@lzear/repo-lint 4.2.2 → 4.4.0

package/README.md

@@ -3,7 +3,7 @@
 [![npm](https://img.shields.io/npm/v/@lzear/repo-lint)](https://www.npmjs.com/package/@lzear/repo-lint)
 [![license](https://img.shields.io/npm/l/@lzear/repo-lint)](../../LICENSE)
 
-Checks lzear repos against forge standards. Used internally by `forge check`.
+Checks lzear repos against forge standards and keeps them fresh. Used internally by `forge check` and `forge update`.
 
 ## Install
 
@@ -58,24 +58,41 @@ interface RepoReport {
 }
 ```
 
+### `runUpdate(options?)`
+
+Powers `forge update`. Detects the package manager (npm, yarn, pnpm, bun) and updates dependency ranges (ncu, honoring `.ncurc{,.json,.js,.cjs,.mjs}`), the `packageManager` field, `.nvmrc`/`.node-version` (latest Node LTS), and `.bun-version`, then installs & refreshes the lockfile.
+
+```ts
+import { detectPackageManager, runUpdate } from '@lzear/repo-lint'
+
+const report = await runUpdate({ dry: true })
+// { dir, packageManager: { name: 'yarn', version: '4.17.1', … }, results: [...] }
+```
+
+| Option    | Type      | Default         | Description                        |
+|-----------|-----------|-----------------|------------------------------------|
+| `dir`     | `string`  | `process.cwd()` | Repo to update                     |
+| `dry`     | `boolean` | `false`         | Report changes without writing     |
+| `install` | `boolean` | `true`          | Run install/lockfile refresh after |
+
 ## Checks performed
 
-| Check                          | Description                                           |
-|--------------------------------|-------------------------------------------------------|
-| `readme-exists`                | `README.md` exists                                    |
-| `readme-npm-badge`             | README has an npm badge                               |
-| `readme-codacy-grade-badge`    | README has Codacy grade badge                         |
-| `readme-codacy-coverage-badge` | README has Codacy coverage badge                      |
-| `codacy-config`                | `.codacy.yml` exists                                  |
-| `license`                      | `LICENSE` exists                                      |
-| `ci-workflow`                  | `.github/workflows/ci.yml` exists                     |
-| `renovate`                     | `renovate.json` exists                                |
-| `pkg-publint`                  | All published packages pass `publint`                 |
-| `pkg-attw`                     | All published packages pass `attw` (ESM-only profile) |
-| `pkg-knip`                     | No unused exports or dependencies (`knip`)            |
-| `deps-fresh`                   | All dependencies up to date (`ncu`)                   |
-| `secret-npm-token`             | GitHub secret `NPM_TOKEN` is set                      |
-| `secret-codacy-token`          | GitHub secret `CODACY_PROJECT_TOKEN` is set           |
+| Check                 | Description                                               |
+|-----------------------|-----------------------------------------------------------|
+| `readme-exists`       | `README.md` exists                                        |
+| `readme-npm-badge`    | README has an npm badge                                   |
+| `codacy`              | Codacy grade & coverage badges in README, `.codacy.yml`   |
+| `license`             | `LICENSE` exists                                          |
+| `ci-workflow`         | a workflow calls the forge reusable CI workflow           |
+| `renovate`            | `renovate.json` exists                                    |
+| `pkg-publint`         | All published packages pass `publint`                     |
+| `pkg-attw`            | All published packages pass `attw` (ESM-only profile)     |
+| `pkg-knip`            | No unused exports or dependencies (`knip`)                |
+| `monorepo-lint`       | Workspace consistency (`sherif`, monorepos only)          |
+| `deps-audit`          | No known vulnerabilities (PM-native `audit`, prod, high+) |
+| `deps-deprecated`     | No direct dependency resolves to a deprecated version     |
+| `deps-fresh`          | All dependencies up to date (`ncu`)                       |
+| `secret-codacy-token` | GitHub secret `CODACY_PROJECT_TOKEN` is set               |
 
 ## Part of forge
 

package/dist/bin.js

@@ -7,150 +7,265 @@ import { parseArgs } from "util";
 
 // src/index.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync3 } from "fs";
 import { tmpdir } from "os";
-import path2 from "path";
+import path3 from "path";
 
 // src/checks.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
+import { run as ncuRun2 } from "npm-check-updates";
+import { publint } from "publint";
+import { maxSatisfying, satisfies } from "semver";
+
+// src/update.ts
 import { spawnSync } from "child_process";
-import { existsSync, readdirSync, readFileSync } from "fs";
+import { existsSync, readFileSync, writeFileSync } from "fs";
 import path from "path";
-import { fileURLToPath } from "url";
+import { pathToFileURL } from "url";
 import { run as ncuRun } from "npm-check-updates";
-import { publint } from "publint";
-var _dirname = path.dirname(fileURLToPath(import.meta.url));
-var readPkg = (dir) => {
-  const f = path.join(dir, "package.json");
-  if (!existsSync(f)) return null;
+var LOCKFILES = [
+  ["bun.lock", "bun"],
+  ["bun.lockb", "bun"],
+  ["pnpm-lock.yaml", "pnpm"],
+  ["yarn.lock", "yarn"],
+  ["package-lock.json", "npm"]
+];
+var PM_FIELD_RE = /^(npm|yarn|pnpm|bun)@([^+\s]+)/;
+var detectPackageManager = (dir) => {
+  const packageFile = path.join(dir, "package.json");
+  if (existsSync(packageFile))
+    try {
+      const package_ = JSON.parse(readFileSync(packageFile, "utf8"));
+      if (typeof package_.packageManager === "string") {
+        const match = PM_FIELD_RE.exec(package_.packageManager);
+        if (match?.[1] && match[2])
+          return {
+            name: match[1],
+            version: match[2],
+            source: "packageManager"
+          };
+      }
+    } catch {
+    }
+  for (const [file, name] of LOCKFILES)
+    if (existsSync(path.join(dir, file))) return { name, source: "lockfile" };
+  return { name: "npm", source: "default" };
+};
+
+// src/checks.ts
+var _dirname = path2.dirname(fileURLToPath(import.meta.url));
+var readPackage = (dir) => {
+  const f = path2.join(dir, "package.json");
+  if (!existsSync2(f)) return null;
   try {
-    return JSON.parse(readFileSync(f, "utf8"));
+    return JSON.parse(readFileSync2(f, "utf8"));
   } catch {
     return null;
   }
 };
-var getWorkspacePatterns = (pkg) => {
-  const ws = pkg.workspaces;
+var getWorkspacePatterns = (package_) => {
+  const ws = package_.workspaces;
   if (Array.isArray(ws)) return ws;
-  const wsPkg = ws;
-  if (Array.isArray(wsPkg?.packages)) return wsPkg.packages;
+  const wsPackage = ws;
+  if (Array.isArray(wsPackage?.packages)) return wsPackage.packages;
   return [];
 };
 var patternToBase = (rootDir, pattern) => {
   const parts = pattern.split("/");
   if (parts.length === 2 && parts[1] === "*")
-    return path.join(rootDir, parts[0] ?? "");
+    return path2.join(rootDir, parts[0] ?? "");
   if (parts.length === 1 && parts[0] === "*") return rootDir;
   return null;
 };
-var getWorkspaceDirs = (rootDir) => {
-  const pkg = readPkg(rootDir);
-  if (!pkg) return [];
-  const dirs = [];
-  for (const pattern of getWorkspacePatterns(pkg)) {
+var getWorkspaceDirectories = (rootDir) => {
+  const package_ = readPackage(rootDir);
+  if (!package_) return [];
+  const directories = [];
+  for (const pattern of getWorkspacePatterns(package_)) {
     const base = patternToBase(rootDir, pattern);
-    if (!base || !existsSync(base)) continue;
-    for (const entry of readdirSync(base, { withFileTypes: true }))
-      if (entry.isDirectory()) dirs.push(path.join(base, entry.name));
+    if (!base || !existsSync2(base)) continue;
+    const entries = readdirSync(base, { withFileTypes: true });
+    for (const entry of entries)
+      if (entry.isDirectory()) directories.push(path2.join(base, entry.name));
   }
-  return dirs;
+  return directories;
 };
 var findBin = (name, startDir) => {
   let dir = startDir;
   while (true) {
-    const bin = path.join(dir, "node_modules", ".bin", name);
-    if (existsSync(bin)) return bin;
-    const parent = path.join(dir, "..");
+    const bin = path2.join(dir, "node_modules", ".bin", name);
+    if (existsSync2(bin)) return bin;
+    const parent = path2.join(dir, "..");
     if (parent === dir) return null;
     dir = parent;
   }
 };
-var eachPublishedPkg = async (dir, fn) => {
-  const pkg = readPkg(dir);
-  if (!pkg) return { pass: true };
-  if (pkg.private === true) {
-    const wsDirs = getWorkspaceDirs(dir);
-    if (wsDirs.length === 0) return { pass: true };
+var eachPublishedPackage = async (dir, function_) => {
+  const package_ = readPackage(dir);
+  if (!package_) return { pass: true };
+  if (package_.private === true) {
+    const wsDirectories = getWorkspaceDirectories(dir);
+    if (wsDirectories.length === 0) return { pass: true };
     const results = await Promise.all(
-      wsDirs.map((d) => eachPublishedPkg(d, fn))
+      wsDirectories.map((d) => eachPublishedPackage(d, function_))
     );
     const failures = results.filter((r) => !r.pass);
     if (failures.length === 0) return { pass: true };
     const detail = failures.flatMap((r) => r.detail ? [r.detail] : []).join("\n");
     return { pass: false, ...detail && { detail } };
   }
-  return fn(dir);
+  return function_(dir);
 };
 var hasPublishedPkg = (dir) => {
-  const pkg = readPkg(dir);
-  if (!pkg) return false;
-  if (pkg.private !== true) return true;
-  return getWorkspaceDirs(dir).some((d) => hasPublishedPkg(d));
+  const package_ = readPackage(dir);
+  if (!package_) return false;
+  if (package_.private !== true) return true;
+  return getWorkspaceDirectories(dir).some((d) => hasPublishedPkg(d));
 };
 var readmeIncludes = (dir, needle) => {
-  const f = path.join(dir, "README.md");
-  return existsSync(f) && readFileSync(f, "utf8").includes(needle);
+  const f = path2.join(dir, "README.md");
+  return existsSync2(f) && readFileSync2(f, "utf8").includes(needle);
+};
+var FORGE_WORKFLOW_RE = /uses:\s*lzear\/forge\/\.github\/workflows\/ci\.yml@/;
+var isForgeRepo = (dir) => getWorkspaceDirectories(dir).some(
+  (d) => readPackage(d)?.name === "@lzear/forge"
+);
+var callsForgeWorkflow = (dir) => {
+  const wfDir = path2.join(dir, ".github", "workflows");
+  if (!existsSync2(wfDir)) return false;
+  return readdirSync(wfDir).filter((f) => /\.ya?ml$/.test(f)).some(
+    (f) => FORGE_WORKFLOW_RE.test(readFileSync2(path2.join(wfDir, f), "utf8"))
+  );
+};
+var auditCommand = (pm) => {
+  switch (pm.name) {
+    case "npm":
+      return ["npm", "audit", "--omit", "dev", "--audit-level", "high"];
+    case "pnpm":
+      return ["pnpm", "audit", "--prod", "--audit-level", "high"];
+    case "bun":
+      return ["bun", "audit"];
+    case "yarn":
+      return pm.version?.startsWith("1.") ? ["yarn", "audit", "--level", "high"] : [
+        "yarn",
+        "npm",
+        "audit",
+        "--environment",
+        "production",
+        "--severity",
+        "high"
+      ];
+  }
+};
+var DEP_FIELDS = [
+  "dependencies",
+  "devDependencies",
+  "optionalDependencies",
+  "peerDependencies"
+];
+var NON_REGISTRY_RANGE_RE = /^(?:workspace:|file:|link:|portal:|catalog:|git|https?:)/;
+var collectEntry = (dependencies, name, range) => {
+  if (typeof range !== "string" || NON_REGISTRY_RANGE_RE.test(range)) return;
+  const alias = /^npm:(.+)@([^@]+)$/.exec(range);
+  const target = alias?.[1] ?? name;
+  const targetRange = alias?.[2] ?? range;
+  if (!dependencies.has(target)) dependencies.set(target, targetRange);
+};
+var collectFromPackage = (dependencies, packageDir) => {
+  const package_ = readPackage(packageDir);
+  for (const field of DEP_FIELDS) {
+    const section = package_?.[field];
+    if (typeof section !== "object" || section === null) continue;
+    for (const [name, range] of Object.entries(section))
+      collectEntry(dependencies, name, range);
+  }
+};
+var collectDependencies = (dir) => {
+  const dependencies = /* @__PURE__ */ new Map();
+  for (const packageDir of [dir, ...getWorkspaceDirectories(dir)])
+    collectFromPackage(dependencies, packageDir);
+  return dependencies;
+};
+var findDeprecated = async (name, range) => {
+  const response = await fetch(
+    `https://registry.npmjs.org/${name.replace("/", "%2F")}`,
+    {
+      headers: { accept: "application/vnd.npm.install-v1+json" },
+      signal: AbortSignal.timeout(1e4)
+    }
+  );
+  if (!response.ok) throw new Error(`HTTP ${response.status}`);
+  const data = await response.json();
+  const latest = data["dist-tags"]?.latest;
+  const resolved = latest && satisfies(latest, range) ? latest : maxSatisfying(Object.keys(data.versions), range);
+  if (!resolved) return null;
+  const deprecated = data.versions[resolved]?.deprecated;
+  return deprecated ? `${name}@${resolved} \u2014 ${deprecated.slice(0, 120)}` : null;
 };
 var LOCAL_CHECKS = [
   {
     id: "readme-exists",
-    desc: "README.md exists",
-    type: "local",
-    check: (dir) => existsSync(path.join(dir, "README.md"))
-  },
-  {
-    id: "readme-codacy-grade-badge",
-    desc: "README has Codacy grade badge",
+    desc: "README",
     type: "local",
-    publishedOnly: true,
-    check: (dir) => readmeIncludes(dir, "project/badge/Grade/")
-  },
-  {
-    id: "readme-codacy-coverage-badge",
-    desc: "README has Codacy coverage badge",
-    type: "local",
-    publishedOnly: true,
-    check: (dir) => readmeIncludes(dir, "project/badge/Coverage/")
+    check: (dir) => existsSync2(path2.join(dir, "README.md"))
   },
   {
     id: "readme-npm-badge",
-    desc: "README has npm badge",
+    desc: "npm badge",
     type: "local",
     publishedOnly: true,
     check: (dir) => readmeIncludes(dir, "shields.io/npm/v/")
   },
   {
-    id: "codacy-config",
-    desc: ".codacy.yml exists",
+    id: "codacy",
+    desc: "Codacy",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, ".codacy.yml"))
+    check: (dir) => {
+      const missing = [
+        readmeIncludes(dir, "project/badge/Grade/") ? null : "grade badge missing in README",
+        readmeIncludes(dir, "project/badge/Coverage/") ? null : "coverage badge missing in README",
+        existsSync2(path2.join(dir, ".codacy.yml")) ? null : ".codacy.yml missing"
+      ].filter((m) => m !== null);
+      if (missing.length === 0) return true;
+      return { pass: false, detail: missing.join("\n") };
+    }
   },
   {
     id: "license",
-    desc: "LICENSE exists",
+    desc: "LICENSE",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, "LICENSE"))
+    check: (dir) => existsSync2(path2.join(dir, "LICENSE"))
   },
   {
     id: "ci-workflow",
-    desc: "CI workflow exists",
+    desc: "CI calls forge workflow",
     type: "local",
     publishedOnly: true,
-    check: (dir) => existsSync(path.join(dir, ".github/workflows/ci.yml"))
+    check: (dir) => {
+      if (callsForgeWorkflow(dir) || isForgeRepo(dir)) return true;
+      return {
+        pass: false,
+        detail: "no workflow calls the forge reusable CI \u2014 replace the local ci.yml copy with:\n  jobs:\n    ci:\n      uses: lzear/forge/.github/workflows/ci.yml@<sha> # vX.Y.Z\n(pin to a commit SHA; renovate keeps it fresh)"
+      };
+    }
   },
   {
     id: "renovate",
-    desc: "renovate.json exists",
+    desc: "renovate.json",
     type: "local",
-    check: (dir) => existsSync(path.join(dir, "renovate.json"))
+    check: (dir) => existsSync2(path2.join(dir, "renovate.json"))
   },
   {
     id: "pkg-publint",
-    desc: "publint (all published packages)",
+    desc: "publint",
     type: "local",
     publishedOnly: true,
-    check: (dir) => eachPublishedPkg(dir, async (pkgDir) => {
+    check: (dir) => eachPublishedPackage(dir, async (pkgDir) => {
       const { messages } = await publint({ pkgDir });
       const failures = messages.filter(
         (m) => m.type === "error" || m.type === "warning"
@@ -164,13 +279,13 @@ var LOCAL_CHECKS = [
   },
   {
     id: "pkg-attw",
-    desc: "attw (all published packages)",
+    desc: "attw",
     type: "local",
     check: (dir) => {
       const bin = findBin("attw", _dirname);
       if (!bin) return { pass: false, detail: "attw not available" };
-      return eachPublishedPkg(dir, (pkgDir) => {
-        const r = spawnSync(
+      return eachPublishedPackage(dir, (pkgDir) => {
+        const r = spawnSync2(
           process.execPath,
           [bin, "--pack", "--profile", "esm-only"],
           {
@@ -186,12 +301,12 @@ var LOCAL_CHECKS = [
   },
   {
     id: "pkg-knip",
-    desc: "knip (no unused exports/deps)",
+    desc: "knip",
     type: "local",
     check: (dir) => {
       const bin = findBin("knip", _dirname);
       if (!bin) return { pass: false, detail: "knip not available" };
-      const r = spawnSync(process.execPath, [bin], {
+      const r = spawnSync2(process.execPath, [bin], {
         cwd: dir,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"],
@@ -204,17 +319,80 @@ var LOCAL_CHECKS = [
 Run: npx knip` };
     }
   },
+  {
+    id: "monorepo-lint",
+    desc: "sherif (workspaces)",
+    type: "local",
+    check: (dir) => {
+      const package_ = readPackage(dir);
+      if (!package_ || getWorkspacePatterns(package_).length === 0)
+        return { pass: true, detail: "not a monorepo" };
+      const bin = findBin("sherif", _dirname);
+      if (!bin) return { pass: false, detail: "sherif not available" };
+      const r = spawnSync2(process.execPath, [bin], {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env, NO_COLOR: "1" }
+      });
+      if (r.status === 0) return true;
+      const detail = (r.stdout + r.stderr).trim().split("\n").slice(0, 20).join("\n");
+      return { pass: false, detail };
+    }
+  },
+  {
+    id: "deps-audit",
+    desc: "audit",
+    type: "local",
+    check: (dir) => {
+      const pm = detectPackageManager(dir);
+      const [command, ...arguments_] = auditCommand(pm);
+      const r = spawnSync2(command, arguments_, {
+        cwd: dir,
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      if (r.error) return { pass: false, detail: String(r.error) };
+      if (r.status === 0) return true;
+      const detail = (r.stdout + r.stderr).trim().split("\n").slice(0, 20).join("\n");
+      return { pass: false, detail: detail || `audit exited ${r.status}` };
+    }
+  },
+  {
+    id: "deps-deprecated",
+    desc: "no deprecated deps",
+    type: "local",
+    check: async (dir) => {
+      const dependencies = collectDependencies(dir);
+      const failures = [];
+      await Promise.all(
+        [...dependencies].map(async ([name, range]) => {
+          try {
+            const deprecated = await findDeprecated(name, range);
+            if (deprecated) failures.push(deprecated);
+          } catch (error) {
+            failures.push(`${name} \u2014 check failed: ${String(error)}`);
+          }
+        })
+      );
+      if (failures.length === 0) return true;
+      return {
+        pass: false,
+        detail: failures.toSorted((a, b) => a.localeCompare(b)).join("\n")
+      };
+    }
+  },
   {
     id: "deps-fresh",
-    desc: "dependencies up to date (ncu)",
+    desc: "deps up to date",
     type: "local",
     check: async (dir) => {
-      const pkg = readPkg(dir);
-      const hasWorkspaces = Array.isArray(pkg?.workspaces) && pkg.workspaces.length > 0;
+      const package_ = readPackage(dir);
+      const hasWorkspaces = Array.isArray(package_?.workspaces) && package_.workspaces.length > 0;
       try {
-        const result = await ncuRun({
-          packageFile: path.join(dir, "package.json"),
-          ...hasWorkspaces ? { workspaces: true } : {},
+        const result = await ncuRun2({
+          packageFile: path2.join(dir, "package.json"),
+          ...hasWorkspaces && { workspaces: true },
           silent: true
         });
         const entries = hasWorkspaces ? Object.values(
@@ -222,10 +400,9 @@ Run: npx knip` };
         ).flatMap((x) => Object.entries(x)) : Object.entries(result);
         if (entries.length === 0) return true;
         const lines = entries.map(([k, v]) => `${k}  \u2192  ${v}`).join("\n");
-        const cmd = hasWorkspaces ? "yarn dlx npm-check-updates --dep dev,optional,peer,prod,packageManager -u --workspaces && yarn install" : "yarn dlx npm-check-updates --dep dev,optional,peer,prod,packageManager -u && yarn install";
         return { pass: false, detail: `${lines}
 
-Run: ${cmd}` };
+Run: forge update` };
       } catch (error) {
         return { pass: false, detail: String(error) };
       }
@@ -234,7 +411,7 @@ Run: ${cmd}` };
 ];
 var listSecrets = (repo) => {
   try {
-    const result = spawnSync(
+    const result = spawnSync2(
       "gh",
       ["secret", "list", "--repo", repo, "--json", "name"],
       {
@@ -251,7 +428,7 @@ var listSecrets = (repo) => {
 var REMOTE_CHECKS = [
   {
     id: "secret-codacy-token",
-    desc: "Secret CODACY_PROJECT_TOKEN set",
+    desc: "Codacy secret",
     type: "remote",
     publishedOnly: true,
     check: (repo) => {
@@ -272,19 +449,21 @@ var checkLocal = async (options = {}) => {
         stdio: ["ignore", "pipe", "ignore"]
       }).trim();
       const match = /github\.com[:/](.+?)(?:\.git)?$/.exec(remote);
-      return match?.[1] ?? path2.basename(dir);
+      return match?.[1] ?? path3.basename(dir);
     } catch {
       return dir;
     }
   })();
-  const published = hasPublishedPkg(dir);
+  const isPublished = hasPublishedPkg(dir);
   const localResults = await Promise.all(
-    LOCAL_CHECKS.filter((c) => !c.publishedOnly || published).map(async (c) => {
-      const raw = await c.check(dir);
-      return typeof raw === "boolean" ? { id: c.id, desc: c.desc, pass: raw } : { id: c.id, desc: c.desc, ...raw };
-    })
+    LOCAL_CHECKS.filter((c) => !c.publishedOnly || isPublished).map(
+      async (c) => {
+        const raw = await c.check(dir);
+        return typeof raw === "boolean" ? { id: c.id, desc: c.desc, pass: raw } : { id: c.id, desc: c.desc, ...raw };
+      }
+    )
   );
-  const remoteResults = skipRemote ? [] : REMOTE_CHECKS.filter((c) => !c.publishedOnly || published).map((c) => ({
+  const remoteResults = skipRemote ? [] : REMOTE_CHECKS.filter((c) => !c.publishedOnly || isPublished).map((c) => ({
     id: c.id,
     desc: c.desc,
     pass: c.check(repo)
@@ -294,11 +473,11 @@ var checkLocal = async (options = {}) => {
 var checkRepo = async (repo, options = {}) => {
   const {
     token,
-    baseDir = path2.join(tmpdir(), "repo-lint"),
+    baseDir = path3.join(tmpdir(), "repo-lint"),
     skipRemote = false
   } = options;
-  const dir = path2.join(baseDir, repo.replace("/", "__"));
-  if (existsSync2(dir))
+  const dir = path3.join(baseDir, repo.replace("/", "__"));
+  if (existsSync3(dir))
     execSync(`git -C ${dir} pull --quiet`, { stdio: "ignore" });
   else {
     const url = token ? `https://${token}@github.com/${repo}.git` : `https://github.com/${repo}.git`;
@@ -329,24 +508,24 @@ var { values } = parseArgs({
   }
 });
 var printReport = (result) => {
-  let anyFail = false;
+  let isAnyFail = false;
   const pass = result.results.filter((r) => r.pass).length;
   const total = result.results.length;
   for (const r of result.results) {
     console.log(`  ${r.pass ? "\u2713" : "\u2717"} ${r.desc}`);
-    if (!r.pass) anyFail = true;
+    if (!r.pass) isAnyFail = true;
   }
   console.log(`
   ${pass}/${total} checks passed`);
-  return anyFail;
+  return isAnyFail;
 };
 var main = async () => {
-  let anyFail = false;
+  let isAnyFail = false;
   if (values.local) {
     console.log(`
 \u2500\u2500 ${process.cwd()}`);
     const result = await checkLocal({ skipRemote: values["skip-remote"] });
-    anyFail = printReport(result);
+    isAnyFail = printReport(result);
   } else {
     if (!values.repos) {
       console.error(
@@ -355,7 +534,8 @@ var main = async () => {
       process.exit(1);
     }
     mkdirSync(values.dir, { recursive: true });
-    for (const repo of values.repos.split(",").map((r) => r.trim())) {
+    const repos = values.repos.split(",").map((r) => r.trim());
+    for (const repo of repos) {
       console.log(`
 \u2500\u2500 ${repo}`);
       try {
@@ -364,13 +544,13 @@ var main = async () => {
           baseDir: values.dir,
           skipRemote: values["skip-remote"]
         });
-        if (printReport(result)) anyFail = true;
+        if (printReport(result)) isAnyFail = true;
       } catch {
         console.log("  \u2717 could not clone repo");
-        anyFail = true;
+        isAnyFail = true;
       }
     }
   }
-  process.exit(anyFail ? 1 : 0);
+  process.exit(isAnyFail ? 1 : 0);
 };
-void main();
+await main();