@avi2dg/checks 0.68.1 → 0.69.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.69.0
+
+Released 2026-11-06.
+
+### Features
+
+- export git, main, test and test-report helpers [#57](https://github.com/avi2d/checks/pull/57)
+
+## 0.68.2
+
+Released 2026-11-06.
+
+### Fixes
+
+- **commit-identity:** accept Dependabot bot identity on Dependabot titles [#53](https://github.com/avi2d/checks/pull/53)
+
 ## 0.68.1
 
 Released 2026-11-06.

package/commitlint.config.ts

@@ -14,7 +14,9 @@ const dependabot = new RegExp(
   String.raw`^build\(deps(?:-dev)?\): (?:${single}|${bumpTo}|${joint}|${byName}|${requirement}|${inGroup}|${groupWithUpdates})(?: \(#\d+\))?$`,
 );
 
+export const isDependabotTitle = (title: string): boolean => dependabot.test(title);
+
 export default {
   extends: ["@commitlint/config-conventional"],
-  ignores: [(message: string) => dependabot.test(message)],
+  ignores: [isDependabotTitle],
 };

package/docs/design.md

@@ -84,12 +84,13 @@ Nothing would then say which gate a helper serves.
 A mutation runner's default scope covers `src/`, so the kit's own Stryker run mutates its source with no `mutate` list.
 The testing directory is named `testing` rather than `tests`, because a `src/tests/` beside the root `tests/` would read as a second suite.
 
-Eight `exports` keys name a path the file does not sit at, because consumers resolve them by that name.
+Twelve `exports` keys name a path the file does not sit at, because consumers resolve them by that name.
 `@avi2dg/checks/scripts/test-skips.ts`, `@avi2dg/checks/scripts/comment-matchers.ts` and `@avi2dg/checks/scripts/prose-matchers.ts` point at their files under `src/`.
 `@avi2dg/checks/browser-hooks.ts` points at `src/quality/browser/hooks.ts`, whose types a product's browser hooks import.
 `@avi2dg/checks/browser-checks.json` points at `src/quality/browser/browser-checks.json`, the starter a product copies.
 `@avi2dg/checks/screen-sizes.ts` points at `src/quality/browser/screen-sizes.ts`, whose sizes a product imports.
 `@avi2dg/checks/block-screens.ts` points at `src/testing/block-screens.ts`, whose screenshot suite a product's pixel tests call.
+`@avi2dg/checks/core/git.ts`, `@avi2dg/checks/core/main.ts`, `@avi2dg/checks/testing/test.ts` and `@avi2dg/checks/testing/test-report.ts` point at their files under `src/`, whose git, entry-point, test-report and skip-judging helpers a repository's own test runner script builds on.
 `@avi2dg/checks/templates/*` points at `dist/templates/`.
 A path read without the resolver, such as `node_modules/@avi2dg/checks/scripts/test-skips.ts`, does not exist.
 

package/docs/gates/checks-commit-identity.md

@@ -17,6 +17,11 @@ The same author on a commit with any other committer must match the allowed name
 `github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>` is allowed as author only of a commit whose subject is `chore: release <version>`, with or without the pull request number a squash merge adds.
 GitHub attributes the release commit [checks-release-pr](checks-release-pr.md) or [checks-release-push](checks-release-push.md) makes to that bot, since each commits through the workflow token.
 Such a commit may carry a `Co-authored-by` trailer naming that bot, since GitHub adds one to some squash merges of a pull request the bot opened, and every other trailer is refused.
+A Dependabot-titled commit may carry a `Co-authored-by` trailer naming `dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>`, since GitHub adds one when the owner squash-merges a pull request the bot opened, and every other trailer is refused.
+`dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>` is allowed as author only of a commit whose subject is a Dependabot title [the commit message lint](../configs/commit-messages.md) exempts, with or without the pull request number a squash merge adds.
+Dependabot writes that commit itself, and GitHub commits it as `GitHub <noreply@github.com>`, which the gate already allows as committer.
+This identity matches by name and email, even on a commit GitHub made, so the Dependabot address under another name is refused.
+Its `Signed-off-by` trailer is not a `Co-authored-by` trailer, so the gate does not read it.
 
 ## What it reads
 
@@ -52,6 +57,9 @@ commit-identity: 1 of 1 commit(s) in HEAD carry a foreign identity:
   79fa94f9f027 feat: foreign
     author someone <someone@example.com>
   allowed: Repo Owner <owner@example.com>
+  allowed as committer only: GitHub <noreply@github.com>, which also lets an allowed email author under any name
+  allowed as release author only: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+  allowed as Dependabot author only, on a Dependabot title: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 ```
 
 ## When it runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.68.1",
+  "version": "0.69.0",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",
@@ -152,6 +152,10 @@
     "./browser-checks.json": "./src/quality/browser/browser-checks.json",
     "./screen-sizes.ts": "./src/quality/browser/screen-sizes.ts",
     "./block-screens.ts": "./src/testing/block-screens.ts",
+    "./core/git.ts": "./src/core/git.ts",
+    "./core/main.ts": "./src/core/main.ts",
+    "./testing/test-report.ts": "./src/testing/test-report.ts",
+    "./testing/test.ts": "./src/testing/test.ts",
     "./oxlint": {
       "types": "./dist/presets/oxlint.d.ts",
       "default": "./dist/presets/oxlint.js"

package/src/delivery/commit-identity.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { isDependabotTitle } from "../../commitlint.config.ts";
 import { releasedVersionOf } from "./release.ts";
 import { git, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
@@ -23,11 +24,13 @@ const SQUASH_COMMITTER: Identity = { name: "GitHub", email: "noreply@github.com"
 // GitHub may also name that bot as co-author when it squashes the pull request the bot opened.
 const RELEASE_AUTHOR: Identity = { name: "github-actions[bot]", email: "41898282+github-actions[bot]@users.noreply.github.com" };
 
+const DEPENDABOT_AUTHOR: Identity = { name: "dependabot[bot]", email: "49699333+dependabot[bot]@users.noreply.github.com" };
+
 const CO_AUTHOR = /^co-authored-by:\s*(.*?)\s*<([^<>]*)>\s*$/i;
 
-function namesReleaseAuthor(trailer: string): boolean {
+function namesCoAuthor(identity: Identity, trailer: string): boolean {
   const [, name, email = ""] = CO_AUTHOR.exec(trailer) ?? [];
-  return name !== undefined && allows([RELEASE_AUTHOR], { name, email });
+  return name !== undefined && allows([identity], { name, email });
 }
 
 // git's own trailer parser, so only the trailer block counts and prose never does.
@@ -130,14 +133,19 @@ function inspect(commit: Commit, allowed: readonly Identity[]): Offence | undefi
   const release = releasedVersionOf(commit.subject) !== undefined;
   const authors = release ? [...allowed, RELEASE_AUTHOR] : allowed;
   const madeByGitHub = allows([SQUASH_COMMITTER], commit.committer);
-  if (!(madeByGitHub ? allowsEmail(authors, commit.author) : allows(authors, commit.author))) {
+  const authored = madeByGitHub ? allowsEmail(authors, commit.author) : allows(authors, commit.author);
+  // Outside the author list, which a GitHub-made commit matches by email alone and so would take any name on the bot's address.
+  const dependabotTitle = isDependabotTitle(commit.subject);
+  const dependabot = dependabotTitle && allows([DEPENDABOT_AUTHOR], commit.author);
+  if (!authored && !dependabot) {
     reasons.push(`author ${render(commit.author)}`);
   }
   if (!allows([...allowed, SQUASH_COMMITTER], commit.committer)) {
     reasons.push(`committer ${render(commit.committer)}`);
   }
   for (const trailer of commit.coAuthoredBy) {
-    if (release && namesReleaseAuthor(trailer)) continue;
+    if (release && namesCoAuthor(RELEASE_AUTHOR, trailer)) continue;
+    if (dependabotTitle && namesCoAuthor(DEPENDABOT_AUTHOR, trailer)) continue;
     reasons.push(`trailer ${trailer}`);
   }
   return reasons.length === 0 ? undefined : { commit, reasons };
@@ -167,6 +175,7 @@ const check = Effect.gen(function* () {
     lines.push(`  allowed: ${allowed.map(render).join(", ")}`);
     lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}, which also lets an allowed email author under any name`);
     lines.push(`  allowed as release author only: ${render(RELEASE_AUTHOR)}`);
+    lines.push(`  allowed as Dependabot author only, on a Dependabot title: ${render(DEPENDABOT_AUTHOR)}`);
     yield* Console.error(lines.join("\n"));
     return false;
   }