@rmartz/pr-policy 0.9.1 → 0.10.0

package/README.md

@@ -16,6 +16,7 @@ new required-status name.
 | --------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | **Blocking labels** ([docs](docs/checks/merge-block.md))              | The PR carries `do not merge`, `dnm`, `blocked`, or `escalation needed` (shows as pending).                                                                                                                                        |
 | **CI-change classification** ([docs](docs/checks/ci-change.md))       | A `.github/workflows/**` change loosens CI (a removed job, `continue-on-error`, a narrowed trigger, …) and no human has applied `CI change approved` (shows as pending). Owns `CI approval needed`.                                |
+| **Base branch** ([docs](docs/checks/base-branch.md))                  | The PR targets a branch other than the default and it isn't a non-epic PR on an open epic's branch. A stacked PR waits for its base PR (shows as pending); a base no open PR heads blocks.                                         |
 | **Title-type rules** ([docs](docs/checks/title.md))                   | The squash title isn't a valid Conventional Commit, puts `!` on a non-functional type, disagrees with the `breaking change` label, or types a linter/formatter bump as a non-release, non-`ci` type.                               |
 | **UAT sign-off** ([docs](docs/checks/uat.md))                         | The PR isn't docs, tests, CI, dependency-only, or repo metadata, and no trusted user has applied `UAT passed` (or `tested`) or `no UAT needed` (shows as pending).                                                                 |
 | **Dependabot claim verification** ([docs](docs/checks/dependabot.md)) | A Dependabot PR touches a non-dependency path, changes a dependency its description doesn't claim, pins a version other than the claimed one, or edits anything Dependabot never edits (a `package.json` script, a workflow step). |

package/dist/bin/pr-policy.js

@@ -7,7 +7,7 @@ import {
   postVerdict,
   resolveRepoTarget,
   selectChecks
-} from "../chunk-TFZMH2KF.js";
+} from "../chunk-TLGL2PTZ.js";
 
 // src/bin/pr-policy.ts
 import { readFile } from "fs/promises";

package/dist/{chunk-TFZMH2KF.js → chunk-TLGL2PTZ.js}

@@ -21,6 +21,7 @@ var BLOCKING_LABELS = [
   BLOCKED_LABEL,
   ESCALATION_NEEDED_LABEL
 ];
+var EPIC_LABEL = "epic";
 var BREAKING_CHANGE_LABEL = "breaking change";
 var HOTFIX_LABEL = "hotfix";
 var RELEASE_PLEASE_PENDING_LABEL = "autorelease: pending";
@@ -1263,6 +1264,45 @@ var titleCheck = {
   evaluate: async (pr) => decideTitle(pr)
 };
 
+// src/checks/base-branch.ts
+var BASE_BRANCH_CHECK = "base-branch";
+var isEpic = (labels) => labels.some((label) => label.trim().toLowerCase() === EPIC_LABEL);
+function decideBaseBranch(pr) {
+  if (pr.base === void 0) return { findings: [] };
+  const { branch, defaultBranch, headOf } = pr.base;
+  if (branch === defaultBranch) return { findings: [] };
+  const target = `This PR targets \`${branch}\``;
+  const [parent] = headOf;
+  if (parent === void 0) {
+    return {
+      findings: [
+        {
+          check: BASE_BRANCH_CHECK,
+          message: `${target}, which is not the default branch and is not the head of an open PR. Retarget it to \`${defaultBranch}\`, or to an open epic PR's branch.`,
+          effect: "block"
+        }
+      ]
+    };
+  }
+  const epicParent = headOf.find((open) => isEpic(open.labels));
+  if (epicParent !== void 0 && !isEpic(pr.labels)) return { findings: [] };
+  const waitFor = epicParent ?? parent;
+  const reason = epicParent === void 0 ? `the branch of #${waitFor.number}, which is not an epic. Only an epic's branch accumulates other PRs` : `the branch of epic #${waitFor.number}. An epic merges into \`${defaultBranch}\` on its own, not into another epic`;
+  return {
+    findings: [
+      {
+        check: BASE_BRANCH_CHECK,
+        message: `${target}, ${reason}. It can merge once #${waitFor.number} merges and GitHub retargets this PR to its base.`,
+        effect: "hold"
+      }
+    ]
+  };
+}
+var baseBranchCheck = {
+  name: BASE_BRANCH_CHECK,
+  evaluate: async (pr) => decideBaseBranch(pr)
+};
+
 // src/checks/uat/index.ts
 var UAT_CHECK = "uat";
 var PASSING_LABELS = [UAT_PASSED_LABEL, LEGACY_UAT_PASSED_LABEL, NO_UAT_NEEDED_LABEL];
@@ -1302,6 +1342,7 @@ var uatCheck = {
 // src/checks/index.ts
 var CHECKS = [
   mergeBlockCheck,
+  baseBranchCheck,
   titleCheck,
   ciChangeCheck,
   uatCheck,
@@ -1403,12 +1444,42 @@ function parseAuthor(value) {
   }
   return { login, type };
 }
+function parseOpenPullRequest(value, index) {
+  const where = `facts.base.headOf[${index}]`;
+  if (typeof value !== "object" || value === null) throw new Error(`${where} must be an object`);
+  const { number, labels } = value;
+  if (typeof number !== "number") throw new Error(`${where}.number must be a number`);
+  if (!isStringArray(labels)) throw new Error(`${where}.labels must be a string array`);
+  return { number, labels };
+}
+function parseBase(value) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "object" || value === null) throw new Error("facts.base must be an object");
+  const { branch, defaultBranch, headOf } = value;
+  if (typeof branch !== "string" || typeof defaultBranch !== "string") {
+    throw new Error("facts.base.branch / defaultBranch must be strings");
+  }
+  if (headOf !== void 0 && !Array.isArray(headOf)) {
+    throw new Error("facts.base.headOf must be an array");
+  }
+  return { branch, defaultBranch, headOf: (headOf ?? []).map(parseOpenPullRequest) };
+}
 function parseFacts(raw) {
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     throw new Error("facts must be a JSON object");
   }
-  const { title, body, author, labels, changedFiles, workflowChanges, manifestChanges, signOffs } = parsed;
+  const {
+    title,
+    body,
+    author,
+    base,
+    labels,
+    changedFiles,
+    workflowChanges,
+    manifestChanges,
+    signOffs
+  } = parsed;
   if (typeof title !== "string") throw new Error("facts.title must be a string");
   if (!isOptionalString(body)) throw new Error("facts.body must be a string");
   if (!isStringArray(labels)) throw new Error("facts.labels must be a string array");
@@ -1422,8 +1493,10 @@ function parseFacts(raw) {
     signOffs: parseSignOffs(signOffs)
   };
   const parsedAuthor = parseAuthor(author);
+  const parsedBase = parseBase(base);
   if (body !== void 0) pr.body = body;
   if (parsedAuthor !== void 0) pr.author = parsedAuthor;
+  if (parsedBase !== void 0) pr.base = parsedBase;
   return pr;
 }
 
@@ -1730,6 +1803,29 @@ async function listFiles(target) {
   if (out === null) throw new Error(`could not list files of ${target.repo}#${target.pr}`);
   return out.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
 }
+async function gatherBase(target, view) {
+  const branch = view.base.ref;
+  const defaultBranch = view.base.repo.default_branch;
+  if (branch === defaultBranch) return { branch, defaultBranch, headOf: [] };
+  const head = encodeURIComponent(`${target.repo.split("/")[0] ?? ""}:${branch}`);
+  const out = await ghCall(
+    {
+      argv: [
+        "gh",
+        "api",
+        "--paginate",
+        `repos/${target.repo}/pulls?state=open&head=${head}&per_page=100`,
+        "--jq",
+        ".[] | {number, labels: [.labels[].name]}"
+      ]
+    },
+    null,
+    { cwd: target.cwd }
+  );
+  if (out === null) throw new Error(`could not list the open PRs heading ${branch}`);
+  const headOf = out.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
+  return { branch, defaultBranch, headOf };
+}
 async function gatherFacts(target) {
   const view = await ghJson(target, [
     "gh",
@@ -1763,6 +1859,7 @@ async function gatherFacts(target) {
     title: view.title,
     body: view.body ?? "",
     author: { login: view.user.login, type: view.user.type },
+    base: await gatherBase(target, view),
     labels,
     // A rename's old path counts too: moving code into docs/ is not docs-only.
     changedFiles: files.flatMap(

package/dist/index.d.ts

@@ -36,6 +36,23 @@ interface PullRequestAuthor {
     login: string;
     type: string;
 }
+/** An open PR, reduced to what the base-branch check reads. */
+interface OpenPullRequest {
+    number: number;
+    labels: readonly string[];
+}
+/** Where a PR merges: its base branch, and what that branch is. */
+interface PullRequestBase {
+    /** The branch the PR merges into. */
+    branch: string;
+    /** The repository's default branch. */
+    defaultBranch: string;
+    /**
+     * The open PRs whose head is `branch`. Empty for the default branch, which
+     * is never looked up.
+     */
+    headOf: readonly OpenPullRequest[];
+}
 /**
  * The facts about a pull request that policy checks judge. Every field is a
  * property of the PR's current state — its content and the labels on it, never
@@ -51,6 +68,8 @@ interface PullRequestFacts {
     body?: string;
     /** Who opened the PR. `gatherFacts` always sets it. */
     author?: PullRequestAuthor;
+    /** The branch the PR merges into. `gatherFacts` always sets it. */
+    base?: PullRequestBase;
     labels: readonly string[];
     /** Every path the PR touches, including the old path of a rename. */
     changedFiles: readonly string[];
@@ -360,7 +379,8 @@ declare function evaluatePolicy(pr: PullRequestFacts, checks?: readonly PolicyCh
 /**
  * Parse and validate a JSON facts document into `PullRequestFacts`.
  * `workflowChanges`, `manifestChanges`, and `signOffs` are optional and default
- * to none; `body` and `author` are optional and stay absent. With no `signOffs`, no sign-off label counts: trust fails closed.
+ * to none; `body`, `author`, and `base` are optional and stay absent. With no
+ * `signOffs`, no sign-off label counts: trust fails closed.
  */
 declare function parseFacts(raw: string): PullRequestFacts;
 

package/dist/index.js

@@ -48,7 +48,7 @@ import {
   sensitiveBumps,
   statusBody,
   titleCheck
-} from "./chunk-TFZMH2KF.js";
+} from "./chunk-TLGL2PTZ.js";
 export {
   AMBIGUOUS_INDICATORS,
   BLOCKED_LABEL,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rmartz/pr-policy",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Read-only PR content classifiers — CI-change classification, title-type rules, and more — reported as one blocking pr-policy check-run. Distributed as a pinned Action kept current by Dependabot.",
   "keywords": [
     "pr-policy",
@@ -47,24 +47,20 @@
     "format": "prettier --write .",
     "format:check": "prettier --check .",
     "test": "vitest run",
-    "test:watch": "vitest",
-    "verify:release-notes": "node scripts/verify-changelog-render.mjs"
+    "test:watch": "vitest"
   },
   "dependencies": {
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@semantic-release/release-notes-generator": "^14.1.1",
     "@types/node": "^26.6.2",
     "@typescript-eslint/eslint-plugin": "^8.70.0",
     "@typescript-eslint/parser": "^8.70.0",
     "@vitest/coverage-v8": "^5.0.1",
-    "conventional-changelog-conventionalcommits": "^9.3.1",
     "eslint": "^10.11.0",
     "eslint-import-resolver-typescript": "^4.4.5",
     "eslint-plugin-import": "^2.32.0",
     "prettier": "^3.9.8",
-    "semantic-release": "^25.0.9",
     "tsup": "^8.5.1",
     "typescript": "^6.0.3",
     "vite": "^8.3.0",