@rtorcato/repo-tooling 2.59.0

package/dist/languages/registry.js

@@ -0,0 +1,37 @@
+export const LANGUAGES = {
+    js: {
+        id: 'js',
+        label: 'JavaScript/TypeScript',
+        codeqlLanguages: ['javascript-typescript'],
+        dependabotEcosystem: 'npm',
+        supported: true,
+    },
+    swift: {
+        id: 'swift',
+        label: 'Swift',
+        codeqlLanguages: ['swift'],
+        dependabotEcosystem: 'swift',
+        supported: true,
+    },
+    python: {
+        id: 'python',
+        label: 'Python',
+        codeqlLanguages: ['python'],
+        dependabotEcosystem: 'pip',
+        supported: false,
+    },
+    perl: {
+        id: 'perl',
+        label: 'Perl',
+        codeqlLanguages: [],
+        dependabotEcosystem: null,
+        supported: false,
+    },
+};
+/**
+ * Resolve the module for a detected language. `unknown` (a bare dir mid-setup)
+ * maps to JS — the historical default so a fresh repo still gets the full suite.
+ */
+export function resolveLanguageModule(language) {
+    return language === 'unknown' ? LANGUAGES.js : LANGUAGES[language];
+}

package/dist/languages/swift/checks.js

@@ -0,0 +1,127 @@
+/**
+ * Swift language module — checks (#286).
+ *
+ * The standard encoded here is the one `swift-common` actually runs: SwiftLint
+ * (lint + `--fix` in pre-commit, `--strict` in CI) and Periphery for dead code.
+ * Deliberately *not* checked:
+ *
+ * - SwiftFormat — SwiftLint's `--fix` does the formatting; a second formatter
+ *   would fight it.
+ * - `.swift-version` — the toolchain is pinned in CI (`setup-xcode`) and the
+ *   package declares `// swift-tools-version:`, so a root file would be a third
+ *   place to keep in sync.
+ */
+import path from 'node:path';
+import fs from 'fs-extra';
+import { checkFile } from '../../base/checks.js';
+import { SWIFT_HOOKS_DIR } from './git-hooks.js';
+const SWIFT_FILE_CHECKS = [
+    {
+        check: 'SwiftLint',
+        candidates: ['.swiftlint.yml', '.swiftlint.yaml'],
+        // SwiftLint configs are project-owned — there's no `extends` mechanism to
+        // point at ours, so any file declaring real config counts as ok.
+        expected: 'is a valid SwiftLint configuration',
+        matcher: /^(disabled_rules|opt_in_rules|only_rules|included|excluded|analyzer_rules):/m,
+        hint: 'Run `npx @rtorcato/repo-tooling fix swiftlint` to scaffold',
+    },
+    {
+        check: 'Periphery',
+        candidates: ['.periphery.yml', '.periphery.yaml'],
+        expected: 'is a valid Periphery configuration',
+        matcher: /^(retain_public|project|schemes|targets|index_exclude):/m,
+        optional: true,
+        hint: 'Run `npx @rtorcato/repo-tooling fix periphery` to scaffold a dead-code scan config',
+    },
+];
+/**
+ * Build artefacts that must never be committed. `.build` and `DerivedData` are
+ * the expensive ones — a single stray commit of either adds hundreds of MB.
+ */
+const REQUIRED_GITIGNORE_ENTRIES = ['.build', 'DerivedData', 'xcuserdata'];
+export async function checkSwiftGitignore(dir) {
+    const filepath = path.join(dir, '.gitignore');
+    if (!(await fs.pathExists(filepath))) {
+        return {
+            check: 'Swift .gitignore',
+            status: 'missing',
+            detail: 'no .gitignore',
+            hint: 'Run `npx @rtorcato/repo-tooling fix swift-gitignore` to scaffold the Swift template',
+        };
+    }
+    const contents = await fs.readFile(filepath, 'utf-8');
+    const missing = REQUIRED_GITIGNORE_ENTRIES.filter((entry) => !contents.includes(entry));
+    if (missing.length > 0) {
+        return {
+            check: 'Swift .gitignore',
+            status: 'drift',
+            detail: `.gitignore missing Swift build artefacts: ${missing.join(', ')}`,
+            hint: 'Run `npx @rtorcato/repo-tooling fix swift-gitignore` to append the missing entries',
+        };
+    }
+    return {
+        check: 'Swift .gitignore',
+        status: 'ok',
+        detail: '.gitignore covers .build, DerivedData and xcuserdata',
+    };
+}
+/**
+ * Package.swift hygiene. Both signals are things SwiftPM will not infer for
+ * you: without a tools-version comment the manifest doesn't parse at all, and
+ * without `platforms:` SwiftPM assumes the oldest deployment target it supports,
+ * which silently rejects modern APIs at build time.
+ */
+export async function checkPackageSwift(dir) {
+    const filepath = path.join(dir, 'Package.swift');
+    if (!(await fs.pathExists(filepath))) {
+        return {
+            check: 'Package.swift',
+            status: 'missing',
+            detail: 'no Package.swift',
+            hint: 'Run `swift package init` to create a SwiftPM manifest',
+        };
+    }
+    const contents = await fs.readFile(filepath, 'utf-8');
+    const toolsVersion = contents.match(/^\/\/\s*swift-tools-version:\s*([\d.]+)/m)?.[1];
+    if (!toolsVersion) {
+        return {
+            check: 'Package.swift',
+            status: 'drift',
+            detail: 'Package.swift has no `// swift-tools-version:` comment',
+            hint: 'Add `// swift-tools-version: 5.9` as the first line — SwiftPM requires it',
+        };
+    }
+    if (!/\bplatforms:\s*\[/.test(contents)) {
+        return {
+            check: 'Package.swift',
+            status: 'drift',
+            detail: `Package.swift (tools ${toolsVersion}) declares no \`platforms:\``,
+            hint: 'Add a `platforms:` clause — without it SwiftPM assumes the oldest supported deployment target',
+        };
+    }
+    return {
+        check: 'Package.swift',
+        status: 'ok',
+        detail: `Package.swift declares tools ${toolsVersion} and explicit platforms`,
+    };
+}
+/**
+ * The Swift shape of the base `Git hooks` / `Pre-push hook` checks (#309).
+ * `install` is null because the wiring — `git config core.hooksPath` — is
+ * per-clone local state that nothing commits; flagging its absence would fail
+ * every fresh CI checkout for something that isn't repo drift.
+ */
+export const SWIFT_GIT_HOOKS = {
+    dir: SWIFT_HOOKS_DIR,
+    install: null,
+    verifyCommand: 'swift test',
+    fixTarget: 'swift-git-hooks',
+};
+/** The Swift module's suite, layered on top of the base checks by doctor. */
+export async function runSwiftChecks(dir) {
+    return [
+        await checkPackageSwift(dir),
+        ...(await Promise.all(SWIFT_FILE_CHECKS.map((spec) => checkFile(dir, spec)))),
+        await checkSwiftGitignore(dir),
+    ];
+}

package/dist/languages/swift/ci.js

@@ -0,0 +1,165 @@
+/**
+ * Swift CI generation (#287), built on the language-agnostic skeleton in
+ * `src/base/ci.ts`. No `setup-node`, no `pnpm` — the Swift path runs on macOS
+ * runners with Xcode, SwiftPM and Homebrew-installed tools.
+ *
+ * Unlike the JS path there's no `ProjectConfig` to read: everything the Swift
+ * workflow needs (products, deployment platforms) is declared in Package.swift,
+ * so the jobs are derived from the repo itself.
+ */
+import path from 'node:path';
+import fs from 'fs-extra';
+import { renderGitHubWorkflow, renderGitLabCI } from '../../base/ci.js';
+/** SwiftPM runs on macOS runners — Xcode isn't available anywhere else. */
+const MACOS = 'macos-latest';
+/**
+ * Pull the two facts CI needs out of a Package.swift. A regex rather than a
+ * SwiftPM invocation: `swift package dump-package` would need a Swift toolchain
+ * on the machine running `repo-tooling`, which is usually a Node environment.
+ */
+export function parsePackageSwift(contents) {
+    const products = [...contents.matchAll(/\.library\(\s*name:\s*"([^"]+)"/g)].map((m) => m[1]);
+    // Only the `platforms:` array declares deployment targets — matching
+    // `.iOS(` across the whole manifest would also catch `.iOS` in target
+    // conditionals.
+    const platformsClause = contents.match(/platforms:\s*\[([^\]]*)\]/s)?.[1] ?? '';
+    const platforms = [...platformsClause.matchAll(/\.(iOS|macOS|tvOS|watchOS|visionOS)\s*\(/g)].map((m) => m[1]);
+    return { products, platforms: [...new Set(platforms)] };
+}
+export async function readSwiftPackage(dir) {
+    const filepath = path.join(dir, 'Package.swift');
+    if (!(await fs.pathExists(filepath)))
+        return { products: [], platforms: [] };
+    return parsePackageSwift(await fs.readFile(filepath, 'utf-8'));
+}
+/** Checkout + pin Xcode. Every Swift job needs both before it can do anything. */
+const XCODE_SETUP = `      - name: 📦 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 🛠️  Select latest stable Xcode
+        uses: maxim-lobanov/setup-xcode@v1
+        with:
+          xcode-version: latest-stable`;
+/**
+ * SwiftPM's build products and the resolved-dependency clone are both expensive
+ * to rebuild; key on Package.resolved so the cache invalidates with the graph.
+ */
+const SPM_CACHE = `      - name: 📦 Cache SwiftPM
+        uses: actions/cache@v5
+        with:
+          path: |
+            .build
+            ~/Library/Caches/org.swift.swiftpm
+            ~/Library/Developer/Xcode/DerivedData
+          key: \${{ runner.os }}-spm-\${{ hashFiles('**/Package.resolved') }}
+          restore-keys: |
+            \${{ runner.os }}-spm-`;
+export function swiftGithubJobs(pkg) {
+    const jobs = [
+        {
+            id: 'build-test',
+            runsOn: MACOS,
+            steps: `${XCODE_SETUP}
+
+${SPM_CACHE}
+
+      - name: 🏗️  swift build
+        run: swift build
+
+      - name: 🧪 swift test
+        run: swift test`,
+        },
+        {
+            id: 'lint',
+            runsOn: MACOS,
+            steps: `      - name: 📦 Checkout repository
+        uses: actions/checkout@v7
+
+      - name: 📦 Install SwiftLint
+        run: brew install swiftlint
+
+      - name: 🔍 swiftlint --strict
+        run: swiftlint lint --strict --reporter github-actions-logging`,
+        },
+    ];
+    // Periphery is part of this module's standard (the `periphery` fixer ships
+    // its config alongside), so the job is unconditional. Gating it on
+    // .periphery.yml existing looked tidier but silently lost the job on a fresh
+    // repo: `fix` walks doctor's findings in order, and GitHub Actions comes
+    // before Periphery, so the CI file was written before the config existed.
+    jobs.push({
+        id: 'dead-code',
+        runsOn: MACOS,
+        // Informational: an established codebase almost always has unused
+        // declarations on day one, and a red X there trains people to ignore CI.
+        // Drop continue-on-error once the repo is clean.
+        extra: '    continue-on-error: true',
+        steps: `${XCODE_SETUP}
+
+      - name: 📦 Install Periphery
+        run: brew install periphery
+
+      - name: 🔍 periphery scan
+        run: periphery scan --strict --format github-actions`,
+    });
+    // xcodebuild per platform catches deployment-target breaks that `swift build`
+    // (host-platform only) never sees. Needs both a scheme and declared platforms.
+    const scheme = pkg.products[0];
+    if (scheme && pkg.platforms.length > 0) {
+        jobs.push({
+            id: 'platforms',
+            runsOn: MACOS,
+            extra: `    name: xcodebuild \${{ matrix.platform }}
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+${pkg.platforms.map((p) => `          - ${p}`).join('\n')}`,
+            steps: `${XCODE_SETUP}
+
+      - name: 📦 Cache DerivedData
+        uses: actions/cache@v5
+        with:
+          path: ~/Library/Developer/Xcode/DerivedData
+          key: \${{ runner.os }}-derived-\${{ matrix.platform }}-\${{ hashFiles('**/Package.resolved') }}
+          restore-keys: |
+            \${{ runner.os }}-derived-\${{ matrix.platform }}-
+
+      - name: 🏗️  Build for \${{ matrix.platform }}
+        run: |
+          set -o pipefail
+          xcodebuild \\
+            -scheme ${scheme} \\
+            -destination "generic/platform=\${{ matrix.platform }}" \\
+            -skipPackagePluginValidation \\
+            build | xcbeautify --renderer github-actions`,
+        });
+    }
+    return jobs;
+}
+export function renderSwiftWorkflow(pkg) {
+    return renderGitHubWorkflow(swiftGithubJobs(pkg));
+}
+/**
+ * GitLab runs Swift in the official Linux image. That rules out Xcode — so no
+ * platform matrix and no SwiftLint (a Homebrew/macOS tool in practice); the
+ * Linux-portable half of the pipeline is `swift build` + `swift test`.
+ */
+function swiftGitlabSpec() {
+    return {
+        image: 'swift:6.0',
+        preamble: `cache:
+  key:
+    files:
+      - Package.resolved
+  paths:
+    - .build`,
+        jobs: [
+            { id: 'build', stage: 'build', script: ['swift build'] },
+            { id: 'test', stage: 'test', script: ['swift test'] },
+        ],
+    };
+}
+export function renderSwiftGitLabCI() {
+    return renderGitLabCI(swiftGitlabSpec());
+}

package/dist/languages/swift/fixers.js

@@ -0,0 +1,102 @@
+/**
+ * Swift language module — fixers (#286). One per check in ./checks.ts.
+ */
+import path from 'node:path';
+import chalk from 'chalk';
+import fs from 'fs-extra';
+import { buildPresetConfig } from '../../cli/commands/setup-presets.js';
+import { copyPreset } from '../../cli/utils/copy-preset.js';
+import { LOCKFILE_NAME, writeLockfile } from '../../cli/utils/lockfile.js';
+import { readSwiftPackage, renderSwiftGitLabCI, renderSwiftWorkflow } from './ci.js';
+import { SWIFT_HOOKS_DIR, installSwiftGitHooks } from './git-hooks.js';
+import { ensureSwiftGitignore } from './gitignore.js';
+export const SWIFT_FIXERS = [
+    {
+        target: 'swiftlint',
+        description: 'Scaffold .swiftlint.yml (the SwiftLint config swift-common runs)',
+        appliesTo: ['SwiftLint'],
+        outputs: ['.swiftlint.yml'],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            const result = await copyPreset('swiftlint', targetDir);
+            return { filesWritten: [result.target] };
+        },
+    },
+    {
+        target: 'periphery',
+        description: 'Scaffold .periphery.yml (dead-code scan config, retains public API)',
+        appliesTo: ['Periphery'],
+        outputs: ['.periphery.yml'],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            const result = await copyPreset('periphery', targetDir);
+            return { filesWritten: [result.target] };
+        },
+    },
+    {
+        target: 'swift-gitignore',
+        description: 'Add the Swift/SwiftPM build artefacts (.build, DerivedData, xcuserdata) to .gitignore',
+        appliesTo: ['Swift .gitignore'],
+        // Appends what's missing; never clobbers a project's own entries.
+        riskLevel: 'safe-merge',
+        outputs: ['.gitignore'],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            return { filesWritten: await ensureSwiftGitignore(targetDir) };
+        },
+    },
+    {
+        target: 'swift-git-hooks',
+        description: `Scaffold ${SWIFT_HOOKS_DIR}/pre-commit + pre-push (SwiftLint, swift build/test) and point git at them via core.hooksPath`,
+        appliesTo: ['Git hooks', 'Pre-push hook'],
+        outputs: [`${SWIFT_HOOKS_DIR}/pre-commit`, `${SWIFT_HOOKS_DIR}/pre-push`],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            const { filesWritten, hooksPathSet } = await installSwiftGitHooks(targetDir);
+            console.log(hooksPathSet
+                ? chalk.dim(`   git config core.hooksPath ${SWIFT_HOOKS_DIR}`)
+                : chalk.yellow(`   run \`git config core.hooksPath ${SWIFT_HOOKS_DIR}\` once per clone — it's local git config, not a committed file`));
+            return { filesWritten };
+        },
+    },
+    {
+        target: 'swift-ci',
+        description: 'Scaffold .github/workflows/ci.yml for Swift (macOS runners: swift build/test, SwiftLint, xcodebuild per platform)',
+        appliesTo: ['GitHub Actions'],
+        outputs: ['.github/workflows/ci.yml'],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            const workflowsDir = path.join(targetDir, '.github', 'workflows');
+            await fs.ensureDir(workflowsDir);
+            const workflow = renderSwiftWorkflow(await readSwiftPackage(targetDir));
+            await fs.writeFile(path.join(workflowsDir, 'ci.yml'), workflow);
+            return { filesWritten: ['.github/workflows/ci.yml'] };
+        },
+    },
+    {
+        target: 'swift-gitlab-ci',
+        description: 'Scaffold .gitlab-ci.yml for Swift (swift build + test on the Linux Swift image)',
+        appliesTo: ['GitLab CI'],
+        outputs: ['.gitlab-ci.yml'],
+        canFixDrift: true,
+        async run({ targetDir }) {
+            await fs.writeFile(path.join(targetDir, '.gitlab-ci.yml'), renderSwiftGitLabCI());
+            return { filesWritten: ['.gitlab-ci.yml'] };
+        },
+    },
+    {
+        target: 'swift-lockfile',
+        description: `Scaffold ${LOCKFILE_NAME} recording the Swift tool choices`,
+        appliesTo: ['lockfile'],
+        outputs: [LOCKFILE_NAME],
+        riskLevel: 'safe-add',
+        canFixDrift: false,
+        async run({ targetDir }) {
+            // A Swift repo has no package.json to infer from, so record what `setup
+            // --preset swift-library` would have written — the same config, minus the
+            // scaffolding.
+            await writeLockfile(targetDir, buildPresetConfig('swift-library', path.basename(targetDir)));
+            return { filesWritten: [LOCKFILE_NAME] };
+        },
+    },
+];

package/dist/languages/swift/git-hooks.js

@@ -0,0 +1,63 @@
+/**
+ * Swift git hooks (#309). Husky is an npm package, so a SwiftPM repo can't use
+ * it without dragging node into a toolchain that otherwise has none. The
+ * node-free equivalent is a committed `.githooks/` directory that git is pointed
+ * at with `core.hooksPath`.
+ *
+ * The hooks run the tools directly rather than a `verify` indirection: SwiftPM
+ * has no scripts field, and inventing a Makefile target would be a third place
+ * to keep the CI commands in sync (they already live in .github/workflows/ci.yml
+ * and .swiftlint.yml).
+ */
+import { execFile } from 'node:child_process';
+import path from 'node:path';
+import fs from 'fs-extra';
+export const SWIFT_HOOKS_DIR = '.githooks';
+// SwiftLint's --fix is the formatter (see ./checks.ts), so pre-commit formats
+// then lints. --quiet keeps a clean commit from printing a wall of nothing.
+export const SWIFT_PRE_COMMIT = `#!/bin/sh
+set -e
+swiftlint --fix --quiet
+swiftlint lint --quiet
+`;
+export const SWIFT_PRE_PUSH = `#!/bin/sh
+set -e
+echo "🔍 Running pre-push verify..."
+swift build
+swift test
+swiftlint lint --strict
+echo "✅ Verify passed — pushing."
+`;
+/** Best-effort `git config` — a missing git or a non-repo dir is not a failure. */
+function gitConfig(cwd, key, value) {
+    return new Promise((resolve) => {
+        execFile('git', ['-C', cwd, 'config', key, value], (err) => resolve(!err));
+    });
+}
+/**
+ * Writes both hooks and points git at them. Returns the files written —
+ * `core.hooksPath` is per-clone local config, not a file, so it's reported
+ * separately rather than pretending to be a repo change.
+ */
+export async function installSwiftGitHooks(targetDir) {
+    const hooksDir = path.join(targetDir, SWIFT_HOOKS_DIR);
+    await fs.ensureDir(hooksDir);
+    const filesWritten = [];
+    for (const [name, content] of [
+        ['pre-commit', SWIFT_PRE_COMMIT],
+        ['pre-push', SWIFT_PRE_PUSH],
+    ]) {
+        const hookPath = path.join(hooksDir, name);
+        await fs.writeFile(hookPath, content);
+        await fs.chmod(hookPath, 0o755);
+        filesWritten.push(`${SWIFT_HOOKS_DIR}/${name}`);
+    }
+    // Guard on .git: `fix --diff` shadow-runs fixers in a temp copy that excludes
+    // .git, and that copy can land inside another repo — an unguarded `git config`
+    // there would rewrite the *parent* repo's hooksPath during a mere preview.
+    const isRepo = await fs.pathExists(path.join(targetDir, '.git'));
+    const hooksPathSet = isRepo
+        ? await gitConfig(targetDir, 'core.hooksPath', SWIFT_HOOKS_DIR)
+        : false;
+    return { filesWritten, hooksPathSet };
+}

package/dist/languages/swift/gitignore.js

@@ -0,0 +1,43 @@
+/**
+ * The Swift .gitignore block, shared by the `swift-gitignore` fixer and the
+ * scaffolder. Its own module so `scaffold.ts` doesn't have to import from
+ * `fixers.ts` — that edge closed an import cycle once `fixers.ts` started
+ * reading the lockfile (lockfile → setup-presets → scaffold → fixers → lockfile).
+ */
+import path from 'node:path';
+import fs from 'fs-extra';
+/**
+ * The Swift build artefacts that must stay out of git. Appended to an existing
+ * .gitignore rather than replacing it — a Swift repo's ignore file usually
+ * carries project-specific entries worth keeping.
+ */
+const SWIFT_GITIGNORE_BLOCK = `# Swift / SwiftPM
+.DS_Store
+/.build
+/Packages
+/*.xcodeproj
+xcuserdata/
+DerivedData/
+.swiftpm/config/registries.json
+.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
+.netrc
+`;
+/** Entries whose presence means the block (or an equivalent) is already there. */
+const SENTINELS = ['.build', 'DerivedData', 'xcuserdata'];
+export async function ensureSwiftGitignore(targetDir) {
+    const filepath = path.join(targetDir, '.gitignore');
+    if (!(await fs.pathExists(filepath))) {
+        await fs.writeFile(filepath, SWIFT_GITIGNORE_BLOCK);
+        return ['.gitignore'];
+    }
+    const existing = await fs.readFile(filepath, 'utf-8');
+    const missing = SENTINELS.filter((entry) => !existing.includes(entry));
+    if (missing.length === 0)
+        return [];
+    // Append only what's absent, so a repo that already ignores .build doesn't
+    // get a duplicate entry for it.
+    const additions = SWIFT_GITIGNORE_BLOCK.split('\n').filter((line) => line.length > 0 && !existing.includes(line));
+    const separator = existing.endsWith('\n') ? '' : '\n';
+    await fs.writeFile(filepath, `${existing}${separator}\n${additions.join('\n')}\n`);
+    return ['.gitignore'];
+}