering(workflow, options) {
 		if (!callsAlways(junction.condition)) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-not-always", `junction job '${junction.id}' has no if: always(), so it is skipped, and its required check never reports, when a job it needs fails`, junction.location));
 		const missing = workflow.jobs.filter((job) => job.id !== junction.id && !exempt.has(job.id) && !junction.needs.includes(job.id) && !transitiveNeeds(workflow, job.id).has(junction.id));
 		for (const job of missing) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-missing-need", `junction job '${junction.id}' does not list job '${job.id}' in needs, so its result is not part of the required check`, junction.location));
-		const text = decisionText(junction);
+		const text = decisionText(workflow, junction);
 		const reportsOutcome = junction.steps.some((step) => stepUses(step, OUTCOME_ACTION));
-		if (SKIPPED_OR_NOT_SUCCESS.test(text)) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-fails-on-skipped", `junction job '${junction.id}' fails when a needed job is skipped, but a skipped job is how a path filter or an if keeps a job out; fail only on 'failure' and 'cancelled'`, junction.location));
-		if (!reportsOutcome && !(RESULT_SOURCE.test(text) && FAILURE_WORD.test(text) && CANCELLED_WORD.test(text))) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-no-failure-condition", `junction job '${junction.id}' does not test the results of its needs for both 'failure' and 'cancelled', so it can pass when a job it needs did not succeed`, junction.location));
+		if (failsOnSkipped(workflow, junction, text)) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-fails-on-skipped", `junction job '${junction.id}' fails when a needed job is skipped, but a skipped job is how a path filter or an if keeps a job out; fail only on 'failure' and 'cancelled'`, junction.location));
+		if (!reportsOutcome && !(RESULT_SOURCE.test(text) && (FAILURE_WORD.test(text) && CANCELLED_WORD.test(text) || [...text.matchAll(NOT_SUCCESS)].length > 0))) violations.push(workflowViolation(workflow, "workflow-job-ordering/junction-no-failure-condition", `junction job '${junction.id}' does not test the results of its needs for both 'failure' and 'cancelled', so it can pass when a job it needs did not succeed`, junction.location));
 	}
 	return violations;
 }
 /**
 * The jobs that release, deploy and report a required check are ordered so that a failure stops what follows: a release job needs the deploy job, a documentation deploy job needs the release job and checks out the default branch afresh, and one junction job with `if: always()` needs every other job and fails only on `failure` or `cancelled`.
 *
-* Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete.
+* Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text, with the environment variables its scripts and conditions read replaced by the expressions that set them: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'` or test a result for `!= 'success'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete. A `!= 'success'` test fails on a skip too, which is reported only for a job an `if` can skip without the junction reading what that `if` reads.
 */
 const workflowJobOrdering = async ({ cwd, options }) => (await loadWorkflows(cwd, options)).flatMap((workflow) => [...releaseAndDocsOrdering(workflow, options), ...junctionOrdering(workflow, options)]);
 //#endregion
@@ -2068,12 +2275,21 @@ const workflowJobOrdering = async ({ cwd, options }) => (await loadWorkflows(cwd
 /**
 * A workflow that checks pull requests also runs for the merge queue: GitHub starts no run of it for a queued pull request unless the workflow has a `merge_group` trigger, and a required check that never reports blocks the queue.
 *
-* A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged. Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read.
+* A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged.
+*
+* Whether the branch has a merge queue is a setting, not something a file shows. Given a GitHub client, the check reads the rules of the branch (`branch`, else the default branch, of `repository`, else the `origin` remote) once it has found a workflow without the trigger, and reports only when a `merge_queue` rule applies, since without a queue no `merge_group` event is ever sent. Offline it cannot tell, so it reports every such workflow.
+*
+* Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read; only rulesets are read, so a queue configured through classic branch protection is not seen and, with a client, nothing is reported for it.
 */
-const workflowMergeGroup = async ({ cwd, options }) => (await loadWorkflows(cwd, options)).flatMap((workflow) => {
-	const location = workflow.triggerLocations.get("pull_request");
-	return location === void 0 || workflow.triggers.has("merge_group") ? [] : [workflowViolation(workflow, "workflow-merge-group/missing-trigger", "the workflow runs for pull requests but has no merge_group trigger, so its checks do not report for a pull request in the merge queue", location)];
-});
+const workflowMergeGroup = async ({ cwd, options, github }) => {
+	const violations = (await loadWorkflows(cwd, options)).flatMap((workflow) => {
+		const location = workflow.triggerLocations.get("pull_request");
+		return location === void 0 || workflow.triggers.has("merge_group") ? [] : [workflowViolation(workflow, "workflow-merge-group/missing-trigger", "the workflow runs for pull requests but has no merge_group trigger, so its checks do not report for a pull request in the merge queue", location)];
+	});
+	if (violations.length === 0 || github === void 0) return violations;
+	const slug = await repositoryOf(cwd, options);
+	return (await github.branchRules(slug, await branchOf(github, slug, options))).mergeQueue ? violations : [];
+};
 //#endregion
 //#region src/checks/workflow-release-job.ts
 const CHECKOUT_ACTION$1 = "actions/checkout";
@@ -2268,7 +2484,7 @@ const workflowRepositoryDispatch = async ({ cwd, options }) => (await loadWorkfl
 //#endregion
 //#region src/checks/workflow-runner-resolution.ts
 /**
-* GitHub's own images: `ubuntu`, `windows` and `macos`, as `-latest`, a version, or a version with an architecture or size suffix, and `ubuntu-slim`.
+* The `hostedLabels` used when the options set none: GitHub's own images, `ubuntu`, `windows` and `macos`, as `-latest`, a version, or a version with an architecture or size suffix, and `ubuntu-slim`. Setting `hostedLabels` replaces it, so a workflow that also falls back to a third-party hosted runner extends it: `[...DEFAULT_HOSTED_LABELS, '^blacksmith-']`.
 */
 const DEFAULT_HOSTED_LABELS = ["^(?:ubuntu|windows|macos)-(?:latest|slim|[0-9][0-9.]*)(?:-(?:arm|intel|xlarge|large))*$"];
 /**
@@ -2280,10 +2496,6 @@ const RESOLVED_RUNNER = /fromJSON\(\s*needs\.([\w-]+)\.outputs\.([\w-]+)\s*\)/gi
 */
 const JOB_OUTPUT_REFERENCE = /^\$\{\{\s*jobs\.([\w-]+)\.outputs\.([\w-]+)\s*\}\}$/u;
 /**
-* A fallback in an output expression: `||` followed by a string literal, whose body may hold `''` for a quote.
-*/
-const LITERAL_FALLBACK = /\|\|\s*'((?:[^']|'')*)'/gu;
-/**
 * The resolver behind each `fromJson(needs.<job>.outputs.<name>)` in a `runs-on` of the workflow; none for one this check cannot read.
 */
 function resolversOf(workflow, workflows) {
@@ -2301,7 +2513,8 @@ function implementation(workflow, workflows, caller, output) {
 	if (caller.uses === void 0) return {
 		workflow,
 		job: caller,
-		output
+		output,
+		inputs: {}
 	};
 	const reference = parseUses(caller.uses);
 	if (reference.kind !== "local") return;
@@ -2310,17 +2523,22 @@ function implementation(workflow, workflows, caller, output) {
 	const forwarded = JOB_OUTPUT_REFERENCE.exec(called.callOutputs[output] ?? "");
 	const job = called.jobs.find((candidate) => candidate.id === forwarded?.[1]);
 	const jobOutput = forwarded?.[2];
+	const inputs = Object.fromEntries(Object.entries(called.callInputs).map(([name, fallback]) => {
+		const passed = caller.with[name];
+		return [name, passed === void 0 ? fallback : hasExpression(passed) ? void 0 : passed];
+	}));
 	return job === void 0 || jobOutput === void 0 ? void 0 : {
 		workflow: called,
 		job,
-		output: jobOutput
+		output: jobOutput,
+		inputs
 	};
 }
 /**
-* The runner labels the last literal fallback of an output expression names, read as the JSON the `fromJson` that consumes it expects: a label or a list of labels. `undefined` when there is no literal fallback, and an empty list when the literal is not labels.
+* The runner labels the fallback of an output expression names, read as the JSON the `fromJson` that consumes it expects: a label or a list of labels. The fallback is the first operand after the first of the expression's top-level `||` chain whose value is the same on every run and not empty (see `constantString`), which is what the chain yields when the operands before it are empty. `undefined` when there is no such operand, and an empty list when its value is not labels.
 */
-function fallbackLabels(expression) {
-	const literal = [...expression.matchAll(LITERAL_FALLBACK)].at(-1)?.[1]?.replaceAll("''", "'");
+function fallbackLabels(expression, inputs) {
+	const literal = operands(unwrapped(expression), "||").slice(1).map((operand) => constantString(operand, inputs)).find((value) => value !== void 0 && value !== "");
 	if (literal === void 0) return;
 	let parsed;
 	try {
@@ -2335,9 +2553,13 @@ function fallbackLabels(expression) {
 function resolverViolations(resolver, hosted) {
 	const violations = [];
 	if (resolver.job.timeoutMinutes === void 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-no-timeout", `resolver job '${resolver.job.id}' has no timeout-minutes, so a runner that never starts holds every job waiting for it until the default six hours`, resolver.job.location));
-	const fallback = fallbackLabels(resolver.job.outputs[resolver.output] ?? "");
-	if (fallback === void 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-no-fallback", `output '${resolver.output}' of resolver job '${resolver.job.id}' has no literal fallback (\`|| '["<hosted label>"]'\`), so the jobs that read it have no runner when resolution produces nothing`, resolver.job.location));
-	else if (fallback.length === 0 || !fallback.every((label) => hosted.some((pattern) => pattern.test(label)))) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-fallback-not-hosted", `the literal fallback of output '${resolver.output}' of resolver job '${resolver.job.id}' does not name only hosted runner labels, so it offers no runner when the self-hosted fleet is down`, resolver.job.location));
+	const fallback = fallbackLabels(resolver.job.outputs[resolver.output] ?? "", resolver.inputs);
+	if (fallback === void 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-no-fallback", `output '${resolver.output}' of resolver job '${resolver.job.id}' has no fallback whose value is known before the run (\`|| '["<hosted label>"]'\`, or format() of literals and of inputs with a literal value), so the jobs that read it have no runner when resolution produces nothing`, resolver.job.location));
+	else if (fallback.length === 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-fallback-not-hosted", `the literal fallback of output '${resolver.output}' of resolver job '${resolver.job.id}' is not a runner label or a non-empty list of them, so the jobs that read it have no runner when resolution produces nothing`, resolver.job.location));
+	else {
+		const unhosted = fallback.filter((label) => !hosted.some((pattern) => pattern.test(label)));
+		if (unhosted.length > 0) violations.push(workflowViolation(resolver.workflow, "workflow-runner-resolution/resolver-fallback-not-hosted", `the literal fallback of output '${resolver.output}' of resolver job '${resolver.job.id}' names ${unhosted.map((label) => `'${label}'`).join(", ")}, which ${unhosted.length === 1 ? "matches" : "match"} no pattern of hostedLabels, so it is not known to offer a runner when resolution produces nothing; name a hosted label, or add the label's pattern to hostedLabels (extending DEFAULT_HOSTED_LABELS) if it is hosted, by GitHub or by a third party`, resolver.job.location));
+	}
 	return violations;
 }
 function customLabels(job, hosted) {
@@ -2357,14 +2579,14 @@ function repeatedLabels(workflow, hosted) {
 /**
 * A self-hosted or custom runner label named literally in more than one job of a workflow is resolved once instead: a resolver job decides the runner and the others read it with `fromJson(needs.<resolver>.outputs.<name>)`. The resolver must have a `timeout-minutes` and its output a literal fallback that names only hosted runner labels, so jobs still get a runner when resolution fails or the self-hosted fleet is down.
 *
-* A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output is taken to have a fallback when its expression has `||` followed by a string literal, and the last such literal is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported.
+* A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output's fallback is the first operand after the first of its expression's top-level `||` chain whose value is the same on every run: a string literal, or `format()` of literals and of inputs of the reusable workflow, read from the literal the caller passes or else the input's default. It is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported, and an output with no such operand has no fallback.
 */
 const workflowRunnerResolution = async ({ cwd, options }) => {
 	const hosted = (options.hostedLabels ?? DEFAULT_HOSTED_LABELS).map((source) => new RegExp(source, "u"));
 	const selected = await loadWorkflows(cwd, options);
 	const available = await loadWorkflows(cwd, { workflows: DEFAULT_WORKFLOWS });
 	const resolvers = /* @__PURE__ */ new Map();
-	for (const workflow of selected) for (const resolver of resolversOf(workflow, available)) resolvers.set(`${resolver.workflow.file}#${resolver.job.id}#${resolver.output}`, resolver);
+	for (const workflow of selected) for (const resolver of resolversOf(workflow, available)) resolvers.set(`${resolver.workflow.file}#${resolver.job.id}#${resolver.output}#${JSON.stringify(resolver.inputs)}`, resolver);
 	return [...selected.flatMap((workflow) => repeatedLabels(workflow, hosted)), ...[...resolvers.values()].flatMap((resolver) => resolverViolations(resolver, hosted))];
 };
 //#endregion
@@ -2812,10 +3034,17 @@ async function runImportChecks(input) {
 	const { cwd, layout, entries } = input;
 	const root = workspaceRoot(cwd, layout);
 	const packages = await readWorkspacePackages(cwd, layout);
+	const declared = await readDeclaredDependencies(root, packages, layout);
+	const read = new Set(layout.dependencyFields ?? DEFAULT_DEPENDENCY_FIELDS);
+	const judged = (from, to) => {
+		const fields = to.name === void 0 ? void 0 : declared.get(from.dir)?.get(to.name);
+		return fields === void 0 || fields.some((field) => read.has(field));
+	};
 	const scope = {
 		cwd,
 		root,
-		packages
+		packages,
+		judged
 	};
 	const contributions = entries.map((entry) => ({
 		...entry,
@@ -2858,13 +3087,13 @@ async function runImportChecks(input) {
 	return new Map(contributions.map(({ spec }) => [spec.name, spec.report(found.get(spec.name) ?? [], scope)]));
 }
 /**
-* The report of a check whose every rule forbids one package importing another: one violation per finding, at the importing file, ordered by file and message.
+* The report of a check whose every rule forbids one package importing another: one violation per finding the scope judges, at the importing file, ordered by file and message.
 */
 function edgeReport(spec) {
-	return (findings, { cwd, root, packages }) => findings.map((finding) => {
+	return (findings, { cwd, root, packages, judged }) => findings.flatMap((finding) => {
 		const from = packageOfPath(packages, finding.from);
 		const to = packageOfPath(packages, finding.to);
-		return {
+		return judged(from, to) ? [{
 			code: `${spec.name}/${spec.reason}`,
 			message: spec.message({
 				from,
@@ -2873,7 +3102,7 @@ function edgeReport(spec) {
 				toFile: finding.to
 			}),
 			file: relativePosix(cwd, join(root, finding.from))
-		};
+		}] : [];
 	}).sort((a, b) => a.file.localeCompare(b.file) || a.message.localeCompare(b.message));
 }
 /**
@@ -3594,6 +3823,25 @@ function online(spec) {
 		}
 	};
 }
+function settingsAware(spec) {
+	return {
+		name: spec.name,
+		description: spec.description,
+		requiresLayout: false,
+		requiresGitHub: false,
+		isEnabled: (checks) => spec.select(checks) !== void 0,
+		run: async ({ cwd, checks, configFiles, github }) => {
+			const options = spec.select(checks);
+			if (options === void 0) throw new ConformanceError(`the check '${spec.name}' is not enabled`);
+			return spec.check({
+				cwd,
+				options,
+				...github === void 0 ? {} : { github },
+				...configFiles === void 0 ? {} : { configFiles }
+			});
+		}
+	};
+}
 function importCheck(spec) {
 	return {
 		name: spec.name,
@@ -3755,7 +4003,7 @@ const registry = {
 		select: (checks) => enabledOptions(checks["workflow-update-bot-cooldown"]),
 		check: workflowUpdateBotCooldown
 	}),
-	"workflow-merge-group": plain({
+	"workflow-merge-group": settingsAware({
 		name: "workflow-merge-group",
 		description: "A workflow that runs for pull requests also runs for the merge queue",
 		select: (checks) => enabledOptions(checks["workflow-merge-group"]),
@@ -3951,7 +4199,10 @@ const checks = z.strictObject({
 		dependabot: z.exactOptional(path),
 		renovate: z.exactOptional(path)
 	}))),
-	"workflow-merge-group": z.exactOptional(enabled(z.strictObject(selection))),
+	"workflow-merge-group": z.exactOptional(enabled(z.strictObject({
+		...selection,
+		...settings
+	}))),
 	"workflow-action-pinning": z.exactOptional(enabled(z.strictObject({
 		...selection,
 		thirdParty: z.exactOptional(pinningLevel),