Enforce canonical GitHub megarepo sources

nix/devenv-modules/tasks/shared/check.nix

@@ -57,6 +57,7 @@ let
   megarepoTasks = lib.optionals hasMegarepoCheck [
     "mr:check"
     "mr:lock-sync-check"
+    "mr:source-policy-check"
   ];
 
   # Build description parts

nix/devenv-modules/tasks/shared/megarepo.nix

@@ -368,6 +368,27 @@ let
         fi
       '';
     };
+
+    "mr:source-policy-check" = {
+      guard = "mr";
+      description = "Verify megarepo GitHub source and lock-file policy";
+      status = trace.status "mr:source-policy-check" "binary" ''
+        if [ ! -f ./megarepo.lock ]; then
+          exit 0
+        fi
+
+        mr check --all
+      '';
+      exec = trace.exec "mr:source-policy-check" ''
+        set -euo pipefail
+
+        if [ ! -f ./megarepo.lock ]; then
+          exit 0
+        fi
+
+        mr check --all
+      '';
+    };
   };
 in
 {

packages/@overeng/megarepo/src/cli/commands/check.ts

@@ -0,0 +1,77 @@
+import * as Cli from '@effect/cli'
+import { Console, Effect, Option } from 'effect'
+
+import { EffectPath } from '@overeng/effect-path'
+
+import { readMegarepoConfig } from '../../lib/config.ts'
+import { LOCK_FILE_NAME, readLockFile } from '../../lib/lock.ts'
+import { checkSourcePolicy, formatSourcePolicyViolation } from '../../lib/source-policy.ts'
+import { Cwd, findMegarepoRoot, jsonOption } from '../context.ts'
+
+const allOption = Cli.Options.boolean('all').pipe(
+  Cli.Options.withDescription('Check member source and lock files in repos/ as well as the root'),
+  Cli.Options.withDefault(false),
+)
+
+/** Check that the megarepo is structurally valid. */
+export const checkCommand = Cli.Command.make(
+  'check',
+  {
+    all: allOption,
+    json: jsonOption,
+  },
+  ({ all, json }) =>
+    Effect.gen(function* () {
+      const cwd = yield* Cwd
+      const rootOpt = yield* findMegarepoRoot(cwd)
+
+      if (Option.isNone(rootOpt) === true) {
+        return yield* Effect.fail(new Error('No megarepo config found'))
+      }
+
+      const root = rootOpt.value
+      const { config } = yield* readMegarepoConfig(root)
+      const lockPath = EffectPath.ops.join(root, EffectPath.unsafe.relativeFile(LOCK_FILE_NAME))
+      const lockFileOpt = yield* readLockFile(lockPath)
+
+      if (Option.isNone(lockFileOpt) === true) {
+        return yield* Effect.fail(
+          new Error('megarepo.lock is required for megarepo checks; run `mr lock` first'),
+        )
+      }
+
+      const sourcePolicy = yield* checkSourcePolicy({
+        megarepoRoot: root,
+        config,
+        lockFile: lockFileOpt.value,
+        includeMembers: all,
+      })
+
+      const result = {
+        checks: [
+          {
+            name: 'source-policy',
+            violations: sourcePolicy.violations,
+          },
+        ],
+        violations: sourcePolicy.violations,
+      }
+
+      if (json === true) {
+        yield* Console.log(JSON.stringify(result, null, 2))
+      } else if (result.violations.length === 0) {
+        yield* Console.log('Megarepo checks OK')
+      } else {
+        yield* Console.error('Megarepo check violations:')
+        for (const violation of result.violations) {
+          yield* Console.error(`- ${formatSourcePolicyViolation(violation)}`)
+        }
+      }
+
+      if (result.violations.length > 0) {
+        return yield* Effect.fail(
+          new Error(`Megarepo checks failed with ${result.violations.length} violation(s)`),
+        )
+      }
+    }),
+).pipe(Cli.Command.withDescription('Check that the megarepo is structurally valid'))

packages/@overeng/megarepo/src/cli/commands/mod.ts

@@ -6,6 +6,7 @@
 
 export { addCommand } from './add.ts'
 export { applyCommand } from './apply.ts'
+export { checkCommand } from './check.ts'
 export { depsCommand } from './deps.ts'
 export { syncMegarepo } from './engine.ts'
 export { envCommand } from './env.ts'

packages/@overeng/megarepo/src/cli/mod.ts

@@ -14,6 +14,7 @@ import { MR_VERSION } from '../lib/version.ts'
 import {
   addCommand,
   applyCommand,
+  checkCommand,
   configCommand,
   depsCommand,
   envCommand,
@@ -54,6 +55,7 @@ export const mrCommand = Cli.Command.make('mr', { cwd: cwdOption }).pipe(
     envCommand,
     statusCommand,
     lsCommand,
+    checkCommand,
     fetchCommand,
     applyCommand,
     lockCommand,