code-standards 8.150.0__tar.gz → 8.151.0__tar.gz

{code_standards-8.150.0 → code_standards-8.151.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: code-standards
-Version: 8.150.0
+Version: 8.151.0
 Summary: One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy.
 Project-URL: Homepage, https://code-standards.sarj.ai/
 Project-URL: Documentation, https://code-standards.sarj.ai/cli/
@@ -30,10 +30,10 @@ Requires-Dist: pyyaml==6.0.3
 Requires-Dist: referencing==0.37.0
 Requires-Dist: repo-standards==6.14.0
 Requires-Dist: ruff==0.17.2
-Requires-Dist: sarj-iac-lint==0.30.3
-Requires-Dist: sarj-python-lint==1.85.0
-Requires-Dist: sarj-rule-contracts==0.4.2
-Requires-Dist: sarj-sql-lint==0.31.0
+Requires-Dist: sarj-iac-lint==0.31.0
+Requires-Dist: sarj-python-lint==1.88.0
+Requires-Dist: sarj-rule-contracts==0.5.0
+Requires-Dist: sarj-sql-lint==0.33.0
 Requires-Dist: shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')
 Requires-Dist: typer==0.27.3
 Description-Content-Type: text/markdown
@@ -105,6 +105,8 @@ Unused private Python test helpers require `reportUnusedFunction` set to `warnin
 
 `check --jobs 2` overlaps native analysis with the external-tool pipeline. The default is `--jobs 1`; external tools remain sequential and report ordering is deterministic.
 
+Public Python suggested edits retain `expected_source_hash`, the lowercase SHA-256 digest of the exact captured source bytes, alongside `expected_text_hash` for the replaced slice. Use `to_json(report, include_fix_source_hashes=True)` or the same keyword on report, diagnostic, fix or edit `as_dict` to emit `expectedSourceHash`. The default JSON output is unchanged. Opted-in JSON requires the updated bundled `analysis.schema.json`; older strict v1 schemas reject the added field. This provenance does not apply edits or validate a current file, and SARIF output is unchanged.
+
 DevOps execution blocks may sequence existing commands without helper scripts. Keep interpreter source, control flow, logical chains, pipelines and substitutions in independently linted files; Python `-m` and script paths, and jq/awk `-f` files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks YAML and JSON for unique IDs, ordered step dependencies, script/argv exclusivity and untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts. JSON configs are discovered in operational directories or with `cloudbuild` in their filename; JSON syntax must be strict, with unique keys and finite numbers. Files named with `cloudbuild`, and Build-shaped files under a `cloudbuild` directory, use the bundled, digest-verified Google Build v1 field schema for field names, types, enums and protobuf durations/integers. The offline schema rejects output-only fields; trigger expansion, resource access and hosted admission require the deployment environment.
 
 The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs. Declare `compose_projects = [["base.yaml", "overlays/production.yaml"]]` in `[devops]` to validate custom filenames and overlays in invocation order. Selecting any member checks the whole project; declared fragments are not checked independently. Undeclared conventional filenames remain standalone projects. Missing inputs and native field errors fail coverage. Source checks use Compose's partially resolved model; full consistency requires the actual deployment environment.

{code_standards-8.150.0 → code_standards-8.151.0}/README.md

@@ -65,6 +65,8 @@ Unused private Python test helpers require `reportUnusedFunction` set to `warnin
 
 `check --jobs 2` overlaps native analysis with the external-tool pipeline. The default is `--jobs 1`; external tools remain sequential and report ordering is deterministic.
 
+Public Python suggested edits retain `expected_source_hash`, the lowercase SHA-256 digest of the exact captured source bytes, alongside `expected_text_hash` for the replaced slice. Use `to_json(report, include_fix_source_hashes=True)` or the same keyword on report, diagnostic, fix or edit `as_dict` to emit `expectedSourceHash`. The default JSON output is unchanged. Opted-in JSON requires the updated bundled `analysis.schema.json`; older strict v1 schemas reject the added field. This provenance does not apply edits or validate a current file, and SARIF output is unchanged.
+
 DevOps execution blocks may sequence existing commands without helper scripts. Keep interpreter source, control flow, logical chains, pipelines and substitutions in independently linted files; Python `-m` and script paths, and jq/awk `-f` files remain supported. SARJ310 is an error, including short inline programs. Cloud Build SARJ315 checks YAML and JSON for unique IDs, ordered step dependencies, script/argv exclusivity and untrusted substitutions in shell source; pass substitutions as quoted arguments to external scripts. JSON configs are discovered in operational directories or with `cloudbuild` in their filename; JSON syntax must be strict, with unique keys and finite numbers. Files named with `cloudbuild`, and Build-shaped files under a `cloudbuild` directory, use the bundled, digest-verified Google Build v1 field schema for field names, types, enums and protobuf durations/integers. The offline schema rejects output-only fields; trigger expansion, resource access and hosted admission require the deployment environment.
 
 The source gate uses pinned actionlint, shared ShellCheck, offline Zizmor, Hadolint and Skaffold v4beta7 schema validation. Every selected `action.yml`/`action.yaml` uses GitHub's pinned action parser and converter offline, including composite steps, expression syntax and available contexts, runtime requirements, step IDs and action-reference forms. This uses the core Node runtime and needs no referencing workflow, consumer npm setup or security capability. Cloud Deploy validation is a documented partial structural contract. Terraform validation and TFLint require explicit repository trust and prepared local providers; analysis never initializes or downloads them. Compose requires an exact consumer `[devops].compose_version`; its source check does not resolve environment inputs. Declare `compose_projects = [["base.yaml", "overlays/production.yaml"]]` in `[devops]` to validate custom filenames and overlays in invocation order. Selecting any member checks the whole project; declared fragments are not checked independently. Undeclared conventional filenames remain standalone projects. Missing inputs and native field errors fail coverage. Source checks use Compose's partially resolved model; full consistency requires the actual deployment environment.

{code_standards-8.150.0 → code_standards-8.151.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "code-standards"
-version = "8.150.0"
+version = "8.151.0"
 description = "One deterministic quality gate for Sarj Python, TypeScript, Swift, Kotlin, shell, SQL, IaC, and repository policy."
 readme = "README.md"
 requires-python = ">=3.14"
@@ -17,7 +17,7 @@ classifiers = [
   "Topic :: Software Development :: Quality Assurance",
 ]
 dependencies = [
-  "sarj-rule-contracts==0.4.2",
+  "sarj-rule-contracts==0.5.0",
   "pathspec==1.1.1",
   "basedpyright==1.40.2",
   "deptry==0.25.1",
@@ -31,9 +31,9 @@ dependencies = [
   "repo-standards==6.14.0",
   "ruff==0.17.2",
   "shellcheck-py==0.11.0.1; (sys_platform == 'darwin' and platform_machine == 'arm64') or (sys_platform == 'darwin' and platform_machine == 'x86_64') or (sys_platform == 'linux' and platform_machine == 'x86_64') or (sys_platform == 'win32' and platform_machine == 'AMD64')",
-  "sarj-iac-lint==0.30.3",
-  "sarj-python-lint==1.85.0",
-  "sarj-sql-lint==0.31.0",
+  "sarj-iac-lint==0.31.0",
+  "sarj-python-lint==1.88.0",
+  "sarj-sql-lint==0.33.0",
   "typer==0.27.3",
 ]
 

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/api.py

@@ -56,6 +56,7 @@ from .libs.diagnostics import (
 from .libs.filesystem import is_link_like
 from .libs.linting.analysis import analyze as analyze_paths, report_from_tools
 from .libs.linting.complexity_baseline import ComplexityBaselineResolver
+from .libs.linting.execution_plan import analysis_jobs
 from .libs.linting.external import UpstreamESLintRules, analyze_external
 from .libs.linting.library_policy import (
     ManifestPolicyError,
@@ -137,6 +138,17 @@ class Result:
     changes: tuple[Change, ...] = ()
     exit_code: int = 0
 
+    def __post_init__(self) -> None:
+        if type(self.status) is not Status:
+            msg = "result status must be a Status"
+            raise TypeError(msg)
+        if isinstance(self.exit_code, bool) or not isinstance(self.exit_code, int):  # pyright: ignore[reportUnnecessaryIsInstance] -- validate untyped public constructor and dataclass replacement calls as well as typed callers.
+            msg = "result exit code must be an integer"
+            raise TypeError(msg)
+        if (self.status in {Status.OK, Status.CHANGED}) != (self.exit_code == 0):
+            msg = "result status and exit code must agree on success"
+            raise ValueError(msg)
+
     @property
     def ok(self) -> bool:
         return self.exit_code == 0
@@ -269,10 +281,9 @@ class Standards:
     ) -> AnalysisReport:
         try:
             import_context = initial_import.load(self.root, staged=staged)
+            analysis_jobs(jobs)
         except ValueError as exc:
             return _failed_analysis(self.root, "invalid-input", str(exc))
-        if jobs not in {1, 2}:
-            return _failed_analysis(self.root, "invalid-input", "analysis jobs must be 1 or 2")
         external = external or bool(upstream_rules.ids)
         try:
             normalized_trust = TrustMode(trust)
@@ -300,7 +311,7 @@ class Standards:
         try:
             selection_policy = _selection_policy(self.root, adopted, normalized_mode)
             rule_selection = _rule_selection(rules)
-            selected = _analysis_inputs(self.root, paths, mode=normalized_mode)
+            selected = _analysis_inputs(self.root, paths, adopted=adopted, mode=normalized_mode)
         except (OSError, TypeError, ValueError) as exc:
             return _failed_analysis(self.root, "invalid-input", str(exc))
         try:
@@ -512,7 +523,8 @@ class Standards:
             )
             return Result(Status.FAILED, findings=(finding,), exit_code=1)
         finding = Finding("update.latest.failed", "error", output or "latest standards update failed")
-        return Result(Status.FAILED, findings=(finding,), exit_code=completed.returncode)
+        status = Status.INTERRUPTED if completed.returncode == _INTERRUPTED_EXIT else Status.FAILED
+        return Result(status, findings=(finding,), exit_code=completed.returncode)
 
     def inspect(self) -> Inspection:
         return inspect(self.root)
@@ -823,13 +835,14 @@ def _with_coverage(report: AnalysisReport, coverage: Sequence[CoverageNotice]) -
     return AnalysisReport(report.root, completion, conclusion, report.tools, notices)
 
 
-def _analysis_inputs(root: Path, paths: Sequence[str] | None, *, mode: AnalysisMode = AnalysisMode.POLICY) -> list[str]:
+def _analysis_inputs(
+    root: Path, paths: Sequence[str] | None, *, adopted: Manifest | None, mode: AnalysisMode
+) -> list[str]:
     if paths is not None:
         selected = _contained_paths(root, paths)
         return selected if mode is AnalysisMode.RAW else _with_tracked_terraform_tests(root, selected)
     if mode is AnalysisMode.RAW:
         return [str(root)]
-    adopted = load_manifest(root)
     verify_paths = adopted.verify_paths if adopted is not None else (".",)
     return _with_tracked_terraform_tests(root, [str(root / path) for path in verify_paths])
 

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/configs/cli-reference.v1.json

@@ -3316,6 +3316,6 @@
   },
   "program": "code-standards",
   "schemaVersion": 1,
-  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.150.0).",
-  "version": "8.150.0"
+  "summary": "Adopt, check, fix, diagnose, and update sarj-ai standards (v8.151.0).",
+  "version": "8.151.0"
 }

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/adoption/devops.py

@@ -12,7 +12,7 @@ from .doctor import Finding
 if TYPE_CHECKING:
     from collections.abc import Sequence
 
-    from sarj_standards.libs.linting.external import ProcessRunner
+    from sarj_standards.libs.linting.external import ProcessExecutor
 
     from .lifecycle import Command
 
@@ -133,9 +133,9 @@ def install_commands(
     return tuple(commands)
 
 
-def health_findings(root: Path, files: Sequence[Path], *, runner: ProcessRunner | None = None) -> tuple[Finding, ...]:
+def health_findings(root: Path, files: Sequence[Path], *, runner: ProcessExecutor | None = None) -> tuple[Finding, ...]:
     from sarj_standards.libs.linting.devops_tools import TOOLS, checked_tool  # ruff: ignore[import-outside-top-level] -- read-only doctor checks start after adoption modules initialize.
-    from sarj_standards.libs.linting.external import run_process  # ruff: ignore[import-outside-top-level] -- reuse bounded native runner.
+    from sarj_standards.libs.linting.external import DEFAULT_EXECUTOR  # ruff: ignore[import-outside-top-level] -- reuse bounded native runner.
 
     from .doctor import Finding, Level  # ruff: ignore[import-outside-top-level] -- doctor record boundary avoids recursive module imports.
 
@@ -155,7 +155,7 @@ def health_findings(root: Path, files: Sequence[Path], *, runner: ProcessRunner
             checked_tool(
                 name,
                 root=root,
-                runner=run_process if runner is None else runner,
+                runner=DEFAULT_EXECUTOR if runner is None else runner,
                 expected_version=adopted.compose_version if name == "docker" else None,
             )
         except (OSError, ValueError, subprocess.SubprocessError) as error:

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/diagnostics/analysis.schema.json

@@ -64,7 +64,8 @@
       "properties": {
         "location": { "$ref": "#/$defs/location" },
         "replacement": { "type": "string" },
-        "expectedTextHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+        "expectedTextHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" },
+        "expectedSourceHash": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
       }
     },
     "fix": {

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/diagnostics/models.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from enum import StrEnum
 from hashlib import sha256
 from pathlib import Path, PureWindowsPath
@@ -98,6 +98,7 @@ class _TextEditData(TypedDict):
     location: _LocationData
     replacement: str
     expectedTextHash: NotRequired[str]
+    expectedSourceHash: NotRequired[str]
 
 
 class _FixData(TypedDict):
@@ -289,6 +290,7 @@ class TextEdit:
     location: Location
     replacement: str
     expected_text_hash: str | None = None
+    expected_source_hash: str | None = field(default=None, kw_only=True)
 
     def __post_init__(self) -> None:
         _require_instance(self.location, Location, "text edit location")
@@ -297,17 +299,17 @@ class TextEdit:
             raise ValueError(msg)
         _require_text(self.replacement, "text edit replacement", allow_empty=True)
         if self.expected_text_hash is not None:
-            _require_text(self.expected_text_hash, "expected text hash")
-            if len(self.expected_text_hash) != _SHA256_HEX_LENGTH or any(
-                char not in "0123456789abcdef" for char in self.expected_text_hash
-            ):
-                msg = "expected text hash must be a lowercase SHA-256 digest"
-                raise ValueError(msg)
+            _require_sha256(self.expected_text_hash, "expected text hash")
+        if self.expected_source_hash is not None:
+            _require_sha256(self.expected_source_hash, "expected source hash")
 
-    def as_dict(self) -> _TextEditData:
+    def as_dict(self, *, include_fix_source_hashes: bool = False) -> _TextEditData:
+        _require_instance(include_fix_source_hashes, bool, "include fix source hashes")
         result: _TextEditData = {"location": self.location.as_dict(), "replacement": self.replacement}
         if self.expected_text_hash is not None:
             result["expectedTextHash"] = self.expected_text_hash
+        if include_fix_source_hashes and self.expected_source_hash is not None:
+            result["expectedSourceHash"] = self.expected_source_hash
         return result
 
 
@@ -340,9 +342,15 @@ class Fix:
             ):
                 msg = "fix edits must not overlap"
                 raise ValueError(msg)
+        _require_matching_edit_sources(self.edits)
 
-    def as_dict(self) -> _FixData:
-        return {"title": self.title, "safety": self.safety.value, "edits": [edit.as_dict() for edit in self.edits]}
+    def as_dict(self, *, include_fix_source_hashes: bool = False) -> _FixData:
+        _require_instance(include_fix_source_hashes, bool, "include fix source hashes")
+        return {
+            "title": self.title,
+            "safety": self.safety.value,
+            "edits": [edit.as_dict(include_fix_source_hashes=include_fix_source_hashes) for edit in self.edits],
+        }
 
 
 @dataclass(frozen=True, slots=True)
@@ -405,7 +413,8 @@ class Diagnostic:
         if self.fingerprint is not None:
             _require_text(self.fingerprint, "diagnostic fingerprint")
 
-    def as_dict(self) -> _DiagnosticData:
+    def as_dict(self, *, include_fix_source_hashes: bool = False) -> _DiagnosticData:
+        _require_instance(include_fix_source_hashes, bool, "include fix source hashes")
         result: _DiagnosticData = {
             "code": self.code,
             "message": self.message,
@@ -425,7 +434,7 @@ class Diagnostic:
         if self.notes:
             result["notes"] = list(self.notes)
         if self.fixes:
-            result["fixes"] = [item.as_dict() for item in self.fixes]
+            result["fixes"] = [item.as_dict(include_fix_source_hashes=include_fix_source_hashes) for item in self.fixes]
         if self.tags:
             result["tags"] = list(self.tags)
         if self.fingerprint is not None:
@@ -581,7 +590,8 @@ class AnalysisReport:
     def ok(self) -> bool:
         return self.exit_code == 0
 
-    def as_dict(self) -> _AnalysisReport:
+    def as_dict(self, *, include_fix_source_hashes: bool = False) -> _AnalysisReport:
+        _require_instance(include_fix_source_hashes, bool, "include fix source hashes")
         rules: dict[str, RuleDescriptor] = {}
         for item in self.diagnostics:
             key = f"{item.source}:{item.rule_id or item.code}"
@@ -599,7 +609,9 @@ class AnalysisReport:
             "conclusion": self.conclusion.value,
             "exitCode": self.exit_code,
             "rules": [rules[key].as_dict() for key in sorted(rules)],
-            "diagnostics": [item.as_dict() for item in self.diagnostics],
+            "diagnostics": [
+                item.as_dict(include_fix_source_hashes=include_fix_source_hashes) for item in self.diagnostics
+            ],
             "issues": [item.as_dict() for item in self.issues],
             "tools": [item.as_dict() for item in self.tools],
             "coverage": [item.as_dict() for item in self.coverage],
@@ -628,6 +640,18 @@ def _edit_key(edit: TextEdit) -> _EditKey:
     return _EditKey(edit.location.path, region.start.byte_offset, region.end.byte_offset)
 
 
+def _require_matching_edit_sources(edits: tuple[TextEdit, ...]) -> None:
+    source_hashes: dict[str, str] = {}
+    for edit in edits:
+        digest = edit.expected_source_hash
+        if digest is None:
+            continue
+        path = edit.location.path
+        if source_hashes.setdefault(path, digest) != digest:
+            msg = f"fix edits for {path} must refer to the same source revision"
+            raise ValueError(msg)
+
+
 def _validate_help_url(value: str | None) -> None:
     if value is None:
         return
@@ -660,6 +684,13 @@ def _require_text(value: object, label: str, *, allow_empty: bool = False) -> No
         raise ValueError(msg)
 
 
+def _require_sha256(value: str, label: str) -> None:
+    _require_text(value, label)
+    if len(value) != _SHA256_HEX_LENGTH or any(char not in "0123456789abcdef" for char in value):
+        msg = f"{label} must be a lowercase SHA-256 digest"
+        raise ValueError(msg)
+
+
 def _require_int(value: int, label: str) -> None:
     if type(value) is not int:
         msg = f"{label} must be an integer"

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/diagnostics/serialize.py

@@ -25,8 +25,11 @@ class _DiagnosticPriority(NamedTuple):
 _GITHUB_ANNOTATION_LIMIT = 10
 
 
-def to_json(report: AnalysisReport, *, indent: int | None = 2) -> str:
-    return json.dumps(report.as_dict(), indent=indent, sort_keys=True) + "\n"
+def to_json(report: AnalysisReport, *, indent: int | None = 2, include_fix_source_hashes: bool = False) -> str:
+    return (
+        json.dumps(report.as_dict(include_fix_source_hashes=include_fix_source_hashes), indent=indent, sort_keys=True)
+        + "\n"
+    )
 
 
 def to_sarif(report: AnalysisReport) -> str:

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/diagnostics/source.py

@@ -7,6 +7,8 @@ from pathlib import Path
 import re
 from typing import TYPE_CHECKING, NamedTuple
 
+from sarj_rule_contracts import SourceSnapshot
+
 from .models import Position, Region
 
 
@@ -28,7 +30,7 @@ class SourceDocument:
     _lines: tuple[str, ...] = field(init=False, repr=False)
     _line_byte_offsets: tuple[int, ...] = field(init=False, repr=False)
     _byte_length: int = field(init=False, repr=False)
-    _utf16_indexes: dict[int, _Utf16Index] = field(init=False, repr=False)
+    _utf16_indexes: dict[int, _Utf16Index] = field(init=False, repr=False, compare=False)
 
     def __post_init__(self) -> None:
         lines = tuple(re.findall(r".*?(?:\r\n|\r|\n)|.+\Z", self.text, flags=re.DOTALL)) or ("",)
@@ -46,7 +48,11 @@ class SourceDocument:
 
     @classmethod
     def read(cls, path: Path) -> Self:
-        return cls(path, path.read_bytes().decode("utf-8", errors="surrogateescape"))
+        return cls.from_snapshot(SourceSnapshot.read(path))
+
+    @classmethod
+    def from_snapshot(cls, snapshot: SourceSnapshot) -> Self:
+        return cls(snapshot.path, snapshot.decode("utf-8", errors="surrogateescape").text)
 
     def point(self, *, line: int, column: int) -> Position | None:
         if line < 1 or column < 1 or line > len(self._lines):

{code_standards-8.150.0 → code_standards-8.151.0}/src/sarj_standards/libs/linting/action_metadata.py

@@ -22,11 +22,11 @@ from sarj_standards.libs.diagnostics import (
     ToolReport,
 )
 from sarj_standards.libs.filesystem import read_prefix
-from sarj_standards.libs.linting.external import run_process
+from sarj_standards.libs.linting.external import DEFAULT_EXECUTOR, process_request
 
 
 if TYPE_CHECKING:
-    from sarj_standards.libs.linting.external import ProcessRunner
+    from sarj_standards.libs.linting.external import ProcessExecutor
 
 _SHA256 = "7408ae0434ecd92441b1bd32a267e181231493e3f8319ad94655fa781c8ba26a"
 _MAX_SOURCE_BYTES = 2 * 1024 * 1024
@@ -55,7 +55,7 @@ class _Results(RootModel[list[_Result]]):
 
 
 def analyze_actions(
-    *, root: Path, paths: tuple[str, ...], runner: ProcessRunner = run_process
+    *, root: Path, paths: tuple[str, ...], runner: ProcessExecutor = DEFAULT_EXECUTOR
 ) -> tuple[ToolReport, ...]:
     selected = tuple(dict.fromkeys(name for name in paths if Path(name).name in {"action.yml", "action.yaml"}))
     if not selected:
@@ -73,7 +73,7 @@ def analyze_actions(
         )
 
 
-def _analyze_selected(root: Path, selected: tuple[str, ...], *, runner: ProcessRunner) -> tuple[ToolReport, ...]:
+def _analyze_selected(root: Path, selected: tuple[str, ...], *, runner: ProcessExecutor) -> tuple[ToolReport, ...]:
     reports: list[ToolReport] = []
     documents: dict[str, SourceDocument] = {}
     size = 0
@@ -105,7 +105,7 @@ def _document(root: Path, name: str) -> SourceDocument:
 
 
 def _analyze_batch(
-    root: Path, documents: dict[str, SourceDocument], *, runner: ProcessRunner
+    root: Path, documents: dict[str, SourceDocument], *, runner: ProcessExecutor
 ) -> tuple[ToolReport, ...]:
     bundle = CONFIGS_DIR / "action-parser.cjs"
     if hashlib.sha256(bundle.read_bytes()).hexdigest() != _SHA256:
@@ -120,7 +120,7 @@ def _analyze_batch(
             encoding="utf-8",
         )
         argv = (str(node), str(bundle), str(source))
-        output = run_process(argv, cwd=root, timeout_seconds=30) if runner is run_process else runner(argv, cwd=root)
+        output = runner.run(process_request(argv, cwd=root, timeout_seconds=30))
     if output.returncode:
         message = f"GitHub action parser failed: {output.stderr.strip()[-_MAX_FAILURE_CHARS:]}"
         raise ValueError(message)