simt-dev 0.2.0__py3-none-any.whl

simt_dev/vendored/rules/stacks/python.md

@@ -0,0 +1,48 @@
+---
+simt-id: python
+simt-title: Python
+simt-applies: [python]
+---
+
+# Stack profile: Python
+
+Applies to: `python`. The environment rules — how to invoke tools, and which lockfile
+owns them — are in the `uv` profile, which selects on `has-uv-lock`.
+
+## Invocation
+
+- Run through the repository's own runner: `uv run` where a `uv.lock` is committed,
+  `poetry run` where a `poetry.lock` is, and the repository's documented wrapper
+  otherwise. See the `uv` profile for the form that must not be used.
+- Never invoke a tool from whatever environment the shell happens to have. It will
+  usually be a different copy of the package than the one under test, and the failure
+  it produces looks like a bug in the code.
+
+## Typing
+
+- No `typing.Any`. Accept `unknown`-equivalent types (`object`) at genuinely untrusted
+  boundaries and narrow explicitly.
+- `Mapping` for a read-only parameter, `dict` for a value that is mutated. Returning a
+  concrete `dict` from a function annotated `Mapping` forces a copy on every caller.
+- Every public function annotated. An unannotated signature is a review finding.
+
+## Tests
+
+- `fail_under` is set per repo in `simt-dev.json` (ADR-006). Where a repo requires
+  100 %, treat it as a behavioural gate: an uncovered path is either a missing test
+  or dead code, and both are defects.
+- No `pytest.skip` without a pre-existing written justification.
+- Test the narrowest layer that proves the behaviour; reach for an integration test
+  only when the behaviour is genuinely cross-system.
+
+## Diff hygiene
+
+- `git diff --check` before handoff: no whitespace errors, no conflict markers, no
+  stray debug prints.
+- Generated artifacts (coverage output, build directories, caches) are not committed.
+
+## Async
+
+- `Awaitable` in annotations, never a bare coroutine where an `Awaitable` is the contract.
+- No blocking I/O on the event loop.
+- No unbounded task creation: a fan-out needs a concurrency limit.

simt_dev/vendored/rules/stacks/react-native.md

@@ -0,0 +1,58 @@
+---
+simt-id: react-native
+simt-title: React Native
+# Selected on the runtime, not on the component library. React Native and Expo
+# arrived with the tag `react` and therefore received the React *web* profile —
+# CSS logical properties, a browser matrix, WCAG reflow at 400 % — none of which a
+# native surface has (S28, ADR-047).
+simt-applies: [react-native]
+---
+
+# Stack profile: React Native
+
+Applies to: `react-native` — a `react-native` or `expo` dependency. A repository whose
+UI is rendered in a browser gets the `react-web` profile instead; see that profile for
+the rules this one does not repeat.
+
+## What does not apply here
+
+- **No CSS.** There is no cascade, no `media` query and no logical property. Layout is
+  Yoga; a stylesheet is a `StyleSheet` object. Do not port a web stylesheet.
+- **No DOM and no browser matrix.** No `document`, no `window`, no engine-compatibility
+  run. The platform is native.
+- **No URL as shared state.** Navigation state lives in the navigator; deep links are
+  the one shareable form, and they are read as parameters.
+
+## Platform boundaries
+
+- A native module is a dependency, not a `npm install`. Adding one changes the
+  prebuild output, and the app must be rebuilt to run — `reload` is not enough.
+- Permissions come from the platform manifest (`app.json` / `Info.plist`), not from a
+  runtime prompt a library raises for itself. State the reason string; a bare
+  "allow" teaches nobody anything.
+- Secrets never reach the bundle. A value in JavaScript is a value in the app store's
+  copy of the app.
+
+## Accessibility
+
+- WCAG 2.2 AA where the platform can express it, and the platform's own semantics where
+  it cannot: `accessibilityLabel`, `accessibilityRole` and `accessibilityHint` carry
+  what `alt` and `aria` carry on the web.
+- Respect the OS text size, bold text and reduced-motion settings. A fixed `fontSize`
+  breaks all three.
+- Touch targets meet the platform minimum, and the minimum is asserted rather than
+  eyeballed.
+
+## Types
+
+- `strict` plus the full strictness set. No `any`, no unsafe casts, no non-null
+  boundary bypasses, no floating promises, no `console.*`.
+
+## Testing
+
+- Unit and component tests with `jest` or the repo's declared runner; journeys that
+  cross a real boundary — a deep link, a permission, a native module — are the ones
+  that need a device or an emulator, and they say so.
+- Assert behaviour, not implementation. Never weaken an assertion, an accessibility
+  check or a fixture to match current behaviour.
+- No arbitrary sleeps. No `.only`. No committed `.skip`. No flaky reruns.

simt_dev/vendored/rules/stacks/react-web.md

@@ -0,0 +1,61 @@
+---
+simt-id: react-web
+simt-title: React web
+# Browser evidence only, and the evidence is the renderer. `react` alone does not
+# distinguish a browser app from React Native or Expo — `react-dom` does — and
+# listing the bare language tags (`typescript`, `vitest`, `node-web`, `less`) put
+# this profile on backend and static repositories that share them (S28, ADR-047).
+simt-applies: [react-dom, react-router, maplibre, firebase]
+---
+
+# Stack profile: React web
+
+Applies to: `react-dom`, `react-router`, `maplibre`, `firebase` — a repository whose
+UI is rendered in a browser.
+
+## Types
+
+- `strict` plus the full strictness set listed in the Workers profile. Generated API DTOs only;
+  never hand-write a duplicate of a type the API already produces.
+- No `any`, no unsafe casts, no non-null boundary bypasses, no floating promises, no
+  `console.*`.
+
+## State
+
+- Server state lives in the query layer, keyed by the query key the API defines. Do not mirror
+  it into a second store.
+- URL holds shareable state; component state holds transient state; nothing else.
+- Any global client state pattern requires a recorded decision explaining why the query layer
+  and URL are insufficient.
+
+## CSS
+
+- Logical properties (`margin-inline-start`, `padding-block`) rather than physical ones, so RTL
+  is a consequence of the stylesheet rather than a patch.
+- Semantic element names. A `div` with a click handler is a button.
+- Match tokens from the design system. Raw hex, `rgb()` and `hsl()` are a review finding.
+
+## RTL and localisation
+
+- Arabic mirrors application chrome only. North, coordinate order, geographic pan and zoom,
+  map symbols, media and universal status meaning do not mirror.
+- Every user-visible string exists in every supported locale in the same change. Adding a
+  locale touches tests, which assert locale parity.
+
+## Accessibility
+
+- WCAG 2.2 AA. Keyboard reachable, screen-reader named, 400% reflow without loss of function,
+  `prefers-reduced-motion` honoured.
+- Run a full browser-compatibility matrix only for browser APIs, SSR or hydration, shared
+  layout, MapLibre/WebGL, media, storage, crypto, a known engine divergence, or a release gate.
+  Engine-neutral changes take focused checks.
+
+## Testing
+
+- `vitest` for unit and component; `playwright` for journeys that cross a real boundary.
+- Assert behaviour, not implementation. Never weaken an assertion, an accessibility check or a
+  fixture to match current behaviour.
+- No arbitrary sleeps. No `.only`. No committed `.skip`. No flaky reruns.
+- Inject a sentinel token, UID, text, gender, coordinate, URL and private media value, and
+  prove its absence from unauthorised UI, storage, cache, telemetry, URL history and
+  artifacts.

simt_dev/vendored/rules/stacks/typescript.md

@@ -0,0 +1,21 @@
+---
+simt-id: typescript
+simt-title: TypeScript
+# A fallback, not a specific profile. `select` drops every fallback once any specific
+# profile matches, and `node` is itself a fallback. A specific profile here would
+# suppress `node` on every TypeScript repository, which is the runner rules those
+# repositories are selected for. Two fallbacks both apply when nothing more specific
+# matched.
+simt-applies: [typescript]
+simt-fallback: true
+---
+
+# Stack profile: TypeScript
+
+Applies to: `typescript`, together with the `node` profile when no more specific
+profile matches.
+
+## Types
+
+- No `any`, no unsafe casts, no non-null boundary bypasses, no floating promises, no
+  `console.*` in application code.

simt_dev/vendored/rules/stacks/uv.md

@@ -0,0 +1,32 @@
+---
+simt-id: uv
+simt-title: uv
+# Selected on the lockfile, not on the language. `python` used to carry `uv run` and
+# `uv.lock` in its body while selecting on any Python marker, so a Poetry project was
+# told to run a tool manager it does not use (S28, ADR-047).
+simt-applies: [has-uv-lock]
+---
+
+# Stack profile: uv
+
+Applies to: `has-uv-lock` — a `uv.lock` is committed, here or in a workspace package.
+The language rules are in the `python` profile, which every Python repository gets.
+
+## Invocation
+
+- `uv run -m pytest`. **Never** `uv run pytest`: the console entrypoint can miss the
+  `uv` import path and silently run against the wrong environment, importing a
+  different copy of the package than the one under test.
+- `uv run ruff check src tests` for lint; never a bare `ruff` from a different
+  environment.
+- The same rule in every form: `-m <module>`, never the console script name.
+
+## The lockfile
+
+- Do not run `uv sync` unless explicitly asked. It mutates the lockfile mid-task, and
+  the resulting diff is not yours to review.
+- `uv add` and `uv remove` change `pyproject.toml` and the lockfile together. Never
+  hand-edit one without the other; a lockfile that disagrees with its project is a
+  build that reproduces nothing.
+- `uv.lock` is committed. An uncommitted lockfile means the resolution a CI run
+  performs is not the one the last developer tested.

simt_dev/vendored/src/argv.mjs

@@ -0,0 +1,116 @@
+// Minimal argv parser. Zero dependencies is a hard requirement (ADR: principle 5):
+// a DX tool that needs an install step is a DX tool that fails on a fresh machine.
+//
+// Supported forms:
+//   --flag              boolean
+//   --key value         string
+//   --key=value         string
+//   --no-flag           sets flag false
+//   --                  everything after is positional
+// Anything unrecognised is an error, not a silent ignore: a typo'd gate name
+// that is ignored is worse than a typo'd gate name that fails.
+
+import { EXIT, fail } from './output/index.mjs';
+
+const BOOL_FLAGS = new Set([
+  'json',
+  'all',
+  'dry-run',
+  'yes',
+  'check',
+  'quiet',
+  'plan',
+  'semantic',
+  'mermaid',
+  'help',
+  'version',
+  'accept-conflicts',
+  'list',
+]);
+
+const VALUE_FLAGS = new Set([
+  'budget',
+  'max-bytes',
+  'paths',
+  'skill',
+  'task',
+  'workspace',
+  'root',
+  // skills install: which body of a multi-variant skill, and which source when the
+  // bytes alone do not identify one.
+  'variant',
+  'from',
+  'surfaces',
+]);
+
+/**
+ * @param {string[]} argv raw arguments, excluding node and the script path
+ * @returns {{ok: true, value: object} | {ok: false, code: number}}
+ */
+export function parse(argv) {
+  const flags = {};
+  const positional = [];
+  let passthrough = false;
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+
+    if (passthrough || !arg.startsWith('--')) {
+      positional.push(arg);
+      continue;
+    }
+    if (arg === '--') {
+      passthrough = true;
+      continue;
+    }
+
+    const eq = arg.indexOf('=');
+    const raw = (eq === -1 ? arg : arg.slice(0, eq)).slice(2);
+    const inlineValue = eq === -1 ? undefined : arg.slice(eq + 1);
+
+    if (raw.startsWith('no-')) {
+      const positive = raw.slice(3);
+      if (!BOOL_FLAGS.has(positive)) {
+        return { ok: false, code: usage(`unknown flag --${raw}`) };
+      }
+      flags[camel(positive)] = false;
+      continue;
+    }
+    if (BOOL_FLAGS.has(raw)) {
+      if (inlineValue !== undefined) {
+        return { ok: false, code: usage(`--${raw} takes no value`) };
+      }
+      flags[camel(raw)] = true;
+      continue;
+    }
+    if (VALUE_FLAGS.has(raw)) {
+      const value = inlineValue ?? argv[i + 1];
+      if (value === undefined || (inlineValue === undefined && value.startsWith('--'))) {
+        return { ok: false, code: usage(`--${raw} requires a value`) };
+      }
+      if (inlineValue === undefined) i += 1;
+      if (raw === 'budget' || raw === 'max-bytes') {
+        const n = Number(value);
+        if (!Number.isInteger(n) || n < 0) {
+          return { ok: false, code: usage(`--${raw} must be a non-negative integer, received ${value}`) };
+        }
+        flags[camel(raw)] = n;
+      } else {
+        flags[camel(raw)] = value;
+      }
+      continue;
+    }
+    return { ok: false, code: usage(`unknown flag --${raw}`) };
+  }
+
+  return { ok: true, value: { flags, positional } };
+}
+
+/** `--max-bytes` -> `maxBytes`. Callers use camelCase; users type kebab-case. */
+function camel(name) {
+  return name.replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+}
+
+function usage(message) {
+  return fail(message, EXIT.USAGE);
+}

simt_dev/vendored/src/ci/dependabot.mjs

@@ -0,0 +1,268 @@
+// Dependency updates, as a file a repo owns.
+//
+// The gap this closes is real and dated: no repository in the estate had a
+// Dependabot config, and plan 1 named it as still missing after the CI gate
+// landed. A repo with no Dependabot config does not get security patches as
+// pull requests - it finds out from an advisory.
+//
+// Two decisions are load-bearing, and both come from what this file IS rather
+// than from taste.
+//
+//   - It is a WHOLE FILE, not a region. ADR-025 ruled that a baseline is a
+//     marker-managed region, and that ruling is right for a file whose grammar
+//     has a place to put one. This file has no such place: `updates:` is a YAML
+//     list, and two lists cannot be concatenated. There is no region shape that
+//     means "these entries are mine and those are yours", so there is nothing to
+//     merge and nothing to preserve - which is not an accident to work around but
+//     the reason the ownership question has to be answered differently rather
+//     than the same.
+//
+//   - So it inherits ADR-023's ownership rule wholesale: written once, never
+//     rewritten, their file from the first commit. A repo that wants a different
+//     cadence, a private registry or an `ignore` rule edits it, and the edit
+//     stays. simt-dev's own repository is the ADR-024 exception and is refreshed
+//     by `simt-dev ci`.
+//
+// The content is detection-driven, which is the ADR-013 shape: the ecosystems
+// listed are the ones this tree actually has a manifest for. Writing an `npm`
+// entry into a repo with no `package.json` looks configured and configures
+// nothing - Dependabot finds no manifest and silently opens no pull request,
+// which is the failure mode a generated file is supposed to make impossible.
+//
+// `github-actions` is the one unconditional entry, and it is unconditional
+// because of what this package ships: simt-dev writes a workflow into every
+// repo it adopts (ADR-023), so every repo that adopted it has Actions to
+// watch. A repo with no workflow has no Actions, and is not an entry here.
+
+import { readFile, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { fingerprint } from '../resolve/fingerprint.mjs';
+import { isOwnRepo, WORKFLOWS_DIR } from './workflow.mjs';
+import { CLI } from '../name.mjs';
+
+/** The one file this module writes. */
+export const DEPENDABOT_FILE = '.github/dependabot.yml';
+
+/**
+ * fact -> the `package-ecosystem` value Dependabot documents for it.
+ *
+ * The fact names are already in the fingerprint vocabulary and already carry
+ * evidence, so this table adds no new observation vocabulary: it says which
+ * Dependabot value watches which observable manifest. Facts absent from this
+ * table are not ecosystems Dependabot updates, and adding one is a new ruling
+ * about the estate rather than a code detail.
+ *
+ * Several facts map to one value on purpose. `has-pyproject` and
+ * `has-requirements` are two ways of declaring python dependencies and
+ * Dependabot reads both under `pip`; emitting two `pip` entries would be a
+ * duplicate the config rejects or silently collapses, and the reader would have
+ * no way to tell which one won.
+ *
+ * A `stack` tag is used where no fact exists and one is needed. npm is the
+ * clearest case: `node` is a stack tag in `fingerprint.mjs` and `typescript` is
+ * a dependency name, so a repo's package manager is either of those and adding
+ * `has-node-manifest` would be a third name for one observation - the exact
+ * duplication that table's own header rules out. `gradle` is the same shape:
+ * the stack tag already names the build file. Every other entry below is a
+ * real `has-*` fact.
+ *
+ * `has-build-system` is deliberately NOT mapped: Makefile, CMakeLists and
+ * meson.build are build files, not dependency manifests, and Dependabot has no
+ * ecosystem that reads them. Mapping it to `maven` would be a lie of exactly the
+ * kind the detection-driven ruling exists to prevent.
+ */
+const ECOSYSTEMS = [
+  { stack: 'node', value: 'npm', manifest: 'package.json' },
+  { stack: 'typescript', value: 'npm', manifest: 'package.json' },
+  { fact: 'has-pyproject', value: 'pip', manifest: 'pyproject.toml' },
+  { fact: 'has-requirements', value: 'pip', manifest: 'requirements.txt' },
+  { fact: 'has-go-mod', value: 'gomod', manifest: 'go.mod' },
+  { fact: 'has-cargo-toml', value: 'cargo', manifest: 'Cargo.toml' },
+  { fact: 'has-gemfile', value: 'bundler', manifest: 'Gemfile' },
+  { fact: 'has-composer', value: 'composer', manifest: 'composer.json' },
+  { fact: 'has-maven-pom', value: 'maven', manifest: 'pom.xml' },
+  { fact: 'has-dockerfile', value: 'docker', manifest: 'Dockerfile' },
+  { fact: 'has-compose', value: 'docker-compose', manifest: 'compose file' },
+  { fact: 'has-terraform', value: 'terraform', manifest: '*.tf' },
+  { stack: 'gradle', value: 'gradle', manifest: 'build.gradle' },
+  { fact: 'has-submodules', value: 'gitsubmodule', manifest: '.gitmodules' },
+  { fact: 'has-nuget', value: 'nuget', manifest: '*.csproj' },
+  { fact: 'has-pubspec', value: 'pub', manifest: 'pubspec.yaml' },
+  { fact: 'has-swift-package', value: 'swift', manifest: 'Package.swift' },
+  { fact: 'has-mix', value: 'mix', manifest: 'mix.exs' },
+  { fact: 'has-uv-lock', value: 'uv', manifest: 'uv.lock' },
+  { fact: 'has-bun-lock', value: 'bun', manifest: 'bun.lock' },
+  { fact: 'has-devcontainer', value: 'devcontainers', manifest: 'devcontainer.json' },
+];
+
+/**
+ * The ecosystems this tree has a manifest for, in a stable order.
+ *
+ * The order is the table's, not detection's: `fingerprint` returns arrays built
+ * from sets and file listings, and a config whose entry order changed with
+ * readdir order could not be diffed. Determinism is a feature here - a pull
+ * request that adds a manifest must show one added entry, not a reshuffle.
+ *
+ * @param {Iterable<string>} facts emitted `has-*` facts
+ * @param {Iterable<string>} [stack] emitted stack tags
+ * @returns {{value: string, manifest: string}[]}
+ */
+export function ecosystems(facts, stack = []) {
+  const seenFacts = new Set(facts);
+  const seenStack = new Set(stack);
+  const out = [];
+  for (const row of ECOSYSTEMS) {
+    const found = row.fact ? seenFacts.has(row.fact) : seenStack.has(row.stack);
+    if (!found || out.some((e) => e.value === row.value)) continue;
+    out.push({ value: row.value, manifest: row.manifest });
+  }
+  return out;
+}
+
+/**
+ * The header.
+ *
+ * @param {boolean} own whether this is simt-dev's own repository
+ * @returns {string}
+ */
+function header(own) {
+  if (own) {
+    return `# Written by simt-dev, and refreshed by it. This repository is simt-dev's
+# own, so this file is a copy of the template rather than a repository's own: a diff
+# here means the TEMPLATE changed, not that somebody hand-edited their updates.
+# Anywhere else this file is written once by \`${CLI} init\` and never touched again.
+#
+# To change which ecosystems are watched, change \`src/ci/dependabot.mjs\` in the same
+# commit and run \`${CLI} ci --yes\`. Editing this file by hand works until the
+# next template change overwrites it.
+#
+# The entries below are the ecosystems this repository has a manifest for. A repo
+# that adds a manifest does not get an entry from this tool: \`${CLI} ci\` is the
+# only writer here, so an entry is added deliberately rather than as a side effect.
+`;
+  }
+  return `# Written by simt-dev when this repo was adopted. Yours from here: simt-dev
+# creates this file once and never rewrites it, so your own cadence, ignore rules
+# and groups stay yours.
+#
+# Each entry is a package manager this repo actually has a manifest for, so every
+# one of them opens pull requests. Adding a manifest does not add an entry - the
+# file is yours now, and the entry is a line you write on purpose.
+#
+# To add one: copy any block below, set \`package-ecosystem\` to your package manager,
+# point \`directory\` at the folder holding the manifest, and leave the schedule at
+# weekly unless you have a reason not to.
+`;
+}
+
+/** One `updates:` entry. `directory` is "/" for everything: a monorepo's packages
+ *  live under the root, and Dependabot searches the directory it is given plus its
+ *  subdirectories only when told to with a glob, which is the repo's decision to
+ *  make rather than this tool's. */
+function entry({ value }) {
+  return `  - package-ecosystem: "${value}"
+    directory: "/"
+    schedule:
+      interval: "weekly"`;
+}
+
+/**
+ * The config, as bytes.
+ *
+ * @param {Iterable<string>} facts emitted `has-*` facts for the target repo
+ * @param {{stack?: Iterable<string>, own?: boolean}} [options]
+ * @returns {string} YAML, LF-terminated
+ */
+export function renderDependabot(facts, { stack = [], own = false } = {}) {
+  const found = ecosystems(facts, stack);
+  const entries = [entry({ value: 'github-actions' }), ...found.map(entry)];
+  return `${header(own)}version: 2
+updates:
+${entries.join('\n')}
+`;
+}
+
+/**
+ * What this repo's dependabot file should be, and what should happen to it.
+ *
+ * Mirrors `planWorkflow` deliberately: two files, one ownership rule, one place
+ * that knows it. A reader of `src/commands/ci.mjs` should not have to work out
+ * which of these two files behaves differently.
+ *
+ * @param {string} root repo root
+ * @returns {Promise<{file:string, path:string, action:'create'|'refresh'|'unchanged'|'skip',
+ *                    own:boolean, exists:boolean, bytes:number, current:boolean,
+ *                    workflows:boolean, ecosystems:string[], reason:string|null}>}
+ */
+export async function planDependabot(root) {
+  const path = join(root, DEPENDABOT_FILE);
+  const own = isOwnRepo(root);
+  let text = null;
+  try {
+    text = await readFile(path, 'utf8');
+  } catch {
+    text = null;
+  }
+  const exists = text !== null;
+  const bytes = exists ? Buffer.byteLength(text) : 0;
+
+  // ENOENT is absence; anything else is a file this tool cannot read, and calling
+  // that "create" hands the writer an EACCES instead of saying what is wrong.
+  let workflows = false;
+  try {
+    workflows = (await stat(join(root, WORKFLOWS_DIR))).isDirectory();
+  } catch {
+    workflows = false;
+  }
+
+  // Detection runs even when the file exists, because the refresh comparison needs
+  // the bytes this repo would get today. Skipping it would make `refresh` mean
+  // "the file differs" instead of "the file differs from what this repo should get",
+  // and those are different questions when a manifest appeared since.
+  const { facts, stack } = await fingerprint(root);
+  const watched = ecosystems(facts, stack).map((e) => e.value);
+  // Carried on the plan so the writer renders from the same observation this
+  // comparison used. Re-detecting at write time would make `ci` and `check`
+  // disagree whenever a manifest appeared between the two calls, and the file
+  // would be written from facts nobody ever saw in the plan.
+  const detection = { facts, stack };
+
+  if (exists) {
+    // Both sides of the comparison, for the same reason as the workflow plan: a reader
+    // told the file differs can be shown how, and re-rendering for a diff would let
+    // the two answers disagree.
+    const desired = renderDependabot(facts, { stack, own: true });
+    const current = own ? text === desired : true;
+    return {
+      file: DEPENDABOT_FILE,
+      path,
+      action: current ? 'unchanged' : 'refresh',
+      own,
+      exists,
+      bytes,
+      current,
+      source: { text, desired },
+      workflows,
+      ecosystems: watched,
+      ...detection,
+      reason: current ? null : `this repository is simt-dev's own, and the dependabot template has changed since this copy was written`,
+    };
+  }
+  return {
+    file: DEPENDABOT_FILE,
+    path,
+    action: workflows || own ? 'create' : 'skip',
+    own,
+    exists,
+    bytes,
+    current: false,
+    workflows,
+    ecosystems: watched,
+    ...detection,
+    reason:
+      workflows || own
+        ? null
+        : `no ${WORKFLOWS_DIR} directory, so this repo does not run GitHub Actions yet`,
+  };
+}