@colrealpro/react-luau-doctor 0.17.0 → 0.17.2

package/docs/ci.md

@@ -4,13 +4,13 @@ There are two workflows to distinguish: this repository's own build/test CI, and
 
 ## Install into a Roblox repository
 
-Build and link Doctor as described in the [README](../README.md). From the Roblox repository, run:
+Run React-Luau Doctor as described in the [README](../README.md). From the Roblox repository, run:
 
 ```bash
 react-luau-doctor ci install --yes
 ```
 
-Commit both `.github/workflows/react-luau-doctor.yml` and the entire `.github/actions/react-luau-doctor` directory. The latter includes the bundled CLI, grammar, license notices, package metadata, and lockfile. This copy pins the analyzer to the installed version without requiring Doctor on npm. CI still needs network access to install Bun and the locked parser dependency.
+Commit `.github/workflows/react-luau-doctor.yml`. The generated workflow installs Bun, then runs the exact npm package version that generated the workflow, for example `@colrealpro/react-luau-doctor@<version>`. This keeps CI reproducible without committing Doctor's bundle, parser grammar, or dependencies into your repository.
 
 The workflow checks out full Git history. Pull requests use `changed` scope by default. Pushes to `main` run a full advisory scan. Change the branch trigger if your default branch has another name.
 
@@ -31,24 +31,20 @@ Fork PR tokens commonly lack write permissions. Reporting failures are logged wh
 
 ## Upgrade
 
-After updating and rebuilding your Doctor installation:
+Run the latest Doctor version, then regenerate the managed workflow:
 
 ```bash
-react-luau-doctor ci upgrade --yes
+bunx @colrealpro/react-luau-doctor@latest ci upgrade --yes
 ```
 
-This refreshes the copied runtime and wrapper while preserving supported workflow settings. Review and commit all generated changes. `ci config` also refreshes the runtime from the invoking installation. These commands regenerate managed files; keep custom workflow logic in a separate workflow.
+This preserves supported workflow settings while updating the pinned npm version. Review and commit the generated change. `ci config` also regenerates the managed workflow using the version of Doctor that invokes it. Keep custom workflow logic in a separate workflow.
 
-`ci install` and `ci upgrade` accept `--pr`, which uses authenticated GitHub CLI access to create a branch, commit generated files, push, and open a PR. Omit it when you want to review the files locally first.
-
-## Direct repository Action
-
-After publishing this repository, you can reference its root `action.yml` instead of committing a runtime copy. Select an existing commit or release tag from `colrealpro/react-luau-doctor`; no release tag is assumed to exist yet. Pinning a full commit SHA also pins `dist/cli.js`.
-
-Your workflow must check out the target repository with `fetch-depth: 0`, set the required permissions, then call the Action. Inputs are `directory`, `project`, `scope`, `blocking`, `comment`, `review-comments`, and `commit-status`. Input values pass through environment variables before shell invocation.
+`ci install` and `ci upgrade` accept `--pr`, which uses authenticated GitHub CLI access to create a branch, commit generated files, push, and open a PR. Omit it when you want to review the file locally first.
 
 ## Outputs
 
+The generated GitHub step has the id `doctor` and writes these outputs through `GITHUB_OUTPUT`, so later steps in the same job can read values such as `${{ steps.doctor.outputs.score }}`.
+
 | Output | Meaning |
 | --- | --- |
 | `score` | Heuristic score for the reported findings. |
@@ -64,10 +60,10 @@ Your workflow must check out the target repository with `fetch-depth: 0`, set th
 react-luau-doctor ci install --provider gitlab --blocking error --yes
 ```
 
-Commit `.gitlab-ci.yml` and `.gitlab/react-luau-doctor`. The generated job installs the copied runtime's parser dependency and runs a CLI gate in a pinned Bun image. It does not publish merge-request comments or statuses. Full Git history is requested; explicitly adapt the comparison base to your merge-request workflow if needed. Existing unrelated `.gitlab-ci.yml` files are not overwritten.
+Commit `.gitlab-ci.yml`. The generated job uses a pinned Bun image and runs the exact npm package version that generated the workflow. It does not publish merge-request comments or statuses. Full Git history is requested; explicitly adapt the comparison base to your merge-request workflow if needed. Existing unrelated `.gitlab-ci.yml` files are not overwritten.
 
 ## Verification
 
-The test suite simulates GitHub API requests for summary creation and updates, review replacement, commit statuses, and forbidden responses. It also checks copied-runtime execution and shell input handling. This repository's CI runs the root composite Action against an example with API reporting disabled.
+The test suite simulates GitHub API requests for summary creation and updates, review replacement, commit statuses, forbidden responses, generated workflow behavior, and shell input handling. Package verification also checks that `ci install` from the packed distribution generates a version-pinned npm workflow without vendoring Doctor into the target repository.
 
-Before enabling a required check, run real PRs in your repository that introduce an error, repair it, delete an affected component, and originate from a fork. Confirm the gate, outputs, comments, and status behavior. Local simulation does not validate GitHub account permissions or hosted runner execution.
+Before enabling a required check, run real PRs in your repository that introduce an error, repair it, delete an affected component, and originate from a fork. Confirm the gate, outputs, comments, and status behavior. Local simulation does not validate GitHub account permissions or hosted-runner behavior.

package/docs/cli.md

@@ -1,6 +1,6 @@
 # CLI and configuration
 
-Examples assume you built the source checkout and ran `bun link`. You can also invoke its absolute `dist/cli.js` path with Bun from the directory you want to analyze.
+Examples use the installed `react-luau-doctor` command. For one-off use, run the same arguments through `bunx @colrealpro/react-luau-doctor` or `npx @colrealpro/react-luau-doctor`; Bun must be installed either way.
 
 ## Scan targets
 
@@ -50,7 +50,7 @@ Use `--category Hooks`, repeatable for multiple categories, or `--min-severity w
 
 ## Configuration
 
-Doctor reads `react-luau-doctor.config.json`, falling back to `doctor.config.json`. It does not search ancestor directories for local scan configuration.
+Doctor reads `react-luau-doctor.config.json` from the directory where the command is run. It does not search ancestor directories for local scan configuration.
 
 ```json
 {
@@ -64,7 +64,7 @@ Doctor reads `react-luau-doctor.config.json`, falling back to `doctor.config.jso
 }
 ```
 
-A rule setting is `error`, `warning`, `suggestion`, or `off`. An explicit severity applies to every finding from that rule, including findings normally downgraded for uncertainty. Without an override, individual findings may have lower severity than the rule default. Unknown rule IDs produce an error. In version 0.17.0, Instance creation and tween render checks share `react-luau/no-side-effects-in-render`; replace their former separate rule settings and suppression names with that shared ID.
+A rule setting is `error`, `warning`, `suggestion`, or `off`. An explicit severity applies to every finding from that rule, including findings normally downgraded for uncertainty. Without an override, individual findings may have lower severity than the rule default. Unknown rule IDs produce an error.
 
 Patterns support `*`, `**`, and `?`; they are not full gitignore syntax. `**/` can match zero directories. Paths are relative to the scan project root.
 
@@ -112,4 +112,4 @@ Doctor stores an incremental cache outside the scanned repository:
 
 Set `REACT_LUAU_DOCTOR_CACHE_DIR` to choose a location. Use `--no-cache` or `REACT_LUAU_DOCTOR_DISABLE_CACHE=1` to bypass it. Cache entries can include source-derived information, so treat the directory as local project data.
 
-For the complete option list, run `react-luau-doctor --help`. Compatibility flags for dead-code and supply-chain checks do not implement those analyses.
+For the complete option list, run `react-luau-doctor --help`.

package/docs/development.md

@@ -1,19 +1,19 @@
 # Development and releases
 
-Use Bun 1.3.14 for reproducible release builds. Newer Bun versions can run the CLI, but bundle output can vary with the builder version. Git is required by the scoped-scan tests. Package verification needs `tar` and registry access. It uses npm when available, otherwise runs npm through Bun.
+Use Bun 1.4.0 for reproducible release builds. Newer Bun versions can run the CLI, but bundle output can vary with the builder version. Git is required by the scoped-scan tests. Package verification needs `tar` and registry access. It uses npm when available, otherwise runs npm through Bun.
 
 ## Work locally
 
 ```bash
 bun install --frozen-lockfile
-bun run build
 bun run check
 bun test
+bun run build
 ```
 
-Build before testing because the CI installer copies the bundled runtime into temporary test repositories. `bun test` runs fixture-based rules, Git scope cases, configuration tests, CLI subprocesses, and simulated GitHub API reporting. The API tests bind only to loopback and use a test token.
+`bun test` runs fixture-based rules, Git scope cases, configuration tests, CLI subprocesses, generated CI tests, and simulated GitHub API reporting. The API tests bind only to loopback and use a test token.
 
-Only `node_modules/` is ignored. Keep `dist/`, `vendor/`, and both lockfiles tracked; the GitHub Action runs the committed bundle directly.
+`dist/` is generated output and should not be committed. Keep `vendor/` and `bun.lock` tracked. npm's `prepack` hook rebuilds `dist/` before packing or publishing.
 
 ## Source layout
 
@@ -26,10 +26,10 @@ Only `node_modules/` is ignored. Keep `dist/`, `vendor/`, and both lockfiles tra
 | `src/project-effects.ts` | Source-visible effects and propagation. |
 | `src/rules/` | Rule definitions and repair guidance. |
 | `src/git.ts`, `src/scope.ts` | Git content selection and comparisons. |
-| `src/ci.ts` | Generated workflows, runtime copying, GitHub reporting. |
+| `src/ci.ts` | Generated workflows, npm version pinning, GitHub reporting. |
 | `vendor/` | Luau parser grammar and its license. |
 
-The build bundles `src/cli.ts` into `dist/cli.js`, leaving runtime dependencies external. Commit all `dist` files because the root GitHub Action runs them directly. The parser locates its grammar relative to the bundle; preserve the package directory structure when copying it.
+The build bundles `src/cli.ts` into `dist/cli.js`, leaving runtime dependencies external. `dist/` exists for the npm distribution, where the package `bin` points at `dist/cli.js`; it is not a source-controlled CI runtime. The parser locates its grammar relative to the published package layout.
 
 ## Change a rule
 
@@ -39,23 +39,24 @@ Check a proposed repair in Roblox where runtime behavior matters. Tests of synta
 
 ## Change CI
 
-Keep root `action.yml` synchronized with `renderPublishedGitHubAction()` in `src/ci.ts`. The test suite checks exact equality. Pass variable Action inputs through environment variables; do not interpolate them directly into shell source.
+Generated GitHub and GitLab workflows pin `${package name}@${package version}` from `package.json` and resolve the package from npm at run time. Keep the package version pin exact rather than using `latest` in generated CI, so a repository only changes analyzer versions when its workflow is regenerated.
 
-Generated CI copies runtime files from the installed package, restoring `bun.lock` from the packaged `dist/runtime-lock.json` when needed. npm excludes the original lockfile. The copied `package.json` records the analyzer version. Do not make an installer depend on an npm release that does not exist.
+Pass variable workflow values through environment variables rather than interpolating them directly into shell source. Tests cover generated settings, package pinning, and shell metacharacters.
 
-Repository CI typechecks, tests, executes the local composite Action against a fixture, verifies package contents, and compares rebuilt `dist` with committed output. Hosted Actions execution remains a separate check from local API simulation.
+Repository CI typechecks, tests, builds, and verifies the packed npm distribution. `dist/` is ignored, so CI does not compare generated bundle bytes against committed artifacts.
 
 ## Release checklist
 
-1. Update `package.json` and `package-lock.json` versions together. A version change also invalidates persistent analysis caches.
-2. Build with Bun 1.3.14, run typechecking and the full tests, and verify the root Action template.
-3. Run `bun run verify:package` to pack, inspect, install, scan, and generate CI from an isolated tarball. You can also run `npm pack --dry-run` to inspect the package list. It must include the bundle, grammar, lockfile, license notices, and docs. It must exclude tests, dependencies, and removed features.
-4. Install the actual tarball in a temporary project and run the CLI and `ci install`. This checks distribution paths separately from source tests.
-5. Commit source, documentation, and rebuilt `dist`. Push to `colrealpro/react-luau-doctor` and wait for GitHub CI.
-6. Test real PR reporting and a fork PR in a disposable repository before recommending required checks.
-7. Create a release tag only after the checks pass. If publishing npm, publish the verified version and then change the README's installation status and examples.
+1. Update the version in `package.json`. A version change also invalidates persistent analysis caches.
+2. Build with Bun 1.4.0 and run the full local checks with `bun run ci`.
+3. Run `npm pack --dry-run` to inspect the package list. It must include `dist/cli.js`, the grammar, license notices, and docs, while excluding tests, dependencies, development-only source files, and CI-only runtime copies.
+4. Run `bun run verify:package` to pack, install, scan, and generate CI from an isolated tarball.
+5. Commit source, documentation, and lockfile changes, then push to `colrealpro/react-luau-doctor` and wait for repository CI. Do not commit `dist/`.
+6. Publish the verified npm version and confirm `bunx @colrealpro/react-luau-doctor@<version> --version` resolves from the registry.
+7. Generate CI from the published version and test real PR reporting plus a fork PR in a disposable repository before recommending required checks.
+8. Create the matching release tag after the published package and hosted CI behavior are verified.
 
-Publishing npm is optional for source installation and the GitHub Action. npm distributes the developer CLI; it does not install a runtime library into Roblox. This checkout does not publish packages, create releases, or push changes automatically.
+npm distributes the developer CLI; it does not install a runtime library into Roblox. Release commands are still manual: this checkout does not publish packages, create releases, or push changes automatically.
 
 ## Report a problem
 

package/docs/rules.md

@@ -53,4 +53,4 @@ Errors, warnings, and suggestions express reporting policy, not proof of a runti
 
 The Binding candidate rule is suggestion-tier because the consumer may require ordinary state or a larger refactor. Array-index keys can also be intentional for collections with stable ordering. See [analysis limits](analysis.md) and [configuration](cli.md).
 
-Instance creation and tween operations during render are reported by `react-luau/no-side-effects-in-render`, with its severity and configuration. They do not have separate rule IDs or a lazy-ref severity exception.
+Instance creation and tween operations during render are reported by `react-luau/no-side-effects-in-render` and use that rule's severity and configuration.

package/package.json

@@ -3,8 +3,8 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.17.0",
-  "description": "A syntax-aware React-Luau code doctor inspired by React Doctor.",
+  "version": "0.17.2",
+  "description": "Static analysis for React-Luau hooks, effects, rendering, and performance.",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -16,8 +16,7 @@
     "README.md",
     "LICENSE",
     "THIRD_PARTY_NOTICES.md",
-    "docs",
-    "action.yml"
+    "docs"
   ],
   "scripts": {
     "build": "bun run scripts/build.ts",
@@ -29,14 +28,14 @@
     "verify:package": "bun run build && bun run scripts/verify-package.ts"
   },
   "engines": {
-    "bun": ">=1.3.14"
+    "bun": ">=1.4.0"
   },
-  "packageManager": "bun@1.3.14",
+  "packageManager": "bun@1.4.0",
   "dependencies": {
     "web-tree-sitter": "0.26.11"
   },
   "devDependencies": {
-    "@types/bun": "1.3.14",
+    "@types/bun": "1.4.0",
     "typescript": "5.8.3"
   },
   "keywords": [

package/action.yml

@@ -1,71 +0,0 @@
-name: React-Luau Doctor
-description: "Review React-Luau pull requests and report introduced diagnostics."
-inputs:
-  blocking:
-    description: "Severity that fails the workflow: error, warning, or none."
-    default: none
-  scope:
-    description: "Pull request scan scope: changed, files, lines, or full."
-    default: changed
-  comment:
-    description: "Create or update a sticky pull request summary comment."
-    default: "true"
-  review-comments:
-    description: "Post inline review comments on changed lines."
-    default: "true"
-  commit-status:
-    description: "Publish score and issue counts as a commit status."
-    default: "true"
-  project:
-    description: "Project directories to scan, comma-separated. Asterisk scans the whole directory."
-    default: "*"
-  directory:
-    description: "Project directory to scan."
-    default: "."
-outputs:
-  score:
-    description: "Health score from 0 to 100."
-    value: ${{ steps.doctor.outputs.score }}
-  total-issues:
-    description: "Total diagnostics reported by this run."
-    value: ${{ steps.doctor.outputs.total-issues }}
-  fixed-issues:
-    description: "Number of diagnostics resolved by the pull request."
-    value: ${{ steps.doctor.outputs.fixed-issues }}
-  error-count:
-    description: "Error diagnostic count."
-    value: ${{ steps.doctor.outputs.error-count }}
-  warning-count:
-    description: "Warning diagnostic count."
-    value: ${{ steps.doctor.outputs.warning-count }}
-  affected-files:
-    description: "Number of files with diagnostics."
-    value: ${{ steps.doctor.outputs.affected-files }}
-runs:
-  using: composite
-  steps:
-    - uses: oven-sh/setup-bun@v2
-      with:
-        bun-version: "1.3.14"
-    - name: Install parser runtime
-      shell: bash
-      run: |
-        cd "$GITHUB_ACTION_PATH"
-        bun install --production --frozen-lockfile
-    - id: doctor
-      shell: bash
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
-        DOCTOR_DIRECTORY: ${{ inputs.directory }}
-        DOCTOR_PROJECT: ${{ inputs.project }}
-        DOCTOR_BLOCKING: ${{ inputs.blocking }}
-        DOCTOR_SCOPE: ${{ inputs.scope }}
-      run: >-
-        bun "$GITHUB_ACTION_PATH/dist/cli.js" ci run
-        --directory "$DOCTOR_DIRECTORY"
-        --project "$DOCTOR_PROJECT"
-        --blocking "$DOCTOR_BLOCKING"
-        --scope "$DOCTOR_SCOPE"
-        ${{ inputs.comment == 'true' && '--comment' || '--no-comment' }}
-        ${{ inputs.review-comments == 'true' && '--review-comments' || '--no-review-comments' }}
-        ${{ inputs.commit-status == 'true' && '--commit-status' || '--no-commit-status' }}

package/dist/runtime-lock.json

@@ -1,29 +0,0 @@
-{
-  "lockfileVersion": 1,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "react-luau-doctor",
-      "dependencies": {
-        "web-tree-sitter": "0.26.11",
-      },
-      "devDependencies": {
-        "@types/bun": "1.3.14",
-        "typescript": "5.8.3",
-      },
-    },
-  },
-  "packages": {
-    "@types/bun": ["@types/bun@1.3.14", "https://registry.npmjs.org/@types/bun/-/bun-1.3.14.tgz", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
-
-    "@types/node": ["@types/node@26.1.1", "https://registry.npmjs.org/@types/node/-/node-26.1.1.tgz", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-nxAkRSVkN1Y0JC1W8ky/fTfkGsMmcrRsbx+3XoZE+rMOX71kLYTV7fLXpqud1GpbpP5TuffXFqfX7fH2GgZREw=="],
-
-    "bun-types": ["bun-types@1.3.14", "https://registry.npmjs.org/bun-types/-/bun-types-1.3.14.tgz", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
-
-    "typescript": ["typescript@5.8.3", "https://registry.npmjs.org/typescript/-/typescript-5.8.3.tgz", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-p1diW6TqL9L07nNxvRMM7hMMw4c5XOo/1ibL4aAIGmSAt9slTE1Xgw5KWuof2uTOvCg9BY7ZRi+GaF+7sfgPeQ=="],
-
-    "undici-types": ["undici-types@8.3.0", "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="],
-
-    "web-tree-sitter": ["web-tree-sitter@0.26.11", "https://registry.npmjs.org/web-tree-sitter/-/web-tree-sitter-0.26.11.tgz", {}, "sha512-Q5Dm3YTIXSXuH6FxX6RuzX2Qwpc4DPGiYMU87Wg5Z8OIStiQFiUex4zMDc0vBTw78EphaYJacncJghCHzbZptg=="],
-  }
-}