workspace-conformance 2.0.2 → 3.0.0

package/dist/index.d.cts

@@ -45,6 +45,14 @@ interface BranchRules {
     readonly requiredReviewThreadResolution: boolean;
     readonly allowedMergeMethods: readonly string[] | undefined;
   }[];
+  /**
+   * Whether a `required_linear_history` rule applies, which keeps merge commits off the branch.
+   */
+  readonly requiredLinearHistory: boolean;
+  /**
+   * Whether a `merge_queue` rule applies, so pull requests into the branch merge through a merge queue.
+   */
+  readonly mergeQueue: boolean;
 }
 /**
  * GitHub's refusal to read a branch's rules because the repository's plan does not offer rulesets, as for a private repository on a plan without them: no ruleset applies to its branches, so a check that requires one cannot be met. The message is GitHub's own. A {@link GitHubClient} rejects `branchRules` with it, and with any other error for every other refusal.
@@ -146,6 +154,19 @@ interface GitHubCheckContext<Options> extends CheckContext<Options> {
  * A check that reads repository settings through the GitHub API. Its violations name the repository (`owner/name`) as the file.
  */
 type GitHubCheckFunction<Options> = (context: GitHubCheckContext<Options>) => Promise<readonly Violation[]>;
+/**
+ * What a check that reads files, and the repository's settings too when it can, receives.
+ */
+interface SettingsAwareCheckContext<Options> extends CheckContext<Options> {
+  /**
+   * The client to read the repository's settings through; absent when the run is offline, and the check then judges from the files alone.
+   */
+  readonly github?: GitHubClient;
+}
+/**
+ * A check that reads files and refines its judgement with the repository's settings when the run is given a GitHub client. It runs offline too, unlike a {@link GitHubCheckFunction}.
+ */
+type SettingsAwareCheckFunction<Options> = (context: SettingsAwareCheckContext<Options>) => Promise<readonly Violation[]>;
 //#endregion
 //#region src/migrations/adapters.d.ts
 /**
@@ -314,6 +335,10 @@ interface Workflow {
    * The `value` of each output a reusable workflow declares under `on.workflow_call.outputs`.
    */
   readonly callOutputs: Readonly<Record<string, string>>;
+  /**
+   * The `default` of each input a reusable workflow declares under `on.workflow_call.inputs`, as text; `undefined` for an input without one.
+   */
+  readonly callInputs: Readonly<Record<string, string | undefined>>;
 }
 /**
  * Parse the text of a workflow file into the model the checks read. It throws `ConformanceError` when the file is not YAML or is not shaped like a workflow, since a check cannot judge what it cannot read.
@@ -690,7 +715,7 @@ interface WorkflowSkippableJobsOptions extends WorkflowSelection {
  */
 interface WorkflowRunnerResolutionOptions extends WorkflowSelection {
   /**
-   * Regular expressions, as source text, for the labels GitHub hosts itself and that may be repeated freely. `ubuntu`, `windows` and `macos` images, `-latest`, versioned, `-arm`, `-intel`, `-xlarge`, `-large` and `-slim` forms, when omitted. Setting it replaces that default.
+   * Regular expressions, as source text, for the labels of hosted runners, which may be repeated freely and are what a resolver's fallback must name. GitHub's own `ubuntu`, `windows` and `macos` images, `-latest`, versioned, `-arm`, `-intel`, `-xlarge`, `-large` and `-slim` forms, when omitted (`DEFAULT_HOSTED_LABELS`). Setting it replaces that default, so spread `DEFAULT_HOSTED_LABELS` into the list to add a third-party hosted runner's labels to GitHub's.
    */
   readonly hostedLabels?: readonly string[];
 }
@@ -738,9 +763,9 @@ interface WorkflowUpdateBotCooldownOptions {
   readonly renovate?: string;
 }
 /**
- * Options of the `workflow-merge-group` check.
+ * Options of the `workflow-merge-group` check. `repository` and `branch` are read only when the run is given a GitHub client, to learn whether the branch has a merge queue.
  */
-type WorkflowMergeGroupOptions = WorkflowSelection;
+interface WorkflowMergeGroupOptions extends WorkflowSelection, SettingsOptions {}
 /**
  * How strictly a reference must be pinned: to a full commit SHA, or any ref (tag, branch or SHA).
  */
@@ -1013,6 +1038,10 @@ interface ImportScope {
    */
   readonly root: string;
   readonly packages: readonly WorkspacePackage[];
+  /**
+   * Whether an import from one package of another is judged: unless the importer declares the imported package, and only in fields the layout's `dependencyFields` does not read. The ESLint workspace rules read the same layout and do not see such a declaration, so a test-only `devDependencies` edge is exempt from both by default. An import of a package not declared at all is judged, since it is what a declaration would have hidden from ESLint.
+   */
+  readonly judged: (from: WorkspacePackage, to: WorkspacePackage) => boolean;
 }
 /**
  * How an import check takes part in a shared cruise: the rules it adds and how it reads its own findings. Findings are routed to a check by the names of the rules it generated, so those names must differ from every other check's.
@@ -1080,7 +1109,7 @@ export declare const migrationsDirectory: CheckFunction<MigrationsDirectoryOptio
 //#endregion
 //#region src/checks/settings-merge-methods.d.ts
 /**
- * Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it and no `pull_request` rule that applies to the branch leaves it out of its allowed methods.
+ * Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it, no `pull_request` rule that applies to the branch leaves it out of its allowed methods, and, for a merge commit, no `required_linear_history` rule applies, since that rule keeps merge commits off the branch.
  *
  * When the repository's plan has no rulesets, no rule applies to the branch and the repository settings alone decide.
  *
@@ -1128,9 +1157,11 @@ export declare const workflowActionPinning: CheckFunction<WorkflowActionPinningO
  *
  * `workflow-credentials/attestation-permissions`: a step of `actions/attest`, `actions/attest-build-provenance` or `actions/attest-sbom` needs `id-token: write` and `attestations: write` in the job's effective permissions. Permissions a job declares replace the workflow's; permissions declared nowhere are the repository's default, which the file cannot show and which never includes `id-token`, so they are reported.
  *
- * `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank `NODE_AUTH_TOKEN` and `NPM_TOKEN` (set them to `''` at step, job or workflow level) or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
+ * `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank (set to `''` at step, job or workflow level) every token variable the publish reads, or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
  *
- * Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
+ * A variable is judged only where something reads it, since npm reads none by name, only through `${NAME}` in an `.npmrc`: `NODE_AUTH_TOKEN` after an `actions/setup-node` step with `registry-url`, whose `.npmrc` refers to it; `NPM_TOKEN` for `semantic-release`, whose npm plugin reads it; and the variables the auth settings (`_authToken`, `_auth`, `_password`) of the `.npmrc` in the working directory refer to.
+ *
+ * Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); an `.npmrc` the file does not show, such as one in the runner's home directory, a Yarn `.yarnrc.yml` and a token set through an `npm_config_` variable are not read; a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
  */
 export declare const workflowCredentials: CheckFunction<WorkflowCredentialsOptions>;
 //#endregion
@@ -1138,7 +1169,7 @@ export declare const workflowCredentials: CheckFunction<WorkflowCredentialsOptio
 /**
  * The jobs that release, deploy and report a required check are ordered so that a failure stops what follows: a release job needs the deploy job, a documentation deploy job needs the release job and checks out the default branch afresh, and one junction job with `if: always()` needs every other job and fails only on `failure` or `cancelled`.
  *
- * Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete.
+ * Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text, with the environment variables its scripts and conditions read replaced by the expressions that set them: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'` or test a result for `!= 'success'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete. A `!= 'success'` test fails on a skip too, which is reported only for a job an `if` can skip without the junction reading what that `if` reads.
  */
 export declare const workflowJobOrdering: CheckFunction<WorkflowJobOrderingOptions>;
 //#endregion
@@ -1146,9 +1177,13 @@ export declare const workflowJobOrdering: CheckFunction<WorkflowJobOrderingOptio
 /**
  * A workflow that checks pull requests also runs for the merge queue: GitHub starts no run of it for a queued pull request unless the workflow has a `merge_group` trigger, and a required check that never reports blocks the queue.
  *
- * A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged. Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read.
+ * A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged.
+ *
+ * Whether the branch has a merge queue is a setting, not something a file shows. Given a GitHub client, the check reads the rules of the branch (`branch`, else the default branch, of `repository`, else the `origin` remote) once it has found a workflow without the trigger, and reports only when a `merge_queue` rule applies, since without a queue no `merge_group` event is ever sent. Offline it cannot tell, so it reports every such workflow.
+ *
+ * Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read; only rulesets are read, so a queue configured through classic branch protection is not seen and, with a client, nothing is reported for it.
  */
-export declare const workflowMergeGroup: CheckFunction<WorkflowMergeGroupOptions>;
+export declare const workflowMergeGroup: SettingsAwareCheckFunction<WorkflowMergeGroupOptions>;
 //#endregion
 //#region src/checks/workflow-release-job.d.ts
 /**
@@ -1173,10 +1208,14 @@ export declare const workflowReleaseJob: CheckFunction<WorkflowReleaseJobOptions
 export declare const workflowRepositoryDispatch: CheckFunction<WorkflowRepositoryDispatchOptions>;
 //#endregion
 //#region src/checks/workflow-runner-resolution.d.ts
+/**
+ * The `hostedLabels` used when the options set none: GitHub's own images, `ubuntu`, `windows` and `macos`, as `-latest`, a version, or a version with an architecture or size suffix, and `ubuntu-slim`. Setting `hostedLabels` replaces it, so a workflow that also falls back to a third-party hosted runner extends it: `[...DEFAULT_HOSTED_LABELS, '^blacksmith-']`.
+ */
+export declare const DEFAULT_HOSTED_LABELS: readonly string[];
 /**
  * A self-hosted or custom runner label named literally in more than one job of a workflow is resolved once instead: a resolver job decides the runner and the others read it with `fromJson(needs.<resolver>.outputs.<name>)`. The resolver must have a `timeout-minutes` and its output a literal fallback that names only hosted runner labels, so jobs still get a runner when resolution fails or the self-hosted fleet is down.
  *
- * A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output is taken to have a fallback when its expression has `||` followed by a string literal, and the last such literal is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported.
+ * A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output's fallback is the first operand after the first of its expression's top-level `||` chain whose value is the same on every run: a string literal, or `format()` of literals and of inputs of the reusable workflow, read from the literal the caller passes or else the input's default. It is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported, and an output with no such operand has no fallback.
  */
 export declare const workflowRunnerResolution: CheckFunction<WorkflowRunnerResolutionOptions>;
 //#endregion
@@ -1234,7 +1273,7 @@ interface RunInput {
   readonly layout: LayoutConfig | undefined;
   readonly configFiles: ConfigFileOptions | undefined;
   /**
-   * The client the settings checks read through; `undefined` when the run is offline.
+   * The client the settings checks, and the checks that refine their judgement with the settings, read through; `undefined` when the run is offline.
    */
   readonly github: GitHubClient | undefined;
   /**
@@ -1430,4 +1469,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsAwareCheckContext, SettingsAwareCheckFunction, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };

package/dist/index.d.ts

@@ -45,6 +45,14 @@ interface BranchRules {
     readonly requiredReviewThreadResolution: boolean;
     readonly allowedMergeMethods: readonly string[] | undefined;
   }[];
+  /**
+   * Whether a `required_linear_history` rule applies, which keeps merge commits off the branch.
+   */
+  readonly requiredLinearHistory: boolean;
+  /**
+   * Whether a `merge_queue` rule applies, so pull requests into the branch merge through a merge queue.
+   */
+  readonly mergeQueue: boolean;
 }
 /**
  * GitHub's refusal to read a branch's rules because the repository's plan does not offer rulesets, as for a private repository on a plan without them: no ruleset applies to its branches, so a check that requires one cannot be met. The message is GitHub's own. A {@link GitHubClient} rejects `branchRules` with it, and with any other error for every other refusal.
@@ -146,6 +154,19 @@ interface GitHubCheckContext<Options> extends CheckContext<Options> {
  * A check that reads repository settings through the GitHub API. Its violations name the repository (`owner/name`) as the file.
  */
 type GitHubCheckFunction<Options> = (context: GitHubCheckContext<Options>) => Promise<readonly Violation[]>;
+/**
+ * What a check that reads files, and the repository's settings too when it can, receives.
+ */
+interface SettingsAwareCheckContext<Options> extends CheckContext<Options> {
+  /**
+   * The client to read the repository's settings through; absent when the run is offline, and the check then judges from the files alone.
+   */
+  readonly github?: GitHubClient;
+}
+/**
+ * A check that reads files and refines its judgement with the repository's settings when the run is given a GitHub client. It runs offline too, unlike a {@link GitHubCheckFunction}.
+ */
+type SettingsAwareCheckFunction<Options> = (context: SettingsAwareCheckContext<Options>) => Promise<readonly Violation[]>;
 //#endregion
 //#region src/migrations/adapters.d.ts
 /**
@@ -314,6 +335,10 @@ interface Workflow {
    * The `value` of each output a reusable workflow declares under `on.workflow_call.outputs`.
    */
   readonly callOutputs: Readonly<Record<string, string>>;
+  /**
+   * The `default` of each input a reusable workflow declares under `on.workflow_call.inputs`, as text; `undefined` for an input without one.
+   */
+  readonly callInputs: Readonly<Record<string, string | undefined>>;
 }
 /**
  * Parse the text of a workflow file into the model the checks read. It throws `ConformanceError` when the file is not YAML or is not shaped like a workflow, since a check cannot judge what it cannot read.
@@ -690,7 +715,7 @@ interface WorkflowSkippableJobsOptions extends WorkflowSelection {
  */
 interface WorkflowRunnerResolutionOptions extends WorkflowSelection {
   /**
-   * Regular expressions, as source text, for the labels GitHub hosts itself and that may be repeated freely. `ubuntu`, `windows` and `macos` images, `-latest`, versioned, `-arm`, `-intel`, `-xlarge`, `-large` and `-slim` forms, when omitted. Setting it replaces that default.
+   * Regular expressions, as source text, for the labels of hosted runners, which may be repeated freely and are what a resolver's fallback must name. GitHub's own `ubuntu`, `windows` and `macos` images, `-latest`, versioned, `-arm`, `-intel`, `-xlarge`, `-large` and `-slim` forms, when omitted (`DEFAULT_HOSTED_LABELS`). Setting it replaces that default, so spread `DEFAULT_HOSTED_LABELS` into the list to add a third-party hosted runner's labels to GitHub's.
    */
   readonly hostedLabels?: readonly string[];
 }
@@ -738,9 +763,9 @@ interface WorkflowUpdateBotCooldownOptions {
   readonly renovate?: string;
 }
 /**
- * Options of the `workflow-merge-group` check.
+ * Options of the `workflow-merge-group` check. `repository` and `branch` are read only when the run is given a GitHub client, to learn whether the branch has a merge queue.
  */
-type WorkflowMergeGroupOptions = WorkflowSelection;
+interface WorkflowMergeGroupOptions extends WorkflowSelection, SettingsOptions {}
 /**
  * How strictly a reference must be pinned: to a full commit SHA, or any ref (tag, branch or SHA).
  */
@@ -1013,6 +1038,10 @@ interface ImportScope {
    */
   readonly root: string;
   readonly packages: readonly WorkspacePackage[];
+  /**
+   * Whether an import from one package of another is judged: unless the importer declares the imported package, and only in fields the layout's `dependencyFields` does not read. The ESLint workspace rules read the same layout and do not see such a declaration, so a test-only `devDependencies` edge is exempt from both by default. An import of a package not declared at all is judged, since it is what a declaration would have hidden from ESLint.
+   */
+  readonly judged: (from: WorkspacePackage, to: WorkspacePackage) => boolean;
 }
 /**
  * How an import check takes part in a shared cruise: the rules it adds and how it reads its own findings. Findings are routed to a check by the names of the rules it generated, so those names must differ from every other check's.
@@ -1080,7 +1109,7 @@ export declare const migrationsDirectory: CheckFunction<MigrationsDirectoryOptio
 //#endregion
 //#region src/checks/settings-merge-methods.d.ts
 /**
- * Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it and no `pull_request` rule that applies to the branch leaves it out of its allowed methods.
+ * Only one merge method is available for a pull request into the branch, `rebase` unless the options say otherwise. A method is available when the repository allows it, no `pull_request` rule that applies to the branch leaves it out of its allowed methods, and, for a merge commit, no `required_linear_history` rule applies, since that rule keeps merge commits off the branch.
  *
  * When the repository's plan has no rulesets, no rule applies to the branch and the repository settings alone decide.
  *
@@ -1128,9 +1157,11 @@ export declare const workflowActionPinning: CheckFunction<WorkflowActionPinningO
  *
  * `workflow-credentials/attestation-permissions`: a step of `actions/attest`, `actions/attest-build-provenance` or `actions/attest-sbom` needs `id-token: write` and `attestations: write` in the job's effective permissions. Permissions a job declares replace the workflow's; permissions declared nowhere are the repository's default, which the file cannot show and which never includes `id-token`, so they are reported.
  *
- * `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank `NODE_AUTH_TOKEN` and `NPM_TOKEN` (set them to `''` at step, job or workflow level) or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
+ * `workflow-credentials/tokenless-publish-unprotected`: a job with `id-token: write` that publishes (`npm`, `pnpm` or `yarn npm publish`, with options such as `-r` or `--filter <package>` before `publish`, `semantic-release`, `changeset publish`, `lerna publish`, bare or run through `pnpm`, `pnpm exec`, `yarn` or `npx`) and passes no token must blank (set to `''` at step, job or workflow level) every token variable the publish reads, or request provenance (`--provenance`, `NPM_CONFIG_PROVENANCE: true`, or `publishConfig.provenance: true` in the `package.json` of the working directory). The npm CLI replaces any configured token with the one from the OIDC exchange, but when the exchange fails it falls back to whatever token the environment holds, silently. Only blanking the variables prevents that fallback. Provenance does not: npm signs it with the CI's own OIDC identity (through Sigstore), separately from the registry token, so a fallback publish still goes ahead with the inherited token and carries an attestation of where it was built. Requesting provenance is accepted because it makes such a publish traceable, not because it makes it safe.
  *
- * Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
+ * A variable is judged only where something reads it, since npm reads none by name, only through `${NAME}` in an `.npmrc`: `NODE_AUTH_TOKEN` after an `actions/setup-node` step with `registry-url`, whose `.npmrc` refers to it; `NPM_TOKEN` for `semantic-release`, whose npm plugin reads it; and the variables the auth settings (`_authToken`, `_auth`, `_password`) of the `.npmrc` in the working directory refer to.
+ *
+ * Limits: `registry-url` is not reported, because it does not stop the exchange (see the README); an `.npmrc` the file does not show, such as one in the runner's home directory, a Yarn `.yarnrc.yml` and a token set through an `npm_config_` variable are not read; a job that calls a reusable workflow is not read; a publish inside a script file or composite action is not seen; provenance set in a `package.json` other than the one in the working directory is not read; a job is tokenless only when no token variable is non-empty anywhere in the job, so a publish that uses a secret is left alone.
  */
 export declare const workflowCredentials: CheckFunction<WorkflowCredentialsOptions>;
 //#endregion
@@ -1138,7 +1169,7 @@ export declare const workflowCredentials: CheckFunction<WorkflowCredentialsOptio
 /**
  * The jobs that release, deploy and report a required check are ordered so that a failure stops what follows: a release job needs the deploy job, a documentation deploy job needs the release job and checks out the default branch afresh, and one junction job with `if: always()` needs every other job and fails only on `failure` or `cancelled`.
  *
- * Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete.
+ * Jobs are recognised by id (see the options), and a role with no job in a workflow is not judged there. Ordering is judged through the transitive `needs` graph; the junction job must list every job directly, because `needs.*.result` only covers direct needs, except jobs that never run for a pull request or a merge group (an `if` on `github.ref` or `github.event_name` that mentions neither `pull_request` nor `merge_group`, where an `&&` needs one such operand and an `||` needs every operand to be), jobs that need such a job or the junction job itself, and the ids in `junctionExempt`. What the junction job decides on is read as text, with the environment variables its scripts and conditions read replaced by the expressions that set them: it must read the results of its needs (`needs.*.result`, `needs.<job>.result` or `toJSON(needs)`) and name both `'failure'` and `'cancelled'` or test a result for `!= 'success'`, or use the `re-actors/alls-green` action; a result read in a way the text does not show is reported as incomplete. A `!= 'success'` test fails on a skip too, which is reported only for a job an `if` can skip without the junction reading what that `if` reads.
  */
 export declare const workflowJobOrdering: CheckFunction<WorkflowJobOrderingOptions>;
 //#endregion
@@ -1146,9 +1177,13 @@ export declare const workflowJobOrdering: CheckFunction<WorkflowJobOrderingOptio
 /**
  * A workflow that checks pull requests also runs for the merge queue: GitHub starts no run of it for a queued pull request unless the workflow has a `merge_group` trigger, and a required check that never reports blocks the queue.
  *
- * A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged. Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read.
+ * A workflow is taken to produce required checks when it is triggered by `pull_request`; `pull_request_target` is left out, since it runs trusted code against untrusted input and is not a place for required checks. The file cannot show which checks are required, so a `pull_request` workflow whose checks are not required is reported too: narrow the check with `workflows` and `exclude`. A `merge_group` trigger on a workflow with no `pull_request` trigger is not judged.
+ *
+ * Whether the branch has a merge queue is a setting, not something a file shows. Given a GitHub client, the check reads the rules of the branch (`branch`, else the default branch, of `repository`, else the `origin` remote) once it has found a workflow without the trigger, and reports only when a `merge_queue` rule applies, since without a queue no `merge_group` event is ever sent. Offline it cannot tell, so it reports every such workflow.
+ *
+ * Limits: a `merge_group` trigger takes only `branches` filters (`paths` is a filter of `push`, `pull_request` and `pull_request_target`), so a workflow path-filtered for pull requests still runs in the queue once it has the trigger; the `branches` filter of a `merge_group` trigger is not read; only rulesets are read, so a queue configured through classic branch protection is not seen and, with a client, nothing is reported for it.
  */
-export declare const workflowMergeGroup: CheckFunction<WorkflowMergeGroupOptions>;
+export declare const workflowMergeGroup: SettingsAwareCheckFunction<WorkflowMergeGroupOptions>;
 //#endregion
 //#region src/checks/workflow-release-job.d.ts
 /**
@@ -1173,10 +1208,14 @@ export declare const workflowReleaseJob: CheckFunction<WorkflowReleaseJobOptions
 export declare const workflowRepositoryDispatch: CheckFunction<WorkflowRepositoryDispatchOptions>;
 //#endregion
 //#region src/checks/workflow-runner-resolution.d.ts
+/**
+ * The `hostedLabels` used when the options set none: GitHub's own images, `ubuntu`, `windows` and `macos`, as `-latest`, a version, or a version with an architecture or size suffix, and `ubuntu-slim`. Setting `hostedLabels` replaces it, so a workflow that also falls back to a third-party hosted runner extends it: `[...DEFAULT_HOSTED_LABELS, '^blacksmith-']`.
+ */
+export declare const DEFAULT_HOSTED_LABELS: readonly string[];
 /**
  * A self-hosted or custom runner label named literally in more than one job of a workflow is resolved once instead: a resolver job decides the runner and the others read it with `fromJson(needs.<resolver>.outputs.<name>)`. The resolver must have a `timeout-minutes` and its output a literal fallback that names only hosted runner labels, so jobs still get a runner when resolution fails or the self-hosted fleet is down.
  *
- * A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output is taken to have a fallback when its expression has `||` followed by a string literal, and the last such literal is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported.
+ * A label is custom when it matches none of `hostedLabels`; the default patterns recognise GitHub's standard images, so a larger runner is named by a custom label and counts. Labels are compared within a workflow file, not across files. A resolver that is a reusable workflow is followed when it is a file of this repository (the output is traced through `on.workflow_call.outputs` to the job that sets it); a resolver in another repository cannot be read and is not judged. An output's fallback is the first operand after the first of its expression's top-level `||` chain whose value is the same on every run: a string literal, or `format()` of literals and of inputs of the reusable workflow, read from the literal the caller passes or else the input's default. It is read as JSON (a label or a list of labels) and matched against `hostedLabels`; a fallback that is not valid JSON, or names any other label, is reported, and an output with no such operand has no fallback.
  */
 export declare const workflowRunnerResolution: CheckFunction<WorkflowRunnerResolutionOptions>;
 //#endregion
@@ -1234,7 +1273,7 @@ interface RunInput {
   readonly layout: LayoutConfig | undefined;
   readonly configFiles: ConfigFileOptions | undefined;
   /**
-   * The client the settings checks read through; `undefined` when the run is offline.
+   * The client the settings checks, and the checks that refine their judgement with the settings, read through; `undefined` when the run is offline.
    */
   readonly github: GitHubClient | undefined;
   /**
@@ -1430,4 +1469,4 @@ export declare function proveExhaustive(input: {
   readonly compilerOptions?: CompilerOptions;
 }): ExhaustivenessProof;
 //#endregion
-export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };
+export type { AggregateMappersOptions, BranchRules, CaseRemoval, CheckContext, CheckFunction, CheckName, CheckOptionsByName, CheckResult, ChecksConfig, CodecPairsOptions, CommandTypesOptions, CommitTypesOptions, ConformanceConfig, DeployDirectory, DeploySelector, DeployToolAdapter, DeployToolName, DerivedTypesOptions, DerivedTypesPair, DiscoveredPackage, DockerfilePackageManagerOptions, EnginesFloorOptions, EslintOptions, EslintRequiredSeverity, EslintSample, ExhaustivenessProof, GeneratorAdapter, GeneratorName, GitHubCheckContext, GitHubCheckFunction, GitHubClient, GitHubClientOptions, ImportGraphOptions, InstructionSymlinksOptions, Job, LayoutCheckContext, LayoutCheckFunction, MigrationsDirectoryOptions, PermissionAccess, Permissions, PinningLevel, RegisteredCheck, RepositorySettings, RepositorySlug, RunChecksOptions, RunResult, RunsOn, SettingsAwareCheckContext, SettingsAwareCheckFunction, SettingsMergeMethodsOptions, SettingsOptions, SettingsRequiredChecksOptions, SettingsReviewThreadResolutionOptions, SingleStorybookOptions, SourceLocation, Step, TypeErrorReport, UsesReference, Violation, Workflow, WorkflowActionPinningOptions, WorkflowCredentialsOptions, WorkflowJobOrderingOptions, WorkflowMergeGroupOptions, WorkflowReleaseJobOptions, WorkflowRepositoryDispatchOptions, WorkflowRunnerResolutionOptions, WorkflowSelection, WorkflowSkippableJobsOptions, WorkflowUpdateBotCooldownOptions, WorkflowVersionSingleSourceOptions, WorkspacePackage };