@avi2dg/checks 0.57.0 → 0.57.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.57.1
+
+Released 2026-10-29.
+
+### Fixes
+
+- **complexity:** time out graphwalk and its dependency cruiser child [#18](https://github.com/avi2d/checks/pull/18)
+
 ## 0.57.0
 
 Released 2026-10-27.

package/commitlint.config.ts

@@ -1,21 +1,3 @@
-import configConventional from "@commitlint/config-conventional";
-
-const houseTypes: ReadonlyArray<string> = [
-  "theme",
-  "renamer",
-  "shell",
-  "pi",
-  "home",
-  "audit",
-  "comments",
-  "unslop",
-];
-
-const conventionalEnum = configConventional.rules["type-enum"];
-
 export default {
   extends: ["@commitlint/config-conventional"],
-  rules: {
-    "type-enum": [conventionalEnum[0], conventionalEnum[1], [...conventionalEnum[2], ...houseTypes]],
-  },
 };

package/docs/configs/commit-messages.md

@@ -8,7 +8,7 @@ The shared commitlint config holds each pull request title to the conventional c
 
 ## Config
 
-Commits follow `@commitlint/config-conventional` plus the house prefixes `commitlint.config.ts` lists, shared from `node_modules/@avi2dg/checks/commitlint.config.ts`.
+Commits follow `@commitlint/config-conventional`, shared from `node_modules/@avi2dg/checks/commitlint.config.ts`.
 It arrives with the kit, since `@commitlint/cli` and `@commitlint/config-conventional` are dependencies, not peers.
 
 ## Workflow

package/docs/configs/effect-rules.md

@@ -28,8 +28,8 @@ import { defineConfig } from "@avi2dg/checks/oxlint";
 export default defineConfig({
   effect: {
     excludeFiles: [
-      // Launchd runs the renamer, and it cannot import Effect v4.
-      "home/.config/renamer/**",
+      // The host loads this entry outside the Effect runtime.
+      "src/host/**",
     ],
   },
 });

package/docs/gates/checks-docs-only.md

@@ -9,7 +9,7 @@ audience: consumers
 ## What it checks
 
 A change is docs-only when every file it touches is a `.md` file at the top level or under `docs/`, and it touches at least one file.
-Markdown anywhere else, such as a test fixture under `tests/` or a template under `dist/`, keeps the full run.
+Markdown anywhere else, such as a test fixture under `tests/` or a template under `dist/`, keeps the typecheck and unit test steps running.
 A rename counts both sides.
 An empty change and a change with no range keep the full run.
 
@@ -41,10 +41,11 @@ docs-only=true
 
 ## When it runs
 
-Each of the `static`, `unit` and `e2e` jobs of the `ci` workflow appends the verdict to `GITHUB_OUTPUT` in a filter step.
+The `static` and `unit` jobs of the `ci` workflow append the verdict to `GITHUB_OUTPUT` in a filter step.
 Their typecheck and test steps skip when the verdict reads `true`.
+The `e2e` job does not read this verdict: `scripts/e2e-skip.ts` skips it for a change of only Markdown and the root `copy.json`, a wider set than this bin's.
 The build, its `git diff --exit-code` and `bun run lint` still run, so `checks-docs` and the generated blocks hold on a docs-only change.
-Every job still runs and reports, so every required check stays green on a docs-only change.
+The `checks` job still runs and reports, so its required check stays green on a docs-only change.
 
 ## Related topics
 

package/docs/gates/checks-graphwalk.md

@@ -55,6 +55,14 @@ It cruises against the first config it finds there:
 It runs dependency-cruiser from the installed kit under Bun, which loads a TypeScript config wherever it sits.
 It leaves out a tracked file the working tree no longer holds.
 
+## Time limits
+
+A run that lasts past 300 seconds stops, prints `graphwalk: timed out after 300s; set CHECKS_GRAPHWALK_TIMEOUT_SECONDS to allow longer` and exits 2.
+A dependency-cruiser run that lasts past 120 seconds stops, and the imports section prints `imports: dependency-cruiser timed out after 120s; set CHECKS_DEPCRUISE_TIMEOUT_SECONDS to allow longer` and cannot decide.
+`CHECKS_GRAPHWALK_TIMEOUT_SECONDS` and `CHECKS_DEPCRUISE_TIMEOUT_SECONDS` each take a whole number of seconds above 0, and any other value leaves the run or the section undecided.
+When a limit passes, the gate sends SIGTERM to the process group of each process it started.
+It sends SIGKILL 2 seconds later to any process still in that group, so nothing it started outlives the gate.
+
 ## Arguments
 
 ```sh
@@ -81,9 +89,10 @@ A seed written after the range adds a dead export, or after it removes the last
 | --- | --- |
 | 0 | no file is unreferenced, no symbol is unlisted, added or stale, and no import breaks an `error` rule, or `--write` recorded the baseline |
 | 1 | a file is unreferenced, a symbol is unlisted, added or stale, an import breaks an `error` rule, or the repository holds no Knip configuration |
-| 2 | a ref does not resolve, a scanner cannot run, or a Knip report, a cruise report or the baseline does not parse |
+| 2 | a ref does not resolve, a scanner cannot run, the run or dependency-cruiser passes its time limit, or a Knip report, a cruise report or the baseline does not parse |
 
 The gate exits 1 when any section reports a violation, and exits 2 only when no section reports one and at least one section cannot decide.
+When the run passes its time limit the gate exits 2 even when a section already reported a violation.
 
 It also exits 2 when the repository tracks no `.ts`, `.tsx`, `.astro`, `.mts` or `.cts` file, or, with `--write`, when it tracks no TypeScript file.
 A repository that tracks `.astro` files but no `.ts`, `.tsx`, `.mts` or `.cts` file prints only the unreferenced-files section.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.57.0",
+  "version": "0.57.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",

package/src/complexity/graphwalk.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 import { BunServices } from "@effect/platform-bun";
-import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { Config, Console, Duration, Effect, FileSystem, Path, Schema } from "effect";
 import { LINTED_SOURCE, TYPESCRIPT_SOURCE, type TrackedContent } from "../core/gates.ts";
 import { checkoutFiles, collect, commitOf, git, pathsAt, rangeEnds, refArgs } from "../core/git.ts";
 import { PASSED, runExitMain, UNDECIDED, Usage, VIOLATED } from "../core/main.ts";
@@ -34,6 +34,10 @@ export const CRUISED = ["*.ts", "*.tsx", "*.mts", "*.cts"] as const;
 
 const KIT_DEFAULTS = "kit-defaults.ts";
 
+type TimeLimit = { readonly variable: string; readonly seconds: number };
+const RUN_LIMIT = { variable: "CHECKS_GRAPHWALK_TIMEOUT_SECONDS", seconds: 300 } satisfies TimeLimit;
+const CRUISE_LIMIT = { variable: "CHECKS_DEPCRUISE_TIMEOUT_SECONDS", seconds: 120 } satisfies TimeLimit;
+
 export type Status = "passed" | "violated" | "undecided";
 
 class GraphwalkError extends Schema.TaggedError<GraphwalkError>()("GraphwalkError", {
@@ -75,6 +79,15 @@ function outside(symbols: readonly UnusedSymbol[], others: readonly UnusedSymbol
   return symbols.filter((symbol) => !known.has(keyOf(symbol))).toSorted(byPosition);
 }
 
+const withinLimit = Effect.fn("withinLimit")(function* <A, E, R>(prefix: string, { variable, seconds: fallback }: TimeLimit, body: Effect.Effect<A, E, R>) {
+  const seconds = yield* Config.schema(Schema.Int.check(Schema.isGreaterThan(0)), variable).pipe(
+    Config.withDefault(fallback),
+    Effect.mapError(() => new GraphwalkError({ message: `${variable} must be a whole number of seconds above 0` })),
+  );
+  const message = `${prefix}timed out after ${seconds}s; set ${variable} to allow longer`;
+  return yield* body.pipe(Effect.timeoutOrElse({ duration: Duration.seconds(seconds), orElse: () => Effect.fail(new GraphwalkError({ message })) }));
+});
+
 const describe = (symbol: UnusedSymbol): string => `  ${symbol.file}: ${symbol.name} (${symbol.kind})`;
 
 export const filesOf = Effect.fn("filesOf")(function* (stdout: string) {
@@ -267,9 +280,10 @@ const importsSection = (root: string) =>
       const files = yield* trackedInTree(root);
       if (files.length === 0) return yield* new GraphwalkError({ message: "no tracked TypeScript to cruise" });
       const config = yield* configOf(root);
-      const run = yield* collect(process.execPath, [yield* depcruise(), "--config", config.file, "--output-type", "json", ...files], root).pipe(
+      const cruise = collect(process.execPath, [yield* depcruise(), "--config", config.file, "--output-type", "json", ...files], root).pipe(
         Effect.mapError((cause) => new GraphwalkError({ message: `cannot run dependency-cruiser: ${cause.message}` })),
       );
+      const run = yield* withinLimit("dependency-cruiser ", CRUISE_LIMIT, cruise);
       const { summary } = yield* decodeCruise(run.stdout).pipe(
         Effect.mapError(
           () => new GraphwalkError({ message: `dependency-cruiser exits ${run.exitCode} with no report: ${(run.stdout + run.stderr).trim()}` }),
@@ -369,6 +383,10 @@ const gate = Effect.gen(function* () {
   ),
 );
 
+const timedGate = withinLimit("", RUN_LIMIT, gate).pipe(
+  Effect.catch((cause) => Console.error(`${NAME}: ${cause.message}`).pipe(Effect.as(UNDECIDED))),
+);
+
 if (import.meta.main) {
-  runExitMain(gate);
+  runExitMain(timedGate);
 }

package/src/core/git.ts

@@ -15,12 +15,15 @@ export type Feed = {
   readonly input?: string;
 };
 
+// Without a SIGKILL deadline, an interrupted child that ignores SIGTERM holds its scope open forever.
+const KILL_GRACE = "2 seconds";
+
 // Both pipes drain while the program runs: one left unread fills its buffer and stalls it.
 export const collect = Effect.fn("collect")(
   function* (program: string, args: readonly string[], cwd?: string, { env, input }: Feed = {}) {
     const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
     const stdin = input === undefined ? undefined : Stream.make(new TextEncoder().encode(input));
-    const handle = yield* spawner.spawn(ChildProcess.make(program, args, { cwd, env, extendEnv: true, stdin }));
+    const handle = yield* spawner.spawn(ChildProcess.make(program, args, { cwd, env, extendEnv: true, stdin, forceKillAfter: KILL_GRACE }));
     const [stdout, stderr, exitCode] = yield* Effect.all([text(handle.stdout), text(handle.stderr), handle.exitCode], {
       concurrency: "unbounded",
     });

package/src/delivery/release-push.ts

@@ -101,7 +101,7 @@ const land = Effect.fn("land")(function* (root: string, base: string, head: stri
           Effect.gen(function* () {
             const now = listed.split("\t")[0];
             if (now === release) return "landed";
-            if (now === head) return yield* Effect.fail(failure);
+            if (now === head) return yield* failure;
             yield* git(["fetch", "--quiet", "--no-tags", "origin", `refs/heads/${base}`], root);
             const ancestor = yield* git(["merge-base", "--is-ancestor", release, "FETCH_HEAD"], root).pipe(
               Effect.as(true),