@avi2dg/checks 0.65.0 → 0.65.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.65.1
+
+Released 2026-11-03.
+
+### Fixes
+
+- allow weekly advisory scan in any public repository [#42](https://github.com/avi2d/checks/pull/42)
+
 ## 0.65.0
 
 Released 2026-11-03.

package/docs/gates/checks-advisories.md

@@ -105,7 +105,7 @@ A range that leaves `bun.lock` unchanged runs in under a second, and a direct ru
 ## Running it on a schedule
 
 A range never fails on an advisory published after its package landed, so a weekly `--all` run finds those.
-Only a public repository that publishes its package to npm runs it on a schedule, as [checks-ci-wiring](checks-ci-wiring.md#schedules) requires.
+Only a public repository runs it on a schedule, as [checks-ci-wiring](checks-ci-wiring.md#schedules) requires.
 Any other repository starts the same workflow by hand with `gh workflow run`, with no `schedule` trigger.
 A package scans on Monday between 05:00 and 06:00 UTC, at a minute chosen so repositories do not start together:
 

package/docs/gates/checks-ci-wiring.md

@@ -104,11 +104,11 @@ Each refusal names the workflow file, the line of its `schedule` trigger and wha
 ### Schedules
 
 It refuses every other workflow that triggers on `schedule`, since a test, mutation, flake, browser or night run starts only by hand, with `gh workflow run`.
-The one schedule it keeps is a weekly advisory scan in a public repository whose `package.json` does not set `private` to `true`.
+The one schedule it keeps is a weekly advisory scan in a public repository.
 A workflow scans advisories when a run step calls `checks-advisories`, the same ways a release call counts, and every other run step is a `bun install`.
 A weekly scan has one `cron` entry with one minute, one hour and one weekday, and `*` for the day of the month and the month.
-It refuses an advisory scan that runs more often, and any scheduled advisory scan in a private repository or a package that sets `private`.
-A run outside CI cannot read whether the repository is private, so it refuses a scan there only for the `package.json` field or the cron.
+It refuses an advisory scan that runs more often, and any scheduled advisory scan in a private repository.
+A run outside CI cannot read whether the repository is private, so it refuses a scan there only for the cron.
 A workflow that releases on a schedule is judged only by the release rule above.
 Each refusal names the workflow file, the line of its `schedule` trigger and what to change.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.65.0",
+  "version": "0.65.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",

package/src/delivery/schedule-policy.ts

@@ -42,7 +42,6 @@ function scansAdvisoriesOnly(workflow: Workflow, context: ScheduleContext): bool
 
 function advisoryFault(workflow: Workflow, owner: ScheduleOwner): string | undefined {
   if (owner.visibility === "private") return "a private repository scans advisories by hand; " + BY_HAND;
-  if (!owner.publishes) return "a package.json that sets private publishes nothing to npm, so it scans advisories by hand; " + BY_HAND;
   const entries = crons(workflow.document);
   if (entries.length === 1 && entries.every(weekly)) return undefined;
   return 'the advisory scan runs more than once a week; keep one cron at a minute, an hour and a weekday, such as "15 5 * * 1"';