@avi2dg/checks 0.5.0 → 0.6.0

package/README.md

@@ -5,9 +5,10 @@ Deterministic checks shared across my TypeScript repos. One package,
 Effect language-service block, the shared commitlint config, the shared
 dependency-cruiser base, the test-layout check with its bunfig preset,
 the commit-identity check with its workflow, the comment gate with its
-workflow and backtest, the Stryker mutation-testing preset with its
-no-regression comparator, the CI-wiring check, and the Effect
-error-channel plugin compiled to JavaScript.
+workflow and backtest, the oxlint suppressions ratchet, the Stryker
+mutation-testing preset with its no-regression comparator, the
+CI-wiring check, and the Effect error-channel plugin compiled to
+JavaScript.
 
 Published as `@avi2dg/checks` on the public npm registry.
 
@@ -347,6 +348,58 @@ jobs:
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
 ```
 
+## Suppressions ratchet
+
+`scripts/suppressions-ratchet.ts` holds oxlint's bulk-suppression
+baseline, `oxlint-suppressions.json`, to counts that only fall. oxlint
+accepts whatever `oxlint --suppress-all` writes, so raising a count to
+let a new site through passes the lint. The ratchet reads the file at a
+base and a head and fails naming each file and rule whose count rose or
+that appeared:
+
+```sh
+bun run checks-suppressions-ratchet <base-ref> <head-ref>
+bun run checks-suppressions-ratchet <ref>
+```
+
+With one argument it compares that commit with its parent, and exits 2
+when the parent is not in the clone. With two it reads the base where
+the head branched off, at their merge-base, so a count the base branch
+lowered since does not read as a rise at the head. A count that fell and
+an entry that went both pass. A commit without the file counts as empty,
+so the commit that first adds a baseline fails with every entry
+appearing. The file is read from the directory the command runs in,
+which is where oxlint writes it. It exits 2 when a ref does not resolve
+or the file is not oxlint's count per rule per file:
+
+```
+suppressions-ratchet: 2 count(s) in oxlint-suppressions.json rose or appeared; fix the site instead of suppressing it:
+  src/added.ts typescript/no-unsafe-type-assertion appeared with 1
+  src/dispatch.ts typescript/no-non-null-assertion rose from 12 to 13
+```
+
+Enforcement runs on pull requests, where the range from the base branch's
+current tip to the head is visible:
+
+```yaml
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+jobs:
+  suppressions-ratchet:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+      - uses: oven-sh/setup-bun@v2
+      - run: bun install --frozen-lockfile
+      - run: bunx checks-suppressions-ratchet "origin/$BASE_REF" "$HEAD_SHA"
+        env:
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+```
+
 ## CI wiring
 
 `checks-ci-wiring` fails when a command the repository's CI must run no
@@ -569,7 +622,7 @@ a tag off `main` and reruns the build, `dist/` check, lint, typecheck
 and tests before it publishes:
 
 ```sh
-git tag v0.5.0 && git push origin v0.5.0
+git tag v0.6.0 && git push origin v0.6.0
 ```
 
 The `release` workflow publishes the tagged version through npm

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Deterministic checks shared across the captain's TypeScript repos",
   "license": "MIT",
   "repository": {
@@ -22,6 +22,7 @@
     "scripts/ci-wiring.ts",
     "scripts/comments.ts",
     "scripts/comment-gate.ts",
+    "scripts/suppressions-ratchet.ts",
     "scripts/backtest.ts",
     "oxlintrc.json",
     "stryker.preset.js",
@@ -39,6 +40,7 @@
     "./scripts/ci-wiring.ts": "./scripts/ci-wiring.ts",
     "./scripts/comments.ts": "./scripts/comments.ts",
     "./scripts/comment-gate.ts": "./scripts/comment-gate.ts",
+    "./scripts/suppressions-ratchet.ts": "./scripts/suppressions-ratchet.ts",
     "./scripts/backtest.ts": "./scripts/backtest.ts",
     "./oxlintrc.json": "./oxlintrc.json",
     "./stryker.preset.js": "./stryker.preset.js",
@@ -52,6 +54,7 @@
     "checks-mutation-compare": "scripts/mutation-compare.ts",
     "checks-ci-wiring": "scripts/ci-wiring.ts",
     "checks-comment-gate": "scripts/comment-gate.ts",
+    "checks-suppressions-ratchet": "scripts/suppressions-ratchet.ts",
     "checks-backtest": "scripts/backtest.ts"
   },
   "scripts": {

package/scripts/suppressions-ratchet.ts

@@ -0,0 +1,142 @@
+#!/usr/bin/env bun
+export const SUPPRESSIONS = "oxlint-suppressions.json";
+
+export type Suppressions = ReadonlyMap<string, ReadonlyMap<string, number>>;
+
+export type Rise =
+  | { readonly kind: "rose"; readonly file: string; readonly rule: string; readonly base: number; readonly head: number }
+  | { readonly kind: "appeared"; readonly file: string; readonly rule: string; readonly head: number };
+
+export type Ratchet = {
+  readonly counted: number;
+  readonly lowered: number;
+  readonly rises: readonly Rise[];
+};
+
+export class SuppressionsError extends Error {}
+
+const USAGE = "usage: suppressions-ratchet.ts <ref> | <base-ref> <head-ref>";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isCount(value: unknown): value is number {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+
+export function parseSuppressions(text: string, where: string): Suppressions {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new SuppressionsError(`suppressions-ratchet: ${where} is not valid JSON`);
+  }
+  if (!isRecord(parsed)) {
+    throw new SuppressionsError(`suppressions-ratchet: ${where} is not an object of files`);
+  }
+  const files = new Map<string, ReadonlyMap<string, number>>();
+  for (const [file, rules] of Object.entries(parsed)) {
+    if (!isRecord(rules)) {
+      throw new SuppressionsError(`suppressions-ratchet: ${where} holds ${file} without an object of rules`);
+    }
+    const counts = new Map<string, number>();
+    for (const [rule, entry] of Object.entries(rules)) {
+      if (!isRecord(entry) || !isCount(entry["count"])) {
+        throw new SuppressionsError(`suppressions-ratchet: ${where} holds ${file} ${rule} without a whole count`);
+      }
+      counts.set(rule, entry["count"]);
+    }
+    files.set(file, counts);
+  }
+  return files;
+}
+
+export function compareSuppressions(base: Suppressions, head: Suppressions): Ratchet {
+  const rises: Rise[] = [];
+  let counted = 0;
+  for (const [file, rules] of head) {
+    for (const [rule, count] of rules) {
+      counted += 1;
+      const before = base.get(file)?.get(rule);
+      if (before === undefined) {
+        if (count > 0) rises.push({ kind: "appeared", file, rule, head: count });
+      } else if (count > before) {
+        rises.push({ kind: "rose", file, rule, base: before, head: count });
+      }
+    }
+  }
+  let lowered = 0;
+  for (const [file, rules] of base) {
+    for (const [rule, count] of rules) {
+      if ((head.get(file)?.get(rule) ?? 0) < count) lowered += 1;
+    }
+  }
+  rises.sort((a, b) => a.file.localeCompare(b.file) || a.rule.localeCompare(b.rule));
+  return { counted, lowered, rises };
+}
+
+function describeRise(rise: Rise): string {
+  const change = rise.kind === "rose" ? `rose from ${rise.base} to ${rise.head}` : `appeared with ${rise.head}`;
+  return `${rise.file} ${rise.rule} ${change}`;
+}
+
+export function report({ counted, lowered, rises }: Ratchet): string {
+  if (rises.length === 0) {
+    return `suppressions-ratchet: no count in ${SUPPRESSIONS} rose or appeared (${counted} at the head, ${lowered} lowered)`;
+  }
+  return [
+    `suppressions-ratchet: ${rises.length} count(s) in ${SUPPRESSIONS} rose or appeared; fix the site instead of suppressing it:`,
+    ...rises.map((rise) => `  ${describeRise(rise)}`),
+  ].join("\n");
+}
+
+function die(message: string): never {
+  console.error(message);
+  process.exit(2);
+}
+
+function git(...args: readonly string[]): string {
+  const result = Bun.spawnSync(["git", ...args], { stdout: "pipe", stderr: "pipe" });
+  if (!result.success) {
+    die(`suppressions-ratchet: git ${args.join(" ")}: ${result.stderr.toString().trim()}`);
+  }
+  return result.stdout.toString();
+}
+
+function commitOf(rev: string): string {
+  return git("rev-parse", "--verify", `${rev}^{commit}`).trim();
+}
+
+function mergeBase(base: string, head: string): string {
+  const result = Bun.spawnSync(["git", "merge-base", base, head], { stdout: "pipe", stderr: "pipe" });
+  if (!result.success) die(`suppressions-ratchet: ${base} and ${head} share no commit`);
+  return result.stdout.toString().trim();
+}
+
+function suppressionsAt(commit: string): Suppressions {
+  const blob = git("ls-tree", "--object-only", commit, "--", SUPPRESSIONS).trim();
+  if (blob === "") return new Map();
+  try {
+    return parseSuppressions(git("cat-file", "blob", blob), `${SUPPRESSIONS} at ${commit}`);
+  } catch (error) {
+    return die(error instanceof SuppressionsError ? error.message : `suppressions-ratchet: ${String(error)}`);
+  }
+}
+
+export function runRange(base: string, head: string): Ratchet {
+  const headCommit = commitOf(head);
+  // At the base tip, a count the base branch lowered after the head branched off would read as a rise at the head.
+  const branchPoint = mergeBase(commitOf(base), headCommit);
+  return compareSuppressions(suppressionsAt(branchPoint), suppressionsAt(headCommit));
+}
+
+if (import.meta.main) {
+  const [first, second, ...extra] = process.argv.slice(2);
+  if (first === undefined || extra.length > 0) die(USAGE);
+
+  const ratchet = second !== undefined ? runRange(first, second) : runRange(`${first}^`, first);
+
+  console.log(report(ratchet));
+  process.exit(ratchet.rises.length === 0 ? 0 : 1);
+}