@davidvornholt/standards 0.1.0 → 0.2.0

package/package.json

@@ -1,8 +1,17 @@
 {
   "name": "@davidvornholt/standards",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Bootstrap, synchronize, and validate davidvornholt/standards consumers",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/davidvornholt/standards.git",
+    "directory": "packages/standards-cli"
+  },
+  "homepage": "https://github.com/davidvornholt/standards#readme",
+  "bugs": {
+    "url": "https://github.com/davidvornholt/standards/issues"
+  },
   "type": "module",
   "bin": {
     "standards": "src/cli.ts"
@@ -19,7 +28,7 @@
     "test": "bun test"
   },
   "devDependencies": {
-    "@davidvornholt/typescript-config": "workspace:*",
+    "@davidvornholt/typescript-config": "0.0.0",
     "@types/bun": "^1.3.14",
     "typescript": "7.0.2"
   },

package/src/cli.ts

@@ -33,6 +33,8 @@ import {
 } from 'node:path';
 import process from 'node:process';
 
+const { YAML: BunYaml } = await import('bun');
+
 const DEFAULT_UPSTREAM = 'github:davidvornholt/standards';
 
 // Characters of a sha256 hex digest shown in drift reports; enough to identify.
@@ -477,6 +479,179 @@ const hasStandardsImport = (justfile: string): boolean =>
     );
   });
 
+const DEPENDABOT_BASELINE_ECOSYSTEMS = ['bun', 'github-actions'] as const;
+const DEPENDABOT_SCHEDULE_INTERVALS = new Set([
+  'daily',
+  'weekly',
+  'monthly',
+  'quarterly',
+  'semiannually',
+  'yearly',
+  'cron',
+]);
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === 'object' && value !== null && !Array.isArray(value);
+
+const isNonEmptyString = (value: unknown): value is string =>
+  typeof value === 'string' && value.length > 0;
+
+type DependabotUpdateInspection = {
+  readonly problems: ReadonlyArray<string>;
+  readonly rootEcosystem: string | null;
+};
+
+const inspectDependabotSchedule = (
+  schedule: unknown,
+  label: string,
+): ReadonlyArray<string> => {
+  if (!(isRecord(schedule) && isNonEmptyString(schedule.interval))) {
+    return [`${label} must define schedule.interval`];
+  }
+  if (!DEPENDABOT_SCHEDULE_INTERVALS.has(schedule.interval)) {
+    return [`${label} has an unsupported schedule.interval`];
+  }
+  if (schedule.interval === 'cron' && !isNonEmptyString(schedule.cronjob)) {
+    return [`${label} must define schedule.cronjob for a cron interval`];
+  }
+  return [];
+};
+
+type DependabotGroupInspection = {
+  readonly problems: ReadonlyArray<string>;
+  readonly scheduledGroups: ReadonlySet<string>;
+};
+
+const inspectDependabotGroups = (
+  groups: unknown,
+): DependabotGroupInspection => {
+  if (groups === undefined) {
+    return { problems: [], scheduledGroups: new Set() };
+  }
+  if (!isRecord(groups)) {
+    return {
+      problems: [
+        '.github/dependabot.yml multi-ecosystem-groups must be a mapping',
+      ],
+      scheduledGroups: new Set(),
+    };
+  }
+
+  const problems: Array<string> = [];
+  const scheduledGroups = new Set<string>();
+  for (const [name, group] of Object.entries(groups)) {
+    const label = `.github/dependabot.yml multi-ecosystem-groups.${name}`;
+    const groupProblems = isRecord(group)
+      ? inspectDependabotSchedule(group.schedule, label)
+      : [`${label} must be a mapping`];
+    problems.push(...groupProblems);
+    if (groupProblems.length === 0) {
+      scheduledGroups.add(name);
+    }
+  }
+  return { problems, scheduledGroups };
+};
+
+const inspectDependabotUpdate = (
+  update: unknown,
+  index: number,
+  scheduledGroups: ReadonlySet<string>,
+): DependabotUpdateInspection => {
+  const label = `.github/dependabot.yml updates[${index}]`;
+  if (!isRecord(update)) {
+    return { problems: [`${label} must be a mapping`], rootEcosystem: null };
+  }
+
+  const {
+    directory,
+    directories,
+    schedule,
+    'multi-ecosystem-group': multiEcosystemGroup,
+    'package-ecosystem': ecosystem,
+  } = update;
+  const problems: Array<string> = [];
+  if (!isNonEmptyString(ecosystem)) {
+    problems.push(`${label} must define package-ecosystem`);
+  }
+
+  const hasDirectory = isNonEmptyString(directory);
+  const hasDirectories =
+    Array.isArray(directories) &&
+    directories.length > 0 &&
+    directories.every(isNonEmptyString);
+  if (hasDirectory === hasDirectories) {
+    problems.push(
+      `${label} must define exactly one of directory or directories`,
+    );
+  }
+
+  if (schedule === undefined && isNonEmptyString(multiEcosystemGroup)) {
+    if (!scheduledGroups.has(multiEcosystemGroup)) {
+      problems.push(
+        `${label} must reference a scheduled multi-ecosystem group`,
+      );
+    }
+  } else {
+    problems.push(...inspectDependabotSchedule(schedule, label));
+  }
+
+  const targetsRoot =
+    directory === '/' ||
+    (Array.isArray(directories) && directories.includes('/'));
+  return {
+    problems,
+    rootEcosystem:
+      isNonEmptyString(ecosystem) && targetsRoot ? ecosystem : null,
+  };
+};
+
+const inspectDependabot = (raw: string): ReadonlyArray<string> => {
+  const problems: Array<string> = [];
+  let config: unknown;
+  try {
+    config = BunYaml.parse(raw);
+  } catch {
+    return ['.github/dependabot.yml must contain valid YAML'];
+  }
+
+  if (!isRecord(config)) {
+    return ['.github/dependabot.yml must contain a YAML mapping'];
+  }
+  if (config.version !== 2) {
+    problems.push('.github/dependabot.yml must use version: 2');
+  }
+
+  const { updates, 'multi-ecosystem-groups': multiEcosystemGroups } = config;
+  if (!Array.isArray(updates)) {
+    problems.push('.github/dependabot.yml must define an updates list');
+    return problems;
+  }
+
+  const groupInspection = inspectDependabotGroups(multiEcosystemGroups);
+  problems.push(...groupInspection.problems);
+  const rootEcosystems = new Set<string>();
+  for (const [index, update] of updates.entries()) {
+    const inspection = inspectDependabotUpdate(
+      update,
+      index,
+      groupInspection.scheduledGroups,
+    );
+    problems.push(...inspection.problems);
+    if (inspection.rootEcosystem !== null) {
+      rootEcosystems.add(inspection.rootEcosystem);
+    }
+  }
+
+  for (const ecosystem of DEPENDABOT_BASELINE_ECOSYSTEMS) {
+    if (!rootEcosystems.has(ecosystem)) {
+      problems.push(
+        `.github/dependabot.yml must include a root-directory ${ecosystem} ecosystem`,
+      );
+    }
+  }
+  return problems;
+};
+
 const inspectPackageJson = (packageRaw: string): ReadonlyArray<string> => {
   const problems: Array<string> = [];
   const packageJson = JSON.parse(packageRaw) as Record<string, unknown>;
@@ -514,6 +689,15 @@ const runDoctor = async (consumer: string): Promise<boolean> => {
     problems.push('AGENTS.local.md must exist for project-specific guidance');
   }
 
+  const dependabot = await readTextIfPresent(
+    join(consumer, '.github/dependabot.yml'),
+  );
+  if (dependabot === null) {
+    problems.push('.github/dependabot.yml must exist');
+  } else {
+    problems.push(...inspectDependabot(dependabot));
+  }
+
   const packagePath = join(consumer, 'package.json');
   const packageRaw = await readTextIfPresent(packagePath);
   if (packageRaw === null) {