@rtorcato/repo-tooling 3.2.3 → 3.2.5

package/dist/base/github-settings.js

@@ -0,0 +1,461 @@
+import { spawn } from 'node:child_process';
+import path from 'node:path';
+import chalk from 'chalk';
+import fs from 'fs-extra';
+const GH_TIMEOUT_MS = 10_000;
+/**
+ * Real `gh` runner — never rejects; a missing/failing gh resolves ok:false.
+ * `cwd` scopes gh's repo resolution to the target dir so `-d/--directory` is
+ * honored (gh otherwise resolves the remote from process.cwd()). Not annotated
+ * `: GhExec` so the optional cwd stays callable; still assignable where GhExec
+ * is expected.
+ */
+export const realGhExec = (args, stdin, cwd) => new Promise((resolve) => {
+    let settled = false;
+    const done = (r) => {
+        if (settled)
+            return;
+        settled = true;
+        clearTimeout(timer);
+        resolve(r);
+    };
+    // gh args are internal/derived from gh itself (never user free-text), so
+    // shell:false + an args array keeps this injection-safe.
+    const child = spawn('gh', args, {
+        cwd,
+        stdio: [stdin === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    const timer = setTimeout(() => {
+        child.kill();
+        done({ ok: false, stdout: '', stderr: 'gh timed out', code: null });
+    }, GH_TIMEOUT_MS);
+    child.stdout?.on('data', (d) => {
+        stdout += d;
+    });
+    child.stderr?.on('data', (d) => {
+        stderr += d;
+    });
+    child.on('close', (code) => done({ ok: code === 0, stdout, stderr, code }));
+    child.on('error', (err) => done({ ok: false, stdout: '', stderr: String(err), code: null }));
+    if (stdin !== undefined && child.stdin) {
+        child.stdin.write(stdin);
+        child.stdin.end();
+    }
+});
+/** The standard doctor checks these settings against. */
+export const GITHUB_STANDARD = {
+    // Required status contexts on the default branch (strict off — see below).
+    requiredContexts: ['lint', 'typecheck', 'build', 'test'],
+};
+const CODE_SCANNING_CHECK = 'Code-scanning gate';
+const CHECK_NAMES = [
+    'Branch protection',
+    'Merge settings',
+    'Workflow permissions',
+    CODE_SCANNING_CHECK,
+];
+// Recommended CodeQL alert thresholds — GitHub's UI defaults. This is the
+// override surface: bump them here for a stricter/looser fleet-wide baseline.
+// ponytail: module constants, not per-repo config, until a repo actually needs to differ.
+const CODE_SCANNING_THRESHOLDS = {
+    security_alerts_threshold: 'high_or_higher',
+    alerts_threshold: 'errors',
+};
+const CODE_SCANNING_RULESET_NAME = 'code-scanning-main';
+/** The branch ruleset POSTed to require code-scanning results before merge (#269). */
+const CODE_SCANNING_RULESET_BODY = JSON.stringify({
+    name: CODE_SCANNING_RULESET_NAME,
+    target: 'branch',
+    enforcement: 'active',
+    // ~DEFAULT_BRANCH keeps this branch-name-agnostic across the fleet.
+    conditions: { ref_name: { include: ['~DEFAULT_BRANCH'], exclude: [] } },
+    rules: [
+        {
+            type: 'code_scanning',
+            parameters: {
+                code_scanning_tools: [{ tool: 'CodeQL', ...CODE_SCANNING_THRESHOLDS }],
+            },
+        },
+    ],
+});
+/** All three checks as an `ok` skip — keeps them out of next-steps and exit code. */
+function skipAll(reason) {
+    return CHECK_NAMES.map((check) => ({ check, status: 'ok', detail: `skipped — ${reason}` }));
+}
+function skip(check, reason) {
+    return { check, status: 'ok', detail: `skipped — ${reason}` };
+}
+/**
+ * One combined probe: proves gh is installed + authed + has a GitHub remote +
+ * online, and carries identity, default branch, and the merge settings. Reads
+ * the REST repo endpoint (gh resolves the `{owner}/{repo}` placeholder from the
+ * remote) rather than `gh repo view --json` because auto-merge (`allow_auto_merge`)
+ * is not a `gh repo view` field at all — requesting it fails the whole call.
+ */
+async function probeRepo(exec) {
+    const r = await exec(['api', 'repos/{owner}/{repo}']);
+    if (!r.ok)
+        return { skip: probeFailureReason(r) };
+    let d;
+    try {
+        d = JSON.parse(r.stdout);
+    }
+    catch {
+        return { skip: 'could not parse gh output' };
+    }
+    const nwo = typeof d.full_name === 'string' ? d.full_name : undefined;
+    if (!nwo)
+        return { skip: 'no GitHub remote' };
+    return {
+        info: {
+            nwo,
+            branch: typeof d.default_branch === 'string' ? d.default_branch : 'main',
+            autoMerge: d.allow_auto_merge === true,
+            squashMerge: d.allow_squash_merge === true,
+            deleteOnMerge: d.delete_branch_on_merge === true,
+            mergeVisible: ['allow_auto_merge', 'allow_squash_merge', 'delete_branch_on_merge'].every((k) => typeof d[k] === 'boolean'),
+        },
+    };
+}
+export async function checkGitHubSettings(dir, exec) {
+    // Cheap gate first: no .git → never spawn (keeps tmp-dir doctor runs offline).
+    if (!(await fs.pathExists(path.join(dir, '.git'))))
+        return skipAll('not a git repository');
+    // Bind gh's cwd to the target dir so its repo resolution honors `-d` (#218).
+    const gh = exec ?? ((args, stdin) => realGhExec(args, stdin, dir));
+    const probe = await probeRepo(gh);
+    if ('skip' in probe)
+        return skipAll(probe.skip);
+    const { info } = probe;
+    return [
+        await checkBranchProtection(gh, info.nwo, info.branch),
+        checkMergeSettings(info),
+        await checkWorkflowPermissions(gh, info.nwo),
+        await checkCodeScanningRuleset(gh, info.nwo, info.branch, dir),
+    ];
+}
+function probeFailureReason(probe) {
+    if (probe.code === null)
+        return 'gh not installed';
+    if (/not logged|gh auth login|authentication/i.test(probe.stderr))
+        return 'gh not authenticated';
+    return 'not a GitHub repo or gh unavailable';
+}
+async function checkBranchProtection(exec, nwo, branch) {
+    const check = 'Branch protection';
+    const r = await exec(['api', `repos/${nwo}/branches/${branch}/protection`]);
+    if (!r.ok) {
+        if (/404|not found/i.test(r.stderr)) {
+            return {
+                check,
+                status: 'optional-missing',
+                detail: `${branch} is unprotected`,
+                hint: `Protect ${branch}: require checks ${GITHUB_STANDARD.requiredContexts.join(', ')}, no force-push/deletions`,
+            };
+        }
+        if (/403|forbidden/i.test(r.stderr))
+            return skip(check, 'token lacks admin access');
+        return skip(check, 'could not read branch protection');
+    }
+    let p;
+    try {
+        p = JSON.parse(r.stdout);
+    }
+    catch {
+        return skip(check, 'could not parse protection response');
+    }
+    const deltas = [];
+    const contexts = p.required_status_checks?.contexts ?? [];
+    // A matrix job reports each leg as `test (node 22)`, `test (node 24)`, etc.
+    // Treat any `<ctx> (...)` variant as satisfying the bare `<ctx>` requirement,
+    // so matrix CIs aren't falsely flagged as missing the check.
+    const isSatisfied = (c) => contexts.some((ctx) => ctx === c || ctx.startsWith(`${c} (`));
+    const missing = GITHUB_STANDARD.requiredContexts.filter((c) => !isSatisfied(c));
+    if (missing.length)
+        deltas.push(`missing required checks: ${missing.join(', ')}`);
+    if (p.required_status_checks?.strict === true)
+        deltas.push('strict status checks on (should be off)');
+    // enforce_admins must stay off so the App/RELEASE_TOKEN can bypass protection
+    // to push semantic-release's version commit (see Release-token doctor check).
+    if (p.enforce_admins?.enabled === true)
+        deltas.push('enforce_admins on (blocks release bypass)');
+    if (p.allow_force_pushes?.enabled === true)
+        deltas.push('force pushes allowed');
+    if (p.allow_deletions?.enabled === true)
+        deltas.push('branch deletions allowed');
+    // Required human review deadlocks solo Dependabot auto-merge.
+    if (p.required_pull_request_reviews)
+        deltas.push('required PR reviews on (deadlocks auto-merge)');
+    if (deltas.length)
+        return {
+            check,
+            status: 'drift',
+            detail: deltas.join('; '),
+            hint: `Align ${branch} protection with the standard`,
+        };
+    return { check, status: 'ok', detail: `${branch} protected per standard` };
+}
+function checkMergeSettings(info) {
+    const check = 'Merge settings';
+    // The token can't see the merge-setting fields (no admin:read) — skip rather
+    // than misreport the absent booleans as "disabled" (a false-positive drift).
+    if (!info.mergeVisible)
+        return skip(check, 'token lacks admin:read for merge settings');
+    const deltas = [];
+    if (!info.autoMerge)
+        deltas.push('auto-merge disabled');
+    if (!info.squashMerge)
+        deltas.push('squash-merge disabled');
+    if (!info.deleteOnMerge)
+        deltas.push('delete-branch-on-merge disabled');
+    if (deltas.length)
+        return {
+            check,
+            status: 'drift',
+            detail: deltas.join('; '),
+            hint: 'Enable auto-merge, squash-merge, and delete-branch-on-merge in repo settings',
+        };
+    return { check, status: 'ok', detail: 'auto-merge, squash-merge, delete-on-merge all on' };
+}
+async function checkWorkflowPermissions(exec, nwo) {
+    const check = 'Workflow permissions';
+    const r = await exec(['api', `repos/${nwo}/actions/permissions/workflow`]);
+    if (!r.ok) {
+        if (/403|forbidden/i.test(r.stderr))
+            return skip(check, 'token lacks admin access');
+        return skip(check, 'could not read workflow permissions');
+    }
+    let p;
+    try {
+        p = JSON.parse(r.stdout);
+    }
+    catch {
+        return skip(check, 'could not parse permissions response');
+    }
+    const deltas = [];
+    if (p.default_workflow_permissions !== 'read')
+        deltas.push(`default permissions '${p.default_workflow_permissions}' (should be read)`);
+    if (p.can_approve_pull_request_reviews === true)
+        deltas.push('workflows can approve PRs (should be off)');
+    if (deltas.length)
+        return {
+            check,
+            status: 'drift',
+            detail: deltas.join('; '),
+            hint: 'Set default workflow permissions to read-only and disable workflow PR approvals',
+        };
+    return { check, status: 'ok', detail: 'read-only default, no workflow PR approvals' };
+}
+/**
+ * True when CodeQL/code-scanning is enabled for the repo. Covers both ways it
+ * ships: an advanced-setup workflow on disk (what `fix codeql` scaffolds) or
+ * GitHub's default setup (no file — ask the code-scanning API). Mirrors doctor's
+ * on-disk CodeQL check; kept inline to avoid a doctor↔settings import cycle.
+ */
+async function codeqlEnabled(gh, nwo, dir) {
+    const workflowsDir = path.join(dir, '.github', 'workflows');
+    if (await fs.pathExists(workflowsDir)) {
+        try {
+            for (const f of await fs.readdir(workflowsDir)) {
+                if (!/\.ya?ml$/.test(f))
+                    continue;
+                const content = await fs.readFile(path.join(workflowsDir, f), 'utf-8');
+                if (/github\/codeql-action/.test(content))
+                    return true;
+            }
+        }
+        catch {
+            // fall through to the API probe
+        }
+    }
+    // Default setup leaves no workflow file — the API is the only signal.
+    const r = await gh(['api', `repos/${nwo}/code-scanning/default-setup`]);
+    if (!r.ok)
+        return false;
+    try {
+        return JSON.parse(r.stdout).state === 'configured';
+    }
+    catch {
+        return false;
+    }
+}
+/** True when a ruleset's ref_name conditions cover the default branch. */
+function rulesetTargetsBranch(conditions, branch) {
+    const include = conditions?.ref_name?.include ?? [];
+    return include.some((ref) => ref === '~DEFAULT_BRANCH' || ref === '~ALL' || ref === `refs/heads/${branch}`);
+}
+/**
+ * Does an active branch ruleset enforce a code_scanning rule on the default
+ * branch? The list endpoint omits rules/conditions, so active branch rulesets
+ * are fetched by id to inspect them. 'skip' on any read failure (self-skips like
+ * the other checks).
+ */
+async function hasCodeScanningRuleset(gh, nwo, branch) {
+    const list = await gh(['api', `repos/${nwo}/rulesets`]);
+    if (!list.ok)
+        return 'skip';
+    let rulesets;
+    try {
+        rulesets = JSON.parse(list.stdout);
+    }
+    catch {
+        return 'skip';
+    }
+    if (!Array.isArray(rulesets))
+        return 'skip';
+    const active = rulesets.filter((r) => r.target === 'branch' && r.enforcement === 'active' && typeof r.id === 'number');
+    for (const rs of active) {
+        const detail = await gh(['api', `repos/${nwo}/rulesets/${rs.id}`]);
+        if (!detail.ok)
+            continue;
+        let full;
+        try {
+            full = JSON.parse(detail.stdout);
+        }
+        catch {
+            continue;
+        }
+        const enforcesCodeScanning = (full.rules ?? []).some((r) => r.type === 'code_scanning');
+        if (enforcesCodeScanning && rulesetTargetsBranch(full.conditions, branch))
+            return 'yes';
+    }
+    return 'no';
+}
+/**
+ * The #269 gap: CodeQL results are advisory by default — a High alert still
+ * merges unless a branch ruleset requires the code-scanning check. Only
+ * meaningful where CodeQL is actually on, so it no-ops otherwise.
+ */
+async function checkCodeScanningRuleset(gh, nwo, branch, dir) {
+    const check = CODE_SCANNING_CHECK;
+    if (!(await codeqlEnabled(gh, nwo, dir))) {
+        return { check, status: 'ok', detail: 'CodeQL not enabled — no code-scanning gate needed' };
+    }
+    const found = await hasCodeScanningRuleset(gh, nwo, branch);
+    if (found === 'skip')
+        return skip(check, 'could not read rulesets');
+    if (found === 'yes') {
+        return { check, status: 'ok', detail: `active ruleset requires code-scanning on ${branch}` };
+    }
+    return {
+        check,
+        status: 'drift',
+        detail: `CodeQL is on but no active ruleset requires code-scanning on ${branch} (High alerts stay advisory)`,
+        hint: 'Run `npx @rtorcato/repo-tooling fix github-settings` to add a code_scanning branch ruleset that blocks merge on High+ CodeQL alerts',
+    };
+}
+/** The branch-protection body PUT to the API — mirrors the doctor standard. */
+const PROTECTION_BODY = JSON.stringify({
+    required_status_checks: { strict: false, contexts: GITHUB_STANDARD.requiredContexts },
+    // enforce_admins off so the App/RELEASE_TOKEN can bypass to push release commits.
+    enforce_admins: false,
+    // Required human review would deadlock solo Dependabot auto-merge.
+    required_pull_request_reviews: null,
+    restrictions: null,
+    allow_force_pushes: false,
+    allow_deletions: false,
+});
+/** Pure: the exact `gh api` invocations for whatever deviates ([] when compliant). */
+export function buildGhApplyCommands(state) {
+    const commands = [];
+    if (state.merge)
+        commands.push({
+            label: 'merge settings (auto-merge, squash, delete-on-merge)',
+            args: [
+                'api',
+                '-X',
+                'PATCH',
+                `repos/${state.nwo}`,
+                '-F',
+                'allow_auto_merge=true',
+                '-F',
+                'allow_squash_merge=true',
+                '-F',
+                'delete_branch_on_merge=true',
+            ],
+        });
+    if (state.protection)
+        commands.push({
+            label: `branch protection on ${state.branch}`,
+            args: [
+                'api',
+                '-X',
+                'PUT',
+                `repos/${state.nwo}/branches/${state.branch}/protection`,
+                '--input',
+                '-',
+            ],
+            stdin: PROTECTION_BODY,
+        });
+    if (state.workflow)
+        commands.push({
+            label: 'workflow permissions (read-only)',
+            args: [
+                'api',
+                '-X',
+                'PUT',
+                `repos/${state.nwo}/actions/permissions/workflow`,
+                '-f',
+                'default_workflow_permissions=read',
+                '-F',
+                'can_approve_pull_request_reviews=false',
+            ],
+        });
+    return commands;
+}
+/**
+ * Re-reads GitHub state and applies only the deltas via `gh api` (idempotent —
+ * a compliant repo is a no-op). Returns human labels for what changed, or `[]`
+ * on skip (no gh/auth/remote, or already compliant), logging the reason. Mirrors
+ * the "no package.json found — skipping" fixer pattern. Read-only unless a delta
+ * exists, so re-runs (walk-all hits it up to 3×) are safe.
+ */
+export async function applyGithubSettings(dir, exec) {
+    if (!(await fs.pathExists(path.join(dir, '.git')))) {
+        console.log(chalk.gray('   skipped — not a git repository'));
+        return [];
+    }
+    // Bind gh's cwd to the target dir so its repo resolution honors `-d` (#218).
+    const gh = exec ?? ((args, stdin) => realGhExec(args, stdin, dir));
+    const probe = await probeRepo(gh);
+    if ('skip' in probe) {
+        console.log(chalk.gray(`   skipped — ${probe.skip}`));
+        return [];
+    }
+    const { info } = probe;
+    // Re-read via the same checks so the delta logic stays single-sourced. A 403
+    // (no admin) reports `ok` → treated as "nothing to apply", never a failed PUT.
+    const bp = await checkBranchProtection(gh, info.nwo, info.branch);
+    const wp = await checkWorkflowPermissions(gh, info.nwo);
+    const commands = buildGhApplyCommands({
+        nwo: info.nwo,
+        branch: info.branch,
+        merge: checkMergeSettings(info).status === 'drift',
+        protection: bp.status === 'optional-missing' || bp.status === 'drift',
+        workflow: wp.status === 'drift',
+    });
+    const applied = [];
+    for (const cmd of commands) {
+        const r = await gh(cmd.args, cmd.stdin);
+        if (r.ok)
+            applied.push(cmd.label);
+        else
+            console.log(chalk.yellow(`   could not apply ${cmd.label}: ${r.stderr.trim() || 'gh error'}`));
+    }
+    // Code-scanning ruleset (#269): POST only when CodeQL is on and no active gate
+    // covers the default branch — the check re-read keeps this idempotent.
+    const cs = await checkCodeScanningRuleset(gh, info.nwo, info.branch, dir);
+    if (cs.status === 'drift') {
+        const label = `code-scanning ruleset on ${info.branch}`;
+        const r = await gh(['api', '-X', 'POST', `repos/${info.nwo}/rulesets`, '--input', '-'], CODE_SCANNING_RULESET_BODY);
+        if (r.ok)
+            applied.push(label);
+        else
+            console.log(chalk.yellow(`   could not apply ${label}: ${r.stderr.trim() || 'gh error'}`));
+    }
+    if (applied.length === 0)
+        console.log(chalk.gray('   already configured — nothing to apply'));
+    return applied;
+}

package/dist/base/types.js

@@ -0,0 +1 @@
+export {};

package/dist/cli/generators/linting.js

@@ -40,7 +40,17 @@ export async function generateBiomeConfig(targetDir) {
 export async function generateESLintConfig(config, targetDir) {
     const eslintConfigPath = path.join(targetDir, 'eslint.config.mjs');
     const configType = config.linting.eslintConfig || 'base';
-    const eslintConfig = `import { default as config } from '@rtorcato/repo-tooling/eslint/${configType}'
+    // eslint/nextjs is a fragment: it registers the @next/next plugin and its
+    // rules but sets no parser, so on its own it can't even parse .tsx ("Parsing
+    // error: Unexpected token <"). It has to be layered onto the base config,
+    // which is what brings typescript-eslint.
+    const eslintConfig = configType === 'nextjs'
+        ? `import base from '@rtorcato/repo-tooling/eslint/base'
+import nextjs from '@rtorcato/repo-tooling/eslint/nextjs'
+
+export default [...base, ...nextjs]
+`
+        : `import { default as config } from '@rtorcato/repo-tooling/eslint/${configType}'
 
 export default config
 `;

package/dist/cli/generators/package-json.js

@@ -237,6 +237,24 @@ function getDependencies(config) {
     if (config.linting.tool === 'eslint' || config.linting.tool === 'both') {
         deps['eslint'] = '^9.0.0';
         deps['prettier'] = '^3.0.0';
+        // Everything tooling/eslint/base.mjs imports. All optional peers of
+        // repo-tooling, so pnpm skips them and `eslint .` dies on the config
+        // import — the scaffold shipped a lint script that could never run.
+        deps['@eslint/js'] = '^9.0.0';
+        deps['@typescript-eslint/eslint-plugin'] = '^8.0.0';
+        deps['typescript-eslint'] = '^8.0.0';
+        deps['eslint-plugin-import'] = '^2.0.0';
+        deps['eslint-plugin-jest'] = '^29.0.0';
+    }
+    // The shipped prettier preset lists this in `plugins`, and the nextjs eslint
+    // preset imports the Next plugin. Both are only *optional* peers of
+    // repo-tooling, so pnpm skips them and the scaffold's first format/lint dies
+    // with ERR_MODULE_NOT_FOUND.
+    if (config.formatting.tool === 'prettier') {
+        deps['@ianvs/prettier-plugin-sort-imports'] = '^4.7.0';
+    }
+    if (config.linting.eslintConfig === 'nextjs') {
+        deps['@next/eslint-plugin-next'] = '^16.2.11';
     }
     // Testing frameworks
     if (config.testing.framework === 'vitest') {
@@ -266,6 +284,10 @@ function getDependencies(config) {
     }
     else if (config.bundler === 'esbuild') {
         deps['esbuild'] = '^0.25.0';
+        // The generated build.mjs imports this directly. It's only an *optional*
+        // peer of repo-tooling, so pnpm won't pull it in — without it here every
+        // esbuild scaffold fails its first `pnpm build` with ERR_MODULE_NOT_FOUND.
+        deps['esbuild-node-externals'] = '^1.18.0';
     }
     else if (config.bundler === 'rollup') {
         deps['rollup'] = '^4.0.0';
@@ -278,6 +300,11 @@ function getDependencies(config) {
     }
     else if (config.bundler === 'vite') {
         deps['vite'] = '^6.0.0';
+        // generateViteConfig emits `import react from '@vitejs/plugin-react'` for
+        // react-app, so the plugin has to be installed or `vite build` can't even
+        // load the config. Keep this condition in step with that one.
+        if (config.projectType === 'react-app')
+            deps['@vitejs/plugin-react'] = '^5.0.0';
     }
     // Tailwind CSS v4 — CSS-first, wired via the PostCSS plugin.
     if (config.tailwind) {

package/dist/cli/generators/testing.js

@@ -16,10 +16,21 @@ export async function generateTestingConfigs(config, targetDir) {
 }
 export async function generateVitestConfig(config, targetDir) {
     const vitestConfigPath = path.join(targetDir, 'vitest.config.ts');
+    // Vite reads `jsx` from tsconfig, and the next preset sets it to "preserve" so
+    // Next's own compiler handles the transform. Vitest has no such compiler, so
+    // .tsx tests fail to parse ("Unexpected token <") unless we opt back in here.
+    // `oxc` (not `esbuild`) is the Vite 8 spelling — vitest ^4 resolves Vite 8,
+    // and Vite 8 silently ignores the old `esbuild` key.
+    const jsxOverride = config.projectType === 'nextjs-app'
+        ? `  // tsconfig sets jsx: "preserve" for Next's compiler; vitest needs a
+  // transform of its own or .tsx tests won't parse.
+  oxc: { jsx: { runtime: 'automatic' } },
+`
+        : '';
     const vitestConfig = `import { defineConfig } from 'vitest/config'
 
 export default defineConfig({
-  test: {
+${jsxOverride}  test: {
     globals: true,
     environment: '${config.testing.environment === 'browser' ? 'jsdom' : 'node'}',
     setupFiles: ['./vitest.setup.ts'],

package/dist/cli/generators/tsconfig.js

@@ -19,6 +19,12 @@ export async function generateTSConfig(config, targetDir) {
         tsconfig.compilerOptions.outDir = './dist';
         tsconfig.compilerOptions.rootDir = './src';
     }
+    // web-app is the only browser target that lands on the `base` preset, whose
+    // lib is ES2022 — so `document`/`window` don't typecheck. The react and next
+    // presets already add the DOM libs themselves.
+    if (config.projectType === 'web-app' && preset === 'base') {
+        tsconfig.compilerOptions.lib = ['ES2022', 'DOM', 'DOM.Iterable'];
+    }
     if (config.projectType === 'nextjs-app') {
         tsconfig.include = ['next-env.d.ts', 'src', 'app', 'pages', 'components', 'reset.d.ts'];
         tsconfig.exclude.push('.next');

package/dist/languages/js/ci.js

@@ -102,7 +102,7 @@ export function githubJobs(config) {
             ? `
 
       - name: 📊 Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: \${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false`

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.2.3",
+	"version": "3.2.5",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [
@@ -46,6 +46,7 @@
 	"files": [
 		"dist/cli/**/*.js",
 		"dist/languages/**/*.js",
+		"dist/base/**/*.js",
 		"tooling/commitlint/commitlint.mjs",
 		"tooling/commitlint/commitlint.d.mts",
 		"tooling/esbuild/index.mjs",

package/tooling/eslint/base.mjs

@@ -43,6 +43,14 @@ export default tseslint.config(
 		ignores: [
 			//
 			'**/*.config.js',
+			// Root-level TS config files are outside the tsconfig `include` of every
+			// app preset, and this config lints type-aware (parserOptions.project),
+			// so linting them fails with "file was not found in any of the provided
+			// project(s)". The .js forms were already ignored; these are the same
+			// thing (the scaffold emits vitest.config.ts / vitest.setup.ts).
+			'**/*.config.ts',
+			'**/*.config.mts',
+			'**/*.setup.ts',
 			'.turbo',
 			'dist',
 			'build',

package/tooling/github-actions/workflows/cloudflare-pages.yml

@@ -26,7 +26,7 @@ jobs:
           node-version-file: .nvmrc
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile

package/tooling/typescript/tsconfig.base.json

@@ -9,8 +9,12 @@
     // "moduleResolution": "node", // Prefer "bundler" if you're using Vite, esbuild, etc.
     // "target": "esnext", // 
     "lib": ["ES2022"], // Specify library files to be included in the compilation
-    "rootDir": "src",
-    "outDir": "dist",
+    // ${configDir} for the same reason as paths/tsBuildInfoFile below: a bare
+    // "src" resolves against THIS file, i.e. inside node_modules, so every
+    // consumer that didn't redeclare rootDir got TS6059 "not under rootDir" the
+    // moment a file outside the preset's own directory entered the program.
+    "rootDir": "${configDir}/src",
+    "outDir": "${configDir}/dist",
 
     
     // 🔍 JavaScript Support

package/tooling/typescript/tsconfig.next.json

@@ -2,12 +2,19 @@
   "extends": "./tsconfig.base.json",
   "compilerOptions": {
     "jsx": "preserve", // Let Next.js handle JSX transformation
+    // The base pins rootDir to src/, but `include` below spans app/, pages/ and
+    // components/ — all siblings of src/ — so tsc raised TS6059 on any Next repo
+    // using the app router. These presets are noEmit, so rootDir buys nothing
+    // here beyond that trap; widen it to the project root.
+    "rootDir": "${configDir}",
     "lib": ["DOM", "DOM.Iterable", "ESNext"], // Include DOM types for browser APIs
     "module": "esnext", // Next.js expects ESNext modules
     "moduleResolution": "bundler", // Modern module resolution for Next.js
     "allowJs": true, // Allow JavaScript files
     "esModuleInterop": true, // Interop for CommonJS/ESM
-    "types": ["react", "tailwindcss", "vitest"],
+    // No "tailwindcss" — see tsconfig.react.json; it broke TS2688 for every
+    // project without Tailwind installed.
+    "types": ["react", "vitest"],
     "plugins": [ { "name": "next" } ], // Next.js plugin for TypeScript
     // ${configDir} anchors paths to the consuming project (drops deprecated baseUrl)
     "paths": {