@rtorcato/repo-tooling 3.38.1 → 3.38.2

package/dist/base/checks.js

@@ -3,7 +3,7 @@ import fs from 'fs-extra';
 import { BLOCK_START, hasStaleAgentBlock } from '../cli/generators/agent-rules.js';
 import { BADGE_START, hasPublicOnlyBadges } from '../cli/generators/badges.js';
 import { claudeSkillStatus, SHIPPED_SKILLS, skillDiffCommand, } from '../cli/generators/claude-skills.js';
-import { DEPENDABOT_CONFIG_PATHS, dependabotIgnoreRules } from '../cli/generators/security.js';
+import { DEPENDABOT_CONFIG_PATHS, dependabotConfigDeltas, dependabotEcosystemFor, dependabotIgnoreRules, } from '../cli/generators/security.js';
 import { detectNestedLanguages } from '../cli/utils/detect-language.js';
 /**
  * Root-only detection is the decision (#317), not an oversight — but it used to
@@ -244,12 +244,7 @@ export async function checkDependabot(dir) {
             // depends on it. Flag any config that predates it so `fix dependabot` can
             // bring the pair up to standard.
             const content = await fs.readFile(candidatePath, 'utf8');
-            const deltas = [];
-            for (const group of ['production-minor', 'dev-minor', 'major-updates']) {
-                if (!new RegExp(`^\\s*${group}:`, 'm').test(content)) {
-                    deltas.push(`missing \`${group}\` group`);
-                }
-            }
+            const deltas = dependabotConfigDeltas(content, await dependabotEcosystemFor(dir));
             const automergePath = path.join(dir, '.github', 'workflows', 'dependabot-automerge.yml');
             if (await fs.pathExists(automergePath)) {
                 // Pre-#423 workflows gated on the semver type alone, so production

package/dist/base/fixers.js

@@ -14,6 +14,7 @@
 import os from 'node:os';
 import path from 'node:path';
 import chalk from 'chalk';
+import fs from 'fs-extra';
 import inquirer from 'inquirer';
 import { installAgentRules, installAiSetup } from '../cli/generators/agent-rules.js';
 import { installClaudeSkill, resolveSkillsDir, SHIPPED_SKILLS, skillDiffCommand, } from '../cli/generators/claude-skills.js';
@@ -21,10 +22,10 @@ import { generateBrand } from '../cli/generators/brand.js';
 import { generateCommunityHealth } from '../cli/generators/community-health.js';
 import { generateCommitlintConfig } from '../cli/generators/git.js';
 import { generateCodeowners, generateEditorConfig } from '../cli/generators/misc.js';
-import { findDependabotIgnoreRules, generateCodeQLWorkflow, generateDependabotConfig, generateRenovateConfig, } from '../cli/generators/security.js';
+import { DEPENDABOT_AUTOMERGE_WORKFLOW, dependabotConfigDeltas, dependabotEcosystemFor, findDependabotIgnoreRules, generateCodeQLWorkflow, generateDependabotConfig, generateRenovateConfig, readDependabotConfig, } from '../cli/generators/security.js';
 import { classifyCopiedAssets } from '../cli/utils/copied-assets.js';
 import { copyPreset } from '../cli/utils/copy-preset.js';
-import { detectLanguage } from '../cli/utils/detect-language.js';
+import { detectAuditLanguage } from '../cli/utils/detect-language.js';
 import { resolveLanguageModule } from '../languages/registry.js';
 import { applyGithubSettings, applyReleaseEnvironment, RELEASE_ENV_CHECK, RELEASE_GATE_CHECK, } from './github-settings.js';
 import { applyLoopLabels } from './labels.js';
@@ -46,9 +47,16 @@ export class FixerAbort extends Error {
         this.name = 'FixerAbort';
     }
 }
-/** The repo's language module, resolved from its marker files. */
+/**
+ * The repo's language module, resolved from its marker files. No marker → no
+ * manifest ecosystem and no CodeQL matrix, rather than npm/JS guessed (#632).
+ */
 async function moduleFor(targetDir) {
-    return resolveLanguageModule(await detectLanguage(targetDir));
+    return (resolveLanguageModule(await detectAuditLanguage(targetDir)) ?? {
+        label: 'unrecognized-language',
+        codeqlLanguages: [],
+        dependabotEcosystem: null,
+    });
 }
 /**
  * Where to install user-global skills, asking only when nothing resolves. Under
@@ -149,6 +157,15 @@ export const BASE_FIXERS = [
         outputs: ['.github/dependabot.yml', '.github/workflows/dependabot-automerge.yml'],
         canFixDrift: true,
         async run({ targetDir }) {
+            const ecosystem = await dependabotEcosystemFor(targetDir);
+            // The config is already canonical for this repo's ecosystem, so only the
+            // workflow half drifts. Leave the config — and its repo-authored comments
+            // — alone rather than regenerate a file with nothing to change (#631).
+            const existing = await readDependabotConfig(targetDir);
+            if (existing && dependabotConfigDeltas(existing.content, ecosystem).length === 0) {
+                await fs.outputFile(path.join(targetDir, '.github', 'workflows', 'dependabot-automerge.yml'), DEPENDABOT_AUTOMERGE_WORKFLOW);
+                return { filesWritten: ['.github/workflows/dependabot-automerge.yml'] };
+            }
             // The template owns the whole file but emits no `ignore:` block, so
             // regenerating deletes any repo-local ignore rule — silently, and with
             // nothing in `doctor` to report the loss afterwards, because from the
@@ -159,8 +176,7 @@ export const BASE_FIXERS = [
             if (ignored) {
                 throw new FixerAbort('dependabot-ignore-rules', `refusing to overwrite ${ignored.file} — it has ${ignored.rules.length} \`ignore:\` rule(s) the canonical config does not reproduce: ${ignored.rules.join(', ')}`, `re-add the \`ignore:\` block after regenerating, or delete it from ${ignored.file} to accept the loss — then re-run \`fix dependabot\``);
             }
-            const { dependabotEcosystem } = await moduleFor(targetDir);
-            return { filesWritten: await generateDependabotConfig(targetDir, dependabotEcosystem) };
+            return { filesWritten: await generateDependabotConfig(targetDir, ecosystem) };
         },
     },
     {

package/dist/cli/commands/doctor.js

@@ -11,7 +11,7 @@ import { readPyproject, renderPythonWorkflow } from '../../languages/python/ci.j
 import { resolveLanguageModule } from '../../languages/registry.js';
 import { SWIFT_GIT_HOOKS, runSwiftChecks } from '../../languages/swift/checks.js';
 import { readSwiftPackage, renderSwiftWorkflow } from '../../languages/swift/ci.js';
-import { detectLanguage } from '../utils/detect-language.js';
+import { detectAuditLanguage } from '../utils/detect-language.js';
 import { checkAgentUser } from '../../base/agent-user.js';
 import { checkGitHubSettings } from '../../base/github-settings.js';
 import { checkLoopLabels } from '../../base/labels.js';
@@ -253,20 +253,21 @@ export async function runDoctor(dir, skillsDir) {
     const lock = await readLockfile(targetDir);
     // Per-module dispatch (#285): the base checks (repo hygiene, CI, security,
     // GitHub settings) apply to any repo and run for every language. A supported
-    // module layers its own checks on top. 'unknown' (bare dir mid-setup)
-    // resolves to JS so a fresh repo runs the full suite.
-    const language = await detectLanguage(targetDir);
+    // module layers its own checks on top. 'unknown' (no marker) gets the base
+    // suite only — JS checks against a C++ or Go repo are all noise (#632).
+    const language = await detectAuditLanguage(targetDir);
     const languageModule = resolveLanguageModule(language);
-    // Every language in the registry has a module as of #289, so nothing reaches
-    // this today. It stays as the on-ramp: a language is added to the registry
-    // with `supported: false` first, and until its module lands its repos get the
+    // Also the on-ramp for a new language: it is added to the registry with
+    // `supported: false` first, and until its module lands its repos get the
     // full base suite rather than the wholesale skip this replaced.
-    if (!languageModule.supported) {
+    if (!languageModule?.supported) {
         const results = [
             {
                 check: 'language',
                 status: 'ok',
-                detail: `detected ${languageModule.label} — running language-agnostic checks; ${languageModule.label}-specific checks land with its module (#139)`,
+                detail: languageModule
+                    ? `detected ${languageModule.label} — running language-agnostic checks; ${languageModule.label}-specific checks land with its module (#139)`
+                    : 'no language marker (package.json, Package.swift, pyproject.toml, cpanfile, …) — running language-agnostic checks only',
             },
             // hooks: null — guessing a hook convention would nag every repo with a
             // fix target that doesn't exist.
@@ -275,7 +276,7 @@ export async function runDoctor(dir, skillsDir) {
                 badges: { audience: 'public', fixTarget: null },
                 presetWorkflow: null,
                 language,
-                codeqlLanguages: languageModule.codeqlLanguages,
+                codeqlLanguages: languageModule?.codeqlLanguages ?? [],
                 skillsDir,
             })),
         ];
@@ -525,7 +526,7 @@ export async function doctorCommand(options = {}) {
         const summary = summarize(results);
         console.log();
         console.log(`  Summary: ${chalk.green(`${summary.ok} ok`)}, ${chalk.yellow(`${summary.drift} drift`)}, ${chalk.red(`${summary.missing} missing`)}, ${chalk.gray(`${summary.optionalMissing} not configured`)}, ${chalk.blue(`${summary.declared} declared`)}\n`);
-        const suggestions = nextStepSuggestions(results, await detectLanguage(dir));
+        const suggestions = nextStepSuggestions(results, await detectAuditLanguage(dir));
         if (suggestions.length > 0) {
             console.log(chalk.bold('  Next steps:'));
             for (const s of suggestions) {

package/dist/cli/commands/fix.js

@@ -14,20 +14,21 @@ import { FIXERS, readPackageJson } from '../../languages/js/fixers.js';
 import { PERL_FIXERS } from '../../languages/perl/fixers.js';
 import { PYTHON_FIXERS } from '../../languages/python/fixers.js';
 import { SWIFT_FIXERS } from '../../languages/swift/fixers.js';
-import { detectLanguage } from '../utils/detect-language.js';
+import { detectAuditLanguage } from '../utils/detect-language.js';
 /** The module-specific fixer set per detected language (#286, #289, #290, #303). */
 const LANGUAGE_FIXERS = {
+    js: FIXERS,
     swift: SWIFT_FIXERS,
     python: PYTHON_FIXERS,
     perl: PERL_FIXERS,
 };
 /**
  * The fixers that apply to a repo, by detected language: the language-agnostic
- * base set plus the module's own. Anything without a module of its own
- * (including a bare dir mid-setup) gets JS, the historical default.
+ * base set plus the module's own. A repo with no marker gets the base set only —
+ * the JS fixers would run against a missing package.json (#632).
  */
 function fixersForLanguage(language) {
-    return [...BASE_FIXERS, ...(LANGUAGE_FIXERS[language] ?? FIXERS)];
+    return [...BASE_FIXERS, ...(LANGUAGE_FIXERS[language] ?? [])];
 }
 /** Every fixer across every language — for `--list` and the unknown-target hint. */
 const ALL_FIXERS = [
@@ -133,8 +134,16 @@ async function previewFixer(fixer, result, targetDir, pkg, lock) {
             },
         });
         // assumeYes: a preview must never prompt.
+        let written;
         try {
-            await fixer.run({ targetDir: tmpDir, pkg, result, lock, assumeYes: true });
+            ;
+            ({ filesWritten: written } = await fixer.run({
+                targetDir: tmpDir,
+                pkg,
+                result,
+                lock,
+                assumeYes: true,
+            }));
         }
         catch (err) {
             // A fixer that refuses has nothing to preview. Swallow it here rather than
@@ -146,14 +155,21 @@ async function previewFixer(fixer, result, targetDir, pkg, lock) {
         }
         const previews = [];
         const seen = new Set();
-        for (const output of fixer.outputs) {
+        // Declared outputs miss globbed writes (apps/docs/**), so also take what the
+        // shadow run reported writing.
+        const candidates = [
+            ...fixer.outputs,
+            ...written.map((f) => (path.isAbsolute(f) ? path.relative(tmpDir, f) : f)),
+        ];
+        for (const output of candidates) {
             const rel = outputToRelativePath(output);
-            if (seen.has(rel))
+            if (seen.has(rel) || rel.startsWith('..'))
                 continue;
             seen.add(rel);
             const tmpPath = path.join(tmpDir, rel);
             const realPath = path.join(targetDir, rel);
-            if (!(await fs.pathExists(tmpPath)))
+            const stat = await fs.stat(tmpPath).catch(() => null);
+            if (!stat?.isFile())
                 continue;
             const newContent = await fs.readFile(tmpPath, 'utf-8');
             const existed = await fs.pathExists(realPath);
@@ -197,12 +213,34 @@ function printPreviews(previews) {
         }
     }
 }
+/**
+ * What a fixer would actually change. Shadow-runs it like `--diff` does, except
+ * for safe-add fixers: some of those write remote state or the home dir, so they
+ * are never executed — and since they only create missing files, the declared
+ * outputs that already exist are dropped instead.
+ */
+async function dryRunFiles(fixer, result, targetDir, pkg, lock) {
+    if ((fixer.riskLevel ?? 'destructive') === 'safe-add') {
+        const missing = [];
+        for (const out of fixer.outputs) {
+            if (!(await fs.pathExists(path.join(targetDir, outputToRelativePath(out))))) {
+                missing.push(out);
+            }
+        }
+        return missing;
+    }
+    const previews = await previewFixer(fixer, result, targetDir, pkg, lock);
+    return previews.filter((p) => p.kind !== 'unchanged').map((p) => p.path);
+}
 async function applyFixer(fixer, result, targetDir, pkg, lock, dryRun, silent, opts) {
     if (dryRun) {
+        const files = await dryRunFiles(fixer, result, targetDir, pkg, lock);
         if (!silent) {
-            console.log(chalk.cyan(`  [dry-run] would write: ${fixer.outputs.join(', ')}`));
+            console.log(chalk.cyan(files.length > 0
+                ? `  [dry-run] would write: ${files.join(', ')}`
+                : '  [dry-run] nothing to write'));
         }
-        return { filesWritten: [], dryRun: true };
+        return { filesWritten: files, dryRun: true };
     }
     const { filesWritten } = await fixer.run({ targetDir, pkg, result, lock, ...opts });
     if (!silent && filesWritten.length > 0) {
@@ -332,7 +370,7 @@ export async function fixCommand(target, options = {}) {
     }
     const pkg = await readPackageJson(targetDir);
     const lock = await readLockfile(targetDir);
-    const fixers = fixersForLanguage(await detectLanguage(targetDir));
+    const fixers = fixersForLanguage(await detectAuditLanguage(targetDir));
     // Same --skills-dir the claude-skills fixer writes to, so the diagnosis fix
     // acts on and the install it performs agree on one directory (#485).
     const results = await runDoctor(targetDir, options.skillsDir);

package/dist/cli/generators/git.js

@@ -1,5 +1,6 @@
 import fs from 'fs-extra';
 import path from 'node:path';
+import { hookHasUncommented } from '../../base/checks.js';
 export const PRE_PUSH_HOOK_CONTENT = `echo "🔍 Running pre-push verify..."
 pnpm verify
 STATUS=$?
@@ -25,10 +26,7 @@ export async function generateHuskyConfig(config, targetDir) {
     // Pre-commit hook. husky v10 format: just the command — the v9 shebang +
     // `. "$(dirname ...)/_/husky.sh"` bootstrap is deprecated (warns on every
     // hook run in v9, fails outright in v10).
-    const preCommitPath = path.join(huskyDir, 'pre-commit');
-    const preCommitContent = 'npx lint-staged\n';
-    await fs.writeFile(preCommitPath, preCommitContent);
-    await fs.chmod(preCommitPath, 0o755);
+    await ensureHookRuns(path.join(huskyDir, 'pre-commit'), /\blint-staged\b/, 'npx lint-staged\n');
     // Pre-push hook — only when the package.json already has a `verify` script.
     // In the setup flow, generatePackageJson runs before this and writes verify
     // when 2+ tools are enabled. In the `fix husky` path, a pre-existing verify
@@ -63,9 +61,24 @@ export async function generateHuskyConfig(config, targetDir) {
 export async function generatePrePushHook(targetDir) {
     const huskyDir = path.join(targetDir, '.husky');
     await fs.ensureDir(huskyDir);
-    const prePushPath = path.join(huskyDir, 'pre-push');
-    await fs.writeFile(prePushPath, PRE_PUSH_HOOK_CONTENT);
-    await fs.chmod(prePushPath, 0o755);
+    await ensureHookRuns(path.join(huskyDir, 'pre-push'), /\bpnpm\s+verify\b/, PRE_PUSH_HOOK_CONTENT, 'pnpm verify\n');
+}
+/**
+ * Write a missing hook; append the command to an existing hook that lacks it.
+ * Never replaces a hand-written hook (#629). Husky runs hooks with `sh -e`, so
+ * an appended command still fails the hook when it fails.
+ */
+async function ensureHookRuns(hookPath, runs, fresh, line = fresh) {
+    if (!(await fs.pathExists(hookPath))) {
+        await fs.writeFile(hookPath, fresh);
+    }
+    else {
+        const existing = await fs.readFile(hookPath, 'utf-8');
+        if (hookHasUncommented(existing, runs))
+            return;
+        await fs.writeFile(hookPath, `${existing.replace(/\n*$/, '\n')}${line}`);
+    }
+    await fs.chmod(hookPath, 0o755);
 }
 /** Package versions the commit-msg hook needs on disk to run at all. */
 export const COMMITLINT_DEPS = {

package/dist/cli/generators/security.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import fs from 'fs-extra';
 import { renderCodeQLWorkflow } from '../../base/ci.js';
 import { LANGUAGES } from '../../languages/registry.js';
+import { detectLanguage } from '../utils/detect-language.js';
 /**
  * The canonical dependency-update standard shared by every @rtorcato repo.
  *
@@ -73,6 +74,37 @@ export const DEPENDABOT_CONFIG_PATHS = [
     '.github/dependabot.yml',
     '.github/dependabot.yaml',
 ];
+/**
+ * The manifest ecosystem a repo's dependabot.yml should cover, or null when it
+ * has none — Perl, or a repo with no recognised manifest at all (#631). Unlike
+ * `resolveLanguageModule`, `unknown` does not fall back to npm here: a C++ repo
+ * with no package.json has nothing for an npm block to update.
+ */
+export async function dependabotEcosystemFor(dir) {
+    const language = await detectLanguage(dir);
+    return language === 'unknown' ? null : LANGUAGES[language].dependabotEcosystem;
+}
+/**
+ * How an existing dependabot.yml falls short of `dependabotConfig(ecosystem)`.
+ * The canonical groups live on the manifest block, so a repo with no manifest
+ * ecosystem is not expected to carry them (#631).
+ */
+export function dependabotConfigDeltas(content, ecosystem) {
+    if (ecosystem === null)
+        return [];
+    return ['production-minor', 'dev-minor', 'major-updates']
+        .filter((group) => !new RegExp(`^\\s*${group}:`, 'm').test(content))
+        .map((group) => `missing \`${group}\` group`);
+}
+/** The existing dependabot config, in Dependabot's resolution order, or null. */
+export async function readDependabotConfig(dir) {
+    for (const file of DEPENDABOT_CONFIG_PATHS) {
+        const candidate = path.join(dir, file);
+        if (await fs.pathExists(candidate))
+            return { file, content: await fs.readFile(candidate, 'utf8') };
+    }
+    return null;
+}
 /**
  * The `ignore:` rules an existing dependabot.yml carries, named by
  * `dependency-name` (#422).
@@ -236,14 +268,11 @@ export const DEPENDABOT_FILES = [
  * they live in — or null when there is nothing to lose (#422).
  */
 export async function findDependabotIgnoreRules(targetDir) {
-    for (const file of DEPENDABOT_CONFIG_PATHS) {
-        const candidate = path.join(targetDir, file);
-        if (!(await fs.pathExists(candidate)))
-            continue;
-        const rules = dependabotIgnoreRules(await fs.readFile(candidate, 'utf8'));
-        return rules.length > 0 ? { file, rules } : null;
-    }
-    return null;
+    const existing = await readDependabotConfig(targetDir);
+    if (!existing)
+        return null;
+    const rules = dependabotIgnoreRules(existing.content);
+    return rules.length > 0 ? { file: existing.file, rules } : null;
 }
 /**
  * Scaffold the canonical Dependabot setup: the grouped \`dependabot.yml\` **and**

package/dist/cli/generators/typedoc.js

@@ -32,9 +32,12 @@ export async function generateTypedocConfig(pkg, targetDir) {
     };
     await fs.writeJson(path.join(targetDir, 'typedoc.json'), config, { spaces: 2 });
 }
+/** The path written, or null when a docs.yml already exists — never replaced (#629). */
 export async function generateTypedocWorkflow(targetDir) {
-    const workflowsDir = path.join(targetDir, '.github', 'workflows');
-    await fs.ensureDir(workflowsDir);
-    await fs.writeFile(path.join(workflowsDir, 'docs.yml'), DOCS_WORKFLOW);
-    return '.github/workflows/docs.yml';
+    const rel = '.github/workflows/docs.yml';
+    const workflowPath = path.join(targetDir, rel);
+    if (await fs.pathExists(workflowPath))
+        return null;
+    await fs.outputFile(workflowPath, DOCS_WORKFLOW);
+    return rel;
 }

package/dist/cli/utils/detect-language.js

@@ -32,6 +32,20 @@ export async function detectLanguage(dir) {
     }
     return 'unknown';
 }
+/**
+ * The language doctor/fix audit a repo as. Like `detectLanguage`, except a fresh
+ * dir — nothing but dotfiles (`.git`, the lockfile) — is audited as JS, the
+ * default `setup` scaffolds, so its full suite shows what is still to come. A
+ * dir with real content and no marker (C++, Go, a README) stays 'unknown' and
+ * gets the base checks only (#632).
+ */
+export async function detectAuditLanguage(dir) {
+    const language = await detectLanguage(dir);
+    if (language !== 'unknown')
+        return language;
+    const entries = await fs.readdir(dir).catch(() => []);
+    return entries.every((entry) => entry.startsWith('.')) ? 'js' : 'unknown';
+}
 /** Never worth descending into, and expensive when we do. */
 const SKIP_DIRS = new Set(['node_modules', 'dist', 'build', 'target', 'vendor', '.build']);
 /**

package/dist/languages/js/fixers.js

@@ -695,7 +695,7 @@ export const FIXERS = [
             await generateTypedocConfig(pkg, targetDir);
             const workflow = await generateTypedocWorkflow(targetDir);
             const pkgPath = path.join(targetDir, 'package.json');
-            const filesWritten = ['typedoc.json', workflow];
+            const filesWritten = workflow ? ['typedoc.json', workflow] : ['typedoc.json'];
             if (await fs.pathExists(pkgPath)) {
                 const pkgData = (await fs.readJson(pkgPath));
                 const scripts = pkgData.scripts ?? {};

package/dist/languages/registry.js

@@ -29,9 +29,11 @@ export const LANGUAGES = {
     },
 };
 /**
- * Resolve the module for a detected language. `unknown` (a bare dir mid-setup)
- * maps to JS — the historical default so a fresh repo still gets the full suite.
+ * Resolve the module for a detected language, or null for `unknown` — a repo
+ * with no marker (C++, Go, a README) gets the base suite only, never JS (#632).
+ * A fresh, empty dir never arrives as `unknown`: `detectAuditLanguage` audits
+ * it as JS, and setup's language picker defaults it to JS itself.
  */
 export function resolveLanguageModule(language) {
-    return language === 'unknown' ? LANGUAGES.js : LANGUAGES[language];
+    return language === 'unknown' ? null : LANGUAGES[language];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@rtorcato/repo-tooling",
-	"version": "3.38.1",
+	"version": "3.38.2",
 	"description": "One CLI to scaffold, audit and fix your repo's whole toolchain — linting, tests, commits, releases & CI.",
 	"type": "module",
 	"keywords": [