From a8dd9235ae0c9f2b5498af462861d528750b26b3 Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:38:00 +0200 Subject: [PATCH 1/9] chore: add effx review workflow --- .github/workflows/effx-analyze.yml | 71 ++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/effx-analyze.yml diff --git a/.github/workflows/effx-analyze.yml b/.github/workflows/effx-analyze.yml new file mode 100644 index 0000000..d061717 --- /dev/null +++ b/.github/workflows/effx-analyze.yml @@ -0,0 +1,71 @@ +name: effx analyze + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +permissions: + contents: read + +jobs: + analyze: + runs-on: ubuntu-latest + steps: + - name: Check out pull request without credentials + uses: actions/checkout@v4 + with: + persist-credentials: false + - name: Check out immutable effx tool revision + uses: actions/checkout@v4 + with: + repository: phibkro/oxlint-effect-plugin + ref: 0e41f6bb73c3e9aba2df75e32ff77da214452497 + path: .effx-tool + persist-credentials: false + - name: Install the reviewed effx tool + working-directory: .effx-tool + run: | + bun install --frozen-lockfile --ignore-scripts + bun run build + - name: Create repository-independent EffectTS configuration + run: | + cat > .effx-oxlintrc.json <<'JSON' + { + "jsPlugins": [{ "name": "effect", "specifier": "./.effx-tool/dist/index.js" }], + "ignorePatterns": [".effx-tool/**", "node_modules/**", "dist/**", "build/**", "coverage/**", ".git/**"], + "rules": { + "effect/no-ambient-console": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-ambient-authority": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-cross-runtime": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-premature-execution": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-native-promise-control-flow": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-raw-json-parse": ["error", { "role": "effect-library", "platform": "portable", "boundaries": ["external-data"] }], + "effect/no-untyped-throw": ["error", { "role": "effect-library", "platform": "portable" }], + "effect/no-opaque-instance-fields": ["error", { "role": "effect-library", "platform": "portable" }] + } + } + JSON + - name: Run Oxlint with structured output + run: | + set +e + .effx-tool/node_modules/.bin/oxlint --config .effx-oxlintrc.json --format json . > effx-oxlint.json + status=$? + set -e + test -s effx-oxlint.json + test "$status" -le 1 + - name: Translate diagnostics + run: .effx-tool/dist/cli.js translate < effx-oxlint.json > effx-diagnostics.json + - name: Build immutable publication input + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} + EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: bun run .effx-tool/scripts/build-github-input.ts effx-diagnostics.json > effx-input.json + - name: Upload decoded analysis result + uses: actions/upload-artifact@v4 + with: + name: effx-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} + path: effx-input.json + if-no-files-found: error + retention-days: 7 From 6046a4b44b14a7dbb7e6496f0da85c48dbb8c3fe Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:38:02 +0200 Subject: [PATCH 2/9] chore: add effx review workflow --- .github/workflows/effx-publish.yml | 55 ++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 .github/workflows/effx-publish.yml diff --git a/.github/workflows/effx-publish.yml b/.github/workflows/effx-publish.yml new file mode 100644 index 0000000..36b6ea4 --- /dev/null +++ b/.github/workflows/effx-publish.yml @@ -0,0 +1,55 @@ +name: effx publish + +on: + workflow_run: + workflows: ["effx analyze"] + types: [completed] + +permissions: + actions: read + checks: write + contents: read + pull-requests: write + +jobs: + publish: + if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' + runs-on: ubuntu-latest + steps: + - name: Check out immutable effx tool revision + uses: actions/checkout@v4 + with: + repository: phibkro/oxlint-effect-plugin + ref: 0e41f6bb73c3e9aba2df75e32ff77da214452497 + path: .effx-tool + persist-credentials: false + - name: Download unprivileged analysis artifact + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + RUN_ID: ${{ github.event.workflow_run.id }} + run: gh run download "$RUN_ID" --repo "$GH_REPO" --dir .effx-input + - name: Select and verify immutable analysis input + env: + EXPECTED_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} + run: | + input="$(find .effx-input -name effx-input.json -type f -print -quit)" + test -n "$input" + test "$(find .effx-input -name effx-input.json -type f | wc -l)" -eq 1 + test "$(jq -r '.expectedHeadSha' "$input")" = "$EXPECTED_HEAD_SHA" + test "$(jq -r '.observedHeadSha' "$input")" = "$EXPECTED_HEAD_SHA" + cp "$input" .effx-input.json + - name: Install the reviewed effx tool + working-directory: .effx-tool + run: | + bun install --frozen-lockfile --ignore-scripts + bun run build + - name: Produce fail-closed publication plan + run: .effx-tool/dist/cli.js github plan < .effx-input.json > .effx-plan.json + - name: Publish canonical Check and review comments + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + EXPECTED_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} + PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + run: bun run .effx-tool/scripts/publish-github-plan.ts .effx-plan.json From 4e2e741cbbcd47dd27a0ffe4ceb53d097dfc4b18 Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:38:03 +0200 Subject: [PATCH 3/9] chore: add effx migration guidance --- docs/effx-migration-guide.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 docs/effx-migration-guide.md diff --git a/docs/effx-migration-guide.md b/docs/effx-migration-guide.md new file mode 100644 index 0000000..18d4aee --- /dev/null +++ b/docs/effx-migration-guide.md @@ -0,0 +1,18 @@ +# effx migration review + +Classification: `agent-migration-opt-in-required` + +This repository declares an Effect release outside the exact reviewed effx release `4.0.0-beta.107`. The pull request adds the two-stage effx review integration, but it does not change dependencies or application source. + +## Required migration review + +1. Review every Effect-family dependency against `4.0.0-beta.107`. +2. Supply exact reviewed targets for every `@effect/*` package. Do not guess package versions. +3. Run this repository's package-manager, type, lint, and test checks. +4. Opt in explicitly before an agent changes application source. + +## Limits + +- No mechanical migration was proven safe from the observed dependency declarations. +- The integration performs syntax and scope enforcement. Effect-specific typed diagnostics remain owned by `@effect/tsgo`. +- The publication workflow uses only artifacts from the unprivileged analysis workflow and binds publication to the immutable pull-request head SHA. From 59f0ebec1dbb2ee849b28064f284dbb44ca0029e Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:41:35 +0200 Subject: [PATCH 4/9] fix: pin exact effx source revision --- .github/workflows/effx-analyze.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/effx-analyze.yml b/.github/workflows/effx-analyze.yml index d061717..ced4d5d 100644 --- a/.github/workflows/effx-analyze.yml +++ b/.github/workflows/effx-analyze.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@v4 with: repository: phibkro/oxlint-effect-plugin - ref: 0e41f6bb73c3e9aba2df75e32ff77da214452497 + ref: 0e41f6b05b08f7ecfd91c7e55e77e98d8b650b02 path: .effx-tool persist-credentials: false - name: Install the reviewed effx tool From a5f23a23f7ffc718b66a095a4d5d67be69b3e18e Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:41:36 +0200 Subject: [PATCH 5/9] fix: pin exact effx source revision --- .github/workflows/effx-publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/effx-publish.yml b/.github/workflows/effx-publish.yml index 36b6ea4..0f3cfee 100644 --- a/.github/workflows/effx-publish.yml +++ b/.github/workflows/effx-publish.yml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@v4 with: repository: phibkro/oxlint-effect-plugin - ref: 0e41f6bb73c3e9aba2df75e32ff77da214452497 + ref: 0e41f6b05b08f7ecfd91c7e55e77e98d8b650b02 path: .effx-tool persist-credentials: false - name: Download unprivileged analysis artifact From c7e0d28b9e4f443ac57268b5e92b42c87008e19c Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:42:42 +0200 Subject: [PATCH 6/9] fix: provision Bun for effx review --- .github/workflows/effx-analyze.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/effx-analyze.yml b/.github/workflows/effx-analyze.yml index ced4d5d..4396eda 100644 --- a/.github/workflows/effx-analyze.yml +++ b/.github/workflows/effx-analyze.yml @@ -22,6 +22,10 @@ jobs: ref: 0e41f6b05b08f7ecfd91c7e55e77e98d8b650b02 path: .effx-tool persist-credentials: false + - name: Set up Bun + uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.13 - name: Install the reviewed effx tool working-directory: .effx-tool run: | From 3c8b316ab9737b4e3df2bc734dab569cc2acbb46 Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:42:43 +0200 Subject: [PATCH 7/9] fix: provision Bun for effx review --- .github/workflows/effx-publish.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/effx-publish.yml b/.github/workflows/effx-publish.yml index 0f3cfee..e456da8 100644 --- a/.github/workflows/effx-publish.yml +++ b/.github/workflows/effx-publish.yml @@ -23,6 +23,10 @@ jobs: ref: 0e41f6b05b08f7ecfd91c7e55e77e98d8b650b02 path: .effx-tool persist-credentials: false + - name: Set up Bun + uses: oven-sh/setup-bun@v2 + with: + bun-version: 1.3.13 - name: Download unprivileged analysis artifact env: GH_TOKEN: ${{ github.token }} From c56da09a4887e51ab4bb9084fb6eb2792308b9ef Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:44:15 +0200 Subject: [PATCH 8/9] fix: invoke effx through Bun --- .github/workflows/effx-analyze.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/effx-analyze.yml b/.github/workflows/effx-analyze.yml index 4396eda..d690998 100644 --- a/.github/workflows/effx-analyze.yml +++ b/.github/workflows/effx-analyze.yml @@ -58,14 +58,14 @@ jobs: test -s effx-oxlint.json test "$status" -le 1 - name: Translate diagnostics - run: .effx-tool/dist/cli.js translate < effx-oxlint.json > effx-diagnostics.json + run: bun .effx-tool/dist/cli.js translate < effx-oxlint.json > effx-diagnostics.json - name: Build immutable publication input env: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }} EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }} - run: bun run .effx-tool/scripts/build-github-input.ts effx-diagnostics.json > effx-input.json + run: bun .effx-tool/scripts/build-github-input.ts effx-diagnostics.json > effx-input.json - name: Upload decoded analysis result uses: actions/upload-artifact@v4 with: From 9f8ad2a061908254f2a720781805ef4eb59d12d3 Mon Sep 17 00:00:00 2001 From: "Philip B. Krogh" <71797726+phibkro@users.noreply.github.com> Date: Wed, 12 Aug 2026 16:44:17 +0200 Subject: [PATCH 9/9] fix: invoke effx through Bun --- .github/workflows/effx-publish.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/effx-publish.yml b/.github/workflows/effx-publish.yml index e456da8..739dd45 100644 --- a/.github/workflows/effx-publish.yml +++ b/.github/workflows/effx-publish.yml @@ -49,11 +49,11 @@ jobs: bun install --frozen-lockfile --ignore-scripts bun run build - name: Produce fail-closed publication plan - run: .effx-tool/dist/cli.js github plan < .effx-input.json > .effx-plan.json + run: bun .effx-tool/dist/cli.js github plan < .effx-input.json > .effx-plan.json - name: Publish canonical Check and review comments env: GH_TOKEN: ${{ github.token }} GH_REPO: ${{ github.repository }} EXPECTED_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} - run: bun run .effx-tool/scripts/publish-github-plan.ts .effx-plan.json + run: bun .effx-tool/scripts/publish-github-plan.ts .effx-plan.json