@codluv/versionguard 0.6.0 → 0.8.0

package/dist/changelog.d.ts

@@ -19,6 +19,18 @@ export interface ChangelogValidationResult {
      */
     hasEntryForVersion: boolean;
 }
+/**
+ * Options for changelog structure enforcement.
+ *
+ * @public
+ * @since 0.7.0
+ */
+export interface ChangelogStructureOptions {
+    /** Validate section headers against an allowed list. */
+    enforceStructure?: boolean;
+    /** Allowed section names. Defaults to Keep a Changelog standard sections. */
+    sections?: string[];
+}
 /**
  * Validates a changelog file for release readiness.
  *
@@ -28,19 +40,26 @@ export interface ChangelogValidationResult {
  * The validator checks for a top-level changelog heading, an `[Unreleased]`
  * section, and optionally a dated entry for the requested version.
  *
+ * When `structure.enforceStructure` is `true`, section headers (`### Name`)
+ * are validated against the allowed list and empty sections produce warnings.
+ *
  * @param changelogPath - Path to the changelog file.
  * @param version - Version that must be present in the changelog.
  * @param strict - Whether to require compare links and dated release headings.
  * @param requireEntry - Whether the requested version must already have an entry.
+ * @param structure - Optional structure enforcement options.
  * @returns The result of validating the changelog file.
  * @example
  * ```ts
  * import { validateChangelog } from 'versionguard';
  *
- * const result = validateChangelog('CHANGELOG.md', '1.2.0', true, true);
+ * const result = validateChangelog('CHANGELOG.md', '1.2.0', true, true, {
+ *   enforceStructure: true,
+ *   sections: ['Added', 'Changed', 'Fixed'],
+ * });
  * ```
  */
-export declare function validateChangelog(changelogPath: string, version: string, strict?: boolean, requireEntry?: boolean): ChangelogValidationResult;
+export declare function validateChangelog(changelogPath: string, version: string, strict?: boolean, requireEntry?: boolean, structure?: ChangelogStructureOptions): ChangelogValidationResult;
 /**
  * Gets the most recent released version from a changelog.
  *

package/dist/changelog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"changelog.d.ts","sourceRoot":"","sources":["../src/changelog.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;OAEG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,OAAc,EACtB,YAAY,GAAE,OAAc,GAC3B,yBAAyB,CAgD3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAA8C,GACnD,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAMjE;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE,MAA8C,GACnD,OAAO,CAoET"}
+{"version":3,"file":"changelog.d.ts","sourceRoot":"","sources":["../src/changelog.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC;;OAEG;IACH,KAAK,EAAE,OAAO,CAAC;IACf;;OAEG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;OAEG;IACH,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAcD;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IACxC,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,OAAc,EACtB,YAAY,GAAE,OAAc,EAC5B,SAAS,CAAC,EAAE,yBAAyB,GACpC,yBAAyB,CAuD3B;AAiCD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQrE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,MAA8C,GACnD,IAAI,CAmBN;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAMjE;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,oBAAoB,CAClC,aAAa,EAAE,MAAM,EACrB,IAAI,GAAE,MAA8C,GACnD,OAAO,CAoET"}

package/dist/chunks/{index-DeZAx4Le.js → index-Cipg9sxE.js}

@@ -323,7 +323,15 @@ const calver = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
   validate: validate$2
 }, Symbol.toStringTag, { value: "Module" }));
 const CHANGELOG_DATE_REGEX = /^\d{4}-\d{2}-\d{2}$/;
-function validateChangelog(changelogPath, version, strict = true, requireEntry = true) {
+const KEEP_A_CHANGELOG_SECTIONS = [
+  "Added",
+  "Changed",
+  "Deprecated",
+  "Removed",
+  "Fixed",
+  "Security"
+];
+function validateChangelog(changelogPath, version, strict = true, requireEntry = true, structure) {
   if (!fs.existsSync(changelogPath)) {
     return {
       valid: !requireEntry,
@@ -360,12 +368,36 @@ function validateChangelog(changelogPath, version, strict = true, requireEntry =
       }
     }
   }
+  if (structure?.enforceStructure) {
+    const allowed = structure.sections ?? KEEP_A_CHANGELOG_SECTIONS;
+    const sectionErrors = validateSections(content, allowed);
+    errors.push(...sectionErrors);
+  }
   return {
     valid: errors.length === 0,
     errors,
     hasEntryForVersion
   };
 }
+function validateSections(content, allowed) {
+  const errors = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const sectionMatch = lines[i].match(/^### (.+)/);
+    if (!sectionMatch) continue;
+    const sectionName = sectionMatch[1].trim();
+    if (!allowed.includes(sectionName)) {
+      errors.push(
+        `Invalid changelog section "### ${sectionName}" (line ${i + 1}). Allowed: ${allowed.join(", ")}`
+      );
+    }
+    const nextContentLine = lines.slice(i + 1).find((l) => l.trim().length > 0);
+    if (!nextContentLine || nextContentLine.startsWith("#")) {
+      errors.push(`Empty changelog section "### ${sectionName}" (line ${i + 1})`);
+    }
+  }
+  return errors;
+}
 function addVersionEntry(changelogPath, version, date = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)) {
   if (!fs.existsSync(changelogPath)) {
     throw new Error(`Changelog not found: ${changelogPath}`);
@@ -1560,6 +1592,89 @@ function checkHardcodedVersions(expectedVersion, config, ignorePatterns, cwd = p
   }
   return mismatches;
 }
+const BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".ico",
+  ".svg",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".otf",
+  ".zip",
+  ".tar",
+  ".gz",
+  ".bz2",
+  ".7z",
+  ".pdf",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".wasm",
+  ".mp3",
+  ".mp4",
+  ".webm",
+  ".webp",
+  ".avif"
+]);
+function scanRepoForVersions(expectedVersion, scanConfig, ignorePatterns, cwd = process.cwd()) {
+  const files = [
+    ...new Set(
+      globSync("**/*", {
+        cwd,
+        absolute: true,
+        dot: true,
+        ignore: [
+          ...ignorePatterns,
+          // Always skip changelogs (handled by changelog validation) and lockfiles
+          "CHANGELOG.md",
+          "*.lock",
+          "package-lock.json",
+          "yarn.lock",
+          "pnpm-lock.yaml",
+          // Skip VG's own config
+          ".versionguard.yml",
+          ".versionguard.yaml"
+        ]
+      })
+    )
+  ].sort();
+  const allowedFiles = new Set(
+    scanConfig.allowlist.flatMap((entry) => resolveFiles([entry.file], cwd, []))
+  );
+  const mismatches = [];
+  for (const filePath of files) {
+    if (BINARY_EXTENSIONS.has(path.extname(filePath).toLowerCase())) continue;
+    if (allowedFiles.has(filePath)) continue;
+    let content;
+    try {
+      content = fs.readFileSync(filePath, "utf-8");
+    } catch {
+      continue;
+    }
+    if (content.slice(0, 8192).includes("\0")) continue;
+    for (const patternStr of scanConfig.patterns) {
+      const regex = new RegExp(patternStr, "gm");
+      let match = regex.exec(content);
+      while (match) {
+        const found = match[1] ?? match[0] ?? "";
+        if (found && found !== expectedVersion && found !== "Unreleased") {
+          mismatches.push({
+            file: path.relative(cwd, filePath),
+            line: getLineNumber(content, match.index),
+            found
+          });
+        }
+        match = regex.exec(content);
+      }
+    }
+  }
+  return mismatches;
+}
 const DEFAULT_SEMVER_CONFIG = {
   allowVPrefix: false,
   allowBuildMetadata: true,
@@ -1775,7 +1890,21 @@ const DEFAULT_CONFIG = {
     enabled: true,
     file: "CHANGELOG.md",
     strict: true,
-    requireEntry: true
+    requireEntry: true,
+    enforceStructure: false,
+    sections: ["Added", "Changed", "Deprecated", "Removed", "Fixed", "Security"]
+  },
+  scan: {
+    enabled: false,
+    patterns: [
+      // version = "1.2.3" or version: "1.2.3" in code/config
+      `(?:version\\s*[:=]\\s*["'])([\\d]+\\.[\\d]+\\.[\\d]+(?:-[\\w.]+)?)["']`,
+      // Docker FROM image:1.2.3
+      "(?:FROM\\s+\\S+:)(\\d+\\.\\d+\\.\\d+(?:-[\\w.]+)?)",
+      // GitHub Actions uses: action@v1.2.3
+      "(?:uses:\\s+\\S+@v?)(\\d+\\.\\d+\\.\\d+(?:-[\\w.]+)?)"
+    ],
+    allowlist: []
   },
   git: {
     hooks: {
@@ -2690,7 +2819,11 @@ function getTagPreflightError(config, cwd, expectedVersion, allowAutoFix = false
     path.join(cwd, config.changelog.file),
     version,
     config.changelog.strict,
-    config.changelog.requireEntry
+    config.changelog.requireEntry,
+    {
+      enforceStructure: config.changelog.enforceStructure,
+      sections: config.changelog.sections
+    }
   );
   if (!changelogResult.valid) {
     return changelogResult.errors[0] ?? "Changelog validation failed";
@@ -2791,6 +2924,14 @@ function validate(config, cwd = process.cwd()) {
       );
     }
   }
+  if (config.scan?.enabled) {
+    const scanFindings = scanRepoForVersions(version, config.scan, config.ignore, cwd);
+    for (const finding of scanFindings) {
+      errors.push(
+        `Stale version in ${finding.file}:${finding.line} - found "${finding.found}" but expected "${version}"`
+      );
+    }
+  }
   let changelogValid = true;
   if (config.changelog.enabled) {
     const changelogPath = path.join(cwd, config.changelog.file);
@@ -2798,7 +2939,11 @@ function validate(config, cwd = process.cwd()) {
       changelogPath,
       version,
       config.changelog.strict,
-      config.changelog.requireEntry
+      config.changelog.requireEntry,
+      {
+        enforceStructure: config.changelog.enforceStructure,
+        sections: config.changelog.sections
+      }
     );
     if (!changelogResult.valid) {
       changelogValid = false;
@@ -2882,7 +3027,7 @@ function isWorktreeClean(cwd) {
   }
 }
 export {
-  validateVersion as $,
+  validateTagForPush as $,
   checkHardcodedVersions as A,
   checkHookIntegrity as B,
   checkHooksPathOverride as C,
@@ -2901,16 +3046,17 @@ export {
   initConfig as P,
   resolveVersionSource as Q,
   RegexVersionSource as R,
-  semver as S,
+  scanRepoForVersions as S,
   TomlVersionSource as T,
-  suggestTagMessage as U,
+  semver as U,
   VersionFileSource as V,
-  sync as W,
-  syncVersion as X,
+  suggestTagMessage as W,
+  sync as X,
   YamlVersionSource as Y,
-  validateChangelog as Z,
-  validateTagForPush as _,
+  syncVersion as Z,
+  validateChangelog as _,
   installHooks as a,
+  validateVersion as a0,
   getPackageVersion as b,
   createCkmEngine as c,
   getVersionFeedback as d,
@@ -2937,4 +3083,4 @@ export {
   canBump as y,
   checkEnforceHooksPolicy as z
 };
-//# sourceMappingURL=index-DeZAx4Le.js.map
+//# sourceMappingURL=index-Cipg9sxE.js.map